ML20248K930

Safety Evaluation Supporting Amend 119 to License NPF-43

ML20248K930
Person / Time
Site:	Fermi
Issue date:	06/02/1998
From:	NRC (Affiliation Not Assigned)
To:
Shared Package
ML20248K916	List: ML20248K914 ML20248K930
References
NUDOCS 9806100345
Download: ML20248K930 (14)

Text

I AR #800 k

UNITED STATES g

)

NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 3060641001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO.119 TO FACILITY OPERATING LICENSE NO. NPF-43 DETROIT EDISON COMPANY FERMI 2 DOCKET NO. 50-341

1.0 INTRODUCTION

By letter dated November 22,1995 (NRC-95-0124), as supplemented February 19, April 19, May 3, June 12, June 21, and December 4,1996, January 30 and August 7,1997, and April 27 and May 22,1998, the Detroit Edison Company (DECO or the licensee) requested an j

amendment to the Technical Specifica*. ions (TS) appended to Facility Operating License No.

NPF-43 for Fermi 2. The January 30,1997, supplement withdrew the licensee's letter of June 21,1996. The proposed amendment would revise TS Action Statement 3.8.1.1 to change the emergency diesel generator (EDG) allowed outage time (AOT) from 3 to 7 days when one or both of the EDGs are inoperable in one of the two required onsite AC electrical power divisions.

Action Statement 3.8.1.1 would also be revised to add a requirement to verify that combustion turbine-generator (CTG) 11-1 is available. In addition, in accordance with draft staff guidance for risk-informed amendments, a section would be added to the Administrative Controls Section of the TS describing the licensee's configuration risk management program (CRMP). The amendment would also revise the Bases Section of the TS to reflect these changes. The licensee states that the proposed AOT extension is justified because of its small impact on plant risk and its improvement in operational flexibility. The licensee currently schedules its Pspection of the EDGs during refueling outages because the time required for the inspections i

exceeds the current 72-hour AOT in TS 3.8.1, 'A.C. Sources - Operating." With the proposed change allowing a 7-day AOT, the licensee would have the option to schedule these inspections during reactor aperation.

4 The November 22,1995, submittal also requested changes to the testing and reporting requirements for the EDGs. T hese aspects were addressed in Amendment No.107 to the TS issued on June 20,1996. The staff's action on the licensee's request is now complete.

The February 19, April 19, May 3, June 12, and December 4,1996, August 7,1997, and May 22,1998, submittals provided clarifying information within the scope of the Federal Register notices and did not change the staff's initial proposed no significant hazards considerations determinations.

l l

9906100345 990602 PDR ADOCK 05000341 P

PDR

2.0 BACKGROUND

l Since the mid-1980s, the NRC has been reviewing and granting improvements to TS that are based, at least in part, on probabilistic risk assessment (PRA) insights, in its final policy statement on TS improvements of July 22,1993, the NRC stated that it...

... expects that licensees, in preparing their Technical Speedication related submittals, will utilize any plant-specific PSA [probabilistic safety assessment]1 or risk 1,urvey and any available literature on risk insights and PSAs.... Similarly, l

the NRC staff will also employ risk insights and PSAs in evaluating Technical Speedications related submittals. Further, as a part of the Commission's ongoing program of improving Technical Speedications, it will continue to I

consider methods to make better use of risk and reliability information for l

defining future generic Technical Specification requirements.

The NRC reiterated this point when it issued the revision to 10 CFR 50.36, " Technical Specifications," in July 1995. In August 1995, the NRC adopted a final policy statement on the use of PRA methods in nuc'sar regulatory activities that encoulaged greater use of PRA to improve safety decision making and regulatory efficiency. The PRA policy statement included the following points:

1.

The use of PRA technology should be increased in all regulatory matters to the extent

- supported by the state of the art in PRA methods and data and in a manner that complements the NRC's deterministic approach and supports the NRC's traddional defense-in-depth philosophy.

2.

PRA and associated analyses (e.g., sensitivity studies, uncertainty analyses, and importance neasures) should be used in regulatory matters, where practical within the bounds of the state of the art, to reduce unnecessary conservatism associated with current regulatory requirements.

3.

PRA evaluations in support of regulatory decisions should be as realistic as practicable and appropriate supporting data should be publicly available for review.

