Text

Risk-Informed Inservice Inspection Program - ASME Code Category B-F, B-J, C-F-1 & C-F-2 Piping
	ML032030059
Person / Time
Site:	Farley
Issue date:	07/17/2003
From:	Beasley J; Southern Nuclear Operating Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	NL-03-1259
	Download: ML032030059 (52)
	v • d • e

J. Barnie Beasley, Jr., P.E Southern Nuclear Vice President Operating Company, Inc.

40 Inverness Center Parkway Post Office Box 1295 Birmingham, Alabama 35201 Tel 205.992.7110 Fax 205.992.0341 A

SOUTHERN COMPANY July 17, 2003 Energy to Serve YourWorld"'

Docket Nos.:

50-348 NL-03-1259 50-364 U. S. Nuclear Regulatory Commission ATrN: Document Control Desk Washington, D. C. 20555-0001 Joseph M. Farley Nuclear Plant Risk-Informed Inservice Inspection Program -

ASME Code Category B-F. B-J. C-F-I. and C-F-2 Piping Ladies and Gentlemen:

As required by 10 CFR 50.55a, the Farley Nuclear Plant (FNP) Units 1 and 2 Inservice Inspection (ISI) Program for Class 1, 2, and 3 components is based on the 1989 Edition of Section XI to the ASME Boiler and Pressure Vessel Code. In accordance with 10 CFR 50.55a(a)(3), Southern Nuclear Operating Company (SNC) requests to use the enclosed Risk-Informed Inservice Inspection (RI-ISI) Program as an alternative to the FNP Units 1 and 2 ISI Program requirements for ASME Code Category B-F, B-J, C-F-i, and C-F-2 piping only. The proposed alternative is based on the risk-informed process described in Westinghouse Owners Group (WOG) WCAP-14572, Revision 1-NP-A, "Westinghouse Owners Group Application of Risk-Informed Methods to Piping Inservice Inspection Topical Report," and WCAP-14572, Revision 1-NP-A, Supplement 1, "Westinghouse Structural Reliability and Risk Assessment (SRRA) Model for Piping Risk-Informed Inservice Inspection."

The enclosed RI-ISI Program supports the conclusion that the proposed alternative provides an acceptable level of quality and safety as required by 10 CFR 50.55a(a)(3)(i).

This program also meets the intent and principles of NRC Regulatory Guide 1.174.

Southern Nuclear Operating Company requests NRC approval of the FNP RI-ISI Program by December 31, 2003, in order to support implementation of the Program during the FNP Unit 2 2R16 Maintenance/Refueling Outage currently scheduled to begin in the spring of 2004.

This letter contains no NRC commitments. If you have any questions, please advise.

Sincerely, J. B.

easley, Jr.

JBB/JLS/sdl

Enclosure:

Farley Nuclear Plant Units 1 and 2 Risk-Informed Inservice Inspection (RI-ISI) Program Submittal Using WOG Methodology (WCAP-14572, Revision 1-NP-A) (Revision I Template) cc:

Southern Nuclear Operating Company Mr. J. D. Woodard, Executive Vice President Mr. L. M. Stinson, General Manager - Farley Mr. D. E. Grissette, General Manager - Plant Farley Document Services RTYPE: CFA04.054; LC# 13799 U. S. Nuclear Regulatory Commission Mr. L. A. Reyes, Regional Administrator Mr. F. Rinaldi, NRR Project Manager - Farley Mr. T. P. Johnson, Senior Resident Inspector - Farley

Joseph M. Farley Nuclear Plant Risk-Informed Inservice Inspection Program -

ASME Code Category B-F, B-J, C-F-1, and C-F-2 Piping Enclosure Farley Nuclear Plant Units 1 and 2 Risk-Informed Inservice Inspection (RI-ISI)

Program Submittal Using WOG Methodology (WCAP-14572, Revision 1-NP-A)

(Revision i Template)

FARLEY NUCLEAR PLANT UNITS 1 AND 2 RISK-INFORMED INSERVICE INSPECTION (RI-ISI)

PROGRAM SUBMITTAL Using WOG Methodology (WCAP-14572, Revision 1-NP-A)

(Revision 1 Template)

I

RISK-INFORMED INSERVICE INSPECTION PROGRAM PLAN Table of Contents

1. INTRODUCION/RELATION TO NRC REGULATORY GUIDE 1.174 1.1 Introduction 1.2 PRA Quality

2. PROPOSED ALTERNATIVE TO CURRENT ISI PROGRAM 2.1 ASME Section XI 2.2 Augmented Programs

3. RISK-INFORMED ISI PROCESS 3.1.

Scope of Program 3.2.

Segment Definitions 3.3. Consequence Evaluation 3.4. Failure Assessment 3.5. Risk Evaluation 3.6. Expert Panel Categorization 3.7. Identification of High Safety Significant Segments 3.8. Structural Element and NDE Selection 3.9. Program Relief Requests 3.10. Change in Risk

4. IMPLEMENTATION AND MONITORING PROGRAM

5. PROPOSED ISI PROGRAM PLAN CHANGE

6.

SUMMARY

OF RESULTS AND CONCLUSIONS

7. REFERENCES/DOCUMENTATION APPENDIX A 2

1.

INTRODUCTION/RELATION TO NRC REGULATORY GUIDE 1.174 1.1 Introduction Inservice inspections (ISI) are currently performed on Farley Nuclear Plant (FNP-1 and FNP-2) piping to the requirements of the ASME Boiler and Pressure Vessel Code Section XI, 1989 Edition as required by 10 CFR 50.55a. Both units are currently in the third 10-year inspection interval as defined by the Code for Program B. The start and end dates for the third 10-year inspection interval are:

FNP-1 Start - December 1, 1997 FNP-1 End - November 30, 2007 FNP-2 Start - July 30, 2001 FNP-2 End - July 29, 2011 By letter dated January 9, 1997, SNC requested authorization to update the FNP-2 program 44 months early to coincide with the FNP-1 update. This request was approved by NRC SER dated March 20, 1997.

It is SNC's intention to continue the practice of updating the ISI Programs concurrently for the remainder of the plant life; therefore, the next update for both units will be on December 1, 2007.

The objective of this submittal is to request a change to the ISI program plan for piping through the use of a risk-informed ISI program. The risk-informed process used in this submittal is described in Westinghouse Owners Group WCAP-14572, Revision 1-NP-A, "Westinghouse Owners Group Application of Risk-Informed Methods to Piping Inservice Inspection Topical Report," and WCAP-14572, Revision 1-NP-A, Supplement 1, "Westinghouse Structural Reliability and Risk Assessment (SRRA) Model for Piping Risk-Informed Inservice Inspection," (referred to as "WCAP-14572, A-version" for the remainder of this document).

Assuming approval, it is SNC's intent to implement the proposed risk-informed ISI (RI-ISI) program as follows:

Farley 2 - RI-ISI to be implemented in the Spring 2004 outage, which is the last outage of the first period of the third 10-year inspection interval. Approximately 1/3 Id of the required risk-informed ISI examinations will be performed during this period.

Farley 1 - RI-ISI to be implemented in the Fall 2004 outage, which is the first outage of the third period of the third 10-year inspection interval. Approximately 1/3 'dof the required risk-informed ISI examinations will performed during this period.

The selection of RI-ISI welds will be based on failure mechanisms, industry experience, site specific experience, past inspection history, the presence of Code acceptable indications, and stress considerations.

When establishing the RI-ISI examination schedules, the sequence of component examinations established during the previous intervals will be repeated, to the extent practical.

As a risk-informed application, this submittal meets the intent and principles of Regulatory Guide 1.174.

Further information is provided in Section 3.10 relative to defense-in-depth.

3

1.2 PRA Quality The Plant Farley-specific Level 1 and Level 2 Probabilistic Risk Assessment (PRA) Model, Revision 5, was used to evaluate the impacts on plant risk of pipe ruptures during power operation. This model, when used in conjunction with deterministic evaluations, is of sufficient quality to support regulatory applications such as this submittal, as described below. The associated PRA calculations performed as part of the development of this RI-ISI submittal were originated, verified, approved and documented in accordance with SNC procedures for the preparation and control of calculations.

As an integral part of its initial development pursuant to NRC Generic Letter 88-20, "Individual Plant Examination for Severe Accident Vulnerabilities," the Farley PRA was reviewed by an Independent Review Group which included experts in plant design, plant operation, and probabilistic risk assessment.

Further, each subsequent revision to the model has been internally reviewed and approved in accordance with applicable SNC procedures. In addition, an evaluation based upon Appendix B of the EPRI PSA Applications Guide was performed to confirm that the PRA conforms to the industry state-of-the-art practices with respect to the scope of potential plant scenarios.

In August 2001, the Revision 4 Farley PRA was extensively reviewed by an experienced five-man Peer Review Team coordinated by the Westinghouse Owners Group in a manner described in the Nuclear Energy Institute's document NEI 00-02, "Industry Peer Review Process." The peer review evaluated the eleven elements of the PRA and concluded that all elements were either a "Grade 3" or a "Contingency Grade 3." A "Grade 3" is defined in the Peer Review Process as:

"This grade extends the requirements fofpreviously defined Grades 1 and 2] to assure that the risk significance determinations made by the PRA are adequate to support regulatory applications, when combined with deterministic insights. Therefore, a PRA with elements determined to be at Grade 3 can support physical plant changes when it is used in conjunction with other deterministic approaches that ensure that defense-in-depth is preserved. Grade 3 is acceptable for Grade I and 2 applications, and also for assessing safety significance of equipment and operator actions. This assessment can be used in licensing submittals to the NRC to support positions regarding absolute levels of safety significance if supported by deterministic evaluations."

Nine PRA elements were judged by the peer review to have findings that resulted in their being considered "Contingency Grade 3." A "Contingency Grade 3" reverts to a "Grade 3" when items noted in the evaluation of the element are resolved. Such pending items are classified as one of four degrees of significance. None of the pending items noted in the Plant Farley PRA evaluation were judged to be of a level of significance to require prompt resolution to ensure the technical adequacy of the PRA. Issues with Facts and Observations classified as significance level "B" [Important and necessary to address, but may be deferred until the next PRA update (Contingent Grading Item).] are addressed in Appendix A to this submittal.

The base Core Damage Frequency (CDF) for the Revision 5 PRA model is 3.86E-05/rx-yr for Unit I and 5.81E-05/rx-yr for Unit 2. The base Large Early Release Frequency (LERF) for the Revision 5 PRA model is 4.19E-07/rx-yr for Unit I and 4.26E-07/rx-yr for Unit 2. The difference in risk between the two units is due to a design difference in the Service Water system, which is being addressed by a design change such that the Unit 2 risk should be reduced to near the Unit 1 values. However, the analysis performed for the Risk-Informed ISI program considered each unit separately using the appropriate PRA model.

4

2.

PROPOSED ALTERNATIVE TO CURRENT ISI PROGRAM 2.1 ASME Section XI Examination Categories B-F, B-J, C-F-i and C-F-2 of the ASME Section XI Code currently contain the requirements for examining (via NDE) piping components. This current program is limited to ASME Class I and Class 2 piping with specific size and pressure/temperature exemptions. The alternative risk-informed inservice inspection (RI-ISI) program for piping is described in WCAP-14572, A-version. The RI-ISI program is a substitute for the current examination program on piping in accordance with 10 CFR 50.55a(aX3Xi) by alternatively providing an acceptable level of quality and safety.

In addition, the alternative program is not limited to the current examination scope in ASME Class 1 or Class 2 piping but encompasses all of the Class 1 and Class 2 high safety significant piping segments, regardless of previous Code exemptions. Other non-related portions of the ASME Section XI Code are unaffected. WCAP-14572, A-version, provides the requirements defining the relationship between the risk-informed examination program and the remaining unaffected portions of ASME Section XL 2.2 Augmented Programs Augmented weld inspection programs include weld examinations in the high-energy Main Steam system outside containment. Flow accelerated corrosion examinations for wall-thinning are conducted in Feedwater and Steam Generator Blowdown systems. The implementation of this Class 1 and 2 Risk-Informed ISI program has no effect on these augmented inspection programs.

3.

RISK-INFORMED ISI PROCESS The processes used to develop the Farley RI-ISI program are consistent with the methodology described in WCAP-14572, A-Version, except as discussed below in the "Deviations." The process that is being applied, involves the following steps:

Scope Definition

Segment Definition

Consequence Evaluation

Failure Assessment

Risk Evaluation

Expert Panel Categorization

Element/NDE Selection

Implementation of Program

Feedback Loop Deviations

1. Credit for Leak Detection was used only for the Reactor Coolant System (RCS) as prescribed by WCAP-14572, A-Version, except that 54 additional segments in the Unit 1 Chemical and Volume Control System (CVCS) and 56 additional segments in the Unit 2 CVCS were credited for Leak Detection. A break in any of these CVCS segments is assumed to cause a small break Loss of Coolant Accident (LOCA) inside containment. Therefore, it is appropriate to use RCS leak detection.

5

2. As part of the risk evaluation described in Section 3.5, the uncertainty analysis as described on page 125 of WCAP-14572, A-Version was performed and is now included as part of the base process.

3. For "Elements Subject to Primary Water Stress Corrosion Cracking (PWSCC)," Table 4.1-1 of WCAP-14572, A-version requires a VT-2 examination of the examination volume defined in Footnote 7; however, VT-2 examinations are not volumetric examinations. Therefore, when VT-2 examinations are performed each refueling outage they will be performed per the requirements set forth in Table IWB-2500-1 of the Section XI Code. Additionally, Farley will perform appropriate volumetric or other examinations each inspection interval to detect ID originating PWSCC such as that identified in Information Notice 2000-17.

