ML17004A209

Safety Evaluation Input for Palo Verde Nuclear Generating Station, Unit 3, Llcense Amendment Request for a One-Time Extension of the 3B Emergency Diesel Generator Completion Time

ML17004A209
Person / Time
Site:	Palo Verde
Issue date:	01/03/2017
From:	Rosenberg S L NRC/NRR/DRA/APLA
To:	Pascarelli R J Plant Licensing Branch IV
Todd Hilsmeier, NRR/DRA 415-6788
References
CAC MF9019
Download: ML17004A209 (16)

Text

January 3, 2017

MEMORANDUM TO: Robert J. Pascarelli, Chief Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation FROM: Stacey Rosenberg, Chief /RA/ PRA Licensing Branch Division of Risk Assessment Office of Nuclear Reactor Regulation

SUBJECT: SAFETY EVALUATION INPUT FOR PALO VERDE NUCLEAR GENERATING STATION, UNIT 3, LICENSE AMENDMENT REQUEST FOR A ONE-TIME EXTENSION OF THE 3B EMERGENCY DIESEL GENERATOR COMPLETION TIME (CAC NO. MF9019)

By letter to the U.S. Nuclear Regulatory Commission (NRC) dated December 30, 2016 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML16365A240), Arizona Public Service Company (APS, the licensee) submitted a License Amendment Request (LAR) for Palo Verde Nuclear Generating Station (PVNGS), Unit This LAR proposed a one-time extension of the completion time from 10 days to 62 days to restore the Unit 3, Train B Emergency Diesel Generator (EDG) to operable status associated with Technical Specifications (TS) 3.8.1. This proposed change will only be used one time for the purpose of completing repairs and testing to re-establish operability of the 3B ED The Probabilistic Risk Assessment Licensing Branch (APLA) in the Office of Nuclear Reactor Regulation has evaluated the licensee's proposed TS change against the guidelines of Regulatory Guide (RG) 1.177 and RG 1.17 The APLA review scope and findings are limited to the evaluation of the risk impacts and did not evaluate the traditional engineering analysis, which is the responsibility of a different divisio The licensee's estimated risk impacts met the acceptance guidelines of RG 1.177 and RG 1.17 The licensee also provided information related to the scope, level of detail, and technical adequacy of the PRA models used to make this estimat On the basis of this information, the NRC staff finds that the licensee's risk insights support the proposed change and are acceptabl This memorandum and the attached safety evaluation complete our work on CAC No. MF901 Docket No.: 50-530

Enclosure:

Safety Evaluation CONTACT: Todd Hilsmeier, NRR/DRA 301-415-6788 R. Pascarelli - 2 -

SUBJECT: SAFETY EVALUATION INPUT FOR PALO VERDE NUCLEAR GENERATING STATION, UNIT 3, LICENSE AMENDMENT REQUEST FOR A ONE-TIME EXTENSION OF THE 3B EMERGENCY DIESEL GENERATOR COMPLETION TIME (CAC NO. MF9019)

DATED: January 3, 2017 DISTRIBUTION: SLingam, DORL RidsNrrDss RidsNrrDra RidsNrrDorl MWatford, DORL RidsNrrDssStstb RidsNrrDraApla RidsNrrDorlLpl4 RidsNrrPMPaloVerde

ADAMS Accession No.: ML17004A209 OFFICE NRR/DRA/APLA NRR/DRA/APLA NRR/DRA/APLA NAME THilsmeier CFong SRosenberg DATE 1/03/2017 1/03/2017 1/03/2017 OFFICIAL RECORD COPY ENCLOSURE SAFETY EVALUATION INPUT FOR PALO VERDE NUCLEAR GENERATING STATION, UNIT 3, LICENSE AMENDMENT REQUEST FOR A ONE-TIME EXTENSION OF THE 3B EMERGENCY DIESEL GENERATOR COMPLETION TIME (CAC NO. MF9019) 1.0 INTRODUCTION By letter dated December 30, 2016 (Reference 1), Arizona Public Service Company (APS, the licensee) submitted a License Amendment Request (LAR) for Palo Verde Nuclear Generating Station (PVNGS), Unit This LAR proposed a one-time extension of the completion time from 10 days to 62 days to restore the Unit 3, Train B Emergency Diesel Generator (EDG) to operable status associated with Technical Specifications (TS) 3.8.1. This proposed change will only be used one time for the purpose of completing repairs and testing to re-establish operability of the 3B ED .0 REGULATORY EVALUATION The Nuclear Regulatory Commission (NRC) staff finds that the licensee, in its December 30, 2016 submittal, identified the applicable risk-informed regulatory guideline The regulatory guidance that the NRC staff considered in its review of the application are discussed belo .1 Applicable Regulation The PRA (Probabilistic Risk Assessment) Licensing Branch (APLA) technical staff has no input to this sectio The input to this section should be provided by the technical staff from the appropriate traditional engineering/deterministic branch(es).

