ML20247M770

Safety Evaluation Supporting Amends 100 & 78 to Licenses NPF-68 & NPF-81,respectively

ML20247M770
Person / Time
Site:	Vogtle
Issue date:	05/20/1998
From:	NRC (Affiliation Not Assigned)
To:
Shared Package
ML20247M757	List: ML20247M751 ML20247M770
References
FACA, NUDOCS 9805260372
Download: ML20247M770 (17)

Text

gas:g y

'a UNITED STATES g

j NUCLEAR REGULATORY COMMISSION g

(

WASHINGTON, D.C. 30e06-0001 k.....

SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO.100 TO FACILITY OPERATING LICENSE NPF-68 AND AMENDMENT NO. 78 TO FACILITY OPERATING LICENSE NPF-81 EQLITHERN NUCLEAR OPERATING COMPANY. INC.. ET AL.

f l

VOGTLE ELECTRIC GENERATING PLANT. UNITS 1 AND 2 j

DOCKET NOS. 50-424 AND 50-425

1.0 INTRODUCTION

By application dated January 22,1998, as supplemented by letters dated March 18,1998, April 21,1998, and May 15,1998, Southem Nuclear Operating Company, Inc. (the licensee) proposed a change to the Technical Specifications (TSs) for the Vogtle Electric Generating Plant (VEGP), Units 1 and 2. The TS change would allow an extended allowed outage time (AOT) for one emergency diesel generator (EDG) of 14 days. The EDG AOT extension, in part, is based on the availability and reliability of the Plant Wilson Combustion Turbine (CT) Facility, the Wilson Line, and the Vogtle Standby Auxiliary Transformer (SAT). The January 22 application supersedes a similar proposal that was to have been a part of the implementation of the improved Standard TSs (Amendment Nos. 96 and 74 for VEGP, Units 1 and 2, respectively), but was not acted upon by the NRC staff as addressed in our letter dated September 25,1996. The supplements dated March 18,1998, April 21,1998, and May 15, 1998, provided clarifying information that did not change the scope of the January 22,1998, application and the initial proposed no significant hazards determination.

2.0 BACKGROUND

Since the mid-1980s, the NRC has been reviewing and granting improvements to TS that are based, at least in part, on probabilistic risk assessment (PRA) insights. In its final policy statement on TS improvements of July 22,1993, the NRC, stated that it...

... expects that licensees, in preparing their Technical Specification related submittals, will utilize any plant-specific PSA [probabilistic safety assessment]' or risk survey and any available literature on risk insights and PSAs.... Similarly, the NRC staff will also employ risk insights and PSAs in evaluating Technical Specifications related submittals. Further, as a part of the Commission's ongoing program of improving Technical Specifications, it will continue to consider methods to make better use of risk and reliability information for defining future generic Technical Specification requirements.

I

'PSA and PRA are used interchangeably herein.

9805260372 990520 PDR ADOCK 05000424 P

PDR

I l

! The NRC reiterated this point when it issued the revicion to 10 CFR 50.36, " Technical '

Specifier hons," in July 1995. In August 1995, the NRC adopted a final policy statement on the use of P % methods in nuclear regulatory activities that encouraged greater use of PRA to improve safety decisionmaking and regulatory efficiency. The PRA policy statement included the following points:

1.

The use of PRA technology should be increased in all regulatory matters to the extent supported by the state of the art in PRA methods and data and in a manner that complements the NRC's deterministic approach and supports the NRC's traditional defense-in-depth philosophy.

2.

PRA and associated analyses (e.g., sensitivity studies, unt ^5ty analyses, and importance measures) should be used in regulatory matters, wnere practical within the bounds of the state of the art, to reduce unnecessary conservatism associated with j

current regulatory requirements.

3.

PRA evaluations in support of regulatory decisions should be as realistic as practicable and appropriate supporting data should be publicly available for review.

On June 25,1997, the Commission published draft regulatory guidance for making risk-l informed changes to technical specifications (62 FR 34321) in DG-1061, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Current Licensing Basis," and DG-1065, "An Approach for Plant-Specific Risk-Informed Decisionmaking: Technical Specifications." These documents were revised based on public comments and forwarded to the Commission for approval. Publication of these Regulatory Guides in final form is expected in mid to late 1998. The staff has used the guidance documents in its review of the proposed TS change:

Previously at VEGP, the two required offsite power source circuits were connected to the onsite Class 1E distribution system solely through their respective reserve auxiliary transformers (RATS). Subsequently, the licensee installed an SAT as a new additional power source that can be connected to the onsite Class 1E distribution system independently of the RATS, and can be utilized to meet the TS requirements for an offsite circuit. The SAT is supplied power l

through direct buried cable from either the 230 kV Southem Electric System Grid or from any l-combination of the Plant Wilson's six,60 MVA CT electrical generators, two of which have l

enhanced black start capability (can be started without offsite power). The black start capability for the two Plant Wilson cts is enabled by the black start diesel, also located at Plant Wilson, which supplies power for the CT starting motors. Both methods of supplying power to the SAT

- via the underground Wilson Line utilize the Plant Wilson 13.8 kV grid system. The SAT is a

" swing" or common offsite power circuit capable of connecting to any 4.16 kV Engineered Safety Features (ESF) bus on either unit. The 13.8 kV underground Wilson Line and SAT provide a new source of offsite power for VEGP that meets the capacity and capability requirements of 10 CFR Part 50 Appendix A, General Design Criterion 17 for one ESF bus.

