ML20237E187

Safety Evaluation Supporting Amends 214 & 195 to Licenses NPF-4 & NPF-7,respectively

ML20237E187
Person / Time
Site:	North Anna
Issue date:	08/26/1998
From:	NRC (Affiliation Not Assigned)
To:
Shared Package
ML20237E184	List: ML20237E182 ML20237E187
References
NUDOCS 9808310022
Download: ML20237E187 (20)

Text

__ _-_ __ - _ _ _

pag gk UNITED STATES g

g NUCLEAR REGULATORY COMMISSION e

WASHINGTON, D.C.=== *1

%...../

SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NOS. 214 AND 195 TO

)

FACILITY OPERATING LICENSE NOS. NPF-4 AND NPF-7 VIRGINIA ELECTRIC AND POWER COMPANY OLD DOMINION ELECTRIC COOPERATIVE

{

I NORTH ANNA POWER STATION. UNITS NO.1 AND NO. 2 j

DOCKET NOS. 50-338 AND 50-339 l

1.0 INTRODUCTION

By letter dated September 1,1995, the licensee requested various changes to the plants' Technical Specifications (TS). Specifically, other than editorial-type changes, a major j

change was proposed which would allow a single outage of up to 14 days once every

(

18 months, in lieu of the current 72-hour limiting condition of operation (LCO), for each emergency diesel generator (EDG) in order to perform a preventive maintenance inspection requiring disassembly of the EDG during plant operation.

In response to the staff's April 2 and November 13,1996, requests, the licensee's letters dated April 8,1996, and November 18,1997, provided additionalinformation and proposed l

revisions to the original requested changes, including a change which would allow the 1

14-day outage whenever an EDG is inoperable for whatever reason under specified l

conditions. Also, in a February 9,1998, response to a January 13,1998, telephone call with l

the staff, the licensee provided additior.al information and editorial-type changes to the 4

proposed technical specification revisions.

Further, in a letter dated March 25,1998, the licensee proposed to change the EDG preventive maintenance inspection frequency to 24 months instead of every 18 months.

Also, a Configuration Risk Management Program was proposed to support risk-informed Technical Specifications. In a June 2,1998, telephone conference call, the staff requested additional information pertaining to the plant's Probabilistic Safety Assessment (PSA),

current EDG reliability, and procedural controls for planned entries into the extended EDG outage. The licensee provided the requested information in a June 25,1998, letter.

The Electrical Engineering Branch (EELB), with support from the Probabilistic Safety i

Assessment Branch (SPSB), has reviewed the requested changes and finds them acceptable as discussed in the following evaluation.

9808310022 900826 l

PDR ADOCK 05000338 l

P PM l

l

9 e

2

2.0 BACKGROUND

Each North Anna unit has two separate and redundant safety-related alternating current (ac) electrical trains. Each train consists of a 4160 v switchgear, two 480 v load centers and various 480 v motor control centers and is normally powered from the offsite power systems via one of three separate reserve station service transformers and associated transfer bus.

Upon loss of the normal offsite source, each train is powered from its sepsrate EDG. Two additional sources of offsite power are available to specific individual emergency buses in Unit 1 under limited conditions.

In addition, a fifth diesel generator was recently installed to comply with 10 CFR 50.63, the station blackout rule. This alternate ac diesel generator (AAC DG) has a capacity that exceeds the capacity of an EDG. The AAC DG starts automatically following a loss-of-offsite power and can tnen be manually connected to any one of the four emergency buses by breaker alignment.

3.0 PROPOSED TECHNICAL SPECIFICATION CHANGES The licensee has proposed the following specific changes to the plants' Technical Specifications:

I Chanae 1: On Page 1-3 under Definition 1.12, add " emergency" before " diesel generator" in the last sentence.

Chanae 2: On Page 3/4 8-1 under Specification 3.8.1.1.b, add " emergency" before and

"(EDGs)" following " diesel generators".

l Chanae 3: On Page 3/4 8-1 under Action b. delete:

With one diesel generator of 3.8.1.1.b inoperable, demonstrate the OPERABILITY of the A.C. offsite power sources by performing Surveillance Requirement 4.8.1.1.1.a within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and at least once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter.

If the EDG became inoperable due to any cause other than an inoperable support system, an independently testable component, or preplanned preventive maintenance or testing, demonstrate the OPERABILITY of the remaining OPERABLE EDG by performing Surveillance Requirement 4.8.1.1.2.a.4 within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />', unless the absence of any potential common mode failure for the remaining diesel generator is demonstrated. Restore the diesel generator to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in at least HOT STANDBY within the next C hours and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

L

b 3-and substitute:

(Risk-informed) With one EDG of 3.8.1.1.b inoperable, demonstrate the OPERABILITY of the ofisite A.C. power sources by performing Surveillance Requirement 4.8.1.1.1.a within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and at least once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter.

li the EDG is inoperable due to any cause other than an inoperable support system, an independently testable component, or preplanned preventive maintenance or testing, demonstrate the OPERABILITY of the remaining I

OPERABLE EDG by performing Surveillance Requirement 4.8.1.1.?.a.4 within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> *, unless the absence of any potential common mode failure for the

-l remaining EDG is demonstrated. Restore the EDG to OPERABLE status within 14 days if the AAC DG and the opposite unit's EDGs are OPERABLE or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. In addition:

1 1.

