ML24038A174

Pre-submittal Meeting Slides

ML24038A174
Person / Time
Site:	Palo Verde
Issue date:	02/07/2024
From:	Arizona Public Service Co
To:	Office of Nuclear Reactor Regulation
Lingam S, 301-415-1564
References
Download: ML24038A174 (1)

Text

Risk-Informed Process for Evaluations (RIPE) License Amendment Request for Safety Injection Tank (SIT) LCO 2nd Pre-Submittal Meeting Palo Verde Nuclear Generating Station (PVNGS)

February 7, 2024

2 Agenda Introduction Issue Description Proposed TS Changes RIPE Screening Question Responses Seven Defense-in-Depth Considerations Summary Path to Submittal

3 Proactive effort to increase SIT reliability by improving our operations and maintenance strategy based on recent plant operating experience Benefits of the proposed TS changes to 3.5.1 and 3.5.2 include:

Allowing for deliberate planning and execution Eliminates the need for control room staff to diagnose SIT instrumentation issues Avoids the potential introduction of internal events by challenging safety systems during Mode changes Risk analysis supports a LAR using the RIPE process to increase the LCO completion time for a single SIT out of service Issue Description

10 days 4

Proposed TS Changes 10 days

RIPE Screening Question Responses

6

1. Does the issue result in an adverse impact on the frequency of occurrence of an accident initiator or result in a new accident initiator? NO Summary There are no accident initiators related to a single required SIT being Inoperable per Condition B of Limiting Condition for Operation (LCO) 3.5.1 or 3.5.2, or per the second case of Condition A of LCOs 3.5.1 and 3.5.2 (one SIT Inoperable due to inability to verify level or pressure). Since the SITs are passive components, single active failures are not applicable to their operation.

Barriers are in place to prevent spurious operation of SIT isolation valves and SIT nitrogen vent valves. This issue does not involve placing the Unit in a different operating condition than currently allowed; thus, would not result in a new accident initiator or adversely affect the frequency of occurrence of an accident initiator.

Section 4.1 Response Question 1

7

2. Does the issue result in an adverse impact on the availability, reliability, or capability of SSCs or personnel relied upon to mitigate a transient, accident, or natural hazard? YES Summary Extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 10 days has the potential to increase the duration that one of the required SITs is Inoperable, which could have an adverse impact on availability of the required SITs to mitigate the consequences of a LOCA. The number of Operable SITs required by LCOs 3.5.1 and 3.5.2 is not being revised, nor are the functional requirements of an Operable SIT. No operator actions or response times are impacted. No adverse impact was determined for the reliability or capability of SSCs, or personnel relied upon to mitigate a transient, accident, or natural hazard.

Section 4.1 Response Question 2

8

3. Does the issue result in an adverse impact on the consequences of an accident sequence? NO Summary The issue would not result in an adverse impact on the consequences (i.e. radiological dose) of an accident sequence since reducing the frequency of core damage is not the intent of this question, as noted in ML22088A135. The SITs are designed to recover the core before significant clad melting or zirconium-water reaction can occur following a LOCA. Since this function is intended to minimize core damage, further consideration for mitigating the radiological dose consequences of an accident sequence is not required per ML22088A135.

Section 4.1 Response Question 3

9

4. Does the issue result in an adverse impact on the capability of a fission product barrier? YES Summary Section 4.1 Response Question 4 In the event of a LOCA while one required SIT is Inoperable, core recovery could be delayed until the LPSI and HPSI pumps are able to deliver sufficient flow to reflood the core. This issue could affect the ability to meet the acceptance criteria of 10 CFR 50.46 following a LOCA and consequently have an adverse impact on the capability of the fuel cladding to act as a fission product barrier.

Fuel Cladding The RCS pressure boundary has already failed when the SITs are required to fulfill their specified safety function. This issue would not have an adverse impact on the capability of the RCS pressure boundary to act as a fission product barrier.

RCS Pressure Boundary The SITs provide no function to preserve Containment integrity. This issue would not have an adverse impact on the capability of the Containment structure to act as a fission product barrier.

Containment

10

5. Does the issue result in an adverse impact on defense-in-depth capability or impact in safety margin? YES Summary The active and passive portions of the ECCS are taken credit for in both the large and small break LOCA analyses at full power. This issue could increase the duration that a required SIT is Inoperable, reducing the successive measures designed to mitigate the consequences of a LOCA.

As such, this issue could result in an adverse impact on defense-in-depth capability.

