ML15150A035

Memorandum Documenting Withdrawal and Planned Denial of Emergency License Amendment Request to Extend the Allowed Outage Time for an Emergency Diesel Generator

ML15150A035
Person / Time
Site:	Cook
Issue date:	07/08/2015
From:	Dietrich A Plant Licensing Branch III
To:	David Pelton Plant Licensing Branch III
Dietrich A
References
TAC MF6262
Download: ML15150A035 (22)

Text

July 8, 2015 MEMORANDUM TO: David L. Pelton, Chief Plant Licensing Branch III-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation FROM: Allison W. Dietrich, Project Manager /RA/

Plant Licensing Branch lIl-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

SUBJECT:

DONALD C. COOK NUCLEAR PLANT UNIT NO. 1 - WITHDRAWAL OF EMERGENCY AMENDMENT REQUEST (TAC NO. MF6262)

By application dated May 28, 2015 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML15149A412), as supplemented by two letters dated May 30, 2015 (ADAMS Accession Nos. ML15154B046 and ML15154B043), Indiana Michigan Power Company (I&M, the licensee) submitted an emergency license amendment request (LAR) for Donald C. Cook Nuclear Plant, Unit 1. The proposed amendment would allow for a one-time extension of the Completion Time (CT) for an inoperable emergency diesel generator (EDG).

The licensee requested an extension from the current CT of 14 days to 65 days in order to replace the crankshaft on the Unit 1 AB EDG. The amendment would also revise TS Surveillance Requirements (SRs) 3.8.1.2 and 3.8.1.3 to extend the Surveillance Frequencies from 31 days to 82 days, or within 3 days following the inoperable EDG being restored to service, and SR 3.8.1.7 to extend the Surveillance Frequencies from 92 days to 145 days, or within 3 days following the inoperable EDG being restored to service.

The U.S. Nuclear Regulatory Commission (NRC) staff in the Office of Nuclear Reactor Regulation (NRR) completed a review of the LAR and supplements provided by the licensee.

On May 30, 2015, during an internal NRC teleconference with staff and management from NRR, Region III (RIII), and the Office of the General Counsel, it was ultimately determined that the amendment request should be denied.

A teleconference was held on May 30, 2015, between NRRs Division of Operating Reactor Licensing (DORL), RIII, and I&M. During this teleconference, I&M was informed that the NRC staffs intention was to deny the emergency LAR. In accordance with NRR Office Instruction LIC-101, Revision 4, License Amendment Review Procedures, the DORL Division Director offered the licensee an opportunity to withdraw the amendment request. The licensee formally withdrew the LAR by letter dated June 1, 2015 (ADAMS Accession No. ML15154B045).

D. Pelton The enclosure contains the draft safety evaluation prepared by the NRC staff to document the basis for the planned denial.

Docket No. 50-315

Enclosure:

Draft Safety Evaluation

ML15150A035

• via email OFFICE NRR/DORL/LPL3-1/PM NRR/DORL/LPL3-1/LA NRR/DE/EEEB/BC NRR/DE/EPNB/BC NAME ADietrich MHenderson (JBurkhardt for) JZimmerman* DAlley*

DATE 6/10/15 6/3/15 6/5/15 6/5/15 OFFICE NRR/DRA/APLA/BC NRR/DRA/AFPB/BC NRR/DSS/STSB/BC OGC NAME SRosenberg* AKlein* RElliott BMizuno DATE 6/5/15 6/3/15 6/17/15 7/08/15 OFFICE NRR/DORL/LPL3-1/BC NRR/DORL/LPL3-1/PM NAME DPelton ADietrich DATE 7/08/15 7/08/15 DRAFT SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO DENIAL OF EMERGENCY LICENSE AMENDMENT REQUEST RENEWED FACILITY OPERATING LICENSE NO. DPR-58 INDIANA MICHIGAN POWER COMPANY DONALD C. COOK NUCLEAR PLANT, UNIT 1 DOCKET NO. 50-315

1.0 INTRODUCTION

By application dated May 28, 2015 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML15149A412), as supplemented by two letters dated May 30, 2015 (ADAMS Accession No. ML15154B046 and ML15154B043), Indiana Michigan Power Company (I&M, the licensee) requested changes to the Technical Specifications (TSs), Appendix A to Renewed Facility Operating License No. DPR-58, for the Donald C. Cook Nuclear Plant (CNP),

Unit 1.

The amendment would modify TS 3.8.1, AC [Alternating Current] Sources - Operating, to allow a one-time extension of the completion time (CT) for an inoperable emergency diesel generator (EDG). The amendment would extend the CT from 14 days to 65 days to allow for the replacement of the Unit 1 AB EDG crankshaft. The amendment would also revise TS Surveillance Requirements (SRs) 3.8.1.2 and 3.8.1.3 to extend the surveillance frequencies (SFs) from 31 days to 82 days, or within 3 days following the inoperable EDG being restored to service, and SR 3.8.1.7 to extend the SF from 92 days to 145 days, or within 3 days following the inoperable EDG being restored to service.

The license amendment request (LAR) was necessitated by damage caused to the Unit 1 AB EDG crankshaft due to a bearing failure during a post-maintenance test run on May 21, 2015.

The licensee requested that the U.S. Nuclear Regulatory Commission (NRC) staff process this submittal as an emergency amendment.

2.0 REGULATORY EVALUATION

The staff used the following NRC requirements and guidance documents to review the LAR:

Section 182a of the Atomic Energy Act requires applicants for nuclear power plant operating licenses to include TSs as part of the license. These TSs are derived from the plant safety analyses.

Enclosure

The regulations in Title 10 of the Code of Federal Regulations (10 CFR) paragraph 50.36(c)(2),

Limiting conditions for operation, require the TSs to include the limiting conditions for operation (LCO) and actions required to be taken by the licensee when the LCO is not met. Power operation may be initiated and continued without restriction only when the LCO is met.

Paragraph (a)(1)(i) of 10 CFR 50.46, Acceptance criteria for emergency core cooling systems for light-water nuclear power reactors, requires, in part, that each boiling or pressurized light-water nuclear power reactor fueled with uranium oxide pellets within cylindrical zircaloy or ZIRLO cladding must be provided with an emergency core cooling system (ECCS) that must be designed so that its calculated cooling performance following postulated loss-of-coolant accidents (LOCAs) conforms to the criteria set forth in 10 CFR 50.46(b). ECCS cooling performance must be calculated in accordance with an acceptable evaluation model and must be calculated for a number of postulated LOCAs of different sizes, locations, and other properties sufficient to provide assurance that the most severe postulated LOCAs are calculated.

