ML25184A390

Shutdown Actions LAR Updated Audit Questions (EPID L-2025-LLA-0011 & L-2024-LLA-0171)

ML25184A390
Person / Time
Site:	Vogtle
Issue date:	07/02/2025
From:	Ed Miller NRC/NRR/DORL/LPL2-1
To:	Lowery K Southern Nuclear Operating Co
References
EPID L-2025-LLA-0011, EPID L-2024-LLA-0171
Download: ML25184A390 (9)

Text

From:

Ed Miller To:

Lowery, Ken G.

Cc:

John Lamb

Subject:

Updated Audit Questions (L-2025-LLA-0011 & L-2024-LLA-0171)

Date:

Wednesday, July 2, 2025 3:27:00 PM Attachments:

Updated Vogtle 3 4 Audit Questions - July 2_2025.docx

Ken, Attached are updated audit questions from those transmitted to you in ML25097A184. The attached questions identify the previous question number that they are replacing or supplementing. We talked about some of the other previous audit questions being closed or likely transitioning to an RAI. We can make a point to review the resolution list at the next audit interaction. These questions dont represent a final NRC position and are intended to foster the upcoming audit discussion. RAIs, if needed, will be communicated via a separate communication at the conclusion of the audit. Please let me know if you need anything additional. Thanks.

ed

Vogtle 3 & 4 Shutdown Actions and Mode Restraints Updated DID and GL 88-17 Audit Questions Regulatory Basis As stated in Section 1.0, Summary Description of the Vogtle 3 & 4 shutdown actions LAR (ML25023A275), the changes to the shutdown technical specifications rely on established procedures to manage shutdown risk that implement 10 CFR 50.65 (the Maintenance Rule) through a shutdown defense-in-depth (DID) model that follows NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management, and NUMARC 93-01, Industry Guidelines for Monitoring the Effectiveness of Maintenance of Nuclear Power Plants. As stated in Section 3.0, Technical Evaluation of the Vogtle 3 & 4 increased flexibility in mode restraints LAR (ML24354A169), risk assessments are conducted using the shutdown Defense-in-Depth model, which is based upon NUMARC 91-06.

Industrys implementation of the NUMARC 91-06 guidance in conjunction with the committed actions taken in response to Generic Letter (GL) 88-17, Loss of Decay Heat Removal, were found to result in significant risk reductions, as documented in the regulatory analysis provided to the Commission in SECY-97-168, Issuance for Public Comment of Proposed Rulemaking for Shutdown and Fuel Storage Pool Operation.

The reduction in risk was found to be significant enough that it precluded the necessity of a proposed rulemaking for shutdown operations, as documented in the Federal Register notice withdrawing the proposed rule, Shutdown and Low-Power Operations for Nuclear Power Reactors, in Federal Register notice 64 FR 5623, issued February 4, 1999. SRM-SECY-97-168, Staff Requirements - SECY-97-168 - Issuance for Public Comment of Proposed Rulemaking for Shutdown and Fuel Storage Pool Operation, states, The Commission expects the staff to continue to monitor licensee performance, through inspections and other means, in the area of shutdown operations to ensure that the current level of safety is maintained.

Although the implementation of NUMARC 91-06 and NUMARC 93-01 are significant to the management of shutdown risk, the guidance found in these documents are not as prescriptive as that found in the current Vogtle 3 & 4 technical specifications (TS) for shutdown operations. The staff reviewed the licensees NUMARC 91-06 implementation procedures and processes as part of the audit to determine if the licensees implementation of maintenance rule during shutdown has the necessary capability to assess conditions and mitigative actions for the LCOs associated with the Vogtle 3 & 4 shutdown actions and mode restraints LARs. NUMARC 91-06 requires the evaluation of defense-in-depth for five key safety functions - (1) decay heat removal, (2) inventory control, (3) power availability, (4) reactivity control, and (5) containment. How these key safety functions are evaluated must be capable of making an assessment that informs any operator action in the absence of prescriptive limiting condition for operations (LCO) actions and mode restraints.

The current Vogtle 3 & 4 technical specifications for shutdown operations provide prescriptive requirements and actions to ensure safe plant operation. In the absence of some of those proposed prescriptive LCO actions and mode restraints, and because GL 88-17 was significant to the proposed rulemaking on shutdown and low power operations, the staff find it necessary to verify that the licensee is adequately implementing the recommendations of the generic letter.

