ML20211F423
| ML20211F423 | |
| Person / Time | |
|---|---|
| Site: | Oyster Creek |
| Issue date: | 09/25/1997 |
| From: | Roche M GENERAL PUBLIC UTILITIES CORP. |
| To: | NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| References | |
| 6730-97-2192, TAC-M94856, NUDOCS 9710010062 | |
| Download: ML20211F423 (25) | |
Text
_ - _ - _ _ _ _ - - - _ _ - _ _ _ _ _ _ _ _ - _ _ - _ - _ _
~.
e l
l l
GPU Nuclear,Inc, U $ Route #9 South NUCLEAM io*r$e$$',?u'!$ mas Tel 609 944000 September 25,1997 6730 97 2192 U.S. Nuclear Regulatory Commission Attn: Document Control Center Washington, DC 20555 Gentlemen:
Subject:
Request for Additional lnformation
- Regarding Emergency Diesel Generator Allowed Outage Extension Request Oyster Creek Nuclear Generating Station Docket No. 50 219 By letter dated January 7,1997, the NRC staff requested additional information to consider the review of Technical Specification Change Request (TSCR) 230. The Request for Additional Information (RAI) concerned the probabilistic safety assessment portion of the supportingjustification for the TSCR. In a Febmary 11,1997 conference call between the NRC staff and GPU Nuclear personnel, the RAI questions were discussed and clarified. Development of the responses to some of the RAI questions was more complex than originally anticipated, however, and GPU Nuclear periodically informed the NRC of the submittal status through the Oyster Creek Project Manager.
Attached is the GPU Nuclear response to the questions posed in the RAI, as clarified in the conference call. Should you require any additional infonnation regarding this submittal, please contact Dennis Kelly of our Licensing stafrat (609) 971-4246 Sincerely.
0 Michael B. Roche Vice President & Director
/
Oyster Creek
/
cc: Administrator, Regioni NRC Project Manager NRC Resident inspector
/l)G/
jWAB8til3Mjjp llRRspypH
l i
l RESPONSE 10 THE REQUEST FOR ADDITIONAL INFORMATION REGARDING EMERGENCY DIESEL, GENERATOR All. OWED OUTAGE EXTENSION REQUEST l
(TAC. NO. M941s%)
The following is the GPU Nuclear response to the NRC's rcquest for additional information on the Oyster Crcck request to estend the Emergency Diesel Generator allowed outage time from a current 7 days to 14 days (once per > car) to accomplish the bitOlal dicscl generator inspection. The NRC questions arc presented in italics followed ty the GPU Nuclear response.
ANC41 1.
\\\\'Ith respect to your explanation to question MJ in pour June 13. 1996, response to a Itti, the basic OCPiki uhtch p>u usedJhr part ofp>ur analysis is pour JPE. Is this correct? If this is correct, have any r hanges been made to the JPE since puu submtlled it to the NRC7 llso, please discuts any rmfor dt][erences, specipcally with respect to 1.00P and SilU requences.
The basic OCPRA which was used in the June 13,1996 response to the RAI is the IPE submitted to the NRC. No changes hase been made to the OCPRA since it was submitted to the NRC it should be noted that the 'OCPRA* referred to in this RAl is synonymous with the Oyster Creek
'IPE Submittal".
2 Ifyour JPE has been modsped to construct the current version <tfUCPlbf uhtch p>u are using to surywt this requested ElXI AUT n !f the OCPil1 is not related to your IPE, please answer the fdlowing questi.ms:
Discuss how the current version utf the OCPKI repects the as budt, ausperated plant. \\\\ hat revleus were performed to ensure that OCPKl rejects current condotions7 lihat reviews uere performed to ensure the necessarv pne structure (resolution) to evaluate the proposed 1N requirements? Explam any changes that were made to the PILl Jue to any such revtew. Discuss the adequacy of the completeness of the PILI, t.e. the inclusion of all signtpcant systems, structures and components.
Please describe the peer reviews performed on the current OCPILI. Indicate uhich revieus uere per)hrmed in house versus those performed by outside wnsultants. Summartie the reviews' overall conclusions andinsights.
The risk model used in the TS AOT cxtension request was a modified version of the OCPRA (original IPE), Subsequent case studies used both the OCPRA (the original IPE) as well as modified versions of the OCPRA.
The current version of the OCPRA sufficiently reflects the design and operation of the plant with respect to the analysis of the proposed TS AOT cxtension. GPU Nucicar internal risk analysis review has assured that the current version of the OCPRA contains the necessary fine structure (rcsolution) to evaluate the TS AOT cstension requested Reviews of the OCPRA and risk models used in support of the TS AOT cxtension were as follows:
a.
Independent review of the original OCPRA (IPE submittal). This review consisted of Wth an internal review as well as an external contractor review, This resiew and its results arc documented in Appendis D of the original OCPRA submittal.
TSCR230rni2 1
9is91 f
J
i 1
l b.
Additional rnings of the OCPRA loss of offsite power recoscry model were i
performed by internal risk anal sis personnel. Results of all risk model 3
calculations were reviewed by internal GPU personnel including licensing, s3 stem engineering, operations and maintenance personnel.
Additionally, the OCPRA was reviewed by a team of Risk Analysis c.
professionals from both the utility industry and contract personnel. This review was performed in August of 1996 by the DWROO Peer Certification conunittec.
The pect certification team consisted of five PRA professionals (3 contractor) and two utility PRA esperts. The team resiewed the OCPRA and performed a one ucck site visit. None of the findings of this detailed review significantly impacts the use of the OCPRA in the TS AOT cstension.
Changes made to the original OCPRA as a result of item (a) above, are detailed in Appendis D of the original OCPRA. Sensitivity cases were developed by changing the loss of ofTsite power recovery model and an overview is provided in the Attachment I (Table 1) of this RAl. No changes have been made as a result of the llWROO Peer Certification. Each of the findings of the UWROO Peer Certification team uill be dispositioned in an upcoming update of the OCPRA.
3 Provide the minimal cutset truncation cuto]T used to quantify the plant CDF changes. In particular, Indicate uhat ejbrts uere made to mvid underestimatton of the risk due to truncatwn.
f l
The OCPRA uses the "Large Event Tree Small Fault Tree" approach to risk model development and quantification As such, cutset truncation limits are not i: sed in the evaluation of systems.
That is, all cutsets arc developed for cach system split fehn used in the event trec. Oa the event trec level, a inmcation limit of Isto" is utili/cd in the quantification of accident sequences This inmcation is judged to be sufficiently low to prevent the underestimate of risk due to the truncation limit. A generic analysis uhich addresses the effect ofinmcation limits of the OCPRA was performed and presented at the PSA96 International Topical Meeting on Probabilistic Safety Assessment (Reference 7). This generic analysis supports the conclusion that truncation limits are set sufficiently low to prevent the under estimation of risk due to inmcation limits.
4 Unscuss,svur treatment of EDG common causefatture in the PK1. Descrsbe mechanisms which lead to common cause EDGJatlure to start andfailure to run.
In the case of 4160 VAC power and the dicscl generators, common cause failure is handled differently than with other systems in the OCPRA (see OCPRA, Lesci I, Appendis F.3). This is due to the need to model the 4160 VAC bus IC and ID supplies from cithe the 4160 VAC l A and ID (non-essential power) or from the dicscl generators in the case of a loss of offsite power.
With the 4160 VAC power systems, common camse failure is modeled between top events in the nent trees rather than within the systems analysis.
