ML071550202

Proposed Technical Specifications Change, Temporary 45-Day and 14-Day Allowed Outage Times to Replace Main Control Room and Emergency Switchgear Room Air Conditioning System Chilled Water Piping, Response to NRC RAI

ML071550202
Person / Time
Site:	Surry
Issue date:	05/31/2007
From:	Gerald Bichof Virginia Electric & Power Co (VEPCO)
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
07-0381
Download: ML071550202 (12)

Text

VIRGINIA ELECTRIC AND POWER COMPANY RICHMOND,VIRGINIA2326 1 May 31,2007 U.S. Nuclear Regulatory Commission Serial No. 07-0381 Attention: Document Control Desk SPS-LICICGL R1" Washington, D.C. 20555 Docket Nos. 50-280 50-281 License Nos. DPR-32 DPR-37 VIRGINIA ELECTRIC AND POWER COMPANY SURRY POWER STATION UNITS 1 AND 2 PROPOSED TECHNICAL SPECIFICATIONS CHANGE TEMPORARY 45-DAY AND 14-DAY ALLOWED OUTAGE TIMES TO REPLACE MAIN CONTROL ROOM AND EMERGENCY SWITCHGEAR ROOM AIR CONDITIONING SYSTEM CHILLED WATER PIPING RESPONSE TO NRC REQUEST FOR ADDITIONAL INFORMATION In a letter dated February 26, 2007 (Serial No. 07-0109), Virginia Electric and Power Company (Dominion) submitted an amendment request to Facility Operating License Numbers DPR-32 and DPR-37 for Surry Power Station Units 1 and 2 to permit the use of temporary 45-day and 14-day allowed outage times (AOTs) to facilitate replacement of Main Control Room (MCR) and Emergency Switchgear Room (ESGR) Air Conditioning System (ACS) chilled water piping. In a letter dated May 3, 2007, the NRC requested additional information associated with the risk analysis that was included as part of the license amendment request. Dominion's response to the NRC request is provided in the attachment.

If you have any questions or require additional information, please contact Mr. Gary D. Miller at (804) 273-2771.

Very truly yours, Gerald T. Bischof w Vice President - Nuclear Engineering Attachment

Serial No. 07-0381 Docket Nos. 50-280, 50-281 Page 2 of 3 Commitments made in this letter: None cc: U.S. Nuclear Regulatory Commission Region II Sam Nunn Atlanta Federal Center 61 Forsyth Street, SW Suite 23 T85 Atlanta, Georgia 30303 Mr. D. C. Arnett NRC Resident Inspector Surry Power Station State Health Commissioner Virginia Department of Health James Madison Building - 7th floor, Room 730 109 Governor Street Richmond, Virginia 23219 Mr. S. P. Lingam NRC Project Manager - Surry U. S. Nuclear Regulatory Commission One White Flint North 11555 Rockville Pike Mail Stop 8-G9A Rockville, Maryland 20852-2738 Mr. R. A. Jervey NRC Project Manager - North Anna U. S. Nuclear Regulatory Commission One White Flint North 11555 Rockville Pike Mail Stop 8-G9A Rockville, Maryland 20852-2738

Serial No. 07-0381 Docket Nos. 50-280, 50-281 Page 3 of 3 COMMONWEALTH OF VIRGINIA )

)

COUNTY OF HENRICO )

The foregoing document was acknowledged before me, in and for the County and Commonwealth aforesaid, today by Gerald T. Bischof, who is Vice President - Nuclear Engineering, of Virginia Electric and Power Company. He has affirmed before me that he is duly authorized to execute and file the foregoing document in behalf of that Company, and that the statements in the document are true to the best of his knowledge and belief.