3.1 Scope of Program FNP Class I and 2 pressure-retaining piping are included in the RI-ISI program. The applicable systems are listed in Table 3.1-1 (FNP-1) and Table 3.1-2 (FNP-2).

3.2 Segment Definitions Once the systems to be included in the program were determined, the piping for these systems was divided into segments based on the following considerations:

1. Change in consequence (piping failures in a given segment have the same consequence).

2. Where the flow splits or joins (e.g., tees, branch connections).

3. The isolation capability for a pipe break (includes check valves, motor-operated valves, and air-operated valves).

4. Pipe size changes (Segments with different diameters were considered as different segments).

The number of pipe segments defined for the systems are summarized in Table 3.1-1 (FNP-1) and Table 3.1-2 (FNP-2). The Piping and Instrumentation Diagrams were used to define the segments.

3.3 Consequence Evaluation The consequences of pressure boundary failures are measured in terms of core damage and large early release. The impact on these measures due to both direct and indirect effects was considered. Table 3.3-1 summarizes the postulated consequences for each system, both the direct and indirect effects.

3A Failure Assessment Failure estimates were generated utilizing industry failure history, plant specific failure history and other relevant information. An engineering team was established that had access to expertise in the following areas: ISL NDE, materials, stress analysis and system engineering. The team was trained in the failure probability assessment methodology and the Westinghouse structural reliability and risk assessment (SRRA) code, including identification of the capabilities and limitations as described in WCAP-14572, A-version. The SRRA code was used to calculate failure probabilities for the failure modes, materials, degradation mechanisms, input variables and uncertainties it was programmed to consider as discussed in the WCAP-14572, A-version. The engineering team assessed industry and plant experience, plant layout, materials, operating conditions and identified the potential failure mechanisms and causes for input into the SRRA model. All the piping configurations included in the RI-ISI program could be adequately modeled using the SRRA code.

6

As a bench-mark, the SRRA code was used for calculating failure probabilities for Intergranular Stress Corrosion Cracking (lGSCC) of BWR plant piping. The results were compared with plant and industry failure data (including recent events) as described in WCAP-14572, A-version, and a range of input values was determined for FNP 1 and 2 based on factors such as material type (e.g., Inconel, 304SS, 304L SS), temperatures, and oxygen content.

Sensitivity studies were performed to aid in determining representative input values when sufficient information was not available. Snubber failure history was also reviewed to identify any potential effects that could increase piping failure probability.

Table 3.4-1 summarizes the failure probability estimates for the dominant potential failure mechanism(s)/combination(s) by system. Table 3.4-1 also describes the dominant failure mechanism and its location(s) within the system.

The failure probabilities used in the risk-informed process are documented and maintained in the plant records.

Selected issues addressed during the failure assessment for Farley are:

Augmented Examinations For Main Steam System augmented weld examinations, the effects of ISI were included in the risk evaluations and were used to assist in categorizing the segments as described on page 105 of WCAP-14572, A-version.

For flow accelerated corrosion (FAC), the EPRI CHECWORKS program along with plant-specific FAC wall-thinning monitoring program data was used as input for the SRRA calculations. Credit was taken for detecting wall thinning and replacing degraded pipe prior to its failure. Where credit was taken for FAC mitigation in the SRRA input, the program output "without isr" was used for change in risk calculations.

All segments in these augmented programs were considered to be High Failure Importance.

Thermal Stratification and CQling Resistance Temperature Detectors (RTDs) were installed on the top and bottom of unisolable RCS branch piping identified in the response to NRC Bulletin 88-08 (i.e., piping believed to be susceptible to thermal stratification and cycling). In general, if a differential temperature between the upper and lower RTDs exceeds a specified value, evaluations are performed to determine the cause of the temperature differential and the potential damage to the piping. For the lines that were identified as being monitored per NRC Bulletin 88-08, thermal stratification and cycling were not modeled into the SRRA program as part of the piping failure probability. Therefore, the SRRA inputs for the monitored lines were not indicative of thermal stratification and cycling and, thus, were not reflected in the calculated risk ranking values. The "Interim Thermal Fatigue Management Guideline (MRP-24)" was used to screen those lines that are not monitored for their potential for cracking. The Expert Panel agreed with this process.

Dissimilar Metal Welds There are a total of 18 dissimilar metal welds per unit. Six reactor pressure vessel (RPV) and six pressurizer nozzle safe-end welds contain Inconel 82 weld metal and have been included in the scope 7

of examinations because of PWSCC issues with Inconel that is in contact with the reactor coolant.

The remaining six dissimilar metal welds consist of Inconel 52 buttered nozzles located on the Steam Generators (SG). This material is considered to be much less susceptible to PWSCC than Inconel 82.

Three of the Inconel 52 SG welds are located on the same hot leg segments as the RPV Inconel 82 welds, and thus were not selected for examination. The three remaining Inconel 52 welds were selected for examination.

3.5 Risk Evaluation Each piping segment within the scope of the program was evaluated to determine the Core Damage Frequency (CDF) and Large Early Release Frequency (LERF), resulting from the postulated piping failure. Calculations were performed considering cases with and without operator action.

Once this evaluation was completed, the total pressure boundary CDF and LERF were calculated by summing across the segments for each system.

The results of these calculations are presented in Table 3.5-1 for FNP-1. The CDF due to piping failure without operator action is 6.5ME-06/year, and with operator action is 3.71E-06/year. The total LERF due to piping failure without operator action is 8.92E-09/year, and with operator action is 3.74E-09/year.

The results of these calculations are presented in Table 3.5-2 for FNP-2. The total core damage frequency due to piping failure without operator action is 3.60E-05/year, and with operator action is 4.47E-06/year.

The total large early release frequency due to piping failure without operator action is 3.14E-08/year, and with operator action is 4.24E-09/year.

The uncertainty analysis, as described on WCAP-14572, A-version, page 125, was performed and is now included as part of the base process.

To assess safety significance, the Risk Reduction Worth (RRW) and Risk Achievement Worth (RAW) were calculated for each piping segment.

3.6 Expert Panel Categorization The final safety determination (i.e., high and low safety significance) of each piping segment was made by the Expert Panel using both probabilistic and deterministic insights. The Expert Panel was comprised of five members with expertise in the following fields:

1. Probabilistic safety assessment

2. Plant operations

3. Plant and industry maintenance

4. Repair and failure history

5. System operation A minimum of 4 members filling the above positions constituted a quorum. This core team was supplemented, as necessary, by other experts. Available supplemental expertise included system engineers, stress engineers, inservice inspection engineers, nondestructive examination personnel, Probabilistic Risk Assessment personnel, and personnel knowledgeable of SRRA methods (including uncertainty).

8

An Expert Panel chairperson, who conducted and ruled on the proceedings of the meeting, was appointed by the Farley Engineering Support Manager.

Members received training and indoctrination in the risk-informed inservice inspection selection process.

They were indoctrinated in the application of risk analysis techniques for ISL These techniques included risk importance measures, threshold values, failure probability models, failure mode assessments, PRA modeling limitations and the use of expert judgment. Training documentation is maintained with the Expert Panel's records.

The chairperson appointed a secretary to record the minutes of each meeting. The minutes included the names of members and alternates in attendance and whether a quorum was present. The minutes contained relevant discussion summaries and the results of membership voting. These minutes are available as program records.

Worksheets were provided to the panel on each system for each piping segment, containing information pertinent to the panel's selection process. This information, in conjunction with each panel member's own expertise and other documents as appropriate, were used to determine the safety significance of each piping segment. A consensus process was used by the Expert Panel. Consensus was defined as a majority of the Expert Panel members concurring with the decision.

During the evaluation all segments with a Risk Reduction Worth (RRW) value greater than 1.005 were determined to be High Safety Significant (HSS) by the Expert Panel. Additionally, the Expert Panel elevated 25 Unit I segments and 43 Unit 2 segments with RRWs less than 1.005 to HSS after evaluation of the consequences. (See Tables 3.7-1 and 3.7-2) 3.7 Identification of High Safety Significant Segments The number of high safety significant segments for each system, as determined by the Expert Panel, are shown in Table 3.7-1 (FNP-1) and Table 3.7-2 (FNP-2) along with a summary of the risk evaluation identification of high safety significant segments.

3.8 Structural Element and NDE Selection Structural Elements The structural elements in the high safety significant piping segments were selected for inspection and appropriate non-destructive examination (NDE) methods were defined.

The program addresses the high safety significant (HSS) piping components placed in Regions 1 and 2 of Figure 3.7-1 in WCAP-14572, A-Version. Segments considered as "high failure importance" (Region I) were those segments affected by an active failure mechanism or analyzed to be highly susceptible to a failure mechanism (probability of large leak at 40 years exceeds lE-04). Region 3 and 4 piping components, which are low safety significant, are to be considered in an Owner Defined Program and are not considered part of the program requiring approval. Region 1, 2, 3 and 4 piping components will continue to receive Code required pressure testing, as part of the current ASME Section XI program.

For FNP-l, 1103 piping segments were evaluated in the RI-ISI program. Region I contains 10 segments, Region 2 contains 86 segments, Region 3 contains 45 segments, and Region 4 contains 962 segments (including two delta risk segments treated in the same manner as the HSS segments).

9

The number of locations to be inspected in an HSS segment (Regions 1 and 2) was determined using the Westinghouse statistical (Perdue) model as described in Section 3.7 of WCAP-14572, A-version, as discussed below.

Six Main Steam segments are High Energy Line Break augmented lines and are completely in Region IA, which is outside the applicability of the Perdue model. For these segments, the guidance in Section 3.7.3 of WCAP-14572, A-version was followed. Three Feedwater segments are in the flow accelerated corrosion (FAC) program, with the Region lA wall thickness examinations covered by the existing FAC program. The welds in these Feedwater segments are in Region lB and were evaluated using the Perdue model. One RCS segment (pressurizer surge line) has one weld in Region IA (Inconel safe end) with the remaining welds in Region 1B. The welds in Region lB were evaluated using the Perdue model.

Twenty-two Region 2 segments consist only of socket welds, which is outside of the applicability of the Perdue model. Three segments consisted of multiple socket welds and one butt weld on each segment.

The socket welds are outside of the applicability of the Perdue model and with only one butt weld in the segment the Perdue model was not run (the butt weld was selected for examination). Sixty-one Region 2 segments and two Region 4 delta risk segments were evaluated using the Perdue model.

For Farley Unit 2, 1120 piping segments were evaluated in the RI-ISI program. Region 1 contains 15 segments, Region 2 contains 83 segments, Region 3 contains 45 segments, and Region 4 contains 977 segments.

The number of locations to be inspected in an HSS segment (Regions 1 and 2) was determined using the Westinghouse statistical (Perdue) model as described in Section 3.7 of WCAP-14572, A-version, as shown below.

Six Main Steam segments are High Energy Line Break augmented lines, whose welds are completely in Region IA, which is outside the applicability of the Perdue model. For these segments, the guidance in Section 3.7.3 of WCAP-14572, A-version was followed. Five additional Main Steam segments have a potentially active degradation mechanism (high vibration) with resulting Large Leak Failure Probabilities greater than E-03. These welds are completely in Region IA, which is outside the applicability of the Perdue model. Three Feedwater segments are in the flow accelerated corrosion (FAC) program, with the Region IA wall thickness examinations covered by the existing FAC program. The welds in these Feedwater segments are in Region lB and were evaluated using the Perdue model. One RCS segment (pressurizer surge line) has one weld in Region IA (Inconel safe end) with the remaining welds in Region 1B. The welds in Region lB were evaluated using the Perdue model.

Twenty-two Region 2 segments consists only of socket welds, which is outside of the applicability of the Perdue model. Three segments consisted of multiple socket welds and one butt weld on each segment.

The socket welds are outside of the applicability of the Perdue model and with only one butt weld in the segment the Perdue model was not run (the butt weld was selected for examination). Fifty-eight Region 2 segments were evaluated using the Perdue model.

10

Weld Selection After completion of the Perdue model evaluations, welds were selected as follows:

Region IA Segments All welds were selected for examination.

Region lB Segments A minimum of one weld was selected for examination.

Region 2 Segments A minimum of one weld was selected for examination.

The selection of a specific weld in a segment was based on failure mechanisms, industry experience, site specific experience, past inspection history, the presence of Code acceptable indications, and stress considerations. For those welds currently examined in the Section XI program that are also in the RI-ISI program, the sequence of examinations previously established in the Section XI program shall be repeated to the extent practical.

Examinations Table 4.1-1 of the WCAP-14572, A-Version, provides guidance for examination volumes (or areas), NDE methods, acceptance criteria, and examination scheduling for piping elements within the scope of the Rl-ISI Program. The Table is based on format and criteria contained in ASME Section XI, IWB-, IWC-, and IWD-2500. Except as identified below, all requirements, as shown in Table 4.1-1, will be implemented for all piping within the scope of the RI-ISI program at Farley, unless specific written relief has been written and approved by the NRC. The exception is the requirements for "Elements Subject to Primary Water Stress Corrosion Cracking (PWSCC)." Table 4.1-1 currently requires a VT-2 examination of an examination volume defined in Footnote 7; however, VT-2 examinations are not volumetric examinations. Therefore, when VT-2 examinations are performed each refueling outage they will be performed per the requirements set forth in Table IWB-2500-1 of the Section XI Code. Additionally, Farley will perform volumetric or other appropriate examinations each inspection interval to detect ID originating PWSCC such as that identified in Information Notice 2000-17.