Within the OCPRA the 4160 VAC s3 stem is represented using six top esents:
Top Event EA Failure of 4160 VAC Dus l A Top Event EH Failure of 4160 VAC Dus ID Top Event EF Failure of Huses I A and ID (when ofTsite power is available)
+
Top Event EC Failure of 4160 VAC Dus IC Top Event ED Failure of 4160 VAC Dus ID Top Event EE Failure of both 4160 VAC Duses IC and ID TscR230rai2 2
91897 l
J
The top events associated willi the failure of toth 4160 VAC fluses IC and ID (top escut EE) is used to calculate the conmion cause failure of both the buses and the dicsci generators when
+
ofTsite power is not available. Specifically, the split fraction EDD, models the failure of bus ID when buses 1 A, lil and IC hase failed This split fraction includes the conunon cause failure of the 4160 VAC buses as wcll as common cause failure of tiic dicsci generators. Spht fraction EDD answers the question, "GPtn the failure of!)us 10, what is the probability of ID failure?" Table F.3 6 of the OCPRA shows tlic calculation of the various split fractiont The common cause failure of the diesel generators, which is modeled in the OCPRA, includes those etcuts associated with tiie design erruts, manufacturing defects and construction errors, as well as procedural deficiencies and unforescen environmental conditions. The generic data applicable to Oyster Creek included two common cause start failurcs (both from NUREG/CR.
1362) and Iwo common cause dicscl generator run failures (toth from PWR data).
All common mode failure events were taken from PLO41500 (reference H). The events timt arc described in PLO 0500 that are taken from NUREO/CR 1362 as applicable to Ilic Oyster Crcck -
plant include a common mode failure of three dicscl generators start at tlic Salem plant duc to a binding fuel rack (tlic third unit operated successfully afict lubc and cicaningk The second PLO.
0500 event taken from NUREO/CR.1362 occurred at Millstone 2 when two dicscl generators failed to start due to the fuel lines being valved out. Runtime common mode failures applicabic to Oyster Crcck that were taken from PLG41500 consist of two esents, one that occurred at Yankcc Rowc involving failure of two out of three dicscis due to heat eschanger plugging. and the other at Zion involving failure of two diesel generators to openite due to loose screws in the control circultry.
The impacts of these common cause failurcs were " mapped" to account for the number of dependent failurcs in the original event and tiic fraction of the population imulved in the dependent failure. This " impact vector mapping" process is described in detail in Section 4,4 of the OCPRA. The specific impact vectors assigned for cach esent are then shown in Table 4.4 3 of the OCPRA. The update of these applicable generic common cause factors is show n in Tabic 4 4 5 of the OCPRA and incorporates site specifi esperience of no common cause dicscl generator failure esents for start or nm.
3.
PnnIde a ducuuton of the 1.00P events that have occurred at yrmrpcihty. Alw, pnn'ide an explanation of the data used to calculate the LUUP inattating eventfrequency.
The following lists the losses of offsite power experienced at the 0 ster Crcck Nuclear 3
Generating Station:
1.
On September 8,1973 while ausiliary power was being transferred from the unit auxiliary transformer to the startup transfonner tuo breakers tripped because of a control wiring error. Differential relays inpped fecdct breakers cach time a condensate pump was started. Power was available in the switchyard, but faulty 4160 V breaker relay operation inhibited using it for a short interval.
2.
On November 14,1981 the plant was in a onc 3 car rebuild and the generator links had been lilled. A fire broke out in a potential transformer in the 34.5ky yard that supplies Iwo startup transformers. The loss of the potential transfonner caused the loss of a startup transformer, Carbon deposits caused arcing in other parts of fac 34.5kr switchyard. A decision was made to de energi/c the 34.5kV 3ard at 2:00 p m. to permit cicaning of the TscR230ic2 3
91897 a
insulators. The 34.5 kv )ard could have been teenergited at an3 time and was recnergited at 6 IKI p m. Because the generator links had twa lifted, power could have been supplied b3 the unit transformer within sescral hours Also, a mobile substation was in route and could have tan on line within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. If the unit had been on-line, the unit ausiliary transformers would have continued to supply plant loads and a plant trip would not have tan required 3.
On May 18.1989 the turbinc generator and reactor tripped as a result of generator over.
escitation. The oser escitation was the result of manual operating actions that were taken because of faulty instrument indications during calibrmions activitics. When the main generator is tripped on over escitation, the generator lockout relay does not actuate, hence the breakers between the unit ausiliary transformer and the in plant 4Lv buses did not automatically open. The main generator continued to supply poner to the buses uhile coasting down. Ilowe er, the ensuing low voltage caused the safety buses to isolaic and then load onto the EDGs. When the plant's supply breaker was opened, the non vital loads automatically transferred to the startup transformer, which was energized throughout the esent.
4.
On May 3,1993 a loss of offsite power occurred at Oyster Creek lasting 6 minutes. All offsite powcr was lost uhen a forest fire west of the plam caused arcing of the incoming transmission lines %c unit tripped off from l(K% powcr. The EDGs started and loaded sucussfully. Offsite power was restored 6 minutes later and repowered most plant loads.
It was also available to pouct the safety buses. Ilowever a decision was made to leave the safety buses on the EDGs until the forest fire clearly posed no threat.
The data used in the OCPRA loss of ofTsite pouct initiating events is based on generic data bayesian updated with plant specific esperience. The plant specific esperience is taken from the Oyster Crcck Transient Assessment Reports (TARS) and in the case of loss of offsite power events, from the NSAC reports on losses of OITsite Power at U S. Nuclear Power Plants (references 9 and 10).
Event number 1, above, was not included in the loss of offsite power initiating event calculation since it occurred in startup mode and o!Tsite power remained available in the switchyard. In addition, the duration of the escnt is estimated at 11 seconds.
Event nmnber 2, was not included in the calculation of the loss of o!Tsite power initiating event since the event occurred during an extended shutdown. In addition, the switchyard could have been recncrgired and, if the unit had been on-line, a loss of oITsite power would not have resulted and the unit could have remained on line.
In the case of event number 3, ofTsite power was not lost. The unit stanup transformers remained energired for the full duration of the event.
Event number 4, occurred outside the data collection period after the initial OCPRA was issued.
This event will be added in a subsequent update of the OCPRA.
The generic loss of offsite power initiating event frequency is equal to 9.22x10 per year, The 2
final OCPRA loss of olisite power initiating event frequency (the generic frequency bayesian updated with 19.7 reactor years and reto events) is equal to 3.26s10'2 per year, lhcR2Wai2 4
91R 97
- _ _ _ _ _ _ _ _ _ - _ _ _ - _ - _ A
4 6.
1:xplain the impact ofsevere urather on Sil0-induced cure damage and how this was addressed In the 0CPfll.
7.
Discun recovery ofA Cpem er (from weather, smichyntd andgrid) in the OCPit 1.
As per the telecon between the NRC Staff and GPU Nuclear, questions #6 and #7 are addressed in a single response.
Severe weather often results in Ls of offsite power esents which are similar to grid failure esents with longer durations than other types of loss of offsite power. All loss of ofTsite power j
es ents in the OCPRA are treated as generic olisite power failures No distinction is made between l
weather, switchyard or gnd loss of offsite power. The loss of ofi6ite power recovery model takes credit for the recovery of the weather / grid / switch ard or alignment of the nearsite combustion 3
turbines installed to comply with the station blackout rule. Recovery of the dicsci generators is not modeled in the OCPRA. Details of the OCPRA loss of offsite power recovery are contained in Appendix It i of the t>CPRA.
The following is a summary of the salient points of OCPRA loss of ofTsite power recovery. The OCPRA loss of olisite power recoscry is anodeled as top event LP. Two split fractions are quantified for top event LP: LPl and LP2. Spht fraction LPI is defined as the " Failure to Recover Offsite Power Within 30 Minutes". The 30 :ninute time freme is chosen since it corresponds to the time at which the reactor vessel level, following a str.,
blackout and stuck open EMRV, would reach top of active fuel. The split fraction LPl models two aspects of ofTsite power recovery. The first is the recovery of oft site power within 30 minutes which is derived from loss of ofTsite power esperience at U.S. nuclear power plants (taken from NSAC/147, reference 11).