The regulations in 10 CFR 50.63, Loss of all alternating current power, state that each light-water-cooled nuclear power plant must be able to withstand for a specified duration and recover from a station blackout (SBO).

The regulations in 10 CFR 50.65, Requirements for monitoring the effectiveness of maintenance at nuclear power plants, require that preventative maintenance activities must not reduce the overall availability of the systems, structures, or components (SSCs).

The CNP Plant Specific Design Criterion (PSDC) 39, Emergency Power, states that an emergency power source shall be provided and designed with adequate independency, redundancy, capacity, and testability to permit the functioning of the engineered safety features and protection systems required to avoid undue risk to the health and safety of the public. This power source shall provide this capacity assuming a failure of a single active component.

The regulations in General Design Criterion (GDC) 17, Electric power systems, of Appendix A, General Design Criteria for Nuclear Power Plants, to 10 CFR Part 50 requires, in part, that nuclear power plants have onsite and offsite electric power systems to permit the functioning of structures, systems, and components that are important safety. The safety function for each system (assuming the other system is not functioning) shall be to provide sufficient capacity and capability to assure that (1) specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences and (2) the core is cooled and containment integrity and other vital functions are maintained in the event of postulated accidents.

The regulations in GDC 18, Inspection and Testing of Electric Power Systems, of Appendix A, General Design Criteria for Nuclear Power Plants, to 10 CFR Part 50 requires, in part, that electric power systems important to safety shall be designed to permit appropriate periodic inspection and testing of important areas and features, such as wiring, insulation, connections, and switchboards, to assess the continuity of the systems and the condition of their components. The systems shall be designed with a capability to test periodically (1) the operability and functional performance of the components of the systems, such as onsite power sources, relays, switches, and buses, and (2) the operability of the systems as a whole and,

under conditions as close to design as practical, the full operation sequence that brings the systems into operation, including operation of applicable portions of the protection system, and the transfer of power among the nuclear power unit, the offsite power system, and the onsite power system.

NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, Branch Technical Position (BTP) 8-8, Onsite (Emergency Diesel Generators) and Offsite Power Sources Allowed Outage Time Extensions, February 2012 (ADAMS Accession No. ML113640138), states that the EDG Allowed Outage Time (AOT) should be limited to 14 days to perform maintenance activities.

Regulatory Guide (RG) 1.9, Selection, Design, Qualification, and Testing of Emergency Diesel Generator (EDG) Units Used as Class 1E Onsite Electric Power Systems at Nuclear Power Plants, Revision 3, July 1993 (ADAMS Accession No. ML003739929), provides recommendations for the EDG design and testing, which in general are used as guidance to develop the SRs for the EDGs.

RG 1.93, Availability of Electric Power Sources, Revision 1, March 2012 (ADAMS Accession No. ML090550661), provides guidance with respect to operating restrictions (i.e., AOTs) if the number of available alternating current (AC) sources is less than that required by the TS LCO.

In particular, this regulatory guide prescribes a maximum AOT of 72 hours3 days <br />0.429 weeks <br />0.0986 months <br /> for an inoperable onsite or offsite AC source.

RG 1.174, An Approach for Using Probabilistic Risk Assessment [PRA] in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, May 2011 (ADAMS Accession No. ML100910006), describes an acceptable method for licensees and the NRC to use for assessing the nature and impact of proposed changes to the licensing basis by considering engineering issues and applying risk insights. This regulatory guide also provides risk-acceptance guidelines for evaluating the results of such evaluations.

RG 1.177, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications, Revision 1, May 2011 (ADAMS Accession No. ML100910008), describes methods acceptable to the NRC for assessing the nature and impact of proposed permanent TS changes, including AOTs, by considering engineering issues and applying risk insights. This regulatory guide also provides risk-acceptance guidelines for evaluating the results of such assessments.

3.0 TECHNICAL EVALUATION

3.1 Reason for the Extension Request Prior to entering a scheduled maintenance work window on May 18, 2015, the Unit 1 AB EDG was run to verify Operability. During the pre-maintenance test run, all equipment performed as expected with operating parameters within their allowable ranges. During the post-maintenance test run of the Unit 1 AB EDG on May 21, 2015, a loss of oil film caused the Number 4 main bearing to contact its journal. This caused the EDG to trip on high bearing temperature. Upon inspection, it was determined that the bearing had failed or wiped, due to the loss of oil film

and contact with the journal. The EDG crankshaft was damaged, and the licensee determined that the crankshaft would need to be replaced.

The licensee stated that the apparent cause for the loss of oil film was that either the oil flow was interrupted, or the oil viscosity was low due to high oil temperature. The Number 4 main bearing has the thinnest oil film of all of the EDG main bearings because it is the most heavily loaded main bearing. It also has a full oil channel on the upper bearing half and a quarter oil channel on the lower bearing half, while the other main bearings have a full oil channel on both halves.

The replacement of the EDG crankshaft is an evolution that requires uncoupling of the generator from the engine, disassembly and reassembly of the engine, and removal of a wall to allow for replacement of the crankshaft. The licensee requested a CT extension to 65 days to perform the crankshaft replacement on Unit 1 AB EDG.

The licensee stated that the safety function of the EDGs will continue to be met with one train inoperable and additional compensatory measures implemented. Therefore, the licensee requested a one-time change to TS 3.8.1 that would allow continued operation with one inoperable EDG. The CNP Unit 1 has two permanent supplemental diesel generators (SDGs).

These are designed to provide a backup AC power source to the emergency bus for either Unit 1 or 2. The SDGs have adequate capacity to power required safe shutdown loads in the event of a loss of offsite power (LOOP) and failure of the operable EDG.

3.2 Proposed TS Changes LCO 3.8.1 in the CNP Unit 1 TS states, in part, that two EDGs capable of supplying emergency power shall be Operable in Modes 1 through 4. According to the CNP Unit 1 TS, Mode 1 is Power Operation, Mode 2 is Startup, Mode 3 is Hot Standby with average reactor coolant temperature greater than 350 degrees Fahrenheit (°F), and Mode 4 is Hot Shutdown with average reactor coolant temperature between 200 °F and 350 °F.

