ML12194A218: Difference between revisions
StriderTol (talk | contribs) (Created page by program invented by StriderTol) |
StriderTol (talk | contribs) (Created page by program invented by StriderTol) |
||
| Line 26: | Line 26: | ||
* Beta | * Beta | ||
* Gamma | * Gamma | ||
* Delta.Given the set of MGL parameters, the current equation underestimatesthe frequency by a factor of 365/3 -122.One upper bound is provided by NUREG/CR-5750, which estimatesthe frequency at about 1 E-3 per critical operating year. This value isbased on individual unit critical years, and may not be appropriate forcases where the failure is a station failure, not a single unit failure. Analternative approach is to develop, via NUREG/CR-4780 techniques,more realistic MGL parameters that deal with loss of a system as aninitiating event not as a design basis function.Note the discussion does not question the MGL parameters. The pointbeing made is the use of the parameters in calculating the frequency.One upper bound is provided by NUREG/CR-5750, which estimatesthe frequency at about 1 E-3 per critical operating year. This value isbased on individual unit critical years, and may not be appropriate forcases where the failure is a station failure, not a single unit failure. Analternative approach is to develop, via NUREG/CR-4780 techniques,more realistic MGL parameters that deal with loss of a system as aninitiating event not as a design basis function.[Duke calc.] SAAG 427 describes the ATWS event tree analysis.Section 4, event B, describes how main feedwater is recovered after anATWS. The probabilities used for main feedwater recovery are .05,AS-1 following a T2 (Loss of Load) and .2 following a T4 (Loss of MFW). CLOSEDIn the non-ATWS analysis, the following non-recoveries (From SAAG427) are:T1 non-rec = .05 T4 -non-rec .1Attachment Page 20 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team StatusConsidering that the critical time for FW to come on line in an ATWSevent involving a loss of main feedwater is very short, even forconditions of favorable MTC, the use of non-recovery probabilities ofthis magnitude does not appear to be justified without supportinganalyses.Remove recovery for MFW in ATWS events initiated by a loss offeedwater.There were several observations on the modeling of event D3 in theSGTR tree:Event D3 is generally defined as the event to cooldown to RHRconditions using 2/3 SG for depressurization. D3 includes the HEPYAGRCOLDHE, which is directed by [procedures].1. D3 is defined as "primary system cooldown via secondary systemdepressurization". Primary system depressurization must beaccomplished in some sequences (YDlD2D3, YOD3, YUOD3), byeither PORV, aux spray, or main spray. These functions are notAS-4 included in D3. CLOSED2. Sequence YUOD3 needs a T/H justification that D3 can actuallyprevent core damage in this circumstance. This sequence has noinjection and no SG isolation. This is "core cooling recovery" with anunisolated SGTR. ECA3 specifies cool down at less than 100F/hr. Thecore cannot be maintained covered for the amount of time it takes tocooldown to RHR conditions at 1 OOF/hr. Suggested resolution is touse a separate function for this heading, using an operator actiondirected by [procedure] and without RCP operating.Attachment Page 21 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O] Observations and Recommendations by Peer Review Team jSau3. Sequence YUD1QD3. comment #2 applies to this sequence as well.This is a stuck open relief PORV with no injection.1. Add functions to D3 for primary system depressurization.2. Find specific procedure for D3 given the multiple uses insequences.3. Add a new operator action for D3 if in some sequences, the operatoraction will be called by a different procedure and then [procedures].The success criteria for AFW for SGTR is 1 CA pump to 2 steamgenerators. The ruptured SG is assumed to be one of the two steamgenerators that supply steam to the turbine-driven AFW pump. In theCatawba Rev. 2b fault tree model, however, the dependency of theTDP on the SGTR initiator is not modeled. Thus, the TDP supply isAS-7 not degraded by the initiating event in the model logic, so the model is CLOSEDincorrect.Correct the SGTR AFW pump logic in the Catawba Rev 3 update asplanned. Check that initiating event impact logic is also correct insequences for other events (e.g., T6 -SLBI).Success Criteria (Level 1 and Level 2) for some systems andsequences are supported by MAAP runs with MAAP 3b, Version 16.This version of MAAP has been found to have limitations which canimpact conclusions and results. In particular for the Catawba PRA, theTH-1 simple pressurizer model likely impacts the analyses that involve RCS The success criteria are in general agreement with those used at similarcooldown and depressurization using SG heat removal by permitting plants. Few changes are expected and the overall impact is expected toRCS depressurization to match RCS cooldown for transients, without be small.the possible need for pressurizer PORVs, spray or aux spray.Consideration should be given to re-running selected analyses with aAttachment Page 22 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team Statuslater version of MAAP code that has an enhanced pressurizer model todetermine extent of impact. Duke PRA personnel indicated that theyare currently developing a MAAP 4.0 model, which would be suitablefor this purpose and for future analyses supporting the PRA.Success Criteria analyses were not done for the range of possible plantconditions to which they are applied. For example, MLOCA successcriteria analyses are done for a 3.5 inch break, while the MLOCA isdefined as a 2 to 5 inch break. The combinations of systems andoperator recoveries that are defined as success at 3.5 inches may notbe success at 2 inches or at 5 inches. This issue also applies to largeLOCA (8.25 ft2 break analyzed) vs. a break range down to 6 inches,and small LOCA (1 inch break analyzed) vs. break sizes from' 3/8 to 2inches.Further, it was not clear that the MLOCA MAAP runs adequatelymatch the accident sequence being modeled in the PRA. Cases in OPENTH-3 [procedure] do not appear to disable accumulators when defining theminimum ECC requirements, but accumulators are not required by the No problems with the appropriateness of the success criteria have beenresulting MLOCA success criteria, identified. There are no impacts to this application.Also, MAAP is not an appropriate code to use in performing analysesfor rapid blowdown events such as large and some medium LOCAs.One possible approach would be to perform success criteria analysesfor a range of possible conditions, including the limiting break sizes.Check the MLOCA analyses to determine whether the accumulatorinjection makes a significant difference in the results and conclusions.Also, a code other than MAAP should be used if success criteriadealing with the blowdown phases of large and medium LOCAs arebeing defined.TH-5 The HEP worksheets do not clearly refer to success criteria analyses to OPEN_ _ support timing for operator actions. Although most worksheetsAttachment Page 23 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team Statusinclude an estimate of the time available for completion of an action, This F&O is considered to be a documentation issue.and some refer generally to information from MAAP analyses,specific references to MAAP (or other analysis) cases are not The current Catawba model of record used the HRA methodologyprovided, developed by SAROS. Beginning with the 2011 Oconee PRA update,Duke now uses the HRA calculator method. Based upon the OconeeReview success criteria analyses to determine whether they adequately update results using HRA calculator, the current Catawba HRA resultsreflect modeled scenarios, including expected operator actions. using SAROS are considered to be conservative and therefore bounding.Thus, this is considered to be a documentation issue only with no impacton this application.There is no room heatup analysis notebook / evaluation of loss ofHVAC to equipment rooms for the Catawba PRA, and apparently no OPENretrievable room heatup calculations or documentation to support theassumption that room cooling need not be modeled in the PRA. Other Loss of UVAC is not expected to lead to core damage. However,PRAs have found that room cooling is required for some rooms such documentation that justifies this position needs to be developed.as electrical equipment rooms and small rooms housing critical pumps.Incidentally, this F&O is under evaluation as part of the in-progressTH-6 Perform an evaluation, with equipment room-specific calculations, if McGuire PRA model update. A similar analysis for room heat-up atpossible, of the potential for, and magnitude of the room heatup for Oconee concluded that a loss of HVAC will not result in equipmentrooms housing electrical equipment, pumps, and other key equipment failures. Engineering judgment is that any potential impact fromcredited in the PRA. Document the basis for any determinations that HVAC failures at McGuire would be small. Given the similarity ofequipment will survive the anticipated room heatups, and model loss plantudes a t McGuire and.Caawba thislite isof room cooling as a failure mode in the system fault trees (with plant design and layout between McGuire and Catawba, this item isrecoveries as appropriate) for equipment that may not survive the expected to have little or no impact on Catawba as well.anticipated heatup for the PRA mission time.System success criteria are specified in the system notebooks insufficient detail to describe the overall fault tree top events, but nobasis is provided in the system notebooks for the number of pumps or CLOSEDflow rate requirements. The Reference section 18.1 does not contain alink to an appropriate success criteria calculation. For example, in theKC notebook, it is stated without a source reference that both pumpsAttachment Page 24 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O I Observations and Recommendations by Peer Review Team Statusand the associated heat exchanger in a train are required for successwhen the ND (RHR) heat exchanger is required. Similarly, in Section12 of the RN notebook, it is stated that the top events simply represent"failure to provide sufficient flow" to components requiring coolingwithout defining a flow rate or number of pumps (in Section 13 of thenotebook it does state that failure to provide flow requires failure ofall four pump trains). The CA (AFW) notebook has a similarstatement without a tie to a specific basis.A reference should be provided in Section 12 of the system notebooksfor each of the stated top event success criteria. The reference couldbe to a design basis analysis, or to a specific MAAP calculation orsome similar best-estimate analysis method. Section 12 in the NISystem Notebook file CR3NI.doc provided for the reviewers containsreferences to specific MAAP runs that serve as the basis for successcriteria, and can be used as an example.In the Component Cooling System Notebook, there is no basisprovided in Section 11.3 for excluding the failure to isolate the Non-Essential Reactor Building Header from the fault trees. In discussionwith the PRA engineer responsible for the notebook update, it wasdetermined that three valves need to fail to close for flow diversion to CLOSEDtake place, but there could be a common cause failure of these valvesthat was not justified to be excluded.Justify excluding this potential diversion flowpath in the systemnotebook or include it in the fault tree.For Catawba, there was no evaluation of the ability of non-qualified OPENSY-6 (non-EQ) equipment to survive in a degraded environment followingan accident such as a steam line of feedwater line break outside of Primarily a documentation issue. (Peer Review F&O L2-2. Level ofcontainment. Significance = C on VX fans is a specific example of another questionAttachment Page 25 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team Statuson survivability of equipment in degraded environment.)Perform an evaluation of potential adverse effects on equipmentoperation due to degraded environmental conditions resulting fromaccidents in the PRA model.Workplace Procedure is the primary data gathering procedure. It issupplemented by [procedure], Catawba PRA Revision 3 Failure RateAnd Maintenance Unavailability Data, and [procedure], the CCFanalysis report. Also, noteworthy is attachment 3, which includes theCCF checklist. Additional details are provided by Rev. 2b SummaryReport and the Rev 2 Summary Report.The data guidance is generally adequate; however it does not address OPENcomponent boundaries. Component boundaries are apparent from thedata as in the specific example in F&O DA-02, i.e., the incoming This F&O is considered to be a documentation issue.breaker and panelboard BLF. However, these should be defined inthe guidance. The industry documents used to generate the Catawba PRA database(such as NUREG/CR-6928) define the component boundaries.Consider revising guidance documents to address the treatment ofcomponent boundaries. Possible guidance sources for this include:NUREG-5497, Common Cause Failure Parameter EstimatesEPRI TR-100382, A Database of Common-Cause Events for Risk andReliability ApplicationsNUREG/CR 5500, Reliability Study: Emergency Diesel GeneratorPower Systems 1987-1993Some of the generic data from SAROS is quite dated, including OPENWASH-1400, NUREG/CR-2815, Zion PRA, and NUREG/CR-4550.DA-2 More recent generic data should be pursued. Use of more recent equipment operating experience data is desirable.Component failures should be defined such that they encompass only However, the current generic data is deemed to provide adequatethose failures that would disable the component over the PRA mission estimates of generic equipment failure rates. In addition, these failuretime. It appears that this has not been considered. Specific examples rates are Bayesian-updated with plant-specific data.Attachment Page 26 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team I Statusof less than adequate reliability data characterization were identifiedthrough review of Tables 1 and 3 in [procedure], Catawba PRA Rev. 3Failure Rate and Maintenance Unavailability Data. First, repeatevents in a short duration, where there was insufficient componentrepair should be counted as one event. An example is PIP nos. 2-C97-2481 and 2-C97-2637 on 7/29/97 and 8/12/97 for incoming breaker2CXI-5C. The first failure occurred "for no apparent reason", but thesecond failure was attributed to a failed relay. The first event shouldbe omitted as a component failure as the component was left in thedegraded condition. Second, component degradation that results infailure to meet normal criteria (e.g., to avoid component lifedegradation), may not impact the component mission for the PRA.For example, PIP no. 0-C98-2057 involved a 6/7/98 event for troublealarms for VI compressor F, and the compressor motor was foundsmoking. The evaluation addressed concern with overheating andinsulation breakdown, but did not address whether ran to failurewould survive PRA mission. Similar pump failures due to routinevibration testing exceeding limits were found (LPR 2B & IA, WO93020502 & PIP 1-C93-1124).More recent generic data sources should be pursued. Reliability datacharacterization should include evaluation of the applicability ofindividual component failures to the PRA model.The unavailabilities computed for the basic events for PORV blockvalve closure, RNC031BDEX, 033ADEX, and 035BDEX, assume thateach PORV is closed one week per quarter. However, there is noDA-5 history of PORV closures for any extended period of time in the last CLOSEDfew years.While this does use plant-specific data, the benefit derived from it islimited due to the highly conservative assumption regarding PORVAttachment Page 27 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team Statusout of service time.As the data is updated, it should be reviewed for excess conservatismsand revised to be more realistic.In [procedure], there is development of a failure probability for therupture of an MOV. The type code for this event is MVR. This typecode is used in the calculation of the ISLOCA frequency. In theDA-6 SAROS database, this distribution is composed of three equally CLOSEDweighted distributions. The three distributions have error factors ofclose to 10.0. The error factor assigned to MVR is -2.6. This isimpossible -the error factor should be close to ten.Another example of conservatism is the SBO following trip event,PACBOFTDEX. This event in the top 100 cutsets, has a 1 E-3DA-8 probability, and has not been updated since the IPE. CLOSEDReview the dominant sequences for conservative values and updatethem.A screening value of 3E-3 was initially used for all pre-initiator HEPs. OPENThere were 7 HEPs quantified in more detail, because the HEPimportance was too high. However, there were 7 Latent Human Error This observation does not necessarily have a large impact on the PRAHR-2 events with a 3E-3 probability in the top 100 importance events in the results. However, per the HR subtier criteria (HLR-HR-D & HR-D2),CR2b quantification. screening HEPs should not be used for actions appearing in significantcontributors.Provide more detailed quantification of more pre-initiator HEPs.The operating staff at the plant had some input to the HRA in thebeginning, but it is not obvious a thorough review of the dominant OPENHR-4 operator actions by the plant staff had been done, nor was it obviousthere had been any feedback of their comments into the analysis. This F&O is considered to be a documentation issue. See the responseThe level of detail and relation to the operating procedures is sparse. to F&O TH-5 above.In some instances, the procedural steps are not mentioned. In someAttachment Page 28 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team Statusplaces, the reference to the procedure is incorrect.Get operating staff more involved in the HRA.In the Catawba HRA notebook for PRA Rev 2b (and similarly in theMcGuire Rev 3 HRA notebook), the documentation of the bases forthe HEPs is not sufficiently specified to assure that the analysis isreproducible. Specifically, the sequence context (e.g., previousfailures in the event sequence, concurrent activities, environmentalfactors, etc.) and procedural steps applicable to each HEP are notconsistently provided. Thus, even though there is evidence that theHEP worksheet information is being reviewed by plant Operationspersonnel, it is not clear that they would have sufficient supportinginformation with which to make an effective assessment of the HRA. OPENSimilarly, the timing, PSF, stress level, and all other contributingHR-5 factors to the HEP were printed, but the basis was not provided. It This F&O is considered to be a documentation issue. See the responsewould not have been possible for another analyst to determine thesame factors and derive the same number. to F&O TH-5 above.The lack of such information in the documentation of the HRA limitsthe ability to verify and reproduce the results, and to determine theirapplicability in specific scenarios.Enhance the HRA documentation to address the above items. Considerdeveloping, for each important HEP, a timeline showing all importantcues and events. Reference specific steps in each procedure for eachaction, and estimate the time at which the step would be reachedduring an accident.Inconsistency among timing for similar HEPs. OPEN1R-9 There are four important times for HCR calculations:T(avail) -total time available for an action to be completed from the Primarily a documentation and consistency issue; not expected tofirst event which starts the demand for the action. significantly impact risk results. See the response to F&O TH-5 above.Attachment Page 29 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O IObservations and Recommendations by Peer Review Team I StatusT(execute) -amount of time needed to execute the actions afterdiagnosisT(1/2) -the median amount of time needed to diagnose and initiate anaction.T(window) -the time window for diagnosis T(w) = T(a) -T(e).The HCR forms used for Catawba only have an entry form forT(window) and T(1/2).The timing for the following important events is shown below;EVENT HYDBACKDHE NNVSSFADHENNVSSFBDHE TRECIRCDHE TFBLD01DHET(avail)40 45 30 18 20T(exec) 15 2 7 0 0T(window) 25 43 23 18 20T(1/2) 3 5 2 3 5 TO 10EVENT NDORWSTDHE KKCSTNDDHEPOPXC02DHE POPXCONDHET(avail) 18 10 90 90T(exec) 0 0 0 0T(window) 18 10 90 90T(1/2) 5 3 30 30The following observations are made:1) In order to be useful to prevent seal LOCA, POPXCOiDHEmust be connected by 30 minutes. If the T1/2 is 30min, there is nochance for success. There must be some execution time for this action,which means there is insufficient time for this action.2) NNVSSFBDHE should be done in 15 minutes to be consistentwith the WOG ERG guidelines about restoration of seal cooling.Attachment Page 30 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team I Status3) NNVSSFBDHE and NNVSSFADHE should have the same T(1/2), because they are similar actions with similar facilities, justunder different conditions.4) TRECIRCDHE and NDORWSTDHE are essentially the sameevent. They should have the same t(1/2). If TRECIRCDHE uses 5minutes, the HCR jumps to .014.Define the four time parameters for all HEPsDocument the basis for all four times for each HEPMake similar HEPs consistent with each other.Requantify HEP with new time data.No specific guidance is given regarding modeling of systemdependencies in the system notebooks; however, a highlyknowledgeable analyst could reproduce the given results. Adependency matrix is provided but contains little detailed explanationof how dependencies were determined. OPENDE-1 The Internal Flood Analysis does not seem to provide the detail This is a documentation issue which has been addressed in a revision torequired to reproduce the results except by a highly knowledgeable a workplace procedure. Note that the F&O states that a knowledgeableanalyst. analyst could reproduce the results.Consider providing guidance for treatment of dependencies, includingtypes of dependencies treated in the model, approaches used to modeldependencies, and important considerations regarding howdependencies may affect the model and results.HVAC cooling of the essential switchgear rooms is stated as being OPENrequired. The IPE quantitative analysis does not provide adequateDE-4 success criteria. For example, the following are not specified: Loss of HVAC is not expected to lead to core damage. However,temperature limits of equipment, minimum number of Air Handling documentation that justifies this position needs to be developed.Units, or minimum number of chillers. The evaluation also statesAttachment Page 31 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O IObservations and Recommendations by Peer Review Team I Statusthere is no concern within 24 hours provided that only those loadsneeded to provide core cooling are operated. There is no discussion ofelectrical load shedding for those loads not required, and of the humaninterface to execute load shedding. The human interface can becomplex, involving both a discovery process (control roomannunciators, or in the case of a local AHU failure, discovery throughoperator walkaround), and procedures and training to direct operationactions.A conservative estimate of essential switchgear room HVAC coolingfailures could be pursued to establish the system importance.However, if moderate importance is observed, more detailed heatupcalculations, recovery actions, and equipment models would bedesirable for a realistic system model.DE-6The PRA flooding analysis builds on a plant calculation thatdetermines flood levels in the plant. That calculation only determinesflood levels; it does not address the effects of water on equipment.The effects of spray and the effects of water on electrical equipmentare not addressed. Further, it is not evident that flood propagationimpacts were addressed, nor that probabilistic failure of flood barriers(e.g., doors) was considered.Obtain the site calculation relating to spray effects and use that todevelop information for incorporation in the PRA.Consider flood propagation impacts, and treat flood barrier failureprobabilistically.OPENSpray effects and flood propagation past flood barriers are not expectedto be significant interactions. This is a more of a completeness /documentation issue.The truncation limit of the baseline CDF at 1 E-9 is not low enough toQU-1 defend convergence toward a stable result. This is shown on page 12 CLOSEDof [procedure]. Use of the lE-9 truncation limit yields 4485 cutsets,while the 1 E-10 truncation limit yields 31512 cutsets. Thus, althoughAttachment Page 32 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team Statusthe PRA runs using 1E-9 are capturing about 85% of the CDFpredicted with a cutoff of 1E-10, they are capturing only 13% of thecutsets using the 1 E-10 truncation limit.The Duke PRA staff uses a high performance quantifier, FORTE.Quantification speed should not be a significant challenge. Oneoption to improve post-processing speed is to recode the recoveryrules and deleted events as a fault tree. Other options (e.g., sensitivitystudies at lower cutoffs to confirm the acceptability of the 1E-9 cutofffor particular applications) may also be appropriate.The IE's for certain support system failures (RN, KC) are not input inthe top event logic as a Boolean equation, but rather as a pointestimate whose value is derived by solution of the IE fault tree.However, failures that cause the IE may also affect the mitigating OPENsystem, such that there is a dependency between the initiating eventQU-2 and the available mitigation. Examples are an electrical bus that failed Modeling initiators with logic instead of point estimates wouldone train of KC and could fail one train of mitigating equipment.Another example is the operator error in the loss of KC to start the improve the accuracy of the model, although it is not expected tostandby train of KC (KKCSTNBDHE). The HRA notebook states this significantly alter the results or conclusions of the analyses.event has dependencies with HYDBACKDHE.One way to resolve this is to Input the IE as a Boolean equation.More guidance or creation of a procedure is needed to address thequantification steps. For example, there is no desktop guide orprocedure as there is for developing system fault trees.QU-4 Develop quantification guidance for PSA analysts. This should CLOSEDinclude information on the quantification codes and the runparameters. Standards for quantification commensurate with theapplication type should be included.Attachment Page 33 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team StatusEvent NDORWSTDHE: This is a recovery action to terminate the NVand NI pumps in the event of failure of ND to provide recirculationafter a SL. The event was quantified on the basis of tripping the pumpswithin 18 minutes. RWST refill was assumed to occur (fromundescribed source) and pumps were restarted to continue injection.This recovery event is applied to:a) loss of KC pumpsb) SNSDRNVLHE -drain plug blockagec) CCF of ND pumps.The recovery event is intended to provide injection flow for the longQU-5 term commensurate with the RWST make-up capability. The time of CLOSEDsome of these failure is 20 minutes, when injection requirements arebeyond the make-up capability of the RWST. Secondly, there arecutsets representing heat removal that cannot be recovered bycontinued injection of HHSI. The sequence needs continuous injectionof HHSI and heat removal from containment.Carefully define the purpose of event NDORWSTDHE.Define the RWST make-up capacity and when it is effective.Distinguish heat removal sequences from injection sequences and donot recover injection sequencesRequantify HEP to include failure to provide RWST refill.Documentation of mutually exclusive events is limited to the text file, OPENcr2b rul.txt.QU-8 This is considered to be a documentation issue and can be addressed inThe rule recovery file allows different numbers of max recoveriesmodel integration notebook.___depending on the combinations in question. ____________________________Attachment Page 34 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team StatusThere is no documentation regarding how the max recoveries wereestablished for each set of events. Examples of the content of the fileare DBLMAINT, DELSEQ, and NSHEATEX, which function asrecoveries set to 0.0Note that this applies to recovery events as well as deletedcombinations.Create a basis document for the deleted combinations and includeexamples. Establish a review process for changes to the deletedcombinations. Document the review of the max recoveries.A document containing an overview of the deleted combinations andwhy would make this portion of the model more clear. In addition,these files should be reviewed to ensure quality of the content.The Conditional core damage Probability of several Initiators from theCR2b results were evaluated. The results are:8.30E-03 Loss Of RN8.38E-03 Loss Of KC5.04E-03 Small LOCAQU- 2.30E-04 Secondary Line Break Inside Containment12 5.47E-05 LOOP CLOSED9.54E-06 FDW Line Break Outside Containment2.26E-06 Loss Of Main Feedwater2.89E-06 SGTR7.75E-07 Loss Of Load5.01E-07 Reactor TripThese results show a discrepancy between Small LOCA and SGTRAttachment Page 35 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team Statusthat is not consistent with what is normally seen in PRAs in theindustry. The CCDP for small LOCA and SGTR are usually in thesame order of magnitude because the initiators have similar mitigationfunctions such as safety injection, secondary side heat removal,primary cooldown and depressurization, and long term injection ifcooldown and depressurization are not successful. A difference of 3orders of magnitude is unusual. Also, the CCDP value for the Loss ofInstrument Air probability is identical to the Inadvertent SS Actuationprobability (to 3 significant figures), which seemed surprising.Review and explain the contributors to inadvertent SI, Loss Instr. Air1.24E-05 Inadvertent SS Actuation1.24E-05 Loss Of Instrument Air1.04E-05 Steamline Break Outside Containment and Tuberupture.Attachment Page 36 3. According to the submittal, the seismic analysis of the NSWS components andpiping caused "the seismic [core damage frequency] CDF [to show] only amodest increase using very conservative bounding assumptions ... [due to] asensitivity study [that] was performed to conservatively bound the impact ofhaving a NSWS discharge line unavailable during a seismic event." Pleaseprovide a description of the change in seismic analysis and the resulting seismicCDF and [large early release frequency] LERF for this application.Duke Energy Response:As indicated in Duke Energy's November 22, 2011 submittal, the current Catawbaseismic PRA model of record was last updated as part of Revision 3 of theCatawba PRA model. The current methodology used is the same as thatdescribed in detail in the IPE submittal and Section 3 of the IPEEE submittal, bothof which have been previously reviewed by the NRC. The reader is referred tothose references for additional details of the seismic analysis.The current seismic PRA contains the technical elements given in Section 1.2.6 ofRG 1.200, Rev. 2 as part of its current methodology. The plant-specific seismicPRA analysis consists of four steps, each of which is described below:1. The Catawba site was evaluated to obtain the seismic hazard in terms of thefrequency of occurrence of ground motions of various magnitudes. The site-specific hazard analysis was performed using the Seismicity Owners Group(SOG) methodology developed by EPRI for seismic hazard analysis of nuclearpower plant sites in the Central and Eastern United States (CEUS) and isdocumented in EPRI document RP101-53. Uncertainties were addressed inthe hazard analysis. Furthermore, Duke Energy has been actively followingdevelopments related to GI-199. In 2008, Risk Engineering Inc. performedpreliminary comparisons of the EPRI-2008 seismic hazards and EPRI-1989seismic hazards for the Duke plants. Their results indicated no significantimpact to Catawba.2. From the site-specific seismic hazard curve, the capacities of important plantstructures and equipment to withstand seismic events were evaluated todetermine conditional probabilities of failure as a function of groundacceleration for significant contributors (i.e., SSCs). These are commonlyreferred to as 'fragilities' or the site-specific fragility curves. Plant walkdownswere conducted, the most recent ones consistent with the guidelines of EPRINP-6041.3. An event tree was developed along with supporting top logic and system faulttrees to reflect plant response to seismic events. These modified logic modelswere then solved to obtain Boolean expressions for the seismic eventsequences of interest.4. The Boolean expressions were quantified by convolving the probabilistic siteseismicity and the fragilities for the plant structures and equipment obtainedin steps I and 2. The resulting sequence frequencies were then integratedAttachment Page 37 into the overall Catawba PRA risk results, resulting in final quantitativeresults.Since the IPEEE submittal, changes have been made to the seismic model suchas:* A comprehensive review and revision of the seismic analysis documentationwrite-up* The addition of component/structure fragility information to support valuesused in analysis* Updated Human Reliability Analysis (HRA) data* Updated common cause data* Editorial and logic changes to the fault