L-PI-08-095, Responses to NRC Requests for Additional Information Dated October 23, 2008, Regarding Application for Renewed Operating Licenses

Responses to NRC Requests for Additional Information Dated October 23, 2008, Regarding Application for Renewed Operating Licenses

ML083370505
Person / Time
Site:	Prairie Island
Issue date:	11/21/2008
From:	Wadley M Xcel Energy
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
L-PI-08-095
Download: ML083370505 (74)

Text

& XcelEnergy-November 21, 2008 L-PI-08-095 10 CFR 51 10 CFR 54 U S Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 Prairie Island Nuclear Generating Plant Units 1 and 2 Dockets 50-282 and 50-306 License Nos. DPR-42 and DPR-60 Responses to NRC Requests for Additional Information Dated October 23,. 2008 Regarding ADDlication for Renewed Operating Licenses By letter dated April 11, 2008, Northern States Power Company, a Minnesota Corporation, (NSPM) submitted an Application for Renewed Operating Licenses (LRA) for the Prairie Island Nuclear Generating Plant (PINGP) Units 1 and 2. In a letter dated October 23, 2008, the NRC transmitted Requests for Additional Information (RAIs) regarding that application. This letter provides responses to those RAIs. provides the text of each RAI followed by the NSPM response. Enclosure 2 provides a copy of analysis ENG-ME-1 48, Revision 1, requested in RAI SAMA 5.b.

If there are any questions or if additional information is needed, please contact Mr. Eugene Eckholt, License Renewal Project Manager.

Summary of Commitments This letter contains no new commitments or changes to existing commitments.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on November 21, 2008.

Michael D. Wadley Site Vice President, Prairie Island Nuclear Generating Plant Units 1 and 2 Northern States Power Company - Minnesota Enclosures (2) 1717 Wakonade Drive East

• Welch, Minnesota 55089-9642 Telephone: 651.388.1121 /4133 IdJ R

Document Control Desk Page 2 cc:

Administrator, Region III, USNRC License Renewal Environmental Project Manager, USNRC Resident Inspector, Prairie Island, USNRC Prairie Island Indian Community ATTN: Phil Mahowald Minnesota Department of Commerce

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 RAI SAMA 1.a Provide the following information regarding the Probabilistic Risk Assessment (PRA) models used for the Severe Accident Mitigation Alternative (SAMA) analysis (for both units unless otherwise specified):

a. Provide the core damage frequency (CDF) for each of the initiating event categories shown in Figures F.2-1 and F.2-2. (The percent contribution to CDF reported in these figures does not provide sufficient resolution).

NSPM Response to RAI SAMA l.a The requested information is provided in the two tables below:

Figure F.2-1 data:

PINGP Unit 1 CDF by Initiating Event Small LOCA 49% 4.82E-06 Loss of Cooling Water 18% 1.76E-06 Loss of Offsite Power 11% 1.04E-06 Loss of Main Feedwater 4% 3.89E-07 Medium LOCA 3% 3.39E-07 Loss of CCW 3% 2.89E-07 Large LOCA 3% 2.76E-07 Internal Flooding 2% 2.39E-07 Normal Transient 2% 2.37E-07 SGTR 2% 1.94E-07 Other 2% 2.12E-07 Total 100%1 9.79E-06

1. Individual contributors do not add to 100% due to rounding.

Figure F.2-2 data:

PINGP Unit 2 CDF by Initiating Event Small LOCA 45% 5.40E-06 Loss of Cooling Water 15% 1.77E-06 Loss of Offsite Power 10% 1.16E-06 SGTR 9% 1.13E-06 Medium LOCA 4% 5.35E-07 Loss of Main Feedwater 3% 4.09E-07 Loss of Train A DC 3% 4.01 E-07 Large LOCA 3% 3.05E-07 Loss of CCW 2% 2.90E-07 Normal Transient 2% 2.83E-07 Internal Flooding 2% 2.41 E-07 Other 1i% 1.73E-07 Total 100%' 1.21 E-05

1. Individual contributors do not add to 100% due to rounding.

1

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 The dominant initiating event contributor to the CDF for both units is the Small LOCA initiating event. In all such events, a means of providing long term cooling to the core must be provided. The PRA model credits two methods for Small LOCAs: RCS cooldown and depressurization to allow use of the RHR system in shutdown cooling mode, and transfer to high-head recirculation. Both methods require operator action directed by the EOPs, and high-head recirculation is strictly a manual action at PINGP (no automatic switchover to recirculation). Therefore, on a Small LOCA, failures of two operator response actions are modeled as leading to core damage. Also, in sequences where the RCS cooldown and depressurization action has failed, the probability of success of the transfer to recirculation operator action is considered to be dependent on the fact that the RCS cooldown and depressurization action has already failed. See the response to RAI SAMA 5.a below for a more thorough discussion of these two operator actions.

RAI SAMA 1.b

b. Provide the CDF for anticipated transient without scram (ATWS) and station blackout events.

NSPM Response to RAI SAMA 1.b The requested information is provided in the table below:

Unit 1 Unit 2 CDF Contributor (per rx-yr) (per rx-yr)

Anticipated Transient Without Scram (ATWS) 1.63E-07 1.65E-07 Station Blackout (SBO) 8.52E-07 9.41 E-07 RAI SAMA 1.c

c. The Environmental Report (ER) notes several differences between Unit 1 and 2, including auxiliary feedwater (AFW) pump breaker control power, Unit 1 replacement steam generators (SGs), and improved Unit 1 sump design. Provide a complete summary of differences between the units with a discussion of the estimated impact of these differences on CDF and the release frequencies. Include the reasons for the difference in the emergency diesel generator common cause failure that was stated in Section F.2.1.2.4.

NSPM Response to RAI SAMA 1.c AFW Pump Breaker Control Power At PINGP, the main feedwater regulating and regulating bypass valves for both units are air operated valves that fail closed on loss of control power. The control power for these valves is supplied from Train A DC power. Therefore, a loss of Train A DC power occurring during at-power operation of either unit will result in a reactor trip (on that unit) with loss of main feedwater. However, breaker control power for the Unit 2 motor driven AFW (MDAFW) pump 2

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 is supplied from Train A DC power, while breaker control power for the Unit 1 MDAFW pump is supplied from Train B DC power. On loss of Unit 2 Train A DC power, if a random failure of the Unit 2 turbine-driven AFW pump occurs, then operator action is required to either locally cross-tie the Unit 1 MDAFW pump discharge to allow the pump to supply the Unit 2 SGs, or (failing that) to initiate bleed and feed cooling of the RCS. A conditional failure probability for failure of the bleed and feed operator action is applied in the PRA model. The likelihood of success of this action is assumed to be partially dependent on the success or failure of the action to align and initiate flow from the Unit 1 MDAFW pump.

As a result of the MDAFW pump control power asymmetry, the Loss of Train A DC initiating event contributes more significantly to the Unit 2 CDF (4.01 E-7/rx-yr) than it does to the Unit 1 CDF (3.84E-8/rx-yr). The Loss of Train B DC initiating event contributes more significantly to the Unit 1 CDF (1.04E-8/rx-yr) than it does to the Unit 2 CDF (9.95E-1 1/rx-yr). This is due to the fact that the MDAFW pump on Unit 1 is impacted by the Loss of Train B DC (no impact to the AFW system on Unit 2 for Loss of Train B DC). Note that the effects of the asymmetry between the Unit 1 and Unit 2 DC power support functions are much less significant for other initiating events, because the DC power trains are highly reliable and the probability of train failures over the typical PRA mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is low.

The AFW pump control power asymmetry contributes to a higher potential for induced SGTR on Unit 2. On a loss of Unit 2 Train A DC power, the loss of main feedwater and inability of one AFW pump to start automatically increases the potential for the event to degrade into a core damage event at high pressure due to loss of heat sink (dry SG). This increases both the frequency of the Large Early Release Frequency (LERF) risk metric for Unit 2 and the L-SR-E release category for Unit 2 by approximately 1.1 8E-9/rx-yr. Other than through the increase in the potential for induced SGTR, the AFW control power asymmetry does not influence the LERF metric significantly because one train of containment systems remains available to provide containment pressure and temperature control, and all containment penetrations with DC power dependencies are either closed or fail in the closed position on loss of DC power. The asymmetry also increases Unit 2 non-LERF release categories X-XX-X (no vessel failure, no containment failure), L-XX-X (vessel failure at low pressure, no containment failure) and L-DH-L (vessel failure at low pressure, late containment failure due to failure to remove decay heat from containment) release category frequencies over their Unit 1 equivalent frequencies; however, the impact to these categories have a much smaller impact on the overall SAMA results.

The table below provides the differences in release category frequencies between Units 1 and 2 based on the AFW control power asymmetry (the differences for release categories not listed were insignificant). Descriptions of the release categories are provided in Section F.2.4 of the ER.

3

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 Differences Between Unit 1 and Unit 2 Release Category Frequencies Dui* tn AFW Control Power A~vmm~trv Unit 1 Frequency Unit 2 Frequency Release Category (per rx-yr) (per rx-yr) Difference (U2 - Ul)

L-SR-E 8.42E-11 1.26E-09 1.18E-09 L-XX-X 2.93E-08 2.86E-07 2.57E-07 L-DH-L 1.44E-08 4.98E-08 3.54E-08 X-XX-X 8.51E-10 5.22E-08 5.13E-08 Unit 1 and Unit 2 Emergency Diesel Generators The Unit 1 emergency diesel generators (EDGs) are the original EDGs, in place since original plant construction. Originally, these EDGs provided backup onsite 4160V AC power for both units; however, in response to the SBO Rule, PINGP installed two new diesel generators dedicated to perform this function for Unit 2. The original capability to supply AC power from an EDG to its train-related 4kV safeguards bus on the opposite unit has been retained.

However, the Unit 2 EDGs differ significantly from the Unit 1 EDGs in manufacturer, design, capacity, and in the external systems required to support their operation. Therefore, common-cause failure of EDGs across the units (for example, between D1 on Unit 1 and D5 on Unit 2) is not modeled in the PINGP PRA model. Common-cause failure of EDGs within units (for example, between D1 and D2 on Unit 1, and between D5 and D6 on Unit 2) is modeled. In addition, the EDG sets of the two units have different operating and performance histories. Therefore, the plant-specific failure data for the Unit 1 and Unit 2 EDGs are not pooled, to allow the model to correctly reflect differences in performance between these EDG sets. As a result of these differences, the random and common-cause failure to start and failure to run basic event values used in the PRA model for the Unit 2 EDGs are somewhat higher than they are for the Unit 1 EDGs. Despite these differences, due to the independent design of the EDGs between units combined with the ability to cross-tie the 4kV buses across units, the contribution to the CDF from events initiated by a loss of all AC power is less than 10% for both units, and the contribution to offsite releases is very low (see response to RAI SAMA 1 .b above and Section F.5.2.3 of the ER).

The EDG sets for each unit are already installed and operational, and are already modeled as an integral part of the PRA for both units. A quantitative estimate of the impact of the design and operating differences on CDF and release frequencies is not available. The extensive effort it would take to quantify the impact of this asymmetry to the PRA results would not be beneficial (i.e., a SAMA to replace the EDGs on one of the units to match the EDGs on the other unit would not be cost-beneficial).

Unit 1 Replacement Steam Generators As described in the ER, the Unit 1 steam generator replacement project was completed in 2004, while the Unit 2 steam generator replacement has not been completed. From a reactor safety standpoint, the primary difference between the new Unit 1 SGs and the Unit 2 SGs is that the Unit 1 SGs are now expected to have a lower potential for tube rupture during plant operation, which is modeled in the PRA by the Steam Generator Tube Rupture (SGTR) 4

Enclosure I Responses to NRC Requests for Additional Information Dated October 23, 2008 initiating event frequency (Unit 1 SGTR frequency = 7.98E-4/rx-yr per loop, Unit 2 SGTR frequency = 4.50E-3/rx-yr per loop). The potential for SG-related equipment failures and component performance modeled in other areas of the PRA (LOCA frequencies, secondary side break frequencies, impact on operator action timing, etc.) were assumed to be the same as the previous SGs. Also note that the analysis does not reflect a possibly lower potential for pressure- and temperature-induced SGTR on Unit 1 due to the replacement SGs.

As core damaging events resulting from SGTR are a significant component of the LERF and a primary means of producing offsite releases relevant to the SAMA analysis, the differences in the SAMA quantification results due to the differences between the Unit 1 and Unit 2 SGs are well-documented in the ER. Differences in the baseline Rev. 2.2 SAMA PRA model results for CDF and LERF due to the SG design asymmetry are presented in Sections F.2.2, F.2.3 and F.2.4 and in the figures presented in Section F.10 of the ER.

Containment Sump Design The containment sump configurations for both Unit 1 and Unit 2 have recently been modified to address the concerns of Generic Letter 2004-02. The Unit 1 model discussed in Section F.2.2.1 of the ER reflects the installed strainer sump modification. As described in Section F.2.2.2 of the ER, the Unit 2 SAMA probabilistic analysis results were quantified using the Unit 2, Level 1 Rev. 2.2 (SAMA) model. At the time of the Rev. 2.2 SAMA model update, the containment sump strainer modifications on Unit 2 had not been completed. However, during the Unit 2 refueling outage in the fall of 2006 (prior to the submittal of the LRA), the containment sump modifications were completed. Therefore, Section F.7.4 of the ER was included to discuss the results of an analysis to address the sensitivity of the SAMA analysis results to this plant configuration change.

With the containment sump modifications assumed to be installed, the calculated Unit 2 CDF metric dropped from 1.21 E-5/rx-yr to 1.13E-5/rx-yr, and the LERF metric dropped from 1.75E-7/rx-yr to 1.72E-7/rx-yr. The release frequencies for late containment failure categories stayed essentially the same, while many of the release frequencies for early containment failure drop. The improved containment sump design is assumed to reduce the potential for debris blockage and failure of ECCS recirculation from the sump; this has the effect of lowering the frequency of core damage sequences at high RCS pressure due to sump recirculation failure. The reduction in the frequencies of these high pressure core damage sequences reduces the potential for high pressure melt ejection (HPME) and reduces the potential for a number of early containment failure modes. Also, the frequencies of the most significant containment-intact categories dropped, reflecting the improved likelihood of long term core cooling success and lower core damage frequency. The table below provides the change in release category frequencies. Descriptions of the release categories are provided in Section F.2.4 of the ER.

5

Enclosure Responses to NRC Requests for Additional Information Dated October 23, 2008 Unit 2 Release Baseline Frequency Sensitivity Case Category (per rx-yr) Frequency (per rx-yr) Change 2X-XX-X 5.67E-06 4.94E-06 -13%

2L-XX-X 2.84E-06 2.75E-06 -3%

2L-DH-L 1.97E-06 1.97E-06 0%

2GLH 1.03E-06 1.03E-06 0%

2L-CC-L 3.39E-07 3.39E-07 0%

2GEH 9.87E-08 9.87E-08 0%

2L-SR-E 4.34E-08 4.02E-08 -7%

2X-H2-E 4.03E-08 3.40E-08 -16%

21SLOCA 3.22E-08 3.22E-08 0%

2H-DH-L 3.14E-08 3.14E-08 0%

2L-H2-E 2.49E-08 *2.42E-08 -3%

2H-XX-X 2.03E-08 2.03E-08 0%

2H-OT-L 5.87E-09 5.87E-09 0%

2X-CI-E 7.32E-10 6.55E-10 -11%

2L-CI-E 1.85E-1 0 1.85E-1 0 0%

2H-H2-E 2.32E-1 1 2.32E-1 1 0%

2H-CI-E 0.OOE+00 0.OOE+00 0%

2X-DH-L 0.OOE+00 0.OOE+00 0%

Note: "Sensitivity Case Frequency" indicates frequency with sump modifications installed; sensitivity analysis is described in ER Section F.7.4.

As the modifications have now been completed on both units, this design asymmetry no longer exists between the units. Ifthe SAMA analysis was completely re-performed to incorporate the Unit 2 modification, the results would not differ in any meaningful way from the sensitivity analysis results described in Section F.7.4 of the ER RAI SAMA 1.d

d. In Section F.2.1.2.4 of the ER, the description of the changes made in PRA Revision 2.0 does not distinguish between changes made to the Unit 1 model to produce Unit 1, Revision 2.0, and changes to the Unit 1 model to develop the initial Unit 2 model (i.e., Unit 2, Revision 2.0). Provide a separate listing of each set of changes.

NSPM Response to RAI SAMA 1.d Section F.2.1.2.4 of the ER listsall of the significant changes made to the Unit 1 PRA model to produce the Unit 1, Rev. 2.0 model from the Unit 1, Rev. 1.2 model. A sequential process was followed, in which the necessary updates and changes to the Unit 1 model were made, followed by development of the Unit 2 model from the (revised and updated) Unit 1 model.

It should be noted that a significant portion of the Unit 2 system logic models already existed in the Unit 1, Rev. 1.2 PRA model, as a number of systems and equipment normally identified 6

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 with Unit 2 are either shared with Unit 1 during normal operation or can be used to support Unit 1 safety functions in response to an event (see the response to RAI SAMA 1.e below).

As the configurations of the two units are nearly symmetrical, the majority of the Unit 2 model development process involved duplication of Unit 1 logic models for the frontline and support systems that were not already in the model as capable of being shared with or cross-tied to Unit 1. Event and logic gate descriptions within these new trees were then changed to reflect the appropriate Unit 2 equipment identifiers. The Rev. 2.0 PRA model was then produced by linking the Unit 1 and new Unit 2 logic models together to support more efficient analysis of equipment and operator failures that impact risk on both units.

The following lists break down the changes listed in Section F.2.1.2.4 of the ER into those made to produce the Unit 1 portion of the Rev. 2.0 model and those made to produce the Unit 2 portion of the Rev. 2.0 model:

Changes Made to the Unit 1 Rev. 1.2 Model to Obtain Unit 1, Rev. 2.0 (Interim) Model

• Removal of the boric acid storage tank (BAST) input to the safety injection (SI) pumps suction logic. The primary suction supply is now only the refueling water storage tank (RWST).

• Enhancement of the existing quantification methodology, including incorporation of fault tree-based deletion of mutually exclusive events, including multiple initiating events.

" Modification to the charging pump system fault tree logic to include an operator action to restart the pumps after a LOOP event since they are not included in the sequencer logic.

• Use of the same common cause failure (CCF) event for the residual heat removal (RHR) pump discharge check valves in the injection, recirculation, and shutdown cooling modes.

" A new operator action to prevent load sequencer failure due to loss of cooling to the 4kV safeguards bus rooms (Bus 15, Bus 16, Bus 25, and Bus 26 rooms) was incorporated into the model. In conjunction with this change, a factor for the sequencer failure at elevated temperatures was added to the fault tree logic for the safeguards bus.

• Update to the logic modeling for the supply/exhaust fans 21, 22, 23, 24 which supply air to the Unit 2 safeguards bus rooms. The original modeling assumed that none of the fans were running (but one train is normally running). This modeling change assumed supply/exhaust fan sets 21 and 22 are normally running and supply/exhaust 23 and 24 are in standby. Therefore, the failure to start logic was only included for sets 23 and 24. The CCF to start basic events (BEs) for all four sets was removed from the model.

• An incorrect and non-conservative mutually exclusive event related to the Screenhouse Flood Zone 2 Initiating event (I-SH2FLD) was removed from the logic. This resulted in an increase in the contribution of the Screenhouse Flood Zone 2 (SH2FLD) event to the overall results.

.7

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 Changes Made to the Unit 1 Rev. 2.0 (Interim) Model to Obtain Units 1 and 2, Rev. 2.0 Model

" Addition of Unit 2 frontline and support system logic modeling.

• Addition of Unit 2 accident sequence logic modeling.

" Inclusion of CDF and LERF calculations for Unit 2.

RAI SAMA i.e

e. The peer review of the PRA was performed in September 2000, several years prior to the development of the Unit 2 PRA. In this regard, provide a description of the quality controls, including any internal and external peer reviews, applied to the development of the Unit 2 PRA.

NSPM Response to RAI SAMA i.e The ER provides supporting information based on the PINGP plant-specific PRA model. A summary of information related to demonstrating the technical adequacy of the PRA is presented below. Information presented includes: peer-review of the Prairie Island model, expansion of the model to include Unit 2 risk metrics, the Prairie Island PRA calculation process and documentation, and additional internal reviews that have been performed.

Peer-Reviewed PRA Model The PINGP PRA model has undergone a Westinghouse Owners Group (WOG) Peer Review Certification performed in September 2000. The most current PRA model at the time (Revision 1.1) was reviewed, which included only Unit 1 core damage frequency (CDF) and large early release frequency (LERF) model results. The Unit 2 CDF and LERF risk metrics had not yet been incorporated in the model and therefore were not included in the peer review process. However, the expansion of the model to include Unit 2 risk metrics has not invalidated the peer review findings, and the results of the peer review process have been incorporated into the Unit 2-specific portions of the modeling that were not available at the time of the peer review. The expansion of the model is discussed below (and in the response to question 1.d. above).

The PRA model that was peer-reviewed did include modeling of the equipment shared between the units. This includes the following plant systems:

" 4160 VAC Power,

• Cooling Water (known as Service Water at other plants),

" Instrument Air,

• Auxiliary Feedwater (AFW) crossties,

• Safeguards Chilled Water, and

• Ventilation supporting shared equipment.