All ultrasonic examinations applied to piping welds within the RI-MSI program (with the exception of wall thickness mapping), will be performed per the Appendix VIII requirements and schedules specified in 10 CFR 50.55a regulations, except where proposed alternatives or exemptions have been approved by the NRC, such as the use of the EPRI Performance Demonstration Initiative.

An attempt will be made to provide a minimum of >90% coverage (per Code Case N460) when performing the risk-informed examinations. When welds have limited accessibility, "Requests for Relief" from ASME Code coverage requirements will be processed as per 10 CFR 50.55a.

The 1989 Edition of ASME Section XI requires that, "The sequence of component examinations established during the first inspection interval shall be repeated during each successive interval, to the extent practical." Farley will continue to meet this requirement, when establishing the RI-MSI examination schedules. Additionally, the selection of welds will be based on failure mechanisms, industry experience, site specific experience, past inspection history, the presence of Code acceptable indications, and stress considerations.

11

Additional Examinations (Scope Expansion)

The program, in all cases, will determine through an engineering evaluation the root cause of any unacceptable flaw or relevant condition found during RI-ISI examinations. The evaluation will include the applicable service conditions and degradation mechanisms to establish that the element(s) will still perform its intended safety function during subsequent operation. Elements not meeting this requirement will be repaired or replaced.

The evaluation will determine whether there are other elements on the same segment or whether there are elements in additional segments subject to the same root cause and degradation mechanism. If so, then additional examinations will be performed on these elements up to a number equivalent to the number of elements initially required to be inspected during the outage on the segment or segments. If unacceptable flaws or relevant conditions are again found similar to the initial problem, the remaining elements identified as susceptible will be examined. These additional examinations will be performed during the outage that the flaws or relevant conditions were identified. No additional examinations will be performed if there are no additional elements identified as being susceptible to the same service related root cause conditions or degradation mechanism.

3.9 Program Relief Requests The following relief requests associated with Class 1 and 2 piping examinations will remain in effect for Rl-ISI examinations:

RR Calibration Blocks RR-Il - Reference System for All Welds and Areas Subject Volumetric and Surface Examination RR Volumetric Examination of Class 1 and Class 2 Pressure-Retaining Piping Welds RR Steam Generator Nozzle To Safe-End Welds RR Volumetric Examination of Class 1 Pressure-Retaining Piping Welds 3.10 Change In Risk The RI-ISI program for FNP-l and FNP-2 has been developed in accordance with NRC Regulatory Guide 1.174, and the risk incurred from implementation of this program is slightly less than the estimated risk from current requirements.

The change-in-risk calculations were performed in accordance with the guidelines provided on page 213 of WCAP-14572, A-version. A comparison between the proposed RI-ISI program and the current ASME Section XI ISI program was made to evaluate the change in risk. The approach evaluated the change in risk with the inclusion of the probability of detection as determined by the SRRA model. Adjustments were made to add segments until all four criteria for accepting the results discussed on page 214 and 215 in WCAP-14572, A-version were met. This evaluation resulted in the addition of examinations for two piping segments for FNP-l (systems identified in Table 5-la). No additional examinations were required for FNP-2.

The results from the risk comparison are shown in Table 3.10-1 for FNP-l and 3.10-2 for FNP-2. As seen from the tables, the R1-ISI program reduces the risk associated with piping CDF/LERF slightly more 12

than the current ASME Section XI ISI program while reducing the number of examinations. Tables 3.10-1 and 3.10-2 also include the systems that are the main contributors to the risk reduction in moving from the current program to the RI-ISI program. The primary basis for this risk reduction is that examinations will be performed on high safety significant piping segments that are not currently examined in the current ASME Section XI ISI program.

Defense-In-Depth Per Regulatory Guide 1.174, the engineering analysis should evaluate whether the impact of the proposed change to the ISI program is consistent with defense-in-depth principals. An important element of defense-in-depth for RI-ISI is maintaining the reliability of the Reactor Coolant system as an independent barrier to fission product release. As shown in Tables 5-la and Table 5-lb, 48 RCS segments on each unit (including all large diameter segments) have been identified as HSS. RI-ISI examinations on these HSS segments, plus the system pressure test and visual VT-2 examination currently required by the Code satisfies defense-in-depth considerations.

4.

IMPLEMENTATION AND MONITORING PROGRAM Upon approval of the RI-ISI program, procedures that comply with the guidelines described in WCAP-14572, A-version, will be prepared to implement and monitor the program. The new program will be integrated into the existing ASME Section XI interval.

The applicable aspects of the Code not affected by this change would be retained, such as inspection methods, acceptance guidelines, pressure testing, corrective measures, documentation requirements, and quality control requirements. Existing ASME Section XI program implementing procedures would be retained and would be modified to address the RI-ISI process, as appropriate.

The proposed monitoring and corrective action program will contain the following elements:

A. Identify B. Characterize (1) Evaluate, determine the cause and extent of the condition identified (2) Evaluate, develop a corrective action plan or plans C. Decide D. Implement E. Monitor F. Trend The RI-ISI program is a living program requiring feedback of new relevant information to ensure the appropriate identification of high safety significant piping locations. As a minimum, risk ranking of piping segments will be reviewed and adjusted on an ASME period basis. Significant changes may require more frequent adjustment as directed by NRC bulletin or Generic Letter requirements, or by plant specific feedback.

13

5.

PROPOSED ISI PROGRAM PLAN CHANGE A comparison between the RI-ISI program and the current ASME Section XI program requirements for piping is given in Table 5-la (FNP-1) and Table 5-lb (FNP-2). An identification of piping segments that are part of plant augmented programs is also included in Table 5-la and Table 5-lb.

For the RI-ISI Program, the plant will be performing volumetric examinations on elements not currently required to be volumetrically examined by ASME Section XI. Some examples are provided below.

The ASME Section XI Code does not require volumetric examination of Class I piping greater than or equal to 2-inches nominal pipe size (NPS) but less than or equal to 4-inches NPS (Code Item B9.21). The RI-ISI program will require volumetric examination of these welds. An example where the risk-informed process requires volumetric examination and the Code does not is the 4-inch pressurizer spray line.

The ASME Section XI Code does not require volumetric or surface examination of Class 2 piping 4-inch NPS or less (non-HHSI). The RI-ISI program will require examination of these welds. An example where the risk-informed process requires examination and the Code does not is the 3-inch non-isolable FNP-2 Main Steam lines outside of containment.

The ASME Section XI Code does not require volumetric and surface examinations of piping less than 3/8-inch wall thickness on Class 2 piping greater than 4-inches NPS. The welds are counted for percentage requirements but are not examined by NDE. The RI-ISI program will require examination of these welds. Examples are the 8-inch and 10-inch RHR pump discharges.

6.

SUMMARY

OF RESULTS AND CONCLUSIONS A partial scope (all Class 1 and 2 piping) risk-informed ISI application has been completed for FNP I and

2. Upon review of the proposed risk-informed ISI examination program given in Table 5-la and Table 5-lb, an appropriate number of examinations are proposed for the high safety significant segments across the Class 1 and Class 2 portions of the plant piping systems. Resources to perform examinations currently required by ASME Section XI in the Class 1 or Class 1 and Class 2 portions of the plant piping systems, though reduced, are distributed to address the greatest amount of risk within the scope. Thus, the change in risk principle of Regulatory Guide 1.174 is maintained. Additionally, the examinations performed will address specific damage mechanisms postulated for the selected locations through appropriate examination selection and increased volume of examination.

Farley has performed activities to reduce the potential for cracking in Class 1 and 2 systems, such as:

The Steam Generators and portions of attached piping were replaced. The design of the new generators reduces the potential for a steam generator tube rupture and reduces the potential for cracking in the Feedwater inlet piping.

Monitoring is performed to detect thermal stratification in unisolable RCS branch lines considered susceptible to high-cycle thermal fatigue cracking.

A fatigue monitoring system has been installed to provide accurate thermal cycling and fatigue information.

From a risk perspective, the PRA dominant accident sequences include Loss of the On-Service Train of Component Cooling Water, Loss of the On-Service Train of Service Water, Loss of Offsite Power, and Loss of Coolant Accidents.

14

For the RI-ISI program, appropriate sensitivity and uncertainty evaluations have been performed to address variations in piping failure probabilities and PRA consequence values along with consideration of deterministic insights to assure that all high safety significant piping segments have been identified.

As a risk-informed application, this submittal meets the intent and principles of NRC Regulatory Guide 1.174.

7.

REFERENCES/DOCUMENTATION General WCAP-14572, Revision 1-NP-A, "Westinghouse Owners Group Application of Risk-Informed Methods to Piping Inservice Inspection Topical Report," February 1999.

WCAP-14572, Revision 1-NP-A, Supplement 1, 'Westinghouse Structural Reliability and Risk Assessment (SRRA) Model for Piping Risk-Informed Inservice inspection," February 1999.

Scope Definition

a. Calculation Note ITS-F-01-1-RI, Revision 0, Farley Unit 1 and 2 Risk-Informed ISI Program Scope, June 2002.

Segment Defnition

a. Technical Services Calculation REES-F-01-007, RI-ISI Segment Definition/Direct Consequence Definition For Farley Units 1&2, Auxiliary Feedwater System, November 6, 2001.

b. Technical Services Calculation REES-F-1 -008, RI-ISI Segment Definition/Direct Consequence Definition For Farley Units 1&2, Chemical and Volume Control System, October 30,2001.

c. Technical Services Calculation REES-F-01-009, RI-ISI Segment Definition/Direct Consequence Definition For Farley Units l&2, Chemical Injection System, October 25,2001.

d. Technical Services Calculation REES-F-01-010, RI-ISI Segment Definition/Direct Consequence Definition For Farley Units 1&2, Condensate and Feedwater System, November 6, 2001.

e. Technical Services Calculation REES-F-01-011, RI-ISI Segment Definition/Direct Consequence Definition For Farley Units 1&2, Containment Isolation System, October 30, 2001.

f.

Technical Services Calculation REES-F-O1-012, RI-ISI Segment Definition/Direct Consequence Definition For Farley Units 1&2, Containment Spray System, October 25, 2001.

g. Technical Services Calculation REES-F-01-013, RI-ISI Segment Definition/Direct Consequence Definition For Farley Units 1 &2, Main Steam System, November 6, 2001.

h. Technical Services Calculation REES-F-01 -014, RI-ISI Segment Definition/Direct Consequence Definition For Farley Units 1&2, Reactor Coolant System, November 12, 2001.

15

i. Technical Services Calculation REES-F-01-015, RI-ISI Segment Definition/Direct Consequence Definition For Farley Units 1 &2, Residual Heat Removal System, November 12, 2001.

j. Technical Services Calculation REES-F-01-016, RI-ISI Segment Definition/Direct Consequence Definition For Farley Units 1&2, Safety Injection System, October 30, 2001.

k. Technical Services Calculation REES-F-01-017, RI-ISI Segment Definition/Direct Consequence Definition For Farley Units 1&2, Sampling System, October 30, 2001.

1. Technical Services Calculation REES-F-01-01 8, RI-ISI Segment Definition/Direct Consequence Definition For Farley Units 1&2, Steam Generator Blowdown System, December 13, 2001.

m. SNC Calculation Note REES-F-02-002 Revision 3, Farley Risk-Informed ISI Expert Panel Data, April 16,2003.

Indirect Effects

a. SNC Calculation Note REES-F-02-002 Revision 3, Farley Risk-Informed ISI Expert Panel Data, April 16, 2003.

b. SNC Calculation Note ITS-F-01-12-RI, Revision 0, Farley Indirect Effects, June 21,2002.

PRA Analyses

a. SNC Calculation Note REES-F-02-002 Revision 3, Farley Risk-Informed ISI Expert Panel Data, April 16, 2003.

Risk Ranking

a. Technical Services Calculatioi REES-02-010, Revision 0, Farley Risk-Informed ISI Risk Ranking, June 2, 2003.

Change in Risk

a. Technical Services Calculation REES-02-01 1, Revision 0, Farley Risk-Informed ISI Delta Risk Evaluation, June 2, 2003.

Perdue Model

a. SRRA Calculation Note TTS-F-03-23-RI, Revision 0, Farley Unit 1 Risk-Inforned ISI Perdue Model Evaluation, May 29, 2003.

16

SRRA Piping Failure Calculations

a. SRRA Calculation Note ITS-F-01-8-RI Revision 1, Farlcy Unit 1 and 2 Containment Spray System, September 12,2002.

b. SRRA Calculation Note ITS-F-0I-9-RI, Revision 2, Farley Unit 1 and 2 Safety Injection System, May 16,2003.

c. SRRACalculationNoterTS-F-01-10-RI,Revision l,FarleyUnit 1 and2AuxiliaryFeedwater System, September 12,2002.

d. SRRA Calculation Note rTS-F-01-11-RI Revision 3, Farley Unit 1 and 2 Residual Heat Removal System, May 22, 2003.

e. SRRA Calculation Note rTS-F-01-13-RI Revision 2, Farley Unit 1 and 2 Reactor Coolant System, May 15, 2003.

f.

SRRA Calculation Note 1TS-F-01-14-RJ Revision 1, Farley Unit 1 and 2 Feedwater System, September 12, 2002.

g. SRRA Calculation Note ITS-F-01-15-RI, Revision 2, Farley Unit 1 and 2 Main Steam System, May 16, 2003.

h. SRRA Calculation Note lTS-F-01 RI, Revision 1, Farley Unit 1 and 2 Steam Generator Blowdown System, September 12,2002.

i.