The second, is the recovery of plant power using the near site combustion turbines installed in response to the station blackout rule. Limited and conservative credit is provided in this recovery split fraction due to the short time interval availabic. Split fra *on LPl. the failure of the recovery offsite powcr within 30 minutes. has a mean value of 2.58...sf Split fraction LP2 is defined as the ' Failure to Recover Offsite Power Within One llour". The one hout time frame is chosen since it corresponds to the SDO rule and it is approsimately when a single isolation condenser would require shcIl side makeup. If two isolation condenscrs were available during the station blackout, significantly more time would be availabic; however this aspect is not modeled. As in the case with split fraction LPI, split fraction LP2 models the recovery of the offsite power using data from U.S. nuclear plant esperience (reference 11) as well as uce of the ncar site combustion turbines. Split fraction LP2. Failure to Recover Offsite Pouct Within One llour, has a mean value of 6.87x104 Each of the split fractions desenbcd above use the data contained in the NSAC reports on Losses of Offsite Power at U.S. Nuclear Power Plants (reference 11) and the use of the nearsite combustion turbines to recover ofTsite power. The data in the NSAC repons contain the duration of the ofTsite power event. The fraction of all loss of olisite power events in the NSAC which are restored within 30 minutes constitute the fraction of " grid" restoration for the 30 minute case modeled in the OCPRA (split fraction LPI). Similart), the fraction of all loss of ofTsite power esents in the NSAC which are restored within one hour constitute the fraction of " grid" restoration for the one hour case modeled in the OCPRA (spht fraction LP2). No distinction is made between the type of loss of offsite power or type of recovery of ofTsite power (i.c., weather, switchyard or grid).
The CGT data used in the original OCPRA (IPE Submittal) was based on the commitments for greater than 95% reliability committed to by GPU Nuclear in the SBO rule since data on actual performance was not available at the time of development of the OCPRA. (Actual performance data has been significantly better than 95% reliability for the succer of one-out-of two CGTs.)
'isCR230rni2 9 tsM
Use of the NSAC data is conservatisc w hen compared to the methodology contained in NUREG.
1032 and NUREG 5032. In the case of the NSAC data, no data points arc escluded in development of the recovery factor. The NUREGs, howescr. allow for the esclusion of events based on plant and site specific causes. This results in higher recovery factors when using the NUREG approach to the recovery of offsite power. In addition, the NUREGs allow for the recovery of the dicscl generators which is not modelctt in the OCPRA loss of ofTsite power recovery.
l l
Tahic 2. Comparium of Recmcry factors ( " Grid" Only )
Split fraction Description NS AC Recovery NUREG 1032 ( 5012)
Percent
]
Recoverv Change LPI - Recovery of Ofhite 0.510 0.593 16 3 %
i Power Within 30 Minutes l
LP2 - Recovery of OfTsite 0 571 0.711 29.l(%
Power Within One llour l
l l
As can be seen in the table above. use of the NUREG data resuhs in larger recovery of offsite power factors (i c., recovery more likely) and therefore lowers the corresponding split fraction (failurc) values. The values in Table 2 do not include the use of the near site combustion turbines to recover offsite power.
Walldowns of the near site combustion turbines confirm that the supply cabics are routed below ground, reducing the susceptibility to severe weather efTects. The nearsite combustion turbines arc designed to the DOCA National Duilding code and are designed to survive the 100 year hurricane for the New Jersey coastal region.
In conchision, the loss of offsite power recovery model in the OCPRA is conservative since it does not consider the following:
Recovery of the Emergency Diesel Generators Near-site combustion turbine can supply through a dedicated feeder line (SDO Transformer) as well as through the switch ard. Only the dedicated path (SDO 3
Transformer) is contained in the current loss of offsite power recovery model.
The loss of offsite power recoscry model was developed before sufficient data was available on the performance of the combustion turbines. A value of 95%
reliability (5% total unavailability), committed to in the SDO rule, was used for the total unavailability of both combustion turbines. Recent data indicates a significantly greater level of performance.
The loss of ofisite power recovery model is based on a preliminary design of the combustion turbine configuration. The as-built design included a larger transformer capable of suppl ing a feedwater/ condensate string. This aspect is 3
not modeled.
If ofTsite power is not recovered in either 30 minutes (split fraction LPI) or one hour (split fraction LP2) then an extended station blackout is assumed ThCR23orai2 6
91897
The sensitivity cases pro ided in Tabic l (Attachment 1) and the EDO AOT remove some of the abosc conservatisms in an attempt to more adequately estimate the risk associated with the proposed technical specification change.
The paragraphs abosc address the development of the split fraction values for the loss of o'isite power recovery top event. The paragraphs below, address the role of the loss of olisite p mer recovery top es ent and split fractions in the model Specifically, the OCPRA loss of offsite power recovery analysis recosers olTsite power within 30 minutes or one hour, less of ofTsite power events of longer duration are assumed to result in core damage except in the case of successful long term isolation condenser operation. Details on the l
AC power recovery are provided in the Appendis III of the OCPRA.
An issue has arisen with regards to the long term heat removal using an isolation condenser under station blackout conditions. This issue concerns a recirculation pump seal failure which could result in failure of this method of long term heat removal (ic., long term isolation condenser heat removal). A recirculation pump scalloss of coolant is not modeled in the OCPRA based on test data contained in references 13 and 14. To address this issue, a sensitivity case has been performed which models the failure of the recirculation pump seals on loss of power events of durations greater than 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> (NUREG 1032, reference 15) This sensitivity case uses the probability of non recoverable recirculation pump seal failures from the NMP l IPE submittal (reference 17). Sec the response to question #12 for the complete details of the sensitivity case.
M.
Discuss the Impact ofthe <10 Ton accident mitigation capability, e g, the abihty to vent. isolate, orfood containment. Uhcuss anypotentialincrease in MOGI prohnhihty.
The proposed AOT estends the time out of service of a single diesel generator and does not produce any new or dilTerent sequences than those contained in the level 1 OCPRA. The proposed AOT does not directly result in any impact on the accident mitigation capabilities although the frequency of loss of offsite power seque
%rcase due to larger dicsci generator m
out of service times. All impacts on accident mit'_
i nbility arc secondary, since when Oyster Crcck is in the proposed AOT. the second dicsci s,.. erator is available as well as station blackout combustion turbines.
The ability to vent containment is not signincantly alTected since the containment vent valves (i c., the hardened vent) rely on DC power and are equipped with an accumulator sired for six cycles of these valves. Containment isolation is not signincantly impacted. Containment isolation valves fall closed on loss of power and therefore perform their function following a loss of power.
The ability to flood the containment is not signincantly affected. Flooding of the containment can be accomphshed using the diesel driven fire protection pumps, The interfacing system LOCA analysis (ISLOCA) at Oyster Creck models the potential over.
pressurization of low pressure systems with reactor coolant pressure. The frequency of low pressure system overpressurization is dominated by the failure of the Reactor Water Cleanup (RWCU) system pressure control valve in the open position Failure of the RWCU pressure control vahc challenges the RWCU isolation motor operated ulves to close. The failure of the motor operated isolation valves results in relief valve discharge to the torus and reactor building equipment drain tank. The unisolated interfacing system LOCA is not signincantly alTected by the proposed AOT since a loss of power to the pressure control valve results in closure of the valve. In addition, the second dicsci generator and station blackout embustion turbines remain availabic when the plant is in the proposed AOT.
TscR230rei2 7
9 titv7 u
9.
l>oes the normally closed DC-jumered Mol'on the outlet pipmg of the isolation condenserfall shut on a loss of DC power? Discuss the impact of battery hfetime on the cwhng capabihty of the asotation condenvr.
The normally closed DC powered MOV in the isolation condenser flowpath does not fail closed on a loss of DC power. On a loss of DC power the DC powered MOV fails "as is". Battery lifetime does not impact the cooling capability of the isolation condenser since the DC powered i
l MOV can be manually operated following the depletion of batteries in an extended station blackout.