2.2 Applicable Regulatory Guidelines and Review Plans The regulatory guidelines on which the APLA staff based its acceptance are:

• Regulatory Guide (RG) 1.174, Revision 2, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis" (Reference 2), describes a risk-informed approach, acceptable to the NRC, for assessing the nature and impact of proposed permanent licensing-basis changes by considering engineering issues and applying risk insight This regulatory guide also provides risk acceptance guidelines for evaluating the results of such evaluation

• RG 1.177, Revision 1, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications" (Reference 3), describes an acceptable risk-informed approach specifically for assessing proposed one-time TS changes in completion times (CTs). This regulatory guide also provides risk acceptance guidelines for evaluating the results of such assessment RG 1.177 provides the following three-tiered TS acceptance guidelines specific to one-time only CT changes for evaluating the risk associated with the revised CT: 1. The licensee has demonstrated that implementation of the one-time only TS CT change impact on plant risk is acceptable (Tier 1):

• Incremental conditional core damage probability (ICCDP) of less than 1.0x10-6 and an incremental conditional large early release probability (ICLERP) of less than 1.0x10-7, or

• ICCDP of less than 1.0x10-5 and an ICLERP of less than 1.0x10-6 with effective compensatory measures implemented to reduce the sources of increased ris . The licensee has demonstrated that there are appropriate restrictions on dominant risk-significant configurations associated with the change (Tier 2). 3. The licensee has implemented a risk-informed plant configuration control progra The licensee has implemented procedures to utilize, maintain, and control such a program (Tier 3).

RG 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities" (Reference 4), describes one acceptable approach for determining whether the quality of the PRA, in total or the parts that are used to support an application, is sufficient to provide confidence in the results, such that the PRA can be used in regulatory decisionmaking for light-water reactor General guidance for evaluating the technical basis for proposed risk-informed changes is provided in Chapter 19, Section 19.2, "Review of Risk Information Used to Support Permanent Plant-Specific Changes to the Licensing Basis: General Guidance," of the NRC Standard Review Plan (SRP), NUREG-0800 (Reference 5). Guidance on evaluating PRA technical adequacy is provided in Chapter 19, Section 19.1, "Determining the Technical Adequacy of Probabilistic Risk Assessment for Risk-Informed License Amendment Requests After Initial Fuel Load," of the SRP (Reference 6). More specific guidance related to risk-informed TS changes is provided in SRP Section 16.1, "Risk-Informed Decisionmaking: Technical Specifications" (Reference 7), which includes CT changes as part of risk-informed decisionmakin Chapter 19 of the SRP states that a risk-informed application should be evaluated to ensure that the proposed changes meet the following key principles:

• The proposed change meets the current regulations, unless it explicitly relates to a requested exemption or rule chang

• The proposed change is consistent with the defense-in-depth philosoph

• The proposed change maintains sufficient safety margin

• When proposed changes increase core damage frequency (CDF) or risk, the increase(s) should be small and consistent with the intent of the Commission's Safety Goal Policy Statemen

• The impact of the proposed change should be monitored using performance measurement strategie .0 TECHNICAL EVALUATION The PVNGS, Unit 3, LAR requested approval for a one-time extension of the TS CT from 10 days to 62 days to restore the 3B EDG to operable status associated with TS 3.8.1. The technical evaluation by the APLA staff presented in this safety evaluation (SE) evaluates those portions of the licensee's submittal that pertain to risk-informed evaluation of the proposed TS change (i.e., PRA considerations, evaluation of the risk impact of the proposed change consistent with RG 1.177, determination of the technical adequacy of the PRA models consistent with the requirements of RG 1.200, and the other applicable aspects of the PRA related to the proposed change).

3.1 Detailed Description of the Proposed Change The LAR proposed a one-time extension of the 3B EDG CT described in TS 3.8.1. Specifically, this amendment proposed to extend the TS required action 3.8.1.B.4 CT from 10 days to 62 days for the purpose of completing repairs and testing to re-establish operability of the 3B ED During surveillance testing on December 15, 2016, the 3B EDG suffered a failure of the number nine right cylinder connecting rod and pisto Current plans to collect and analyze data associated with the engine failure and continue the repair would exceed the TS required action CT of 10 day As a result, the licensee requested a one-time risk-informed license amendment to extend the C .2 Determination of Common Cause Mode of Failure The APLA technical staff has no input to this sectio The input to this section should be provided by the technical staff from the appropriate traditional engineering/deterministic branch(es).