SRRA Calculation Note lTS-F-01 RI Revision 0, Farley Unit 1 and 2 Sampling System, June 21, 2002.

j.

SRRA Calculation Note ITS-F-OI-1 8-RI, Revision 2, Farley Unit I and 2 Containment Penetrations, May 16, 2003.

k. SRRA Calculation Note rTS-F-0I-1 9-RI, Revision 1, Farley Unit 1 and 2 CVCS System, September 12,2002.

1. SRRA Calculation Note lTS-F-01-20-RI Revision 0, Farley Unit 1 and 2 Chemical Injection System, June 21, 2002.

17

Table 3.1-1 System Selection and Segment Definition for FENP-1 Class 1 and 2 Piping

System Description

PRA Section XI Number of Segments Auxiliary Feedwater (AFW)

Yes Yes 15 Chemical Injection (CHI)

No No 6

Containment Isolation (Cl)

Yes No 153 Containment Spray (CS)

Yes Yes 54 Chemical and Volume Control (CV)

Yes Yes 333 Feedwater (FW)

Yes Yes 18 Main Steam (MS)

Yes Yes 57 Reactor Coolant (RC)

Yes Yes 202 Residual Heat Removal (RH)

Yes Yes 83 Steam Gen Blowdown (SGB)

Yes No 27 Safety Injection (SI)

Yes Yes 128 Sampling System (SS)

No No 27 Total 1103 18

Table 3.1-2 System Selection and Segment Definition for FNP-2 Class 1 and 2 Piping

System Description

PRA Section XI Number of Segments Auxiliary Feedwater (AFW)

Yes Yes 15 Chemical Injection (CHI)

No No 6

Containment Isolation (Cl)

Yes No 161 Containment Spray (CS)

Yes Yes 55 Chemical and Volume Control (CV)

Yes Yes 321 Feedwater (FW)

Yes Yes 18 Main Steam (MS)

Yes Yes 60 Reactor Coolant (RC)

Yes Yes 215 Residual Heat Removal (RH)

Yes Yes 78 Steam Gen Blowdown (SGB)

Yes No 33 Safety Injection (SI)

Yes Yes 131 Sampling System (SS)

No No 27 Total 1120 19

Table 3.3-1 Summary of Postulated Consequences by System for FNP-1 and FNP-2 Piping

System Description

Summary of Consequences AFW - Auxiliary Feedwater Segment failure leads to a reactor trip or Secondary-Side line break initiating events. Mitigating system impacts include loss of AFW pump, Main Feedwater (MFW) pump, Condensate Pump and containment isolation functions. Several segment failures increase the likelihood of containment bypass given a Steam Generator Tube Rupture (SGTR).

SGB - Steam Generator Several segment failures lead to a reactor trip or Secondary-Side Blowdown line break inside containment initiating events. Mitigating system impacts include the following losses: steam supply to Turbine Driven Auxiliary Feedwater (TDAFW) pump, AFW flow to Steam Generators and MFW/Condensate flow to Steam Generators.

CI - Containment Isolation The mitigating system impact of pipe breaks in some segments is the loss of containment isolation, loss of Component Cooling Water (CCW) flow, loss of Service Water (SW) flow, loss of Instrument Air, or loss of back-up air for the Pressurizer Power Operated Relief Valves (PORVs). The CCW system provides cooling to the Reactor Coolant pump thermal barrier and to the Centrifugal Charging pumps (CCPs). Loss of Instrument Air isolates CCW flow from the RCP thermal barriers and prevents the re-establishment of feedwater and/or condensate flow to the steam generators. The SW system provides cooling water to the containment fan coolers, Emergency Core Cooling pump room coolers, the Diesel Generatorjacket water coolers, and the CCW heat exchangers. Failures of some pipe segments cause an increase in the likelihood of a special initiating event (e.g., loss of one CCW train, loss of one Service Water (SW) train, or loss of Instrument Air that also leads to mitigating system losses).

CS - Containment Spray Mitigating system impacts include the following: loss of CS train A or B injection, loss of sump inventory, loss of Reactor Water Storage Tank (RWST) inventory and an increased likelihood of the failure of containment isolation.

CV -Chemical & Volume Many segment failures lead to a reactor trip, small LOCA or Control medium LOCA initiating events. Mitigating system impacts include loss of one or more centrifugal charging pumps (CCPs),

the RWST, seal injection to one or all loops, sump inventory, emergency boration, normal charging, and the Volume Control Tank (VCI).

20

Table 3.3-1 Summary of Postulated Consequences by System for FNP-1 and FNP-2 Piping

System Description

Summary of Consequences FW - Feedwater Several segment failures lead to a reactor trip or Secondary-Side line break initiating events. Mitigating system impacts include loss of steam supply to TDAFW pump, AFW flow to Steam Generators, MFW and Condensate flow to Steam Generators.

Several segment failures increase the likelihood of containment bypass given a SGTR event; several segment failures result in an immediate bypass given a SGTR event.

MS - Main Steam Several segment failures lead to a reactor trip or Secondary-Side line break inside containment initiating events. Mitigating system impacts include loss of steam supply to TDAFW pump, AFW flow to Steam Generators, MFW and Condensate flow to Steam Generators and failure of Main Steam Isolation Valves (MSIVs) to isolate. Several segment failures increase the likelihood of containment bypass given a SGTR event; several segment failures result in an immediate bypass given a SGTR event.

SS - Sampling System This system is not modeled in the FNP PRA. Within the segments identified as part of the Sampling System, there were no mitigating system or initiating event impacts.

RC - Reactor Coolant Many segment failures lead to a large, medium or small LOCA, or a reactor trip initiating event. Mitigating system impacts include the following: loss of high/low pressure injection/recirculation to a hot/cold leg (CCPs; RHR),

accumulator injection, normal Residual Heat Removal (RHR),

letdown, pressurizer spray, or normal charging.

RH - Residual Heat Removal Mitigating system impacts include loss of RHR functions, sump inventory, and RWST inventory. There are multiple indirect effect scenarios due to jet impingement, spray, pipe whip, and flooding. The interactions are with various cable trays, CS system, CV system and the SI system.

SI - Safety Injection Several segment failures lead to a reactor trip. Mitigating system impacts include the following: loss of high/low pressure injection/recirculation to a hot/cold leg (CCPs; RHR),

accumulator injection, normal Residual Heat Removal (RHR),

sump inventory, RWST, and containment isolation functions.

OII - Chemical Injection This system is not modeled in the FNP PRA. Within the segments identified as part of the Sampling System, there were no mitigating system or initiating event impacts.

21

Table 3.4-1 Failure Probability Ranges (without ISI) for FNP-1 and FNP-2 Piping System Dominant Potential Failure Probability Range at 40 years with no ISI Comments Degradation Mechanism(s)/

Ce mbidation eh sn(s)/

Small leak Disabling leak (by disabling Combination(s)

Smnll leak leak rate)*

AFW Thermal Fatigue 7.51E 1.91E-07 5.87E-1 1 - 3.73E-08 CI Thermal Fatigue 3.07E 8.43E-06 2.05E 7.91E-08 Miscellaneous Containment Penetrations.

Highest failure probability is in Service Erosion/Corrosion & Thermal 3.87E 3.65E-05 8.99E 4.06E-06 Water penetrations due to potential for Fatigue microbiologically induced corrosion.

CIE NA NA NA Chemical Injection System has no consequence of failure.

CS Thermal Fatigue 1.38E 5.49E-06 1.12E 5.48E-08 This is a standby system at ambient room temperature with Reactor Water Storage Thermal and Vibratory Fatigue 6.35E 9.45E-06 4.58E 1.45E-06 Tank chemistry. Below SCC threshold temperature with the FNP water chemistry.

Only thermal cycling (very limited) and vibration occurs during quarterly pump testing.

CV Thermal Fatigue 1.96E 3.42E-05 SLOCA 9.09E 1.IOE-05 Class 1 CVCS within the Reactor Coolant MLOCA 1.07E 5.61E-06 Pressure Boundary is in RC.

SYS 9.13E 2.07E-05 Thermal and Vibratory Fatigue 1.32E 8.56E-02 SLOCA 1.56E L.27E-05 MLOCA 3.76E 7.OOE-07 SYS 3.34E 5.26E-02 FW Erosion/Corrosion & Thermal 8.09E 8.09E-08 3.60E 7.17E-10 Thermal stratification near the Steam Fatigue Generators eliminated due to the design of Thermal Fatigue 4.63E 1.1 lE-04 3.48E 1.3 1E-06 the replacement Steam Generators.

22

Table 3.4-1 Failure Probability Ranges (without ISI) for FNP-1 and FNP-2 Piping System Dominant Potential Failure Probability Range at 40 years with no ISI Comments Degradation Mechanism(s)/

Combination(s)

Small leak Disabling leak (by disabling leak rate)*

MS Thermal and Vibratory Fatigue 4.61E 1.04E-01 5.43E 4.23E-02 High failure probability values due to high vibration levels.

RC Thermal Fatigue Thermal Fatigue & Stress Corrosion Cracking Thermal and Vibratory Fatigue, Stress Corrosion Cracking Thermal and Vibratory Fatigue 6.991E 3.711E-05 1.871E 2.48E-04 1.95E3 1.951E-08 1.35E 1.991E-05 SLOCA 1.07E 1.95E-05 MLOCA 7.40E 4.15E-06 LLOCA 2.45E 4.14E-06 SYS 1.16E 1.26E-04 SLOCA 1.52E 1.08E-04 MLOCA 1.12E 8.86E-05 LLOCA 1.08E 8.74E-05 SYS 1.62E-10-2.O1E-04 SLOCA 4.32E 5.70E-05 MLOCA 4.32E 5.70E-05 LLOCA 4.32E 5.70E-05 SYS 4.32E 5.711E-05 SLOCA 1.17E 1.26E-05 MLOCA l.09E 2.26E-06 LLOCA 1.77E-lO - 1.49E-06 SYS l.OOE 1.70E-05 Includes all Reactor Coolant Pressure Boundary segments.

Thermal stratification in the pressurizer surge line.

A potential exists for cold water in-leakage and subsequent thermal stratification/cycling (Bulletin 88-08) in small lines off the RCS; however, most lines are monitored, which substantially lowers the failure probability from this mechanism. (See Section 3.4)

SCC is a potential for the Inconel welds, with the potential evaluated as a function of the temperature.

Thermal Fatigue 6.33E 9.51E-05 2.OE 6.72E-06 High cycle thermal fatigue (Civaux) cracking at RHR Heat Exchanger Bypass Thermal & Vibratory Fatigue 3.60E 9.46E-05 2.46E-1 I - 5.78E-06 evaluated and considered in input. Failure probability primarily due to cycling from ambient to 350°F when used for shutdown cooling.

23

Table 3.4-1 Failure Probability Ranges (without 1IS) for FNP-1 and FNP-2 Piping System Dominant Potential Failure Probability Range at 40 years with no ISI Comments Degradation Mechanism(s)/

Combination(s)

Small leak Disabling leak (by disabling leak rate)*

SGB Erosion/Corrosion and Thermal 6.78E 2.18E-07 2.08E 8.355E-09 Failure probability controlled by thermal Fatigue fatigue due to cooldown and beatup of line. SGB piping is in FAC program, Thermal Fatigue 6.78E 8.51E-07 2.08E 3.27E-07 which minimizes failure probabilities.

SS NA NA NA Sampling System has no consequence of failure.

SI Thermal Fatigue 1.86E 6.80E-05 6.75E 1.66E-05 A large portion of this system is in standby at ambient room temperature with RWST water chemistry. Ambient temperature piping is below SCC threshold temperature with the FNP water chemistry. Failure probability controlled by thermal fatigue due to cooldown and heatup of lines interfacing with RHR during shutdown

._______ _ _ _ _ _ _ _ _cooling.

Notes:

- Disabling leak rate - LLOCA, MLOC4, SLOCA, and SYS (system disabling leak). When no identifier is shown, this is the system disabling leak rate.