CNP TS 3.8.1, Condition B, One required DG inoperable, states that the CT for restoring a required EDG to Operable status is 14 days AND 17 days from discovery of failure to meet LCO 3.8.1.a or b. The licensee proposed a one-time amendment to add a footnote to the CT, which would state:

For the Unit 1 AB DG only, the Completion Time that the DG can be inoperable as specified by Required Action B.5 may be extended beyond the 14 days AND 17 days from discovery of failure to meet LCO 3.8.1.a or b up to 65 days AND 65 days from discovery of failure to meet LCO 3.8.1.a or b, to support repair and restoration of the Unit 1 AB DG. Upon completion of the repair and restoration, this footnote is no longer applicable and will expire at 0010 on July 22, 2015.

I&M also proposed adding a footnote to the SFs for SRs 3.8.1.2, 3.8.1.3, and 3.8.1.7. These SRs are due to be performed within the next 65 days, but cannot be performed while the Unit 1 AB EDG is inoperable.

For SR 3.8.1.2 and 3.8.1.3, the footnote would state:

For the duration of the repair and restoration of the Unit 1 AB DG failure which occurred on May 21, 2015, the Surveillance Frequency for the Unit 1 CD DG is extended to 82 days, or 3 days following the restoration of the Unit 1 AB DG, whichever is first.

For SR 3.8.1.7, the footnote would state:

For the duration of the repair and restoration of the Unit 1 AB DG failure which occurred on May 21, 2015, the Surveillance Frequency for the Unit 1 CD DG is extended to 145 days, or 3 days following the restoration of the Unit 1 AB DG, whichever is first.

The licensee stated that the difference in the footnotes is due to the length of the SF for each SR, the time when each was last performed, and the length of the requested AOT extension.

3.3 Description of the CNP Electrical Power System 3.3.1 Description of the Offsite Power System The preferred offsite power source auxiliary system for both units can be arranged so that transformer No.4 supplies Reserve Auxiliary Transformers (RATs) TR101CD and TR201CD, while transformer No.5 supplies RATs TR101AB and TR201AB. Each RAT is equipped with an automatic load tap changer (33 total steps, neutral, 16 raise, 16 lower) and has the following ratings: 18/24/30 Mega-Volt Ampere (MVA), 34.5/4.36 kiloVolt (kV). The automatic load tap changers are capable of varying the transformer secondary voltage by +/- 15 % of the 4360 Volt (V) rated voltage. The engineered safety feature loads are sequenced onto the RATs, under accident conditions, using the same timing relays and sequence as used for the EDG sequencing. The RATs supply the reserve auxiliary power for both units. Under certain plant conditions and grid loading conditions, and with proper precautions and limitations, it is possible for either transformer No.4 or transformer No.5 to feed the entire plant auxiliary load.

A 69 kV line operating on a right-of-way off the plant property has been tapped to feed a 7500 kilo-Volt Ampere (kVA) 69/4.16 kV transformer TR12EP-1 located at the plant site. This transformer has the necessary capacity to operate the engineered safeguard equipment of one train in one unit while supplying the safe shutdown power of one train in the other unit. This 4160 V power is used as the alternate offsite power source to both units and is manually connected to 4160 V buses T11A, T11B, T11C, and T11D. The breakers which connect this source to the 4160 V buses are interlocked so they will not close if any other 4160 V bus source is closed. In addition, the availability of the 69 kV alternate offsite power source is constantly monitored and its loss annunciated.

3.3.2 Description of Emergency Power System The emergency power sources for CNP Units 1 and 2, including the EDGs, are similar and are electrically and physically isolated from one another. Each unit has two full capacity EDGs, each supplying power to two safety-related 4160 V buses. Upon sensing a loss of power to the

safety-related buses, the EDGs automatically start and align to provide power to the buses within 10 seconds. If either EDG fails to start, the remaining one is capable of supplying the required load. The EDGs are sized at 3500 kilowatts each to assure available power to operate one train of safety equipment assuming a LOOP concurrent with a LOCA.

CNP Updated Final Safety Analysis Report (UFSAR), Section 8.1.2, Functional Criteria, provides functional requirements employed on electrical systems to achieve maximum reliability and operating efficiency. One of the criteria is that motor loading does not exceed its nameplate rating.

Each diesel engine is a Worthington Type SWB-12, 12-cylinder, heavy-duty turbocharged diesel engine with a continuous rated output of 4900 brake horsepower at 514 revolutions per minute.

The AC sources are designed to permit inspection and testing of all important areas and features, especially those that have a standby function, in accordance with PSDC 39. Periodic component tests are supplemented by extensive functional tests during refueling outages under simulated accident conditions.

The supporting requirements for demonstrating operability of the EDGs are in accordance with the recommendations of NRC RG 1.9 and the Institute of Electrical and Electronic Engineers (IEEE) Standard 387-1995, IEEE Standard Criteria for Diesel-Generator Units Applied as Standby Power Supplies for Nuclear Power Generating Stations.

CNP also has an independent onsite, standby AC power source consisting of two SDGs, which automatically supply power to 4.16 kV EP Bus 1. EP Bus 1 is normally supplied by the 69 kV alternate qualified offsite circuit and can be manually aligned using control room (CR) procedures to directly supply a 4.16 kV emergency bus. On loss of the offsite qualified 69 kV circuit/power, the SDGs automatically start and energize the EP Bus 1, in standby, ready for CR action to align them to a safety bus.

3.3.3 Station Blackout UFSAR Section 8.7 describes how CNP meets the SBO requirements mandated by 10 CFR 50.63. SBO refers to the complete loss of AC electric power to the essential and non-essential switchgear buses in a nuclear power plant, such as would occur with a loss of offsite electric power concurrent with a turbine trip and unavailability of onsite emergency AC power.

SBO does not include the loss of available AC power to buses fed by station batteries through inverters or by alternate AC power sources, nor does it assume a concurrent single failure or a design-basis accident. At CNP, which is a two-unit nuclear station, SBO is postulated to occur in only one unit since the emergency AC power sources are not completely shared by the two units. The determination of the specified period that the plant is required to cope with a SBO is based on the probability of an SBO at the site as well as the capability for restoring power. The calculated minimum acceptable SBO coping duration is determined to be 4 hours0.167 days <br />0.0238 weeks <br />0.00548 months <br /> for CNP.