Questions

1. [Revised Audit Question 7] In the Vogtle 3 & 4 design, general design criterion (GDC) 34 is met in modes 5 and 6 by the automated and passive actuation of the gravity-driven core cooling system combined with actuation of the automatic depressurization system (ADS), which is covered by technical specifications. Per LCO 3.5.7, IRWST - Shutdown, MODE 5, and LCO 3.5.8, IRWST - Shutdown, MODE 5, only one injection flow path and one containment recirculation isolation valve need to be operable in modes 5 and 6 for sustained decay heat removal.

a. How is this lack of redundancy considered in the maintenance rule (a)(4) risk evaluations when in modes 5 and 6?

b. It appears to the staff that ADS stage 4 is necessary for gravity injection using the gravity-driven core cooling flow path and the normal residual heat removal system (RNS) gravity injection flow path. Explain how these dependencies do not result in overcounting the licensees defense-in-depth capability, or explain why there are no dependencies between ADS stage 4 and the gravity-driven core cooling and RNS gravity injection flow paths.

c. The chemical and volume control system (CVCS) is credited as one source of defense-in-depth for the key safety function of inventory control. Is CVCS capable of making up for inventory losses from decay heat during the entire outage?

2. [Revised Audit Question 23] There are multiple examples in the Vogtle 3 & 4 shutdown actions LAR where a potential conflict is identified with the LCOs for TS 3.6.7, Containment Penetrations. Numerous LCOs require the opening of a containment air flow path 6 inches, the containment equipment hatch, or the containment airlock while LCO 3.6.7 requires the capability of closing the containment prior to steaming (e.g., loss of decay heat removal that would lead to steaming in containment). The staff need to understand what guidance on opening a containment air flow path 6 inches the operators have during shutdown operations to ensure that there are appropriate restrictions on dominant risk significant configurations and determine if the defense-in-depth assessment can inform any operator action in the absence of a prescriptive LCO action.

a. How does the defense-in-depth assessment performed in accordance with NUMARC 91-06 and B-ADM-OPS-011, Outage Risk Assessment Monitoring, evaluate the need to create an opening of a containment air flow path? As part of the response, discuss any potential impacts to the key safety functions, including containment closure.

b. If the defense-in-depth assessment does not evaluate the need to create an opening of a containment air flow path, identify the procedures or guidance that directs operators or informs them of the need to assess opening a containment air flow path, or justify why the defense-in-depth assessment does not evaluate the need to create an opening of a containment air flow path.

3. [Revised Audit Question 24] There are multiple examples within the Vogtle 3 & 4 shutdown actions LAR where it states that events requiring actuation of ADS stage 1, 2, and 3 or ADS stage 4 do not assume a minimum reactor coolant system (RCS) water level. The staff need to understand what guidance on RCS level and plant configuration the operators have during shutdown operations to ensure that there are appropriate restrictions on dominant risk significant configurations and determine if the defense-in-depth assessment can inform any operator action in the absence of a prescriptive LCO action.

a. How does RCS level impact the defense-in-depth assessment performed in accordance with NUMARC 91-06 and B-ADM-OPS-011? As part of the response, discuss any potential impacts to the key safety functions, including inventory control, containment closure, and decay heat removal.

b. How is a 20% pressurizer water level (or any comparable level) in the pressurizer credited in the defense-in-depth assessment performed in accordance with NUMARC 91-06 and B-ADM-OPS-011? As part of the response, discuss any potential impacts to the key safety functions, including inventory control, containment closure, and decay heat removal.

4. [Revised Audit Question 25] There are multiple examples within the Vogtle 3 & 4 shutdown actions LAR where it states that once the RCS is vented, the complement of safety systems available to respond to an event is reduced.

How are the RCS vented and RCS pressure boundary intact states credited in the defense-in-depth assessment performed in accordance with NUMARC 91-06 and B-ADM-OPS-011? As part of the response, discuss any potential impacts to the key safety functions).

5. [Revised Audit Question 26] There are multiple examples within the Vogtle 3 & 4 shutdown actions LAR where it states that the removal of the upper internals would preclude normal outage progression to proceed to mode 5 with the reactor vessel head on, which also precludes establishing an additional fission product barrier.

