ML20249A527
| ML20249A527 | |
| Person / Time | |
|---|---|
| Site: | San Onofre  |
| Issue date: | 06/12/1998 |
| From: | Rainsberry J SOUTHERN CALIFORNIA EDISON CO. |
| To: | NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| Shared Package | |
| ML20249A528 | List: |
| References | |
| NUDOCS 9806170013 | |
| Download: ML20249A527 (16) | |
Text
)
(Bf EDISON L M 2 "'u - n, h
50UlHikN CAllFORMA An LDl50N 1%Tfil%AT10NAL* Compeny June 12, 1998 U.S. Nuclear Regulatory Commission Attention: Document Control Desk Washington, D.C.
20555 Gentlemen:
Subject:
Docket Nos. 50-361 and 50-362 Additional Information Regarding Amendment Application Nos.150 and 134, "EDG Allowed Outage Time Extension."
San Onofre Nuclear Generating Station, Units 2 & 3
References:
1)
Letter dated November 2, 1995, from R. M. Rosenblum (SCE) to Document Control Desk (NRC),
Subject:
Amendment Application Nos. 150 and 134, Extension of Emergency Diesel Generator Allowed Outage Time, San Onofre Nuclear Generating Station, Units 2 and 3.
2)
Letter dated January 9, 1998, from D. E. Nunn (SCE) to Document Control Desk (NRC),
Subject:
Amendment Application I
Nos.150 and 134, Supplement 1, Extension of Emergency Diesel Generator Allowed Outage Time, San Onofre Nuclear Generating
[
Station, Units 2 and 3.
Enclosed is additional information in support of Amendment Application Nos.
150 and 134 for the San Onofre Nuclear Generating Station, Units 2 and 3 (References'Iand2). These Amendment Applications requested an extension to l
the Allowed Outage Time of the Emergency Diesel Generator. This additional information was requested by the NRC during a meeting on May 21, 1998.
j l
.CVV^6 9906170013 980612 I I
PDR ADOCK 05000361 P
PDR-San Onofre Nudear Generating Station -
P.O,Ikn 128 San Clemente CA 92674-0128 714 368-7420 l
t c:
(
Document Control Desk If you have any questions on this subject,'please call me.
l Sincerely, 6 3.L./2s,~s Enclosure cc:
E. W. Merschoff, Regional Administrator, NRC Region IV K. E. Perkins, Jr., Director, Walnut Creek Field Office, NRC Region IV J. A. Sloan, NRC Senior Resident Inspector, San Onofre Units 2 & 3 J..W. Clifford, NRC Project Manager, San Onofre Units 2 and 3 S. Y. Hsu, Department of Health Services, Radiologic Health Branch j
2 l
l l
F o
i l
l l
RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION ON THE I
SAN ONOFRE EMERGENCY DIESEL GENERATOR ALLOWED OUTAGE TIME EXTENSION REQUEST l
1 l
l J
l i
r-
.4!
' Table of Contents Questions and Responses l : Living PRA Model Peer Review
-Attachment 2: PRA Model Revision Procedure Attahhment 3i Loss of Offsite Power and Station Blackout Event Trees
- : Loss of Offsite Power and Station Blackout Events Top 50 Cutsets.
' Attachment 5: Living PRA Model Updates
~ Attachment 6: Internal Events Qualitative Level 2 Risk Results
.l f-l i
.l l
-=-_2_2_=--
['
List of Acronyms.
4
-AC' Alternating Current
. ABB/CE ABB Combustion Engineering, Inc.
AOT Allowed Outage Time CCFP Conditional Containment Failure Probability CCW Component Cooling Water l
CDF--
Core Damage Frequency CEOG Combustion Engineering Owners Group EDG-Emergency Diesel Generator ICLERP.