In the January 22,1996, application, the licensee is requesting that the SAT raiso be considered as a temporary replacement for an EDG during extended EDG maintenance. The NRC staff has granted EDG AOTs in the past based on plants having a source of power that meets or

l d exceeda the requirements of an attemate ac power (AAC) source as established by Nuclear

- Management and Resource Council (NUMARC) 8700, Rev. O, " Guidelines and Technical Basis for NUMARC Initiative for Addressing Station Blackout (SBO) at Light Water Reactors," or NRC Regulatory Guide (RG) 1.155, " Station Blackout." The reasoning implicit to this special case is that, if a licensee has an excess and diverse power source available to cope with a loss of offsite power event, then this power source could be temporarily used to replace an EDG during extended maintenance. Subsequently, the staff has concluded that under certain controlled conditions it is acceptable to extend EDG AOTs to perform online maintenance to improve EDG reliability and availability.

3.0 EVALUATION The staff evaluated the licensee's proposed amendment to the TS using both traditional engineering analysis, PRA methods, and a review of operating experience. The staffs traditional analysis evaluated the capabilities of the plant to mitigate design basis and station blackout events with one EDG inoperable. The staff then used insights derived from the use of PRA methods to determine the risk significance of the proposed changes. The results of these evaluations were used in combination by the staff to determine the safety impact of extending the allowed outage time for one inoperable EDG.

The licensee is requesting an extension of the current EDG AOT from 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to 14 days for one inoperable EDG based on the reliability and availability of the Plant Wilson Facility, the SAT, and the Wilson Line. After preliminary review of this source of ac power, it was determined by the staff that VEGP warranted further consideration for an EDG AOT extension.

3.1 Equivalent AAC Source Presently, VEGP is meeting the "SBO Rule" by coping with de power only and would like to use its recently installed SAT, which receives power via the Plant Wilson Facility, to remove an EDG from service for up to 14 days for extended maintenance. Although this source of ac power was not explicitly credited as an AAC source as part of its SBO conformance, the staff has used the same guidance provided in NUMARC 8700, Rev. O, and NRC RG 1.155 to evaluate it as

" equivalent" to an AAC source. As a result of its review, the NRC staff imposed the following requirements on the Wilson Line and cts:

1.

The attemate source of ac power should not be normally connected to an offsite or onsite emergency ac power system.

2.

No single point of vulnerability should exist whereby a single weather-related event or single active failure could disable any portion of the onsite emergency ac power sources or the normal offsite power sources and simultaneously fail the attemate source of ac power. Also, there should be no common cause failure mechanism or component that increases the likelihood of a failure between the normal electrical distribution system and the AAG source.

3.

' This attemate source of ac power should be available in a timely manner and it should have provisions to be manually connected to one or all of the redundant safety buses as I

! required. The time required for starting and connecting the AAC source to the safety buses should not be more than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> as demonstrated by a test.

l 4.

This source of power should have sufficient capacity to operate the systems necessary to cope with an SBO event (i.e., loss of all ac power).

i 5.

This source of power should be inspected, maintained, and tested periodically to demonstrate operability and reliability. The reliability should be at least 95 percent.

in response to item 1, the licensee stated that power from Plant Wilson via the underground line will not be normally connected to the VEGP electrical distribution system. Plant Wilson is l

isolated from the VEGP electrical system and no common mode failure mechanism exists that could fail Plant Wilson and the electrical distribution system at VEGP. Plant Wilson is approximately 1 mile away from the VEGP switchyard and is connected to the SAT through the 13.8 kV Wilson Line. The SAT is located in the VEGP switchyard; however, the SAT is not normally interconnected with the VEGP electrical distribution system. Additionally, protective relaying on the SAT assures faults are isolated and alarmed.

In response to item 2, the licensee stated that Plant Wilson is a completely self-sufficient, independent generation facility. Plant Wilson has no common auxiliary power, fuel, equipment, or shared systems and/or components with VEGP. Consequently, there is no common cause mode failure mechanism that could simultaneously fail the offsite or onsite power system at l

VEGP and Plant Wilson. Additionally, protective relaying on both the RAT and SAT assures that faults are isolated and alarmed. If a fault were to occur on the normal alignment, the SAT -

could not be connected onto the faulted bus until the fault had been cleared. If failure occurred that rendered one preferred offsite power source (RAT) and the SAT unavailable for use on a l

train, another attemative is available whereby the unit's other RAT can be connected through an alternate 4.16 kV 1E safety bus tie breaker to provide offsite power to the safety bus.

The Wilson Line is protected from likely weather-related events such as a lightning and severe I

thunderstorms accompanied by high winds through the use of a direct buried cable. The L

structural integrity of the SAT cable bus work and disconnect switches can withstand these types of high winds. In accordance with standard licensee switchyard design, both Plant Wilson and VEGP's switchyard equipment and overhead lines follow the design requirements for light-to-medium loading as seen in National Electrical Safety Code, ANSI C2. Also, the distance that separates VEGP and Plant Wilson minimizes the likelihood of loose debris from VEGP, or the same weather-related event, causing Plant Wilson to be incapable of providing safe shutdown of VEGP. The underground connecting power feed from Plant Wilson and its associated transformer (SAT) share common disconnect switches, cable bas, and a 4.16 kV safety bus supply breaker with each of the VEGP preferred normal offsite power sources (RATS).

