NRC-97-0088, Forwards Response to 970703 RAI Re License Amend to Extend EDG Allowed Outage Times.Response Includes Descriptions of Current Plant Procedures & Practices Which Makes Changes as Necessary
| ML20217H658 | |
| Person / Time | |
|---|---|
| Site: | Fermi  |
| Issue date: | 08/07/1997 |
| From: | Gipson D DETROIT EDISON CO. |
| To: | NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| Shared Package | |
| ML20217H660 | List: |
| References | |
| CON-NRC-97-0088, CON-NRC-97-88 NUDOCS 9708130169 | |
| Download: ML20217H658 (16) | |
Text
_- _ _ - _ - _ _ - _ - - _ - -
Dnglas R, Cipson Senior Vice 1%ident, Nudear Generation L Ferml0 0100 Lrth liixic lluy , Newport, Michiv.an 4 %'4 Tel:313 T>%Tdul Fat 313 TM4172 Detroit Edison August 7,1997 NRC 97 0088 l
l l
U. S. Nuclear Regulatory Commission Attn.: Document Control Desk Washington, D. C. 20555
References:
- 1) Fermi 2 NRC Docket No. 50-341 NRC License No. NPF-43
- 2) Detroit Edison Letter to NRC," Proposed Technical Specification Change (License Amendment)- Emergency Diesel Generator Action Statements, Surveillance Requirements and Reports," NRC-95-0124, dated November 22,1995
- 3) Detroit Edison Letter to NRC," Response to Questions on Proposed Emergency Diesel Generator Technical Specification Change," NRC-96-0008, dated February 19,1996
- 4) Detroit Edison Letter ta NRC," Response to NRC Letter on Emergency Diesel Generator. Allowed Outage Time Extension (TAC No. M94171)," NRC-96-0041, dated April 19,1996
- 5) Det>oit Edison Letter to NRC," Response to Probabilistic Safety
)
Assessment Questions Related to Request for increasing Emergency Diesel Generator Allowed Out of Service Time rgd (TAC No. M94171)," NRC-96-0050, dat-i May 3,1996
- 6) NRC Letter to Detroit Edison," Request for Additional Information Related to the Amendment to Extend Emergency _
Diesel Generator Allowed Outage Times at Fermi 2 (TAC No.
M94171)," dated November 5,1996 -
- 7) Detroit Edison Letter to NRC," Additional Information Related to the License Amendment to Extend Emergency Diesel Generator Allowed Outage Times at Fermi 2," NRC-96-0133, dated December 4,1996 97081301[9 970007 '
PDR ADOCK 05000341 ,
P PDR '
A UrE Energy 0,mpany
^ _
Page 2
- 8) NRC Letter to Detroit Edison," Request for Additional Information Related to the Amendment to Extend Emergency Diesel Generator Allowea Outage Times at Fermi 2 (TAC No.
M94171)," dated July 2,1997
Subject:
Additional Information Related to the License Amendment to Extend Emergency Diesel Generator Allowed Outane Times at Fermi 2 l In Reference 2, Detroit Edison submitted a License Amendment request to the NRC to extend the allowed outage times for the Emergency Diesel Generators.
l Supplemental infonnation related to the amendment request was submitted by j Detroit Edison in References 3,4,5 and 7.
l Subsequently, the NRC requested additional information related to the subject license amendment request in Reference 8. The Enclosure to this letter provides response to the eight items requested by the NRC, as described in the enclosure of the NRC letter. The response includes descriptions of current Fermi 2 procedures and practices which may be changed as necessary. There are no new commitments made in this letter, if you have any questions regarding this response, please contact Mr. Nonnan K.
Peterson, Acting Director, Nuclear Licensing at (313) 586-4258.
Sincerely, , ,
/,
h Enclosure Attachments: (1) Risk Matrix (2) Conduct Manual MWC02, " Work Control" (3) Work Management Guidelines cc: A. B. Beach M. J. Jordan A. J. Kugler A. Vegel s
Enclosure to NRC-97-0088 Pagei Detroit Edison Response to NRC Reauest for AdditionalInformation (RAll Related to the License Amendment to Extend Emereenes Diesel Generator Allowed Outage Times at Fermi 2 (TAC No M94171)
The following is the Detroit Edison response to the eight items requested by the NRC in the enclosure of the NRC letter dated July 2,1997:
1 NRC RAI Item No.1: "NRC Information Notice (IN) 97 21," Availability of Alternate AC Power Source Designed for Station Blackout Event," was issued on l
April 18,1997. This IN discusses problems that could cause the alternate AC (AAC) power source to become unavailable during a station blackout (SBO) event. Is the Fem 11-2 AAC power source subject to similar concerns. Explain i
the basis of the response."
