Text

License Amendment Request to Revise Technical Specifications 3.5.1 and 3.5.2 Using Risk-Informed Process for Evaluations
	ML24068A252
Person / Time
Site:	Palo Verde
Issue date:	03/08/2024
From:	-Neednewvalue; Arizona Public Service Co
To:	; Office of Nuclear Reactor Regulation, Document Control Desk
References
	02-08736-TAH/KJG
	Download: ML24068A252 (1)
	v • d • e

10 CFR 50.90 A member of the STARS Alliance, LLC Callaway

Diablo Canyon

Palo Verde

Wolf Creek TODD A. HORTON Sr. Vice President Nuclear Regulatory & Oversight Palo Verde Nuclear Generating Station P.O. Box 52034 Phoenix, AZ 85072 Mail Station 7602 Tel 623.393.6418 102-08736-TAH/KJG March 8, 2024 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001

Subject:

Palo Verde Nuclear Generating Station Units 1, 2, and 3 Docket Nos. STN 50-528, 50-529, and 50-530 Renewed Operating License Number NPF-41, NPF-51, and NPF-74 License Amendment Request to Revise Technical Specifications 3.5.1 and 3.5.2 using Risk-Informed Process for Evaluations Pursuant to 10 CFR 50.90, Arizona Public Service Company (APS) is submitting a request for an amendment to the Technical Specifications (TS) for Palo Verde Nuclear Generating Station (PVNGS) Units 1, 2, and 3.

The proposed changes revise TS Sections 3.5.1 and 3.5.2, and their bases using Risk-Informed Process for Evaluations (RIPE). The RIPE process is a Nuclear Regulatory Commission (NRC) approved risk-informed method that is used to disposition issues of very low safety significance that are within the licensing basis of a plant. The RIPE process is used to evaluate the safety significance of an issue, and if it is determined to be of low safety significance, an amendment request can be submitted to the NRC and qualify for a streamlined NRC review.

The enclosure to this letter provides a description and assessment of the proposed amendment using the RIPE process. The amendment request being submitted is consistent with Nuclear Energy Institute (NEI) 21-01, Industry Guidance to Support Implementation of NRCs Risk-Informed Process for Evaluations, dated June 2022, and the NRC, Guidelines for Characterizing the Safety Impact of Issues, Revision 2, dated May 2022 [Agencywide Documents Access and Management System (ADAMS)

Accession No. ML22088A135]. Attachment 1 of the enclosure provides the final screening impact results. Attachment 2 of the enclosure provides the final risk evaluation for the proposed amendment. Attachment 3 of the enclosure contains a summary of the plant Integrated Decision-making Panel (IDP) evaluation results. to the enclosure provides the existing TS pages marked up to show the proposed changes. Attachment 5 to the enclosure provides revised (re-typed) TS pages. to the enclosure provides marked up TS Bases pages to show the proposed changes. The changes to the TS Bases are provided for information only.

Pre-submittal meetings for this amendment request were held between APS and the NRC staff on January 4, 2024 (ADAMS Accession No. ML24003A853) and February 7, 2024 (ADAMS Accession No. ML24038A174). Additionally, an IDP meeting was held on January 31, 2024. Approval of the proposed amendment is requested by July 26, 2024.

Once approved, the amendment shall be implemented within 90 days.

102-08736-TAH/KJG ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Proposed Amendment to Technical Specifications 3.5.1 and 3.5.2 using RIPE Page 2 In accordance with the PVNGS Quality Assurance Program, the Plant Review Board has reviewed and approved the license amendment request (LAR). By copy of this letter, the amendment is being forwarded to the Arizona Department of Health Services -

Bureau of Radiation Control for information.

No new commitments are being made to the NRC by this letter.

Should you need further information regarding this letter, please contact Matthew S.

Cox, Licensing Department Leader, at (623) 393-5753.

I declare under penalty of perjury that the foregoing is true and correct to the best of my knowledge.

Executed on: _ March 8, 2024 _

(Date)

Sincerely, TAH/KJG/cr

Enclosure:

Description and Assessment of Proposed License Amendment cc:

J. D. Monninger NRC Region IV Regional Administrator W. T. Orders NRC NRR Project Manager for PVNGS L. N. Merker NRC Senior Resident Inspector for PVNGS B. D. Goretzki Arizona Department of Health Services - Bureau of Radiation Control

Horton, Todd (Z10098)

Digitally signed by Horton, Todd (Z10098)

Date: 2024.03.08 14:09:19 -07'00'

ENCLOSURE Description and Assessment of Proposed License Amendment

Enclosure Description and Assessment of Proposed License Amendment i

Description and Assessment of Proposed License Amendment

Subject:

License Amendment Request - Revise Technical Specifications 3.5.1 and 3.5.2 using Risk-Informed Process for Evaluations 1.0

SUMMARY

DESCRIPTION

2.0 BACKGROUND

2.1 PVNGS SIT Functions 2.2 PVNGS Previous SIT Changes 3.0 DETAILED DESCRIPTION 3.1 Description of Proposed Change 3.2 Reason for Proposed Change

4.0 TECHNICAL EVALUATION

4.1 Screening Impact Results 4.2 Technical Adequacy of the Probabilistic Risk Assessment 4.3 SIT Operating Experience and Reliability 4.4 Plant-Specific Risk Assessment Results 4.5 Integrated Decision-Making Panel (IDP) Process 4.6 IDP Results

5.0 REGULATORY EVALUATION

5.1 Precedent 5.2 No Significant Hazards Consideration 5.3 Conclusion 6.0 ENVIRONMENTAL ASSESSMENT

7.0 REFERENCES

ATTACHMENTS:

1.

Evaluation of Screening Impact

2.

Evaluation of Risk Significance

3.

Integrated Decision-Making Panel (IDP) Evaluation Results

4.

Proposed Technical Specification Changes (Mark-Up)

5.

Revised Technical Specification Pages (Re-Typed)

6.

Proposed Technical Specification Bases Changes (Mark-Up) - For Information Only

Enclosure Description and Assessment of Proposed License Amendment 1

1.0

SUMMARY

DESCRIPTION In accordance with the provisions of Section 50.90 of Title 10 of the Code of Federal Regulations (10 CFR), Arizona Public Service Company (APS) is submitting a License Amendment Request (LAR) to revise the Technical Specifications (TS) for Palo Verde Nuclear Generating Station (PVNGS) Units 1, 2, and 3.

The proposed LAR uses Risk-Informed Process for Evaluations (RIPE) to modify Condition A and Condition B of TS 3.5.1, Safety Injection Tanks (SITs) - Operating, and TS 3.5.2, Safety Injection Tanks (SITs) - Shutdown. Specifically, the proposed changes modify the Completion Time for Condition B of TS Limiting Condition for Operation (LCO) 3.5.1 and LCO 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days. Additionally, this change deletes the second case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e., One required SIT inoperable due to inability to verify level or pressure).

The RIPE process is a Nuclear Regulatory Commission (NRC) approved risk-informed method that is used to disposition issues of very low safety significance that are within the licensing basis of a plant. The RIPE process is used to evaluate the safety significance of an issue, and if it is determined to be of low safety significance, an amendment request can be submitted to the NRC and qualify for a streamlined NRC review.

2.0 BACKGROUND

2.1 PVNGS SIT Functions The functions of the four SITs are to supply water to the reactor vessel during the blowdown phase of a Loss of Coolant Accident (LOCA), to provide inventory to help accomplish the refill phase that follows thereafter, and to provide Reactor Coolant System (RCS) makeup for a small break LOCA. The blowdown phase of a large break LOCA is the initial period of the transient during which the RCS departs from equilibrium conditions, and heat from fission product decay, hot internals, and the vessel continues to be transferred to the reactor coolant. The blowdown phase of the transient ends when the RCS pressure falls to a value approaching that of the containment atmosphere.

The refill phase of a LOCA follows immediately where reactor coolant inventory has vacated the core through steam flashing and ejection out through the break. The core is essentially in adiabatic heat-up. The balance of the SITs' inventory is then available to help fill voids in the lower plenum and reactor vessel downcomer to establish a recovery level at the bottom of the core and ongoing reflood of the core with the addition of safety injection (SI) water.

The SITs are passive components partially filled with borated water and pressurized with nitrogen to facilitate injection into the reactor vessel. No operator or control action is required for the SITs to perform their function. Internal tank pressure is sufficient to discharge the contents to the RCS, if RCS pressure decreases below the SIT pressure.

Each SIT is piped into one RCS cold leg via the injection lines utilized by the High Pressure Safety Injection (HPSI) and Low Pressure Safety Injection (LPSI) Systems.

Each SIT is isolated from the RCS by a motor operated isolation valve and two check valves in series. The motor operated isolation valves are normally open, with power

Enclosure Description and Assessment of Proposed License Amendment 2

removed from the valve motor to prevent inadvertent closure prior to or during an accident. Additionally, the isolation valves are interlocked with the pressurizer pressure instrumentation channels to ensure that the valves will automatically open as RCS pressure increases above SIT pressure and to prevent inadvertent closure prior to an accident. The valves also receive a Safety Injection Actuation Signal (SIAS) to open.

The SIT gas and water volumes, gas pressure, and outlet pipe size are selected to allow three of the four SITs to partially recover the core before significant clad melting or zirconium water reaction can occur following a LOCA. The need to ensure that three SITs are adequate for this function is consistent with the LOCA assumption that the entire contents of one SIT will be lost via the break during the blowdown phase of a LOCA.

LCO 3.5.1 requires four SITs to be OPERABLE to ensure that the required contents of three of the SITs will reach the core during a LOCA. If the contents of fewer than three tanks are injected during the blowdown phase of a LOCA, the Emergency Core Cooling System (ECCS) acceptance criteria of 10 CFR 50.46, Acceptance criteria for emergency core cooling systems for light-water nuclear power reactors, could be violated. LCO 3.5.2 establishes the minimum conditions required to ensure that the required SITs are available to accomplish their core cooling safety function following a LOCA. The number of SITs required to be OPERABLE in LCO 3.5.2 is based on the minimum required volume that will reach the core during a LOCA, assuming a single failure. If the contents of less than the remaining required tanks are injected during the blowdown phase of a LOCA, the ECCS acceptance criteria of 10 CFR 50.46, could be violated. These requirements are consistent with the assumption that the contents of one tank spill through the break.

2.2 PVNGS Previous SIT Changes In June 1995, APS requested changes to the TS for the SITs [Agencywide Documents Access and Management System (ADAMS) Accession Nos. ML17311A950, ML17311A952, and ML17311B118]. The change extended the allowed outage times (AOTs) to TS 3.5.1 and 3.5.2 for a single SIT inoperable specifically due to malfunctioning SIT water level or nitrogen cover pressure instrumentation inoperability from one hour to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , and for a single inoperable SIT from one hour to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The justifications for modifying the SIT AOT were based on CE NPSD-994, Combustion Engineering Owners Group (CEOG) Joint Applications Report for Safety Injection Tank AOT/STI Extension, dated May 1995 (ADAMS Accession No. ML17228B190).

CE NPSD-994 provides a series of deterministic and probabilistic findings that support 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months as being either "risk beneficial" or "risk neutral" in comparison to shorter periods for restoring the SIT to OPERABLE status. CE NPSD-994 discusses best-estimate analysis for a typical Pressurized Water Reactor (PWR) that confirmed that, during large break LOCA scenarios, core melt can be prevented by either operation of one LPSI pump or the operation of one HPSI pump and a single SIT. CE NPSD-994 also discusses plant-specific probabilistic analysis that evaluated the risk-impact of the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months recovery period in comparison to shorter recovery periods. The Conditional Core Damage Frequencies (CDFs), and the Single and Yearly AOT Risk Contributions for PVNGS is provided in CE NPSD-994, Table 6.3.2-1, CEOG AOT Conditional CDF Contributions for SITs - Corrective Maintenance.

Enclosure Description and Assessment of Proposed License Amendment 3

The NRC evaluated the proposed amendment using a combination of traditional engineering analysis, Probabilistic Risk Assessment (PRA) methods, and a review of operating experience. The staff's traditional analysis evaluated the capabilities of the plant to mitigate design basis events with one SIT inoperable. The staff then used insights derived from the use of PRA methods to determine the risk significance of the proposed changes. The results of these evaluations were used in combination by the staff to determine the safety impact of extending the AOTs for one inoperable SIT. In October 1998, the NRC issued Amendment No. 118 for the proposed changes to TS 3.5.1 and 3.5.2 (ADAMS Accession No. ML021720024).

3.0 DETAILED DESCRIPTION 3.1 Description of Proposed Change 3.1.1 TS 3.5.1 - Safety Injection Tanks (SITs) - Operating The proposed change deletes the second case of Condition A (i.e., One SIT inoperable due to inability to verify level or pressure) and extends the Completion Time of Condition B for one SIT that is inoperable for reasons other than boron concentration being outside of limits from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days.

This TS section is applicable in MODES 1 and 2, and MODES 3 and 4 with pressurizer pressure equal to or greater than 1837 psia.

3.1.2 TS 3.5.2, Safety Injection Tanks (SITs) - Shutdown The proposed change deletes the second case of Condition A (i.e., One required SIT inoperable due to inability to verify level or pressure) and extends the Completion Time of Condition B for one SIT that is inoperable for reasons other than boron concentration being outside of limits from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days.

This TS section is applicable in MODES 3 and 4 with pressurizer pressure less than 1837 psia.

3.2 Reason for Proposed Change This amendment is requested as part of a station-initiated effort to increase SIT reliability. The existing 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months completion time is a short period to diagnose and repair an inoperable SIT and is not commensurate with its safety significance. The proposed changes to extend AOTs for the SITs would allow for deliberate planning and execution of the performance of both corrective and preventive maintenance during power and shutdown operation. Eliminating the case for level and/or pressure instrumentation issues simplifies the Control Room staff response by removing the need to diagnose or troubleshoot instrumentation issues related to SIT level and pressure to determine if Condition A or B should be entered. Additionally, implementing the proposed change avoids the potential introduction of internal events by challenging safety systems during Mode changes if the current 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is not met for Condition B of LCOs 3.5.1 or 3.5.2. These changes would not revise the number of Operable SITs required by LCOs 3.5.1 and 3.5.2, and the functional requirements of an Operable SIT also remain unchanged.

In the event of an inoperable SIT that requires complex troubleshooting, a 10 day AOT would allow the station to enhance safety decision-making by the use of risk

Enclosure Description and Assessment of Proposed License Amendment 4

insights, be more efficient in implementation of station resources, and reduce unnecessary burden on the station staff, which are consistent with the objectives of NRC Final Policy Statement 60 FR 42622, Use of Probabilistic Risk Assessment Methods in Regulatory Activities; Final Policy Statement, dated August 16, 1995.

Specifically, the 10 day AOT provides time to assemble a multi-discipline troubleshooting team to diagnose and restore the inoperable SIT. This team would typically create a troubleshooting plan which requires a proper level of risk review.

Once approved, the troubleshooting plan would then have to be executed. Depending on the nature of the inoperable SIT, the entire process of assembling a team, developing a plan, and planning the work execution could realistically take over the current allowable 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Following the work planning, maintenance would need to implement the troubleshooting plan. Further, depending on the nature of the inoperable SIT, a vendor representative would typically be requested/required to travel to the site. The mobilization of a vendor representative typically would take a minimum of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , dependent on day, time, and schedule. Additionally, time could be required if replacements parts are unavailable and need to be ordered for maintenance to repair the inoperable SIT.

Risk-informed and performance-based approaches provide for greater focus on items of the highest safety significance, enable more efficient use of agency resources, and reduce unnecessary regulatory burden. A probabilistic approach enhances and extends the traditional deterministic approach by allowing consideration of a broader set of potential challenges to safety, providing a logical means for prioritizing these challenges based on safety significance, and allowing consideration of a broader set of resources to defend against these challenges. In contrast to the deterministic approach, PRAs address credible initiating events by assessing the event frequency.

Mitigating system reliability is then assessed, including the potential for common cause failures. The probabilistic approach to regulation is an extension and enhancement by considering risk in a comprehensive manner.

To take advantage of the safety enhancements available through the use of PRA, in May 2022 the NRC expanded the RIPE process to allow its application to license amendments involving a change to TSs (ADAMS Accession No. ML22088A129). The RIPE process provides a risk-informed method to disposition issues of very low safety significance that are within the licensing basis of a plant and require resolution.

The RIPE process may be used for actions needed to correct an issue that would result in a minimal safety impact. Examples of issues for which the RIPE process may be used include, but are not limited to:

Actions needed to address inspection findings Resolution of issues identified through other regulatory or licensee processes Responses to orders requiring changes or modifications to the plant Generic issues requiring changes or modifications to the plant Changes to technical specifications The RIPE process will be used to disposition the very low safety significance of extending the Completion Time for Condition B of LCO 3.5.1 and LCO 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and deleting the second case of Condition A of LCOs 3.5.1 and 3.5.2.

Enclosure Description and Assessment of Proposed License Amendment 5

This amendment request is a licensee-identified issue, where the delta risk is the difference between the approved existing licensing basis condition and the condition that would exist after NRC approval and implementation.

4.0 TECHNICAL EVALUATION

The NRC staff approved the RIPE process in January 2021 (Reference 1). On May 10, 2022, the NRC staff expanded the RIPE process to allow its application to license amendments involving a change to TS (Reference 2). The process is effective and provides a risk-informed method to disposition issues of very low safety significance that are within the licensing basis of a plant. The RIPE process is used to evaluate the safety significance of an issue, and if it is determined to be of low safety significance, an amendment or exemption request can be submitted to the NRC and qualify for a streamlined NRC review.

The RIPE process being implemented for this amendment is consistent with Nuclear Energy Institute (NEI) 21-01, Industry Guidance to Support Implementation of NRCs Risk-Informed Process for Evaluations, Revision 1, dated June 2022 (Reference 3),

and the NRC, Guidelines for Characterizing the Safety Impact of Issues, Revision 2, dated May 2022 (Reference 4). NEI 21-01 (Reference 3) describes an approach that is acceptable to the NRC staff for developing a risk-informed application for an amendment request that applies risk insights, consistent with the guidance in Regulatory Guide (RG) 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 3 (Reference 5).

The RIPE process can be used by licensees that have a technically acceptable PRA as demonstrated by having implemented risk-informed initiatives including risk-informed completion time (TSTF-505) or the surveillance frequency control program (TSTF-425) and have established a 50.69-equivalent integrated decision-making panel (IDP). Licensees with an approved and implemented risk-informed completion time (RICT) amendment and a 10 CFR 50.69 (or equivalent) IDP can leverage their PRA models to perform safety impact characterizations using this process. The NRC approved the PVNGS RICT license amendment consistent with NEI 06-09, Risk-Informed Technical Specifications Initiative 4B, Risk-Managed Technical Specifications (RMTS) Guidelines (Reference 6), in lieu of TSTF-505 since at the time the NRC had temporarily suspended approval of TSTF-505.

PVNGS has implemented RICT, TSTF-425, and has established an IDP as part of implementation of 10 CFR 50.69. Therefore, PVNGS meets the requirements to submit amendment requests via the RIPE process.

In order to characterize an issue as having a minimal safety impact, all of the following must apply:

The issue contributes less than 1x10-7/year to core damage frequency (CDF).

The issue contributes less than 1x10-8/year to large early release frequency (LERF).

The issue screens to no impact (per Step 1, Section 4.1 of NEI 21-01) or minimal impact (per Step 2, Section 4.2 of NEI 21-01).

Cumulative risk is acceptable using the guidelines in Section 5 of NEI 21-01.

If any of the criteria above are not met, then the proposed change cannot be characterized as having minimal impact on safety.

Enclosure Description and Assessment of Proposed License Amendment 6

4.1 Screening Impact Results NEI 21-01, Industry Guidance to Support Implementation of NRCs Risk-Informed Process for Evaluations, Sections 4.1 and 4.2 (Reference 3), provides a set of screening questions that are used to determine the impact of the proposed amendment. The findings of the PVNGS Units 1, 2, and 3, screening questions, contained in Attachment 1 of this submittal, confirms that extending the Completion Time for Condition B of LCO 3.5.1 and LCO 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and deleting the second case of Condition A of LCOs 3.5.1 and 3.5.2 screened in as adverse, but is considered to have a minimal impact on safety. Attachment 1 of this enclosure provides the detailed answers to the screening questions.

4.2 Technical Adequacy of the Probabilistic Risk Assessment PVNGS implemented RICT in accordance with NEI Topical Report 06-09, (Revision 0)-

A, Risk-Informed Technical Specification Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (Reference 6). Additionally, 10 CFR 50.69 was implemented in accordance with NEI 00-04, Revision 0, 10 CFR 50.69 SSC Categorization Guideline, Revision 0, which was endorsed by the NRC in Regulatory Guide 1.201, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance, Revision 1 (Reference 7).

The NRC safety evaluations for the 10 CFR 50.69 and RICT license amendments were issued on October 10, 2018 (Reference 8), and May 29, 2019 (Reference 9),

respectively. The NRC found the PVNGS PRA acceptable to support the 10 CFR 50.69 and RICT Program and determined that the PVNGS PRA models for internal and external events, fires, and seismic used to implement 10 CFR 50.69 and the RICT Program satisfied the guidance of RG 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2 (Reference 10), with the completion of the implementation items described in each NRC safety evaluation.

The PVNGS PRA has undergone numerous peer reviews and Fact and Observation (F&O) closure reviews. All finding level F&Os have been resolved and F&O closure reviews performed to document closure. There are no open finding level F&Os associated with the PRA. PVNGS implemented 10 CFR 50.69 and RICT on January 3, 2019, and July 10, 2020, respectively.

Since the implementation of 10 CFR 50.69 and RICT, there have been no upgrades or new methods implemented in the PRA model other than those addressed in NRC safety evaluation for the 10 CFR 50.69 and RICT (References 9 and 10).

Consequently, there are no identified PRA model open issues which would adversely impact the results or conclusions of this analysis. Therefore, the PVNGS PRA is technically adequate to support this risk-informed application.

Internal Events and Internal Flood PRA The Internal Events PRA model was peer reviewed in July 1999 by the Combustion Engineering Owners Group (CEOG) prior to the issuance of RG 1.200 (Reference 11).

As a result, a self-assessment of the Internal Events PRA model was conducted by APS in March 2011 in accordance with Appendix B of RG 1.200, Revision 2 (Reference 10), to address the PRA quality requirements not considered in the CEOG peer review.

Enclosure Description and Assessment of Proposed License Amendment 7

The Internal Events PRA quality (including the CEOG peer review and self-assessment results) has previously been reviewed by the NRC in requests to extend the Inverter Technical Specification Completion Time dated September 29, 2010 (Reference 12),

and to implement TSTF-425, Relocate Surveillance Frequencies to Licensee Control -

RITSTF Initiative 5b, dated December 15, 2011 (Reference 13). All PRA upgrades [as defined by the ASME PRA Standard RA-Sa-2009 (Reference 14)] implemented since conduct of the CEOG peer review in 1999 have been peer reviewed.

A focused-scope PRA peer review of the PVNGS internal flood PRA (IFPRA) to determine compliance with Addendum A of the ASME/ANS PRA Standard and RG 1.200, Revision 2, was performed in 2010.