tree* Updated quantitative results tableThe impact of this LAR on the seismic CDF was also reviewed. Per the Catawbaseismic PRA documentation, components with median seismic capacities inexcess of 2g were screened out of the seismic fault tree models due to their lowprobability of failure. Likewise, structures were eliminated from considerationwhen their seismic capacities were in excess of 2.5g. Among those componentsand structures screened out were the Standby Nuclear Service Water Pond Dam,the NSWS pumps, and all qualified piping and valves. Therefore, the NSWScomponents and piping are considered to be seismically-rugged and thus do notimpact this analysis.However, since the NSWS components and structures were screened out of themodel, a sensitivity study was performed to conservatively bound the impact ofhaving an NSWS discharge line unavailable during a seismic event. Using thecurrent Catawba analysis, the following safety system trains were consideredunavailable (i.e., set to '1') in the seismic cut sets:* Auxiliary Feedwater Motor-Driven Pump 'B' (CA MDP 'B')* Safety Injection Train 'B' (NI 'B')" Emergency Diesel Generator 'B' (D/G 'B')* Component Cooling Train 'B' (KC 'B')* Residual Heat Removal Train 'B' (ND 'B')The standby trains of these systems were made available (i.e., set to '0') in theseismic cut sets.The cut sets were then processed using Duke Energy's seismic analysis code('SEISM') to calculate a new seismic CDF of 1.35E-05/yr. With a current baselineCatawba seismic CDF of 1.14E-05/yr, this represents an increase of 2.1E-06/vr(which equates to 8.1 E-08 per 14-day period). The current Catawba seismic modeldoes not include LERF; however, based on the most recent seismic LERFanalysis performed for the Oconee station, it is expected to be about one order ofAttachment Page 38 magnitude less than the CDF. Again, this is a conservative bounding value sinceboth trains of each safety system would normally be available while an NSWSdischarge line is out of service. It is expected that the actual seismic CDF wouldbe smaller than this value. In addition, there were no new failure modesintroduced and consideration of the seismic impact is thus not a factor for thisassessment.In accordance with the discussion in this section and the results of theconservative bounding analysis above, Duke Energy considers inclusion of theseismic results as insignificant to the overall results and is not considered to be apotentially significant hazard. It is judged that the analyses assessing theinfluence of seismic events provide an acceptable evaluation of the contributionof the seismic risk for the requested Completion Time of 14 days.4. Please provide a description of the internal fire PRA analysis and resultingchange in internal fire CDF and LERF for this application.Duke Energy Response:The current Catawba fire PRA model analysis and methodology used in the modelof record is the same analysis and methodology as described in the IPEsubmittal; Section 4 and Appendix B of the IPEEE submittal; and as discussed inthe Supplemental IPEEE Fire Analysis Report, all of which have already beenreviewed by the NRC.The plant-specific fire PRA analysis consists of four steps, each of which isdescribed below:1. The Catawba site and plant areas were analyzed to determine critical fire areasand possible scenarios for the possibility of a fire causing one or more of apredetermined set of initiating events. Screening criteria were defined forthose fire areas excluded from the fire analysis.2. If there was a potential for an initiating event to be caused by a fire in an area,then the area was analyzed for the possibility of a fire causing other eventswhich would impact the ability to shutdown the plant. These were identifiedby reviewing the impact on the internal event analysis models.3. Each area was examined with an event tree fire model to quantify fire damageprobabilities. The event tree related fire initiation, detection suppression, andpropagation probabilities to equipment damage states.4. Fire sequences were derived and quantified based on the fire damageprobabilities and the additional failures necessary for a sequence to lead to acore melt. The additional failures were quantified by the models used in theinternal events analysis.The major changes to the current fire analysis that have been made since theIPEEE submittal deal with implementation of changes from the SupplementalAttachment Page 39 IPEEE Fire Analysis Report and revised base case fire initiating eventfrequencies.Since the Catawba fire PRA model is integrated into the overall PRA model,quantitative fire risk insights can be obtained for the LAR. The cut sets generatedfor the analysis presented in Question I above were reviewed to determine thecontribution level of the fire initiating events. Internal fire events contributedapproximately 10% of the CDF and 3% of the LERF. Whereas fire-induced loss ofNSWS events are included in the PRA model, they did not appear in any coredamage or large early release sequences (above the respective truncation limits).Furthermore, in comparing the delta risk cut sets created in support of the LARanalysis (i.e., those cut sets whose values showed an increase in the LARconfiguration when compared to their values in the 'base case' configuration), nointernal fire sequences of any type appeared in the core damage and large earlyrelease results. Therefore, the contribution from fire events for the LARconfiguration impacting the NSWS is deemed negligible.Finally, from a deterministic standpoint, consider that the NSWS essential headerdischarge valves and the discharge valve to the Standby Nuclear Service WaterPond (SNSWP) will remain open during the requested 14-day Completion Timewith power removed. Therefore, fire events affecting power to these valvescannot cause their spurious operation and thus would have no effect on theNSWS discharge alignment during the Completion Time.Given the negligible influence of fires on the NSWS for the LAR configuration,fires are not considered to be a potentially significant hazard. It is judged that theanalyses assessing the influence of internal fire events provide an acceptableevaluation of the contribution of the fire risk for the requested Completion Time of14 days.5. Please provide a description of the internal/external floods PRA analysis andresulting change in internal flooding CDF and LERF for this application.Duke Energy Response:Flooding events at Catawba have been assessed via the IPE process and arenoted in Sections 3.3.5 and 3.4 of the IPE submittal. Internal flooding events areprimarily caused by plant piping ruptures while external floods are mostly causedby very heavy precipitation events. The external events portion is recreated inSection 5.2 of the IPEEE report. As mentioned above, the IPE and IPEEEsubmittals have already been reviewed by the NRC.Per the Design Basis Document for external flooding, flood levels for the sitewere analyzed for the following flood producing phenomena:1. Probable Maximum Flood (PMF) resulting from the Probable MaximumPrecipitation (PMP) positioned appropriately over the Catawba River Basin.Attachment Page 40 2. Probable Maximum Flood (PMF) resulting from the Probable MaximumPrecipitation (PMP) positioned appropriately over the tributary area of theSNSWP.3. Standard Project Flood (SPF) passing through Lake Wylie (positioned overeach Catawba River basin drainage area) combined with the failure of one ofthe upstream dams because of an Operating Basis Earthquake (OBE). TheSPF is considered equal to one-half of the PMF.4. Surge and seiche effects caused by probable maximum hurricane.5. Coincident wave runup due to a 40 mph wind.6. Local intense precipitation (PMP) occurring over the immediate project site.In the IPEEE report, it was concluded that the contribution to plant risk fromexternal flooding would be insignificant compared to the risk from internalflooding.The plant-specific Catawba internal flooding analysis was performed in six steps:1. Identification of the critical flood areas2. Calculation of flood rates3. Development of flood probabilities4. Identification of critical flood levels5. Assessment of human response for flood isolation6. Development and quantification of the flood core damage cut setsThe major change made to the current internal flood analysis since the IPE andIPEEE submittals deals with the installation of concrete flood walls in the TurbineBuilding basement to protect essential 4160V ac switchgear against largeflooding events. As a result, flooding initiator probabilities which would result ineither a reactor trip or a loss of the transformers have been significantly reduced.As with the fire analysis, the Catawba internal flooding PRA model is integratedinto the overall PRA model; therefore, quantitative flood risk insights can beobtained for the LAR. The cut sets generated in the response to Question 1 abovewere reviewed to determine the contribution level of the flooding initiating events.Internal flooding events comprise approximately 2% of the CDF and less than 1%of the LERF. The majority of this contribution comes from a flooding event in theAuxiliary Building which results in a loss of the Auxiliary Shutdown Panel.As indicated previously, the NSWS discharge piping associated with this LARresides in the Auxiliary Building; thus, it could be postulated that this area couldbe more susceptible to flooding risk during the Completion Time. Duke EnergyNuclear System Directives require the station to give consideration to plantconfigurations which could potentially cause internal flood hazards resulting in afailure of risk significant structures, systems, and components. Furthermore, themanual and motor operated valves installed in this portion of the NSWS areAttachment Page 41 Fisher Posi-Seal butterfly valves. When these valves are closed, there is not acredible failure that would cause them to change position or catastrophicallycome apart. In the closed position, the operator gearbox will hold the valve discstill. The gearbox operators are manufactured by Limitorque and have lockinggear sets that will not move even during a seismic event. Therefore, exposing theisolated NSWS discharge piping during the 14-day Completion Time is consideredto have a negligible impact on flooding risk in the Auxiliary Building. As asensitivity study, the value for the Auxiliary Building flood initiator in the PRAmodel was increased by its error factor (7.5) from 5.5E-06 to 4.13E-05. As a result,the CDF for the Completion Time configuration increased by only 9.8% and thecorresponding LERF increased by only 2.2%. Thus, the impact on internalflooding is considered insignificant.Given the negligible influence of flooding events for the LAR configuration, floodsare not considered to be a potentially significant hazard. It is judged that theanalyses assessing the influence of these events provide an acceptableevaluation of the contribution of the flood risk for the requested Completion Timeof 14 days.6. Please provide a description of the tornado/high winds PRA analysis andresulting change in the tornado/high winds CDF and LERF for this application.Duke Energy Response:As with earthquakes, fires, and floods, an assessment for tornados and otherhigh wind events at Catawba has been performed via the IPE process as well aswith the IPEEE process.The plant-specific Catawba tornado/high wind analysis was performed in threesteps:1. Calculation of occurrence frequency2. Tornado missile analysis3. Tornado wind analysisThe major changes to the tornado analysis since the IPE and IPEEE submittalsinclude the following:* enhancements to the diesel generator building modeling* addition of the upper surge tank, condensate storage tank, and portableinstrument air diesel compressor* revised switchyard strike frequencyAs with the fire and flooding analyses, the Catawba tornado PRA model isintegrated into the overall PRA model; therefore, quantitative tornado risk insightscan be obtained for the LAR. The cut sets generated in response to Question 1above were reviewed to determine the contribution level of the tornado initiatingevents. The cut sets generated for the LAR analysis were reviewed to determineAttachment Page 42 the contribution level of the tornado initiating events. Only one event (TornadoCauses a Loss of Offsite Power) contributed to the CDF (- 3%) and the LERF (~4%). Typically, these cut sets include a loss of the diesel generators and eitherAuxiliary Feedwater or the Standby Shutdown Facility. A review of the delta riskcut sets created in support of the LAR analysis found that, while tornado eventswere a significant contributor to the ICCDP, this contribution comes from theincreased tornado frequency value ('seasonal factor') used in the risk assessmentto account for historic increased tornado activity during the months of March,April, and May, rather than from interactions with the NSWS configuration.Furthermore, even though the NSWS provides cooling to the diesel generators aswell as the assured source of Auxiliary Feedwater, functionality of the NSWSfollowing a tornado event is governed by the operability of the diesel generatorsand would not be altered per the configuration found in the 14-day CompletionTime. Therefore, the impact of tornados and high wind events is negligible.Given the negligible influence of tornado and high wind events on the NSWS forthe LAR configuration, they are not considered to be a potentially significanthazard. It is judged that the analyses assessing the influence of these eventsprovide an acceptable evaluation of the contribution of the tornado and high windrisk for the requested Completion Time of 14 days.7. BackgroundThe guidelines of RG 1.177 state that one of the elements of consistency withdefense-in-depth philosophy is maintaining "defenses against potential common-cause failures (CCFs).... " In the proposed new Condition C for TS 3.7.8 onlyone path of NSWS discharge flow to the standby nuclear service water pond(SNSWP) is available when one NSWS header is isolated between 1RPN-19 to1 RN63A or between 1 RPN-20 to 1 RN58B and flow is blocked to Lake Wylie.IssueIf the only operable NSWS discharge header, as described above, had a pipebreak or became blocked or became inoperable, all NSWS cooling could stop.Requesta) Discuss your contingency plans, training, procedures, and compensatorymeasures to restore NSWS and maintain core and spent fuel poolcooling, in the event that this sole return to the SNSWP unexpectedlybreaks/cracks or becomes flow blocked causing a total loss of NSWScooling.Duke Energy Response:If the in service flowpath to the SNSWP were to become blocked or tobecome unavailable for any other reason, the Operator Aid Computer,control room annunciators, and control room indications are all availableAttachment Page 43 to aid the operator in determining if a loss of flowpath were to occur.Procedures will aid the operators in determining the nature of the event,and will direct the operators to realign the NSWS back to Lake Wylie ifappropriate. NSWS valves I RN57A and 1 RN843B are the in-series returnisolations to Lake Wylie. These valves will be closed per procedure whenthe NSWS is aligned in the single discharge header configuration.However, power will not be removed from these valves and they are motor-operated valves that can be repositioned, as directed by procedure, fromthe control room. Operators are trained on existing procedures for plantflooding and loss of the NSWS. Operators will receive additional trainingon the NSWS single discharge header alignment prior to implementation.b) Discuss any other possible CCF and associated contingency plans,training, procedures and compensatory measures or discuss why otherCCF's do not exist.Duke Energy Response:The NSWS alignment for the single discharge header configuration wasdeveloped with PRA guidance. First, the NSWS is aligned to the ultimateheat sink (the SNSWP), which eliminates the possibility of the worst casesingle failure of the NSWS, the loss of one train during a swap from LakeWylie to the SNSWP. Additionally, the return header motor-operatedcrossover valves 1 RN53B and I RN54A are tagged open with powerremoved to ensure a flowpath for the in service Unit I NSWS train. Themotor-operated discharge isolation valve for the out of service NSWS trainis tagged closed with power removed. Additional measures to ensure thatthe valve disc on the out of service NSWS train does not reposition arediscussed in the response to Question 10a. The motor-operated dischargeisolation valve for the in service NSWS train is tagged open with powerremoved to ensure it cannot be inadvertently repositioned. If the manually-operated isolation valves IRNP19 and IRNP20 were to leak due to disc orvalve seat failure, there are redundant isolation valves that can berepositioned to isolate the failure. Note that the piping coating work andthe valve isolation boundaries are in the same room in the AuxiliaryBuilding on the same elevation. Any problem with failures or floodingwould be immediately apparent to the personnel performing the work. TheNSWS single discharge header alignment and the associated isolationvalves will be controlled by procedure and by the Safety Tagging Program.Operators are trained on existing procedures for plant flooding and loss ofthe NSWS. Operators will receive additional training on the NSWS singledischarge header alignment prior to implementation.8. BackqroundProposed new Condition C defines a new TS Condition statement where aNSWS discharge header is inoperable. This condition makes the associatedNSWS train for Catawba 1 inoperable, causing a condition that does not meetAttachment Page 44 the limiting condition for operation (LCO). Cases 1 and 2 as shown in the LARon attachment 1, page 17, describe initial conditions for new Condition C.IssueThe licensee is additionally placing a Catawba 2 diesel generator (DG) and aCatawba 2 NSWS pump out of service as an initial condition and calling this asingle failure. Single failures are normally failures that are postulated to occurafter a design basis accident, not as initial conditions.RequestPlease explain:a) Why are DGs and NSWS pumps placed out of service for maintenanceand called single failures? [in the initial conditions and Note 9 of cases 1and 2]Duke Energy Response:The wording in the supporting calculation has been revised to remove thewords "single failure" from the description and simply say that the DGsand NSWS pumps are out of service for maintenance. The reason that theUnit 2 DG and U2 NSWS pump are assumed to be out of service formaintenance is described below in the response to Question 8b.b) Since DGs 2A and 2B can discharge to the SNSWP downstream of1 RN63A and 1 RN58B, and apparently do not have to be out of service,why are they assumed to be unavailable?Duke Energy Response:When a unit is shut down, it is typical to perform maintenance on theassociated unit's NSWS pumps and DGs. The proposed single dischargeheader alignment will only be allowed when Unit 2 is in Mode 5, 6, or NoMode. The submittal and associated PRA assumes that the NSWS pumpand DG on the associated train is out of service for maintenance. Forexample, when aligned in the single discharge header configuration withthe Train A discharge header to the SNSWP out of service, the Unit 2 TrainA NSWS pump and the Unit 2 Train A DG are assumed to be out of service.9. BackgroundThe licensee is proposing a single discharge header alignment to allow a portionof each of the NSWS return headers in the Auxiliary Building to the SNSWP tobe removed from service for cleaning, repairing, coating and inspecting. Thelicensee has stated these activities "will ensure the long-term reliability of theNSWS."Attachment Page 45 IssueThe proposal addresses the short length of NSWS piping in the AuxiliaryBuilding, while most of the NSWS discharge piping to the NSWSP and LakeWylie is outside the Auxiliary Building.Requesta) Explain how the work on the short length of piping in the AuxiliaryBuilding ensures long term reliability of the NSWS, when most of the pipeis outside the Auxiliary Building.Duke Energy Response:With the exception of this piping, the NSWS piping in the Auxiliary Buildingwith a diameter greater than 30 inches has been coated with epoxy. TheNSWS piping in the Auxiliary Building with a diameter of 30 inches andsmaller has been replaced with a corrosion resistant, superausteniticnickel stainless steel alloy, commonly called AL6XN.The buried NSWS piping is discussed in the response to Question 9b.b) What will be done to clean, repair, coat and inspect the NSWS pipingoutside the Auxiliary Building?Duke Energy Response:The buried carbon steel NSWS piping from Lake Wylie to the NSWSpumphouse has been cleaned and coated with epoxy. The buried carbonsteel NSWS piping from the NSWS pumphouse to the Auxiliary Buildinghas been cleaned and coated with epoxy. The buried carbon steel pipingto and from the Unit I and Unit 2 DGs was replaced with high densitypolyethylene (HDPE) and AL6XN. The buried carbon steel NSWS pipingfrom the Auxiliary Building that discharges to Lake Wylie has been cleanedand coated with epoxy.The buried NSWS piping from the SNSWP to the NSWS pumphouse andthe NSWS piping from the Auxiliary Building to the SNSWP has not beencoated. The normal alignment for the NSWS is to have the suction anddischarge aligned to Lake Wylie, and the NSWS piping in this flowpath hasbeen cleaned and coated with epoxy or replaced.The NSWS piping from and to the SNSWP is not the normal flowpath andprevious inspections have shown that this piping has not experienced thecorrosion and degradation seen in the piping that is normally in service.This piping is inspected per the Service Water Piping Inspection Programand the Buried Piping Program, which are part of the Service Water PipingCorrosion Program described in the Aging Management Programs andAttachment Page 46 Activities section in the Catawba UFSAR, Section 18.2.24, Service WaterPiping Corrosion Program.10. BackgroundDuring the proposed single discharge header lineups, valves 1 RN63A, 1 RN58B,1RPN19A and 1RPN20 isolate the pipe to be worked and form single valvebarriers from Lake Wylie and the SNSWP to the Auxiliary Building.IssueFailure of any of the valves or personnel error could allow flooding into theAuxiliary Building.Requesta) Discuss the elevation of the work boundaries 1 RN63A, 1 RN58B,1RPN19A and 1RPN20 as compared to the maximum elevation of theSNSWP and the maximum elevation of discharge pipes to the SNSWP.Describe design features that will prevent the SNSWP and/or NSWSdischarge piping from draining into the Auxiliary Building if workboundaries failed/leaked or personnel error breached the work boundary.Duke Energy Response:The normal SNSWP top-of-pond elevation is approximately 574.0 feet MeanSea Level (MSL). The centerline elevation of the 42 inch SNSWP returnTrain A and Train B NSWS piping in the Auxiliary Building is 581.25 feetMSL. Therefore, it is not possible to siphon the SNSWP back into theAuxiliary Building if valve I RN63A or I RN58B were to fail open and therewas not a simultaneous Probable Maximum Precipitation (PMP) event.As described in Catawba UFSAR Section 3.4, "Water Level (Flood) Design",during a PMP event, the elevation of the SNSWP could reach approximately583.5 feet MSL. Therefore, if the valve failure were to occur simultaneouslywith a PMP event, it would be possible to siphon the SNSWP into theAuxiliary Building. A PMP event would only occur due to a major weatherevent, and the NSWS single discharge header alignment will haveprocedural requirements to verify that no severe weather is in the forecastprior to implementation.The NSWS discharge piping to the SNSWP in the yard does have a highpoint of 594.75 feet MSL centerline elevation. If 1 RN63A or 1 RN58B were tofail open, this water could flood the Auxiliary Building. Measures will betaken to prevent these valves from repositioning, and these measures arediscussed below.Any passive valve seat leakage on valves I RN63A or I RN58B will beaddressed depending on the amount of leakage. To enable personnel toAttachment Page 47 work in the adjacent piping, the system must be drained anddepressurized, and released for work through the Safety Tagging Program.If there is excessive seat leakage such that the system cannot be drainedand depressurized, the NSWS could not be opened and released for workuntil the leakage is controlled.To prevent inadvertent repositioning of valves I RN63A or I RN58B, thevalves will be controlled by procedure and by the Safety Tagging Program.Additionally, to prevent the possibility of the valve discs on I RN63A orIRN58B repositioning and causing Auxiliary Building flooding, the valveswill be inspected and gagged if required. From a review of the OperatingEquipment Database and the industry failures concerning this type ofbutterfly valve, the primary failure mode which could enable the valve discto reposition is a failure of the disc to valve stem pins. To preclude thisfailure mode, the valve to disc pins will be verified to be installed. If thepins cannot be verified to be installed, a mechanical gag will be installed toprevent the valve disc from repositioning. These measures are intended topreclude the possibility of Auxiliary Building flooding and possiblesiphoning of the SNSWP due to the valve disc repositioning.Valves 1RNP19 and 1RNP20 are manually-operated butterfly valves. Thecenterline elevation of the 42 inch piping adjacent to valves 1RNPI9 and1 RNP20 is 585.75 feet MSL. If these valves were to reposition or have aseat or disc failure resulting in leakage, there are redundant isolationvalves that can be closed to isolate the failure and mitigate flooding. Toprevent inadvertent repositioning, these valves will be controlled byprocedure and by the Safety Tagging Program.b) Discuss additional backup isolation features and compensatory measuresto prevent internal flooding.Duke Energy Response:As described in the response to Question 10a, the position of valvesI RN63A or 1 RN58B will be controlled by procedure and by the SafetyTagging Program. Additionally, to prevent the possibility of the valve discson 1RN63A or 1RN58B repositioning and causing Auxiliary Buildingflooding, the valves will be inspected and gagged if required.To prevent inadvertent repositioning of valves IRNP19 and IRNP20, thevalves will be controlled by procedure and by the Safety Tagging Program.Additionally, if these valves were to reposition or have a seat or disc failureresulting in leakage, there are redundant isolation valves that can beclosed to isolate the failure and mitigate flooding.11. BackgroundThe LAR describes two cases of single discharge header operation, i.e. a) pipebetween 1 RPN63A and 1 RPN 19 is isolated, and b) pipe between 1RPN58B andAttachment Page 48 1 RPN20 is isolated. In each case NSWS return header crossover valves areopen with power removed; the NSWS return isolation valve to the SNSWP isopen (power removed); NSWS suction is aligned to the SNSWP; and Lake Wyliedischarge isolation valves are closed.The updated facility safety analysis report (UFSAR) refers to the NSWSdischarge headers as the A header and the B header, each serving both units.The LAR description and the proposed new Insert 2 for the proposed TS Basesrefer to both headers as the Catawba 2 discharge headers.New Condition C of the proposed TS refers to them individually as one NSWSAuxiliary Building discharge header.IssueThe above descriptions of the NSWS discharge headers in the TS Bases andnew Condition C are unclear without reading the LAR. New Condition C and theBases (Insert 3) do not define which portion of the discharge is allowed to beinoperable and the special lineup for safety that is described in the LAR.Therefore, operators may be inconsistent in plant configuration when enteringnew Condition C. Inspectors may not be able to know valid Condition C lineups.RequestExplain the licensee's intent to adequately define single discharge headeroperation in the UFSAR, new Condition C, and TS Bases, so that operators canalign the plant to meet new Condition C as defined in the LAR when allowed, andinspectors can know the required discharge header alignment when in newCondition C.Duke Energy Response:For this response, please refer to the revised reprinted TS and TS Basesthat are included at the end of this attachment. As indicated in the May 3,2012 telephone conference call between Duke Energy and the NRC, the TSBases for new Condition C have been expanded to define the lineup for thesingle Auxiliary Building discharge header alignment. As discussed in theconference call, this level of detail is not necessary for inclusion in the TSitself. Finally, as indicated in the conference call, Duke Energy commits toinclude corresponding detail regarding the single Auxiliary Buildingdischarge header alignment in the UFSAR following NRC approval of thisamendment request. THIS CONSTITUTES A REGULATORY COMMITMENT.12. BackgroundInsert 2 of the proposed TS Bases describes the NSWS operating in the singledischarge header alignment. This places Catawba 1 in new Condition C of theproposed TS which describes a condition where LCO 3.7.8 is not met. However,Insert 2 also says that each NSWS train is operable.Attachment Page 49 Issuea) The licensee has placed the proposed Insert 2 for the single dischargeheader lineup in the LCO section of the TS Bases. However, as statedabove, the single discharge header lineup does not meet the LCO.b) Insert 2 states that each NSWS train is operable. Yet, Insert 2 describesCondition C which does not meet the LCO. Therefore, not all NSWStrains would be operable. Throughout the LAR, the licensee lists eitherNSWS 1A or 1B train as inoperable when in the single discharge headerlineup. Thus Insert 2 conflicts with the background/technical evaluation inthe LAR.RequestExplain the inconsistencies in the location of Insert 2 in the TS Bases and thecontent of Insert 2 as described above in a) and b) and correct Insert 2 asappropriate.Duke Energy Response:For this response, please refer to the revised reprinted TS and TS Basesthat are included at the end of this attachment. The primary function ofInsert 2 in the original submittal was to clarify the conditions under whichthe Unit 1 required NSWS trains could be considered to be operable whilethe NSWS is operating in the single Auxiliary Building discharge headeralignment. It is acknowledged that while operating in this alignment, theLCO is not met. However, since Unit 2 must be in Mode 5, 6, or No Modewhile in this alignment, the train related NSWS pump associated with theAuxiliary Building discharge header that is removed from service may alsobe removed from service. With the exception of the Auxiliary Buildingdischarge header that is inoperable per Condition C, this does nototherwise impact the operability of the two NSWS trains required for Unit1. This Bases discussion was relocated under Condition C, where it ismore appropriate. (For consistency, the similar Bases discussion forsingle supply header alignment was also relocated under Condition B,where it is more appropriate.) In addition, this Bases discussion wasmodified to clarify that it is applicable to single Auxiliary Buildingdischarge header alignment, since only the Auxiliary Building portion ofthe discharge header may be inoperable per Condition C.When in the single Auxiliary Building discharge header alignment with theNSWS Train A discharge header inoperable, the NSWS piping betweenvalves IRNP19 and IRN63A is isolated. With the piping between IRNP19and I RN63A isolated, Unit 1 and Unit 2 do not have their train-relatedflowpath to the SNSWP available. Therefore the Unit 1 Train A NSWSdischarge header is inoperable due to the single Auxiliary Buildingdischarge header alignment. In the single Auxiliary Building dischargeAttachment Page 50 header alignment, Unit 2 must be in Mode 5, 6, or No Mode, and the TS forthe NSWS is not applicable in these modes.Likewise, when in the single Auxiliary Building discharge header alignmentwith the NSWS Train B discharge header inoperable, the NSWS pipingbetween valves IRNP20 and 1RN58B is isolated. With the piping betweenI RNP20 and I RN58B isolated, Unit I and Unit 2 do not have their train-related flowpath to the SNSWP available. Therefore the Unit I Train BNSWS discharge header is inoperable due to the single Auxiliary Buildingdischarge header alignment. In the single Auxiliary Building dischargeheader alignment, Unit 2 must be in Mode 5, 6, or No Mode, and the TS forthe NSWS is not applicable in these modes.13. BackgroundWhen in a single discharge header lineup, the background/technical sections ofthe LAR state that Catawba 2 must be in Mode 5, 6 or no Mode.IssueNew Condition C of the TS as proposed in Insert 1 does not specifically requirethat Catawba 2 be in Mode 5, 6 or no Mode.RequestExplain why new Condition C of the TS does not require that Catawba 2 be inMode 5, 6, or no Mode.Duke Energy Response:For this response, please refer to the revised reprinted TS and TS Basesthat are included at the end of this attachment. Note 1 of new Condition Chas been expanded by adding the following statement: "Entry into thisCondition shall not be allowed while Unit 2 is in MODE 1, 2, 3, or 4." Thisstatement was deemed preferable to a statement requiring Unit 2 to be inMode 5, 6, or No Mode for two reasons: 1) the term "No MODE" is notutilized in TS, and 2) the chosen statement is consistent with other Notesin TS governing Mode prohibitions, which are typically stated in thenegative.14. BackgroundInsert 3 of the LAR states"... Condition C is only allowed to be entered in supportof planned maintenance or