3.3 Review Methodology Per SRP Section 19.1 and Section 16.1, the NRC staff reviewed the submittal using the three-tiered approach and the five key principles of risk-informed decision making presented in RG 1.174 and RG 1.17 The scope of APLA's review and findings are limited only to the evaluation of the risk-related portion of the review and do not include evaluation of the traditional engineering analysi .3.1 Key Principle 1: Compliance with Current Regulations The APLA technical staff has no input to this sectio The input to this section should be provided by the technical staff from the appropriate traditional engineering/deterministic branch(es).

3.3.2 Key Principle 2: Evaluation of Defense-in-Depth The APLA technical staff has no input to this sectio The input to this section should be provided by the technical staff from the appropriate traditional engineering/deterministic branch(es).

3.3.3 Key Principle 3: Evaluation of Safety Margins The APLA technical staff has no input to this sectio The input to this section should be provided by the technical staff from the appropriate traditional engineering/deterministic branch(es). 3.3.4 Key Principle 4: Change in Risk Consistent with the Commission's Safety Goal Policy Statement The evaluation below addresses the NRC staff's philosophy of risk-informed decision making:

that when the proposed changes result in a change in CDF or risk, the increase should be small and consistent with the intent of the Commission's Safety Goal Policy Statemen The NRC staff evaluation of Key Principal 4 for the proposed one-time TS change is described belo .3. Tier 1: PRA Capability and Insights The first tier evaluates the impact of the proposed change on plant operational ris The Tier 1 review involves two aspects: (1) evaluation of the technical adequacy of the PVNGS PRA models and their application to the proposed change, and (2) evaluation of the PRA results and insights based on the licensee's proposed chang PRA Quality RG 1.174 states that, "[t]he scope, level of detail, and technical adequacy of the PRA are to be commensurate with the application for which it is intended and the role the PRA results play in the integrated decision process." The technical adequacy of the PRA must be compatible with the safety implications of the TS change being requested and the role that the PRA plays in justifying that chang That is, the more the potential change in risk or the greater the uncertainty in that risk from the requested TS change, or both, the more rigor that must go into ensuring the technical adequacy of the PR This applies to Tier 1, and it also applies to Tier 2 and Tier 3 to the extent that a PRA model is use RG 1.200, Revision 2, describes one acceptable approach for determining whether the technical adequacy of the PRA, in total or the parts that are used to support an application, is sufficient to provide confidence in the results such that the PRA can be used in regulatory decision-making for light-water reactor RG 1.200, Revision 2, endorses with comments and qualifications the use of: the American Society of Mechanical Engineers/American Nuclear Society (ASME/ANS)

PRA standard ASME/ANS RA-Sa-2009, "Addenda to ASME/ANS RA-S-2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications" (Reference 8); Nuclear Energy Institute (NEI) 00-02, Revision 1, "Probabilistic Risk Assessment Peer Review Process Guidance" (Reference 9); and NEI 05-04, Revision 2, "Process for Performing Follow-On PRA Peer Reviews Using the ASME PRA Standard" (Reference 10). The ASME/ANS PRA standard provides technical supporting requirements in terms of three Capability Categories (CCs). The intent of the delineation of the Capability Categories within the Supporting Requirements (SRs) is generally that the degree of scope and level of detail, the degree of plant specificity, and the degree of realism increase from CC I to CC II In general, the staff anticipates that current good practice, i.e., CC II of the ASME/ANS standard is adequate for the majority of application Internal Events PRA (Including Internal Flooding) The full-power, internal events PRA (IEPRA) and internal flooding PRA (IFPRA) for PVNGS, Unit 3, address both CDF and large early release frequency (LERF). The licensee stated that their risk management process for maintaining and updating the PRA ensures that the IEPRA and IFPRA accurately reflect the as-built, as-operated plan The licensee used RG 1.200, Revision 2, to address the technical adequacy of the IEPRA and IFPRA to assure these PRAs are capable of accurately characterizing the risk impact from internal events (including flooding) associated with the TS CT change for 3B ED Capability Category II of ASME/ANS RA-Sa-2009 was applied as the standard, and any identified deficiencies to those requirements were assessed further to determine any impacts to the risk evaluatio In 1999, the Combustion Engineering Owners Group (CEOG) conducted a peer review of the IEPRA in accordance with NEI 00-0 Attachment 8 of the LAR provided the findings from this peer review and the licensee's disposition of these finding In 2010, the licensee performed a self-assessment on the IEPRA in accordance with Appendix B of RG 1.200, Revision 2, to assess gaps between the CEOG peer review results and the SRs in ASME/ANS RA-Sa-2009, as qualified by RG 1.200, Revision Attachment 9 of the LAR provided the findings from the self-assessment of the IEPRA for SRs determined not met to CC II and the licensee's disposition of these finding In 2010, Westinghouse performed a full-scope peer review of the IFPRA against the SRs of ASME/ANS RA-Sa-2009, as qualified by RG 1.200, Revision Attachment 10 of the LAR provides the facts and observations (F&Os) from the peer review of the IFPRA for SRs determined not met to CC II and the licensee's disposition to these F&O The licensee stated that no changes have been made to the IEPRA and IFPRA subsequent to the peer reviews that would constitute an upgrade as defined by ASME/ANS RA-Sa-200 Therefore, no additional peer reviews were performed to support the risk evaluation under this LA The NRC staff reviewed the licensee's disposition of the findings and F&Os, as supplemented by Attachment 16 of the LAR, associated with the IEPRA and IFPRA, and concludes that they were properly dispositioned to support the internal events and internal flooding PRA technical adequacy for the proposed one-time CT extensio Also, the LAR risk results (i.e., ICCDP and ICLERP for the proposed one-time CT extension) for internal events and internal flooding met the RG 1.177 risk acceptance guidelines by a large margin, which provides additional confidence that any uncertainties associated with the IEPRA and IFPRA would not change the conclusions of this assessmen Fire PRA The PVNGS, Unit 3, internal fire PRA (FPRA) addresses both CDF and LER The licensee stated that its risk management process for maintaining and updating the PRA ensures that the FPRA remains an accurate reflection of the as-built and as-operated plan The licensee used RG 1.200, Revision 2, to address the technical adequacy of the FPRA to ensure that it is capable of accurately characterizing the risk impact from internal fires associated with the TS CT change for 3B ED Capability Category II of ASME/ANS RA-Sa-2009 was applied as the standard, and any identified deficiencies to those requirements were assessed further to determine any impacts to the risk evaluatio The licensee stated that its FPRA was developed consistent with the guidance in NUREG/CR-6850 (Reference 11) including the frequently asked question (FAQ) guidance developed for the National Fire Protection Association Standard (NFPA) 805, "Performance Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants."