10.
Are the ahernate AC (ACC) sources modeled in OCrill? If w, chscuss hme common cause failure was included in >vur modehng of the, LAC wurces. It' hat is the rehabihty of each combustion gas turbine (CGT) uhkh males up the IAC? Are the CGTs ounedand run by Oyster Creek? Ifnot, how does this affect the rehabshty? (For example, testing and mamtenance, and testing and maintenance outages may not be determined by OC. Also will OC encounter any resistance to using the CGTs uhen needed? Please do not hmstyour restumse to the examples providedfor gunkmce). ll. tlc :s inclu,kd in the OCPiLi, quant (ty the NIIU CDF reduction (credit) talen en OCPlblfor AAC.
The ahernate AC (AAC) sources are modeled in the loss of offsite power recovery model (Appendis B.1) of the OCPRA. As discussed in the response to question C of this RAl, GPU has committed in the 500 Rule Submittal to a total reliability of the near site combustion turbines of 95% (5% unavailability). Since actual performance data was not available when the OCPRA was developed this value (a total of 5% total unavailability) was used in the calculations of loss of o(Tsite power reco cry. This total mmvailabiht) is assumed to include common cause failures, testing and maintenance, and unavailability due to failure to start of run. Actual performance data indicates that this value (5% total unavailability ) is conservative.
The CGTs are not owned by Oyster Creck. The CGTs arc owned and operated by GPU Genco.
Testing and maintenance as well as other acthitics (use of the CGTs for peaking power) are not controlled by Oyster Creek. Ilowever, GPU Genco is aware of the need for the CGTs at Oyster Crcck. Oyster Creck has a system engineer responsible for the CGTs. Maintenance and testing of the CGTs which would render the unit inoperable for S00 support of Oyster Creek are reported to the Oyster Creek system engineer. Data on the maintenance and testing of the CGTs is prmided to the Oy ster Crcck system engineer.
The CGTs are included in the Maintenance Rules as risk significant. The total availability maintenance rule goal is greater than 95% as required for the SBO rule. Levels of performance are monitored to lower levels to ensure that the system does not cseced the established maintenance rule goal.
The core damage frequency increases from 3.80x10* to 4.92x10 when the alternate AC 4
capabihty (nearsite combustion turbines) are removed from the OCPRA. This corresponds to an increase of approximately 30%
l Similarly, the station blackout (SBO) contribution to core danuge frequency increases from l.02sl0* to 214x10' when the alternate AC capability (ncarsite combustion turbines) are removed from the OCPRA. This corresponds to a 110% increase. This result indicates that nearly all the core damage frequency increase (1.12sl0*) is in the area of station blackout sequences.
'IsCR210rni2 8
9 is 97
.A
1 11.
lihat are the pnyetted average correctn e maintenance andpreventive maintenance dountimes for ElXis used in your calculations? hxplain how they are obtained I)iscuss any sensittroty l
1 analyses that puu have done on Svur CAI and pal downtunes that q[kct the risk resuhs in the previous question.1)iscuss insights gleanedfrom the study.
As stated in the GPU Nuclear response to the prnious RAl, the unavailability of the EDGs used L
in the risk calculations was due to PM and CM calculated at a frequency of 6.15slod and a l
duration of 1.26s10". This equates to an annual unavailability due to maintenance (PM and CM) oro 8% or 68 hours7.87037e-4 days <br />0.0189 hours <br />1.124339e-4 weeks <br />2.5874e-5 months <br /> mer a scar period (while at power operation) All out of senicc data is plant I
specific based on Switching and Tagging requests over a ten scar period from 1978 to 1988. The EDG tagging data collected over this ten 3 car period agrees closely with current data (January 1993 to May 1995) w hich report 79.$ hours out of service due to PM and CM per year.
Various sensitivity cases were performed for both the initial evaluation of the risk increase of the proposed AOT (reference 1) and the subsequent RAI response (reference 4) Table 1 in, provides the details of cach sensitivity case including the maintenance downtimes used in cach case.
12.
h the failure af recirculation pump seat modeled in the ()CPKl. if not, provide sensitivity stuches and corresptmdmg results uhkh depict the impact ofa seal 111C1 on the requesteditiJT extension. Perform thrAe calctdations for each of the four defintflons in ()efnititms Section.
Provided initial and final values of the variables in the I)efinitions Sectitm uhtch lead to changes in the variables. fireak down ccmtributions into 1 OOP and SHO.
The failure of a recirculation pump seal is implicitly modeled in the OCPRA included in the group of small loss of coolant accidents below the reactor sessel and insiou the containment (initiating event 501). The failure of a recirculation seal is not modeled following a loss of ofTsite power event or in station blackout sequences. This assumption is based on the testing results of the CAN2A seals (references 13 and 14). A total of ten tests were performed indicating low leak rates under station blackout conditior s. On this basis recirculation scal failures wcre not modeled in the OCPRA under station blackout conditions.
In the OCPRA taodel, long term station blackout scenarios (i c., station blackouts lasting longer than one hour) result in core damage, except for successful long term operation of the isolation condenser. Therefore, the cilect of modeling recirculation seal failure in the OCPRA is the failure of previously successful station blackout sequences involving successful isolation condenser operation. Ilowever, recirculation seal LOCAs are expected to declop approximately four hours into an extended station blackout event (references 15,16 and 17). With a total of four hours for olisite power recmcry, the potential for successful recovery of ofTsite power increases. Using information available in NUREG 1032, NUREG 5032 and NMP 1 IPE Submittal, a sensitivity case was de cloped to reflect an extended station blackout with recirculation pump seal failure in the OCPRA.
In this sensitivity case, the split fractions used for the loss of olTsite power recovery over the 30 minute and one hour intervals (split fractions LPI and LP2) are not changed or adjusted. Using new CGT data and new gnd recovery data for the development of LPI and LP2 split fractions is expected to result in decreases to the current split fraction values. Ilowever, the purpose of this sensitivity case is to demonstrate the sensitivity of the existing OCPRA to recirculation pump scals under extended station blackout conditions and the initial values of the 30 minute and one hour loss of olisite power recoveries are not adjusted.
A value for the ' Recovery of Offsite Power Within 4 Ilours' (split fraction LP3) is developed.
This split fraction is descloped using NUREG 1032 and NUREG 5032 data on the recovery of 18CR2 h 2 9
91R97
o!Tsite powcr within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. In addition, the recoscr> of dicsci generators within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> as well as use of the nearsite combustion tuitiines are modeled. The non recoverable recirculation seal LOCA probability is taken from the NMF l IPE Submittal (reference 17). The base model is l
adjusted to ensure that long term isolation condenscr operation during station blackout conditions can result in core damage due to the failure of the recirculation scals.
1 In stunmary, this sensitivity is the base case OCPRA with the single change of the incorporation of a recirculation seal failure in long term station blackout events. The result of this sensitisity case including a comparison with the OCPRA is prosided in fable 3.
