ML051570016

Rmts Initiative 4b RAI

ML051570016
Person / Time
Issue date:	05/31/2005
From:	Tjader T NRC/NRR/DIPM/IROB
To:	Bradley B Nuclear Energy Institute
Tjader T., NRC/IROB, 415-1187
References
Download: ML051570016 (20)

Text

May 31, 2005Mr. Biff BradleyNuclear Energy Institute Suite 400 1776 I Street, NW Washington, DC 20006-3708

Dear Mr. Bradley:

The Nuclear Regulatory Commission (NRC) has continued its review of the South TexasProject (STP) complete plant proposed pilot for RMTS Initiative 4b, dated March 18, 2003.

Enclosed are staff comments and requests for additional information (RAIs) on the STP proposed pilot. Note that some RAIs are requests to clarify the prior RAIs, as noted. Some RAIs are system-specific RAIs based on the scope of the STP submittal, especially withregards to application to loss of function conditions. Other RAIs are based on reviews of the RG 1.200 pilot results and other, STP-specific, technical questions. Additional RAIs can be expected with regards to RG 1.200 since the STP submittal does not contain all of the required information, which is now being requested. Upon review, there could be additional clarifications

needed.We are prepared to meet with you to further discuss these comments and RAIs to ensure thatprogress continues on Initiative 4b.Please contact me at (301) 415-1187 or e-mail trt@nrc.gov if you have any questions or needfurther information on these proposed changes.Sincerely,/RA/T. R. Tjader, Senior Reactor Engineer Technical Specifications Section Reactor Operations Branch Division of Inspection Program Management Office of Nuclear Reactor Regulation

Enclosures:

As stated cc: w/encl: See next page

ML051570016DOCUMENT NAME:E:\Filenet\ML051570016.wpdNAMETSS:SRETSS:SCNAMETRTjaderTHBoyceDATE05/26/0505/31/05/05 Mr. Biff Bradley cc:

Senior Resident InspectorU.S. Nuclear Regulatory Commission

P. O. Box 910 Bay City, TX 77414C. Kirksey/C. M. CanadyCity of Austin Electric Utility Department721 Barton Springs Road Austin, TX 78704Mr. J. J. NesrstaMr. R. K. Temple City Public Service Board P. O. Box 1771 San Antonio, TX 78296Mr. C. A. Johnson/ R. P. PowersAEP Texas Central Company

P. O. Box 289 Mail Code: N5022 Wadsworth, TX 77483INPORecords Center 700 Galleria Parkway Atlanta, GA 30339-3064Regional Administrator, Region IVU.S. Nuclear Regulatory Commission 611 Ryan Plaza Drive, Suite 400 Arlington, TX 76011Jack A. Fusco/Michael A. ReedTexas Genco, LP 12301 Kurland Drive Houston, TX 77034Judge, Matagorda CountyMatagorda County Courthouse 1700 Seventh Street Bay City, TX 77414A. H. Gutterman, Esq.Morgan, Lewis & Bockius 1111 Pennsylvania Avenue, NW Washington, DC 20004E. D. HalpinVice President OversightSTP Nuclear Operating Company P. O. Box 289 Wadsworth, TX 77483S. M. Head, Manager, LicensingSTP Nuclear Operating Company P. O. Box 289, Mail Code: N5014 Wadsworth, TX 77483Environmental and Natural Resources Policy Director P. O. Box 12428 Austin, TX 78711-3189Jon C. WoodCox Smith Matthews 112 East Pecan, Suite 1800 San Antonio, TX 78205DirectorDivision of Compliance & Inspection Bureau of Radiation Control Texas Department of State Health Services 1100 West 49th Street Austin, TX 78756Brian AlmonPublic Utility Commission William B. Travis Building P. O. Box 13326 1701 North Congress Avenue Austin, TX 78701-3326Susan M. JablonskiOffice of Permitting, Remediation and Registration Texas Commission on Environmental Quality MC-122 P.O. Box 13087 Austin, TX 78711-3087Mr. Terry Parks, Chief InspectorTexas Department of Licensing and Regulation Boiler Division P. O. Box 12157 Austin, TX 78711Mr. Ted Enos4200 South Hulen Suite 630 Ft. Worth, Texas 76109 cc via e-mail

Mr. Wayne HarrisonSTPMr. Rick GrantomSTPMr. Drew RichardsSTPMr. John GaertnerEPRIMr. Frank RahnEPRIMr. Jim LimingABSG/EPRIMr. Alan Hackerott, ChairmanOmaha Public Power DistrictMr. Ray SchneiderWestinghouse Electric CompanyMr. Gabe SalamonPSEG Nuclear DISTRIBUTION

ADAMS PUBLIC IROB R/F TSS Staff BBoger/CCarpenter (RidsNrrDipmDpr)

SCBlack (RidsNrrDssaDpr)

WDBeckner (RidsNrrDipmIrob)

TRQuay (RidsNrrDipmlehb)

MDTschiltz (RidsNrrDssaSpsb)

JNHannon (RidsNrrDssaSplb)

ACRS/ACNW (RidsAcrsAcnwMailCenter)

OGC (RidsOgcRp)

FMReinhart (FMR)

NSaltos (NTS)

MLWohl (MLW1)

GSShukla (GSS)

SPWall (SPW)

WDReckley (WDR)

DGHarrison (DGH)

CKDoutt (CKD)]

DFThatcher (DFT)

SDAlexander (SDA)

PFPrescott (PFP)

KCoyne (KXC)

MDrouin (MXD)

MCThadani (MCT)

GWMorris (GWM2)

YGHsii (YGH)

DHShum (DHS)

RKMathew (RKM)

GWParry (GWP)

ABWang (ABW)

BMPham (BMP)

AJHowe (AJH1)

TWAlexion (TWA)

MAStutzkie (MAS7)

DHJaffe (DHJ)

Request for Additional Information - Technical Review of STP RMTS Initiative 4B Full Plant Pilot1.RAI #1 requested clarification of the risk calculations planned for the RMTS program toassure Regulatory Guide 1.174 criteria for acceptably small risk increases was being met.