24

Table 3.5-1 Southern Nuclear Operating Company FNP-1 Numb r of Segments and Piping Risk Contribution by System (w ut ISI)

CDF CDF LERF LERF without with without with

of Operator Operator Operator Operator System Segments Action (/yr)

Action (/yr)

AFW 15 1.31E-10 4.19E-13 3.66E-13 7.21E-15 CHI 6

O.OOE+OO O.OOE+00 O.OOE+OO O.OOE+OO CI 153 4.50E-09 7.20E-1 I 3.04E-1 I 8.55E-13 Cs 54 1.81E-09 1.74E-13 3.20E-11 8.84E-15 Cv 333 9.14E-08 4.05E-08 4.53E-10 1.08E-10 FW 18 2.70E-08 1.19E-10 1.94E-11 1.94E-13 MS 57 2.65E-06 8.67E-08 1.95E-09 5.65E-1 I RCS 202 3.52E-06 3.52E-06 3.18E-09 3.18E-09 RHR 83 1.38E-07 3.82E-08 2.28E-09 1.1OE-10 SGB 27 3.79E-09 9.64E-12 2.19E-12 1.43E-14 SI 128 7.09E-08 2.75E-08 9.65E-10 2.84E-10 Ss 27 O.OOE+0O O.OOE+00 O.OOE+00 O.OOE+OO Total 1103 6.51E-06 3.71E-06 8.92E-09 3.74E-09 25

Table 3.5-2 Southern Nuclear Operating Company FNP-2 Number of Segments and Piping Risk Contribution by System (with IS CDF CDF LERF LERF without with without with

of Operator Operator Operator Operator System Segments Action (/yr)

Action (/yr)

AFW 15 1.31E-10 4.26E-13 3.67E-13 7.22E-15 CHI 6

0.OOE+00 0.00E+00 0.00E+00 0.OOE+00 CI 161 4.43E-09 6.84E-11 3.06E-11 1.61E-12 CS 55 1.87E-09 1.78E-13 3.20E-1 1 2.09E-14 CV 321 8.25E-08 3.86E-08 4.36E-10 1.07E-10 FW 18 2.70E-08 1.21E-10 1.95E-11 1.95E-13 MS 60 3.23E-05 9.26E-07 2.38E-08 5.47E-10 RCS 215 3.46E-06 3.46E-06 3.16E-09 3.16E-09 RHR 78 5.46E-08 1.55E-08 2.92E-09

-1.49E-10 SGB 33 3.79E-09 9.90E-12 2.23E-12 1.79E-14 SI 131 5.38E-08 2.69E-08 9.59E-10 2.67E-10 SS 27 0.OOE+00 0.OOE+00 0.00E+00 0.00E+00 Total 1120 3.60E-05 4.47E-06 3.14E-08 4.24E-09 26

Table 3.7-1 Southern Nuclear Operating Company FNP-1 Summary of Risk Evaluation and Expert Panel Categorization Results Number of Number of Total number of segments Number of Number of Number of segments with any segments with all selected segments with segments with any segments with 1.001 5 RRW <

RRW < 1.001 for inspection any 1.001 RRW <

all 1.005 selected for (High Safety Significant System RRW 2 1.005 1.005 RRW < 1.001 placed in HSS inspection Segments)

AFW 0

0 15 0

3 3

CHI 0

0 6

0 0

0 CI 0

10 143 0

0 0

CS 0

2 52 0

0 0

CV 3

43 287 (2 delta risk) 0 3 + (2 delta risk)

FW 0

3 15 0

3 3

MS 11 9

37 3

0 14 RCS 32 76 94 16 0

48 RHR 18 12 53 0

0 18 SGB 0

0 27 0

0 0

SI 7

20 101 0

0 7

SS 0

0 27 0

0 0

TOTAL 71 175 857 19 + (2 delta risk) 6 96 + (2 delta risk) 27

Table 3.7-2 Southern Nuclear Operating Company FNP-2 Summary of Risk Evaluation and Expert Panel Categorization Results Number of Number of Total number of segments Number of Number of Number of segments with any segments with all selected segments with segments with any segments with 1.001 5 RRW <

RRW < 1.001 for inspection any 1.001 _ RRW <

all 1.005 selected for (High Safety Significant System RRW > 1.005 1.005 RRW < 1.001 placed in HSS inspection Segments)

AFW 0

0 15 0

3 3

CIII 0

0 6

0 0

0 CI 0

2 159 0

0 0

CS 0

2 53 0

0 0

CV 2

31 288 1

0 3

FW 0

3 15 0

3 3

MS 14 37 9

0 0

14 RCS 26 81 108--

22 0

48 RHR 7

18 53 11 1

19 SGB 0

0 33 0

0 0

SI 6

22 103 2

0 8

SS 0

0 27 0

0 0

TOTAL 55 196 869 36 7

98 28

TABLE 3.10-1 SOUTHERN NUCLEAR OPERATING COMPANY FNP-1 COMPARISON OF CDFILERF FOR CURRENT SECTION XI AND RISK-INFORMED ISI PROGRAMS AND THE SYSTEMS WHICH CONTRIBUTED SIGNIFICANTLY TO THE CHANGE Case (Systems Contributing to Change)

Current Section XI Risk-Informed CDF without Operator Action 3.92E-06 3.29E-06 MS 2.65E-06 2.18E-06 RH 1.23E-07 1.60E-08 CDF with Operator Action 1.16E-06 1.09E-06

-MS 8.67E-08 7.48E-08 RC 9.99E-07 9.86E-07 RH 3.73E-08 1.19E-09 LERF without Operator Action 5.66E-09 3.15E-09 MS 1.95E-09 1.61E-09 RH 1.77E-09 1.12E-10 SI 6.38E-10 1.66E-10 LERF with Operator Action 1.28E-09 1.05E-09 CV 9.73E-11 3.28E-1 1 RC 9.25E-10 9.08E-10 RH 1.OSE-10 3.64E-12 SI 9.85E-1 1 5.35E-1 1 29

TABLE 3.10-2 SOUTHERN NUCLEAR OPERATING COMPANY FNP-2 COMPARISON OF CDF/LERF FOR CURRENT SECTION Xl AND RISK-INFORMED ISI PROGRAMS AND THE SYSTEMS WHMCH CONTRIBUTED SIGNIFICANTLY TO THE CHANGE Case (Systems Contributing to Change)

Current Section XI Risk-Informed CDF without Oierator Action 3.35E-05 3.30E-05 MS 3.23E-05 3.20E-05 CDF with Operator Action 1.95E-06 1.92E-06 MS 9.26E-07 9.16E-07 RC 9.86E-07 9.70E-07 RH 8.31E-09 9.83E-10 LERF without Operator Action 2.70E-08 2.51E-08 MS 2.38E-08 2.35E-08 RH 1.77E-09 4.94E-1 1 LERF with Operator Action 1.66E-09 1.53E-09 CV 9.62E-11 3.26E-1 I RC 9.20E-10 9.02E-10 RH 4.23E-1 1 2.35E-12 30

Table 5-la (sheet 1 of 2)

FARLEY UNIT 1 STRUCTURAL ELEMENT SELECTION RESULTS AND COMPARISON TO ASME SECTION XI 1989 EDITION REQUIREMENTS System No. of HSS Degradation Class ASME Weld Count ASME Section XI Exam RI-ISI11&

Segments (No. of Mechanism(s)

Code Methods HSS in Aug Category Program / Total No.

of Segments in Aug Butt Socket Volumetric Surface SES Matrix Number of Exam Program ) We_)

& SurfaceO OnlyO Region Locations lAFW 3

MF, TF Class 2 C-F-2 18 0

2 0

2 3 NDE CE 0

MF, TF Class 2 (b)

(b)

(b) 0 lCI 0

MF, TFE/C Class 2 (b)

(b)

(b) 0 iCS 0

MF, TF Class 2 C-F-1 132 0

10 0

0 M F, TF, V F Class I B-J 3

38 0

1 1 0

lCV 3

M, TF Class 2 C-F-I 415 146 32 11 2

2 ARiskwNDE Class 2 (c)

(c)

(c) 2 3 NDE lFW 3(3/6)(e)

MF, TF, E/C Class 2 C-F-2 63 0

5 0

1A, lB 3 (eh) NDE Class 2 C-F-2 153 0

12 (d) 0 IA, 2 49NDE 1(/1)M, T,. F Class 2 (c)

(c)

(c) 2 5 NDE 31

Table 5-1a (sheet 2 of 2)

FARLEY UNIT 1 STRUCTURAL ELEMENT SELECTION RESULTS AND COMPARISON TO ASME SECTION XI 1989 EDITION REQUIREMENTS System No. of HSS Degradation Class ASME Weld Count ASME Section XI RI-ISI(*

Segments (No. of Mechanism(s)

Code Exam Methods HSS in Aug Category Program / Total No.

of Segments In Aug Butt Socket Volumetric Surface SES Matrix Number of Exam Program )(d"

& SurfaceW Only0 Region Locations MF, TF Class I B-F 18 0

18 0

IA, 2 15 NDE MF, TF. SCC lRC 48 MF, TF, VF, Class I B-J 456 206 114 52 1B, 2 9 NDE + 7 VT)

MF, TF, VF Class 1 (c)

(c)

(c) 2 18 VTt' IRH 18 MF, TF Class 2 C-F-1 380 0

29 0

2 18 NDE I SGB 0(0/3)(0)

E/C, MIFTF Class 2 (b)

(b)

(b) 0 M~~~~~~~ff,

-TF iSI 7

MF, TF Class 2 C-F-1 413 267 31 21 2

7 NDE ISS 0

MF, TF Class 2 (b)

(b)

(b) 0 Class 1 B-F 18 0

18 0

1A, 2 15 NDE Classi B-J 459 244 114 63 1B,2 9 NDE + 7 VTV TOTAL 96(9/27)

(c)

(c) 2 18 VT(i)

C-F-1 1340 413 102 32 2

27 NDE Class 2 C-F-2 234 0

19T 0

1A, 1B, 2 55 NDE (b)7

)(_b)

(b)

()

-0 I (c)

(c)

I (c) 2, 8 NDE Total 2051 657 253 95 1A, 1B,2 114NDE+25VTP' 32

Table 5-lb (sheet 1 of 2)

FARLEY UNIT 2 STRUCTURAL ELEMENT SELECTION R:RESULTS AND COMPARISON TO ASME SECTION XI 1989 EDITION REQUIREMENTS System No. of HSS Degradation Class ASME Weld Count ASME Section XI Exam RI-ISI()

Segments (No. of Mechanism(s)

Code Methods HSS in Aug Category Program / Total No.

of Segments in Aug Butt Socket Volumetric Surface SES Matrix Number of Exam Program ) (dxe)

I_

& SurfaceO Only°O Region Locations 2AFW 3

MF, TF Class 2 C-F-2 21 0

2 0

2 3 NDE 2CHI 0

MF, TF Class 2 (b)

(b)

(b) 0 2CI O

MEC TF Class2 (b)

(b)

_=

O ff, TF, I 2CS 0

MF, TF Class 2 C-F-1 139 0

11 0

0 Class I B-J 3

30 0

9 0

2CV 3

MMFTTFVF Class 2 C-F-1 400 94 30 8

0 Mff, TF Class 2 (c)

(c)

(c) 2 3 NDE 2FW 3(3/6) (e)

MF, TF, E/C Class 2 C-F-2 60 0

5 0

1A, 1B 3 (eh) NDE C-F-2 146 O

1 (d O

1A, 2 49 NDE 2MS 14(6/18) (d)

MF, TF, VF Class 2 C

1-(c)

(c)

(c) 1A 25 NDE 33

Table 5-lb (sheet 2 of 2)

FARLEY UNIT 2 STRUCTURAL ELEMENT SELECTION RESULTS AND COMPARISON TO ASME SECTION XI 1989 EDITION REQUREMENTS System No. of HSS Degradation Class ASME Weld Count ASME Section XI RI-ISI(

Segments (No. of Mechanism(s)

Code Exam Methods HSS In Aug Category Program / Total No.

of Segments in Aug Butt Socket Volumetric Surface SES Matrix Number of Exam Program ) (dX )

& SurfaceaD Only)

Region Locations MF, TF Class I B-F 18 0

18 0

1A, 2 1S NDE MF, TF, SCC 2RC 48 MF, TF, VF, Class I B-J 467 186 117 47 1B, 2 9 NDE + 7 VT )

MFTFVF Class I (c)

(c)

(c) 2 18 VTV 2RH 19 MF, TF, VF Class 2 C-F-I 369 0

28 0

2 19 NDE 2SGB 0(0/3) (e)

E/C, MF, TF Class 2 (b)

(b)

(b) 0 g, TF.

2SI 8

MF, TF Class 2 C-F-1 388 136 30 11 2

8 NDE 2SS 0

MF, TF Class 2 (b)

(b)

(b) 0 Class1 B-F 18 0

18 0

1A, 2 15 NDE Class I B-J 470 216 117 56 1B, 2 9NDE+7VT(0 (c)

(c)

(c) 2 18 VT )

C-F-1 1296 230 99 19 2

27 NDE TOTAL 98(9/27)

Class 2 C-F-2 227 0

18 0

1A, 1B, 2 55 NDE

'(b)

(b)

O (c)

(c)

(c) 1A, 2 28 NDE Total 2011 446 252 75 1AiB,2 134NDE+25VT ')

34

Table 5-la and Table 5-lb FARLEY UNIT 1 and 2 STRUCTURAL ELEMENT SELECTION NOTES Summary: Current ASME Section XI selects a total of 348 non-destructive exams for FNP Unit 1 while the RI-ISI program selects a total of 139 exams (25 visual exams), which results in a 60 % reduction.

Current ASME Section XI selects a total of 327 non-destructive exams for FNP Unit 2 while the RI-ISI program selects a total of 159 exams (25 visual exams), which results in a 51 % reduction.

Degradation Mechanisms: VF - Vibratory Fatigue; TF - Thermal Fatigue; MF - Mechanical Fatigue; E/C - Erosion/Corrosion (FAC); SCC -

Stress Corrosion Cracking Notes for Table 5-la and 5-lb.

a.

System pressure test requirements and VT-2 visual examinations shall continue to be performed in all ASME Code Class 1 and 2 systems.

b. Piping is exempt per the requirements of the 1989 Edition of Section XI.

c. Piping in this grouping is exempt per the requirements of the 1989 Edition of Section XI; however, examinations are required per the proposed RI-ISI program.

d. Augmented program consists of those ASME Class 2 high-energy welds examined in Main Steam ("No-Break" Zone). Examinations will continue per Technical Specification requirements. (86 additional welds on Unit 1 and 80 additional welds on Unit 2 receive a volumetric examination due to augmented requirements).

e. Augmented thickness measurements continue to be performed in the FW and SGB systems as part of the flow-accelerated corrosion (FAC) program (also known as erosion/corrosion). Not included in the "Number of Exam Locations."

f.