Focused scope peer reviews of all F&Os that constituted an upgrade to the PRA were performed in 2017 (Reference 15), 2018 (Reference 16), and 2020 (Reference 17).

All F&Os were reviewed and confirmed closed during concurrent F&O closure reviews performed in 2017 (Reference 15), 2018 (Reference 18), and 2020 (Reference 19).

Fire PRA A full-scope peer review to determine compliance with Addendum A of the ASME/ANS PRA Standard and RG 1.200, Revision 2, was performed on the PVNGS Fire PRA by the Pressurized Water Reactors Owners Group (PWROG) in 2012. In 2014, after updating the PVNGS Fire PRA to address selected F&Os identified in the full-scope fire PRA peer review, a focused-scope peer review was performed on the PVNGS fire PRA.

Focused scope peer reviews of all F&Os that constituted an upgrade to the PRA were performed in 2017 (Reference 15), 2018 (Reference 16), and 2020 (Reference 17).

All F&Os were reviewed and confirmed closed during concurrent F&O closure reviews performed in 2017 (Reference 15), 2018 (Reference 18), and 2020 (Reference 19).

Seismic PRA APS conducted a full scope Seismic PRA model peer review in February 2013, in accordance with the current endorsed standard ASME/ANS RA-Sa-2009 and NEI 12-13 (Reference 20), including NRC comments on NEI 12-13. All finding F&Os were resolved.

Focused scope peer reviews of all F&Os that constituted an upgrade to the PRA were performed in 2017 (Reference 15), 2018 (Reference 16), and 2020 (Reference 17).

All F&Os were reviewed and confirmed closed during concurrent F&O closure reviews performed in 2017 (Reference 15), 2018 (Reference 18), and 2020 (Reference 19).

Other External Hazards PRA APS conducted a full scope External Hazards screening peer review in December 2011, in accordance with RG 1.200, Revision 2.

All F&Os were subsequently resolved and then were confirmed closed during an F&O closure review performed in 2018 (Reference 18).

Enclosure Description and Assessment of Proposed License Amendment 8

Assessment of RG 1.200, Revision 3 A risk assessment associated with the amendment is contained in Attachment 2 of this submittal, which applies RG 1.200, Revision 2 (Reference 10), for extending the Completion Time for Condition B of LCO 3.5.1 and LCO 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and deleting the second case of Condition A of LCOs 3.5.1 and 3.5.2. APS conducted a review of the of RG 1.200, Revision 3 (Reference 21), to determine if there were any impacts with this amendment request, due to the changes in RG 1.200 from Revision 2 to Revision 3. The review of RG 1.200 from Revision 2 to Revision 3 did not identify any impacts to the PRA model that is used for the plant-specific risk assessment conducted to support this change. Therefore, it is appropriate to use the PVNGS PRA model used in Attachment 2, which applies RG 1.200, Revision 2 (Reference 10), to support this amendment request.

PRA Maintenance and Update The APS risk management process ensures that the applicable PRA models used in this application continue to reflect the as-built and as-operated plant for each of the PVNGS units. The process delineates the responsibilities and guidelines for updating the PRA model and includes criteria for both regularly scheduled and interim PRA model updates. The process includes provisions for monitoring potential areas affecting the PRA model (e.g., due to changes in the plant, errors or limitations identified in the model, or industry operational experience) for assessing the risk impact of unincorporated changes, and for controlling the model and associated computer files. The process assesses the impact of these changes on the plant PRA model in a timely manner but no longer than once every two refueling outages.

The risk associated with extending the Completion Time of Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and deleting the second case (i.e., One required SIT inoperable due to an inability to verify level or pressure) from Condition A of LCOs 3.5.1 and 3.5.2 is quantified using PVNGS PRA One Top Multi-Hazard Model (OTMHM) PRADATA, Version 22, issued in December 2021. As previously mentioned, Version 22 of the PRA model does not contain any new upgrades or new methods.

Additionally, there are no identified PRA model open issues which would adversely impact the results or conclusions of this analysis.

4.3 SIT Operating Experience and Reliability Internal operating experience reviews were performed for entries into Conditions A and B of LCOs 3.5.1 and 3.5.2. While a fair amount of operating experience exists for these components, no operating experience was identified to affect the responses provided in Attachment 1, Steps 1 and 2 (i.e., Section 4.1 and 4.2 screening questions). Table 4.3-1 summarizes the number of historical entries into Conditions A and B of LCOs 3.5.1 and 3.5.2 across all three Units. The average number of combined entries did not exceed 0.7 per year in any Unit. The average number of combined entries for the worst three-year period between 2021 and 2023 was 1.22 entries per year per Unit.

Enclosure Description and Assessment of Proposed License Amendment 9

Table 4.3-1: Historical LCO Entries Year Unit 1 Unit 2 Unit 3 LCO 3.5.1 Cond A &

B Entries LCO 3.5.2 Cond A &

B Entries LCO 3.5.1 Cond A &

B Entries LCO 3.5.2 Cond A &

B Entries LCO 3.5.1 Cond A &

B Entries LCO 3.5.2 Cond A &

B Entries 2004 1

0 2

1 2005 1

1 0

0 0

0 2006 0

0 0

0 1

0 2007 1*

0 1*

0 1

0 2008 2

0 0

0 2009 0

0 0

0 2010 0

0 0

0 2011 0

0 2

0 0

0 2012 0

0 0

0 1

0 2013 2*

0 1

0 0

0 2014 0

0 0

0 2015 0

0 0

0 1*

0 2016 0

0 0

0 2017 0

0 0

0 2018 0

0 0

0 1

1 2019 0

0 0

0 2020 2

0 0

1 2021**

1 0

0 0

2022 **

2 0

0 0

1 0

2023 **

1 0

5 0

0 0

Total 13 1

12 0

8 3

Yearly Average (over 20 years) 0.65 0.05 0.60 0.00 0.40 0.15 Combined Yearly Average (over 20 years) 0.70 0.60 0.55 Notes:

Condition A of LCO 3.5.1 entered once for that unit. No entries into Condition A of LCO 3.5.2 were experienced between 2004 and 2023. The inventory of a SIT remains available to inject into the RCS when in Condition A. Other entries in Table 4.3-1 are Condition B of LCOs 3.5.1 and 3.5.2.

- The average number of combined entries for the worst three-year period between 2021 and 2023 was 1.22 [(11/3)/3 = 1.22] entries per year per Unit.

Additionally, a review of surveillance test results over the last 20 years was performed to characterize the reliability of the SITs with respect to their ability to passively inject their contents into the RCS. This review revealed no documented test failures or deficiencies that would have prevented the two check valves between each SIT and its corresponding RCS cold leg from opening to admit flow, prevented the SIT isolation valves from opening fully within the required time, prevented the SIT isolation valves from opening automatically prior to RCS pressure exceeding 420 psia, or prevented the SIT isolation valves from opening automatically on a SIAS. As such, a high degree of reliability is assured for the SITs that remain Operable during entries into Condition B of LCOs 3.5.1 and 3.5.2.

Furthermore, Attachment 2 of this submittal provides insights into the likelihood of an equipment failure preventing an operable SIT from injecting water into the RCS. The calculated probability of an individual SIT failing to inject water into the RCS is 7.4 x10-4. This result supports the conclusion that individual SITs are highly reliable.

Enclosure Description and Assessment of Proposed License Amendment 10 4.4 Plant-Specific Risk Assessment Results A plant-specific risk assessment was performed using PVNGS PRA OTMHM PRADATA, Version 22, to determine the risk impact associated with extending the AOTs of Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and deleting the second case (i.e., One required SIT inoperable due to an inability to verify level or pressure) from Condition A of LCOs 3.5.1 and 3.5.2. The PVNGS PRA does not include a low power / shutdown model and is applicable for Modes 1 and 2. However, the NRCs RIPE guidance, Guidelines for Characterizing the Safety Impact of Issues, Revision 2 (Reference 4), states that conservative or bounding analyses may be performed to quantify the risk impact when low power and shutdown PRA models are not available.

For MODES 3 and 4 with pressurizer pressure less than 1837 psia, a review of PVNGS initiating events has been performed to determine if any changes to the online PRA model are necessary to evaluate the risk associated with one SIT inoperable. The relevant initiating events for the SITs and these technical specifications are Large Loss of Coolant Accidents (LLOCA) and Small Loss of Coolant Accidents (SLOCA). The SITs do not provide a recovery function for any other initiating events in the at-power model, nor are there initiating events unique to Modes 3 and 4 that the SITs support.

Therefore, only LLOCA and SLOCA are considered for potential low power/shutdown risk impact.

In the lower Modes, the stresses on the RCS piping are far-less than expected at design conditions. WCAP-16196-P, PRA LPSD Transition Risk Notebook, dated October 2004, and WCAP-16560-P, Assessment of Shutdown Risk and Insights for the PWROG, dated October 2006, stipulate that when RCS pressure is at 1000 psi that there is negligible probability of a pipe break. Therefore, the at-power initiating event frequencies for LLOCA and SLOCA is used to quantify the risk impact of having one SIT inoperable for 10 days. This is done to provide a bounding conservative analysis for Modes 3 and 4.

Documented in PRA Study 13-NS-B061, At-Power PRA Event Trees and Success Criteria (Reference 22), the PVNGS PRA model as reviewed by peer reviews credits the SITs to mitigate both large and small break LOCAs. PRA Study 13-NS-B106, At-Power PRA System Study for the Safety Injection Systems (Reference 23), identifies the following success criterion for the SITs during a large break LOCA transient:

Two SITs are required to inject borated water into the RCS. The UFSAR requirement of 3 SITs is based on the extremely conservative 10 CFR 50 App. K analysis criteria. Best estimate analysis in WCAP-15701 (see Table 6.1-6) by CE has shown that 1 SIT with either one train of HPSI or LPSI is adequate to cool/reflood the core. The requirement for 2 is used, because HPSI is not credited in the model.

For a large break LOCA, the SITs provide the initial injection of borated water needed to reflood the reactor vessel and cool the core immediately following a large break LOCA. Since break location is unknown, but could be in a cold leg, it is conservatively assumed that the inventory from one SIT is lost out the break. Two SITs injecting into the core through intact cold legs are required for success (Reference 22).

Enclosure Description and Assessment of Proposed License Amendment 11 Following a small break LOCA, procedure 40EP-9EO03, Loss of Coolant Accident (Reference 24), directs operators to commence plant cooldown using the Auxiliary Feedwater (AFW) system and the Atmospheric Dump Valves (ADVs). If High Pressure Safety Recirculation (HPSR) fails when the Recirculation Actuation Signal (RAS) is reached, the operators would not attempt to go onto shutdown cooling. Instead, they would proceed with the cooldown [requiring both steam generators (SGs)] using SITs for inventory makeup (Reference 22).

To quantify the core damage frequency (CDF) and large early release frequency (LERF) for one SIT inoperable, the PVNGS PRA OTMHM model is quantified one hazard at a time to allow each hazard to be quantified at the appropriate truncation value.

The existing PVNGS OTMHM Master Flag File is modified by setting one SIT out of service basic event to a probability PROB of 1.0. Setting the SIT out of service basic event to a probability of 1.0, fails the capability of the SIT inventory injecting into the RCS cold leg. The findings of the PVNGS Units 1, 2, and 3 risk assessment, contained in Attachment 2 of this submittal, confirms that the risk impact associated with extending the AOTs of Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and deleting the second case (i.e., One required SIT Inoperable due to an inability to verify level or pressure) from Condition A of LCOs 3.5.1 and 3.5.2 is not risk significant. Attachment 2 of this enclosure provides the risk significance evaluation. A summary of the quantitative analysis results associated with extending the AOTs is provided in Table 4.3-2.

Table 4.3-2: Quantification Results Case Core Damage Frequency (CDF)

Large Early Release Frequency (LERF)

PVNGS OTMHM PVNGS OTMHM Baseline 6.11x10-5/year 9.65x10-6/year Total CDF and LERF with 10 day AOT for Condition B of LCOs 3.5.1 and 3.5.2 (Maintenance frequency =

1.22/year) 6.11x10-5/year 9.65x10-6/year Yearly Increase Based on 10 day AOT for Condition B of LCOs 3.5.1 and 3.5.2 (Maintenance frequency =

1.22/year) 1.13x10-8/year 1.17x10-10/year NEI 21-01 RIPE Acceptance Guidelines

< 1.0x10-7/year

< 1.0x10-8/year The cumulative risk impact associated with this amendment request is provided in Table 4.3-3. The results indicate the cumulative risk remains within the acceptance guidelines established in Regulatory Guide 1.174.

Enclosure Description and Assessment of Proposed License Amendment 12 Table 4.3-3: Cumulative Risk Case Core Damage Frequency (CDF)

Large Early Release Frequency (LERF)

PVNGS OTMHM Baseline 6.11x10-5/year 9.65x10-6/year Yearly Increase Based on 10-day AOT for Condition B of LCOs 3.5.1 and 3.5.2 (Maintenance frequency = 1.22/year) 1.13x10-8/year 1.17x10-10/year Total CDF and LERF with 10-day AOT for Condition B of LCOs 3.5.1 and 3.5.2 (Maintenance frequency = 1.22/year) 6.11x10-5/year 9.65x10-6/year NRC RG 1.174 Acceptance Guideline

< 1.0x10-4/year

< 1.0x10-5/year Based on the minimal risk impact of extending the AOTs of Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days, no new risk management actions are required to offset the risk increase. Additionally, existing Operations and Work Management processes provide adequate controls to ensure the impact of ongoing maintenance, emergent maintenance, and future maintenance work activities are assessed.

Therefore, the risk associated with the PVNGS request to extend the AOTs of Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days is not risk significant per the guidance provided in Section 4 of NEI 21-01 (Reference 3).

4.5 Integrated Decision-Making Panel (IDP) Process The RIPE process is implemented into station procedure 01DP-0RS04, Integrated Decision-Making Panel Composition, Training, and Qualification Requirements, in accordance with Enclosure 1 of NEI 21-01 (Reference 3). The procedure includes the following:

The IDP is composed of a group of experts who have plant-specific knowledge and experience. The minimum quorum requirements for RIPE IDP meetings will be composed of a group of at least five experts with joint expertise in the following fields: Plant Operations, Design and Systems Engineering, PRA and risk-informed decision making, Safety Analysis, and Licensing.

The IDP is trained in the specific requirements related to the RIPE process.

Training addressed, at a minimum, the purpose of the safety impact determination, the RIPE process, the risk-informed defense-in-depth philosophy and criteria to maintain this philosophy; PRA fundamentals including details of the plant-specific PRA analyses that are relied upon for the preliminary categorization (including the modeling scope and assumptions),

interpretation of risk importance measures, and the role of sensitivity studies and change in risk evaluations; and the IDP process, including roles and responsibilities.

The decision criteria for the IDP are documented in a RIPE package. Decisions of the IDP are arrived at by consensus. Differing opinions are documented and resolved, if possible. However, a simple majority of the panel is enough for final decisions regarding the safety impact of the issues.

Enclosure Description and Assessment of Proposed License Amendment 13 The RIPE process may be used for actions needed to correct an issue that would result in a minimal safety impact. Examples of issues for which the RIPE process may be used include, but are not limited to: actions needed to address inspection findings, resolution of issues identified through other regulatory or licensee processes, responses to orders requiring changes or modifications to the plant, generic issues requiring changes or modifications to the plant, changes to technical specifications.

4.6 IDP Results An IDP meeting for extending the Completion Time of Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and deleting the second case (i.e., One required SIT inoperable due to an inability to verify level or pressure) from Condition A of LCOs 3.5.1 and 3.5.2 was held on January 31, 2024. The IDP determined that extending the AOTs of Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and deleting the second case (i.e., One required SIT inoperable due to an inability to verify level or pressure) from Condition A of LCOs 3.5.1 and 3.5.2 is considered a low safety impact and the issue may be submitted to the NRC for expedited review. The IDP evaluation results are documented in Attachment 3 of this enclosure.

The resolution to the action items from the IDP meeting is complete and documented in the PVNGS Corrective Action Program (CAP).

5.0 REGULATORY EVALUATION

5.1 Precedent A precedent has not been established for use of the RIPE process for LARs; however, the following guidance documents describe an approach that is acceptable to the NRC for developing a risk-informed LAR:

NEI 21-01, Industry Guidance to Support Implementation of NRCs Risk-Informed Process for Evaluations, Revision 1, dated June 2022 (Reference 3)

NRC, Guidelines for Characterizing the Safety Impact of Issues, Revision 2, dated May 2022 (Reference 4) 5.2 No Significant Hazards Consideration The proposed amendment modifies Condition A and Condition B of TS 3.5.1, Safety Injection Tanks (SITs) - Operating, and TS 3.5.2, Safety Injection Tanks (SITs) -

Shutdown. Specifically, the proposed changes modify the Completion Time for Condition B of TS Limiting Condition for Operation (LCO) 3.5.1 and LCO 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days. Additionally, this change deletes the second case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e., One required SIT inoperable due to inability to verify level or pressure).

Arizona Public Service Company (APS) has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, Issuance of amendment, as discussed below:

Enclosure Description and Assessment of Proposed License Amendment 14

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

To support proper planning and deliberate execution of Safety Injection Tank (SIT) maintenance, this change will extend the Completion Time for Condition B of Technical Specification (TS) Limiting Condition for Operation (LCO) 3.5.1 and LCO 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days. Additionally, this change deletes the second case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e., One required SIT inoperable due to inability to verify level or pressure). Condition B is broader than the second case of Condition A and eliminating the case for level and/or pressure instrumentation issues simplifies the Control Room staff response by removing the need to diagnose or troubleshoot instrumentation issues related to SIT level and pressure to determine if Condition A or B should be entered. This change would not revise the number of Operable SITs required by LCOs 3.5.1 and 3.5.2, and the functional requirements of an Operable SIT also remain unchanged.

The SITs are passive components in the Emergency Core Cooling System (ECCS) and are designed to mitigate the consequences of a Loss of Coolant Accident (LOCA). There are no accident initiators in any accident previously evaluated related to a single required SIT being Inoperable per Condition B of LCO 3.5.1 or 3.5.2, or per the second case of Condition A of LCOs 3.5.1 and 3.5.2. The condition of one required SIT being Inoperable does not involve a significant increase in the probability of occurrence of an accident previously evaluated.

This change is evaluated in accordance with Risk-Informed Process for Evaluations (RIPE) per Nuclear Energy Institute (NEI) 21-01, Industry Guidance to Support Implementation of NRCs Risk-Informed Process for Evaluations, Revision 1. The responses to the RIPE process screening questions evaluated the consequence of a LOCA in relation to this change and determined that the contribution of this change to Core Damage Frequency (CDF) and Large Early Release Frequency (LERF) is characterized as having a minimal safety impact. Additionally, the risk associated with the proposed change is very small and within Region III as defined by Regulatory Guide (RG) 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 3, for both CDF and LERF. As a result, the required systems, structures, and components (SSCs) used to mitigate the consequences of a LOCA event will perform their safety functions with a high probability, and the proposed change does not alter or prevent the ability of SSCs to perform their intended function to mitigate the consequences of an accident previously evaluated within the acceptance limits. In accordance with the guidance of RG 1.174, there is substantial safety margin and defense-in-depth that provide additional confidence that the design-basis functions are maintained. As such, the consequence of a LOCA does not significantly increase.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

Enclosure Description and Assessment of Proposed License Amendment 15 To support proper planning and deliberate execution of SIT maintenance, this change will extend the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days. Additionally, this change deletes the second case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e., One required SIT inoperable due to inability to verify level or pressure). Condition B is broader than the second case of Condition A and eliminating the case for level and/or pressure instrumentation issues simplifies the Control Room staff response by removing the need to diagnose or troubleshoot instrumentation issues related to SIT level and pressure to determine if Condition A or B should be entered.

This change would not revise the number of Operable SITs required by LCOs 3.5.1 and 3.5.2, and the functional requirements of an Operable SIT also remain unchanged. The accident analysis initial conditions will remain the same.

Therefore, since there is no change to the design basis analytical limits or any changes to physical equipment or required operational conditions, there are no credible new failure mechanisms, malfunctions, or accident initiators not considered in the design and licensing basis.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

To support proper planning and deliberate execution of SIT maintenance, this change will extend the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days. Additionally, this change deletes the second case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e., One required SIT inoperable due to inability to verify level or pressure). Condition B is broader than the second case of Condition A and eliminating the case for level and/or pressure instrumentation issues simplifies the Control Room staff response by removing the need to diagnose or troubleshoot instrumentation issues related to SIT level and pressure to determine if Condition A or B should be entered.

This change would not revise the number of Operable SITs required by LCOs 3.5.1 and 3.5.2, and the functional requirements of an Operable SIT also remain unchanged. The accident analysis initial conditions will remain the same. There is no change to the design basis analytical limits or any changes to physical equipment or required operational conditions, and there is not a significant reduction in the margin of safety.

Additionally, this change is evaluated in accordance with RIPE per NEI 21-01, Industry Guidance to Support Implementation of NRCs Risk-Informed Process for Evaluations, Revision 1. The responses to the RIPE process screening questions evaluated the change and determined the safety impact to be minimal.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

APS concludes that the proposed amendment does not involve a significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of no significant hazards consideration is justified.

Enclosure Description and Assessment of Proposed License Amendment 16 5.3 Conclusion In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

6.0 ENVIRONMENTAL ASSESSMENT The proposed amendment involves components located within the restricted area, as defined in 10 CFR 20, Standards for Protection Against Radiation, or would change an inspection or surveillance requirement. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure.

Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment would change a requirement with respect to installation or use of a facility.

Enclosure Description and Assessment of Proposed License Amendment 17

7.0 REFERENCES

1.

Ho K. Nieh, to Craig G. Erlanger, January 7, 2021, Approval of the Risk-Informed Process for Evaluations, Office of Nuclear Reactor Regulation, U.S.

Nuclear Regulatory Commission, Agencywide Documents Access and Management System (ADAMS) Accession No. ML21006A324

2.

Antonios M. Zoulis and William T. Orders memorandum to Andrea K. Veil, May 10, 2022, Expansion of Risk-Informed Process for Evaluations, Office of Nuclear Reactor Regulation, U.S. Nuclear Regulatory Commission, ADAMS Accession No. ML22088A129

3.

NEI 21-01, Industry Guidance to Support Implementation of NRCs Risk-Informed Process for Evaluations, Revision 1, dated June 2022

4.

NRC, Guidelines for Characterizing the Safety Impact of Issues, Revision 2, dated May 2022 (ADAMS Accession No. ML22088A135)

5.

Regulatory Guide (RG) 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 3

6.

Nuclear Energy Institute (NEI) Topical Report NEI 06-09, (Revision 0)-A, Risk-Informed Technical Specification Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines

7.

NEI 00-04, Revision 0, 10 CFR 50.69 SSC Categorization Guideline, Revision 0, which was endorsed by the NRC in Regulatory Guide 1.201, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance, Revision 1

8.