Table J. Comparium of the OCPRA and Recirrulation Seal Failure Models Factor OCPRA Recirc Seal Model Value Value Recovery of Offsite Powct 30 minutes 2.58x 10 '
2.58x10
(NS AC Data and Nearsite CGTs)
Recovery of Offsite Power 1 ilout 6 9lx10 6 91xioi (NSAC Data and Nearsite CGTs)
Recovery of Offsite Power 4 llours n/a 2.51x10' (NSAC Data and Nearsite CGTs)
Diesel Generator Recovery 4 Hours n/a 0.6 Unrecoverable Seal Failurc n/a 0 05 Core Danure Frequency 3.80s10*
4.05 x 10*
Percent Change in CDF 6.5%
Loss of OfTsite Power (LOSP) Frequency 1.34x10*
1,35x10*
Percent Change in LOSP Frequency 0.72 %
Station Illackout (Si1O) Frequency 1.02x10+
1.03x10*
Percent Change in SBO Frequency 0.95 %
Large Early Release Frequency (LERF) 7.56x10' 8.3tx10' LERP Percent Change 9.9%
IJ'l amt IJ'2 spht traems are the same twtween the OCPNA ami Rn.reulatmn heal railure nmslet Une or NURI O data tenuits in lower iJ' apht reacts m s aluen. Ilowever, Hw purp me or this nennitivity came in to compare the hwecame in CDF due to nusklmg or recirculation scal raiture emit to evaluate charigen in bmn or onute [miwer recoven salues As can be seen from the results in Table 3, the total increase in core damage frequency as a result of the modeling of unrecovered recirculation pump seal failures is approximately 2.5x10' per 3 car or 6.5%. This value is espected since in the traditional loss of offsite power model, a recirculation seal failure is not expected to develop in under 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. This 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> time frame allows rttitional time for the recovery of the grid as well as for the recovery of the dicsci generate A review d.he results indicates that although the core damage frequenc3 change is approximately 6.5%, the changes in loss of ofTsite power and station blackout contributions are not as dramatic. Further reviews of the sequence database indicate that much of the 6 5% change in core damage frequency is due to the common cause failure of 4160 VAC buses in combination TSCR2.inrai2 10 91 97
with the failure of a recirculation pump scal The cosmnon mode failure of 41MI VAC buses is similar in plant response to a station blackout with the exception that it is assumed that it cannot be recoveral. Wilhout the opportunity to recover power, these normally low frequency sequences are more significantly impacted by a failure of a recirculation pump seal. Although the percent change is 6.5%, the actual absolute value change in core damage frequene3 due to incorporation of the recirculation pump seal failures is relatiscly small, approximately 2.5x10' per scar.
A second sensitisity case is descloped which uses the model described atxnc with the diesel generator maintenance frequency adjusted to reflect a comparison of technical specification AOT limits. That is, the dicsci generator maintenance fraluency is set to the current technical l
specification AOT limit (7 da3s per diescl) as well as the proposed AOT linut (7 days and 14 da>s). The results of these evaluations including a comparison between the two are displa>cd on 1
Tabic 4.
Table 4. Retirculation Pump Seal Fellure Sennithit) Cancs Case Description CDF Percent Ims of OITsite Power Station lilackout Change Value
% Change Value
'h Change Recirculation pump scal failure model uith EDO outage time set mi =
1.64x10*
I31x10*
to current AOT limit 4.42 s l0*
(7 da3s per EDOt 7.2%
152%
17.6 %
Recirculation pump scal failure
-m=
2.5x 10" 2.3x10d nxxict with EDO outage time m2 =
3.2 x 10' equal to the 7 days and 14 da3s 4.74 x 10*
1 2 10*
l.54x10*
for EDO 1 and 2.
(Proposed AOT limit).
M4e *i'ercent thange' in dentwd at dw getcent diHererwe lietween dw Iwo 1 tX1 M fl cancs es aluated in dw talile aime The comparison of the results from the recirculation scal failure evaluations produce a core damage frequency change of 3.2x10" per scar on an annual average tnsis uhich is equisalent to a 7.2% increase. This core damage frequency remains conservative since it includes average maintenance terms and a conservative loss of ofTsite power recovery values (short term), The percent change in total core damage frequency agrees relatively closely with the cases I and 2 which comparc the AOT options using the tuse OCpRA without recirculation seal failure (Tabic I in Attachment 1).
loss of offsite pouct contribution increases as a result of the proposed 14 day AOT, The increase is approximalely 2.5x10 per 3 car or 15.2% Although the percentage change is relatively large, when compared with the total core damage frequency percent change, the absolute value of the change remains small and the conservatisms mentioned above also apply here.
The station blackout contribution increase from 131x10' per year to 1.54x10' per year or approximately 17.6% As in the case with the loss of oITsite power contribution, the absolute value of the change remains small despite the relatively large percentage change.
As requested in Question #12, the large early release frequency (LERF) is calculated for the recirculation pump seal failure inodel. (For the definition of large early release frequency see the response to question #14) Table 5 precents the large, carly release frequency (LERF) and percent changes for the risk evaluations described above in Table 4.
TECR2.sorni2 ll 91897
Table S. Ascray Chany in Lary Earl) Relenne Frequenc) (LERF)
Case Desenplion LERF Percent (per Scar)
Change Recirculation pump scal failure model with mi=
EDO outage time set to current AOT limit (7 8.52 x 10",
days per EDG) 20%
Recirculation pump seal failure modcl with m2"
-m =
EDO outage time equal to the 7 da3s and 14 8 69510' l.7x10*
days for EDO I and 2. (Protmed AOT limio The change in LERF is equal to 1.7x10*, or an increase of 2.0% The instantaneous LERF when Oyster Creek is in the proposed AOT is calculated b) cvaluating the base recirculation pump seal failure case with a single dicscl generator out of service (guaranteed failed). This evaluation results in an instantancous core damage frequency of 2.28s10 per 3 car. The LERF associated 4
with this evaluation is 1.8Sx10* per ) car. The change in instantaneous LERF is then equal to:
(1.85x10*. 8,31x10' = 1.02x10+ per year)
Despite the 7.2% change in corc damage frequency (albeit a small absolute value change). the LERP does not change significantly either on an absolute basis or percentage changc. This is due primarily to Ilic fact that station blackout and loss of olisite power events which result in core damage usually have intact containment endstates A review of the sequence results reveals that I
LERF increases are primarily a function of the loss of mitigative systems when a presious containment failure had occurred. That is, a station blackout or loss of offsite powet with, for esample, an unmitigated LOCA outside the primary centainment boundary. These sequences have relatively small frequencies and increase only slightly as a result of the estended AOT.
The following prosides a summary of the Recirculation Pump Scal Failure model using the NRC Statidefinitions in the request for additional information:
(l) Chanyin Aversy CDF(-m(CDF)):
=
4 4.42x10 4.74x10'
=
4 3.2x10
=
(2) Chany in instantaneous CDF (-CDFe):
=
4 2.28s10 4.0$x10*
=
4 1,873x10
=
(3) Chang in Ascrage Lary Early Releane Farquency (-m(LERF))
-m (LERF) m2 (LERF). mi (LERF)
=
4 8.$2x10 8 69x10'
=
8 1.7x10
=
(4) Chany in Instantaneous Large Early Release Farquency (-LERF )
i
=
1.85 s 10*. 8.31 x10'
=
1.02x10*
=
TScR230rni2 12 91897 I
13 For the calculations perprmed in question kJ in your June 1.1, 1996, respmse to the R.ll, pnwide the LOOP contributions in additwn to the SHO controbuttons p>u have alreadygwen.
Table 1 (see Attachment 1) provides a sununaiy of all sensitisity studies performed in toth the initial Technical Specification Change Request. reference 1) and the subsequent RAI response (reference 4). It should be noted that the prestous RAI response provided by GPU Nucicar (reference 4) provided the loss of ofhite power contnbutions (initiator: LOSP) rather than the S130 contributions to CDF as indicated on page 9 of the RAI response.
IJ.
Quant ([v the impact of the extended.10T on the instantaneous and average f.FRF by calculating the change in IJJtF due to the propard AUT. Provide pour definition ofIJiRF. an c.nplanation of this impact, and the mitial andfinal values of IJ.RF uhich are inputs to the change in instantaneous and average IJCRF.
As per the telecon between the NRC StafT and GPU Nuclear on February 11.1997, question #14 is adequately addressed by the response to question #8 and the response to question #12. In question #8, the impact of the proposed AOT on accident mitigation ability is discussed in quer, tion #12. a sensitivity case which models a recirculation pump seal failure following an extended station blackout is provided in the response to question #12 the large early release (LERF) instantaneous and average values are provided The definition of a large, carly release used in the response to question #12 is consistent with the definition used in the EPRI PSA Applications Guide (reference 20) which states:
"A large, early release is a radioactivity relcaw from the containment uhich is both large and early. Large is defined as involving the rapid, unscrubbed release of airborne Assion products to the environment. Early is defined as occurring before the c!Tective implementation of the oft site emergency response and protective actions."