On June 25,1997, the Commission published draft regulatory guidance for making risk-infomwd changes to TS (62 FR 34321) in DG-1061, "An Approach for Using Probabilistic Risk Assessment in Risk-informed Decisions on Plant-Specific Changes to the Current Licensing Basis," and DG-1065, "An Approach for Plant-Specific Risk-Informed Decision making: Technical Specifications." Publication of these regulatory guides in final form is expected in mid-to late 1998. The staff has used the guidance documents in its review of the proposed TS change.

- 1 PSA and PRA are used interchangeably herein.

, 3.0 EVALUATION The staff evaluated the licensee's proposed amendment to the TS using traditional (deterministic) engineering analysis, PRA methods, and a review of operating experience. The staff's traditional analysis evaluated the capabilities of the plant to mitigate design-basis and station blackout (SBO) events with one EDG inoperable. The staff then used insights denved from the use of PRA methods to determine the risk significance of the proposed changes. The results of these evaluations were used in combination by the staff to determine the safety impact of extending the AOT for one inoperable EDG.

The loss of offsite power (LOOP) to essential and nonessential electrical. buses, concurrent with a turbine trip and unavailability of the onsite AC power systems (i.e., EDGs), is referred to as

" station blackout." Since probabilistic safety assessment (PSA) studies have shown that SBO is an important contributor to the total risk from nuclear power plant accidents, the SBO rule, Section 50.63 of Title 10 of the Code of Federal Regulations (10 CFR 50.63), was issued to lower that risk from these sequences. For the implementation of the SBO rule, some licensees l-have installed or provided excess and diverse power sources (e.g., nonsafety diesels, existing Appendix R diesels, shutdown diesels, combustion turbines, and special transmission lines) as an alternate AC (AAC) source to cope with ari SBO for a specified duration and to recover from it. For the SBO rule, the licensee has selected CTG 11-1, one of the four peaking CTGs, as an AAC power source. The staff believes that the above excess and diverse power sources provided under the SBO rule could be temporarily used to compensate when an EDG is out of service for on-line inspection or preventive maintenance.

The licensee states that the proposed EDG AOT extension and on-line inspection could l

improve EDG reliability by allowing a longer time in which to identify the root cause of failures l

and to repair the EDGs. Since the fact that the EDG provides onsite emergency AC power for a nuclear power plant in case all offsite power sources are lost is an important factor in assuring l

acceptable safety at nuclear power plants, the staff reviewed the proposed AOT extension and on-line inspection considering the reduction in the availability of the EDGs and the effect on the risk reduction achieved by implementing the SBO rule.

The staff's evaluation of the proposed changes follows:

3.1 Ravinian of Ar* ion S* ment 3.8.1.1.b and Add 4 ion of TS 6.8.5.h The current Action Statement (AS) 3.8.1.1.b states, in part:

With one or both diesel generators in one of the above required onsite A.C.

electrical power divisions inoperable.... Restore the inoperable division to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

The licensee initially proposed that the above 72-hour AOT in AS 3.8.1.1.b be increased to 7 days and later committed to verify by an administrative check that the AAC power source (CTG 11-1) is operable when an EDG is out of service. The staff subsequently requested that this commitment be incorporated into the TS. By letter dated January 30,19g7, the licensee

I t I:

proposed to revise TS AS 3.8.1.1.b further by subdividing it into three ass in which AS 3.8.1.1.b has been revised as follows:

With one or both diesel generators in one of the above required onsite A.C.

electrical power divisions inoperable; AS 3.8.1.1.b.1 would state:

Demonstrate the OPERABILITY of the remaining A.C. sources by performing Surveillance Requirement 4.8.1.1.1 within one hour and at least once per 8 -

. hours thereafter, and if the diesel generator (s) became inoperable due to any cause other than an inoperable support system, an independently testable component, or preplanned preventive maintenance or testing, by performing Surveillance Requirement 4.8.1.1.2.a.4 for one diesel generator at a time within -

24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, unless the absence of any potential common mode failure for the remaining diesel generators is determined, and

. AS 3.8.1.1.b.2 would state:

Verify within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> and at least once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter, that CTG 11-1 is OPERABLE. Restore the inoperable division to OPERABLE status within 7 days or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

AS 3.8.1.1.b.3 would state:

If the requirements of ACTION b.2 above for CTG 11-1 cannot be met, either restore the inoperable division to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (not to exceed 7 days from the time the division became inoperable); or, satisfy the i

requirements of ACTION b.2 above within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and restore the inoperable i

division to OPERABLE status within 7 days from the time the division became inoperable; or, be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

i The revised AS 3.8.1.1.b.2 allows that the above 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> in AS 3.8.1.1.b be increased to 7 l

days so long as CTG 11-1 is operable. If CTG 11-1 is found to be inoperable, AS 3.8.1.1.b.3 reverts to the original 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

The licensee also proposes adding TS 6.8.5.h, ' Configuration Risk Management Program

- (CRMP)," to Section 6.0, Administrative Controls. The purpose of the CRMP is to ensure that a proceduralized PRA-informed process is in place that assesses the overall impact of plant maintenance on plant risk.

. The primary purpose of the licensee's request for this amendment is to allow the performance of Surveillance Requirement (SR) 4.8.1.1.2.e.1 during plant operation. This SR involves the l

inspection of each EDG at least once per 18 months. Performance of this SR at power is not precluded in the current TS except that the amount of time required to complete the work

(,

, exceeds the current EDG AOT of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Extension of the AOT will provide sufficient time to perform the SR at power. No changes to SR 4.8.1.1.2.e.1 are required.

. To allow the staff to evaluate the effect of the proposed request on the reduction in severe accident risk achieved by implementation of the SBO rule, the staff requested the licensee, by

)

r quests for additional information (RAls), to evaluate the impact of the proposed EDG AOT e

extension on the plant risk and positive measures that would be required during the on-line inspection. The licensee responded to the staffs RAls on February 19, April 19, May 3, June 12, and December 4,1996, and January 30, and August 7,1997.

The staff reviewed the current power system design at Fermi 2 and the licensee's responses to the staffs RAls and made the following deterministic and risk assessment of the EDG AOT -

extension:

3.1.1 Deterministic Evaluation 1.

The offsite power system at Fermi 2 is comprised of two physically independent poweer sources supplied from (a) the 120-kV switchyard, which is powered from three transmission lines and four peaking CTGs located at Fermi 1 and connects with Division 1 engineered safety feature (ESF) and balance of plant (BOP) loads, and (b) the 345-kV switchyard, which is powered from two transmission lines and Fermi 2 unit generation output and connects with Division 2 ESF and BOP loads. Of the five offsite lines, one of the three 120-kV lines and one of the two 345-kV lines are adequate

. for complying with the TS requirement for two offsite lines. Unlike the offsite power system design that powers from a common switchyard, a loss of switchyard at Fermi 2 would not result in a total LOOP as the remaining switchyard can supply power to one division to perform its safety function.

2.

The onsite power system at Fermi 2 consists of two ESF divisions (I and 11) and the loads on each ESF division are subdivided between *wo EDGs, thus requiring a total of four EDGs. Either division has the capability and capacity to supply the ESF loads required for safe shutdown during a design-basis accident. Manually operated tie breakers are also available to cross-tie divisions. Those breakers are normally maintained in the open and disconnected position, with interlocks that prevent tying l,

both divisions together. Therefore, the onsite distribution design maintains l

independence between redundant onsite power sources and between their distribution systems.

l 3.

If one EDG is found to be inoperable (e.g., through on-line inspection), the current TS at

' Fermi 2 assumes that a whole division of onsite AC electrical power is inoperable. In reality, three of the four EDGs would be available to mitigate an SBO event. Under a similar circumstance, a plant with an onsite power system designed with only two EDGs would have one EDG available. This feature makes Fermi 2's onsite distribution design

less susceptible to an SBO.

4.

CTG 11-1, the AAC power source for an SBO at Fermi 2, is a 13.8-kV,18,875-kVA, 0.85-pf self-contained outdoor peaking unit with a diesel starting motor to provide black L

, start capability. The AAC power source has adequate capacity (16 MW vs. 2.85 MW for an EDG) and is proceduralized to supply the Division 1 safe shutdown loads. Under SR 4.711.2, the operability of CTG 11-1 is ensured by starting and supplying loads on a monthly basis. CTG 11-1 can also be connected to supply Division 2 safety loads through the cross-tie. However, the use of the cross-tie is administratively controlled and is used only in the shutdown condition.

5.