Incremental Conditional Large Early Release Probability.
j IPE -
Individual Plant Examination
. IPEEE Individual Plant Examination of External Events LERF Large Early Release Frequency LOCA Loss of Coolant Accident
' LOOP /SBO Loss of Offsite Power / Station Blackout NRC Nuclear Regulatory Commission
.PRA" Probabilistic Risk Assessment RCP Reactor Coolant Pump SCE-Southern California Edison Company SBO Station Blackout SONGS San Onofre Nuclear Generating Station -
.l l
'I l
QUESTION #1: Consistent with the Draft Regulatory Guide 1.174,"An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Current Licensing Basis," the staff expects that the scope and quality of the analysis conducted to justify the proposed changes be appropriate for the nature and scope of the change, and be based on the as-built and as-operated and maintained plant. Further, the current plant-specific PRA supporting the licensee proposal has been subjected to quality controls. The staff finds that your current PRA is different from the original Individual Plant Examination (IPE). Extensive review of the Joint Application Report for Emergency Diesel Generators (EDGs), responses to the staff requests for additional information, your plant-specific submittal, and your IPE has been performed to examine your PRA. The review resulted in the need for the following additional information for the staff evaluation of your plant-specific submittal.
Describe any independent peer reviews performed on your most updated PRA. What a.
quality control process do you have in order to maintain your current PRA representing the as-built and as-operated plant?
SCE Response: An extensive peer review of the San Onofre Living PRA was conducted in late 1996. Immediatelyfollowing the peer review, San Onofre instituted aprocedurali:ed process to track, independently review, and document changes to the Living PRA model.
A briefsummary of thatpeer review isprovidedin Attachment #1. Since that time, the San Onofre Living PRA has been controlled via a change process delineated in procedure PRA-lWV-001, "PRA ModelRevisions", Revision i, which isprovidedas Attachment #2. Thisprocedure establishes administrative controls andprovides guidelinesforperforming updates to maintain the Living PRA models currentfor San Onofre Units 2 and 3. Thisprocedure requires the review ofplant design and operation documents, such as Abnormal Operating Instructions, Design Change Packages, 1
Operating Procedures, etc., to determine of the PRA is impacted by the changes. The Living PRA modelis updated to reflectplant design and operating changes as near real time aspractical. Initiating events and component reliability / availability data are i
updated at periods no greater than once every two refueling cycles.
Page1of5
b.
Provide the following for staff review of your current PRA:
(a) a copy of the LOOP /SBO event tree, SCE Response: Enclosedin Attachment #3 are copies ofthe SONGS 2/3 Loss of Offsite Power and Station Blackout Event Trees.
(b) a list of dominant SBO sequences, SCE Response: Enclosedin Attachment #4 are the top 50 cutsetsfor Loss of Offsite Power / Station Blackout events.
l t
(c) major modeling assumptions for LOOP /SBO events, and SCEResponse: Major PRA modeling assumptions with respect to LOOP /SBO events include thefollowing:
a)
During an SBO event, the Class IE 125VDC batteries on busses A and B can supplypower up to 90 minutes without load shedding and 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> with loads wdding. 7he batteries on the other two busses, C & D, can l
t provide power up to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, b)
Although the turbine-driven auxiliaryfeedwaterpump may initially be available during an SBO event, it is conservatively assumed that the loss of the vital batteries and residting loss ofsteam generator level indication willlead to core damage, c)
Credit is takenfor the engineered dieselgenerator cross-tiefollowing an SBO.
(d) major differences from your original IPE.
SCE Response: Enclosed as Attachment #5, " Updates to the San Onofre IPE PRA Model", is a list ofsigmficant changes to the PRA model that have occurred since the originalIPE submittal. While the number ofchanges is substantial, there have besn no structural changes to the electricalpower system modelsince the IPE. The only major changesfrom the IPE affecting SBO were: (1) the revision of the RCP seal LOCA model to reflect more conservative ABB/CE assumptions and (2) increasing creditfor the EDG cross-tie capability. The EDG
- cross-tie has always been creditedin the San Onofre JPE, however, the likelihood ofits success will be improved sigmficantly with the installation of the engineered EDG cross-tie modification. The overall core damage impact of these model changes has been a reduction in the average CDFfrom 3.0E-5/yr reported in the Page 2 of 5
1993 SONGS 2/3 JPE to the current average CDF of 2.5E-05/yr. The Level 2 impact of these changes has not been quantifiedsince LERF um not calculatedat the time of the JPE submittal and CCFP is no longer calculatedfor the present model.
c.
