Text

Response to 12/12/03 Request for Additional Information Regarding Application for License Renewal
	ML040650645
Person / Time
Site:	Farley
Issue date:	02/26/2004
From:	Stinson L; Southern Nuclear Operating Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	NL-04-0287
	Download: ML040650645 (78)
	v • d • e

L M. Stinson (Mike)

Vice President Southern Nuclear Operating Company, Inc.

40 Inverness Center Parkway Post Office Box 1295 Birmingham, Alabama 35201 Tel 205.992.5181 Fax 205.992.0341 February 26, 2004 SOUTHERN A COMPANY Energy to Serve Your World' Docket Nos.:

50-348 50-364 NL-04-0287 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D. C. 20555-0001 Joseph M. Farley Nuclear Plant Units I and 2 Application for License Renewal -

December 12, 2003. Requests for Additional Information Ladies and Gentlemen:

This letter is in response to your letter dated December 17, 2003, requesting additional information regarding Severe Accident Mitigation Alternatives (SAMAs) for Joseph M. Farley Nuclear Plant (FNP) Units I and 2. Responses to these Requests for Additional Information (RAls) are provided in the Enclosure.

FNP identified three cost beneficial SAMAs as a result of NRC requests for additional conservative assumptions and an expanded scope for the SAMA analysis. Southern Nuclear Operating Company's assessment of these cost beneficial SAMAs has determined that none of the proposed changes related to aging management.

If you have any questions regarding these responses, please contact Charles Pierce at 205-992-7872.

(Affirmation and signature on the following page).

A' 9<

U. S. Nuclear Regulatory Commission NL-04-0287 Page 2 Mr. L. M. Stinson states he is a vice president of Southern Nuclear Operating Company, is authorized to execute this oath on behalf of Southern Nuclear Operating Company and to the best of his knowledge and belief, the facts set forth in this letter are true.

Respectfully submitted,

-SOUTHERN NUCLEAR OPERATING COMPANY L. M. Stinson Vice President, Farley Sworn to and subscribed before me this da of 2004.

-- '7\\

z z:.

= 7 -

.7

i I

I "

.. I

,I

-Al), commission expires: (v -OJ-oS U

LMS/JTB/slb

Enclosure:

cc:

Southern Nuclear Operating Company Mr. J. B. Beasley Jr., Executive Vice President Mr. D. E. Grissette, General Manager-Plant Farley (w/ enclosure)

Document Services RTYPE: CFA04.054; LC# 13962 U. S. Nuclear Repulatorv Commission Mr. J. S. Cushing, Environmental Project Manager (w/ enclosure)

Mr. R. L. Palla Jr., Senior Reactor Engineer (w/ enclosure)

Mr. L. A. Reyes, Regional Administrator Mr. S. E. Peters, NRR Project Manager - Farley (wX enclosure)

Mr. C. A. Patterson, Senior Resident Inspector - Farley Alabama Department of Public Health Dr. D. E. Williamson, State Health Officer

Joseph AM. Farley Nuclear Plant Units I and 2 Application for License Renewal -

December 12, 2003, Requests for Additional Information Enclosure

Joseph M. Farley Nuclear Plant Units 1 and 2 Application for License Renewal -

December 12, 2003, Requests for Additional Information Enclosure

1. The SANMA analysis is based on the most recent version of the FNP Probabilistic Risk Assessment (PRA) for internal events, i.e., Revision 5, which is a modification to the individual plant evaluation (IPE) submittal transmitted to the NRC in June 1993. Please provide the following information regarding this PRA model:

a. a description of the internal and external peer reviews of the level 1, 2, and 3 portions of the PRA that have been performed since the IPE; SNC Response:

The Farley PRA model does not include a Level 3 analysis. As an integral part of the development of the Farley Level 1 and 2 PRA model pursuant to NRC Generic Letter 88-20, "Individual Plant Examination for Severe Accident Vulnerabilities", the PRA was repeatedly reviewed by an Independent Review Group which included experts in plant design, plant operation, and probabilistic risk assessment. Further, each subsequent revision to the model has been internally reviewed and approved in accordance with applicable SNC procedures. In addition, an evaluation based upon Appendix B of the EPRI PSA Applications Guide was performed to confirm that the PRA conforms to the industry state-of-the-art practices with respect to the scope of potential plant scenarios.

In August 2001 (prior to performance of the License Renewal Application SAMA analysis), the Revision 4 Farley PRA was extensively reviewed by an experienced five-man Peer Review Team coordinated by the Westinghouse Owners Group in a manner described in the Nuclear Energy Institute's document NEI 00-02, "Industry Peer Review Process". This review included the Level 1 and Level 2 portions of the PRA.

b. a description of the overall findings of the Westinghouse Owners Group PRA Peer Review (by element) and discussion of any findings/observations (e.g., A and B Facts and Observations) that could potentially affect the SAMA identification and evaluation process, and how SNC has addressed these findings for this application (including for example sensitivity studies of the impacts of alternative assumptions);

SNC Response:

As stated above, the Westinghouse Owners Group peer review was performed on Revision 4 of the Farley PRA model in August 2001. The overall findings of the Westinghouse Owners Group PRA Peer Review (by element) are summarized in the following tables. A recommended element grade follows each section (denoted by either conditional or X). Following the tables is a discussion of the findings/observations, Southern Nuclear Operating Company (SNC) responses and the potential impact on SAMA identification and evaluation process developed for the FNP License Renewal Application.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 2 of 75 ELEMENT: INITIATING EVENTS (JE)

Guidance: There is no specific guidance document for this element. However, the process used was consistent with industry practice, was well documented, and in general provided sufficient detail for reproduction of the analysis.

Grouping: lEs were developed via a process of a review of plant specific experience, industry documents, and an assessment of the effects of loss of support trains or systems.

Treatment of Support System/Special Initiators: In order to identify the special initiating events, the system drawings, abnormal operating procedures, and FSAR were reviewed. Fact and Observations in the system element (SY-02 and SY-07, both significance B) may affect the loss of CCW and loss of SW initiating event frequencies.

Data: The initiating event frequencies are, in general, consistent with industry experience or analyses. Plant specific experience is reflected in the frequency of initiators. There was an observation regarding the calculation of the frequency of the interfacing system LOCAs (Fact and Observation EE-2, Level B significance) concerning the correlation of valve failure data.

(Also see related ISLOCA recommendations in other elements.) Fact and Observation IE-3 (Significance Level B) notes that the frequency of the initiator for spuriously open pressurizer safety valves is very conservative.

Documentation: In general the documentation reflected the process used. Fact and Observation DA-4, significance level C, suggests improvements in the documentation of the identification of support system initiators. Fact and Observation EE4, significance level C, addresses improvements in the overall IE documentation.

Recommended Enhancements: Revise the ISLOCA analysis. Provide the bases for not including the noted failure modes in the special initiators. Review the frequencies for the pressurizer safety valves.

Overall Process Assessment: With resolution of the items noted above, the initiating event analysis will support risk significance evaluations with deterministic input.

Recommended Element Grade:

Grade I - Supports Assessment of Plant Vulnerabilities Grade 2 - Supports Risk Ranking Applications conditional Grade 3 - Supports Risk Significance Evaluations w/Deterministic Input Grade 4 - Provides Primary Basis For Application

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 3 of 75 ELEMENT: ACCIDENT SEQUENCE EVALUATION (AS)

Guidance: There is no current guidance document for this element (F&O AS-06, significance C). The IPE plant response tree guidance document is available but it is geared toward the large event tree methodology used in the IPE rather than the current linked fault tree CAFTA model. It is not clear that that guidance is still applicable. Even so, the process appears to be consistent with industry practice. The level of documentation is uneven, but most, but not all, elements of the analysis could be reproduced with equivalent results.

Success Criteria and Bases: Functional success criteria have been developed for reactivity control, RCS inventory, RCS pressure, and containment pressure. They are based on a combination of generic and plant specific realistic thermal hydraulic analyses. MAAP is referenced in the large LOCA success criteria. This code is no longer considered appropriate for that type of event (F&O AS-05, significance C).

Accident Scenario Evaluation (Event Tree Structure): The IPE plant response trees were converted into functional top level event trees to be used as the backbone for a CAFTA linked fault tree model. Since that time the event trees have taken on a secondary importance and are maintained only as an aid to understand sequences, and tracking down obscure cutsets. The CAFTA model contains most of the sequences expected by the reviewers. There was no evident use of success events for large split fraction nodes (F&O AS-03, significance C). The plant damage state information was purposely not retained during the CAFTA conversion (F&O AS-04, significance C). Alternate mitigation equipment is not always credited (F&O AS-07, significance C). The SGTR sequences with successful high head injection do not require ruptured SG isolation (F&O AS-01, significance B). The UET calculation is used in the ATWS tree and has not been updated since the IPE (F&O AS-10, significance C). The ISLOCA initiator dependencies have not clearly been considered (see F&O AS-11, significance B).

Interface with EOPs/AOPs: The plant EOP's were not specifically reviewed, however the event tree sequences were developed following, and are consistent with, the WOG ERG's.

Accident Sequence Endstate Definition/Treatment: The outcome of each event tree sequence is either a safe, stable plant condition (fulfilling the success criteria established for the core) or a potential core damage state.

Documentation: The level of documentation is uneven. F&O AS-02, significance C, documents the most significant items identified during this review. While most of the desired information is available it is often difficult to find and not of sufficient detail to verify that the process used was rigorously followed. However, the results seem reasonable compared to similar plants.

Recommended Enhancements: Address the items noted above and in the associated significance B F&Os.

Overall Process Assessment: With resolution of the items noted above, the accident sequences analysis will support risk significance evaluations with deterministic input.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 4 of 75 ELEMENT: ACCIDENT SEQUENCE EVALUATION (AS)

Recommended Element Grade:

Grade I - Supports Assessment of Plant Vulnerabilities Grade 2 - Supports Risk Ranking Applications conditional Grade 3 - Supports Risk Significance Evaluations w/Deterministic Input Grade 4 - Provides Primary Basis For Application

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 5 of 75 ELEMENT: THERMAL HYDRAULIC ANALYSIS (TH)

Guidance: Event sequence termination criteria are clearly defined in the IPE Success Criteria notebook. This served as a very good guide for the IPE and subsequent updates, such as shown in the PSA Summary Report, Revision 4a.

Best Estimate Calculations: The majority of plant specific MAAP calculations use MAAP 4.0.3. A few MAAP 3.0B cases appear to be a carryover from the IPE. The newer MAAP cases confirm the existing success criteria although credit for the relaxed criteria has not yet been used (Fact & Observation AS-9, significance level C).

The documented definition for core damage (>1200 F for greater than 30 minutes) is informally being replaced with simple core uncovery. This should be formalized (Fact & Observation AS-9, significance level C) in order to bring the higher tier definitions up to date and avoid potential confusion and/or conflicts.

While no errors were noted in the MAAP results, Fact & Observation TH-2, significance level C, suggests that the documentation should strive to avoid potential interpretation errors due to the ability of code users to specify different input and output units for the various parameters (e.g.,

pressures can be expressed in psia, psig, or Pascal, and it is not always clear from the output results what the units are).

Room Heat Up Calculation: Plant specific calculations were performed to assess the need for ventilation and room cooling.

Documentation: Information is contained in comprehensive WPE documents and various revisions and supporting calculations to that material.

Recommended Enhancements: Over an extended period of time, the flow of information has become disjointed. A "roadmap" (Farley PRA Document Map) to the PSA model documentation is a good beginning to make specific subjects, topics, information, and details easier to locate and cross reference.

Overall Process Assessment: The thermal hydraulic analysis element supports risk significance evaluations with deterministic input.

Recommended Element Grade:

Grade I - Supports Assessment of Plant Vulnerabilities Grade 2 - Supports Risk Ranking Applications X

Grade 3 - Supports Risk Significance Evaluations %v/Deterministic Input Grade 4 - Provides Primary Basis For Application

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 6 of 75 ELEMENT: SYSTEMS ANALYSIS (SY)

Guidance: Guidance was generally available for most activities in this element. In some cases, the guidance was provided by the IPE-era documentation. In other cases, information from the CAFTA conversion notes also applied. Information from the 4a Summary document also was applicable in many cases. The guidance for fault tree modeling was given primarily by the IPE-era Fault Tree Modeling Guidelines. These were no longer wholly applicable. For example, they described the importance of and approaches for modularization, a practice now abandoned by the Southern Nuclear PSA group. Suggestions were provided to update the guidance.

Systems Modeled: The set of systems modeled seemed appropriate. A review per the peer review process guidance was performed of a subset of plant models. The models were available for review in electronic form only. Generally they seemed to reasonably represent the intended plant systems and functions. Some enhancements were suggested.

System Model Structure (Fault Tree): A review (within the constraints of the limited time available during the peer review) was performed of electric power, service water, closed cooling water, and auxiliary feedwater system models. The models were found to be acceptable, however a number of areas for potential improvements were suggested (see F&O's SY-2, significance B; and SY4, significance B). These suggestions included modeling the ability to supply the CST or AFW with SW, adding some components to system models, including strainers (obstruction failure mode) and relief valves (flow diversions), adding a new failure mode to SW and CCW (trip of running pump and discharge check valve failing to close, creating a recirculation path), and enhancing common-cause failure modeling (SY-07, significance B).

Enhancement of the DG system modeling is also suggested (SY-03, significance B) to include the fuel oil storage and transfer system.

Success Criteria: Success criteria for plant systems modeled seemed generally appropriate.

Support system requirements for frontline system success were also examined and additional review of the following was suggested (F&O SY-5, significance B): For dual-unit station blackouts, documentation indicates that station batteries will provide two hours of support to unit I and one hour of support to unit 2. Some sequences in the current station blackout event tree assume at least 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months of success by the TDAFWP. However, this presumes that DC-powered SG level instrumentation remains available for that duration. These assumptions should be revisited to determine if battery lifetime information should be changed or the model changed (or additional clarification provided).

Recommended Enhancements: As the comments above describe, updating and correcting dated documentation is suggested, and some model changes are also suggested. Note that some suggestions may have implications for systems not examined. Where appropriate other systems should be reviewed for concerns similar to those identified in the F&Os noted above for the electric power, SW, CCW, and AFW systems.

Overall Process Assessment: With resolution of the significance "B" level comments noted above, the Systems Analysis supports risk significance determinations with deterministic input.

Recommended Element Grade:'

Grade I - Supports Assessment of Plant Vulnerabilities Grade 2 - Supports Risk Ranking Applications conditional Grade 3 - Supports Risk Significance Evaluations w/Deterministic Input Grade 4 -Provides Primary Basis For Application

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 7 of 75 ELEMENT: DATA ANALYSIS (DA)

Guidance/Documentation: There is no specific guidance document for this element, however, the process used is consistent with industry practice, was documented, and provides sufficient detail for reproducing the results.

Plant Specific Component Data: Realistic generic estimates were used and supplemented by plant specific evidence. Similar components were grouped together in a reasonable fashion and the grouping is supported by documentation.

System/Train Unavailabilities: The system maintenance unavailabilities are derived based on plant specific data.

Common Cause Failure Quantification: The CCF analysis is unchanged from the IPE and does not reflect the data bases developed by the NRC. The common cause failure probabilities are referenced to an out of date source (Fact & Observation DA-2, significance level B). The PRA assumes that common cause failures are not possible between standby and operating components.

Fact & Observation SY-07, significance level B, addresses viability of this assumption in light of events in the INEEL CCF database. The CCF analysis also assumed that no common cause events were possible between the on-site emergency diesel generators of different designs, but did not discuss the potential for events caused by common maintenance crews, common 1&C technicians, similar procedures, or common fuel oil (Fact & observation DA-5, significance level B).

(Unique Unavailabilities or Data Modeling Issues, e.g., OlMsite Power Recovery Quantification): The unique unavailabilities were located and, with one exception, were reasonable. The exception deals with the data source used to develop the LOSP AC recovery curves and is addressed in Fact & Observation DA-7, significance level B.

Recommended Enhancements: Address the items noted above and in the associated significance B observations.

Overall Process Assessment: With resolution of the items noted above, the data analysis supports risk significance evaluations with deterministic input.

Recommended Element Grade:

Grade I - Supports Assessment of Plant Vulnerabilities Grade 2 - Supports Risk Ranking Applications conditional Grade 3 - Supports Risk Significance Evaluations w/Deterministic Input Grade 4 - Provides Primary Basis For Application

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 8 of 75 ELEMENT: HUMAN RELIABILITY ANALYSIS (HR)

Guidance: There is not a current guidance document for HRA analysis, although a Westinghouse guidebook is referenced in the IPE HRA Notebook. The IPE HRA Notebook provides an overview of the process for two HRA methods, SLIM and THERP. The application of SLIM and THERP as outlined in the notebook exhibited several shortcomings, as outlined in F&O HR-05, significance B.

Pre-Initiator Human Actions: The process used to identify pre-initiator human events excluded calibration errors. The basis for this exclusion is not consistent with current industry practice.

Several similar plants have identified significant calibration errors (F&O HR-04, significance B).

Post-Initiator Human Actions: The post-initiator human events were identified in a systematic fashion and evaluated using plant/sequence specific PSFs. The HEPs appear to be internally consistent and consistent with similar plants. All the HEPs were calculated using either SLIM or THERP and no screening values are used in the model.

Treatment of Dependencies: SLIM handles dependencies within the HEP only in an implicit manner. THERP does it explicitly. The IPE HRA analysis also explicitly considered dependencies between HEPs via a cutset search for multiple HEPs. This dependency search was no longer valid after the conversion to CAFTA. As part of the conversion a search for cutsets with multiple operator actions was made by increasing all the HEPs to 0.1 as part of a sensitivity study. However, this study was not documented and there is no guidance to ensure that this evaluation will be continued after future model revisions (F&O QU-02, significance C). Also, as a result of the CAFTA conversion, several HEPs appear in sequences for which they were not analyzed (F&O HR-01, significance B). There was also one instance in which a basic event was omitted during the emergency air system model changes. This omission prevents the mutually exclusive file from deleting related inappropriate cutsets (F&O HR-03, significance B).

Documentation: The HRA analysis results are contained in several documents. They reflect the general basis for the HRA analysis but do not provide the details necessary to verify the basis for all of the sub-tier criteria for this element. The current HRA notebook had not been signed off by a reviewer at the time of the peer review, and it was not clear to the reviewers that the HRA documents have received adequate review by plant Operations. Operations expertise is important to verify the assumptions and modeling details (see F&O HR-07 and HR-08, both significance C).

Recommended Enhancements: Address the items noted above and in the associated significance B F&Os.

Overall Process Assessment: With resolution of the items noted above, the HRA will support risk significance evaluations with deterministic input.

Recommended Element Grade:

Grade I - Supports Assessment of Plant Vulnerabilities Grade 2 - Supports Risk Ranking Applications Conditional Grade 3 - Supports Risk Significance Evaluations w/Deterministic Input Grade 4 - Provides Primary Basis For Application

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 9 of 75 ELEMENT: DEPENDENCY ANALYSIS (DE)

Guidance/Documentation: The guidance for identification and modeling of dependencies was developed as part of the IPE. The IPE used a support state methodology and as such, the search for dependencies was necessarily a focal point of the analysis. The search for functional and phenomenological dependencies between systems, environments, and operator actions meets the peer review criteria.

Dependency Matrices: A detailed, complete dependency matrix was developed for the IPE.

When the PRA was convened to a linked fault tree model, the dependency matrix is no longer maintained. The dependencies are maintained through the linked fault tree top logic model.

Common Cause Treatment: Common cause treatment generally follows the methods in NUREG/CR4780. However, several observations from the Data and Systems Review found missing or incomplete common cause modeling (F&Os DA-02, SY-07, and DA-05, all significance B).

Spatial Dependencies: Spatial dependencies for room cooling, inadvertent fire sprinkler actuation, flooding, and water spray were modeled. Environmental fouling of the SW intake structure components were not included (F&O DE-01, significance C).

HI Dependencies: The HI human dependencies were an integral part of the original HRA analysis. Identification of dependent HIs in the same cutset and calculation of conditional HEPs upon the failure of a previous action were done for the IPE and carried forward in the present model. (See the HR element for additional discussion.)

Recommended Enhancements: The recommended'enhancements for.this element all involve the additional common cause failure modeling. These actions are also identified in F&O's for other tasks. No enhancements are recommended solely for the purpose of the dependency element.

Overall Process Assessment: The dependency methods and process are suitable to support risk significance evaluations with deterministic input. Related information regarding dependencies is also provided in the summaries for other PRA elements.