l However, it has been determined by the licensee that the only weather-related event, which j

could disable both the normal offsite power sources and remove all power routes from Plant Wilson, is a " direct strike" of an extremely severe tornado. It has been determined by the j

licensee that this is a very unlikely event based on the evaluation of tomado data reported in the VEGP area from the National Severe Storm Forecast Center between June 1951 and May 1993.

l I

L_______-_____________________--_____--

_ - - _ _ _ _ _ _. The cable bus located in the VEGP low voltage switchyard is designed for 40 years expected life, exposure to direct sunlight, a maximum normal ambient temperature of 40 degrees C, a i

maximum 24-hour average ambient temperature of 30 degrees C, and 120 mph winds. This cable bus is in a metal enclosed raceway except for the connections to the disconnect switches and the switchgear. The disconnect switches are designed for 60 mph winds, open-or-closed operation, 90 mph wind gusts, 80 mph winds, and 3.3 inches of snow or 1.5 inches of ice. The historical wind data recorded at the VEGP meteorological tower indicates the highest recorded wind speed at VEGP is 62 mph, which is within the design capabilities of the Wilson / SAT line and components.

As a precautionary measure, the licensee will consult extended weather forecasts prior to l

entering extended EDG AOTs. For the occurrence of a severe weather event such as a hurricane where it is not reasonable to foresee such an event for an extended period in advance, the licensee has in place administrative controls, which require the units to be placed in shutdown, to at least Mode 3, within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> prior to projected 74 mph sustained winds reaching the site. This additional measure will help to minimize the risk of having a severe weather-related event during an extended EDG AOT.

j In response to item 3, the licensee stated that Plant Wilson can provide power to the VEGP switchyard either via the 230 kV Southem Electric System Grid or through any of the six, l

60 MVA cts that make-up the Plant Wilson Facility. The Plant Wilson Facility is a completely self-sufficient electrical generating facility that can be connected to any of the 4.16 kV safety buses within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. There are six,60 MVA cts, any of which can power all the necessary safety loads during accident conditions. Two of the cts have black start capability, which will be tested and maintained at greater than or equal to 0.95 reliability. The VEGP staff has committed to demonstrate the complete enhanced black-start generation capability every 18 months. The appropriate operations personnel will be trained in the use of these procedures, I

and the procedures will be available to the appropriate operations personnel during the 14-day EDG AOT.

In response to item 4, the licensee stated that the SAT can be connected to any safety bus to provide shutdown capacity during loss-of-offsite power (LOOP) or accident conditions. The

{

SAT will receive power either from the 230 kV Southem Electric System Grid or by the cts in the Plant Wilson Facility.~ Only one of the s'x,60 MVA cts is required to power the necessary safety loads during accident conditions.

In response to item 5, the licensee stated that during the extended EDG AOT, the Wilson Line and SAT will be continuously energized via the 230 kV Southem Electric System Grid. As stated previously, if the 230 kV line is unavailable, Plant Wilson is equipped with two black start cts, either of which has the capacity to power the required loads during accident conditions.

Additionally, the licensee has made a commitment to maintain the reliability of the black start i

cts greater than or equal to 0.95. The initial reliability is based on a minimum of 20 tests on i

each black start CT and appropriate support systems. Quarterly testirig will be performed to assure that the required reliability is being maintained. If the reliability of the cts cannot be maintained, the licensee reserves the option of starting and running any CT during the extended EDG AOT.

---

l 3.2 AOT Extension in considering an EDG AOT extension from 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to 14 days for one EDG inoperable at VEGP, the staff requested that the licensee propose the following conditions:

' 1.

The TSs should include verification that the required systems, subsystems, trains, components, and devices that depend on the remaining diesel generators as a source of emergency power are operable before removing an EDG from service for preventative maintenance (PM). In addition, positive measures should be provided to preclude subsequent testing or maintenance activities on these systems, subsystems, trains, components, and devices while an EDG is inoperable.

2.

' The TS should contain requirements to demonstrate, before taking an EDG out for an extended period, that the AAC power source or equivalent power source is functional by demonstrating that this source of power starts and reaches the required voltage and frequency.

L 3.

Voluntary entry into the EDG AOT limiting condition for operation (LCO) action i

statement should not be abused by repeated entry into and exit from the LCO.

4.

. Removal from service of safety systems and important nonsafety equipment, including offsite power sources, should be avoided during the EDG AOT.

5.

Any component testing or maintenance that increases the likelihood of a plant transient should be avoided; plant operation should be stable during the EDG AOT.

6.

Entry into an LCO for extended maintenance activities on the EDG should not be scheduled when adverse weather conditions are expected.

In response to Condition 1, the licensee stated that the TSs and administrative controls will ensure that a review will be conducted to verify that the required systems, subsystems, trains, components, and devices that depend on the remaining diesel generators as a source of emergency power are operable before removing an EDG for PM. Additionally, administrative controls will preclude subsequent testing or maintenance activities on required systems, subsystems, trains, components, and devices that depend on the remaining diesel generators as a source of emergency power.

In response to Condition 2, the licensee stated the changes to the TSs will include verifying that the SAT, Wilson Line, and a black start CT (including support systems) are available and functional within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> before an EDG is removed from service for extended maintenance.

In response to Condition 3, the licensee stated that e'ntry into the 14-day LCO is for the purpose of performing preventative maintenance on the EDGs. The completion of EDG maintenance during power operation provides a critical benefit of reducing the need to remove EDGs from service during shutdown conditions. The proposed 14-day LCO, is of sufficient duration to allow completion of the required maintenance without repetative entry into, and exit from, the LCO.