The response stated that the total ICCDP and ICLERP would be "automatically determinedas the risk is being accumulated-". Please provide additional detail as to how this automatic calculation is physically accomplished. It is the staff's understanding that the accumulated risk, tracked from the point when thefront stop CT is first exceeded until all extended CTs are exited, and based on actual plant configurations, will be cumulatively tracked and periodically reviewed to determine that theoverall RITS program application meets the criteria in Regulatory Guide 1.174 for small risk increases. Please confirm. Further, it is the staff's understanding that the actual integrated risk (either ICDP or ILERP)will be tracked during use of the RICT and will be used to determine the amount of timeavailable to reach the integrated risk limits for the RICTs (i.e., 10

-6/10-7 ICDP/ICLERP forRMA threshold RICT, 10

-5/10-6 ICDP/ICLERP for the maximum safety limit RICT). That is,the calculated RICT is dependent upon the actual configuration which currently exists, andon the actual accumulation of risk which has occurred from the point the equipment was declared inoperable. Please clarify.Finally, it is also the staff's understanding that once the RICT is entered, accumulation ofrisk toward the 10

-5/10-6 ICDP/ICLERP for the maximum safety limit RICT continues until allLCOs for which the front stop CTs have been exceeded have been restored to a MET status (components fully operable). Please confirm.2.RAI #3, in part, requested the requirements for crediting compensatory measures andcontingency actions in risk assessments performed for RICT calculations. In response, it was stated that only actions in the PRA model would be credited, typically, and that specialemergent conditions would require procedural and administrative controls. This seems to contradict the guidance provided in Attachment 3 of the licensee's August 2, 2004 submittal, used by the operators to determine functionality, which implies that SSCs can be considered functional with manual operator actions "-contained in approved written instructions-" (item 1), and that realignment from surveillance testing can be credited ifincluded in the test procedure. Considering such equipment functional appears to be the expected outcome of the guidance, and effectively assigns an HEP of zero to those manual actions. The staff believes that credit should be taken in accordance with the applicable PRA standards after a realistic or bounding human reliability analysis is used toquantify the action, and an assessment of potential dependencies with other actions isconsidered. Further, the relevant procedures should be part of the expected plant responseto accidents or transients (i.e., emergency or abnormal operating procedures), or to component failure (alarm response procedures), to assure that a direct cue is available which directs the operator to the applicable procedure. The mere existence of written instructions does not assure timely implementation of recovery actions. Please discuss in detail how manual actions are credited for functionality determinations for RICT calculations.Enclosure 3.RAI #4 asked for clarification of the STP process for assessing common cause failurepotential. Additional information is required for the staff to understand how STP assesses CCF within the context of a RMTS program.a.STP identified their Corrective Action Program as providing guidance for the CCFassessment. Please discuss the specific technical guidance provided to the operators which would apply to an emergent failure or condition of components within the scope of the RMTS. Does the CCF assessment require testing, inspections, or other activities to reach a determination? How is the time frame for this assessment determined within the Corrective Action Program (i.e., within the front stop CT?).b.From Attachment 3 of the licensee's August 2, 2004 submittal, it is stated that SSCsare considered functional if it is "reasonably assured" that they can perform intended functions. If an emergent failure of one of three redundant components occurs, would all trains be declared inoperable, but the unfailed components be considered "reasonably assured" of being functional unless they specifically exhibited symptoms of the failure mode?c.It is stated that if a CCF issue is determined to exist, "it will be accounted for in theoperability determination". Please clarify - does this mean that the components will beconsidered inoperable or non-functional?d.It is stated that the PRA and CRMP are used to provide safety significance insights"for components that might affect more than one train or function". Please clarify -

should this refer to "component failure modes" instead of "components"? How are the insights used in the RMTS program for RICT calculation?e.It is stated that the PRA "includes the effect of a component failure in the CCF ofsimilar components", but then states that the failure rate of "cross-train" components isnot adjusted. Please clarify exactly what the PRA calculation is doing for CCF rates when an emergent SSC failure occurs.f.It is stated that the CRMP "-requires consideration-" of risk reduction actionsincluding plant shutdown if the risk crosses the 1E-5 threshold. It is understood thatthe 1E-5 risk is the RICT limit, which would require applicable TS shutdown actions. How could such actions only be "considered" in a RMTS program?4.RAI #7 requested clarification of the assessment of LERF within the RMTS program. Inresponse, it was stated that CDF is the only required metric "for nearly all evaluations",

then described the capability to perform such assessments with the PRA model. Pleaseclarify under what configurations would a LERF assessment be performed. The RMTS guidelines require the LERF evaluation for all RICT calculations, so it is not clear how LERF could not be required.5.RAI #8 requested clarification of the RMTS program treatment of planned vs. emergentconfigurations. In response, it was stated that a threshold CDF of 10