Monitoring program continues for high-cycle thermal fatigue (stratification/cycling) issues.

g. Two volumetric weld examinations added for change in risk considerations for FNP-l. None were added for FNP-2.

h. One weld on each of the three Region 1B FW segments will be examined for cracking.

i.

Visual examination once per refueling outage frequency or a penetrant examination once per 10-year interval.

j.

Includes only those weld examinations required to meet the requirements of the 1989 Edition of Section XI.

35

APPENDIX A FARLEY PRA PEER REVIEW RESULTS Observation IE-2 Issue: The Interfacing System LOCA Frequency notebook documents the development of the ISLOCA initiating event frequency. When calculating the probability of failure of valves in series (i.e., RHR discharge and suction), the probability of failure was not correlated. The correlation is dependent on the variance of the probability distribution, which is usually quite large for valve rupture probabilities. The necessity of correlating variables is discussed in NUREG/CR-5744, "Assessment of ISLOCA Risk-Methodology and Application to a Westinghouse Four-Loop Ice Condenser Plant."

That NUREG also provides an overall ISLOCA evaluation approach that is generally accepted as more realistic than the approach used for the Farley IPE, addressing in more detail such factors as alternate pathways resulting from failures of other equipment (e.g., heat exchangers, relief valves) in the interfacing systems.

SNC Response to the Observation: PRA Revision 5 updated the ISLOCA analysis using the guidance in NSAC-154, NUREG/CR-5102, NUREG/CR-5744 and NUREG/CR-5682. This revised analysis treats each potential ISLOCA pathway as a separate event tree considering the potential for pathway isolation and mitigating system impacts. The ISLOCA initiating event frequencies for the revised model are calculated using a Monte Carlo equation to address uncertainties in each component failure mode making up the initiating event frequency. This also ensures proper correlation of failure rates for identical components. The revised ISLOCA modeling was independently reviewed by an outside contractor to ensure that the analysis meets current industry standards.

Impact on Risk-Informed ISI: The revised model was used to assess the impact of pipe segment failures within the ISLOCA boundaries with respect to potential change in the ISLOCA initiating event frequency, mitigating system impacts, and loss of isolation capability. Therefore, SNC considers that this observation has been adequately addressed to ensure that no issues remain which could adversely impact the risk-informed ISI analysis.

Observation E-3 Issue: The Farley PRA includes initiators PSV1 and PSV2 for one and two stuck open primary safety valves, respectively. The E frequencies of PSVI and PSV2 are stated as 0.0047/yr and 3.4E-04/yr. The initiating events have Fussel Vessely values of.064 and.017. This means approximately 8% of the CDF is due to stuck open safety valves. This result is unusual for Westinghouse PWRs.

The E frequencies for these initiators should be reviewed, including examining the data in NUREG/CR-5750. LERs noted in NUREG/CR-5750 indicate that there have been two events where a safety valve opened spuriously. Both of those events occurred at a single plant, and were due to the existence of loop seals downstream of the safety valves. The loop seal in the line was lost, effectively lowering the safety valve setpoint, so that the safety valve opened. The valve reclosed and the SI actuation setpoint was not reached (reactor was manually tripped). These events are not applicable to Farley unless the piping configuration is similar. Further, the reviewers believe that the only events where two safety valves have been challenged in response to a transient have occurred at plants without pressurized PORVs. There is no evidence of spurious opening of two safety valves in NUREG/CR-5750.

SNC Response to the Observation: Revision 5 of the Farley PRA included a re-analysis of initiating events PSVI and PSV2. It was concluded that these events were included in NUREG/CR-5750 as functional impact rather than initial plant fault events. Since the Farley linked fault tree model explicitly 36

models stuck open safety valves as a consequential LOCA, the inclusion of initiating events PSV1 and PSV2 were considered overly conservative and the events were removed.

Impact on Risk-Informed ISI: Since the Revision 5 PRA model was used for the risk-informed ISI analysis, SNC considers that this observation has been adequately addressed and that no issues remain which could adversely impact the risk-informed ISI analysis.

Observation AS-Ol Issue: The SGTR event tree does not question isolation of the ruptured SG if HHSI is available.

Sequence 2 even allows a success state without isolation for recirculation after feed and bleed.

The distinguishing factor between the SGTR and SLOCA is the loss of primary inventory from containment for a SGTR. An analysis supporting injection capability for the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission time with this continued loss of inventory could not be located.

SNC Response to the Observation: The Steam Generator Tube Rupture success criteria have been reviewed and verified to cover the case of successful operation of HHi and AFW as a safe, stable end state.

Impact on Risk-Informed ISI: The piping segments analyzed as part of the risk-informed ISI process do not directly lead to Steam Generator Tube Rupture events. Where a segment could result in loss of SG isolation capability, this was included as a system impact. A review of the piping CDF contributions for the segments with potential direct bypass of containment for a SGTR event indicate that the Initiating Event contribution was one to two orders of magnitude greater than the system contribution for each of these segments. In addition, the segments which were ranked low safety significant had total piping segment CDF values two orders of magnitude below the level which would have placed the Risk Reduction Worth (RRW) values in the medium category to be assessed by the Expert Panel. Therefore, a significant change in the mitigating system consequences would have been required to affect the ranking of any of the segments potentially affected by this review comment. Since all of the segments greater than 1 inch in diameter also included loss of CST inventory as;a consequence, this impact is considered to be of much more significance than the loss of SG isolation since mitigation sequences for many more initiating events are affected. Therefore, SNC believes that the impact of this comment on the risk ranking results would not be significant and in any case, loss of isolation capability during SGTR events and the potential LERF impacts were considered by the Expert Panel for all of these segments.

Observation AS-1 1 Issue: ISLOCA initiating event frequency is calculated as a separate calculation and the 1E frequency, taken as the sum of frequencies for all scenarios evaluated, is input into the event tree, which models a "limiting case." The dependencies between the events causing ISLOCA (i.e., the individual ISLOCA scenarios) and the systems mitigating ISLOCA are not considered. There are two possible considerations missing from this approach:

1. ISLOCA can occur in the charging pump suction line, the seal water return line, and the excess letdown heat exchanger. The fault tree asks for makeup from HHSI and assumes all 3 HHSI pumps are available, without verifying that the HHSI suction is intact after the ISLOCA initiating event. The ISLOCA or the flooding effect of the ISLOCA could fail one or more of the HHSI pumps and they would not be available for make-up.

2. The RHR discharge and suction lines contribute about 20% to ISLOCA initiating event frequency.

These breaks could be 6"-10" breaks. The tree assumes 120 gpm make-up is adequate to mitigate the 37

break. 120 gpm is adequate for decay heat 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months after shutdown. A 10" break would blow down much faster and the assumption of 120 gpm would not be appropriate.

SNC Response to the Observation: See response to observation IE-2.

Impact on Risk-Informed ISI: See response to observation IE-2.

Observation SY-02 Issue: This element asks if the model matches the as-built, as-operated plant, including information in the AOPs and EOPs. A brief review was performed, focusing on the system models for electric power, CCW, SW and AFW. The model fidelity with plant systems as described in available documentation generally seemed good, but there were a number of apparent differences which should be resolved.

1. Plant procedures address alignment of service water as a long-term source of CST/AFW supply but this does not appear in the model. If CST inventory is guaranteed to be adequate for the PRA mission time, then some discussion of this in the documentation should be provided. If not, the SW supply (or other applicable means of decay heat removal) needs to be modeled. (See F&O SY-04 for Element SY-13 for further elaboration)

2. There is a check valve, NIP16V538, in the turbine building SW return line which the modeling assumptions (p. 211) indicate is not modeled because it is "non-safety grade." To match the "as-built, as-operated plant," the appropriate failure modes for this check valve should be modeled, irrespective of the safety-grade classification of the valve. Possibly these modes could include failure to close, failure to open (for scenarios where there is an interruption in SW flow), and transfers closed.

3. The SW pump discharge check valve fails-to-close should be added as a failure mode for the other pump(s) in that train. That is, if a running pump fails to run (or trips and fails to restart, such as during a LOSP event) and its check valve does not seat, a recirculation path back to the SW pond is created and the output of the remaining "good" pump(s) will be diverted. Since the pump will be running, this event may be harder for operators to detect than a simple failure of two pumps to function. The model should be reviewed to see if there are other systems where modeling this failure mode might be appropriate.

4. Strainer faults (main and lube/cooling water), as well as common-cause events involving strainers, should be modeled. Traveling screen failures should also be modeled. Modeling assumptions indicate that debris blockage is not expected and that the screens are not "water tight," apparently indicating that there is a significant amount of bypass flow. It would be better to put the screens in the model and let the quantification demonstrate their (non-)importance. Note that strainer/screen fouling has occurred at plants due to introduction of man-made material (trash at one plant, Furmanite concrete patch material at another), so this failure mode is possible even if the suction pond is relatively clean. Also, consider that if bypass flow around screens is sufficient to render them unnecessary, then they may not be providing the protection they are designed to provide.

5. Common-cause failures (CCF) of all service water pumps should be added to the model. It was not clear to the reviewers if these pumps are all of identical manufacture, but there are many common elements associated with their installation and use. The model should be reviewed to see if there are other systems where CCFs need to be applied to n of n components (such as CCW).

6. There is apparently a SW control air system. The reviewers did not find a modeling assumption justifying why this system does not need to be modeled. If this system does not need to be modeled, such justification should be provided.

38

7. This comment is applicable to emergency air, and possibly other systems. Spurious opening of safety/relief valves should be added as failure modes to systems where this could impair function (e.g.

Emergency air system safety/relief valves on compressor and receiver). See also F&O SY-06 related to CCW relief valves and flow diversions.

SNC Response to the Observation: With regard to item 1, CST inventory has been shown to be adequate for all analyzed scenarios, including the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission time following Very Small LOCA or General Transient initiating events. However, to ensure completeness of the model, the Service Water System backup feed for AFW was incorporated in Revision S.

With regard to item 2, failure of this check valve will only impact the cooling for the Main Feedwater pumps and Condensate pumps. The only events which would interrupt the flow of service water through this valve would be a Loss of Offsite Power. Since the Main Feedwater Pumps and Condensate Pumps are not modeled for mitigation after an LOSP, this valve does not need to be modeled.

With regard to item 3, Revision 5 added failure of the discharge check valve on an idle pump as a potential failure mode to all pumps where appropriate (i.e, where the pumps are physically aligned to the same discharge path).

With regard to item 4, Revision 5 of the PRA model added plugging of the traveling screens, discharge strainers and lube and cooling strainers as potential failure modes for the system.

With regard to item 5, SNC has plans to develop a common methodology for common cause analysis to be used across all SNC PRA models. The application of common cause to groups including both running and standby equipment will be included in this methodology.

With regard to item 6, the SWIS instrument air system is used to control the SW pump miniflow valves (which fail closed) and to provide air to SW pond level instruments. No mitigating functions are impacted by the failure of SWIS instrument air.

With regard to item 7, many of the relief valves in Farley fluid systems are thermal relief valves designed i to protect equipment from overpressurization following its isolation. These valves are not expected to be challenged by normal system pressure transients. However, PRA Model Revision S did add potential failure of check valves to the CCW system since a relatively small volume loss in the system will lead to i draining of the surge tank on the system. In addition, other systems were reviewed and verified to have relief valve failures included where appropriate.

Impact on Risk-Informed ISI: Since all of these issues other than common cause were resolved as part of PRA Model Revision 5, SNC does not believe any issues remain that potentially affect the risk-informed ISI analysis. With respect to the common cause issue, where there are both normally running and standby pumps in a system at Farley, the operating cycle of the standby pump is significantly different from those of the primary pump(s). Where there are significant differences in operating cycles, SNC does not believe that common cause failure (to run) due to simultaneous wear of all pumps is a credible failure mode. Where pumps take a suction from a common source, failure of the suction source, including appropriate common cause failures, is modeled under each potentially affected pump.

Therefore, SNC is of the opinion that the common cause modeling is appropriate as implemented in PRA Model Revision 5. In addition, the WOG risk-informed ISI methodology applies uncertainty bounds to the point estimate CCDP/LERP and ACDF/ALERF produced by the Farley PRA model which should minimize any potential impacts on the final results due to common cause modeling issues.

39

Observation SY-03 Issue: Enhancement of the level of modeling detail for Emergency Diesel Generators (EDGs) and their support systems is suggested.

The onsite emergency AC power system modeling was examined and it does not appear to include some detail expected by the reviewers. In particular, the fuel oil supply system to EDGs should be modeled if credit for DG run times greater than allowed by the day tank inventory is needed. A 24-hour DG run time is usually used, consistent with the PRA mission time (e.g., to cover all possibilities of power recovery for LOSP), and it is assumed that the day tank alone could not support a run of this length.

Assumption 11 of the IPE Service Water System Notebook, Revision 0, June 1993 (Westinghouse Reference Numbers: CN-PORI-92-277 / CN-PORI-92-385) discusses the exclusion of Service Water strainers from the model. The component identifiers are not specifically called out. It is assumed that the affected components are F501A and F501B. The following statements are from PRA Summary Rev. 4, Service Water section. "Plugging of the SW strainers is not included in the fault tree logic model. Plant experience shows that there has been no strainer plugging." (PRA Summary Rev. 4, Service Water section). Similar statements could have been made for other utilities until a significant event occurred (e.g., frazil icing of service water systems at Wolf Creek). Screening of apparent low failure items may mask their true importance to system functional success. It is believed that inclusion of the strainers in the appropriate fault tree would provide a more complete and current state-of-technology model for use in risk-informed applications. Common-cause issues for DG fuel oil components and strainers should also be evaluated.