D(troit Edison Respons_cl l
NRC Information Notice 97-21 was reviewed for its impact on Fermi 2. The review has detennined that Fermi 2 is not subject to the problems that could cause the alternate AC (AAC) power source to become unavailable during a station blackout (SBO) event. The two issues discussed in the Notice 97-21 were related to (1) battery capacity, and (2) challenging environmental conditions.
Following is the response to these two concerns:
(1) Battery Canacity At Fermi 2, the Station Blackout (SBO) Alternate AC (AAC) power source is a Combustion Gas Turbine Generator (CTG 11-1), which has a small diesel engine with a DC starter for black start capability. CTG 11-1 has a General Electric Mark V computer control system which operates on 125 VDC supplied by a 125 VDC charger in parallel with a 125 VDC battery bank. The charger is normally fed from off-site AC power or, if a SBO event has occurred and CTG 11-1 is started and its output breaker is closed, the CTG 11-1 charger will be fed from the output of CTG 11-1. All DC loads for CTG 11-1, including the Mark V, are fed from the same 125 VDC battery / charger. The battery cells have an eight hour capacity rating of 710 ampere hours.
The SBO loads on the CTG 11-1 battery during initial start of the CTG would include the diesel starter, Mark V, DC fuel forwarding pump, and atomizing air compressor. These loads are not energized until an actual start sequence is initiated for CTG 11-1. The standby 125 VDC loads for a non-operating CTG
Enclosure to NRC-97-0088 Page 2 11-1 includes the Mark V, a 120 VAC inverter, and a DC turbine lube oil circulating pump, which equals a total DC load of approximately seven amperes.
During a SBO event, CTG 11-1 would be expected to be started and loaded j within one hour. Under this one hour condition, the load discharge on the battery prior to starting the CTG would be approximately seven ampere hours which is insignificant compared to the 710 ampere hour rating of the battery, if a SBO event occurred and the CTG was not started for eight hours, the standby load discharge of the CTG 11-1 battery would be approximately 56 ampere hours.
This is only a relatively small amount of the eight hour battery capacity rating of
- 710 ampere hours, and would still leave a large amount of the capacity availab!c to easily start CTG 11-1.
l l Upon starting CTG 11-1 for a SBO event, the generator output breaker would be closed shortly afterward which would automatically re-energize the CTG 11-1 charger, recharge the battery, and power all of the CTG 11-1 AC equipment. At this point, the CTG could be loaded and run indefinitely as long as fuel was available (Note: The CTG 11 fuel storage tank is filled with enough fuel to operate CTG 11 1 loaded for at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />). Normal off-site AC power for CTG 11-1 is supplied from the 120 kV switchyard.
(2) Challencine Environmental Conditions The CTG 11-1 accessory compartment, which contains the starting diesel and support equipment, is normally heated with AC blower heaters at the skid. The CTG 11-1 turbine compartment and generator have AC strip heaters which provide heat to prevent condensation. The CTG 11-1 control house, which contains the control system, and the 125 VDC batteries are also normally heated at 68 - 76 degrees Fahrenheit. Upon a loss of off-site power the heaters, which require AC power, for the above mentioned equipment are de-energized until either CTG 11-1 is started and its output breaker is closed or off-site power is restored at the 120 kV switchyard.
During a SBO event, the above heaters will initially be de-energized. The vendor for the CTG 11-1 starting diesel has previously stated that the diesel should start with an ambient temperature of zero degrees Fahrenheit. The enclosed diesel compartment is heated above 50 degrees Fahrenheit as long as the associated heaters are energized with AC power. In the event of a SBO, assuming outside air temperature is zero degrees Fahrenheit and CTG 11-1 was not started, the CTG starting diesel engine would be expected to start after several hours since the diesel engine would take a period of time to cool off to a point near outside ambient air temperature.
Enclosure to NRC 97 0088 Page 3 The CTO 11 1 turbine lube oil system contains approximately 1700 gallens of lube oil and is heated with AC emersion heaters to approximately 60 degrees
{
Fahrenheit. The CTG has a lockout feature which prevents the CTG from starting if tube temperature goes below 50 degrees Fahrenheit. In the event of a .