In response to Condition 4, the licensee stated that administrative controls will be implemented to avoid removing safety systems and important nonsafety equipment from service during the extended EDG AOT. Additionally, offsite power sources (RATS) will not be removed from service during the EDG extended AOT.

In response to Conditions'5 and 6, the licensee stated that no further elective equipment maintenance or testing, which increase the likelihood of a plant transient, will be performed during the EDG AOT and that an extended EDG AOT will not be entered for scheduled maintenance purposes if severe weather conditions are expected.

The NRC staff's deterministic review of VEGP's " equivalent" attemate source of ac power used as justification for extending its current EDG AOT concludes that it meets the applicable squirements of NUMARC 8700. Based on this equivalent AAC source and the compensatory measures, the staff has concluded that it is acceptable to extend the current EDG AOT from 72 hot.

to 14 days.

3.3 Pr.,abilistic Risk Assessment (PRA)

The NRC staff reviewed the licensee's request for a new 14-day (replacing the 72-hour) AOT for one inoperable EDG except for conditions where the SAT is unavailable, or the electrical power generation capability of (the site-adjacent combustion turbine generator) Plant Wilson

)

becomes unavailable or unreliable during the time that an EDG is out of service. The NRC staff used a three-tiered approach to evaluate the risk associated with the proposed license

. amendment. The first tier evaluated the PRA model and the impact of the change on plant operational risk. The second tier addressed the need to preclude potentially high risk configurations, should additional equipment outages occur during the AOT period. The third tier eva eated the licensee's configuration risk management program (CRMP), to ensure that equipment removed from service prior to entering, or during, the proposed AOT will be appropriately assessed from a risk perspective. Each tier and associated findings are discussed below.

Tier 1: PRA Evaluation of AOT Extensions The licensee used traditional PRA methodology to evaluate the requested AOT extension for EDGs. The Tier 1 NRC staff review of the licensee's PRA involved two aspects: (i) evaluation of the PRA model and application to the proposed AOT extension, and (ii) evaluation of PRA results and insights stemming from the application. The review did not warrant an assessment of any unconventional PRA practices or unique features that could significantly impact the PRA findings and conclusions.

(i)

Evaluation of PRA Model and Application to the AOT Extension The staffs review focussed on the capability of the licensee's PRA model to analyze the risk stemming from the proposed AOT changes for EDGs, and did not involve an in-depth review of the licensee's PRA.' This review was based on the staff's initial screening process where the staff examined the licensee's intemal events PRA results, recent operational experience regarding loss of offsite power and EDG reliability and availability, and plant-specific features

. _ _ _ _ _ _ _ _ _ _ _ _ - - _ - - - - - - - l such as EDG configurations, offsite sources, and other systems critical to mitigation of an LOOP power event. The staff concludes that the licensee's PRA results are reasonable, and the scope and depth of the PRA analysis support such a finding. Recent data for EDG and offsite ac power reliability and availability did not indicate any adverse trends. The six combustion turbine generators at Plant Wilson are fully capable of safely shutting down the plant given an LOOP. The staff notes the level of redundancy of design and reasonableness of the PRA insights supports the proposed EDG AOT extension from 3 to 14 days, except when the SAT or Plant Wilson is unavailable / unreliable.

The licensee's PRA includes both a Level 1 and Level 2 analysis. Vogtle, Units 1 and 2 used the linked fault tree methodology based on the Electric Power Research Institute's Computer S

Alded Fault Tree Analysis (CAFTA) suite of software to perform core damage analysis. The analysis modeled both generic and plant-specific initiators, including intemal flooding, and dependencies that exist between initiating events and the associated mitigating systems.

These initiators are consistent with those identified in previous PRAs. The licensee used both generic and plant-specific data. Generic data sources and plant-specific data were incorporated into the model by updating generic data using Bayesian techniques. The licensee plans regular updates of the PRA, which would include the use of an updated data base, and changes to fault tree models made to reflect modifications made since the original PRA. The staff recognizes that the SBO contribution to core damage frequency (CDF) has decreased due to the SAT / Plant Wilson availability.

Since the common cause failure (CCF) of EDGs is potentially a dominant contributor to the plant SBO risk, the staff examined the licensee's CCF analysis. The licensee used the multiple Greek letter (MGL) method and generic data for treating CCFs. The CCF probability of EDGs is reasonable and the beta factors (of the MGL) used are consistent with those used in previous PRAs.

(ii) Evaluation of PRA Results and insights The current estimated plant CDF (3.64E-05/yr with 4-hour battery depletion time) for intemal events at Vogtle is comparable to that for other pressurized water reactors. The licensee's PRA originally identified SBO as the largest contributor 61 percent to the CDF relative to other contributors; however, with the inclusion of the SAT / Plant Wilson, the licensee estimates the SBO contribution to the CDF declined to 5.6 percent.

The following baseline CDFs were calculated by the licensee, with the most current PRA model, including SAT / Plant Wilson benefit:

Nonhurricane season:

CDF = 3.620E-05/yr Hurricane season:

CDF = 3.798E-05/yr Annual average:

CDF = 3.641 E-05/yr The staff estimates the annual average CDF with the proposed 14-day AOT to be 3.66E-05/yr.,

an approximate increase of 1 percent within the guidelines published in DG-1061.