Palo Verde Nuclear Generating Station, Units 1, 2, and 3, Issuance of Amendments 207, 207, and 207 to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors ADAMS Accession No. ML18243A280), dated October 10, 2018

9.

Palo Verde Nuclear Generating Station, Units 1, 2, and 3, Issuance of Amendments 209, 209, and 209, Re: Adoption of Risk-Informed Completion Times in Technical Specifications ADAMS Accession No. ML19085A525),

dated May 29, 2019

10. RG 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, March 2009 (ADAMS Accession No. ML090410014)

11. RG 1.200, Revision 0, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, February 2004 (ADAMS Accession No. ML040630078)

12. Palo Verde Nuclear Generating Station, Units 1, 2, and 3, Issuance of Amendments 180, 180, 180, Re: Changes to Technical Specification 3.8.7, Inverters-Operating (ADAMS Accession No. ML102670352), dated September 29, 2010

Enclosure Description and Assessment of Proposed License Amendment 18

13. Palo Verde Nuclear Generating Station, Units 1, 2, and 3, Issuance of Amendments 188, 188, 188, Re: Adoption of TSTF-425, Revision 3, Relocate Surveillance Frequencies to Licensee Control RITSTF Initiative 5b (ADAMS Accession No. ML112620293), dated December 15, 2011

14. ASME/ANS RA-Sa-2009, Addenda to ASME/ANS RA-S-2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, dated February 2009.

15. ABS Consulting Report R-3882824-2037, Palo Verde Generating Stations PRA Finding Level Fact and Observation Closure Review, June 23, 2017

16. ABS Consulting, Palo Verde Generating Station Probabilistic Risk Assessment Focused-Scope Peer Review, R-4076030-2073, June 21, 2018

17. ABS Consulting, Palo Verde Generating Station Probabilistic Risk Assessment Focused-Scope Peer Review, R-4369996-2141, June 23, 2020

18. ABS Consulting, Palo Verde Generating Station Probabilistic Risk Assessment Finding Level Fact and Observation Closure Review, R-3882824-2037, June 25, 2018

19. ABS Consulting, Palo Verde Generating Station Probabilistic Risk Assessment Finding Level Fact and Observation Closure Review, R-4369996-2142, June 23, 2020

20. NEI 12-13, External Hazards PRA Peer Review Process Guidelines, August 2012 (ADAMS Accession No. ML12240A027)

21. RG 1.200, Revision 3, Acceptability of Probabilistic Risk Assessment Results for Risk-Informed Activities, December 2020 (ADAMS Accession No. ML20238B871)

22. PRA Study 13-NS-B061, At-Power PRA Event Trees and Success Criteria, Revision 7

23. PRA Study 13-NS-B106, At-Power PRA System Study for the Safety Injection Systems, Revision 1

24. PVNGS Procedure 40EP-9EO03, Loss of Coolant Accident, Revision 45

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 1

ATTACHMENT 1:

Evaluation of Screening Impact

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 2

NEI 21-01, Industry Guidance to Support Implementation of NRCs Risk-Informed Process for Evaluations, Revision 1, dated June 2022, and the NRC, Guidelines for Characterizing the Safety Impact of Issues, Revision 2, dated May 2022, provide the screening questions for no impact and minimal impact for Risk-Informed Process for Evaluations (RIPE). The screening for no impact involves addressing the following set of questions in Step 1:

Step 1 - Screening for No Impact If the responses to the above questions are no, the issue screens to no impact.

However, if any of the responses to these questions are yes, the following set of questions in Step 2 determine if the magnitude of the adverse impact on safety identified in Step 1 screening questions are minimal:

Step 2 - Screening for Minimal Impact If the responses to the questions in Step 2 are no, the issue screens to minimal impact. However, if any of the responses to these questions are yes, the issue has a more than minimal impact on safety.

For PVNGS, the result of the responses to the screening questions for no impact (Step 1), does result in an adverse impact. Specifically, an adverse impact was identified for questions 2, 4 and 5. The result of the screening questions for minimal impact (Step

2) was that all adverse impacts identified were determined to be minimal impacts.

Therefore, the result of the PVNGS screening questions contained in this attachment, confirms that extending the Completion Time of Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and deleting the second case (i.e., One required SIT inoperable due to an inability to verify level or pressure) from Condition A of LCOs 3.5.1 and 3.5.2 screened in as adverse, but is considered to have a minimal impact on safety.

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 3

Step 1 - Screening for No Impact

1. Does the issue result in an adverse impact on the frequency of occurrence of an accident initiator or result in a new accident initiator?

Response: No.

The Emergency Core Cooling System (ECCS) or Safety Injection (SI) System is designed to provide core cooling in the unlikely event of a Loss of Coolant Accident (LOCA). The SI System accomplishes these functional requirements by use of redundant active and passive injection subsystems. The active portion of the ECCS consists of high and low pressure Safety Injection pumps and associated valves.

The passive portion consists of four pressurized Safety Injection Tanks (SIT). The SITs containing borated water pressurized by a nitrogen cover gas constitute a passive injection system because no operator action or electrical signal is required for operation. Each tank is connected to its associated reactor coolant cold leg by a separate line containing two check valves which isolate the tank from the Reactor Coolant System (RCS) during normal operation. When the reactor coolant pressure falls below the tank pressure, the check valves open discharging the contents of the tank into the RCS. (Reference Revision 22 of PVNGS UFSAR Sections 6.3.1.1, System Description, and 6.3.2.5.1, Safety Injection Tanks)

There are no accident initiators related to a single required SIT being Inoperable per Condition B of Limiting Condition for Operation (LCO) 3.5.1 or 3.5.2, or per the second case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e., One required SIT inoperable due to inability to verify level or pressure). Since the SITs are passive components, single active failures are not applicable to their operation. The SIT isolation valves and SIT nitrogen vent valves, however, are not single failure proof; therefore, whenever the SIT motor operated isolation valves are open, power is removed from their operators, and the switch is key locked open (Reference PVNGS Technical Specification Bases, Revision 77, and PVNGS UFSAR Section 7.6.2.2.2, Safety Injection Tank Isolation Valve Interlocks). Additionally, the SIT motor operated isolation valves are interlocked with the pressurizer pressure instrumentation channels to ensure that the valves will automatically open as RCS pressure increases above SIT pressure and to prevent inadvertent closure prior to an accident. The valves also receive a Safety Injection Actuation Signal (SIAS) to open. SIT nitrogen vent valves are unlocked and operated on an as needed basis during plant operation. Whenever the SIT nitrogen vent valves are closed, power is removed with a keylock switch (Reference PVNGS Technical Specification Bases B 3.5.1 and B 3.5.2, Revision 77).

Condition A of LCOs 3.5.1 and 3.5.2 addresses specific causes for a required SIT being inoperable. Specifically, Condition A pertains to one required SIT Inoperable due to boron concentration not within limits, or one required SIT Inoperable due to an inability to verify level or pressure. Condition B of LCOs 3.5.1 and 3.5.2 is specific to one SIT Inoperable for reasons other than Condition A and in this situation (unlike that of Condition A) the Inoperable SIT may not provide the assumed volume during a LOCA. Condition B is broader than the second case of Condition A in which one SIT is Inoperable due to an inability to verify level or pressure as the Condition A case only pertains to an issue related to level or pressure instrumentation adequacy, while a condition involving SIT level and/or pressure known to be outside the required limits results in entry into Condition B.

In addition to extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days, this proposed change deletes the second case of

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 4

Condition A of LCOs 3.5.1 and 3.5.2 (i.e., One required SIT inoperable due to inability to verify level or pressure).

Given the lack of corresponding accident initiators and the presence of barriers to preclude a single failure, extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and deleting the second case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e., One required SIT inoperable due to inability to verify level or pressure) would not result in an adverse impact on the frequency of occurrence of an accident initiator. Extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and deleting the second case of Condition A of LCOs 3.5.1 and 3.5.2 do not involve placing the Unit in a different operating condition than currently permitted; thus, it would not result in a new accident initiator or adversely affect the frequency of occurrence of an accident initiator.

Three beneficial safety impacts of the proposed change include:

1. Avoiding the potential introduction of internal events by challenging safety systems during Mode changes if the current 24-hour Completion Time is not met for Condition B of LCOs 3.5.1 or 3.5.2.

2. Allowing more time for the deliberate planning and execution of maintenance.

3. Eliminating the need for Control Room staff to diagnose potential SIT instrumentation issues.

2. Does the issue result in an adverse impact on the availability, reliability, or capability of SSCs or personnel relied upon to mitigate a transient, accident, or natural hazard?

Response: Yes.

Extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and deleting the second case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e., One required SIT inoperable due to inability to verify level or pressure) would not result in an adverse impact on the reliability or capability of the SITs to mitigate a transient, accident, or natural hazard as the number of Operable SITs required by LCOs 3.5.1 and 3.5.2 is not being revised and the functional requirements of an Operable SIT also remain unchanged.

Extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and deleting the second case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e., One required SIT inoperable due to inability to verify level or pressure) would not result in an adverse impact on personnel relied upon to mitigate a transient, accident, or natural hazard. The SITs are passive components since no operator or control action is required for them to perform their function. Internal tank pressure from the nitrogen cover gas is sufficient to discharge the contents into the RCS if RCS pressure decreases below the SIT pressure (Reference PVNGS Technical Specification Bases B 3.5.1 and B 3.5.2, Revision 77).

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 5

The proposed change does not add any new operator actions, nor does it change established operator response times. Extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days could result in an adverse impact on the availability of systems, structures, and components (SSC) relied upon to mitigate a transient, accident, or natural hazard.

The functions of the four SITs are to supply water to the reactor vessel during the blowdown phase of a large break LOCA, to provide inventory to help accomplish the refill phase that follows thereafter, and to provide RCS makeup for a small break LOCA. The blowdown phase of a large break LOCA is the initial period of the transient during which the RCS departs from equilibrium conditions, and heat from fission product decay, hot internals, and the vessel continues to be transferred to the reactor coolant. The blowdown phase of the transient ends when the RCS pressure falls to a value approaching that of the Containment atmosphere. The refill phase of a LOCA follows immediately where reactor coolant inventory has vacated the core through steam flashing and ejection out through the break. The core is essentially in adiabatic heat-up. The balance of the SITs' inventory is then available to help fill voids in the lower plenum and reactor vessel downcomer to establish a recovery level at the bottom of the core and ongoing reflood of the core with the addition of SI water. (Reference PVNGS Technical Specification Bases B 3.5.1 and B 3.5.2, Revision 77)

The SIT gas and water volumes, gas pressure, and outlet pipe size are selected to allow three of the four SITs to partially recover the core before significant clad melting or zirconium water reaction can occur following a LOCA. The need to ensure that three SITs are adequate for this function is consistent with the LOCA assumption that the entire contents of one SIT will be lost via the break during the blowdown phase of a LOCA. Due to the reduced decay heat removal requirements in Modes 3 and 4, and the reduced probability of a design basis accident (DBA),

the SITs operational requirements are reduced in these Modes. (Reference PVNGS Technical Specification Bases B 3.5.1 and B 3.5.2, Revision 77)

The SITs are taken credit for in both the large and small break LOCA analyses at full power. These are the DBAs that establish the acceptance limits for the SITs. In performing the LOCA calculations, conservative assumptions are made concerning the availability of SI flow. These assumptions include signal generation time, equipment starting times, and delivery time due to system piping. In the early stages of a LOCA with a loss of offsite power, the SITs provide the sole source of makeup water to the RCS. This is because the Low Pressure Safety Injection (LPSI) pumps and High Pressure Safety Injection (HPSI) pumps cannot deliver flow until the Diesel Generators start, come to rated speed, and go through their timed loading sequence. For the limiting cold leg break, the entire contents of one SIT are assumed to be lost through the break during the blowdown and reflood phases. (Reference PVNGS Technical Specification Bases B 3.5.1, Revision 77)

Extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days has the potential to increase the duration that one of the required SITs is Inoperable, which could have an adverse impact on availability of the required SITs to mitigate a LOCA.

See Question 1 of Step 1 - Screening for No Impact for the three beneficial safety impacts of the proposed change.

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 6

3. Does the issue result in an adverse impact on the consequences of an accident sequence?

Response: No.

Extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and deleting the second case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e., One required SIT inoperable due to inability to verify level or pressure) would not result in an adverse impact on the consequences of an accident sequence. The SIT gas and water volumes, gas pressure, and outlet pipe size are selected to allow three of the four SITs to partially recover the core before significant clad melting or zirconium water reaction can occur following a LOCA.

The need to ensure that three SITs are adequate for this function Is consistent with the LOCA assumption that the entire contents of one SIT will be lost via the break during the blowdown phase of a LOCA (Reference PVNGS Technical Specification Bases B 3.5.1 and B 3.5.2, Revision 77). Due to the reduced decay heat removal requirements in Modes 3 and 4, and the reduced probability of a DBA, the SITs operational requirements are reduced in these Modes (Reference PVNGS Technical Specification Bases B 3.5.2, Revision 77). LCO 3.5.2 allows either three or four SITs to be Operable depending upon water level.

The limiting large break LOCA is a double ended guillotine cold leg break at the discharge of the reactor coolant pump. During this event, the SITs discharge to the RCS as soon as RCS pressure decreases to below SIT pressure. The actual delay from the time that the pressurizer pressure reaches the SIAS setpoint to the time that the SI pump flow is delivered to the RCS does not exceed 30 seconds, which includes Diesel Generator starting and sequence loading delays. No operator action is assumed during the blowdown stage of a large break LOCA. (Reference PVNGS Technical Specification Bases B 3.5.1, Revision 77, and PVNGS UFSAR Table 7.3-1B, Engineered Safety Features Response Times)

The worst-case small break LOCA also assumes a time delay before pumped flow reaches the core. For the larger range of small breaks, the rate of blowdown is such that the increase in fuel clad temperature is terminated solely by the SITs, with pumped flow then providing continued cooling. As break size decreases, the SITs and HPSI pumps both play a part in terminating the rise in clad temperature.

As break size continues to decrease, the role of the SITs continues to decrease until they are not required, and the HPSI pumps become solely responsible for terminating the temperature increase (Reference PVNGS Technical Specification Bases B 3.5.1, Revision 77).

LCOs 3.5.1 and 3.5.2 help to ensure that the following acceptance criteria, established by 10 CFR 50.46 for the ECCS, will be met following a LOCA:

a. Maximum fuel element cladding temperature is 2200°F;

b. Maximum cladding oxidation is 0.17 times the total cladding thickness before oxidation;

c. Maximum hydrogen generation from a zirconium water reaction is 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react; and

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 7

d. The core is maintained in a coolable geometry.

Since the SITs discharge during the blowdown phase of a LOCA, they do not contribute to the long-term cooling requirements of 10 CFR 50.46.

In the event of a LOCA while one required SIT is Inoperable, core recovery could be delayed until the LPSI and HPSI pumps are able to deliver sufficient flow to reflood the core. This could affect the ability to meet the acceptance criteria of 10 CFR 50.46 following a LOCA. However, for the purpose of this question consequence is intended to mean radiological dose from risk-significant accident sequences per Nuclear Regulatory Commission (NRC) guidance document, Guidelines for Characterizing the Safety Impact of Issues, Revision 2 (ADAMS Accession No. ML22088A135). NRC guidance document, Guidelines for Characterizing the Safety Impact of Issues, Revision 2, goes on to state that reducing the frequency of core damage is addressed elsewhere and is not the intent of this question.

The assumptions and methodologies of the accident dose consequences are not impacted by the proposed change, because the LCO is unchanged and, therefore, the LOCA design basis analyses and dose consequences remain unchanged. Only the allowed outage time (AOT) is changed, which is a rational time limited deviation from the DBA analyses, based upon controlling operational risk.

Extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and deleting the second case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e., One required SIT inoperable due to inability to verify level or pressure) would not result in an adverse impact on the consequences (i.e., radiological dose) of an accident sequence.

See Question 1 of Step 1 - Screening for No Impact for the three beneficial safety impacts of the proposed change.

4. Does the issue result in an adverse impact on the capability of a fission product barrier?

Response: Yes.

The Palo Verde Nuclear Generating Station (PVNGS) multiple fission product barriers are fuel cladding, RCS pressure boundary, and Containment. Extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days could result in an adverse impact on the capability of a fission product barrier.

Fuel Cladding The limiting large break LOCA is a double ended guillotine cold leg break at the discharge of the reactor coolant pump. During this event, the SITs discharge to the RCS as soon as RCS pressure decreases to below SIT pressure. The actual delay from the time that the pressurizer pressure reaches the SIAS setpoint to the time that the SI pump flow is delivered to the RCS does not exceed 30 seconds, which includes Diesel Generator starting and sequence loading delays. No operator action is assumed during the blowdown stage of a large break LOCA. (Reference PVNGS Technical Specification Bases B 3.5.1, Revision 77, and PVNGS UFSAR Table 7.3-1B, Engineered Safety Features Response Times)

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 8

The worst-case small break LOCA also assumes a time delay before pumped flow reaches the core. For the larger range of small breaks, the rate of blowdown is such that the increase in fuel clad temperature is terminated solely by the SITs, with pumped flow then providing continued cooling. As break size decreases, the SITs and HPSI pumps both play a part in terminating the rise in clad temperature.

As break size continues to decrease, the role of the SITs continues to decrease until they are not required, and the HPSI pumps become solely responsible for terminating the temperature increase (Reference PVNGS Technical Specification Bases B 3.5.1, Revision 77).

LCOs 3.5.1 and 3.5.2 help to ensure that the following acceptance criteria, established by 10 CFR 50.46 for the ECCS, will be met following a LOCA:

a. Maximum fuel element cladding temperature is 2200°F;

b. Maximum cladding oxidation is 0.17 times the total cladding thickness before oxidation;

c. Maximum hydrogen generation from a zirconium water reaction is 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react; and

d. The core is maintained in a coolable geometry.

The aforementioned 10 CFR 50.46 criteria pertain to the requirements for core cooling and the protection of the fuel cladding barrier in the event of a LOCA.

Extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days has the potential to increase the duration that one of the required SITs is Inoperable. In the event of a LOCA while one required SIT is Inoperable, core recovery could be delayed until the LPSI and HPSI pumps are able to deliver sufficient flow to reflood the core. This could affect the ability to meet the acceptance criteria of 10 CFR 50.46 following a LOCA and consequently have an adverse impact on the capability of the fuel cladding to act as a fission product barrier.

RCS Pressure Boundary A LOCA is an accident which is caused by a break in the RCS pressure boundary (Reference Procedure 40DP-9AP08, Loss of Coolant Accident Technical Guideline, Revision 30). By definition, the RCS pressure boundary has already failed when the SITs are required to fulfill their specified safety function. Extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and deleting the second case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e.,

One required SIT inoperable due to inability to verify level or pressure) would not have an adverse impact on the capability of the RCS pressure boundary to act as a fission product barrier.

Containment The SITs provide no function to preserve Containment integrity. Extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and deleting the second case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e.,

One required SIT inoperable due to inability to verify level or pressure) would not

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 9

have an adverse impact on the capability of the Containment structure to act as a fission product barrier.

See Question 1 of Step 1 - Screening for No Impact for the three beneficial safety impacts of the proposed change.

5. Does the issue result in an adverse impact on defense-in-depth capability or impact in safety margin?

Response: Yes.

Defense-in-depth is an element of the NRCs safety philosophy that employs successive compensatory measures to prevent accidents or mitigate damage if a malfunction, accident, or naturally caused event occurs at a nuclear facility. The defense-in-depth philosophy has traditionally been applied in plant design and operation to provide multiple means to accomplish safety functions and prevent the release of radioactive material. Defense-in-depth is often characterized by varying layers of defense, each of which may represent conceptual attributes of nuclear power plant design and operation or tangible objects such as the physical barriers between fission products and the environment. The NRC implements defense-in-depth as four layers of defense that are a mixture of conceptual constructs and physical barriers (see NUREG/KM-0009, Historical Review and Observations of Defense-in-Depth, for further detail). For the purposes of Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, nuclear power plant defense-in-depth is taken to consist of layers of defense (i.e.,

successive measures) to protect the public:

Robust plant design to survive hazards and minimize challenges that could result in an event occurring, Prevention of a severe accident (core damage) if an event occurs, Containment of the source term if a severe accident occurs, Protection of the public from any releases of radioactive material (e.g.,

through siting in low-population areas and the ability to shelter or evacuate people, if necessary).

The ECCS is designed to provide core cooling in the unlikely event of a LOCA and is associated primarily with the second bullet above. The ECCS employs a diverse design to accomplish its functional requirements by the use of active and passive injection subsystems to supply borated water to the core. The four pressurized SITs comprise the passive portion of the ECCS. The active portion of the ECCS includes HPSI pumps, LPSI pumps, and associated valves. The active and passive portions of the ECCS are taken credit for in both the large and small break LOCA analyses at full power. Extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days could increase the duration that a required SIT is Inoperable, reducing the successive measures designed to mitigate a LOCA. As such, this issue could result in an adverse impact on defense-in-depth capability.

See Question 1 of Step 1 - Screening for No Impact for the three beneficial safety impacts of the proposed change.

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 10 Step 2 - Screening for Minimal Impact

1. Does the issue result in more than a minimal increase in frequency of occurrence of a risk significant accident initiator or result in a new risk significant accident initiator?

Response: No.

Table A.1-1 provides a list of accident initiator categories that were evaluated and considered for risk significance concerning extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and deleting the second case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e., One required SIT inoperable due to inability to verify level or pressure). The term risk-significant refers to SSCs performing risk-significant functions, including non-safety-related and safety-related SSCs and actions dependent on human performance. NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, provides specific guidance on risk-significant criteria. The potential for a more than minimal increase in the frequency of occurrence was considered for all categories to identify whether they could be affected by extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days or deleting the second case of Condition A of LCOs 3.5.1 and 3.5.2.

Table A.1-1 provides typical accident initiators and operating Modes (e.g., at-power, low power, or shutdown conditions) that were considered for the potential to be affected by the issue of extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days or deleting the second case of Condition A of LCOs 3.5.1 and 3.5.2.

Table A.1-1: Accident Initiator Categories Accident Initiator Categories Risk Significant?

More than Minimal Increase?

Transients initiated by frontline systems No No. There are no transients initiated by a single required SIT being Inoperable per the second case of Condition A, or Condition B, of LCOs 3.5.1 or 3.5.2.

Transients initiated by support systems No No. There are no transients initiated by a single required SIT being Inoperable per the second case of Condition A, or Condition B, of LCOs 3.5.1 or 3.5.2.

Primary system integrity loss (e.g.,

SGTR, RCP seal LOCA, LOCA)

No No. While the SITs play a role in mitigation of primary system integrity loss, they do not present any accident initiators that affect primary system integrity.

Secondary system integrity loss No No. The SITs do not present any accident initiators that affect secondary system integrity.

Internal flooding No No. The SITs do not present any accident initiators that affect internal flooding.

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 11 Accident Initiator Categories Risk Significant?

More than Minimal Increase?

Internal fires No No. The SITs do not present any accident initiators that affect internal fires.

Earthquakes No No. The SITs do not present any changes to external accident initiators External flooding No No. The SITs do not present any changes to external accident initiators.