All of the above models were complete models at the time of the peer review. For example, the Unit 2 4160 VAC power equipment addressed in the Unit 1 PRA models subject to peer review included the following:

8

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008

• Unit 2 safeguards 4160 VAC buses,

• Emergency diesel generators,

" Manual and automatic voltage restoration (Safeguards load sequencers), and

• Support systems required for the Unit 2 safeguards AC power system and EDGs.

The logic models added to the PRA model since the peer certification review have not included any significant changes to these core portions of the PRA model.

Expansion of Existing PRA Model to Include Unit 2 Risk Metrics After the peer review was completed, the PINGP PRA model was expanded to include Unit 2 quantification of CDF and LERF risk metrics. This is considered to be a significant enhancement to the PINGP in-house risk analysis capability. This expansion allows PINGP to more accurately model the impact to Unit 2 risk due to physical and operational differences that exist between the units. These differences include different EDG set designs, safeguards AC bus and electrical system location (spatial) differences, cooling water pump power supply differences and steam generator replacement. In addition, availability of straightforward Unit 2 model risk metrics greatly improves configuration risk assessments for Maintenance Rule (MR) evaluations (10 CFR 50.65(a) (4)), and other Unit 2 risk evaluations, since the operators and scheduling personnel are not required to translate Unit 1 results (while accounting for differences between the units) to perform those evaluations.

The Unit 2-specific portions of the PINGP PRA model are essentially a mirror-image of the corresponding Unit 1 model portions (which were peer reviewed), with plant-specific differences included as necessary to make sure that Unit 2 risk is accurately modeled. The only differences between the Unit 1 and Unit 2 symmetric system fault trees are the basic event names, descriptions (which reflect Unit 2 equipment), and support system linkages such as power supplies that are specific to Unit 2 equipment. Examples of Unit 2-specific fault tree modeling include the Safety Injection, Residual Heat Removal, Component Cooling, Chemical and Volume Control systems, and secondary systems such as Main Feedwater, Condensate and Main Steam systems.

The methodology and assumptions used in the Unit 1 portion of the model are applied in the same way in the Unit 2 portion of the model unless physical differences exist between units.

In addition, the updates that have been performed to address peer review issues have been applied to the modeling for both units.

Upon expansion to include Unit 2 CDF and LERF risk metric quantification, the model was subjected to a series of reviews intended to identify incorrect modeling assumptions and errors in modeling. Due to the symmetry of design and similar operation between the units, one of the best ways to identify model problems is to compare the quantified output from one unit to the other, and verify any unexpected results to be accurate. Results from the model for Unit 2 were consistent with the results for Unit 1 risk metrics (which were peer reviewed),

including similar cutsets with similar frequencies, similar importance measure results, and so forth. In addition, clear quantification differences between the units appeared where they were expected (where dissimilarities between the units exist, such as the AFW control power asymmetry described in the response to RAI SAMA 1.c above). Some of the evaluations performed on the results for both units include:

9

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008

" Cutset Review (CDF and LERF).

• Initiating Event Distribution (CDF and LERF).

• Dominant Accident Sequences.

• Model Asymmetry Review.

" Accident Class Definition and LERF Calculation.

" Important Operator Actions.

" Importance Measures (Component, train and system level).

• Important Equipment Failures and Unavailability.

" Important Common Cause Failures.

The quantification review was also documented in accordance with the PRA Calculation File System process (see below).

PINGP PRA Calculation File System Process The inclusion of the Unit 2 CDF and LERF portions into the PINGP model was documented using the PRA Calculation File System process. This process utilizes a preparer (who is responsible for performing the model revisions and providing documentation that supports the changes), and a reviewer (who is responsible for performing a verification of the revisions to ensure assumptions and input and output data are correct, and to ensure that documentation is accurate). The PRA Calculation File System process ensures the quality and completeness of the modeling changes and the documentation. The peer certification team reviewed the PRA Calculation File System process and (together with the other elements of the maintenance and update process) found it to be adequate for risk informed applications, contingent on closeout of recommendations related to the maintenance and update process (MU). The Findings and Observations (F&O) related to the MU element have been resolved.

As described above, the PRA Calculation File System process was used during the expansion of the model to include Unit 2 risk metrics. In addition, although not required for all PRA calculations, many portions of the expanded, dual-unit PRA model evaluation were reviewed and approved by the Fleet Lead PRA Engineer and PINGP PRA Supervisor.

It can be demonstrated that the model used for the SAMA analysis is up to date in that it represents the current plant design and configuration, and represents current operating practices to the extent required to support the submittal. This demonstration is achieved through a PRA maintenance plan that includes a commitment to update the model periodically to reflect changes that impact the significant accident sequences. The Fleet PRA program requires that the PRA model receive an update regularly, with a frequency approximately once every other operating cycle (for PINGP that is every three to four years). Model elements to be updated during a periodic update include data (may be limited to a subset of the most risk significant equipment) and selected initiating events. Model changes may also result from required reviews of procedures for changes to Human Error Probabilities (HEPs) and testing intervals; internal and external plant operating experience; changes to Technical Specifications; changes to design bases or other calculations that may affect assumptions in the model; and an assessment of open industry and NRC issues that may affect the PRA and its use for applications.

10

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 Key assumptions and approximations relevant to the SAMA analysis were used to identify sensitivity studies needed for input to the decision making associated with the analysis. The peer certification review included a focus on the key model assumptions. The Rev. 2.2 SAMA model development included a parametric uncertainty analysis, truncation level review, and a number of sensitivity studies to determine the importance of key assumptions (including credit for containment spray recirculation, potential for containment failure prior to vessel failure, and the failure probability values used for early containment phenomena in the Level 2 analysis).

The ER includes the results of a number of sensitivity studies that exercise key assumptions relative to the methodology used for determination of the cost-benefit associated with identified SAMAs, including the uncertainty associated with PRA model parameters.

Additional Assurance of PRA Quality At PINGP, the PRA program is controlled by the Fleet Program Engineering group, and is subject to internal and external assessment to ensure fleet program standards are met and program health is maintained. Since the WOG Peer Certification review, the PINGP PRA model has been reviewed three times as part of the self-assessment process. Maintenance Rule program processes, which rely on the quality of the PRA model underlying the assessment of equipment importance and online maintenance risk, were reviewed by the site Nuclear Oversight (i.e., Quality Assurance) group in 2003. In addition, engineering self assessments of the PRA by PRA staff from other fleet facilities were conducted in 2004 and in 2007. The 2007 assessment also included other external resources. Each of these assessments included the completed 2-unit PRA model.

RAI SAMA 1.f

f. The model changes identified in Section F.2.1.2 of the ER do not include changes to the reactor coolant pump seal loss-of-coolant accident (LOCA) model. Describe the current seal LOCA model, including the conditional seal LOCA probabilities used in the model.

NSPM Response to RAI SAMA I.f The RCP seal LOCA model used for the Prairie Island model is the Westinghouse RCP seal LOCA model described in WCAP-1 0541, "Reactor Coolant Pump Seal Performance Following a Loss of all AC Power," Revision 2, November 1986 (Proprietary). WCAP-1 0451 models core uncovery due to a seal failure as a function of time from a loss of seal cooling and includes effects of restoration of offsite power. The probability of an RCP seal leak as a function of time was analyzed for two conditions: one with RCS cooldown and one without RCS cooldown.

RAI SAMA 1.g

g. The discussion in Section F.2.2.2 of the ER notes that the Level 1 model used for the SAMA evaluation included one additional correction that had a slight impact on CDF, but does not describe this correction. Provide a description of this change and its impact on CDF.

11

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 NSPM Response to RAI SAMA I.g The correction to the model was made to reflect the fact that the containment sump modifications (as described in Sections F.2.2.2 of the ER and in the response to RAI SAMA 1 .c above) were not yet installed on Unit 2. The Rev. 2.2 model had previously (erroneously) modeled the sump modifications as if they were in place in both units. The impact of this change on the Unit 2 CDF is provided in Section F2.2.2 of the ER (final CDF increased approximately 8E-7/yr, to 1.21 E-5/yr).

RAI SAMA 1.h

h. Provide the CDF and containment release characteristics for internal flood events, and a breakdown and summary of the top flood scenarios.

NSPM Response to RAI SAMA 1.h The table below provides, for each unit, the requested information regarding the contribution to CDF from internal flooding scenarios.

Internal Flooding Contribution to CDF/LERF Risk Metrics and Release Category Frequencies Int. Flood Unit Int. Flood Unit Risk Metric/ 1 Frequency  % Unit 1 2 Frequency  % Unit 2 Release Category (per rx-yr) CDF (per rx-yr) CDF CDF 2.39E-07 2.4% 2.41 E-07 2.0%

1GEH 0.OOE+00 0.0% 0.00E+00 0.0%

1GLH 0.OOE+00 0.0% 0.O0E+00 0.0%

1H-CI-E 0.00E+00 0.0% 0.00E+00 0.0%

1H-DH-L 0.00E+00 0.0% 0.00E+00 0.0%

1H-H2-E 2.32E-1 1 0.0% 2.32E-1 1 0.0%

1 H-OT-L 4.63E-09 0.0% 4.63E-09 0.0%

1H-XX-X 1.18E-10 0.0% 1.18E-10 0.0%

1ISLOCA 0.OOE+00 0.0% 0.OOE+00 0.0%

1L-CC-L 2.27E-07 2.3% 2.27E-07 1.9%

1L-CI-E 0.OOE+00 0.0% 0.OOE+00 0.0%

1L-DH-L 8.86E-1 0 0.0% 8.87E-1 0 0.0%

1 L-H2-E 1.61 E-09 0.0% 1.61 E-09 0.0%

1 L-SR-E 1.19E-09 0.0% 1.19E-09 0.0%

1L-XX-X 6.83E-09 0.1% 6.80E-09 0.1%

1X-CI-E 0.OOE+00 0.0% 0.OOE+00 0.0%

1X-DH-L 0.OOE+00 0.0% 0.OOE+00 0.0%

1X-H2-E 0.OOE+00 0.0% 0.OOE+00 0.0%

1X-XX-X 5.55E-11 0.0% 5.55E-11 0.0%

12

Enclosure I Responses to NRC Requests for Additional Information Dated October 23, 2008 The dominant internal flooding sequences for both units involve flooding of the 695' elevation of the Auxiliary Building. The worst case flooding scenario (which is assumed for all flooding events associated with this initiating event) is due to a Cooling Water (CL) header rupture in the Component Cooling Water (CC) heat exchanger area, which is assumed to fail one train of CC pumps on both units as they are located below the associated CL header in that room.

This is considered a dual-unit initiating event. The other train of CC pumps will continue to function if operator action to identify and isolate the ruptured CL header prior to submergence of the CC pump electrical connections is successful. Failure of this action will also result in flooding beyond the CC pumps, impacting both trains of Safety Injection (SI) pumps, Residual Heat Removal (RHR) pumps, and Containment Spray (CS) pumps, as well as motor control centers (MCCs) supporting the Charging pumps and other safeguards equipment. The core damage sequence involves occurrence of the flooding initiating event followed by failure of the operators to isolate the break prior to loss of the second train of Component Cooling (CC) pumps. This results in loss of reactor coolant pump (RCP) seal cooling, which eventually leads to an unrecoverable RCP seal LOCA as the ECCS pumps have been impacted by the flooding event. For both units, about 97% of the contribution to CDF from internal flooding involves events initiated by flooding of the 695' elevation of the Auxiliary Building (as described above).

The dominant internal flooding containment failure sequence involves the core damage scenario described above. Core damage occurs at high reactor pressure in this sequence.

In-vessel recovery due to submergence of the lower reactor vessel head (by filling the reactor cavity) is not successful as all means of pumping the RWST water into containment, including the CS pumps, have been impacted by the flooding in the Auxiliary Building. Hot leg creep rupture occurs prior to vessel failure in this sequence, allowing the core debris to exit the vessel at low pressure. As the debris in the cavity cannot be cooled, containment failure occurs due to basemat failure. This is considered a late containment failure mode. For both units, essentially all of the contribution to containment failure release categories from internal flooding involves events initiated by flooding of the 695' elevation of the Auxiliary Building.

13

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 RAI SAMA 2.a Provide the following information relative to the Level 2 PRA analysis:

a. Describe the modeled risk benefit achieved from the removal of procedural guidance to operator initiation of containment spray recirculation as discussed in Section F.2.1.3.1.

NSPM Response to RAI SAMA 2.a Credit for operation of the containment spray (CS) system in recirculation mode was removed in the Unit 1 Level 2 Revision 1 (1L2R1) analysis so that the PRA model would reflect the as-built, as-operated plant. As described in Section F.2.1.3.1 of the ER, the decision to make the procedure change was made based on the results of licensing-basis calculations. There was no risk benefit realized as a result of the procedure change. A specific sensitivity study to identify the significance of this change was not performed for the 1 L2R1 model; however it could have had only a very small impact (risk increase) on the overall results of the 1 L2R1 analysis. The availability of the spray recirculation function does not impact the CDF or LERF metrics for either unit. Rather, it primarily supports long term containment heat removal for high pressure melt ejection (HPME) accident sequences. These sequences are a subset of the "late containment failure, vessel failure at high pressure" sequence grouping that had a collective frequency of <2% of the total containment failure frequency in the 1 L2R1 analysis (1.69E-7/rx-year).

Note that MAAP analyses performed for the IPE showed these sequences (without credit for CS recirculation) take on the order of 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> to result in failure of containment on overpressure, increasing the potential for recovery of failed equipment and reducing the overall source term of any releases. In addition, the frequency of sequences in which the CS recirculation function is required and remains available is very low, as this function requires successful operation of the low pressure RHR recirculation function. Therefore, many of the same sequences that lead to HPME (those initiated by or that involve loss of plant cooling water, component cooling water, electric power, etc.) also result in failure of RHR recirculation and ultimately, CS recirculation. These facts indicate that the overall importance of the CS recirculation function is actually less than the impact described above.

The PINGP Severe Accident Management Guides (SAMGs) now specify use of CS recirculation (CSR) in the event of containment challenge post-core damage. Therefore, credit for the containment spray recirculation function was re-instituted in Level 2 Revision 2 (L2R2) SAMA update. A sensitivity study was performed for that model update to investigate the risk benefit of this function based on the current model. To perform the sensitivity case, the CSR function was set to TRUE (failed) in the modeling, and a full re-quantification of the model was performed. Compared to the baseline Level 2 results (provided in Sections F.2.3, F.2.4 and Figures F.2-5 and F.2-6), quantification of the CSR sensitivity case for both units produced very little change in the overall quantification results, with only a slight (<1 %) shift from the 1 H-XX-X [2H-XX-X] release category to the 1H-DH-L [2H-DH-L] release category.

This shift was due to an increase in core damage sequences leading to vessel failure at high RCS pressure (typically small LOCA with operator failures to cool down and depressurize the RCS and then to switch to recirculation) in which the containment fails on overpressure without the containment spray system capable of operating in recirculation mode.

14

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 RAI SAMA 2.b

b. It appears that treatment of induced-steam generator tube rupture (SGTR) events was eliminated in Revision 1.0 of the Level 2 PRA (per ER Section F.2.1.3.1) but reintroduced in Revision 2.2 SAMA of the Level 2 PRA (per ER Sections F.2.3.1 and F.2.3.2). Clarify the evolution of the treatment of induced-SGTR events. Describe the approach to modeling pressure-induced and thermally-induced SGTRs in the version of the PRA used for the SAMA analyses, including the conditional tube rupture probability and the likelihood of a stuck open SG safety valve.

NSPM Response to RAI SAMA 2.b Induced SGTR events were eliminated in Revision 1.0 of the Level 2 PRA model, and were re-introduced in the Level 2 model update used for the SAMA analysis, as described in the ER report sections referenced in the question. In the IPE analysis, the potential for induced SGTR events was modeled as dominated by the procedurally-directed operator action to delay core uncovery by starting a reactor coolant pump to pump the remaining water in the loop seal into the reactor vessel. This action, if performed on an RCS loop in which the SG is dry and depressurized, was seen as having the potential for inducing creep rupture of the SG tubes. An IPE recommendation to revise the procedure such that this action is only performed if the SG tubes are verified to be adequately covered with water was implemented.

This led to an incorrect assumption that the remaining risk from induced SGTR events was negligible.

The current understanding of these complex accident scenarios across the industry has developed significantly in recent years (NUREG-1 570, NUREG/CR-6595, Rev. 1, etc.). The treatment of induced SGTR in the Rev. 2.2 SAMA models follows the guidance of WCAP-16341 -P, "Simplified Level 2 Modeling Guidelines." WCAP-16341-P is an analysis performed specifically for Westinghouse plants, and was performed with the knowledge of the results of the other two reference documents; therefore, this document was used as the primary reference document for modeling pressure- and temperature-induced SGTR.

Consistent with the WCAP, all core damage accident class sequences in which core damage occurs at high reactor pressure, and the steam generators are dry at the time of core damage (i.e., secondary cooling with Auxiliary Feedwater and Main Feedwater has failed), are assumed to have the potential to lead to pressure-induced SGTR (PI-SGTR). In addition, all "high-dry" sequences in which the RCS is not depressurized prior to vessel failure are assumed to have the potential to lead to temperature-induced SGTR (TI-SGTR).

Depressurization can occur either intentionally, through operator action via the SAMGs, or unintentionally, from a large RCP seal LOCA, or from a primary relief valve becoming stuck open during cycling to relieve RCS pressure during the event.

In addition, in order to progress to induced SGTR, it was assumed that the secondary side must be depressurized, either through failure of a relief valve upstream of the MSIV to close or remain closed (SG PORV or safety valve), or through the initiating event (main steam line break or main feedwater line break initiating events), or the primary side must have experienced overpressure (accident class REP - ATWS core damage events at high pressure). Core damage sequences initiated by these events were treated as having the 15

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 potential to lead to induced SGTR events. Note that the term SG PORV is used at PINGP, while the WCAP and NUREG-1 570 use the term Atmospheric Dump Valve (ADV). The acronym "ADV" will be used hereafter in this discussion to avoid confusion of these valves with the RCS PORVs.

The potential for failure of a main steam safety valve (MSSV) to close is an input to the PI-SGTR conditional probability calculation. SG depressurization will occur when a MSSV fails to reseat during cycling. The analysis assumes that the number of challenges to the MSSVs is dependent on whether SG depressurization was attempted by the operators and whether ADV closure was successful (individual MSSV failure to reseat probability values applied were 4.5E-3 for the initial lift, and 3.93E-4 per cycle during valve cycling). It is assumed that four MSSVs are actuated at event initiation. Following the initial discharge, the challenges will likely occur to only one MSSV per SG at the lowest pressure setpoint. Based on WCAP-16341 -P, the number of steam cycles expected prior to a SG dryout is between 60 and 80 if no action is taken. If an ADV is opened by the operator, the MSSVs will experience significantly less demands, thus the MSSV will have a lower probability to stick open. For each of these cases (operator action and no operator action) the probability per SG for an MSSV to stick open is then calculated by multiplying the number of MSSVs assumed to be challenged times the failure probability of the valve to reseat, and adding to that value the number of assumed relief valve cycles multiplied by the failure rate per demand that the valve sticks open during cycling operation. The probability of any or all SGs at low pressure was determined by using an event tree to identify the algebraic expressions in terms of the likelihood per SG. The probability of a steam generator depressurizing was also assumed to be equal for both steam generators.

The WCAP-1 6341-P methodology uses an event tree approach to determining the potential for PI-SGTR and TI-SGTR. For high pressure core damage sequences, the PI-SGTR probability is defined by: 1) the number of SGs at the plant, 2) the success or failure of operator action to use an ADV to prevent lifting a main steam safety valve, 3) whether or not an ADV has stuck open, and 4) whether or not a main steam safety valve has stuck open.

The TI-SGTR probability is defined by: 1) the number of SGs at the plant, 2) the number of SGs depressurized during accident progression, 3) the condition of the RCP loop seals, and

4) whether a cleared loop seal occurs in an intact or depressurized SG. WCAP-16341-P provides generic (by reactor class) induced SGTR branch probabilities that take into account an analysis of the potential for SG depressurization and considerations specific to the WOG SAMGs that would lead to conditions necessary for pressure- and temperature-induced SGTR. The probability values used in the PRA model are 2-loop PWR values, assuming an "average" tube condition (mid-life operation with thorough SG tube inspection process).

Due to the proprietary nature of WCAP-1 6341 -P, NSPM is unable to provide the SG depressurization and the PI-SGTR and TI-SGTR probability values recommended in the report in this RAI response. During a conference call between NSPM and NRC staff held on August 23, 2008 to clarify the draft RAI questions, the staff suggested that NSPM indicate in its response whether the values were "closer to" the similar values identified in NUREG-1 150 or in NUREG-1570.

NUREG-1 570, Table 2.6 provides the breakdown of the probabilities assumed for having 0, 1, or more SGs depressurized at the time of core uncovery for two NUREG-1 150 plants (Surry and Sequoyah), and also provides the staff assumptions for these probabilities for the 16

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 NUREG-1 570 analysis. The WCAP-1 5341-P values calculated for 2-loop PWRs (based on the methods described above) are closer to the NUREG-1 150 Sequoyah results. This is due to the lower MSSV initial lift and cycling failure-to-close rates applied, and credit for minimizing the required number of MSSV lifts ifthe operator successfully uses the ADVs during the event.