The large early release frequency calculated by the licensee is 1.72E-06/yr.

Values of the incremental conditional core damage probability (ICCDP) calculated by the licensee are (including selsmic effects and tomado):

9 Nonhurricane season, EDG-A in maintenance for 14 days, EDG-B not in maintenance:

ICCDP=3.29E-07.

Nonhurricane season, EDG-B in maintenance for 14 days, EDG-A not in maintenance:

l lCCDP=4.05E-07.

l l

Hurricane season, EDG-A in maintenance for 14 days, EDG-B not in maintenance:

ICCDP=4.21E-07.

Hurricane season, EDG-B in maintenance for 14 days, EDG-A not in maintenance:

ICCDP=5.41E-07.

All of the above ICCDP values are below or very near the staff guideline value of SE-07, published in DG-1065. The incremental conditional large early release probability was calculated to be negligibly small, and also within that published in DG-1065.

i Additionally, the licensee will implement, prior to implementation of the extended (14-day) EDG L

AOT, a procedure that will prohibit entry into the AOT for scheduled maintenance purposes, if severe weather conditions are expected. This commitment will be included in Appendix D to the Facility Operating Licenses for VEGP, Units 1 and 2, as addressed in the April 21,1998, supplement to the January 22,1998, application for license amendment.

The EDG unreliability and unavailability values used in the above calculations are historically based and listed below:

EDG random failure-to-run probability = 1.14E-02 EDG random failure-to-start probability = 6.33E-03 l

l EDGs A and B common cause failure-to-run probability = 3.08E-04 EDGs A and B common cause failure-to-start probability = 1.71 E-04 EDG maintenance unavailability = 1.3E-02, i.e.,98.7 percent availability (Based on historical data: miscellaneous outages, i.e., testing and corrective maintenance during power operations).

For an EDG 14-day AOT, assuming 14 days per cycle per EDG out-of-service, the EDG at -

power unavailability is expected to rise to 3.9E-2 or 96.1 percent availability, with a commensurate increase in shutdown EDG availability.

Currently, the licensee's maintenance rule EDG target unavailability is 1.52E-2 or 98.48 percent availability. With a 14-day EDG AOT, the new EDG maintenance rule unavailability performance criterion is expected to become 4.10E-2 or 95.9 percent availability. During the SBO rule implementation, the licensee committed to an EDG target reliability of 0.95.

Based on the preceding Tier 1 review and the related information presented, the staff concludes that the PRA model used for the proposed AOT extension for single inoperable EDGs is considered to be reasonable, and the risk impact of the change is small and supports the AOT extension.

Tier 2: Avoidance of Risk-Significant Plant Configurations As required by license condition (Appendix D), the licensee will implement a procedure, prior to use of the EDG AOT, that will prohibit entry into an extended EDG AOT (14 days) for scheduled maintenance purposes, if severe weather conditions are expected, as described in the licensee's application dated January 22,1998, as supplemented April 21,1998.

The licensee will have TS Required Actions (3.8.1) for the condition with one EDG inoperable that require verifying availability of the SAT, and verifying that an enhanced black-start CTG and diesel generator starts and achieves steady state voltage and frequency, or requires starting and running at least one CTG while in this condition.

The staff has concluded that these restrictions are necessary to preclude high risk situations associated with having o.se EDG inoperable for greater than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Tier 3: Risk-Informed Plant Configuration Management The licensee has provided reasonable assurance that risk-significant plant equipment outage configurations will not occur while the plant is subjected to the extended EDG AOT. The L

licensee utilizes its equipment-out-of-service (EOOS) risk monitor to provide planning and scheduling strategies to maximize equipment performance, reliability, and availability during the proposed EDG extended AOT. This process will be incorporated as part of the proposed Configuration Risk Management Program (CRMP).

EOOS will be used by the Central Scheduling Group to support the safety assessment of schedule EDG maintenance. As part of the plan-of-the-day report, a list of affected equipment tag numbers and scheduled maintenance dates is generated every weekday. This scheduled maintenance information will be used as an input to EOOS, and the resulting EOOS output will be used by central scheduling personnelin developing a safety assessment of scheduled EDG l

maintenance. The licensee plans to continue the current practice of scheduling system outages l

on only one safety significant system at a time. Central scheduling will inform plant j.

management of risk insights generated using EOOS, whose quantification engine is the Vogtle PRA, which will be updated regularly to reflect plant changes.

An EOOS table provides management guidelines, includ'ing corrective actions based on configuration-specific Instantaneous Core Damage Frequency (CDFINST-the annual conditional CDF of any plant configuration) or the Plant Safety Index (PSI = 10 [ Log (CDFINST) divided by Log (2.494E-05)). ~ Also provided are Maximum Duration Limits associated with PSI color bands (DURmax) keyed to an ICCDP, along with staff / management

. approvallevels, and corrective actions. The Risk Management Guidelines of this table will be included in procedure 00354-C and will be revised when needed to reflect changes to the l

licensee's PRA. A licensee analysis of annual average core damage frequency with and without SAT availability and other equipment outages does not show large risk increments.

if equipment failure occurs during an EDG outage, the on-shift operations staff will respond to

' restore safety functions and provide compensatory measures to minimize the consequences of

' out-of-service equipment. The appropriate shift operations personnel will contact Outages and i

Planning for assistance in using EOOS software for evaluating the safety impact of the j

equipment failure (s).