Based on audit responses, the staff agree that plant configurations in mode 6 with the upper internals installed should be evaluated as drained conditions, which have the highest risk, since the RCS inventory may not communicate with the volume in the refueling cavity for decay heat removal.

How is the removal of the upper internals credited in the defense-in-depth assessment performed in accordance with NUMARC 91-06 and B-ADM-OPS-011?

As part of the response, discuss any potential impacts to the key safety functions.

6. [Revised Audit Question 27] There are multiple examples within the Vogtle 3 & 4 shutdown actions LAR where mode 6 LCO actions to initiate action to establish water level 23 feet above the top of the reactor vessel flange are eliminated. The staff need to understand what guidance on RCS level and plant configuration the operators have during shutdown operations to ensure that there are appropriate restrictions on dominant risk significant configurations and determine if the defense-in-depth assessment can inform any operator action in the absence of a prescriptive LCO action.

a. How does refueling cavity water level impact the defense-in-depth assessment performed in accordance with NUMARC 91-06 and B-ADM-OPS-011? As part of the response, discuss any potential impacts to the key safety functions including inventory control, containment closure, and decay heat removal.

b. How is a 23-foot level (or any comparable level) in the refueling cavity credited in the defense-in-depth assessment performed in accordance with NUMARC 91-06 and B-ADM-OPS-011? As part of the response, discuss any potential impacts to the key safety functions, including inventory control, containment closure, and decay heat removal.

7. [Revised Audit Question 28] On page E-20 of the Vogtle 3 & 4 shutdown actions LAR, the following statement is made with respect to TS 3.3.9, Function 7, ADS Stage 4 Actuation - Manual Initiation, Actions H & I: Once the RCS is vented (i.e.,

the first portion of Required Action H.2) the remaining requirement to establish 20% pressurizer level is not required to be completed since the Applicability would be exited.

To exit the mode of applicability (mode 5) for this function and action (H.2), operators would need to take the plant to either mode 4 or mode 6. Vented is defined in the

Vogtle 3 & 4 TS as a condition when all required flow paths in ADS stage 1, 2, and 3, or alternative flow path with equivalent area Mode 4 and mode 6, as defined in section 1.1 of the Vogtle 3 & 4 TS, do not require the RCS to be vented.

How does the act of taking the RCS to a vented status affect the requirement to establish a level in the pressurizer?

8. [Revised Audit Question 31] As part of the Vogtle 3 & 4 shutdown actions LAR, an elimination of RCS level requirements has been requested as part of proposed changes to TS 3.6.7, Containment Penetrations. The proposed changes impact TS 3.6.7 required actions B.1.1 and B.1.2, which are only entered if it is found that a containment penetration cannot be closed prior to steaming in containment and the penetrations cannot be restored in one hour (action A.1). The staff need to understand what guidance on RCS level and plant configuration the operators have during shutdown operations to ensure that there are appropriate restrictions on dominant risk significant configurations and determine if the defense-in-depth assessment can inform any operator action in the absence of a prescriptive LCO action.

a. An entry into required actions B.1.1 and B.1.2 of TS 3.6.7 represents a loss of the containment closure safety function, which is a significant loss of defense-in-depth and a loss of a fission product barrier. What guidance and restrictions are there on entering dominant risk significant configurations when there is an inability to maintain containment closure?

b. For a complete loss of the containment closure safety function, how would changes to the time to boil based on changes to RCS level impact the defense-in-depth assessment performed in accordance with NUMARC 9106 and B-ADM-OPS-011?

c. For a complete loss of containment closure safety function, how would changes to the other key safety functions of the defense-in-depth assessment inform any operator decision on plant configuration in the absence of a prescriptive LCO action?

d. If the defense-in-depth assessment does not inform operator action for a complete loss of the containment closure safety function, are there any procedurally-driven processes or actions that would inform any operator decision on plant configuration in the absence of a prescriptive LCO action?