However, some of the more recent endorsed methods have not yet been incorporated into the fire PRA mode In December 2012, a full-scope peer review of the FPRA was performed in accordance with NEI 07-12 (Reference 12) against the SRs of ASME/ANS RA-Sa-2009, as qualified by RG 1.200, Revision Subsequently, in December 2014, a focused-scope peer review of the FPRA was conducted in accordance with NEI 07-12 to address ASME/ANS RA-Sa-2009 SRs determined not met to CC II in the first peer review, including a complete re-review of the affected SR Attachment 12 of the LAR provided the F&Os from the peer reviews of the FPRA for SRs determined not met to CC II and the licensee's disposition to these F&O The licensee stated that no changes were made subsequent to the peer reviews that would constitute an upgrade as defined by ASME/ANS RA-Sa-200 Therefore, no additional peer reviews were performed to support the risk evaluation under this LA The NRC staff evaluated the licensee's disposition of the F&Os associated with the FPRA and concludes these F&Os were properly dispositioned to support the internal fire PRA technical adequacy for the proposed one-time CT extensio Also, the licensee performed a sensitivity analysis in Attachment 16 of the LAR that quantitatively evaluated risk associated with the unavailability of 3B EDG for 62 days and credit for the portable diesel generator This analysis showed that the internal fire risk results (i.e., ICCDP and ICLERP) meet the RG 1.177 risk acceptance guidelines by a large margi This provides additional confidence that any uncertainties associated with the FPRA would not change the conclusions of this assessmen Seismic and Other External Hazards The licensee stated that the PVNGS, Unit 3, seismic PRA (SPRA) addressed both CDF and LER The licensee also stated that their risk management process for maintaining and updating the PRA ensured that the SPRA remains an accurate reflection of the as-built and as-operated plan The licensee used RG 1.200, Revision 2, to address the technical adequacy of the SPRA to assure this PRA is capable of evaluating the risk impact from seismic hazards associated with the TS CT change for 3B ED Capability Category II of ASME/ANS RA-Sa-2009 was applied as the standard, and any identified deficiencies to those requirements were assessed further to determine any impacts to the risk evaluatio In December 2013, a full-scope peer review of the SPRA was performed in accordance with NEI 12-13 (Reference 13) against the SRs of ASME/ANS RA-Sa-2009, as qualified by RG 1.200, Revision Attachment 11 of the LAR provided the F&Os from this peer review for SRs determined not met to CC II and the licensee's disposition to these F&O The licensee stated that no changes have been made to the SPRA subsequent to the peer review that would constitute an upgrade as defined by ASME/ANS RA-Sa-200 Therefore, no additional peer reviews were performed to support the risk evaluation under this LA The NRC staff evaluated the licensee's disposition of the F&Os associated with the SPRA and concludes that they were properly dispositioned to support the seismic PRA technical adequacy for the proposed one-time CT extensio Also, the seismic risk results presented by the licensee (i.e., ICCDP and ICLERP for the proposed one-time CT extension) met the RG 1.177 risk acceptance guidelines by a large margin, providing confidence that any uncertainties associated with the SPRA would be unlikely to change the conclusions of this assessmen Regulatory Position 2.3.2 of RG 1.177 states that the scope of the analysis should include all hazard groups (i.e., internal events, internal flooding, internal fires, seismic events, and other external hazards) unless it can be shown that the contribution from specific hazard groups does not affect the decisio All hazards not addressed using PRA were screened for applicability by a peer reviewed plant-specific evaluation in accordance with RG 1.200, Revision There were no findings from this peer revie Attachment 13 of the LAR provides the results of the external hazards screening analysi The NRC staff finds that the licensee followed RG 1.177 by performing quantitative or qualitative bounding analyses of other external hazards and determining that those hazards do not impact this applicatio In addition, the proposed compensatory actions listed in the LAR would reduce any risk associated with these external hazard PRA Results and Insights The licensee evaluated the impact of the proposed change on plant risk using the internal events, internal flooding, internal fire, and seismic events PRA model This risk evaluation is specific to the PVNGS 3B EDG outage with all relevant configurations represented in the PRA models, including:

• The 3B EDG was unavailable for the 62 day perio

• The increased potential for a common cause failure of 3A EDG was minimal during the 62 day period that 3B EDG was unavailable, based on the 3B EDG failure cause evaluation presented in Attachment 4 of the LA The staff's review of this failure cause evaluation is provided in this S The sensitivity of calculated risk to this assumption was evaluated in Attachment 16 of the LAR by increasing the common cause failure probability for 3A EDG to the alpha factor value in the NRC common cause databas When crediting the portable diesel generators (DGs), the licensee's sensitivity analysis indicated that ICCDP and ICLERP met the RG 1.177 risk acceptance guidelines by a large margin as discussed in detail later in this S

• The risk evaluation used a zero test and maintenance model, because the licensee stated that elective maintenance on other risk-significant plant equipment will be prohibited during the 62 day perio The licensee stated that surveillance tests conducted during the 62 day period that will cause the tested equipment to be inoperable can be completed within the specified 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> completion time specified by TS 3.8.1. The testing elements that require this equipment to be declared inoperable during testing relate to use of temporary testing instruments or valve alignments that can be quickly restored, if neede Therefore, the use of the average test and maintenance model was considered conservative based on controls being taken to eliminate unavailability of equipment for planned maintenance, and the low likelihood of corrective maintenance occurring during the 62 day repair perio The sensitivity to this assumption on risk was evaluated in Attachment 16 of the LAR by using the average test and maintenance PRA mode When crediting the portable DGs, the licensee's sensitivity analysis indicated that ICCDP and ICLERP met the RG 1.177 risk acceptance guidelines by a large margin as discussed in detail later in this S

• The risk evaluation did not credit: - The three portable DGs that were deployed at Unit 3 and connected to the 4.16 kV AC FLEX connection box, - The diesel-driven FLEX steam generator (SG) makeup pump, and - Recovering from the failure of A or B EDG

• The risk evaluation credited the following compensatory measures, which were identified as commitments in Attachment 3 of the LAR: - An additional dedicated auxiliary operator was added to each shift to implement the auxiliary feedwater cross-tie functio A continuous fire watch was posted in fire zone FCCOR2 (120' Corridor Building). - Transient combustible and hot work exclusion zones were established in risk-significant fire zones through use of procedures and barriers/signag These zones were walked down each shif In response to request for additional information APLA RAI-1 (Reference 14), the licensee explained how the FPRA model was adjusted to credit these three compensatory measure The NRC staff concludes that these compensatory measures are appropriately reflected in the FPRA, because the adjustments are consistent with NRC guidance in NUREG-1921, "EPRI/NRC-RES Fire Human Reliability Analysis Guidelines" (Reference 17), NUREG/CR-6850, "EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, Volume 2: Detailed Methodology" (Reference 11), and NUREG/CR-6850, Supplement 1, "Fire Probabilistic Risk Assessment Methods Enhancements" (Reference 18). Also, the licensee included in the response a sensitivity analysis that quantitatively evaluated the impact of not crediting these three compensatory measures during the 3B EDG outage with credit for the portable DG This sensitivity analysis indicated that the total ICCDP and ICLERP met the RG 1.177 risk acceptance guidelines by a factor of 1.6 and 5, respectively, providing additional confidence that any uncertainties associated with the modeling of these compensatory measures would be unlikely to change the conclusions of this assessmen The licensee calculated total ICCDP and ICLERP based on the entire 62 day completion time for 3B ED These risk values are presented belo ICCDP = 9.8 x 10-6 (RG 1.177 Acceptance Guideline: < 1 x 10-5 with effective compensatory measures implemented to reduce the sources of increased risk)