Acknowledged before me the  ?/ Y d a y of ,A$!,&/ ,2007 My Commission Expires:

Notary public' (SEAL)

Serial No. 07-0381 Docket Nos. 50-2801281 Attachment ATTACHMENT RESPONSE TO NRC REQUEST FOR ADDITIONAL INFORMATION PROPOSED LICENSE AMENDEMENT REQUEST SURRY POWER STATION

7. Virginia Electric and Power Company (the licensee) identified that the probabilistic risk assessment (PRA) internal events model includes the main control room (MCR) and emergency switchgear room (ESGR) air-conditioning (AC) system as a mitigating system, and loss of the function of ESGR cooling as an initiating event.

The submittal states that a manual reactor trip is required prior to reaching 120°F in the ESGR. However, the submittal does not provide any further details as to the failure effects of the unavailability of this system, the success criteria used for the system compared to the design bases, or any other assumptions regarding system operation and impacts in the PRA relevant to this amendment request. The licensee is requested to describe the plant impact assumed in the PRA model upon loss of the MCRESGR A C system, including any related assumptions, system success criteria, and any modeled alternate cooling capabilities. This should also include discussion regarding how the initiating event frequency for loss of control room AC was adjusted to account for the unavailability of a chilled water loop. If appropriate to assess any non-consetvative assumptions applied, the licensee should also discuss the sensitivity of their results to this assumed plant response, including any sensitivity studies conducted using different assumed responses to a loss of the system.

Dominion Response A. Plant Impact from Loss of Chilled Water Svstem Loss of the chilled water system could be caused by failure of a chiller, chilled water pump, chilled water piping, or support systems such as service water or electric power.

In the event of a loss of a chiller, Operations would identify the chiller malfunction from annunciators 0-VSP-D5 (Mechanical Equipment Room "MER-3 CHILLER TROUBLE1')

or 0-VSP-K5 ("MER-5 CHILLER TROUBLE"). Each chiller has equipment protection instrumentation that will initiate a chiller compressor lockout. Increasing temperature in the main control room (MCR) or emergency switchgear room (ESGR) could also be caused by loss of service water. 0-AP-12.00 ("Service Water System Abnormal Conditions") ultimately directs the operators to 0-AP-13.02 ("Loss of ESGR Cooling").

Loss of service water (SW) will result in a high condenser pressure trip of the respective chiller and subsequent initiation of the 0-VSP-D5 or 0-VSP-K5 annunciators. Failure of a chilled water pump in the chilled water loop will have similar results. Additionally, a leak or rupture in the chilled water loop would be identified by control room annunciators due to chiller trip on low chilled water temperature or by report of local flooding.

Page 1 of 9

Serial No. 07-0381 Docket Nos. 50-2801281 Attachment Each annunciator response procedure (ARP) referenced above directs the operators to:

stop any affected chiller, vent the SW headers in accordance with 0-OP-SW-49.3

("Swapping Control Room Chiller and Charging Pump Service Water Supply Headers")

if a SW system manipulation was in progress, and align ventilation in accordance with 0-OP-VS-006 ("Control Room and Relay Room Ventilation System").

In case of a chilled water piping leak or rupture, the operators would receive a report of flood water entering the Turbine Building, MER 3, or MER 5. In this case, the operators would follow the instructions of 0-AP-13.00 ("Turbine Building or MER-3 Flooding") and possibly 0-AP-13.01 ("Uncontrollable Turbine Building Flooding") Furthermore, if no MCR chiller can be restarted, then the operators would use 0-AP-13.02 ("Loss of ESGR Cooling"), which deals with: 1) loss of the operating ESGR AHU on one unit due to loss of chilled water flow or mechanical failure, and 2) loss of MCR chillers due to flooding, loss of SW flow, or mechanical failure. The affected unit(s) would be operated in accordance with the actions specified in the applicable TS LCO.