SBO, assuming outside air temperature is zero degrees Fahrenheit and CTG 11 1 l
was not started, the CTG lube would be expected to take several hours or longer to cool off below 50 degrees Fahrenheit. This is due to the large volume oflube oil, the operation of the DC lube oil circulating pump, and insulated enclosure around the lube oil.
Fermi 2 has several Abnormal Operating Procedures (AOP) that deal with a SBO event or a Loss of Off site Power (LOOP) event. These procedures are as follows:
- 1) AOP 20.300.01 " Loss of Off-site and Onsite Power"
- 2) AOP 20.300.03 " Loss of Off-site Power"
[ 3) AOP 20.300.13 " Loss of 120 kV Off-site Power" l
- 4) AOP 20.000.18 " Control of the Plant From the Dedicated Shutdown Panel" During various postulated SBO or LOOP events which would cause a loss of off-site AC power to CTG 11-1, one of the above AOP's would be entered within a very short time. All of the above AOP's require starting CTG 1i 1 and closing its output breaker within a short time to pick up plant loads. Upon closure of the output breaker, all CTG 11-1 AC loads and the battery charger will be powered back up from the generator output of CTG 11-1. It is expected that CTG 11-1 would be started and loaded within an hour for any of the above Loss of Off-site Power scenarios. Thus, CTG 11-1 would not be expected to remain in standby for more than an hour under a SBO event.
NRC RAI Item No. 2: " Submit a copy of the risk matrix and a description. If the contents of the risk matrix vary depending on whether one or two emergency diesel generators (EDGs) in a division are out of service, provide copies of the matrix for both conditions."
Detroit Edison Resnonse:
A typical Risk Matrix is provided in Attachment 1. The attached matrix is similar to the one used for work control at Fermi 2. The matrix shows the risk
- Enclosure to NRC-97-0088 Page 4 -
l significance of system outages (see column labeled PM Risk) plus the risk significance of contingency system outages that may occur during a scheduled outage, The risk significance of the system outage is based on the duration of the outage. The matrix contains configurations where one of the four EDGs is in a i scheduled maintenance outage and one other system that is modeled in the L probabilistic safety assessment (PSA) model is also unavailable for other reasons, l This also includes the configurations where one of the four EDGs is in a maintenance outage with one othe EDG unavailable. Configurations with two EDGs unavailable have a low risk significance as per the attached matrix. i e
NRC RAI Item No. 3: "In your December 4,1996, response to the previous request for additional information (RAI), you stated that the risk matrix identified ;
that the Essential DC and AC equipment in addition to systems devoted to decay i heat removal are more risk significant during a particular EDG outage, Did you find any of these components or systems that fall in the ranking of High or Unacceptable? If so, would the risk matrix lead you to prohibit the concurrent outage of these pieces of equipment and the EDG?"
Detroit Edison Resnonse:
The attached matrix indicates that all configurations with one EDG out of senice for maintenance and one of the essential DC or AC components unavailable have either a low risk significance or a moderate risk significance. Likewise, the matrix shows that when one of the EDGs is out of service for maintenance and only one of the methods for removing decay heat is also unavailable, the risk significance is either low or moderate. If the risk significance of any configuration is high, senior management approval would be rt; quired before that-configuration could be intentionally entered Configurations that have an unacceptable risk are not allowed to be intentionally entered.
NRC RAI Item No. 4: "How do you assess the resulting overall risk impact on safety functions when equipment that is not in the matrix is removed from service or when more than two components or systems in the matrix are concurrently taken out of senice, or found to be inoperable? Do you use your current probabilistic risk assessment (PRA) in these cases? If you do, explain the process."
Detroit Edison Resnonse:
Development of the PSA included an ass,:ssment of all systems which have a -
p gnificant contribution to risk (CDF). The enclosed matrix (RAI Item 2) used to
- Enclosure to NRC-97-0088 -
Page 5 assess risk includes all of the systems in the PSA. Therefore, maintenance on systems which are not on the matrix has beenjudged to be non risk significant.
For risk significant systems, the resulting overall risk impact on safety ft.netions is assessed in the risk matrix for the cases when two risk significant systems are l concurrently removed from service, liowever, per the Work Management l Guidelines, Section B 8.3," Corrective & Preventive Maintenance Scheduling,"
care is taken to minimize or mitigate the potential for scheduling or working on more than two risk significant systems simultaneously. The situation described is expected to occur very rarely. However, if such a situation occurs l inadvertently, resources would be directed to exit the condition as soon as '
l possible and restore the system to a low risk configuration. Additionally, if a situation is projected where more than two systems in the matrix would be out of senice, the Work Control Group would recognize the situation and request the PSA Group to perform the requisite analysis for evaluating the risk significance of the specific situation.