SNC Response to the Observation: PRA Model Revision 5 incorporated detailed modeling of the diesel generator fuel oil makeup system including appropriate common cause failures. Revision 5 also incorporated modeling of all Service Water system strainers and the intake traveling screens as noted above.

Impact on Risk-Informed ISI: SNC considers that this observation has been adequately addressed to ensure that no issues remain which could adversely impact the risk-informed ISI analysis.

Observation SY-04 Issue: The AFW fault tree does not model alternate sources of condensate to the AFW pumps other than the CST. The AFW system notebook provides discussion of the SW supply to the AFW pump suction in the event the CST fails, but this capability is not modeled in the fault tree. The plugging of the CST suction valve (XV501) has a Fussel Vessely value of.04. The failure probability for the valve is calculated from an elementary failure rate of IE-7/hr for 18 months. This valve is virtually tested every time one of the motor driven AFW pumps is run from the CST. The test interval of 18 months seems too long. Realistic calculation of the valve failure rate should be considered. Also, consider modeling the SW backup as a source of condensate to prevent core damage.

SNC Response to the Observation: As stated in the response to Observation SY-02, Service Water backup to the Auxiliary Feedwater Pump suction has been added in PRA Model Revision 5. In addition, the test interval for CST suction check valve XV501 has been changed to quarterly to better reflect the actual test conditions. This may still be somewhat conservative because of staggering of the motor-driven AFW pump surveillance tests, but because the amount of staggering between tests may vary depending on plant conditions, the quarterly interval is believed to be appropriate.

Impact on Risk-Informed ISI: SNC considers that this observation has been adequately addressed to ensure that no issues remain which could adversely impact the risk-informed ISI analysis.

40

Observation SY-05 Issue: Modeling of support to important plant systems credited during LOSP sequences should be reviewed, particularly for dual-unit LOSPs, to ensure that assumptions are consistent and logical. For example, consider the following sequence: The SBO event tree indicates that given little or no RCP seal leakage and TDAFWP success, 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months are available for recovery of offsite power. It appears that the TDAFWP is modeled to succeed for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , until the emergency air system necessary for pump control and operation of SG PORVs fails. It is apparently assumed that core uncovery will not occur for at least 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months after that time, and that recovery of offsite power within 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months will allow restoration of RCS inventory, resumption of core cooling, and avoidance of core damage.

There is an implicit assumption in this sequence that DC power will be available to support necessary instrumentation for at least the period of time that the TDAFWP is relied upon. For example, steam generator level indication supplied with DC power is necessary so that the TDAFWP can be controlled.

Accordingly, availability of DC power for at least two hours is required for sequence success. However, document A-181004, "Electrical Distribution System" indicates that the plant IE 125V batteries can support necessary loads for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months on one unit and I hour on the adjacent unit. This appears to conflict with the model assumption.

SNC Response to the Observation: Documentation provided to the reviewers late in the review process revealed that the Electrical System Functional System Description (A-181004) statement concerning the battery capacity for Unit 2 was not correct. During an Electrical System Function System Inspection (EDFSl) at FNP, it was discovered that the Unit 2 batteries could not be verified to have sufficient capacity to operate all safety related components at the end of two hours with no battery charger support.

However, design changes were completed in 1994 to restore the capability to operate all safety related DC loads at two hours. At that time, document A-181004 should have been revised to remove the referenced comment concerning the Unit 2 battery capacity, but was not. Therefore, the PRA modeling assumptions are correct, and appropriate SNC personnel have been informed of the error in document A-181004.

Impact on Risk-Informed ISI: SNC considers that this observation has been adequately addressed to ensure that no issues remain which could adversely impact the risk-informed ISI analysis.

Observation SY-07 Issue: It is standard practice in the Farley PRA to not model any common cause between standby and operating components. While this practice may have been acceptable during the IPE time period, the INEEL CCF database provides some evidence of common cause dependencies between standby and operating components. Current practice suggests that you should identify and model common-cause failures which could prevent all similar components in a system from performing their intended function (for example: CCW pumps, SW pumps).

SNC Response to the Observation: SNC has plans to develop a common methodology for common cause analysis to be used across all SNC PRA models. The application of common cause to groups including both running and standby equipment will be included in this methodology. As noted in the response to Observation SY-02, where there as both normally running and standby pumps in a system at Farley, the operating cycle of the standby pump is significantly different from those of the primary pump(s). Where there are significant differences in operating cycles, SNC does not believe that common cause failure (to run) due to simultaneous wear of all pumps is a credible failure mode. Where pumps take a suction from a common source, failure of the suction source, including appropriate common cause failures, is modeled under each potentially affected pump. Therefore, SNC is of the opinion that the common cause modeling is appropriate as implemented in PRA Model Revision 5. In addition, the WOG risk-informed ISI methodology applies uncertainty bounds to the point estimate CCDPALERP and 41

ACDF/ALERF produced by the Farley PRA model which should minimize any potential impacts on the final results due to common cause modeling issues.

Impact on Risk-Informed ISI: SNC considers that this observation has been adequately addressed to ensure that no issues remain which could adversely impact the risk-informed ISI analysis.

Observation SY-09 Issue: Documentation that a global evaluation has been performed to confirm the ability of important plant components to function as modeled in adverse environments was not identified. There is no entry for this item in the "information roadmap" supplied to the reviewers.

SNC Response to the Observation: Equipment referenced for use in the Emergency Response Procedures (ERPs) was verified to be capable of performing the required function in post-accident environments as part of the procedure development process. No equipment is credited in the Farley PRA modeling which is not included in the ERPs. Therefore, SNC considers that adverse environmental conditions have been appropriately considered for all modeled PRA components.

Impact on Risk-Informed ISI: This is a documentation issue-which has no influence on the component modeling with respect to the risk-informed ISI analysis. In addition, the WOG risk-informed ISI methodology explicitly considers indirect effects of pipe failure induced spray and flooding. Therefore, SNC is of the opinion that no issues remain with respect to this observation which could adversely impact the risk-informed ISI analysis.

Observation DA-02 Issue: The common cause failure probabilities are referenced to a 1990 data source. Given the extensive research on common cause events sponsored by the NRC since the time of the TPE, a more up-to-date common cause data source should be used. Some of the common cause failure probabilities used in the PRA are significantly different than those from a recent generic data source, NUREG/CR-5497. It is recognized that the values in that document are unscreened values and are likely to be reduced by NUREG/CR-4780 screening process that Farley employs.

SNC Response to the Observation: Farley CCF analysis followed procedures suggested in NUREG/CR-4780. NUREG/CR-4780 procedures had been a generally accepted CCF analysis procedures until NUREG/CR-5485, was published in 1998. NUREG/CR-5485 is considered to be an enhanced version of NUREG/CR-4780.

According to NUREG/CR-4780 (also NUREGICR-5485), historical CCF events are specialized for a plant specific CCF. Farley performed plant specific CCF analysis. In a plant specific analysis, each historic CCF event is reviewed and its applicability to the Farley plant is determined. Different designs, environments, and operation modes are some of the factors affecting the applicability. A CCF event may be screened out, or applied with some probability, or applied with probability of 1 according to the effectiveness of plant specific defenses against the event.

It is a general observation that plant specific CCF analysis may result in lower CCF values than generic values because generic values could include contributions from events that are not applicable to plant specific cases. Sometimes, a generic value could be an order of magnitude higher than a plant specific value (reference: Young G Jo. et al, "Effects of Operating Environments on the Common Cause Failures of Essential Service Water Pumps," Proceeding of International Topical Meeting on Probabilistic Safety Assessment, PSA02, October 2002, Detroit).

42

And thus, screening out of non-applicable events for plant specific CCF is a part of CCF procedures.

It is acknowledged that the common cause data needs to be updated to the later database published under the program which developed NUREG/CR-5485, and SNC has efforts underway to perform this update.

However, as noted in observations above, the WOG risk-informed ISI methodology applies uncertainty bounds to the point estimate CCDP/LERP and ACDF/ALERF produced by the Farley PRA model which should minimize any potential impacts on the final results due to common cause modeling issues.

Impact on Risk-Informed ISI: Due to the application of uncertainty bounds on the point estimate CCDPALERP and ACDF/ALERF produced by the Farley PRA model for the risk-informed ISI analysis, SNC does not believe the potential changes in common cause factors which may result from use of the most current common cause database, when appropriately screened for plant-specific factors will result in different conclusions with respect to the risk significance of individual pipe segments under the WOG methodology.

Observation DA-05 Issue: There are two diesel generator common cause groups. One set includes the IC and 2C diesel generators and the other set includes the IB, 2B, and the 1/2-A diesel generators. These two sets are apparently of different design. However, there are other factors that should be considered in establishing common cause groups, including common maintenance crews, common I&C technicians, similar procedures, common fuel oil, etc. It is recognized that, in the past, it was not common practice to consider common cause failures where substantial design differences existed. The basis for such practice lies with the practicality of implementation. In the case of the onsite emergency AC sources, no such implementation barriers exist.

SNC Response to the Observation: With respect to the diesels at FNP, plant operating experience has shown that the differences in design between the two types of diesels used are far more important factors in predicting diesel failure than any common elements between the two designs. However, the recommendations of this observation will be considered in the update of our common cause methodology.

Impact on Risk-Informed ISI: Even if the common cause modeling of the diesel generators is determined to require consideration of common cause between diesel models, no pipe segment failures considered in the Farley risk-informed ISI analysis cause LOSP nor affect the DGs. Thus, no initiating event pipe failure consequence (which tend to dominate the piping segment CDF/LERF) will be affected.

For evaluation of piping segment mitigating system consequences, the WOG methodology uses a ACDF/ALERF calculation. For these calculations, any DG contributions will be effectively cancelled out when the ACDF/ALERF is determined. This, in addition to the uncertainty bounds applied to the point estimate values used in the WOG risk-informed ISI methodology will minimize any adverse impacts on the risk-informed ISI analysis due to this observation.

Observation DA-07 Issue: The loss of offsite power non-recovery curves were developed during the IPE based on data from NUREG-1032. The curves have not been updated for the PRA. NUREG/CR-5496, "Evaluation of Loss of Offsite Power Events at Nuclear Power Plants: 1980 - 1996," is a more up to date data source.

SNC Response to the Observation: Although not implemented in PRA Model Revision 5 which was used for the risk-informed ISI analysis, SNC has begun its regular data update activities for the Farley model. As part of this data update, a preliminary analysis of updated LOSP experience has been used to update the appropriate offsite power recovery factors. The conclusion from this update is that the recovery factors used in PRA Model Revision 5 will likely be reduced in the data update.

43

Impact on Risk-Informed ISI: As stated in the response to Observation DA-05, modeling issues related to LOSP will have little impact on the risk-informed ISI results due to the fact that no piping failure leads to an LOSP initiating event.

Observation HRR-1 Issue: The IPE HRA calculation developed HEPs for specific plant response trees. After the conversion to CAFTA, the linked fault tree allows them to be applied to other events. For example, BEP IDGOPOPERDGICHDE indicates that it was evaluated for use in the SBO event tree. When the event is followed up the single top CDF tree it is also found to be used in other event trees such as ATWS. There is no documentation that the calculation is valid for event trees other than SBO.

SNC Response to the Observation: The application of HEPs to sequences other than those for which they were analyzed in the IPE has always considered similarities in the events with regards to the expected PSFs and event timing. This will continue to be SNC practice.

Impact on Risk-Informed ISI: Since the application of HEPs in the CAFTA conversion to event trees (different than those considered in the original IPE analysis) has only been done where the event timing, PSFs, and procedures are similar, SNC does not believe this observation has any adverse impact on the use of PRA Model Revision 5 in the risk-informed ISI analysis.

Observation HR-02 Issue: The emergency and abnormal operating procedures are the basis for the HRA. The only update to the 1993 WE HRA is the addition of two new operator actions and the revision of one operator action as documented in calculation PSA-F-0-0O1. There is no documentation that revisions to procedures have been evaluated for their impact on the HRA although discussions with the Farley staff indicate that at least one review has been done.

SNC Response to the Observation: All procedures used in the development of HEPs for the IPE were reviewed in 1999 to identify changes that could impact the HEP calculations. The only REPs identified as potentially impacted by changes in procedures were those documented in calculation PSA-F-00-001.

The documentation of this review should have been included in calculation PSA-F-00-01, but was not.

SNC will ensure that future calculations for REP update include a record of the review of all FNP procedures used as the basis of an HEP.

Impact on Risk-Informed ISI: This is a documentation issue which does not affect the PRA inputs into the risk-informed ISI analysis. Therefore, SNC is of the opinion that no issues remain with respect to this observation which could adversely impact the risk-informed ISI analysis.

Observation HR-03 Issue: Discussion with Farley PRA staff regarding the logic behind gate OA-ARV in the mutually exclusive tree revealed that ARVLOCAL--H had been omitted from the new emergency air system tree where OAB_A 4-D-H is used rather than OAB_A_4----H.

The omission of gate ARVLOCAL--H from the new emergency air system tree prevents the mutually exclusive file from deleting inappropriate cutsets involving this event. The result is that both the independent and dependent operator actions will appear in cutsets that are appropriate only for the dependent operator action.

44

SNC Response to the Observation: Sensitivity analyses completed during the peer review indicate the referenced example had no impact on CDF because the combination of events involved occurs only on non-minimal sequences in the event tree. The noted problem was corrected in PRA Model Revision 5 and a review was done of all mutually exclusive logic to ensure that no further examples of this issue were present.