15 Provide the valuesfor the liUG o habihty and availabihty used in the UCPitI to calculate the SHO CDF values. Discuss thes values in relationship to any goals associated with the implementation of the maintenana rule and in comparison to actual paAI performance of the liDGs at the plant, Also, compare the values usedin the UCPRA to the target valuesfor SHO, As stated in the response to the presious RAI, the OCPRA does not use reliability or availability in the calculation of CDF, The mean unavailability of the EDGs used in the OCPRA are as follows:
4 EDO Start Failurc
= 135x10 per demand 4
EDO Run Failure (first hour)
= 1.42x10 for the Drst hour 4
EDO Run Failure
= 2.51x10 per hour 4
4 EDO Out of Service Time
= 6,15x10
- 1.26x10 = 7,75x10 (67.9 hrs / r) 3 The total availability is calculated as I minus the unavailability over the stated mission of the 4
EDGs which is equal to (1 530 x 10 ) or 94.7% availability. This value includes the unavailability due to PM and CM as well as failure rate. The failure rates abose are based on generic data updated with plant specific failure esperience (work requests) over the ten year period of 1978 to 1988. The EDO out of service time, the maintenance frequency and duration, is also developed using generic data updated with plant specific esperience (Switching and Tagging Requests) over the same ten year period from 1978 to 1988.
1scR2Kne:2 13 91897
e The current maintenance rule goal associated with the EDOs i. a total out of senice time of 2 00% or 175 out of senice hours per year. This goal is based on more recent plant esperience as well as the need to hase the goal sufficiently above the average performance over a ten > car period.
16.
Explain how EDG PM and subsequent on hne operability testing is treated in CDF calculations.
As stated in the previous RAI response, the average maintenance terms used in the OCpRA include all EDO unavailability and out of service time including on line operability testing since the average maintenance terms are based on the Switching and Tagging Requests. That is, if the EDG were unavailable due to any cause, a Switching and Tagging Request would log the total time the EDG was unavailable. This is the information used to generate the maintenance frequency and duration contained in the OCpRA.
AltEA 2 1.
Utven the AUT plant configuration. what does the PM Indicate are the most rid significant systems? Please explain the results.
The 0 ster Creek On Line Mainterumcc (OLM) program (reference 12) uses risk achievement 3
i wonh to determine what systems are most ituportant when performing OLM. The risk model used in the determination of the most risk significant systems when an EDO is out of senice is 4
'OLM DG2". In this nsk model a single EDO is out of service (guaranteed failed). The other systems modeled are ranked by risk achievement worth below. The risk achievement wonh displayed is that of the entire splem. Trains or components of tlic system would therefore have j
lower risk achievement worths. Only those systems which have risk achievement wonhs greater than two (2) arc shown.
a Table 2 - Important Systems n 6th a Dienel Generator Out of Senice (So1cd by Rink Achlesement Worth)
Rank Top Top Event Description Risk Event (System or Function)
Achievement Worth I_
R S __
Reactor Scram (including ARI) 7317 l
___2_
__ _ AD Automatic Depressuritation 32n Mi isolation Condenser Isolation MII 3_
Op 34.5Lv Switchyard 224 4_-
DC 125 VDC lius C 156 6
CS Core Spray S stem 145 3
rore her 3 by.eem t i.7s Corehere3 h3 neem Il 2.40 7
VO__
EMRV (Open) 140 N
VS Scram Discharge Volume Isolation 137 9
lC Inolation Condenners 114 Isolatha Condenner T 2.7a teciatka Condtnner *H" t.31 10 Dil 125 VDC Ilus H In7 11 EC 4160 VAC Bus IC 60,1 tue.el cener.cor a 16.01 12_
EA 416n VAC 1.lus I A 46 9 TscR230rsi2 14 9is97
Rank Top Top Event Description Risk Event (Splem or Function)
Achicsement Worth 13 VR liMRV (closure) 2M M 14 ED 41(di VAC But ID 15 3 1$
Ell 4l(di VAC llus til 14 M 16 MU lsolation Condenser Makeup Vivs 9 34 17 FP Fire Protection S stem 9 2M 3
IN ME MSIV Closure (Iow pressure)
H.17 19 ST Condenvite Storage 5 23 2n OV Contamment _ Vent 3 93 21 CP Condensate S) stem 3 49 22 TB TBCCW Splem 3.32 1 M T W Pony 1.031 1 W 4 % Heat Fuhanner 122 23
'IT Turbine Trip System 3 19 24 LP Ofhite power Recovert 3.17 25 SO SaIcty Valves (open) 2 14 NOTES
- 1. Items in bold provide the splem (top event) risk achievement worths (RAW) as ucil as selected individual component RAWS.
- 2. RAWS provided in the table above are related to the total CDF of the "OLM DO2" risk model. The OLM DO2 core danmge frequency is greater
(~ $ 44 times) than the OCPRA due to the diesci out of r.crvice.
In general, the above ranking of Opter Creek systems with an EDO out of service agrecs closely with the ranking produced from the base case model.
2.
For the risk signtpcant systems >vu utentijled in the previous question, hme uvuld >vu ensure that no risk signipcant plant equipment outage cortpgurations would occur whde the plant is subject to the LCO proposedpr modsjication? Are the basesfer this assurance reflected in >vur procedures or *IS?
As stated in the GPU Nuclear respon= to the previous RAl, Oyster Creek uses an ndministrative procedure to manage on line maintenance (OLM)(reference 12). Procedure 2tXXbADM.3022.01, "On-Line Msintenance Risk Management" provides for the control of on line maintenance at Opter Creck.
Specifically, a review is performed of the entire cycle OLM. Combinations of system windows are analy7cd using the plant specific OCPRA to determine the overall risk including the clicct of enviromnental conditions as well as any potential for risk reduction. Configurations u hich result in risk achievement worths of greater than 10 (defined as high high) require " unloading" or that compensatory measures be taken to reduce the risk of the planned maintenance. In the event that risk remains undesirable other alterrutives to performing the maintenance while on line will be considered.
Changes to the OLM schedule require evaluation through the OCPRA or, if not possible, a defense in depth determination to ensure that no undue risk is incurred Combinations of sptem windows which result in risk achievement worths greater than 10 require compensatory measures. Below is an esecrpt from the OLM procedure:
TsCR230rai2 l$
91897
'PR4 Schedule Review PK4 reverw is required to determine the PRI risk aunciated with a previously unanalped system window, spect])c combinations of system windous or to determine measures that can be laten uhen the risk is high high it is acceptable to schedule system windows as long as the evmbined PR4 risLJbr all concurrent system windous is not high high Addalonal Pili review is there)bre requiredJhr thefidlowing:
all system u tndows that have a risk level ofhigh-high e
l uhen tuo or enore system utndows are scheduled concurrently and the combined risk levelis unknown except asfdiows:
uhen a window is scheduled cvncurrently wth system uindows that i
have risk levels oflow low 1
If credit can be takenfor a previous PR4 review that shows the PR4 riskJbr the concurrent system wtndow In question is not hegh high IfAttachment i Indicates that it is acceptable to comhtne the system wondow with another system u tndow A PK4 review should be performed by Risk Analysts personnel with inputfnnn Scheduhng and Plant Operations as needed The review shouldinclude determining the risk level and Identifiong significant controbutions to risk. It' hen the review indicates that the risk to perform scheduled activities is undestrahle, then with input from Scheduhng and Plant Operations, schedule changes, schedule restrictions, contingencies and Guidehnes in Attachment 4 should be considered to make the risk acceptable. Alternatives to per)brming the activory should also be considered
Ilowever, additional OLM is possible in an EDG system window, since the risk achievement uorth of the EDGs is less than 10. In any case. EDG and concurrent maintenance is analyzed for its impact on risk. If the combination of OLM in a given system window escceds a risk achievement worth (RAW) of 10, the additional on-line maintenance is deferred or compensatory actions are taken. A copy of reference 12 is availabic for review.