Section 4.1 Response Question 5

11

1. Does the issue result in more than minimal increase in the frequency of occurrence of an accident initiator or result in a new accident initiator? NO Summary There are no accident initiators related to a single required SIT being Inoperable per Condition B of LCO 3.5.1 or 3.5.2, or per the second case of Condition A of LCOs 3.5.1 and 3.5.2 (one SIT Inoperable due to inability to verify level or pressure). Since the SITs are passive components, single active failures are not applicable to their operation. Barriers are in place to preclude spurious operation of SIT isolation valves and SIT nitrogen vent valves. This issue does not involve placing the Unit in a different operating condition than currently allowed. It does not present a more than minimal increase in the frequency of occurrence of an accident initiator or result in any new accident initiators.

Section 4.2 Response Question 1 (No adverse impact)

12

2. Does the issue result in more than minimal decrease in the availability, reliability, or capability of SSCs or personnel relied upon to mitigate a transient, accident, or natural hazard? NO Summary The decrease in availability is considered minimal based on historical entries into Condition B of LCOs 3.5.1 and 3.5.2 being infrequent. The most-limiting 3-year historical average of 1.22 combined entries into Condition B of LCOs 3.5.1 and 3.5.2 per year per Unit was used as an input to the RIPE risk evaluation. The calculated yearly increase in CDF and LERF are well below the thresholds for risk significance specified in ML22088A135. Therefore, the issue is considered to have a minimal impact on safety and not result in a more than minimal decrease in the availability, reliability, or capability of SSCs or personnel relied upon to mitigate a transient, accident, or natural hazard.

Section 4.2 Response Question 2

13

3. Does the issue result in more than minimal increase in the consequences of a risk significant accident sequence? NO Summary The issue would not result in a more than minimal impact on the consequences (i.e. radiological dose) of an accident sequence since reducing the frequency of core damage is not the intent of this question, as noted in ML22088A135. The SITs are designed to recover the core before significant clad melting or zirconium-water reaction can occur following a LOCA. Since this function is intended to minimize core damage, further consideration for mitigating the radiological dose consequences of an accident sequence is not required per ML22088A135. It is worth noting that the PVNGS LOCA dose consequence analyses are highly conservative to the point of overestimating potential consequences. Additionally, the yearly increase in CDF and LERF calculated by the RIPE risk evaluation are well below the thresholds for risk significance specified in ML22088A135.

Section 4.2 Response Question 3 (No adverse impact)

14

4. Does the issue result in more than minimal decrease in the capability of a fission product barrier? NO Summary Section 4.2 Response Question 4 It is noted in ML17228B190 that best estimate analyses for a typical PWR confirmed that for large break LOCAs, core melt can be prevented by either the operation of one LPSI pump, or the operation of one HPSI pump and a single SIT. PVNGS at-power PRA success criteria for the SI System require two SITs to inject borated water into the RCS during a large break LOCA. These criteria would not be compromised while one required SIT is Inoperable. The yearly increase in CDF and LERF calculated by the RIPE risk evaluation are well below the thresholds for risk significance specified in ML22088A135.

This issue would not result in a more than minimal decrease in the capability of the fuel cladding to act as a fission product barrier.

Fuel Cladding The RCS pressure boundary has already failed when the SITs are required to fulfill their specified safety function. This issue would not result in a more than minimal decrease in the capability of the RCS pressure boundary to act as a fission product barrier.

RCS Pressure Boundary The SITs provide no function to preserve Containment integrity. This issue would not result in a more than minimal decrease in the capability of the Containment structure to act as a fission product barrier.

Containment

15

5. Does the issue result in more than minimal decrease in defense-in-depth capability or safety margin? NO Summary The plants design criteria will continue to be met as this change does not revise the number of Operable SITs required by LCOs 3.5.1 and 3.5.2, nor does it change the functional requirements of an Operable SIT. During an entry into Condition B the remaining Operable SITs remain capable of injecting into the RCS (minus one assumed to spill out the break) along with HPSI and LPSI. Appropriate balance among the layers of defense is preserved and the combined layers of defense in depth would remain effective. This change preserves sufficient defense against human errors and does not introduce a new common cause failure mode. The yearly increase in CDF and LERF calculated by the RIPE risk evaluation are well below the thresholds for risk significance specified in ML22088A135. This issue would not result in more than minimal decrease in defense-in-depth capability or safety margin.