Both the Joint Application Report (CE NPSD-996) and your plant-specific submittal qualitatively addressed the Level 2 risk associated with the proposed extended EDG AOT.
However, quantitative Level 2 risk information is also an important consideration when evaluating the risk associated with your proposed EDG AOT extension request. The conditional containment failure probabilities (CCFPs) and.large early release frequency (LERF) for both the current and proposed cases calculated from your updated PRA should be submitted for staff review. In addition, incremental conditional large early release probability (ICLERP) for a single 14-day AOT should also be submitted for staff evaluation of the risk associated with a single EDG outage.
SCE Response: Utili:ing the methodology described in CE NPSD-966, the current and proposed A OTextension internal events LERF values and single AOTICLERP were generated. See Attachment #6, Tables 1-1,1-2, and 1-3, for the results of these LERF andICLERP calcidations. Per Draft Reg. Guide.' 34, the residtant increase in LERF due to this AOTextensionfalls within acceptance Region Ill, and therefore, is considered acceptable. In addition, the single AOTICLERP value is much less than the 5.0E-08 1CLERP acceptance guidelinepublishedin NRC Draft Reg. Guide DG-1065. CCFP is no longer calctdatedfor the San Onofre PRA models and is not a risk metric in draft risk-informed Reg. Guides DG-1061 or DG-1065.
d.
No RCP seal loss of coola;.. accident (LOCA) was assumed during an SBO in your IPE.
Provide your engineering basis for making that assumption. Provide a discussion of how your PRA modeled the potential RCP LOCA during an SBO in your most updated PRA, if modeled differently from the IPE. If you have performed any sensitivity studies on potential seal failures during an SBO, provide the results. Explain why the potential RCP seal LOCA during an SBO is a negligible risk contributor for the proposed changes.
SCEResponse: The San Onofre IPE model assumed that no RCP seal LOCA would occur during an SBO based on information provided in Combustion Engineering's response to draft NUREG-1032, (CE NPSD-340, "Enduation ofStation Blackout Accidents at Nuclear Power Plants", March 1986). This documentpresented the residts of SBO simulated tests as well as documentation ofRCP seal performance during actual loss of CCW events at CEplants. A simulatedstation blackout test at RCS temperature andpressure wasperformed with aprototype cartridge ofsimilar design as those used at San Onofre (4 seal stages, each ofwhich is designed to withstandfull RCSpressure and temperature). The test was rumfor 50 hours5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br /> without loss ofsealfunction. A second test ran a prototype RCPfor 30 minutes without component cooling water cooling. During the 30 minute test, sealfunction was maintained. The restdts of these tests are consistent Page 3 of 5
with actual operating historical experience. As documented in the CE NPSD-340, there j
have been a number ofinstances in which these types ofpumps were runfor longperiods of time without CCW cooling. 7hese instances, none of which resultedin loss ofseal function, were more severe than an SBO event since the pump would not be running following an SBO event and thus would not be generating additional seal heat. Based on this information, Sim Onofre did not consider RCP seal LOCA to be a credible event if thepumps are not running.
l However, after the IPE was submitted San Onofre revised the Living PRA model to
\\
include the potentialfor an RCP sealLOCA (LSE-3) even if the RCPs are tripped within 30 minutes based on an assessment by ABB/CE ofall CEplant RCPs (CEOG Letter / Report CEOG-92-3203, " Additional Analysis ofRCP SealFailure Given a Loss of Cooling", Jime 15,1993). Since no RCP sealfailure has occurredin a CE PWR, this I
value was based on a conservative extrapolation ofsealleakage events (< 3 gym) when one or more stages were observed to befailed or degraded. A more recent examination of this experience indicates that RCP sealfailure probabilities are more than an order of magnitude lower than that usedin the current SCE model.
i For multiple unit sites, potential dual-unit initiators, single-unit initiators that propagate to e.
the other unit, and shared systems can be important in PRA. Explain how your cunent PRA addresses these issues and provide a quantitative or qualitative discussion that these issues either have been adequately taken into account in your analysis or have a negligible risk impact due to the proposed changes.