Tornados and High Winds No No. The SITs do not present any changes to external accident initiators.

Other External Hazards No No. The SITs do not present any changes to external accident initiators.

Spent Fuel Pool No No. The SITs do not present any accident initiators that affect the Spent Fuel Pool.

Low power and shutdown conditions No No. The SITs do not present any accident initiators that affect low power or shutdown conditions.

External hazard frequencies cannot be reduced or increased by a plant-initiated change. The issue presents no change to external hazards.

Extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and deleting the second case of Condition A of LCOs 3.5.1 and 3.5.2 were determined to not present any increase in the frequency of occurrence of an accident initiator and there are no new accident initiators resulting from this change.

2. Does the issue result in more than a minimal decrease in the availability, reliability, or capability of SSCs or personnel relied upon to mitigate a risk significant transient, accident, or natural hazard?

Response: No.

The ECCS or SI System is designed to provide core cooling in the unlikely event of a LOCA. The SI System accomplishes these functional requirements by use of redundant active and passive injection subsystems. The active portion of the ECCS consists of high and low pressure Safety Injection pumps and associated valves.

The passive portion consists of four pressurized SITs. The SITs containing borated water pressurized by a nitrogen cover gas constitute a passive injection system because no operator action or electrical signal is required for operation. Each tank is connected to its associated reactor coolant cold leg by a separate line containing two check valves which isolate the tank from the RCS during normal operation.

When the reactor coolant pressure falls below the tank pressure, the check valves open discharging the contents of the tank into the RCS. (Reference Revision 22 of PVNGS UFSAR Sections 6.3.1.1, System Description, and 6.3.2.5.1, Safety Injection Tanks)

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 12 The HPSI and LPSI pumps are automatically actuated by a SIAS that is generated by either low pressurizer pressure or high Containment pressure; both of these parameters provide an indication of a LOCA which requires operation of the SI System. The SIAS also repositions various SI System valves to their required positions to facilitate the injection of borated water into the RCS. Each HPSI pump injects to one of two high pressure injection headers, each of which feeds four cold legs. Each LPSI pump injects to one of two low pressure injection headers, each of which feeds two cold legs. The water level in the Refueling Water Tank (RWT) will eventually drop sufficiently to result in the generation of a Recirculation Actuation Signal (RAS). Upon generation of the RAS, the LPSI pumps will be stopped and the Containment sump isolation valves open to supply the HPSI pumps during the recirculation phase. Following the RAS, timely operator action is required to close the RWT isolation valves to prevent ingress of air in the pump suction piping during switchover to recirculation (Reference PVNGS UFSAR Sections 6.3.3a.2.4, Safety Injection System Parameters, 6.3.3b.2.4, Safety Injection System Parameters, and 6.3.5.2, System Actuation Signals).

Extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and deleting the second case of Condition A of LCOs 3.5.1 and 3.5.2 do not affect the availability, reliability, or capability of the LPSI or HPSI portions of the ECCS as the associated actuation signals, pump operation, valve positioning, and operator actions are unaffected by this issue.

The functions of the four SITs are to supply water to the reactor vessel during the blowdown phase of a LOCA, to provide inventory to help accomplish the refill phase that follows thereafter, and to provide RCS makeup for a small break LOCA.

The blowdown phase of a large break LOCA is the initial period of the transient during which the RCS departs from equilibrium conditions, and heat from fission product decay, hot internals, and the vessel continues to be transferred to the reactor coolant. The blowdown phase of the transient ends when the RCS pressure falls to a value approaching that of the Containment atmosphere. The refill phase of a LOCA follows immediately where reactor coolant inventory has vacated the core through steam flashing and ejection out through the break. The core is essentially in adiabatic heat-up. The balance of the SITs' inventory is then available to help fill voids in the lower plenum and reactor vessel downcomer to establish a recovery level at the bottom of the core and ongoing reflood of the core with the addition of SI water. (Reference PVNGS Technical Specification Bases B 3.5.1 and B 3.5.2, Revision 77)

The SIT gas and water volumes, gas pressure, and outlet pipe size are selected to allow three of the four SITs to partially recover the core before significant clad melting or zirconium water reaction can occur following a LOCA. The need to ensure that three SITs are adequate for this function is consistent with the LOCA assumption that the entire contents of one SIT will be lost via the break during the blowdown phase of a LOCA. Due to the reduced decay heat removal requirements in Modes 3 and 4, and the reduced probability of a DBA, the SITs operational requirements are reduced in these Modes (Reference PVNGS Technical Specification Bases B 3.5.1 and B 3.5.2, Revision 77).

UFSAR Section 6.3, Emergency Core Cooling System, Revision 22, describes the ECCS performance analyses of record for the three different fuel types that are currently used in the PVNGS cores; specifically, Westinghouse standard fuel with ZIRLO cladding (UFSAR Section 6.3.3a, Performance Evaluation - CE16STD Fuel),

Westinghouse Next Generation Fuel with Optimized ZIRLO cladding (UFSAR

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 13 Section 6.3.3b, Performance Evaluation - CE16HTP Fuel), and Framatome fuel with M5 cladding (UFSAR Section 6.3.3c, Performance Evaluation - CE16STD Fuel).

The ECCS performance analyses encompass a wide range of RCS break locations and sizes, including both large and small break LOCAs. The analyses also address the single failure criterion and the availability of onsite and offsite electric power systems as required by General Design Criterion (GDC) 35, Emergency Core Cooling, of 10 CFR Part 50 Appendix A.

The ECCS performance analyses of record model the SITs as follows:

1. For the Westinghouse CE16STD and CE16NGF fuel types, the limiting breaks that result in the closest approach to 10 CFR 50.46 acceptance criteria -

that is, peak cladding temperature, maximum localized oxidation, and core-wide oxidation - are Double-Ended Guillotine breaks in the Reactor Coolant Pump Discharge leg (DEG/PD). The Westinghouse analyses credit 100 percent of the flow from three SITs to intact RCS cold legs. The remaining SIT is modeled to spill out the broken cold leg to Containment.

2. For the Framatome CE16HTP fuel type, the limiting break for the core-wide oxidation acceptance criterion of 10 CFR 50.46 is also a DEG/PD. The limiting breaks for the peak cladding temperature and maximum localized oxidation acceptance criteria of 10 CFR 50.46 are, however, split breaks in an RCS cold leg. The treatment of guillotine and split breaks in Framatome large break LOCA analyses is described in Revision 3 of EMF-2103P-A, Realistic Large Break LOCA Methodology for Pressurized Water Reactors, dated June 2016 [Technical Specifications 5.6.5, Core Operating Limits Report (COLR)]. That is, guillotine breaks are modeled similar to that described above for the Westinghouse fuel types, with the contents of one SIT spilling out the broken cold leg to Containment. The Framatome split break model, however, preserves the flow path between cold leg nodes at the break plane, as noted in Section 9.0 of the topical report, and spillage at the break location will therefore vary with the size of the break.

3. For postulated breaks elsewhere in the RCS (that is, hot leg breaks and stuck open pressurizer safety valves), the SIT flow credits four SITs because all RCS cold legs will be intact.

The SITs are taken credit for in both the large and small break LOCA analyses at full power. These are the DBAs that establish the acceptance limits for the SITs. In performing the LOCA calculations, conservative assumptions are made concerning the availability of SI flow. These assumptions include signal generation time, equipment starting times, and delivery time due to system piping. In the early stages of a LOCA with a loss of offsite power, the SITs provide the sole source of makeup water to the RCS. This is because the LPSI pumps and HPSI pumps cannot deliver flow until the Diesel Generators start, come to rated speed, and go through their timed loading sequence. For the limiting cold leg break, the entire contents of one SIT are assumed to be lost through the break during the blowdown and reflood phases. (Reference PVNGS Technical Specification Bases B 3.5.1, Revision 77)

Extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days has the potential to increase the duration that one of the

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 14 required SITs is Inoperable, which could decrease the availability of a required SIT. However, the decrease in availability is considered to be minimal based on entries into Condition B of LCOs 3.5.1 and 3.5.2 being infrequent.

A review of Control Room logs revealed that over the past 20 years of operating history the combined number of entries into Conditions A and B of LCOs 3.5.1 and 3.5.2 has averaged no more than 0.7 per year in any Unit, and 1.22 per year per Unit over the most-limiting three-year period between 2021 and 2023. This most-limiting historical average of 1.22 entries per year per Unit was used as an input to the risk evaluation. The yearly increase in CDF and LERF if the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 were extended from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days would be 1.13x10-8/year for CDF and 1.17x10-10/year for LERF. These results fall below the thresholds for risk significance specified in NRC guidance document, Guidelines for Characterizing the Safety Impact of Issues, Revision 2 (ADAMS Accession No. ML22088A135), of an issue contributing less than 1x10-7/year to CDF and less than 1x10-8/year to LERF. Therefore, the issue is considered to have a minimal impact on safety.

While the historical entries represent a small amount of time, the goal of these entries is nonetheless to expeditiously and safely restore the affected SIT to an Operable status. During operation at an RCS pressure greater than 430 psia the SIT isolation valves are procedurally locked open and motive power is removed with the breakers locked open, which is conservative with respect to the minimum LOCA analysis pressure of 1600 psia (Reference PVNGS Technical Specification Bases B 3.5.1 and B 3.5.2, Revision 77). Periodic testing is performed to ensure the capability of the SIT isolation valves to open automatically prior to RCS pressure exceeding 420 psia, and also upon receipt of a SIAS.

A review of surveillance test results over the last 20 years revealed no test failures or deficiencies that would have prevented the two check valves between each SIT and its corresponding RCS cold leg from opening to admit flow (Procedures 73ST-9XI25, SIT Isolation and Outlet Check Valves Inservice Test, and 40ST-9SI12, Shutdown Cooling Flow Verification), prevented the SIT isolation valves from opening fully within the required time (Procedure 73ST-9XI25), prevented the SIT isolation valves from opening automatically prior to RCS pressure exceeding 420 psia (Procedure 40ST-9SI08, SIT Isolation Valve Motors Power Removed and Auto Open Test), or prevented the SIT isolation valves from opening automatically on a SIAS (Procedures 36ST-9SA01, ESFAS Train A Subgroup Relay Functional Test, 36ST-9SA02, ESFAS Train B Subgroup Relay Functional Test, 36ST-9SA03, ESFAS Train A Subgroup Relay Shutdown Functional Test, 36ST-9SA04, ESFAS Train B Subgroup Relay Shutdown Functional Test, 73ST-9DG01, Class 1E Diesel Generator and Integrated Safeguards Test Train A, and 73ST-9DG02, Class 1E Diesel Generator and Integrated Safeguards Test Train B).

As such, a high degree of reliability is assured for the SITs that remain Operable during entries into Condition B of LCOs 3.5.1 and 3.5.2. Furthermore, this issue does not affect the availability, reliability, or capability of the active injection subsystems (LPSI and HPSI) of the ECCS.

Table A.1-2 outlines considerations for the availability, reliability, or capability of SSCs or personnel.

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 15 Table A.1-2: Availability, Reliability, or Capability Considerations Availability, Reliability, or Capability Considerations Potential Effect?

More than Minimal Decrease?

Changes in maintenance, testing, training No No. This issue does not present any changes in maintenance, testing, or training.

Changes in specific SSCs No No. This issue does not present any changes in SSCs.

Changes in materials No No. This issue does not present any changes in materials.

Equipment replacements to address age related degradation No No. This issue does not present any equipment replacements.

Changes in redundancy and diversity Yes No. This issue does not present any changes to the availability, reliability, or capability of the LPSI or HPSI subsystems. The SITs are not considered redundant as the more limiting LCO 3.5.1 requires all four SITs to be Operable. Based on the infrequent nature of entries into Condition B of LCOs 3.5.1 and 3.5.2, the decrease in ECCS diversity associated with extending the Completion Time is considered to be minimal.

Addition of equipment No No. This issue does not present any addition of equipment.

Strengthening of equipment No No. This issue does not present any strengthening of equipment.

Moving equipment No No. This issue does not require moving equipment.

Eliminating the need for recovery action No No. This issue does not present any changes to recovery actions.

Improving performance shaping factor related to human performance No No. The SITs are passive components; no operator or control action is required for them to perform their function.

Changes in operating practices No No. This issue does not prescribe a change in operating practices. The SITs are passive components with no operator or control action required for them to perform their function. This issue does not add any new operator actions, nor does it change established operator response times.

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 16 The SITs are passive components with no operator or control action required for them to perform their function. This issue does not add any new operator actions, impact emergency operating procedures, or change established operator response times. Given the infrequent historical rate of entries into Condition B of LCOs 3.5.1 and 3.5.2, lack of impact on operator actions, and the lack of impact on the LPSI or HPSI subsystems, the issue does not result in a more than minimal decrease in the availability, reliability, or capability of SSCs or personnel relied upon to mitigate a transient, accident, or natural hazard.

Condition A of LCOs 3.5.1 and 3.5.2 addresses specific causes for a required SIT being inoperable. Specifically, Condition A pertains to one required SIT Inoperable due to boron concentration not within limits, or one required SIT Inoperable due to an inability to verify level or pressure. Condition B of LCOs 3.5.1 and 3.5.2 is specific to one SIT Inoperable for reasons other than Condition A and in this situation (unlike that of Condition A) the Inoperable SIT may not provide the assumed volume during a LOCA.

Condition B is broader than the second case of Condition A in which one SIT is Inoperable due to an inability to verify level or pressure as the Condition A case only pertains to an issue related to level or pressure instrumentation adequacy, while a condition involving SIT level and/or pressure known to be outside the required limits results in entry into Condition B. The second Condition A case necessitates reasonable assurance that level and pressure for the affected SIT remain within limits; otherwise, Condition B would apply.

In addition to extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days, this proposed change deletes the second case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e., One required SIT inoperable due to inability to verify level or pressure). Condition B is broader than the second case of Condition A and eliminating the case for level and/or pressure instrumentation issues simplifies the Control Room staff response by removing the need to diagnose or troubleshoot instrumentation issues related to SIT level and pressure to determine if Condition A or B should be entered.

The first case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e., One required SIT inoperable due to boron concentration not within limits) is not proposed to be eliminated or modified. The PVNGS PRA model does not assess the impact of SIT boron concentration being outside limits for LOCA scenarios, so the use of the RIPE process would not be appropriate for such a change.

Since the second case of Condition A of LCOs 3.5.1 and 3.5.2 is bounded by Condition B of LCOs 3.5.1 and 3.5.2, deleting the second case of Condition A does not affect the adverse impacts noted in the Section 4.1 responses, corresponding risk increase, or the assessed safety impact of the proposed change to extend the completion time to 10 days. As such, the assessment for extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days bounds the deletion of the second case of Condition A of LCOs 3.5.1 and 3.5.2 obviating the need to be addressed separately.

3. Does the issue result in more than a minimal increase in the consequences of a risk significant accident sequence?

Response: No.

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 17 The following risk significant accident sequences could be affected by this issue (PRA Study 13-NS-B106, At-Power PRA System Study for the Safety Injection Systems):

1. Large break LOCA

2. Small break LOCA with a failure of high pressure safety recirculation (HPSR)

The limiting large break LOCA is a double ended guillotine cold leg break at the discharge of the reactor coolant pump. During this event, the SITs discharge to the RCS as soon as RCS pressure decreases to below SIT pressure. The actual delay from the time that the pressurizer pressure reaches the SIAS setpoint to the time that the SI pump flow is delivered to the RCS does not exceed 30 seconds, which includes Diesel Generator starting and sequence loading delays. No operator action is assumed during the blowdown stage of a large break LOCA. (Reference PVNGS Technical Specification Bases B 3.5.1, Revision 77, and PVNGS UFSAR Table 7.3-1B, Engineered Safety Features Response Times)

The worst-case small break LOCA also assumes a time delay before pumped flow reaches the core. For the larger range of small breaks, the rate of blowdown is such that the increase in fuel clad temperature is terminated solely by the SITs, with pumped flow then providing continued cooling. As break size decreases, the SITs and HPSI pumps both play a part in terminating the rise in clad temperature.

As break size continues to decrease, the role of the SITs continues to decrease until they are not required, and the HPSI pumps become solely responsible for terminating the temperature increase (Reference PVNGS Technical Specification Bases B 3.5.1, Revision 77).

UFSAR Section 6.3, Emergency Core Cooling System, describes the ECCS performance analyses of record for the three different fuel types that are currently used in the PVNGS cores; specifically, Westinghouse standard fuel with ZIRLO cladding (UFSAR Section 6.3.3a, Performance Evaluation - CE16STD Fuel),

Westinghouse Next Generation Fuel with Optimized ZIRLO cladding (UFSAR Section 6.3.3b, Performance Evaluation - CE16HTP Fuel), and Framatome fuel with M5 cladding (UFSAR Section 6.3.3c, Performance Evaluation - CE16STD Fuel).

The ECCS performance analyses encompass a wide range of RCS break locations and sizes, including both large and small break LOCAs. The analyses also address the single failure criterion and the availability of onsite and offsite electric power systems as required by GDC 35, Emergency Core Cooling, of 10 CFR Part 50 Appendix A.

The ECCS performance analyses of record model the SITs as follows:

1. For the Westinghouse CE16STD and CE16NGF fuel types, the limiting breaks that result in the closest approach to 10 CFR 50.46 acceptance criteria -

that is, peak cladding temperature, maximum localized oxidation, and core-wide oxidation - are Double-Ended Guillotine breaks in the Reactor Coolant Pump Discharge leg (DEG/PD). The Westinghouse analyses credit 100 percent of the flow from three SITs to intact RCS cold legs. The remaining SIT is modeled to spill out the broken cold leg to Containment.

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 18

2. For the Framatome CE16HTP fuel type, the limiting break for the core-wide oxidation acceptance criterion of 10 CFR 50.46 is also a DEG/PD. The limiting breaks for the peak cladding temperature and maximum localized oxidation acceptance criteria of 10 CFR 50.46 are, however, split breaks in an RCS cold leg. The treatment of guillotine and split breaks in Framatome large break LOCA analyses is described in Revision 3 of EMF-2103P-A, Realistic Large Break LOCA Methodology for Pressurized Water Reactors, dated June 2016 [Technical Specifications 5.6.5, Core Operating Limits Report (COLR)]. That is, guillotine breaks are modeled similar to that described above for the Westinghouse fuel types, with the contents of one SIT spilling out the broken cold leg to Containment. The Framatome split break model, however, preserves the flow path between cold leg nodes at the break plane, as noted in Section 9.0 of the topical report, and spillage at the break location will therefore vary with the size of the break.

3. For postulated breaks elsewhere in the RCS (that is, hot leg breaks and stuck open pressurizer safety valves), the SIT flow credits four SITs because all RCS cold legs will be intact.

LCOs 3.5.1 and 3.5.2 help to ensure that the following acceptance criteria, established by 10 CFR 50.46 for the ECCS, will be met following a LOCA:

a. Maximum fuel element cladding temperature is 2200°F;

b. Maximum cladding oxidation is 0.17 times the total cladding thickness before oxidation;

c. Maximum hydrogen generation from a zirconium water reaction is 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react; and

d. The core is maintained in a coolable geometry.

Since the SITs discharge during the blowdown phase of a LOCA, they do not contribute to the long-term cooling requirements of 10 CFR 50.46.

In the event of a LOCA while one required SIT is Inoperable, core recovery could be delayed until the LPSI and HPSI pumps are able to deliver sufficient flow to reflood the core. This could impact the ability to meet the acceptance criteria of 10 CFR 50.46 following a LOCA. However, for the purpose of the analogous question in Section 4.1 consequence is intended to mean radiological dose from risk-significant accident sequences per NRC guidance document, Guidelines for Characterizing the Safety Impact of Issues, Revision 2 (ADAMS Accession No. ML22088A135). NRC guidance document, Guidelines for Characterizing the Safety Impact of Issues, Revision 2, goes on to state that reducing the frequency of core damage is addressed elsewhere and is not the intent of this question.

The functions of the four SITs are to supply water to the reactor vessel during the blowdown phase of a LOCA, to provide inventory to help accomplish the refill phase that follows thereafter, and to provide RCS makeup for a small break LOCA.

The blowdown phase of a large break LOCA is the initial period of the transient during which the RCS departs from equilibrium conditions, and heat from fission product decay, hot internals, and the vessel continues to be transferred to the

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 19 reactor coolant. The blowdown phase of the transient ends when the RCS pressure falls to a value approaching that of the Containment atmosphere. The refill phase of a LOCA follows immediately where reactor coolant inventory has vacated the core through steam flashing and ejection out through the break. The core is essentially in adiabatic heat-up. The balance of the SITs' inventory is then available to help fill voids in the lower plenum and reactor vessel downcomer to establish a recovery level at the bottom of the core and ongoing reflood of the core with the addition of SI water (Reference PVNGS Technical Specification Bases B 3.5.1 and B 3.5.2, Revision 77).

The assumptions and methodologies of the accident dose consequences are not impacted by the proposed change, because the LCO is unchanged and, therefore, the LOCA design basis analyses and dose consequences remain unchanged. Only the AOT is changed, which is a rational time limited deviation from the DBA analyses, based upon controlling operational risk. Therefore, the issue would not result in more than minimal increase in the consequences of a risk significant accident sequence.

Although this issue does not result in a more than minimal increase in the consequences of a risk significant accident sequence, it is worth noting that the LOCA dose consequence analyses (PVNGS Calculations 13-NC-ZY-0205, Large Break LOCA Radiological Consequences, 13-NC-ZY-0251, Small Break LOCA, Radiological Consequences, and 13-NC-ZY-0287, Determination of Allowable Control Room Inleakage Following Design Basis Accidents) have conservative results such that the actual consequences (radiological dose) of a LOCA would be realistically much less severe. These analyses use conservative inputs and methodology, many of which result in what can objectively in risk space be considered extremely overestimated radiological consequences. This includes the selection of source term, flow/leakage rates, meteorological data/atmospheric dispersion, and overall accident progression.

Since the second case of Condition A of LCOs 3.5.1 and 3.5.2 is bounded by Condition B of LCOs 3.5.1 and 3.5.2, deleting the second case of Condition A does not affect the adverse impacts noted in the Section 4.1 responses, corresponding risk increase, or the assessed safety impact of the proposed change to extend the completion time to 10 days. As such, the assessment for extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days bounds the deletion of the second case of Condition A of LCOs 3.5.1 and 3.5.2 obviating the need to be addressed separately.

4. Does the issue result in more than a minimal decrease in the capability of a fission product barrier?

Response: No.

The PVNGS multiple fission product barriers are fuel cladding, RCS pressure boundary, and containment.

Fuel Cladding The limiting large break LOCA is a double ended guillotine cold leg break at the discharge of the reactor coolant pump. During this event, the SITs discharge to the RCS as soon as RCS pressure decreases to below SIT pressure. The actual delay from the time that the pressurizer pressure reaches the SIAS setpoint to the

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 20 time that the SI pump flow is delivered to the RCS does not exceed 30 seconds, which includes Diesel Generator starting and sequence loading delays. No operator action is assumed during the blowdown stage of a large break LOCA. (Reference PVNGS Technical Specification Bases B 3.5.1, Revision 77, and PVNGS UFSAR Table 7.3-1B, Engineered Safety Features Response Times)

The worst-case small break LOCA also assumes a time delay before pumped flow reaches the core. For the larger range of small breaks, the rate of blowdown is such that the increase in fuel clad temperature is terminated solely by the SITs, with pumped flow then providing continued cooling. As break size decreases, the SITs and HPSI pumps both play a part in terminating the rise in clad temperature.