To improve long-term reliability of CTG 11-1 and to prevent failure of components as a result of aging, the licensee (by letter dated June 12,1997) has refurbished and overhauled many components (e.g., the generator excitation unit, the breaker, the battery system, and the control system) of CTG 11-1.

\\

6.

The licensee has set and the EDGs currently meet a reliability target of 95%. This target is comparable to industry averages of 95% to 99%. With a longer AOT and the on-line inspection request approved, the reliability would be expected to improve further.

7.

In the current 3-day AOT study, the licensee used an EDG availability value of 99.5%

(i.e., unavailability value of 0.5%). For the proposed AOT study, the licensee added 7 days for each refueling cycle as a projected total maintenance time for each EDG and this reduced the availability value to 98.1% (i.e., unavall ability of 1.9%). However, both availability values are still within the industry-recommended availability goal of 96% to 99%. Wdh the AOT extended to 7 days, the unavailability value (i.e.,1.9%) is on a par with the current average industry unavailability value of 2.0% during plant operation that is documented in NUREG/CR-5994, "Er gency Diesel Generator: Maintenance and Fai!ure Unavailability, and Their Risk Impacts" (1994). However, recent actual unavailability values collected for the maintenance rule task force for 1991-1995 were 0.44%,0.19%,0.26%,0%, and 0.24%, respectively (average of 0.23%). This information indicates that the actual unavailability value (i.e., 0.23%) is less than that of the value used for the 3-day AOT study (i.e.,0.5%).

8.

As a part of the commitment to monitor EDG reliability and availability according to the maintenance rule in 10 CFR 50.65, " Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," EDG performance criteria will be measured by using conditional success probability (CSP); that is, the product of availability and reliability of an EDG, which means that an EDG is available for operation and it will start and run for its desired mission time. For the 3-day AOT, the licensee computed a CSP value to be 93.8% while 92.8% is calculated for the extended 7-day AOT. The licensee will use the CSP to set and monitor future EDG performance goals. Currently, the licensee has ad goal of maintaining a CSP value greater than 95%, which is comparable to a goal set by the industry.

9.

To further minimize the likelihood of a plant transient, the licensee's daily scheduling program guidelines require the evaluation of the effect of adding more work to the schedule or removing additional redundant equipment from service from a TS and risk standpoint. For instance, AS 3.8.1.1.c requires that the licensee verify that the required systems, subsystems, trains, components, and devices that depend on the remaining EDG as a source of emergency power are operable.

le m.m-___.__

, 10.

All planned work activities cre currently scheduled over 13 weeks (quarterly) and the work and testing are normally divisionalized by scheduling one division in a week, thus precluding work on both divisions at the same time. In case of electricalinstability or of possible severe weather, the inspection is deferred.

Based on the above assessment and the January 30,1997, submittal that restricts the AOT durations according to the operability of the AAC power source, the staff finds that Fermi 2 has (1) several design features (i.e., offsite and onsite power sources, and an AAC source) that-can reduce the overall plant risk from an SBO event, (2) comparable EDG reliability, availability, and performance goals with established industry averages, and (3) adequate TS measures to minimize the likelihood of SBO events before removal of an EDG from service.

3.1.2 Risk Evaluation To gain risk insights, the staff used a three-tiered approach to evaluate the risk associated with the proposed amendment. The first tier evaluated the PRA model and the impact of the change on plant operational risk. The second tier addressed the need to preclude potentially high risk configurations if additional equipment will be taken out of service simultaneously or other risk significant operational factors such as concurrent system or equipment testing are involved.

The third tier evaluated the licensee's configuration risk management program to ensure that equipment removed from service prior to or during the proposed AOT will be appropriately assessed from a risk perspective. Each tier and the associated findings are discussed below.

Tier 1: PRA Evaluation of AOT Extensions The licensee used traditional PRA methodology to evaluate the requested AOT extension for EDGs. The Tier 1 staff review of the licensee's PRA involved two aspects:

(i) evaluation of the PRA model and application to the proposed AOT extensicn, and (ii) evaluation of PRA results and insights stemming from the application. The review did not warrant an assessment of any unconventional PRA practices or unique features that could impact the PRA findings and conclusions.