SCEResponse: Dual-unit initiators were evaluated aspart of the IPE effort and were s
determined to not contribute measurably to the core damage risk. Dual-unit initiators were consideredin the EDG AOTextension analysis and were also not considered to measurably contribute to core damage risk. 7he common systems in the Living PRA model shared by Units 2 and 3 include instrument air, normal chilled water, emergency l
chilled water, turbine plant cooling water, and vital 4kVpower (onlyfor secondary and emergency AC sources). The potentialfor maintenance unavailability orfailures in these common systems to impact both units is explicitly modeledin the San Onofre Safety Monitor. The only single unit initiatorpotentially impacted by the EDG AOTextension is a plant centered loss of offsite power at one unit. This event requires a number of multiplefailures whose likelihoods negligible to propagate to the other unit and cause a core damage event. The breakerprotection scheme at each unit ensures that any electricalfaidts on one unit will notpropagate to the other unit. The San Onofre 2/3 Configuration Risk Management Program will ensure during an extended outage of a EDG that no other EDGs at either unit will voluntarily be removedfrom service and the EDG cross-tie capability will be available.
Page 4 of 5 i
j l
u ___ _
1 QUESTION #2:.Your IPEEE analysis shows that the average CDF contributed by external events exceeds that contributed by internal events. Discuss the impact on external event risk due to the proposed changes either quantitatively or qualitatively, and justify that the impact on the external event risk would not result in a different overall risk perspective.
'SCE Response: The SONGS 2/3 IPEEE analysis determined the average CDF contributed by external events to be 3.3E-5 peryear. This compares to the SONGS 2/3 IPE analysis which calculated an internal events average CDF of 3.0E-5 peryear. The contribution to core damage l
riskfrom external events is dominated by seismic andfire initiating events. liigh winds, floods, l
and other hazards were notfound to contribute to the overall core damage probability. The single 14 day ACT core damage riskfor seismic events was anal >=ed andfound to be less than the NRC acceptance criteria ofSE-7. The impact of the EDG AOT extension onfire initiators was evaluated andfound to be much less likely than those causes analyzed in the internal events PRA. Therefore, the inclusion ofexternal events in the analysis does not change the overall acceptability ofthe AOTextension.
QUESTION #3: According to your submittal, the cross-tie capability, recently installed at your site and modeled in your current PRA, significantly reduces the SBO risk contribution from 1.8E-6/yr to 5.91E-8/yr. The cross-tie was worth over 1.7E-6/yr for the SBO CDF. You have also indicated that the cross-tie reduced the total CDF by 3.4E-6/yr (11% reduction in total CDF).
The stafrexpects that the cross-tic capability would dominantly contribute to the reduction in the SBO risk; however, your submittal indicates that the SBO CDF reduction accounts for only 50%
of the total CDF reduction. Please explain how the cross-tic contributes to the remaining non-SBO risk.
SCE Respcmse: The EDG cross-tie does not contribute to any events other than SBO. The values referred to above were provided in a CEOG response, dated March 26,1997, to a prior NRC requestfor additionalinformation on the EDG AOTextension. 7he values were contained in i
I responses to two different NRC questions, numbers 6 and 7. The responses were not identical
<lue to subtle differences in the NRC questions. In question 6, the NRC requested the change in i
core damage risk due to crediting any alternate AC or EDG cross-tie capability, which was 3.4E-6/yr. This value is the difference in internal events SBO core damage riskfrom a case where no credit is takenfor any EDG cross-tie versus the post-IPEEE Living PRA where the engineered EDG cross-tie was credited in question 7, the NRC requested the change in core damage riskfrom the JPE due to crediting any alternate AC or EDG cross-tie capability, which was 1.7E-6/yr. This value is the difference in the internal events SBO core damage risk reported in the IPE versus thepost-IPEEE Living PRA where the engineered EDG cross-tie was credited San Onofre has had the capability to cross-tie the EDGs since the late 1980s and as such limited credited was assumed in the IPE. Ilowever, during preparation of the IPEEE, San Onofre determined that upgrading the EDG cross-tie capability via a plant modification would sigmficantly improve its likelihood ofsuccess and sigmficantly reduce the contributionfrom core damage due to seismic events. Therefore, the total value ofthe EDG cross-tie in reducing
{
Internal events SBO core damage risk is 3.4E-6/yr.