If one or more of the three diesel generators (i.e., AAC DG or opposite 1

unit's EDGs) required ?cr entry into the 14-day action statement is (are) inoperable at the stari of de 14-day action statement, restore the diesel generator (s) to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in at least HOT

' STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD SHUTDOWN within the next following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

2.

If one or more of the three diesel generators (i.e., AAC DG or opposite unit's EDGs) required for entry into the 14-day action statement become(s) inoperable during the 14-day action statement, restore the diesel generator (s) to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD SHUTDOWN within the next following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

Chance 4: in Specification 3.8.1.1 under the action statements substitute "EDG" or "EDGs" for " diesel generator" or " diesel generators", respectively, wherever they occur.

Chance 5: On Page 3/4 8-3 under Surveillance Requirement 4.8.1.1.2, add " emergency" before and "(EDG)" following " diesel generator."

Change 6 in Surveillance Requirements 4.8.1.1.2.a through e, substitute "EDG" or "EDGs"

(

for " diesel generator" or " diesel generators", respectively, wherever they occur.

Chance 7: In Surveillance Requirement 4.8.1.1.2.c, substitute "EDG" for " generator" in the l

third sentence.

a

f A'

4 Chance 8: Delete Surveillance Requirement 4.8.1.1.2.d.1: " Subjecting the diesel to an inspection in accordance with procedures prepared in conjunction with its manufacturer's recommendations for this class of standby service."

Chance 9: Renumber individual surveillance requirements under Surveillance Requirement i

4.8.1.1.2.d as a result of Change 8.

Chance 10:

Under renumbered Surveillance Requirement 4.8.1.1.2.d.3.b and 4.8.1.1.2.d.5.b, substitute "EDG" for " diesel" in their first sentences.

1 Chance 11:

Add the following footnote to Page 3/4 8-3b of Unit i Technical

)

Specifications:

{

(

This band is meant as guidance to avoid routine overloading of the

{

engine. Loads in excess of this band for special testing under ditect monitoring of the manufacturer or momentary variations due to changing i

bus loads shall not invalidate the test.

Chance 12:

Under renumbered Surveillance Requirement 4.8.1.1.2.d.8.a, substitute "EDG" for " generator" Chance 13:

Add the following as new Surveillance Requirement 4.8.1-.1.2.f:

At least once per 24 months during any mode of operation, by subjecting each EDG to a preventive maintenance inspection in accordance with maintenance procedures appropriate for diesels used for this class of standby service.

Chance 14:

Under Surveillance Requirement 4.8.1.1.3, add " emergency" before

" diesel generator".

Chance 15:

In the title and the first sentence of Footnote

• of Table 4.8-2, add

" emergency" before " diesel generator".

Chance 16:

In the first sentence of the second paragraph in Footnote

• to Table 4.8-2 in Unit 'l Technical Specifications, substitute " overhaul" for "overhal".

Chance 17:

Under Surveillance Requirement 4.8.1.1.4, substitute "EDG" for " diesel generator".

Chance 18:

Under Specification 3.8.1.2.b add " emergency" before " diesel generator".

Chance 19:

On Page B 3/4 0-2 la the third paragraph under 3.0.5, delete "a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />" and substitute "an".

l

a.

L 4'.

1 Chahoe 20:

In the second sentence of the first paragraph under Bases 3/4.1.2, add

{

" emergency" before " diesel generators".

l Chance 21:

Under Bases 3/4.8.1 and 3/4.8.2 add the follow'ag new paragraphs:

Entering the 14-day EDG action statement during power operation has i

been shown to result in a small increase in the core damage frequency, 1

providing the A ternate A.C. diesel generator (AAC DG) is OPERABLE and the opposite unit's EDGs are both OPERABLE. A Configuration Risk Management Program (CRMP) defined in Administrative Control Section 6.8.4.g is implemented to evaluate risk associated with the EDG outage.

The EDG and AAC DG annual unavailability is limited by the Maintenance Rule Program.

l When one or more of the diesel generators (i.e., AAC DG or opposite unit's EDGs) required to enter the 14 day action statement is inoperable l

or becomes inoperable during the fourteen day action statement of the j

affected EDG, a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> action statement is entered. If the three diesel i

generators (i.e., AAC DG or opposite unit's EDGs) required to support f

entry into the fourteen day action statement are restored to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, the remainder of the 14 day action statement can be used. Restoring the affected EDG to service removes the conditional OPERABILITY requirements for the AAC DG and the opposite unit's I

EDGs.

I The operability requirements for the AAC DG are specified in the j

Technical Requirements Manual (TRM). The TRM is located in the UFSAR and is subject to 10 CFR 50.59. In addition, to be considered OPERABLE to support the fourteen day action statement the AAC DG l

must be capable of providing power to the affected bus (i.e., connectable to the bus with the associated breakers and control power available). If the AAC DG becomes inoperable during the 14 day action statement, the OPEP. ABILITY of the remaining EDGs does not need to be demonstrated since the AAC DG was designed and purchased according to specifications which adequately ensure that common cause failure is not likely.