-6 was established forplanned configurations, consistent with the generic guidelines, but then identified that ahigher risk level could be used by duty manager approval. It was not stated if this approval is used only to address emergent conditions or if it could be part of the normal planned maintenance practices. It is the staff's understanding that planned use of RICTs would be applicable to preventive as well as emergent corrective maintenance, and will not exceed thresholds of 10

-6 for CDF and 10

-7 for LERF. It is also the staff's understanding that theuse of the higher RICT limits would only be used for emergent failures of equipment or other unanticipated conditions which occur during implementation of an RICT. Please clarify.6.RAI #9 requested clarifications of the risk assessments documented in Table 2 of thelicensee's August 2, 2004 submittal. Table 2 includes the column "Risk Basis Calculated STP AOT Before Backstop (base case)" which is further clarified in footnote 1 as the calculated time to reach an ICDP of 1E-5. Each of the technical specification LCOs includes actions for one or more of the redundant trains being inoperable, but only a few of the table entries provide the corresponding RICT for each separate configuration. Pleaseprovide an expansion of this table to provide the calculated RICT for each number of trains being inoperable within the proposed scope of the submittal. If there is a significant difference in the RICT depending upon which train(s) is inoperable, identify each RICT and provide the basis for the asymmetry in the calculated RICT.7.The staff has no additional questions regarding RAI #10, except to confirm our interest inseeing the STP program demonstrate application of the RMTS for several plant configurations.8.RAI #12 requested further explanation of the distinction between "inoperable" and "non-functional" components within the RMTS process. In response, Attachment 3 of the licensee's August 2, 2004 submittal was referenced. The staff requests additional clarification of the use of functionality to determine RICTS for TS.a.The licensee submittal identifies a differentiation between the definition ofOPERABILITY applied to the technical specification LCOs, and the term "functionality", which is not defined in technical specifications, to be applied to components for calculating RICTs. When a component is INOPERABLE, due to the inability to perform a limited portion of its intended functions, and these functions aredistinguishable in the PRA model and can therefore be quantified while taking credit for those functions which the component is still able to perform, it may be acceptablefor the RICT to be longer than would otherwise be calculated if the component isassumed to be completely non-functional. However, if one or more components are determined to be INOPERABLE, but the loss of functionality is (1) not known or uncertain, or (2) not capable of being addressed in the PRA model, then the component should be assumed to be non-functional for purpose of calculating a RICT.

This would typically arise with emergent issues associated with design issues of components which impact all safety trains, and would currently require entry into TS 3.0.3. Please discuss in detail how components which are inoperable may be evaluated as fully or partially functional in the calculation of RICTs. Several examples which cover the spectrum of possible conditions may be beneficial to the staff's understanding of this issue. b.With regards to functionality vs. operability, it is understood that functionality will onlyaddress requirements modeled in the PRA. Some mitigating functions are reviewed and screened out in the development of a PRA model due to low frequency of demand for the particular function, or the low probability of failure of the function. For specificconfigurations which may be encountered during planned maintenance or testing, combined with possible emergent conditions, these screened functions could become more important, and would potentially impact the calculation of a RICT. For each of the TS LCOs for which the RMTS will apply, (1) identify the PRA function(s) which aremodeled including success criteria if different than the design basis, and (2) identify any design basis functions not modeled, and (3) justify that these should not significantly impact the calculated RICT under configurations covered by the RMTS.c.Further with regards to functionality vs. operability, Attachment 3 of the licensee'ssubmittal identified procedural requirements for functionality. The staff requests additional clarifications of the application of these requirements in RMTS:Item 1 states that a component is functional without automatic actuation if"prompt restoration" by the control room operator or a dedicated local operator is available, with written instructions provided for actions not involving complex repairs or diagnostics. Similarly, item 9 allows actions in surveillance proceduresto be similarly credited. The staff assumes that such recovery actions would not normally be part of the baseline PRA model, but would be specific to the configuration. Crediting such manual recovery actions, without a quantitative consideration of the human error probability, or of dependencies on other actionswhich may be required in specific sequences, would not be appropriate for calculation of RICTs. This also appears to conflict with responses made to NRC RAI 3, that only PRA modeled actions are typically credited in the RICT calculations.Item 4 identifies examples of alterations which affect functionality. Some can bedirectly evaluated as to impact (i.e., jumpers or lifting electrical leads), but the others are somewhat uncertain as to the impact on functionality.Item 5 allows an SSC to be functional if there is "reasonable assurance" that itcan perform its intended functions. The staff is concerned that two standards are being applied with regards to the operators' confidence in assessing the status of SSCs, one to determine operability and a lesser standard to determinefunctionality.Items 5 and 8 identify that, if the functionality determination is later determined tobe in error, "non-functional time will be corrected accordingly". This implies thatthe determination of functionality need not be rigorous and can have some degree of uncertainty, since it can be later modified if found to be incorrect. This would not be appropriate for RICT determination.9.RAI #24 requested justification of proposed changes which involved application of theRMTS to loss of function conditions. The staff requests additional discussion of these configurations, and refers to new RAIs #25 through #38.10.The licensee proposes to apply a RICT to the reactor trip breakers (TS 3.3.1.20) and to theautomatic trip and interlock logic (TS 3.3.1.21). It is therefore critical to this application thatthe PRA modeling and success criteria for ATWS sequences be thorough and comprehensive, unless bounding analyses are applicable.a.In the development of accident sequences, it is not unusual to screen out failure to tripthe reactor for some initiating events, such as LOCAs, steamline breaks, or SGTRs, since the combination of the low frequency initiator and the failure of the reactor trip system, as well as the potential for adequate negative reactivity from ECCS flow,make these sequences very low frequency. However for this application, such a screening process may not be appropriate. Please discuss.b.The success criteria for mitigation of an ATWS event is dependent upon the specificpoint in each operating cycle, as well as the cycle-specific core reactivity designcharacteristics (i.e., moderator temperature coefficient and the unfavorable exposure time). It is not unusual that the risk calculations performed to support the CRMP for Maintenance Rule a(4) would not specifically account for the time in the operating cycle, but inst ead use a cycle-average risk calculation. In order to support thecalculation of a RICT for these TS, such an average calculation may not be appropriate, and the configuration-specific risk should account for this time-dependent impact. Please discuss.c.The existing technical specifications do not address the operability of the AMS AC.Since the AOT is only six hours when the reactor trip function is unavailable, it is notcritical that AMSAC be considered. However, if a RICT is implemented, then the operability of AMSAC should be required so that there is some mitigation immediatelyavailable in the event of a demand for a reactor trip. Please discuss how AMSAC is addressed in the PRA model, and whether a new TS for AMSAC should be required given the proposed modifications to these TS requirements.d.The emergency boration system (EBS) was deleted from the STP design based onacceptable fuel performance in the event of a return to criticality for a steamline break accident. STP is proposing to apply a RICT to the trip logic and breakers, and the MSIVs and actuation logic. How does the STP PRA model address steamline break accidents with regards to the synergies between reactor trip and steamline isolation functions? Is the model detail able to distinguish concurrent unavailability of theserelated functions with regards to the potential for core damage due to return to criticality?11.The licensee proposes to apply a RICT to the steam line isolation actuation logic andrelays (TS 3.3.2.4.b), to the turbine trip and feed water isolation actuation logic and relays(TS 3.3.2.5.a), to the main steam line isolation valves (TS 3.7.1.5), and to the mainfeedwater isolation valves (TS 3.7.1.7). These LCOs exist to limit the reactor cooldown transient, and such events are not typically modeled in PRAs as being relevant to core damage. Please describe how the STP PRA models these functions such that an RICT is appropriate.12.The licensee proposes to apply a RICT to the pressurizer code safety valves (TS 3.4.2.2). There are no tests or maintenance performed on these valves during operation, and no challenges occur which would reveal an INOPERABILITY. Therefore, the only application of the RICT would be to allow extended time to deal with an emergent issue causing INOPERABILITY of all three valves. a.Does the scope of the STP PRA model include all design basis events which result ina challenge to the code safety valves? If not, please identify those events not modeled, discuss the plant response to the event under these conditions, discuss why continued plant operation is appropriate with no code safety valves OPERABLE to mitigate those events, and identify what compensatory measures would be applicableduring such operation.