9. [Revised Audit Question 34] GL 88-17 in conjunction with NUMARC 91-06 were found to reduce risk significantly enough that a proposed rule on shutdown and low-power operations for nuclear power reactors was found to be unnecessary. GL 88-17

has numerous recommendations, particularly with respect to operating in a reduced inventory condition. The staff need to understand what guidance on RCS level and plant configuration the operators have during shutdown operations to ensure that there are appropriate restrictions on dominant risk significant configurations and determine if the recommended actions of GL 88-17 are being implemented at Vogtle 3 & 4.

a. Expeditious action 2 in the Recommended Actions attachment to GL 88-17 recommends that plants Implement procedures and administration controls that reasonably assure that containment closure will be achieved prior to the time at which a core uncovery could result These procedures and administrative controls should be active and in use: (a) prior to entering a reduced inventory condition for NSSSs supplied by Combustion Engineering or Westinghouse and should apply whenever operating in those conditions. Regarding closure before steaming inside containment, GL 88-17 also states, "The 200 F temperature identified above provides assurance that containment is closed prior to the existence of such conditions.

If a complete loss of the containment closure safety function were to occur (such as when LCO 3.6.7 is entered), what guidance is provided to operators to implement the above referenced expeditious action 2 from GL 88-17?

b. Expeditious action 6 in the Recommended Actions attachment to GL 88-17 recommends that Prior to operating in a reduced inventory condition provide at least two available or operable means of adding inventory to the RCS that are in addition to pumps that are a part of the normal DHR systems. NUMARC 91-06 guidance states that Prior to entering a reduced inventory condition, equipment requirements that provide or support key safety functions should be verified.

Is the operability or availability of two means of adding inventory to the RCS verified before entering reduced inventory operation? As part of the response describe how ADS stage 4 is verified prior to entering reduced inventory operation or provide a justification if it is not verified.

c. Expeditious action 7 in the Recommended Actions attachment to GL 88-17 recommends that Prior to operating in a reduced inventory condition Implement procedure and administrative controls that reasonably assure that all hot legs are not blocked simultaneously by nozzle dams unless a vent path is provided that is large enough to prevent pressurization of the upper plenum of the reactor vessel.

What procedures and administrative controls does Vogtle 3 & 4 have to implement 88-17 expeditious action 7?

10. [Follow up question to the licensees response to Audit Question 5 on Mode Restraints regarding the qualitative risk assessment consistent with attachments to TSTF-359] The TSTF-359 safety evaluation for the Turkey Point license amendment on mode restraints (ML18018A559) states, [i]n evaluating these submittals, the NRC staff applies the guidance in RG 1.174, Revision 3, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, dated January 2018 and in RG 1.177, Revision 1, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications, dated May 2011. The SER also states, [b]oth the temporary and cumulative risk of the proposed change is adequately limited. The temporary risk is limited by the exclusion of higher-risk systems and components, and completion time limits contained in TS (Section 3.1.1 of this safety evaluation).

In addition, the references to and risk insights from the San Onofre LPSD PRA do not necessarily apply to Vogtle 3 & 4, since San Onofre is not an advanced light-water reactor with a passive ECCS. General Design Criterion 34 was met at San Onofre by safety-related pumps that provided the decay heat removal function. In the AP1000 design, GDC 34 is met using the safety-related gravity-driven core cooling system and ADS.

In this context, the qualitative assessment was reviewed, and the staff has the following questions.

a. In revision 10 of the UFSAR, Section 19.59.3, System Importances for At-Power Core Damage, it states that the protection and safety monitoring system (which actuates the safety-related systems) and the Class 1E DC power system are the most important systems for maintaining the low CDF.

This section also states that the risk-significant systems are the safety-related systems. The initial version of NUREG-1793, Final Safety Evaluation Report Related to Certification of the AP1000 Standard Design, states, The most important systems for core damage prevention, or equivalently, the systems that are the most worthy in achieving the low CDF level assessed in the PRA (i.e., systems with the highest risk achievement worth), are the PMS, the Class 1E dc power, the ADS, IRWST recirculation, IRWST injection, the CMTs, and the accumulators. How have these risk insights been incorporated into evaluation of the proposed LCO 3.0.4.b?

b. In revision 10 of the UFSAR, Section 19.59.5-1, Summary of Shutdown Level 1 Results, states that the major contributors to risk due a loss of RNS during drained conditions are:

• Common-cause failure of the RNS pumps to run

• Common-cause failure of the recirculation line squib valves

• Common-cause failure of the ADS 4th stage squib valves

• Common-cause failure of the IRWST injection squib valves

• Common-cause failure of the strainers in the IRWST Tank (failing the function of the IRWST)

• Common-cause failure of the recirculation sump strainers (failing the function of recirculation)

How have these UFSAR risk insights been incorporated for the evaluation of LCO. 3.0.4.b?