NRC RAI Item No. 5: Submit a copy of the relevant procedures that incorporate the use of the risk matrix or insights from your PRA for system or component outages."
Detroit Edison Response:
Information copies of the procedures MWC02, " Work Control" and the " Work Management Guidelines" are attached (Attachments 2 & 3),
e NRC RAI Item No. 6: In your December 4,1996, response to our previous RAI, you provided conditional core damage probabilities given the success of one EDG and failure of the other three EDGs, a total LOOP, failure of combustion turbine-generator (CTG) I l-1, and no offsite power recovery. They were: 3.2E-2 for EDGs #11, #12, & #13 and 5.3E-3 for EDG #14. From this infonnation, we interpret that you can avoid core damage with a 96.8%
probability for the first three EDGs and with a 99.47% probability for EDG #14.
In turn, we interpret that any one diesel can mitigate a SBO accident with high probability. Is this interpretation correct? If so, please provide the engineering bases that support these numerical estimates."
Detroit Edison Response:
Detroit Edison response submitted in Reference 5 provided the following core damage frequencies that were conditional on a total loss of off-site power initiating event, off-site power not being recovered and CTG 11-1 fails:
Enclosure to NRC-97-0088 Page 6 CCDF ner event EDG 1I successful and EDG 12,13 and 14 fail 3.2E-2 EDG 12 successful and EDG 11,13 and 14 fail 3.0E-2 EDG 13 successful and EDG 11,12 and 14 fail 3.0E-2 EDG 14 successful and EDG 11,12 and 13 fail 5.3 E-3 The above values indicate that given the success ofjust one diesel, there is a high probability that a transient would be mitigated. This does not include a SBO event, since a SBO, by definition, requires the failure of all four EDGs. The high mitigation success probability of a tmnsient is partly due to the cross-tie capability of the Fermi 2 buses assumed in the PSA model. From a licensing basis both EDGs in a division are needed to supply the full safe shutdown loads in the division. In the PSA evaluation, however, credit is taken for the cross-i connecting capability of the engineered safety feature (ESF) buses during a transient. There is the capability to transfer loads between the two 480 volt ESF f buses on each division. For example, the Division 1 loads from bus 72EA can be transferred to bus 72EB and visa versa. System Operating Procedure 23.321 provides instructions for the 480 volt transfer on both divisions. One EDG has adequate capacity to provide the safe shutdown loads for a general transient.
The following credit is taken in the PSA model for the cross-connect. For Anticipated Transient Without Scram (ATWS) events where the Standby Liquid 4 Control system fails or one of the recirculation pumps fail to trip, or for any event (
involving a failed bus, the cross-corinect is guaranteed to fail. Events where the cross-connect is not guaranteed to fail and iflow pressure injection is available, then the operator will have six to eight hours to connect the loads from one 480 volt bus in a division to the other bus in that division and establish decay heat removal The mean failure rate used in the PS A model for this operator action is 2.0E-2 per event. Ifinjection is not available then only one hour is available for establishing the connection and the failure rate used in the PSA model for these scenarios is 2.0E-1 per event.
- NRC RAI Item No. 7: "In addition to the above, we are interested in the following scenario. Assume you take an EDG in Division I (or II) out of service for maintenance and a LOOP occurs. Then assume an EDG in Division II (or 1) fails to start and CTG 11-1 also fails. Now you have one EDG operating in each division. Have you analyzed this scenario in PRA? If you have, please provide
Enclosure to NRC-97-0088 Page 7 the results and the associated bases. We recognize that this scenario is beyond design basis. Therefore, if you have not analyzed this scenario, no further action in response to this question is necessary."
Detroit Edison Responsel This scenario was not analyzed with the PSA; however, the scenario is less restrictive than the cases discussed in the response to NRC RAI Item No. 6.
Given at least a 96.8% probability of success with just one diesel operating, then it could be expected that there would be a 99.9% probability that an accident initiated by a total loss of off site power without any recovery of off-site power and failure of CTO 11-1 would be successfully mitigated if two diesels operated.
The probability of success would actually be greater than this given the likely probability that off-site power would be recovered.
NRC RAI Item No. 8: " Discuss the plant-specific factors that led to the relatively small SBO numbers in your PRA."
l l
Detroit Edison Response:
For a station blackout to occur at Fermi 2. all of the following events would have to occur at the same time:
- 1) Failure of two independent 345 kV power lines that feed the 345 kV switchyard of Fermi 2.