Chance 22:

In Bases 3/4.8.1 and 3/4.8.2 under the paragraph that discusses Regulatory Guide 1.9, substitute " Emergency Diesel Generators" for

" diesel generators" in the first sentence.

$ Change 23 Add the following as new Section 6.r,.4.g:

g.

Configuration Risk Manmaament Proaram The Configuration Risk' Management Program (CRMP) provides a proceduralized risk-informed assessment to manage the risk associated with equipment inoperability. The program applies to technical specification structures, systems, or components for which a i

risk-informed allowed outage time has been granted. The program shall include the following elements:

1)

Previsions for the control and implementation of a Level 1, at power,

{

intemal events, PRA-Informed methodology. The assessment shall be capable of evaluating the applicable plant configuration.

2)

Provisions for performing an assessment prior to entering the LCO l

Action Statement for planned activities.

i 3)

Provisions for performing an assessment after entering the LCO Action Statement for unplanned entry into the LCO Action Statement.

4)

Provisions for assessing the need for additional actions after the discovery of additional equipment out of service conditions while in the LCO Action Statement.

5)

Provisions for considering other applicable risk significant contributors such as Level 2 issue and extemal events, qualitatively or quantitatively.

i Current risk-informed action statement include: Action 3.8.1.1.b.

4.0 EVALUATION All the above changes except Changes 3,8,13,21 and 23 are editorial and correct previous typographical errors, change terminology, result from new page spacing or specification renumbering due to added material related to other proposed changes, or are necessary to support the other proposed changes. On that basis they are therefore acceptable.

The staff evaluated the licensee's proposed Changes 3, S,13,21 and 23 using both

' deterministic analysis and probabilistic risk analysis (PRA) methods as documented below.

9

ef $

4 CHANGE 3 Change 3 includes some minor editorial changes and also is the major change which allows an EDG to be inoperable for up to 14 days in any mode of plant operation. Currently, the Technical Specifications allow an outage of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for one inoperable EDG.

The ac electrical power for essential and nonessential service in a nuclear power plant is supplied primarily by offsite power. Redundant onsite emergency ac power systems are also provided in the event that all offsite power sources are lost. These systems provide power for the various safety functiors, including reactor core decay heat removal and containment heat removal, which are essential for preserving the integrity of the reactor core and containment building, respectively. The reactor core decay heat can also be removed for a l(mited period of time by safety systems that are independent of ac power.

In evaluating the licensee's request to extend the allowed out-of-service time (AOT) for onsite emergency ac power sources, the staff reviewed the request to determine if the decrease in severe accident risk achieved with the issuance of 10 CFR 50.63 (Station Blackout Rule) is not being eroded. The staff also evaluated the request to ensure that the overall av6fability of the onsite ac power systems will not be reduced significantly as a result of increased online preventive maintenance activities. In order to determine that the decrease in severe accident risk achieved with the issuance of 10 CFR 50.63 is not eroded, the staff used review guidelines identified below to evaluate the proposal to extend the AOTs for onsite emergency power sources. These guidelines are based on engineering i

. judgment and it is the staff's view that conformance with these guidelines will ensure that a licensee is not significantly increasing the likelihood of a station blackout (SBO) event and ths risk of a core damage accident by performing increased maintenance on the EDGs

]

during power operations. The reasoning implicit in the review gpidelines is that if the i

licensee has an excess and diverse power source available to cope with a loss of offsite power event (e.g., AAC DG with adequate capacity) and this power source can be temporarily used to compensate for an onsite emergency power source that is out-of-service without significantly increasing the likelihood of an SBO eveM. the under cedain controlled conditions it is acceptable to extend the AOT and to perform increased online 1

maintenance intended to improve the overall reliability of the onsite emergency power systems.

- The staff formally communicated to the licensee the review guidelines for the EDG AOT extension in a request for additional information dated April 2,1996. The licensee's responses were provided in a letter dated April 8,1996, and are summarized (and updated for subsequent revisions to the requested changes) for each guideline / question as follows:

\\

l l

o e

l

. 1.

Provide the current calculated total core damage frequency (CDF) resulting from all PSA' sequences involving SBO. Also provide the calculated total CDF from all SBO sequences after accounting for the increase in EDG unavailability due to the extended allowed outage time requested. Provide the iristantaneous change in the CDF value for the worst-case plant configuration allowed under the proposed Specification 3.8.1.1.b.2.

The licensee stated that the SBO contribution to the CDF for North Anna Unit 1 was i

calculated to be 1.2E-5 per year without the AAC DG credited. The calculated CDF for

{

SBO sequences was reduced to 5.9E-6 per year with the addition of the AAC DG.

l This would be increased slightly to 6.5E-6 per year when accounting for the increased EDG unavailability due to the extended AOT requested.

The licensee performed sensitivity studies to estimate the configuration risk assuming different EDGs were inoperable for the extended outage time. The instantaneous change in CDF for the worst-case plant configuration allowed during the maintenance was calculated to be 1.5E-5 per year when one EDG is inoperable and 1.4E-4 per year when one EDG and the AAC DG are both inoperable.