(i)

Evaluation of PRA Model and Application to the AOT Extension The staffs review focused on the capability of the licensee's PRA model to analyze the AOT risk stemming from the modified AOTs for EDGs. This activity, however, did not involve an in-depth review of the licensee's PRA to the extent necessary to validate the licensee's overall quantitative estimates. This was based on the staffs initial screening process that examined the licensee's internal event PRA for completeness, recent experience regarding LOOP and EDG reliability and availability, and plant-specific features such as EDG configurah,ns, offsite sources, and other systems critical to mitigation of a LOOP event. The staff concludes that the licensee's PRA results are reasonable, and the scope and depth of the PRA analysis supports such a finding. Recent data for EDG and offsite AC power reliability and availability do not indicate adverse 1

.a

,. trends. The AAC capability of the CTG r.nd other safety system features are reflected in the PRA analysis.

The licensee's PRA involves Level 1 and Level 2 analyses, it reflects refinements and plant changes made since the completion of the individual plant examination (IPE). The staff finds that the licensee has made efforts to maintain its PRA such that it represents the as-built, as-operated plant and that both intemal and extemal peer reviews have been performed on its Level 1 PRA. The licensee's Level 2 PRA has not been updated; therefore, the large early release frequency (LERF) calculation is approximated by mapping each core damage end state to an appropriate release end state. The PRA analysis modeled both generic and plant-specific accident initiators, and these iriitiators are consistent with those identified in other PRAs. The licensee's PRA modeled and took credit for the cross-tie capability between ESF buses and the four CTGs, one (CTG 11-1) of which has a black start capability and is the SBO AAC power source.

Since the common cause failure (CCF) of EDGs is potentially a dominant contributor to the plant SBO risk, the staff examined the licensee's CCF analysis for reasonableness. - The licensee's PRA uses the Multiple Greek Letter (MGL) methodology and includes failure of two, three, and four EDGs in its analysis.

The beta, gamma, and delta factors used in the analysis were obtained from an industry generic database and are generally consistent with those in other PRAs.

Therefore, the staff finds the licensee's CCF modeling of EDGs to be reasonable.

The staff also examined the LOOP initiating event frequency, EDG failure probability, reactor core isolation cooling (RCIC) and high pressure coolant injection (HPCI) failure probability, AAC failure probability, battery hours, and recovery probability of AC power sources used in the licensee's PRA. The staff finds that the licensee performed a detailed LOOP analysis for its PRA and the analysis was available for staff review. The staff notes that the licensee has recently upgraded the control system for CTC 11-1, and enhanced its black start capability. The battery depletion time is 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> without recharging, and load shedding is also called for in procedures to extend the battery life; however, it was not credited in PRA. The licensee PRA modeled failure to recover preferred (offsite) AC power before core damage. The non-recovery probabilities are generally high, and it is attributed to the LOOP characteristic at the site that is dominated by severe weather, i.e., tomados and snow and ice storms. These assumptions are consistent with the NUREG-1032, "Evolustion of Station Blackout Accidents at Nuclear Power Plants."

The staff, therefore, finds that the licensee's PRA analysis can adequately l

assess the proposed EDG AOT from a risk perspective.

i l

^

.g.

(ii) -

Evaluation of PRA Results and insights Associated with the Proposed Change Fermi 2 has several design features that lower its plant SBO risk. These include an offsite power distribution system with two entirely independent divisions each connected to a different switchyard, an onsite AC power system with four EDGs with intra-divisional cross-ties,4-hour DC batteries, and four CTGs--one with black start capability, which is an AAC source at the site. The IPE estimated the core damage frequency (CDF) as 5.7x104/yr (intemal events) and an updated 1995 PRA increased the estimate to 6.5x104/yr. The difference in CDF stems

{

from both changes made to the plant since the original IPE and software model J

I refinements. The SBO contribution to the plant CDF was estimated to be approximately 1.3x10-7/yr for botn the IPE and updated PRA. This estimate is i

l considered small as compared to other boiling-water reactor (BWR) plants. This low estimate stems primarily from design features, such as the CTGs and crossties. The staff also notes that the plant site is not vulnerable to hurricanes, and the EDG reliability and availability data have been generally high. The PRA indicates that the long-term SBO sequences, where either RCIC or HPCI initially.

)

injects coolant makeup to the core but fails as batteries are drained later, dominate the SBO risk. The short-term SBO sequences had a negligible contribution (6x104/yr).