As break size continues to decrease, the role of the SITs continues to decrease until they are not required, and the HPSI pumps become solely responsible for terminating the temperature increase. (Reference PVNGS Technical Specification Bases B 3.5.1, Revision 77).

UFSAR Section 6.3, Emergency Core Cooling System, describes the ECCS performance analyses of record for the three different fuel types that are currently used in the PVNGS cores; specifically, Westinghouse standard fuel with ZIRLO cladding (UFSAR Section 6.3.3a, Performance Evaluation - CE16STD Fuel),

Westinghouse Next Generation Fuel with Optimized ZIRLO cladding (UFSAR Section 6.3.3b, Performance Evaluation - CE16HTP Fuel), and Framatome fuel with M5 cladding (UFSAR Section 6.3.3c, Performance Evaluation - CE16STD Fuel).

The ECCS performance analyses encompass a wide range of RCS break locations and sizes, including both large and small break LOCAs. The analyses also address the single failure criterion and the availability of onsite and offsite electric power systems as required by GDC 35, Emergency Core Cooling, of 10 CFR Part 50 Appendix A.

The ECCS performance analyses of record model the SITs as follows:

1. For the Westinghouse CE16STD and CE16NGF fuel types, the limiting breaks that result in the closest approach to 10 CFR 50.46 acceptance criteria - that is, peak cladding temperature, maximum localized oxidation, and core-wide oxidation - are Double-Ended Guillotine breaks in the Reactor Coolant Pump Discharge leg (DEG/PD). The Westinghouse analyses credit 100 percent of the flow from three SITs to intact RCS cold legs. The remaining SIT is modeled to spill out the broken cold leg to Containment.

2. For the Framatome CE16HTP fuel type, the limiting break for the core-wide oxidation acceptance criterion of 10 CFR 50.46 is also a DEG/PD. The limiting breaks for the peak cladding temperature and maximum localized oxidation acceptance criteria of 10 CFR 50.46 are, however, split breaks in an RCS cold leg. The treatment of guillotine and split breaks in Framatome large break LOCA analyses is described in Revision 3 of EMF-2103P-A, Realistic Large Break LOCA Methodology for Pressurized Water Reactors, dated June 2016 [Technical Specifications 5.6.5, Core Operating Limits Report (COLR)]. That is, guillotine breaks are modeled similar to that described above for the Westinghouse fuel types, with the contents of one SIT spilling out the broken cold leg to Containment. The Framatome split break model, however, preserves the flow path between cold leg nodes at

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 21 the break plane, as noted in Section 9.0 of the topical report, and spillage at the break location will therefore vary with the size of the break.

3. For postulated breaks elsewhere in the RCS (that is, hot leg breaks and stuck open pressurizer safety valves), the SIT flow credits four SITs because all RCS cold legs will be intact.

The most limiting condition associated with Condition B of LCO 3.5.1 would involve two SITs discharging to the RCS as soon as RCS pressure decreases to below SIT pressure during a large break LOCA while the contents of one SIT are assumed to be lost through the break during the blowdown and reflood phases (Reference PVNGS Technical Specification Bases B 3.5.1, Revision 77); the fourth SIT is Inoperable and assumed to not participate. Although this does not satisfy the assumed condition of the contents of three SITs reaching the core, the contents of two SITs would discharge to the RCS to support the refill phase of a LOCA until the LPSI and HPSI pumps are able to deliver sufficient flow to reflood the core.

Similarly, the most limiting condition associated with Condition B of LCO 3.5.2 would involve one SIT, with a greater minimum required water level than that of LCO 3.5.1, discharging to the RCS as soon as RCS pressure decreases to below SIT pressure during a large break LOCA while the contents of the second SIT are assumed to be lost through the break (Reference PVNGS Technical Specification Bases B 3.5.2, Revision 77); the third SIT is Inoperable and assumed to not participate, and the fourth SIT is not required to be Operable per the LCO statement. While this does not satisfy the assumed condition of the contents of two SITs (with the greater minimum water level requirement specified in the LCO statement) reaching the core, the contents of at least one SIT (with a greater minimum required water level) would discharge to the RCS to support the refill phase of a LOCA until the LPSI and HPSI pumps are able to deliver sufficient flow to reflood the core. It should be noted that voluntary entries into Condition B of LCO 3.5.2 are not part of a normal plant cooldown, nor is crediting only three Operable SITs to meet LCO 3.5.2.

It is noted in CE NPSD-994, Combustion Engineering Owners Group (CEOG) Joint Applications Report for Safety Injection Tank AOT/STI Extension (ADAMS Accession No. ML17228B190), that best estimate analyses for a typical Pressurized Water Reactor (PWR) confirmed that for large break LOCAs, core melt can be prevented by either the operation of one LPSI pump, or the operation of one HPSI pump and a single SIT. While the precise equipment set for any specific PWR may vary, the design basis requirement for one LPSI train, one HPSI train, and all SITs to avert a core melt condition is very conservative. Compliance with Condition B of LCOs 3.5.1 and 3.5.2 would ensure that the minimum available number of Operable SITs capable of discharging to the RCS, excluding the one SIT for which the contents are assumed to be lost through the break, would either be two SITs or a single SIT with a greater minimum required water level as an initial condition to the accident.

Study 13-NS-B106, At-Power PRA System Study for the Safety Injection Systems, specifies the PRA success criteria for the SI System. Table 3 of the Study identifies the following success criterion for the SITs during a large break LOCA transient:

Two SITs are required to inject borated water into the RCS. The UFSAR requirement of 3 SITs is based on the extremely conservative 10 CFR 50 App.

K analysis criteria. Best estimate analysis in WCAP-15701 (see Table 6.1-6) by

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 22 CE has shown that 1 SIT with either one train of HPSI or LPSI is adequate to cool/reflood the core. The requirement for 2 is used, because HPSI is not credited in the model.

Table 3 of Study 13-NS-B106 identifies the following success criterion for the SITs during a small break LOCA transient:

The SITs are required only during a failure of both HPSI trains and after the Control Room operators have depressurized the RCS to less than 610 psig per 40EP-9EO10, Functional Recovery. All four SITs are required during cooldown if HPSR fails as demonstrated by Westinghouse analyses and PVNGS simulator runs for CRDR 2726509. It is assumed that if HPSI fails, the same success criterion is applicable.

LCO 3.5.1 would be applicable to these PRA success criteria based on the corresponding plant operating Mode. Entry into Condition B of LCO 3.5.1 could involve two SITs discharging to the RCS as soon as RCS pressure decreases to below SIT pressure during a large break LOCA based on one SIT being inoperable and the contents of one SIT assumed to be lost through the break (Reference PVNGS Technical Specification Bases B 3.5.1, Revision 77). Consideration of the single failure criterion would only result in the failure of a single train of HPSI for the small break LOCA scenario so the SITs would not be required in order to satisfy the small break LOCA PRA success criterion (UFSAR Section 6.3.2.5.4, Capacity to Maintain Cooling Following a Single Failure). As such, these PRA success criteria would not be jeopardized by extending the Completion Time for Condition B of LCO 3.5.1 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days.

During operation at an RCS pressure greater than 430 psia the SIT isolation valves are procedurally locked open and motive power is removed with the breakers locked open, which is conservative with respect to the minimum LOCA analysis pressure of 1600 psia (Reference PVNGS Technical Specification Bases B 3.5.1 and B 3.5.2, Revision 77). Periodic testing is performed to ensure the capability of the SIT isolation valves to open automatically prior to RCS pressure exceeding 420 psia, and also upon receipt of a SIAS.

A review of surveillance test results over the last 20 years revealed no test failures or deficiencies that would have prevented the two check valves between each SIT and its corresponding RCS cold leg from opening to admit flow (Procedures 73ST-9XI25, SIT Isolation and Outlet Check Valves Inservice Test, and 40ST-9SI12, Shutdown Cooling Flow Verification), prevented the SIT isolation valves from opening fully within the required time (Procedure 73ST-9XI25), prevented the SIT isolation valves from opening automatically prior to RCS pressure exceeding 420 psia (Procedure 40ST-9SI08, SIT Isolation Valve Motors Power Removed and Auto Open Test), or prevented the SIT isolation valves from opening automatically on a SIAS (Procedures 36ST-9SA01, ESFAS Train A Subgroup Relay Functional Test, 36ST-9SA02, ESFAS Train B Subgroup Relay Functional Test, 36ST-9SA03, ESFAS Train A Subgroup Relay Shutdown Functional Test, 36ST-9SA04, ESFAS Train B Subgroup Relay Shutdown Functional Test, 73ST-9DG01, Class 1E Diesel Generator and Integrated Safeguards Test Train A, and 73ST-9DG02, Class 1E Diesel Generator and Integrated Safeguards Test Train B). As such, a high degree of reliability is assured for the SITs that remain Operable during entries into Condition B of LCOs 3.5.1 and 3.5.2.

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 23 The risk significance of this issue was assessed by the risk evaluation in which the yearly increase in CDF and LERF if the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 were extended from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days would be 1.13x10-8/year for CDF and 1.17x10-10/year for LERF. These results fall below the thresholds for risk significance specified in NRC guidance document, Guidelines for Characterizing the Safety Impact of Issues, Revision 2 (ADAMS Accession No. ML22088A135), of an issue contributing less than 1x10-7/year to CDF and less than 1x10-8/year to LERF. Therefore, the issue is considered to have a minimal impact on safety.

Given the above considerations, the proposed issue would not result in a more than minimal decrease in the capability of the fuel cladding to act as a fission product barrier.

Condition A of LCOs 3.5.1 and 3.5.2 addresses specific causes for a required SIT being inoperable. Specifically, Condition A pertains to one required SIT Inoperable due to boron concentration not within limits, or one required SIT Inoperable due to an inability to verify level or pressure. Condition B of LCOs 3.5.1 and 3.5.2 is specific to one SIT Inoperable for reasons other than Condition A and in this situation (unlike that of Condition A) the Inoperable SIT may not provide the assumed volume during a LOCA.

Condition B is broader than the second case of Condition A in which one SIT is Inoperable due to an inability to verify level or pressure as the Condition A case only pertains to an issue related to level or pressure instrumentation adequacy, while a condition involving SIT level and/or pressure known to be outside the required limits results in entry into Condition B. The second Condition A case necessitates reasonable assurance that level and pressure for the affected SIT remain within limits; otherwise, Condition B would apply.

In addition to extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days, this proposed change deletes the second case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e., One required SIT Inoperable due to inability to verify level or pressure). Condition B is broader than the second case of Condition A and eliminating the case for level and/or pressure instrumentation issues simplifies the Control Room staff response by removing the need to diagnose or troubleshoot instrumentation issues related to SIT level and pressure to determine if Condition A or B should be entered.

The first case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e., One required SIT inoperable due to boron concentration not within limits) is not proposed to be eliminated or modified. The PVNGS PRA model does not assess the impact of SIT boron concentration being outside limits for LOCA scenarios, so the use of the RIPE process would not be appropriate for such a change.

Since the second case of Condition A of LCOs 3.5.1 and 3.5.2 is bounded by Condition B of LCOs 3.5.1 and 3.5.2, deleting the second case of Condition A does not affect the adverse impacts noted in the responses, corresponding risk increase, or the assessed safety impact of the proposed change to extend the completion time to 10 days. As such, the assessment for extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days bounds the deletion of the second case of Condition A of LCOs 3.5.1 and 3.5.2 obviating the need to be addressed separately.

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 24 RCS Pressure Boundary A LOCA is an accident which is caused by a break in the RCS pressure boundary (Reference Procedure 40DP-9AP08, Loss of Coolant Accident Technical Guideline, Revision 30). By definition the RCS pressure boundary has already failed and Extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and deleting the second case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e., One required SIT inoperable due to inability to verify level or pressure) would not result in a more than minimal decrease in the capability of the RCS pressure boundary to act as a fission product barrier.

Containment The SITs provide no function to preserve Containment integrity. Extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and deleting the second case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e.,

One required SIT inoperable due to inability to verify level or pressure) would not result in a more than minimal decrease in the capability of the Containment structure to act as a fission product barrier.

5. Does the issue result in more than a minimal decrease in defense-in-depth capability or safety margin?

Response: No.

The ECCS employs a diverse design to accomplish its functional requirements with the use of active and passive injection subsystems to supply borated water to the core in the unlikely event of a LOCA. The SITs comprise the passive portion of the ECCS as each tank discharges its contents into the RCS when RCS pressure falls below SIT pressure. The active portion of the ECCS relies upon delivery of borated water into the core from the HPSI and LPSI pumps. The HPSI and LPSI pumps are automatically actuated by a SIAS that is generated by either low pressurizer pressure or high Containment pressure; both of these parameters provide an indication of a LOCA which requires operation of the SI System (Reference UFSAR Sections 6.3.1.1, System Description, and 6.3.2.5.1, Safety Injection Tanks).

The pumps also receive a start signal actuated by a Containment Spray Actuation Signal (CSAS) that is generated by high-high Containment pressure. The SIAS repositions various SI System valves to their required positions to facilitate the injection of borated water into the RCS. Each HPSI pump injects to one of two high pressure injection headers, each of which feeds four cold legs. Each LPSI pump injects to one of two low pressure injection headers, each of which feeds two cold legs. The water level in the RWT will eventually drop sufficiently to result in the generation of a RAS. Upon generation of the RAS, the LPSI pumps will be stopped and the Containment sump isolation valves open to supply the HPSI pumps during the recirculation phase. Following the RAS, timely operator action is required to close the RWT isolation valves to prevent ingress of air in the pump suction piping during switchover to recirculation (PVNGS UFSAR Sections 6.3.3a.2.4, Safety Injection System Parameters, 6.3.3b.2.4, Safety Injection System Parameters, and 6.3.5.2, System Actuation Signals).

The proposed issue of extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days was identified to have an adverse effect on defense-in-depth. Regardless of this effect, the principles of defense-in-depth

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 25 remain preserved such that this issue does not result in a more than minimal decrease in defense-in-depth capability or safety margin.

Consistency with the defense-in-depth philosophy is maintained by following the seven defense-in-depth considerations provided in Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 3. Key Principle 2 states, The proposed licensing basis change is consistent with the defense-in-depth philosophy. Section C.2.1.1.2 provides considerations for evaluating the impact of the proposed licensing basis change on defense-in-depth. This section addresses seven considerations that the NRC finds acceptable for a licensee to use to evaluate how the proposed licensing basis change impacts to defense-in-depth.

The seven defense-in-depth considerations and the PVNGS response to each is provided below.

Seven Defense-In-Depth Considerations (per RG 1.174, Revision 3):

1. Preserve a reasonable balance among the layers of defense.

Defense-in-depth is often characterized by varying layers of defense, each of which may represent conceptual attributes of nuclear power plant design and operation or tangible objects such as the physical barriers between fission products and the environment. The NRC implements defense-in-depth as four layers of defense that are a mixture of conceptual constructs and physical barriers (see NUREG/KM-0009 for further detail). For the purposes of Regulatory Guide 1.174, nuclear power plant defense-in-depth is taken to consist of layers of defense (i.e., successive measures) to protect the public:

Robust plant design to survive hazards and minimize challenges that could result in an event occurring, Prevention of a severe accident (core damage) if an event occurs, Containment of the source term if a severe accident occurs, and Protection of the public from any releases of radioactive material (e.g.,

through siting in low-population areas and the ability to shelter or evacuate people, if necessary).

Applicable layers of defense include the following (Reference UFSAR Section 3.1, Conformance with NRC General Design Criteria):

SSCs important to safety are designed to withstand the effects of applicable natural phenomena without loss of the capability to perform their safety functions. SSCs important to safety are also designed and located to minimize, consistent with other safety requirements, the probability and effect of fires and explosions. Equipment and facilities for fire protection, including detection, alarm, and extinguishment, are provided to protect plant equipment and personnel from fire, explosion, and the resultant release of toxic vapors. SSCs important to safety are capable of withstanding the effects of, and are compatible with, the environmental conditions associated with normal operation, maintenance, testing, and postulated accidents, including LOCA.

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 26 RCS components are designed to meet the requirements of the American Society of Mechanical Engineers (ASME) Code,Section III. To establish operating pressure and temperature limitations during startup and shutdown of the Reactor Coolant System, the fracture toughness rules defined in the ASME Code,Section III, are followed. Quality control, inspection, and testing are performed as required by ASME Section III and allowable reactor pressure-temperature operations are specified to ensure the integrity of the RCS.

The Reactor Coolant Pressure Boundary (RCPB) is designed to accommodate the system pressures and temperatures attained under all expected modes of Unit operation including all anticipated transients and maintain the stresses within applicable limits. The operating conditions for normal steady state and transient plant operations are established conservatively. Normal operating limits are selected so that an adequate margin exists between them and the design limits. The plant control systems are designed to ensure that plant variables are maintained well within the established operating limits. The plant transient response characteristics and pressure and temperature distributions during normal operations are considered in the design as well as the accuracy and response of the instruments and controls. These design techniques ensure that a satisfactory margin is maintained between the plants normal operating conditions, including design transients, and the design limits for the reactor coolant pressure boundary.

A steel-lined, prestressed, post-tensioned concrete Containment encloses the RCPB. It is designed to sustain, without loss of required integrity, all effects of equipment failures up to and including the double-ended rupture of the largest pipe in the RCPB. In the event of a LOCA, the ECCS and Containment Spray System are actuated, cool the reactor core, and return the Containment to near atmospheric pressure. The Containment, ECCS, Containment Spray System, and Containment isolation system ensure the functional capability of containing any uncontrolled release of radioactivity.

For each nuclear power unit of PVNGS, an onsite electric power system and an offsite electric power system provide power for electric loads important to safety. Two completely independent and redundant electric load groups important to safety are provided for each Unit. Each load group has sufficient capability, independent of the other load group for the same unit, to ensure that:

a. Specified acceptable fuel design limits and design conditions of the RCPB are not exceeded as a result of anticipated operational occurrences.

b. The core is cooled and Containment integrity and other vital functions are maintained in the event of postulated accidents.

Each redundant load group is provided with two offsite (preferred) electric power supplies, an onsite standby Diesel Generator power supply, and two sets of batteries. In addition, Station Blackout Generators (SBOG) can supply power to one of the safety-related 4.16 kV busses. These provide sufficient independence and redundancy to perform their safety functions, assuming a single failure. Eight physically independent circuits on four separate rights-of-way provide electric power from the transmission network to the Palo Verde 525 kV switchyard which, in turn, supplies offsite (preferred) power to the onsite power system.

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 27 Design of the offsite power system minimizes the possibility that failure of any one circuit will cause the failure of any other circuit. For each nuclear power Unit, two physically independent, full-capacity electric power circuits supply offsite (preferred) power to the onsite power system. Each circuit is available following a postulated LOCA to ensure that core cooling, Containment integrity, and other vital safety functions are maintained. Provisions are included to minimize the probability of losing electric power from any of the remaining sources as a result of, or coincident with, the loss of power generated by the nuclear power Unit, the loss of power from the transmission network, or the loss of power from the onsite Diesel Generator. In addition to its two offsite (preferred) electric power supplies, each redundant load group is supplied by an emergency Diesel Generator. The Diesel Generator is capable of providing the total load requirements for a safe shutdown of the Unit, or for the engineered safety features, following a LOCA or other postulated accidents.

Emergency core cooling is provided by the SI System. The system is designed to provide abundant cooling water to remove heat at a rate sufficient to maintain the fuel in a coolable geometry and to assure that zirconium-water reaction is limited to a negligible amount (less than one percent). Detailed analysis has been performed, utilizing models complying with 10 CFR 50, Appendix K, ECCS Evaluation Models, to verify that the system performance is adequate to meet the intent of the Acceptance Criteria for Emergency Core Cooling Systems for Light Water Power Reactors of 10 CFR 50, Paragraph 50.46(b). The system design includes provisions to assure that the required safety functions are accomplished with either onsite or offsite electrical power system operation, assuming a single failure of any component. The single failure may be an active failure during the initial period following an accident (coolant injection phase of emergency core cooling) or an active or limited leakage passive failure during the long-term cooling (coolant recirculation) phase of emergency core cooling.

The Containment Spray System consists of two completely independent subsystems. The heat removal capacity of the flow from either Containment Spray subsystem is adequate to keep the Containment pressure and temperature below design conditions for any size break in the RCS piping up to and including a double-ended break of the largest reactor coolant pipe, with an unobstructed discharge from both ends. Borated water is sprayed downward by the system from the upper regions of the Containment to cool the atmosphere. Cooling reduces the Containment pressure and temperature following a major LOCA.

The reactor Containment structure and its internal compartments, including access openings, penetrations, and the Containment heat removal system, accommodate the calculated pressure and temperature conditions resulting from any LOCA, without exceeding the design leakage rate and with a sufficient margin. Sub-compartment analyses and associated structural evaluations of Containment internal structures consider the worst-case line breaks that are not precluded by Leak Before Break Criteria.

Protection of the public from any releases of radioactive material is accomplished by siting PVNGS in a low-population area located a considerable distance from large population centers, as evaluated around the time of initial licensing. The PVNGS Low Population Zone (LPZ) has been defined as a 4-mile

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 28 radius area, based on the centerline of the Unit 2 Containment building, and has been conservatively selected on the basis of providing effective emergency planning for the residents in the LPZ, as well as limiting radiation doses to below 10 CFR 100 limits to those residents outside the LPZ under the most conservative assumptions for a DBA. The population density of the LPZ is low and is expected to remain as such throughout the plant life, thereby enabling effective emergency planning.

The PVNGS Emergency Plan features provisions to facilitate protection of the public from releases of radioactive material within the 10-mile Emergency Planning Zone (EPZ), and also beyond the 10-mile EPZ as conditions warrant.

Additionally, the LOCA dose consequence analyses (PVNGS Calculations 13-NC-ZY-0205, Large Break LOCA Radiological Consequences, 13-NC-ZY-0251, Small Break LOCA, Radiological Consequences, and 13-NC-ZY-0287, Determination of Allowable Control Room Inleakage Following Design Basis Accidents) have conservative results such that the actual consequences (radiological dose) of a LOCA would be realistically much less severe. These analyses use conservative inputs and methodology, many of which result in what can objectively in risk space be considered extremely overestimated radiological consequences. This includes the selection of source term, flow/leakage rates, meteorological data/atmospheric dispersion, and overall accident progression.

The proposed issue of extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days only impacts the passive portion of the ECCS. SIT injection capability could be reduced, but is not eliminated, while one required SIT is Inoperable per Condition B of LCO 3.5.1 or 3.5.2.