Based on these determinations performed by the licensee, the staff finds that the increase in CDF is small and that the overall SBO risk for the plant will remain small even with the added EDG unavailability due to the extended AOT requested.

2.

Provide the values for the EDG reliability and availability used in the PSA analysis to calculate the SBO CDF values requested in Question 1 above. Discuss these values in relationship to any goals associated with the implementation of the maintenance rule and in comparison to actual past performance of the EDGs at the plant. Also compare the values used in the PSA analysis to the target values committed to for SBO.

The licensee stated that SBO base cases utilized an EDG test and maintenance unavailability of 4.1 days per year. This was increased to 13.4 days per year to account for the EDG extended AOT. These then correspond to EDG availability of 0.989 and 0.963 for the base case and the extended outage case. The licensee also stated that an AAC DG maintenance unavailability of 17.3 days per year was utilized in the calculations. This corresponds to an AAC DG availability of 0.953.

The licensee's maintenance rule program unavailability performance criterion for the EDGs and AAC DG is set based on a combination of maintenance unavailability used in current PSA analyses and anticipated online maintenance requirements. The

'In this Safety Evaluation, probabilistic safety assessment (PSA) and probabilistic risk assessment (PRA) are understood to have the same meaning.

l i

5

.g.

licensee's current maintenance rule goalis 0.984 for the plant's EDGs and AAC DG.

Actual EDG and AAC DG performance during 1995 resulted in an availability of 0.995.

The EDG reliability assumed in the PSA calculations was 0.986 corresponding to a failure-to-start probability of 1.43E-2. The AAC DG reliability utilized was 0.976 corresponding to a failure-to-start probability of 2.41E-2. The current maintenance rule reliability goal for all diesels is 0.990. The plant's SBO commitment for diesel reliability is 0.95. The 1995 diesel reliability was 1.000 since there have been no failures in the past.100 start attempts.

Based on the above, the staff finds that the reliability values used in the PSA analyses are higher than the SBO commitment but slightly lower than the current maintenance rule target. Also the unavailability used for the base case is slightly higher than the maintenance rule goal while the unavailability used for the PSA calculations for the extended outage case is below the maintenance rule goal. The licensee will need to monitor the actual EDG and AAC DG reliability / availability to periodically evaluate the effect of the extended outage upon plant performance in relationship to the maintenance goals and SBO target values.

3.

The proposed 14-day AOT requires that the AAC DG be operable. Bases 3/4.8.1 and 3/4.8.2 state that operability of the AAC DG is defined in administrative!y controlled station documents. Discuss how the AAC DG is verified to be operable including verification that it can be connected to the safety bus associated with the EDG undergoing the extended maintenance.

The licensee stated that the AAC DG operability requirements will be located in the North Anna Power Station Technical Requirements Manual. Operability testing for the AAC DG will verify that:

its support systems are operable.

The AAC DG can start and accelerate to 60i1.2 Hz and 4300i100 volts.

The AAC DG can be synchronized and loaded onto the 37 ficable safety bus to an indicated 3250-3350 kW and can be operated for at least 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

The licensee further stated that the operabiHty testing associated with the extended EDG allowed outage time would include verification of the ability to connect the AAC DG to the applicable safety bus (via manual breaker alignments) ence per shift.

In a November 13,1996, request for additional information, the staff discussed a concern about the availability of the AAC source it its battery charger is not connected to an EDG powared bus during a loss-of-offsite power. In a November 18,1997, L

d

-.- response, the licensee stated that the battery charger is normally powere,d from an offsite source, is not powered from an EDG when offsite power is lost, but is powered from the AAC source itself when it is running and connected to its bus. This response prompted the staff to express, in a January 13,1998, telephone call, further concem about the availability of the AAC source and its support equipment and to request the licensee to review the plants' SBO design in relationship to information Notice 97-21,

" Availability of the Alternate AC Power Source Designed for Station Blackout Event,"

dated April 18,1997.- In a followup telephone call on March 3,1998, the licensee stated that the AAC DG would be automatically started on a loss-of-offsite power and would energize its own support loads and thus be available for a subsequent SBO event. Based on this informdion, the staff considered their concem resolved.

4.

Additional vulnerability may be created during the extended outage time for an EDG.

Discuss how systems, subsystems, trains, components, an'd devices that depend on the remaining EDG as a source of onsite power are verified to be operable before removing an EDG for extended maintenance. Discuss what positive measures will be tcken to preclude subsequent testing or maintenance activities on these systems, subsystems, trains, components, and devices while an EDG is inoperable. This discussion should include consideration of degraded or inoperable balance-of-plant equipment.

The licensee's response stated that the plant's safety philosophy does not permit maintenance to be planned or perfcrmed concurrently on multiple risk-significant equipment unless the risk is shown to be acceptable for the outage duration. The status of all systems, subsystems, trains, components, and devices that may affect equipment operability is tracked on a computer network. Before maintenance is performed it is verified that the proposed configuration is not prohibited by the Technical Specifications. Currently, the plant has administrative procedures that address control of maintenance and testing of risk-significant equipment while the unit is online utilizing operating judgment and PSA insight.