modification activities associated with the AuxiliaryBuilding discharge header that is taken out of service. An example of a situationfor which entry into this Condition is allowed is refurbishment of an AuxiliaryBuilding discharge header. Entry into this Condition is not allowed in response tounplanned events or for other events involving the NSWS."Attachment Page 51 The LAR cover letter and description describes the proposed scope to be for theNSWS discharge header to be removed from service for cleaning, coating andfollow-up inspections.IssueInsert 3 defines the allowed entry into Condition C to be much broader than thescope delineated in the rest of the LAR.RequestExplain how you will modify Insert 3 to be consistent with the rest of the LAR.Duke Energy Response:The original scope of activities that warranted the submission of this LARwere associated with removing the Auxiliary Building portion of a NSWSdischarge header from service for cleaning, coating, and follow-upinspections. This submittal specifically excludes emergent work as asituation under which Condition C may be entered. However, there may beother pre-planned maintenance or modification activities in the future thatare appropriate for entry into Condition C that have not yet beenanticipated. Over the years, several one-time TS change requests weresubmitted and approved which supported pre-planned maintenanceactivities associated with the NSWS supply headers at Catawba. In aneffort to avoid additional one-time requests, Duke Energy submitted, andthe NRC approved, a permanent TS change to allow the NSWS supplyheaders to be removed from service for pre-planned maintenanceactivities. This submittal for the NSWS Auxiliary Building dischargeheaders is therefore consistent with previous Catawba submittal/approvalhistory. The TS Bases are written specifically enough to only allow pre-planned maintenance activities, without being overly specific so as todisallow future unanticipated types of these activities. Therefore, nochanges to the TS Bases are being proposed in response to this question.15. BackgroundThe guidelines of RG 1.177 state that the licensee "should consider... whetherthere are appropriate restrictions in place to preclude simultaneous equipmentoutages that would erode the principles of redundancy and diversity," and"whether compensatory actions to be taken when entering the modified[completion time] CT for preplanned maintenance are identified."When operating in a single discharge header as proposed by the LAR, oneNSWS train is inoperable. NSWS is a support system. In accordance with TS3.0.6, the corresponding supported systems are required to be declaredinoperable if determined to be inoperable as a result of the support systeminoperability. Supported systems include Emergency Core Cooling System,Containment Spray System, Containment Valve Injection Water System,Auxiliary Feedwater, Component Cooling Water, Control Room Area VentilationAttachment Page 52 System, Auxiliary Building Filtered Ventilation Exhaust System, and EmergencyDiesel Generators.IssueThe licensee has not identified any inoperable systems that are supported byNSWS in the LAR. The licensee has not expressed any compensatorymeasures to ensure the redundant trains of supported systems are protected toreduce the risk of loss of safety function. The licensee has not described anyevaluation required by LCO 3.0.6 to perform an evaluation in accordance with TSAdministrative Control 5.5.15, "Safety Function Determination Program (SFDP)"for supported systems.RequestIdentify all inoperable supported systems as a result of each inoperable NSWStrain. Identify all compensatory measure to protect the redundant system asdetermined by TS Administrative Control 5.5.15.Duke Energy Response:The TS systems supported by the NSWS include the following:TS 3.4.6, RCS Loops -MODE 4 (cascade required only when all NSWScooling is inoperable per Note 2 in TS 3.7.8, Required Action A.1)TS 3.5.2, ECCS -OperatingTS 3.5.3, ECCS -ShutdownTS 3.6.6, Containment Spray SystemTS 3.6.17, Containment Valve Injection Water System (CVIWS)TS 3.7.5, Auxiliary Feedwater (AFW) SystemTS 3.7.7, Component Cooling Water (CCW) SystemTS 3.7.11, Control Room Area Chilled Water System (CRACWS)TS 3.8.1, AC Sources -Operating (DGs) (cascade required only when allNSWS cooling is inoperable per Note I in TS 3.7.8, Required Action A.1)Per the requirements of LCO 3.0.6, the Conditions and Required Actionsassociated with the supported systems are not required to be entered.Only the support system LCO Actions are required to be entered. TS5.5.15, Safety Function Determination Program, ensures that a loss ofsafety function is detected and appropriate actions are taken.While the NSWS is aligned in the single Auxiliary Building dischargeheader configuration, procedures will direct compensatory measures. Theprocedures for aligning the NSWS in the single Auxiliary Buildingdischarge header configuration will include the following measures:* Verify flood barriers in the Turbine Building basement prior toimplementation.* Verify no severe weather is in the forecast prior to implementation.Attachment Page 53 | * Delta.Given the set of MGL parameters, the current equation underestimatesthe frequency by a factor of 365/3 -122.One upper bound is provided by NUREG/CR-5750, which estimatesthe frequency at about 1 E-3 per critical operating year. This value isbased on individual unit critical years, and may not be appropriate forcases where the failure is a station failure, not a single unit failure. Analternative approach is to develop, via NUREG/CR-4780 techniques,more realistic MGL parameters that deal with loss of a system as aninitiating event not as a design basis function.Note the discussion does not question the MGL parameters. The pointbeing made is the use of the parameters in calculating the frequency.One upper bound is provided by NUREG/CR-5750, which estimatesthe frequency at about 1 E-3 per critical operating year. This value isbased on individual unit critical years, and may not be appropriate forcases where the failure is a station failure, not a single unit failure. Analternative approach is to develop, via NUREG/CR-4780 techniques,more realistic MGL parameters that deal with loss of a system as aninitiating event not as a design basis function.[Duke calc.] SAAG 427 describes the ATWS event tree analysis.Section 4, event B, describes how main feedwater is recovered after anATWS. The probabilities used for main feedwater recovery are .05,AS-1 following a T2 (Loss of Load) and .2 following a T4 (Loss of MFW). CLOSEDIn the non-ATWS analysis, the following non-recoveries (From SAAG427) are:T1 non-rec = .05 T4 -non-rec .1Attachment Page 20 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team StatusConsidering that the critical time for FW to come on line in an ATWSevent involving a loss of main feedwater is very short, even forconditions of favorable MTC, the use of non-recovery probabilities ofthis magnitude does not appear to be justified without supportinganalyses.Remove recovery for MFW in ATWS events initiated by a loss offeedwater.There were several observations on the modeling of event D3 in theSGTR tree:Event D3 is generally defined as the event to cooldown to RHRconditions using 2/3 SG for depressurization. D3 includes the HEPYAGRCOLDHE, which is directed by [procedures].1. D3 is defined as "primary system cooldown via secondary systemdepressurization". Primary system depressurization must beaccomplished in some sequences (YDlD2D3, YOD3, YUOD3), byeither PORV, aux spray, or main spray. These functions are notAS-4 included in D3. CLOSED2. Sequence YUOD3 needs a T/H justification that D3 can actuallyprevent core damage in this circumstance. This sequence has noinjection and no SG isolation. This is "core cooling recovery" with anunisolated SGTR. ECA3 specifies cool down at less than 100F/hr. Thecore cannot be maintained covered for the amount of time it takes tocooldown to RHR conditions at 1 OOF/hr. Suggested resolution is touse a separate function for this heading, using an operator actiondirected by [procedure] and without RCP operating.Attachment Page 21 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O] Observations and Recommendations by Peer Review Team jSau3. Sequence YUD1QD3. comment #2 applies to this sequence as well.This is a stuck open relief PORV with no injection.1. Add functions to D3 for primary system depressurization.2. Find specific procedure for D3 given the multiple uses insequences.3. Add a new operator action for D3 if in some sequences, the operatoraction will be called by a different procedure and then [procedures].The success criteria for AFW for SGTR is 1 CA pump to 2 steamgenerators. The ruptured SG is assumed to be one of the two steamgenerators that supply steam to the turbine-driven AFW pump. In theCatawba Rev. 2b fault tree model, however, the dependency of theTDP on the SGTR initiator is not modeled. Thus, the TDP supply isAS-7 not degraded by the initiating event in the model logic, so the model is CLOSEDincorrect.Correct the SGTR AFW pump logic in the Catawba Rev 3 update asplanned. Check that initiating event impact logic is also correct insequences for other events (e.g., T6 -SLBI).Success Criteria (Level 1 and Level 2) for some systems andsequences are supported by MAAP runs with MAAP 3b, Version 16.This version of MAAP has been found to have limitations which canimpact conclusions and results. In particular for the Catawba PRA, theTH-1 simple pressurizer model likely impacts the analyses that involve RCS The success criteria are in general agreement with those used at similarcooldown and depressurization using SG heat removal by permitting plants. Few changes are expected and the overall impact is expected toRCS depressurization to match RCS cooldown for transients, without be small.the possible need for pressurizer PORVs, spray or aux spray.Consideration should be given to re-running selected analyses with aAttachment Page 22 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team Statuslater version of MAAP code that has an enhanced pressurizer model todetermine extent of impact. Duke PRA personnel indicated that theyare currently developing a MAAP 4.0 model, which would be suitablefor this purpose and for future analyses supporting the PRA.Success Criteria analyses were not done for the range of possible plantconditions to which they are applied. For example, MLOCA successcriteria analyses are done for a 3.5 inch break, while the MLOCA isdefined as a 2 to 5 inch break. The combinations of systems andoperator recoveries that are defined as success at 3.5 inches may notbe success at 2 inches or at 5 inches. This issue also applies to largeLOCA (8.25 ft2 break analyzed) vs. a break range down to 6 inches,and small LOCA (1 inch break analyzed) vs. break sizes from' 3/8 to 2inches.Further, it was not clear that the MLOCA MAAP runs adequatelymatch the accident sequence being modeled in the PRA. Cases in OPENTH-3 [procedure] do not appear to disable accumulators when defining theminimum ECC requirements, but accumulators are not required by the No problems with the appropriateness of the success criteria have beenresulting MLOCA success criteria, identified. There are no impacts to this application.Also, MAAP is not an appropriate code to use in performing analysesfor rapid blowdown events such as large and some medium LOCAs.One possible approach would be to perform success criteria analysesfor a range of possible conditions, including the limiting break sizes.Check the MLOCA analyses to determine whether the accumulatorinjection makes a significant difference in the results and conclusions.Also, a code other than MAAP should be used if success criteriadealing with the blowdown phases of large and medium LOCAs arebeing defined.TH-5 The HEP worksheets do not clearly refer to success criteria analyses to OPEN_ _ support timing for operator actions. Although most worksheetsAttachment Page 23 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team Statusinclude an estimate of the time available for completion of an action, This F&O is considered to be a documentation issue.and some refer generally to information from MAAP analyses,specific references to MAAP (or other analysis) cases are not The current Catawba model of record used the HRA methodologyprovided, developed by SAROS. Beginning with the 2011 Oconee PRA update,Duke now uses the HRA calculator method. Based upon the OconeeReview success criteria analyses to determine whether they adequately update results using HRA calculator, the current Catawba HRA resultsreflect modeled scenarios, including expected operator actions. using SAROS are considered to be conservative and therefore bounding.Thus, this is considered to be a documentation issue only with no impacton this application.There is no room heatup analysis notebook / evaluation of loss ofHVAC to equipment rooms for the Catawba PRA, and apparently no OPENretrievable room heatup calculations or documentation to support theassumption that room cooling need not be modeled in the PRA. Other Loss of UVAC is not expected to lead to core damage. However,PRAs have found that room cooling is required for some rooms such documentation that justifies this position needs to be developed.as electrical equipment rooms and small rooms housing critical pumps.Incidentally, this F&O is under evaluation as part of the in-progressTH-6 Perform an evaluation, with equipment room-specific calculations, if McGuire PRA model update. A similar analysis for room heat-up atpossible, of the potential for, and magnitude of the room heatup for Oconee concluded that a loss of HVAC will not result in equipmentrooms housing electrical equipment, pumps, and other key equipment failures. Engineering judgment is that any potential impact fromcredited in the PRA. Document the basis for any determinations that HVAC failures at McGuire would be small. Given the similarity ofequipment will survive the anticipated room heatups, and model loss plantudes a t McGuire and.Caawba thislite isof room cooling as a failure mode in the system fault trees (with plant design and layout between McGuire and Catawba, this item isrecoveries as appropriate) for equipment that may not survive the expected to have little or no impact on Catawba as well.anticipated heatup for the PRA mission time.System success criteria are specified in the system notebooks insufficient detail to describe the overall fault tree top events, but nobasis is provided in the system notebooks for the number of pumps or CLOSEDflow rate requirements. The Reference section 18.1 does not contain alink to an appropriate success criteria calculation. For example, in theKC notebook, it is stated without a source reference that both pumpsAttachment Page 24 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O I Observations and Recommendations by Peer Review Team Statusand the associated heat exchanger in a train are required for successwhen the ND (RHR) heat exchanger is required. Similarly, in Section12 of the RN notebook, it is stated that the top events simply represent"failure to provide sufficient flow" to components requiring coolingwithout defining a flow rate or number of pumps (in Section 13 of thenotebook it does state that failure to provide flow requires failure ofall four pump trains). The CA (AFW) notebook has a similarstatement without a tie to a specific basis.A reference should be provided in Section 12 of the system notebooksfor each of the stated top event success criteria. The reference couldbe to a design basis analysis, or to a specific MAAP calculation orsome similar best-estimate analysis method. Section 12 in the NISystem Notebook file CR3NI.doc provided for the reviewers containsreferences to specific MAAP runs that serve as the basis for successcriteria, and can be used as an example.In the Component Cooling System Notebook, there is no basisprovided in Section 11.3 for excluding the failure to isolate the Non-Essential Reactor Building Header from the fault trees. In discussionwith the PRA engineer responsible for the notebook update, it wasdetermined that three valves need to fail to close for flow diversion to CLOSEDtake place, but there could be a common cause failure of these valvesthat was not justified to be excluded.Justify excluding this potential diversion flowpath in the systemnotebook or include it in the fault tree.For Catawba, there was no evaluation of the ability of non-qualified OPENSY-6 (non-EQ) equipment to survive in a degraded environment followingan accident such as a steam line of feedwater line break outside of Primarily a documentation issue. (Peer Review F&O L2-2. Level ofcontainment. Significance = C on VX fans is a specific example of another questionAttachment Page 25 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team Statuson survivability of equipment in degraded environment.)Perform an evaluation of potential adverse effects on equipmentoperation due to degraded environmental conditions resulting fromaccidents in the PRA model.Workplace Procedure is the primary data gathering procedure. It issupplemented by [procedure], Catawba PRA Revision 3 Failure RateAnd Maintenance Unavailability Data, and [procedure], the CCFanalysis report. Also, noteworthy is attachment 3, which includes theCCF checklist. Additional details are provided by Rev. 2b SummaryReport and the Rev 2 Summary Report.The data guidance is generally adequate; however it does not address OPENcomponent boundaries. Component boundaries are apparent from thedata as in the specific example in F&O DA-02, i.e., the incoming This F&O is considered to be a documentation issue.breaker and panelboard BLF. However, these should be defined inthe guidance. The industry documents used to generate the Catawba PRA database(such as NUREG/CR-6928) define the component boundaries.Consider revising guidance documents to address the treatment ofcomponent boundaries. Possible guidance sources for this include:NUREG-5497, Common Cause Failure Parameter EstimatesEPRI TR-100382, A Database of Common-Cause Events for Risk andReliability ApplicationsNUREG/CR 5500, Reliability Study: Emergency Diesel GeneratorPower Systems 1987-1993Some of the generic data from SAROS is quite dated, including OPENWASH-1400, NUREG/CR-2815, Zion PRA, and NUREG/CR-4550.DA-2 More recent generic data should be pursued. Use of more recent equipment operating experience data is desirable.Component failures should be defined such that they encompass only However, the current generic data is deemed to provide adequatethose failures that would disable the component over the PRA mission estimates of generic equipment failure rates. In addition, these failuretime. It appears that this has not been considered. Specific examples rates are Bayesian-updated with plant-specific data.Attachment Page 26 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team I Statusof less than adequate reliability data characterization were identifiedthrough review of Tables 1 and 3 in [procedure], Catawba PRA Rev. 3Failure Rate and Maintenance Unavailability Data. First, repeatevents in a short duration, where there was insufficient componentrepair should be counted as one event. An example is PIP nos. 2-C97-2481 and 2-C97-2637 on 7/29/97 and 8/12/97 for incoming breaker2CXI-5C. The first failure occurred "for no apparent reason", but thesecond failure was attributed to a failed relay. The first event shouldbe omitted as a component failure as the component was left in thedegraded condition. Second, component degradation that results infailure to meet normal criteria (e.g., to avoid component lifedegradation), may not impact the component mission for the PRA.For example, PIP no. 0-C98-2057 involved a 6/7/98 event for troublealarms for VI compressor F, and the compressor motor was foundsmoking. The evaluation addressed concern with overheating andinsulation breakdown, but did not address whether ran to failurewould survive PRA mission. Similar pump failures due to routinevibration testing exceeding limits were found (LPR 2B & IA, WO93020502 & PIP 1-C93-1124).More recent generic data sources should be pursued. Reliability datacharacterization should include evaluation of the applicability ofindividual component failures to the PRA model.The unavailabilities computed for the basic events for PORV blockvalve closure, RNC031BDEX, 033ADEX, and 035BDEX, assume thateach PORV is closed one week per quarter. However, there is noDA-5 history of PORV closures for any extended period of time in the last CLOSEDfew years.While this does use plant-specific data, the benefit derived from it islimited due to the highly conservative assumption regarding PORVAttachment Page 27 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team Statusout of service time.As the data is updated, it should be reviewed for excess conservatismsand revised to be more realistic.In [procedure], there is development of a failure probability for therupture of an MOV. The type code for this event is MVR. This typecode is used in the calculation of the ISLOCA frequency. In theDA-6 SAROS database, this distribution is composed of three equally CLOSEDweighted distributions. The three distributions have error factors ofclose to 10.0. The error factor assigned to MVR is -2.6. This isimpossible -the error factor should be close to ten.Another example of conservatism is the SBO following trip event,PACBOFTDEX. This event in the top 100 cutsets, has a 1 E-3DA-8 probability, and has not been updated since the IPE. CLOSEDReview the dominant sequences for conservative values and updatethem.A screening value of 3E-3 was initially used for all pre-initiator HEPs. OPENThere were 7 HEPs quantified in more detail, because the HEPimportance was too high. However, there were 7 Latent Human Error This observation does not necessarily have a large impact on the PRAHR-2 events with a 3E-3 probability in the top 100 importance events in the results. However, per the HR subtier criteria (HLR-HR-D & HR-D2),CR2b quantification. screening HEPs should not be used for actions appearing in significantcontributors.Provide more detailed quantification of more pre-initiator HEPs.The operating staff at the plant had some input to the HRA in thebeginning, but it is not obvious a thorough review of the dominant OPENHR-4 operator actions by the plant staff had been done, nor was it obviousthere had been any feedback of their comments into the analysis. This F&O is considered to be a documentation issue. See the responseThe level of detail and relation to the operating procedures is sparse. to F&O TH-5 above.In some instances, the procedural steps are not mentioned. In someAttachment Page 28 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team Statusplaces, the reference to the procedure is incorrect.Get operating staff more involved in the HRA.In the Catawba HRA notebook for PRA Rev 2b (and similarly in theMcGuire Rev 3 HRA notebook), the documentation of the bases forthe HEPs is not sufficiently specified to assure that the analysis isreproducible. Specifically, the sequence context (e.g., previousfailures in the event sequence, concurrent activities, environmentalfactors, etc.) and procedural steps applicable to each HEP are notconsistently provided. Thus, even though there is evidence that theHEP worksheet information is being reviewed by plant Operationspersonnel, it is not clear that they would have sufficient supportinginformation with which to make an effective assessment of the HRA. OPENSimilarly, the timing, PSF, stress level, and all other contributingHR-5 factors to the HEP were printed, but the basis was not provided. It This F&O is considered to be a documentation issue. See the responsewould not have been possible for another analyst to determine thesame factors and derive the same number. to F&O TH-5 above.The lack of such information in the documentation of the HRA limitsthe ability to verify and reproduce the results, and to determine theirapplicability in specific scenarios.Enhance the HRA documentation to address the above items. Considerdeveloping, for each important HEP, a timeline showing all importantcues and events. Reference specific steps in each procedure for eachaction, and estimate the time at which the step would be reachedduring an accident.Inconsistency among timing for similar HEPs. OPEN1R-9 There are four important times for HCR calculations:T(avail) -total time available for an action to be completed from the Primarily a documentation and consistency issue; not expected tofirst event which starts the demand for the action. significantly impact risk results. See the response to F&O TH-5 above.Attachment Page 29 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O IObservations and Recommendations by Peer Review Team I StatusT(execute) -amount of time needed to execute the actions afterdiagnosisT(1/2) -the median amount of time needed to diagnose and initiate anaction.T(window) -the time window for diagnosis T(w) = T(a) -T(e).The HCR forms used for Catawba only have an entry form forT(window) and T(1/2).The timing for the following important events is shown below;EVENT HYDBACKDHE NNVSSFADHENNVSSFBDHE TRECIRCDHE TFBLD01DHET(avail)40 45 30 18 20T(exec) 15 2 7 0 0T(window) 25 43 23 18 20T(1/2) 3 5 2 3 5 TO 10EVENT NDORWSTDHE KKCSTNDDHEPOPXC02DHE POPXCONDHET(avail) 18 10 90 90T(exec) 0 0 0 0T(window) 18 10 90 90T(1/2) 5 3 30 30The following observations are made:1) In order to be useful to prevent seal LOCA, POPXCOiDHEmust be connected by 30 minutes. If the T1/2 is 30min, there is nochance for success. There must be some execution time for this action,which means there is insufficient time for this action.2) NNVSSFBDHE should be done in 15 minutes to be consistentwith the WOG ERG guidelines about restoration of seal cooling.Attachment Page 30 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team I Status3) NNVSSFBDHE and NNVSSFADHE should have the same T(1/2), because they are similar actions with similar facilities, justunder different conditions.4) TRECIRCDHE and NDORWSTDHE are essentially the sameevent. They should have the same t(1/2). If TRECIRCDHE uses 5minutes, the HCR jumps to .014.Define the four time parameters for all HEPsDocument the basis for all four times for each HEPMake similar HEPs consistent with each other.Requantify HEP with new time data.No specific guidance is given regarding modeling of systemdependencies in the system notebooks; however, a highlyknowledgeable analyst could reproduce the given results. Adependency matrix is provided but contains little detailed explanationof how dependencies were determined. OPENDE-1 The Internal Flood Analysis does not seem to provide the detail This is a documentation issue which has been addressed in a revision torequired to reproduce the results except by a highly knowledgeable a workplace procedure. Note that the F&O states that a knowledgeableanalyst. analyst could reproduce the results.Consider providing guidance for treatment of dependencies, includingtypes of dependencies treated in the model, approaches used to modeldependencies, and important considerations regarding howdependencies may affect the model and results.HVAC cooling of the essential switchgear rooms is stated as being OPENrequired. The IPE quantitative analysis does not provide adequateDE-4 success criteria. For example, the following are not specified: Loss of HVAC is not expected to lead to core damage. However,temperature limits of equipment, minimum number of Air Handling documentation that justifies this position needs to be developed.Units, or minimum number of chillers. The evaluation also statesAttachment Page 31 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O IObservations and Recommendations by Peer Review Team I Statusthere is no concern within 24 hours provided that only those loadsneeded to provide core cooling are operated. There is no discussion ofelectrical load shedding for those loads not required, and of the humaninterface to execute load shedding. The human interface can becomplex, involving both a discovery process (control roomannunciators, or in the case of a local AHU failure, discovery throughoperator walkaround), and procedures and training to direct operationactions.A conservative estimate of essential switchgear room HVAC coolingfailures could be pursued to establish the system importance.However, if moderate importance is observed, more detailed heatupcalculations, recovery actions, and equipment models would bedesirable for a realistic system model.DE-6The PRA flooding analysis builds on a plant calculation thatdetermines flood levels in the plant. That calculation only determinesflood levels; it does not address the effects of water on equipment.The effects of spray and the effects of water on electrical equipmentare not addressed. Further, it is not evident that flood propagationimpacts were addressed, nor that probabilistic failure of flood barriers(e.g., doors) was considered.Obtain the site calculation relating to spray effects and use that todevelop information for incorporation in the PRA.Consider flood propagation impacts, and treat flood barrier failureprobabilistically.OPENSpray effects and flood propagation past flood barriers are not expectedto be significant interactions. This is a more of a completeness /documentation issue.The truncation limit of the baseline CDF at 1 E-9 is not low enough toQU-1 defend convergence toward a stable result. This is shown on page 12 CLOSEDof [procedure]. Use of the lE-9 truncation limit yields 4485 cutsets,while the 1 E-10 truncation limit yields 31512 cutsets. Thus, althoughAttachment Page 32 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team Statusthe PRA runs using 1E-9 are capturing about 85% of the CDFpredicted with a cutoff of 1E-10, they are capturing only 13% of thecutsets using the 1 E-10 truncation limit.The Duke PRA staff uses a high performance quantifier, FORTE.Quantification speed should not be a significant challenge. Oneoption to improve post-processing speed is to recode the recoveryrules and deleted events as a fault tree. Other options (e.g., sensitivitystudies at lower cutoffs to confirm the acceptability of the 1E-9 cutofffor particular applications) may also be appropriate.The IE's for certain support system failures (RN, KC) are not input inthe top event logic as a Boolean equation, but rather as a pointestimate whose value is derived by solution of the IE fault tree.However, failures that cause the IE may also affect the mitigating OPENsystem, such that there is a dependency between the initiating eventQU-2 and the available mitigation. Examples are an electrical bus that failed Modeling initiators with logic instead of point estimates wouldone train of KC and could fail one train of mitigating equipment.Another example is the operator error in the loss of KC to start the improve the accuracy of the model, although it is not expected tostandby train of KC (KKCSTNBDHE). The HRA notebook states this significantly alter the results or conclusions of the analyses.event has dependencies with HYDBACKDHE.One way to resolve this is to Input the IE as a Boolean equation.More guidance or creation of a procedure is needed to address thequantification steps. For example, there is no desktop guide orprocedure as there is for developing system fault trees.QU-4 Develop quantification guidance for PSA analysts. This should CLOSEDinclude information on the quantification codes and the runparameters. Standards for quantification commensurate with theapplication type should be included.Attachment Page 33 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team StatusEvent NDORWSTDHE: This is a recovery action to terminate the NVand NI pumps in the event of failure of ND to provide recirculationafter a SL. The event was quantified on the basis of tripping the pumpswithin 18 minutes. RWST refill was assumed to occur (fromundescribed source) and pumps were restarted to continue injection.This recovery event is applied to:a) loss of KC pumpsb) SNSDRNVLHE -drain plug blockagec) CCF of ND pumps.The recovery event is intended to provide injection flow for the longQU-5 term commensurate with the RWST make-up capability. The time of CLOSEDsome of these failure is 20 minutes, when injection requirements arebeyond the make-up capability of the RWST. Secondly, there arecutsets representing heat removal that cannot be recovered bycontinued injection of HHSI. The sequence needs continuous injectionof HHSI and heat removal from containment.Carefully define the purpose of event NDORWSTDHE.Define the RWST make-up capacity and when it is effective.Distinguish heat removal sequences from injection sequences and donot recover injection sequencesRequantify HEP to include failure to provide RWST refill.Documentation of mutually exclusive events is limited to the text file, OPENcr2b rul.txt.QU-8 This is considered to be a documentation issue and can be addressed inThe rule recovery file allows different numbers of max recoveriesmodel integration notebook.___depending on the combinations in question. ____________________________Attachment Page 34 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team StatusThere is no documentation regarding how the max recoveries wereestablished for each set of events. Examples of the content of the fileare DBLMAINT, DELSEQ, and NSHEATEX, which function asrecoveries set to 0.0Note that this applies to recovery events as well as deletedcombinations.Create a basis document for the deleted combinations and includeexamples. Establish a review process for changes to the deletedcombinations. Document the review of the max recoveries.A document containing an overview of the deleted combinations andwhy would make this portion of the model more clear. In addition,these files should be reviewed to ensure quality of the content.The Conditional core damage Probability of several Initiators from theCR2b results were evaluated. The results are:8.30E-03 Loss Of RN8.38E-03 Loss Of KC5.04E-03 Small LOCAQU- 2.30E-04 Secondary Line Break Inside Containment12 5.47E-05 LOOP CLOSED9.54E-06 FDW Line Break Outside Containment2.26E-06 Loss Of Main Feedwater2.89E-06 SGTR7.75E-07 Loss Of Load5.01E-07 Reactor TripThese results show a discrepancy between Small LOCA and SGTRAttachment Page 35 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team Statusthat is not consistent with what is normally seen in PRAs in theindustry. The CCDP for small LOCA and SGTR are usually in thesame order of magnitude because the initiators have similar mitigationfunctions such as safety injection, secondary side heat removal,primary cooldown and depressurization, and long term injection ifcooldown and depressurization are not successful. A difference of 3orders of magnitude is unusual. Also, the CCDP value for the Loss ofInstrument Air probability is identical to the Inadvertent SS Actuationprobability (to 3 significant figures), which seemed surprising.Review and explain the contributors to inadvertent SI, Loss Instr. Air1.24E-05 Inadvertent SS Actuation1.24E-05 Loss Of Instrument Air1.04E-05 Steamline Break Outside Containment and Tuberupture.Attachment Page 36 | ||