3.4 Deterministic Evaluation RG 1.93 provides guidance with respect to operating restrictions, such as AOTs, if the number of available onsite EDGs and offsite power sources is less than that required by the TS. In

particular, RG 1.93 prescribes a maximum AOT of 72 hours3 days <br />0.429 weeks <br />0.0986 months <br /> for an inoperable onsite or offsite power source. 10 CFR 50.36(c)(2 requires that the TS include LCOs, which are defined as the lowest functional capability or performance levels of equipment required for safe operation of the facility. Furthermore, it requires that, when an LCO of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the TS until the condition can be met. The regulatory position described in RG 1.93 is to ensure that a nuclear power plant is in an acceptably safe operating mode whenever the available electric power sources are less than the TS LCO. In addition, the licensees should severely restrict the time allowed for continued operation of a nuclear power plant with less than the required redundant onsite power sources.

The NRC staff developed and issued BTP 8-8 (ADAMS Accession No. ML113640138) in February 15, 2012, to provide guidance for allowing licensees to perform required plant maintenance to maintain the reliability and availability of onsite power sources consistent with the maintenance rule requirements. The purpose of this BTP is to provide guidance from a deterministic perspective in reviewing such amendment requests. The BTP states:

the EDG or offsite power AOT should be limited to 14 days to perform maintenance activities. This time period is based on industry operating experience for performing major maintenance which occurs only every 6 -10 years; for example, a maximum of 216 hours9 days <br />1.286 weeks <br />0.296 months <br /> (13.5 days, consisting of two shifts, each shift working 8 hours0.333 days <br />0.0476 weeks <br />0.011 months <br />) is considered to be sufficient for a major EDG overhaul or offsite power major maintenance. The licensee must provide justification for the duration of the requested AOT (actual hours plus margin based on plant-specific past operating experience). An EDG or offsite power AOT license amendment of more than 14 days should not be considered by the staff for review.

The NRC staffs expectation is that the licensees use the 14-day LCO on rare occasions to perform preventive maintenance. As stated above, the regulatory position for safe operation of the facility with an inoperable onsite power source is 72 hours3 days <br />0.429 weeks <br />0.0986 months <br />.

The NRC staff has reviewed the licensees apparent cause for the damaged Number 4 main bearing and agrees that either low oil flow or low oil viscosity due to high oil temperature was the likely cause for the damage to the Number 4 main bearing. The Number 4 main bearing is most susceptible to damage because it has the thinnest oil film of all of the EDG main bearings, and it has a full oil channel on the upper bearing half and only a quarter oil channel on the lower bearing half.

The licensee stated that the current timeline for repairs is 56 days, which would result in a completion time of 65 days. This timeline includes 6 days of margin, which is approximately 9 percent of the 65-day CT. The NRC staff has reviewed the licensees timeline, and considers it reasonable for the complexity of the repairs. These repairs include numerous complex tasks, such as removing/installing intake, exhaust, and jacket water headers; disconnecting/connecting support system piping connections; removing/installing support system equipment; uncoupling and removing/installing the generator; removing/installing a block wall of the room; and lifting the top half of the engine off of the base and later replacing it.

The licensee stated that the timeline for repair and restoration of the Unit 1 AB EDG would not allow for the plant conditions to accommodate the performance of the Unit 1 CD EDG monthly fully loaded surveillance, as the Unit 1 CD diesel is rendered inoperable during the completion of SRs 3.8.1.2, 3.8.1.3, and 3.8.1.7. SRs 3.8.1.2 and 3.8.1.3 were last completed on May 5, 2015, and must be completed again no later than June 12, 2015. SR 3.8.1.7 was last completed on March 3, 2015, and must be completed again no later than June 26, 2015. An extension to these three SFs would be required in order to delay the completion of these SRs until after the repair and restoration of the Unit 1 AB EDG. Performing surveillances on the operable EDG could potentially challenge the safe operation of the plant.

The licensee stated that for this one-time CT extension, CNP will reduce plant risk exposure through a combination of risk management actions that prevent planned high-risk configurations. Since the One-time CT extension will exceed the CNP Maintenance Rule (a)(4) on line risk assessment criteria for "Normal" risk conditions for both online risk from the internal events model and fire risk considerations, risk management actions will be required. These actions are taken to minimize the higher risk concerns associated with long term unavailability of the Unit 1 AB EDG. The licensee will also reduce risk through other measures such as ensuring the availability of additional power supplies requiring manual actions. As a mitigating measure, CNP will stage a temporary non-safety diesel generator (NDG) capable of supplying power to the Train B 4.16 kV emergency bus within the CNP protected area. The NDG will be connected to the bus should a LOOP event occur. The NDG can supply power to one train of equipment required to maintain the affected unit in a safe and stable state for a 24-hour period in the event of an SBO. The NDG will be kept in non-running, standby alignment to prevent excess fuel consumption and damage due to long-duration, unloaded operation, which can cause diesel generator reliability problems. The NDG fuel tank will be kept full, and the generator output connections will be made to the low potential side of the 480 V/4.16 kV step-up transformer.

This configuration has been previously analyzed by the CNP probabilistic risk assessment (PRA) model to provide successful outcomes for a LOOP and subsequent failure of a single installed SDG.

The licensee has proposed changes to allow for continued operation of CNP for a period of up to 65 days with one operable EDG and continued use of two SDGs. The NRC staff reviewed the capability of the power sources to mitigate the design-basis accidents, events, and conditions. By electronic mail dated May 28, 2015 (ADAMS Accession No. ML15149A217), the staff requested that the licensee explain how the plant mitigates the consequences of the following events when the plant is operating with one EDG out of service for 65 days. This information was necessary in order to determine whether the licensee can operate the plant safely within its design and licensing bases with acceptable defense-in-depth and safety margins. The three events considered, which are evaluated in the CNP Unit 1 UFSAR, were (1) LOOP, (2) SBO, and (3) LOOP with LOCA and a single failure of the operable EDG.

By letter dated May 30, 2015 (ADAMS Accession No. ML15154B046), in response to the NRC staffs request for additional information (RAI), the licensee provided evaluations of these three events. The licensees evaluation included the automatic plant response, operator actions, available power sources, and completed operator training for each event. The NRC staff reviewed the licensees response to ensure that the proposed CT extension would meet the requirements of 10 CFR 50.46, 10 CFR 50.63, and PSDC 39.

For LOOP and SBO events, the licensees discussion included the use of SDGs, NDGs, Diverse and Flexible Coping Strategies (FLEX) for an extended loss of AC power event, and manual operator actions to align alternate power sources to the emergency bus. The NRC staff concludes that, during the proposed CT extension period, CNP can mitigate the consequences of a LOOP and an SBO event at CNP Unit 1. This conclusion is based upon the availability of SDGs, the NDG, and FLEX equipment, and also upon adequate operating procedures and operator training.