The licensee also stated that Technical Specification 3.0.5 limits the configuration risk when an EDG is undergoing the extended maintenance by requiring all equipment powered from the emergency bus casociated with the inoperable EDG to be treated as inoperable if the redundant train of safety-related equipment becomes inoporable.

Under those conditions Technical Specification 3.0.5 requires that the urat cease power operation within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> which minimizes the time that the plant is in any potentially high risk configuration.

i in addition, the licensee proposed, in a March 25,1998, letter, a Con 5guration Risk Management Program to support risk-informed Technicc! Specifications (see Change 23 evaluation below).

l

.- 5; The originalintent of the extended AOT was for conducting an extended preventive maintenance on the EDGs. The condition of offsite sources of electrical power prior to and during the extended EDG outage time has additionalimportance. Discuss what considerations should be given to not performing the extended maintenance when the offsite grid condition or configuration is degraded or when adverse / extreme weather conditions (e.g., high winds, lightning, icing conditions) are expected. Discuss how planning of the extended EDG maintenance should consider the time needed to complete the extended EDG maintenance and the ability to accurately forecast weather conditions that are expected to occur during the maintenance. Discuss what, if any, contingency plans should be developed to restore the inoperable EDG in the event of unanticipated adverse weather or degraded grid conditions occurring which can significantly increase the probability of losing offsite electrical power.

The licensee stated that the plant's philosophy does not allow maintenance to be planned or performed on risk-significant equipment when the offsite grid condition or coriguration is degraded or when adverse weather conditions are expected.

Cuuantly, maintenance activities on risk-significant equipment are prevented by administrative controls during periods of electrical system instabilities. These controls also address possible complications due to weather or other extemal events that may affect electrical system or plant operational stability.

Specifically, the staff notes that Administrative Procedure VPAP-2001, " Station Planning and Scheduling," requires that "If...the risk of loss of off-site power is significantly increased due to.. environmental activity, those systems used to mitigate a loss of off-site power...should be maintained or retumed to an available status as soon ac practical." This requirement precludes AOT entry during severe weather.

I in addition to the above controls for equipment maintenance and testing, additional procedural controls are being established. A license condition (Appendix C), will require the licensee to implement a procedure, prior to use of the EDG AOT, that will prohibit entry into an extended EDG AOT (14 days) for scheduled maintenance l

purposes if severe weather conditions are expected. That procedure, as described in l

the licensee's supplemental application dated June 25,1998, will require:

i that the extended weather forecast is reviewed to verify that severe weather is not predicted during the planned allowed outage time, and l

prohibit entry into the extended (14-day) AOT for the EDG if severe weather E

conditions are predicted onsite during the duration of the AOT.

l To aid the procedural controls, the plant has computer link access to the licensee's meteorological department for rest time display in the control room of local and l

national weather conditions and forecasts from the National Weather Service and any 1

L_____________._

Q c.

I severe weather wamings are relayed directly to the plant. Tropical storms or hurricanes are also tracked.

For long term developing adverse weather conditions that could affect stable operation, actions will be taken to restore the EDG undergoing extended maintenance to operable status as soon as practicable. For rapidly developing adverse weather conditions, such as a sware thunderstorm, tomado watch, or high wind /tomado wamings, abnormal operating procedures are available to direct compensatory actions to minimize the impact of such adverse conditions.

In addition to the above deterministic analysis to evaluate Change 3, the staff also used a three-tiered PRA-based approach; as discussed in Regulatory Guide (RG) 1.177, "An Approach for Plant-Specific, Risk-Informed Decision making: Technical Specifications;" to evaluate the risk associated with the proposed license amendment. The first tier evaluated the PRA model and the impact of the change on plant operational risk. The second tier addressed the need to preclude potentially high-risk configurations, should additional equipment outages occur during the AOT period. The third tier evaluated the licensee's CRMP to ensure that equipment removed from service prior to entering or during the proposed AOT will be appropriately assessed from a risk perspective.

Tier 1: PRA Evaluation of AOT Extensions The licensee used traditional PRA methodology to evaluate the requested AOT extension for EDGs. The Tier i NRC staff review of the licensee's PRA involved two aspects:

(1) evaluation of the PRA model and application to the proposed AOT extension, and (ii) evaluation of PRA results and insights stemming from the application. The review did not warrant an assessment of any unconventional PRA practices or unique features that could significantly impact the PRA findings and conclusions.

(l)

Evaluation of PRA Model and Application to the AOT Extension The licensee's PRA models were initially developed in response to a request for the

. licensee-performed Individual Plant Examination (IPE) in Generic Letter 88-20. The licensee performed a detailed peer review in support of triis work. The peer review used outside contractors and station personnel to review the IPE results. Both the Level I and Level 11 models were reviewed. Later, the licensee performed an additional PRA quality review as~ part of the Surry risk-informed in Service Testing (IST) pilot project. For this review, the Surry PRA model attributes were compared against the requirements presented in Appendix C of the PRA Applications Guide prepared by the l.

Electric Power Research Institute (EPRI). The most recent extemal review was performed by the expert panel during the development of the maintenance rule program.