: 3. According to the submittal, the seismic analysis of the NSWS components andpiping caused "the seismic [core damage frequency] CDF [to show] only amodest increase using very conservative bounding assumptions ... [due to] asensitivity study [that] was performed to conservatively bound the impact ofhaving a NSWS discharge line unavailable during a seismic event." Pleaseprovide a description of the change in seismic analysis and the resulting seismicCDF and [large early release frequency] LERF for this application.Duke Energy Response:As indicated in Duke Energy's November 22, 2011 submittal, the current Catawbaseismic PRA model of record was last updated as part of Revision 3 of theCatawba PRA model. The current methodology used is the same as thatdescribed in detail in the IPE submittal and Section 3 of the IPEEE submittal, bothof which have been previously reviewed by the NRC. The reader is referred tothose references for additional details of the seismic analysis.The current seismic PRA contains the technical elements given in Section 1.2.6 ofRG 1.200, Rev. 2 as part of its current methodology. The plant-specific seismicPRA analysis consists of four steps, each of which is described below:1. The Catawba site was evaluated to obtain the seismic hazard in terms of thefrequency of occurrence of ground motions of various magnitudes. The site-specific hazard analysis was performed using the Seismicity Owners Group(SOG) methodology developed by EPRI for seismic hazard analysis of nuclearpower plant sites in the Central and Eastern United States (CEUS) and isdocumented in EPRI document RP101-53. Uncertainties were addressed inthe hazard analysis. Furthermore, Duke Energy has been actively followingdevelopments related to GI-199. In 2008, Risk Engineering Inc. performedpreliminary comparisons of the EPRI-2008 seismic hazards and EPRI-1989seismic hazards for the Duke plants. Their results indicated no significantimpact to Catawba.2. From the site-specific seismic hazard curve, the capacities of important plantstructures and equipment to withstand seismic events were evaluated todetermine conditional probabilities of failure as a function of groundacceleration for significant contributors (i.e., SSCs). These are commonlyreferred to as 'fragilities' or the site-specific fragility curves. Plant walkdownswere conducted, the most recent ones consistent with the guidelines of EPRINP-6041.3. An event tree was developed along with supporting top logic and system faulttrees to reflect plant response to seismic events. These modified logic modelswere then solved to obtain Boolean expressions for the seismic eventsequences of interest.4. The Boolean expressions were quantified by convolving the probabilistic siteseismicity and the fragilities for the plant structures and equipment obtainedin steps I and 2. The resulting sequence frequencies were then integratedAttachment Page 37 into the overall Catawba PRA risk results, resulting in final quantitativeresults.Since the IPEEE submittal, changes have been made to the seismic model suchas:* A comprehensive review and revision of the seismic analysis documentationwrite-up* The addition of component/structure fragility information to support valuesused in analysis* Updated Human Reliability Analysis (HRA) data* Updated common cause data* Editorial and logic changes to the fault tree* Updated quantitative results tableThe impact of this LAR on the seismic CDF was also reviewed. Per the Catawbaseismic PRA documentation, components with median seismic capacities inexcess of 2g were screened out of the seismic fault tree models due to their lowprobability of failure. Likewise, structures were eliminated from considerationwhen their seismic capacities were in excess of 2.5g. Among those componentsand structures screened out were the Standby Nuclear Service Water Pond Dam,the NSWS pumps, and all qualified piping and valves. Therefore, the NSWScomponents and piping are considered to be seismically-rugged and thus do notimpact this analysis.However, since the NSWS components and structures were screened out of themodel, a sensitivity study was performed to conservatively bound the impact ofhaving an NSWS discharge line unavailable during a seismic event. Using thecurrent Catawba analysis, the following safety system trains were consideredunavailable (i.e., set to '1') in the seismic cut sets:* Auxiliary Feedwater Motor-Driven Pump 'B' (CA MDP 'B')* Safety Injection Train 'B' (NI 'B')" Emergency Diesel Generator 'B' (D/G 'B')* Component Cooling Train 'B' (KC 'B')* Residual Heat Removal Train 'B' (ND 'B')The standby trains of these systems were made available (i.e., set to '0') in theseismic cut sets.The cut sets were then processed using Duke Energy's seismic analysis code('SEISM') to calculate a new seismic CDF of 1.35E-05/yr. With a current baselineCatawba seismic CDF of 1.14E-05/yr, this represents an increase of 2.1E-06/vr(which equates to 8.1 E-08 per 14-day period). The current Catawba seismic modeldoes not include LERF; however, based on the most recent seismic LERFanalysis performed for the Oconee station, it is expected to be about one order ofAttachment Page 38 magnitude less than the CDF. Again, this is a conservative bounding value sinceboth trains of each safety system would normally be available while an NSWSdischarge line is out of service. It is expected that the actual seismic CDF wouldbe smaller than this value. In addition, there were no new failure modesintroduced and consideration of the seismic impact is thus not a factor for thisassessment.In accordance with the discussion in this section and the results of theconservative bounding analysis above, Duke Energy considers inclusion of theseismic results as insignificant to the overall results and is not considered to be apotentially significant hazard. It is judged that the analyses assessing theinfluence of seismic events provide an acceptable evaluation of the contributionof the seismic risk for the requested Completion Time of 14 days.4. Please provide a description of the internal fire PRA analysis and resultingchange in internal fire CDF and LERF for this application.Duke Energy Response:The current Catawba fire PRA model analysis and methodology used in the modelof record is the same analysis and methodology as described in the IPEsubmittal; Section 4 and Appendix B of the IPEEE submittal; and as discussed inthe Supplemental IPEEE Fire Analysis Report, all of which have already beenreviewed by the NRC.The plant-specific fire PRA analysis consists of four steps, each of which isdescribed below:1. The Catawba site and plant areas were analyzed to determine critical fire areasand possible scenarios for the possibility of a fire causing one or more of apredetermined set of initiating events. Screening criteria were defined forthose fire areas excluded from the fire analysis.2. If there was a potential for an initiating event to be caused by a fire in an area,then the area was analyzed for the possibility of a fire causing other eventswhich would impact the ability to shutdown the plant. These were identifiedby reviewing the impact on the internal event analysis models.3. Each area was examined with an event tree fire model to quantify fire damageprobabilities. The event tree related fire initiation, detection suppression, andpropagation probabilities to equipment damage states.4. Fire sequences were derived and quantified based on the fire damageprobabilities and the additional failures necessary for a sequence to lead to acore melt. The additional failures were quantified by the models used in theinternal events analysis.The major changes to the current fire analysis that have been made since theIPEEE submittal deal with implementation of changes from the SupplementalAttachment Page 39 IPEEE Fire Analysis Report and revised base case fire initiating eventfrequencies.Since the Catawba fire PRA model is integrated into the overall PRA model,quantitative fire risk insights can be obtained for the LAR. The cut sets generatedfor the analysis presented in Question I above were reviewed to determine thecontribution level of the fire initiating events. Internal fire events contributedapproximately 10% of the CDF and 3% of the LERF. Whereas fire-induced loss ofNSWS events are included in the PRA model, they did not appear in any coredamage or large early release sequences (above the respective truncation limits).Furthermore, in comparing the delta risk cut sets created in support of the LARanalysis (i.e., those cut sets whose values showed an increase in the LARconfiguration when compared to their values in the 'base case' configuration), nointernal fire sequences of any type appeared in the core damage and large earlyrelease results. Therefore, the contribution from fire events for the LARconfiguration impacting the NSWS is deemed negligible.Finally, from a deterministic standpoint, consider that the NSWS essential headerdischarge valves and the discharge valve to the Standby Nuclear Service WaterPond (SNSWP) will remain open during the requested 14-day Completion Timewith power removed. Therefore, fire events affecting power to these valvescannot cause their spurious operation and thus would have no effect on theNSWS discharge alignment during the Completion Time.Given the negligible influence of fires on the NSWS for the LAR configuration,fires are not considered to be a potentially significant hazard. It is judged that theanalyses assessing the influence of internal fire events provide an acceptableevaluation of the contribution of the fire risk for the requested Completion Time of14 days.5. Please provide a description of the internal/external floods PRA analysis andresulting change in internal flooding CDF and LERF for this application.Duke Energy Response:Flooding events at Catawba have been assessed via the IPE process and arenoted in Sections 3.3.5 and 3.4 of the IPE submittal. Internal flooding events areprimarily caused by plant piping ruptures while external floods are mostly causedby very heavy precipitation events. The external events portion is recreated inSection 5.2 of the IPEEE report. As mentioned above, the IPE and IPEEEsubmittals have already been reviewed by the NRC.Per the Design Basis Document for external flooding, flood levels for the sitewere analyzed for the following flood producing phenomena:1. Probable Maximum Flood (PMF) resulting from the Probable MaximumPrecipitation (PMP) positioned appropriately over the Catawba River Basin.Attachment Page 40 | |||
: 2. Probable Maximum Flood (PMF) resulting from the Probable MaximumPrecipitation (PMP) positioned appropriately over the tributary area of theSNSWP.3. Standard Project Flood (SPF) passing through Lake Wylie (positioned overeach Catawba River basin drainage area) combined with the failure of one ofthe upstream dams because of an Operating Basis Earthquake (OBE). TheSPF is considered equal to one-half of the PMF.4. Surge and seiche effects caused by probable maximum hurricane.5. Coincident wave runup due to a 40 mph wind.6. Local intense precipitation (PMP) occurring over the immediate project site.In the IPEEE report, it was concluded that the contribution to plant risk fromexternal flooding would be insignificant compared to the risk from internalflooding.The plant-specific Catawba internal flooding analysis was performed in six steps:1. Identification of the critical flood areas2. Calculation of flood rates3. Development of flood probabilities4. Identification of critical flood levels5. Assessment of human response for flood isolation6. Development and quantification of the flood core damage cut setsThe major change made to the current internal flood analysis since the IPE andIPEEE submittals deals with the installation of concrete flood walls in the TurbineBuilding basement to protect essential 4160V ac switchgear against largeflooding events. As a result, flooding initiator probabilities which would result ineither a reactor trip or a loss of the transformers have been significantly reduced.As with the fire analysis, the Catawba internal flooding PRA model is integratedinto the overall PRA model; therefore, quantitative flood risk insights can beobtained for the LAR. The cut sets generated in the response to Question 1 abovewere reviewed to determine the contribution level of the flooding initiating events.Internal flooding events comprise approximately 2% of the CDF and less than 1%of the LERF. The majority of this contribution comes from a flooding event in theAuxiliary Building which results in a loss of the Auxiliary Shutdown Panel.As indicated previously, the NSWS discharge piping associated with this LARresides in the Auxiliary Building; thus, it could be postulated that this area couldbe more susceptible to flooding risk during the Completion Time. Duke EnergyNuclear System Directives require the station to give consideration to plantconfigurations which could potentially cause internal flood hazards resulting in afailure of risk significant structures, systems, and components. Furthermore, themanual and motor operated valves installed in this portion of the NSWS areAttachment Page 41 Fisher Posi-Seal butterfly valves. When these valves are closed, there is not acredible failure that would cause them to change position or catastrophicallycome apart. In the closed position, the operator gearbox will hold the valve discstill. The gearbox operators are manufactured by Limitorque and have lockinggear sets that will not move even during a seismic event. Therefore, exposing theisolated NSWS discharge piping during the 14-day Completion Time is consideredto have a negligible impact on flooding risk in the Auxiliary Building. As asensitivity study, the value for the Auxiliary Building flood initiator in the PRAmodel was increased by its error factor (7.5) from 5.5E-06 to 4.13E-05. As a result,the CDF for the Completion Time configuration increased by only 9.8% and thecorresponding LERF increased by only 2.2%. Thus, the impact on internalflooding is considered insignificant.Given the negligible influence of flooding events for the LAR configuration, floodsare not considered to be a potentially significant hazard. It is judged that theanalyses assessing the influence of these events provide an acceptableevaluation of the contribution of the flood risk for the requested Completion Timeof 14 days.6. Please provide a description of the tornado/high winds PRA analysis andresulting change in the tornado/high winds CDF and LERF for this application.Duke Energy Response:As with earthquakes, fires, and floods, an assessment for tornados and otherhigh wind events at Catawba has been performed via the IPE process as well aswith the IPEEE process.The plant-specific Catawba tornado/high wind analysis was performed in threesteps:1. Calculation of occurrence frequency2. Tornado missile analysis3. Tornado wind analysisThe major changes to the tornado analysis since the IPE and IPEEE submittalsinclude the following:* enhancements to the diesel generator building modeling* addition of the upper surge tank, condensate storage tank, and portableinstrument air diesel compressor* revised switchyard strike frequencyAs with the fire and flooding analyses, the Catawba tornado PRA model isintegrated into the overall PRA model; therefore, quantitative tornado risk insightscan be obtained for the LAR. The cut sets generated in response to Question 1above were reviewed to determine the contribution level of the tornado initiatingevents. The cut sets generated for the LAR analysis were reviewed to determineAttachment Page 42 the contribution level of the tornado initiating events. Only one event (TornadoCauses a Loss of Offsite Power) contributed to the CDF (- 3%) and the LERF (~4%). Typically, these cut sets include a loss of the diesel generators and eitherAuxiliary Feedwater or the Standby Shutdown Facility. A review of the delta riskcut sets created in support of the LAR analysis found that, while tornado eventswere a significant contributor to the ICCDP, this contribution comes from theincreased tornado frequency value ('seasonal factor') used in the risk assessmentto account for historic increased tornado activity during the months of March,April, and May, rather than from interactions with the NSWS configuration.Furthermore, even though the NSWS provides cooling to the diesel generators aswell as the assured source of Auxiliary Feedwater, functionality of the NSWSfollowing a tornado event is governed by the operability of the diesel generatorsand would not be altered per the configuration found in the 14-day CompletionTime. Therefore, the impact of tornados and high wind events is negligible.Given the negligible influence of tornado and high wind events on the NSWS forthe LAR configuration, they are not considered to be a potentially significanthazard. It is judged that the analyses assessing the influence of these eventsprovide an acceptable evaluation of the contribution of the tornado and high windrisk for the requested Completion Time of 14 days.7. BackgroundThe guidelines of RG 1.177 state that one of the elements of consistency withdefense-in-depth philosophy is maintaining "defenses against potential common-cause failures (CCFs).... " In the proposed new Condition C for TS 3.7.8 onlyone path of NSWS discharge flow to the standby nuclear service water pond(SNSWP) is available when one NSWS header is isolated between 1RPN-19 to1 RN63A or between 1 RPN-20 to 1 RN58B and flow is blocked to Lake Wylie.IssueIf the only operable NSWS discharge header, as described above, had a pipebreak or became blocked or became inoperable, all NSWS cooling could stop.Requesta) Discuss your contingency plans, training, procedures, and compensatorymeasures to restore NSWS and maintain core and spent fuel poolcooling, in the event that this sole return to the SNSWP unexpectedlybreaks/cracks or becomes flow blocked causing a total loss of NSWScooling.Duke Energy Response:If the in service flowpath to the SNSWP were to become blocked or tobecome unavailable for any other reason, the Operator Aid Computer,control room annunciators, and control room indications are all availableAttachment Page 43 to aid the operator in determining if a loss of flowpath were to occur.Procedures will aid the operators in determining the nature of the event,and will direct the operators to realign the NSWS back to Lake Wylie ifappropriate. NSWS valves I RN57A and 1 RN843B are the in-series returnisolations to Lake Wylie. These valves will be closed per procedure whenthe NSWS is aligned in the single discharge header configuration.However, power will not be removed from these valves and they are motor-operated valves that can be repositioned, as directed by procedure, fromthe control room. Operators are trained on existing procedures for plantflooding and loss of the NSWS. Operators will receive additional trainingon the NSWS single discharge header alignment prior to implementation.b) Discuss any other possible CCF and associated contingency plans,training, procedures and compensatory measures or discuss why otherCCF's do not exist.Duke Energy Response:The NSWS alignment for the single discharge header configuration wasdeveloped with PRA guidance. First, the NSWS is aligned to the ultimateheat sink (the SNSWP), which eliminates the possibility of the worst casesingle failure of the NSWS, the loss of one train during a swap from LakeWylie to the SNSWP. Additionally, the return header motor-operatedcrossover valves 1 RN53B and I RN54A are tagged open with powerremoved to ensure a flowpath for the in service Unit I NSWS train. Themotor-operated discharge isolation valve for the out of service NSWS trainis tagged closed with power removed. Additional measures to ensure thatthe valve disc on the out of service NSWS train does not reposition arediscussed in the response to Question 10a. The motor-operated dischargeisolation valve for the in service NSWS train is tagged open with powerremoved to ensure it cannot be inadvertently repositioned. If the manually-operated isolation valves IRNP19 and IRNP20 were to leak due to disc orvalve seat failure, there are redundant isolation valves that can berepositioned to isolate the failure. Note that the piping coating work andthe valve isolation boundaries are in the same room in the AuxiliaryBuilding on the same elevation. Any problem with failures or floodingwould be immediately apparent to the personnel performing the work. TheNSWS single discharge header alignment and the associated isolationvalves will be controlled by procedure and by the Safety Tagging Program.Operators are trained on existing procedures for plant flooding and loss ofthe NSWS. Operators will receive additional training on the NSWS singledischarge header alignment prior to implementation.8. BackqroundProposed new Condition C defines a new TS Condition statement where aNSWS discharge header is inoperable. This condition makes the associatedNSWS train for Catawba 1 inoperable, causing a condition that does not meetAttachment Page 44 the limiting condition for operation (LCO). Cases 1 and 2 as shown in the LARon attachment 1, page 17, describe initial conditions for new Condition C.IssueThe licensee is additionally placing a Catawba 2 diesel generator (DG) and aCatawba 2 NSWS pump out of service as an initial condition and calling this asingle failure. Single failures are normally failures that are postulated to occurafter a design basis accident, not as initial conditions.RequestPlease explain:a) Why are DGs and NSWS pumps placed out of service for maintenanceand called single failures? [in the initial conditions and Note 9 of cases 1and 2]Duke Energy Response:The wording in the supporting calculation has been revised to remove thewords "single failure" from the description and simply say that the DGsand NSWS pumps are out of service for maintenance. The reason that theUnit 2 DG and U2 NSWS pump are assumed to be out of service formaintenance is described below in the response to Question 8b.b) Since DGs 2A and 2B can discharge to the SNSWP downstream of1 RN63A and 1 RN58B, and apparently do not have to be out of service,why are they assumed to be unavailable?Duke Energy Response:When a unit is shut down, it is typical to perform maintenance on theassociated unit's NSWS pumps and DGs. The proposed single dischargeheader alignment will only be allowed when Unit 2 is in Mode 5, 6, or NoMode. The submittal and associated PRA assumes that the NSWS pumpand DG on the associated train is out of service for maintenance. Forexample, when aligned in the single discharge header configuration withthe Train A discharge header to the SNSWP out of service, the Unit 2 TrainA NSWS pump and the Unit 2 Train A DG are assumed to be out of service.9. BackgroundThe licensee is proposing a single discharge header alignment to allow a portionof each of the NSWS return headers in the Auxiliary Building to the SNSWP tobe removed from service for cleaning, repairing, coating and inspecting. Thelicensee has stated these activities "will ensure the long-term reliability of theNSWS."Attachment Page 45 IssueThe proposal addresses the short length of NSWS piping in the AuxiliaryBuilding, while most of the NSWS discharge piping to the NSWSP and LakeWylie is outside the Auxiliary Building.Requesta) Explain how the work on the short length of piping in the AuxiliaryBuilding ensures long term reliability of the NSWS, when most of the pipeis outside the Auxiliary Building.Duke Energy Response:With the exception of this piping, the NSWS piping in the Auxiliary Buildingwith a diameter greater than 30 inches has been coated with epoxy. TheNSWS piping in the Auxiliary Building with a diameter of 30 inches andsmaller has been replaced with a corrosion resistant, superausteniticnickel stainless steel alloy, commonly called AL6XN.The buried NSWS piping is discussed in the response to Question 9b.b) What will be done to clean, repair, coat and inspect the NSWS pipingoutside the Auxiliary Building?Duke Energy Response:The buried carbon steel NSWS piping from Lake Wylie to the NSWSpumphouse has been cleaned and coated with epoxy. The buried carbonsteel NSWS piping from the NSWS pumphouse to the Auxiliary Buildinghas been cleaned and coated with epoxy. The buried carbon steel pipingto and from the Unit I and Unit 2 DGs was replaced with high densitypolyethylene (HDPE) and AL6XN. The buried carbon steel NSWS pipingfrom the Auxiliary Building that discharges to Lake Wylie has been cleanedand coated with epoxy.The buried NSWS piping from the SNSWP to the NSWS pumphouse andthe NSWS piping from the Auxiliary Building to the SNSWP has not beencoated. The normal alignment for the NSWS is to have the suction anddischarge aligned to Lake Wylie, and the NSWS piping in this flowpath hasbeen cleaned and coated with epoxy or replaced.The NSWS piping from and to the SNSWP is not the normal flowpath andprevious inspections have shown that this piping has not experienced thecorrosion and degradation seen in the piping that is normally in service.This piping is inspected per the Service Water Piping Inspection Programand the Buried Piping Program, which are part of the Service Water PipingCorrosion Program described in the Aging Management Programs andAttachment Page 46 Activities section in the Catawba UFSAR, Section 18.2.24, Service WaterPiping Corrosion Program.10. BackgroundDuring the proposed single discharge header lineups, valves 1 RN63A, 1 RN58B,1RPN19A and 1RPN20 isolate the pipe to be worked and form single valvebarriers from Lake Wylie and the SNSWP to the Auxiliary Building.IssueFailure of any of the valves or personnel error could allow flooding into theAuxiliary Building.Requesta) Discuss the elevation of the work boundaries 1 RN63A, 1 RN58B,1RPN19A and 1RPN20 as compared to the maximum elevation of theSNSWP and the maximum elevation of discharge pipes to the SNSWP.Describe design features that will prevent the SNSWP and/or NSWSdischarge piping from draining into the Auxiliary Building if workboundaries failed/leaked or personnel error breached the work boundary.Duke Energy Response:The normal SNSWP top-of-pond elevation is approximately 574.0 feet MeanSea Level (MSL). The centerline elevation of the 42 inch SNSWP returnTrain A and Train B NSWS piping in the Auxiliary Building is 581.25 feetMSL. Therefore, it is not possible to siphon the SNSWP back into theAuxiliary Building if valve I RN63A or I RN58B were to fail open and therewas not a simultaneous Probable Maximum Precipitation (PMP) event.As described in Catawba UFSAR Section 3.4, "Water Level (Flood) Design",during a PMP event, the elevation of the SNSWP could reach approximately583.5 feet MSL. Therefore, if the valve failure were to occur simultaneouslywith a PMP event, it would be possible to siphon the SNSWP into theAuxiliary Building. A PMP event would only occur due to a major weatherevent, and the NSWS single discharge header alignment will haveprocedural requirements to verify that no severe weather is in the forecastprior to implementation.The NSWS discharge piping to the SNSWP in the yard does have a highpoint of 594.75 feet MSL centerline elevation. If 1 RN63A or 1 RN58B were tofail open, this water could flood the Auxiliary Building. Measures will betaken to prevent these valves from repositioning, and these measures arediscussed below.Any passive valve seat leakage on valves I RN63A or I RN58B will beaddressed depending on the amount of leakage. To enable personnel toAttachment Page 47 work in the adjacent piping, the system must be drained anddepressurized, and released for work through the Safety Tagging Program.If there is excessive seat leakage such that the system cannot be drainedand depressurized, the NSWS could not be opened and released for workuntil the leakage is controlled.To prevent inadvertent repositioning of valves I RN63A or I RN58B, thevalves will be controlled by procedure and by the Safety Tagging Program.Additionally, to prevent the possibility of the valve discs on I RN63A orIRN58B repositioning and causing Auxiliary Building flooding, the valveswill be inspected and gagged if required. From a review of the OperatingEquipment Database and the industry failures concerning this type ofbutterfly valve, the primary failure mode which could enable the valve discto reposition is a failure of the disc to valve stem pins. To preclude thisfailure mode, the valve to disc pins will be verified to be installed. If thepins cannot be verified to be installed, a mechanical gag will be installed toprevent the valve disc from repositioning. These measures are intended topreclude the possibility of Auxiliary Building flooding and possiblesiphoning of the SNSWP due to the valve disc repositioning.Valves 1RNP19 and 1RNP20 are manually-operated butterfly valves. Thecenterline elevation of the 42 inch piping adjacent to valves 1RNPI9 and1 RNP20 is 585.75 feet MSL. If these valves were to reposition or have aseat or disc failure resulting in leakage, there are redundant isolationvalves that can be closed to isolate the failure and mitigate flooding. Toprevent inadvertent repositioning, these valves will be controlled byprocedure and by the Safety Tagging Program.b) Discuss additional backup isolation features and compensatory measuresto prevent internal flooding.Duke Energy Response:As described in the response to Question 10a, the position of valvesI RN63A or 1 RN58B will be controlled by procedure and by the SafetyTagging Program. Additionally, to prevent the possibility of the valve discson 1RN63A or 1RN58B repositioning and causing Auxiliary Buildingflooding, the valves will be inspected and gagged if required.To prevent inadvertent repositioning of valves IRNP19 and IRNP20, thevalves will be controlled by procedure and by the Safety Tagging Program.Additionally, if these valves were to reposition or have a seat or disc failureresulting in leakage, there are redundant isolation valves that can beclosed to isolate the failure and mitigate flooding.11. BackgroundThe LAR describes two cases of single discharge header operation, i.e. a) pipebetween 1 RPN63A and 1 RPN 19 is isolated, and b) pipe between 1RPN58B andAttachment Page 48 1 RPN20 is isolated. In each case NSWS return header crossover valves areopen with power removed; the NSWS return isolation valve to the SNSWP isopen (power removed); NSWS suction is aligned to the SNSWP; and Lake Wyliedischarge isolation valves are closed.The updated facility safety analysis report (UFSAR) refers to the NSWSdischarge headers as the A header and the B header, each serving both units.The LAR description and the proposed new Insert 2 for the proposed TS Basesrefer to both headers as the Catawba 2 discharge headers.New Condition C of the proposed TS refers to them individually as one NSWSAuxiliary Building discharge header.IssueThe above descriptions of the NSWS discharge headers in the TS Bases andnew Condition C are unclear without reading the LAR. New Condition C and theBases (Insert 3) do not define which portion of the discharge is allowed to beinoperable and the special lineup for safety that is described in the LAR.Therefore, operators may be inconsistent in plant configuration when enteringnew Condition C. Inspectors may not be able to know valid Condition C lineups.RequestExplain the licensee's intent to adequately define single discharge headeroperation in the UFSAR, new Condition C, and TS Bases, so that operators canalign the plant to meet new Condition C as defined in the LAR when allowed, andinspectors can know the required discharge header alignment when in newCondition C.Duke Energy Response:For this response, please refer to the revised reprinted TS and TS Basesthat are included at the end of this attachment. As indicated in the May 3,2012 telephone conference call between Duke Energy and the NRC, the TSBases for new Condition C have been expanded to define the lineup for thesingle Auxiliary Building discharge header alignment. As discussed in theconference call, this level of detail is not necessary for inclusion in the TSitself. Finally, as indicated in the conference call, Duke Energy commits toinclude corresponding