Technical Specification (TS) 3.23 requires that three chiller refrigeration units for the MCR and ESGR must be operable whenever either unit is above cold shutdown. A limiting condition for operation (LCO) clock would be entered if the minimum operable chillers requirement of TS 3.23 is not met. With one train of MCR and ESGR ventilation system inoperable, the operators must return the inoperable train to an operable status within seven days or must shutdown the affected unit to at least hot shutdown conditions within the next six hours and in cold shutdown conditions within the following 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />. If one of the operable chillers becomes inoperable or is not powered by one of the four emergency buses, then the operators must return that inoperable chiller to operable status within seven days or bring both units to hot shutdown within the next six hours and be in cold shutdown within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. If two of the operable chillers become inoperable or are not powered by one of the four emergency buses, then the operators must return an inoperable chiller to operable status within one hour or bring both units to hot shutdown within the next six hours and be in cold shutdown within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

The impact of chilled water system loss on MCR and ESGR room temperatures has been analyzed using the GOTHIC code. The MCR analysis, which is not included in the current PRA model, has shown that without chilled water flow to the in-service train of MCR coolers, MCR temperatures will remain well within the equipment design limits (Ref. 1) for up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and no compensatory measures are needed. Regarding the ESGR, Attachment 1 of 0-AP-13.02 provides operators with directions to: align doors to provide a flow path of cool air from the cable spreading room, down the stairwell, and into the ESGR; adjust the thermostat for 1-VS-AC-4, Service Building HV unit, to its minimum setting; evacuate non-essential personnel from the ESGR; open dampers and start the relay room emergency supply fans 1-VS-F-42 andlor 2-VS-F-42; place any available temporary portable fans in service in the ESGR; open all instrument rack doors; and start all available ESGR AHUs.

Page 2 of 9

Serial No. 07-0381 Docket Nos. 50-2801281 Attachment of 0-AP-13.02 directs operations, in the event temperatures continue to increase in the ESGR, to load shed in order to align critical components to a single emergency bus to allow de-energizing the opposite bus if ESGR heatup continues.

B. Chilled Water Svstem PRA Model Assum~tions The chilled water system cools the MCR and ESGR rooms. The Surry PRA models the ESGR cooling as a support system for the emergency electrical power systems, 4160 V AC, 480 V AC, 125 V DC, and 120 V AC.

Failure to maintain the ESGR temperature below 120 degrees F is conservatively assumed to result in the non-recoverable failure of all of these power systems. The Surry PRA models the MCR cooling function as failed when insufficient cooling occurs from the control room AHUs, which could be caused by the AHUs1failure to run or start or failure of its associated chillers or their supporting components. Based on the recently completed MCR heatup calculation, this assumption was overly conservative.

When one chiller loop is out of service, its air handling units (AHUs) are credited in accordance with the room heatup GOTHIC analyses for ensuring air circulation and uniform bulk air temperatures in each area. The AHUs on the operating chilled water loop are assumed to be in service.

For the baseline risk analysis, each chiller is assumed to run forty percent of the time (two of five chillers are running), consistent with normal plant operating practices. For the analyses in this risk assessment, it will be assumed that one chiller is operating initially (e.g., the C chiller is running when chilled water loop A is out of service, and the A chiller is chosen when chilled water loop C is out of service).

C. Chilled Water Svstem Success Criteria Initiating Events Design Basis (TS 3.23) PRA Model Success Criteria All loss of coolant Specification: chiller refrigeration units accident (LOCA) Three main control room and emergency switchgear For MCR':

events, loss of room chillers must be OPERABLE whenever either 1 MCR AHU, main feed water unit is above COLD SHUTDOWN. 1 chiller, 1 chilled (MM"Nt water loop anticipated Basis: The chillers supply chilled water to eight AHUs, transient without arranged in two independent and redundant chilled For ESGR:

scram (ATWS), water loops. Each chilled water loop provides 1 ESGR AHU, main steam line redundant 100 percent heat removal capacity per 1 chiller, 1 chilled break (MSLB) unit. Acceptable operating alignments include one water loop inside chiller supplying one chilled water loop with four containment operating AHUs, or two chillers supplying two chilled water loops with two AHUs operating on each loop. In General ~ l a n t either case, one AHU must be operated in the MCR Page 3 of 9