WCAP-1 6341-P provides PI-SGTR and TI-SGTR event tree branch probabilities that are based on review of NUREG-1 570, EPRI analysis, and plant specific analyses for two Combustion Engineering plants. No treatment of PI-SGTR was identified in NUREG-1 150; however, Appendix C, Section 0.6.2 provides results of an expert elicitation on TI-SGTR probability in which two of the three panel experts believed that this probability was less than 5E-4, based on their belief that the RCS hot leg would fail first in these scenarios. In Section 5.1 of NUREG-1 570, the probability of a PI-SGTR is estimated to be 0.0549 and 0.107 for events/APET branches involving depressurization of one and two SGs, respectively, that are assumed to have "moderate" degradation. NUREG-1 570, Table 5.2, provides a TI-SGTR value for the intact SG loop (no SGs depressurized) of 0.0058 (Case 1 R), a value for one depressurized loop of 0.0835 (Case 3R), and a value for all 3 SGs depressurized of 0.0399 (Case 7R). Upon loop seal clearing on an RCP seal LOCA, a value of 0.121 is provided for the intact SG and 1.0 for the depressurized SG (Case 9R).

The WCAP PI-SGTR values are roughly about an order of magnitude lower than the NUREG-1570 values. The WCAP TI-SGTR values are generally mid-way between the NUREG-1 150 and NUREG-1570 values, or are closer to the NUREG-1150 values. In one case (TI-SGTR, intact loop seal, both SGs depressurized), the WCAP value is higher than the NUREG-1 570 value.

RAI SAMA 2.c

c. State the version of the modular accident analysis program (MAAP) code used for the SAMA analysis, and the PRA version in which the MAAP cases were last updated.

NSPM Response to RAI SAMA 2.c The version of the MAAP code used for the SAMA analysis was MAAP 3.0B. The MAAP cases were those originally performed for the IPE analysis.

17

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 RAI SAMA 3.a Provide the following information regarding the treatment of external events in the SAMA analysis:

a. Provide a summary of the dominant fire scenarios for the individual plant examination of external events (IPEEE) fire model in terms of overall fire frequency, plant initiator, and structures, systems, and components (SSCs) impacted. Demonstrate for each fire scenario that no viable SAMA candidates exist to reduce fire risk.

NSPM Response to RAI SAMA 3.a A complete discussion of dominant fire scenarios for the IPEEE Fire risk analysis, including the requested information on frequency, initiator and SSCs impacted, is provided in the IPEEE Rev. 1, Section B.1.4, and supporting table B.2.1 1.1.

For the ER SAMA analysis, fire area-specific SAMA candidates were not developed. The Fire IPEEE was performed using a Fire PRA built on the Unit 1 Level 1 Revision 1 (1Li R1) PRA model. As described in Section F.2.1.2.1, the 1Li R1 model was completed in 1996 and was the first major revision of the PRA model since the IPE. This was a Unit 1-only, Level 1-only model, and did not include an estimate of the LERF metric for Unit 1. In the twelve years since the 1 Li R1 model was implemented, numerous plant modifications, procedure changes and risk analysis methodology changes have been incorporated, and model enhancements have been made in response to industry peer certification comments. As a result, significant changes to the calculated CDF and distribution of dominant accident sequences and contributors are evident when comparing the results of the 1Li R1 and Unit 1 Rev. 2.2 SAMA models. Section F.2 of the ER shows the changes that have been reflected in the Level 1 and Level 2 PRA models since the 1 Li R1 model was implemented. Also, methodologies associated with Fire PRA have been improved over the ten years since the Fire IPEEE was developed. The Fire PRA methodologies used in the Fire IPEEE analysis differ from current industry methodology (NUREG/CR-6850, etc.). Also, as discussed in the response to RAI SAMA 3.b, the Fire IPEEE results include significant conservative assumptions, even in the sequences that were found to dominate the risk profile. The fire CDF of 4.9E-5/yr reported in the Fire IPEEE is considered to be a conservative upper bound for that (1998-vintage) risk model. Due to these considerations, it was concluded that an evaluation of fire area-specific SAMA candidates using the IPEEE would not provide valid results.

From the Fire IPEEE, Section B.1.4, the CDF from internal fires is spread across five accident classes:

1. [66%] Accident class TEH is comprised of transient (i.e., fire) initiated events with loss of secondary heat removal (loss of MFW and AFW) and failure of bleed and feed.

Reactor pressure is high at the time of core damage. Core damage occurs within approximately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of the loss of heat removal.

2. [1 9%]The SEH accident class for the IPEEE consists of RCP seal LOCA initiated events, or events that progress similar to small LOCAs due to fire-induced spurious equipment actuation, in which high head safety injection is not capable of preventing core damage. Reactor pressure is high at the time of core damage, which occurs relatively early (see TEH).

18

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008

3. [11 %]The BEH accident class involves fires that cause the loss of offsite power, and onsite power is not successfully restored prior to core damage. Only one initiating fire was determined to lead to loss of offsite power, a large fire in the control room "G" control panel. A fire large enough in this panel could affect both trains of offsite power, and the recovery of both offsite and onsite power from the control room. In this event, credit is given for operator response to locally restore onsite AC power from the emergency diesel generators according to established plant procedures.

4. [2%]Accident class SLH is similar to the SEH class, except that high head safety injection is successful. Long term recirculation cooling of the RCS then fails, leading to late core damage at high pressure.

5. [2%]Accident class TLH is characterized by transient initiated events with loss of secondary heat removal, successful bleed and feed but failure of recirculation. Reactor pressure is high at the time of core damage, which occurs on the order of 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> after the loss of secondary cooling.

Each of these accident classes correspond to accident classes used in the internal events PRA models. Except for the fire suppression response, most of the equipment and operator actions necessary to mitigate most fire-induced transients and LOCAs are the same as those that are necessary to mitigate transients and LOCAs caused or induced by internal initiating events. Therefore, all SAMAs identified in the ER with risk benefits that are not limited only to containment bypass events, LOCA events larger than a small LOCA, and reduction of the frequency of internal initiating events, will also act to reduce the core damage risk associated with internal fires (to various degrees, depending on the SAMA). Of the SAMAs described in the ER, the only SAMAs that do not also act to reduce internal fires risk are:

• The SAMAs that only limit the impact of internal flooding events (SAMAs 6, 6a and 13);

and

• The SAMAs that only improve the risk associated with ISLOCA events (SAMAs 19 and 20).

All of the other SAMAs identified in the ER would also function to reduce the risk of events initiated by internal fires.

The above considerations notwithstanding, a number of additional SAMAs that attempt to specifically address the risk from internal fires were developed in response to this RAI question. Many of these SAMAs are general in nature, as a focus on individual fires or fire areas may not be appropriate given the number of changes to the plant, procedures and risk analysis models that have occurred since the IPEEE was issued. The following table describes these alternatives and their disposition for PINGP:

Phase 1

SAMA Result of Potential Screening ID# SAMA Title Enhancement Basis Disposition 1 Enhance SAMA would Already Procedures to control the use, location and control of minimize risk implemented amount of combustible material and ignition transient associated with sources are in place at PINGP. Deficiencies combustibles important fire are captured in the Corrective Action and ignition areas by Program.

sources decreasing the 19

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 Phase 1

SAMA Result of Potential Screening ID# SAMA Title Enhancement Basis Disposition frequency of fires and their consequences.

2 Enhance fire SAMA would Already Credit for manual fire suppression was given brigade minimize risk implemented only for fires in the Control Room and Relay awareness associated with Room in the Fire IPEEE. A procedure important fire provides specific instructions on the areas by organization of fire brigades, training and decreasing the qualification of individual fire brigade duration and members, individual responsibilities in regard consequences of to fires, and procedures for extinguishing fires. fires. Operations emergency responses for fires located in specific locations is covered in subsections of this procedure and in the site Emergency Plan Individual Fire Brigade members are required to actively participate in at least two (2) drills per year. PRA insights, including dominant fire sequences from the Fire IPEEE analysis, are included in the operations initial and requalification training programs 3 Upgrade fire SAMA would Already PINGP fire compartment barriers are compartment minimize risk implemented monitored and maintained operable to barriers associated with reduce fire propagation. Operability important fire requirements and surveillance frequencies areas. are identified in plant procedures. Barriers found to be inoperable are required to have a fire watch or patrol established (assuming operable fire detectors) on one side of the affected barrier within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Other compensatory measures may be established in lieu of these requirements if they are determined to be more effective (the use of such measures is controlled according to procedure and requires an evaluation that includes risk insights).

4 Enhance SAMA would Already PINGP safe shutdown procedures are procedures to reduce the risk implemented available for use to accomplish safe allow specific associated with shutdown in response to fires. The purpose operator important fire of these procedures is to outline those actions areas by reducing actions necessary to safely shut down the the consequences plant in the event that the Control Room of fires. must be evacuated, or there is a fire in the Relay Room or other plant area affecting the operation of equipment needed for safe shutdown. Operations emergency response for fires located in specific locations is covered in subsections of these procedures and in the site Emergency Plan.

5 Enhance This SAMA would Already PINGP procedures outline those actions procedures allow alternate implemented necessary to safely shut down the plant in associated system control in the event that the Control Room becomes with plant the event that the uninhabitable due to a fire.

shutdown from Control Room I 20

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 Phase 1

SAMA Result of Potential Screening ID# SAMA Title Enhancement Basis Disposition the Hot becomes Shutdown uninhabitable.

IPanel 6 Isolate This SAMA would Already See discussion of item #1 above. In combustible reduce risk by implemented addition, the IPEEE analysis included a sources for limiting the volume review of seismic/fire interactions. As part of seismic or of flammable or the seismic assessment walkdown, it was other events combustible verified that hydrogen or other flammable materials that may gas or liquid storage vessels in areas with emanate from safety related equipment are not subject to piping systems leakage under seismic conditions. The damaged during potential failure of vessels containing seismic events, flammable or combustible liquids or gases could cause a fire hazard in the plant following an earthquake. As a part of the seismic walkdowns, a survey of tanks and vessels that may contain flammable fluids was performed. The IPEEE review concluded that these issues are not significant contributors to fire-induced core I damage at Prairie Island.

7 Restrain or This SAMA would Already See discussion of Item #6 above.

locate reduce risk by implemented cabinets reducing the containing potential for flammable cabinets materials to overturning and reduce the spilling flammable likelihood of liquid contents.

overturning caused by seismic or other events 8 Ensure that This SAMA would Already PINGP has controls governing the fire-safe the quantity of reduce risk by implemented use and storage of combustible materials combustible reducing the within the process buildings. The Fire materials in potential for a Hazard Analysis documents the analyzed critical process prolonged fire to combustible loading in each fire area. Plant areas is develop in safety- procedures require a Combustible Control monitored related areas. Permit (CCP) for any work involving a fire hazard, and prior to temporary or permanent storage of combustible material the additional combustible loading must be I analyzed through the CCP process.

9 Limit switches This SAMA would Already PINGP has reconfigured the control circuits and torque address the implemented of a number of Appendix R motor-operated switches reconfiguration of valves to address hot short concerns of NRC would not be the MOVs control Information Notice IN 92-18.

bypassed circuits and during a fire protect the motor induced hot operator via the short for limit and torque Control Room switches due to and Relay the fire induced 21

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 Phase 1

SAMA Result of Potential Screening ID# SAMA Title Enhancement Basis Disposition Room fire hot short.

events 11 Relocate This SAMA would High This modification with potential as a fire-instrument air reduce risk by implementation related risk mitigation measure is currently in compressors reducing the cost progress. This is a very complex and out of the potential for fire expensive plant modification that may not be AFW pump ignition and cost-justifiable based on risk-reduction alone.

rooms development of The site MMACR from ER Section F.4.6 was large fires in AFW just over $4 million; the current cost estimate pump rooms. for this modification is >$4 million.

Potential risk Instrument Air is not lost in most of the top benefits to both internal events CDF and LERF sequence units. cutsets. Fire IPEEE showed fires in AFW/IA compressor room to contribute only 16.7% of fire CDF.

12 Re-route This SAMA would High Re-route of individual cables can provide cables that reduce risk by implementation highly targeted risk reduction for certain fire currently exist reducing the cost scenarios. However, the risk reduction is in risk- consequences of unlikely to offset the high cost of these significant fire a fire in risk- modifications.

areas significant fire I __ Iareas.

Refer to Section F.5.1.6 of the ER for a discussion of how the recommendations developed from the IPEEE insights were dispositioned.

RAI SAMA 3.b

b. ER Section F.5.1.8 indicates that the maximum averted cost-risk (MACR) for internal events was doubled to account for external events contributions. However, ER Section F.5.1.7.2 indicates that the IPEEE fire CDF is about 5E-5 per year, which is approximately five times the internal event CDF. (This value is stated as being conservative in part due to not crediting automatic and manual fire suppression.)

Furthermore, in a July 21, 2006, request for additional information (RAI) response related to an extension of the containment integrated leakage rate test (ML062060033), Nuclear Management Company, LLC estimated the seismic CDF for Prairie Island Nuclear Generating Plant (PINGP) to be 7.82E-6 per year. Provide additional justification for use of a multiplier of 2 given that the fire CDF is approximately five times the current internal events CDF, that credit for automatic and manual fire suppression has been included for many of the dominant fire sequences, and that seismic and other external events also contribute to the total CDF.

22

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 NSPM Response to RAI SAMA 3.b Internal Fires From the results of the PINGP IPEEE, it can be reasonably concluded that the majority of the external events risk at PINGP is due to internal fires. Both the IPE CDF (5.OE-5/rx-yr) and the fire CDF from the IPEEE (4.9E-5/rx-yr) are comparable and of the same magnitude. These two analyses were performed within four years of each other in the mid-1 990s, and were based on conservative modeling methodologies consistent with state-of-the-knowledge at the time. In addition, the purpose of the Fire IPEEE analysis was to meet Generic Letter 88-20 requirements (identify vulnerabilities to severe accidents initiated by internal fires), and was not to determine the internal fires CDF to a high degree of accuracy. The analysis contained numerous conservative assumptions for which (in alignment with the original purpose of the analysis and available analysis resources) further refinement was unnecessary. The fire IPEEE CDF can be considered to be an estimate of the upper bound risk of internal fires that existed at that time, based on then-available methodologies.

Therefore, it is not appropriate to compare a conservative CDF estimate for fire hazards based on the IPEEE to the present-day internal events CDF, which is based on more refined modeling techniques and analyses. In fact, the IPEEE CDF due to fires would be expected to decline along with the CDF due to internal events, since the plant response to fire damage is not unlike the plant response to plant transients due to equipment failures and other internal events. Since the Fire IPEEE analysis was completed, the conditional core damage probability (CCDP) associated with normal (or general) plant transient-initiated events on Unit 1 (as calculated for the updated internal events PRA model) has fallen by 46%. This fact, independent of fire PRA methodology improvements now available, supports NSPM's belief that the current, actual Fire CDF is significantly lower than the value calculated for the IPEEE.

As stated above, there were a number of significant, conservative assumptions included in the Fire IPEEE that could be refined using currently available methodologies to determine a more realistic estimate of the current fire CDF.

All fires (any size) were conservatively assumed to result in shutdown of both units.

One impact of this conservatism relates to the ability to credit cross-tie of the motor-driven AFW pump (MDAFWP) from the opposite unit to the steam generators (SGs) of the unit experiencing the fire. A limitation on this crosstie was included in the fault tree for AFW such that if a dual unit initiating event occurred and the opposite unit turbine-driven AFW pump (TDAFWP) failed, the opposite unit MDAFWP could not be cross-tied to the fire-affected unit as it would be required to support the SGs on its own unit.

As all fires were conservatively assumed to result in shutdown of both units, credit for this crosstie is limited if random or fire-associated failures impacting the opposite unit TDAFWP were assumed to occur.

" Credit given in IPEEE for automatic and manual suppression was limited. A large portion of IPEEE fire CDF could be significantly reduced through additional application of credit for automatic or manual suppression. In the IPEEE, credit was only applied to cutsets representing <13% of the internal fires CDF.

23

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 o No credit was given for the ability of fire brigade to extinguish local fires before shutdown of the plant would be required.

o Credit only applied to Control Room, Relay Room, and certain AFW pump room fires. Only automatic fire suppression was credited in the AFW pump rooms.

o No detailed analysis of Human Error Probabilities (HEPs) for failure of manual fire suppression was performed for fires in any fire area.

No credit was given to the availability of the RCS PORV passive air accumulators located inside containment to provide support for bleed and feed (B&F) cooling of the RCS. For any fire that is assumed to impact the instrument air (IA)system, B&F is assumed to fail. This is an important consideration in a number of dominant IPEEE fire areas (FA) in which main feedwater or AFW is also impacted. For example, the response to the fires occurring in FA 13 (Control Room panel zones 5 & 6) and FA 32 (AFW pump room) described below are significantly impacted by this conservative treatment. Credit is now given in the internal events PRA analysis for the availability of this equipment (see response to RAI question 6.d).

Detailed fire modeling was not performed in a number of fire areas that did not screen out of the analysis, including the Bus 16 and Bus 111 switchgear rooms and three large fire areas covering the entire floor elevation for a given unit in the Auxiliary and Turbine buildings.

The Fire IPEEE results showed that fires originating in two Unit 1 plant fire areas contributed approximately 82% of the total internal fires CDF. No other individual fire areas contributed more than 4.5% of the CDF. Conservative assumptions in the IPEEE analysis specific to these areas include:

• Control Room (CRM) - FA 13 (65.3%, 3.22E-5Lyr):

o Except for fires in the G-panel, small control room panel fires (those that are not large enough to propagate outside the control board zone in which they initiate) are assumed to cause the loss of all equipment within that panel zone. No credit for cable separation to allow partitioning of these cabinet fires further was given.

o CRM Panel Zones 5, 6 fires (LOFW/AFW) (-40% of total fire IPEEE CDF, almost 2E-5/yr)

" Almost all sequences include failure of B&F or recirculation

" ANY size fire results in loss of entire cabinet (in this case, loss of all main FW and AFW).

" Local recovery of AFW was not credited, nor was any other means of feeding the SGs (see responses to RAI questions 8.a, 8.b, and 8.c).

" ANY size Panel Zone 6 fire was assumed to result in spurious actuation (open) of the SG PORVs, resulting in an MSLB-like plant response (including Instrument Air (IA)to containment valve auto-closure). This requires the operator to re-open IAto containment isolation valves in order to prevent B&F failure (see conservative IApassive accumulator treatment described above).

24

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 o CRM Panel fires (LOOP/SBO) (-11% of total fire IPEEE CDF, >5E-6/yr)

• ANY size fire results in loss of at least one train of offsite and onsite AC power to safeguards equipment.

o CRM Panel Zones 7, 8 and Panel 1PLP (LOCA) (-4% of total fire IPEEE CDF,

>2E-6/yr)

• ANY size fire results in spurious opening of RCS PORVs and block valve failure to operate.

AFW Pump Room - FA 32 (16.7%, 8.23E-6/yr) o Although fire water suppression was credited for certain fires in this fire area, only about 12% of FA 32 CDF involved unsuccessful suppression (1.01 E-6/yr, 2.05% of overall fire CDF).

o Fire water suppression credit was applied using a simple point value (2E-2) taken from EPRI FIVE analysis; PINGP did not have a plant-specific fault tree model for this system (would be expected to provide a lower, more realistic unavailability value).

It is recognized that a re-analysis of internal fires risk, if performed today (based on the current state of knowledge regarding fire risk and methodologies now available), may show that some of the assumptions and methodologies used in the Fire IPEEE were potentially non-conservative. However, it is believed likely that these considerations would not outweigh the scope and magnitude of the conservatisms included in the IPEEE (the most significant of which are described above). Therefore, NSPM believes that it is reasonable to assume that the CDF due to fire would still be comparable to the internal events CDF.

Seismic Events:

In addressing the seismic portion of the IPEEE, a reduced-scope seismic margins assessment was performed in accordance with EPRI NP-6041 -SL, "Assessment of Nuclear Power Plant Seismic Margin (Revision 1)." Section F.5.1.7.1 of the Environmental Report stated that there were no identified significant plant vulnerabilities to severe accidents attributable to seismic events at Prairie Island.

Although PINGP does not have a completed seismic PRA, a bounding estimate of seismic risk was developed in support of another NRC submittal. Using a methodology known as the "Simplified Hybrid Method" to quantify the results of a seismic margins analysis (SMA) methodology, a core damage frequency estimate of 7.82E-6/yr was obtained. The purpose of that calculation was only to provide a conservative upper bound estimate of seismic CDF to support that particular submittal, not to obtain a realistic measure of seismic risk at PINGP.

The Simplified Hybrid Method uses only two plant-specific details, the High Confidence Low Probability of Failure (HCLPF) of the seismic Safe Shutdown Equipment List (SSEL) component determined to be the most limiting in the SMA, and the seismic hazard curve for PINGP. Mathematical formulae developed from comparisons of other-plant SMAs and 25

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 industry seismic PRAs were then used to determine the seismic CDF estimate for PINGP. It is very difficult to conclude much about the true seismic CDF value or distribution of seismic risk based on the results of this simplified method.