Impact on Risk-Informed ISI: The conditions noted in this observation were corrected in the PRA Model revision used in the risk-informed ISI analysis. Therefore, SNC is of the opinion that no issues remain with respect to this observation which could adversely impact the risk-informed ISI analysis.

Observation HR-04 Issue: There was no indication that miscalibration errors or common cause miscalibration errors were included. A reference was found that said miscalibration was ignored, because the high and low miscalibrations would cancel out. This reasoning does not follow.

SNC Response to the Observation: SNC considers equipment failure due to miscalibration to be included in the reliability and common cause events for the affected instruments. This position will be evaluated as part of a planned review of our Human Reliability Analysis process.

Impact on Risk-Informed ISI: Due to the application of uncertainty bounds on the point estimate CCDP/LERP and ACDF/ALERF produced by the Farley PRA model for the risk-informed ISI analysis, SNC does not believe the potential changes caused by moving common cause miscalibration errors from the component common cause event to an HEP will result in different conclusions with respect to the risk significance of individual pipe segments under the WOG methodology.

Observation HR-05 Issue: The HRA uses two different methods for calculating HEPs - the Success Likelihood Index Method (SLIM) and the Technique for Human Error Rate Prediction (THERP). The implementation of these HRA methods is problematic for the following reasons:

1. Although several groups of plant Operations/Training personnel were involved in the assignment of SLIM weighting factors for the PSFs, this activity appears to have been dominated by two individuals who alone did the assignments for 1/3 of the HEPs and, in conjunction with a third individual, did the assignments for another 1/3 of the HEPs. The basis of the method assumes that the assignments would be done by a larger panel of experts.

2. The validity of the SLIM anchor points could not be verified during this review because the source is not identified in the HRA notebook and the referenced Westinghouse calculation note which contains the details regarding the anchor point source is on microfiche and was not readily available for review.

3. The THERP calculations contain 0.1 multipliers for operator training/qualifications in both the diagnosis and execution portions of the calculation. They also contain a 0.1 multiplier for a "slack time recovery." These multipliers are not described in THERP and there is no justification for their use.

SNC Response to the Observation: With regard to item 1, the SLIM evaluation included not only the operating crews referenced in this observation, but also other licensed operators in the FNP Training department and General Office. Therefore, none of the SLI calculations were based on the assessments of only two or three individuals as implied. A review of the SLI calculation details in Appendix E of the 45

Human Reliability Analysis notebook reveals that only two SLIs were based on input from fewer than 5 individuals. These two actions, OSIc and OSId, were not used in the IPE model and are not used in the current model. Of the remaining 34 actions evaluated with SLIM, 15 had the input of 10 licensed individuals, 2 had the input of 9 licensed individuals, 6 had the input of 8 licensed individuals, 5 had the input of 7 licensed individuals, 3 had the input of 6 licensed individuals and 3 had the input of 5 licensed individuals. Therefore, the majority of the SLIM evaluations had the input from at least 8 licensed individuals and is considered to have met the intent of the methodology.

With regard to item 2, this was subjected to independent review at the time of the ]PE and it was concluded that appropriate anchor points were selected for use. Therefore, the intent of the SLIM methodology is believed to have been met.

With regard to item 3, SNC is aware that Westinghouse applied some factors in their application of THERP that are not addressed in the general methodology. SNC plans to conduct a general review of the processes used in Human Reliability Analysis, including evaluation of the HRA toolkit under development by EPRI. Following this review, the Human Reliability Analysis for the Farley PRA model will be updated as appropriate. In the interim, SNC will continue to assess the consistency of our REP values with those used within the industry for similar events. As outliers are identified, we will take appropriate action to re-evaluate those specific HEPs.

Impact on Risk-Informed ISI: Due to the application of uncertainty bounds on the point estimate CCDP/LERP and ACDF/ALERF produced by the Farley PRA model for the risk-informed ISI analysis, SNC does not believe the potential changes caused by use of different HRA methods for pre-initiator and post-initiator actions leads to different conclusions with respect to the risk significance of individual pipe segments under the WOG methodology.

Observation HR-09 Issue: There was little evidence of plant specific analysis to support the timing of the HRA quantification. For each HEP, timing constraints were established but the basis for these constraints was not referenced. It appears that many of the timing constraints are generic estimates or screening values.

SNC Response to the Observation: HEP timing constraints were established based on Modular Accident Analysis Program (MAAP) or THERP calculations performed as part of the IPE. These timing constraints have been provided to the Farley Training department for reference during operator simulator and job performance evaluations. When problems are identified, the issues are entered into a tracking system to be resolved in an immediate model update or at the next regular scheduled update based on potential significance to the quantification results.

Impact on Risk-Informed ISI: SNC does not believe that this observation will impact the risk-informed ISI analysis because Farley HRA methods (SLIM for procedure based actions and THERP for recovery actions) are not time-sensitive enough to produce significantly different values for small differences in time. In addition, as noted above the application of uncertainty bounds on the point estimate CCDPALERP and ACDF/ALERF produced by the Farley PRA model for the risk-informed ISI analysis will minimize adverse impacts on the overall results.

Observation ST-01 Issue: The ISLOCA analysis did not use probabilistic treatment of pipe rupture on overpressure, as indicated in NUREG!CR-5124, NUREG/CR-5744, or similar studies. ISLOCA pathways were identified and the frequency of ISLOCA was calculated directly by examining potential valve failure modes in the 46

ISLOCA pathways. This is actually the probability of pipe overpressure, but was used as the ISLOCA initiating event frequency.

In one case, (RHR suction) a hoop stress calculation was performed to show that the over pressure was within the ultimate strength of the pipe. This was used to justify that the suction pipes would not rupture.

However, the ISLOCA was still assumed to be a medium size LOCA, and plant response was modeled on this basis.

SNC Response to the Observation: See response to observation IE-2.

Impact on Risk-Informed ISI: See response to observation IE-2.

Observation ST-2 Issue: The review of the flooding analysis provided no indication that probabilistic failure of the barriers to propagation of flood waters (doors, drains) was considered. Failure of doors includes structural failure as well as the probability the door is left open prior to the flood. Plugging of floor drains was not considered.

SNC Response to the Observation: The plant administrative controls of doors used for flood area separation are sufficient to minimize the impact of this observation. Where flood barrier doors are left open for significant periods of time, this is evaluated by the maintenance rule program to ensure to risk exposure is small. If operating history shows that flood barriers are being opened for significant time periods, the regular PRA model update process will identify this issue and ensure appropriate changes are made to the model.

Impact on Risk-Informed ISI: The WOG risk-informed ISI methodology explicitly considers indirect effects of pipe failure induced spray and flooding. Therefore, SNC is of the opinion that there are no issues with respect to this observation which could adversely impact the risk-informed ISI analysis.

Observation OU-03 Issue: Although three sensitivity analyses are documented in section 3.4.4 of the Rev 4a summary report, no discussion of a systematic search for unique or unusual sources of uncertainty is provided or performed (qualitatively or quantitatively).

SNC Response to the Observation: SNC is following industry initiatives to develop an adequate methodology to perform uncertainty analysis to meet the intent of the ASME PRA Standard and the peer review process.

Impact on Risk-Informed ISI: The WOG risk-informed ISI methodology applies uncertainty bounds to the point estimate CCDP/LERP and ACDF/ALERF produced by the Farley PRA model. Specifically, the point estimate values were used as the median of a lognormal distribution with error factors of 5, 10, or 20 used to define the spread of the distribution (please refer to WCAP-14572, A-version, pages 125-129).

Therefore, SNC considers that the application of uncertainty through the WOG methodology adequately addresses the concerns of this observation with respect to the risk-informed ISI analysis.

Observation OU-06 Issue: There is no documented evidence that results (e.g., cutsets or sequences) from similar plants are reviewed to ensure that potentially important cutsets are not missing from the PRA model.

47

SNC Response to the Observation: SNC is of the opinion that the grading of this element is inappropriate since no practical means of implementing the recommendation of this observation currently exists. Therefore, this is seen as a generic industry issue rather than a specific item to be addressed in the SNC PRA program SNC has and will continue to use information in the WOG PRA Comparison Database to compare our distribution of core damage by initiating event with the results reported by sister plants to ensure that our PRA results are generally consistent with plants of similar design.

Impact on Risk-Informed ISI: This is a documentation issue which does not affect the PRA inputs into the risk-informed ISI analysis. No issues remain with respect to this observation which could adversely impact the risk-informed ISI analysis Observation OU-07 Issue: A sampling of non-dominant sequences (cutsets) were reviewed by the peer review team. The cutsets were true to the success criteria and the fault logic. The cutsets were not illogical.

Although discussions with the Farley PRA staff indicates that they carefully checked the converted LPE cutsets against the IPE results, there is no documented systematic search mentioned for validation of non-dominant cutsets. To meet a grade 3 for non-dominant cutsets, documentation should be provided for a systematic review of non-dominant cutsets to establish they are reasonable, not deleted inappropriately, and are not overly conservative.

The sub-tier criteria for QU-1 5 state that "in evolving the PRA to be used for risk based applications, overly-conservative assumptions should be eliminated to avoid biasing the results." The review of the non-dominant sequences observed the instances of potentially "overly conservative criteria" given in attachment A to this F&O. Those are just a sampling of apparent conservatisms found in the IE-1 I cutset range. The overall effect of these is not known.

SNC Response to the Observation: The specific examples provided by the review team were evaluated during preparation of PRA Model Revision 5. Most of the issues raised were items included in the model at the recommendation of the independent review panel during the IPE. The remaining item was a misunderstanding on the part of the reviewer. Therefore, no changes were made as a result of this observation.

Impact on Risk-Informed ISI: Since the WOG risk-informed ISI risk ranking uses the Risk Reduction Worth importance measure, the impact on the results due to low order cutsets would be minimal. In addition, processes used to calculate the CCDP/LERP and ACDF/MLERF values used in the analysis would tend to result in these lower order cutsets being subsumed by higher order cutsets with surrogate components representing the piping segment set to guaranteed failure. Therefore, SNC does not believe that the issues raised in this observation would have an adverse impact on the risk-informed ISI analysis.

Observation L2-1 Issue: The LERF analysis uses the 1998 WOG definition from ESBU/WOG-98-053.

Farley does not include Emergency Action Levels (EAL) in the LERF definition. The WOG definition dismisses the need to use EALs on the assumption that the operators would be sensitive to protection of the public. In accordance with the WOG definition, the "early" in LERF is defined as "within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months of the initiating event." A more common definition of "early" is "release within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months of evacuation."

The SGTR accident sequences must be evaluated with respect to EALs to decide if they are LERF or Non-LERF. Sequences 4 and 5 are included as LERF, but Sequences 1, 2, 3 are currently non-LERF.

48

SNC Response to the Observation: SNC is continuing to follow WOG efforts to clarify the definition of LERF adopted by the Risk Based Technology Working Group. In the interim, SNC revised the LERF modeling in PRA Revision 5 to include all SGTR sequences as direct containment bypasses. In addition, all Steam Generators have been recently replaced at Farley Nuclear Plant which results in minimal exposure to induced tube ruptures at this point in plant history. We will continue to follow industry initiatives related to developing methodololgies for addressing induced tube ruptures in the LERF calculations.

Impact on Risk-Informed ISI: SNC considers that this observation has been adequately addressed to ensure that no issues remain which could adversely impact the risk-informed ISI analysis.

Observation MU-02 Issue: This element asks if the update steps are traceable using the available documentation. Using the documentation available, it did not seem that it would always be possible to determine how the inputs to the model update (operating experience, plant procedure changes, plant modifications, etc.) were evaluated to arrive at the list of model changes needed.

SNC Response to the Observation: The calculation documenting PRA Model Revision 5 includes a discussion of each plant design change completed since the previous model update and documents the determination of potential impacts on the PRA model. Those items selected for incorporation are further documented as to how the model was changed to address them.

Impact on Risk-Informed ISI: SNC considers that this observation has been adequately addressed to ensure that no issues remain which could adversely impact the risk-informed ISI analysis.

In addition to these peer review findings, the Staff Review of the Individual Plant Examination (WPE)

Submittal for Internal Events and Floods for the Joseph M. Farley Nuclear Plants, Units I and 2 identified limitations in the HRA approach used in the IPE. The specific issues noted were:

1. Treatment of human errors related to calibration of equipment, and

2. Use of the Westinghouse application of the Techniques for Human Error Rate Prediction (THERP) methodology.

These issues were also identified in the Peer Review as part of items HR-04 and HR-05. The responses provided to these issues above also apply to the limitations identified in the IPE review. Due to the specific usage of the PRA results in the Westinghouse risk-informed ISI methodology and the application of uncertainty bounds on the PRA model results prior to ranking the relative risk of individual piping segments, SNC is of the opinion that the HRA limitations noted in the staff review of the Farley IPE submittal would have no adverse effect on the results of this analysis.

49

NL-03-1259, Risk-Informed Inservice Inspection Program - ASME Code Category B-F, B-J, C-F-1 & C-F-2 Piping

Contents

Text

Enclosure:

SUMMARY

SUMMARY

System Description

System Description

System Description

System Description

Navigation menu

NL-03-1259, Risk-Informed Inservice Inspection Program - ASME Code Category B-F, B-J, C-F-1 & C-F-2 Piping

Text

Enclosure:

SUMMARY

SUMMARY

System Description

System Description

System Description

System Description

Navigation menu

Search