Page 5 of 5 l
i LL-__--__.
4 9
4 i
ATTACHMENT #1 LIVING PRA MODEL PEER REVIEW
A comprehensive independent peer review of the SONGS 2/3 Level 1 and Level 2 internal events living PRA for full power and shutdown operations was conducted between August 1996 and April 1997 by Dr. Parviz Moleni of SCIENTECH, Inc.. The review was mainly based on the guidance provided in the PRA procedure guides such as NUREG/CR-2300 and NUREG/CR-4550 as well as PRA applications documents such as EPRI TR-105396 and NUREG-1489. A database (called as the PRA Review Punch List) was developed by SCE as a mechanism to systematically track the review comments. The scope of the peer review is outlined in detail below.
I. System Fault Trees The following system fault trees with their assumptions and associated basic event (BE) calculation files were reviewed:
Low Pressure Safety Injection (LPSI)
Containment Spray / Containment Emergency Cooling (CS/ CEC)
High Pressure Safety Injection (HPSI)
Heating, Ventilation and Air Conditioning (HVAC)
Component Cooling Water (CCW)
Chemical and Volume Control System (CVCS)
Main Feedwater (MFW) and Condensate Main Steam System (MSS)
Electric Power (EP) j Instrument Air (IA) i Plant Protection System ( PPS)
Safety Injection Tank System (SIT)
Reactor Coolant System (RCS) Pressure Control Containment Isolation System (CIS)
Saltwater Cooling System (SWC)
The above list represents all the system fault trees in the SONGS 2/3 Living PRA.
i Page1of5 L__.__.m_______
II. Event Trees
- The following event trees with their assumptions and associated BE calculation files were reviewed:
Loss of Power Conversion System (PCS)
Transients with PCS Initially Available (TT)
Loss ofOffsite Power (LOP)
Station Blackout (SBO).
. Main Steam Line Break (SLB)
Small Small LOCA (SSL)
Steam Generator Tube Rupture (SGR)
Loss of125V DC Bus (LDC)
Loss of Component Cooling Water (CCW) l Interfacing System LOCA (VL)
Reactor Pressure Vessel Rupture (VR)
Anticipated Transient Without Scram (TWS)
Internal Flooding Analysis '
The above list represents all the event trees in the Level-1 SONGS 2/3 Living PRA.
III. Basic Event (BE) Calculation Files As part of the SONGS 2/3 Individual Plant Examination (IPE) study, a large number of basic event (BE) calculation files had been developed to suppon a variety of tasks such as human reliability analysis (HRA) and common cause failure (CCF) analysis. All the BE calculation files related to the following topics were reviewed.
Fault tree analysis Event tree analysis Common cause failure analysis Pre-and post initiating event operator actions Plant-specific equipment data analysis (i.e., Bayesian update of equipment failure rates)
Plant-specific maintenance unavailability calculations
. Over 200 BE calculation files were reviewed.
Page 2 of 5
'l
_n.L
r a
l' l
. IV. Level-2 Extended Event Trees (EETs)
The following Level-2 extended event trees with their assumptions were reviewed:
Loss of Power Conversion System (PIE and P2E) i Transients with PCS Initially Available (TlE and T2E)
~
Loss of Offsite Power (LPE)
Station Blackout (SBE)
Main Steam Line Break (MSE)
Large LOCA (LLE)
Medium LOCA (MLE)
Small LOCA (SLE)'
Steam Generator Tube Rupture (GIE, G2E, and G3E) l Loss of125V DC Bus (LDE)
Loss of Component Cooling Water (CWE)
Interfacing System LOCA (VLE)
Anticipated Transient Without Scram (AWE)
The above list represents all the extended event trees in the Level-2 SONGS 2/3 Living PRA.