During operation at an RCS pressure greater than 430 psia the SIT isolation valves are procedurally locked open and motive power is removed with the breakers locked open, which is conservative with respect to the minimum LOCA analysis pressure of 1600 psia (Reference PVNGS Technical Specification Bases B 3.5.1 and B 3.5.2, Revision 77). Periodic testing is performed to ensure the capability of the SIT isolation valves to open automatically prior to RCS pressure exceeding 420 psia, and also upon receipt of a SIAS.

A review of surveillance test results over the last 20 years revealed no test failures or deficiencies that would have prevented the two check valves between each SIT and its corresponding RCS cold leg from opening to admit flow (Procedures 73ST-9XI25, SIT Isolation and Outlet Check Valves Inservice Test, and 40ST-9SI12, Shutdown Cooling Flow Verification), prevented the SIT isolation valves from opening fully within the required time (Procedure 73ST-9XI25), prevented the SIT isolation valves from opening automatically prior to RCS pressure exceeding 420 psia (Procedure 40ST-9SI08, SIT Isolation Valve Motors Power Removed and Auto Open Test), or prevented the SIT isolation valves from opening automatically on a SIAS (Procedures 36ST-9SA01, ESFAS Train A Subgroup Relay Functional Test, 36ST-9SA02, ESFAS Train B Subgroup Relay Functional Test, 36ST-9SA03, ESFAS Train A Subgroup Relay Shutdown Functional Test, 36ST-9SA04, ESFAS Train B Subgroup Relay Shutdown Functional Test, 73ST-9DG01, Class 1E Diesel Generator and Integrated Safeguards Test Train A, and 73ST-9DG02, Class 1E Diesel Generator and Integrated Safeguards Test Train B). As such, a high degree of reliability is assured for the SITs that remain Operable during entries into Condition B of LCOs 3.5.1 and 3.5.2.

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 29 Extending the Completion Time was determined to result in a minimal increase in risk. This minimal risk significance is supported by the risk evaluation in which the yearly increase in CDF and LERF if the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 were extended from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days would be 1.13x10-8/year for CDF and 1.17x10-10/year for LERF. These results fall below the thresholds for risk significance specified in NRC guidance document, Guidelines for Characterizing the Safety Impact of Issues, Revision 2 (ADAMS Accession No. ML22088A135), of an issue contributing less than 1x10-7/year to CDF and less than 1x10-8/year to LERF. Therefore, the issue is considered to have a minimal impact on safety.

The active portions of the ECCS (HPSI and LPSI) are unaffected by the proposed issue and remain capable of playing their role in preventing a severe accident in the unlikely event of a LOCA. For the passive portion of the ECCS, a high degree of reliability is assured for the SITs that remain Operable during entries into Condition B of LCOs 3.5.1 and 3.5.2; their contents would discharge to the RCS to support the refill phase of a LOCA until the LPSI and HPSI pumps are able to deliver sufficient flow to reflood the core. Additionally, there is sufficient margin in Calculations 13-MC-SI-0804, Containment Building Water Level During LOCA, and 13-MC-SI-0250, Safety Injection, Containment Spray, and Shutdown Cooling System Pump NPSH Evaluations, to ensure net positive suction head (NPSH) requirements for the SI pumps would be met while one required SIT is inoperable and isolated during the recirculation mode of operation. This bounds Condition B of LCO 3.5.1 and LCO 3.5.2, as applicable.

The elements of a robust plant design to survive hazards and minimize challenges that could result in an event occurring, containment of the source term if a severe accident occurs, and protection of the public from any releases of radioactive material are not adversely impacted by the proposed issue.

Therefore, appropriate balance among these layers of defense is preserved and the combined layers of defense-in-depth would remain effective.

2. Preserve adequate capability of design features without an overreliance on programmatic activities as compensatory measures.

The most limiting condition associated with Condition B of LCO 3.5.1 would involve two SITs discharging to the RCS as soon as RCS pressure decreases to below SIT pressure during a large break LOCA while the contents of one SIT are assumed to be lost through the break during the blowdown and reflood phases (Reference PVNGS Technical Specification Bases B 3.5.1, Revision 77);

the fourth SIT is Inoperable and assumed to not participate. Although this does not satisfy the assumed condition of the contents of three SITs reaching the core, the contents of two SITs would discharge to the RCS to support the refill phase of a LOCA until the LPSI and HPSI pumps are able to deliver sufficient flow to reflood the core.

Similarly, the most limiting condition associated with Condition B of LCO 3.5.2 would involve one SIT, with a greater minimum required water level than that of LCO 3.5.1, discharging to the RCS as soon as RCS pressure decreases to below SIT pressure during a large break LOCA while the contents of the second SIT are assumed to be lost through the break (Reference PVNGS Technical Specification Bases B 3.5.2, Revision 77); the third SIT is Inoperable and assumed to not participate, and the fourth SIT is not required to be Operable

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 30 per the LCO statement. While this does not satisfy the assumed condition of the contents of two SITs (with the greater minimum water level requirement specified in the LCO statement) reaching the core, the contents of at least one SIT (with a greater minimum required water level) would discharge to the RCS to support the refill phase of a LOCA until the LPSI and HPSI pumps are able to deliver sufficient flow to reflood the core. It should be noted that voluntary entries into Condition B of LCO 3.5.2 are not part of a normal plant cooldown, nor is crediting only three Operable SITs to meet LCO 3.5.2.

It is noted in CE NPSD-994, Combustion Engineering Owners Group (CEOG)

Joint Applications Report for Safety Injection Tank AOT/STI Extension (ADAMS Accession No. ML17228B190), that best estimate analyses for a typical PWR confirmed that for large break LOCAs, core melt can be prevented by either the operation of one LPSI pump, or the operation of one HPSI pump and a single SIT. While the precise equipment set for any specific PWR may vary, the design basis requirement for one LPSI train, one HPSI train, and all SITs to avert a core melt condition is very conservative. Compliance with Condition B of LCOs 3.5.1 and 3.5.2 would ensure that the minimum available number of Operable SITs capable of discharging to the RCS, excluding the one SIT for which the contents are assumed to be lost through the break, would either be two SITs or a single SIT that satisfies a greater water level requirement as an initial condition to the accident.

This issue extends the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days; it does not revise the number of Operable SITs required by LCOs 3.5.1 and 3.5.2, nor does it change the functional requirements of an Operable SIT. As such, there is no reduction in the capability of design features associated with the SITs.

The SITs constitute a passive injection system because no operator action or electrical signal is required for operation. Each tank is connected to its associated reactor coolant cold leg by a separate line containing two check valves which isolate the tank from the RCS during normal operation. When the reactor coolant pressure falls below the tank pressure, the check valves open discharging the contents of the tank into the RCS (Reference UFSAR Section 6.3.2.5.1, Safety Injection Tanks). No compensatory measures are required for the proposed issue. The proposed issue does not add any new operator actions, impact emergency operating procedures, or change established operator response times. Additionally, development of a specific performance monitoring strategy is not required. The Technical Specifications LCOs applicable to the ECCS will remain in effect and the associated Surveillance Requirements will continue to be met per their respective frequencies.

Extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days would not result in an overreliance on programmatic activities as compensatory measures.

3. Preserve system redundancy, independence, and diversity commensurate with the expected frequency and consequences of challenges to the system, including consideration of uncertainty.

The proposed change does reduce the diversity, redundancy, and independence of the ECCS. The ECCS is designed to provide core cooling in the unlikely event of a LOCA. The ECCS employs a diverse design to accomplish its functional requirements by the use of active and passive injection subsystems

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 31 to supply borated water to the core. The four pressurized SITs comprise the passive portion of the ECCS. The active portion of the ECCS includes HPSI pumps, LPSI pumps, and associated valves. The active and passive portions of the ECCS are taken credit for in both the large and small break LOCA analyses at full power. This issue does not impact the diversity, redundancy, or independence of the LPSI or HPSI subsystems.

Extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days could increase the duration that a required SIT is Inoperable, temporarily impacting one of the measures designed to mitigate a LOCA. While the full volume of the Inoperable required SIT is assumed to not reach the core while in Condition B of LCOs 3.5.1 and 3.5.2 the available volume from the Operable SITs, except for that which is assumed to be lost through the break, will support the refill phase of a LOCA until the LPSI and HPSI pumps are able to deliver sufficient flow to reflood the core as described in response to question 4 of Step 2 in this Attachment.

The risk significance of this issue was assessed by the risk evaluation in which the yearly increase in CDF and LERF if the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 were extended from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days would be 1.13x10-8/year for CDF and 1.17x10-10/year for LERF. The PVNGS PRA model includes considerations for uncertainty. No additional sensitivity studies for key assumptions or sources of uncertainty are required for the risk evaluation of this issue. These results fall below the thresholds for risk significance specified in NRC guidance document, Guidelines for Characterizing the Safety Impact of Issues, Revision 2 (ADAMS Accession No. ML22088A135) of an issue contributing less than 1x10-7/year to CDF and less than 1x10-8/year to LERF.

Therefore, the issue is considered to have a minimal impact on safety.

4. Preserve adequate defense against potential CCFs.

The ECCS is designed with adequate defense against potential common-cause failures (CCF). The SITs constitute a passive injection system because no operator action or electrical signal is required for operation, and each SIT injects into a different RCS cold leg. The HPSI and LPSI pumps and required valves are automatically actuated by a SIAS that is generated by either low pressurizer pressure or high Containment pressure; the SIAS features 2-out-of-4 initiation logic. Each HPSI pump injects to one of two high pressure injection headers, each of which feeds four cold legs. Each LPSI pump injects to one of two low pressure injection headers, each of which feeds two cold legs. The LPSI and HPSI subsystems are separated into two independent trains powered by independent safety related electrical busses which can each be powered by offsite power or its respective onsite Diesel Generator. In addition, the SBOGs can supply power to one of the safety-related 4.16 kV electrical busses (Reference UFSAR Sections 3.1, Conformance with NRC General Design Criteria, 6.3.2.5.1, Safety Injection Tanks, 6.3.3a.2.4, Safety Injection System Parameters, 6.3.3b.2.4, Safety Injection System Parameters, and 6.3.5.2, System Actuation Signals).

Extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days does not introduce a new common cause failure mode.

Additionally, the potential for common cause failures of components is accounted for in the PVNGS PRA model (Reference PRA Study 13-NS-B064,

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 32 Common Cause Failure Analysis for the Level 1 PRA, Revision 14). As such, adequate defense against potential CCFs is preserved.

5. Maintain multiple fission product barriers.

The PVNGS multiple fission product barriers are fuel cladding, RCS pressure boundary, and containment.

Fuel Cladding The limiting large break LOCA is a double ended guillotine cold leg break at the discharge of the reactor coolant pump. During this event, the SITs discharge to the RCS as soon as RCS pressure decreases to below SIT pressure. The actual delay from the time that the pressurizer pressure reaches the SIAS setpoint to the time that the SI pump flow is delivered to the RCS does not exceed 30 seconds, which includes Diesel Generator starting and sequence loading delays. No operator action is assumed during the blowdown stage of a large break LOCA. (Reference PVNGS Technical Specification Bases B 3.5.1, Revision 77, and PVNGS UFSAR Table 7.3-1B, Engineered Safety Features Response Times)

The worst-case small break LOCA also assumes a time delay before pumped flow reaches the core. For the larger range of small breaks, the rate of blowdown is such that the increase in fuel clad temperature is terminated solely by the SITs, with pumped flow then providing continued cooling. As break size decreases, the SITs and HPSI pumps both play a part in terminating the rise in clad temperature. As break size continues to decrease, the role of the SITs continues to decrease until they are not required, and the HPSI pumps become solely responsible for terminating the temperature increase.

(Reference PVNGS Technical Specification Bases B 3.5.1, Revision 77)

The most limiting condition associated with Condition B of LCO 3.5.1 would involve two SITs discharging to the RCS as soon as RCS pressure decreases to below SIT pressure during a large break LOCA while the contents of one SIT are assumed to be lost through the break during the blowdown and reflood phases (Reference PVNGS Technical Specification Bases B 3.5.1, Revision 77);

the fourth SIT is Inoperable and assumed to not participate. Although this does not satisfy the assumed condition of the contents of three SITs reaching the core, the contents of two SITs would discharge to the RCS to support the refill phase of a LOCA until the LPSI and HPSI pumps are able to deliver sufficient flow to reflood the core as described in response to question 4 of Step 2 in this Attachment.

Similarly, the most limiting condition associated with Condition B of LCO 3.5.2 would involve one SIT, with a greater required water level than that of LCO 3.5.1, discharging to the RCS as soon as RCS pressure decreases to below SIT pressure during a large break LOCA while the contents of the second SIT are assumed to be lost through the break (Reference PVNGS Technical Specification Bases B 3.5.2, Revision 77); the third SIT is Inoperable and assumed to not participate, and the fourth SIT is not required to be Operable per the LCO statement. While this does not satisfy the assumed condition of the contents of two SITs (with the greater minimum water level requirement specified in the LCO statement) reaching the core, the contents of at least one SIT (with a greater minimum required water level) would discharge to the RCS

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 33 to support the refill phase of a LOCA until the LPSI and HPSI pumps are able to deliver sufficient flow to reflood the core. It should be noted that voluntary entries into Condition B of LCO 3.5.2 are not part of a normal plant cooldown, nor is crediting only three Operable SITs to meet LCO 3.5.2.

During operation at an RCS pressure greater than 430 psia the SIT isolation valves are procedurally locked open and motive power is removed with the breakers locked open, which is conservative with respect to the minimum LOCA analysis pressure of 1600 psia (Reference PVNGS Technical Specification Bases B 3.5.1 and B 3.5.2, Revision 77). Periodic testing is performed to ensure the capability of the SIT isolation valves to open automatically prior to RCS pressure exceeding 420 psia, and also upon receipt of a SIAS.

A review of surveillance test results over the last 20 years revealed no test failures or deficiencies that would have prevented the two check valves between each SIT and its corresponding RCS cold leg from opening to admit flow (Procedures 73ST-9XI25, SIT Isolation and Outlet Check Valves Inservice Test, and 40ST-9SI12, Shutdown Cooling Flow Verification), prevented the SIT isolation valves from opening fully within the required time (Procedure 73ST-9XI25), prevented the SIT isolation valves from opening automatically prior to RCS pressure exceeding 420 psia (Procedure 40ST-9SI08, SIT Isolation Valve Motors Power Removed and Auto Open Test), or prevented the SIT isolation valves from opening automatically on a SIAS (Procedures 36ST-9SA01, ESFAS Train A Subgroup Relay Functional Test, 36ST-9SA02, ESFAS Train B Subgroup Relay Functional Test, 36ST-9SA03, ESFAS Train A Subgroup Relay Shutdown Functional Test, 36ST-9SA04, ESFAS Train B Subgroup Relay Shutdown Functional Test, 73ST-9DG01, Class 1E Diesel Generator and Integrated Safeguards Test Train A, and 73ST-9DG02, Class 1E Diesel Generator and Integrated Safeguards Test Train B). As such, a high degree of reliability is assured for the SITs that remain Operable during entries into Condition B of LCOs 3.5.1 and 3.5.2.

It is noted in CE NPSD-994, Combustion Engineering Owners Group (CEOG)

Joint Applications Report for Safety Injection Tank AOT/STI Extension (ADAMS Accession No. ML17228B190), that best estimate analyses for a typical PWR confirmed that for large break LOCAs, core melt can be prevented by either the operation of one LPSI pump or the operation of one HPSI pump and a single SIT. While the precise equipment set for any specific PWR may vary, the design basis requirement for one LPSI train, one HPSI train, and all SITs to avert a core melt condition is very conservative. Compliance with Condition B of LCOs 3.5.1 and 3.5.2 would ensure that the minimum available number of Operable SITs capable of discharging to the RCS, excluding the one SIT for which the contents are assumed to be lost through the break, would either be two SITs or a single SIT that satisfies a greater water level requirement as an initial condition to the accident.

PRA Study 13-NS-B106, At-Power PRA System Study for the Safety Injection Systems, specifies the PRA success criteria for the SI System. Table 3 of the Study identifies the following success criterion for the SITs during a large break LOCA transient:

Two SITs are required to inject borated water into the RCS. The UFSAR requirement of 3 SITs is based on the extremely conservative 10 CFR 50 App. K analysis criteria. Best estimate analysis in WCAP-15701 (see Table 6.1-6) by CE has shown that 1 SIT with either one train of HPSI

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 34 or LPSI is adequate to cool/reflood the core. The requirement for 2 is used, because HPSI is not credited in the model.

Table 3 of PRA Study 13-NS-B106 identifies the following success criterion for the SITs during a small break LOCA transient:

The SITs are required only during a failure of both HPSI trains and after the Control Room operators have depressurized the RCS to less than 610 psig per 40EP-9EO10, Functional Recovery. All four SITs are required during cooldown if HPSR fails as demonstrated by Westinghouse analyses and PVNGS simulator runs for CRDR 2726509.

It is assumed that if HPSI fails, the same success criterion is applicable.

LCO 3.5.1 would be applicable to these PRA success criteria based on the corresponding plant operating Mode. Entry into Condition B of LCO 3.5.1 could involve two SITs discharging to the RCS as soon as RCS pressure decreases to below SIT pressure during a large break LOCA based on one SIT being inoperable and the contents of one SIT assumed to be lost through the break (Reference PVNGS Technical Specification Bases B 3.5.1, Revision 77).

Consideration of the single failure criterion would only result in the failure of a single train of HPSI for the small break LOCA scenario so the SITs would not be required in order to satisfy the small break LOCA PRA success criterion (UFSAR Section 6.3.2.5.4, Capacity to Maintain Cooling Following a Single Failure). As such, these PRA success criteria would not be jeopardized by extending the Completion Time for Condition B of LCO 3.5.1 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days.

The risk significance of this issue was assessed by the risk evaluation in which the yearly increase in CDF and LERF if the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 were extended from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days would be 1.13x10-8/year for CDF and 1.17x10-10/year for LERF. These results fall below the thresholds for risk significance specified in NRC guidance document, Guidelines for Characterizing the Safety Impact of Issues, Revision 2 (ADAMS Accession No. ML22088A135), of an issue contributing less than 1x10-7/year to CDF and less than 1x10-8/year to LERF. Therefore, the issue is considered to have a minimal impact on safety.

Given the above considerations, the proposed issue would not result in a more than minimal decrease in the capability of the fuel cladding to act as a fission product barrier.

RCS Pressure Boundary A LOCA is an accident which is caused by a break in the RCS pressure boundary (Reference Procedure 40DP-9AP08, Loss of Coolant Technical Guideline, Revision 30). By definition, the RCS pressure boundary has already failed and Extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and deleting the second case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e., One required SIT inoperable due to inability to verify level or pressure) would not result in a more than minimal decrease in the capability of the RCS pressure boundary to act as a fission product barrier.

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 35 Containment The SITs provide no function to preserve Containment integrity. Extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and deleting the second case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e.,

One required SIT inoperable due to inability to verify level or pressure) would not result in a more than minimal decrease in the capability of the Containment structure to act as a fission product barrier.

6. Preserve sufficient defense against human errors.

The SITs constitute a passive injection system because no operator action or electrical signal is required for operation. Each tank is connected to its associated reactor coolant cold leg by a separate line containing two check valves which isolate the tank from the RCS during normal operation. When the reactor coolant pressure falls below the tank pressure, the check valves open discharging the contents of the tank into the RCS (UFSAR Section 6.3.2.5.1, Safety Injection Tanks). The proposed issue does not add any new operator actions, impact emergency operating procedures, or change established operator response times. Therefore, sufficient defense against human errors is preserved.

7. Continue to meet the intent of the plants design criteria.

The intent of the plants design criteria will continue to be met. The functional requirements of an Operable SIT and the number of Operable SITs required to fulfill design criteria will remain unchanged. The accident analysis initial conditions will remain the same. There is no change to the design basis analytical limits or any changes to physical equipment or required operational conditions.

The impact of the proposed change is consistent with the principle that sufficient safety margins are maintained. The plants design criteria will continue to be met as the functional requirements of an Operable SIT and the number of Operable SITs required to fulfill design criteria will remain unchanged. The accident analysis initial conditions will remain the same. There is no change to the design basis analytical limits or any changes to physical equipment, required operational conditions, or compliance with applicable codes and standards. While extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days could allow for an increase in the duration that a required SIT is inoperable, sufficient balance among the four layers of defense-in-depth is preserved.

The risk significance of this issue was assessed by the risk evaluation in which the yearly increase in CDF and LERF if the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 were extended from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days would be 1.13x10-8/year for CDF and 1.17x10-10/year for LERF. These results fall below the thresholds for risk significance specified in NRC guidance document, Guidelines for Characterizing the Safety Impact of Issues, Revision 2 (ADAMS Accession No. ML22088A135), of an issue contributing less than 1x10-7/year to CDF and less than 1x10-8/year to LERF. Therefore, the issue is considered to have a minimal impact on safety. This issue would not result in more than minimal decrease in defense-in-depth capability or safety margin.

Enclosure Attachment 1 Description and Assessment of Proposed License Amendment 36 Condition A of LCOs 3.5.1 and 3.5.2 addresses specific causes for a required SIT being inoperable. Specifically, Condition A pertains to one required SIT Inoperable due to boron concentration not within limits, or one required SIT Inoperable due to an inability to verify level or pressure. Condition B of LCOs 3.5.1 and 3.5.2 is specific to one SIT Inoperable for reasons other than Condition A and in this situation (unlike that of Condition A) the Inoperable SIT may not provide the assumed volume during a LOCA.

Condition B is broader than the second case of Condition A in which one SIT is Inoperable due to an inability to verify level or pressure as the Condition A case only pertains to an issue related to level or pressure instrumentation adequacy, while a condition involving SIT level and/or pressure known to be outside the required limits results in entry into Condition B. The second Condition A case necessitates reasonable assurance that level and pressure for the affected SIT remain within limits; otherwise, Condition B would apply.

In addition to extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days, this proposed change deletes the second case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e., One required SIT inoperable due to inability to verify level or pressure). Condition B is broader than the second case of Condition A and eliminating the case for level and/or pressure instrumentation issues simplifies the Control Room staff response by removing the need to diagnose or troubleshoot instrumentation issues related to SIT level and pressure to determine if Condition A or B should be entered.

The first case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e., One required SIT inoperable due to boron concentration not within limits) is not proposed to be eliminated or modified. The PVNGS PRA model does not assess the impact of SIT boron concentration being outside limits for LOCA scenarios, so the use of the RIPE process would not be appropriate for such a change.

Since the second case of Condition A of LCOs 3.5.1 and 3.5.2 is bounded by Condition B of LCOs 3.5.1 and 3.5.2, deleting the second case of Condition A does not affect the adverse impacts noted in the responses, corresponding risk increase, or the assessed safety impact of the proposed change to extend the completion time to 10 days. As such, the assessment for extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days bounds the deletion of the second case of Condition A of LCOs 3.5.1 and 3.5.2 obviating the need to be addressed separately.