b.The submittal states that the pressurizer PORVs and sprays provide overpressureprotection. Is the mitigating capability of these components (e.g., capacity, responsetime, availability during design basis events) equivalent to the code safety valves? Arethese components able to provide equivalent overpressure protection to the reactor coolant system pressure boundary for the spectrum of design basis events whichchallenge the code safety valves? The pressurizer spray valves are not included in the scope of technical specifications, and indefinite power operation with both PORVs isolated is permitted under TS 3.4.4; should this specification include a requirement forOPERABILITY of one or both PORVs and/or the pressurizer spray valves? Does the STP PRA model include both the PORVs and spray valves as an alternative to the code safety valves?c.The proposed changes to TS 3.4.2.2 do not include any assurance of theOPERABILITY of any component(s) which are capable of providing overpressure protection to the reactor coolant system pressure boundary to assure that the safetylimit for maximum RCS pressure is not exceeded. Please identify how the integrity of the RCS as a fission product barrier is assured under such operations.13.The licensee proposes to apply a RICT to the pressurizer power-operated relief valves andtheir associated block valves (TS 3.4.4). The submittal identifies a RICT of 352 days with one PORV inoperable, and 349 days with both PORVs inoperable. It is not clear why these RICTs are so similar. Please clarify:a.What accident sequences take credit for operation of the PORVs?

b.What is the success criteria for the PORVs for each accident sequence?

c.If the PORVs are credited for overpressure protection of the RCS, as a redundantcapability to the code safety valves, discuss if operator action is credited in the eventof (1) the failure of the automatic function or (2) if the PORV is isolated due to seatleakage.14.The licensee proposes to apply a RICT to the safety injection system accumulators(TS 3.5.1). a.Confirm that the success criteria and the required accident sequences for theaccumulators is consistent with the design basis analyses, or provide a sensitivity study of the calculated RICTs for one or more accumulators inoperable using the design basis criteria.b.For action b when boron concentration is not within limits, the submittal states that theRICTs presented for action a apply. This seems inconsistent with other parts of the submittal where it is stated that the functionality of the INOPERABLE components isused to determine the RICT. Please discuss how the RICT would be applied to action b.15.For TS 3.5.2 for ECCS, with two or more subsystems INOPER ABLE, the proposed changerequires restoration of at least one ECCS train to OPERABLE status within one hour. In Table 2 for this LCO, it states that a risk-informed AOT is appropriate with no OPERABLEtrains. However, the RICT could not apply since the proposed action requirement is to restore one train within one hour. Is this the intent of the changes to TS 3.5.2? Please clarify.16.For TS 3.6.2.3 for the reactor containment fan coolers, the calculated RICT is stated to bebased on CDF and there was no impact on LERF. Please clarify how the fan coolers are credited in the PRA model for mitigation of core damage given that the design basis function is containment heat removal, and identify the basis for the success criteria (i.e.,