Section 4.2 Response Question 5

Seven Defense-in-Depth Considerations

17

1. Preserve a reasonable balance among the layers of defense.

Reg Guide 1.174 defense-in-depth layers to protect the public Robust plant design to survive hazards and minimize challenges that could result in an event occurring Prevention of a severe accident (core damage) if an event occurs Containment of the source term if a severe accident occurs Protection of the public from any releases of radioactive material SITs support prevention of severe accident along with active portion of ECCS Other three defense in depth layers, and active portion of ECCS, not impacted Remaining SITs (minus 1) capable of injecting into the RCS PRA at-power LOCA success criteria for SITs would not be jeopardized CEOG Topical (ML17228B190) one HPSI pump and a single SIT can prevent core melt for large break LOCA Defense-in-Depth Considerations

18

2. Preserve adequate capability of design features without an overreliance on programmatic activities as compensatory measures.

No change to required number of Operable SITs or functional requirements of an Operable SIT SITs are passive with no operator or control action required No new operator actions, impact to EOPs, or change to established operator response times LCOs applicable to ECCS remain in effect and SRs will continue to be met Remaining SITs (minus 1) capable of injecting into the RCS prior to HPSI and LPSI delivery PRA at-power LOCA success criteria for SITs would not be jeopardized CEOG Topical (ML17228B190) one HPSI pump and a single SIT can prevent core melt for LB LOCA Defense-in-Depth Considerations (continued)

19

3. Preserve system redundancy, independence, and diversity commensurate with the expected frequency and consequences of challenges to the system, including consideration of uncertainty.

ECCS uses active and passive injection subsystems to supply borated water to the core The four SITs comprise the passive portion of the ECCS The active portion includes HPSI pumps, LPSI pumps, and associated valves Remaining SITs (minus 1) capable of injecting into the RCS prior to HPSI and LPSI delivery PRA at-power LOCA success criteria for SITs would not be jeopardized CEOG Topical (ML17228B190) one HPSI pump and a single SIT can prevent core melt for LBLOCA No impact to the LPSI or HPSI subsystems PRA model includes uncertainty considerations; risk evaluation required no additional sensitivity studies for key assumptions or sources of uncertainty Calculated yearly increase in CDF and LERF well below the thresholds for risk significance Defense-in-Depth Considerations (continued)

20

4. Preserve adequate defense against potential Common Cause Failures (CCFs).

ECCS designed with adequate defense against potential CCFs SITs provide passive injection into all 4 RCS cold legs SIAS features 2-out-of-4 initiation logic and diverse initiation conditions LPSI and HPSI subsystems separated into 2 independent trains Pumps and valves powered by offsite power, DGs, or SBOGs Each HPSI header feeds into all 4 cold legs LPSI headers each feed 2 different cold legs Issue does not introduce new common-cause failure mode Potential for CCF of components is accounted for in PRA model Defense-in-Depth Considerations (continued)

21

5. Maintain multiple fission product barriers.

Remaining SITs (minus 1) capable of injecting into the RCS prior to HPSI and LPSI delivery PRA at-power LOCA success criteria for SITs would not be jeopardized CEOG Topical (ML17228B190) one HPSI pump and a single SIT can prevent core melt for LBLOCA Calculated yearly increase in CDF and LERF well below the thresholds for risk significance specified in the NRC guideline for RIPE Capability of RCS and Containment barriers not adversely impacted Defense-in-Depth Considerations (continued)

22

6. Preserve sufficient defense against human errors.

SITs are passive with no operator or control action required No new operator actions No impact to EOPs No change to established operator response times Defense-in-Depth Considerations (continued)

23

7. Continue to meet the intent of the plants design criteria.

No change to required number of Operable SITs or functional requirements of an Operable SIT Accident analysis initial conditions remain the same No change to design basis analytical limits No changes to physical equipment, required operational conditions, or compliance with codes and standards Defense-in-Depth Considerations (continued)

24 Scope of PV RIPE change well defined PV IDP review provided value and good challenges RIPE screening questions

Defense-in-depth provided by robust design bases

No new risk management actions required PRA results for extending the AOTs of TS 3.5.1.B and TS 3.5.2.B from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 10 days are within the RIPE acceptance criteria An amendment using RIPE process is appropriate for extending the AOTs of TS 3.5.1.B and TS 3.5.2.B at Palo Verde Summary

25 Path to Submittal Completed Actions Challenge board w/ NEI - December 15, 2023 Pre-submittal meeting - January 4, 2024 Integrated Decision-Making Panel - January 31, 2024 In-Progress 2nd Pre-submittal meeting - February 7, 2024 Submittal expected - February 29, 2024 Requested approval - July 2024 (20 weeks)

Implementation within 90 days of approval

Questions