ML101100457

Draft Request for Additional Information, LAR, Technical Specification 3.8.7 Inverter Completion Times

ML101100457
Person / Time
Site:	Palo Verde
Issue date:	04/20/2010
From:	Plant Licensing Branch IV
To:
Hall, J R, NRR/DORL/LPL4,301-415-4032
Shared Package
ML101100444	List: ML101100457
References
TAC ME2337, TAC ME2338, TAC ME2339
Download: ML101100457 (5)

Text

DRAFT REQUEST FOR ADDITIONAL INFORMATION ARIZONA PUBLIC SERVICE COMPANY, ET. AL.

PALO VERDE NUCLEAR GENERATING STATION, UNITS 1, 2, AND 3 DOCKET NOS. STN 50-528, 50-529, AND 50-530 LICENSE AMENDMENT REQUEST TO EXTEND THE COMPLETION TIME IN TECHNICAL SPECIFICATION 3.8.7 FOR RESTORATION OF AN INOPERABLE INVERTER TAC NOS. ME2337, ME2338, AND ME2339 By letter dated September 28, 2009 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML092810227), Arizona Public Service Company (APS) submitted a license amendment request for the Palo Verde Nuclear Generating Station (PVNGS), Units 1, 2, and 3.

The proposed amendment would revise Technical Specification (TS) 3.8.7, Inverters -

Operating, to extend the allowable Completion Time for Required Action A.1, applicable when one inverter is inoperable, from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 7 days. The change has been requested to support corrective maintenance of the vital inverters while the impacted unit remains at power.

The U.S. Nuclear Regulatory Commission (NRC) staff has reviewed the information provided and determined that the additional information specified below is needed for the staff to complete its evaluation of the license amendment request (LAR).

I. Electrical Review

1. Provide current as-built simplified one-line schematics of the Vital Direct Current system and the Vital Alternating Current (AC) Instrumentation and Control power system including the backup regulated power supply.

2. Describe in detail the maintenance plan/schedule to conduct online corrective maintenance, which is cited in the LAR as justification for the extension of the completion time from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 7 days. In the response, include a description of all post-maintenance and surveillance testing necessary to return the inverter to operable status.

3. Provide a detailed discussion concerning corrective actions and causal analyses which were undertaken for the numerous inverter failures at PVNGS, including the current status and whether inverter reliability issues have been adequately addressed. Also, provide a detailed discussion of other options evaluated (such as modifications, procurement of additional spare parts and/or complete inverters, etc.,) to allow operation and necessary maintenance within the requirements of the existing Technical Specifications.

4. Provide a detailed discussion of the loss-of-power effects for each of the Vital AC busses on an operating unit along with abnormal operating procedures (AOPs) developed to respond to such events. In addition, provide more detail as to why the assumption is made that a loss of offsite power (and resulting unit trip) was the only reason for the de-energization of a

vital bus while powered from the backup supply (loss of a vital bus could occur while the unit is operating due to other failures in the backup supply path), for the purpose of evaluating effects on the plant.

5. Provide a detailed discussion of compensatory measures enacted whenever an inverter is out of service (inoperable) during the proposed 7-day Completion Time, and how such compensatory measures are documented (e.g., captured in the Final Safety Analysis Repot) to ensure their consistent and continued use going forward.

II. PRA Review

1. The LAR describes the process for capturing plant design and procedure changes, but does not address plant operating experience (i.e., failure data and initiating events data).

Describe how such plant-specific data and experience is reviewed and incorporated into the Probabilistic Risk Assessment (PRA) models. If the current model used for this application does not use recent plant-specific data, justify that the results would not be significantly impacted.

2. The LAR does not identify if there are outstanding plant changes (configuration changes or procedure changes) which would require a change to the PRA models, but which have not yet been incorporated into the PRA models used for this application. Identify if such changes exist, and if so, provide an appropriate disposition that the risk impact of these changes would not adversely impact the acceptability of the proposed Technical Specifications (TS) change.

3. The LAR identified that the licensee used an integrated fire PRA model to assess the risk impact from internal fires for this application. The LAR did not provide sufficient information as to the technical adequacy of this model, as required to support a risk-informed licensing action, for the staff to conclude that the fire PRA model is of sufficient quality and scope to support this application. The staff requests the following additional information relevant to the technical adequacy of this model for this application.

a. Address how the current fire PRA model satisfies the technical elements identified in Regulatory Guide (RG) 1.200 Rev. 1, Section 1.2.4.

b. Provide an appropriate justification of any outstanding plant changes not incorporated into the fire PRA model per RG 1.200 Rev. 1 Section 4.2.

c. Describe how spurious component operations are addressed in the fire PRA model.

d. Describe how plant components, modeled in the PRA but not in the scope of the plants fire safe shutdown licensing basis, have been addressed in the fire PRA. Specifically identify how cable route information for such components is handled if these components are credited in the fire PRA.

e. Identify how the human reliability analysis was modified for the fire PRA to account for the impacts of fire on these actions; identify any fire-specific recovery actions credited in the fire PRA, their failure probabilities, and the basis for the probabilities.

f. Identify the reviews (internal, external, and/or peer) completed for the fire PRA model to assure its quality.