Recommended Element Grade:

Grade I - Supports Assessment of Plant Vulnerabilities Grade 2 - Supports Risk Ranking Applications X

Grade 3 - Supports Risk Significance Evaluations w/Deterministic Input Grade 4 - Provides Primary Basis For Application

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page IO of 75 ELEMENT: STRUCTURAL RESPONSE (ST)

Guidance/Documentation: The structural element comprises four areas of analysis: RPV integrity, probabilistic treatment of pipe rupture for ISLOCA, probabilistic treatment of flood barriers, and probabilistic treatment of containment failure strength. The Farley PRA did not sufficiently address all these issues. For the issues addressed (RPV and containment failure strength) the process guidance was developed from accepted industry programs.

RPV Capability: The ATWS analysis for Farley is based on WCAP-l 1993. The PTS evaluation is based on WCAP-10139. Both methods are state of the art and fulfill the criteria for this subject element.

Containment Capability: The ultimate containment failure strength was evaluated as part of the Level 2 IPE. The mean failure pressure was 116 psig. The evaluation was performed in accordance with acceptable industry procedures.

Pipe Overpressurization: The ISLOCA analysis does not address the ultimate strength capacity of the interfacing pipes (F&O ST-01, significance B). The probability of pipe failure upon pressurization beyond design strength is considered to be synonymous with the probability of pipe rupture. A hoop stress calculation was performed for the RHR suction lines to justify they will not be the site of the ISLOCA. However, the methods and process of NUREG/CR-5124 was not utilized for the PRA.

Probabilistic treatment of flood barriers (F&O ST-02, significance B) was not addressed in the Farley PRA. Flood doors and, drains were assumed to function as designed in the flood analysis.

Recommended Enhancements: The recommended enhancements to ISLOCA and flooding should be implemented as indicated in the F&O's.

Overall Process Assessment: With resolution of the items noted above, the ST technical elements will support risk significance evaluations with deterministic input.

Recommended Element Grade:

Grade I - Supports Assessment of Plant Vulnerabilities Grade 2 - Supports Risk Ranking Applications conditional Grade 3 - Supports Risk Significance Evaluations w/Deterministic Input Grade 4 - Provides Primary Basis For Application

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 11 of 75 ELEMENT: QUANTIFICATION (QU)

Guidance/Documentation: Although there is no specific guidance document for the PRA element QU, the quantification process is being applied in a reasonable manner. Suggestions have been made to enhance the documentation and guidance provided in the Rev 4a Summary Document, which is a good place to supplement the existing information, as discussed in F&O QU-1, QU-2, and QU-5.

Dominant Sequences: Core damage and LERF cutsets are reported. Accident sequence frequencies or cutsets are not reported. There are no review team observations (F&Os) on specific dominant sequences. An F&O (QU-6, significance B) is provided regarding performing and documenting a comparison of dominant sequences with those from "similar" plants. A separate observation (F&O QU-7, significance B) recommends some additional consideration of modeling affecting currently non-dominant sequences.

Truncation/Recovery Analysis: The models are quantified with appropriately low cutoff probability. Recovery analysis is reasonable and is applied properly to the PRA model.

Uncertainty: Quantitative uncertainty analysis is not performed. No strong recommendation to perform such an analysis is given by the review team.

However, the existing sensitivity analyses should be expanded/documented to respond to the need to demonstrate an understanding of sources of uncertainty inherent in the model and their potential impacts on PRA applications (see F&O QU-3, significance B).

Results Summary: The CDF/LERF quantification methods and tools are compatible with the state of the art PRA methods and tools. The documentation is on a good path to be very useful for future updates, with some enhancement.

Recommended Enhancements: The following recommendations are provided to remove the contingency from the grade assigned:

Respond to F&O QU-3 by performing and documenting a systematic search/analysis of unique or unusual sources of uncertainty not present in the typical generic plant analysis.

Respond to F&O QU-6 by providing documentation for review of cutsets from similar plants to assure that potentially dominant cutsets are not missing.

Respond to F&O QU-7 by providing documentation for review of non-dominant cutsets to establish they are reasonable, not deleted inappropriately, and are not overly conservative.

Overall Process Assessment: With resolution of the items noted above, the PRA quantification element will meet the criteria to support risk significance evaluations with deterministic input.

Recommended Element Grade:

Grade I - Supports Assessment of Plant Vulnerabilities Grade 2 - Supports Risk Ranking Applications conditional Grade 3 - Supports Risk Significance Evaluations wv/Deterministic Input Grade 4 - Provides Primary Basis For Application

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 12 of 75 ELEMENT: CONTAINMENT PERFORMANCE ANALYSIS (L2)

Guidance/Documentation: Guidance for the Level 2 process is clearly laid out in the IPE.

Conversion from Plant Response Trees to a linked fault tree is addressed in a 1997 PRA revision.

Additional modifications to the process are streamlined in the PRA Summary Revision 4a report.

Level I/Level 2 Interface: The current Level 2 analysis is represented by a LERF model in CAFTA. The LERF model is derived from the original IPE Level 2 analysis. The link between the two models is easily traceable.

Phenomena CETs/HEPs/System Considered/Success Criteria: Severe accident phenomena were evaluated in the IPE and remain valid. No HEPs were identified following core damage.

Success criteria were simple, yet realistic. Evidence of equipment survivability post-accident considerations seemed to only consider containment electrical penetrations (F&O L2-2, level C significance).

Containment Capability Assessment: An ultimate containment strength evaluation was performed for the Level 2 IPE. Severe accident phenomenological evaluations also conducted for the IPE checked for potential vulnerabilities and the need (none identified) for detailed probabilistic studies.

End-state Definitions: Plant damage states were defined for the original Level 2 model, but are not included (or needed) in the current simplified LERF model.

LERF Definition: The LERF definition is consistent with the WOG criteria, but is somewhat behind current trends (Fact and Observation L2-1, level B significance).

Recommended Enhancements: The LERF definition should be revisited to ensure that sequence timing considers releases within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months of core damage in the LERF total. The Severe Accident Management Program has been implemented for several years. At some point, the LERF model should take credit for the proceduralized methods (F&O L2-3, level C significance). This would have additional benefits if a Level 3 analysis was subsequently evaluated.

Overall Process Assessment: With resolution of the items noted above, the Level 2 element meets the criteria to support risk significance evaluations with deterministic input.

Recommended Element Grade:

Grade I - Supports Assessment of Plant Vulnerabilities Grade 2 - Supports Risk Ranking Applications conditional Grade 3 - Supports Risk Significance Evaluations w/Deterministic Input Grade 4 - Provides Primary Basis For Application

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 13 of 75 ELEMENT: MAINTENANCE AND UPDATE PROCESS (MU)

Guidance: The guidance provided by REES procedures 2-2, 2-3, 2-4, 2-5,2-6, 2-8, and 2-9 provide adequate guidance with respect to how to update the PRA model and some of its derivative tools. However no clear criteria were found explaining how to determine when PRA derivative products should be updated.

Input: A guidance procedure described the list of inputs to be evaluated in considering an update to the PRA. The list was detailed and was consistent with the one provided in the evaluation criteria for the MU element.

Model Control: Model control practices met specified requirements. A suggestion was provided that a read-only copy of the current model be provided on the network and that a copy of this be used as a starting point for PRA analyses.

Update/M~1aintenance: The update and maintenance process is adequately addressed by the group's update procedures. Additional guidance is suggested regarding when a non-periodic update should be performed, as the result of emergent plant changes.

Application Re-evaluation: Procedural guidance is provided to remind PRA staff members to consider whether to reevaluate applications, but little guidance is given to help them determine if reevaluation is or is not required. It is suggested that additional guidance be provided.

Documentation: Documentation is provided regarding the changes which were made. However, documentation was not retained detailing how inputs to the update process were dispositioned (see F&O MU-2, significance "B").

Recommended Enhancements: Provide additional guidance to help determine when a model update should be performed based on emergent plant changes. Provide additional guidance to help determine when applications must be reevaluated. Change the input evaluation process documentation practices to improve traceability.

Overall Process Assessment: With resoluiion of the one B-level F&O noted above, the maintenance and update process supports risk significance evaluations with deterministic input.

Recommended Element Grade:

Grade I - Supports Assessment of Plant Vulnerabilities Grade 2 - Supports Risk Ranking Applications conditional Grade 3 - Supports Risk Significance Evaluations w/Deterministic Input Grade 4 - Provides Primary Basis For Application

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 14 of 75 No Facts and Observations classified as significance level "A." were issued during WOG Peer Review of the Farley Revision 4 PRA model. Those Facts and Observations classified as significance level "B" and the SNC Response to the observation are discussed below. (Level "B" is defined as important and necessary to address, but may be deferred until the next PRA update (Contingent Grading Item).) The Revision 5 Farley PRA (issued in December 2001 prior to the SAMA analysis) included changes to address some of the peer review findings. These changes are identified in the responses to each issue. The Observation numbers and issue descriptions used below are from the Final WOG Peer Review report for the Farley PRA. Therefore, gaps exist in the numbering because the Level C and D findings are not included in the response.

Observation IE-2 Issue: The Interfacing System LOCA Frequency notebook documents the development of the ISLOCA initiating event frequency. When calculating the probability of failure of valves in series (i.e., RHR discharge and suction), the probability of failure was not correlated (pages 28-31).

The correlation is dependent on the variance of the probability distribution, which is usually quite large for valve rupture probabilities. The necessity of correlating variables is discussed in NUREG/CR-5744, "Assessment of ISLOCA Risk-Methodology and Application to a Westinghouse Four-Loop Ice Condenser Plant."

That NUREG also provides an overall ISLOCA evaluation approach that is generally accepted as more realistic than the approach used for the Farley IPE, addressing in more detail such factors as alternate pathways resulting from failures of other equipment (e.g., heat exchangers, relief valves) in the interfacing systems.

SNC Response to the Observation: PRA Revision 5 updated the ISLOCA analysis using the guidance in NSAC-154, NUREG/CR-5102, NUREG/CR-5744 and NUREG/CR-5682. This revised analysis treats each potential ISLOCA pathway as a separate event tree considering the potential for pathway isolation and mitigating system impacts. The ISLOCA initiating event frequencies for the revised model are calculated using a Monte Carlo equation to address uncertainties in each component failure mode making up the initiating event frequency. This also ensures proper correlation of failure rates for identical components. The revised ISLOCA modeling was independently reviewed by an outside contractor to ensure that the analysis meets current industry standards. Therefore, this issue was resolved prior to the SAMA analysis.

Observation IE-3 Issue: The Farley PRA includes initiators PSVI and PSV2 for one and two stuck open primary safety valves, respectively. The LE frequencies of PSV I and PSV2 are stated as 0.0047/yr and 3.4E 4/yr. The initiating events have Fussel Vessely values of.064 and.017. This means approximately 8% of the CDF is due to stuck open safety valves. This result is unusual for Westinghouse PWRs.

The IE frequencies for these initiators should be reviewed, including examining the data in NUREG/CR-5750. LERs noted in NUREG/CR-5750 indicate that there have been 2 events where a safety valve opened spuriously. Both of those events occurred at a single plant, and were due to the existence of loop seals downstream of the safety valves. The loop seal in the line was lost, effectively lowering the safety valve setpoint, so that the safety valve opened. The valve reclosed and the SI actuation setpoint was not reached (reactor was manually tripped). These events are not applicable to Farley unless the piping configuration is similar. Further, the reviewers believe that the only events where two safety valves have been challenged in response

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 15 of 75 to a transient have occurred at plants without pressurized PORVs. There is no evidence of spurious opening of 2 safety valves in NUREG/CR-5750.

SNC Response to the Observation: Revision 5 of the Farley PRA included a re-analysis of initiating events PSVI and PSV2. It was concluded that these events were included in NUREG/CR-5750 as functional impacts rather than initial plant fault events. Since the Farley linked fault tree model explicitly models stuck open safety valves as a consequential LOCA, the inclusion of initiating events PSVI and PSV2 were considered overly conservative and the events were removed. Therefore, this issue was resolved prior to the SAMA analysis.

Observation AS-01 Issue: The SGTR event tree does not question isolation of the ruptured SG if HHSI is available.

Sequence 2 even allows a success state without isolation for recirculation after feed and bleed.

The distinguishing factor between the SGTR and SLOCA is the loss of primary inventory from containment for a SGTR. An analysis supporting injection capability for the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission time with this continued loss of inventory could not be located.

SNC Response to the Observation: The Steam Generator Tube Rupture success criteria have been reviewed and verified to cover the case of successful operation of HHI and AFW as a safe, stable end state for the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission time. Therefore, this issue was resolved prior to the SAMA analysis.

Observation AS-11 Issue: ISLOCA initiating event frequency is calculated as a separate calculation and the EE frequency, taken as the sum of frequencies for all scenarios evaluated, is input into the event tree, which models a "limiting case". The dependencies between the events causing ISLOCA (i.e., the individual ISLOCA scenarios) and the systems mitigating ISLOCA are not considered. There are two possible considerations missing from this approach:

1. ISLOCA can occur in the charging pump suction line, the seal water return line, and the excess letdown heat exchanger. The fault tree asks for makeup from HHSI and assumes all 3 HHSI pumps are available, without verifying that the HHSI suction is intact after the ISLOCA initiating event. The ISLOCA or the flooding effect of the ISLOCA could fail one or more of the HHSI pumps and they would not be available for make-up.

2. The RHR discharge and suction lines contribute about 20%c to ISLOCA initiating event frequency. These breaks could be 6"-O" breaks. The tree assumes 120gpm make-up is adequate to mitigate the break. 120 gpm is adequate for decay heat 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months after shutdown. A 10 " break would blow down much faster and the assumption of 120gpm would not be appropriate.

SNC Response to the Observation: This issue was addressed by the general update of the ISLOCA modeling in PRA Revision 5. For a more detailed description of the model changes, see the response to observation IE-2.

Observation SY-02 Issue: This element asks if the model matches the as-built, as-operated plant, including information in the AOPs and EOPs. A brief review was performed, focusing on the system models for electric power, CCW, SW and AFW. The model fidelity with plant systems as

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 16 of 75 described in available documentation generally seemed good, but there were a number of apparent differences which should be resolved.

(L.) Plant procedures address alignment of service water as a long-term source of CST/AFW supply but this does not appear in the model. If CST inventory is guaranteed to be adequate for the PRA mission time, then some discussion of this in the documentation should be provided. If not, the SW supply (or other applicable means of decay heat removal) needs to be modeled. (See F&O SY-04 for Element SY-3 for further elaboration).

(2.) There is a check valve, NIP16V538, in the turbine building SW return line which the modeling assumptions (p. 211) indicate is not modeled because it is "non-safety grade." To match the "as-built, as-operated plant," the appropriate failure modes for this check valve should be modeled, irrespective of the safety-grade classification of the valve. Possibly-these modes could include failure to close, failure to open (for scenarios where there is an interruption in SW flow), and transfers closed.

(3.) The SW pump discharge check valve fails-to-close should be added as a failure mode for the other pump(s) in that train. That is, if a running pump fails to run (or trips and fails to restart, such as during a LOSP event) and its check valve does not seat, a recirculation path back to the SW pond is created and the output of the remaining "good" pump(s) will be diverted. Since the pump will be running, this event may be harder for operators to detect than a simple failure of two pumps to function. The model should be reviewed to see if there are other systems where modeling this failure mode might be appropriate.

(4.) Strainer faults (main and lube/cooling water), as well as common-cause events involving strainers, should be modeled. Traveling screen failures should also be modeled. Modeling assumptions indicate that debris blockage is not expected and that the screens are not "water tight," apparently indicating that there is a significant amount of bypass flow. It would be better to put the screens in the model and let the quantification demonstrate their (non)-importance.

Note that strainer/screen fouling has occurred at plants due to introduction of man-made material (trash at one plant, Furmanite concrete patch material at another), so this failure mode is possible even if the suction pond is relatively clean. Also, consider that if bypass flow around screens is sufficient to render them unnecessary, then they may not be providing the protection they are designed to provide.

(5.) CCF of all service water pumps should be added to the model. It was not clear to the reviewers if these pumps are all of identical manufacture, but there are many common elements associated with their installation and use. The model should be reviewed to see if there are other systems where common-cause failures need to be applied to n of n components (such as CCW).

(6.) There is apparently a SW control air system. The reviewers did not find a modeling assumption justifying why this system does not need to be modeled. If this system does not need to be modeled, such justification should be provided.

(7.) This comment is applicable to emergency air, and possibly other systems. Spurious opening of safety/relief valves should be added as failure modes to systems where this could impair function (e.g. Emergency air system safety/relief valves on compressor and receiver). See also F&O SY-06 related to CCW relief valves and flow diversions.

SNC Response to the Observation: With regard to item 1, CST inventory has been shown to be adequate for all analyzed scenarios, including the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission time following Very Small

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 17 of 75 LOCA or General Transient initiating events. However, to ensure completeness of the model, the Service Water System backup feed for AFW was incorporated in Revision 5.

With regard to item 2, failure of this check valve will only impact the cooling for the Main Feedwater pumps and Condensate pumps. The only events which would interrupt the flow of service water through this valve would be a Loss of Offsite Power. Since the Main Feedwater Pumps and Condensate Pumps are not modeled for mitigation after an LOSP, this valve does not need to be modeled.

With regard to item 3, Revision 5 added failure of the discharge check valve on an idle pump as a potential failure mode to all pumps where appropriate (i.e, where the pumps are physically aligned to the same discharge path).

With regard to item 4, Revision 5 of the PRA model added plugging of the traveling screens, discharge strainers and lube an cooling strainers as potential failure modes for the system.

With regard to item 5, SNC has plans to develop a common methodology for common cause analysis to be used across all SNC PRA models. The application of common cause to groups including both running and standby equipment will be included in this methodology.

With regard to item 6, the SWIS instrument air system is used to control the SW pump miniflow valves (which fail closed) and to provide air to SW pond level instruments. No mitigating functions are impacted by the failure of SWIS instrument air.

With regard to item 7, many of the relief valves in Farley fluid systems are thermal relief valves designed to protect equipment from overpressure following its isolation. These valves are not expected to be challenged by normal system pressure transients. However, PRA Model Revision 5 did add potential failure of check valves to the CCW system since a relatively small volume loss in the system will lead to draining of the surge tank on the system. -In addition, other systems were reviewed during the preparation of PRA Model Revision 5 and verified to have relief valve failures included where appropriate.

All issues with the exception of the common cause modeling for the service water pumps were resolved prior to the SAMA analysis. Common cause modeling is further discussed in the response to Observation SY-07.

Observation SY-03 Issue: Enhancement of the level of modeling detail for Emergency Diesel Generators (EDGs) and their support systems is suggested.

The onsite emergency AC power system modeling was examined and it does not appear to include some detail expected by the reviewers. In particular, the fuel oil supply system to EDGs should be modeled if credit for DG run times greater than allowed by the day tank inventory is needed. A 24-hour DG run time is usually used, consistent with the PRA mission time (e.g., to cover all possibilities of power recovery for LOSP), and it is assumed that the day tank alone could not support a run of this length.

Assumption I I of the IPE Service Water System Notebook, Revision 0, June 1993 (Westinghouse Reference Numbers: CN-PORI-92-277 / CN-PORI-92-385) discusses the exclusion of Service Water strainers from the model. The component identifiers are not

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 18 of 75 specifically called out. It is assumed that the affected components are F5OIA and F5OIB. The following statements are from PRA Summary Rev. 4, Service Water section. "Plugging of the SW strainers is not included in the fault tree logic model. Plant experience shows that there has been no strainer plugging." (PRA Summary Rev. 4, Service Water section). Similar statements could have been made for other utilities until a significant event occurred (e.g., frazil icing of service water systems at Wolf Creek). Screening of apparent low failure items may mask their true importance to system functional success. It is believed that inclusion of the strainers in the appropriate fault tree would provide a more complete and current state-of-technology model for use in risk-informed applications.

Common-cause issues for DG fuel oil components and strainers should also be evaluated.

SNC Response to the Observation: PRA Model Revision 5 incorporated detailed modeling of the diesel generator fuel oil makeup system including appropriate common cause failures.

Revision 5 also incorporated modeling of all Service WVater system strainers and the intake traveling screens as noted above. Therefore, this issue was resolved prior to the SAMA analysis.

Observation SY-04 Issue: The AFW fault tree does not model alternate sources of condensate to the AFW pumps other than the CST. The AFW system notebook provides discussion of the SW supply to the AFW pump suction in the event the CST fails, but this capability is not modeled in the fault tree.

The plugging of the CST suction valve (XV501) has a Fussel Vessely value of.06. The failure probability for the valve is calculated from an elementary failure rate of IE-7/hr for 18 months.

This valve is virtually tested every time one of the motor driven AFW pumps is run from the CST. The test interval of 18 months seems too long. Realistic calculation of the valve failure rate should be considered.