ICLERP = 2.8 x 10-7 (RG 1.177 Acceptance Guideline: < 1 x 10-6 with effective compensatory measures implemented to reduce the sources of increased risk)

The staff finds that the licensee met the appropriate risk measures specific to one-time only CT changes considering the compensatory measures discussed later in this SE, and is, therefore, acceptabl Sensitivity and Uncertainty Analyses Regulatory Position 2.3.5 of RG 1.177 states that the risk resulting from TS CT changes is often relatively insensitive to uncertainties, because uncertainties associated with CT changes tend to similarly affect the base case and the change cas Section 4.3.3, Attachment 15, and Attachment 16 of the LAR presented the uncertainty and sensitivity analyses associated with the risk evaluation for this proposed chang Model uncertainties and related assumptions for the PVNGS PRAs were identified using guidance in NUREG-1855 (Reference 15) and EPRI TR-1016737 (Reference 16). In Attachment 15 of the LAR the licensee demonstrated that no additional sensitivity analyses were required to address these model uncertainties and related assumption To address potential uncertainties associated with the risk estimates for the proposed change, the licensee discussed numerous conservatisms of the PRA models, including:

• Firewater cross-connect to auxiliary feedwater was not credited in the Unit 3 IEPRA and IFPR This modification was only credited in the Unit 3 FPR

• Temporary equipment such as the three portable DGs and FLEX SG makeup pump were not credited in the PRA The DGs were only credited in the sensitivity analyses in Attachment 16 of the LA

• Fire events were assumed to, at a minimum, cause a loss of main feedwater and subsequent reactor tri

• Simplified relay fragility analyses were performed that resulted in higher failure probabilities than if detailed fragility analyses had been performe This over-estimates the failure probability of an emergency diesel generator during seismic event

• Hot shorts were conservatively assumed to occur with enough electrical contact to impose full voltage on the "target conductor."

• Non-rated fire barriers were always assumed to fai

• The main control room ventilation system was assumed unavailable or isolated during a fire even This assumption was conservative since the use of the smoke purge system would remove heat and smoke from the room, improving habitabilit

• It was assumed that containment isolation fails during all fire scenarios that necessitate main control room abandonmen In response to NRC technical concerns, the licensee provided in Attachment 16 of the LAR the following sensitivity analyses associated with the proposed change:

• The licensee performed a sensitivity analysis of the proposed change that credited the portable DGs using the zero test and maintenance mode The portable DGs were conservatively credited in the FPRA and not credited in the IEPRA, IFPRA, and SPR Failure data used for the portable DGs was dominated by human error probability (0.322) to start the DG The only fire scenarios credited for portable DGs were those that allowed sufficient time to restore power to the Class 1E bus in order to recover safety functions and mitigate the even The licensee stated that: - Operators have been trained on the procedures for loss of offsite power that specify use of alternate power sources, including the portable DG Training, briefings, and walkdowns have been provided to the operators responsible for operating the portable DG Designated operators were made familiar with instructions for starting and operating the portable DG

• It should be noted that use of the FLEX SG makeup pump was not credited in this sensitivity analysi The sensitivity analysis indicated that ICCDP and ICLERP met the RG 1.177 risk acceptance guidelines by a factor of 3.7 and 8.3, respectivel

• The licensee performed a sensitivity analysis of the proposed change that credited the portable DGs using the average test and maintenance mode The portable DGs were modeled in the same manner as the first sensitivity analysis and use of the FLEX SG makeup pump was not credite This sensitivity analysis indicated that ICCDP and ICLERP met the RG 1.177 risk acceptance guidelines by a factor of 1.5 and 5, respectivel