In its discussion of a LOOP with LOCA and a single EDG failure, the licensee stated that this event is beyond the plant design basis, and that neither the SDGs nor the NDG is designed to mitigate a LOCA coincident with an SBO. In this scenario, the operators would perform the actions for an SBO. These include actions to minimize reactor coolant system (RCS) inventory loss, ensure secondary heat sink, and restore a source of AC power. The licensee stated that, the success in these strategies in preventing core damage would depend on the size of the RCS LOCA and the power source restored. If the SBO strategies are not successful at preventing core damage, the operators will follow the Severe Accident Mitigation Guidelines to protect the remaining fission product barriers and minimize release to the public.

3.4.1 Conclusion Regarding Deterministic Evaluation The NRC staff reviewed the licensees responses discussed above and the one-time 12 Regulatory Commitments and compensatory measures specified in the LAR and supplements.

The NRC staff concludes that the regulatory commitments to implement restrictions and compensatory measures would ensure the availability of the remaining sources of AC power for LOOP and SBO scenarios during the one-time extended CT period (65 days) for EDGs. The staff also concludes that, during the proposed CT extension period, CNP can mitigate the consequences of a LOOP and an SBO event at CNP Unit 1 based on an operable direct current power system, SDGs, the NDG, FLEX equipment, operating procedures, and operator training.

However, the NRC staff determined that CNP would not be able to mitigate the consequences of a LOOP and LOCA with a single failure of the operable EDG during the proposed CT extension period. The current CNP TS allows a CT of 14 days for the condition of one inoperable EDG. During the permitted CT, the accident analysis assumption of a single failure of the operable EDG is not met. The licensees requested CT extension from 14 days to 65 days would permit vulnerability to a single failure for an additional 51 days. This would result in an unacceptable decrease in the margin of safety and defense-in-depth, because a LOOP with a LOCA would lead to core damage without an adequate power supply. The SDGs and NDG are not able to supply power to the loads for accident mitigation within the time constraints of the accident analyses assumptions.

The alternate power sources and compensatory measures, as specified in the LAR and RAI response, are not capable of mitigating the consequence of design-basis accidents, events, and conditions, as specified in CNP Unit 1 UFSAR Chapter 14. Therefore, the NRC staff concludes that the licensees request to extend the CT for restoring an inoperable EDG should not be approved, based on the deterministic evaluation.

3.5 Probabilistic Risk Assessment In evaluating the risk information submitted by the licensee, the NRC staff followed the three-tiered approach documented in RG 1.177, Revision 1.

Under the first tier, the NRC staff determines if the proposed change is consistent with the NRCs Safety Goal Policy Statement, as documented in RG 1.174. Specifically, the first tier objective is to ensure that the plant risk does not increase unacceptably during the period the equipment is taken out of service.

The second tier addresses the need to preclude potentially high-risk plant configurations that could result if additional equipment, not associated with the change, is taken out of service during the proposed 65-day AOT.

The third tier addresses the establishment of a configuration risk management program for identifying risk-significant configurations resulting from maintenance or other operational activities, and taking appropriate compensatory measures to avoid such configurations.

RG 1.177 clarifies that for one-time only changes to CTs, the frequency of entry into the CT is known, and the configuration of the plant SSCs can be established. Further, there is no permanent change to the plant core damage frequency (CDF) or large early release frequency (LERF), and hence the risk guidelines of RG 1.174 cannot be applied directly . The following TS acceptance guidelines specific to one-time only CT changes are provided for evaluating the risk associated with the revised CT:

1. The licensee has demonstrated that implementation of the one-time only TS CT change impact on plant risk is acceptable (Tier 1):

• Incremental conditional core damage probability (ICCDP) of less than 1.0E-06 and an incremental conditional large early release probability (ICLERP) of less than 1.0E-07, or

• ICCDP of less than 1.0E-05 and an ICLERP of less than 1.0E-06 with effective compensatory measures implemented to reduce the sources of increased risk.

2. The licensee has demonstrated that there are appropriate restrictions on dominant risk-significant configurations associated with the change (Tier 2).

3. The licensee has implemented a risk-informed plant configuration control program. The licensee has implemented procedures to utilize, maintain, and control such a program (Tier 3).

The licensee evaluated the circumstances leading to the failure of the Unit 1 AB EDG, which occurred during the first minutes of post-maintenance operation testing to determine whether there is a potential for common mode failure of the other diesels. An inspection of the Number 4 bearing surfaces showed them to be wiped, and the cause of the wiped bearing is still pending further analysis. While it is likely that the failed bearing is a direct result of the maintenance

performed on Unit 1 AB EDG, the potential for a common failure mode on the remaining EDGs cannot be ruled out. The licensees risk assessment assumes nominal failure probabilities for the remaining EDGs. However, since the exact cause of the failed bearing is unknown, this assumption may be invalid. Therefore, the values of the ICCDP and ICLERP are indeterminate, and the licensees risk evaluation may be inaccurate.

3.5.1 Quality of the PRA Models The technical adequacy of the PRA must be compatible with the safety implications of the TS change being requested and the role that the PRA plays in justifying that change. The licensee stated that the increase in the internal events risk comes exclusively from LOOP-initiating events leading to SBO events. There are a large number of AC power sources during most non-LOOP initiators and the impact of the loss of one source is limited. The increase in fire risk comes from transformer yard fires which are effectively LOOP events. Fire events that lead to reactor coolant pump (RCP) seal LOCAs also contribute to fire risk increases because of degraded injection and cooldown capabilities without the 1 AB EDG. The risk increases due to fire events are greater than the internal event increase which is consistent with the capability of fires to destroy multiple components simultaneously.

By application dated July 1, 2011 (ADAMS Accession No. ML111880961), as supplemented, the licensee submitted an LAR requesting transition to a risk-informed performance-based fire protection program (National Fire Protection Association (NFPA) Standard 805) in accordance with 10 CFR 50.48(c). The NRC staff reviewed the NFPA 805 submittal and supplements and issued revised fire protection license conditions in each units license by letter dated October 24, 2013 (ADAMS Accession No. ML13140A398). The NRC staffs review of the NFPA 805 LAR included a comprehensive review of the quality of the licensees fire PRA and, as needed to support the fire PRA, the internal events PRA. The NRC staffs review of the acceptability of the quality of the PRA performed to support the extended CT request is based on the review of the PRA to support the NFPA 805 LAR, supplemented by consideration of the changes made to the PRA after the October 24, 2013, amendment was issued.