Also, consider modeling the SW backup as a source of condensate to prevent core damage.

SNC Response to the Observation: As stated in the response to Observation SY-02, Service Water backup to the Auxiliary Feedwater Pump suction has been added in PRA Model Revision

5. In addition, the test interval for CST suction check valve XV501 has been changed to quarterly to better reflect the actual test conditions. This may still be somewhat conservative because of staggering of the motor-driven AFW pump surveillance tests, but because the amount of staggering between tests may vary depending on plant conditions, the quarterly interval is believed to be appropriate. Therefore, this issue was resolved prior to the SAMA analysis.

Observation SY-05 Issue: Modeling of support to important plant systems credited during LOSP sequences should be reviewed, particularly for dual-unit LOSPs, to ensure that assumptions are consistent and logical. For example, consider the following sequence: The SBO event tree indicates that given little or no RCP seal leakage and TDAFWP success, 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months are available for recovery of offsite power. It appears that the TDAFWP is modeled to succeed for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , until the emergency air system necessary for pump control and operation of SG PORVs fails. It is apparently assumed that core uncovery will not occur for at least 3 h after that time, and that recovery of offsite power within 5 h will allow restoration of RCS inventory, resumption of core cooling, and avoidance of core damage.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 19 of 75 There is an implicit assumption in this sequence that DC power will be available to support necessary instrumentation for at least the period of time that the TDAFWP is relied upon. For example, steam generator level indication supplied with DC power is necessary so that the TDAFWP can be controlled. Accordingly, availability of DC power for at least two hours is required for sequence success. However, document A-181004, "Electrical Distribution System) indicates that the plant IE 125 v batteries can support necessary loads for 2 hr on one unit and I hr on the adjacent unit. This appears to conflict with the model assumption.

SNC Response to the Observation: Documentation provided to the reviewers late in the review process revealed that the Electrical System Functional System Description (A-I 81004) statement concerning the battery capacity for Unit 2 was not correct. During an Electrical System Function System Inspection (EDFSI) at FNP, it was discovered that the Unit 2 batteries could not be verified to have sufficient capacity to operate all safety related components at the end of two hours with no battery charger support. However, design changes were completed in 1994 to restore the capability to operate all safety related DC loads at two hours. At that time, document A-] 81004 should have been revised to remove the referenced comment concerning the Unit 2 battery capacity, but was not. Therefore, the PRA modeling assumptions are correct, and appropriate SNC personnel have been informed of the error in document A-I 81004. Therefore, this issue was resolved prior to the SAMA analysis.

Observation SY-07 Issue: It is standard practice in the Farley PRA to not model any common cause between standby and operating components. While this practice may have been acceptable during the IPE time period, the INEEL CCF database provides some evidence of common cause dependencies between standby and operating components. Current practice suggests that you should identify and model common-cause failures which could prevent all similar components in a system from performing their intended function (for example: CCW pumps, SW pumps).

SNC Response to the Observation: SNC has plans to develop a common methodology for common cause analysis to be used across all SNC PRA models. The application of common cause to groups including both running and standby equipment will be included in this methodology. Where there are both normally running and standby pumps in a system at Farley, the operating cycle of the standby pump can be significantly different from those of the primary pump(s). Where there are significant differences in operating cycles, SNC does not feel that common cause failure (to run) due to simultaneous wear of all pumps is a credible failure mode.

Where pumps take a suction from a common source, failure of the suction source, including appropriate common cause failures, is modeled under each potentially affected pump. Therefore, SNC feels that the common cause modeling is appropriate as implemented in PRA Model Revision 5.

Observation SY-09 Issue: Documentation that a global evaluation has been performed to confirm the ability of important plant components to function as modeled in adverse environments was not identified.

There is no entry for this item in the "information roadmap" supplied to the reviewers.

SNC Response to the Observation: The guidelines for development of plant-specific Emergency Response Procedures (ERPs) based on the generic Westinghouse Owners Group Emergency Response Guidelines note that equipment credited should be capable of performing the required function in post-accident environments. This equipment is also typically included in

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 20 of 75 the Environmental Qualification program. Since no equipment is credited in the Farley PRA modeling which is not included in the ERPs, SNC considers that adverse environmental conditions have been appropriately considered for all modeled PRA components as part of the normal ERP development process.

Observation DA-02 Issue: The common cause failure probabilities are referenced to a 1990 data source. Given the extensive research on common cause events sponsored by the NRC since the time of the IPE, a more up-to-date common cause data source should be used.

Some of the common cause failure probabilities used in the PRA are significantly different than those from a recent generic data source, NUREG/CR-5497. It is recognized that the values in that document are unscreened values and are likely to be reduced by NUREG/CR-4780 screening process that the Farley employs.

SNC Response to the Observation: Farley common cause failure (CCF) analysis followed procedures suggested in NtJREG/CR-4780. NUREG/CR4780 procedures had been a generally accepted CCF analysis procedures until NUREG/CR-5485, was published in 1998. NUREG/CR-5485 is considered to be an enhanced version of NUREG/CR-4780.

According to the NUREG/CR-4780 (also NUREG/CR-5485), historical CCF events are specialized for a plant specific CCF. Farley performed plant specific CCF analysis. In a plant specific analysis, each historic CCF event is reviewed and its applicability to the Farley plant is determined. Different designs, environments, and operation modes are some of the factors affecting the applicability. A CCF event may be screened out, or applied with some probability, or applied with probability of I according to the effectiveness of plant specific defenses against the event.

It is a general observation that plant specific CCF analysis may result in lower CCF values than generic values because generic value could include contributions from events that are not applicable to plant specific cases. Sometimes, a generic value could be an order of magnitude higher than plant specific value (reference: Young G Jo. et al, "Effects of Operating Environments on the Common Cause Failures of Essential Service Water Pumps," Proceeding of International Topical Meeting on Probabilistic Safety Assessment, PSA02, October 2002, Detroit).

And thus, screening out of non-applicable events for plant specific CCF is a part of CCF procedures.

It is acknowledged that the common cause data needs to be updated to the later database published under the program which developed NUREG/CR-5485 and SNC has efforts underway to perform this update. However, there is no reason to expect that the probability of CCF events will be significantly increased by this update process. Therefore, the current analysis is believed to be sufficient to support the SAMA analysis.

Observation DA-05 Issue: There are two diesel generator common cause groups. One set includes the IC and 2C diesel generators and the other set includes the IB, 2B, and the 1/2-A diesel generators. These two sets are apparently of different design. However, there are other factors that should be considered in establishing common cause groups, including common maintenance crews,

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 21 of 75 common l&C technicians, similar procedures, common fuel oil, etc. It is recognized that, in the past, it was not common practice to consider common cause failures where substantial design differences existed. The basis for such practice lies with the practicality of implementation. In the case of the onsite emergency AC sources, no such implementation barriers exist.

SNC Response to the Observation: With respect to the diesels at FNP, plant operating experience has shown that the differences in design between the two types of diesels used are far more important factors in predicting diesel failure than any common elements between the two designs. Therefore, the current analysis is believed to be sufficient to support the SAMA analysis.

Observation DA-07 Issue: The loss of offsite power non-recovery curves were developed during the IPE based on data from NUREG-1032. The curves have not been updated for the PRA. NUREG/CR-5496, "Evaluation of Loss of Offsite Power Events at Nuclear Power Plants: 1980 - 1 996," is a more up to date data source.

SNC Response to the Observation: Although not implemented in PRA Model Revision 5 which was used for the SAMA analysis, SNC has begun its regular data update activities for the Farley model. As part of this data update, a preliminary analysis of updated Loss of Offsite Power experience has been used to update the appropriate offsite power recovery factors. The conclusion from this update is that the recovery factors used in PRA Model Revision S will likely be reduced in the data update. Therefore, the current analysis is believed to be sufficient to support the SAMA analysis.

Observation HR-01 Issue: The IPE HRA calculation developed HEPs for specific plant response trees. After the conversion to CAFTA, the linked fault tree allows them to be applied to other events. For example, HEP IDGOPOPERDGICHDE indicates that it was evaluated for use in the SBO event tree. When the event is followed up the single top CDF tree it is also found to be used in other event trees such as ATWS. There is no documentation that the calculation is valid for event trees other than SBO.

SNC Response to the Observation: The application of HEPs to sequences other than those for which they were analyzed in the IPE has always considered similarities in the events with regards to the expected PSFs and event timing. Therefore, the current analysis is believed to be sufficient to support the SAMA analysis.

Observation HR-02 Issue: The emergency and abnormal operating procedures are the basis for the HRA. The only update to the 1993 IPE HRA is the addition of two new operator actions and the revision of one operator action as documented in calculation PSA-F-00-01. There is no documentation that revisions to procedures have been evaluated for their impact on the HRA although discussions with the Farley staff indicate that at least one review has been done.

SNC Response to the Observation: All procedures used in the development of HEPs for the IPE were reviewed in 1999 to identify changes that could impact the HEP calculations. The only HEPs identified as potentially impacted by changes in procedures were those documented in

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 22 of 75 calculation PSA-F-00-001. The documentation of this review should have been included in calculation PSA-F-00-001, but was not. SNC will ensure that future calculations for HEP update include a record of the review of all FNP procedures used as the basis of an HEP. Therefore, this issue was resolved prior to the SAMA analysis.

Observation I-R-03 Issue: Discussion with Farley PRA staff regarding the logic behind gate OA-ARV in the mutually exclusive tree revealed that ARVLOCAL-----H had been omitted from the new emergency air system tree where OAB-A_4--D---H is used rather than OABA_4------H.

The omission of gate ARVLOCAL-----H from the new emergency air system tree prevents the mutually exclusive file from deleting inappropriate cutsets involving this event. The result is that both the independent and dependent operator actions will appear in cutsets that are appropriate only for the dependent operator action.

SNC Response to the Observation: Sensitivity analyses completed during the peer review indicate the referenced example had no impact on CDF because the combination of events involved occurs only on non-minimal sequences in the event tree. The noted problem was corrected in PRA Model Revision 5 and a review was done of all mutually exclusive logic to ensure that no further examples of this issue were present.

Observation I-R-04 Issue: There was no indication that miscalibration errors or common cause miscalibration errors were included. A reference was found that said miscalibration was ignored, because the high and low miscalibrations would cancel out. This reasoning does not follow.

SNC Response to the Observation: SNC considers equipment failure due to miscalibration in the development of common cause event probabilities for the affected instruments. Therefore, the current analysis is believed to be sufficient to support the SAMA analysis.

Observation HIR-05 Issue: The HRA uses two different methods for calculating HEPs - the Success Likelihood Index Method (SLIM) and the Technique for Human Error Rate Prediction (THERP). The implementation of these HRA methods is problematic for the following reasons:

1) Although several groups of plant Operations/Training personnel were involved in the assignment of SLIM weighting factors for the PSFs, this activity appears to have been dominated by two individuals who alone did the assignments for 1/3 of the HEPs and, in conjunction with a third individual, did the assignments for another 1/3 of the HEPs. The basis of the method assumes that the assignments would be done by a larger panel of experts.

2) The validity of the SLIM anchor points could not be verified during this review because the source is not identified in the HRA notebook and the referenced Westinghouse calc. note which contains the details regarding the anchor point source is on microfiche and was not readily available for review.

3) The THERP calculations contain 0.1 multipliers for operator training/qualifications in both the diagnosis and execution portions of the calculation. They also contain a 0.1 multiplier for a "slack

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 23 of 75 time recovery". These multipliers are not described in THERP and there is no justification for their use.

SNC Response to the Observation: With regard to item 1, the SLIM evaluation included not only the operating crews referenced in this observation, but also other licensed operators in the FNP Training department and General Office. Therefore, none of the SLI calculations were based on the assessments of only two or three individuals as implied. A review of the SLI calculation details in Appendix E of the Human Reliability Analysis notebook reveals that only two SLIs were based on input from fewer than 5 individuals. These two actions, OSIc and OSId, were not used in the IPE model and are not used in the current model. Of the remaining 34 actions evaluated with SLIM, 15 had the input of 10 licensed individuals, 2 had the input of 9 licensed individuals, 6 had the input of 8 licensed individuals, 5 had the input of 7 licensed individuals, 3 had the input of 6 licensed individuals and 3 had the input of 5 licensed individuals.

Therefore, the majority of the SLIM evaluations had the input from at least 8 licensed individuals and is considered to have met the intent of the methodology.

With regard to item 2, this was subjected to independent review at the time of the IPE and it was concluded that appropriate anchor points were selected for use. Therefore, the intent of the SLIM methodology has been met.

With regard to item 3, the noted weakness of using a 0.1 multiplier applied only to those human error events analyzed using the THERP methodology. In the Farley PRA model, THERP is used for pre-initiating event human errors and for limited recovery events. The major human error events for operator response to initiating events using the Westinghouse Emergency Response Guidelines such as alignment of Emergency Core Cooling System recirculation were evaluated using the SLIM methodology. The human error probabilities for the major operator responses to LOCA events have been compared with those used by other Westinghouse Owners Group plants, the Checklist for Technical Consistency in a PSA Model contained in the EPRI PSA Applications Guide (TR-105396), and have also been reviewed as part of the NRC benchmarking effort for the Significance Determination Process. No significant differences have been identified in these comparisons.

These issues will be resolved in an on-going project to perform a general update of the Farley HRA. However, based on the factors cited above, the resolution of these issues is expected to have little impact on the total core damage frequency and therefore will not affect the conclusions of the SAMA analysis.

Observation llR-09 Issue: There was little evidence of plant specific analysis to support the timing of the BRA quantification. For each HEP, timing constraints were established but the basis for these constraints was not referenced. It appears that many of the timing constraints are generic estimates or screening values.

SNC Response to the Observation: HEP timing constraints were established based on MAAP or THERP calculations performed as part of the IPE. These timing constraints have been provided to the Farley Training department for reference during operator simulator and job performance evaluations. This issue will be resolved in an on-going project to perform a general update of the Farley HRA. However, the resolution is expected to have little impact on the total core damage frequency and therefore will not affect the conclusions of the SAMA analysis.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 24 of 75 Observation ST-01 Issue: The ISLOCA analysis did not use probabilistic treatment of pipe rupture on overpressure, as indicated in NUREG/CR-5 124, NUREG/CR-5744, or similar studies. ISLOCA pathways were identified and the frequency of ISLOCA was calculated directly by examining potential valve failure modes in the ISLOCA pathways. This is actually the probability of pipe overpressure, but was used as the ISLOCA initiating event frequency.

In one case, (RHR suction) a hoop stress calculation was performed to show that the over pressure was within the ultimate strength of the pipe. This was used to justify that the suction pipes would not rupture. However, the ISLOCA was still assumed to be a medium size LOCA, and plant response was modeled on this basis.

SNC Response to the Observation: This issue was addressed by the general update of the ISLOCA modeling in PRA Revision 5. For a more detailed description of the model changes, see the response to observation IE-2.

Observation ST-2 Issue: The review of the flooding analysis provided no indication that probabilistic failure of the barriers to propagation of flood waters (doors, drains) was considered. Failure of doors includes structural failure as well as the probability the door is left open prior to the flood. Plugging of floor drains was not considered.

SNC Response to the Observation: SNC feels that plant administrative controls of doors used for flood area separation are sufficient to minimize the impact of this observation. Where flood barrier doors are left open for significant periods of time, this is evaluated by the maintenance rule program to ensure to risk exposure is small. If operating history shows that flood barriers are being opened for significant time periods, the regular PRA model update process will identify this issue and ensure appropriate changes are made to the model. Therefore, the current analysis is sufficient to support the SAMA analysis.

Observation QU-03 Issue: Although three sensitivity analyses are documented in section 3.4.4 of the Rev 4a summary report, no discussion of a systematic search for unique or unusual sources of uncertainty is provided or performed (qualitatively or quantitatively).

SNC Response to the Observation: SNC is following industry initiatives to develop an adequate methodology to perform uncertainty analysis to meet the intent of the ASME PRA Standard and the peer review process. The SAMA analysis included sensitivity cases to examine alternative ways of evaluating the impact of each SAMA. Therefore, this observation has no impact on the conclusions of the SAMA analysis.

Observation QU-06 Issue: There is no documented evidence that results (e.g., cutsets or sequences) from similar plants are reviewed to ensure that potentially important cutsets are not missing from the PRA model.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 25 of 75 SNC Response to the Observation: SNC feels that the grading of this element is inappropriate since no practical means of implementing the recommendation of this observation currently exists. Therefore, this is seen as a generic industry issue rather than a specific item to be addressed in the SNC PRA program. SNC has and will continue to use information in the WOG PRA Comparison Database to compare our distribution of core damage by initiating event with the results reported by sister plants to ensure that our PRA results are generally consistent with plants of similar design. Therefore, this observation has no impact on the conclusions of the SAMA analysis.

Observation QU-07 Issue: A sampling of non-dominant sequences (cutsets) were reviewed by the peer review team.

The cutsets were true to the success criteria and the fault logic. The cutsets were not illogical.

Although discussions with the Farley PRA staff indicates that they carefully checked the converted IPE cutsets against the IPE results, there is no documented systematic search mentioned for validation of non-dominant cutsets. To meet a grade 3 for non-dominant cutsets, documentation should be provided for a systematic reviewer of non-dominant cutsets to establish they are reasonable, not deleted inappropriately, and are not overly conservative.

The sub-tier criteria for QU-1 5 state that "in evolving the PRA to be used for risk based applications, overly-conservative assumptions should be eliminated to avoid biasing the results."

The review of the non-dominant sequences observed the instances of potentially "overly conservative criteria" given in attachment A to this F&O. Those are just a sampling of apparent conservatisms found in the IE-1 I cutset range. The overall effect of these is not known.

SNC Response to the Observation: The specific examples provided by the review team were evaluated during preparation of PRA Model Revision 5. Most of the issues raised were items included in the model at the recommendation of the independent review panel during the IPE.

The remaining item was a misunderstanding on the part of the reviewer. Therefore, no changes were made as a result of this observation and this issue was resolved prior to the SAMA analysis.

Observation L2-I Issue: The LERF analysis uses the 1998 WOG definition from ESBU/WOG-98-053.

Farley does not include Emergency Action Levels (EAL) in the LERF definition. The WOG definition dismisses the need to use EALs on the assumption that the operators would be sensitive to protection of the public. In accordance with the WOG definition, the "early" in LERF is defined as "within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months of the initiating event". A more common definition of "early" is "release within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months of evacuation". The SGTR accident sequences must be evaluated with respect to EALs to decide if they are LERF or Non-LERF. Sequences 4 and 5 are included as LERF, but Sequences 1, 2, 3 are currently non-LERF.

SNC Response to the Observation: SNC is continuing to follow WOG efforts to clarify the definition of LERF adopted by the Risk Based Technology Working Group. In the interim, SNC revised the LERF modeling in PRA Revision 5 to include all SGTR sequences as direct containment bypasses. In addition, all Steam Generators have been recently replaced at Farley Nuclear Plant which results in minimal exposure to induced tube ruptures at this point in plant history. Therefore, this issue was resolved prior to the SAMA analysis.

Observation MU-02

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 26 of 75 Issue: This element asks if the update steps are traceable using the available documentation.

Using the documentation available, it did not seem that it would always be possible to determine how the inputs to the model update (operating experience, plant procedure changes, plant modifications, etc.) were evaluated to arrive at the list of model changes needed.

SNC Response to the Observation: The calculation documenting PRA Model Revision 5 includes a discussion of each plant design change completed since the previous model update and documents the determination of potential impacts on the PRA model. Those items selected for incorporation are further documented as to how the model was changed to address them.

Therefore, this issue was resolved prior to the SAMA analysis.

c.

a breakdown of the internal events core damage frequency (CDF) by major contributors, initiators or accident classes, such as loss or offsite power (LOOP), station blackout (SBO),

transients, anticipated transient without scram (ATWIS), loss-of-coolant accident (LOCA),

interfacing systems LOCA (ISLOCA), internal floods, etc.;

SNC Response:

The following tables provide the breakdown of the Unit I CDF from the Revision 5 PRA model by initiating event category and by NUMARC accident class. Please note that these values reflect a change to the initiating event frequency for flooding of the cable spreading room with the system clapper valve tripped. This change was made in the SAMA analysis to more accurately assess the benefit of SAMA 118. The change resulted from an analysis of more recent data for the flooding exposure time which found that the clapper valve was only open an average of 102 hours0.00118 days 0.0283 hours 1.686508e-4 weeks 3.8811e-5 months per year'for the time period from 1993 through 2000 instead of the 1,489 hours0.00566 days 0.136 hours 8.085317e-4 weeks 1.860645e-4 months per year assumed in the Revision 5 model. This resulted in a reduction in the total CDF to 3.35E-05 per reactor year from the 3.86E-05 per reactor year referenced in the response to question l.d.