Serial No. 07-0381 Docket Nos. 50-2801281 Attachment Initiating Events Design Basis (TS 3.23) PRA Model Success Criteria transients with and ESGR air conditioning zones of each unit. During safety injection normal operation, and accident scenarios with a loss (SI) of offsite power (LOOP) and single failure of an General fire emergency diesel generator (EDG), one chiller Transients; cable providing chilled water to one chilled water loop with vault, tunnel and four operating AHUs is sufficient to maintain the MCR electrical and ESGR air temperature within normal limits. A penetration room, chiller does not have to be in operation to be normal switchgear considered OPERABLE.

room, ESGRs Refueling water storage tank (RWST) pipe rupture in Auxiliary Building or Safeguards Building leading to a reactor coolant pump (RCP) seal LOCA Flood in Auxiliary Building General plant Same as above.

transients without For MCR':

SI, LOOP, 1 MCR AHU, recoverable loss 1 chiller, 1 chilled of MFW, transient water loop with MFW available, loss of For ESGR:

DC bus, loss of 1 ESGR AHU circulating water (chilled water not (CW) pumps, loss required for of instrument air ESGR per room (IA), loss of heatup analysis) control room AC, MSLB outside containment Notes:

'Subsequent MCR heatup analysis performed after PRA model development indicates that chilled water is not required for MCR within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Therefore, PRA model success criteria are overly conservative for MCR.

Page 4 of 9

Serial No. 07-0381 Docket Nos. 50-2801281 Attachment D. Modeled Alternate Cooling Capabilities in Loss of Chilled Water Svstem There are no alternate cooling capabilities modeled in the PRA for the chilled water system.

E. Chilled Water Svstem Initiating Event Frequency The initiating event frequency for a loss of control room cooling is dynamically calculated using a fault tree. In both the PRA model used in assessing the risk of this technical specification change and the 10 CFR 50.65(a)(4) model (i.e., the configuration risk analysis model), the initiating event frequency is calculated by a fault tree that factors the unavailability of each loop, chiller, air handler, pump, and other components (e.g. strainers, relief valves, pressure control valves, gate valves, check valves and selector switches). The unavailability of their power supplies (i.e., the chillers are powered from the emergency buses) is also considered in calculating this frequency.

F. Sensitivity Studies No non-conservative assumptions were made regarding chilled water system modeling; therefore, no sensitivity analysis is necessary.

Ref. I : Letter Serial No. 07-0109B, dated May 14, 2007 -

Subject:

Proposed Technical Specifications Change - Temporary 45-day and 14-day Allowed Outage Time to Replace MCR and ESGR Air Conditioning System Chilled Water Piping - Additional Information Regarding Main Control Room Heatup Page 5 of 9

Serial No. 07-0381 Docket Nos. 50-2801281 Attachment

2. The licensee's submittal did not identify if the risk analyses provided point estimates of the mean or actual means, nor was there any discussion of uncertainty analyses to support the calculations. The licensee is requested to address PRA model and parametric uncerfainty consistent with the guidance of Regulatory Guide 1.174, Section 2.2.5.

Dominion Response A. Parameter Uncertainty The risk analyses in the submittal were based on point estimates of the mean. The parameter uncertainty and model uncertainty in the Regulatory Guide 1. I 74 results are discussed below.

A parametric uncertainty analysis was performed for the baseline case and modified case over the period the change is effective (two years) using WinNUPRA 3.0 Service Release (SR) 4. The parametric uncertainty analysis utilized the following parameters:

- Number of samples selected was 15,000 (the maximum allowed in WinNUPRA 3.0 SR 4).

- The Fixed Random Array option was selected (same initial seed to random number generator in Monte Carlo analysis).

- Basic event uncertainty distributions (except component unavailability) were calculated in accordance with the method recommended in NUREG-CR-6823 "Handbook of Parameter Estimation for Probabilistic Risk Assessment." There are two methods to estimate component unavailability. Most of the component unavailabilities are calculated from the actual collected data and their error factor is assumed to be equal to three. Some component unavailabilities are calculated using the average of all collected data and their error factor is assumed to be equal to five.