3.5.2 Internal Events PRA In the May 28, 2015, request for CT extension, the licensee clarified that a 2009 Internal Event and Internal Flooding PRA was the last model of record. This model of record was reviewed during the NFPA 805 review and was used to develop the fire PRA. In the 2011 NFPA 805 LAR, the licensee provided its dispositions to all facts and observations (F&Os) from a 2001 Westinghouse Owners Group (WOG) peer review, a 2004 gap self-assessment, and a 2009 focused-scope peer review. The NRC staff reviewed all the F&Os provided by the peer reviewers and determined that the resolution of every F&O supports the determination that the quantitative results are adequate to support the fire PRA. Loss-of-power events are dominant fire risk contributors, so the NFPA 805 NRC staff review included consideration of the internal events loss-of-power models.

The licensee stated that the 2009 internal events model of record has been updated to incorporate recent plant changes and to better reflect accepted industry modeling practices and updated CNP and industry data. The updated model has been scheduled for a July 2015 peer review. In a supplement to the LAR dated May 30, 2015 (ADAMS Accession

No. ML15154B043), the licensee provided information about all modifications made to its 2009 model of record and how each modification affected the application-specific risk results.

Most of the modifications reported had a limited impact on the quantitative results, but one modification increased some common cause failure probabilities which significantly increased the calculated risk results. The internal events CDF increased from 1.412E-05/year in the 2009 model of record to 1.268E-04/year in the updated model, a factor of about ten. Another modification was that the LERF analysis had been updated using the guidance in Simplified Level 2 Modeling Guidelines, WCAP-16341-P, Rev. 0, November 2005. The licensee reported that the internal events LERF increased from 2.867E-06/year in the 2009 model of record to 4.237E-06/year in the updated model, a factor of about two. The smaller LERF increase than CDF increase is consistent with a larger CDF increase moderated by a less conservative LERF analysis. The reported change in risk associated with the CT extension increased for CDF and decreased for LERF. Modification to the PRA to support specific licensing actions are common, but a review of these modifications is not feasible with the limited time available for this emergency CT extension request.

The NRC staff concludes that the quality of the licensees internal events PRA is sufficient to support the extended CT request assuming that defense-in-depth and safety margin considerations are satisfied. The NRC staff reached this conclusion based on the detailed review of the PRA reported in the October 24, 2013, NFPA 805 safety evaluation and no identification of any unreasonable modifications described in the extended CT request. A sensitivity study using the 2009 internal events model of record instead of the updated model was provided by the licensee and supports the finding that the PRA results can be used to support the extended CT request.

3.5.3 Fire PRA The May 28, 2015, request for CT extension reported that the fire PRA model of record was created during the NFPA 805 transition. The May 30, 2015, supplement (ADAMS Accession No. ML15154B043), reported several modifications to the fire PRA model of record to support the extended CT request.

In one change to the fire PRA model of record, the licensee extended credit for the auxiliary feedwater and charging and volume control cross-tie capability to also include the capability to mitigate RCP seal failures. The licensee provided extensive documentation of its evaluation supporting the inclusion of the success path. The NRC staff noted that detailed thermal hydraulic and human action analyses were done which demonstrates that the licensee applied appropriate PRA methods to develop and quantify the new success path. The NRC staff concludes that this new success path evaluation is acceptable because the licensee used generally acceptable PRA methods, such as realistic thermal hydraulic calculations and plant operator supported human reliability evaluations.

In a second change to the fire PRA model of record, the licensee adjusted the stress levels for several human actions from high to moderate, which reduces the human error probability (HEP) associated with the action. The licensee provided justification for the changes in the stress levels based on timing and training considerations and reported that operator phone interviews were conducted to verify the proposed levels. HEP methods require assigning stress level to

actions, but the level that should be assigned to any given action is part of the engineering evaluation. The NRC staff concludes that the assigned levels are acceptable because the licensee used generally acceptable PRA methods, including interaction with the plant operators to modify the stress levels. The licensee did not inappropriately assign any low stress levels.

A third change to the fire PRA model of record was to use the new LERF model in the fire PRA instead of the model in the 2009 internal events model of record. As discussed above, the new LERF model was developed using generally acceptable methodology, and the plant-specific implementation of this method was subjected to an independent review. The NRC staff concludes that this change is acceptable to support the extended CT request because such upgrades to methods generally are improvements, and the independent review, instead of a focused-scope peer review, is sufficient for a one-time change.

The NRC staff concludes that the quality of the licensees internal events PRA is sufficient to support the extended CT request, assuming that defense-in-depth and safety margin considerations are satisfied. The NRC staff reached this conclusion based on the detailed review of the fire PRA reported in the October 24, 2013, NFPA 805 safety evaluation, and a review of the PRA modifications described above that indicated the licensee used acceptable PRA methods.

3.5.4 Evaluation of Seismic Risk The licensee based its seismic evaluation on the individual plant evaluation of external events (IPEEE) seismic assessment. The licensee states that the top seismic risk contributors are auxiliary building collapse, loss of electrical systems, and ice condenser failures. The licensee further stated that the contribution to risk from auxiliary building collapse or from ice condenser failures is not affected by the unavailability of the Unit 1 AB EDG. The licensee also referenced the results of an assessment based on the IPEEE performed by the licensee in 2010, which concluded that the seismic contribution of the Unit 1 AB EDG being unavailable for 1 month results in an ICCDP of 1.95E-09. A 2-month unavailability would double the associated risk.

The licensee concludes that the proposed Unit 1 AB EDG CT extension has minimal impact on the seismic contribution to risk.

The NRC staff concludes that the licensee has provided sufficient information to support this seismic risk evaluation.

3.5.5 Other External Hazards The licensee reviewed its IPEEE evaluation of other external hazards, which included high winds and tornadoes, shipping which could affect the ultimate heat sink, hazardous materials, and turbine-generated missiles. The licensee assessed that the unavailability of the Unit 1 AB EDG would not affect the initiators related to these external events, and is not expected to affect plant response for shipping, hazardous material, and turbine missile events, due to the existence of multiple source of offsite AC power to the plant. The licensee stated that the IPEEE study concluded that contribution to risk from high winds and tornadoes was insignificant due to the low frequency of wind, tornadoes, and tornado-induced missiles. The licensee further assessed that unavailability of the Unit 1 AB EDG would affect plant response to those high winds and tornado events that cause a LOOP. However this consideration is included in

the licensees risk assessment through the internal events PRA model, which addresses frequency of LOOP events in the industry, including severe weather LOOP.