• The licensee performed a sensitivity analysis of the proposed change that credited the portable DGs using the zero test and maintenance model, and the common cause failure rate for 3A EDG was set to the alpha factor value (this represents common mode failure of the 3B EDG). The portable DGs were modeled the same as described in the first sensitivity analysis, and use of the FLEX SG makeup pump was not credite The sensitivity analysis indicated that ICCDP and ICLERP met the RG 1.177 risk acceptance guidelines by a factor of 3.4 and 7.7, respectivel Based on the margin by which the sensitivity analyses met the RG 1.177 risk acceptance guidelines and the multiple compensatory measures that the licensee committed to implement (or has already implemented), the NRC staff concludes that PRA model uncertainties are not sufficient to change the conclusions of the LA The LAR described how the PRA models were sufficiently complete and no new initiating events or failure modes were introduced by the proposed change and, therefore, the PRA models were able to adequately predict the change in CDF and LERF for the one-time CT extensio Based on the discussion above, the NRC staff finds that the licensee's assessment of sensitivity and uncertainty meets the guidance in RG 1.17 .3. Tier 2: Avoidance of Risk-Significant Plant Configurations Under the Tier 2 acceptance guideline in RG 1.177, the licensee should provide reasonable assurance that risk-significant plant equipment outage configurations would not occur when specific plant equipment is taken out of service in accordance with the proposed TS chang Based on configuration-specific risk insights provided by the PVNGS IEPRA, IFPRA, FPRA, and SPRA, and as part of the PVNGS Configuration Risk Management Program, the licensee identified risk-significant combinations of equipment that if out-of-service during the 3B EDG outage would significantly increase ris Next, the licensee identified further compensatory actions and restrictions to avoid these high risk equipment outage combination Attachment 3 of the LAR discussed in detail these compensatory measures and commitments that would be implemented during the 3B EDG outage to ensure the risk impacts are acceptably lo The NRC staff finds that the licensee provided an acceptable (i.e., consistent with RG 1.177) Tier 2 analysis of potential risk-significant configurations that could occur during the 3B EDG outage and used these risk insights to identify compensatory measures to preclude their occurrenc The staff notes that the licensee performed this Tier 2 analysis using PRA models of the appropriate scope, level of detail, and technical adequacy as discussed under the "PRA Quality" section of this S The staff also notes that the licensee's Tier 2 analysis used the base PRA, which conservatively does not credit FLEX equipmen The licensee used an approach consistent with RG 1.177, which provides reasonable assurance that risk-significant plant equipment outage configurations will not occur during the 3B EDG outag .3. Tier 3: Risk-Informed Configuration Risk Management RG 1.177 states that Tier 3 is the establishment of an overall configuration risk management program to ensure that other potentially lower probability, but nonetheless risk-significant, configurations resulting from maintenance and other operational activities are identified and manage RG 1.177 further states that the licensee program for compliance with 10 CFR 50.65(a)(4) ensures that the risk impact of out-of-service equipment is appropriately assessed and manage The licensee stated in Section 4.3.3 of the LAR that PVNGS has an established configuration risk management program (CRMP) that implements 10 CFR 50.65(a)(4) requirement The licensee stated that all maintenance activities associated with Unit 3 are assessed and managed per 10 CFR 50.65(a)(4) (Maintenance Rule) to evaluate the overall impact on risk of proposed plant configurations prior to, and during, the performance of maintenance activities that remove equipment from servic Based on the above, the staff finds the licensee's Tier 3 program for complying with 10 CFR 50.65(a)(4) is consistent with the guidance of Section 16.1 of the SRP and RG 1.177 and, thus, is acceptabl .3. Conclusions The licensee has demonstrated that the scope, level of detail, and technical adequacy of its PRA models are sufficient to support the proposed one-time completion time change to TS 3.8.1. The risk metrics used to support the LAR are consistent with RG 1.17 The NRC staff finds that the licensee has followed the three-tiered approach outlined in RG 1.177 to evaluate the risk associated with the proposed change and, therefore, the proposed change satisfies the fourth key safety principle of RG 1.17 .3.5 Key Principle 5: Performance Measurement Strategies - Implementation and Monitoring Program RG 1.174 and RG 1.177 establish the need for an implementation and monitoring program to ensure that no adverse safety degradation occurs because of the changes to the T An implementation and monitoring program is intended to ensure that the impact of the proposed TS change continues to reflect the reliability and availability of SSCs impacted by the chang RG 1.177 states that the licensee is to use a three-tiered approach in implementing the proposed TS CT chang Application of the three-tiered approach is in keeping with the fundamental principle that the proposed change is consistent with the defense-in-depth philosoph Application of the three-tiered approach provides assurance that defense-in-depth will not be significantly impacted by the proposed chang Furthermore, RG 1.177 states that, to ensure that extension of a TS CT does not degrade operational safety over time, the licensee should ensure, as part of its Maintenance Rule program (10 CFR 50.65), that when equipment does not meet its performance criteria, the evaluation required under the Maintenance Rule includes prior related TS changes in its scop The licensee provided a brief evaluation of the proposed TS change against the three tiered approach in the LA In addition, the 3B EDG is monitored under the PVNGS Maintenance Rule Progra If the pre-established reliability or availability performance criteria for the 3B EDG is exceeded, they are evaluated for 10 CFR 50.65(a)(1) actions, which requires increased management attention and goal setting in order to restore their performance to an acceptable leve Furthermore, the licensee described additional post maintenance monitoring and re-testing activities (e.g., isochronous load testing, 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> loaded run with 100% load reject) that will provide assurance that the long-term reliability of the SSC impacted by the change (i.e., the 3B EDG) is not degrade The staff concludes that the implementation and monitoring program for the proposed TS change described by the licensee satisfies the fifth key safety principle of RG 1.17 .4 Comparison with Regulatory Guidance As discussed in detail in this SE, within the scope of APLA's review, the licensee's proposed change is consistent with RG 1.174, RG 1.177, SRP Sections 19.1 and 1 .0 CONCLUSION The NRC staff finds that the risk impact of the licensee's request for a one-time extension of the completion time of TS 3.8.1.B.4 from 10 days to 62 days, as estimated by ICCDP and ICLERP, is consistent with the acceptance guidelines specified in RG 1.177 and the staff guidance outlined in Sections 19.1 and 16.1 of NUREG-080 The licensee's methodology for assessing the risk impact is accomplished using PRA models of sufficient scope and technical adequac For external hazards not explicitly modeled by PRA, the licensee used qualitative or bounding analyse The NRC staff finds that the licensee has followed the three-tiered approach and performance monitoring programs outlined in RG 1.17 .0 REFERENCES 1. Letter from G. Andrews, Arizona Public Service Company, to NRC, "Palo Verde Nuclear Generating Station (PVNGS), Unit 3, Docket No. STN 50-530, Renewed Operating License No. NPF-74, Emergency License Amendment Request to Extend Diesel Generator 3B Completion Time," December 30, 2016 (ADAMS Accession No. ML16365A240). 2. Regulatory Guide 1.174, Revision 2, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," May 2011 (ADAMS Accession No. ML100910006). 3. Regulatory Guide 1.177, Revision 1, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," May 2011 (ADAMS Accession N ML100910008). 4. Regulatory Guide 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities,"