detail regarding the single Auxiliary Buildingdischarge header alignment in the UFSAR following NRC approval of thisamendment request. THIS CONSTITUTES A REGULATORY COMMITMENT.12. BackgroundInsert 2 of the proposed TS Bases describes the NSWS operating in the singledischarge header alignment. This places Catawba 1 in new Condition C of theproposed TS which describes a condition where LCO 3.7.8 is not met. However,Insert 2 also says that each NSWS train is operable.Attachment Page 49 Issuea) The licensee has placed the proposed Insert 2 for the single dischargeheader lineup in the LCO section of the TS Bases. However, as statedabove, the single discharge header lineup does not meet the LCO.b) Insert 2 states that each NSWS train is operable. Yet, Insert 2 describesCondition C which does not meet the LCO. Therefore, not all NSWStrains would be operable. Throughout the LAR, the licensee lists eitherNSWS 1A or 1B train as inoperable when in the single discharge headerlineup. Thus Insert 2 conflicts with the background/technical evaluation inthe LAR.RequestExplain the inconsistencies in the location of Insert 2 in the TS Bases and thecontent of Insert 2 as described above in a) and b) and correct Insert 2 asappropriate.Duke Energy Response:For this response, please refer to the revised reprinted TS and TS Basesthat are included at the end of this attachment. The primary function ofInsert 2 in the original submittal was to clarify the conditions under whichthe Unit 1 required NSWS trains could be considered to be operable whilethe NSWS is operating in the single Auxiliary Building discharge headeralignment. It is acknowledged that while operating in this alignment, theLCO is not met. However, since Unit 2 must be in Mode 5, 6, or No Modewhile in this alignment, the train related NSWS pump associated with theAuxiliary Building discharge header that is removed from service may alsobe removed from service. With the exception of the Auxiliary Buildingdischarge header that is inoperable per Condition C, this does nototherwise impact the operability of the two NSWS trains required for Unit1. This Bases discussion was relocated under Condition C, where it ismore appropriate. (For consistency, the similar Bases discussion forsingle supply header alignment was also relocated under Condition B,where it is more appropriate.) In addition, this Bases discussion wasmodified to clarify that it is applicable to single Auxiliary Buildingdischarge header alignment, since only the Auxiliary Building portion ofthe discharge header may be inoperable per Condition C.When in the single Auxiliary Building discharge header alignment with theNSWS Train A discharge header inoperable, the NSWS piping betweenvalves IRNP19 and IRN63A is isolated. With the piping between IRNP19and I RN63A isolated, Unit 1 and Unit 2 do not have their train-relatedflowpath to the SNSWP available. Therefore the Unit 1 Train A NSWSdischarge header is inoperable due to the single Auxiliary Buildingdischarge header alignment. In the single Auxiliary Building dischargeAttachment Page 50 header alignment, Unit 2 must be in Mode 5, 6, or No Mode, and the TS forthe NSWS is not applicable in these modes.Likewise, when in the single Auxiliary Building discharge header alignmentwith the NSWS Train B discharge header inoperable, the NSWS pipingbetween valves IRNP20 and 1RN58B is isolated. With the piping betweenI RNP20 and I RN58B isolated, Unit I and Unit 2 do not have their train-related flowpath to the SNSWP available. Therefore the Unit I Train BNSWS discharge header is inoperable due to the single Auxiliary Buildingdischarge header alignment. In the single Auxiliary Building dischargeheader alignment, Unit 2 must be in Mode 5, 6, or No Mode, and the TS forthe NSWS is not applicable in these modes.13. BackgroundWhen in a single discharge header lineup, the background/technical sections ofthe LAR state that Catawba 2 must be in Mode 5, 6 or no Mode.IssueNew Condition C of the TS as proposed in Insert 1 does not specifically requirethat Catawba 2 be in Mode 5, 6 or no Mode.RequestExplain why new Condition C of the TS does not require that Catawba 2 be inMode 5, 6, or no Mode.Duke Energy Response:For this response, please refer to the revised reprinted TS and TS Basesthat are included at the end of this attachment. Note 1 of new Condition Chas been expanded by adding the following statement: "Entry into thisCondition shall not be allowed while Unit 2 is in MODE 1, 2, 3, or 4." Thisstatement was deemed preferable to a statement requiring Unit 2 to be inMode 5, 6, or No Mode for two reasons: 1) the term "No MODE" is notutilized in TS, and 2) the chosen statement is consistent with other Notesin TS governing Mode prohibitions, which are typically stated in thenegative.14. BackgroundInsert 3 of the LAR states"... Condition C is only allowed to be entered in supportof planned maintenance or modification activities associated with the AuxiliaryBuilding discharge header that is taken out of service. An example of a situationfor which entry into this Condition is allowed is refurbishment of an AuxiliaryBuilding discharge header. Entry into this Condition is not allowed in response tounplanned events or for other events involving the NSWS."Attachment Page 51 The LAR cover letter and description describes the proposed scope to be for theNSWS discharge header to be removed from service for cleaning, coating andfollow-up inspections.IssueInsert 3 defines the allowed entry into Condition C to be much broader than thescope delineated in the rest of the LAR.RequestExplain how you will modify Insert 3 to be consistent with the rest of the LAR.Duke Energy Response:The original scope of activities that warranted the submission of this LARwere associated with removing the Auxiliary Building portion of a NSWSdischarge header from service for cleaning, coating, and follow-upinspections. This submittal specifically excludes emergent work as asituation under which Condition C may be entered. However, there may beother pre-planned maintenance or modification activities in the future thatare appropriate for entry into Condition C that have not yet beenanticipated. Over the years, several one-time TS change requests weresubmitted and approved which supported pre-planned maintenanceactivities associated with the NSWS supply headers at Catawba. In aneffort to avoid additional one-time requests, Duke Energy submitted, andthe NRC approved, a permanent TS change to allow the NSWS supplyheaders to be removed from service for pre-planned maintenanceactivities. This submittal for the NSWS Auxiliary Building dischargeheaders is therefore consistent with previous Catawba submittal/approvalhistory. The TS Bases are written specifically enough to only allow pre-planned maintenance activities, without being overly specific so as todisallow future unanticipated types of these activities. Therefore, nochanges to the TS Bases are being proposed in response to this question.15. BackgroundThe guidelines of RG 1.177 state that the licensee "should consider... whetherthere are appropriate restrictions in place to preclude simultaneous equipmentoutages that would erode the principles of redundancy and diversity," and"whether compensatory actions to be taken when entering the modified[completion time] CT for preplanned maintenance are identified."When operating in a single discharge header as proposed by the LAR, oneNSWS train is inoperable. NSWS is a support system. In accordance with TS3.0.6, the corresponding supported systems are required to be declaredinoperable if determined to be inoperable as a result of the support systeminoperability. Supported systems include Emergency Core Cooling System,Containment Spray System, Containment Valve Injection Water System,Auxiliary Feedwater, Component Cooling Water, Control Room Area VentilationAttachment Page 52 System, Auxiliary Building Filtered Ventilation Exhaust System, and EmergencyDiesel Generators.IssueThe licensee has not identified any inoperable systems that are supported byNSWS in the LAR. The licensee has not expressed any compensatorymeasures to ensure the redundant trains of supported systems are protected toreduce the risk of loss of safety function. The licensee has not described anyevaluation required by LCO 3.0.6 to perform an evaluation in accordance with TSAdministrative Control 5.5.15, "Safety Function Determination Program (SFDP)"for supported systems.RequestIdentify all inoperable supported systems as a result of each inoperable NSWStrain. Identify all compensatory measure to protect the redundant system asdetermined by TS Administrative Control 5.5.15.Duke Energy Response:The TS systems supported by the NSWS include the following:TS 3.4.6, RCS Loops -MODE 4 (cascade required only when all NSWScooling is inoperable per Note 2 in TS 3.7.8, Required Action A.1)TS 3.5.2, ECCS -OperatingTS 3.5.3, ECCS -ShutdownTS 3.6.6, Containment Spray SystemTS 3.6.17, Containment Valve Injection Water System (CVIWS)TS 3.7.5, Auxiliary Feedwater (AFW) SystemTS 3.7.7, Component Cooling Water (CCW) SystemTS 3.7.11, Control Room Area Chilled Water System (CRACWS)TS 3.8.1, AC Sources -Operating (DGs) (cascade required only when allNSWS cooling is inoperable per Note I in TS 3.7.8, Required Action A.1)Per the requirements of LCO 3.0.6, the Conditions and Required Actionsassociated with the supported systems are not required to be entered.Only the support system LCO Actions are required to be entered. TS5.5.15, Safety Function Determination Program, ensures that a loss ofsafety function is detected and appropriate actions are taken.While the NSWS is aligned in the single Auxiliary Building dischargeheader configuration, procedures will direct compensatory measures. Theprocedures for aligning the NSWS in the single Auxiliary Buildingdischarge header configuration will include the following measures:* Verify flood barriers in the Turbine Building basement prior toimplementation.* Verify no severe weather is in the forecast prior to implementation.Attachment Page 53 | |||
* Limit discretionary maintenance in Unit I and Unit 2.cable rooms, onavailable DGs, on Unit 1 turbine-driven AFW pump, on plant DrinkingWater System (which provides backup cooling to the Train A centrifugalcharging pump), and on Standby Shutdown System (including standbymakeup pump) during implementation.* Implement roving fire watch in Unit I and Unit 2 cable rooms duringimplementation.Attachment Page 54 NSWS3.7.83.7 PLANT SYSTEMS3.7.8 Nuclear Service Water System (NSWS)LCO 3.7.8APPLICABILITY:Two NSWS trains shall be OPERABLE.MODES 1, 2, 3, and 4.ACTIONSCONDITION REQUIRED ACTION COMPLETION TIMEA. One NSWS train A.1 ---------NOTES------inoperable. 1. Enter applicableConditions andRequired Actions ofLCO 3.8.1, "ACSources-Operating," foremergency dieselgenerator madeinoperable by NSWS.2. Enter applicableConditions andRequired Actions ofLCO 3.4.6, "RCSLoops-MODE 4," forresidual heat removalloops madeinoperable by NSWS.Restore NSWS train to 72 hoursOPERABLE status.(continued)Catawba Units 1 and 23.7.8-1Amendment Nos. 243/237 NSWS3.7.8ACTIONS (continued)CONDITION REQUIRED ACTION COMPLETION TIMEB. --------NOTES-----1. Entry into thisCondition shall onlybe allowed for pre-planned activities asdescribed in theBases of thisSpecification.2. Immediately enterCondition A of thisLCO if one or moreNSWS componentsbecome inoperablewhile in thisCondition and oneNSWS train remainsOPERABLE.3. Immediately enterLCO 3.0.3 if one ormore NSWScomponents becomeinoperable while inthis Condition andno NSWS trainremainsOPERABLE.B.1Restore NSWS supplyheader to OPERABLEstatus.30 daysOne NSWS supplyheader inoperable dueto NSWS being alignedfor single supply headeroperation.(continued)Catawba Units 1 and 23.7.8-2Amendment Nos. | * Limit discretionary maintenance in Unit I and Unit 2.cable rooms, onavailable DGs, on Unit 1 turbine-driven AFW pump, on plant DrinkingWater System (which provides backup cooling to the Train A centrifugalcharging pump), and on Standby Shutdown System (including standbymakeup pump) during implementation.* Implement roving fire watch in Unit I and Unit 2 cable rooms duringimplementation.Attachment Page 54 NSWS3.7.83.7 PLANT SYSTEMS3.7.8 Nuclear Service Water System (NSWS)LCO 3.7.8APPLICABILITY:Two NSWS trains shall be OPERABLE.MODES 1, 2, 3, and 4.ACTIONSCONDITION REQUIRED ACTION COMPLETION TIMEA. One NSWS train A.1 ---------NOTES------inoperable. 1. Enter applicableConditions andRequired Actions ofLCO 3.8.1, "ACSources-Operating," foremergency dieselgenerator madeinoperable by NSWS.2. Enter applicableConditions andRequired Actions ofLCO 3.4.6, "RCSLoops-MODE 4," forresidual heat removalloops madeinoperable by NSWS.Restore NSWS train to 72 hoursOPERABLE status.(continued)Catawba Units 1 and 23.7.8-1Amendment Nos. 243/237 NSWS3.7.8ACTIONS (continued)CONDITION REQUIRED ACTION COMPLETION TIMEB. --------NOTES-----1. Entry into thisCondition shall onlybe allowed for pre-planned activities asdescribed in theBases of thisSpecification.2. Immediately enterCondition A of thisLCO if one or moreNSWS componentsbecome inoperablewhile in thisCondition and oneNSWS train remainsOPERABLE.3. Immediately enterLCO 3.0.3 if one ormore NSWScomponents becomeinoperable while inthis Condition andno NSWS trainremainsOPERABLE.B.1Restore NSWS supplyheader to OPERABLEstatus.30 daysOne NSWS supplyheader inoperable dueto NSWS being alignedfor single supply headeroperation.(continued)Catawba Units 1 and 23.7.8-2Amendment Nos. | ||
NSWS3.7.8ACTIONS (continued)CONDITION REQUIRED ACTION COMPLETION TIMEC. --------NOTES-----1. Entry into thisCondition shall onlybe allowed for Unit 1and for pre-plannedactivities asdescribed in theBases of thisSpecification. Entryinto this Conditionshall not be allowedwhile Unit 2 is inMODE 1, 2, 3, or 4.2. Immediately enterCondition A of thisLCO if one or moreUnit 1 requiredNSWS componentsbecome inoperablewhile in thisCondition and oneNSWS train remainsOPERABLE.3. Immediately enterLCO 3.0.3 if one ormore Unit 1 requiredNSWS componentsbecome inoperablewhile in thisCondition and noNSWS train remainsOPERABLE.C.1Restore NSWS AuxiliaryBuilding discharge headerto OPERABLE status.14 daysOne NSWS AuxiliaryBuilding dischargeheader inoperable dueto NSWS being alignedfor single AuxiliaryBuilding dischargeheader operation.(continued)Catawba Units 1 and 23.7.8-3Amendment Nos. | NSWS3.7.8ACTIONS (continued)CONDITION REQUIRED ACTION COMPLETION TIMEC. --------NOTES-----1. Entry into thisCondition shall onlybe allowed for Unit 1and for pre-plannedactivities asdescribed in theBases of thisSpecification. Entryinto this Conditionshall not be allowedwhile Unit 2 is inMODE 1, 2, 3, or 4.2. Immediately enterCondition A of thisLCO if one or moreUnit 1 requiredNSWS componentsbecome inoperablewhile in thisCondition and oneNSWS train remainsOPERABLE.3. Immediately enterLCO 3.0.3 if one ormore Unit 1 requiredNSWS componentsbecome inoperablewhile in thisCondition and noNSWS train remainsOPERABLE.C.1Restore NSWS AuxiliaryBuilding discharge headerto OPERABLE status.14 daysOne NSWS AuxiliaryBuilding dischargeheader inoperable dueto NSWS being alignedfor single AuxiliaryBuilding dischargeheader operation.(continued)Catawba Units 1 and 23.7.8-3Amendment Nos. | ||
Revision as of 08:06, 29 March 2018
| ML12194A218 | |
| Person / Time | |
|---|---|
| Site: | Catawba  |
| Issue date: | 07/09/2012 |
| From: | Glover R M Duke Energy Carolinas |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| TAC ME7659, TAC ME7660 | |
| Download: ML12194A218 (72) | |
Text
Duke DUKE ENERGY CAROLINAS, LLCCatawba Nuclear StationL c Energy 4800 Concord RoadCarolinas York, SC 29745July 9, 2012 10 CFR 50.90U.S. Nuclear Regulatory CommissionAttention: Document Control DeskWashington, D.C. 20555Subject: Duke Energy Carolinas, LLC (Duke Energy)Catawba Nuclear Station, Units 1 and 2Docket Numbers 50-413 and 50-414Proposed Technical Specifications (TS) and Bases AmendmentTS and Bases 3.7.8, Nuclear Service Water System (NSWS)Response to NRC Request for Additional Information (RAI)(TAC Nos. ME7659 and ME7660)References: 1. Letter from Duke Energy to the NRC, same subject, dated November22, 2011.2. Letter from the NRC to Duke Energy, "Request for AdditionalInformation (RAI) Regarding License Amendment Related to Requestto Revise Technical Specification (TS) 3.7.8, Nuclear Service WaterSystem (NSWS)", dated May 11, 2012.In Reference 1, Duke Energy requested amendments to the Catawba Facility OperatingLicenses and TS to modify the subject TS and Bases to allow single discharge headeroperation of the NSWS (Duke Energy designation "RN") for a time period of 14 days.The requested change will facilitate future maintenance of the Unit 2 NSWS dischargeheaders in the Auxiliary Building. In Reference 2, the NRC transmitted RAls associatedwith this amendment request. The purpose of this letter is to provide responses tothese RAIs. The attachment to this letter provides the responses. The format of eachresponse is to restate the RAI question, followed by the associated response.The original regulatory evaluation contained in Reference 1 is unaffected as a result ofthis RAI response supplement. As discussed in a telephone conference call betweenDuke Energy and the NRC on May 3, 2012, there is one regulatory commitmentassociated with this RAI response supplement. This commitment is discussed on page49 of the attachment.Pursuant to 10 CFR 50.91, a copy of this RAI response supplement is being sent to theappropriate State of South Carolina official.www.duke-energy comr U.S. Nuclear Regulatory CommissionPage 2July 9, 2012Inquiries on this matter should be directed to L.J. Rudy at (803) 701-3084.Very truly yours,R. Michael GloverInterim Site Station ManagerLJR/sAttachment U.S. Nuclear Regulatory CommissionPage 3July 9, 2012R. Michael Glover affirms that he is the person who subscribed his name to theforegoing statement, and that all the matters and facts set forth herein are true andcorrect to the best of his knowledge.R, Michael Glover, Interim Site Station ManagerSubscribed and sworn to me: 7'-79-"L t ("Z-DateNotary PvMy commission expires: 21 " 2.--2..--Date.-SEAL U.S. Nuclear Regulatory CommissionPage 4July 9, 2012xc (with attachment):V.M. McCreeRegional AdministratorU.S. Nuclear Regulatory Commission -Region IIMarquis One Tower245 Peachtree Center Ave., NE Suite 1200Atlanta, GA 30303-1257G.A. Hutto, IIISenior Resident Inspector (Catawba)U.S. Nuclear Regulatory CommissionCatawba Nuclear StationJ.H. Thompson (addressee only)NRC Project Manager (Catawba)U.S. Nuclear Regulatory CommissionOne White Flint North, Mail Stop 8-G9A11555 Rockville PikeRockville, MD 20852-2738S.E. JenkinsManagerRadioactive & Infectious Waste ManagementDivision of Waste ManagementSouth Carolina Department of Health and Environmental Control2600 Bull St.Columbia, SC 29201 ATTACHMENTRESPONSE TO NRC REQUEST FOR ADDITIONAL INFORMATION (RAI)
REQUEST FOR ADDITIONAL INFORMATION (RAI)BY THE OFFICE OF NUCLEAR REACTOR REGULATIONREGARDING LICENSE AMENDMENT RELATED TOREVISION OF THE TECHNICAL SPECIFICATION (TS) 3.7.8 TO ALLOWSINGLE DISCHARGE HEADER OPERATION OF THE NUCLEAR SERVICEWATER SYSTEM (NSWS) FOR A TIME PERIOD OF 14 DAYSCATAWBA NUCLEAR STATION, UNITS 1 AND 2 (CATAWBA 1 AND 2)DOCKET NOS. 50-413 AND 50-414By letter dated November 22, 2011, (Agencywide Document Access and ManagementSystem Accession No. ML 11327A149), Duke Energy Carolinas, LLC (Duke Energy orthe licensee), submitted a proposed license amendment request (LAR) in the form ofchanges to the Technical Specifications (TSs) for Catawba 1 and 2. The proposed LARwould revise TS 3.7.8 to allow single discharge header operation of the NSWS [NuclearService Water System] (Duke Energy designation "RN") for a time period of 14 days.To complete its review, the U.S. Nuclear Regulatory Commission (NRC) staff requeststhe following additional information:1. According to the LAR, the licensee concludes that "the NSWS single dischargeheader alignment supports operation in this configuration ... [and] the increase inrisk ... is minimal and acceptable." Provide the quantitative results that are beingcompared against the Regulatory Guide (RG) 1.177 and RG 1.174 acceptanceguidelines.Duke Energy Response:RG 1.177 AcceptanceThe baseline Core Damage Frequency (CDF) and Large Early Release Frequency(LERF) for the Catawba PRA model used in the supporting analysis are 1.83E-05/yr and 1.27E-06/yr, respectively. When the NSWS is placed in the operatingconfiguration to support single discharge header operation, the CDF and LERFincrease to 2.05E-05/yr and 1.36E-06/yr, respectively. The increase in risk isattributed to the change in the loss of NSWS frequency when the system is in thesingle discharge header alignment.A CDF = (2.05E-05/yr -1.83E-05/yr) = 2.20E-06/yrA LERF = (1.36E-061yr -1.27E-06/yr) = 9.OOE-08/yrAssuming a capacity factor of 0.9,Attachment Page 1 Incremental Conditional Core Damage Frequency (ICCDF) = 2.20E-06 / 0.9 =2.44E-06/rx-yr (or 6.69E-09/day)Incremental Conditional Large Early Release Frequency (ICLERF) = 9.OOE-08 / 0.9 = 1.OOE-07/rx-yr (or 2.74E-1 0/day)Therefore, for each 14-day TS Condition duration,Incremental Conditional Core Damage Probability (ICCDP) = (6.69E-09/day)(14 days) = 9.37E-08Incremental Conditional Large Early Release Probability (ICLERP) = (2.74E-10/day) (14 days) = 3.84E-09It is anticipated that Catawba will enter this TS Condition for the full 14 days twice(once per train) initially and then in subsequent refueling cycles enter the TSCondition on a decreasing duration and frequency. Therefore, assuming amaximum of two full entries per year, the ICCDP and ICLERP are:ICCDP = (9.37E-08) x 2 = 1.87E-07ICLERP = (3.84E-09) x 2 = 7.68E-09Thus, the guidelines for RG 1.177 of IE-06 (ICCDP) and 1E-07 (ICLERP) are metfor this configuration.RG 1.174 AcceptanceFirst, converting the baseline CDF and LERF to reactor years,CDF =[ 1.83E-05 / 0.9 = 2.03E-05/rx-yrLERF = 1.27E-06 / 0.9 = 1.41 E-06/rx-yrAnd the corresponding CDF and LERF when entering the TS Condition are,CDF = 2.05E-05 / 0.9 = 2.28E-05/rx-yrLERF = 1.36E-06 /,0.9 = 1.51 E-06/rx-yrCalculating the new CDF and LERF with added unavailability from entering the TSCondition a maximum of twice in one reactor year,CDFnew = [2.03E-05/rx-yr x (337 / 365)] + [2.28E-05/rx-yr x (28 / 365)]= 2.05E-05/rx-yrLERFnew = [1.41 E-06/rx-yr x (337 / 365)] + [1.51 E-06/rx-yr x (28 / 365)]Attachment Page 2
= 1.42E-O6/rx-yrTherefore, the CDF and LERF would be expected to increase by a maximum of,A CDF = 2.05E-05 -2.03E-05 = 2.OOE-07/rx-yrA LERF = 1.42E-06 -1.41E-06 = 1.OOE-08/rx-yrThus, the guidelines for RG 1.174 of IE-06 (A CDF) and 1E-07 (A LERF) are metfor this configuration.2. RG 1.200 states "A peer review is needed to determine if the intent of therequirements in the standard is met." The standard referred to is the AmericanSociety of Mechanical Engineers (ASME) and American Nuclear Society (ANS)probabilistic risk assessment (PRA) standard that provides both process andtechnical requirements for an at-power Level 1 and limited Level 2 PRA forinternal events, internal flood, internal fire, seismic, wind, external flood and otherexternal events. RG 1.200 also states that "The results of the peer review and/orself-assessment, and a description of the resolution of all the peer review or self-assessment findings and observations are included."a) The submittal does not address an independent peer review according tothe ASME/ANS PRA Standard, for any of the hazard groups, includinginternal events. The NRC staff expects applications to have had PRApeer reviews of all potentially significant hazard groups for an application.Please indicate what were the findings and observations of these reviewsand how they were dispositioned for this application.Duke Energy Response:a) In March 2002, the Catawba PRA initially received an internal eventsfull scope peer review by an industry team of knowledgeable PRApractitioners. A detailed list addressing the findings andobservations of the peer review is provided in the response to Partc) of this question.Since the performance of this peer review, the industry has utilizedthe American Society of Mechanical Engineers (ASME) process todevelop a standard identifying the requirements associated withPRA. RG 1.200 endorses the ASME PRA Standard as an acceptablemethod for demonstrating the technical adequacy of a PRA,provided various clarifications are made as identified in theregulatory guide.Subsequently in 2008, Duke Energy conducted a self-assessment ofthe Catawba internal events PRA in accordance with NEI-00-02against the ASME PRA Standard through addenda RA-Sc-2007.Duke Energy has updated this assessment against the 2009Attachment Page 3 Standard. The Catawba PRA self-assessment included the RiskAssessment Technical Requirements listed in Part 2 of the 2009ASME PRA Standard. This self-assessment evaluated the PRA withrespect to Capability Category (CC) II. For those requirements ofthe standard that have not been met, a justification of why it isacceptable that the requirement has not been met was created. Asummary of these outstanding items was provided to the NRC byDuke Energy in its November 22, 2011 LAR submittal.Regarding external hazards, the key is to determine whether thesehazards can be considered as "potentially significant hazardgroups" for the LAR configuration of concern. Duke Energy hasreviewed the impacts from seismic events, fires, floods, andtornado/high wind events and has determined that the contributionof these risks for the requested Completion Time of 14 days isacceptable. The details of these analyses are provided in theresponses to Questions 3 through 6 below and demonstrate thatthese hazards are not potentially significant.b) The licensee states that the "[self] assessment indicated that 231 of the306 Supporting Requirements (SRs) for Rev. 1 were fully met [but] 24 ofthe SRs were not applicable to Catawba [1 and 2] at all". However, only10 SRs were actually considered to have an impact on the PRA modeland were addressed in the submittal. Please provide a detailed listaddressing all SRs that were not met in the self assessment.Duke Energy Response:b) As stated in the submittal, Duke Energy reviewed 306 SupportingRequirements (SRs) for Rev. 1. Of these, 231 were fully met. Forthe remaining 75 SRs, 24 were not applicable to Catawba at all,either because the referenced techniques were not used in the PRAor because the SR was not required for CC II. For the remainingSRs, 41 required enhanced documentation but none were expectedto have a significant impact on the PRA results or insights. Theremaining 10 items were of a technical nature and weredispositioned in the November 22, 2011 LAR submittal. Each of theitems was either found to be addressed for the requestedapplication or was not expected to have any significant impact onthe application.A detailed list addressing all applicable SRs that were not met in theupdated self-assessment is provided below. SRs listed in ()refer tothe 2007 Standard nomenclature.Attachment Page 4 Title Description of Gap Applicable Current Expected Impact onSRs Status/Comment ApplicationPhenomenologicaleffects are alreadyAccident sequence notebooks Open. considered in theand system model notebooks Phenomenological model. No technicalshould document the effects are considered issues wereGap #1 phenomenological conditions AS-B3 in the model, although identified for thispheatenomenooicacoendti these considerations item. This is acreated by the accidentsequence progression. are not always documentation issuedocumented. only and there is noimpact on thisapplication.The industrydocuments used togenerate theOpen. SSC and Catawba PRAdatabase (such asunavailability NUREG/CR-6928)boundaries, SSC failure define theRevise the data calculation to modes and success compnentGap #2 discuss component DA-Al criteria are used boundaries. Noboundaries definitions. (DA-Ala) consistently across technical issuesanalyses; however, werinifiedufotheseneed o bewere identified forthese need to bethsgpTissaformally documented. this gap. This is adocumentation issueonly and there is noimpact on thisapplication.Open. Partitioning the This is a refinementfailure rates represents to the equipmenta refinement to the data failure rates.Revise the data calculation to analysis process. However, since mostgroup standby and operating Previously, generic data components areGap #3 component data. Group DA-B1 sources often did not groupedcomponents by service provide standby and appropriately, thecondition to the extent operating failure rates. overall impact will besupported by the data. NUREG/CR-6928 does small and is notprovide more of this expected to have adata, and will be used significant impact ongoing forward. this application.Open. As part of theBayesian updateprocess, checks areEnhance the documentation to performed to assure None. No technicalEnhane the dcumentaion toe that the posterior issues wereinluea icusono tedistribution is identified for thisGap #4 specific checks performed on DA-D4 reason iv the gap Ti istheBaesan-pdte daaasreasonable given the gap. This is arequired by this SR. prior distribution and documentation issueplant experience, only.These checks need tobe formallydocumented.Attachment Page 5 Title Description of Gap Applicable Current Expected Impact onSRs Status/Comment ApplicationOpen. Generic CCFprobabilities areconsidered forProvide documentation of the applicability to the None. No technicalcomparison of the component plant. CCF probabilities issues wereboundaries assumed for the are consistent with issues wereGap #5 generic CCF estimates to DA-D6 plant experience and iefe fhisthose assumed in the PRA to component boundaries, gap. This is adocumentation issueensure that these boundaries although the CCF only.are consistent. documentation needsto be enhanced todiscuss componentboundaries.Open. Based onevaluations using theEPRI HRA calculator,calibration errors thatresult in failure of asingle channel are Recent modelingexpected to fall in the updates for Oconee10-3 range. Relative to support the positionGap #6 the potential for calibration HR-A2 post-initiator HEPs, that calibrationerrorst equipment random errors are notfailure rates and expected to have amaintenance significant impact onunavailability, this application.calibration HEPs are notexpected to contributesignificantly to overallequipmentunavailability.Attachment Page 6 Title Description of Gap Applicable Current Expected Impact onSRs Status/Comment ApplicationOpen. Based onevaluations using theEPRI HRA calculator,calibration errors thatresult in failure ofmultiple channels areexpected to fall in the This gap is not10"5 (or smaller) range. expected toIdentify maintenance and Relative to post-initiator significantly impactcalibration activities that could HEPs, latent human the base case PRAsimultaneously affect error probabilities, model and shouldGap #7 equipment in either different HR-A3 equipment random have even lesstrains of a redundant system failure rates and impact on thisoradiverse ofae ts. e maintenance application, whichor diverse systems. unavailability, involves a singlecalibration HEPs and discharge headermisalignment of alignment.multiple trains ofequipment are notexpected to contributesignificantly to overallequipmentunavailability.Open. Pre-initiator Mean values forHEPs are generally set HEPs were used into relatively high the supportingGap #8 Develop mean values for pre- HR-D6 screening values, which analysis; therefore,initiator HEPs. bound the mean values.heeinitiatr HE~s boundShe measvalueEven so, pre-initiator addressed for thisHEPs are not significant addresediorhcontributors to risk. application.Attachment Page 7 TitleDescription of GapApplicable CurrentSRs Status/CommentExpected Impact onApplicationGap #9Document in more detail theinfluence of performanceshaping factors on executionhuman error probabilities.HR-G3Open. Performanceshaping factors areaccounted for in thedevelopment of humanerror probabilities,although detaileddocumentation is notalways available forevery HRA input.The current Catawbamodel of record usedthe HRAmethodologydeveloped bySAROS. Beginning,with the 2011Oconee PRA update,Duke Energy nowuses the HRAcalculator method.Based upon theOconee updateresults using HRAcalculator, thecurrent CatawbaHRA results usingSAROS areconsidered to beconservative andtherefore bounding.Thus, this gap isconsidered to be adocumentation issueonly with no impacton this application.