. The capabilities of EOOS provide one of many inputs to the development of safety l

assessments of scheduled EDG maintenance and coping with any additional equipment

(.

failurek. The overall safety assessment of scheduled EDG maintenance and coping with any.

i coincident equipment failures (emergent work) is performed, according to the licensee, by knowledgeable and experienced personnel who will continue to assert a key role in assuring l

that the scheduled EDG maintenance and any coincident emergent work does not place the

!~

plant in an unsafe condition. The safety assessment performed prior to the scheduled EDG maintenance includes a multidisciplinary review by operations, maintenance, and central scheduling personnel as part of the daily plan-of-the-day meetings. Uncertainties in EOOS calculations will be addressed by a qualitative assessment of the entire work scope by trained and experienced personnel. This will be a key element in assuring that scheduled work at Vogtle does not place the plant in an unsafe condition.

PRA Quality The baseline PRA has undergone a rev ew by an Independent Review Group (IRG) and the l

IRG consultant, PLG, Inc., who provided a peer review as part of the Individual Plant Examination (IPE) process. The purpose of the IRG was to provide a critical review of the IPE l

plan, results, and documentation by experienced personnel with diverse areas of plant expertise. This effort provided considerable confidence to the licensee that the results and conclusions of the IPE were applicable and representative of the plant. The original PRA submitted as part of this process has recently been converted to linked-fault tree methodology based on the EPRI CAFTA (Computer Aided Fault Tree Analysis) suite of software.

Calculations performed as part of the baseline PRA and conversion to CAFTA are documented

~ in calculation packages, which were originated and independently verified by qualified L

. personnel in accordance with approved procedures. The PRA calculations performed in L

support of the proposed TS changes were also originated and independently verified by i

qualified personnel in accordance with approved procedures. A current revision zero (Rev. 0) l.

' to the PRA model now exists, with which the calculatiores referenced herein were performed.

The licensee's approach is consistent with staff guidance on quality, i

~ The EDG AOT CDF and LERF calculations were performed in accordance with licensee procedures including REES 2-6, " Performance of Risk-Based Analysis (RBA)." In accordance with this procedure, RBAs are originated and reviewed by fully qualified engineers assigned by licensee departmental management. The designated originator ensures that the model utilized has been properly developed, contro. led, documented in accordance with other licensee departmental procedures, and is installed on a computer which has been verified to produce accurate results for the model selected. The reviewer in tum confirms that the RBA is: free of

l

' l errors; accurately represents the issue under consideration; utilizes an appropriately approved j

PRA model; is based on technically sound judgment; and is properly documented. The reviewer, if deemed appropriate, can expand the scope of the review. An RBA is considered a l

quality assurance (QA) record and is maintained in departmental files for a period of ten years following completion of the analysis. The licensee's approach is consistent with staff guidance on quality.

A focused staff audit of PRA accident sequences and cut sets did not indicate any irregularities.

The staff's audit did not indicate any aspects of the accident initiation and progression analysis that would alter the licensee's core damage frequency or large early release frequency calculation results.

Conclusions Recardina the Licensee's Prohnhi!!stic Risk Analysis Used to Suonart the Proposed Amendment Based on the three-tiered approach, the staff finds the following:

The proposed EDG AOT modifications have only a minimal quantitative impact on plant risk.

i e

The calculated ICCDP for a single EDG AOT is small, primarily because of the redundancy in EDG configuration and the availability of the (six) Plant Wilson combustion turbine generators through the SAT.

The licensee verifies availability of the SAT and functionality of an enhanced black-start i-CTG before the proposed extended EDG AOT is entered, as required by the TS. The licensee is required by license condition to implement a procedure that will prohibit entry into an extended EDG AOT for scheduled maintenance purposes if severe weather conditions are expected. The licensee's submittal also includes several compensatory measures and normal plant practices that help avoid potentially high risk configurations during the proposed extended EDG AOT.

e The licensee has proposed a risk-informed plant CRMP to assess the risk associated with the removal of equipment from service during the extended EDG AOT. The program j

provides the necessary assurances that appropriate assessments of plant risk

[

configurations using the EOOS software, augmented by appropriate engineering judgment, are sufficient to support the proposed AOT extension request for EDGs.

Additionally, the staff notes that Procedure Number 11889-C, " Severe Weather Checklist,"

requires that if sustained hurricane inland winds are projected onsite to exceed 74 mph, Units 1 and 2 should be shut down to at least Mode 3 (Hot Standby) within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> prior to projected 74 mph winds reaching the site.

The NRC staff concludes that the EDG AOT extension will result in an insignificant increase in plant risk. The licensee has a process for scheduling and controlling maintenance activities into which plant risk is incorporated; that compensates for the small risk increase and uncertainty associated with the proposed AOT change. The NRC staff, therefore, finds that the PRA insights support the proposed EDG AOT extension with the caveat that where the standby auxiliary transformer is unavailable, or the electrical power generation capability of (the site-l A

____. adjacent combustion turbine generator) Plant Wilson becomes unavailable or unreliable during the time that an EDG is out of service, the AOT remains 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> it should be noted, however, that should the black start combustion / black start diesel reliability decline below 95 percent, deterministic considerations support the 14-day EDG AOT provided that the combustion turbines are run during this period.