The NRC staff concludes that the licensee has provided sufficient information to support this external hazard risk evaluation.

3.5.6 Shutdown Risk The licensees submittal did not discuss shutdown risk, since the proposed change is only applicable during power operations. This is conservative, since the licensee is avoiding additional shutdown risk by completing EDG repairs during operation.

3.5.7 Risk Impact of the Proposed Change (Tier 1)

Tier 1 assesses the risk impact of the proposed change in accordance with acceptance guidelines that are consistent with the Commission Safety Goal Policy Statement, as documented in RGs 1.174 and 1.177. The risk impact of the proposed extended CT was calculated over the full 65 days.

The ICCDP and ICLERP risk metrics were evaluated assuming that the Unit 1 AB EDG is unavailable during the 65-day outage interval. The licensee assessed the increased failure probabilities caused by the extension of the surveillance intervals in SRs 3.8.1.2, 3.8.1.3, and 3.8.1.7. Increased probabilities were estimated based on a linear increase per unit time the surveillance interval increased, which is a logical and acceptable method. No increase was used for TS 3.8.17 because multiple additional component failures are needed, causing a negligible increase in probability.

Other required surveillance for equipment unrelated to the diesels will need to be performed, which might make the equipment unavailable during the surveillance. The license stated that unavailability increases for all required surveillance runs with a short duration of 15 minutes or less were not included. A 15-minute exposure time during the typical 1-to-3-month surveillance interval is negligible. The licensee evaluated the possible increase in risk caused by reactor trips during these surveillance runs by increasing the transient initiator event frequency by a factor of 10, and determined that it had a negligible impact on the calculated results.

The licensee also noted that a wall that must be removed during the repair of the Unit 1 AB EDG is a high energy line break (HELB) barrier. The licensee estimated the risk associated with removal of the barrier and determined that the contribution to risk was negligible.

Additionally, unavailability of three components that were out of service during the initial period of the CT, and which have since been returned to service, were included in the 65-day risk calculation. This is a conservative calculation. The one-time CT extension request is based on the current and anticipated known plant conditions, and used the zero-maintenance PRA models. This means that all nominal test and maintenance unavailability was removed from the PRA. Use of zero-maintenance models is allowed by RG 1.177 with justification. Zero-maintenance models are normally used in one-time CT extensions such as this emergency request because the nominal operating status of all equipment is known.

The licensee stated that the internal events PRA was updated, the LERF model was redone, and some modifications were made to the fire PRA (including using the new LERF model). In its supplement dated May 30, 2015, the licensee provided the extended CT ICCDP and ICLERP separately for fires and for internal events, and these results are provided in Table 1 below.

Inspection of the reported results confirms that the ICCDP values are less than 1.0E-05 and ICLERP results are less than 1.0E-06, and therefore satisfy the acceptance guidelines in RG 1.177, provided that compensatory measures are implemented to reduce the sources of increased risk.

Table 1: ICCDP and ICLERP Results for 65-Day Completion Time Case ICCDP ICLERP Fire PRA only 3.49E-06 1.42E-07 2009 Internal Events PRA and Fire PRA 4.47E-06 2.46E-07 Updated Internal Events PRA and Fire PRA 4.13E-06 2.46E-07 RG 1.177 reports that previous sensitivity analyses performed for risk-informed TS changes have shown that the risk resulting from TS CT changes is relatively insensitive to uncertainties.

This is because the uncertainties associated with CT changes tend to similarly affect the base case before the change, and the changed case. That is, the risks result from similar causes in both cases, as no new initiating transients or subsequent failure modes are likely to have been introduced by relatively minor CT changes.

The NRC staff concludes that the calculations performed by the licensee to determine the ICCDP and ICLERP caused by the requested CT extension, and other supplemental effects, are reasonable and acceptable.

3.5.8 Avoidance of Risk-Significant Plant Configuration (Tier 2)

Tier 2 identifies and evaluates potential risk-significant plant configurations that could result if equipment, other than that associated with the proposed LAR, is taken out of service. Tier 2 also evaluates other risk-significant operational factors, such as concurrent system or equipment testing. The licensee has identified risk-significant plant equipment for both units that will be administratively protected and not voluntarily removed from service for any routine work activities during the extended EDG outage. The licensee committed to avoid elective maintenance or test activities that could lead to a unit trip, excluding TS-required surveillances, unless needed to address emergent failures.

In Section 3.3 of the LAR, the licensee separately evaluated the impact of the unavailable EDG on initiating events associated with internal events, internal flooding events, and fire risk. For each type of initiating event, the licensee identified the scenarios most affected by the unavailable EDG. The results of the evaluation include both equipment that would be protected, and actions to be taken to reduce the frequency or consequences of the scenarios. The licensee also proposed actions that will be taken to increase the general awareness of the increased risk from these scenarios.

Fires are significant contributors to the elevated risk during the extended CT. Both Unit 1 and Unit 2 plant operators and fire brigade crews will be made aware of the out-of-service EDG.

The licensee identified fire zones where fires have the potential to damage Unit 1 Train A

equipment, such as the Unit 1 CD EDG Room, and the licensee will not perform elective maintenance on fire detection or suppression equipment in those fire zones. In addition, the licensee will implement hourly fire watch tours in those fire zones and if the licensee cannot verify that fire detection and suppression systems are available, the licensee will implement a continuous fire watch in that area. The licensee will also verify that transient combustibles are not stored in those fire zones and no hot work will be performed in the area. The same actions will be provided for Unit 2 fire zones where fire has the potential to damage all Unit 2 Safe Shutdown Equipment, such as the Unit 2 600 V Switchgear Room.

To minimize the possibility of fires that occur due to large breaker actuation, the licensee will only allow operation of certain breakers in response to emergent plant conditions, unless the area is protected with an operable carbon dioxide fire extinguishing system and plant personnel is available to manually actuate the carbon dioxide system. Both Unit 1 and Unit 2 large breakers will be controlled in this way.