-I IGap #10Enhance HRA documentationof the time available tocomplete actions.HR-G4Open. T/H analyses,simulator runs, andoperator interviews areused in developing thetime available tocomplete operatoractions. The time atwhich the cue to takeaction is received isspecified in the HEPquantification.However, the HRAdocumentation needsto be enhanced toprovide a traceable pathto all analysis inputs.See the response toGap #9.Document a review of the Open. HFEs areHFEs and their final HEPs reviewed byrelative to each other to knowledgeable siteGap #11 confirm their reasonableness HR-G6 personnel to assuregiven the scenario context, high quality. However, Gap #9.plant history, procedures, this review needs to beoperational practices, and better documented.experience. betterdocumented.Attachment Page 8 Title Description of Gap Applicable Current Expected Impact onSRs Status/Comment ApplicationMean values forOpen. The use of mean HEPs were used inDevelop mean values for post- HR-G8 values for HEPs instead the supportingGap #12 initiator HEPs. (HR-G9) of lower probability analysis; therefore,median values can this issue has beenaffect the PRA results. addressed for thisapplication.Open. Operatorrecovery actions arecredited only if they areDevelop more detailed feasible, as determineddocumentation of operator by the proceduralcues, relevant performance guidance, cues,Gap #13 shaping factors, and HR-H2 performance shaping See the response toavailability of sufficient factors, and available Gap #9.manpower to perform the manpower. As notedactionn for HR-G3, G4, and G6above, thedocumentation of theseconsiderations needs tobe enhanced.Attachment Page 9 Title Description of Gap Applicable Current Expected Impact onT It DecitonoIa SRs Status/Comment ApplicationGap #14Document:* a structured, systematicidentification of initiatingevents" a review of genericanalyses of similar plants* the systematic evaluationof the potential for failureof each system, includingsupport systems, to resultin an initiating event* the inclusion of initiatorsresulting from commoncause equipment failuresand from routine systemalignments* the disposition of eventsthat have occurred atconditions other than at-power operation for theirpotential to result in aninitiator while at power* plant personnel input indetermining whetherpotential initiating eventshave been overlooked" a review of plant-specificprecursor events for theirpotential to result ininitiating events* a structured, systematicinitiating events groupingprocess that facilitatesaccident sequencedefinition andquantification* that initiators are groupedby similarity of plantresponse, success criteria,timing, and effect onoperators and relevantsystems; or events can besubsumed within abounding group" the initiating eventsanalysis assumptions andsources of uncertaintyIE-A1IE-A4(IE-A3a)IE-A5(IE-A4)IE-A6(IE-A4a)IE-A7(IE-A5)IE-A8(IE-A6)IE-A9(IE-A7)IE-B1IE-B2IE-B3IE-D3Open. No technicalissues are identified,just a need to enhancethe documentation.The list of Catawba PRAinitiating events isconsistent with that ofits sister plant, McGuireNuclear Station, as wellas with those found inanalyses for similarplants, such as thosecontained in thePressurized WaterReactor Owner's GroupPSA Model and ResultsComparison Database.The Catawba initiatingevents analysis isrevised with each PRAupdate to ensure that itremains consistent withindustry operatingexperience as well ascurrent plant design,operation andexperience. In addition,calculation CNC-1535.00-00-0114,Potential InternalInitiating Events for theCatawba PRA, has beenperformed to addressthe IE supportingrequirements.However, this analysisneeds to beincorporated into thebase case PRA model.No impact to thisapplication. This is adocumentation issueonly. No technicalissues wereidentified for thisgap.As a matter ofcomparison, theinitiator assessmentcalculation recentlyperformed for theOconee PRA and theMcGuire PRAupdates includeddetaileddocumentation of theinitiator selectionprocess. The analystnoted no significantissues between theupdates and theirprevious versions.Given that theinitiator analysis forthe current CatawbaPRA model of recordwas performed usingthe same personnel,methods, andprocedures, theanalyses areconsistent and thisgap is adocumentation issueonly.Attachment Page 10 Title Description of Gap Applicable Current Expected Impact onSRs Status/Comment ApplicationThis item is relevantVarious enhancements to the to applications thatinternal flood analysis: include internal flood" Identify the release initiators. The lonesignificant internalcharacteristic and capacity signifing entfondassociated with each flood IFSO-A5 flooding event foundsource. (IF-B33) in the cut setsDiscuss flood mitigative generated for thisfeatures. IFSN-A5 Open. An update of the application involvesfeAddress the potential for (IF-C2c) flood analysis to meet the Auxiliarythe Standard's Shutdown Panel.spray, jet impingement, and IFSN-A6 requirements is planned However, this event" Provide more analysis of (IF-C3) for 2011. For McGuire, does not dominateGap #15 Catawba's sister plant, the results (seeflood propagation IFSN-A8 the internal flooding section belowflowpaths. Addresspotential structural failure (IF-C3b) analysis has already entitledof doors or walls due to been upgraded to meet 'Internal/Externalofldoon loralls ndu to IFQU-A9 the Standard's Floods PRA' whichflooding loads and the (IF-E6b) requirements. confirms nopotential for barrier sgiiatipcunavalabiity.significant impactunavailability. n/a from internalAddress potential indirect (IF-F2) flooding events).effects. Teeoe hsie" Enhance the documentation Therefore, this itemto address all of the SR is not expected todetails, have a significantimpact on thisapplication.Open. This issue Small LOCAsExplicitly model RCS affects certain small contribute less thandepressurization for small LOCAs. However, since 2% to LERF for theGap #16 LOCAs and perform the LE-C7 the small LOCA LAR configuration.dependency analysis on the (LE-C6) contribution to LERF is Therefore, this itemHEPs. small, there is no does not have asignificant impact on significant impact onthe PRA results. this application.No impact to thisLE-G3 application. This is aVarious enhancements to the documentation issueGap #17 LERF documentation. LE-G5 Open. only. No technicalissues wereLE-G6 identified for thisgap.Attachment Page 11 Title Description of Gap Applicable Current Expected Impact onSRs Status/Comment ApplicationOpen. Since Catawbaand McGuire are sisterplants, in practice, theirresults are oftenPerform and document a compared. Also,comparison of PRA results comparisons performedwith similar plants and identify for the Mitigating No impact to thiscauses for significant LE-F3 Systems Performance application. This is acausenes. frIgentifinthe EIndex and other documentation issueGap #18differences. Identify theGap #18 contributors to LERF and QU-D4 programs help identify only. No technicalcharacterize the LERF (QU-D3) causes for significant issues wereuncertainties consistent with differences. However, identified for thisuncrtiniescositen wthto fully meet this SR, gap.the applicable ASME Standard the melrequirements. the modelquantificationdocumentation needsto be enhanced toprovide a resultscomparison.Perform and document nla No impact to thissensitivity analyses to (LE-F2) Open. This is application. This is adetermine the impact of the addressed with each only. No technicalassumptions and sources of LE-G4 Surveillance Test issues weremodel uncertainty on the Interval assessment. isues wereresults. QU-E4 identified for thisgap.No impact to thisOpen. These SRs application. This is aExpand the documentation of QU-F2 pertain to the model documentation issueGap #20 the PRA model results to quantification only. No technicaladdress all required items. QU-F6 documentation. issues wereidentified for thisgap.Open. Success criteriaare developed to No impact to thisaddress all of the application. This is aImprove the documentation on modeled initiating documentation issueGap #21 the T/H bases for all safety SC-A3 events. However, the only. No technicalfunction success criteria for (SC-A4) documentation of issues wereall initiators. success criteria needs issues wereto be improved to i f otinclude initiator gap.information.Attachment Page 12 Title Description of Gap Applicable Current Expected Impact onSRs Status/Comment ApplicationOpen. Catawbasuccess criteria areconsistent with those of No impact to thissister plants included in application. This is aProvide evidence that an the PWROG PSA documentation issueGap #22 acceptability review of the T/H SC-B5 database. However, to only. No technicalanalyses is performed. fully meet this SR, the issues weresuccess criteriasucces crieriaidentified for thisdocumentation needsto be enhanced to gap.include a resultscomparison.No impact to thisExpand the documentation of application. This is aExpadthe s scumeriat o SC-Cl Open. These SRs documentation issueGap #23 the success criteria pertain to the success only. No technicaldevelopment to address all SC-C2 criteria documentation. issues wererequired items. identified for thisgap.Open. To supportsystem modeldevelopment, No impact to thisEnhance the system walkdowns and plant application. This is adocumentation to include an personnel interviews documentation issueGap #24 up-to-date system walkdown SY-A4 were performed. only. No technicalchecklist and system engineer However, issues werereview for each system. documentation of an identified for thisup-to-date system gap.walkdown is not gap.included with eachsystem notebook.Attachment Page 13 Title Description of Gap Applicable Current Expected Impact onSRs Status/Comment ApplicationOpen. Basic eventcomponent boundariesutilized in the systemsanalysis are consistentwith those in the dataanalysis. In addition,component boundariesare consistent withthose defined in thegeneric failure rate No impact to thissource documents,such as NUREG/CR- application. This is aEnhance the systems analysis documentation issueGap #25 documentation to discuss SY-A8 6928. Dependencies only. No technicalcomponent boundaries, among components, issues weresuch as interlocks, areexplicitly modeled, i f otconsistent with the gap.Duke PRA ModelingGuidelines workplaceprocedure (XSAA-115).There is no evidence ofa technical problemwith componentboundaries, just a needto improve thedocumentation.Attachment Page 14 Title Description of Gap Applicable Current Expected Impact onT SRs Status/Comment ApplicationGap #26 Provide quantitativeevaluations for screening.SY-A15(SY-A1 4)Open. There is noevidence of a technicalproblem associatedwith the screening ofcomponents orcomponent failuremodes, just a need todocument a quantitativescreening. It isexpected thatconversion to a morequantitative approachwould not changedecisions aboutwhether or not toexclude components orfailure modes. A reviewof our qualitativescreening processconfirms thisexpectation. Forexample, transfer failureevents for motor-operated valves (MOVs)with 24-hr exposuretimes may not bemodeled unlessprobabilisticallysignificant with respectto logically equivalentbasic events. ForCatawba, the MOVtransfers failureprobability is less than1% of the MOV fails toopen on demand failurerate. In cases like this,not including therelatively lowprobability failure modein the PRA model doesnot have an appreciableimpact on the results.No impact to thisapplication. This is adocumentation issueonly. No technicalissues wereidentified for thisgap.Attachment Page 15 Title Description of Gap Applicable Current Expected Impact onSRs Status/Comment ApplicationPer Duke's PRA modelingguidelines (XSAA-115), ensurethat a walkdown/system Open. As noted for SY-engineer interview checklist is A4, walkdowns (whichincluded in each system look for spatial andnotebook. Based on the environmental hazards)Gap #27 results of the system have been performed, See response to Gapwalkdown, summarize in the SYB8 although up-to-date #24.system write-up any possible walkdownspatial dependencies or documentation is notenvironmental hazards that included with eachmay impact multiple systems system notebook.or redundant components inthe same system.Open. The impact ofadverse environmentalconditions on SSCreliability is consideredbut is not always No impact to thisdocumented. However, Nopimatto ThisDocument a consideration of there is no evidence of application. This is adocumentation issueGap #28 potential SSC failures due to SY-B14 a technical problem only. No technicaladverse environmental (SY-B15) associated with issues wereconditions. components that may identified for thisbe required to operatein conditions beyond gap.their environmentalqualification, just aneed to improve thedocumentation.No impact to thisEnhance system model application. This is adocumentation to comply with Open. This SR pertains documentation issueGap #29 all ASME PRA Standard SY-C2 to the systems analysis only. No technicalrequirementst documentation. issues wereidentified for thisgap.Attachment Page 16 C) In this risk-informed submittal, the licensee makes use of a selfassessment that should only be used if it builds off of an independent fullscope peer review. To use this self assessment, the license would needto describe and provide the results of (and disposition of) any findingsfrom the full scope peer review. Furthermore, if there has been a PRAupgrade (as defined in the NRC-endorsed ASME/ANS-RA-Sa-2009)since the latest full scope peer review, a focused scope peer review ofthe upgraded areas would be needed. Please provide informationregarding any full-scope independent peer review findings anddispositions relevant to this LAR. Also, if there have been any upgradesto the PRA since the last full scope independent peer review, pleasedescribe the upgrades and provide information on the associated focusedscope peer review, including findings and dispositions relevant to thisLAR.Duke Energy Response:c) As described in the response to part a) above, the Catawba PRAinitially received an internal events full scope peer review by anindustry team of knowledgeable PRA practitioners in March 2002.Based on the PRA peer review report, the Catawba PRA received noFact and Observations (F&O) with the significance level of "A" and32 F&O with the significance level of "B". The "B" findings werereviewed and prioritized for incorporation into the PRA. Theircurrent status is summarized on the following pages.In 2005, the Catawba PRA was updated and included an upgrade tothe LERF model. A focused-scoped peer review was not performedfor this LERF model; however, for this application, LERF is not asignificant contributor (- 1E-08) to risk.Attachment Page 17 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team StatusAlthough [procedure] states that a review of plant systems wasperformed to search for support initiators, documentation of thereview was not located. Each system notebook includes a sectionindicating whether or not it was determined that loss of that systemleads to an initiating event.However, there was no discussion in [procedure] or the systemIE-3 notebooks to indicate that the process followed was sufficiently CLOSEDstructured to capture potential initiators across various systemalignments and support system alignments, and to consider initiatingevent precursors.Document the disposition of consideration of loss of each supportsystem, and loss of other systems when in alternate alignments, ifappropriate, as a potential initiating event.The initiating event frequency for a stuck open PORV or safety valveis taken from NUREG/CR-5750 but is conservative for the followingreasons. The NUREG assigned a value to these events based on anon-informative prior updated with 0 events and the total number ofcritical reactor years in the study.IE-4 In the case of a spurious opening of a primary safety valve, the model CLOSEDshould address the potential for the valve to close as the pressuredecreased, effectively terminating the loss of coolant. The evaluationof the subsequent reclosure of the PORV is not as straightforward.The cause of the opening PORV would need to be addressed.However, either the PORV could be closed or the block valve could beclosed.Attachment Page 18 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team StatusThe Loss of HVAC initiator was removed, because operators may shutdown the plant from remote locations (the Auxiliary Shutdown Paneland the SSF) if the Control Room is incapable of maintaininginventory control. This is an inadequate reason to omit an IE. If loss OPENof HVAC causes a plant trip and requires SSD from the ASP, thatsequence should be identified and modeled. Note that the switchgear Loss of HVAC is not expected to be a significant contributor to coreIE-6 room may also be affected by failed HVAC. A particular example is damage. However, since documentation providing justification for thisthe possibility that the switchgear chiller is working, in which case the position cannot be located, it needs to be redeveloped. This is thereforeoperators may not diagnose the situation in time. considered to be a documentation issue with no direct impact on thisapplication.Perform and document additional evaluation of the impact of loss ofswitchgear room HVAC and, if appropriate, develop a new event treeto analyze loss of switchgear room cooling.The estimation of the frequency of the loss service water (RN) isincorrect in the application of common cause factors. A "missiontime" of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is used to describe the failure of all four pumps inthe calculation of a yearly frequency. The equation used is basically:Lambda*72 hours
- Beta
- Gamma
- Delta. OPENNote that Lambda*72 hours is the frequency of a pump failing to runfor 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The CCF factors are dimensionless and represent the The Catawba analysis uses an exposure time based on an estimatedIE-8 failure of the other three pumps. mean time to repair. While other approaches are possible, there is notcurrently a consensus among the industry on recommended exposureThe equation above calculates the frequency times for common-cause failure events associated with initiators.period. The "mission time" must be consistent with the frequencybeing calculated. That is, one would expect the frequency for an 18month period (a refueling cycle) to be 1.5 times the frequency for ayear. The current equation would provide the same frequency for ayear, a refueling cycle, or the life of the plant. Ignoring a plantavailability factor, the annual frequency is given by:Attachment Page 19
!F&O Observations and Recommendations by Peer Review Team StatusSummary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team I StatusLambda*8760 hours
- Beta
- Gamma
- Delta.Given the set of MGL parameters, the current equation underestimatesthe frequency by a factor of 365/3 -122.One upper bound is provided by NUREG/CR-5750, which estimatesthe frequency at about 1 E-3 per critical operating year. This value isbased on individual unit critical years, and may not be appropriate forcases where the failure is a station failure, not a single unit failure. Analternative approach is to develop, via NUREG/CR-4780 techniques,more realistic MGL parameters that deal with loss of a system as aninitiating event not as a design basis function.Note the discussion does not question the MGL parameters. The pointbeing made is the use of the parameters in calculating the frequency.One upper bound is provided by NUREG/CR-5750, which estimatesthe frequency at about 1 E-3 per critical operating year. This value isbased on individual unit critical years, and may not be appropriate forcases where the failure is a station failure, not a single unit failure. Analternative approach is to develop, via NUREG/CR-4780 techniques,more realistic MGL parameters that deal with loss of a system as aninitiating event not as a design basis function.[Duke calc.] SAAG 427 describes the ATWS event tree analysis.Section 4, event B, describes how main feedwater is recovered after anATWS. The probabilities used for main feedwater recovery are .05,AS-1 following a T2 (Loss of Load) and .2 following a T4 (Loss of MFW). CLOSEDIn the non-ATWS analysis, the following non-recoveries (From SAAG427) are:T1 non-rec = .05 T4 -non-rec .1Attachment Page 20 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team StatusConsidering that the critical time for FW to come on line in an ATWSevent involving a loss of main feedwater is very short, even forconditions of favorable MTC, the use of non-recovery probabilities ofthis magnitude does not appear to be justified without supportinganalyses.Remove recovery for MFW in ATWS events initiated by a loss offeedwater.There were several observations on the modeling of event D3 in theSGTR tree:Event D3 is generally defined as the event to cooldown to RHRconditions using 2/3 SG for depressurization. D3 includes the HEPYAGRCOLDHE, which is directed by [procedures].1. D3 is defined as "primary system cooldown via secondary systemdepressurization". Primary system depressurization must beaccomplished in some sequences (YDlD2D3, YOD3, YUOD3), byeither PORV, aux spray, or main spray. These functions are notAS-4 included in D3. CLOSED2. Sequence YUOD3 needs a T/H justification that D3 can actuallyprevent core damage in this circumstance. This sequence has noinjection and no SG isolation. This is "core cooling recovery" with anunisolated SGTR. ECA3 specifies cool down at less than 100F/hr. Thecore cannot be maintained covered for the amount of time it takes tocooldown to RHR conditions at 1 OOF/hr. Suggested resolution is touse a separate function for this heading, using an operator actiondirected by [procedure] and without RCP operating.Attachment Page 21 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O] Observations and Recommendations by Peer Review Team jSau3. Sequence YUD1QD3. comment #2 applies to this sequence as well.This is a stuck open relief PORV with no injection.1. Add functions to D3 for primary system depressurization.2. Find specific procedure for D3 given the multiple uses insequences.3. Add a new operator action for D3 if in some sequences, the operatoraction will be called by a different procedure and then [procedures].The success criteria for AFW for SGTR is 1 CA pump to 2 steamgenerators. The ruptured SG is assumed to be one of the two steamgenerators that supply steam to the turbine-driven AFW pump. In theCatawba Rev. 2b fault tree model, however, the dependency of theTDP on the SGTR initiator is not modeled. Thus, the TDP supply isAS-7 not degraded by the initiating event in the model logic, so the model is CLOSEDincorrect.Correct the SGTR AFW pump logic in the Catawba Rev 3 update asplanned. Check that initiating event impact logic is also correct insequences for other events (e.g., T6 -SLBI).Success Criteria (Level 1 and Level 2) for some systems andsequences are supported by MAAP runs with MAAP 3b, Version 16.This version of MAAP has been found to have limitations which canimpact conclusions and results. In particular for the Catawba PRA, theTH-1 simple pressurizer model likely impacts the analyses that involve RCS The success criteria are in general agreement with those used at similarcooldown and depressurization using SG heat removal by permitting plants. Few changes are expected and the overall impact is expected toRCS depressurization to match RCS cooldown for transients, without be small.the possible need for pressurizer PORVs, spray or aux spray.Consideration should be given to re-running selected analyses with aAttachment Page 22 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team Statuslater version of MAAP code that has an enhanced pressurizer model todetermine extent of impact. Duke PRA personnel indicated that theyare currently developing a MAAP 4.0 model, which would be suitablefor this purpose and for future analyses supporting the PRA.Success Criteria analyses were not done for the range of possible plantconditions to which they are applied. For example, MLOCA successcriteria analyses are done for a 3.5 inch break, while the MLOCA isdefined as a 2 to 5 inch break. The combinations of systems andoperator recoveries that are defined as success at 3.5 inches may notbe success at 2 inches or at 5 inches. This issue also applies to largeLOCA (8.25 ft2 break analyzed) vs. a break range down to 6 inches,and small LOCA (1 inch break analyzed) vs. break sizes from' 3/8 to 2inches.Further, it was not clear that the MLOCA MAAP runs adequatelymatch the accident sequence being modeled in the PRA. Cases in OPENTH-3 [procedure] do not appear to disable accumulators when defining theminimum ECC requirements, but accumulators are not required by the No problems with the appropriateness of the success criteria have beenresulting MLOCA success criteria, identified. There are no impacts to this application.Also, MAAP is not an appropriate code to use in performing analysesfor rapid blowdown events such as large and some medium LOCAs.One possible approach would be to perform success criteria analysesfor a range of possible conditions, including the limiting break sizes.Check the MLOCA analyses to determine whether the accumulatorinjection makes a significant difference in the results and conclusions.Also, a code other than MAAP should be used if success criteriadealing with the blowdown phases of large and medium LOCAs arebeing defined.TH-5 The HEP worksheets do not clearly refer to success criteria analyses to OPEN_ _ support timing for operator actions. Although most worksheetsAttachment Page 23 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team Statusinclude an estimate of the time available for completion of an action, This F&O is considered to be a documentation issue.and some refer generally to information from MAAP analyses,specific references to MAAP (or other analysis) cases are not The current Catawba model of record used the HRA methodologyprovided, developed by SAROS. Beginning with the 2011 Oconee PRA update,Duke now uses the HRA calculator method. Based upon the OconeeReview success criteria analyses to determine whether they adequately update results using HRA calculator, the current Catawba HRA resultsreflect modeled scenarios, including expected operator actions. using SAROS are considered to be conservative and therefore bounding.Thus, this is considered to be a documentation issue only with no impacton this application.There is no room heatup analysis notebook / evaluation of loss ofHVAC to equipment rooms for the Catawba PRA, and apparently no OPENretrievable room heatup calculations or documentation to support theassumption that room cooling need not be modeled in the PRA. Other Loss of UVAC is not expected to lead to core damage. However,PRAs have found that room cooling is required for some rooms such documentation that justifies this position needs to be developed.as electrical equipment rooms and small rooms housing critical pumps.Incidentally, this F&O is under evaluation as part of the in-progressTH-6 Perform an evaluation, with equipment room-specific calculations, if McGuire PRA model update. A similar analysis for room heat-up atpossible, of the potential for, and magnitude of the room heatup for Oconee concluded that a loss of HVAC will not result in equipmentrooms housing electrical equipment, pumps, and other key equipment failures. Engineering judgment is that any potential impact fromcredited in the PRA. Document the basis for any determinations that HVAC failures at McGuire would be small. Given the similarity ofequipment will survive the anticipated room heatups, and model loss plantudes a t McGuire and.Caawba thislite isof room cooling as a failure mode in the system fault trees (with plant design and layout between McGuire and Catawba, this item isrecoveries as appropriate) for equipment that may not survive the expected to have little or no impact on Catawba as well.anticipated heatup for the PRA mission time.System success criteria are specified in the system notebooks insufficient detail to describe the overall fault tree top events, but nobasis is provided in the system notebooks for the number of pumps or CLOSEDflow rate requirements. The Reference section 18.1 does not contain alink to an appropriate success criteria calculation. For example, in theKC notebook, it is stated without a source reference that both pumpsAttachment Page 24 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O I Observations and Recommendations by Peer Review Team Statusand the associated heat exchanger in a train are required for successwhen the ND (RHR) heat exchanger is required. Similarly, in Section12 of the RN notebook, it is stated that the top events simply represent"failure to provide sufficient flow" to components requiring coolingwithout defining a flow rate or number of pumps (in Section 13 of thenotebook it does state that failure to provide flow requires failure ofall four pump trains). The CA (AFW) notebook has a similarstatement without a tie to a specific basis.A reference should be provided in Section 12 of the system notebooksfor each of the stated top event success criteria. The reference couldbe to a design basis analysis, or to a specific MAAP calculation orsome similar best-estimate analysis method. Section 12 in the NISystem Notebook file CR3NI.doc provided for the reviewers containsreferences to specific MAAP runs that serve as the basis for successcriteria, and can be used as an example.In the Component Cooling System Notebook, there is no basisprovided in Section 11.3 for excluding the failure to isolate the Non-Essential Reactor Building Header from the fault trees. In discussionwith the PRA engineer responsible for the notebook update, it wasdetermined that three valves need to fail to close for flow diversion to CLOSEDtake place, but there could be a common cause failure of these valvesthat was not justified to be excluded.Justify excluding this potential diversion flowpath in the systemnotebook or include it in the fault tree.For Catawba, there was no evaluation of the ability of non-qualified OPENSY-6 (non-EQ) equipment to survive in a degraded environment followingan accident such as a steam line of feedwater line break outside of Primarily a documentation issue. (Peer Review F&O L2-2. Level ofcontainment. Significance = C on VX fans is a specific example of another questionAttachment Page 25 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team Statuson survivability of equipment in degraded environment.)Perform an evaluation of potential adverse effects on equipmentoperation due to degraded environmental conditions resulting fromaccidents in the PRA model.Workplace Procedure is the primary data gathering procedure. It issupplemented by [procedure], Catawba PRA Revision 3 Failure RateAnd Maintenance Unavailability Data, and [procedure], the CCFanalysis report. Also, noteworthy is attachment 3, which includes theCCF checklist. Additional details are provided by Rev. 2b SummaryReport and the Rev 2 Summary Report.The data guidance is generally adequate; however it does not address OPENcomponent boundaries. Component boundaries are apparent from thedata as in the specific example in F&O DA-02, i.e., the incoming This F&O is considered to be a documentation issue.breaker and panelboard BLF. However, these should be defined inthe guidance. The industry documents used to generate the Catawba PRA database(such as NUREG/CR-6928) define the component boundaries.Consider revising guidance documents to address the treatment ofcomponent boundaries. Possible guidance sources for this include:NUREG-5497, Common Cause Failure Parameter EstimatesEPRI TR-100382, A Database of Common-Cause Events for Risk andReliability ApplicationsNUREG/CR 5500, Reliability Study: Emergency Diesel GeneratorPower Systems 1987-1993Some of the generic data from SAROS is quite dated, including OPENWASH-1400, NUREG/CR-2815, Zion PRA, and NUREG/CR-4550.DA-2 More recent generic data should be pursued. Use of more recent equipment operating experience data is desirable.Component failures should be defined such that they encompass only However, the current generic data is deemed to provide adequatethose failures that would disable the component over the PRA mission estimates of generic equipment failure rates. In addition, these failuretime. It appears that this has not been considered. Specific examples rates are Bayesian-updated with plant-specific data.Attachment Page 26 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team I Statusof less than adequate reliability data characterization were identifiedthrough review of Tables 1 and 3 in [procedure], Catawba PRA Rev. 3Failure Rate and Maintenance Unavailability Data. First, repeatevents in a short duration, where there was insufficient componentrepair should be counted as one event. An example is PIP nos. 2-C97-2481 and 2-C97-2637 on 7/29/97 and 8/12/97 for incoming breaker2CXI-5C. The first failure occurred "for no apparent reason", but thesecond failure was attributed to a failed relay. The first event shouldbe omitted as a component failure as the component was left in thedegraded condition. Second, component degradation that results infailure to meet normal criteria (e.g., to avoid component lifedegradation), may not impact the component mission for the PRA.For example, PIP no. 0-C98-2057 involved a 6/7/98 event for troublealarms for VI compressor F, and the compressor motor was foundsmoking. The evaluation addressed concern with overheating andinsulation breakdown, but did not address whether ran to failurewould survive PRA mission. Similar pump failures due to routinevibration testing exceeding limits were found (LPR 2B & IA, WO93020502 & PIP 1-C93-1124).More recent generic data sources should be pursued. Reliability datacharacterization should include evaluation of the applicability ofindividual component failures to the PRA model.The unavailabilities computed for the basic events for PORV blockvalve closure, RNC031BDEX, 033ADEX, and 035BDEX, assume thateach PORV is closed one week per quarter. However, there is noDA-5 history of PORV closures for any extended period of time in the last CLOSEDfew years.While this does use plant-specific data, the benefit derived from it islimited due to the highly conservative assumption regarding PORVAttachment Page 27 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team Statusout of service time.As the data is updated, it should be reviewed for excess conservatismsand revised to be more realistic.In [procedure], there is development of a failure probability for therupture of an MOV. The type code for this event is MVR. This typecode is used in the calculation of the ISLOCA frequency. In theDA-6 SAROS database, this distribution is composed of three equally CLOSEDweighted distributions. The three distributions have error factors ofclose to 10.0. The error factor