3.4 CHANGES TO THE TECHNICAL SPECIFICATIONS The licensee has proposed a change to TS 3.8.1, "AC Sources - Operating," to extend the EDG AOT, the Completion Time for Required Action B.6, from "72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> M 6 days from discovery of failure to meet LCO" to "14 days from discovery of failure to meet LCO." As stated above, this change in EDG AOT is acceptable in that it is supported by the NRC staff's finding that the

" equivalent" attemate ac power meets the applicable requirements of NUMARC 8700. In the same manner, the licensee has proposed that the Completion Time for exiting LCO 3.8.1, associated with restoration of one required o# site circuit, Required Action A.3, would be -

increased from "6 days from discovery of failure to meet LCO" to "14 days from discovery of failure to meet LCO." This change is needed to allow the EDG AOT to be extended to 14 days; otherwise, LCO 3.8.1 would be required to be exited after only 6 days. Since the completion time for restoration of one required o# site circuit remains 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, this AOT has not been increased. Accordingly, the proposed change to the Completion Time for Required Action A.3 is acceptable.

The licensee has proposed two new Required Actions / Completion Times for TS 3.8.1 to address the operability of the " equivalent" AAC. Proposed Required Action B.2 requires that, with one EDG inoperable, the licensee shall" Verify SAT available" with a Completion Time of "1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> MD Once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> thereafter." The proposed Required Action and associated Completion Time assure that the SAT is promptly confirmed to be available and subsequently confirmed to be available on a frequency commensurate with its safety importance.

Accordingly, the proposed Required Action B.2 and the associated Completion Time are acceptable.

The second new Required Action / Completion Time, B.S.1 and B.5.2, address the operability of the _.,halent" AAC power source, Plant Wilson. Propose Required Action B.5.1 would require that, with one EDG inoperable, the licensee shall, " Verify an enhanced black-start CTG is functional by verifying the CTG and black-start diesel generator starts and achieves steady state voltage and frequency." The proposed Completion Time for B.S.1 is"72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> QB Within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> prior to entry into Condition B." Proposed Required Action B.5.2 would require that, with one EDG inoperable, the licensee shall, " Start and run at least one CTG while in Condition B." The proposed Completion Time for B.S.2 is"72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> QB Prior to entry into Condition B for preplanned maintenance." The following note in the TS would determine whether B.S.1 or B.5.2 would be applicable: " Required Action B.S.1 is only applicable if the combined reliability of the enhanced black-start combustion turbine generators (CTG) and the black-start dieselis t 95%. Otherwise, Required Action B.S.2 applies." The requirements of B.S.1 and B.5.2 implement the licensee's commitment to maintain the " equivalent" AAC at a reliability of greater than or equal to 95 percent or run one CTO during extended (greater than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />) EDG preplanned maintenance QB start, and run at least one CTG The proposed Completion Times assure that the adequacy of the " equivalent" AAC is confirmed prior to an l

extended EDG AOTJ Accordingly, proposed Required Actions B.5.1 and B.5.2, and their associated Completion times, are acceptable.

The licensee has proposed a change to the remedial action requirements, and Completion Times, that are applicable to situations when Required Actions associated with one inoperable EDG (Condition B) cannot be met. Currently, TS 3.8.1, Condition G, requires that the reactor be placed in Mode 3 (Hot Standby) within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> ANQ in Mode 5 (Cold Shutdown) within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> when the Required Action and Completion Time for Condition B are nct met. The licensee has proposed that Condition G be divided into two parts; the first being those conditions associated the " equivalent" AAC (Conditions B.2, B5.1, and B5.2), which would be incorporated in a now proposed Condition C. The second group of remedial actions, the remainder of existing Condition G, would be incorporated in a new proposed Action H. With regard to the new proposed Condition C, if the " equivalent" AAC cannot be made operable, the inoperable EDG would have to be restored to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />; this requirement is the same as the previous design basis for the maximum allowable AOT for an inoperable EDG with no " equivalent" AAC. _With regard to the new proposed Condition H, these remedial actions are the same as those previously contained in Condition C. Accordingly, proposed Conditions C and G are acceptable.

The licensee has proposed changes to TS 3.8.1 to accommodate the insertion of a new Condition C (e.g., existing Condition C becomes Condition D). Condition C specifies remedial action to be taken when the Required Actions associated with the " equivalent" AAC are not completed within the associated Completion Times. These changes to the TS are administrative, do not change any regulatory requirements, and are acceptable.

The licensee has proposed a new TS 5.5.18, " Configuration Risk Management Program." The Configuration Risk Management Program (CRMP) provides a proceduralized risk-informed assessment to manage the risk associated with equipment inoperability. The program applies to technical specification structures, systems, or components for which a risk-informed allowed outage time has been granted. The proposed program includes the following elements:

a.

Provisions for the control and implementation of a Level 1, at power, intemal events, PRA-informed methodology. ~ The assessment shall be capable of evaluating the applicable plant configuration.

b.

Provisions for performing an assessment prior to entering the LCO Condition for preplanned activities.

c.

Provisions for performing an assessment after entering the LCO Condition for unplanned entry into the LCO Condition.

d.'

Provisions for assessing the need for additional actions after the discovery of additional equipment out-of-service conditions while in the LCO Condition, e.