The parametric uncertainities in core damage frequency (CDF) are documented in Figure 1 and Table 1, and the uncertainities in large early release frequency (LERF) are documented in Figure 2 and Table 2.

Tables 1 and 2 demonstrate that the increased unavailability of the chilled water loops during the two-year period of the temporary technical specification change does not significantly impact the overall CDF and LERF uncertainty distributions.

Page 6 of 9

Serial No. 07-0381 Docket Nos. 50-2801281 Attachment Base Line Risk Temporary Risk During Proposed AOT (Average Test and Maintenance) (Four 45-Day Outages over 2 Years)

Internal Fire Seismic Internal Fire Seismic Total Events Events Events Events Events Events Total

- 95% - 95% - Mean 50% - 95% - 95%

Mean

- 5% - 5%

- Mean

- - Mean

- 50%

Mean

- - 50%

Mean

- 95%

50%

- 95%

Mean 50%

- Mean 7

Figure 1 Parameter Uncertainties of CDF Table I - Summary of Parameter Uncertainties of CDF (per year)

Base Line Risk Temporary Risk During Period Change is Effective Internal Fire Seismic Internal Fire Seismic Total Total Events Events Events Events Events Events Point Estimate 1.79E-5 1.54E-5 1.15E-5 4.48E-5 1.86E-5 1.62E-5 1.15E-5 4.63E-5 95th0hConfidence 3.54E-5 3.48E-5 1.37E-5 8.36E-5 3.65E-5 3.58E-5 1.40E-5 8.57E-5 5th%Confidence 7.53E-6 5.76E-6 3.18E-6 2.29E-5 7.94E-6 6.26E-6 3.23E-6 2.46E-5 Page 7 of 9

Serial No. 07-0381 Docket Nos. 50-2801281 Attachment Base Line Risk Temporary Risk During Proposed AOT (Average Test and Maintenance) (Four 45-Day Outages over 2 Years)

I Internal Events Fire Events Seismic Events Total Internal Events Fire Events Seismic Events Total 1.OE-7 1 5 %

- Mean 1 5 % -Mean 7.OE-8 I

b Figure 2 Parameter Uncertainties of LERF Table 2 -Summary of Parameter Uncertainties of LERF (per year)

Base Line Risk Temporary Risk During Period Change is Effective I Internal I Fire I Seismic I T-a-a l utat Internal I Fire I Seismic I -I otal ..

Events Events Events Events Events Events Point Estimate 6.59E-7 1.24E-7 1.03E-7 8.85E-7 6.79E-7 1.37E-7 1.04E-7 9.20E-7 95th%Confidence 1.59E-6 3.67E-7 2.00E-7 1.83E-6 1.68E-6 3.69E-7 2.03E-7 1.98E-6 5th%Confidence 1.39E-7 2.26E-8 4.38E-8 2.26E-7 1.43E-7 3.18E-8 4.39E-8 2.03E-7 Page 8 of 9

Serial No. 07-0381 Docket Nos. 50-2801281 B. Model Uncertainties Room Heatup Calculations The major uncertainty when dealing with HVAC analyses in a PRA is the uncertainty in how loss of the ventilation will ultimately impact the equipment. The room heatup calculations were based on detailed GOTHIC models using bounding initial conditions such as design basis heat loads and initial temperatures (inside and outside). Should the loss of ventilation occur during cool weather, room heatup would take longer.

Nonetheless, this bounding heatup evaluation was applied to all assumed initial conditions of normal operation, so this constitutes a conservative approach. Any relaxation of the heatup assumptions would yield lower risk results.

External Events The fire and seismic PRA models used in this analysis were developed based on the Surry IPEEE models, but upgraded to utilize the current system fault tree models. The quality of the external event model is not comparable to the internal event models since the external event models have not been subject to peer review or assessment against any standards. However, the fire model does not credit any automatic or manual suppression features and the seismic results are a minor overall contributor to the total risk. Therefore, the impact of any modeling uncertainties is offset by the conservatisms in the fire model or low impact from the seismic model.

Page 9 of 9