)!-

1

__..______________._m_______

,.e-

.. butine PRA quality is ensured using the same processes established to comply with 10 CFR 50, Appendix C. The licensee's Nuclear Design Control Program (NDCP) is designed to maintain quality work processes and to ensure that the requirements of Appendix C are met. PRA calculations and evaluations are performed in accordance with the NDCP similar to other engineering work.

A focused staff audit of PRA accident sequences and cut sets did not indicate any-irregularities. The staff's audit did not indicate any aspects of the accident initiation and progression analysis that would alter the licensee's CDF or large early release frequency calculation results.

For the AOT extension, the staffs review focused on the capability of the !icensee's PRA model to analyze the risk stemming from the proposed AOT changes for EDGs and did not involve an in-depth review of the licensee's PRA. This review was based on the staff's initial screening process'where the staff examined the licensee's internal events PRA results; recent operational experience regarding loss-of-offsite power (LOOP) and EDG reliability and availability; and plant-specific features such as EDG configurations, offsite sources, and other systems critical to mitigation of a LOOP power event. The staff concludes that the licensee's PRA results are reasonable, and the scope and depth of the PRA analysis support such a finding. Recent data for EDG and offsite ac power reliability and availability did not indicate any adverse trends. The EDGs and AAC DG are each fully capable of safely shutting down the plant given a LOOP.

The licensee's PRA includes both a Level 1 and modified Level 2 analysis and makes extensive use of the PRA performed for Surry (similar in design to North Anna). North Anna Units 1 and 2 used a Level 1 PRA for front-end analysis. A small event tree /large fault tree technique with fault tree linking was used with quantification performed with the NUPRA computer code. The analysis modeled 17 initiating events and dependencies that exist between initiating events and the associated mitigating systems. These initiators are consistent with those identified in previous PRAs. The licensee used both generic and plant-specific data. Generic data sources and plant-specific data were incorporated into the model by updating generic data using Bayesian techniques. The licensee plans regular updates of the PRA which would include the use

(

of an updated database and changes to fault tree models reflecting modifications made

'since the original PRA.

Since the common cause failure (CCF) of EDGs is potentially a dominant contributor to L

the plani SBO risk, the staff examined this licensee's CCF analysis. Essentially, industry experience and plant-specific data are analyzed to create a failure database, with the industry events re-interpreted (mapping down) to the target plant (North Anna). The results of the data analysis are then applied with the Basic Parameter Model of NUREG/CR-4780, " Procedures for Treating Common Cause Failures in Safety and l-

o

.. Reliability Studies." The final North Anna IPE EDG CCF model includes six dual CCF basic events (e.g., EDGs 1H and 1J), four triple CCF events (e.g., EDGs 1H,1J and 2H) and one quadruple CCF basic event (EDG's 1H,1J,2H and 2J).

The North Anna Power Station EDG CCF rnodel has been conservatively. simplified to include two dual CCF basic events (EDGs 1H and 1J, and EDGs 2H and 2J) and one CCF basic event subsuming the remaining four dual, four triple and one quadruple CCF basic events. The two dual CCF basic events maintain their original quantification from the IPE NUREG/CR-4780 approach. The final CCF conservatively combines the remaining CCF fault exposures through a simple summation of the fault probabilities.

The staff finds this acceptable.

1 (ii) Evaluation of PRA Results and Insights The staff estimates that, with the licensee-fumished annual average CDF associated f

with the proposed 14-day AOT of 3.56E-05/yr., an approximate A CDF is 6E-07/yr.

l which is within the guidelines in RG 1.174, "An Approach for Using Probabilistic Risk j

Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Current

{

Licensing Basis."

The baseline large early release frequency (LERF) calculated by the licensee is I

4.66E-06/yr., and that for the proposed 14-day AOT is 4.68E-06/yr. The A LERF of 2E-08/yr. is also within the above guidelines in RG 1.177.

The incremental conditional core damage probability (ICCDP) calculated by the staff, from licensee-fumished information, is 5.9E-07, which is very close to the staff guideline value of SE-07.

The licensee has also demonstrated that, with a slightly higher peak, the probability density function'of the CDF for a 14-day AOT is essentially coincident with that for a 3-l day AOT. The incremental conditional large early release probability was calculated to be 8.6E-09, also within that published (SE-08) in approved RG 1.177.

Based on the preceding Tier 1 review and the related information presented, the staff concludes that the PRA model used for the proposed AOT extension for a single inoperable EDG is considered to be reasonable, and the risk impact of the change is small and suppcrts the AOT extension.

' Tier 2: Avoidance of Risk-Significant Plant Configurations

(

As required by License condition (Appendix C), the licensee will implement a procedure that will prohibit entry into an extended EDG AOT (14 days) for scheduled maintenance 1

l

o

.,. purposes if severe weather conditions are expected as described in the licensee's supplemental application dated June 25,1998.

The licensee has also proposed TS Action b. under 3.8.1.1 as a limiting condition for operation should one or more of the other three diesel generators become inoperable at the start of or during the extended EDG AOT.

The staff has concluded that these restrictions are necessary to preclude high-risk situations associated with having one EDG inoperable for greater than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Tier 3: Risk-Informed Plant Configuration Management The licensee has provided reasonable assurance that risk-significant plant equipment outage configurations will not occur while the plant is subjected to the extended EDG AOT.