Provisions for considering other applicable risk significant contributors nuch as Level 2 issues and extemal events, qualitatively, or quantitatively.

l

(

___-_. _ _ _ _ ____-__ ___- - - As stated above, the CRMP is acceptable in that the program provides the necessary assurances that appropriate assessments of plant risk configurations using the EOOS software, augmented by appropriate engineering judgment, are sufficient to support tne proposed AOT extensica request for EDGs.

g in addition, the CRMP is used to assess changes in core damage frequency resulting from 3

applicable plant configurations. The CRMP uses the equipment out-of-service risk monitor, a computer based tool that may be used to aid in the risk assessment of online maintenance and to evaluate the change in risk from a component failure. The equipment out-of-serv;ce risk monitor uses the plant probabilistic risk assessment model to evaluate the risk of removing equipment from service based on current plant configuration and equipment condition. The CRMP is used when an EDG is intentionally taken out of service for a planned activity excluding short duration activities (e.g., perfoaning an air roll on the EDG prior to a routine surveillance).

In addition, the CRMP is used for unplanned maintenance or repairs of an EDG.

The licensee and the staff have agreed to implementation of the CRMP as described below.

The Configuration Risk Management Program (CRMP) includes the following key elements:

Key Element 1. Implementation of CRMP The intent of the CRMP is to implement a (a)(3) of the Maintenance Rule (10 CFR 50.65) with respect to on-line malatenance for risk-informed technical specifications, with the following additions and clarifications:

The scope of the structures, systems and components (SSCs) to tie included in the a.

CRMP will be those SSCs modeled in the licensee's plant PRA ir, addition to those SSCs considered risk significant in accordance with the VEGP Maintenance Rule Scoping Manual that are not modeled in the PRA.

b.

The CRMP is PRA informed, and may be in the form of either a risk matrix, an on-line assessment, or a direct PRA assessment.

c.

CRMP will be invoked as fn!!ows for:

Risk informed inoperability: A risk assessment wili be performed prior tn entering the LCO Condition for preplanned activities. For unplanned entry into the LCO Condition, a risk assessment will be performed in accordance with plant procedures.

Additiona! SSC Inoperability and/or Loss of Functionality: When in the risk-informed Completion Time, if an additional SSC within the scope of the CRHP becomes inoperable /non-functional, a risk assessment shall be performed in accordance with plant procedures.

r d.

Tier 2 commitments apply for planned maintenance only, but will be evaluated as part of the Tier 3 assessment for unplanned occurrences.

- Key Element 2. Control and Use of the CRMP a.

Plant modifications and procedure changes will be monitored, assessed, and dispositioned as part of the normal PRA update process:

Evaluation of changes in plant configuration or PRA model features can be dispositioned by implementing PRA model changes or by the qualitative assessment of the impact of the changes on the CRMP. This qualitative assessment recognizes that changes to the PRA take time to implement and that changes can be effectively compensated for without compromising the ability to make sound engineering judgments.

Limitations of the CRMP are identified and understood for each specific Completion Time extension.

b.

Procedures exist for the control and application of CRMP, including description of the process when outside the scope of the CRMP.

. Key Element 3. Level 1 Risk-Informed Assessment The CRMP is based on a Level 1, at power, intemal events PRA model. The CRMP assessment may use any combination of quantitative and qualitative input. Quantitative assessments can include reference to a risk matrix, pre-existing calculations, or new PRA analyses.

a.

Quantitative assessments should be performed whenever necessary for sound decision making.

b.

When quantitative assessments are not necessary for sound decision making, or are beyond the scope of the PRA model, qualitative assessments will be performed.

Qualitative assessments will consider applicable, existing insights from quantitative assessments previously performed.

Key Element 4. Level 2 issues /Extemal Events Extemal events and Level 2 issues are treated qualitatively and/or quantitatively.

The staff, therefore, concludes the licensee's Tier 3 approach is reasonable for %e purpose of the proposed extended EDG AOT.

Planned activities involving an extended EDG AOT will be synchronized with other maintenance activities as much as possible in order to maximize equipment reliability while minimizing the time equipment is unavailable. In addition, Required Action B.3 requires that features supported by the inoperable DG be declared inoperable within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> of discovery when redundant features are discovered to be inoperable. The combination of planned maintenance centered around the extended DG AOT, Required Action B.3, and use of the CRMP provides l

an appropriate leveel of assurance that risk significant activities with an unacceptable risk i

achievement worth will be minimized during an extended DG AOT.

I The staff expects the licensee to implement these TS changes in accordance with the three-tiered approach described above. The licensee has also indicated that the EDGs are currently

in the 10 CFR 50.65(a)(2) maintenance rule category and has identified new EDG performance criteria to be effective with implementation of the proposed AOT change. The AOT extension will allow efficient scheduling of online maintenance within the boundaries established by implementing the maintenance rule. The licensee will monitor EDG performance in relation to the maintenance rule performance criteria. Therefore, application of these implementation and monitoring strategies will help to ensure that extension of the TS EDG AOT does not degrace operational safety over time and that the risk incurred 'when an EDG is taken out of service is minimized.

4 0 STATE CONSULTATION in accordance with the Commission's regulations, the Georgia State official was notified of the proposed issuance of the amendments. The State official had no comments.

5.0 ENVIRONMENTAL CONSIDERATION

The amendments change requirements with respect to installation or use of a facility component located within the restricted area as defined in 10 CFR Part 20. The NRC staff has determined that the amendments involve no significant increase in the amounts, and no significant change in the types, of any effluents that may be released offsite, and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that the amendments involve no significant hazards consideration, and there has been no public comment on such finding (63 FR 6998 dated February 11,1998). Accordingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9). Pursuant to 10 CFR 51.22(b) no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

6.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributors: M. Pratt M. Wohl D. Jaffe N. Gilles Date:

May 20, 1998