Unit I CDF by Initiating Event Category I

Initiating Event Category l CDF/reactor year Percentage of Total CDF Loss of Offsite Power 7.76E-06 23.21 Loss-of-coolant Accidents 1.97E-06 5.88 ISLOCA 3.34E-07 1.00 Steam Generator Tube Rupture 7.45E-08 0.22 Transients 5.59E-06 16.71 Special Initiators 1.61E-05 48.13 Internal Floods 1.63E-06 4.86 Total 3.35E-05 100.00

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 27 of 75 Unit I CDF by NUM ARC 91-04 Accidence Se uence Group Functional Group Core Accident Damage Percentage Sequence Definition Contribution IA NON-LOCA WITH LOSS OF HEAT REMOVAL 6.89E-06 20.59 IN INJECTION PHASE IB NON-LOCA WITH LOSS OF HEAT REMOVAL 6.53E-06 19.52 IN RECIRC PHASE IIA CONSEQUENTIAL LOCA WITH LOSS OF 9.78E-06 29.24 PRIMARY COOLANT OR HEAT REMOVAL IN INJ. PHASE IIB CONSEQUENTIAL LOCA WITH LOSS OF 6.34E-06 18.93 PRIMARY COOLANT OR HEAT REMOVAL IN RECIRC.

IC SBO WITH LOSS OF PRIMARY COOLANT IN 1.52E-06 4.53 INJECTION PHASE IID SBO WITH LOSS OF PRIMARY COOLANT IN 3.08E-08 0.09 RECIRCULATION PHASE IIIA SMALL LOCA WITH LOSS OF HEAT

]

.79E-07 0.54 REMOVAL IN INJECTION PHASE IIIB SMALL LOCA WITH LOSS OF HEAT 1.53E-06 4.57 REMOVAL IN RECIRC PHASE IIIC MLOALLO WITH LOSS OF HEAT REMOVAL 1.96E-07 0.59 IN INJECTION PHASE IID MLO/LLO WITH LOSS OF HEAT REMOVAL 6.09E-08 0.18 IN RECIRC PHASE IV ACCIDENT SEQUENCES WITH FAILURE OF 3.54E-10 0.00 REACTIVITY CONTROL VA LOCA OUTSIDE CTMT WITH LOSS OF 3.34E-07 1.00 INVENTORY CONTROL VB SGTR WITH LOSS OF INVENTORY 7.45E-08 0.22 CONTROL I

I

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 28 of 75

d. the approximate core damage frequency (CDF) and large early release frequency (LERF) for each revision to the PRA model, as described in Section 1.1 of Attachment F to Appendix D of the ER, and a description of the major reasons for the changes from the prior version; SNC Response:

CDF by Revision for Unit I CDF per reactor LERF per reactor Major changes from previous Revision year year revision 0 (IPE) 1.30E-04 4.47E-07 N/A 7.63E-05 6.29E-07

Conversion of model from large event tree to linked fault tree using CAFTA

Developed unit-specific models for Unit I and Unit 2 to support EOOS

Incorporated plant design changes completed since the IPE 2

8.72E-05 5.50E-07

Revised RCP seal LOCA modeling.

Revised SBO modeling.

Revised ATWS modeling to ensure proper application of UET.

Changed mission time for AFW to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for general transient initiating events.

Refined modeling of swing components to ensure all failure modes are addressed where train re-alignment is credited.

Revised LERF modeling to use LERF definition developed by the WOG Risk Based Technologies Working Group.

Incorporated plant design changes completed since previous revision.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 29 of 75 I

CDF by Revision for Unit 1 I

CDF per reactor LERF per reactor Major changes from previous Revision I year I year I revision 3

6.52E-05 4.50E-07

Updated component reliability data to include plant experience through 12/31/97

Updated initiating event frequencies using NUREG/CR-5750 generic data and plant experience through 12/31/97

Incorporated design changes for the instrument air system

Expanded modeling of the service water intake structure and turbine building DC systems to include alternate battery chargers and battery banks to support EOOS assessments

Revised SBO modeling to include SBO sequences in the fault tree rather than adding offsite power recovery during post-processing

Revised the ATWT modeling to ensure the proper success criteria for AFW are applied to the various cases

Added Very Small LOCA event tree

U. S. Nuclear Regulatory Commission N'L-04-0287 Enclosure Page 30 of 75 CDF by Revision for Unit I CDF per reactor LERF per reactor Major changes from previous Revision year year revision 4

5.57E-05 4.47E-07 Revised HRA for events where procedures had changed.

Updated flooding analysis for the Service Water Intake Structure and CCW pump/HX rooms.

Added System Model for emergency air compressors for atmospheric relief valves and AFW pumps.

Added Unit 2 SW lube and cooling booster pumps Incorporated plant design changes completed since previous revision.

5 3.86E-05 (The 4.19E-07 Revised model to address SAMA analysis WOG Peer Review used 3.35E-05 as comments.

noted in the Incorporated plant design response to changes completed since question I.c) previous revision.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 31 of 75

e. the changes in the leiel 2 methodology since the IPE submittal, including major modeling assumptions, plant response tree (PRT)/containment event tree (CET) structure; SNC Response:

The FNP IPE used PRTs that incorporated containment event tree (CET) aspects, as documented in the Farley IPE Submittal Report Section 3.1.4. Therefore, separate CETs were not applicable to the FNP IPE. For the current Rev. 5 model, the containment event tree is replaced by a table which assigns a designator to the sequence based on the status of the containment systems (FC, CS, CSR, and CQ). This containment function designator is combined with the NUMARC functional group designator of the core damage sequence to specify a unique end-state. The combinations of containment system failures considered and the designations for each combination are shown in the following table:

CONTAINMENT SYSTEM FUNCTION DESIGNATIONS CONTAINMENT SYSTEM STATUS" FUNCTION DESIGNATION FC CSI CS Cl S

S S

S 2

S S

F S

3 S

F F

S 4

F S

S S

5 F

S F

S 6

F F

F S

7 S

S S

F 8

S S

F F

9 S

F F

F 10 F

S S

F Il F

S F

F 12 F

F F

F

a. Successful system operation is designated by an S, failure by an F.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 32 of 75

f. the methodology and criteria for binning endstates into the 13 accident sequences/release categories shown in Table F-6 and used in the current level 3 analysis; SNC Response:

For the IPE, sequence selection for source-term analysis involved a screening process to determine those sequences which would be used to represent each source-tern bin. This process is described in detail in Section 4.7.2 of the Farley IPE Submittal Report. For the Rev. 5 source-term analysis, the current core damage cutsets were examined to determine the most representative functional sequence for each bin.

The key functions with respect to a potential radiological release from the containment are the containment status, the availability of containment sprays, debris cooling and containment heat removal, and the RCS pressure at vessel failure. For the IPE, this information was embodied in the plant damage state designators (see the Farley IPE Submittal Report Section 3.1.7). The WPE functional sequences selected for the source-term analysis were generally binned according to the last four characters of the plant damage state designators. Each sequence (functional or systemic) within a particular bin is expected to have a similar containment response. Due to their. unique nature as containment bypass pathways, all SGTR damage states are treated as a single functional group and all ISLOCA damage states are treated as a single functional group.

Once the binning process was completed, a representative functional sequence from each bin (termed the "analyzed sequence") was selected for source-term analysis. For the IPE, the analyzed sequence was chosen either because it had the largest frequency of occurrence of any functional sequence within the bin or because the analyzed sequence source-term was expected to bound that which was expected from the other functional sequences within the bin. (It was also intended that each dominant accident initiator be represented among the analyzed sequences.)

For the Rev. 5 model, the representative sequences were re-evaluated to reflect the current end-state designations and the current core damage cutsets. The results of the FNP source-term binning process, shown in the table below, indicate that 13 analyzed functional sequences were used to represent all 40 screened functional sequences. Thus, there are 27 "bounded" functional sequences.

The source-term for each analyzed functional sequence was computed by performing a MAAP analysis of a dominant systemic sequence that represented that functional group. The source-term results for the selected analyzed sequence in a particular bin was then assigned to the bounded sequences in that bin as well. This was accounted for by summing over all functional sequences within a bin to determine the cumulative frequency associated with the reported source-term.

To illustrate this process, refer to the table below and consider the following example. Source-term bin 2 contains eight functional sequences: IA-], ]A-2, ]A-3, IIA-2, IIA-3, IIC-3, lIlA-1, and IIIA-3. Five of these sequences are transients (IA-I, IA-2, IA-3, IIA-2, and IIA-3), two are small LOCAs (IIIA-I and IIIA-2), and one is a SBO (IIC-3), also with a seal LOCA. All eight

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 33 of 75 sequences have the same functional failures (failure of heat removal in the injection phase), the same containment status (isolated), and the same expected RCS pressure at vessel failure (high).

Each sequence is expected to have core damage within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , although the sequences with LOCAs (IIA-2, IIA-3, IIC-3, IIA-I, and IIIA-3) would likely have core damage somewhat earlier than the sequences with no LOCA (IA-, IA-2, and IA-3) because of the more rapid loss of RCS inventory. This bin is dominated by transients, with IA-I contributing 20.15 percent to the total core damage frequency for Unit 1. (The total contribution of bin 2 is 20.18 percent.)

Sequence IA-1 was selected as the analyzed functional sequence because of its relatively early core damage timing and its large frequency of occurrence. Thus, IA-2, IA-3, IIA-2, IIA-3, IIC-3, IIIA-I, and IIIA-3 are bounded functional sequences, and IA-] is the analyzed functional sequence chosen to represent source-term bin 2.

Next, to determine the source-term associated with bin 2, a MAAP analysis was performed on a specific core damage cutset from functional group IA-I. There are 17 such cutsets in the top 100 list (Table 3.4-4): cutsets 20, 21, 24, 36, 38, 41, 42, 53, 60, 61, 75, 77, 85, 93, 96,97, and 98.

From these candidates, cutset number 20 was selected for MAAP analysis because it has the highest frequency and was judged to be representative. The calculated source-term results for cutset number 4 are a best estimate for functional sequence IA-I, and also a bounding estimate of the expected results for functional sequences IA-2, IA-3, IIA-2, IIA-3, IIC-3, HIA-I, and IIIA-3.

The frequency associated with this calculated source-term release was therefore taken to be the cumulative frequency of all eight functional sequences composing source-term bin 2.

U. S. Nucleiar Regulatory Commission NL-04-0287 Enclosure Page 34 of 75 PRA BACK-END SEQUENCE SELECTION

SUMMARY

FOR FARLEY Rcleasc Bounded Systemic Unit I Source-Unit I Pcrcent Catcgory Source-Analyzed Analy7ed Sequences Tcrm Bin or (Updated Term Systemic Functional (Unit I Top 100 and Others Boundcd Finctional Frequency Total nsing MAAP Bin Scquencc Scqucncc of Intcrcst)

Sequences (per year)

Core Damagc 4.0.3)

IA-h6 6.22.33.34.55.56.72.6 113-6 2.3911-06 7.14 K

2 20 IA-I 21.24.36,38,41.42.53.60.61.

IA-2. IA-3. IIA-2.

6.75E-06 20.18 A

75.77.85.93,96.97.98 IIA-3. IIC-3. HIIA-I.

IIIA-3 3

37 IllA-6 None IIIC-6 1.22E-07 0.36 A

4 3

IIA-I 10.11.1 2.14.15.19.23.26.28.

None 7.651E-06 22.87 A

30.35.39.43.44,45.50.51,57.

58.59.62.73.81.87.88.90.91 5

7 11B1-I 8.13.17.18.25.27.31.32.54.6 111-I. IIIC-I. HID-I 7.971E-06 23.82 A

3,(4.65.66.67.68.69,70.71.7 6.80.82.83.84.89.92.94.95.

99.100 6

4 IIA-4 16.40.52.74.78.79 IIA-6. 11l-4. 11C-6 3.48E-06 10.40 A

7 2

IB-I 5.17.46.47.48.49 11-3. 11-3. 11B-2.

4.1 IE-06 12.27 A

1113-6. IID-I. IID.2.

111B-2. IIIB3-3 8

735 IIC-2 None IIC-I 1.94E-07 0.58 A

9 2153 111-3, None Nonc 4.f4E-09 0.01 A

10 29

!IIC-I None None 1.001F-07 0.30 A

9 VA None All ISLOCA 3.341E-07 1.00 T

12 1933 IIC-12 None IA-12. IIA-12.

2.7211-07 0.81 G

IIIA-12 13 4998 VSn None All SGTR 8.36E-08 0.25 T

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 35 of 75

g. the specific source terms used to represent each of the 13 accident sequence/release categories, and a containment matrix describing the mapping of Level I results into the various accident sequences/release categories; SNC Response:

The significance of a release of radionuclides is best characterized by the amount of volatiles released. Potential release categories for FNP are defined in terms of containment failure timing (early or late), containment failure mode (overpressure, not isolated, or bypass), and the airborne fractional release of fission products at the containment boundary. Note that sequences with early containment failure would derive only limited benefit from natural fission product depletion mechanisms (for example, settling and so forth). Based on the source-term results of the analyzed sequences, the appropriate release categories were assigned to the analyzed sequences and thus to the bins which they represented. It was found that the FNP source-term results fell into five release categories: A, D, G, K, and T. The cumulative frequency of each release category represents all analyzed and bounded functional sequences in that category.

RELEASE CATEGORY DEFINITIONS Release Category Definition A

No containment failure within 48-hour mission time, but failure could eventually occur without further mitigating action; noble gases and less than 0.1 % volatiles released.

D Containment bypassed with noble gases and up to 10% of the volatiles released.

G Containment failure prior to vessel failure with noble gases and up to 10% of the volatiles released (containment not isolated).

K Late containment failure with noble gases and less than 0.1 % volatiles released (containment failure greater than 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after vessel failure; containment not bypassed; isolation successful prior to core damage).

T Containment bypassed with noble gases and more than 10% of the volatiles released.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 36 of 75 FNP SOURCE-TERMI ANALYSIS RESULTS NIAAP RUN SUNMNMARY TABLE SEQUE1NCE TYPE TRANSIENT TRANSIENT SMAIlL IOCA TRANSIENT WMI TRANSIENT %VMT TRANSIENT W ITH TRANSIENT SEAI. IOCA SEAL LOCA SEAI, IOCA SeqttcnceNo./(BIN)

SEQ13I /(I)

SEQB20/(2)

SEQB37/(O)

SEQB03/(4)

SE.QB07/(5)

SEQI3(4/(6)

SEQB02/(7)

Source Term Bin Frequiency (yr t) 2.39E-6 6.75E-6 I.22E-7 7.65E-6 7.97E-6 3.4813-6 4.11 E-6 CORE/CONTAINMENT RESPONSE Time ofCore Uncovcty (hr) 0.9 0.9 4.1 5.0 19.1 1.8 13.9 Ons.t orCore Melt (hr) (I 20XrT) 1.1 1.1 5.0 55 19.8 2.2 145 Time of Vessel Failure (hr) 4.2 4.1 9.2 in 25.4 85 19.6 Time of Containment Failure (hr) 37.8

>48

>48 Maximntm Containment Prlsture (rsia) 122 64 83 53 50 52 59 Cavity Water Level at 48 Hotirs (f) 0.0 0.0 0.0 0.0

0.

0.0 0.0 Fraction of Clad Reacted in Vessel 0.78 0.71 0.76 0.69 0.60 0.74 0.78 112 Mass Burned (lb.)

287 3.310 1.109 2.603 1.877 3.081 1.938 Cavity Concrete Ablation Depth at 48 Ilors (ft) 7.7 8.1 6.0 6.1 3.7 6.7 5.2 FISSION PRODUCT DISTRIBUTION AT END)

OF MISSION TIME Noble Release (%)

14.0 0.3 0.3 0.2 0.1 0.3 0.2 Volatile FP Release (%)

213-2 713-3 413-3 I E-3 213-3 213-3 11.4 Non-Volatile FP Reletsc()

613-3 713-5 I E-3 313-4 413-4 613-4 613-5 Volatile FP Retained in Prtmaty System (%)

60 54 75 84 82 86 28 Release Category K

A A

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 37 of 75 FNP SOURCE-TERMI ANALYSIS RESULTS MIAAP RUN

SUMMARY

TABLE SEQUE.NCE TYPE STATION BLACKOUT TRANSIENT WVIT1 RPV RUITIlJRE INTERFACING STATION STFAM GENERATOR SEAL ILOCA SYSTEMNIS LOCA BLACKOUT TUlE RUPTURE ScqucnecNo./(BIN)

SE13Q735/(R)

SEQB2153/(9)

SEQB29/(10)

SEQBn09/(Il)

SFQB 1933/(12)

SEQB4998/(I3)

Sourcc Term Bin Freqtiency (y f )

I.941E-7 4.64E.9 1.0013-7 33413-7 2.72F-7 8.3613-8 CO]REICONTAINME NT RUSIPONSE Timc or Corc Uncovery (hr) 6.2 4.8 0.0 7.4 1.7 16.R Onset of Corcn clt (hr) ( 2(MF) 6.6 5.2 0.02 7.9 2.0 19.R Time of Vcssel Failure (hr) 11.0 8.7 1.0 11.6 9.2 26.A Time or Containment Failurc (hr)

>48

>48 BYPASS NOT ISOLATED BYPASS Maximum Containmcnt Pressure (psia) 116 56 46 16 24 33 Cavity Water Level at 48 Hotirs (f) 0.0 0.0 0.0 0.0 0.0 0.0 Fraction of Clad Reacted in Vesscl 0.81 0.67 0.42 0.65 0.79 0.75 1 Mass Burned (lhb) 372 3.278 3.284 1.514 276 1.271 Cavity Concrete Ahlation Depth at 481 lowirs (0) 6.8 7.0 7.9 6.5 6.6 4.0 FISSION PRODUCT DISTRIBUTION AT END OF MISSION TIME Nohlc Release (%)

0.3 0.2 0.3 99.99 97.2 73 Volatile FP Release (%)

613-3 213-3 613-3 95.6 4.1 6.4 Non-VolalileFP Relase(%)

IP -3 RE-4 113-S 25.6 1.9 0.2 Volatilc FP Retained in Primary System (%)

70 86 1i 3

84 37 Rclcase Category A

A lA J

T l

G l

D

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 38 of 75

h. a description of the accident sequence used to represent each of the 13 accident sequences/release categories showvn in Table F-6, and how each sequence was chosen to represent a bin; SNC Response:

The 13 sequences (cutsets) selected for source-term analysis are described below. The sequence numbers refer to the sequence ranking among the top core damage cutsets. Also shown are the functional sequence/plant damage state identifiers.

Sequence Number 1, IA-6 A transient occurs due to flooding of the cable spreading room. All ECCS injection is unavailable because of ESFAS actuation failure. AFW fails, and all fan coolers and containment spray do not operate. Seal cooling is provided to the RCPs, so a consequential seal LOCA does not occur. The containment is isolated.

Sequence Number 20, IA-I A transient occurs due to a loss of main feedwater flow. Auxiliary feedwater subsequently fails and the operators fail to align the condensate pumps to provide cooling to the steam generators.

When the Bleed and Feed initiation criteria is met, the operators fail to start the HHi pumps to provide primary cooling. The modeling assumes that 114 FCs operates, although Sequence Number 20 would actually have at least 2/4 FCs available. Sprays are assumed not to function (not checked in PRT since FCs are operational). The containment is isolated.

Sequence Number 37, IIIA-6 A small LOCA occurs due to failure of a Reactor Coolant Pump seal. Both trains of ESF fail to initiate an SI signal. This fails the LHI and HHI Systems, the FCs, and containment spray. The SLOCA is modeled as a 0.002838 ft2 break in one of three intermediate legs, assumed to occur at the start of the event. Although ECCS injection does not operate, all three accumulators do inject. The containment is isolated.

Sequence Number 3, IIA-I A transient with a consequential RCP seal LOCA of 480 gpm/pump occurs because of a loss of all CCW cooling due to flooding of the CCW heat exchanger room. High-head injection fails, AFW operates, and secondary side depressurization succeeds. The RCPs are turned off at 2 minutes. Seal leakage is modeled as a 0.002838 ft2 break in each of three intermediate legs, assumed to occur at 20 minutes. At 30 minutes the atmospheric relief valves are opened to depressurize the primary system. The three accumulators inject and RCS pressure is reduced below the shut-off head of the low-head injection pumps, but they fail to run due to the loss of

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 39 of 75 CCW. Containment fan coolers (114 assumed) and one train of containment spray operates, and the containment is isolated. The switch to containment spray recirculation mode is successful.