The NRC staff concludes that the discussion in the LAR demonstrates that the licensee has fully evaluated the potential impact of the unavailable EDG. The NRC staff concludes that the licensee has satisfactorily completed the Tier 2 evaluation and demonstrated that appropriate Tier 2 protections and actions have been developed.

3.5.9 Risk-Informed Configuration Risk Management (Tier 3)

Tier 3 provides additional coverage to ensure that risk-significant plant equipment outage configurations are identified in a timely manner and that the risk impact of out-of-service equipment is appropriately evaluated. RG 1.177 describes Tier 3 as the establishment of an overall configuration risk management program (CRMP) to ensure that configurations resulting from maintenance and other operational activities are identified and compensated for.

In general and consistent with precedent, Tier 3 guidance can be satisfied by the Maintenance Rule (10 CFR 50.65(a)(4)). The licensee has programs in place to comply with 10 CFR 50.65(a)(4) to assess and manage risk from proposed maintenance activities. Typically the licensee procedures require risk management actions when there are elevated risk levels.

Specific actions are developed by each licensee.

The NRC staff concludes that the administrative controls to protect risk-significant equipment from voluntarily being made unavailable, and the 10 CFR 50.65(a)(4) compliant program to assess and manage risk, satisfy the generally accepted Tier 3 direction to identify and avoid or mitigate risk-significant emergent conditions that may not have been identified in the Tier 2 evaluation. However, few CTs are greater than 14 days, and few CT extensions greater than several extra days are granted. Comparing a requested CT of 65 days to a CT of 17 days, there is a greater time during which emergent failures could occur, and multiple emergent failures could occur. Furthermore, the exposure time at elevated risk would be an average of 32 days instead of 9 days. Through the risk-informed TS initiative 4b, the NRC has evaluated CTs of up to 30 days, but the program requires the licensee to shut down the reactor if emergent failures increase risk to unacceptable levels. The NRC staff concludes that consideration should be given as to whether the 50.65(a)(4) program to assess and manage risk should be augmented with a more predictable and protective CRMP program before approving extended CTs.

3.5.10 Conclusions Regarding Risk Evaluation The NRC staff concludes that the PRA submitted by the licensee for the proposed one-time extension of the CT for Unit 1 AB EDG meets the appropriate acceptance guidelines in RG 1.177 with regard to Tier 1 and Tier 2 considerations, assuming that defense-in-depth and safety margin considerations are satisfied. This conclusion is based on:

• a review of the quality of the internal event and fire PRAs and a review of the consideration of the risk contribution of other external events,

• a review of the incorporation of the direct and indirect effects of the unavailable EDG into the PRA model to calculate the required risk metrics,

• a review of the results of the risk analysis,

• proposed compensatory measures which are required in order to use the higher risk acceptance guidelines that have been proposed by the licensee, and

• a review of the licensee implementation of Tier 1, Tier 2, and Tier 3.

Regarding RG 1.177 Tier 3 guidelines, the NRC staff concludes that consideration should be given to whether the 50.65(a)(4) program to assess and manage risk should be augmented with a more predictable and protective CRMP program before approving extended CTs.

Furthermore, due to the changes that the licensee made to its PRA that could not be reviewed in the time available, the NRC staff performed an independent risk evaluation of the proposed 65-day CT using the CNP Standardized Plant Analysis Risk (SPAR) Model, revision 8.22.

There is no LERF calculation in the SPAR models. The SPAR model ICCDP for the 65-day CT is 2.4E-05, whereas the licensees estimate is 4.9E-06. Therefore, the SPAR model ICCDP exceeds the acceptance guideline contained in RG 1.177 for one-time CT extensions, which is 1E-05.

The final quantitative risk results indicate that the impact of the proposed CT extension is not a negligible risk increase and is near or may exceed the acceptance guidelines. RG 1.174 directs that the risk estimates should be considered together with defense-in-depth and safety margin, and the numerical values provided by the licensee are currently not conclusive enough to grant the proposed request based on a negligible risk increase.

Due to the possibility of a common cause failure mode for the other EDGs that is not included in the risk evaluation, the fact that the risk increases are near or may exceed the acceptance guidelines, the difference between ICCDP values calculated by the NRC staff and by the licensee, the uncertainty as to whether a CRMP based on 50.65(a)(4) is sufficiently protective during the unusually long CT, and the insufficient time available to perform a more thorough review of the licensees changes to the PRA, the NRC staff concludes that the licensees request to extend the CT to 65 days for restoring an inoperable EDG should not be approved.

4.0 CONCLUSION

The Commission has concluded that the licensees request for a one-time extension of the CT for an inoperable EDG is unacceptable. The basis for this conclusion is summarized below:

• The SDGs, NDG, and the compensatory measures are not able to supply power to the engineered safety feature loads for accident mitigation within the time constraints of the accident analyses assumptions.

• Neither the SDG nor any other power source (NDG and FLEX equipment) are credited in the accident analysis for accident mitigation.

• The licensee has not fully demonstrated that CNP Unit 1 can mitigate the consequences of LOOP with LOCA and a single failure.

• The proposed operating configuration, having only one engineered safety feature emergency power source, does not meet the requirements of 10 CFR 50.46 and the CNP PSDC 39, Emergency Power. This is due to the fact that accident analysis assumes one train of emergency AC power is available given a worst-case single failure for all CNP UFSAR Chapter 14 accidents.

• The NRC staffs independent risk evaluation of the proposed AOT using the CNP SPAR model, Revision 8.22, resulted in a CCDP that exceeds the acceptance guideline contained in RG 1.177.

• The licensee made several recent modifications to its PRA, resulting in a CCDP below the acceptance guideline contained in RG 1.177. There is insufficient time for the NRC staff to complete a thorough investigation into the modifications made by the licensee that resulted in a CCDP value lower than was produced by its SPAR model.

• The cause of the wiped bearing is still unknown, pending further analysis. While it is likely that the failed bearing is a direct result of the maintenance performed on the Unit 1 AB EDG, the potential for a common failure mode on the remaining EDGs cannot be eliminated.

• NUREG-0800, BTP 8-8 states that EDG AOTs should be limited to 14 days. The licensee has not provided sufficient justification for allowing an extension beyond the 14-day AOT.

Based on the above, the NRC staff concludes that the proposed change does not provide reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner. Therefore, the requested extension of the CT for an inoperable EDG is unacceptable, and the amendment request is denied.

Principal Contributors: R. Mathew S. Dinsmore R. Wolfgang D. Frumkin M. Chernoff A. Dietrich Date: July 8, 2015