V. Shutdown PRA Fault Trees The following shutdown PRA fault trees with their assumptions and associated BE calculation i
1 files were reviewed:
Spent Fuel Pool Cooling System (SXSDR)
CS/LPSI for Spent Fuel Pool Cooling (TXSDR)
Spent Fuel Pool (SFP) Makeup via SPF Makeup Pump P011 (YXSDR)
SFPC Pumps for SFP Inventory Makeup (SMSDR)
Shutdown Cooling System (AXSDR)
Charging System - for Injection (DXSDR)
HPSI for PCS Inventory Makeup (HXSDR)
LPSI for PCS Inventory Makeup (VXSDR)
Containment Spray for Inventory Makeup (NXSDR)
Component Cooling Water (EXSDR)
Heating, Ventilation and Air Conditioning (MXSDR)
Saltwater _ Cooling System (PXSDR)
Electric Power (UXSDR)
Instrument Air (BXSDR)
Plant Protection System (KXSDR)
. The above list represents all the system fault trees for the SONGS 2/3 shutdown risk assessment.
l Page 3 of 5 l'j
l
\\
I VL Shutdown PRA Event Trees All the shutdown PRA event trees with their assumptions and associated BE calculation files were reviewed. A total of 32 event trees associated with 4 initiating events and 8 plant operating configurations had been developed in the shutdown PRA. The 4 initiating events are:
Loss of Operating Shutdown Cooling (SDC) Train Loss of RCS Inventory Plant-Centered Loss of Offsite Power Grid-Related Loss of Offsite Power i
The 8 plant operating configurations are:
Configuration 1 - RCS Water Level l' Below RV Flange, Fuel in the Core
. Configuration 2 - RCS Operation, Fuel Offloading in Progress Configuration 3 - Spent Fuel Pool (SFP) Operation, Fuel Offloaded in the SFP Configuration 4 - SFP Operation with CS/SFP Cross-Tie Inservice, Fuel Offloaded in the SFP Configuration SA - SFP Operation with CS/SFP Cross-Tie Inservice, Fuel Reloading in
- Progress Configuration 5B - RCS Operation, Fuel Reloading in Progress Configuration 6 - RCS Water Level l' Below RV Flange, Fuel Reloaded Configuration 7 4fidloop Operations, Fuel Reloaded The event trees for spent fuel pool were not available for review.
Vit Shutdown HRA Worksheets A sample (three) of the human reliability analysis (HRA) BE calculation files related to the shutdown PRA were reviewed.
Page 4 of 5 A2._A_._i_-.._.
m.
Vill. Seismic-Related HRA Worksheets The seismic HRA methodology described in Section 3.6.4 of the IPE for External Events (IPEEE) study was reviewed. Also, tne following seismic-related HRA BE calculation files were '
reviewed:
Operator failure to reset relays for battery chargers 'OP64)
Operator failure to failure to open SWC pump diwharge valve and start the redundant SWC pump (OP91)
Operator failure to. reset and start the DG following relay or process switch chatter (OP13)
Operator failure to align fire truck for CCW makeup given primary plant makeup (PPMU) tank is unavailable (OPFIRETNKR)
Operator failure to respond to high temperature alarm in the switchgear/ distribution room and align portable ventilation (OPALTVENT)
The above list represents all the seismic-related HRA BE calculation files for SONGS 2/3 IPEEE study.
i' IX. Fire-Related HRA Worksheets The fire HRA methodology and the following fire-related HRA BE calculation files were reviewed:
Operator failure to activate fire procedure SO23-13-2 (Shutdown from Outside the Control Room)
Operator failure to manually control Train A AFW/HPSI/CS from outside the control room following a control room fire Operator failure to manually start the diesel generator (DG) from the DG room following a control room fire Operator failure to manually start the diesel generator (DG) from the control room following a relay room fire The above list represents all the fire-related HRA BE calculation files for SONGS 2/3 IPEEE study.
i i
Page 5 of 5
__=__-__:___-__ _ - _.