The increase to the total CDF due to the proposed EDG AOT extension was estimated to be 1x10'7/yr. For EDG 14, which is considered to be the. worst case among the EDGs on site (due to its loading requirement), the incremental conditional core damage probability (ICCDP) is approximately 1.2x10-7 The licensee indicates that the associated AC division would be declared inoperable when an EDG is taken out of service, although the remaining EDG may still be I

i available to power associated safety equipment. Fermi indicates that any one EDG can safely shut down the plant with a high probability (>94%). With both EDGs 11 and 12 out of service simultaneously (one electrical division), which is a more limiting condition than EDG 14 out of service, the associated ICCDP is estimated to be 3.5x10-7 The licensee reports that the LERF would increase by approximately 3.0x104/yr with the proposed extended EDG AOT in place. The estimated incremental 4

. conditional large early release probability (ICLERP) is less than 2x10.

Therefore, the impact on the Level 2 risk of the proposed TS change is small.

i The ICCDPs and ICLERP above are below the staff guideline values of 5x10-7 for ICCDP and 5x104 for ICLERP published in DG-1065, "An Approach for Plant-Specific, Risk-Informed Decision Making: Technical Specifications," (62 FR

- 34321, June 25,1997), in addition, the changes in CDF and LERF are within the staff guidelines published in DG-1061, "An Approach for Using Probabilistic Risk Assessment in Risk-informed Decisions on Plant-Specific Changes to the Current Licensing Basis" (62 FR 34321, June 25,1997).

7

)

o-7 Based on the Tier i review, the staff concludes that tha PRA model used for the proposed plant-specific change in EDG AOT is reasonable, and the risk impact of the change is small. The staff's Tier i review, therefore, supports the AOT extension request.

Tier 2: Avcidance of Risk Significant Plant Configurations The staff concluded that the verification of the operability of CTG 11-1 is necessary to compensate for the risk of having an EDG out of service for greater than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The proposed TS requires the licensee to verify CTG 11-1 is operable when the EDG AOT is entered. If CTG 11-1 becomes inoperable during the 7-day AOT and cannot be restored to operable status, the AOT reverts back to 3 days, not to exceed a total of 7 days from the time the EDG originally became inoperable.

In its program, the licensee identified the essenL41 DC and AC equipment in addition to decay heat removal systems that are more risk significant (" Moderate") when a single EDG is out of service. The licensee did not identify the need for adoitional requirements in the TS that would restrict concurrent outage of other systems / components to avoid risk significant configurations ("High" or " Unacceptable"). Prior to removing an EDG from service for planned maintenance, the licensee indicated that it normally considers whether any severe weather is predicted, potentially deferring the planned work.

Tier 3: Risk-Informed Plant Configuration Management The staff recognizes the licensee has in place controls on equipment outages to reduce the likelihood of risk significant plant configurations during the proposed EDG AOT. The licensee's work scheduling and control process includes provisions for performing a proceduralized risk-informed assessment of both planned and unplanned maintenance activities. The licensee's process states that advance preparations are made to minimize the out-of-service time during maintenance activities at power. Additionally, system outages are not scheduled cross divisionally and no more than one safety system outage is scheduled at any one time. -The licensee's maintenance risk matrix was created as part of the Maintenance Rule implementation and is scheduled to be updated annually. Given an outage, the licensse's Tier 3 process categorizes other systems or subsystems into four classes designated as " Low," " Moderate," "High," and

" Unacceptable" based on the quantitative criteria used for temporary risk increase. The staff did not ident#y the use of these quantitative criteria as weakness or deficiency during the recent Maintenance Rule Baseline inspection performed at the site. Changes in the duration of an outage requires involvement of the PSA group. Per work control procedures and guidelines, the licensee uses the risk matrix to evaluate the risk associated with scheduling work to avoid undue risk resulting from performing work.

This matrix is also used to assess risk significance prior to removing additional systems from service during a scheduled system / subsystem outage, such as a scheduled EDG outage, and management approval is required for entry into higher risk rankings, i

with entry into " Unacceptable" configurations prohibited. Any planned system outage is

)

evaluated to determine whether it meets the intent of the Maintenance Rule.

{

\\.

_____2_________-_________-_.

\\

~.