Sequence Number 7, IIB-I A transient with a consequential RCP seal LOCA of 480 gpm/pump occurs because of a loss of the On-Service SW Train and failure of operator action to trip the reactor coolant pumps on the subsequent loss of bearing cooling. High-head injection and AFW operate, and secondary side depressurization succeeds. The RCPs are assumed to fail at 10 minutes. Seal leakage is modeled as a 0.002838 ft2 break in each of three intermediate legs, assumed to occur at 10 minutes. At 30 minutes the atmospheric relief valves are opened to depressurize the primary system. The three accumulators inject and RCS pressure is reduced below the shut-off head of the low-head injection pumps, but the pump with cooling support is unavailable due to maintenance.

Containment fan coolers (1/4 assumed) and one train of containment spray operate, and the containment is isolated. The switch to containment spray recirculation mode is successful.

Sequence Number 4, IIA-4 A loss of all SW results in a seal LOCA of 480 gpm/pump. Seal leakage is modeled as a 0.002838 ft2 break in each of three intermediate legs, assumed to occur at 20 minutes after event initiation. The turbine-driven AFW pump provides decay heat removal (the motor-driven pumps are assumed to be failed due to a loss of room cooling). Containment spray (both trains) is assumed to initiate, but neither train of SW is restored requiring operator action to perform actions to mitigate the loss of room cooling. ECCS injection and the containment fan coolers do not operate because of the failure of SW. Spray recirculation is conservatively assumed to fail, although it would actually be operational for Sequence Number 4. The containment is isolated.

Sequence Number 2, lB-I A secondary side break occurs downstream of the MSIVs. AFW operates and the High-head injection system operates. The operators fail to terminate safety injection and the pressurizer overfills resulting in a consequential small LOCA through the pressuizer PORVs. Sprays are assumed not to operate (not checked in PRT since the FCs are operational). The modeling assumes that 1/4 FCs are operational, although Sequence Number 2 would actually have at least 2/4 FCs available. The switch to ECCS recirculation mode is not successful and injection is terminated when the RWST is empty (50,000 gallons). However, spray recirculation is successfully established. The containment is isolated.

Sequence Number 735, IIC-2 A dual-unit LOSP with loss of 4160 V buses F and G results in SBO and a small seal leak of 21 gpmlpump. Seal leakage is modeled as a 1.242E-4 ft2 break in each of three intermediate legs, assumed to occur at 20 minutes after event initiation. The turbine-driven AFW pump provides

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 40 of 75 flow to the steam generators, but the operators-fail to open the atmospheric relief valves to initiate a secondary side cooldown. Offsite power is not recovered at I hour. The failure to recover power results in continued loss of RCS inventory with no ECCS injection available. In addition, containment spray and the containment fan coolers are unavailable because of the failure to recover power. The containment is isolated.

Sequence Number 2153, IIB-3 A transient with a consequential RCP seal LOCA of 480 gpmlpump occurs because of a loss of one train of SW and CCW and the failure of the operators to trip the reactor coolant pumps in response to the loss of bearing cooling. High-head injection, low-head injection, and containment spray are not available because of support system failures. AFW and the atmospheric relief valves are operational, and one fan cooler operates. The modeling assumes that 1/4 FCs are operational, although Sequence Number 2153 would actually have at least 2/4 FCs available. The RCPs are assumed to fail at 10 minutes. Seal leakage is modeled as a 0.002838 ft2 break in each of three intermediate legs, assumed to occur at 10 minutes after event initiation. RCS cooldown and depressurization are initiated at 30 minutes by opening the SG ARVs. The cooldown rate is limited by fixing the ARV dump fraction at 1/2. The switch to ECCS recirculation is not successful because of support system failures. The containment is isolated.

Sequence Number 29, HIIC-1 RPV rupture occurs. The RPV rupture is modeled as a 4 ft2 break in the vessel wall. (Note that this sequence bounds those cases where pressurized thermal shock [PTS] could be postulated to fail the RPV.) Since this is a break beyond the capability of the ECCS, ECCS operation is not credited, but all three accumulators do inject. One FC and one train of sprays operate. The modeling assumes 1/4 FCs are operational, although sequence number 192 would actually have at least 2/4 FCs available. Spray recirculation is assumed to be unsuccessful (not addressed in PRT). Note that this sequence leads to substantial basemat ablation which could be mitigated by continued vessel injection/recirculation. The containment is isolated.

Sequence Number 9, VA An ISLOCA occurs in the RHR hot leg suction piping. HHI is successful and the FCs function.

Operator action to reduce the ECCS flow to the minimum required to remove decay heat and extend the RWST is not modeled. The ISLOCA is modeled as a 0.1 ft2 break in the hot leg. This break area is based on an upper bound of 0.1 ft2 for the RHR pump seals (both pumps). The operators are assumed to initially treat the accident like a medium LOCA inside containment and maintain the maximum high-head injection flowrate and initiate RCS cooldown and depressurization. Maximum HHI (two charging pumps) continues, unthrottled, until the RWST is empty (50,000 gallons left). RCS cooldown is initiated at 30 minutes by opening the SG ARVs. The cooldown rate is limited by fixing the ARV dump fraction at 1/2. LHI does not operate since the RHR pumps are assumed to fail. The containment is isolated but bypassed.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 41 of 75 Sequence Number 1933, IIC-12 A dual-unit LOSP with loss of 4160 V buses F and G results in SBO and a seal LOCA of 480 gpm/pump. Seal leakage is modeled as a 0.002838 ft2 break in each of three intermediate legs, assumed to occur at 20 minutes after event initiation. The turbine-driven AFW pump provides flow to the steam generators, and the operators initiate a secondary side cooldown at 30 minutes by opening the SG ARVs. The cooldown rate is limited by fixing the ARV dump fraction at 1/2.

Offsite power is recovered at 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , but the operators fail to start the ECCS systems, containment fan coolers or containment spray. The containment is not isolated. The failure to isolate is assumed to occur at an 8-inch containment mini-purge line.

Sequence Number 4998, NIB An SGTR occurs. ECCS injection fails because of support system failures but all three accumulators inject. AFW is operational, but the ruptured SG is not isolated. The safety valve on the ruptured SG sticks open because of SG overfill. The tube break area is assumed to be equivalent to 100 percent of the cross-sectional area of a single tube (0.775 in. ID). FCs do not operate, and the sprays are assumed not to operate (not checked in PRT). The containment is isolated but bypassed.

i.

a breakdown of the population dose (person-rem per year within 50 miles) by containment release mode, such as steam generator tube rupture (SGTR), ISLOCA, containment isolation failure, early containment failure, late containment failure, and no containment failure; and SNC Response:

The following table presents a breakdown, by containment release mode, of the population dose risk in person-rem per year within 50 miles of FNP.

CONTAINMENT RELEASE POPULATION DOSE MODE (PERSON-REM/YEAR)

SGTR 0.047 ISLOCA 0.69 Containment Isolation Failure 0.031 Early Containment Failure None identified Late Containment Failure 0.34 No Containment Failure 0.37

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 42 of 75

j. justification for why early containment failure mechanisms are not included in the PRA quantification.

SNC Response:

Section 4.4 of the Farley Individual Plant Examination Report in Response to Generic Letter 88-20 summarizes the plant-specific phenomenological evaluations performed to determine the likelihood of all postulated containment failure modes and mechanisms identified in NUREG-1335. These detailed evaluations were performed systematically to address the controlling mechanistic processes or events specific to the FNP configuration. The general approach used in these evaluations comprised modeling and bounding calculations based on extensively compiled experimental data and phenomenological uncertainties (complemented with MAAP calculations in some cases).

Based on those evaluations, early containment failure due to hydrogen combustion, direct containment heating (DCH), steam explosions, molten core-concrete interaction (MCCI), thermal attack of containment penetrations, and vessel thrust forces were determined to be unlikely for Farley. Containment bypass due to Interfacing Systems Loss of Coolant Accidents (ISLOCA) and Steam Generator Tube Rupture (SGTR) and containment isolation failure are specifically addressed by the Farley Large Early Release Frequency (LERF) model and were considered in the SAM analysis (e. g., SAMAs 79 through 86 address SGTR response, SAMAs 89 through 95 address ISLOCA, and SAMA 96 addresses containment isolation valves.)

The evaluations which formed the basis for the determination that hydrogen combustion, direct containment heating (DCH), steam explosions, molten core-concrete interaction (MCCI), thermal attack of containment penetrations, and vessel thrust forces are unlikely are described in the following paragraphs.

Hydrogen Combustion A phenomenological evaluation was performed to assess the susceptibility of the FNP containment to early failure due to hydrogen deflagration and detonation. The evaluation was based on bounding analyses and conservative assumptions for a worst-case station blackout (SBO) sequence.

The assessment of hydrogen deflagration assumed in-core hydrogen production due to 100-percent oxidation of all zirconium and metallic constituents of the lower core plate (equivalent to about 1,840 lb of hydrogen). This conservatively large amount of hydrogen was assumed to enter the containment at the time of vessel failure. The amount of inerting steam was conservatively limited to the level in containment at the time of RPV failure, and the containment temperature and pressure at that time (280'F and 40 psia, respectively) were based on typical FNP MAAP results.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 43 of 75 The potential containment pressurization was bounded by calculating the adiabatic isochoric complete combustion (AICC) of the assumed hydrogen inventory. The adiabatic calculation ignored the presence of any passive or active heat sinks in the containment. Thus, all the combustion energy was used to heat the containment atmosphere and produce the largest possible pressure increase. The calculation assumed that all the hydrogen produced accumulates in containment and bums all at one time. It also ignored the possibility of hydrogen burning as it is released, in which case the containment pressurization would be much less severe. The selected worst-case scenario resulted in an estimated post-bum AICC containment pressure of 112 psia, which is still within the lower-bound ultimate capacity of the FNP containment.

The assessment of hydrogen detonation potential concluded that hydrogen detonation by direct energy deposition is not possible in the FNP containment since there are no potential ignition sources with sufficient energy to trigger such an event.

The potential for deflagration-to-detonation transition (DDT) was evaluated based on a procedure for engineering judgment by Sherman and Borman. This procedure assumed that the potential for DDT can be assessed based on the mixture's intrinsic flammability (detonation cell width) and type of geometry. The FNP analysis consen'atively assumed a dry containment atmosphere and 100-percent oxidation of all zirconium and the lower core plate. This corresponds to a dry-basis hydrogen mole fraction of 15.9 percent. Based on the open design of the FNP containment and its conduciveness to natural circulation, the containment gas was assumed to be uniformly mixed.

The DDT assessment concluded that failure of the containment due to hydrogen detonation is very unlikely to occur.

Because only a small ignition source is required to initiate a deflagration, it is far more likely that combustible gases would be consumed within the containment by deflagration rather than detonation. It is unlikely that enough hydrogen would accumulate to produce a deflagration that could challenge the containment ultimate pressure capacity. Typical FNP source-term MAAP runs, for example, showed that molten core debris in the (dry) reactor cavity acts as an ignition source and continuously bums hydrogen as it is generated during core-concrete attack. None of the sequences addressed in the FNP source-term analysis could realistically threaten containment because of hydrogen combustion.

Direct Containment Heating DCH is the process of directly heating the containment atmosphere by molten core debris should it be hydrodynamically forced out of the reactor cavity during the primary system blowdown. A phenomenological evaluation was performed to examine the likelihood of FNP containment failure due to DCH. This evaluation was based on recent DCH experiments and the use of mechanistic models for debris dispersal which take into account entrainment from the reactor cavity and de-entrainment at the instrument tunnel exit.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 44 of 75 DCH experiments for a large dry PWR (Zion) have shown that containment structures (geometry) have a first order (dominant) mitigating influence on the potential for DCH. For example, in the Argonne Corium/Water Thermal Interaction (CWTI) experiments, tests performed with a dry cavity compartment and the seal table structure present showed that only I to 5 percent of the debris that left the cavity contributed its energy directly to the air of the Containment Building.

Comparison of the FNP and Zion cavity/instrument tunnel designs clearly indicates that the FNP geometry would trap and de-entrain more debris than in the Zion configuration. Therefore, the results of DCH experiments performed for Zion are a conservative estimate of what they might be for an analogous FNP DCH experiment.

The DCH modeling methodology focused on:

The debris mass that could potentially be particulated in the reactor cavity and instrument tunnel That fraction of the entrained (particulated) debris that could escape the change in flow direction caused by the seal table enclosure The analysis was inherently conservative since it neglected all internal structure in the cavity and instrument tunnel, as well as lower compartment structures. That fraction of the debris not particulated would have such a large characteristic dimension that the instrument tunnel enclosure beneath the seal table floor would collect it and prevent it from entering the containment atmosphere. The assessment of the entrained particle size used a conservative approach based on the maximum gas velocity in the reactor cavity and a single droplet Weber number criterion.

Less than 9 percent of the entrained core debris is expected to make it past the 90-degree turn from the instrument tunnel to the lower compartment. This percentage corresponds to a maximum debris mass of about 8,100 lb.

The potential containment pressurization was bounded by assuming that the debris mass that could potentially contribute to DCH is 100-percent efficient at transferring its heat to the containment atmosphere. The initial debris temperature was assumed to be 40400F at the time of RPV failure. Forty percent of the zirconium fuel cladding was assumed to be oxidized prior to RPV failure, which is consistent with typical MAAP results for an SBO sequence. Calculation results show that DCH combined with a hydrogen bum (not considered feasible in the best-estimate analysis) would pressurize the FNP containment to 81 psia. Without hydrogen bum, the resulting containment pressure would be 54 psia. These conservative estimates of the peak containment pressure due to DCH are well within the containment capabilities.

Steam Explosions Steam explosion phenomena were evaluated for both in-vessel and ex-vessel events as potential mechanisms for early containment failure under severe accident conditions. A steam explosion

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 45 of 75 refers to a boiling process in which steam production occurs at a rate larger than the rate at which the surrounding media can acoustically relieve the pressure increase. This leads to the formation of a shock wave.

The issue for in-vessel steam explosions is whether an explosion of sufficient magnitude to fail the reactor vessel with consequential failure of the containment could occur. This was addressed by evaluating the fundamental physical processes required to create an explosion of such magnitude. The analysis closely followed the IDCOR assessment of this phenomenon and indicated that explosions of this magnitude are not likely to be established within the confines of the FNP reactor vessel. This is in agreement with the findings of the NRC-sponsored Steam Explosion Review Group (SERG) that concluded that an in-vessel steam explosion leading to containment failure was very unlikely.

Ex-vessel steam explosions were addressed by considering the potential for both the rapid steam generation that could occur as a result of the explosive interaction and the shock waves that could be formed and propagated to the containment boundary.

The existing experimental work and analyses examined provide a thorough basis for evaluating steam overpressure challenges to containment integrity and strongly indicate that sufficient steam overpressure to challenge the containment integrity would not be achieved under realistic conditions. The calculated increase in containment pressure caused by postulated steam generation during an ex-vessel steam explosion, 6 psig, is well within the capability of the containment. The calculated induced shock wave pressure at the containment wall is 19 psi.

Since the containment has an ultimate capacity of 117 psia, blast effects from potential steam explosions are not a concern. Shock wave propagation to the containment boundary yields overpressure values well within the containment capability.

It is concluded that the slumping of molten debris into the RPV lower plenum could not result in sufficient energy release to threaten the vessel integrity and, hence, would not lead directly to containment failure. Likewise, evaluations of both the steam generation rate and shock waves induced by ex-vessel explosive interactions show that these would not be of sufficient magnitude to threaten the containment integrity.

Molten Core-Concrete Interaction Molten core-concrete interaction (MCCI) was evaluated using a simple bounding analysis model to determine whether the aggressive attack on concrete by molten core debris could lead to late containment failure. The analysis assumed that the concrete ablation rate is proportional to the total heat generation rate due to decay heat and chemical reactions. The model used empirical parameters determined from available MCCI experimental data.

At FNP, all core debris ejected from the reactor vessel is expected to be contained in the (dry) reactor cavity. MCCI in the cavity is hypothesized to cause containment failure either by

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 46 of 75 penetrating the cavity floor, liner, and basemat, or by weakening the RPV support sufficiently that the vessel and attached piping move and tear out associated containment penetrations. The combined thickness of the cavity floor and basemat is 8 ft 10 in., while the cavity walls are at least 5 ft thick. Experimental evidence suggests that the ratio of sideward to downward erosion rates is nonzero, but much less than one. Examination of the FNP cavity design indicates that failure at containment penetrations, caused by erosion of the cavity walls and the embedded structural steel columns that support the RPV, will not occur prior to melt-through of the basemat.

Basemat penetration is, therefore, the MCCI failure criterion for FNP.

Although some fraction of the core could remain cooled in-vessel while the bulk of the core is expelled, it was convenient to make the conservative assumption that the entire core is expelled with its full initial inventory of fission products and zirconium. In many accident sequences, a substantial fraction of the zirconium can be oxidized in-vessel, as opposed to being oxidized during core-concrete attack. This potentially decreases the duration of the zirconium oxidation phase and slows core-concrete attack overall, since the chemical energy of the core debris is decreased. This possibility was not considered here. Moreover, a substantial fraction of the core's initial fission product inventory would not reside in the core debris attacking the basemat.

Fission products are distributed throughout the primary system and containment compartments in a manner that depends upon the severe accident progression. Volatile fission products initially present in the core debris can be vaporized or entrained to form aerosols, which are transported throughout the containment. The net effect of these neglected mechanisms is to reduce the mass of fission products and decay heat in the core debris as it attacks the cavity floor.

The estimation of containment failure time due to MCCI in the cavity accounted for changes in the governing phenomena as time progresses. The first phase of the erosion process was considered to be the interval during which unoxidized zirconium in the core debris reacts with steam and carbon dioxide liberated by the concrete erosion. During the second phase, the chemical reaction energy was considered negligible and the concrete decomposition enthalpy was reduced to reflect the lack of chemical reaction. The calculation method determined whether containment failure would occur before the zirconium in the core debris bed was depleted. If containment failure occurred first, the time at which containment failure would occur would be obtained by straightforward calculation. If zirconium depletion occurred first, the calculation procedure would become more complicated. First, the time interval to reach zirconium depletion was determined. Then, an iterative process was required to determine the predicted depth of concrete erosion corresponding to zirconium depletion. Finally, the additional concrete mass that must be eroded to cause containment failure and its corresponding time interval were determined.

The FNP analysis of basemat melt-through assumed that the ratio of sideward to downward ablation rate is constant and equal to 0.2. This assumed ratio is somewhat less than the best-estimate value of 0.29 based on long-term decay heat experiments reported by Alsmeyer, thereby enhancing the downward ablation rate. The cavity dry-out time for an SBO is about 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after trip, based on typical FNP MAAP results, and the nominal full power for FNP is 2650 MW (9.05 x 109 Btulhr). Substituting these values into the MCCI model resulted in containment failure due

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 47 of 75 to basemat melt-through at about 62 hours7.175926e-4 days 0.0172 hours 1.025132e-4 weeks 2.3591e-5 months after trip. This failure lime represents a conservative lower bound and is expected to be earlier than that predicted by an integral code such as MAAP.

The MCC] evaluation concludes that molten core-concrete attack can be excluded from consideration as a significant late containment failure mechanism. This is not meant to downplay the significance of MCCI in the FNP Back-End Analysis, or suggest that containment failure due to concrete melt-through cannot occur under any circumstances. Rather, relative to other containment failure mechanisms, MCCI-induced melt-through will occur so late in time that:

The containment will have failed because of other, relatively more rapid mechanisms Mitigating actions will almost surely have taken place to arrest MCCI before reaching the containment failure criterion of basemat melt-through Also, relative to other failure mechanisms, the source-term for a basemat melt-through would be small because of the failure time (very late) and location (below ground).

Thermal Attack of Containment Penetrations The susceptibility of FNP containment penetrations to failure due to thermal loadings has been evaluated for severe accident conditions. Failure of the "leaktightness" of containment penetrations could provide a pathway through the containment structure for the release of fission products. The locations of the penetrations were reviewed to assess the potential for direct contact of penetrations by core debris. Data on the nonmetallic seal materials used in the FNP penetrations were compiled and used in conjunction with existing environmental qualification work to determine the response of the penetrations to the expected worst-case severe accident conditions at FNP. The limiting sealant material at FNP is a GE epoxy.

The evaluation of debris dispersal in conjunction with the location of the mechanical and electrical penetrations revealed that it is highly unlikely for these penetrations to be in direct contact with molten debris dispersed during postulated high-pressure melt ejection. The majority of entrained debris would be removed at the instrument tunnel exit (in the lower compartment),

and there are no direct paths by which core debris could contact any containment penetrations (in the annular compartment). The operational limits of the nonmetallic penetration materials were shown not to be exceeded by the maximum gas temperatures predicted for containment compartment regions during severe accident sequences. Hence, thermal loading of penetration nonmetallic materials would not cause degradation and leakage from the containment under conditions expected at FNP during a severe accident.