However, as calculated, the seismic CDF estimate is below the internal events CDF level currently calculated for either unit. Also, as described in the ER Section F.5.1.6 and in the response to RAI 3.c, plant improvements that lower the risk due to seismic events were made as a result of both the IPEEE and SQUG efforts. Therefore, it is believed that the true seismic CDF is even lower than that calculated by the Simplified Hybrid Method.

Other External Events:

In addition to internal fires and seismic events, the PINGP IPEEE included an assessment of a variety of other external hazards:

• High Winds

• Tornadoes

• External Flooding

• Transportation and Nearby Industrial Facility Accidents

• Other External Hazards The PINGP IPEEE analysis of these hazards was accomplished by reviewing the plant environs against regulatory requirements regarding these hazards. Based upon this review, it was concluded that PINGP meets the applicable Standard Review Plan requirements and therefore has an acceptably low risk with respect to these hazards. As such, these hazards were determined in the PINGP IPEEE to be negligible contributors to overall plant risk.

Based on the above considerations for internal fires, seismic events, and other external events, the (x2) multiplier was chosen in calculating the value for the Modified Maximum Averted Cost Risk (MMACR). No higher multiplier is believed to be warranted given the current state of knowledge regarding external events at PINGP.

RAI SAMA 3.c

c. As stated in the IPEEE seismic analysis, several potential seismic outliers were dispositioned through an analysis process which determined that the impacted function was not required or could be recovered, or that an alternate means for performing the associated function was available. For those outliers identified in IPEEE Section A.2.4.1.2, where recovery or an alternate means is credited, demonstrate that enhancing the ruggedness of the associated components is not cost-beneficial. The outliers include:

turbine-driven AFW pump trip and throttle valves (recovered), diesel generator fuel oil storage tanks 122 and 124 (alternative tanks available), the boric acid transfer pumps (alternate supply available), charging pumps 12 and 23 (alternative charging pumps available), panel 117 (alternate power normally available), cooling water pump 121 (alternate pumps available), condensate storage tanks 11, 12 and 13 (recovered through the use of alternate sources (e.g., cooling water)), component cooling water pressure switches (alternate start signal available), and diesel-driven cooling water pump pressure switches (alternative start signal available). For those outliers stated as being resolved 26

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 through the closure of USI A-46 (IPEEE Section A.2.4.1.1), confirm that all corrective actions have been completed, and that their use is supported by procedures and training, as appropriate.

NSPM Response to RAI SAMA 3.c The outliers identified in IPEEE Section A.2.4.1.2, and the discussion of whether increasing their seismic ruggedness would be cost beneficial, are provided in the following table:

IPEEE Seismic Outlier IPEEE (Section Disposition A.2.4.1.2) Basis Comments From the PINGP seismic hazard curve presented in NUREG-1488 Appendix A, the expected frequency of exceedance of the PINGP SSE (0.1 2g) is approximately 1 E-4/yr. The TDAFWP is seismic category 1 equipment and would be expected to remain available following an SSE event; however, assuming TDAFWP overspeed device is tripped, and 1 E-2 probability of random failure of the MDAFWP on the affected unit, the frequency of seismic events requiring recovery of the TDAFWP is at most 1 E-6/yr. Identification and recovery of the TDAFWPs is likely in this event (see below). In addition, the cross-tie from the opposite unit MDAFWP may be available, as would RCS bleed and feed capability. Any releases (due to core damage sequences Turbine Driven developing from additional unrelated equipment failures) would Auxiliary not be expected to bypass containment. Therefore the potential Feedwater risk reduction for enhancing the ruggedness of this equipment is Pump Recovered not expected to justify the cost.

(TDAFWP) trip and throttle Identification and recovery of a TDAFWP overspeed trip valves activation following a seismic event is likely due to the numerous cues and procedural guidance available to the operators responding to the event:

a) The procedure for visual inspection of equipment and structures after earthquake directs the operator to check local alarms, breakers and protective devices for actuation/trips for horizontal pumps.

b) On any reactor trip, procedures direct verification of AFW flow.

c) TDAFWP overspeed trip operation is annunciated in the Control Room. For example, for Unit 1, the alarm response procedure directs the operator to determine the cause of the trip, and refers the operator to the procedure for resetting the overspeed trip.

The DG FOSTs are safety-related equipment and the D5 and D6 Diesel FOSTs were found to be seismically rugged in the IPEEE as Generator Alternative were the Unit 1 and Unit 2 fuel oil transfer pumps and day tanks.

(DG) Fuel Oil tanks The 121 and 123 FOSTs were determined by the SQUG Storage Tanks available program to be acceptable to SSE levels. Therefore, this (FOSTs) 122 equipment would be expected to remain available following an and 124 SSE event.

27

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 IPEEE Seismic Outlier IPEEE (Section Disposition A.2.4.1.2) Basis Comments However, assuming the supply from the 122 and 124 tanks had failed due to failure of buried piping (the IPEEE concern), the affected DGs would still operate without operator action for 1 - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> (IPEEE Section A.2.4.1.2). Four safety related storage tanks are provided for supplying fuel oil to the two diesel generator sets D1 and D2. Each tank is equipped with a transfer pump to pump fuel from the tank to the day tank of either DG set.

The valve pit contains necessary valving and piping arrangements for transferring fuel oil from any one storage tank to any other tank. Procedures direct the performance of this transfer. Based on the discussion below, the likelihood of successful recovery of the fuel supply through operator action following the event is high. Assuming a 1E-1 probability of failure to restore the fuel oil supply to an affected EDG, and a 1E-1 probability of random failure of the unaffected EDG, the frequency of seismic events requiring recovery of the fuel oil supply to an EDG is at most 1E-6/yr. In addition, the cross-tie from the opposite unit AC buses and EDGs (performed from the Control Room) would be available. Even if the cross-tie failed, only one train of AC power is necessary for successful prevention of core damage. Any releases (due to core damage sequences developing from additional unrelated equipment failures) would not be expected to bypass containment.

Therefore the potential risk reduction for enhancing the ruggedness of this equipment is not expected to justify the cost.

Identification and recovery of an affected DG fuel oil supply following a seismic event is likely due to the cues and procedural guidance available to the operators responding to the event:

a) The procedure for visual inspection of equipment and structures after earthquake directs the operator to check for damage, leaking or flooding from low pressure storage tanks and connected piping, and buried piping.

b) Procedures direct the transfer of fuel oil from any Unit 1 DG 4 +

FOST or the heatina boiler FOST.

At the time of the IPEEE, the ECCS design was such that the initial suction supply for the high head SI pumps was from the Boric Acid Storage Tanks (BASTs). The normal suction supply is now provided by the RWST. The BA transfer pumps' only function credited in the PRA is to supply BA from the BASTs for boration of the RCS following an ATWS event. This is one of a Boric Acid Alternate number of potential means of providing long term shutdown of (BA) transfer supply the reactor; its failure probability is dominated by failure of the pumps available operator to perform the actions. The overall long term shutdown function contributed to sequences containing less than 1% of the total internal events CDF for either unit, and less than 1/2 of 1%

of the total internal events LERF for either unit (i.e., this function did not survive the SAMA Phase 1 screening process described in the ER Sections F.5.1.1 and F.5.1.2). Therefore, the potential 28

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 IPEEE Seismic Outlier IPEEE (Section Disposition A.2.4.1.2) Basis Comments risk reduction for enhancing the ruggedness of this equipment is not expected to justify the cost.

The availability of individual charging pumps is not a risk risk Alternative significant contributor to the internal events CDF or LERF basic Charging charging metrics for either unit. No individual charging pump failure Pumps 13 and chrgn events survived the SAMA Phase 1 screening process described 23 apumps in the ER (Sections F.5.1.1 and F.5.1.2). Therefore, the potential risk reduction for enhancing the ruggedness of this equipment is not expected to justify the cost.

As stated in the IPEEE report, Section A.2.4.1.2, Panel 117 provides only a backup 120V AC supply function to other Alternate normally-energized AC panels. Therefore, the availability of Altern Panel 117 is not a risk significant contributor to the internal Panel 117 power events CDF or LERF risk metrics for either unit. No Panel 117 normally failure basic events survived the SAMA Phase 1 screening available process described in the ER Sections F.5.1.1 and F.5.1.2.

Therefore, the potential risk reduction for enhancing the ruggedness of this equipment is not expected to justify the cost.

Since the IPEEE was issued, the anchorage and shaft columns 121 Cooling Alternate of the Diesel Cooling Water Pumps and the 121 Cooling Water Water (CL) pumps Pump have been determined to have HCLPF capacities greater pump available than 0.3g (the IPEEE RLE). Therefore, the potential risk reduction for enhancing the ruggedness of this equipment is not expected to justify the cost.

The CSTs are not qualified to the IPEEE RLE of 0.3g, but may survive the SSE. Calculations qualify the 21 and 22 CSTs to the SSE using SQUG methodology. Assuming the CSTs fail on the seismic event, and no operator action occurs to stop the AFW pumps, the pumps will trip automatically on low suction pressure.

From the PINGP seismic hazard curve presented in NUREG-1488 Appendix A, the expected frequency of exceedance of the PINGP SSE (0.12g) is approximately 1E-4lyr. The Cooling Water suction supply lines and MOVs to the AFW pumps (MV-32025, MV-32026, MV-32027, and MV-32030) on both units are through the seismic category 1 equipment and would be expected to remain StorageTnksa ale of available following an SSE event, and were found to be Storage Tanks alternate seismically rugged to RLE in the IPEEE. These valves are (CSTs) 11, 21 sources operated from switches located in the control room. Successful operation of only one valve, supplying one AFW pump with Cooling suction from the CL system, and restart of the pump is required Water) for successful delivery of AFW to at least one SG. Assuming a 1E-2 probability of operator failure to align at least one AFW pump to its suction supply and restart the pump from the control room, and random failure of the pump of 1 E-2, the frequency of seismic events involving an initial loss of heat sink is at most 2E-6/yr (1E-4*(1 E-2 + 1E-2) = 2E-6/yr). Identification and recovery of failed pumps is likely in this event due to operator local investigation for equipment damage prompted by procedure (see TDAFWP discussion above). In addition, the cross-tie from the 29

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 IPEEE Seismic Outlier IPEEE (Section Disposition A.2.4.1.2) Basis Comments opposite unit MDAFWP may be available, and RCS bleed and feed capability would remain available. Therefore the frequency of a complete loss of decay heat removal leading to core damage on this event would be less than 1E-7/yr. Any releases (due to core damage sequences developing from additional unrelated equipment failures) would not be expected to bypass containment. Therefore the potential risk reduction for enhancing the ruggedness of this equipment is not expected to justify the cost.

The CC pump pressure switches are not seismically qualified.

Therefore, an automatic start of the standby CC pump (should the running pump fail) may not occur. Ifthe seismic event results in a small LOCA, an SI-signal would be generated that would produce an automatic start signal for the pumps.

However, assuming this condition does not exist, in this event the operators would be made aware of the status of the CC system pumps early in the event as the earthquake response procedure directs the operators to verify that at least one CC pump is running. Assuming the running CC pump stops on a seismically-induced loss of offsite power, it will restart following the safeguard 4kV bus load restoration permissive signal.

However, a low pressure signal will be required to restart the pump, which may not be received if the pressure switch has failed. Ifthe pump fails to restart, a low flow/pressure condition will occur in the system requiring operator response. From the PINGP seismic hazard curve presented in NUREG-1 488 Appendix A, the expected frequency of exceedance the PINGP Component Alternate SSE (0.1 2g) is approximately 1E-4/yr. Assuming a probability of Cooling (CC) start signal 1E-2 for the running CC pump failure to start, and that the pressure available standby pump pressure switch fails on the seismic event, switches operator response will be required to restart one pump. A Human Error Probability (HEP) of 1E-2 for operator action to start one CC pump from the control room to restore system pressure is assumed. This results in an expected frequency of loss of all CC pumps of roughly 1E-4*(1 E-2 + 1E-2) = 2E-6/yr.

However, the charging system will remain available providing cooling to the RCP seals, and preventing loss of RCS inventory.

If Cooling Water (CL) is lost to the Unit 1 EDGs, then cross-tie of the Unit 2 4kV power supplies to Unit 1 may be required to prevent RCP seal degradation (this is not an issue for Unit 2 as the Unit 2 EDGs are air-cooled). Assuming another 1E-2 for operator failure to cross-tie the power supplies yields an upper-bound frequency of 2E-8/yr (2E-6*(1 E-2) = 2E-8/yr) for core damage due to this event. Any releases (due to core damage sequences developing from additional unrelated equipment failures) would not be expected to bypass containment.

Therefore the potential risk reduction for enhancing the ruaaedness of this eauioment is not exDected to iustifv the cost.

30

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 IPEEE Seismic Outlier IPEEE (Section Disposition A.2.4.1.2) Basis Comments The DDCL pump pressure switches are not seismically qualified, but would likely chatter during such an event. Any chattering would likely result in actuation of the diesel-driven pump, a safe condition. Also, if the seismic event results in a small LOCA, an SI-signal would be generated that would produce an automatic start signal for the pumps. However, assuming these conditions do not exist, in this event the operators would be made aware of the condition of the CL system early in the event as managing the CL system flow is a major focus of the procedural response to an earthquake. Assuming the running horizontal motor-driven pumps stop on a seismically-induced loss of offsite power, a low flow/pressure condition will occur in the system requiring operator response. From the PINGP seismic hazard curve presented in NUREG-1488 Appendix A, the expected frequency of exceedance of the PINGP SSE (0.1 2g) is approximately 1E-4/yr. Assuming that the pressure switches fail on the seismic event, an HEP of 1 E-2 for operator action to start 2/3 CL pumps from the control room to restore system pressure is assumed.

Combining this with random pump failure probabilities of 1 E-2 each results in an expected frequency of loss of all CL pumps of roughly 1E-4*[(1 E-2) + 3*(1 E-2)2] = 1E-6/yr. In this event, equipment and procedural guidance are available to Diesel Driven Cooling Water Alternative prevent the loss of CL condition from deteriorating into an pumps on (DDCL) pump start signal RCP seal LOCA condition. At least two charging pressure available each unit would remain available to supply RCP seal switches injection and seal cooling (only one is required to meet the seal cooling function; however, an operator would have to restart the pump from the control room following the assumed loss of offsite power and load rejection/restoration sequence). Assuming the CL pumps are not eventually restarted, failure of the operator to restore a charging pump could result in an unrecoverable RCP seal LOCA due to the unavailability of CL to support high head injection and recirculation. Note that an SI-signal would be expected to occur on any significant RCP seal LOCA, and would provide the automatic restart of the CL pumps necessary to recover from the event.

Assuming no recovery of CL pumps in the short term, and successful operator response to restart charging pumps for RCP seal injection flow, the eventual concern will be loss of heat sink in the SGs (due to loss of CSTs on the seismic event and loss of the backup supply from CL). This condition will drive the operators to a procedure for responding to a loss of secondary heat sink. After all attempts to restore a means of orovidina secondary heat 31

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 IPEEE Seismic Outlier IPEEE (Section Disposition A.2.4.1.2) Basis Comments removal have failed, the operators are directed to attempt decay heat removal using RCS bleed and feed. However, the first step in this process is to manually actuate SI. This action will start the CL pumps necessary to support bleed and feed cooling and high head recirculation. Applying a 1 E-2 probability to this sequence for failure of the operators to perform bleed and feed cooling per the emergency procedures results in an overall core damage frequency of (1E-6)*(1 E-2) = 1 E-8/yr. Any releases (due to core damage sequences developing from additional unrelated equipment failures) would not be expected to bypass containment (note that induced SGTR sequences developing from this event would have a total frequency of less than 1 E-9/yr). Therefore the potential risk reduction for enhancing the ruggedness of this equipment is not expected to justify the cost.

Components listed in Section A.2.4.1.1 of the PINGP IPEEE provide a summary of the SQUG outliers that pertain to the IPEEE scope. In a letter from NRC to Northern States Power dated August 5, 1998, Resolution of Unresolved Safety Issue (USI) A-46 for Prairie Island Nuclear Generating Plant, Units 1 and 2 (TAC NOS. M69474 and M69475), the NRC issued a Safety Evaluation stating that the NRC had received notification that all outliers had been resolved, except for four (4) equipment outliers. The four (4) remaining equipment outliers were committed to be resolved by Prairie Island during the Unit 2 outage in December 1998 and the Unit 1 outage in May 1999. Of those remaining equipment outliers, three (3) were related to components listed in section A.2.4.1.1 of the Prairie Island IPEEE. The equipment included control valves CV-39409, CV-39401, and Motor Control Center MCC-2LA2.

Per Attachment 2 of the letter sent to the NRC from NSP dated November 17, 1997, Response to Request for Additional Information on the Prairie Island Nuclear Generating Plant, Units 1 and 2, Resolution of Unresolved Safety Issue A-46 (TAC Nos. M69474 and M69475), NSP notified the NRC of equipment outliers, resolution descriptions, and resolution timeline, if not already completed. The actions taken to resolve the three outliers are described below and are consistent with statements in the November 17, 1997 letter.

CV-39409 Control valve CV-39409 was identified as an outlier because contact with surrounding conduits could break the solenoid tap connection. The airline to valve CV-39409 was relocated such that the airline is greater than two (2) inches from other electrical conduits in the area. This modification was completed during the 1R20 refueling outage in May of 1999.

CV-39401 Control valve CV-39401 was identified as an outlier because contact with surrounding conduits could break the solenoid tap connection. The airline and associated solenoid valve for CV-39401 were rerouted so that the airline and solenoid valve are a minimum of two (2) 32

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 inches away from existing conduits. Also, the electrical junction box associated with the solenoid valve for CV-39401 was relocated such that the box is greater than two (2) inches from other electrical conduits in the area. These modifications were completed during the 1 R20 refueling outage in May of 1999.

MCC-2LA2 Motor Control Center MCC-2LA2 was identified as an outlier because it was observed that the MCC rocked about its weak axis when bumped, making the welding at the base suspect.

New angle support braces were installed at the base of MCC-2LA2 to increase the structural stability of the MCC. This modification was completed during the 2R19 refueling outage in November 1998.

Per the work completed as described above, all outliers identified in Section A.2.4.1.1 of the Prairie Island IPEEE have been resolved. Aside from work completed, no additional procedure changes or training was required to close identified outliers.

RAI SAMA 3.d

d. Discuss the results of the seismic IPEEE from the standpoint of potential SAMAs for the SSCs with the lowest seismic margins, and provide an assessment of whether any SAMAs to increase the seismic capacity of these limiting components would be cost beneficial (i.e., improvements to the component cool water heat exchanger anchorage).

NSPM Response to RAI SAMA 3.d The seismic IPEEE for PINGP used a seismic margins approach in the identification of vulnerabilities to severe accidents. The focus of the analysis was on determining the survivability of key plant equipment and safety functions, and the assurance of available success paths for safe plant shutdown following the RLE seismic event. Quantitative risk analysis techniques supporting the determination of CDF and LERF risk metrics were not performed. An analysis to quantitatively determine the potential decrease in dose risk to the public from improving the anchorage of the CC heat exchangers is currently not available.

In the initial IPEEE submittal, a 0.1 2g RLE (the SSE for PINGP) was used as the basis for the seismic margins analysis. In response to the IPEEE seismic RAI questions, the equipment on the Safe Shutdown Equipment List developed for the analysis was reviewed to a 0.3g RLE.

The evaluation at the 0.3g RLE concluded that all important safety functions could be accomplished following a seismic event. All of these functions were found to be supported by components with HCLPFs greater than or equal to 0.3g, with the exception of the Component Cooling (CC) heat exchangers. The CC heat exchangers HCLPFs of 0.28g were considered to be very close to the 0.3g threshold, and were thus considered to be adequate. With the exception of the CC heat exchangers (discussed below), based on the IPEEE analysis results and recommendations implemented, it was concluded that there is no benefit to be achieved from evaluation and implementation of additional SAMAs from a seismic risk perspective.

The RLE was assumed to result in the failure of plant systems that are not seismically rugged, such as the equipment supporting delivery of offsite power to the plant, and Instrument and Station Air system equipment. In addition, the analysis assumed the occurrence of a 33

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 concurrent small LOCA due to the seismic event. This assumption is conservative, because all piping that interfaces with the RCS is considered to be seismically rugged. The Component Cooling (CC) heat exchangers play a key role in the recovery from this postulated set of events. However, even if it is assumed that the RLE results in loss of all four of the CC heat exchangers, equipment remains available to support at least the containment function, such that the dose to the public from any offsite releases from these events are small.

Figure 1 of the IPEEE RAI response for seismic issues1 shows the success paths available for prevention of core damage following a seismic event according to the IPEEE Seismic Margin Analysis (SMA) methodology. If it is assumed that the CC heat exchanger function is failed on the seismic event, then the CC system function shown in the diagram is assumed to be failed. Although from the diagram it may appear that the CC function is required for success for both paths shown, this is not the case for the loss of offsite power (LOOP) success path.

In this case, core damage is prevented as AC power (through the onsite emergency diesel generator supply), DC power, Cooling Water (CL), Reactor Protection (RPS) and Control Rods, RCP seal injection through the Chemical and Volume Control System (CVCS) charging pumps, and the Auxiliary Feedwater (AFW) system remain available. The CC function, which is to provide cooling to the RCP seals, is accomplished by the CVCS System.