Enclosure Attachment 2 Description and Assessment of Proposed License Amendment 1

ATTACHMENT 2:

Evaluation of Risk Significance

Enclosure Attachment 2 Description and Assessment of Proposed License Amendment 2

PRA Analysis For the purposes of this evaluation, the risk impact was based on the relative change in risk associated with baseline core damage frequency (CDF) and large early release frequency (LERF). The Nuclear Energy Institute (NEI) has provided the following guidance on CDF and LERF thresholds for risk significance in technical report NEI 21-01, Industry Guidance to Support Implementation of NRCs Risk-Informed Process for Evaluations, Revision 1.

Generally, items that are not risk-significant are those that contribute less than 1 x 10-7/year and 1 x 10-8/year for CDF and LERF, respectively.

The risk associated with extending the AOTs of Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and deleting the second case (i.e., One required SIT inoperable due to an inability to verify level or pressure) from Condition A of LCOs 3.5.1 and 3.5.2 is quantified using PVNGS PRA One Top Multi-Hazard Model (OTMHM)

PRADATA, Version 22. The current AOT for the second case of Condition A of LCOs 3.5.1 and 3.5.2 is 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . Deleting this condition will make the AOT 10 days for a SIT inoperable for any reason other than due to boron concentration not within limits.

The yearly increase in CDF/LERF associated with making these changes to the technical specifications is calculated by quantifying the PVNGS OTMHM with one SIT inoperable with none of its inventory available to inject into the RCS for 10 days.

The second case of Condition A in LCO 3.5.1 and LCO 3.5.2 is entered when the inventory of a SIT is available to inject into the RCS but is inoperable because the water level or pressure is not able to be verified due to an instrumentation issue.

LCOs 3.5.1 and 3.5.2 are entered when a SIT cannot inject any of its inventory into the RCS. Therefore, the risk associated with extending the AOT for the second case of Condition A in LCOs 3.5.1 and 3.5.2 from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is bounded by the risk associated with extending the AOTs for Condition B in LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days.

The PVNGS OTMHM PRA model is quantified one hazard at a time to allow each hazard to be quantified at the appropriate truncation value and to speed up the quantification time. The following flag files were used to turn off the hazards not being quantified.

Flag File to turn Internal Events off, PV_I_OFF.flg Flag File to turn Internal Flooding off, PV_L_OFF.flg Flag File to turn Seismic off, PV_S_OFF.flg Flag File to turn Internal Fire off, PV_F_OFF.flg Lower Mode Low Power Shutdown Risk The PVNGS PRA does not include a low power / shutdown model and is applicable for Modes 1 and 2. However, NRCs RIPE guidance, Guidelines for Characterizing the Safety Impact of Issues, Revision 2, states that conservative or bounding analyses may be performed to quantify the risk impact when low power and shutdown PRA models are not available.

Enclosure Attachment 2 Description and Assessment of Proposed License Amendment 3

A review of PVNGS initiating events has been performed to determine what if any changes to the online PRA model are necessary to evaluate the risk associated with one SIT inoperable. The relevant initiating events for the SITs and these technical specifications are Large Loss of Coolant Accidents (LLOCA) and Small Loss of Coolant Accidents (SLOCA). The SITs do not provide a recovery function for any other initiating events in the at-power model, nor are there initiating events unique to Modes 3 and 4 that the SITs support. Therefore, only LLOCA and SLOCA are considered for potential low power/shutdown risk impact.

Loss of coolant accidents are calculated with the RCS at operating pressures when in Mode 1 and 2. In the lower Modes, the stresses on the RCS piping are far-less than expected at design conditions. WCAP-16196-P, PRA LPSD Transition Risk Notebook, dated October 2004, and WCAP-16560-P, Assessment of Shutdown Risk and Insights for the PWROG, dated October 2006, stipulate that when RCS pressure is at 1000 psi that there is negligible probability of a pipe break.

Therefore, it would be appropriate to reduce the at-power initiating event frequencies for LLOCA and SLOCA when quantifying risk impact of having one SIT inoperable for 10 days.

For the purposes of this evaluation, the risk associated with having one SIT inoperable for 10 days in Modes 3 and 4 will be quantified using the PVNGS at-power PRA model with no adjustments made to the LLOCA or SLOCA initiating events. This is done to provide a bounding conservative analysis for Modes 3 and 4.

Safety Injection Tank PRA Modeling In PRA Study 13-NS-B061, At-Power PRA Event Trees and Success Criteria, Revision 7, the SITs are required to mitigate LLOCA and SLOCA. For LLOCA (LLOCASEQ), the SITs provide the initial injection of borated water needed to reflood the reactor vessel and cool the core immediately following a Large LOCA. Since break location is unknown, but could be in a cold leg, it is conservatively assumed that the inventory from one SIT is lost out the break. Documented in PRA Study 13-NS-B061, two SITs injecting into the core through intact cold legs are required for success.

The Medium LOCA event tree (MLOCA-SEQ) applies to all reactor coolant system ruptures inside containment that are large enough to carry away decay heat without relying on secondary cooling, but not large enough such that rapid core reflood from the SITs is required (PRA Study 13-NS-B061, At-Power PRA Event Trees and Success Criteria, Revision 7). The core is quenched primarily by HPSI flow.

Following a SLOCA procedure, 40EP-9EO03, Loss of Coolant Accident, Revision 45, directs operators to commence plant cooldown using the AFW system and the Atmospheric Dump Valves (ADVs). If High Pressure Safety Recirculation (HPSR) fails when the Recirculation Actuation Signal (RAS) is reached, the operators would not attempt to go onto shutdown cooling. Instead, they would proceed with the cooldown (requiring both SGs) using SITs for inventory makeup (PRA Study 13-NS-B061, At-Power PRA Event Trees and Success Criteria, Revision 7).

Additional Assumptions

1. None

Enclosure Attachment 2 Description and Assessment of Proposed License Amendment 4

Inputs Model Files The following PVNGS OTMHM PRA model files were used to quantify the CDF and LERF with one SIT inoperable:

Master Fault Tree: PV_ILFS_111221.caf Database: PV_I0L0F0S1_2020-06-24.rr Master Flag File: PV_Common_111521 - 1ASIT.flg*

Master Recovery File: PV_ILFS-FV_102821.recv

Note, the PV_Common_111521 - 1ASIT.flg is a modified version of the PVNGS OTMHM which changes the 1A SIT out of service basic event flag (OOS-SIT1A) value from True.T to a probability PROB of 1.0.

Maintenance Frequency The maintenance frequency for SITs is not expected to change based on an extended AOT, so the maintenance frequency for the proposed AOT is the same frequency as for the current AOT. A review of the past three years of operator logs was performed to determine the average frequency of entering Condition B in LCOs 3.5.1 and 3.5.2, or the second case of Condition A in LCOs 3.5.1 and 3.5.2 (i.e., One required SIT inoperable due to an inability to verify level or pressure). For the past three years PVNGS has entered these LCOs an average of 1.22 times per year per unit.

One Top Multi-Hazard Model CDF and LERF Quantification The OTMHM PRA is quantified one hazard at a time to allow for using the most appropriate truncation level for each hazard. The truncation level for each hazard and consequence is presented in Table A.2-1.

Table A.2-1: Truncation Level for Hazards Hazard CDF Truncation Level LERF Truncation Level Fire 2.0x10-12 2.0x10-13 Internal Events 2.0x10-13 1.0x10-14 Internal Flood 1.0x10-13 1.0x10-15 Seismic 5.0x10-10 2.0x10-11 The total CDF and LERF is calculated by summing the contribution from each hazard listed below in Table A.2-2.

Table A.2-2:

Hazard Event Baseline (per year)

One Inoperable SIT (per year)

Delta (per year)

Fire CDF 2.59x10-5 2.59x10-5 4.97x10-9 Internal Events CDF 2.62x10-6 2.96x10-6 3.33x10-7 Internal Flood CDF 1.71x10-5 1.71x10-5 0.00 Seismic CDF 1.54x10-5 1.54x10-5*

0.00 Fire LERF**

3.22x10-6 3.22x10-6 3.25x10-10

Enclosure Attachment 2 Description and Assessment of Proposed License Amendment 5

Hazard Event Baseline (per year)

One Inoperable SIT (per year)

Delta (per year)

Internal Events LERF 1.28x10-7 1.31x10-7 3.18x10-9 Internal Flood LERF 6.02x10-7 6.02x10-5 0.00 Seismic LERF**

5.70x10-6 5.70x10-6 0.00

Noted changes to the Seismic CDF and LERF cutsets for the SIT case were limited to seismic bins 10 and 11 that both have CDP/LERP values of 1.0 due to failures unrelated to the Safety Injection Tanks.

- The EPRI ACUBE, Advanced Cutset Upper Bound Estimator, software is used here for post processing of the top 25000 Fire LERF cutsets and the top 5000 Seismic LERF cutsets to produce a more accurate summation of the cutsets.

The increase in risk associated with having a SIT inoperable is driven by internal events hazards.

Risk Calculation This evaluation calculates the Incremental Core Damage Probability (ICDP) and Incremental Large Early Release Probability (ILERP) associated with the extended allowed outage time by multiplying the total increase in CDF (CDF) and LERF (LERF) by the fraction of the year taken by the proposed allowed outage time as shown below.

The CDF and LERF results provided in Computer Aided Fault Tree Analysis System (CAFTA) cutsets results for individual hazards are reported using 7 decimal places.

The calculations shown below are calculated in Microsoft Excel using scientific notation with 7 decimal places. Seven decimal places are provided for the terms in the equations below so the reader can review the results of these calculations without having access to the Microsoft Excel spreadsheet used to calculate them. The quantification results provided in Tables A.2-3 and A.2-4 are reported using scientific notation with two significant digits per normal convention.

CDF = CDF1SIT Inoperable - CDFbaseline LERF = LERF1SIT Inoperable - LERFbaseline The total CDF/LERF is calculated using the results provided in Table A.2-2.

CDFtotal = CDFfire + CDFinternal events + CDFinternal flood + CDFseismic CDFtotal = 4.9650000E-09+ 3.3334840E-07+ 0.0000000E+00+ 0.0000000E+00 CDFtotal = 3.3831340E-07/year LERFtotal = LERFfire + LERFinternal events + LERFinternal flood + LERFseismic LERFtotal = 3.2500000E-10 + 3.1838600E-09 + 0.0000000E+00+ 0.0000000E+00 LERFtotal = 3.5088600E-09/year The ICDP and ILERP associated with having one SIT inoperable for 10 days is calculated as shown below.

ICDP = CDFtotal * (AOTdays / 365days/year)

Enclosure Attachment 2 Description and Assessment of Proposed License Amendment 6

ICDP = 3.3831340E-07/year *(10 days / 365days/year) = 9.2688603E-09 ILERP = LERFtotal * (AOTdays / 365days/year)

ILERP = 3.5088600E-09/year * (AOTdays / 365days/year) = 9.6133151E-11 The yearly increase in CDF and LERF is calculated by multiplying the ICDP and ILERP by the PVNGS yearly average maintenance frequency (f).

CDFincrease/year = ICDP

fLCO entries/year CDFincrease/year = 9.2688603E-09* 1.22LCO entries/year CDFincrease/year = 1.1308010E-08/year LERFincrease/year = ILERP

fLCO entries/year LERFincrease/year = 9.6133151E-11

1.22LCO entries/year LERFincrease/year = 1.1728244E-10/year Safety Injection Tank Reliability This evaluation includes a section which provides an estimate of the reliability of the SITs to provide insights into the likelihood of an equipment failure preventing an operable SIT from injecting water into the RCS. The result of these calculations provide an estimate of how reliable the SITs and their associated valves which provide the flow path to the RCS cold legs.

The following PVNGS internal events PRA model files were used to quantify the reliability of the SITs:

Master Fault Tree: PV_ILFS_111221.caf Master Database: PV_ILFS_121521.rr Applicable SIT top logic gates in the PVNGS internal events PRA model files identified above were quantified with a cutset truncation value of 2.0E-13 to calculate the failure probability of one of the four SITs failing to inject water in to the RCS due to a failure of a discharge check valve or motor operated isolation valve (GSIT1A Train 1A, GSIT-1B Train 1B, GSIT-2A Train 2A, and GSIT-2B Train 2B). The truncation value of 2.0E-13 was used, because truncation analysis documented in 13-NS-B067, At-Power Level 1 PRA Quantification, Revision 8, demonstrated that the PVNGS internal events CDF results converge at this truncation value.

GSIT-1A: Safety Injection Tank 1A Fails to Inject Water to RCS GSIT-1B: Safety Injection Tank 1B Fails to Inject Water to RCS GSIT-2A: Safety Injection Tank 2A Fails to Inject Water to RCS GSIT-2B: Safety Injection Tank 2B Fails to Inject Water to RCS

Enclosure Attachment 2 Description and Assessment of Proposed License Amendment 7

The probability of an individual SIT failing to inject water into the RCS is 7.4E-04.

These results support the conclusion that individual SITs are highly reliable.

PRA Key Assumptions and Sources of Uncertainty Key assumptions and sources of uncertainty for the PVNGS internal events, internal flooding, seismic and fire PRA Models of Record were identified and dispositioned in the four reports listed below. A review of these reports was performed to identify key assumptions and sources of uncertainty which would be significant for this SIT risk assessment. This review did not identify any key assumptions or sources of uncertainty that were applicable to quantifying the risk associated with a SIT being inoperable. Therefore, no additional sensitivity studies for key assumptions or sources of uncertainty are required.

001031-RPT-01, Internal Events PRA Sensitivity and Uncertainty Analysis Palo Verde Generating Station, Revision 0 001031-RPT-02, Internal Flood PRA Sensitivity and Uncertainty Analysis Palo Verde Generating Station, Revision 0 0001-0013-017-009, Palo Verde Nuclear Generating Station Fire PRA Uncertainty and Sensitivity Analysis Notebook, Revision 2 001031-RPT-03, At-Power SPRA Sensitivity and Parametric Uncertainty Analysis Palo Verde Generating Station, Revision 1 Results and Conclusions The overall conclusion of this risk assessment is that extending the AOTs of Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and to deleting the second case (i.e., One required SIT inoperable due to an inability to verify level or pressure) from Condition A of LCOs 3.5.1 and 3.5.2 is not risk significant. This conclusion is supported by the quantification results provided below in Table A.2-3 which indicate that the risk impact of these changes are a 1.13x10-8/year increase in CDF and a 1.17x10-10/year increase in LERF calculated by the PVNGS OTMHM. Therefore, the changes associated with this request are not risk significant per the guidance provided in section four of NEI 21-01, Industry Guidance to Support Implementation of NRCs Risk-Informed Process for Evaluations, Revision 1.

Table A.2-3: PVNGS OTMHM Quantification Results Case Core Damage Frequency (CDF)

Large Early Release Frequency (LERF)

PVNGS Baseline 6.11x10-5/year 9.65x10-6/year Yearly Increase based on 10-day AOT for Condition B of LCOs 3.5.1 and 3.5.2 (Maintenance frequency = 1.22/year) 1.13x10-8/year 1.17x10-10/year Cumulative Risk The cumulative risk impact associated with this amendment request is provided below in Table A.2-4. The cumulative risk is calculated by adding the total yearly increase in CDF and LERF provided in Table A.2-3 to the baseline CDF and LERF calculated by the

Enclosure Attachment 2 Description and Assessment of Proposed License Amendment 8

PVNGS OTMHM. The results indicate the cumulative risks remain within the acceptance guidelines established in Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to The Licensing Basis, Revision 3.

Table A.2-4: Quantification Results Case Core Damage Frequency (CDF)

Large Early Release Frequency (LERF)

PVNGS Baseline 6.11x10-5/year 9.65x10-6/year Yearly Increase based on 10-day AOT for Condition B of LCOs 3.5.1 and 3.5.2 (Maintenance frequency = 1.22/year) 1.13x10-8/year 1.17x10-10/year Total CDF and LERF with 10-day AOT for Condition B of LCOs 3.5.1 and 3.5.2 (Maintenance frequency = 1.22/year) 6.11x10-5/year 9.65x10-6/year NRC RG 1.174 Acceptance Guideline 1.0x10-4/year 1.0x10-5/year

Enclosure Attachment 3 Description and Assessment of Proposed License Amendment 1

ATTACHMENT 3:

Integrated Decision-Making Panel (IDP) Evaluation Results

Enclosure Attachment 3 Description and Assessment of Proposed License Amendment 2

Integrated Decision-Making Panel (IDP) Meeting R-24-01 Risk-Informed Process for Evaluations (RIPE)

January 31, 2024 Verification of Quorum Members:

Eric Miller Chair, Operations Ryan Siddens System Engineering Jill Anderson Design Engineering Mike Cymbor PRA Bob Hicks Safety Analysis Carl Stephenson Licensing Melissa Cole IDP Coordinator Presenters:

Josh Jenkins Engineering Patrick Bozym PRA Other:

Matthew Cox, APS Sarah Kane, APS Jared Schank, APS Kenneth Hall, APS Maria Groshner, APS Minutes recorded by: Melissa Cole I.

The IDP assembled and the meeting convened at 11:30AM in-person and virtually via Microsoft Teams (hybrid meeting).

II.

AGENDA

a. Opening Remarks-Matthew Cox

b. Quorum & Training Verification-Melissa Cole

c. IDP Briefing-Eric Miller

d. Issue Presentation-Josh Jenkins and Patrick Bozym

e. IDP Discussion

f.

IDP Recommendations and Comments

g. IDP Vote

h. Action Item Review-Melissa Cole

i.

Closing Remarks-Matthew Cox

j.

Meeting Adjournment III.

IDP MEETING This Risk-Informed Process for Evaluations (RIPE) Integrated Decision-Making Panel (IDP) Meeting will explore the issue of extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days and delete the second case (i.e., One required SIT inoperable due to an inability to verify level or pressure) from Condition A of LCOs 3.5.1 and 3.5.2. If it is determined to be of low safety significance, a license amendment request can then be submitted to the NRC and qualify for an expedited NRC review. Cox provided opening remarks.

Quorum and training qualifications were verified by Cole. Miller conducted a pre-job brief for the IDP members and highlighted the scope and responsibilities for the meeting. Jenkins and Bozym presented the key conclusions from their evaluation of the issue.

Enclosure Attachment 3 Description and Assessment of Proposed License Amendment 3

Key conclusions include:

1. Reason for the proposed changes.

a. Recent plant operating experience resulted in a station-initiated effort to increase SIT reliability

b. 24-hour LCO Completion Time cycles the organization and does not allow for planning and deliberate execution, potential NOED situation

c. Risk analysis supports a LAR using the RIPE process to increase the LCO completion time for a single SIT out of service

2. Issue description and presentation of the markup to the Technical Specifications with proposed changes. Discussion took place related to why the first case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e., One SIT inoperable due to boron concentration not within limits) is not being pursued for a change to 10 days, because this would require a new LOCA analysis and a traditional license amendment request outside of the RIPE process. Further clarification was also provided about Condition B being the bounding case that justifies deletion of the second case in Condition A.

3. Section 4.1 Responses

a. Question 1 - Does the issue result in an adverse impact on the frequency of occurrence of an accident initiator or result in a new accident initiator? NO There are no accident initiators related to a single required SIT being Inoperable per Condition B of Limiting Condition for Operation (LCO) 3.5.1 or 3.5.2, or per the second case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e., One required SIT inoperable due to inability to verify level or pressure).

b. Question 2 - Does the issue result in an adverse impact on the availability, reliability, or capability of SSCs or personnel relied upon to mitigate a transient, accident, or natural hazard? YES Extending the Completion Time for Condition B of LCOs 3.5.1 and 3.5.2 from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 10 days has the potential to increase the duration that one of the required SITs is Inoperable, which could have an adverse impact on availability of the required SITs to mitigate a LOCA.

c. Question 3 - Does the issue result in an adverse impact on the consequences of an accident sequence? NO

[This response is generated prior to PRB comment incorporation (i.e.,

response has been revised to include statement that dose consequences are not impacted)] - The issue would not result in an adverse impact on the consequences (i.e., radiological dose) of an accident sequence since reducing the frequency of core damage is not the intent of this question, as noted in ML22088A135. The SITs are designed to recover the core before significant clad melting or zirconium-water reaction can occur following a LOCA. Since this function is intended to minimize core damage, further consideration for mitigating the radiological dose consequences of an accident sequence is not required per ML22088A135.

d. Question 4 - Does the issue result in an adverse impact on the capability of a fission product barrier? YES In the event of a LOCA while one required SIT is Inoperable, core recovery could be delayed until the LPSI and HPSI pumps are able to

Enclosure Attachment 3 Description and Assessment of Proposed License Amendment 4

deliver sufficient flow to reflood the core. This issue could affect the ability to meet the acceptance criteria of 10 CFR 50.46 following a LOCA and consequently have an adverse impact on the capability of the fuel cladding to act as a fission product barrier.

Discussion took place on how the volume of the water in the SIT relates to temperature and peak pressure in containment. Anderson clarified how the design basis relates to temperature and pressure calculations.

e. Question 5 - Does the issue result in an adverse impact on defense-in-depth capability or impact in safety margin? YES The active and passive portions of the ECCS are taken credit for in both the large and small break LOCA analyses at full power. This issue could increase the duration that a required SIT is Inoperable, reducing the successive measures designed to mitigate the consequences of a LOCA.

As such, this issue could result in an adverse impact on defense-in-depth capability.

4. Section 4.2 Responses

a. Question 1 - Does the issue result in more than minimal increase in the frequency of occurrence of an accident initiator or result in a new accident initiator? NO There are no accident initiators related to a single required SIT being Inoperable per Condition B of Limiting Condition for Operation (LCO) 3.5.1 or 3.5.2, or per the second case of Condition A of LCOs 3.5.1 and 3.5.2 (i.e., One required SIT inoperable due to inability to verify level or pressure). Since the SITs are passive components, single active failures are not applicable to their operation. Barriers are in place to prevent spurious operation of SIT isolation valves and SIT nitrogen vent valves.

This issue does not involve placing the Unit in a different operating condition than currently allowed; thus, would not result in a new accident initiator or adversely affect the frequency of occurrence of an accident initiator.

b. Question 2 - Does the issue result in more than minimal decrease in the availability, reliability, or capability of SSCs or personnel relied upon to mitigate a transient, accident, or natural hazard? NO The decrease in availability is considered minimal based on historical entries into Condition B of LCOs 3.5.1 and 3.5.2 being infrequent. The most-limiting 3-year historical average of 1.22 combined entries into Condition B of LCOs 3.5.1 and 3.5.2 per year per Unit was used as an input to the RIPE risk evaluation. The calculated yearly increase in CDF and LERF are well below the thresholds for risk significance specified in ML22088A135. Therefore, the issue is considered to have a minimal impact on safety and not result in a more than minimal decrease in the availability, reliability, or capability of SSCs or personnel relied upon to mitigate a transient, accident, or natural hazard.