Vessel Thrust Force In this phenomenological evaluation, a strategy was developed to account for postulated containment failure due to excessive thrust force caused by molten core debris being ejected from

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 48 of 75 a failed reactor vessel. The concern was that the thrust force could cause the reactor vessel to shift position and tear out containment penetrations.

The maximum jet thrust force that could be expected during the expulsion of molten core debris through a failed FNP reactor vessel was estimated to be I x 106 lb1. This predicted thrust force was calculated under the assumption that vessel failure occurs at a lower head penetration/vessel cladding weld rather than by failure of the lower head itself. The predicted thrust force is nearly the same as the lower-bound deadweight of the RPV, estimated to be 0.97 x 106 lb1. This lower-bound estimate excluded the combined weight of the fuel, cladding, control rods, and lower core support plate. Thus, the jet force most likely could not lift the vessel and its intemals,.even without considering the ability of the vessel support structure to withstand the thrust load. If the coolant loop piping and shield wall were considered, a much larger force would be required to dislodge the reactor vessel. Even if the vessel could shift, the FNP containment is configured in such a manner that reaction forces cannot be transmitted to the containment wall. Therefore, this postulated failure mode is bounded by the plant design.

2. The CDF cited and used in the SAMA analysis is based on the risk profile for internal events at Farley Unit 1. Please provide the internal events CDF for Unit 2 if different, and a discussion of the reasons for any differences from Unit 1. Discuss the impact on the SAMA analysis and results if the analysis was based on Unit 2 rather than Unit 1.

SNC Response:

The CDF results for the Unit 2 Revision 5 model are provided in the following table:

CDF by Initiating Event Category 1

Initiating Event Category CDF/reactor year Percentage of Total CDF Loss of Offsite Power 1.01E-05 17.31 Loss-of-coolant Accidents 1.88E-06 3.23 ISLOCA 3.34E-07 0.57 Steam Generator Tube Rupture 7.45E-08 0.13 Transients 5.94E-06 10.23 Special Initiators 3.30E-05 56.81 Internal Floods 6.82E 11.73 Total 5.81 E-05 100.00 The major difference between the Unit I and Unit 2 models is that the Unit 2 service water pumps are of a different design than the Unit I pumps. Prior to model revision 4, information provided by the vendor indicated that the Unit 2 service water pumps could operate for 30 days without high pressure filtered water for pump bearing lubrication. However, additional information was received from the pump vendor in March 2000 indicated that they could no longer support this conclusion. As a result, the modeling for the Unit 2 service water pumps was revised to require an auxiliary pump to provide high pressure filtered water for bearing lubrication following loss of the normal supply. This results in higher initiating event frequencies for the Loss of Service Water and Loss of Service Water Train

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 49 of 75 initiating event frequencies for Unit 2 and a higher contribution to total CDF for these initiating events.

The quantification results for model revision 3 for Units I and 2 were as follows:

Unit CDF per reactor year LERF per reactor year I

6.52E-05 4.50E-07 2

6.45E-05 4.50E-07 Therefore, prior to the change in assumptions regarding the need for the auxiliary pumps for service water pump lubrication, the core damage frequency and large early release frequency were bounded by the Unit I results. Since modifications to remove this dependency for the Unit 2 service water pumps are scheduled to be completed prior to the extension of the operating licenses, it was determined that the Unit I model was most representative for use in the SAMA analysis.

3. The reactor coolant pump (RCP) seal LOCA previously contributed 47% to the CDF. One of the plant improvements under consideration at the time of the IPE was replacing the current RCP seal 0-rings with new high temperature O-rings. SAMA 13, which addresses installation of improved seals, is labeled as already addressed by the existing plant design. Confirm that 0-rings constructed from improved materials have been installed on all pumps. Discuss the RCP seal LOCA model utilized in the FNP PRA and why this is judged to provide an appropriate representation of RCP seal LOCA events. Also, indicate the current percent contribution to the CDF for RCP seal LOCA.

SNC Response:

All reactor coolant pumps at Farley have been modified to use the high temperature 0-rings in the seal packages. Therefore, SAMA 13 has already been addressed by the existing plant design. The percentage contribution to CDF from RCP seal LOCA is still approximately 47%. This is largely driven by random failure of the service water and component cooling water systems which are required for RCP seal cooling.

The RCP seal LOCA model used in the Revision 5 PRA model (which was used for the SAMA analysis) is based on the model presented in Brookhaven National Laboratory Technical Report W621 1 01/99, "Guidance Document for Modeling of RCP Seal Failures." To simplify the linked fault tree structure, loss of RCP seal cooling events (due to loss of support systems or SBO) are binned into two treatments based on the expected RCP seal leakage rate. Those sequences with leakage rates of 21 gpm per pump (assigned a probability of 0.81 1) are expected to progress in the same manner and require the same mitigation equipment as a general transient (i.e., reactor trip or turbine trip). Those sequences with leakage rates greater than 21 gpm per pump (assigned a probability of 0.189) are expected to progress in the same manner and required the same mitigation equipment as small LOCA events. For the purposes of analyzing time to core uncovery for the events with leakage rates greater than 21 gpm per pump, the maximum expected leakage rate of 480 gpm per pump was used. The increased leakage is assumed to occur at 15 minutes after loss of all RCP seal cooling, but no operator actions are credited for recovery of RCP seal cooling that are expected to require more that 10 minutes for completion.

This application of the RCP seal LOCA model from BNL Technical Report W6211 in combination with the assumed time window available for recovery of RCP seal cooling is consistent with the WOG 2000 model (WCAP-15603, Revision 1-A, "WOG 2000 Reactor Coolant Pump Seal Leakage Model for Westinghouse PWRs") with regards to the timing of the increase in RCP seal leakage.

U. S. Nuclear Regulatory Commission NL-,04-0287 Enclosure Page 50 of 75 Further, the combination of the greater than 21 gpm per pump leakage rate probabilities into a single binning event serves to remove credit for the third stage seal as recommended by Rhodes and as recommended in the NIRC SER for WCAP-15603. Therefore, the RCP seal LOCA model used in the Farley Revision 5 PRA model is judged to be appropriate for use in risk-informed applications.

4. The MACCS analysis assumes all releases occur at ground level and has a thermal content the same as ambient. These assumptions could be non-conservative when estimating olfsite consequences. Please provide an assessment of the sensitivity of offsite consequences (dose to the population within 50 miles) to these assumptions.

SNC Response:

Of those sequences analyzed using MACCS, only sequences BO], B09, and B4998 are expected to be non-ground level releases. The BO] release, as a containment failure, would be at approximately 124 feet above grade. The B09 release would be from the auxiliary building vent, 145 feet 9 inches above grade. Steam releases from B4998 would be from the ARVs on top of the main steam room, approximately 55 feet above grade. The increase in FNP dose risk (over that of ground level releases) from these changes in release height would be 8.7 percent. Approximately 90 percent of this change is due to B09.

The sensitivity of the assumption that all releases have a thermal content the same as ambient was investigated by comparing the 50-mile population dose risk that would result if all of the analyzed sequences were released with a heat content (above ambient) of 0, 3, 30, and 300 megawatts. Using the release heights indicated in the previous paragraph, the FNP dose risk for heat contents of release of 3, 30, and 300 megawatts (relative to ambient) further increases by 4.2 percent, 16 percent, and 11 percent, respectively.

5. According to Table F-10 of the Environmental Report (ER), SNC evaluated 124 SAMA candidates (SNC states that there are 128 SAMAs, however four were not used). SNC indicates that the set of SAMAs was developed from a review of lists for other plants, NRC documents, and advanced power reactor designs. It is not clear that the set of SAMAs evaluated in the ER addresses the major risk contributors for FNP. In this regard, please provide the following:

a. A description of how the dominant risk contributors at FNP, including dominant sequences and cut sets from the current PRA and equipment failures and operator actions identified through importance analyses (e.g., Fussell-Vesely, Risk Reduction Worth, etc.) were used to identify potential plant-specific SAMAs for FNP; SNC Response:

The list of candidate SAMAs was provided to SNC PRA Services personnel familiar with the Farley PRA model for review. The reviewer was asked to evaluate the candidate SAMAs to provide input as to which candidates were addressed by existing procedures and design and to identify other potential design changes needed to address dominant risk contributors at FNP.

This review was performed using knowledge gained by the reviewer through risk ranking activities performed for the Maintenance Rule program, and did not involve any new risk ranking This review resulted in addition of SAMAs 116-125 to address dominant contributors to CDF at Farley.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 51 of 75

b. The number of sequences and cut sets reijewed/evaluated and what percentage of the total

b. The number ofsequences and cut sets reiiem ed/evaluated and ^ hiat percentage of the total CDF they represent; SNC Response:

As stated above, the review was not based on a specific number of sequences or percentage of total CDF.

c.

A listing of equipment failures and human actions that have greatest potential for reducing risk at FNP based on importance analysis and cut set screening; SNC Response:

Based on ranking of maintenance rule functions and human actions modeled in the Farley PRA, the following are those operator actions/system functions with RRW values greater than 1.100 (i.e., capable of generating a CDF or LERF reduction of greater than 10%). This was selected as a cutoff value because risk reductions of less than this would have to have extremely low costs (i.e., <S140,000) to be cost effective.

Max CD LR ITEM Description RRWV RRW RRW I OP-FLD-PUMP-H Operator fails to initiate control of components 1.205 1.205 1.004 from hot shutdown panel R43-FOI Provide adequate emergency power to engineered 1.200 1.200 1.001 safeguards loads within the required time frame and duration N23-F02 The TDAFW pump provides a reliable source of 1.191 1.191 1.032 water to the steam generators during emergency conditions V43-F03 Maintain risk significant fire protection system 1.186 1.186 1.004 pressure boundary to prevent flooding R1S-F01 Provides power to Class IE equipment 1.157 1.157 1.002 E21-Fl I Provide a flowpath for delivery of High pressure 1.149 1.029 1.149 emergency core cooling for ECCS injection phase or Bleed and Feed P17-F0I Circulate water through the CCW system and 1.142 1.142 1.002 maintain temperatures within the design operating band with the heat exchangers during normal operation and during accident conditions N23-FOI MDAFW pumps provide a reliable source of water 1.134 1.134 1.003 to the steam generators during emergency conditions ORC_A_I------H Operator fails to trip reactor coolant pump on loss 1.130 1.130 1.002 of oil cooling P16-F02 Provide sufficient cooling water flow to meet the 1.119 1.119 1.001 requirements of components served by service water during normal and emergency operations

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 52 of 75

d. For each dominant contributor identified in the current PRA (Revision 5), a cross-reference to the SAMA(s) evaluated in the ER that address that contributor. If a SAMA was not evaluated for a dominant risk contributor, justify why SAMAs to further reduce these contributors would not be cost beneficial; and SNC Response:

Candidate 1TEN11 Description SANIAs I OP-FLD-PUMP-H Operator fails to initiate control of components from hot 116, 117, shutdown panel in response to cable spreading room 118 flooding R43-FOl Provide adequate emergency power to engineered 56, 70, 72, safeguards loads within the required time frame and 73, 76 duration N23-F02 The TDAFW pump provides a reliable source of water to 102-104, the steam generators during emergency conditions 107 V43-F03 Maintain risk significant fire protection system pressure 118 boundary to prevent flooding R15-FOI Provides power to Class IE equipment 60, 64, 66, E21-FI I Provide a flowpath for delivery of High pressure 109 emergency core cooling for ECCS injection phase or Bleed and Feed P17-FOI Circulate water through the CCW system and maintain 3-5, 6, 8, 10, temperatures within the design operating band with the 14, 19 heat exchangers during normal operation and during accident conditions N23-FOI MDAFW pumps provide a reliable source of water to the 102,107 steam generators during emergency conditions ORCAI------H Operator fails to trip reactor coolant pump on loss of oil 2

cooling P16-F02 Provide sufficient cooling water flow to meet the 19, 119, 121 requirements of components served by service water during normal and emergency operations

e. A listing of the industry and NRC documents used to derive the set of SAMAs for FNP.

SNC Response:

In preparing the Farley SAMA list, SNC used Farley-specific insights and the list of SAMAs that SNC included in its environmental report for the Hatch Nuclear Plant license renewal. The Hatch list was a compilation of Hatch-specific insights and the list of SAMAs that Baltimore Gas and Electric Company (BGE) had included in its environmental report for the Calvert Cliffs license renewal. The BGE list was a compilation of Calvert Cliffs-specific insights and SAMAs and SAMDAs identified in a variety of industry and NRC documents and that BGE listed in its environmental report. Thus, the listing of industry and NRC documents used to derive the set of SAMAs for FNP is as follows:

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 53 of 75

Applicant's Environmental Report - Operating License Renewal Stage; Edwin 1. Hatch Nuclear Plant. Appendix D, Application for License Renewal Under the Atomic Energy Act of 1954 as Amended for Edwin 1. Hatch Nuclear Plant Units I and 2. February, 2002.

Applicant's Environmental Report - Operating License Renewal Stage; Calvert Cliffs Nuclear Power Plant Units I and 2, Volume 3, Calven Cliffs Nuclear Power Plant Units I and 2 License Renewal Application. April 1998.

The Watts Bar Nuclear Plant Unit I PRA/IPE submittal The Limerick SAMDA cost estimate report NUREG-1437 description of Limerick SAMDA NUREG-1437 description of Comanche Peak SAMDA Watts Bar SAMDA submittal TVA response to NRC's RAI on the Watts Bar SAMDA submittal Westinghouse AP600 SAMDA Safety Assessment Consulting (SAC) presentation by Wolfgang Werner at the NUREG 1560 conference NRC IPE Workshop - NUREG 1560 presentation NUREG 0498, supplement 1, section 7 NUREG/CR-5567, PWR Dry Containment Issue Characterization NUREG-1560, Volume 2, NRC prospective on the IPE program NUREG/CR-5630, PWR Dry Containment Parametric Studies NUREG/CR-5575, Quantitative Analysis of Potential Performance Improvements for the Dry PWR Containment CE System 80+ SAMDA Submittal NUREG 1462, NRC Review of the ABB/CE System 80+ Submittal An ]CONE paper by C. W. Forsberg, et. al., on a core melt source reduction system

6. The set of SAMAs considered in the FNP ER appear to have originated from a compilation of potential plant improvements developed as part of SNC's license renewal application for Hatch Nuclear Plant. In license renewal applications for subsequent plants, several additional SAMAs have been identified that might also be applicable for FNP. These include SAMA numbers 59, 60,149,166,169,175, 177, 210,21]1, and 216 in Table F.4-1 of the ER for Summer Nuclear Station. Please provide rationale for eliminating each of these SAMAs from further consideration at FNP, e.g., justification that the objective of the candidate SAN1A and the associated risk reduction is addressed by one or more of the Phase I SAMAs identified in Table F-10 of the FNP ER (with reference to the appropriate Phase I SAMAs), or that the candidate SAMA is not relevant to FNP.

SNC Response:

A response for each of the referenced SAMAs is provided in the following Table:

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 54 of 75 SNC Evaluation of V. C. Summer Candidate SAMAs V. C.

Summer FNP SAMA Screening ID SAMA Title Result of potential enhancement Discussion Criteria 59 Refill CST.

SAMA would reduce the risk of core This is not directly applicable to a Not damage during events such as extended PWR design. However, consistent Screened station blackouts or LOCAs that render with the treatment by V. C. Summer.

the suppression pool unavailable as an improvements in ECCS recirculation injection source due to heatup.

performance or installation of additional RWST capacity could improve LOCA response.

60 Maintain ECCS Suction on CST.

SAMA would maintain suction on the This is not directly applicable to a B

CST as long as possible to avoid pump PWR design. However, consistent failure as a result of high suppression with the treatment by V. C. Summer, a pool temperature.

similar PWR consideration would be delay of ECCS recirculation by minimizing RWST drawdown. This strategy is already considered in FNP Emergency Response Guidelines.

149 Proceduralize use of pressurizer vent Some plants may have procedures to Use of the pressurizer PORVs as a B

valves during steam generator tube direct use of pressurizer sprays to back-up means of RCS pressure rupture (SGTR) sequences.

reduce RCS pressure after a SGTR.

reduction after a SGTR is already Use of vent valves would provide a included in the FNP Emergency back-up method.

Response Guidelines.

166 Proceduralize local manual operation This SAMA would lengthen AFW FNP Emergency Response Guidelines Not of AFW when control power is lost.

availability in a SBO. Also provides a include provisions for manual control Screened success path should AFW control of AFW flow following loss of control power be lost in non-SBO sequences.

power. However, procedures do not exist for operation of the turbine-driven AFW pump (TDAFWP) with no control power. Therefore, there is a potential procedure enhancement to extend TDAFWP operation in a SBO.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 55 of 75 Summer FNP SAMA Screening ID SAMA Title Result of potential enhancement Discussion Criteria 169 Create ability for emergency This SAMA would be a back-up water FNP already has provisions for A

connections of existing or alternate supply for the feedwater/condensate alignment of the service water system water sources to feedwater/condensate.

systems.

as a water supply for Auxiliary Feedwater.

175 Replace current PORVs with larger This SAMA would reduce the The PORVs at FNP already have A

ones so only one is required for dependencies required for successful sufficient capacity to allow successful successful feed and bleed.

feed and bleed.

feed and bleed with a single valve.

177 Use Main FW pumps for a Loss of This SAMA involves a procedural FNP Emergency Response Guidelines B

Heat Sink Event.

change that would allow for a faster for response to Loss of Heat Sink response to loss of the secondary heat events already include provisions for sink. Use of only the feedwater use of the turbine driven feedwater booster pumps for injection to the SGs pumps.

requires depressurization to about 350 psig. before the time this pressure is reached, conditions would be met for initiating feed and bleed. Using the available turbine driven feedwater pumps to inject water into the SGs at a high pressure rather than using the feedwater booster alone allows injection without the time consuming

___depressurization.

210 Alternate Charging Pump Cooling This SAMA will improve the high Procedures already exist at FNP for B, C (7.

pressure core flooding capabilities by alignment of the Fire Protection 14) providing the SI pumps with alternate System as an alternate charging pump gear and oil cooling sources. Given a cooling source. Tn addition, FNP total loss of CCW, AOPs would direct SAMAs 7 and 14 addressed provision alignment of chilled water, of additional cooling for charging.

Demineralized Water. or the Fire pump gear oil and installation of an System to the CCW System to provide additional component cooling water cooling to the ST pumps' gear oil box pump to accomplish this same (and the other normal loads).

improvement.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 56 of 75 V. C.

Summer FNP SAMA Screening I)

SAMA Title Result of potential enhancement Discussion Criteria 211 Chiller Operation Rotation This SAMA will improve the high FNP (Ioes not utilize a chilled water N/A pressure core flooding capabilities by system for component cooling. FNP providing the St pumps with a more SAMAs 7 and 14 addressed provision reliable source of Chilled Water to the of additional cooling for charging gear and oil coolers in the event that pump gear oil and installation of an CCW is lost. The VCSNS operations additional component cooling water group identified a detriment in the pump to accomplish this same Chiller pumps' start probability related improvement.

to prolonged "standby times." Standby times would be reduced by rotating the operating chiller train.

216 Allow local, manual operation of This SAMA will allow re-FNP Emergency Response Guidelines 1

Instrument Air isolation valves.

establishment of Instrument Air flow already contain provisions for manual to the Pressurizer PORVs and opening of the instrument air isolation subsequent alignment of feed and valves when control power is lost or bleed for sequences in which the remote operation is unsuccessful.

accumulators have been depleted and the IA isolation valves' air operators fail to cycle on an "open" signal (assuming Instrument Air is available).

Screening Criteria A - Already addressed by existing FNP design.

B - Already addressed by existing FNP procedures.

C - Addressed by other SAMAs (Other SAMA numbers In parentheses) 0 - Already addressed by FNP training program E - Estimated cost exceeds twice the maximum attainable benefit from internal events mitigation N/A - Not applicable to FNP.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 57 of 75 Therefore, the only SAMAs from the V. C. Summer list that would not immediately screen out in Phase I would be SAMAs 59 and 166.

The potential for CDF reduction from implementation of plant modifications to address SAMA 59 were estimated by applying a recovery factor of 0.1 to cutsets involving failures of ECCS sump suction or ECCS sump cooling in the ECCS recirculation phase. Applying the recovery factor of 0.1 lowers the total CDF to 2.90E-05 per reactor year. This is a CDF reduction of 4.47E-06. A CDF reduction of this magnitude would result in an averted cost for this SAMA of approximately $89,276.