4. The LAR does not provide an internal flood analysis for this application, but instead states general conclusions about the insignificance of internal floods generally, and that equipment of importance for the vital AC application is not located in areas where a

significant flood could occur. Provide the basis for this conclusion; what equipment is important for this application, where is it physically located, what are the significant flood sources; so that the staff can reach a conclusion about the importance of internal floods for this application.

5. The self-assessment identified the failure to conduct walkdowns with system engineers and operators, as required by the American Society of Mechanical Engineers (ASME) PRA standard, element SR SY-A4. The licensees disposition acknowledges the deficiency, but justifies that system engineer reviews of fault tree models and PRA analysts familiarity with the plant layout and operations is acceptable. The staff does not agree with this generic disposition, which excludes operator input to the system model development. Describe the experience of PRA analysts with regard to plant layout and current plant operations specific to the vital AC inverter system and other plant systems important for this application.

6. The self-assessment identified the failure to address the state-of-knowledge correlation in estimating the mean core damage frequency, as required by the ASME standard, elements SR QU-A2b and SR QU-E3. The licensees disposition acknowledges the deficiency, but justifies that the uncertainty in the underlying failure data and its treatment of this older data as median values compensate for ignoring the correlation. The staff does not agree with this justification for not considering correlated data sources. Evaluate the results for this application to determine if the failure to address correlated data is having a significant adverse impact on the results; either justify that this impact is not occurring, or provide an appropriate sensitivity study to bound the impact.

7. The self-assessment identified the failure to perform cross-comparisons to other similar plants to identify causes of significant differences, as required by the ASME standard, element SR QU-D3. The licensees disposition identifies a dated comparison performed by the owners group. Discuss the results of this comparison; were any results of the PRA identified as an outlier? What was the disposition of these outliers, if they exist?

8. The self-assessment identified that sources of model uncertainty are not identified, and that there was no systematic approach to assure key assumptions are identified, as required by the ASME standard, elements SR QU-E1 and SR QU-E2. The licensees disposition addresses only parametric uncertainties. There is no discussion or disposition of other sources of uncertainty or the key assumptions. Discuss other sources of uncertainty and key assumptions relevant to this application, and provide appropriate sensitivity studies to bound the impacts.

9. The self-assessment identified that there was no documented basis for crediting a decontamination factor for scrubbing effects, as required by the ASME standard, element SR LE-C10. The disposition of this item implies that scrubbing is credited for preventing large releases for steam generator tube rupture, based on an assumed operator response to assure steam generators are water-filled (flooded). Describe where the large early release frequency (LERF) analysis credits scrubbing, and provide a basis for this credit.

10. The self-assessment identified that the limitations of the LERF model for applications were not identified, as required by the ASME standard, element SR LE-G5. The licensee disposition acknowledges the deficiency, and then states that the existing LERF model is clearly adequate for this application Provide the basis for how the LERF model was found to be clearly adequate.

11. The self-assessment identified 15 separate deficiencies related to documentation of the PRA model. The staff expects that licensees pursuing risk-informed changes to their license have a robust program for configuration control of the PRA, including maintaining adequate documentation per the industry consensus standards. Given the scope of this deficiency in documentation, address how the technical adequacy of the overall PRA model has been assured for this application.

12. It is unclear how the cause/effect relationship was modeled in the PRA for this application.

Specifically, with the inverter inoperable, it is assumed that the associated instrument bus is energized from its backup alternating current (AC) power supply, and that this power supply would then be subject to random failures. This seems to be contradicted in Enclosure 1, Section 3.4.4, in the discussion of the static transfer switch, where the submittal states that the operator action for aligning the backup power is set to TRUE, which would indicate automatic failure and de-energizing of the associated bus. Clarify how the PRA model was modified for evaluating this configuration. If the bus is assumed energized from its alternate source, confirm how the TS require this configuration.

13. Identify how equipment unavailability other than the inverter was addressed by the PRA model in determining the risk metrics for this application. Specifically, also address any PRA assumptions for the proposed tier 2 restrictions on diesel generator (DG) unavailability and Reactor Protection System (RPS) and Engineered Safety Features Actuation System (ESFAS) channel maintenance.

14. The proposed tier 2 restrictions on DG maintenance and planned RPS or ESFAS channel maintenance, applicable for planned inverter maintenance activities, are proposed to be included in the TS Bases, rather than being restrictions of the TS action.

a. It is not clear why equipment operability requirements for a permanent TS change are being proposed to be placed in the Bases, rather than being placed directly in the action requirement. If Action A.1 of TS 3.8.7 is in effect, and a DG failure or RPS/ESFAS channel trip were to occur, what action would be required to comply with the TS, given the proposed TS Bases? Similarly, if DG maintenance were in progress, or if one or more RPS/ESFAS channel(s) were in trip condition when an inverter failure occurred, what action would be required by TS? Further, the licensee has not made any formal commitment for these tier 2 equipment restrictions. The licensee should clarify the intent of the proposed TS Bases changes with regard to plant operations and regulatory commitments.

b. As written, it appears that the restrictions only apply to planned inverter maintenance or other activities. The licensee should clarify the meaning of planned with regards to the applicability of these restrictions.

c. The restriction on application of Action A.1 of TS 3.8.7 apparently applies to any associated DG maintenance (planned or unplanned), but only to planned RPS/ESFAS

channel maintenance. The licensee should clarify its intent with regard to the planned/unplanned unavailability status of these components.

d. Clarify how the risk analyses addressed these proposed TS Bases equipment restrictions.