- 2) Failure of three independent 120 kV power lines that feed the 120 kV switchyard of Fermi 1.
- 3) Failure of four independent emergency diesel generators.
Fermi 2 is supplied by two independent and physically separated switchyards.
Each switchyard is capable of powering the loads necessary for shutdown without relying on electrical cross-connections. Therefore, a power failure would have to occur from both switchyards for a station blackout. Contributors to the loss of power included grid instabilities, switchyard faults and weather related events. Using a combination of generic industry data and specific characteristics of the Detroit Edison grid, a frequency of 0.012 events per year was calculated for the total loss of off site power to Fermi 2. Separate frequencies for the loss of the 120 kV and 345 kV switchyards were also developed. Frequencies for the loss of power to the individual switchyards was computed to be 0.14 events per year for the 120 kV supply and 0.036 events per year for the 345 kV supply.
i
- Enclosure to -
- Page 8 Details for these calculation are described in Appendix A of the Fermi 2 IPE,
- which was submitted to the NRC in August of 1992; Another plant specific factor that led to the small SBO contribution to the Fr rmi l 2 core damage frequency is the fact that Fermi 2 has four emergency diesel
' generators. Realistically, any one of these diesels is capable of powering the loads necessary to mitigating the consequences of a transient.
- A third factor that contributes to the low probability of a SBO at Fermi 2 is the on-site combustion turbine generator with black start capability (CTG 11-1). ]
Only one division is required for a safe shutdown, and CTG 11-1 is capable of-providing the division 1 SBO safe shutdown loads. CTG 11-1 could also be used to supply some division 2 loads. There is a maintenance cross-tie breaker (64T) from division 1 BOP power to the two 4160 volt division 2 ESF buses 65E and 65F, Using this cross-connect,it is assumed in the PSA model that CTG 11-1
- could also power the division 2 SBO safe shutdown loads. System Operation
' Procedure 23.321," Engineered Safety Features Auxiliary Electrical Distribution -
o System," provides instructions and cautions for performing the cross-connect.
The PSA model uses a mean failure rate of 1,0E-1 for the operator action to cross-connect the 4160 volt buses, i
)
i
. . _ _ . . m._ ____...___-...__.___-._..._._.m ~ _ _ - _ .-_. _ _ __._ . _ . _ .- _ _ -_ __ _ _ _ .._. _..._ _-_ _ _ _ ._ _ _ _
t Attachment I to ;
NRC-97-0088 , l
~
Risk Matrix i oc m oc = = = v m- -- = = = .c .: o.
- ~
- x. , . .
ethi
$yg g Divi, : Ohrt- ^ Dirt ' 11 " .12 { ;13.. ;14 . Se8r11 SV 2 Mt.13 GSF 14 72CF CTG 11 j Der 2 iM: 4 DAYS ?DESC/ DIV RISK DA' DB. DC. ~G1.: G2. G3 G4 'B4 .C4 'ES: F51 CF- GT. .B1 B2- DW NP !
^ ~
OUT' -
l ' - 3' ?] Core Spray : l: 2 : l : L" l M M L L L L L M L' L L L L L L L mm l 4. -l H2O2- - l 11 e l - LV l M M L L L L L M L L L L L L L L mm l =2 -l' -
SGTS' -l 1: 1-L l M L L L L L L L L- L L L L L L L mm j l ~2 :l- SBFW B. - lN/Al L :l M L L L L L L L L L L L L L L L me l14 Jl CCHVAC = - l 114 l ' L ' l M M L L L L L M L L L L L L L L mm je- 4 r l: CCHVACM l< 2 l L{l M M L L L L L M L L L L L L L L mm l 12 ' l- SBFW A- lN/Al ? L lM L L L L L L L L L L L L L L L mm !
l T / 2:~ - ] - c EDG 11 : -l 1;lLL-=l M M L n/a L L L L M L M L L L L L mm j l u 2 - l '= EDG 12 - lrie ln LDl M M L L n/a L L M L L M L L L L L mm l.,2 -l- EDG 13 - 2l522 l L* l M L L L L n/a L M M L L L L L L L mm !