assigned to MVR is -2.6. This isimpossible -the error factor should be close to ten.Another example of conservatism is the SBO following trip event,PACBOFTDEX. This event in the top 100 cutsets, has a 1 E-3DA-8 probability, and has not been updated since the IPE. CLOSEDReview the dominant sequences for conservative values and updatethem.A screening value of 3E-3 was initially used for all pre-initiator HEPs. OPENThere were 7 HEPs quantified in more detail, because the HEPimportance was too high. However, there were 7 Latent Human Error This observation does not necessarily have a large impact on the PRAHR-2 events with a 3E-3 probability in the top 100 importance events in the results. However, per the HR subtier criteria (HLR-HR-D & HR-D2),CR2b quantification. screening HEPs should not be used for actions appearing in significantcontributors.Provide more detailed quantification of more pre-initiator HEPs.The operating staff at the plant had some input to the HRA in thebeginning, but it is not obvious a thorough review of the dominant OPENHR-4 operator actions by the plant staff had been done, nor was it obviousthere had been any feedback of their comments into the analysis. This F&O is considered to be a documentation issue. See the responseThe level of detail and relation to the operating procedures is sparse. to F&O TH-5 above.In some instances, the procedural steps are not mentioned. In someAttachment Page 28 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team Statusplaces, the reference to the procedure is incorrect.Get operating staff more involved in the HRA.In the Catawba HRA notebook for PRA Rev 2b (and similarly in theMcGuire Rev 3 HRA notebook), the documentation of the bases forthe HEPs is not sufficiently specified to assure that the analysis isreproducible. Specifically, the sequence context (e.g., previousfailures in the event sequence, concurrent activities, environmentalfactors, etc.) and procedural steps applicable to each HEP are notconsistently provided. Thus, even though there is evidence that theHEP worksheet information is being reviewed by plant Operationspersonnel, it is not clear that they would have sufficient supportinginformation with which to make an effective assessment of the HRA. OPENSimilarly, the timing, PSF, stress level, and all other contributingHR-5 factors to the HEP were printed, but the basis was not provided. It This F&O is considered to be a documentation issue. See the responsewould not have been possible for another analyst to determine thesame factors and derive the same number. to F&O TH-5 above.The lack of such information in the documentation of the HRA limitsthe ability to verify and reproduce the results, and to determine theirapplicability in specific scenarios.Enhance the HRA documentation to address the above items. Considerdeveloping, for each important HEP, a timeline showing all importantcues and events. Reference specific steps in each procedure for eachaction, and estimate the time at which the step would be reachedduring an accident.Inconsistency among timing for similar HEPs. OPEN1R-9 There are four important times for HCR calculations:T(avail) -total time available for an action to be completed from the Primarily a documentation and consistency issue; not expected tofirst event which starts the demand for the action. significantly impact risk results. See the response to F&O TH-5 above.Attachment Page 29 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O IObservations and Recommendations by Peer Review Team I StatusT(execute) -amount of time needed to execute the actions afterdiagnosisT(1/2) -the median amount of time needed to diagnose and initiate anaction.T(window) -the time window for diagnosis T(w) = T(a) -T(e).The HCR forms used for Catawba only have an entry form forT(window) and T(1/2).The timing for the following important events is shown below;EVENT HYDBACKDHE NNVSSFADHENNVSSFBDHE TRECIRCDHE TFBLD01DHET(avail)40 45 30 18 20T(exec) 15 2 7 0 0T(window) 25 43 23 18 20T(1/2) 3 5 2 3 5 TO 10EVENT NDORWSTDHE KKCSTNDDHEPOPXC02DHE POPXCONDHET(avail) 18 10 90 90T(exec) 0 0 0 0T(window) 18 10 90 90T(1/2) 5 3 30 30The following observations are made:1) In order to be useful to prevent seal LOCA, POPXCOiDHEmust be connected by 30 minutes. If the T1/2 is 30min, there is nochance for success. There must be some execution time for this action,which means there is insufficient time for this action.2) NNVSSFBDHE should be done in 15 minutes to be consistentwith the WOG ERG guidelines about restoration of seal cooling.Attachment Page 30 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team I Status3) NNVSSFBDHE and NNVSSFADHE should have the same T(1/2), because they are similar actions with similar facilities, justunder different conditions.4) TRECIRCDHE and NDORWSTDHE are essentially the sameevent. They should have the same t(1/2). If TRECIRCDHE uses 5minutes, the HCR jumps to .014.Define the four time parameters for all HEPsDocument the basis for all four times for each HEPMake similar HEPs consistent with each other.Requantify HEP with new time data.No specific guidance is given regarding modeling of systemdependencies in the system notebooks; however, a highlyknowledgeable analyst could reproduce the given results. Adependency matrix is provided but contains little detailed explanationof how dependencies were determined. OPENDE-1 The Internal Flood Analysis does not seem to provide the detail This is a documentation issue which has been addressed in a revision torequired to reproduce the results except by a highly knowledgeable a workplace procedure. Note that the F&O states that a knowledgeableanalyst. analyst could reproduce the results.Consider providing guidance for treatment of dependencies, includingtypes of dependencies treated in the model, approaches used to modeldependencies, and important considerations regarding howdependencies may affect the model and results.HVAC cooling of the essential switchgear rooms is stated as being OPENrequired. The IPE quantitative analysis does not provide adequateDE-4 success criteria. For example, the following are not specified: Loss of HVAC is not expected to lead to core damage. However,temperature limits of equipment, minimum number of Air Handling documentation that justifies this position needs to be developed.Units, or minimum number of chillers. The evaluation also statesAttachment Page 31 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O IObservations and Recommendations by Peer Review Team I Statusthere is no concern within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> provided that only those loadsneeded to provide core cooling are operated. There is no discussion ofelectrical load shedding for those loads not required, and of the humaninterface to execute load shedding. The human interface can becomplex, involving both a discovery process (control roomannunciators, or in the case of a local AHU failure, discovery throughoperator walkaround), and procedures and training to direct operationactions.A conservative estimate of essential switchgear room HVAC coolingfailures could be pursued to establish the system importance.However, if moderate importance is observed, more detailed heatupcalculations, recovery actions, and equipment models would bedesirable for a realistic system model.DE-6The PRA flooding analysis builds on a plant calculation thatdetermines flood levels in the plant. That calculation only determinesflood levels; it does not address the effects of water on equipment.The effects of spray and the effects of water on electrical equipmentare not addressed. Further, it is not evident that flood propagationimpacts were addressed, nor that probabilistic failure of flood barriers(e.g., doors) was considered.Obtain the site calculation relating to spray effects and use that todevelop information for incorporation in the PRA.Consider flood propagation impacts, and treat flood barrier failureprobabilistically.OPENSpray effects and flood propagation past flood barriers are not expectedto be significant interactions. This is a more of a completeness /documentation issue.The truncation limit of the baseline CDF at 1 E-9 is not low enough toQU-1 defend convergence toward a stable result. This is shown on page 12 CLOSEDof [procedure]. Use of the lE-9 truncation limit yields 4485 cutsets,while the 1 E-10 truncation limit yields 31512 cutsets. Thus, althoughAttachment Page 32 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team Statusthe PRA runs using 1E-9 are capturing about 85% of the CDFpredicted with a cutoff of 1E-10, they are capturing only 13% of thecutsets using the 1 E-10 truncation limit.The Duke PRA staff uses a high performance quantifier, FORTE.Quantification speed should not be a significant challenge. Oneoption to improve post-processing speed is to recode the recoveryrules and deleted events as a fault tree. Other options (e.g., sensitivitystudies at lower cutoffs to confirm the acceptability of the 1E-9 cutofffor particular applications) may also be appropriate.The IE's for certain support system failures (RN, KC) are not input inthe top event logic as a Boolean equation, but rather as a pointestimate whose value is derived by solution of the IE fault tree.However, failures that cause the IE may also affect the mitigating OPENsystem, such that there is a dependency between the initiating eventQU-2 and the available mitigation. Examples are an electrical bus that failed Modeling initiators with logic instead of point estimates wouldone train of KC and could fail one train of mitigating equipment.Another example is the operator error in the loss of KC to start the improve the accuracy of the model, although it is not expected tostandby train of KC (KKCSTNBDHE). The HRA notebook states this significantly alter the results or conclusions of the analyses.event has dependencies with HYDBACKDHE.One way to resolve this is to Input the IE as a Boolean equation.More guidance or creation of a procedure is needed to address thequantification steps. For example, there is no desktop guide orprocedure as there is for developing system fault trees.QU-4 Develop quantification guidance for PSA analysts. This should CLOSEDinclude information on the quantification codes and the runparameters. Standards for quantification commensurate with theapplication type should be included.Attachment Page 33 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team StatusEvent NDORWSTDHE: This is a recovery action to terminate the NVand NI pumps in the event of failure of ND to provide recirculationafter a SL. The event was quantified on the basis of tripping the pumpswithin 18 minutes. RWST refill was assumed to occur (fromundescribed source) and pumps were restarted to continue injection.This recovery event is applied to:a) loss of KC pumpsb) SNSDRNVLHE -drain plug blockagec) CCF of ND pumps.The recovery event is intended to provide injection flow for the longQU-5 term commensurate with the RWST make-up capability. The time of CLOSEDsome of these failure is 20 minutes, when injection requirements arebeyond the make-up capability of the RWST. Secondly, there arecutsets representing heat removal that cannot be recovered bycontinued injection of HHSI. The sequence needs continuous injectionof HHSI and heat removal from containment.Carefully define the purpose of event NDORWSTDHE.Define the RWST make-up capacity and when it is effective.Distinguish heat removal sequences from injection sequences and donot recover injection sequencesRequantify HEP to include failure to provide RWST refill.Documentation of mutually exclusive events is limited to the text file, OPENcr2b rul.txt.QU-8 This is considered to be a documentation issue and can be addressed inThe rule recovery file allows different numbers of max recoveriesmodel integration notebook.___depending on the combinations in question. ____________________________Attachment Page 34 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team StatusThere is no documentation regarding how the max recoveries wereestablished for each set of events. Examples of the content of the fileare DBLMAINT, DELSEQ, and NSHEATEX, which function asrecoveries set to 0.0Note that this applies to recovery events as well as deletedcombinations.Create a basis document for the deleted combinations and includeexamples. Establish a review process for changes to the deletedcombinations. Document the review of the max recoveries.A document containing an overview of the deleted combinations andwhy would make this portion of the model more clear. In addition,these files should be reviewed to ensure quality of the content.The Conditional core damage Probability of several Initiators from theCR2b results were evaluated. The results are:8.30E-03 Loss Of RN8.38E-03 Loss Of KC5.04E-03 Small LOCAQU- 2.30E-04 Secondary Line Break Inside Containment12 5.47E-05 LOOP CLOSED9.54E-06 FDW Line Break Outside Containment2.26E-06 Loss Of Main Feedwater2.89E-06 SGTR7.75E-07 Loss Of Load5.01E-07 Reactor TripThese results show a discrepancy between Small LOCA and SGTRAttachment Page 35 Summary of Catawba WOG Peer Review "B" Fact and ObservationsF&O Observations and Recommendations by Peer Review Team Statusthat is not consistent with what is normally seen in PRAs in theindustry. The CCDP for small LOCA and SGTR are usually in thesame order of magnitude because the initiators have similar mitigationfunctions such as safety injection, secondary side heat removal,primary cooldown and depressurization, and long term injection ifcooldown and depressurization are not successful. A difference of 3orders of magnitude is unusual. Also, the CCDP value for the Loss ofInstrument Air probability is identical to the Inadvertent SS Actuationprobability (to 3 significant figures), which seemed surprising.Review and explain the contributors to inadvertent SI, Loss Instr. Air1.24E-05 Inadvertent SS Actuation1.24E-05 Loss Of Instrument Air1.04E-05 Steamline Break Outside Containment and Tuberupture.Attachment Page 36
- 3. According to the submittal, the seismic analysis of the NSWS components andpiping caused "the seismic [core damage frequency] CDF [to show] only amodest increase using very conservative bounding assumptions ... [due to] asensitivity study [that] was performed to conservatively bound the impact ofhaving a NSWS discharge line unavailable during a seismic event." Pleaseprovide a description of the change in seismic analysis and the resulting seismicCDF and [large early release frequency] LERF for this application.Duke Energy Response:As indicated in Duke Energy's November 22, 2011 submittal, the current Catawbaseismic PRA model of record was last updated as part of Revision 3 of theCatawba PRA model. The current methodology used is the same as thatdescribed in detail in the IPE submittal and Section 3 of the IPEEE submittal, bothof which have been previously reviewed by the NRC. The reader is referred tothose references for additional details of the seismic analysis.The current seismic PRA contains the technical elements given in Section 1.2.6 ofRG 1.200, Rev. 2 as part of its current methodology. The plant-specific seismicPRA analysis consists of four steps, each of which is described below:1. The Catawba site was evaluated to obtain the seismic hazard in terms of thefrequency of occurrence of ground motions of various magnitudes. The site-specific hazard analysis was performed using the Seismicity Owners Group(SOG) methodology developed by EPRI for seismic hazard analysis of nuclearpower plant sites in the Central and Eastern United States (CEUS) and isdocumented in EPRI document RP101-53. Uncertainties were addressed inthe hazard analysis. Furthermore, Duke Energy has been actively followingdevelopments related to GI-199. In 2008, Risk Engineering Inc. performedpreliminary comparisons of the EPRI-2008 seismic hazards and EPRI-1989seismic hazards for the Duke plants. Their results indicated no significantimpact to Catawba.2. From the site-specific seismic hazard curve, the capacities of important plantstructures and equipment to withstand seismic events were evaluated todetermine conditional probabilities of failure as a function of groundacceleration for significant contributors (i.e., SSCs). These are commonlyreferred to as 'fragilities' or the site-specific fragility curves. Plant walkdownswere conducted, the most recent ones consistent with the guidelines of EPRINP-6041.3. An event tree was developed along with supporting top logic and system faulttrees to reflect plant response to seismic events. These modified logic modelswere then solved to obtain Boolean expressions for the seismic eventsequences of interest.4. The Boolean expressions were quantified by convolving the probabilistic siteseismicity and the fragilities for the plant structures and equipment obtainedin steps I and 2. The resulting sequence frequencies were then integratedAttachment Page 37 into the overall Catawba PRA risk results, resulting in final quantitativeresults.Since the IPEEE submittal, changes have been made to the seismic model suchas:* A comprehensive review and revision of the seismic analysis documentationwrite-up* The addition of component/structure fragility information to support valuesused in analysis* Updated Human Reliability Analysis (HRA) data* Updated common cause data* Editorial and logic changes to the fault tree* Updated quantitative results tableThe impact of this LAR on the seismic CDF was also reviewed. Per the Catawbaseismic PRA documentation, components with median seismic capacities inexcess of 2g were screened out of the seismic fault tree models due to their lowprobability of failure. Likewise, structures were eliminated from considerationwhen their seismic capacities were in excess of 2.5g. Among those componentsand structures screened out were the Standby Nuclear Service Water Pond Dam,the NSWS pumps, and all qualified piping and valves. Therefore, the NSWScomponents and piping are considered to be seismically-rugged and thus do notimpact this analysis.However, since the NSWS components and structures were screened out of themodel, a sensitivity study was performed to conservatively bound the impact ofhaving an NSWS discharge line unavailable during a seismic event. Using thecurrent Catawba analysis, the following safety system trains were consideredunavailable (i.e., set to '1') in the seismic cut sets:* Auxiliary Feedwater Motor-Driven Pump 'B' (CA MDP 'B')* Safety Injection Train 'B' (NI 'B')" Emergency Diesel Generator 'B' (D/G 'B')* Component Cooling Train 'B' (KC 'B')* Residual Heat Removal Train 'B' (ND 'B')The standby trains of these systems were made available (i.e., set to '0') in theseismic cut sets.The cut sets were then processed using Duke Energy's seismic analysis code('SEISM') to calculate a new seismic CDF of 1.35E-05/yr. With a current baselineCatawba seismic CDF of 1.14E-05/yr, this represents an increase of 2.1E-06/vr(which equates to 8.1 E-08 per 14-day period). The current Catawba seismic modeldoes not include LERF; however, based on the most recent seismic LERFanalysis performed for the Oconee station, it is expected to be about one order ofAttachment Page 38 magnitude less than the CDF. Again, this is a conservative bounding value sinceboth trains of each safety system would normally be available while an NSWSdischarge line is out of service. It is expected that the actual seismic CDF wouldbe smaller than this value. In addition, there were no new failure modesintroduced and consideration of the seismic impact is thus not a factor for thisassessment.In accordance with the discussion in this section and the results of theconservative bounding analysis above, Duke Energy considers inclusion of theseismic results as insignificant to the overall results and is not considered to be apotentially significant hazard. It is judged that the analyses assessing theinfluence of seismic events provide an acceptable evaluation of the contributionof the seismic risk for the requested Completion Time of 14 days.4. Please provide a description of the internal fire PRA analysis and resultingchange in internal fire CDF and LERF for this application.Duke Energy Response:The current Catawba fire PRA model analysis and methodology used in the modelof record is the same analysis and methodology as described in the IPEsubmittal; Section 4 and Appendix B of the IPEEE submittal; and as discussed inthe Supplemental IPEEE Fire Analysis Report, all of which have already beenreviewed by the NRC.The plant-specific fire PRA analysis consists of four steps, each of which isdescribed below:1. The Catawba site and plant areas were analyzed to determine critical fire areasand possible scenarios for the possibility of a fire causing one or more of apredetermined set of initiating events. Screening criteria were defined forthose fire areas excluded from the fire analysis.2. If there was a potential for an initiating event to be caused by a fire in an area,then the area was analyzed for the possibility of a fire causing other eventswhich would impact the ability to shutdown the plant. These were identifiedby reviewing the impact on the internal event analysis models.3. Each area was examined with an event tree fire model to quantify fire damageprobabilities. The event tree related fire initiation, detection suppression, andpropagation probabilities to equipment damage states.4. Fire sequences were derived and quantified based on the fire damageprobabilities and the additional failures necessary for a sequence to lead to acore melt. The additional failures were quantified by the models used in theinternal events analysis.The major changes to the current fire analysis that have been made since theIPEEE submittal deal with implementation of changes from the SupplementalAttachment Page 39 IPEEE Fire Analysis Report and revised base case fire initiating eventfrequencies.Since the Catawba fire PRA model is integrated into the overall PRA model,quantitative fire risk insights can be obtained for the LAR. The cut sets generatedfor the analysis presented in Question I above were reviewed to determine thecontribution level of the fire initiating events. Internal fire events contributedapproximately 10% of the CDF and 3% of the LERF. Whereas fire-induced loss ofNSWS events are included in the PRA model, they did not appear in any coredamage or large early release sequences (above the respective truncation limits).Furthermore, in comparing the delta risk cut sets created in support of the LARanalysis (i.e., those cut sets whose values showed an increase in the LARconfiguration when compared to their values in the 'base case' configuration), nointernal fire sequences of any type appeared in the core damage and large earlyrelease results. Therefore, the contribution from fire events for the LARconfiguration impacting the NSWS is deemed negligible.Finally, from a deterministic standpoint, consider that the NSWS essential headerdischarge valves and the discharge valve to the Standby Nuclear Service WaterPond (SNSWP) will remain open during the requested 14-day Completion Timewith power removed. Therefore, fire events affecting power to these valvescannot cause their spurious operation and thus would have no effect on theNSWS discharge alignment during the Completion Time.Given the negligible influence of fires on the NSWS for the LAR configuration,fires are not considered to be a potentially significant hazard. It is judged that theanalyses assessing the influence of internal fire events provide an acceptableevaluation of the contribution of the fire risk for the requested Completion Time of14 days.5. Please provide a description of the internal/external floods PRA analysis andresulting change in internal flooding CDF and LERF for this application.Duke Energy Response:Flooding events at Catawba have been assessed via the IPE process and arenoted in Sections 3.3.5 and 3.4 of the IPE submittal. Internal flooding events areprimarily caused by plant piping ruptures while external floods are mostly causedby very heavy precipitation events. The external events portion is recreated inSection 5.2 of the IPEEE report. As mentioned above, the IPE and IPEEEsubmittals have already been reviewed by the NRC.Per the Design Basis Document for external flooding, flood levels for the sitewere analyzed for the following flood producing phenomena:1. Probable Maximum Flood (PMF) resulting from the Probable MaximumPrecipitation (PMP) positioned appropriately over the Catawba River Basin.Attachment Page 40
- 2. Probable Maximum Flood (PMF) resulting from the Probable MaximumPrecipitation (PMP) positioned appropriately over the tributary area of theSNSWP.3. Standard Project Flood (SPF) passing through Lake Wylie (positioned overeach Catawba River basin drainage area) combined with the failure of one ofthe upstream dams because of an Operating Basis Earthquake (OBE). TheSPF is considered equal to one-half of the PMF.4. Surge and seiche effects caused by probable maximum hurricane.5. Coincident wave runup due to a 40 mph wind.6. Local intense precipitation (PMP) occurring over the immediate project site.In the IPEEE report, it was concluded that the contribution to plant risk fromexternal flooding would be insignificant compared to the risk from internalflooding.The plant-specific Catawba internal flooding analysis was performed in six steps:1. Identification of the critical flood areas2. Calculation of flood rates3. Development of flood probabilities4. Identification of critical flood levels5. Assessment of human response for flood isolation6. Development and quantification of the flood core damage cut setsThe major change made to the current internal flood analysis since the IPE andIPEEE submittals deals with the installation of concrete flood walls in the TurbineBuilding basement to protect essential 4160V ac switchgear against largeflooding events. As a result, flooding initiator probabilities which would result ineither a reactor trip or a loss of the transformers have been significantly reduced.As with the fire analysis, the Catawba internal flooding PRA model is integratedinto the overall PRA model; therefore, quantitative flood risk insights can beobtained for the LAR. The cut sets generated in the response to Question 1 abovewere reviewed to determine the contribution level of the flooding initiating events.Internal flooding events comprise approximately 2% of the CDF and less than 1%of the LERF. The majority of this contribution comes from a flooding event in theAuxiliary Building which results in a loss of the Auxiliary Shutdown Panel.As indicated previously, the NSWS discharge piping associated with this LARresides in the Auxiliary Building; thus, it could be postulated that this area couldbe more susceptible to flooding risk during the Completion Time. Duke EnergyNuclear System Directives require the station to give consideration to plantconfigurations which could potentially cause internal flood hazards resulting in afailure of risk significant structures, systems, and components. Furthermore, themanual and motor operated valves installed in this portion of the NSWS areAttachment Page 41 Fisher Posi-Seal butterfly valves. When these valves are closed, there is not acredible failure that would cause them to change position or catastrophicallycome apart. In the closed position, the operator gearbox will hold the valve discstill. The gearbox operators are manufactured by Limitorque and have lockinggear sets that will not move even during a seismic event. Therefore, exposing theisolated NSWS discharge piping during the 14-day Completion Time is consideredto have a negligible impact on flooding risk in the Auxiliary Building. As asensitivity study, the value for the Auxiliary Building flood initiator in the PRAmodel was increased by its error factor (7.5) from 5.5E-06 to 4.13E-05. As a result,the CDF for the Completion Time configuration increased by only 9.8% and thecorresponding LERF increased by only 2.2%. Thus, the impact on internalflooding is considered insignificant.Given the negligible influence of flooding events for the LAR configuration, floodsare not considered to be a potentially significant hazard. It is judged that theanalyses assessing the influence of these events provide an acceptableevaluation of the contribution of the flood risk for the requested Completion Timeof 14 days.6. Please provide a description of the tornado/high winds PRA analysis andresulting change in the tornado/high winds CDF and LERF for this application.Duke Energy Response:As with earthquakes, fires, and floods, an assessment for tornados and otherhigh wind events at Catawba has been performed via the IPE process as well aswith the IPEEE process.The plant-specific Catawba tornado/high wind analysis was performed in threesteps:1. Calculation of occurrence frequency2. Tornado missile analysis3. Tornado wind analysisThe major changes to the tornado analysis since the IPE and IPEEE submittalsinclude the following:* enhancements to the diesel generator building modeling* addition of the upper surge tank, condensate storage tank, and portableinstrument air diesel compressor* revised switchyard strike frequencyAs with the fire and flooding analyses, the Catawba tornado PRA model isintegrated into the overall PRA model; therefore, quantitative tornado risk insightscan be obtained for the LAR. The cut sets generated in response to Question 1above were reviewed to determine the contribution level of the tornado initiatingevents. The cut sets generated for the LAR analysis were reviewed to determineAttachment Page 42 the contribution level of the tornado initiating events. Only one event (TornadoCauses a Loss of Offsite Power) contributed to the CDF (- 3%) and the LERF (~4%). Typically, these cut sets include a loss of the diesel generators and eitherAuxiliary Feedwater or the Standby Shutdown Facility. A review of the delta riskcut sets created in support of the LAR analysis found that, while tornado eventswere a significant contributor to the ICCDP, this contribution comes from theincreased tornado frequency value ('seasonal factor') used in the risk assessmentto account for historic increased tornado activity during the months of March,April, and May, rather than from interactions with the NSWS configuration.Furthermore, even though the NSWS provides cooling to the diesel generators aswell as the assured source of Auxiliary Feedwater, functionality of the NSWSfollowing a tornado event is governed by the operability of the diesel generatorsand would not be altered per the configuration found in the 14-day CompletionTime. Therefore, the impact of tornados and high wind events is negligible.Given the negligible influence of tornado and high wind events on the NSWS forthe LAR configuration, they are not considered to be a potentially significanthazard. It is judged that the analyses assessing the influence of these eventsprovide an acceptable evaluation of the contribution of the tornado and high windrisk for the requested Completion Time of 14 days.7. BackgroundThe guidelines of RG 1.177 state that one of the elements of consistency withdefense-in-depth philosophy is maintaining "defenses against potential common-cause failures (CCFs).... " In the proposed new Condition C for TS 3.7.8 onlyone path of NSWS discharge flow to the standby nuclear service water pond(SNSWP) is available when one NSWS header is isolated between 1RPN-19 to1 RN63A or between 1 RPN-20 to 1 RN58B and flow is blocked to Lake Wylie.IssueIf the only operable NSWS discharge header, as described above, had a pipebreak or became blocked or became inoperable, all NSWS cooling could stop.Requesta) Discuss your contingency plans, training, procedures, and compensatorymeasures to restore NSWS and maintain core and spent fuel poolcooling, in the event that this sole return to the SNSWP unexpectedlybreaks/cracks or becomes flow blocked causing a total loss of NSWScooling.Duke Energy Response:If the in service flowpath to the SNSWP were to become blocked or tobecome unavailable for any other reason, the Operator Aid Computer,control room annunciators, and control room indications are all availableAttachment Page 43 to aid the operator in determining if a loss of flowpath were to occur.Procedures will aid the operators in determining the nature of the event,and will direct the operators to realign the NSWS back to Lake Wylie ifappropriate. NSWS valves I RN57A and 1 RN843B are the in-series returnisolations to Lake Wylie. These valves will be closed per procedure whenthe NSWS is aligned in the single discharge header configuration.However, power will not be removed from these valves and they are motor-operated valves that can be repositioned, as directed by procedure, fromthe control room. Operators are trained on existing procedures for plantflooding and loss of the NSWS. Operators will receive additional trainingon the NSWS single discharge header alignment prior to implementation.b) Discuss any other possible CCF and associated contingency plans,training, procedures and compensatory measures or discuss why otherCCF's do not exist.Duke Energy Response:The NSWS alignment for the single discharge header configuration wasdeveloped with PRA guidance. First, the NSWS is aligned to the ultimateheat sink (the SNSWP), which eliminates the possibility of the worst casesingle failure of the NSWS, the loss of one train during a swap from LakeWylie to the SNSWP. Additionally, the return header motor-operatedcrossover valves 1 RN53B and I RN54A are tagged open with powerremoved to ensure a flowpath for the in service Unit I NSWS train. Themotor-operated discharge isolation valve for the out of service NSWS