3.
Ekscribe how PR4 insights are used in the decision making process, spec l1cally with respect to planning mamtenance activities imviving the ElXis?
> SA insights are used in various evolutions of the OLM process. The inost signincant use of PSA insights is during the review of the OLM Schedule for the upcoming cycle, During the PSA review of the upcoming cycle, the various system windows are evaluated for their risk level. Each work week window is also reviewed for the potential to reduce the risk. Factors such as environmental conditions, have been noted in the comments section of the schedule as in the case of sentilation and intake systems. Work wecks which present significant risk or scram / trip hazards have been unloaded. That is, work is moved to less risk signincant work wecks.
In the case of the diesel generators, outage periods have been moved from the summer and winter to the spring and fall when grid voltages are more stable. In addition, outages associated with the combustion 19tbines, used in support of station blackout at Oyster Creck, have been scheduled such that they do not coincide with dicsci generator outages. Outages associated with risk TSCR230rai2 16 9ts97
4 significant sptems, such as the core spray and isolation condenser sptem have been moved out of the dier.cl generator OLhi work ueck uindow.
In an effort to inform plant staff of ongoing maintenance activitics, the risk level associated with all work week windows, including the EDO splem window, is posted on the plant status board which appear at various site locations and plant entrances as well as the STA status thcet.
i llave;vu thoroughly revicurdyour 1N to see If there are needsfor any other r hanges to your 1N or 1N bases (in adthtton to the 1S amembnent items p>u are currently requesting) due to your request ofElX1 extensionfrom 7 to 14 days? please identt(v any 1N changes made to ensure that the plant will not enter a known risk significant plant configuration u htle in the AUT.
Use of the OLM procedure to control the risk associated with the performance of on line maintenance is judged to be sufficient and no changes to the esisting technical specincations arc deemed required AREA 3 1.
Are p>u capable ofperforming "Real Time" auessment of overall impact on safetyfunctions of related 1N activities before conducttng test and maintenance aalvilles includmg the removal of equipmentfnnn service? I' lease explain how this "real time" auessment tool, or viher processes.
will be used la ensure that risk signtllcant plant configurations will not be entered during the AUT.
Risk evaluations are performed for the evaluation of OLM sptem windows for the entire current operating cycle. The evaluations use the ibil OLM pRA inodel quantified to Islo'". The quantification of a single sptem window or plant configuration takes approximately four (4) hours. GPU is currently in the process of evaluating on-linc maintenance so0nare for use in the evaluation of risk due to OLM.
The PRA is currently scheduled for and upaate which is espected to be completed in early 199tt. This update will utilire RISKMAN Release 8. Model run times are espected to decrease significantly as a result of the implementation of the new soRware version.
2.
Explam how p>u are going to address the issue ofconfiguration and ccmtrol, consistent with the Alaintenance Rule, i.e., to evaluate the impact ofmaintenance activities on plant cortfiguration.
The purpose of the Risk Management of On Line Maintenance procedure is to control of the risk of on line maintenance. This is performed using the insights derived from the pRA model. In addition, a review of the previous out of service times is to be incorporated into the risk model to develop a historical view of the previous operating cycles OLM and to glean insights which can then be incorporated into the OLM program.
,L l)iscuss how p>ur conj 1guration risk management program is reflected in 1N The current configuration management program is not rc0ceted in the technical specifications.
The Risk Management of On Line Maintenance procedure operates within the current technical specification program to adnunistratively prohibit those configurations uhich may be allowed by current technical specification but which contribute significantly to the plant risk.
TSCR230rai2 17 9 'lk 97
.1
l 4.
II'ithin theframeuvrk ofyour pnqvred Configuration lurk Management l'rogram, describe the quahfications ofthe perwnnel that will use or relvrt Pitt results to utywr management?
The GPU Nuclear Risk Anal sis group is contained within the Safety and Risk Anal sis 3
3 Department. The manager of the department has been imolved in PRA since the original Oyster Crcck Safety Assessment (OPSA) was performed in 1979 and updated in 1982 (references 18 and 19). Risk Analysis group personnel have a minimum of 10 years esperience in the risk anal sis 3
field. Personnel currently involved in the Configuration Risk Management Program (the On Line Maintenance (OLM) Risk Management Program at Oyster Crcck) were intimately involved in the development of the OCPRA and the OLM Program and have more than 10 cars esperience 3
in the risk anal sis fictd.
3 T80R230rai2 lg 9 g97 l
l 1
l
REFERENCES 4
1.
GPU Nuclear Corporation. " Oyster Creck Nuclear Generating Station (OCNGS) Docket No. 50 219. Technical Specification Change Request (TSCRI No. 230", GPU Nuclear Letter 6730 96 2086, March 25,1996.
l 2.
GPU Nuclear Corporation, " Risk Evaluation of Proposed Dicscl Generator Technical Specification Change", GPU Nuclear hiemorandum 5430-96 0006, February 1,1996.
3.
Nuclear Regulatory Comminion. " Oyster Creck Nuclear Generating Station. Request
)
for Additional Information Related to Proposed Changes for Emergency Diescl Generator Allowed outage Time (TAC No. A194856)", hiarch 21,1996.
4.
GPU Nuclear Corporation, " Request for Additional information Related to Proposed Changes for Emergency Diesel Generator Allowed Outage Time", GPU Nuclear Letter 6730-% 2138, June 13,1996.
5.
GPU Nuclear Corporation, " Oyster Creek Protabilistic Risk Assessment (Level 1)",
Volumes I through 6, November 1991.
6.
GPU Nuclear Corporation. " Oyster Creek Probabilistic Risk Assessment (Levcl 2)",
Volume I, June 1992.
7.
Canavan, K., PSA96 International Topical hiceting on Probabilistic Safety Assessment,
- EITect of Probabilistic Safety Assessment rruncation Limits on Risk Achictement Worth Calculation", Volume I, pages 237 14, Octotver 1996.
H.
PLO, incorporated, " Database for Probabilistic Risk Assessment of Light Water Nuclear Power Plants". PLG-0500, Volume 4. Revision 1. August 1989.
9.
Nuclear Safety Analysis Center (NSAC), " Losses of OITsite Power at U.S. Nuclear Power Plants. All Years Through 1983" NSAC 80, July 1983.
10, Nuclear Safety Analysis Center (NSAC), " Losses of Offsite Power at U.S. Nuclear Power Plants Through 1993", NSAC 203, April 1994.
II.
Nuclear Safety Analysis Center (NSAC) " Losses of O!Tsite Power at U.S. Nuclear Power Plants", NSAC 147, hiarch 1990.
12.
GPU Neicar Corporation. "On-Line hiaintenance Risk hianagement" Procedure 2000 ADP13022.01, lunc 5,1995.
13.
David D. Rhodes, AECL Research, " Performance of the CAN2A Recirculation Pump Seal Cartridges Dunng Station Blackout" TSCR2Wai2 19 91R97
l 14.
Greene, T. E. (MPR Associates). Inch, G.11. (Niagara Mohawk Power Co poration),
' Evaluation of Shaft Scal Leakage under Station Blackout Conditions for the Reactor.
Recirculation Purnps at NMP 1".
15.
Nuclear Regulatory Conunission. *Modeling Time to Recoscry and Imtiating Esent
)
Frequency for Loss of Off Site Power incidents at Nuclear Power Plants", NUREG/CR.
l 1032, January 1988.
16.
Nuclear Regulatory Commission, "Modeling Time to Recover) and initiating Event Frequency for Loss of Off Site Power incidents at Nuclear Pouct Plants", NUREG/CR-5032, January 1988.