The net benefit of this SAMA is addressed in the response to questions 8 and 9 under SAMA ID S59.

The potential for CDF reduction from implementation of the changes recommended for SAMA 166 was estimated by adding a recovery factor of 0.01 to all cutsets involving failure of the turbine-driven AFW pump uninterruptible power supply. This resulted in a new total CDF of 2.98E-05 per reactor year. This is a CDF reduction of 3.62E-06. A CDF reduction of this magnitude would result in an averted cost for this SAMA of approximately $72,199. The net benefit of this SAMA is addressed in the response to questions 8 and 9 under SAMA ID S 166.

7. The SANIA analysis did not include an assessment of SAMIAs for external events. The FNP IPE for External Events (IPEEE) has shown that the CDF due to internal fire initiated events is about 1.66x10-4 per reactor year for Unit 1 and 1.28x10-4 per reactor year for Unit 2 which is substantially greater than the internal events CDF on which the SAMA evaluation is based.

The risk analyses at other commercial nuclear power plants also indicate that external events could be large contributors to CDF and the overall risk to the public. In this regard, the following additional information is needed:

I

a. NUREG-1742 ("Perspectives Gained From the IPEEE Program," Final Report, 4/02), lists the significant fire area CDFs for FNP (page 3-21 of Volume 2). WThile these fire-related CDF estimates may be conservative, they are still large relative to the FNP internal events CDF. For each fire area, please explain what measures were taken to further reduce risk, and explain why these CDFs can not be further reduced in a cost effective manner; SNC Response:

The compartments identified as having significant fire impacts can be grouped into nine general categories with respect to the significant contributors to fire risk and potential plant improvements:

Switchaear Rooms This category includes fire compartments 18A, 19A, 21A, 41A, 56A, and 56B. The significant contributors to risk for the switchgear rooms are fires in the oil-filled transformers for 600-V load centers located in the rooms and fires originating in the Control Rod Drive Mechanism Motor-generator sets. Loss of the on-service train switchgear leads to a loss of RCP seal cooling support systems. Consistent with NEI guidelines for assessing IPEEE vulnerabilities, SNC identified procedural enhancements to improve response to a fire-induced loss of RCP seal cooling.

Additional modifications to reduce the fire risks in these areas, such as replacement of the oil-filled transformers with dry transformers or installation of alternate RCP seal cooling capability, were determined not to be cost effective.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 58 of 75 Electrical Penetration Rooms This category includes fire compartments 34B and 35A. The significant contributors to risk for these compartments are fires in the motor control centers (MCCs) resulting in spurious closure of valves in the service water supply to the component cooling water heat exchanger or in the discharge paths for the motor-driven auxiliary feedwater pumps. Since these spurious closures would require smart hot-shorts in the valve control circuits, the risk for these compartments was considered conservatively high. Consistent with NE] guidelines for assessing IPEEE vulnerabilities, SNC identified procedural enhancements to improve response to the potential spurious valve closures.

Main Control Room This category consists of fire compartment 44A. The major contributors to risk in this compartment are fires in the main control boards which result in loss of control of both trains of safe shutdown (SSD) equipment and require plant shutdown using controls on the hot shutdown panels. This analysis is also considered conservative, since the configuration of the control board and distance between controls for various SSD systems make it unlikely that both trains of every SSD system will be damaged before the fire is extinguished. Consistent with NEI guidelines for assessing IPEEE vulnerabilities, SNC verified that procedures were in place to address loss of control from the main control board due to fire.

Service Water Pump Room This category consists of fire compartment 72A. The major contributor to risk in the compartment is transient fires in areas where both trains of service water are impacted. This would result in loss of RCP seal cooling. Consistent with NEI guidelines for assessing IPEEE vulnerabilities, SNC identified procedural enhancements to improve response to a fire-induced loss of RCP seal cooling. Additional modifications to reduce the fire risks in this area, such as installation of alternate RCP seal cooling capability, were determined not to be cost effective.

Component Cooling Water Heat Exchanger/Pump Room This category consists of fire compartment 6C. The major contributor to risk in the compartment is a fire in the on-service CCW pump, resulting in loss of RCP seal cooling and damage to control cables for the turbine-driven auxiliary feedwater pump. Consistent with NEI guidelines for assessing IPEEE v'ulnerabilities, SNC identified procedural enhancements to improve response to a fire-induced loss of RCP seal cooling. Additional modifications to reduce the fire risks in this area, such as installation of alternate RCP seal cooling capability, were determined not to be cost effective.

Low Voltage Switchyard This category consists of fire compartment 84A. The major contributor to risk in this compartment is fire in the auxiliary transformers or startup transformers resulting in a total or partial loss of offsite power. Consistent with NE] guidelines for assessing IPEEE vulnerabilities, SNC verified that procedures were in place to address loss of offsite power due to fire.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 59 of 75 Cable Spreading Room This category consists of fire compartment 40A. The major contributors to risk in this compartment are fires in electrical cabinets and transient combustible fires resulting in a loss of control of SSD equipment from the control room. Consistent with NEI guidelines for assessing IPEEE vulnerabilities, SNC verified that procedures were in place to address loss of control from the main control board due to fire.

Turbine Buildine This category consists of fire compartment 80A. The major contributors to risk in this compartment are oil-filled transformer fires resulting in loss of offsite power. Equipment required for safe shutdown is not located in the Turbine Building, and does not have cables routed through the turbine building. In addition, turbine generator fires were verified not to contribute to loss of offsite power. Consistent with NEI guidelines for assessing IPEEE vulnerabilities, SNC verified that procedures were in place to address loss of offsite power due to fire.

Other Compartments This category encompasses fire compartments 6A, 4A10, and 4A 17. The major contributors to risk in these compartments are electrical cabinet fires, indoor transformer fires, and emergency air compressor fires resulting in loss of SSD equipment. These compartments were screened by evaluation external to the Fire Induced Vulnerability Evaluation (FIVE) methodology, but were included in the LPEEE summary table to provide a complete accounting of all compartments not screened through FIVE, Phase 11, step 3. Consistent with NEI guidelines for assessing IPEEE vulnerabilities, SNC verified that procedures were in place to address to address the fire risks in these compartments. Additional modifications to reduce the fire risks in this area, such as installation of alternate RCP seal cooling capability, were determined not to be cost effective.

As can be seen, the major fire risks were associated with fires causing loss of offsite power and/or loss of RCP seal cooling support systems. Therefore, although not explicitly identified as reducing risks due to fire, SAMAs 2-5, 6, 8, 10-11, 13-14, 19, 56,70, and 124 would result in a reduction of fire risk associated with the significant fire compartments identified in the IPEEE.

b. Table 3.5 of NUREG-1742 lists several fire-related plant improvements for FNP (pages 3-55 and 3-56 of Volume 2). Indicate whether all of the "Plant improvements" have been implemented. If not, please explain why within the context of this SAMA study; SNC Response:

All fire-related plant improvements listed in NUREG-1742 Table 3.5 had been implemented prior to the SAMA analysis.

c. NUREG-1742 lists seismic outliers and improvements for FNP (pages 2-28 of Volume 2).

Indicate whether the "Plant improvements" that address the outliers have been implemented for all outliers. If not, please explain why within the context of this SAMA study;

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 60 of 75 SNC Response:

All plant improvements to corrected seismic outliers listed in NUREG-1742 (pages 2-28 of Volume 2) had been implemented prior to the SAMA analysis.

8. SNC has opted to double the estimated benefits (for internal events) to accommodate any contributors for external events. This is acceptable when sound reasons exist to support such a numerical adjustment. However, based on the information in the ER and in the FNP IPEEE report, the fire CDF is approximately a factor five greater than the internal events CDF, which suggests that the baseline CDF should be increased by a factor of six to account for external events. In order to determine if external events have been satisfactorily accounted for, please provide the following information:

a. The current CDF for fire-initiated events, and justification that doubling the estimated benefits for internal events will bound risk from fire events:

SNC Response:

SNC recently updated the CDF for fire-initiated events in the significant fire compartments identified during the IPEEE with conditional core damage probabilities generated from the Revision 5 PRA model. The revised CDF for each significant compartment is:

Average Average Fire Compartment Description CDF LERF 1-41A Aux Bldg SWGR Room Train A 1.57E-05 3.33E-09 44A Control Room -.

I6E-05 3.1OE-09 1-21A Aux. Bldg SWGR Room Train B 1.04E-05 2.20E-09 72A SW Intake Structure 3.77E-06 8.0IE-I0 J-35A Train A Elec. Pen. Room 2.18E-06 4.63E-10 1-34B Train B Elec. Pen. Room 1.54E-06 3.26E-I0

]14A10 Aux Bldg, Elev 12] Elev.

9.95E-07 2.68E-10 I-6C Aux Bldg (CCW Pumps) 7.36E-07

].56E-10 56B DG Bldg SWGR Room B 6.05E-07

].28E-I 0 1-19A Aux Bldg. SWGR Room lB (DC) 6.OOE-07 1.27E-I0 1-18A Aux Bldg. SWGR Room IA (DC) 4.67E-07 9.90E-1 I 1-80A XFMR Yard 3.08E-07 6.53E-1 I 56A DG Bldg SWGR Room A 2.63E-07 5.53E-1 I 1-84A Turbine Bldg 2.18E-07 4.62E-l I 1-4A17 Aux Bldg 155'Elev.

2.12E-07 4.49E-l l I1-40A Unit I Cable Spread Rm I.74E-07 4.27E-I I 1-6A Aux Bldg (TDAFWP) 2.18E-08 4.62E-12 Total 4.98E-05 I.13E-08

The Fire Compartment References may be found in the Joseph M. Farley Nuclear Plant Unit I and Unit 2 Individual Plant Examination of External Events Submittal Report Table 4-1.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 61 of 75 Therefore, the multiplying factor for internal events plus fire events should have been:

MF = (Internal CDF + Fire CDF) / Internal CDF

= (3.35E-05 + 4.98E-05) / 3.35E-05

= 2.49 The seismic risks for Farley were evaluated using the Seismic Margins Assessment methodology.

Therefore, a seismic CDF has not been calculated for Farley. However, the Farley site was binned in the lowest seismic risk category for the IPEEE. Therefore, seismic risks would not be expected to be significant contributors to total CDF for Farley. However, to bound a small seismic risk contribution, a multiplying factor of 3.0 is used in the responses to questions 8.c and 8.d.

b. A description of the impact on the fire CDF from the plant/procedure modifications that were made in conjunction with SNCs decision to retract the two Appendix R exemption requests as described in a letter to the NRC dated June 29,2000; SNC Response:

The plant/procedure modifications which resulted in retraction of the subject Appendix R exemptions were completed prior to the IPEEE analysis and were considered in determining the consequences of fire in the affected compartments. Therefore, there is no impact on the CDF calculated for the affected compartments in the IPEEE and the subsequent update of the fire CDF for each significant compartment.

c. An assessment of the impact on the Phase I screening if the internal events risk reduction estimates are increased by a factor that would bound the risk from fire and seismic events; and SNC Response:

As discussed in the response to question 8.a, a more appropriate multiplying factor to bound external events would have been 3.0. Use of a multiplying factor of 3 instead of the factor of 2 used in the baseline analysis would result in the Phase I screening value being increased from

.$1,400,000 to $2,106,000.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 62 of 75 Using the new screening value, the following nine additional SAMAs would have been retained for the Phase 2 analysis:

SAMA ID SAMA Title Estimated Cost 8

Eliminate the RCP thermal barrier dependence on

$1,660,000 component cooling such that a loss of component cooling does not result directly in core damage.

14 Install additional component cooling water pump

$1,500,000 19 Procedural guidance for use of cross-tied component cooling

$1,750,000 or service water pumps.

36 Create a passive design hydrogen ignition system.

$1,520,000 48 Install a passive containment spray system.

$2,000,000 80 Improve SGTR coping abilities.

S1,670,000 121 Modify Unit 2 SW pumps to eliminate dependence on lube

$1,760,000

& cooling booster pumps.

122 Replace RHR HX heads with stronger material.

$1,400,000 124 Redesign CCW miscellaneous header to allow either train to

$1,746,000 supply RCP thermal barrier without need for local manual re-alignment.

d. An assessment Of the impact on the Phase 2 evaluation if risk reduction estimates are increased by a factor that would bound the risk from fire and seismic events.

SNC Response:

SAMAs 8,14, 19, and 124 are similar in benefit to analyzed SAMA II in that the intent is to lower RCP seal dependence on the component cooling water system. The estimated benefit value of SAMA 11 was $229,028. If this is increased by a factor of 3 to bound external events impacts, the total benefit value is $687,085.

SAMAs 36 and 48 would not reduce CDF and would not significantly affect offsite release probability for Farley because containment failure due to overpressure is a late failure mode and hydrogen detonation is not a likely containment failure mode. Therefore, the benefit of these SAMAs is considered bounded by the benefit of eliminating the Offsite Exposure Costs and Offsite Economic Costs calculated in ER Attachment F, Section 3.0. The total of these costs is

$45,756. If this is multiplied by a factor of 3 to bound external events, the final benefit value of these SAMAs is approximately $137,269.

SAMA 80 is not bounded by the analyzed cases. The benefit of this SAMA can be estimated by determining the benefit to be achieved by complete elimination of Steam Generator Tube Rupture (SGTR) events. Based on the FNP Revision 5 results, the CDF due to SGTR is 7.45E-08 per reactor year (0.1 9% of the total CDF). The offsite release consequences of SGTR are represented by Sequence B4998 in Table F-6 of the ER. The person-rem contribution of Sequence B4998 is 0.045 per Table F-6 of the ER. Therefore, the benefit value of eliminating SGTR is approximately $3,486. If this is increased by a factor of 3 to bound external events impacts, the total benefit value is $10,457.

The potential benefit of SAMA 122 is bounded by analyzed SAMA 96 which was analyzed by assuming that all ISLOCA sequences and all failures of containment isolation were eliminated.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 63 of 75 The estimated benefit value of SAMA 96 was $37,500. If this is increased by a factor of 3 to bound external events impacts, the total benefit value is S] 12,500 Prior to performance of the SAMA, SNC management had approved implementation of the modification proposed for SAMA 121. The modifications have been completed on two of the five pumps and are currently scheduled to be completed on all pumps by the end of 2005.

Therefore, it was not considered necessary to calculate the benefit for this SAMA.

The net value of modifications to address the expanded list of SAMAs, using a factor of 3 to increase the internal events only value to bound external events, is presented in the following table:

U. S. Nuclear Regulatory CommissiOn NL-04-0287 Enclosure Page 64 of 75 Table 8.d - Summary or Phase 11 SANMA Analysis Considering Internal and External Events Person-CDF rem Avcrted Avcrted Averted Averted Averted Extcrnal Recdction reduction orrsitc Orfsitc On-sitc On-Sitc Replacement Events Final Estimated SAMA

(%)

Exposure Cost Expostirc Cicanup Power Total Multiplicr Benefit Cost Net Benceit 7

9.03 1.52

$396

$6

$l.l50

$35,757

$22.312

$59.621 3

$178.964

$270,000

($91.136) 8 34.58 8.34

$2.179

$39

$4,403

$136.952

$85.455

$229,029 3

$687,085

$1.660.000

($972.915) 11 34.5*

8.34

$2.179

$39

$4,403

$136,952

$85.455

$229.028 3

$687.085

$520.000

$167.085 14 34.58 8.34

$2,179

$39

$4,403

$136,952

$85.455

$229.028 3

$687,085

$1.500.oO0

($812.915) 19 34.58 834

$2,179

$39

$4,403

$136,952

$85.455

$229.028 3

$687.085

$1.750,On

($1.062.915) 24 9.41 7.08

$1.849

$456

$1.198

$37.264

$23.252

$64,019 3

$192.058

$830,000

($637.942) 36 00.0 I00.00

$26.123

$19.633

$0

$45,756 3

$137.269

$1,520.000

($1.382,731) 48 o.00 100.0

$26.123

$19,633

$0

$45.756 3

$137.269

$2,000.000

($1.862.731) s0 0.25 3.75

$979

$867

$32

$990

$618

$3.486 3

$10,457

$I.670.000

($1,659.543) 89 1.00 57.25

$14.954

$15.997

$127

$3.954

$2.467

$37,500 3

$112.500

$425,000

($312.50n) 96 1.00 57.25

$14,954

$15.997

$127

$3.954

$2,467

$37.500 3

$112.500

$90000

($847,500) 10l 13.81 6.21

$1,624

$24

$1.759

$54,697

$34,130

$92.233 3

$276.698

$900,000

($623,302) 117 1.26 0.90

$234

$5

$160

$4.972

$3.103

$8,474 3

$25.422

$122,0O0

($96,578) 118 1.15 0.82

$215

$4

$147

$4.558

$2.844

$7,768 3

$23,304

$122,000

($98,6.96) 119 9.41 7.08

$1.849

$456

$1,198

$37,264

$23.252

$64.019 3

$192.058

$930,000

($737.942) 120 2.53 1.80

$471

$lo

$322

$10,004

$6.242

$17,049 3

$51,147 S475,000

($423.853) 122 I.00 57.25

$14,954

$15.997

$127

$3.954

$2,467

$37,500 3

$112,500

$1,400.000

($1,287,500) 123

.0 57.25

$14,954

$15.997

$127

$3,954

$2,467

$37.500 3

$112.500

$330,000

($217,500) 124 34.58 8.34

$2.179

$39

$4.403

$136,952

$85,455

$229,028 3

$687.085

$1,746.000

($1,058.915)

S59*

13.35 5.69

$1.487

$193

$1,701

$52.892

$33.003

$89.276 3

$267.827

$1.500.000

($1.232.173)

S166*

10.83 4.39

$1,146

$35

$1.379

$42.882

$26.758

$72,199 3

$216,598

$100,0o0

$116.598

SAMAs added in response to RAI question 6.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 65 of 75

9. The SAMA analysis did not include an assessment of the impact of PRA uncertainties. On that basis, please provide the following information to address these concerns:

a. An estimate of the uncertainties associated with the calculated core damage frequency (e.g.,

the mean and median internal events CDF estimates and the 5th and 95 th percentile values of the uncertainty distribution);

SNC Response:

The Farley Revision 5 PRA model used for the SAMA analysis was not populated with uncertainty distributions for all basic events. Consequently, the median, 5t, and 95th percentile CDF values are not readily available. To provide an estimate of the uncertainty, SNC reviewed uncertainty distribution estimates for plants with similar design available from published sources and reviewed the insights regarding PRA uncertainty developed in EPRI Technical Report 1008905, Final Report, June 2003, 'Parametric Uncertainty Impacts on Option 2 Safety Significance Categorization."

The only publicly available information for plants similar in design to Farley came from the SAMA RAI responses for H. B. Robinson and V. C. Summer. The uncertainty distributions developed for those plants are as follows:

Plant Point Parametric 5 Median 95h 95h/Point Error Estimate Mean Percentile Value Percentile Estimate Factor Mean Value Value Value Mean Value Ratio H. B.

4.3E-05 4.5E-05 l.5E-05 3.3E-05 1.1 E-04 2.6 2.7 Robinson I

V. C.

5.6E-05 5.6E-05 I.9E-05 4.4E-05 I 1.3E-04 2.3 2.6 Summer These results are consistent with the results of the EPRI analysis which showed that for error factors from 3 to 10, the ratio of the 95th percentile value to the point estimate mean ranged from 2.4 to 3.7.

The point estimate mean CDF calculated in the Farley Revision 5 PRA model for Unit I is similar to that calculated by both H. B. Robinson and V. C. Summer. Also, V. C. Summer and H.

B. Robinson are considered to be peer plants to Farley due to similarity in design. Therefore, the ratio of the 95th percentile to point estimate mean would be expected to be consistent with the results obtained for these plants. Therefore, the higher ratio of 2.6 will be applied to represent the uncertainty in the internal events CDF.