judgment or specific calculations).17.For TS 3.7.1.5 and 3.7.1.7, the wording of the action requirement includes a note whichstates: "Separate condition entry is permitted for each MSIV (MFIV)." This wording is inconsistent with other action statements being revised, as is noted in Table 2. Introducinga new phrasing would seem to be an unnecessary complication and distraction to the operators applying the technical specifications. Further, as worded the proposed action could be interpreted to allow a new 30 day backstop AOT to be constantly applicablewithout restoration of all MSIVs or MFIVs to OPERABLE status. Please confirm that inclusion of this note is not intended to create any unique interpretation of the application of a RICT for these specifications, with regards to applying the 30 day backstop. Specifically,confirm that it is not intended to have a separat e 30 day backstop for each individual MSIVor MFIV, but only a single 30 day backstop applicable to all valves. 18.For TS 3.7.14 for chilled water, which supplies room cooling to safety-related equipment, itis typical that the PRA model would only include a subset of the components supported,based on room heatup evaluations. It is also typical to include time-of-year flag events to turn off the ventilation models when cooler outside temperatures exist. These PRA model conventions would result in a 30 day LCO for large portions of the system, and duringwinter months. Please discuss STP plans in this regard. 19.For TS 3.8.1.1 for AC sources, Table 2 states that the STP switchyard is served by 8incoming lines. However, there is no control in the technical specifications requiring these 8 separate lines. Please describe how the STP PRA model accounts for the unavailabilityof one or more incoming lines. Describe also the plant configuration controls on the incoming lines.20.For TS 3.8.1.1, Action d, which applies concurrently with actions b and c, is inconsistentwith those actions with regards to the application of 3.13.1. Specifically, action d requires that 3.13.1 be applied within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The requirement to apply 3.13.1 at 14 days(action b) is unnecessary since 3.13.1 was already in effect from action d. Similarly, the requirement to apply 3.13.1 at 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (action c) renders action d unnecessary.21.For TS 3.8.1.1 Action d, the defense-in-depth requirement that, for a loss of offsite power,at least one safety train of equipment is OPERABLE and powered from an OPERABLE EDG is eliminated, as is the requirement for OPERABILITY of the steam driven AFW pump for station blackout mitigation. In response to related RAI #20, STP stated that existingprocedures "require very similar compensatory actions". It is not clear why an existing requirement is proposed to be eliminated from TS control within the context of RMTS 4b initiative. Please discuss, and provide examples of the RICT for cases involving EDGs and other supported equipment.

22.For TS 3.8.1.1 Action e, which applies when two of the two required offsite AC circuits areINOPERABLE, Table 2 of the submittal states that STP will maintain in this configuration at least one ESF bus with offsite power. This requirement is not found in the technical specifications. Please confirm if this is intended as a commitment.23.For TS 3.8.3.1 (onsite power distribution), Table 2 states that the loss of a single ESF busdoes not result in a plant trip. If the ESF bus is de-energized, the battery chargers for that train would be lost, and after a period of time the batteries would deplete. Does the loss of one DC train cause a plant trip? If so, wouldn't the application of 3.13.1 for this LCO (and for TS 3.8.2.1 for batteries and chargers) potentially lead to a plant transient?RG 1.200 PRA QualityNOTE: During the staff review of Regulatory Guide 1.200 conducted at STP, the reviewersencountered difficulty in assessing how the STP PRA complied with the elements of the standard. This was based in part on the staff's unfamiliarity with the support statemethodology; however, it was also attributed to the lack of adequate documentation. The staffis currently assessing how to assure a thorough review and assessment of STP PRA quality per the requirements of Regulatory Guide 1.200, and considers the following RAIs to begathering preliminary information leading to a more detailed assessment.24.Regulatory Guide 1.200 sections 1.2.4 and 1.2.5, and section 1.3 Table 3, identifyattributes of a fire PRA and external events PRA, which are not addressed by existing PRA standards. The licensee is requested to describe the scope and quality of their fire and external events PRA models, addressing the attributes identified in the guide.25.Regulatory Guide 1.200 section 4.2 requires the licensee to submit "- a discussion of theresolution of the peer review comments that are applicable to the parts of the PRA required for the application." Two options are identified, one to provide a discussion of how thePRA model has been changed, and the second to provide a sensitivity study that demonstrates the particular issue does not impact the significant accident sequences or contributors. The licensee has provided only the numerical identification of their peerreview facts and observations, and identified which were categorized as level 'A' or 'B' (Attachment 5, Resolution of Peer Review Comments, to submittal letter dated 10/28/2004). Therefore, the licensee is requested to submit the information required by the guide to address the resolution of peer review comments.26.Regulatory Guide 1.200 section 4.2 requires the licensee to submit the identification of thekey assumptions and approximations relevant to the results used in the decision-making process, along with the peer reviewers' assessment of those assumptions. Reference is made to Regulatory Guide 1.174 in section 3.3 for applicable guidance on addressing the impact of these assumptions on uncertainty as it relates to the decision-making process.

Only four areas were identified by the licensee, and the peer review assessment was not provided (Attachment 4, Key Assumptions and Approximations, to submittal letter dated 10/28/2004). Since this is a "whole plant" application of risk-informed TS initiative 4B, it is expected that there would be something more than four key assumptions/approximationsapplicable. Therefore, the licensee is requested to submit additional information regarding the key assumptions and approximations in their PRA model, along with the peer reviewer assessments.