17.
Niagara Mohawk Pouct Corporation, "Nine Mile Point Nuclear Pouct Station. Unit i Individnal Plant Examination (IPUP, Revision 0, July 1993.
18.
Pickard, Lowe and Garrick, incorporated in association with Jersey Central Power and Light Company and GPU Service Corporation, " Oyster Creek Protwollistic Safety Assessment (OPSA)", PLG4)l00, August 1979.
l 19.
Pickard, Lowe and Garrick, incorporated in association with Jctsey Central Pouct and Light Company and GPU Service Corporation, " Oyster Creek Probabilistic Safety Assessment (OPSA) Plant Analysis Update", PLG 0253, December 1982, 20.
Electric Power Research Institute (EPRI), "PSA Applications Guide" EPRI TR 1053%,
Final Report, August 1995, page A-4.
TSCR230rai2 20 91897
l l
A1TACllMENT I I,ESCRIPTION OF SENSITIVITY CASES T5CR210rai2 21 9gg97
i 1
4 I
This attachment provides the sensitivity cases which were quantified to support the Diesel Generator Technical Specification Change Request (TSCR). Specifically, the TSCR changes the dicscl generator 1
allowed outage time (AOT) from seven (7) days to 14 days in the case of the biennial inspection to allow i
the inspection to be perfonned which 0) ster Creek is at power.
t The sensithity cases are developed using the OCPRA as a base model. The OCP' A was developed in November of 1991 and reficcts tlw design and operation of Opter Creek at that time with tim espected l
additions of the hardened vent, manual containment spray and the alternate AC capability (nearsite combustion turbines). The OCPRA has not been modiDed since its development. Internal reviews have i
i indicated that the current version of the OCPRA sufficiently reflects the design and operation of ihc plant with respect to lls analysis of tlw proposed TS AOT estension. GPU Nuclear internal risk analpis review has assured that the current version of the OCPRA contains the necessary fine structure (resolution) to i
cvaluate the TS AOT cxtension requested.
h The sensitivity cases are an attempt to develop a more realistic comparison of the proposed technical i
1-specification change. The sensitivity cases address two factors with respect to the evaluation of the proposed technical specification change:
I First, is the conservative loss of offsite power recovery model. The conservative l
loss of offsite power recovery model is adjusted with current data on i
combustion turbine performance and better grid recovery factors.
i The second, is the impact of average maintenance terms in the base OCPRA, e
l The average maintenance terms are removed.
i l
In order to compare the technical specification options (i c., currem versus proposed technical specification) the outage time on each dicsci is adjusted to tellect the current technical specification and j
then to the proposed technical specification AOT. These Iwo options are compared.
f in summary, six evahiations are performed, tuo for cach of the three risk models developed.
i U
BASE CASE COMPARISONS I
The first risk model is the base case OCPRA, Tuo evahiations are performed of this risk mocici:
l.
Diesel generator outage times adjusted for ihe current AOT (7 days per EDG). Tlw results of this sensitivity case are provided as case I on Table 1. (hiodel evahiation AOT 7C) 2 2,
Diesel generator outage time set to the proposed technical specification AOT limit (7 days and 14 days) The results of this sensitivity case arc provided as case 2 on Tabic l. (hiodel evaluation AOT 714C)
A comparison of sensitivity cases I and 2 is also prosided on Table 1. Table i presents the absolute values as well as the percent change in core damage frequency (CDF), loss of offsite power (LOSP) contribution and station blackout (SBO) contributions.
rsCR230rai2
'.' 2 9 IRM
9 i
l AVERAGE MAINTENANCE TERMS REMOVED The second risk model is the base case OCPRA adjusted to remove the average maintenance terms. This risk model is similar to the risk model used in the evaluation of the risk of the performance of on linc maintenance. As above, this model is evaluated for the two technical specincation options of 7 days of outage time for cach dicsci and 7 and 14 days of outage time on cach ticscl.
3.
Dicsci generator outage times adjusted for the current AOT (7 da)s per EDO). The results of this sensithity case arc prodded as case 3 on Tabic 1. (Model evaluation AOT.7B) 4.
Diesel generator outage time set to the proposed technical specincation AOT limit (7 days and 14 days). The results of this sensitivity case are provided as case 4 on Table 1. (Model evaluation AOT 714B)
Tabic 1 presents a comparison of the absolute vahics as v*ll as the percent clumge in core damage frequency (CDF), loss of olisite power (LOSP) contribution and station blackout (SBO) contributions between cases 3 and 4.
REVISED LOSS OF OFFSITE POWER RECOVERV AND REMOVAL OF AVERAGE MAINTENANCE TERMS The third risk model is tie base case OCPRA with the loss of olTsite power recovery model revised to remove conservatisms and average maintenance terms removed. As in the cases above, the risk model is evaluated for the two technical specification options.
5.
Diesel generator outage times adjusted for the current AOT (7 da3s per EDO). The results of this sensitivity case arc provided as case 5 on Table I,(Modelevaluation AOT.7A) 6.
Diesel generator outage time set to the proposed technical specification AOT limit (7 days and 14 days). The results of this sensitivity case are provided as case 6 on Tabic 1. (Model evaluation AOT 714 A)
Table i presents a comparison of tie absolute values as well as the percent change in core damage frequency (CDF), loss of offsite power (LOSP) contribution and station blackout (SBO) contributions between cases 5 and 6.
TSCR230rai2 23 9 gy I
\\
TABLE 1 -
SUMMARY
OF SENSITIVITY CASES Case C.{.c e Descnption Model DG OOS Core Damage LOSP Contribution SBO Contribution No.
Name (hrstyr)
Value Percent Value Percent Percent Value Percent
- j. Percent Change j Contributton Change Contntxfaon Change f
Base OngnalOC eta OCPRA 67.9 3.80E-06 n/a 1.34E-06 35.3 %
n/a 102E-06 26.7%
n/a OCP41A model adjusted to reflect the currert Technical Specification AOT of seven days per diesel generator.
AOT-7C 108 4 84E-06 1.63E-06 33 68%
1.29E-06 26.7 %
(Average maintenance terms and loss of offsite power recovery remains unchanged from the base case).
6.00 %
14.7 %
18.6 %
OCPRA raodel adjusted to reflect the proposed Technical bpecification AOT of 7 days and 14 days for the EDGs.
2 AOT-714C 168/336 5.13E-Gi 1.87E-06 36.5 %
1.53E-06 29.8 %
(Average maintenance terms and offsite power recovay remains unchanged from the base casd.
OCPRA mode; adjusted to reflect a seven day A JT per diesel generator as 3
well as removal of average maintenance AOT-7B 168 4.41 E-06 1.58E-06 35.87%
1.2SE-06 29.1 %
terms. (Offsite pcwer recovery model is unchanged from the base case).
6.50 %
15 2%
18.8 %
OCI'RA model adjusted to reflect t
pr*>posv! Technical Specification AOT o.
7 days and 14 days per EDG as we!! as AOT-714B 168/336 4.69E-06 1.82E-06 38.8 %
1.52E-06 32.4 %
removal of average maintenance terms.
(Offsite power recovery modelis i
unchanged from the base case).
OCPRA model adjusted to reflect seven days of outage time per diesel (current 5
Technical Specification) as well as less AOT-7A 168 3.04E-06 6.90E-07 22.68 %
3 91E-07 12.9%
conservative offsite power recovery and removal of average maintens ce terms.
3.85 %
i 10.7%
16.9%
OCPRA model ad;1Tsted to ref,ect proposed Technical Specification AOT of 7 days and 14 days per EDG as well as O
AOT-714A 168/336 3.16E-06 7.64E-07 24.2 %
4 57E-07 14.5 %
less conservative offsite power recovery and removal of average maintenance terms..
Rai-tab 1ts 7/11/97
-. - - ---