With regards to the uncertainty in the external events CDF contribution, EPRI TR 1008905 notes that for very large uncertainty range events, (such as seismic events), the mean value is close to the upper bound value. Therefore, the use of the same multiplier for the fire contribution to total CDF would not be appropriate. The EPRI report calculated a 95th percentile to point estimate mean ratio of 2.0 with an assumed error factor of 100. Therefore, this value will be used for external events.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 66 of 75 This results in a total multiplying factor considering the upper bound internal and external events of:

MF = I (Internal CDF

2.6) + (Fire CDF

2.0)) / Internal CDF

= 1(3.35E-05

2.6) + (4.98E-05

2.0)) / 3.35E-05

= 18.71 E-05 + 9.96E-05) / 3.35E-05

= 5.57 To account for small unquantified seismic risks, a final factor of 6.0 will be used for responding to the following questions.

b. An assessment of the impact on the Phase I screening if risk reduction estimates are increased to account for uncertainties in the risk assessment; and SNC Response:

Use of a multiplying factor of 6 to bound external events and uncertainties instead of the factor of 2 used in the baseline analysis would result in the Phase I screening value being increased from

$1,400,000 to 54,21 1,000. When the Phase I screening was re-evaluated using the higher screening value, seven SAMAs in addition to those identified in the response to question 8.c would have been retained for the Phase 2 analysis. These additional SAMAs are:

SAMA ID SAMA Title Estimated Cost 9

Add redundant DC Control Power for SW Pumps C & D

$3,200,000 10 Create an independent RCP seal injection system, with a

$3,800,000 dedicated diesel.

45 Provide a containment inerting capability.

$3,200,000 49 Strengthen primary/secondary containment.

$3,260,000 79 Install a redundant spray system to depressurize the primary

$2,270,000 system during a steam generator tube rupture.

86 Implement a maintenance practice that inspects 100% of the

$3,000,000 tubes in a SG.

107 Install motor-driven feedwater pump.

$2,200,000

c.

An assessment of the impact on the Phase 2 evaluation if risk reduction estimates are increased to account for uncertainties in the risk assessment. Please consider the uncertainties due to both the averted cost-risk and the cost of implementation to determine changes in the net value for these SAMAs.

SNC Response:

SAMAs 9 and 10 are similar in benefit to analyzed SAMA I1 in that the intent is to lower the RCP seal LOCA contribution to CDF. The estimated benefit value of SAMA II was $229,028.

If this is increased by a factor of 6 to bound external events impacts and uncertainties, the total benefit value is $1,374,170.

SAMAs 45 and 49 would not reduce CDF and would not significantly affect offsite release probability for Farley because containment failure due to overpressure is a late failure mode and hydrogen detonation is not a likely containment failure mode. Therefore, the benefit of these SAMAs is considered bounded by the benefit of eliminating the Offsite Exposure Costs and

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 67 of 75 Offsite Economic Costs calculated in ER Attachment F, Section 3.0. The total of these costs is

$45,756. If this is multiplied by a factor of 6 to bound external events and uncertainties, the final benefit value of these SAMAs is approximately $274,538.

SAMAs 79 and 86 are not bounded by the analyzed cases, but are similar in impact to SAMA 80 which was evaluated in the response to question 8.d. The benefit of these SAMAs can be estimated by determining the benefit to be achieved by complete elimination of Steam Generator Tube Rupture (SGTR) events. Based on the FNP Revision 5 results, the CDF due to SGTR is 7.45E-08 per reactor year (0.199% of the total CDF). The offsite release consequences of SGTR are represented by Sequence B4998 in Table F-6 of the ER. The person-rem contribution of Sequence B4998 is 0.045 per Table F-6 of the ER. Therefore, the benefit value of eliminating SGTR is approximately S3,486. If this is increased by a factor of 6 to bound external events impacts and uncertainties, the total benefit value is $20,913.

The potential benefit of SAMA 107 is similar to that for analyzed SAMA 101 which was analyzed by assuming that main feedwater flow control valve failure was removed from the model. The estimated benefit value of SAMA 101 was $92,233. If this is increased by a factor of 6 to bound external events impacts and uncertainties, the total benefit value is S553,396.

The net value of modifications to address the expanded list of SAMAs, using a factor of 6 to increase the internal events only value to bound external events and uncertainties, is presented in the following table:

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Pagc 68 of 7.5 Table 9.c - Summary of Phase 11 SAMA Analysis Considering Internal and External Events and Uncertainties Person-CDF rem Avertled Averted Averted Averted Averted Reduction reduction ofrsite Ofrsitc On-sitc On-Site Replacemcnt Uncertainty Final Estimated SAMA

(%)

Expos-trc Cost Exposire Cleanup Power Total Multiplier Bencfit Cost Net Benefit 7

9.03 1.52

$396

$6

$S.150

$35.757

$22.312

$59.621 6

$357.728

$270.000

$87,728 8

34.58 8.34

$2.179

$39

$4.403

$136.952

$85,455

$229.028 6

$1.374,170

$ 1660,000

(.$2S5.830) 9 34.58 8.34

$2.179

$39

$4.403

$136,952

$R5,455

$229.028 6

$l.374.170

$3.200.000

($l1.25.830) 10 34.58 8.34

$2.179

$39

$4.403

$136.952

$85.455

$229.028 6

$1,374,170

$3,800,000

($2.425.830)

.I 34.58 8.34

$2.179

$39

$4.403

$136,952

$85.455

$229.028 6

$1.374,170

$520,000

$854.170 14 34.58 34

$2,179

$39

$4.403

$136.952

$85.455

$229.028 6

$l.374.70

$i.sooono

($125,830) 19 34.58 8.34

$2.179

$39

$4.403

$136,952

$R5.455

$229.028 6

$1.374.170

$1.750,00O

($375,830).

24 9.41 7.08

$1.849

$456

$1.198

$37,264

$23.252

$64.019 6

$384.116

$830,000

($445,884) 3 6 0o0n 100.00

$26.123

$19,633

$0

$45.756 6

$274.538

$1.520,000

($1.245.462) 45 o.m(

100.00

$26.123

$19,633

$0 so

$0

$45,756 6

$274.538

$3,200,000 ($2,925,462) 48 0.0n 100.00

$26.123

$19,633

$0

$45.756 6

$274.538

$2.000,0O0

($1,725,462) 49 0.00 100.0

$26.123

$19.633

$0

$45,756 6

$274.538

$3,260,000

($2.9R5,462) 79 0.25 3.75

$979

$867

$32

$990

$618

$3.486 6

$20.913

$2.270,000

($2.249.087) 80 0.25 3.75

$979

$867

$32

$990

$618

$3.486 6

$20.913

$1,670,000

($1,649,087) 86 0.25 3.75

$979

$867

$32

$990

$618

$3,486 6

$20.913

$3.000,000

($2,979,087) 89 1.00 57.25

$14,954

$15,997

$127

$3,954

$2,467

$37.500 6

$225,001

$425.000

($199.999) 96 I.0 57.25

$14,954

$15.997

$127

$3.954

$2,467

$37,500 6

$225,001

$960,0O0

($734,999) 101 13.81 6.21

$1.624

$24

$1,759

$54.697

$34.130

$92.233 6

$553.396

$900.00o

($346,604)-

107 13.81 6.21

$1.624

$24

$1.759

$54,697

$34,130

$92.233 6

$553.396

$2.200,0oo

($1.646.604) 117 1.26 0.90

$234

$5

$160

$4,972

$3.103

$8,474 6

$50.845

$122.00

($71,155)

IN 1.15 0.82

$215

$4

$147

$4.558

$2,844

$7.768 6

$46,607

$122.0O0

($75.393) 119 9.41 7.0R

$1,849

$456

$1,198

$37,264

$23,252

$64.019 6

$384,116

$930.000

($545,884) 120 2.53 1.80

$471

$10

$322

$10,004

$6.242

$17,049 6

$102.294 S475.000

($372.706) 122 1.o 57.25

$14,954

$15,997

$127

$3.954

$2,467

$37,500 6

$225.001

$1.400.000

($1.174.999) 123 u.0 57.25

$14,954

$15,997

$127

$3,954

$2.467

$37,500 6

$225,001

$330,000

($104,999) 124 34.58 8.34

$2,179

$39

$4.403

$13f6,952

$R85455

$229.028 6

$1.374,170

$1.746,000

($371,830)

S59*

13.35 5.69

$1,487

$193

$1.701

$52,892

$33.003

$R89276 6

$535,653

$1.500,000

($964.347)

S166*

10.83 4.39

$1,146

$35

$1.379

$42.882

$26,758

$72,199 6

$433,197

$1 00.O0

$333,197

SAMAs idded in response to RAI questiOn 6.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 69 of 75

10. Provide the requested information on the following SAMAs:

a.

hy SANIA 122 was screened in Phase 1 when it has an estimated cost or $1.4NI SNC Response:

SAMA 122 was screened in to be conservative because its estimated cost was right at the screening threshold.

b.

wvhy SAMAs 14 and 36 were not screened in when using a 3-percent real discount rate, SNC Response:

The SNC response to RAI 9c shows the results of including SAMAs 14 and 36 in evaluations of additional benefit from accounting for reduction in risk from external events and for uncertainties (multiplying total SAMA benefit by 6). As shown, the potential benefits of SAMA 14 ($I.4M).-

and SAMA 36 ($275,000) are still less than the estimated cost of implementation for SAMA 14

($l.5M) and SAMA 36 ($1.5M). These data suggest that SAMA 14 is the limiting of the two cases. Determination of net benefit for SAMA 14 with 3 percent discount rate and a factor of 3 to account for external events yields a net benefit of approximately minus $755,000, indicating that SAMAs 14 and 36 would not screen in under Phase 11 SAMA analysis under these conservative conditions. However, for informational purposes, the Alabama Power discount rate for modifications has historically been over 7%.

c. SAMA 19 involves "procedural guidance for use orcross-tied component cooling or service water-pumps" with an estimated cost of $1.75M. Explain/provide more details on the enhancement and the associated cost, SNC Response:

Valves isolating CCW flow to the CCW heat exchangers, including the train cross-connect isolation valves, are manually operated. Valves isolating SW flow to the CCW heat exchangers have MOVs, which are electrically interlocked to prevent aligning two CCW heat exchangers to one SW train. The SW train cross-connect isolation valves are manually operated. Analysis has determined that for cross-tying CCW or SW to be beneficial for prevention of Reactor Coolant Pump seal damage, alignment must be achieved in 15 minutes or less. To achieve this, positioning of the isolation and train cross-connect isolation valves will have to be done remotely.

In either case, configuring the valves for remote operation will require extensive electrical modifications including installation of several motor-operators, associated power supplies, hand switches, position indicators, cabling, etc. as well as procedure development.

Aligning the CCW system for cross-train operation could be done manually, but requires repositioning at least five (5) 18" diameter butterfly valves. This may not be achievable in the 15 minute window.

References:

D-175002, P&ID, CCW System D-175003, P&ID, SW System

d. SAMA 54 proceduralizes alignment of the spare diesel to the shutdown board after LOOP and failure of the diesel normally supplying it. The screening criterion refers to SAMA 56 which involves the installation of an additional diesel generator estimated to cost $74.5M.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 70 of 75 Indicate whether procedures already exist to do this with the spare diesel, and if not, what the estimated cost is, SNC Response:

Procedures exist to align the spare diesel (diesel generator 2C) to the shutdown board on LOOP and failure of the diesel normally aligned to the shutdown board.

e. SAMA 61 involves cross-tying the AC buses, or installing a portable diesel-driven battery charger. The criterion associated with this SAMIA suggests that this has been implemented at Farley. Indicate which ability Farley has-the cross-tie or the portable charger, SNC Response:

FNP does not have either the capability to cross-tie the AC buses or a portable, diesel-driven battery charger.

In the Auxiliary Building for each unit, there is an installed spare battery charger (a -swing" charger) that may be aligned to either train. In the SWVIS, there is an installed spare battery charger for each train.

f.

SAMA 66 involves developing procedures to repair or replace failed 4 kV breakers w ith an estimated cost of $7.15M. Explain/provide more details on the enhancement and the associated cost, SNC Response:

FNP is in the process of replacing existing the existing 4.16kV air magnetic circuit breakers with new state of the art vacuum breakers for 4.16 kV switchgear H & J. Cutler-Hammer type MA-350VR series vacuum circuit breakers will replace the existing Allis-Chalmers (reference DCPs 00-1-9683 and 00-2-9684). Plans are currently being made to extend this replacement to all the 4.16 'kV switchgear breakers at FNP. This modification will reduce the maintenance required on the 4.16 kV breakers and will further improve the overall reliability of the Farley AC Distribution system. Note that the $7.15M cost is for replacement of 4.16kV breakers on both units.

g. SAMA 81 is assigned screening criterion C which means that this SAMA is addressed by another SAMA(s); however, the other SAMA that addresses SGTR coping abilities is not provided. Indicate which SAMA addresses SAMA 81, SNC Response:

SAMAs 79, 80 & 82 address additional SGTR coping capabilities. No additional SGTR coping capabilities were identified.

h. SAMA 90, which addresses increased frequency for valve leak testing, is assigned screening criterion C and refers to SAMA 93. SAMA 93 discusses providing leak testing, not increased frequency. Indicate whether increased valve frequency testing would be cost beneficial at Farley.

SNC Response:

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 71 of 75 Currently, containment isolation valves are leak tested during each refueling outage. Additional testing would require adding an outage, with all the associated costs including manpower for testing and replacement power. This would not be cost beneficial.

11. For certain SAMIAs considered in the ER, there may be lower cost alternatives that could achieve much of the risk reduction. As one example, SAMA 58 evaluated the use of fuel cells instead of lead-acid batteries. The disposition of this SANMA was N/A, but no explanation was provided. It is noted that a lower cost alternative is available, but was not explored. Please consider and provide estimated costs and benefits for:

SAMA 58 states "Because of the limited commercial use and availability of fuel cells, this activity is not recommended for further evaluation." There is no mention of a lower cost option.

The development of fuel cell technology is still not at a point where commercial industrial application is viable.

a. adding a diesel-driven battery charger, unless this capability already exists (see RAI JOe),

SNC Response:

FNP does not have a diesel-driven battery charger. Costs for design and implementation of modifications to install a diesel-driven battery charger, tying it into the FNP electrical distribution system and supplying fuel would easily exceed the phase ] screening threshold. Additionally, due to the existing FNP design features that include spare battery chargers, there is no benefit to having a diesel-driven battery charger.

b. installing a direct-drive diesel to power an auxiliary feedwater (AFW) pump as an alternative to a motor-driven pump (SAMA 107),

SNC Response:

Costs for design and implementation of modifications to either 1) installation a diesel-driven AFWV pump and connect it to the existing AFW piping system or 2) replace an existing motor with a diesel on an AFN' would easily exceed the phase I screening threshold.

12. For the remaining I I (Phase 2) SANMAs, the following information is needed to better understand the modification and/or modeling assumptions:

a. The estimated benefit in terms of percent reduction in CDF and person-rem for each of the 11 SAMAs;

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 72 of 75 SNC Response:

The percent reduction in CDF and person-rem for each of the analyzed cases is summarized in the following table.

Percentage Percentage reduction in reduction in SAMA ID CDF person-rem 7

9.03 1.52 11 34.58 8.34 24 9.41 7.08 89 1.00 57.25 96 1.00 57.25 101 13.81 6.21 117 1.26 0.90 118 1.15 0.82 119 9.41 7.08 120 2.53 1.80 123 1.00 57.25

b. the major cost factors that are included and not included in the estimated implementation costs, e.g., the cost of replacement power during extended outages required to implement the modifications, recurring maintenance and surveillance costs, contingency costs associated with unforeseen implementation obstacles, costs associated with procedures, engineering analysis, training and documentation; SNC Response:

The major cost factors included in the estimated implementation cost are summarized in the following table.

Major Cost Factors in Estimated Implementation Costs SAMA ID Engineering Utility Procurement Construction 7

X X

11 X

X X

X 24 X

X X

X 89 X

X X

X 96 X__

X 101 X

X X

X 117 X

X X

X 118 X

X X

X 119 X

X X

X 120 X

X X

123 X

X X

X Engineering includes development of design change packages and licensing documents for the proposed modification including material and equipment specifications. Engineering costs include engineering analysis, drawing preparation, specification development, and plant reviews.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 73 of 75 Utility includes procedure changes, field testing, training, documentation and operating license changes required to address the plant modification.

Procurement includes development of procurement documents from the design specifications for equipment and materials to support the plant modification. Procurement includes costs for document preparation, bid evaluation, purchase orders, material shipping, receipt inspections and storage on site prior to installation.

Construction includes the costs associated with planning the installation, labor and supervision required to implement the modification.

Cost associated with replacement power during extended outages required to implement the modifications, recurring maintenance and surveillance costs, and contingency costs associated with unforeseen implementation obstacles were not included in the estimated implementation costs.

c. SAMA I I involves the use of the hydro test pump for reactor coolant pump seal injection.

In Section 5.2 of Attachment F, SNC states that the hydro test pump suction isolation valve svould need to be replaced with a safety-related motor-operated valve, and that the power supply to the hydro test pump would have to be changed to a class IE supply. Discuss how much of the estimated implementation cost is attributed to the replacement of the existing valve with a safety-related MOV, and discuss why such a change-out is necessary. Discuss how much of the cost is attributed to the replacement of the existing power supply with a safety-related supply, and why a non class IE power supply would not be acceptable.

SNC Response:

Discussion of Valve Replacement Costs The following tasks are required for to replace the hydro test pump suction isolation valve:

I. Engineering specification of replacement valve.

2. Procurement of replacement valve.

3. Preparation of design change documents.

4. Field work planning, including preparation of traveler drawings for piping and pipe support modifications (the new valve will be heavier with a motor operator, changes to pipe supports will most likely be required), conduit and cable routing, etc.

5. Engineering review and approval of traveler piping and pipe support drawings.

6. Installation of the new valve and associated power supply and control cables.

Replacement of the hydro test pump suction valve with an appropriate MOV is estimated to cost

$50,000.

It should be noted that the majority of the cost for this SAMA is in the installation of a new small bore line from the hydro test pump discharge, running through the Auxiliary Building, to an appropriate tie-in location on the RCP seal injection line, including the installation of two additional MOVs for isolating the line at the tie-in and the associated power supplies and controls to allow remote operation to align the hydro test pump to the RCP seal injection line.

U. S. Nuclear Regulatory Commission NL-04-0287 Enclosure Page 74 of 75 Discussion of Need to Replace Valve The hydro test pump takes suction from the 16" line on the Refueling Water Storage Tank (RWST) that also feeds the suction of the Containment Spray (CS) pumps. The hydro test pump suction is isolated by a manually operated globe valve that also serves as the piping class boundary between the 2' diameter hydro test pump suction line (ANSI B31.1) and the 16" diameter CS pump suction line (ASME Section III class 2). For the hydro test pump suction isolation valve to maintain its design function as a piping class boundary valve, it must be a safety-related valve. To provide the needed alignment to the Reactor Coolant Pump (RCP) seal injection flow path in time to prevent hot Reactor Coolant water from entering the seal package (15 minutes or less) this valve must be motor operated.

Discussion of Power Supply to New MOV The existing hydro test pump suction isolation valve is manually operated and has no existing power supply. The hydro test pump is powered from a non-IE power supply. Use of a IE power supply for the new MOV and the hydro test pump will ensure availability of these components to perform the seal injection function. Due to its location in the Auxiliary Building, there is a negligible difference in cost between providing a new JE power supply ora new non-1E power supply to the new MOV. The cost for changing the existing power supply to the hydro test pump to a IE supply is approximately $5,000.

d. SAMA 24 involves development of procedures for actions on loss of HVAC. In Section 5.3 of Attachment F, the implementation cost is estimated to be $830,000 per unit. The cost appears to be dominated by the installation of temperature sensors in several pump rooms, and control circuits to generate an alarm in the main control room. Describe the existing capabilities to monitor temperatures in these rooms, and why such capabilities would not be sufficient to initiate operator action. Also in that section, SNC discusses a lower cost alternative involving re-labeling the fan trouble alarm annunciator window and revising procedures to instruct operators to take actions to mitigate the loss of HVAC. This low cost alternative does not appear to have evaluated. Please provide the costs and benefits associated with this low cost alternative.

SNC Response:

FNP does not have any room temperature monitoring instrumentation in the Auxiliary Building including the following rooms containing ESF equipment:

Charging Pump Rooms'

Residual Hear Removal (RHR) Pump Rooms

Containment Spray (CS) Pump Rooms

Component Cooling Water (CCW) Pump Rooms

Battery Charger Rooms

MCCs IA & B rooms Since no remote temperature indication exists, operators do not know when actions are required to mitigate a high temperature condition in one of these rooms.

U. S. Nuclear Regulatory Commission NhL-04-0287 Enclosure Page 75 of 75 The estimated cost of S830,000 is for the "low cost alternative" to install room temperature monitoring instrumentation, re-label existing annunciators indicating room cooler fan trouble and develop appropriate response procedures.

NL-04-0287, Response to 12/12/03 Request for Additional Information Regarding Application for License Renewal

Contents

Text

Enclosure:

SUMMARY

SUMMARY

References:

Navigation menu

NL-04-0287, Response to 12/12/03 Request for Additional Information Regarding Application for License Renewal

Text

Enclosure:

SUMMARY

SUMMARY

References:

Navigation menu

Search