27.Regulatory Guide 1.200 section 4.2 requires the licensee to submit documentation that thePRA is consistent with the standard as endorsed in the appendices to the guide, and the identification of the parts of the PRA that conform to the less detailed capability categoriesand the limitations which this imposes. The licensee did not identify how their PRA model conforms to the capability categories identified in the ASME Standard as endorsed by theappendices to Regulatory Guide 1.200 (Attachment 3, Conformance to Standards, to submittal letter dated 10/28/2004). Further, during the NRC staff review of the STP PRAfor the Regulatory Guide 1.200 pilot, the reviewers noted that the STP self assessmentdocumentation was "difficult to discern their conclusions about their PRA". Therefore, the licensee is requested to submit the information required by the guide, and their plans and schedules (if applicable) to address identified deficiencies which are relevant to this application.28.Regulatory Guide 1.200 section 1.2.6 describes the characteristics of PRA modeldocumentation. During the NRC staff review of the STP PRA for the RegulatoryGuide 1.200 pilot, deficiencies in the documentation were specifically noted, and it was further identified that STP placed excess reliance on one particular experienced staff member. Because the nature of this application is to place ongoing reliance on the accuracy and quality of the PRA model to calculate RICTs for the technical specifications, robust documentation of the PRA model is essential to assure the capability of the licenseeto properly maintain the fidelity of the model, without undue reliance on specific staff members. The licensee is therefore requested to describe the current capability of theirPRA model documentation, and to identify a schedule for updates and upgrades to assure their documentation is adequate to permit ongoing maintenance of their PRA models forthe following key areas:a.Key assumptions and approximations applicable to system and event tree models.b.Screening of sequences or failure modes from the model.

c.Quantification instructions, including recovery rules and their bases, mutually exclusiveevent combinations and their bases, and truncation levels.PRA Technical Questions29.During the NRC staff review of the STP PRA for the Regulatory Guide 1.200 pilot, issueswith the adequacy of the common cause failure modeling were noted during very brief reviews of system modeling. The methods were not using the most recent availableinformation, and some CCF modes were not considered (i.e., batteries, chargers). The licensee is requested to describe the development of CCF models for their PRA, and provide a listing of the CCF modes considered, the components which are modeled for CCF, and the sources of data used.30.For use in the configuration risk management program, the baseline PRA model requireschanges to account for the real time nature of the calculations, compared to the average annual risk calculation of the baseline model. The licensee is requested to describe the process of making changes to the baseline PRA model for the CRMP, including the following key areas in their discussion:a.Alignment of operating train(s), including swing or spare components.

b.Disallowed maintenance (i.e., multiple trains in maintenance typically removed fromfinal results, should be retained in CRMP model).c.Maintenance impact on initiating events for systems.d.Adjustment of initiator frequencies (i.e., average CDF model includes unit availabilityfactor, not applicable to CRMP model).e.Seasonal dependencies, or point-in-cycle dependencies (e.g., seasonal HVACrequirements, ATWS success criteria).f.Repairs of failed components (should be removed in CRMP model).31.During the NRC staff review of the STP PRA for the Regulatory Guide 1.200 pilot, issueswith the adequacy of the LERF model were identified and require resolution:a.The STPNOC self-assessment of LERF did not include an explicit review of the LERFelements of the PRA. Rather, reliance was placed on results of the independent peer review and an STPNOC contractor's proposal for addressing the peer review comments. However, the technical issues and criteria used to conduct the peer review do not fully cover the areas addressed in the ASME standard. As a result, the assessment of PRA capability in the area of LERF is incomplete. Please complete theself assessment of LERF, and identify the results and corrective actions from that assessment.b.The attributes used to distinguish large, early releases from other source terms isinsufficient to discern a "potential for early health effects" as required by the Standard.

With the exception of containment bypass and induced steam generator tube rupture(ISGTR), the sole characteristic of large early release (LER) sequences is the size of the opening in the containment pressure boundary. Although this attribute is typically an important contributor, it is not the only one. Some of the sequences assigned tothe LER category involved long-term operation of containment sprays and have wet cavities (i.e., quenched debris ex-vessel). Conversely, some of the small early release (SER) sequences involve dry containments (no sprays and dry cavities). A technical basis for this counter-intuitive grouping scheme is not offered in PRA documentation.Further, the simplistic method of assigning release categories does not appear to besupported by results of plant-specific MAAP calculations of radionuclide release.

Consider the following two damage states: - SGTR (fast station blackout with induced SGTR during core damage).

- 07SU (fast station blackout with pre-existing containment leakage).

According to the attributes used to assign accident sequences to release categories,the first of these is allocated to LER (RC-I), whereas the second is classified as SER (RC-II). However, the MAAP results indicate the following actual release fractionswithin the first 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> of the event:Fission productgroupPercent of Core InventoryReleased to EnvironmentISGTRR07SUXe, Kr2050I93Cs82c.A systematic search for, and evaluation of, plant-specific containment failuremodes was not evident in PRA documentation. As assessment of containmentfailure modes was performed as part of the STP IPE. However, much of the IPE analysis relied on adapting the structural evaluation of the Zion containment.