Ifa Small LOCA is conservatively assumed to occur with the seismic event, then core damage will be assumed to occur, because the remaining functions shown on the diagram all depend on the CC function. Ultimately, this dependency comes from the requirement for a CC supply to the SI pump oil coolers and the RHR heat exchangers. However, even in this case, the capability for RCS depressurization and RWST injection with the RHR pumps remains available, such that the potential for early core damage and vessel failure at high pressure is low. Also, the containment fan coil units remain available for long term containment pressure control. Therefore, the potential for significant offsite releases (early or late) from success paths that require the CC function is low.

As described above, an analysis to quantitatively determine the potential decrease in dose risk to the public from improving the anchorage of the CC heat exchangers is not available.

While the existing anchorage of the CC heat exchangers does not ensure the survivability of these components at the 0.3g RLE, it is very close (0.28g). Assumption of failure of all CC heat exchangers at the RLE is conservative. Also, simplifying and bounding assumptions made in the IPEEE seismic margins analysis, such as the assumption of a concurrent LOOP, loss of instrument air and small LOCA on occurrence of the RLE, are conservative. Each of these assumed events would individually have a conditional probability of occurrence below 1.0; the conditional probability of all of these events occurring would be significantly lower. In addition, as the charging function remains available, the small LOCA of concern in this event would be one involving leakage greater than available charging pump makeup. Given the seismic capability of RCS equipment, piping and piping connected to the RCS, a small LOCA of this size occurring following a seismic event is clearly not a certainty, even at the RLE.

1 Letter from NSP to NRC dated February 28, 2000, "Response to Request for Additional Information Regarding Report NSPLMI-96001, Individual Plant Examination of External Events (IPEEE), Related to Generic Letter 88-20" (ML003691712).

34

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 A plant modification to improve the anchorage of the CC heat exchangers to withstand higher level seismic events would be expensive (estimates for a similar project from another recent License Renewal applicant's Environmental Report indicate the costs could exceed $500 K).

Based on the above considerations, it is concluded that the averted dose benefit achieved from this proposed modification would not exceed its estimated implementation cost.

35

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 RAI SAMA 4 ER Section F.3.5 indicates that the core radionuclide inventory used in the MACCS2 analysis is based on results of a plant-specific calculation assuming a core average exposure of 50,000 MWD/MTU, combined with core inventory information from MACCS2 Sample Problem A adjusted to account for the PINGP power level. Describe the plant specific calculation (which appears to be in addition to the calculation described in the updated safety analysis report (USAR)). Describe the purpose and development of the additional adjustment factor of 1.39 (based on differences between the PINGP USAR calculation and MACCS2 Sample Problem A values). Confirm that the resulting core inventory reflects the PINGP-specific fuel burnup/management as the plant is expected to be operated during the renewal period, including any planned fuel management changes (power uprates, extended burnup fuel, etc.).

NSPM Response to RAI SAMA 4 As discussed in ER Section F.3.5, MACCS2 requires input for 60 nuclides. These 60 nuclides are listed in Table F.3-3. Plant specific core inventory values for 20 significant nuclides (including the Cs and I nuclides) required by MACCS2 were available from data contained in the USAR. For the remaining 40 core inventory nuclides, plant specific estimates were judged to be required.

In some past SAMA evaluations, the MACCS2 Sample Problem A core inventory values were utilized in lieu of plant specific core inventories. For those studies, the MACCS2 Sample Problem A core inventories were adjusted by using a ratio to account for differences between the Sample Problem A core power level and the SAMA plant specific power level. It has become recognized that in addition to differences in core power levels, changes in fuel enrichment and core exposure between current industry practices and those assumed for Sample Problem A should be accounted for via a plant specific core inventory.

Since a Prairie Island plant specific core inventory for 40 of the 60 nuclides was not available, plant specific values for the 40 nuclides were estimated in the following manner:

1. The 60 MACCS2 Sample Problem A core inventory values were adjusted to account for differences between the Sample Problem A power level of 3412 MWth and the Prairie Island power level of 1650 MWth.

2. For each of the 20 nuclide values contained in the USAR, a comparison was made between the USAR value and the adjusted Sample Problem A value. The difference between the USAR nuclide value and the adjusted Sample Problem A value differed for each nuclide.

3. The average change between the USAR values and the adjusted Sample Problem A values was calculated for these 20 nuclide values. On average, the USAR nuclide values were approximately 39 percent higher than the adjusted Sample Problem A values.

4. This factor of 1.39 was then applied to the 40 adjusted Sample Problem A values to estimate the plant specific core inventory of these 40 nuclides.

The increase factor of 1.39 that was applied to the 40 adjusted Sample Problem A values was judged to adequately estimate the impacts associated with fuel enrichment and core exposure between the Sample Problem A core assumptions and those utilized by Prairie Island.

36

Enclosure I Responses to NRC Requests for Additional Information Dated October 23, 2008 Although the change in core average exposure and fuel burnup strategies that make use of newer and more efficient fuel designs will have an impact on the radioisotopic source term, specific operating strategies and power uprates planned for the future are not fully realized at present. To capture this and other inherent uncertainties that are part of the SAMA methodology, the use of the 9 5 th percentile averted cost risk results for each Phase 2 SAMA was used to determine whether a particular SAMA was cost beneficial. The 9 5 th percentile results were meant to provide a "bounding" assessment to determine those SAMAs that may be cost beneficial and worthy of a more detailed analysis via the utility's action tracking process for plant modifications.

37

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 RAI SAMA 5.a Provide the following information with regard to the selection and screening of Phase I SAMA candidates:

a. The top two events in the Level 1 importance listing (ER Table F.5-1a) involve failure of operator actions (Events OSLOCAXXCDY and OHRECIRCC2Y, with failure probabilities 1.9E-02 and 5.3E-02, respectively). Potential improvements to operator training are mentioned in the table, but dismissed on the basis that there is a great deal of uncertainty regarding the operator failure probability estimates. Despite the uncertainties, improvement to operator training would appear to be a potentially cost-beneficial SAMA given the high importance of these operator actions for both CDF and large early release frequency. In this regard provide the following: (1) a description of the current procedural guidance and training scope and frequency, (2) the bases for the human error probability values, including the role that timing, experience/training, and procedures play in determining these values, (3) a characterization of the uncertainty associated with these actions and discussion of why their uncertainty may be greater than other events in the PRA, and (4) an evaluation of the costs and benefits of improving the training and/or procedures for these actions.

NSPM Response to RAI SAMA 5.a A summary of the operator actions is listed below:

OSLOCAXXCDY: Operator Fails To Perform RCS Cooldown and Depressurization on Small LOCA This operator action involves failure of the operator to perform an RCS cooldown and depressurization after a small LOCA event with successful secondary cooling and safety injection actuation. Ifthis action fails, the operator must perform high head recirculation to be successful. This event was applied to all small LOCA-like (small LOCA and pressurizer PORV LOCA) sequences.

OHRECIRCC2Y: Operator Fails To Initiate High Head Recirculation Conditional on Failure of RCS Cooldown and Depressurization This action involves the failure of the operator to initiate high head recirculation following a small LOCA conditional failure of the operator to perform RCS cooldown and depressurization for a small LOCA (operator action OSLOCAXXCDY), or for a RCP seal LOCA event (ORCPLOCACDY, "Operator Fails to Cooldown and Depressurize RCS for an RCP Seal LOCA"). Ifthe operator fails to perform this action, core damage will occur. This operator action is a conditional operator action based on operator action OHRECIRCSMY, "Operator Fails to Initiate High Head Recirculation for a Small LOCA."

Part (1):

The Emergency Operating Procedures (EOPs) will be used by Operations to perform the two operator actions listed above. For OSLOCAXXCDY, the execution procedure covers post-38

Enclosure I Responses to NRC Requests for Additional Information Dated October 23, 2008 LOCA cooldown and depressurization. For OHRECIRCC2Y, the execution procedure covers transfer to recirculation.

For initial license training, simulator scenarios are taught for post-LOCA cooldown and depressurization and transfer to high head recirculation. In addition, a classroom presentation is also given.

Continuing license training includes specific training tasks for both operator actions, including simulator and classroom training. Since both actions are standard EOP actions, they are trained on at least once during the 2 year training cycle in accordance with the 6-year training plan.

Part (2):

Operator action OSLOCAXXCDY (Operator Fails To Perform RCS Cooldown and Depressurization on Small LOCA) involves failure of the operator to perform an RCS cooldown and depressurization after a small LOCA event with successful secondary cooling and safety injection actuation. Ifthis action fails, the operator must perform high head recirculation to be successful.

Operator action OHRECIRCC2Y (Operator Fails To Initiate High Head Recirculation Conditional on Failure of RCS Cooldown and Depressurization) involves the failure of the operator to initiate high head recirculation following a small LOCA conditional on failure of the operator to perform RCS cooldown and depressurization for a small LOCA event (OSLOCAXXCDY). Since these two operator actions appear in the same SLOCA initiating cutset, OHRECIRCC2Y is a conditional operator action based on OHRECIRCSMY. The EPRI HRA Calculator was used to determine the Human Error Probability (HEP) associated with OSLOCAXXCDY and OHRECIRCSMY. The methodology used to determine the cognitive part of the HEP is quantified using Cause Based Decision Tree Methodology (CBDTM).

CBDTM methodology is explained in EPRI TR-1 00259, "An Approach to the Analysis of Operator Actions in Probabilistic Risk Assessment." The execution part of the HEP was quantified using Technique for Human Error Rate Prediction (THERP). THERP methodology is explained in NUREG/CR-1 278, "Handbook of Human Reliability Analysis With Emphasis on Nuclear Power Plant Application."

Part (3):

Many factors influence the final Human Error Probability (HEP) value including cues and indications, timing analysis, dependencies (related human interactions), cognitive analysis, cognitive recovery and execution performance shaping factors. Various methods are also available to determine the HEP value such as the EPRI methods (HCR/ORE, Cause Based Decision Tree Method (CBDTM)) and the NRC methods (THERP/ASEP and SPAR-H).

Since credit is already taken for training in calculating the above HEPs, any further improvement in training for the HEP events listed above will have no benefit on improving the success of the operator actions. There is always a degree of uncertainty associated with HEP estimates, but the improvement in training benefits for this particular case would be within the range of uncertainty for these HEPs. In other words, the resolution of HEP methods is not 39

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 precise enough to capture marginal improvements, such as due to enhanced operator training when operator training is already fully credited.

Part (4M:

Both of these operator actions are standard Emergency Operating Procedure (EOP) actions and are trained on at least once during a 2 year training cycle. The CBDTM is applicable to EOP responses in the control room and the training branches are really only to mitigate unusual circumstances such as inaccurate instrumentation, inaccurate cues, unavailability of information required for diagnosis and complex decision logic. Standard operator actions such as these are not subject to these unusual circumstances and are not sensitive to the training mitigating factors in CBDTM. As a result, any additional training will add cost but little benefit in the HEP analysis.

Although additional training would not provide benefit, the important PRA information is transmitted to the Training Department to be incorporated into the Prairie Island Training Center procedure which provides instructions and guidance for using PRA information in operator training programs. Specifically, PRA insights are used in the classroom training and in the development of simulator training and evaluation. The procedure identifies the top two operator actions for both units as OSLOCAXXCDY and OHRECIRCC2Y.

RAI SAMA 5.b

b. ER Section F.5.1.5 indicates that two internal flood related enhancements identified in the individual plant examination (Items 2 and 3 on page F.5-5) were implemented through piping modifications, design features, and periodic inspections, as described in Calculation ENG-ME-1 48, Rev. 1. The thrust of the argument appears to be that this has rendered the probability of cooling water system header rupture negligible. Provide a copy of this calculation/white paper. Justify that the potential enhancements would not be warranted given the dominant contributors to internal flooding CDF, as described in response to RAI 1.h.

NSPM Response to RAI SAMA 5.b A copy of ENG-ME-1 48, Revision 1, is included as Enclosure 2. The objective of this paper is to document the qualifications, design features and periodic inspections in place which provide confidence that the probability of occurrence of a pipe rupture (double-ended guillotine break) is negligible. The break postulation is reviewed from a deterministic standpoint and is based on current Prairie Island licensing basis, plant material condition, and other factors.

The cooling water header piping was completely replaced during the two unit outage in November 1992. The new piping is 33 percent thicker (1/2" compared to the original thickness of 3/8"). The Cooling Water System is a safety related system designed and constructed to Design Class I and QA Type 1 standards. These design and construction standards are much more stringent than are the standards used in industrial and fossil plant design and construction. Also, the internal surface of the new header piping is coated with an epoxy coating to inhibit microbiologically induced corrosion (MIC).

40

Enclosure I Responses to NRC Requests for Additional Information Dated October 23, 2008 In addition, it is likely that a substantial piping leak (which could lead to a larger piping failure) would be noticed by operators, engineering or maintenance staff, or security personnel who periodically walk through these rooms such that corrective action could be taken well before a break might occur.

As described in the response to RAI SAMA 1 .h, the dominant internal flooding sequences for both units involve flooding of the 695' elevation of the Auxiliary Building. The worst case flooding scenario (which is assumed for all flooding events associated with this initiating event) is due to a Cooling Water (CL) header rupture in the Component Cooling Water (CC) heat exchanger area, which is assumed to fail one train of CC pumps on both units as they are located below the associated CL header in that room. This is considered a dual-unit initiating event. The other train of CC pumps will continue to function if operator action to identify and isolate the ruptured CL header prior to submergence of the CC pump electrical connections is successful. Failure of this action will also result in flooding beyond the CC pumps, impacting both trains of Safety Injection (SI) pumps, Residual Heat Removal (RHR) pumps, and Containment Spray (CS) pumps, as well as MCCs supporting the Charging pumps and other safeguards equipment. The core damage sequence involves the occurrence of the flooding initiating event followed by failure of the operators to isolate the break prior to loss of the second train of CC pumps. This results in loss of reactor coolant pump (RCP) seal cooling, which eventually leads to an unrecoverable RCP seal LOCA as the ECCS pumps have been impacted by the flooding event.

The operator action to isolate the Auxiliary Building 695' elevation flooding source (0AB7FLDISLY) was identified in the Level 1 Importance List Review for Unit 1 and Unit 2 (ER Tables F.5-1 a and F.5-1 b). According to the review for potential SAMAs for this event, several were identified:

• Mitigation of this event can be accomplished via an automatic sump pump system to remove water ifthe operator fails to isolate Zone 7 of the Auxiliary Bldg. (SAMA 13)

• Consider installing waterproof (EQ) equipment (valves / level sensors) capable of automatically isolating the flooding source. (SAMA 6)

" Consider segregating this zone into 2 compartments to reduce the impact of a flood on both trains of SI and RHR. (SAMA 6a)

As stated in ER Section F.5.1.5, the IPE identified two internal flood enhancements (Items 2 and 3 on page F.5-5). These enhancements are related to flooding in the Auxiliary Feedwater (AFW) Pump Room due to the CL header pipe break. However (as reflected in the response to RAI Question 1 .h), AFW Pump Room flooding is no longer a significant contributor to the PRA results. Therefore, potential enhancements would not be warranted.

RAI SAMA 5.c

c. ER Section F.5.1.7.1 states that a recommendation from the seismic margins analysis was to restrain or remove wall hung ladders and scaffolding. Describe the actions taken in response to this recommendation.

41

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 NSPM Response to RAI SAMA 5.c Per the PINGP IPEEE one of the recommendations from the seismic margins assessment was to "restrain or remove wall hung ladders and scaffolding that are located near safety related equipment to reduce the impact of seismically induced relay chatter." As noted in IPEEE Section A.2.2.4, "Findings from the Plant Walkdowns," scaffolding was found to be hung on the wall behind the D2 Diesel Generator Control Panel. Although damage to the panel and its anchorage due to the possible impact of the scaffolding was unlikely, it was thought an impact may cause relay chatter. Similarly, a wall-mounted ladder was found to be located behind 4160 VAC Bus 25. Like the D2 control panel, it was thought that if the ladder would fall off its wall-hooks due to earthquake motion, relay chatter may result.

Currently, no scaffolding is stored near safety-related equipment. Scaffolding storage is controlled in accordance with a plant procedure, which states that temporary staging of materials, such as scaffolding, shall be consistent with allowable floor loadings and storage areas shown in plant drawings. Also, a plant procedure provides guidance on scaffolding construction and use, including requirements for clearances to safety-related equipment and seismic restraints to limit horizontal movement during a seismic event. With the guidance given in these procedures, the impact of scaffolding on safety related equipment is negligible.

For ladder use and storage, current practices are defined in a plant procedure, which states that ladders shall be returned to storage racks or other designated storage locations, when not in use. In addition, a housekeeping and material condition procedure states that all portable ladders in an area (not in use) are to be secured at the proper ladder storage location and visually checked for safety concerns.

During a recent field walkdown, it was noted that ladders are still located near safety-related equipment such as 4160 VAC Bus 25 and D2. The ladders are stored on plant storage racks per procedure; however, it was questioned whether additional restraints were warranted to secure the ladders. Investigation determined that there was no clear guidance for the location and construction of ladder storage. The condition has been entered into the corrective action program to further investigate the issue and determine whether current ladder storage standards are adequate.

RAI SAMA 5.d

d. ER Section 4.17.1 identifies five criteria for screening out Phase I SAMA candidates, whereas ER Section F.5.2 identifies two such criteria, one of which involves the use of engineering judgment and expected maximum cost and dose benefits. Clarify which criteria were actually used in the SAMA screening process.

NSPM Response to RAI SAMA 5.d Although the screening criteria listed may appear to be different between the two documents, they are meant to be equivalent with similar intent. Also, even though a particular screening criterion was listed, it does not imply that it was necessarily utilized, since it may not have been necessary or applicable. The following table attempts to resolve the apparent discrepancy between the two sections by showing their similarity.

42

Enclosure I Responses to NRC Requests for Additional Information Dated October 23, 2008 ER Section F.5.2 ER Section 4.17.1 Applicability to the Plant: If a proposed SAMA (1) Candidates not applicable to does not apply to the Prairie Island design, it is the PINGP design not retained.

Engineering Judgment: Using extensive plant (2) Candidates with no significant knowledge and sound engineering judgment, benefit in pressurized water potential SAMAs are evaluated based on their reactors such as PINGP expected maximum cost and dose benefits; (5) Candidates whose estimated those that are deemed not beneficial are implementation costs exceed the screened from further analysis. maximum averted cost-risk It was not deemed necessary to list a potential (3) Candidates that have already SAMA candidate if the option has already been, been implemented at PINGP or is planned to be, implemented, e.g., planned replacement of steam generators on Unit 2.

Table F.5-3 discusses the various SAMA (4) Candidates with benefits that options, and as applicable, recommends the have been achieved using other use of other SAMAs that could prove more means effective, e.g., SAMA 18 was dispositioned by recommending the use of SAMA 15.

RAI SAMA 5.e

e. For each screened Phase I SAMA candidate (i.e., SAMAs 1,6, 6a, 7,8,10,11,13,14,16, 17, 18, 19a, 21, 23, 24) identify the criteria used to screen the SAMA. If engineering judgment was used as the criteria (as opposed to the criteria provided in ER Section 4.17.1), provide the estimated cost and dose benefit values used in the screening decision for each SAMA, as well as the basis for the engineering judgment decision.

NSPM Response to RAI SAMA 5.e ER Table F.5-3 provides a description of how each SAMA was dispositioned in Phase I.

Those SAMAs that required a more detailed cost-benefit analysis were evaluated in Section F.6. Also see the response for RAI 5.f below.

RAI SAMA 5.f

f. ER Section F.7.2.1 identifies five Phase 1 SAMAs that were originally screened out but subsequently screened in and further evaluated as a result of an uncertainty assessment (i.e., SAMAs 1, 10, 17, 19a, and 21). Describe the process and criteria used to identify these five SAMAs. Explain why an uncertainty evaluation for the remaining 11 screened out SAMAs is not appropriate.

NSPM Response to RAI SAMA 5.f This response addresses both RAIs 5.e and 5.f:

43

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 Four of the five Phase 1 SAMAs (1, 10, 17, and 19a) were originally carried forward into the Phase 2 evaluation based on preliminary implementation costs, but later refined estimates clearly made them not cost beneficial when compared with other Phase 1 SAMAs that were dispositioned as being too costly. Nonetheless, it was decided to retain their analysis by including them as a sensitivity calculation rather than delete the earlier Phase 2 work. SAMA 21, although not seen as cost-beneficial, was retained as a sensitivity calculation only as an exercise to see what possible averted cost benefits might be realized since the SAMA option was viewed to have a large impact on LERF. The other 11 screened out Phase 1 SAMAs were screened based on the implementation cost being high and the perceived risk benefit as being low. The following table was developed to help clarify where in the ER each of the identified SAMAs was dispositioned.