March 2009 (ADAMS Accession No. ML090410014). 5. NUREG-0800, Standard Review Plan 19.2, "Review of Risk Information Used to Support Permanent Plant-Specific Changes to the Licensing Basis: General Guidance," June 2007 (ADAMS Accession No. ML071700658). 6. NUREG-0800, Standard Review Plan Section 19.1, Revision 3, "Determining the Technical Adequacy of Probabilistic Risk Assessment for Risk-Informed License Amendment Requests After Initial Fuel Load," September 2012 (ADAMS Accession No. ML12193A107). 7. NUREG-0800, Standard Review Plan Section 16.1, Revision 1, "Risk-Informed Decision Making: Technical Specifications," March 2007 (ADAMS Accession No. ML070380228). 8. ASME/ANS PRA Standard ASME/ANS RA-Sa-2009, "Addenda to ASME/ANS RA-S-2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications." 9. NEI 00-02, "Probabilistic Risk Assessment Peer Review Process Guidance," Revision A3, Nuclear Energy Institute, Washington, DC, March 20, 200 . Nuclear Energy Institute, Letter from Anthony Pietrangelo, Director of Risk- and Performance-Based Regulation Nuclear Generation, Nuclear Energy Institute, to Mary Drouin, Office of Nuclear Regulatory Research, U.S. Nuclear Regulatory Commission, Washington, DC, "NEI 00-02, 'Probabilistic Risk Assessment Peer Review Process Guidance,' Revision 1," May 19, 2006 (ADAMS Accession No. ML061510621). 11. Nuclear Energy Institute, Letter from Biff Bradley, Manager of Risk Assessment, Nuclear Energy Institute, to Mary Drouin, Office of Nuclear Regulatory Research, U.S. Nuclear Regulatory Commission, Washington, DC, "Update of Appendix D to Revision 1 of NEI 00-02, Probabilistic Risk Assessment Peer Review Process Guidance," November 15, 200 . NEI 05-04, "Process for Performing Follow-On PRA Peer Reviews Using the ASME PRA Standard," Revision 2, Nuclear Energy Institute, Washington, DC, November 200 . NUREG/CR-6850, "EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, Volume 2: Detailed Methodology," September 2005 (ADAMS Accession No. ML052580118). 14. NEI 07-12, "Fire Probabilistic Risk Assessment (FPRA) Peer Review Process Guidelines," Revision 1, Nuclear Energy Institute, July 201 . NEI 12-13, "External Hazards PRA Peer Review Process Guidelines," Nuclear Energy Institute, August 201 . Letter from G. Andrews, Arizona Public Service Company, to NRC, "Palo Verde Nuclear Generating Station (PVNGS), Unit 3, Docket No. STN 50-530, Renewed Operating License No. NPF-74, Response to NRC Requests for Additional Information (RAIs) Regarding Emergency License Amendment Request (LAR) to Extend Diesel Generator 3B Completion Time," January 2, 2017 (ADAMS Accession No. ML17002A001). 17. NUREG-1855, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making," March 200 . EPRI TR-1016737, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments," December 200 . NUREG-1921, "EPRI/NRC-RES Fire Human Reliability Analysis Guidelines," July 2012 (ADAMS Accession No. ML12216A104). 20. NUREG/CR-6850, Supplement 1, "Fire Probabilistic Risk Assessment Methods Enhancements," September 2010 (ADAMS Accession No. ML103090242).

Principal Contributor: Todd Hilsmeier, NRR/DRA