Although adaptation of reference plant analysis is acceptable for determining theultimate strength of the containment pressure boundary under quasi-static loads, a plant-specific evaluation of alternative failure modes was not found in PRA documentation.d.Actions to mitigate the effects of core damage recommended in the STP severeaccident guidelines (SAGs) are not addressed in the PRA. For example, successful implementation of the guidelines offered in SCG-1 could alter the magnitude of radiological releases.e.The effects of major assumptions, simplification and uncertainties on LERF havenot been evaluated.f.The effects of adverse environmental conditions in containment and physicaleffects of structural failure(s) of the containment pressure boundary on long-term spray recirculation operation are not addressed. STPNOC documentation provided during the review indicates the minimum NPSH required by containment spray pumps (operating in recirculation mode) is 20 ft-H 2 O.Additional Electrical Questions32.This is a followup question on the STP response to RAI 19 on compensatory measures,as it would apply to Technical Specification (TS) 3.8.2.1, DC Sources,. Following the December 15, 2004 public meeting at NRC, the licensee provided a copy of procedure0POP01-ZO-0006, Extended Allowed Outage Time.The risk informed completion time (RICT) for two out-of-service battery chargers for thisTS is 140-1042 days with a proposed 30 day back-stop.

A backstop time of 30 days byitself is not acceptable for the following reasons: a.The battery, without a battery charger, will continue to discharge at a rate relatedto the normal dc operating load. This may result in a deep discharge damaging the connected battery cells by a reverse polarity to the weakest cells. This could be irreversible.

b.The battery is sized for a limited time discharge of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. If a battery chargeris not restored within that time, loss of a complete protection channel will result. Also, possible loss of a complete ac power train could result because dc control is required for the ac power system to be operable.c.Typical battery manufacturer's operating manuals state that damage may occurto an open circuited (unloaded) after some time (months) without the battery being on charge.33.Procedure 0POP01-ZO-0006, Extended Allowed Outage Time, does not address theDC system. Please identify all compensatory measures for the DC system whenremoving a required battery charger from service. Also, please address how the following items, including required action time, will be accomplished when batterycharging capability is not available:a. Limit the immediate discharge of the affected battery.

b. Recharge the affected battery to float voltage conditions using a spare batterycharger.c. Confirm that the partially discharged battery has sufficient capacity remaining toperform its safety function.d. Periodically verify battery float voltage is equal to or greater than the minimumrequired float voltage.34.The original allowed outage times (AOTs)/completion times (CTs) established in thetechnical specifications were, in part, based on realistic industry standards for maintenance time intervals for equipment under test or maintenance. It is the staff's understanding that the additional optional extended AOTs based on the riskmanagement techniques will not be entered as a standard operating practice but willonly be entered when the maintenance or test conditions can not be completed because of some extraordinary circumstance. This being the case;a.Please identify those electrical components where you believe this extendedAOT/CT may be necessary, identify the length of the extended AOT/CT andprovide justification why such an extended AOT/CT would be required. A 30 day extended outage should not be required based upon past industry experience for the following equipment: Circuit breakers and other switchgear components, transformers, motors, cables, battery chargers, inverters, control and protective relays and associated circuits.b.In as much as an extended AOT/CT based on risk management techniqueswould be the exception rather than the rule, please describe the record keepingsystem identifying the following items to verify application for the risk-informedprocess: (1) each application of risk management techniques to extend the AOT/CT, (2) any contingency actions or compensatory measures used during the extended time, and (3) the analysis that justified the extension.c.Will the risk-informed extension of the AOT result in a 30 day extension to a 10 CFR 50.72 or 50.73 reporting requirements if the 30 day backstop is invoked?

35. 10 CFR 50, Appendix B, states that:"This appendix establishes quality assurance requirements for the design,construction, and operation of those structures, systems, and components. Thepertinent requirements of this appendix apply to all activities affecting the safety-related functions of those structures, systems, and components; these activitiesinclude designing, purchasing, fabricating, handling, shipping, storing, cleaning,erecting, installing, inspecting, testing, operating, maintaining, repairing, refueling, and modifying.As used in this appendix, "quality assurance" comprises all those planned andsystematic actions necessary to provide adequate confidence that a structure,system, or component will perform satisfactorily in service."Please confirm that the STP Configuration Risk Management Program (CRMP) andassociated procedures fall under the 10 CFR 50 Appendix B. If STP believes these programs and procedures are not subject to the Appendix B requirements, please justify any exceptions to those requirements.36.In Table 2, Specifications 3.3.2.8.a-c, new Action 20.A.b states, "with the number ofoperable channels more than one less than the Total Number of Channels, within one hour apply the requirements of specification 3.13.1, or be in at least Hot Standby withinthe next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and be in at least Hot Shutdown within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and be in Cold Shutdown within the subsequent 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />." a.How long does it take to update the CRMP database regarding plant equipmentconfiguration changes? Is it credible that the implementation of T.S. 3.13.1 canbe accurately accomplished within one hour? Would not the loss of the second channel fall into the "emergent conditions" that would not be expected to require an extension of the AOT (page 2 of license submittal dated August 2, 2004)?b.During the five year history of the use of the CRMP to make risk assessments,has there been any instances where the initial assessment significantly differed from the final assessment? c.The primary function of the loss-of-power instrumentation system is to assure theindependence between offsite and onsite systems. This independence, pursuantto GDC 17 of 10 CFR Part 50, Appendix A, minimizes the probability of losingelectric power from the onsite electric supplies as a result of, or coincident with, the loss of power from the offsite power supply. Loss-of-power instrumentation initiates load shedding to prevent overloading of the stand-by diesel generators (SDGs). It also supports independence between redundant ac systems and,together with automatic load sequencing, assures the capacity and capability ofthe offsite and onsite ac power supplies.