lc :2 - '] EDG 14 - l 2.l1L-l M L L L L L n/a M M L L L L L L L mm l::3 -l- ~ RCIC 'l 1'10Lcl M M L L L L L M L L L L L L M L mm I l : - 41' - l - H202- :l 2:l.L-l M M L L L L L M L L L L L L L L mm l 2' -- l RHR/RHRSW -l 2: lo: L :: m3 L M M M L L ': <
M L L L M M L mm l 2.' - l TCORE SPRAY l '1 ' l - L:-- l M L L L L L L L L L L L L L L L mm l :3' ~l
- HPCI.- "l 2 'l ? L5 l M M M L L L L M L L L L L L M L mm l ' 2 - l CORE SPRAY - l ~ 2 ;l ~-Ix l M L L L L L L L L L L L L L L L mm l 3 [' RWCU 'lN/Al-~ L il M M L L L L L M L L L L L L L L mm l; l - ' 2' l RHR/RHRSW- l 1 'l' t lM 0 M L L M M L L >: J L L M M L mm l:2 :lNL?l M L mm l .1 - 2 ' 11 ESGTSc - L L L L L L L L L L L L L L l 22 :l- i NIAS l l 2~ l ~L- l M L L L L L L L L L L L L L L L mm l1 '5'~l- -CCHVAC - l 1:1 l ~ L '. l M M L L L L L M M L L L L L L L mm l 5:' l : CCHVAC --- ~ l '2 l L* l M M L L L L L M M L L L L L L L mm l3 l H2 RECOMB e l-1: l/ L~ l M M L L L L L M L L L L L L L L [
l ' ' 3 : l a H2 RECOMB ? l 2 'l - L' ~l M M L L L L L M L L L L L L F L l '2' l ' NIAS - l 11 j'L4l M L L L L L L L L L L L L L L L mm l i
L Low Risk Significance f M Moderate Risk - Requires heightened awareness for planning and scheduling 11 High Risk - Requires management discretion i X Unacceptable Risk f
r
Attachment I to NRC-97-0088 ..
Risk Matrix seew, neew, e s inas . su es,
{ Mg
-SYSTEM
~- -
< . . PM.
68" CC* "*CC*
""" *2 ' * *6 D se :eno : ste-
. . 'v 2 .. c .-
e w.
wu
- e. i ;
cm 6 i.
N ra DAYS DESC. DtV RISK LV SW .TB ._
CC C1 - .C2 SA A1.. A2 l Ni' RS l Bl .. PT CN . FW FLL CT OUT -
l l Core Spray l ' 2 l :' L - l L L L L L L L M L L mm L L .I L L L L .
l:4.4l H2O2 li1 l L-l L M L L L L L M L L mm L L L L L L l' 2: l ' SGTS -- :l 1 l. L'-l L L L L L L L M L L mm L L L L L L l-'2:'l. SBFW B :lN/Al L lL L L L L L L M L L mm L L L L L L l 4' l' CCHVAC - l i u l L -l L M L L L L L M L L mm L L L L L L l 4 l ~ CCHVAC : l 2 : l - L" l L M L L L L L M L L mm L L L L L L l: 2--l: SBFW A - ' l N/A l . L e l L L L L L L L M L L mm L L L L L L l 21:lc 'EDG 11 < t l *1ll':L :::l L L L L L L L M L L mm L L L L L L l' 2 ':l' ' EDG 12 2
- l > 1'-l' L: .l L L L L L L L M L L mm L L L L L L l < .E . - l EDG 13 - -l'2"l" L4 ] L L L L L L L M L L mm L L L L L L l l.2; l : EDG 14 - ~l:2;l L".l L L L L L L L M L L mm L L L L L L l l- 34 l' : RCIC e ,l-:1 lnt l L M L L L L L M L L mm L L L L L L
'4 ' H202- -2: L L M L L L L L M L L L L L L L 2 t RHR/RHRSW - -2 : 2L L N N L L L N N N M L T T T T T
'21 CORE SPRAY: '1' -L: L L L L M L L L L L L L ls - 3 : l - HPCI- . l' 2 <l - L lL M L L L L L M L L mm L L L L L L l^2' l CORE SPRAY .] 2 -l L Jl L L L L L L L M L L mm L L L L L L lc3::l- JRWCU~ : lN/Al J L lL L L L L L L M L L mm L L L L L L l . -.2 - : l '-RHR/RHRSW l ' 1' l ' L' l L ' M L L L M 0 M Mmm L L M L L L l-'2 :l. 7SGTS= ~ l:2 l- LJl L L L L L L L M L L mm L L L L L L l 7 2 s. l . NIAS " :l- 2 'l- ~ L rl L L L L L L L M n/a L mm L L L L L L l .5 1l 1 JCCHVACn l11- ll l lL M L L L L L M L L mm L L L L L L l S ' l-: sCCHVACJ l~2'l OLE l L M L L L L L M L L mm L L L L L L l' '3 - l n H2 RECOMB l11P l' L4 l L L L L L L L M L L Mm L L L L L L l: 3 i - l H2 RECOMB _ -l' 2 -- l L ' l L L L L L L L M L L mm L L L L L L l 2 lu NIAS ' ~ l -1' j : L~~ ] L L L L L L L n/a L L mm L L L L L L L Low Risk Significance M Moderate Risk - Req ~ ires heightened awareness for planning and scheduling 11 Ifigh Risk - Requires management discretion X Unacceptable Risk
= - . _ __ - - .. .. . - . - - ..- . .-.. .- - - . - - - - - . - . _ _ . .- - . .- - -- .