Discussion took place on the sensitivity of allowed out of service times used to determine CDF and LERF impacts. Bozym confirmed that doubling the historical values used would have negligible impact, confirming that the sensitivity is low. Cymbor commented that historical entries have been limited to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months and now we are going to 10 days

Enclosure Attachment 3 Description and Assessment of Proposed License Amendment 5

and questions if there is a threshold for defining more than minimal decrease in availability. Jenkins justification uses engineering judgement that parallels the more than minimal application in the 50.59 process. This was captured on the comment form to document the response outlining what was specifically considered in his engineering judgement.

c. Question 3 - Does the issue result in more than minimal increase in the consequences of a risk significant accident sequence? NO The issue would not result in a more than minimal impact on the consequences (i.e., radiological dose) of an accident sequence since reducing the frequency of core damage is not the intent of this question, as noted in ML22088A135. The SITs are designed to recover the core before significant clad melting or zirconium-water reaction can occur following a LOCA. Since this function is intended to minimize core damage, further consideration for mitigating the radiological dose consequences of an accident sequence is not required per ML22088A135. It is worth noting that the PVNGS LOCA dose consequence analyses are highly conservative to the point of overestimating potential consequences. Additionally, the yearly increase in CDF and LERF calculated by the RIPE risk evaluation are well below the thresholds for risk significance specified in ML22088A135.

d. Question 4 - Does the issue result in more than minimal decrease in the capability of a fission product barrier? NO It is noted in ML17228B190 that best estimate analyses for a typical PWR confirmed that for large break LOCAs, core melt can be prevented by either the operation of one LPSI pump, or the operation of one HPSI pump and a single SIT. PVNGS at-power PRA success criteria for the SI System require two SITs to inject borated water into the RCS during a large break LOCA. These criteria would not be compromised while one required SIT is Inoperable. The yearly increase in CDF and LERF calculated by the RIPE risk evaluation are well below the thresholds for risk significance specified in ML22088A135. This issue would not result in a more than minimal decrease in the capability of the fuel cladding to act as a fission product barrier.

e. Question 5 - Does the issue result in more than minimal decrease in defense-in-depth capability or safety margin? NO The plants design criteria will continue to be met as this change does not revise the number of Operable SITs required by LCOs 3.5.1 and 3.5.2, nor does it change the functional requirements of an Operable SIT. During an entry into Condition B the remaining Operable SITs remain capable of injecting into the RCS (minus one assumed to spill out the break) along with HPSI and LPSI. Appropriate balance among the layers of defense is preserved and the combined layers of defense-in-depth would remain effective. This change preserves sufficient defense against human errors and does not introduce a new common cause failure mode. The yearly increase in CDF and LERF calculated by the RIPE risk evaluation are well below the thresholds for risk significance specified in ML22088A135. This issue would not result in more than minimal decrease in defense-in-depth capability or safety margin.

Enclosure Attachment 3 Description and Assessment of Proposed License Amendment 6

5. Risk Assessment

a. A plant specific risk assessment was conducted:

SITs and their safety functions are in the scope of the PVNGS PRA model o

Quantitative analysis performed for Modes 1 & 2 o

Bounding analysis used to quantify lower Modes (i.e., Modes 3 & 4)

No risk management actions are required to offset the risk

b. The PRA model used reflected the following:

Fully compliant internal events, flooding, fire and seismic PRA models All Other External Hazards listed in RG 1.200, Revision 3, screened out Addressed all NRC license conditions from the 10 CFR 50.69 and RICT License Amendments No open finding level Facts and Observations (F&Os)

No newly developed methods No additional key assumptions or sources of uncertainty PRA model fully compliant with NRC RG 1.200, Revision 3

c. The PRA does not have a low power/shutdown PRA model to assess the change in CDF and LERF.

Per NEI 21-01 Rev 1: Where PRA models are not available, conservative or bounding analyses may be performed to quantify the risk impact (e.g., external events, low power and shutdown).

The following references stipulate that when RCS pressure is at 1000 psi that there is negligible probability of a pipe break and it would be appropriate to reduce the at-power initiating event frequencies for large and small LOCA when quantifying risk impact of extending the AOT.

1. WCAP-16196-P, PRA LPSD Transition Risk Notebook, October 2004

2. WCAP-16560-P, Assessment of Shutdown Risk and Insights for the PWROG, October 2006 Therefore, a bounding conservative analysis associated with extending the AOT will be quantified using the PVNGS at-power PRA model with no adjustments to large or small LOCA initiating events.

d. Risk Results (Prior to IDP comment incorporation)

NEI 21-01 Acceptance Guidelines for risk increase met (delta CDF

<1E-7/yr; delta LERF <1E-8/yr)

NRC RG 1.174 Acceptance Guidelines for cumulative risk are met (CDF <1E-4/yr; LERF <1E-5/yr)

No risk management actions are required to offset the risk Therefore, extending the Completion Time for the proposed SIT LCO is not risk-significant and has a negligible impact on nuclear safety

Enclosure Attachment 3 Description and Assessment of Proposed License Amendment 7

Core Damage Frequency (CDF)

Large Early Release Frequency (LERF)

PVNGS Baseline 6.11x10-5/year 9.65x10-6/year Yearly Increase based on 10-day AOT for Condition B of LCOs 3.5.1 and 3.5.2 (Maintenance frequency = 1.22/year) 1.13x10-8/year 1.17x10-10/year Total CDF and LERF with 10-day AOT for Condition B of LCOs 3.5.1 and 3.5.2 (Maintenance frequency = 1.22/year) 6.11x10-5/year 9.65x10-6/year After the key conclusions of the issue evaluation were presented, IDP discussion continued. Stephenson pointed out the need to consider RMAs, and asked if there would there be any value in considering RMAs for when we exceed the existing 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Bozym clarified that there are no risk management actions specific to the SIT online, so the type of RMAs we would use for other equipment is not applicable in the same way to this condition.

Further IDP discussion led to Miller highlighting that we do not do elective or preventative maintenance on the SITs online. A detailed discussion continued to consider the need for RMAs and to review the definition of an RMA. The existing processes for responding to emergent issues requires Operations to evaluate the impact of ongoing maintenance activities and emergent maintenance, as well as looking at work that has not started yet to determine if it should continue. This includes reviewing the consequences of not performing required work and using protected equipment schemes. Miller used the example of when the plant had issues with one SIT in the past, the other three SITs would be protected as well as any other equipment deemed appropriate. The consensus of the IDP was that no new risk management actions are required because existing Operations and Work Management processes provide adequate controls. There needs to be more discussion in the RIPE package on how RMAs were considered for this issue. This comment was captured on the comment form for resolution.

Kane brought up questions about how the PRA model was quantified, which led to a discussion on truncation values and avoiding masking results. The PRA model failed the flow path associated with the SIT, and for the LOCA modeling it was considered that another SIT was lost so it goes from 3/4 to 2/4 tanks.

The function of providing flow to the RCS is explicitly modeled in the PRA so there was no need to use surrogates in this case. The boron concentration in the SIT is not modeled in the PRA, which is why this RIPE could not be applied to the first case of Condition A. Additional details about the PRA model were discussed for clarification of success criteria.

The RIPE package comment form was then reviewed for further discussion on the technical comments. Siddens brought up additional operating experience for consideration as part of the package and this comment was captured on the comment form. Hall challenged the team to add beneficial safety impacts to the station, this was also captured on the comment form.

Enclosure Attachment 3 Description and Assessment of Proposed License Amendment 8

IV.

ACTION ITEMS 23-10117-009-IDP coordinator to ensure incorporation of IDP comments in the final RIPE package R-24-01, which includes revisions to both 23-10117-005 and 23-10117-006.

V.

IDP VOTE Motion from Ryan Siddens and seconded by Mike Cymbor to approve the final characterization of the issue as having a minimal safety impact pending comment resolution.

Quorum members:

Eric Miller - APPROVE Ryan Siddens - APPROVE Jill Anderson - APPROVE Mike Cymbor - APPROVE Bob Hicks - APPROVE Carl Stephenson-APPROVE VI.

MEETING ADJOURNMENT Matthew Cox provided closing remarks and discussion of next steps. Melissa Cole adjourned the meeting.

Enclosure Attachment 4 Description and Assessment of Proposed License Amendment ATTACHMENT 4:

Proposed Technical Specification Changes (Mark-Up)

Changed Page(s) 3.5.1-1 3.5.2-1

SITs-Operating 3.5.1 PALO VERDE UNITS 1,2,3 3.5.1-1 AMENDMENT NO. 118, 209 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.1 Safety Injection Tanks (SITs) - Operating LCO 3.5.1 Four SITs shall be OPERABLE.

APPLICABILITY:

MODES 1 and 2, MODES 3 and 4 with pressurizer pressure 1837 psia.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A.

One SIT inoperable due to boron concentration not within limits.

OR One SIT inoperable due to inability to verify level or pressure.

A.1 Restore SIT to OPERABLE status.

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months B.

One SIT inoperable for reasons other than Condition A.

B.1 Restore SIT to OPERABLE status.

10 days 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months C.

NOTES-----------

1. Not applicable when the second or a subsequent SIT intentionally made inoperable.

2. The following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

Two or more SITs inoperable for reasons other than Condition A.

C.1 Restore all but one SIT to OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time Program

SITs - Shutdown 3.5.2 PALO VERDE UNITS 1,2,3 3.5.2-1 AMENDMENT NO. 117, 118 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.2 Safety Injection Tanks (SITs) - Shutdown LCO 3.5.2 Four SITs shall be OPERABLE with a borated water volume > 39%

wide range indication and < 83% wide range indication; OR Three SITS shall be OPERABLE with a borated water volume

> 60% wide range indication and < 83% wide range indication.

APPLICABILITY: MODES 3 and 4 with pressurizer pressure < 1837 psia.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A.

One required SIT inoperable due to boron concentration not within limits.

OR One required SIT inoperable due to inability to verify level or pressure.

A.1 Restore required SIT to OPERABLE status.

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months B.

One required SIT inoperable for reasons other than Condition A.

B.1 Restore required SIT to OPERABLE status.

10 days 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months C.

Inoperability of the required SIT was discovered but not restored while in ITS 3.5.1, "SITs Operating" OR Required Action and associated Completion Time of Condition A or B not met.

C.1 Be in MODE 5.

24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months D.

Two or more required SITs inoperable.

D.1 Enter LCO 3.0.3.

Immediately

Enclosure Attachment 5 Description and Assessment of Proposed License Amendment ATTACHMENT 5:

Revised Technical Specification Pages (Re-Typed)

Changed Page(s) 3.5.1-1 3.5.2-1

SITs-Operating 3.5.1 PALO VERDE UNITS 1,2,3 3.5.1-1 AMENDMENT NO. 209, 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.1 Safety Injection Tanks (SITs) - Operating LCO 3.5.1 Four SITs shall be OPERABLE.

APPLICABILITY:

MODES 1 and 2, MODES 3 and 4 with pressurizer pressure 1837 psia.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A.

One SIT inoperable due to boron concentration not within limits.

A.1 Restore SIT to OPERABLE status.

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months B.

One SIT inoperable for reasons other than Condition A.

B.1 Restore SIT to OPERABLE status.

10 days C.

NOTES-----------

1. Not applicable when the second or a subsequent SIT intentionally made inoperable.

2. The following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

Two or more SITs inoperable for reasons other than Condition A.

C.1 Restore all but one SIT to OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time Program

SITs - Shutdown 3.5.2 PALO VERDE UNITS 1,2,3 3.5.2-1 AMENDMENT NO. 118, 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.2 Safety Injection Tanks (SITs) - Shutdown LCO 3.5.2 Four SITs shall be OPERABLE with a borated water volume > 39%

wide range indication and < 83% wide range indication; OR Three SITS shall be OPERABLE with a borated water volume

> 60% wide range indication and < 83% wide range indication.

APPLICABILITY: MODES 3 and 4 with pressurizer pressure < 1837 psia.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A.

One required SIT inoperable due to boron concentration not within limits.

A.1 Restore required SIT to OPERABLE status.

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months B.

One required SIT inoperable for reasons other than Condition A.

B.1 Restore required SIT to OPERABLE status.

10 days C.

Inoperability of the required SIT was discovered but not restored while in ITS 3.5.1, "SITs Operating" OR Required Action and associated Completion Time of Condition A or B not met.

C.1 Be in MODE 5.

24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months D.

Two or more required SITs inoperable.

D.1 Enter LCO 3.0.3.

Immediately

Enclosure Attachment 6 Description and Assessment of Proposed License Amendment ATTACHMENT 6:

Proposed Technical Specification Bases Changes (Mark-Up) - For Information Only Changed Page(s)

B 3.5.1-7 B 3.5.1-8 B 3.5.1-10 B 3.5.2-6 B 3.5.2-7 B 3.5.2-9

SITs - Operating B 3.5.1 BASES (continued)

PALO VERDE UNITS 1,2,3 B 3.5.1-7 REVISION 1 ACTIONS A.1 If the boron concentration of one SIT is not within limits, the SIT must be returned to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . If the boron concentration is not within limits, ability to maintain subcriticality or minimum boron precipitation time may be reduced, but the reduced concentration effects on core subcriticality during reflood are minor. Boiling of the ECCS water in the core during reflood concentrates the boron in the saturated liquid that remains in the core. In addition, the volume of the SIT is still available for injection. Since the boron requirements are based on the average boron concentration of the total volume of three SITs, the consequences are less severe than they would be if a SIT were not available for injection. Thus, 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is allowed to return the boron concentration to within limits.

If one SIT is inoperable due to the inability to verify level or pressure, the SIT must be returned to operable status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . Section 7.4 of NUREG-1366 (Ref. 5) discusses surveillance requirements in technical specifications for the instrument channels used in the measurement of water level and pressure in SITs. The following statement is made in Section 7.4 of NUREG-1366 (Ref. 5):

"The combination of redundant level and pressure instrumentation [for any single SIT] may provide sufficient information so that it may not be worthwhile to always attempt to correct drift associated with one instrument [with resulting radiation exposures during entry into containment]

if there were sufficient time to repair one in the event that a second one became inoperable. Because these instruments do not initiate a safety action, it is reasonable to extend the allowable outage for them. The [NRC] staff, therefore, recommends that an additional condition be established for the specific case, where 'One accumulator [SIT] is inoperable due to the inoperability of water level and pressure channels,' in which the completion time to restore the accumulator to operable status will be 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . While technically inoperable, the accumulator would be available to fulfill its safety function during this time and, thus, this change would have a negligible increase in risk."

SITs - Operating B 3.5.1 BASES (continued)

PALO VERDE UNITS 1,2,3 B 3.5.1-8 REVISION 71 ACTIONS B.1 (continued)

If one SIT is inoperable for a reason other than boron concentration or the inability to verify level or pressure, the SIT must be returned to OPERABLE status within 10 days24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . In this Condition, the required contents of three SITs cannot be assumed to reach the core during a LOCA.

CE NPSD-994 (Ref. 6) provides a series of deterministic and probabilistic findings that support 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months as being either "risk beneficial" or "risk neutral" in comparison to shorter periods for restoring the SIT to OPERABLE status. CE NPSD-994 (Ref. 6) discusses best-estimate analysis for a typical PWR that confirmed that, during large-break LOCA scenarios, core melt can be prevented by either operation of one low pressure safety injection (LPSI) pump or the operation of one high pressure safety injection (HPSI) pump and a single SIT. The Completion Time of 10 days is adequate for most repairs and is based on a combination of deterministic defense-in-depth and safety margin inherent in the plant design and operation, with risk insights from the stations PRA model that determined a Completion Time of 10 days would have a minimal impact on safety (Ref. 9)CE NPSD-994 (Ref. 6) also discusses plant-specific probabilistic analysis that evaluated the risk-impact of the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months recovery period in comparison to shorter recovery periods.

C.1 With two or more SITs inoperable, the Required Action is to restore all but one SIT to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain this safety function. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of sufficient SITs to regain safety function. Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the second or a subsequent SIT is intentionally made inoperable. The Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one SIT is inoperable for any reason and additional SITs are found to be inoperable, or if two or more SITs are found to be inoperable at the same time. Note 2 provides constraints for this condition, the applicable constraints are located in TS section 5.5.20.

SITs-Operating B 3.5.1 BASES PALO VERDE UNITS 1,2,3 B 3.5.1-10 REVISION 71 SURVEILLANCE SR 3.5.1.5 REQUIREMENTS (continued)

Verification that power is removed from each SIT isolation valve operator ensures that an active failure could not result in the undetected closure of a SIT motor operated isolation valve. If this were to occur, only two SITs would be available for injection, given a single failure coincident with a LOCA. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.2.5 allows power to be supplied to the motor operated isolation valves when RCS pressure is < 1500 psia, thus allowing operational flexibility by avoiding unnecessary delays to manipulate the breakers during unit startups or shutdowns. Even with power supplied to the valves, inadvertent closure is prevented by the RCS pressure interlock associated with the valves. Should closure of a valve occur in spite of the interlock, the SI signal provided to the valves would open a closed valve in the event of a LOCA. At RCS pressures above the valve auto-open interlock, the maximum pressure at which the SIAS open signal will open the valves is limited by the valve operator differential pressure design capability.

REFERENCES

1.

IEEE Standard 279-1971.

2.

UFSAR, Section 6.

3.

10 CFR 50.46.

4.

UFSAR, Chapter 15.

5.

Deleted. NUREG-1366, "Improvements to Technical Specifications Surveillance Requirements," December 1992.

6.

CE NPSD-994, "CEOG Joint Applications Report for Safety Injection Tank AOT/STI Extension," May 1995.

7.

UFSAR Section 7.6.2.2.2.

8.

TRM T3.5 (ECCS); TSR 3.5.200.4

9.

License Amendment Request to Revise Technical Specifications 3.5.1 and 3.5.2 using Risk-Informed Process for Evaluations, as submitted to NRC in APS letter no. 102-08736, dated February 29, 2024. Also see TS amendment no. xxx, dated xx/xx/xxxx.

SITs Shutdown B 3.5.2 BASES (continued)

PALO VERDE UNITS 1,2,3 B 3.5.2-6 REVISION 66 ACTIONS A.1 (continued) the ECCS water in the core during reflood concentrates the boron in the saturated liquid that remains in the core. In addition, the volume of the SIT is still available for injection. Since the boron requirements are based on the average boron concentration of the total volume of the required SITs assuming a single failure, the consequences are less severe than they would be if a SIT were not available for injection. Thus, 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is allowed to return the boron concentration to within limits.

If one of the required SITs is inoperable due to the inability to verify level or pressure, the SIT must be returned to operable status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . Section 7.4 of NUREG-1366 (Ref. 4) discusses surveillance requirements in technical specifications for the instrument channels used in the measurement of water level and pressure in SITs. The following statement is made in Section 7.4 of NUREG-1366 (Ref. 4):

"The combination of redundant level and pressure instrumentation [for any single SIT] may provide sufficient information so that it may not be worthwhile to always attempt to correct drift associated with one instrument [with resulting radiation exposures during entry into containment] if there were sufficient time to repair one in the event that a second one became inoperable. Because these instruments do not initiate a safety action, it is reasonable to extend the allowable outage for them. The [NRC] staff, therefore, recommends that an additional condition be established for the specific case, where 'One accumulator [SIT] is inoperable due to the inoperability of water level and pressure channels,' in which the completion time to restore the accumulator to operable status will be 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . While technically inoperable, the accumulator would be available to fulfill its safety function during this time and, thus, this change would have a negligible increase in risk."

B.1 If one SIT is inoperable for a reason other than boron concentration or the inability to verify level or pressure, the SIT must be returned to OPERABLE status within 10 days24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . In this Condition, the required contents of three SITs cannot be assumed to reach the core during a LOCA.

SITs Shutdown B 3.5.2 BASES (continued)

PALO VERDE UNITS 1,2,3 B 3.5.2-7 REVISION 66 ACTIONS B.1 (continued)

CE NPSD-994 (Ref. 5) provides a series of deterministic and probabilistic findings that support 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months as being either "risk beneficial" or "risk neutral" in comparison to shorter periods for restoring the SIT to OPERABLE status. CE NPSD-994 (Ref. 5) discusses best-estimate analysis for a typical PWR that confirmed that, during large-break LOCA scenarios, core melt can be prevented by either operation of one low pressure safety injection (LPSI) pump or the operation of one high pressure safety injection (HPSI) pump and a single SIT. The Completion Time of 10 days is adequate for most repairs and is based on a combination of deterministic defense-in-depth and safety margin inherent in the plant design and operation, with risk insights from the stations PRA model that determined a Completion Time of 10 days would have a minimal impact on safety (Ref. 8).CE NPSD-994 (Ref. 5) also discusses plant-specific probabilistic analysis that evaluated the risk-impact of the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months recovery period in comparison to shorter recovery periods.

C.1 If the inoperability of the required SIT was discovered but not restored while the plant was within the applicability of specification 3.5.1, "SITs - Operating", the plant must be brought to a MODE in which the LCO does not apply. The time allowed for restoration in specification 3.5.1 is adequate and may not be duplicated, for the same condition, when in specification 3.5.2, "SITs - Shutdown".

If the required SIT cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply.

To achieve this status, the plant must be brought to at least MODE 5 within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions in an orderly manner and without challenging plant systems.

D.1 If more than one of the required SITs is inoperable, the unit is in a condition outside the accident analyses. Therefore, LCO 3.0.3 must be entered immediately.

SITs Shutdown B 3.5.2 BASES PALO VERDE UNITS 1,2,3 B 3.5.2-9 REVISION 66 SURVEILLANCE SR 3.5.2.5 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR allows power to be supplied to the motor operated isolation valves when pressurizer pressure is < 1500 psia, thus allowing operational flexibility by avoiding unnecessary delays to manipulate the breakers during unit startups or shutdowns. Even with power supplied to the valves, inadvertent closure is prevented by the RCS pressure interlock associated with the valves. Should closure of a valve occur in spite of the interlock, the SI signal provided to the valves would open a closed valve in the event of a LOCA. At RCS pressures above the valve auto-open interlock, the maximum pressure at which the SIAS open signal will open the valves is limited by the valve operator differential pressure design capability.

REFERENCES

1.

IEEE Standard 279-1971.

2.

10 CFR 50.46.

3.

UFSAR, Chapter 15.

4.

Deleted.NUREG-1366, "Improvements to Technical Specifications Surveillance Requirements," December 1992.

5.

CE NPSD-994, "CEOG Joint Applications Report for Safety Injection Tank AOT/STI Extension," May 1995.

6.

UFSAR Section 7.6.2.2.2

7.

TRM T3.5 (ECCS); TSR 3.5.200.4

8.

License Amendment Request to Revise Technical Specifications 3.5.1 and 3.5.2 using Risk-Informed Process for Evaluations, as submitted to NRC in APS letter no. 102-08736, dated February 29, 2024. Also see TS amendment no. xxx, dated xx/xx/xxxx.

v t e Letter Sequence Request
EPID:L-2024-LLA-0027, TSTF-505, TSTF-425 (Approved, Closed)
Initiation Request, Request Acceptance Administration Questions Answers Results Approval Other:
MONTHYEAR2024-03-08 [Table View]

ML24068A252

Text

Subject:

Enclosure:

Subject:

SUMMARY

2.0 BACKGROUND

4.0 TECHNICAL EVALUATION

5.0 REGULATORY EVALUATION

7.0 REFERENCES

SUMMARY

2.0 BACKGROUND

4.0 TECHNICAL EVALUATION

5.0 REGULATORY EVALUATION

7.0 REFERENCES

Navigation menu

Search