Please confirm that the proposedchanges in T.S. 3.2.2.8.b and .c will not reduce this independence betweenpower sources.37.In Table 2, Specification 3.8.1.1, New Action Requirement, specifies restoration of atleast one SDG to operable status within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> whereas the existing Action requirement calls for restoration of at least one standby diesel generator within 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />sand two standby diesel generators within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Please explain why this change was not submitted separately in accordance with Regulatory Guides 1.174 and 1.177 sincethe technical basis provided does not justify this change.38.New Action Requirement 3.8.2.1 implies that one battery bank and one battery chargecan be inoperable indefinitely. Please clarify whether Action is initiated only if multiple components are inoperable. In addition, please address concerns stated in question 36 for Specification 3.8.2.1.39.New Action Requirement 3.8.3.1.a implies that one battery bank and one battery chargecan be inoperable indefinitely. Please clarify Action if only one train of the AC power ESF buses is inoperable. In addition, please address concerns stated in question 36 for Specification 3.8.3.1.a.40.Please address concerns stated in question 36 for Specifications 3.

8.3.1.b and 3.8.3.1.c(Re. the one hour risk assessment.)41.Please clarify how the proposed changes will differentiate between degraded vs.inoperable systems, trains, channels or components.General Questions42.LCO 3.13.1 specifies that when referred to this specification, equipment that has beendeclared inoperable shall be evaluated for its impact on risk and AOT determined accordingly. The first two actions require the determination of the acceptability of theconfiguration for AOT beyond the frontstop AOT when an equipment is declaredinoperable, and for the continued operation beyond the frontstop AOT whenever theconfiguration changes, respectively. In response to previous RAI 22 to specify the allowable time to complete the required determination process, the licensee stated that this time will be defined in the implementing procedure for the Configuration RiskManagement Program and will be consistent with the generic industry guidance. However, each referencing Action specifies that within a specific frontstop completion time (e.g., 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />) ... apply the requirements of Specification 3.13.1. Also Section 1 of (Description of Changes and Safety Evaluation) stated that the frontstoptime also provides the operator sufficient time to determine and apply an appropriate extended time from the application of the CRMP for those situations where it isdetermined that an extended AOT is necessary. a.Explain and justify why it is acceptable to specify the allowable time in theimplementing procedure for the CRMP, rather than in TS 3.13.1 or thereferencing TSs? b.Clarify whether the frontstop time specified in the referencing TS is also theallowable time to complete the required determination process in Specification 3.13.1. 43.Some ACTION statements are revised and some new ACTION statements are createdto deal with cases with more than one channel, component, train, or subsysteminoperable, which currently do not have a associated ACTION statement and would be subject to TS 3.0.3. These revised or new Action statements generally require that within one hour restore at least one inoperable channel, component, train, or subsystemto OPERABLE status or apply the requirements of Specification 3.13.1, or be in HOTSTANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. Examples of these revised or new ACTION statements are Action 3.4.2.2 (pressurizer code safety valves), 3.4.4 Actions c and e (PORVs), 3.5.1.a and b (Accumulators), 3.5.2.b (ECCS subsystems), 3.6.2.1.b (containment spray systems),3.6.2.3.b (containment fan coolers), Table 3.3-1 (RTS Instrumentation)

Actions 9, and 9A.b, Table 3.3-3 (ESFAS Instrumentation) Action14.b, 17.b, 19.b, 20A.b, and 22.b. a.Since these revised or new Action statements have a frontstop AOT of only onehour, is one hour sufficient to apply LCO 3.13.1 requirements, which include the use of CRMP to determine AOT extension and the need for corrective or compensatory actions? b.Could there be cases where it takes longer than one hour to determine that anAOT extension for the configuration is not acceptable, and therefore thefrontstop AOT is exceeded without implementing subsequent actions?44.For these conditions that could result in the loss of the required safety function,compensatory actions are most likely required as a defense-in-depth consideration.

Section 4 of Attachment 1 (Description of Changes and Safety Evaluation) discussed the use of the CRMP to determine the safety implications associated with multiple inoperable components, and to assist the operator in identifying effective corrective or compensatory actions for various plant configurations to maintain and manage acceptable risk levels. It is said that these compensatory actions may be incorporated in procedures, work instructions, or other station media. To support this TS amendment, please identify all TS changes (especially for those conditions where two or more channels or trains are inoperable) that require compensatory actions to reduce risk significance, describe each compensatory action and where it is incorporated. 45.In WCAP-15773-P, Rev. 0, supporting TSTF-424, it is stated in Section B3.2, "Scopeand Structure of the Flexible AOT Concept," that typically, AOTs/CTs less than one day are associated with loss of system function and extension beyond the existing AOT mayincur significant risks. Therefore, shorter term Action Statements, such as those associated with complete system inoperability or loss of an entire safety function willretain an Action Statement with a fixed AOT/CT value based on the system's or function's risk importance. ... The flexible AOT concept would also not apply to TS associated with plant operational limits." However, in the STP's application of LCO 3.13.1 for AOT extension, many referencing TSs have 24-hour frontstop AOT(e.g., Table 3.3-1, Actions 9A.a) and some have one-hour frontstop AOT (e.g., TS 3.5.1 Actions a and b, TS 3.5.2 Action b). Explain why the application of LCO 3.13.1 for thoseTSs with frontstop AOT of one and 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is not contradictory to TSTF-424. 46.In TS Table 3.3-3, Action 19.a specifies the action with the number of OPERABLEchannels less than the Minimum Channels OPERABLE requirement, and therefore appears to cover Action 19.b, which specifies the action with the number of OPERABLE channels more than one less than the Minimum Channels OPERABLE requirement. Isthere a typographic error in Action 19.a in that it is intended for the number of operable channels one less than the minimum channels operable requirement?