. 1 Attachment I to NRC-97-0088 ..
, Risk Matrix cao co , Te m. = = nm = = a. -
ww wn 7 .gygy{g; pg WW DCIC N M -M %2 h Cand im W tw O2 N %2 w
SW SW n,a Mt m DAYS - ;DESCf DIV RISK SE ~
RC HP CD CA CB VS MC T1 . T2; LA .LB HA HB VT .lS OUT= 11 l - 3 ' - l' ' Core Spray ~ .- l :2 : l ' l l L L L L L L L L L L M L M L L M I l':4 :l- H2O2' l 1:: F LOl L L L L L L L L L L M L M L L M l 2--l SGTS l -1: l, L- l L L L L L L L L L L L L M L , L M l . 2 . - l .. ' S8FW B ~ ' l N/A l . L
- l L L L L L L L L L L L L M Ll L M i l34--l CCHVAC l.11ltL.l L L L L L L L L L L M L M L L M l' 4 l l CCHVAC': - l 2'l ~ L - l L L L L L L L L L L M L M L L M j l 2 -l- -SBFW A : l N/Al v L ; l L L L L L L L L L L L L M L L M l 12 -l: EDG 11 l31 ~ l -L "l L L L L L L L L L L M L M M L M l:~2-cl :EDG12< -1: 1;l:-L(l L L L L L L L L L L L M M M L M l 2.M l ' - EDG 13 l-2'-l Lxl L L L L L L L L L L M L M L L M l2 l EDG 14 2 - l 2 -l ? L1l L L L L L L L L L L M L M L L M !
- l. l- ' RCIC ' <l 1--l1LHl L n/a L L L L L L L L M L M L L M i l 4 '~l' H202 ; l 2~ l 4 L lL L L L L L L L L L M L M L lL M l : l RHR/RHRSW ;l' 2 l ' t - l L -
L L L L L L M 0 L 0 n/a u n/a m M l - 2' l CORE SPRAY - l ni l_L l L L L L n/a L L L L L L L M L lL M l- 3 : l: . HPCl ? l' 2: l: L Jl L L n/a L L L L L L L M L M L lL M i l 2 ' l CORE SPRAY -l "2 = l- L: l L L L L L n/a L L L L L M L lL M ;
l.3~ lE ' R W C U (- - l N/Al n L 'l L L L L L L L L L L M L M L lL M l -2: l .- RHR/RHRSW l L 1 ^ l / L lL .
L L L L L L M L M n/a O n/a eM M 7
~l 2'l--L l L l-- 2. j' .SGTS L L L L L L L L L L L M LlL M l-2 l> NIAS- ~ t l : 2 l-: L" l L L L L L L L L L L L L M L lL M ;
l 5 l -- CCHVAC ':l 1 ~ l L l L L L L L L L L L L M L M L lL M l-51:l' CCHVAC< :l 2 lxL lL L L L L L L L L L M L M L lL M e l 3 - l: H2 RECOMB '- l l ' l -l L L L L L L L L L L M L M L lL M [
l- - 3 : l H2 RECOM8 v l' 2 L l JJ L lL L L L L L L L L L M L M L lL M f l l NIAS - -l 1tl L^ l L L L L L L L L L L L L M L lL M !