SAMA Identifier License Renewal Section / Comments 1 Section F.7.2.1.1 6 Section F.5.2.1 6a Section F.5.2.2 7 Table F.5-3 8 Section F.5.2.3 10 Section F.7.2.1.2 11 Table F.5-3; SAMA 10 viewed as alternative to this SAMA 13 Section F.5.2.4 14 Table F.5-3 16 Table F.5-3 17 Section F.7.2.1.3 18 Table F.5-3; SAMA 15 viewed as alternative 19a Section F.7.2.1.4 21 Section F.7.2.1.5 23 Table F.5-3; SAMAs 5 and 19a viewed as alternatives 24 Table F.5-3; SAMAs 16, 17, 21, and 22 viewed as alternatives RAI SAMA 5.g

g. Provide additional description of the SAMA 6a barriers described in Section F.5.2.2 in order to better justify the cost estimate of $2M per unit.

NSPM Response to RAI SAMA 5.g As shown in USAR Figure 1.1-5, the critical equipment in the scope of SAMA 6a is all located on the same floor elevation of the Auxiliary Building. The equipment involved includes (for each unit) two SI pumps, two CC pumps, several motor control centers, three charging pumps, and two RHR pumps located in pits below the floor level. The equipment is not separated by flood-proof barriers, and, for the CC pumps, all pumps from both units are located in the same large area. Therefore, any modification to achieve the benefits of SAMA 6a would have to consist of a series of enclosures that surround individual pieces of equipment. Some enclosures may only consist of walls to protect from rising water, but others may need to be full covered enclosures to protect from spray. At least 22 (11 per unit) 44

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 individual, custom-designed enclosures would be required. Additional enclosures may also be required to protect specific instrumentation, MOVs, or other electrical devices.

Because the area of concern is congested and limited in size, and the equipment separation distance tends to be small, permanent barriers are generally not practical. Open access will continue to be needed for each component during periodic disassembly or replacement; permanent barriers that provide room for maintenance are either not possible or would unreasonably restrict access to other equipment. Therefore, each individual equipment enclosure would have to be able to be constructed in relatively small sections that can be moved and assembled in restricted areas, and they would have to be disassembled easily to provide access for equipment operation, maintenance or replacement. Simply pouring concrete walls around equipment is not an option. The enclosures would also have to be seismically designed and capable of being sealed to the floors. Provisions would also be needed to remove water that may leak from the component inside each enclosure to prevent flooding from even small leaks rendering inoperable the equipment that the enclosure is intended to protect. Floor drains located within proposed enclosures may have to be relocated or modified to provide backflow protection.

For the RHR pump pits, it may be possible to increase the heights of the existing curbs or build new higher curbs outside the existing curbs. However, higher curbs would still have to permit easy access to remove and install the pit covers, and to move personnel, materials and equipment into and out of the pits during maintenance and inspections. The power operators used to remove and reinstall pit covers may have to be redesigned. The RHR pit curb design, therefore, is not necessarily straightforward.

The construction work to erect these enclosures would be difficult. Assembly would be labor-intensive. Special precautions would be required during construction to avoid contacting and damaging the safety-related equipment each enclosure is intended to protect, as well as to protect other safety-related equipment in the vicinity.

In view of these considerations, it is reasonable to conclude that the cost of design, fabrication and construction of each enclosure, costs associated with future removal and replacement of each enclosure for equipment maintenance, and costs of maintaining the sealed joints in each enclosure water tight, could easily reach $200,000 each, or more than $2,000,000 per unit.

45

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 RAI SAMA 6.a Provide the following information with regard to the Phase II cost-benefit evaluations:

a. ER Section F.6 states that the PINGP-specific implementation cost estimates do not account for replacement power costs that may be incurred due to consequential shutdown time. Clarify whether contingency costs or inflation adjustments are included in the cost estimates. Describe the types of costs that are included within the estimated "life cycle" costs.

NSPM Response to RAI SAMA 6.a Cost estimates for potential plant modifications identified in the SAMA analysis have been developed as order-of-magnitude cost estimates. Contingency cost or inflation adjustments were not included in these estimates. Each cost estimate is broken down into relevant work activities across the following major project phases: Study, Analysis, Design, Implementation, and Life Cycle.

Work activities associated with the various project phases as described below are considered with respect to the expanded SAMA project descriptions.

The 'Study' phase estimates account for the identification of physical design change alternatives, identification of stakeholders, pre-conceptual design, assessment of impact on plant procedures, processes and programs, and a draft safety evaluation or licensing /

permitting assessment.

Estimates for the 'Analysis' phase of each project account for evaluations, calculations and analyses required to support the basis for the project such as revisions to the plant heat balance or accident analyses.

The "Engineering and Design' phase estimates account for conceptual design, preliminary design and final design. This involves preparation, review and approval of drawings, specifications, data sheets, design change packages, as well as various discipline engineering elements and engineering program elements. Also included are evaluations, calculations and analyses required to support the implementation of the design change such as piping analysis, pipe support calculations, structural load analyses, electrical circuit analyses and loading, cable tray loading, etc.

The 'Implementation' phase estimates account for procurement, materials management, work planning, installation, testing, return to operations and closeout. This involves maintenance services, construction services, craft labor, design engineering support, program engineering support and procurement services.

Estimates in the 'Life Cycle' phase accounts for labor and materials required for maintaining plant equipment in operable condition for 20 years. Life cycle costs do not include any contingency or inflation adjustments. Life cycle costs are costs related to ensuring the operability of the equipment.

46

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 RAI SAMA 6.b

b. For SAMA 2, ER Section F.6.1 indicates a $300K implementation cost for each unit but provides no basis for this value. It appears that this SAMA would involve the upgrade of one site diesel-driven fire pump and the addition of the associated piping connections and starting circuitry. As such, the cost would be shared by each unit.

Provide additional information regarding the basis for the cost estimates for this SAMA.

Identify any other SAMAs that serve both units and whose costs are shared.

NSPM Response to RAI SAMA 6.b The $300k estimate for each unit credited the B.5.B portable fire pump being connected to the cooling water system. The estimate also credited existing connections with operator actions to open valves, and nominal costs associated with procedure changes. However, additional analysis indicated that the B.5.B Fire Protection System pump capacity would be limited, and additional capacity would be needed. To meet the additional pumping capacity, a diesel driven pump could be installed for an estimated $2.4 million between both units. The cost estimate is comparable to the cost of a similar installation at Palisades. This higher cost would screen this SAMA from being cost beneficial.

RAI SAMA 6.c

c. For SAMA 20, ER Table F.5-3 indicates a $313K implementation cost for each unit to change normally-open motor-operated valve to normally-closed, including a $1 00K "life cycle" cost. Describe the physical changes that are included in this cost estimate.

Elaborate on the each of the cost factors that contribute to this implementation cost.

NSPM Response to RAI SAMA 6.c A description of SAMA 20 and a breakdown of the cost factors are provided below:

Title: Close Low Head Injection MOVs to Prevent RCS Backflow to SI System

==

Description:==

Change the safety-related motor-operated low head reactor vessel injection valves (one valve in each Emergency Core Cooling System train) from normally open to normally closed. Valves would need modifying by drilling a hole in the upstream disk in order to eliminate any pressure locking concern.

Assumptions: Each valve will be placed in the closed position (or verified closed) by the control room operator prior to entering the appropriate Tech Spec MODE and each valve will receive, as it does presently, an "S" (safety injection) signal; therefore, in order to implement this alternative, procedure and drawing changes are required. Assumptions include:

• The design requirements for the valve and its motor operator which were in effect at the time the valve was a normally open valve are still valid.

47

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008

• The current valve design will support the modification to eliminate any pressure locking concern.

• The valve MEDP (maximum expected differential pressure) and actuator will not be changed by this modification. Minor changes in the wedge friction factor may occur, but will not change the valve actuator or its settings PHASE ITEM RESOURCE FUNCTIONAL AREA ESTIMATE Study/Analyses 1 Contract Labor Engineering Design $40,000 Studies 2 PINGP Support Engr / Ops / Lic $12,000 Design 3 Contract Labor Engr Design - Mech / $60,000 Civil 4 Contract Labor Engr Design - Elec / $60,000 I&C 5 PINGP Support Engr / Ops / Maint $40,000 Implement 6 Labor Maintenance / $50,000 Construction 7 Contract Labor Engineering $2,000 8 Materials Material &Material $1,000 Mgmt 9 PINGP Support Engr / Ops / Lic $3,000 Life Cycle 10 Labor Ops / Maint for 20 years $100,000 GRAND TOTAL $368,000 Note: This estimate is for one unit only. The cost estimate for the second unit would save approximately 30% on the Design Phase. Therefore, the total cost for the second unit is

$258,000. The sum of the two costs is $626K, or an average of $313K per unit.

RAI SAMA 6.d

d. For SAMA 22, it is stated that the PRA model does not take full credit for the ability of the power-operated relief valve (PORV) accumulators, because their ability to supply sufficient air to support bleed and feed operation over the full range of reactor coolant system break sizes has not been verified (through testing or through engineering calculations). Describe the credit that is taken for the accumulators in the current model.

NSPM Response to RAI SAMA 6.d Basic events are included in the PRA to model the failure probability of the air accumulators for the pressurizer PORV to be able to open the valves for bleed and feed with the instrument air supply to the valves failed. The current failure probability is 0.1.

48

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 RAI SAMA 6.e

e. In ER Sections 4.17 and F.4.6, the modified MACR (MMACR) is indicated to be

$1,114,000 and $2,980,000 for Unit 1 and 2, respectively. In ER Section F.7.1 it is indicated to be $1,048,000 and $2,706,000. Address this discrepancy.

NSPM Response to RAI SAMA 6.e The correct values are $1,114,000 and $2,980,000 for Unit 1 and 2, respectively. The values listed in Section F.7.1 are the result of typographical errors. The MMACR values had been modified based on updated information, but the older values within Section F.7.1 were inadvertently not corrected. This section dealt with adjusting the Real Discount Rate (RDR) value from 3% to 7%. The end result is that this typographical error does not change any of the results or conclusions for any of the SAMA analyses or sensitivity cases.

Accordingly, the third paragraph in Section F.7.1 is hereby corrected to state the following, with changes shown in boldface:

The PhaseII analysis was re-performed using the 7percentRDR. Implementation of the 7percent RDR reduced the MMACR by 28.4 percent compared with the case where a 3 percent RDR was used.

This corresponds to a decrease in the MMACR from $1,114,000 to $798,000 for Unit 1 andfrom

$2,980,000 to $2,134,000 for Unit 2.

Additionally, the values in the tables of Section F.7.1 are hereby updated as follows, with changes shown in boldface:

Unit 1 Summary of the Impact of the RDR Value on the Detailed SAMA Analyses Averted Net Value Averted Net Value Change in SAMA Cost of Cost Risk (3Cost (7 percent Risk Cost ID Implementation (3 percent RDRc (7 percent Effective-RRDR) RDl) ness?

1 $4,250,000 $268,252 ($3,981,748) $192,168 ($4,057,832) No 2 $1,200,0001 $123,376 ($1,076,624) $88,388 ($1,111,612) No 3 $250,000 $74,956 ($175,044) $53,700 ($196,300) No 5 $1,500,000 $75,942 ($1,424,058) $54,346 ($1,445,654) No 9 $62,500 $62,746 $246 $44,950 ($17,550) Yes 10 $2,866,000 $46,870 ($2,819,130) $33,580 ($2,832,420) No 12 $900,000 $186,188 ($713,812) $133,376 ($766,624) No 15 $130,000 $0 ($130,000) $0 ($130,000) No 17 $2,362,000 $88,030 ($2,273,970) $63,004 ($2,298,996) No 19 $700,000 $60,330 ($639,670) $43,178 ($656,822) No 19a $1,935,000 $329,802 ($1,605,198) $236,168 ($1,698,832) No 20 $313,000 $53,910 ($259,090) $38,582 ($274,418) No 21 $3,000,000 $11,286 ($2,988,714) $8,082 ($2,991,918) No 22 $39,000 $15,350 ($23,650) $10,990 ($28,010) No

'Cost of implementation is revised as discussed in NSPM response to RAI SAMA 6.b.

49

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 Unit 2 Summary of the Impact of the RDR Value on the Detailed SAMA Analyses Averted Net Value Averted Net Value Change in SAMA Cost of Cost Risk Netae Cost Risk Netae Cost ID Implementation (3 percent (3 percent 7 percent (7 percent Effective-RDR) RDR) RDR) RDR) ness?

1 $4,250,000 $270,474 ($3,979,526) $193,762 ($4,056,238) No 2 $1,200,0001 $123,092 ($1,076,908) $88,180 ($1,111,820) No 3 $250,000 $76,654 ($173,346) $54,910 ($195,090) No 5 $1,500,000 $222,610 ($1,277,390) $159,310 ($1,340,690) No 9 $62,500 $62,918 $418 $45,070 ($17,430) Yes 10 $2,866,000 $48,630 ($2,817,370) $34,838 ($2,831,162) No 12 $900,000 $302,132 ($597,868) $216,350 ($683,650) No 15 $130,000 $19,324 ($110,676) $13,842 ($116,158) No 17 $2,362,000 $488,118 ($1,873,882) $349,330 ($2,012,670) No 19 $700,000 $60,514 ($639,486) $43,308 ($656,692) No 19a $1,935,000 $929,586 ($1,005,414) $665,408 ($1,269,592) No 20 $313,000 $54,646 ($258,354) $39,106 ($273,894) No 21 $3,000,000 $12,518 ($2,987,482) $8,958 ($2,991,042) No 22 $39,000 $67,650 $28,650 $48,420 S9,420 No

'Cost of implementation is revised as discussed in NSPM response to RAI SAMA 6.b.

RAI SAMA 6.f

f. ER Table F.3-7 contains a number of entries that are inconsistent with values reported elsewhere in the ER. Specifically, the Unit 1 CDF is indicated to 9.85E-6 per year, whereas a value of 9.79E-6 per year is reported elsewhere. The Unit 2 dose-risk is indicated to be 8.37 person-rem per year, whereas a value of 8.43 is reported elsewhere.

The offsite economic cost risk for Unit 1 and 2, is indicated to be 1.36E4 and 5.44E4, whereas values of 1.59E4 and 6.33E4 are reported elsewhere.

Address these discrepancies.

NSPM Response to RAI SAMA 6.f The Containment Event Tree (CET) sequence frequencies were determined through quantification of the Boolean logic models and included delete-term operations to remove success-branch cutsets from the output at the sequence level. The CET sequences are mapped to release categories; to produce the release category frequencies presented in Table F.3-7, a simple summation of the appropriate sequence frequencies was used. This introduces a small amount of over-prediction in the release category frequencies, as another delete-term operation on the combined sequence cutsets for mutually-exclusive sequences was not performed. Some of the release category frequency values shown on Table F.3-7 are, therefore, slightly higher than their actual values. The Unit 1 and Unit 2 CDF values presented in the table are also simple summations of the release category frequencies. As shown in the CDF for Unit 1, the sum of the release category frequencies produces a CDF metric for Unit 1 that is approximately 6E-8 (less than 1%) higher than the Boolean-logic quantified CDF value of 9.79E-6. The difference in the Unit 2 CDF value is not noticeable to 3 50

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 significant digits, but is also less than 1% higher. The slightly higher CDF values presented in Table F.3-7 were not used in the SAMA quantification. The slightly higher release category frequencies were used, but as the differences are small, and it is the delta between release category values that is used as the basis for the SAMA evaluations, these differences are considered insignificant to the overall results of the evaluation.

Note that the release categories making up the LERF risk metric are more important to the SAMA results, as these categories are more likely to impact onsite and offsite doses and cleanup costs. The over prediction of the LERF metric produced by summing these release categories is less than 3/1000 of 1% for both units, which indicates that the actual frequencies for these release categories are very close to the approximations used in the analysis.

During performance of the Prairie Island analysis, three SECPOP2000 code errors were publicized, specifically: 1) incorrect column formatting of the output file, 2) incorrect 1997 economic database file end character resulting in the selection of data from wrong counties, and 3) gaps in the 1997 economic database numbering scheme resulting in the selection of data from wrong counties. All three errors were addressed and new MACCS2 results were generated. It was verified that these new results for MACCS2 served as the basis for all SAMA quantifications. However, the numbers that were presented in Table F.3-7 had not been updated to reflect the latest values from MACCS2.

Accordingly, ER Table F.3-7 is hereby corrected as presented below, with changes shown in boldface. Coincidentally, the Unit 1 Dose Risk (2.94 p-rem/yr), at least to three significant figures, did not change when using the updated MACCS2 results, which is the reason why it is not shown in boldface.

Table F.3-7 MACCS2 Base Case Mean Results Source Release Dose Offsite Unit 1 Unit 1 Dose- Unit 1 Unit 2 Unit 2 Dose- Unit 2 Term Category (p-sv)(1) Economic Freq. Risk OECR Freq. Risk OECR Cost ($) (/yr) (p-rem/yr)(1 ) ($/yr) (/yr) (p-ren/ yr)(1) ($/yr) 1 H-XX-X 1.64E+01 3.39E+02 7.28E-06 1.19E-02 2.47E-03 8.52E-06 1.40E-02 2.89E-03 2 H-H2-E 2.11E+04 1.20E+10 2.32E-11 4.89E-05 2.78E-01 2.32E-11 4.89E-05 2.78E-01 3 L-H2-E 2.14E+04 1.32E+10 5.61E-08 1.20E-01 7.41E+02 6.52E-08 1.40E-01 8.60E+02 4 L-CL-E 3.40E+04 2.10E+10 8.40E-10 2.86E-03 1.76E+01 9.17E-10 3.12E-03 1.93E+01 5 H-OT-L 2.48E+03 5.70E+07 4.89E-09 1.21E-03 2.79E-01 5.87E-09 1.46E-03 3.35E-01 6 L-CC-L 2.23E+04 3.41E+09 2.82E-07 6.28E-01 9.61E+02 3.39E-07 7.56E-01 1.16E+03 7 H-DH-L 1.95E+02 1.22E+06 3.09E-08 6.03E-04 3.77E-02 3.14E-08 6.13E-04 3.83E-02 8 L-DH-L 6.22E+02 9.60E+06 1.92E-06 1.20E-01 1.85E+01 1.97E-06 1.22E-01 1.89E+01 9 SGTR 5.69E+04 5.03E+10 2.33E-07 1.32E+00 1.17E+04 1.17E-06 6.66E+00 5.89E+04 10 ISLOCA 2.28E+05 7.47E+10 3.22E-08 7.35E-01 2.41E+03 3.22E-08 7.35E-01 2.41E+03 FREQUENCY WEIGHTED TOTALS 9.85E-06 2.94E+00 1.59E+04 1.21 E-05 8.43E+00 6.33E+04

• ' MAACS2 provides dose results in Sieverts (sv). The MAACS2 result is converted to rem (1 sv = 100 rem) for the Dose-Risk results to be used in Section F.4.

51

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 RAI SAMA 6.g

g. ER Section F.7.2 presents the approach used to address the impact of uncertainty on SAMA results. For PINGP, this approach involves quantifying the Level 1 model uncertainty (and uncertainty multiplier) separately for each SAMA evaluation case. (In previous licensee renewal uncertainty analyses, licensees determined and applied a single uncertainty multiplier based on the uncertainty distribution in the baseline risk model.) The ER indicates that for those SAMAs whose modeling required the addition of new basic events, no new uncertainty distributions were assigned since the design and implementation of the SAMA was defined by the analysis. It appears that this approach may have had the unintended consequences of narrowing the uncertainty for those SAMAs that provide a significant risk reduction (because the added basic events are point estimates, the more they show up in the cutsets the tighter the distribution becomes.) In addition, the actual uncertainty is associated with the difference between the base model and the model with the improvement. The approach used in the ER assigns that uncertainty distribution to the model with the improvement even though two different distributions are being subtracted. As a result, the actual uncertainty distribution may be broader than indicated in the ER. Demonstrate that the approach used to estimate uncertainty is appropriate. Describe the impact on SAMA results if a single uncertainty multiplier (based on the uncertainty in the baseline model) were used in lieu of the SAMA-specific uncertainty multipliers.

NSPM Response to RAI SAMA 6.g The approach used that accounted for the uncertainty associated with each specific SAMA option on a case-by-case basis was deemed to be more precise in capturing the specific uncertainty associated with those particular generated cutsets. Although the practice of using a single multiplier has been used for other License Renewal applications, the use of a single multiplier for the 95th percentile utilizing baseline model CDF cutsets tends to provide a multiplier that may not necessarily represent the individual uncertainty associated with each particular SAMA. That is, in using a single multiplier, some SAMAs could be perceived as not being cost beneficial if the overall multiplier was too low. Likewise, an individual SAMA may be mistakenly perceived as being cost beneficial ifthe single multiplier is too high. Therefore, it was deemed more appropriate to evaluate the 9 5 th percentile estimates using those cutsets that pertain to the actual SAMA of interest to provide for better resolution and a more refined estimate of the 9 5 th percentile cost benefits for each individual SAMA. Therefore, the use of individual multipliers based on each SAMA option's 9 5 th percentile results was considered technically sound.

However, in reviewing the PINGP application of the above process, where it was intended to isolate the uncertainty effects to each individual SAMA, it was found that the 95th percentile result for each SAMA had been actually divided by the baseline CDF value. To provide a more accurate ratio of the 9 5 th to the mean estimate, the denominator should have been each SAMA's point estimate for CDF, not the baseline CDF. The revised results using each SAMA's CDF point estimate are provided in the following tables. The tables also reflect the cost correction for SAMA 2 discussed in the response to SAMA 6.b above. The resulting impact from these changes is that Unit 2 now shows SAMA 19a as potentially cost beneficial when using this corrected method.