The licenses utilizes its online maintenance configuration matrix to provide planning and scheduling strategies to maximize equipment performance, reliability, and availability during

- the proposed EDG extended AOT. This process will be incorporated as part of the proposed CRMP.

The Configuration Matrix may be used as a tool for risk-informed maintenance during operating modes 1 and 2. The risk information is only based on the functional equipment groups (FEGs) included in each configuration plus one additional FEG being unavailable. It is assu.1ed that all other risk-significant FEGs are operable. It is recommended that defense-in-depth be maintained for all low-risk-significant FEGs which can be used to mitigate core damage or offsite release. Defense-in-depth means that no more than one in a redundant series or equipment is removed from service (i.e., one out of four channels, or one out of three trains).

The risk recommended allowed outage time for each configuration is intended only as a means to understand the relative instantaneous risk level during the maintenance configuration. Currently, cumulative maintenance risk is limited to an acceptable level by conformance to the Maintenance Rule unavailability performance criteria.

A configuration is a group of FEGs which are simultaneously out-of-service. When possible, each configuration is generalized to represent multiple possible combinations of similar FEGs. For example, a configuration may be "one CC heat exchanger, CC-E-1 A/B, and one charging pump, CH-P-1 A/B/C." This means that any one of four CC heat I

, exchangers is unavailable simultaneously with any one of six charging pumps. A conservative bounding risk analysis was actually performed utilizing the combination of any CC heat exchanger with any charging pump which will provide the worst-case risk.

l-

.l 4

4' 1 Based on the three-tiered approach, the staff finds the following:

The proposed EDG AOT modifications have only a minimal quantitative impact on plant o

risk. The calculeted ICCDP for a single EDG AOT is small, primarily because of the 3

redundancy in EDG configuration and the availability of the AAC DG.

J The lice'nses is required by license condition to implement a procedure that will prohibit e

entry into an extended EDG AOT for scheduled maintenance purposes if severe

.j weather conditions are expected The licensee also will have several compensatory measures and normal plant practices that help avoid potentially high-risk configurations during the proposW extended EDG AOT.

.The licensee has proposed a risk-informed plant CRMP (see Change 23 evaluation) to e

assess the risk associated with the removal of equipment from service during the extended EDG AOT. The program provides the necessary assurances that appropriate assessments of plant risk configurations using the maintenance configuration matrix, augmented by appropriate engineering judgment, are sufficient to support the proposed AOT extension request for EDGs.

On the basis of the information presented above, the staff finds Change 3 acceptable.

CHANGES 8 AND 13-I Change 8 is_necessary because that surveillance requirement is being replaced by new

~ Surveillance Requirement 4.8.1.1.2.f which is encompassed by Change 13 that allows the EDG extensive preventive maintenance to be performed at least once every 24 months in any mode of plant operation. This is in lieu of the current requirement that this maintenance be performed once every 18 months during shutdown. Change 8 and Change 13 are also related to Change 3 in that the new 14-day AOT in any mode of plant operation is long enough for performance of the extensive EDG maintenance such that performance during shutdown is no longer required. The added risk was evaluated in the PRA assessment for Change 3 and is acceptable on the same basis presented under Change 3. Additionally, allowing the EDG extensive preventive maintenance to be performed at least once in 24 months ;n lieu of once every 18 months has been endorsed by the EDG manufacturer,

' reduces EDG unavailability, and is acceptable on that basis.

CHANGE 21-

- The new paragraphs for the Bases under Change 21 provide a discussion of the conditions i

= associated with the new 14-day outage for preventive maintenance of an EDG which supports the proposed changes to the Technical Specifications. The discussion provides a i

' level of detail that is similar to other existing Bases discussions and is therefore considered j

acceptable.

I l

a

e

..o-

'I l

-1 "

CHANGE 23-

{

l Change 23 encompasses a new Configuration Risk Management Program which is intended to proceduralize risk-informed assessment to manage the risk associated with equipment inoperability, The program includes five elements and applies to technical specification structures, systems, or components for which a risk-informed allowed outage time has been granted.

The CRMP is acceptable in that the pr gram provides the necessary assurances that appropriate assessments of plant risk configurations using the equipment-out-of-service

- (EOOS) software (augmented by appropriate engineering judgment) are sufficient to support the proposed AOT extension request for EDGs.

In addition, the CRMP is used to assess changes in core damage frequency resulting from applicable plant configurations. The CRMP uses the maintenance configuration matrix, a tool that may be used to aid in the risk assessment of online maintenance and to evaluate the change in risk frc. a component failure. The equipment out-of-service risk monitor uses the plant probabilistic risk assessment model to evaluate the risk of removing equipment from service based on current plant configuration and equipment condition. The CRMP is used when an EDG is intentionally taken out of service for a planned activity, excluding short duration activities (e.g., performing an air roll on the EDG prior to a routine surveillance). In addition, the CRMP is used for unplanned maintenance or repairs of an EDG.