. The licensee includes in its risk matrix all of the systems modeled in its PRA. In addition, if a configuration is recognized where multiple systems, beyond the capability of the risk matrix, would be out of service simultaneously, the PSA group would be requested to perform the requisite analysis for evaluating the risk significance of the specific situation. The capability of the licensee's PSA group to perform the risk assessment within a reasonable amount of time was evaluated and is considered acceptable. Therefore, the staff believes that the licensee has established a process that addresses the shortcomings of the use of a risk matrix. In addition, the licensee incorporates both risk and deterministic insights in making decisions for unplanned l

situations.

The staff believes that the licensee's risk-informed configuration risk man'agement program (CRMP) will allow an evaluation of the risk associated with both scheduled and unschedule'd plant activities when performing the EDG maintenance at power. The licensee has also submitted a proposal that adds a description of the CRMP to the Administrative Controls Section of the TS.

The licenses and the staff have agreed to the implemeritation of the CRMP as described below.

The CRMP includes the following key elements:

Kev Element 1.

Implementation of the CRMP The intent of tne CRMP is to implement 10 CFR 50.65(a)(3) of the Maintenance Rule with respect to on-line maintenance for risk-informed TS (TS 3.8.1.1.b.2), with the following additions and clarifications:

a.

The scope of the structures, systems, and components (SSCs) to be included in the CRMP will be those SSCs modeled in the Fermi 2, Level 1, PRA in addition to those SSCs considered of high safety significance per Regulatory Guide (RG) 1.160, Revision 2 (the Maintenance Rule regulatory guide) that are not modeled in the PRA.

b.

The CRMP assessment tool is PRA informed and may be in the form of a risk matrix, computer program, or direct risk assessment by the PRA staff. Evaluations may have quantitative or qualitative bases.

c.

CRMP will be invoked as follows for:

Risk-informed Inoperability: A risk assessment will be performed prior to entering the applicable Limiting Condition for Operation (LCO) Action Statement for pre-planned activities. For unplanned activities that result in LCO entry prior to assessing risk, a risk assessment will be performed in a time frame consistent with the plant procedures and programs.

Additional SSC inoperability and/or Loss of Functionality: When in the risk-informed AOT, if an additional SSC within the scope of the CRMP becomes inoperable / nonfunctional, a risk assessment shall be performed in a time frame consistent with the plant procedures and programs.

I

, d.

CRMP provides an evaluation of the risk significance of planned maintenance associated with equipment unavailability. CRMP implementation manages scheduling maintenance on risk-significant equipment combinations. For unplanned entry into the risk-informed LCO, the same type of risk assessment is performed that considers the current plant configuration, including unavailability of SSC defined per Key Element 1a above.

Kev Element 2.

Control and Use of the CRMP Assessment Tool a.

Plant modifications and procedure changes will be monitored, assessed, and dispositioned as part of the normal PRA update process.

Evaluation of the changes in plant configuration or PRA model features can be dispositioned by implementing PRA model changes or by the qualitative assessment of the impact of the changes on the CRMP assessment tool. This qualitative assessment recognizes that changes can be effectively compensated for without compromising the ability to make 8ound engineering judgments.

Limitations of the CRMP assessment tool are identified and understood for each specific AOT extension.

b.

Procedurec exist for the control and application of CRMP assessment tools, including l

description of process when outside the scope of the primary CRMP assessment tool.

l Key Element 3.

Level 1 Risk-informed Assessment The CRMP risk assessment tool is primarily based on a Level 1, a; power, internal events PRA model. The CRMP assessment may use any combination of quantitative and qualitative input.

Quantitative assessments can include reference to a risk matrix, pre-existing calculations, or new PRA analyses.

a.

Quantitative assessments should be performed whenever necessary for sound decision making.

b.

When quantitative ast.essments are not necessary for sound decision making, or are beyond the scope of the PRA model, qualitative assessments may be performed.

Qualitative assessments will consider applicable or existing insights from quantitative assessments previously performed.

Kev Element 4 Level 2 issues /Extemal Events Extemal events and Level 2 PRA issues, as a minimum, are treated when these considerations are judged to be important using e"f,6 qualitative or quantitative approaches. Guidance for implementing the CRMP is provided by plant procedures and programs.

. Based on the information provided by the licensee, the staff concludes that the licensee's Tier 3 approach is reasonable for the purpose of the proposed extended EDG AOT.