52

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 Unit I 95th Percentile Results Using Individual SAMA Uncertainty Multipliers SAMA ID Cost of Ratio of 95th SAMA to CDF Unit 1 Averted Cost-RiskNet Value SAMAI Implementation Cost-Risk SAMA 1 $4,250,000 2.89 $775,079 -$3,474,921 SAMA 2 $1,200,000' 2.69 $332,481 -$867,519 SAMA 3 $250,000 2.75 $205,793 -$44,207 SAMA 5 $1,500,000 2.86 $216,922 -$1,283,078 SAMA 9 $62,500 2.87 $180,002 $117,502 SAMA 10 $2,866,000 2.84 $132,985 -$2,733,015 SAMA 12 $900,000 2.79 $519,433 -$380,567 SAMA 15 $130,000 2.90 $0 -$130,000 SAMA 17 $2,362,000 2.89 $254,417 -$2,107,583 SAMA 19 $700,000 2.86 $172,754 -$527,246 SAMA 19a $1,935,000 2.77 $914,173 -$1,020,827 SAMA 20 $313,000 2.85 $153,784 -$159,216 SAMA 21 $3,000,000 2.91 $32,882 -$2,967,118 SAMA 22 $39,000 2.89 $44,386 $5,386

1. Results reflect cost correction discussed in the response to RAI SAMA 6.b Unit 2 95th Percentile Results Using Individual SAMA Uncertainty Multipliers SAMA ID Cost of Implementation Ratio of 95th to SAMA Unit 2 Averted Cost-Risk Net Value CDF SAMA 1 $4,250,000 2.82 $763,219 -$3,486,781 SAMA 2 $1,200,000' 2.79 $343,506 -$856,494 SAMA 3 $250,000 2.71 $207,943 -$42,057 SAMA 5 $1,500,000 2.89 $642,520 -$857,480 SAMA 9 $62,500 2.75 $173,012 $110,512 SAMA 10 $2,866,000 2.86 $138,918 -$2,727,082 SAMA 12 $900,000 2.92 $881,438 -$18,562 SAMA 15 $130,000 2.84 $54,901 -$75,099 SAMA 17 $2,362,000 2.86 $1,397,133 -$964,867 SAMA 19 $700,000 2.87 $173,931 -$526,069 SAMA 19a $1,935,000 2.74 $2,542,917 $607,917 SAMA 20 $313,000 2.85 $155,678 -$157,322 SAMA 21 $3,000,000 2.76 $34,610 -$2,965,390 SAMA 22 $39,000 2.84 $192,028 $153,028

1. Results reflect cost correction discussed in the response to RAI SAMA 6.b In response to the question involving the impact of using a single multiplier, the tables below show that when the baseline 9 5 th percentile estimate is divided by the respective unit's baseline CDF, the results show the same outcome with respect to those SAMAs that are cost 53

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 beneficial at this level of uncertainty. The tables also reflect the cost correction for SAMA 2 discussed in the response to RAI SAMA 6.b above. Therefore, this exercise has shown for this particular SAMA evaluation that the two methods, when appropriately applied, produced similar results with regard to determining those SAMAs that are cost beneficial at the 9 5 th percentile.

Unit 1 95th Percentile Results Using Global Uncertainty Multiplier SAMA ID Cost of Implementation Ratio of 95th to Base CDF Unit 1 Averted Cost-Risk Net Value SAMA 1 $4,250,000 2.95 $791,490 -$3,458,510 SAMA 2 $1,200,000' 2.95 $364,026 -$835,974 SAMA 3 $250,000 2.95 $221,161 -$28,839 SAMA 5 $1,500,000 2.95 $224,070 -$1,275,930 SAMA 9 $62,500 2.95 $185,135 $122,635 SAMA 10 $2,866,000 2.95 $138,292 -$2,727,708 SAMA 12 $900,000 2.95 $549,356 -$350,644 SAMA 15 $130,000 2.95 $0 -$130,000 SAMA 17 $2,362,000 2.95 $259,736 -$2,102,264 SAMA 19 $700,000 2.95 $178,006 -$521,994 SAMA 19a $1,935,000 2.95 $973,096 -$961,904 SAMA 20 $313,000 2.95 $159,064 -$153,936 SAMA 21 $3,000,000 2.95 $33,300 -$2,966,700 SAMA 22 $39,000 2.95 $45,291 $6,291

1. Results reflect cost correction discussed in the response to RAI SAMA 6.b Unit 2 95th Percentile Results Using Global Uncertainty Multiplier SAMA ID Cost of Ratio of 95th Unit 2 Averted Net Value Implementation to Base CDF Cost-Risk SAMA 1 $4,250,000 2.78 $751,691 -$3,498,309 SAMA 2 $1,200,000' 2.78 $342,092 -$857,908 SAMA 3 $250,000 2.78 $213,034 -$36,966 SAMA 5 $1,500,000 2.78 $618,669 -$881,331 SAMA 9 $62,500 2.78 $174,859 $112,359 SAMA 10 $2,866,000 2.78 $135,151 -$2,730,849 SAMA 12 $900,000 2.78 $839,673 -$60,327 SAMA 15 $130,000 2.78 $53,704 -$76,296 SAMA 17 $2,362,000 2.78 $1,356,558 -$1,005,442 SAMA 19 $700,000 2.78 $168,178 -$531,822 SAMA 19a $1,935,000 2.78 $2,583,469 $648,469 SAMA20 $313,000 2.78 $151,870 -$161,130 SAMA 21 $3,000,000 2.78 $34,790 -$2,965,210 SAMA 22 $39,000 2.78 $188,010 $149,010

1. Results reflect cost correction discussed in the response to RAI SAMA 6.b 54

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 RAI SAMA 8.a For certain SAMAs considered in the ER, there may be lower-cost alternatives that could achieve much of the risk reduction at a lower cost. In this regard, discuss whether any lower-cost alternatives to those Phase IISAMAs considered in the ER would be viable and potentially cost-beneficial. Evaluate the following SAMAs or indicate ifthe particular SAMA has already been considered. Ifthe latter, indicate whether the SAMA has been implemented or has been determined to not be cost-beneficial at PINGP.

a. Procedure for manually controlling the degree of SG depressurization and reclosing the SG PORVs in the event core damage is imminent, in order to prevent or reduce the challenge to SG tube integrity.

NSPM Response to RAI SAMA 8.a Procedural guidance similar to that suggested in this SAMA is already in place for events involving extreme damage to the plant (such as may occur during a security-related incident).

The Extreme Damage Mitigation Guideline (EDMG) for injecting water into the steam generators includes the following direction for Technical Support Center (TSC) personnel:

Monitor conditions and be prepared to recommend closure of the Steam Generator (SG) Power Operated Relief Valves (PORVs) in the event core damage is imminent in order to prevent a challenge to SG tube integrity.

Also, the Severe Accident Management Guideline (SAMG) procedure for injecting water into the steam generators provides direction to the plant staff in re-establishing water flow to the SGs following a core damaging event. The procedure requires that the negative impacts of injecting water into the SGs be identified and evaluated. The procedure includes a table of negative impacts to consider and a listing of actions that can be taken to reduce or mitigate these impacts, ifthe decision is made to use this strategy. The negative impacts are described in detail, including how depressurization of the SGs (to allow injection with lower pressure systems) can increase the potential for tube failure due to the higher differential pressures across the tubes.

The PINGP emergency response personnel (TSC and Operations staff) that respond to plant events requiring use of the Emergency Operating Procedures are the same personnel that respond to events requiring implementation of the SAMGs and EDMGs. These personnel are trained in the use of these procedures in response to an event similar to that described above.

Due to the guidance to the operations and emergency response staff already in place, implementation of this proposed SAMA would have no beneficial impact.

RAI SAMA 8.b

b. Procedure for enhancing manual operation of turbine-driven Auxiliary Feedwater (AFW) pumps including alternate water sources, and operator aids for using local flow indication to maintain SG level.

55

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 NSPM Response to RAI SAMA 8.b The use of alternate water sources is already addressed in the post-accident procedures requiring operation of the AFW pumps, including the TDAFWP (e.g., Caution statements state that if Condensate Storage Tank (CST) level decreases to less than 10,000 gallons, then alternate water sources for AFW pumps will be necessary). Local manual operation of the TDAFWP may be required during a Station Blackout (SBO) scenario. An abnormal operating procedure provides direction necessary to perform these actions. This procedure also contains a step notifying the operator to refer to other procedures for possible sources of makeup to the CST (as CST water level is depleted by pump operation).

PINGP also maintains a special document called an "Alternate Source Book" (ASB) that provides information to personnel during off-normal plant operations and during implementation of SAMGs (Decision Maker, Evaluators and Implementers) when developing strategies to mitigate a severe accident. The ASB provides information on resources for:

" Electrical Power Supply

" Water Makeup Supply

" Pneumatic (Air) Supply, and

• Fission Product Scrubbing Supply In addition to the normal and emergency sources of water to the AFW pumps called for in the EOPs, the ASB identifies a number of alternate on-site and external water sources for providing water to the SGs (see response to RAI SAMA 8.c below). Also, the EDMG for manual operation of TDAFW pumps also contains procedural guidance similar to that suggested in this SAMA (see the response to RAI SAMA 8.a. above for a discussion of the potential for use of the EDMG procedures in response to other events).

Due to the guidance to the operations and emergency response staff already in place, implementation of this proposed SAMA would have no beneficial impact.

RAI SAMA 8.c

c. Procedure and equipment for using a portable pump to provide feedwater to the SGs with suction from either the external fire ring header or intake canal.

NSPM Response to RAI SAMA 8.c The suggested action is the subject of an EDMG procedure for injecting water into the steam generators. Such an action would be considered by the operators and emergency response personnel following an event involving loss of heat sink (see the response to RAI SAMA 8.a above for a discussion of the potential for use of the EDMG procedures in response to non-extreme damage scenarios). A portable, diesel-powered pump and instructions for connecting the pump to supply water to the SGs from various sources (including the river) is in place, and emergency response personnel have been trained on the use of the equipment and on the procedures.

56

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 The ASB also identifies the portable diesel pump as a potential means of delivering water to the SGs, and refers the reader to the EDMGs for guidance in implementing this strategy. In addition, the ASB identifies other potential water sources, including 1) connection to the fire main using fire hoses and 2) drawing water from the external circulating water basins or Mississippi River using portable suction hoses and a fire pumper truck (supplied from the local fire station) delivering water to fire hydrant connections. These strategies would provide the water to the SGs via fire hoses connected to either the condensate system (condensate polisher strainer drains) or to the SG blowdown line drains.

Based on the procedures and equipment already available, NSPM considers this strategy to have been already implemented at PINGP.

RAI SAMA 8.d

d. Procedure for recovering emergency diesel generators D-1 and D-2 by supplying alternate cooling from well water or fire water through a spool piece on the inlet to the emergency diesel generator heat exchangers.

NSPM Response to RAI SAMA 8.d Sections F.5.1.1 and F.5.1.2 of the ER describe the identification of candidate SAMAs through the review of PRA basic event importance measures. In general, events having a Risk Reduction Worth (RRW) importance measure of 1.02 or greater were considered for SAMA identification. Failure of the Cooling Water (CL) system supply to the Unit 1 Emergency Diesel Generators (EDGs) was modeled explicitly in the Rev. 2.2 SAMA PRA models (failure of active supply valves to open and remain open, common cause failure (CCF) to open, and failure of normally-open manual valves in the supply lines to remain open). The importance measures of all of these events in the Unit 1 and Unit 2 CDF cutsets show that this function is not providing a significant contribution to the overall PRA results (RRW measure is approximately 1.001 or less for all events, including the CCF event).

In addition, an EDMG procedure provides the procedural guidance recommended in this suggested SAMA (see the response to RAI SAMA 8.a above for a discussion of the potential for use of the EDMG procedures in response to non-extreme damage scenarios). The strategy is to provide a means to cool EDG D1 or D2 independent of the Cooling Water system. An external cooling supply is provided by removing the spool piece between the existing Cooling Water system supply control valve and the diesel heat exchangers.

Therefore, as the importance of these events was previously evaluated to fall below the SAMA candidate screening criterion, and since the procedures are already in place, NSPM considers this strategy to have already been implemented at PINGP.

57

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 RAI SAMA 8.e

e. As an alternative to SAMA 15 (Portable DC Power Source), reconfiguring the non-safety main feedwater loads to be powered from DC Bus B rather than the addition of a portable DC power source for 21 AFW pump breaker control as proposed for SAMA 15.

NSPM Response to RAI SAMA 8.e ER Section F.6.6 showed that SAMA 15 had a small positive net value. However, changing the DC power supplies to the Unit 2 Main Feedwater system loads (instead of the associated motor-driven AFW pump) involves modifications to a larger set of components (pump breaker control power, feedwater regulating and bypass valves, etc.). In addition, the suggested SAMA would extend the DC power asymmetry between the units to the Main Feedwater system (in addition to the AFW system) and additional costs for procedure changes and training would be required. The modification would cost significantly more than the averted cost-risk estimate associated with SAMA 15 ($0 for Unit 1 and $19,324 for Unit 2) and would provide no additional risk benefit.

Therefore, the proposed SAMA would not be cost beneficial.

RAI SAMA 8.f

f. Modifying the charging pump(s) electrical connections to enable re-powering from alternate 480VAC power supply (e.g., opposite unit) using pre-staged cables.

NSPM Response to RAI SAMA 8.f The important safety function supported by the charging pumps as modeled in the PRA is to provide water for Reactor Coolant Pump (RCP) seal injection. RCP seal injection, one of the two available means of RCP seal cooling, can be provided by 1 of 3 charging pumps. In the event that seal injection is lost, the seal cooling function is provided automatically by Reactor Coolant System (RCS) water flowing through the seals after having been cooled by passing through the RCP thermal barrier heat exchanger (TBHX), which is cooled by the Component Cooling (CC) system. The only support system shared by the charging pumps and the CC system pumps is AC power (both sets of pumps are supported by 4KV AC buses 15 and 16 on Unit 1, and 25 and 26 on Unit 2). Therefore, one means of losing RCP seal cooling is to lose safeguards AC power (station blackout).

However, unlike many other PWRs, this is not the dominant contributor to the seal LOCA core damage frequency at PINGP. Non-SBO induced RCP seal LOCA sequences contribute approximately 26% of the Unit 1 CDF [22% of the Unit 2 CDF], while SBO-induced RCP seal LOCA sequences contribute only approximately 9% [8%]. This is due to the ability to cross-tie the train-related 4kV buses between units, the availability of dedicated emergency diesel generators for each 4kV safeguards bus, and the differences between the EDG sets between the units (different cooling systems, different manufacturers, etc.). The dominant sequences involving loss of all RCP seal cooling involve loss of Cooling Water (CL), which fails the CC system and support for ECCS injection systems, and ultimately failure of the normal supply of water to the charging pumps from the Volume Control Tank (VCT), followed by failure of the 58

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 transfer of the charging pump suction supply to the Refueling Water Storage Tank (RWST).

SAMAs 2, 3, 9,10,12, 19a were developed and evaluated to address the CL, CC, and RWST to charging pump suction supplies for these important sequences.

Both the charging pumps and the CC pumps for each unit are already each powered from two independent trains of safeguards 4kV AC power, and each of those trains of AC power can already be transferred to the opposite unit train-related 4kV bus. The charging pumps are powered from safeguards 480V AC power; pumps 11, 12, and 13 [21, 22, and 23] are powered from 480V buses 121, 111, and 121 [221, 211 and 221] respectively via MCCs 1K2, 1K1, and 1 K2 [2K2, 2K1, and 2K2], respectively. The CC pumps are powered from 4kV safeguards buses 15 [25] and 16 [26], respectively. Failures of individual 4kV buses, and failures of electrical equipment between the 4kV buses and the charging pumps (in which the 4kV buses remain available) are low probability events and do not result in loss of more than two charging pumps. In these cases, at least one charging pump and one CC train remains available to support both means of RCP seal cooling. For this reason, the basic event importance for all such equipment failures falls below the screening thresholds described in Sections F.5.1.1 and F.5.1.2 of the ER.

Therefore, implementation of the suggested SAMA would not be cost beneficial at PINGP.

RAI SAMA 8.g

g. Installing a connection flange and valve on safety injection (SI) pump flow test return line to the refueling water storage tank to enable cross-connection of SI pumps to AFW piping via a temporary connection/hose.

NSPM Response to RAI SAMA 8.g As described in the response to RAI SAMA 8.c above, a number of alternative means of providing an independent supply of water to the steam generators in the event that all other water sources are unavailable have already been implemented via the ASB, EDMG procedures, and the SAMGs. Connection of the Safety Injection (SI) pumps to divert RWST water to the SGs on the same unit experiencing a loss of heat sink via temporary connections may not effectively reduce the risk of core damage from this event. Supplying water to the SGs from the SI pumps on the opposite unit would involve a greater length of hose, and the hose required would have to able to withstand high pressures.

Given the alternate supplies and strategies already available to the operators, implementation of the suggested strategy would not be cost beneficial at PINGP.

RAI SAMA 8.h

h. Modifying the charging and volume control system to allow cross-tie of the charging pumps from opposite unit using temporary connections.

59

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 NSPM Response to RAI SAMA 8.h The risk-significant function supported by the charging pumps is to provide RCP seal injection, preventing an RCP seal leak from occurring. The most probable situation in which all three charging pumps fail is a single unit station blackout (SBO) event. Due to the ability to crosstie the train-related AC buses between units at PINGP, the potential for a single unit SBO to occur is lower than at single unit plants and at multiple unit plants without this capability. Core damage sequences in which the charging pumps on the opposite unit may be available for cross-tie to the affected unit have a frequency of approximately 2.3E-6/rx-yr on both units, and are dominated by non-SBO-related RCP seal LOCAs. This is considered an upper bound frequency; in some of these sequences power may be lost to the opposite unit standby charging pumps, or other equipment or operator failures may prevent them from being used. These factors were not investigated fully for this response.

This RAI suggests that temporary connections could be used to make the necessary alternate flow path available to the other unit. However, the charging pumps are positive displacement pumps that develop the very high discharge pressures necessary for injection into the RCS.

For personnel safety, it is assumed that this connection would involve a modification to install a hard-pipe line (meeting current charging pump discharge piping standards) between the Unit 1 and Unit 2 charging pumps. At least one manual valve on either end would be required for isolation from the normally-operating high-pressure charging system. Both of these valves would have to be opened to provide flow through the temporary connection pathway. The shortest path for the piping run would be to cross the Auxiliary Building 695' elevation floor in the overhead of the CC heat exchanger room between the units. Assuming this minimum-distance pathway is available and can be used for the modification, roughly 100'-125' of high pressure piping would need to be installed.

If a (potentially optimistic) 1 E-1 probability of operator failure to perform this local recovery action prior to development of an RCP seal LOCA is applied, then the core damage risk savings associated with this SAMA is approximately 2E-6/rx-yr on each unit. However, most of these core damage sequences would not bypass containment (AFW is generally available in these sequences, such that induced SGTR is not a factor).

SAMA 3 (Provide Alternate Flow path from RWST to Charging Pump Suction) is comparable to this SAMA both in terms of CDF reduction and impact to dominant core damage sequences and release categories. From the ER Section F.7.2.3, the calculated averted cost-risk values for SAMA 3 were:

Base Averted 9 5 m'Percentile Unit Cost-Risk (ACR) ACR Unit 1 $74,956 $179,894 Unit 2 $76,654 $183,970 Total $151,610 $363,864 SAMA 3 involved installing a bypass around the motor-operated valve that must open to supply charging pump suction flow from the RWST upon loss of VCT level. This line would include an air-operated valve, whereas the suggested SAMA investigated here would include two manual isolation valves. The additional, new piping installed under SAMA 3 would need to be far shorter in length than would this SAMA, and the piping design and installation 60

Enclosure 1 Responses to NRC Requests for Additional Information Dated October 23, 2008 requirements would be less as SAMA 3 involved installation on the suction side of the charging pumps. The SAMA 3 cost estimate was $250,000 per unit. Ifthe proposed SAMA could be installed for this amount, then the modification would only be cost-beneficial at the 9 5 th percentile ACR for both units combined. However, based on the considerations outlined above, the cost to implement this modification would be expected to exceed the SAMA 3 implementation costs. Therefore, implementation of the suggested SAMA is not considered to be cost beneficial for PINGP.

RAI SAMA 8.i

i. Purchase or manufacture of a gagging device that could be used to close a stuck-open SG safety value on the ruptured steam generator prior to core damage in SGTR events NSPM Response to RAI SAMA 8.i Two recent license renewal applicants addressed this SAMA as part of their analysis (either on initial submittal or in response to an RAI). Beaver Valley found it to be cost beneficial at the upper bound of a sensitivity analysis, whereas Indian Point found it to be cost beneficial in the base case. Both plants used a $50,000 estimated implementation cost for this SAMA.