L Low Risk Significance M Moderate Risk - Requires heightened awareness for planning and scheduling 11 Iligh Risk - Require < management discretion ;
X Unacceptable Risk l
Attachnsent I to NRC-97-0088 ,
KEY to Contingency System Identification System ID System Description Al NIAS Division 1 System ID System Description A2 NIAS Division 2 B1 BOP AC division I buses G4 Emergency Diesel EDG 14 B2 BOP AC division 2 buses GT Combustion Turbine Generator (CTG 11-1)
B4 4160V bus 64B and EDG bus 11 A IIA RIIRSW division 1 BI Standby Liquid Control System lib RIIRSW division 2 C1 EECW/EESW division 1 IIP Iligh Pressure Coolant Injection System (IIPCI)
C2 EECW/EESW division 2 LA RIIR division 1 C4 4160V bus 64C and EDG bus 12B LB RIIR division 2 CA Core Spray System division 1 LV Low RPV Water Level Signal CB Core Spray System division 2 MC Main Condenser CC RBCCW NI Nitrogen Supply System CD Control Rod Drive Ilydraulic System NP Low Pressure Injection Permissive Signal CF 480V MCC 72CF PT Reactor Recirculation Pump Trip CN Condensate and IIeater Feed Pumps RC Reactor Core Isolation Cooling System (RCIC)
CT Condensate Storage and Transfer System RS Reactor Protection System /CRD Control System DA Division 1 DC power SA Station Air DB Division 2 DC power SF Standby Feedwater System DC BOP DC power SR SRVs DW Ifigh Drywell Pressure Signal SW General Service Water E5 4160V bus 65E and EDG bus 13C Tl RIIR Complex Cooling Towers - Division 1 F5 4160V bus 65F and EDG bus 14D T2 RIIR Complex Cooling Towers - Division 2 FL Feedwater Control Logic TB TBCCW FW Feedwater System VT Ilardened Vent Path G1 Emergency Diesel EDG 11 IS Containment Isolation Valves (Includes MSIVs)
G2 Emergency Diesel EDG 12 G3 Emergency Diesel EDG 13
~
' Attachment I to '
NRC-97-0088 ' .
Risk Matrix Assumptions
- 1. The matrix was constructed by evaluating the risk associated with each scheduled system outage. The impact of having an additional system out-of-service during a scheduled system outage was assessed by applying the risk achievement worth (RAW) for the applicable system. The criteria used to nimtify the respective risk category is consistent with the EPRI PSA Applications Guide (TR-1053%)
- 2. If the care damage frequency (CDF) for the scheduled outage times the RAW for the applicable system is greater than 0.001/ year, the configuration falls into the unacceptable risk category (category X).
- 3. If the configuration is not a category X condition, the core damage probability (CDP) is computed. The CDP for the configuration is obtained by -
multiplying the previously computed CDF by the outage duration (in years). The configuration is then categorized according to the following scheme, consistent with the EPRI PSA Applications Guide:
. L - Low Risk: CDP for the event is less than 1.0e-06 '
. M - Moderate: risk, CDP between 1.0E-05 and 1.0E-06 e 11 - liigh Risk: CDP greater than 1.0E-05
- 4. The baseline PSA model used in the generation of the matrix assumes all systems are normally availability. That is, except for the scheduled maintenance there is no unavailability of systems due to maintenance or testing.
- 5. Continued plant operation would not be possible when some of the contingency systems specified in the matrix are inoperable (e.g. condensate system or station air). These systems are included in the matrix so that conservative assessments of maintenance on individual components, that would not disable the system, could be performed.
- 6. It is assumed that a SGTS outage will not prevent nor degrade the successful operation of the hardened vent.
- 7. It is assumed that a RWCU outage will be performed with isolation valve G3352F004 or G3352F220 closed.
- 8. Outage risk is a function of the outage duration in addition to the plant configuration. Outages durations longer than those specified could impact .
the risk classification. This matrix assumes that the dual ontage (contingency system plus scheduled system) completely spans the dates shown for the scheduled system outage. For example, any contingency system together with a planned outage of RCIC is assumed to last three full days (72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />).
Attachment I to NRC-97-0088 .
Risk Matrix Assumptions
- 9. Configurations categorized as 'L' are in the range deemed to be "Non-Risk significant by the EPRI PSA Applications Guide for temporary plant configurations.
- 10. It is recommended that configurations categorized as 'M' be given heightened awareness for planning and scheduling and that configurations categorized as 'II' receive additional management scrutiny.
I 1. IS (containment isolation valves) pertains to those isolation valves that may be required to isolate a break outside of containment or provide a high to low pressure boundary. An IS contingency outage means that one of these valves will not provide the aforementioned function for the time period ofinterest. The IS valves ofinterest in the PSA model are:
El150F008 El150F009 El150F015A-B El150F608 E2150F005A-B E4150F006 E4150F002 F4150F003 F4150F600 E5150F013 E5150F007 E5150F008 G3352F001 G3352F004 B2103F022A-D B2103F028A-D
_ _ _ _ _ _ _