Based on the three-tiered approach, the staff finds the following:

The proposed AOT modifications have only a small quantitative impact on plant risk. The e

calculated ICCDP for a single AOT is small, primarily because of the robust plant design features such as the AAC source, switchyard design, and four EDi..

The licensee verifies CTG 11-1 is operable when the action statement for an inoperable e

EDG is entered, as required by the TS. The licensee's submittal also includes several compensatory measures and normal plant practices that help avoid potentially high risk configurations during the proposed extended EDG AOT.

The licensee has implemented a risk-informed plant CRMP to assess the risk associated e

with the removal of equipment from service during the AOT. The program provides the necessary assurance that appropriate assessments of plant risk configurations using a risk-i informed tool and process, augmented by engineering judgment and PSA group involvement, are performed for EDG AOTs. The program supports the proposed EDG AOT extension.

Implementation and Monitonng The staff expects the licensee to implement these TS changes in accordance with the three-tiered approach described above. The licensee has also indicatea that the maintenance scheduling practice and the tools used to implement a means of evaluating the impact of maintenance activities on plant configurations are consistent with the Maintenance Rule (10 CFR 50.65). The AOT extension will allow efficient scheduling of on-line maintenance within the boundaries established by implementing the Maintenance Rule. The licensee will monitor EDG performance in relation to the Maintenance Rule performance criteria. Therefore,

. application of these implementation and monitoring strategies will help to ensure that extension of TS EDG AOT does not degrade operational safety over time and that the risk incurred when an EDG is taken out of service is minimized.

3.1.3 Overall Conclusion of the EDG AOT Extension for AS 3.8.1.1.b and Addition of TS 6.8.5.h With all of the diverse offsite, onsite, and AAC power sources available, the staff concurs with the licensee that the EDG AOT extension and the on-line inspection will have small impact on the overall plant risk and will improve operational flexibility. In approving the extension of the AOT from 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to 7 days, the staff relied upon the existing surveillance requirement that CTG 11-1 is verified to be operable by starting and supplying loads on a monthly basis and upon the new requirement that the licensee periodically verify the CTG is operable while an EDG is out of. service. If the licensee finds that CTG 11-1 is inoperable, the AOT would revert back to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> consistent with the existing TS.

l

~

i

( The proposed TS 6.8.5.h and the supporting information were reviewed based on the draft staff guidance, it appears that the proposed CRMP program is in accordance with the guidance.

The staff concludes that the proposed AS 3.8.1.1.b, which pertains to extending the EDG AOT from 3 to 7 days, and TS 6.8.5.h, which pertains to the CRMP, are acceptable.

3.2 Revision of AS 3.8.1.1.d The licensee proposes to delete AS 3.8.1.1.d in its entirety and replace it with the following paragraphs:

With both of the above required onsite A.C. electrical power divisions inoperable;

1. Demonstrate the OPERABILITY of the remaining A.C. sources by performing Surveillance Requirement 4.8.1.1.1 within one hour and at least once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter; and

2. Restore at least one of the above required inoperable divisions to OPERABLE status within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />; and

3. Restore the second of the above required divisions to OPERABLE status within the time required by Action b above from the time of initial loss or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

The staff has reviewed the proposed change and finds that there are no substantive changes to the existing AS other than rearranging the current AS into three separate sentences for l

clarification and including the newly approved 7-day EDG AOT. Therefore, the staff concludes i

that the proposed AS 3.8.1.1.d is acceptable.

I 3.3 Modifiemtinn of R==as Sections 3/4 8.1 (A.C. Sources). 3/4 8.2 (D C. Sources). and 3/4.8.3 (Onsite Power Distribution Svatoms)

The licensee proposes that the Bases sections of the TS for the electrical power systems (Sections 3/4.8.1,3/4.8.2, and 3/4.8.3) be revised because of the changes in the duration of the EDG AOT. The current 72-hour AOTs for the AC and DC power sources are based on RG 1.93, " Availability of Electric Power Sources," December 1974. Because the proposed 7-day AOT is not included in RG 1.93, the licensee proposes to add the words "in part," as follows:

. The A.C. and D.C. source allowable out-of-service times are based, in part, on Regulatory Guide 1.93...."

- in its April 27,1998, submittal, the licensee omitted this change on page B 3/4 8-1. However, in a telephone conversation on May 18,1998, the licensee confirmed that this omission was