The Beaver Valley submittal stated that this SAMA involved procedure changes to require the operators to close the primary loop isolation valve associated with the ruptured SG, and then to gag the stuck open relief valve. This would reduce but not eliminate the radiation exposure to personnel received during the relief valve gagging operation. Like Indian Point, PINGP does not have RCS loop isolation valves. Therefore, in addition to steam and heat-related risk to personnel, the gagging operation is assumed to involve some additional amount of radiation exposure risk. The design and implementation of any gagging device would have to address issues related to personnel safety.

Based on the PRA Rev. 2.2 SAMA results, the CDF associated with SGTR events in which gagging a stuck open relief valve may be of value is about 2E-7/yr for Unit 1 and 1 E-6/yr for Unit 2. These sequences involve failure of the operators to cooldown and depressurize the RCS prior to stopping the primary-to-secondary leakage and prior to SG overfill, followed by failure of a SG relief valve to remain closed. The Indian Point RAI response also assumed that implementation of this SAMA would effectively eliminate the risk of temperature-induced SGTR events. This produced a large positive net value for this SAMA. As Indian Point is located near New York City, it may be expected that the dose savings might be very large there, whereas it might not be expected to be so large at Prairie Island where the local population is far lower. However, from the PINGP ER, Sections F.7.2.1.3 and F.7.2.1.4, SAMA-1 7 and SAMA-1 9a were found to work on the same set of core damage sequences as may be expected from this SAMA. SAMA 17 and SAMA 19a showed positive benefit to the SGTR avoided costs for both units (U2 more than Ul), although, overall, the numbers were negative based on the high costs of those modifications. Given the relatively lower implementation cost associated with this SAMA, this modification may be cost beneficial. This SAMA has been entered into the corrective action program for a more detailed examination of viability and implementation cost.

61

Enclosure 2 PINGP Calculation ENG-ME-148, Revision 1 10 Pages

Enclosure 2 PINGP Calculation ENG-ME-148, Revision 1 Piop 16oA, REV. 0 Page 1 of 2 (Front)

Retention: Ufe CALCULATION VERIFICATION CHECKUST Calculation No.: EWA - Revision No.:

Use of Computer for Cal ,ifttlon Manual Calculation (no computer results)

"Computer Verified Prograim (Reference _ Provides Verification)

R Unverified Program (Verification of Results Required)

Verification Ite, * (Refer Ito Site Engineering Manual, InItials DLate Admin Istrative Standard 1.2.3) 1.0 Purpose ttne;ueo th clulton ~is

- Clear objective and problem statement.

. Identification of affectted structure, system. end/or component.

use of the calculation results.

Identification of the Inntended nary results.

identificatlon of aumm

,"

2.0 Methodology

• Discussion of the metihod/opproach and major steps.

• Definition of any limits ltions of methodology.

0,;,.* .3.0 Acceptance Criteria

'Clear dofinition of the acceptance criteria. Is

.Exceptions clearly del ined.

'..4.0 Assumption*

Sufficient rationale to permit verification of assumption.

UHvrified assumptlions Identified a such.

References provi*ed Ior assumptions.

5.0 Design Inputs All applicable design Inputs Identified.

- CODES, (ASME. CFiR. STATE. aic)

- STANDARDS (IEEE. ANSI. ANS. ASTM. etc)

-USAR

- Design Criteria

- Input Data

- Regulatory Guldes/Rlequirements (NRC. EPA. STATE. etc.)

Design Bases Docur aents Appropriate verificatign ofwaIkdown information.

Ao ckcopr~

• .. *1.

1

Enclosure 2 PINGP Calculation ENG-ME-148, Revision 1 PINOP o108A, REV. 0

_ . Page 2 of 2 (Back)

CALCULATION VERIFICATION CHECKIST (Continued)

Yeriflcatlon Itm

6.0 Calculations

""

..:

' *Correct formulas/methods selected to support the problem objective.

Formula variables clearly labeled (Including engineering units) statement and and

ý Ivlbýs consistent with source references. Input/output.

• Review of computer program date for sketches.

Reference provided, as appropriate, of engineering

• *-Sufficientbases/rational provided to permit verification judgment . . -.

t __"

':' 7.0 Conclsons with the

- Clear statement of the calculation results and consistency problem statement and objective.

• Acceptability of the results clearly delined. provided. It applicable.

(z:P/941 i

-Recommendations for unacceptable results, Imposed by the calculation

-Clear definition of limitations or requirements necessary to maintain the v of the results.

I'.

10;0 Referencess.

Information /1

-All pages of the attachments labeled with. appropriate no.. number of sheets (attachment no., project calculation no.. revision

.(Sht of .. )

" 10.0 .

Administrative contrast to allow Calculation prepared neat and legibly with sufficient satisfactory copie8 to be produced.. ,

on each page.

Calculation number/revision and sheet number provided caics.

Revision block and revision bars completed for revised page numbering.

-All attachments provided are Included In . ..... ...  :

7%-.

o *Celculatlon's name and subject appropriately Identified. .. ,. .

Index.

-Calculation properly logged In the Site Analysis

-Analysis of Record form completed (PINGP 1075).

A V.

_____________________________________________

h _______________________________

2

Enclosure 2 PINGP Calculation ENG-ME-148, Revision 1

.LbF~

4.

• ';%7,!*::

.':' *;NOTHRN*rlr*PONIER-CGOMPANY,

';: -IF i 'i *

- PRARIE ISADNCERGENERATING PLANT CALCULATION 'COVER SHEET..

cuhto Rev. No.:.-- 0I,

• AdnaNo on _________

Ce~~cula~on =ile7177..-oZe rou~

I n~~~r..~~

.D...A .. n*...,... a. . ... ' n

, a culauon venrication Menoa: tuneCK One):

".Design',Revlew,`.-'.'!,i.Alternate'Calculation . . ualification Testing

.Av'caArs owv :kv 8

Scopeof6Re('lsfn: -,NA:AA o--  ;~~. tf, 4v T *rc,. . .

Documentation ofRvesanWprvl

- iDate. ,ii~'- 40, V erlfleldiBy:, * -' t b..... ........... Cole .:.* : ,.: Date -. '.: :..': . * *-. - *... . .' * '

• ,, .:.*"*,* .- . .  ; . r .... . -=-. - .. . 4....,..

4..........*..W  : ... ". ..

,- *.:.** .¢*

• ';  ;:?:.;.* ,* ,*::;:

. ,* - ",;

'; . . . . . .. . .. , . .

. .-- ... . . . *;

• 3

Enclosure 2 PINGP Calculation ENG-ME-148, Revision 1

,

AA12 ! n "

8hck o i

-0;e I 1.

.2.

FORM 1083 CALCULATION COVER SHEET INSTRUCTIONS Calculation Number - A unique calculation number is required for each NSP generated calculation in accordance with NPSP-E-7.1. Contact NPD General Superintendent Engineering for number assignment.

Calculation Revision and Addenda - Enter as appropriate. If this Is not a calculation addenda Input INA' In this field. (Addenda is a supplement to an existing calculation where as a revision Is a change to an existing calculation)

.3. Calculation Title - Enter Calculation Title

4. Safety Related - Indicate Yes or No (See 5 and 7 below)

5. Calculation Verification Method - Identify verification method used if required. Refer to ANSI N45.2.11-1974 or the Site Engineering Manual for additional guidance. This field is required for all safety-related calculations.

6. Scope of Revision - Enter as Appropriate. If original calculation, state "Original" In this field.

7. Documentation of Reviews and Approvals - Sign and date fields as needed.

Refer to the Site Engineering Manual for additional guidance.

NOTES:

A. All calculations require the signature of the Originator.

B. All calculations require checking (confirmation of numerical accuracy etc.)

and the signature of the checker.

0 C. Safety-related calculatloni require verification (confirmation of the appropriateness of calculation method, use of design Inputs, reasonableness of results, etc.). The originators supervisor Mm! not be the verifier.

D. All calculations require the signature of the Approver.

J.

0 4

Enclosure 2 PINGP Calculation ENG-ME-148, Revision 1 AKg CORPORATIaO 7O V537.4445 P.*2 "

"

AUG-02-05 VED 09:10 PRAIRIE ISLA.UD *fNIl FAX HO. 3305743 P.03 PINGP 108-, Rev. 1 Front Iaeof I Retenioni: Ufe NORTHERN STATE8 POWER COMPANY PRAIRIE ISLAND NUOL EAR GENERATING PLANT CALCULATII I COVER SHEET I"" -i '* __". '" I

• li* I I II -"

Calculation Number. E N ( - 1. ,

I: Calculation Rev. No.:Jill-~wx I * ý -

%%A 0 I II II-A.ddenda

" III No.:

ge- IFI

-

" _

IawaIonii -- I Calculation Verifloetion Method (Check One):

Design Review Alternate Calculation _ Quallficatlon Testing

. -

-7 * ., . ,T,..

scope of Revision:

11 Documientation -of Reviews and Approvals:

originated 13T 7g. Date:

Checked By:. Date:

Verified By: Date:

II Approved By: Datoe 5

Enclosure 2 PINGP Calculation ENG-ME-148, Revision 1 cr-Lc Ew--m - %4e~ iptwm o July 17, 1995 POSmION PAPER ON COOLING WATER HEADER PIPE FAILURE CAUSING FLOODING IN THE AUXILIARY FEEDWATER PUMP/INSTRUMENT AIR COMPRESSOR ROOM I. BACKGROUND The Prairie Island Individual Plant Examination (IPE) Report [Ref I] in Section 3.3.8 discusses the Internal Flooding Evaluation as Wa of the IPE process required by NRC Generic Letter 88-20. A Probabilistic Risk Assessment (PRA) on internal flooding was performed to determine potential vulnerabilities due to flooding from sources such as "tank overfilling, hose and pipe ruptures, and pump seal leaks." The report concludes that the tow core damage frequency (CDF) from internal flooding events for Prairie Island is 1.04 E-5/year. This constitutes 21 percent of the total CDF of 5.0 E-5 calculated in the study from ell events.

The single most significant flood that accounted for almost all of the CDF from internal flooding events was a flood in the Auxiliary Feedwater PumplIngstru Air Compressor Rooms due to a break of one of the two 24" Cooling Water (CL) loop header lines that traverse these rooms (Damage Class FEH-TB I of Reference I). The report postulates that the resulting flood will cause loss of all auxiliary feedwater pumps. loss of all instrument air, and loss of MFW pump lube oil cooling. Reactor trip is successful along with reactor coolant pump (RCP) seal cooling, Secondary cooling fails due to failure of auxilary feedwater (AFW) and main feedwater (MFW). Short term reactor coolant system (RCS) inventory f'ils due to loss of pressurizer power operated relief valves (PORVs) which fail closed on loss of instrument air. No other internal flood scenario had a significant impact on core damage.

The initial action item resulting from this PRA study was to quantify the rate of rise in water level inside the AFW room, to determine the most feasible solution to mitigate the impact of such a postulated flood, and to recommend modifications to the procedures and/or the CL piping and AFW rooms, if necessary. However, prior to proceeding with any major modifications to the plant as a result of this study, it was decided to perform a deterministic.

examination of the postulation of such a catastrophic pipe failure in a "moderate energy" line "

with guidance from current NRC regulatory positions and the PI licensing babss.

Review of this sequence of events has resulted in farther input on the possibilities of loss of main feedwater, condensate, and heater drain pumps due to loss of lube oil cooling- The break inthe auxiliary feedwater pump room is down stream of the tap for the turbine building which supplies the condensate, heater 'drain, and feedwater pumps lube oil cooling. Since there is enough pressure to force water out of the break (35psi per hydraulic analysis) this same pressure plus the friction head" will be available to provide flow to the turbine building.

Therefore cooling to these pum.; would be maintained even though it would be reduced. The turbine buildings cooling water supply also has isolation motor valves MV-32031,3 which can be closed to isolate the turbine biding from the break and has a cross connect that can be used to supply cooling water to both turbine buildings from either remaining cooling water header 6

Enclosure 2 PINGP Calculation ENG-ME-148, Revision 1 Position Paper on Aux, Feedwater Room Hlooding Page 2 July 17, 1995 should a break occur in the auxilary feedwater pump room. Since there are capabilitits to cool the main feed system pumps both during the break and after isolation it is not credible to assume that these pumps are lost due to the assumed break in the auxiliary feedwater pump area.

2, PURPOSE OF THIS POSITION PAPER The objective ofthis paper is to review the postulation of a double-ended guillotine pipe break in the cooling water header piping and its consequences. The break postulation is reviewed

- from a deterministic standpoint and is based on current Prairie Island licensing basis, plant

• material condition, and other factors.

This paper does not address other modifications suggested in the PRA study to lower the total CDF value, such as procedural changes to allow station air to be crosstied with the instrument air and others.

• 3. EFFECIS OF AND MITIGATING FACTORS FOR DOUBLE ENDED GUILLOTINE BREAK IN ONE CL LOOP HEADER Under the present plant configuration, an instantaneous and complete double-ended guillotine break in the 24-inch cooling water lobp header will result in a high flow of cooling water from

• , . both segments (normal and back flows) of the double-ended break. Ths large flow will result in the rise of water level of six inches in both AFW rooms within a few seconds. Six inch rise in water level inside the AFW rooms will result in the failure of electrical equipment in the rooms, loss of instrument air and the AFW pumps.

However, an instantaneous and complete double-ended break is not a design basis break, is outside the ur= licensing basis for the plant, and is a highly unlikely event. A more lely

,scenano could be a leak before a break in the headerpipin as aninitiating event The AFW rooms ve periodically walked through by operators, engineering and maintenan, . staf and .

security staff Any leak in the cooingwaer h er wll be asl noticeable and opertor action can be initiated within an houiof its occurrence. This provides assurance that any leak in the CL header loop piping will be detected and appropriate action taken before a major break in the line occurs.

Operations Manual HI0.2 [Ref 5] ,provides guidance for repairing code piping containing flaws that exceed code acceptance limits. This guidance is based on Generic Le*ter 90.05.

.The NRC stff reviews any leak before break analysis based on fracture mechanics technology utilring the procedures given in Reference 6. Ifflaws are detected in the CL piping. fracture mechanics technology can be applied "to demonstrate that high energy fluid system piping is very unlikely to experience double-ended ruptures or their equ;valent as longitudinal or 7

Enclosure 2 PINGP Calculation ENG-ME-148, Revision 1 CAIC FG-146-E-*a fIAenL by Positon Paper on Aux. Feedwater Room Flooding Page 3 July 17, 1995

• =-diagonal splits.":Ref. 6]. Thefore, administrative, operational and anlytical procedures are in place to provides sufficient assuranuc that flaws and through wall cracks- if detected, will be repaired or analyzed to avert any catastrophic failure of high or moderate energy piping systems such as the CL loop header"pping

4. OTHER WATER LINES INSIDE THE AFW ROOMS A 12-inch condensate make-up water li crosses the two AFW rooms in the trench. The pressure in this line is small and is equal to the head of water in the condensate nmke-up storage tanks. The material of construction is austenitic sted where the "eak-bforewbrea criterion for austenitic steel is well 'established and accepted by the NRC. Becae of its low pressure, a double ended break in this pipe isextremely unlikely and would not result inloss of lube oil cooling for the condensate, heater drain or the main feedwater supply system.

Smaller cooling water branch lines (6 and 4 inch branches from the CL loop header to the AFW pumps) inthe AFW room were replaced during the Cooling Water Header Replacemnt

• Project (92Yl70) in 1992, Here tio, the leak before break criterion is applicable. Any leaks occurring inthese pipes will be readily noticeable and can be isolated.

5. REVIEW OF THE MATERIALCONDITION AND LICENSING BASIS OF THE

• " CL SYSTEM

. The Cooling Water System is a safety related system designed and constructed to Design Class I and QA Type I standards. These standards of design and construction are much more stringent than the standard quality uutil inindustrial and fossil plant design and construction.

. :..

,* Additionally, the CL header pipmg was completely replaced d the two unit outagein

.November 199. The new piping is 33 percent thicker (Vi". compared to the original thickness of/*38"). Also the internal surface of the new header pipe is coated with an epox-y coating to..._.

inhibit adcrobiologicaly.induced co*rrosion (MIC). Th* additional margin above and beyond the design requirement should contribute to lowering .hefaildr frequency of the CL header piping.

A review of the licensing basis for the PI plant [Ref. 4] reveals that the CL system is not a high energy line (defined as those having a service temperature above 200*F Wd a design pressure above 275 psig). The licensing basis at PI does not postulate any breaks or cracks in piping systems that do not fall into the di tion of a high energy line. These low energy lines (as opposed to high energy lines) are ahalyzed and designed to the USAS B3 1.1-1967 piping code with no line breaks or cracks assumed.

I ýWMWINIINWý 8

PINGP Calculation Enclosure ENG-ME-148, 2 Revision 1 Position Paper on Aux. Feedwater Room Flooding Page 4 July 17. 1995 However, current regulatory position for cooling water (service water) system would place the CL system as a moderate energy line.: For this category, the NRC Standard Review Plan 3.6.1 and 3.6.2 (NURlG-0800) reviews the effects ofia through-Wall crack opening of M.the pipe dian--er in length and %the pipe wal thicknes w in idth be assumed at loca ons dat would result in the most severe environmental consequences. Per SRP 3.3.1, the fluid flow frm the crack should be based on a circular opening of are equal to the rectangular dtough-wall crack opening described above. It should be emphasized that this break criteria does not apply to the Prairie bland licensing basis but is presented here to quantify a break sie that would be reasonable, from current licensing viewpoint, for studying the flooding vulnerability in the AW rooms.

The postulated crack opening in the ooling water line will result in a 2r diameter hole in the 24" Loop A gr B line inside one of the two AFW rooms. Conservatively assuming that the pressure at the crack opening location to be equal to the operating pressure of 100 psig (this assumes no friction loss in the piping between the pumps and the crack location), the flow from a 2" diameter orifice is 673 gpmr [kef.' 3]. Supporting calculations performed by NS~a Nudear Analysis Department [Ref. 7] show that this flow rate can be readily handled by the Boor drains, trench, and the gap under the doors leading to the AFW rooms with less than 3 inch rise in water level. The water level in the adjacent AFW room will not rise above the 6" level necessary to cause the equipment in the rooms to fail even with the fire door in its fully open position. Therefore, these postulated break scenarios will not cause the loss of the second AFW pump per unit and at leant oninstrument air compressor.

Also, it has been judged that these break scenarios will not cause the loss of lube oil cooling for the main feed pump or the condensate pump as postulated in the report and as re-sted in the Background portion of this paper.'Prelimin*y evaluations regarding continuance of flow, during a postulated double ended break, through the 24" Turbine Building branch and ultimately the 3" supply line (3-2M-9) to the feedwater pump and the heater drain pump oil

• ~coolers ai well as the 1Is" supply line (I ts,2CLl7) to the condensate pump oil coolers hawe been perforied. Based upon these evaluaions it has belenjudged that there would be su*fi.ent S.......

' flow available. during a postulated b*r. to adequately supply die associated sets of pump oil.

coolers, The system engineers indi*ate from past exerience that the systems oil coolers a*e capable of flow interruption for periods exceeding an hour due to the mass in the system oi coolers without taking the pumps out of service. Also once operator actions to isolate the

• ,* break are initiated the cooling water flow to main water supply system lube oil coolers can be mint..ned.

Inil WT/

9

Enclosure 2 PINGP Calculation ENG-ME-148, Revision 1 rACF- Et - MT~-14-a9il i(A ý~C,Ft Position Paper on Aux. Feedwater Room Flooding Page 5 July 17, 1995

6. CONCLUSION This position paper has presented :deterministic arguments why the AFW rooms need not be modified as a result of the analysis from damage Class FEH-TBI - Flood w3th Loss oa Secondt.y Cooling and Bleed and Feed described in the PRA study [Ref. ]. These reasons are based on:

a a

The loss of the normal steam generator cooling is not a credible assumption due to flooding of the auxiliary feedwater pump room....

Instantaneous and complete double-ended break in the cooling water header loop I

piping is an etremely unlikely event and is outside the design and ficemsing basis for the system. The concept of leak-before-break! in moderate to low energy fines will provide suffcient warning time for initiation of operator action to isolate the loop and other measures.

0 A more reasonable scenario of a postulated crack in a moderate energy line, such as the cooling water header line, is supported by the arrent regulatoy positions although the Prairie Island licensing basis does not require the postulation of a crack ki the cooling water line. A crack in one of the two header loops will not cause th. loss of the equipment in the adjacent AFW room.

Therefore, it is Northern States Power's position that no modifications need be made to the AFWV rooms.

7. REFERENCES I. Prairie Island Individual Plant Examination (IPE), NSPLMI.94001, Rev. 0, Februry 1994.

2. Pipe Failure Study Update, EPRI Report, TR-102266, April 1993.

3. Calculation of the Flow Through a 2" diameter Orifice, NSP Calc. No. ENG-ME-148, Rev. 0 (attached).

4 Prairie Island FSAR, Appendix I.

5. Prairie Island Operations Manual H10.2, Rev. 0

6. "NRC Leak-Before-Break (LBB.NRC) Analysis Method for Circumferenially Trd*gh-Wanl Cracked Pipes Under Axial Plus Bending Loads" Topical Report NUREG/CR-4572, May 1986.

7. Detailed Analysis of Auxiliary Feedwater Pump Room Internal Flooding. NSP L&MI File V.SMN.94.006 prepared by D.R Biown, verified by R. Best, 4r7/94.

=11111111 10