The licensee has committed to implementation of the CRMP which includes the following key elements:

Key Element 1. Implementation of CRMP The intent of the CRMP is to implement (a)(3) of the Maintenance Rule (10 CFR 50.65) with respect to online maintenance for risk-informed technical specifications, with the following additions and clarifications:

a.

The scope of the structures, systems and components (SSCs) to be included in the CRMP will be those SSCs modeled in the licensee's plant PRA in addition to those SSCs considered risk-significant in accordance with the North Anna Maintenance Rule Program that are not modeled in the PRA.

b.

The CRMP is PRA-informed and may be in the form of either a risk matrix, an online assessment, or a direct PRA assestment.

l i

r

. c.

CRMP will be invoked as follows for:

Risk-Informed inoperability: A risk assessment will be performed prior to e

entering the LCO for preplanned activities. For unplanned entry into the LCO, a risk assessment will be performed in accordance with plant procedures utilizing the maintenance configuration matrix augmented by appropriate engineering judgment.

Additional SSC Inoperability and/or Loss of Functionality: When in the e

risk-informed Completion Time, if an additional SSC within the scope of the CRMP becomes inoperable /non-functional, a risk assessment shall be performed in accordance with plant procedures.

d.

Tier 2 commitments apply for planned maintenance only, but will be evaluated as part of the Tier 3 assessment for unplanned occurrences.

Key Element 2. Control and Use of the CRMP Plant ' modifications and procedure changes will be monitored, assessed, and a.

dispositioned as part of the normal PRA update process:

Evaluation of changes in plant configuration or PRA model features can be e

dispositioned by implementing PRA model changes or by the qualitative assessment of the impact of the changes on the CRMP. This qualitative assessment recognizes that changes to the PRA take time to implement and that changes can be effectively compensated for without compromising the ability to make sound engineering judgments.

Limitations of the CRMP are identified and understood for each specific Completion Time extension.

- b.

Procedures exist for the control and application of CRMP, including description of the process when outside the scope of the CRMP.

Key Element 3. Level 1 Risk-informed Assessment l

The CRMP is based on a Level 1, at power, intemal events PRA model. The CRMP assessment may use any combination of quantitative and qualitative input. Quantitative assessments can include reference to a risk matrix, pre-existing calculations, or new PRA analyses.

a.

. Quantitative assessments should be performed whenever necessary for sound decision making.

L

v" e b.

When quantitative assessments are not necessary for sound decision making or are beyond the scope of the PRA model, qualitative assessments will be performed.

- Qualitative assessments will consider applicable, existing insights from quantitative assessments previously performed.

Kep Element 4. Level 2 lasues/Extemal Events External events and Level 2 issues are treated qualitatively and/or quantitatively.

On the basis of the information presented above, the staff finds Change 23 acceptable.

1 COMMITMENT NECESSARY TO SUPPORT ACCEPTABLE FINDING As noted above, the licensee stated that the AAC DG operability requirements will be

, located in the North Anna Power Station Technical Requirements Manual. Those requirements will encompass operability testing for the AAC DG associated with the extended EDG allowed outage time including the verification of the ability to connect the AAC DG to the applicable safety bus (via manual breaker alignments) once per shift. The staff finds the licensee's commitment for operabilty testing (including connectability) of the

. AAC DG prior to entry into the proposed 14-day AOT necessary to support an acceptable finding for the extended AOT in that it ensures the availability of the AAC DG. Future change to this commitment contained in the plants' Technical Requirements Manual is covered by 10 CFR 50.59, " Changes, Tests and Experiments." Also, the staff's acceptance of the 14-day AOT requires a condition to be added to the license prohibiting entry into the

. extended AOT if severe weather is expected.

5.0 STATE CONSULTATION

in accordance with the Commission's regulations, the Virginia State official was notified of the proposed issuance of the amendments. The State official had no comment.

6.0 ENVIRONMENTAL CONSIDERATION

. These amendments change a requirement with respect to installation or use of a facility component located within the restricted area as defined in 10 CFR Part 20 and change surventance requirements. The NRC staff has determined that the amendments involve no significant increase in the amounts, and no significant change in the types, of any effinnt that may be released offsite, and that there is no significant increase in individual or l

cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that these amendments involve no significant hazards consideration and there has been no public comment on such finding (63 FR 33110, which superseded an earlier finding,60 FR 49949). Accordingly, these amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9). Pursuant to 10 CFR 51.22(b) no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

u-_ __ - - - - - - - - _ - -..

ja*

e

7.0 CONCLUSION

Based on the preceding discussions, the staff finds that the proposed changes to the TS to increase the EDG AOT during power operation from 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to 14 days for any reason, once every 24 months, are acceptable to the staff assuming adequate compensatory measures are in place. The compensatory measures include requirements that the other EDGs, off-site power supply, and the AAC DG be operable and the licensee implements a procedure that will prohibit entry into an extended EDG Outage Time of 14 days, for scheduled maintenance purposes, if severe weather conditions are expected, The average CDF associated with the proposed change has been estimated to be 3.56E-05 per year or an increase of approximately 6E-07 per year and is within the guidelines in RG 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Current Licensing Basis."

The Commission has concluded, based on the considerations discussed above, that:

(1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributors:

F. Burrows M. Wohl Date: August 26, 1998 i

i I

1 1