trainis tagged closed with power removed. Additional measures to ensure thatthe valve disc on the out of service NSWS train does not reposition arediscussed in the response to Question 10a. The motor-operated dischargeisolation valve for the in service NSWS train is tagged open with powerremoved to ensure it cannot be inadvertently repositioned. If the manually-operated isolation valves IRNP19 and IRNP20 were to leak due to disc orvalve seat failure, there are redundant isolation valves that can berepositioned to isolate the failure. Note that the piping coating work andthe valve isolation boundaries are in the same room in the AuxiliaryBuilding on the same elevation. Any problem with failures or floodingwould be immediately apparent to the personnel performing the work. TheNSWS single discharge header alignment and the associated isolationvalves will be controlled by procedure and by the Safety Tagging Program.Operators are trained on existing procedures for plant flooding and loss ofthe NSWS. Operators will receive additional training on the NSWS singledischarge header alignment prior to implementation.8. BackqroundProposed new Condition C defines a new TS Condition statement where aNSWS discharge header is inoperable. This condition makes the associatedNSWS train for Catawba 1 inoperable, causing a condition that does not meetAttachment Page 44 the limiting condition for operation (LCO). Cases 1 and 2 as shown in the LARon attachment 1, page 17, describe initial conditions for new Condition C.IssueThe licensee is additionally placing a Catawba 2 diesel generator (DG) and aCatawba 2 NSWS pump out of service as an initial condition and calling this asingle failure. Single failures are normally failures that are postulated to occurafter a design basis accident, not as initial conditions.RequestPlease explain:a) Why are DGs and NSWS pumps placed out of service for maintenanceand called single failures? [in the initial conditions and Note 9 of cases 1and 2]Duke Energy Response:The wording in the supporting calculation has been revised to remove thewords "single failure" from the description and simply say that the DGsand NSWS pumps are out of service for maintenance. The reason that theUnit 2 DG and U2 NSWS pump are assumed to be out of service formaintenance is described below in the response to Question 8b.b) Since DGs 2A and 2B can discharge to the SNSWP downstream of1 RN63A and 1 RN58B, and apparently do not have to be out of service,why are they assumed to be unavailable?Duke Energy Response:When a unit is shut down, it is typical to perform maintenance on theassociated unit's NSWS pumps and DGs. The proposed single dischargeheader alignment will only be allowed when Unit 2 is in Mode 5, 6, or NoMode. The submittal and associated PRA assumes that the NSWS pumpand DG on the associated train is out of service for maintenance. Forexample, when aligned in the single discharge header configuration withthe Train A discharge header to the SNSWP out of service, the Unit 2 TrainA NSWS pump and the Unit 2 Train A DG are assumed to be out of service.9. BackgroundThe licensee is proposing a single discharge header alignment to allow a portionof each of the NSWS return headers in the Auxiliary Building to the SNSWP tobe removed from service for cleaning, repairing, coating and inspecting. Thelicensee has stated these activities "will ensure the long-term reliability of theNSWS."Attachment Page 45 IssueThe proposal addresses the short length of NSWS piping in the AuxiliaryBuilding, while most of the NSWS discharge piping to the NSWSP and LakeWylie is outside the Auxiliary Building.Requesta) Explain how the work on the short length of piping in the AuxiliaryBuilding ensures long term reliability of the NSWS, when most of the pipeis outside the Auxiliary Building.Duke Energy Response:With the exception of this piping, the NSWS piping in the Auxiliary Buildingwith a diameter greater than 30 inches has been coated with epoxy. TheNSWS piping in the Auxiliary Building with a diameter of 30 inches andsmaller has been replaced with a corrosion resistant, superausteniticnickel stainless steel alloy, commonly called AL6XN.The buried NSWS piping is discussed in the response to Question 9b.b) What will be done to clean, repair, coat and inspect the NSWS pipingoutside the Auxiliary Building?Duke Energy Response:The buried carbon steel NSWS piping from Lake Wylie to the NSWSpumphouse has been cleaned and coated with epoxy. The buried carbonsteel NSWS piping from the NSWS pumphouse to the Auxiliary Buildinghas been cleaned and coated with epoxy. The buried carbon steel pipingto and from the Unit I and Unit 2 DGs was replaced with high densitypolyethylene (HDPE) and AL6XN. The buried carbon steel NSWS pipingfrom the Auxiliary Building that discharges to Lake Wylie has been cleanedand coated with epoxy.The buried NSWS piping from the SNSWP to the NSWS pumphouse andthe NSWS piping from the Auxiliary Building to the SNSWP has not beencoated. The normal alignment for the NSWS is to have the suction anddischarge aligned to Lake Wylie, and the NSWS piping in this flowpath hasbeen cleaned and coated with epoxy or replaced.The NSWS piping from and to the SNSWP is not the normal flowpath andprevious inspections have shown that this piping has not experienced thecorrosion and degradation seen in the piping that is normally in service.This piping is inspected per the Service Water Piping Inspection Programand the Buried Piping Program, which are part of the Service Water PipingCorrosion Program described in the Aging Management Programs andAttachment Page 46 Activities section in the Catawba UFSAR, Section 18.2.24, Service WaterPiping Corrosion Program.10. BackgroundDuring the proposed single discharge header lineups, valves 1 RN63A, 1 RN58B,1RPN19A and 1RPN20 isolate the pipe to be worked and form single valvebarriers from Lake Wylie and the SNSWP to the Auxiliary Building.IssueFailure of any of the valves or personnel error could allow flooding into theAuxiliary Building.Requesta) Discuss the elevation of the work boundaries 1 RN63A, 1 RN58B,1RPN19A and 1RPN20 as compared to the maximum elevation of theSNSWP and the maximum elevation of discharge pipes to the SNSWP.Describe design features that will prevent the SNSWP and/or NSWSdischarge piping from draining into the Auxiliary Building if workboundaries failed/leaked or personnel error breached the work boundary.Duke Energy Response:The normal SNSWP top-of-pond elevation is approximately 574.0 feet MeanSea Level (MSL). The centerline elevation of the 42 inch SNSWP returnTrain A and Train B NSWS piping in the Auxiliary Building is 581.25 feetMSL. Therefore, it is not possible to siphon the SNSWP back into theAuxiliary Building if valve I RN63A or I RN58B were to fail open and therewas not a simultaneous Probable Maximum Precipitation (PMP) event.As described in Catawba UFSAR Section 3.4, "Water Level (Flood) Design",during a PMP event, the elevation of the SNSWP could reach approximately583.5 feet MSL. Therefore, if the valve failure were to occur simultaneouslywith a PMP event, it would be possible to siphon the SNSWP into theAuxiliary Building. A PMP event would only occur due to a major weatherevent, and the NSWS single discharge header alignment will haveprocedural requirements to verify that no severe weather is in the forecastprior to implementation.The NSWS discharge piping to the SNSWP in the yard does have a highpoint of 594.75 feet MSL centerline elevation. If 1 RN63A or 1 RN58B were tofail open, this water could flood the Auxiliary Building. Measures will betaken to prevent these valves from repositioning, and these measures arediscussed below.Any passive valve seat leakage on valves I RN63A or I RN58B will beaddressed depending on the amount of leakage. To enable personnel toAttachment Page 47 work in the adjacent piping, the system must be drained anddepressurized, and released for work through the Safety Tagging Program.If there is excessive seat leakage such that the system cannot be drainedand depressurized, the NSWS could not be opened and released for workuntil the leakage is controlled.To prevent inadvertent repositioning of valves I RN63A or I RN58B, thevalves will be controlled by procedure and by the Safety Tagging Program.Additionally, to prevent the possibility of the valve discs on I RN63A orIRN58B repositioning and causing Auxiliary Building flooding, the valveswill be inspected and gagged if required. From a review of the OperatingEquipment Database and the industry failures concerning this type ofbutterfly valve, the primary failure mode which could enable the valve discto reposition is a failure of the disc to valve stem pins. To preclude thisfailure mode, the valve to disc pins will be verified to be installed. If thepins cannot be verified to be installed, a mechanical gag will be installed toprevent the valve disc from repositioning. These measures are intended topreclude the possibility of Auxiliary Building flooding and possiblesiphoning of the SNSWP due to the valve disc repositioning.Valves 1RNP19 and 1RNP20 are manually-operated butterfly valves. Thecenterline elevation of the 42 inch piping adjacent to valves 1RNPI9 and1 RNP20 is 585.75 feet MSL. If these valves were to reposition or have aseat or disc failure resulting in leakage, there are redundant isolationvalves that can be closed to isolate the failure and mitigate flooding. Toprevent inadvertent repositioning, these valves will be controlled byprocedure and by the Safety Tagging Program.b) Discuss additional backup isolation features and compensatory measuresto prevent internal flooding.Duke Energy Response:As described in the response to Question 10a, the position of valvesI RN63A or 1 RN58B will be controlled by procedure and by the SafetyTagging Program. Additionally, to prevent the possibility of the valve discson 1RN63A or 1RN58B repositioning and causing Auxiliary Buildingflooding, the valves will be inspected and gagged if required.To prevent inadvertent repositioning of valves IRNP19 and IRNP20, thevalves will be controlled by procedure and by the Safety Tagging Program.Additionally, if these valves were to reposition or have a seat or disc failureresulting in leakage, there are redundant isolation valves that can beclosed to isolate the failure and mitigate flooding.11. BackgroundThe LAR describes two cases of single discharge header operation, i.e. a) pipebetween 1 RPN63A and 1 RPN 19 is isolated, and b) pipe between 1RPN58B andAttachment Page 48 1 RPN20 is isolated. In each case NSWS return header crossover valves areopen with power removed; the NSWS return isolation valve to the SNSWP isopen (power removed); NSWS suction is aligned to the SNSWP; and Lake Wyliedischarge isolation valves are closed.The updated facility safety analysis report (UFSAR) refers to the NSWSdischarge headers as the A header and the B header, each serving both units.The LAR description and the proposed new Insert 2 for the proposed TS Basesrefer to both headers as the Catawba 2 discharge headers.New Condition C of the proposed TS refers to them individually as one NSWSAuxiliary Building discharge header.IssueThe above descriptions of the NSWS discharge headers in the TS Bases andnew Condition C are unclear without reading the LAR. New Condition C and theBases (Insert 3) do not define which portion of the discharge is allowed to beinoperable and the special lineup for safety that is described in the LAR.Therefore, operators may be inconsistent in plant configuration when enteringnew Condition C. Inspectors may not be able to know valid Condition C lineups.RequestExplain the licensee's intent to adequately define single discharge headeroperation in the UFSAR, new Condition C, and TS Bases, so that operators canalign the plant to meet new Condition C as defined in the LAR when allowed, andinspectors can know the required discharge header alignment when in newCondition C.Duke Energy Response:For this response, please refer to the revised reprinted TS and TS Basesthat are included at the end of this attachment. As indicated in the May 3,2012 telephone conference call between Duke Energy and the NRC, the TSBases for new Condition C have been expanded to define the lineup for thesingle Auxiliary Building discharge header alignment. As discussed in theconference call, this level of detail is not necessary for inclusion in the TSitself. Finally, as indicated in the conference call, Duke Energy commits toinclude corresponding detail regarding the single Auxiliary Buildingdischarge header alignment in the UFSAR following NRC approval of thisamendment request. THIS CONSTITUTES A REGULATORY COMMITMENT.12. BackgroundInsert 2 of the proposed TS Bases describes the NSWS operating in the singledischarge header alignment. This places Catawba 1 in new Condition C of theproposed TS which describes a condition where LCO 3.7.8 is not met. However,Insert 2 also says that each NSWS train is operable.Attachment Page 49 Issuea) The licensee has placed the proposed Insert 2 for the single dischargeheader lineup in the LCO section of the TS Bases. However, as statedabove, the single discharge header lineup does not meet the LCO.b) Insert 2 states that each NSWS train is operable. Yet, Insert 2 describesCondition C which does not meet the LCO. Therefore, not all NSWStrains would be operable. Throughout the LAR, the licensee lists eitherNSWS 1A or 1B train as inoperable when in the single discharge headerlineup. Thus Insert 2 conflicts with the background/technical evaluation inthe LAR.RequestExplain the inconsistencies in the location of Insert 2 in the TS Bases and thecontent of Insert 2 as described above in a) and b) and correct Insert 2 asappropriate.Duke Energy Response:For this response, please refer to the revised reprinted TS and TS Basesthat are included at the end of this attachment. The primary function ofInsert 2 in the original submittal was to clarify the conditions under whichthe Unit 1 required NSWS trains could be considered to be operable whilethe NSWS is operating in the single Auxiliary Building discharge headeralignment. It is acknowledged that while operating in this alignment, theLCO is not met. However, since Unit 2 must be in Mode 5, 6, or No Modewhile in this alignment, the train related NSWS pump associated with theAuxiliary Building discharge header that is removed from service may alsobe removed from service. With the exception of the Auxiliary Buildingdischarge header that is inoperable per Condition C, this does nototherwise impact the operability of the two NSWS trains required for Unit1. This Bases discussion was relocated under Condition C, where it ismore appropriate. (For consistency, the similar Bases discussion forsingle supply header alignment was also relocated under Condition B,where it is more appropriate.) In addition, this Bases discussion wasmodified to clarify that it is applicable to single Auxiliary Buildingdischarge header alignment, since only the Auxiliary Building portion ofthe discharge header may be inoperable per Condition C.When in the single Auxiliary Building discharge header alignment with theNSWS Train A discharge header inoperable, the NSWS piping betweenvalves IRNP19 and IRN63A is isolated. With the piping between IRNP19and I RN63A isolated, Unit 1 and Unit 2 do not have their train-relatedflowpath to the SNSWP available. Therefore the Unit 1 Train A NSWSdischarge header is inoperable due to the single Auxiliary Buildingdischarge header alignment. In the single Auxiliary Building dischargeAttachment Page 50 header alignment, Unit 2 must be in Mode 5, 6, or No Mode, and the TS forthe NSWS is not applicable in these modes.Likewise, when in the single Auxiliary Building discharge header alignmentwith the NSWS Train B discharge header inoperable, the NSWS pipingbetween valves IRNP20 and 1RN58B is isolated. With the piping betweenI RNP20 and I RN58B isolated, Unit I and Unit 2 do not have their train-related flowpath to the SNSWP available. Therefore the Unit I Train BNSWS discharge header is inoperable due to the single Auxiliary Buildingdischarge header alignment. In the single Auxiliary Building dischargeheader alignment, Unit 2 must be in Mode 5, 6, or No Mode, and the TS forthe NSWS is not applicable in these modes.13. BackgroundWhen in a single discharge header lineup, the background/technical sections ofthe LAR state that Catawba 2 must be in Mode 5, 6 or no Mode.IssueNew Condition C of the TS as proposed in Insert 1 does not specifically requirethat Catawba 2 be in Mode 5, 6 or no Mode.RequestExplain why new Condition C of the TS does not require that Catawba 2 be inMode 5, 6, or no Mode.Duke Energy Response:For this response, please refer to the revised reprinted TS and TS Basesthat are included at the end of this attachment. Note 1 of new Condition Chas been expanded by adding the following statement: "Entry into thisCondition shall not be allowed while Unit 2 is in MODE 1, 2, 3, or 4." Thisstatement was deemed preferable to a statement requiring Unit 2 to be inMode 5, 6, or No Mode for two reasons: 1) the term "No MODE" is notutilized in TS, and 2) the chosen statement is consistent with other Notesin TS governing Mode prohibitions, which are typically stated in thenegative.14. BackgroundInsert 3 of the LAR states"... Condition C is only allowed to be entered in supportof planned maintenance or modification activities associated with the AuxiliaryBuilding discharge header that is taken out of service. An example of a situationfor which entry into this Condition is allowed is refurbishment of an AuxiliaryBuilding discharge header. Entry into this Condition is not allowed in response tounplanned events or for other events involving the NSWS."Attachment Page 51 The LAR cover letter and description describes the proposed scope to be for theNSWS discharge header to be removed from service for cleaning, coating andfollow-up inspections.IssueInsert 3 defines the allowed entry into Condition C to be much broader than thescope delineated in the rest of the LAR.RequestExplain how you will modify Insert 3 to be consistent with the rest of the LAR.Duke Energy Response:The original scope of activities that warranted the submission of this LARwere associated with removing the Auxiliary Building portion of a NSWSdischarge header from service for cleaning, coating, and follow-upinspections. This submittal specifically excludes emergent work as asituation under which Condition C may be entered. However, there may beother pre-planned maintenance or modification activities in the future thatare appropriate for entry into Condition C that have not yet beenanticipated. Over the years, several one-time TS change requests weresubmitted and approved which supported pre-planned maintenanceactivities associated with the NSWS supply headers at Catawba. In aneffort to avoid additional one-time requests, Duke Energy submitted, andthe NRC approved, a permanent TS change to allow the NSWS supplyheaders to be removed from service for pre-planned maintenanceactivities. This submittal for the NSWS Auxiliary Building dischargeheaders is therefore consistent with previous Catawba submittal/approvalhistory. The TS Bases are written specifically enough to only allow pre-planned maintenance activities, without being overly specific so as todisallow future unanticipated types of these activities. Therefore, nochanges to the TS Bases are being proposed in response to this question.15. BackgroundThe guidelines of RG 1.177 state that the licensee "should consider... whetherthere are appropriate restrictions in place to preclude simultaneous equipmentoutages that would erode the principles of redundancy and diversity," and"whether compensatory actions to be taken when entering the modified[completion time] CT for preplanned maintenance are identified."When operating in a single discharge header as proposed by the LAR, oneNSWS train is inoperable. NSWS is a support system. In accordance with TS3.0.6, the corresponding supported systems are required to be declaredinoperable if determined to be inoperable as a result of the support systeminoperability. Supported systems include Emergency Core Cooling System,Containment Spray System, Containment Valve Injection Water System,Auxiliary Feedwater, Component Cooling Water, Control Room Area VentilationAttachment Page 52 System, Auxiliary Building Filtered Ventilation Exhaust System, and EmergencyDiesel Generators.IssueThe licensee has not identified any inoperable systems that are supported byNSWS in the LAR. The licensee has not expressed any compensatorymeasures to ensure the redundant trains of supported systems are protected toreduce the risk of loss of safety function. The licensee has not described anyevaluation required by LCO 3.0.6 to perform an evaluation in accordance with TSAdministrative Control 5.5.15, "Safety Function Determination Program (SFDP)"for supported systems.RequestIdentify all inoperable supported systems as a result of each inoperable NSWStrain. Identify all compensatory measure to protect the redundant system asdetermined by TS Administrative Control 5.5.15.Duke Energy Response:The TS systems supported by the NSWS include the following:TS 3.4.6, RCS Loops -MODE 4 (cascade required only when all NSWScooling is inoperable per Note 2 in TS 3.7.8, Required Action A.1)TS 3.5.2, ECCS -OperatingTS 3.5.3, ECCS -ShutdownTS 3.6.6, Containment Spray SystemTS 3.6.17, Containment Valve Injection Water System (CVIWS)TS 3.7.5, Auxiliary Feedwater (AFW) SystemTS 3.7.7, Component Cooling Water (CCW) SystemTS 3.7.11, Control Room Area Chilled Water System (CRACWS)TS 3.8.1, AC Sources -Operating (DGs) (cascade required only when allNSWS cooling is inoperable per Note I in TS 3.7.8, Required Action A.1)Per the requirements of LCO 3.0.6, the Conditions and Required Actionsassociated with the supported systems are not required to be entered.Only the support system LCO Actions are required to be entered. TS5.5.15, Safety Function Determination Program, ensures that a loss ofsafety function is detected and appropriate actions are taken.While the NSWS is aligned in the single Auxiliary Building dischargeheader configuration, procedures will direct compensatory measures. Theprocedures for aligning the NSWS in the single Auxiliary Buildingdischarge header configuration will include the following measures:* Verify flood barriers in the Turbine Building basement prior toimplementation.* Verify no severe weather is in the forecast prior to implementation.Attachment Page 53
- Limit discretionary maintenance in Unit I and Unit 2.cable rooms, onavailable DGs, on Unit 1 turbine-driven AFW pump, on plant DrinkingWater System (which provides backup cooling to the Train A centrifugalcharging pump), and on Standby Shutdown System (including standbymakeup pump) during implementation.* Implement roving fire watch in Unit I and Unit 2 cable rooms duringimplementation.Attachment Page 54 NSWS3.7.83.7 PLANT SYSTEMS3.7.8 Nuclear Service Water System (NSWS)LCO 3.7.8APPLICABILITY:Two NSWS trains shall be OPERABLE.MODES 1, 2, 3, and 4.ACTIONSCONDITION REQUIRED ACTION COMPLETION TIMEA. One NSWS train A.1 ---------NOTES------inoperable. 1. Enter applicableConditions andRequired Actions ofLCO 3.8.1, "ACSources-Operating," foremergency dieselgenerator madeinoperable by NSWS.2. Enter applicableConditions andRequired Actions ofLCO 3.4.6, "RCSLoops-MODE 4," forresidual heat removalloops madeinoperable by NSWS.Restore NSWS train to 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />sOPERABLE status.(continued)Catawba Units 1 and 23.7.8-1Amendment Nos. 243/237 NSWS3.7.8ACTIONS (continued)CONDITION REQUIRED ACTION COMPLETION TIMEB. --------NOTES-----1. Entry into thisCondition shall onlybe allowed for pre-planned activities asdescribed in theBases of thisSpecification.2. Immediately enterCondition A of thisLCO if one or moreNSWS componentsbecome inoperablewhile in thisCondition and oneNSWS train remainsOPERABLE.3. Immediately enterLCO 3.0.3 if one ormore NSWScomponents becomeinoperable while inthis Condition andno NSWS trainremainsOPERABLE.B.1Restore NSWS supplyheader to OPERABLEstatus.30 daysOne NSWS supplyheader inoperable dueto NSWS being alignedfor single supply headeroperation.(continued)Catawba Units 1 and 23.7.8-2Amendment Nos.
NSWS3.7.8ACTIONS (continued)CONDITION REQUIRED ACTION COMPLETION TIMEC. --------NOTES-----1. Entry into thisCondition shall onlybe allowed for Unit 1and for pre-plannedactivities asdescribed in theBases of thisSpecification. Entryinto this Conditionshall not be allowedwhile Unit 2 is inMODE 1, 2, 3, or 4.2. Immediately enterCondition A of thisLCO if one or moreUnit 1 requiredNSWS componentsbecome inoperablewhile in thisCondition and oneNSWS train remainsOPERABLE.3. Immediately enterLCO 3.0.3 if one ormore Unit 1 requiredNSWS componentsbecome inoperablewhile in thisCondition and noNSWS train remainsOPERABLE.C.1Restore NSWS AuxiliaryBuilding discharge headerto OPERABLE status.14 daysOne NSWS AuxiliaryBuilding dischargeheader inoperable dueto NSWS being alignedfor single AuxiliaryBuilding dischargeheader operation.(continued)Catawba Units 1 and 23.7.8-3Amendment Nos.
NSWS3.7.8ACTIONS (continued)CONDITION REQUIRED ACTION COMPLETION TIMED. Required Action and D.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassociated CompletionTime of Condition A, B, ANDor C not met.D.2 Be in MODE 5. 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />sSURVEILLANCE REQUIREMENTSSURVEILLANCE FREQUENCYSR 3.7.8.1 -----------------------NOTE --------------Isolation of NSWS flow to individual components doesnot render the NSWS inoperable.Verify each NSWS manual, power operated, and In accordance withautomatic valve in the flow path servicing safety related the Surveillanceequipment, that is not locked, sealed, or otherwise Frequency Controlsecured in position, is in the correct position. ProgramSR 3.7.8.2 --------------------NOTE -----------------Not required to be met for valves that are maintained inposition to support NSWS single supply or dischargeheader operation.Verify each NSWS automatic valve in the flow path that In accordance withis not locked, sealed, or otherwise secured in position, the Surveillanceactuates to the correct position on an actual or simulated Frequency Controlactuation signal. ProgramSR 3.7.8.3 Verify each NSWS pump starts automatically on an In accordance withactual or simulated actuation signal. the SurveillanceFrequency ControlProgramCatawba Units 1 and 23.7.8-4Amendment Nos.
NSWSB 3.7.8B 3.7 PLANT SYSTEMSB 3.7.8 Nuclear Service Water System (NSWS)BASESBACKGROUND The NSWS, including Lake Wylie and the Standby Nuclear ServiceWater Pond (SNSWP), provides a heat sink for the removal of processand operating heat from safety related components during a DesignBasis Accident (DBA) or transient. During normal operation, and anormal shutdown, the NSWS also provides this function for various safetyrelated and nonsafety related components. The safety related function iscovered by this LCO.The NSWS consists of two independent loops (A and B) of essentialequipment, each of which is shared between units. Each loop containstwo NSWS pumps, each of which is supplied from a separate emergencydiesel generator. Each set of two pumps supplies two trains (1A and 2A,or 1 B and 2B) of essential equipment through common discharge piping.While the pumps are unit designated, i.e., 1A, 1B, 2A, 2B, all pumpsreceive automatic start signals from a safety injection or blackout signalfrom either unit. Therefore, a pump designated to one unit will supplypost accident cooling to equipment in that loop on both units, provided itsassociated emergency diesel generator is available. For example, the 1ANSWS pump, supplied by emergency diesel 1A, will supply post accidentcooling to NSWS trains 1A and 2A.One NSWS loop containing two OPERABLE NSWS pumps has sufficientcapacity to supply post loss of coolant accident (LOCA) loads on one unitand shutdown and cooldown loads on the other unit. Thus, theOPERABILITY of two NSWS loops assures that no single failure willkeep the system from performing the required safety function.Additionally, one NSWS loop containing one OPERABLE NSWS pumphas sufficient capacity to maintain one unit indefinitely in MODE 5(commencing 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> following a trip from RTP) while supplying thepost LOCA loads of the other unit. Thus, after a unit has been placed inMODE 5, only one NSWS pump and its associated emergency dieselgenerator are required to be OPERABLE on each loop, in order for thesystem to be capable of performing its required safety function, includingsingle failure considerations.Additional information about the design and operation of the NSWS,along with a list of the components served, is presented in the UFSAR,Section 9.2.1 (Ref. 1). The principal safety related function of the NSWSis the removal of decay heat from the reactor via the CCW System.Catawba Units 1 and 2B 3.7.8-1Revision No. 5 NSWSB 3.7.8BASESAPPLICABLE The design basis of the NSWS is for one NSWS train, in conjunctionSAFETY ANALYSES with the CCW System and a containment spray system, to remove coredecay heat following a design basis LOCA as discussed in the UFSAR,Section 6.2 (Ref. 2). This prevents the containment sump fluid fromincreasing in temperature during the recirculation phase following aLOCA and provides for a gradual reduction in the temperature of this fluidas it is supplied to the Reactor Coolant System by the ECCS pumps.The NSWS is designed to perform its function with a single failure of anyactive component, assuming the loss of offsite power.The NSWS, in conjunction with the C.CW System, also cools the unitfrom residual heat removal (RHR), as discussed in the UFSAR,Section 5.4 (Ref. 3), from RHR entry conditions to MODE 5 during normaland post accident operations. The time required for this evolution is afunction of the number of CCW and RHR System trains that areoperating. Thirty six hours after a trip from RTP, one NSWS train issufficient to remove decay heat during subsequent operations inMODES 5 and 6. This assumes a maximum NSWS temperature, asimultaneous design basis event on the other unit, and the loss of offsitepower.The NSWS satisfies Criterion 3 of 10 CFR 50.36 (Ref. 4).LCO Two NSWS trains are required to be OPERABLE to provide the requiredredundancy to ensure that the system functions to remove post accidentheat loads, assuming that the worst case single active failure occurscoincident with the loss of offsite power.While the NSWS is operating in the normal dual supply and dischargeheader alignment, an NSWS train is considered OPERABLE duringMODES 1, 2, 3, and 4 when:a. 1. Both NSWS pumps on the NSWS loop are OPERABLE; or2. One unit's NSWS pump is OPERABLE and one unit'sflowpath to the non essential header, AFW pumps, andContainment Spray heat exchangers are isolated (orequivalent flow restrictions); andb. The associated piping, valves, and instrumentation and controlsrequired to perform the safety related function are OPERABLE.Catawba Units 1 and 2B 3.7.8-2Revision No. 5 NSWSB 3.7.8BASESLCO (continued)The NSWS system is shared between the two units. The shared portionsof the system must be OPERABLE for each unit when that unit is in theMODE of Applicability. Additionally, both normal and emergency powerfor shared components must also be OPERABLE. If a shared NSWScomponent becomes inoperable, or normal or emergency power toshared components becomes inoperable, then the Required Actions ofthis LCO must be entered independently for each unit that is in theMODE of applicability of the LCO, except as noted in a.2 above foroperation in the normal dual supply header alignment. In this case,sufficient flow is available, however, this configuration results ininoperabilities within other required systems on one unit and theassociated Required Actions must be entered. Use of a NSWS pumpand associated diesel generator on a shutdown unit to support continuedoperation (> 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />) of a unit with an inoperable NSWS pump isprohibited. A shutdown unit supplying its associated emergency powersource (1 EMXG/2EMXH) cannot be credited for OPERABILITY ofcomponents supporting the operating unit.APPLICABILITY In MODES 1, 2, 3, and 4, the NSWS is a normally operating system thatis required to support the OPERABILITY of the equipment serviced bythe NSWS and required to be OPERABLE in these MODES.In MODES 5 and 6, the requirements of the NSWS are determined by thesystems it supports.ACTIONS A. 1If one NSWS train is inoperable, action must be taken to restoreOPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In this Condition, the remainingOPERABLE NSWS train is adequate to perform the heat removalfunction. However, the overall reliability is reduced because a singlefailure in the OPERABLE NSWS train could result in loss of NSWSfunction. Due to the shared nature of the NSWS, both units are requiredto enter a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Action when a NSWS Train becomes inoperable oneither unit. Required Action A.1 is modified by two Notes. The first Noteindicates that the applicable Conditions and Required Actions ofLCO 3.8.1, "AC Sources-Operating," should be entered if an inoperableNSWS train results in an inoperable emergency diesel generator. Thesecond Note indicates that the applicable Conditions and RequiredActions of LCO 3.4.6, "RCS Loops-MODE 4," should be entered if aninoperable NSWS train results in an inoperable decay heat removal trainCatawba Units 1 and 2B 3.7.8-3Revision No. 5 NSWSB 3.7.8BASESACTIONS (continued)(RHR). An example of when these Notes should be applied is with bothunits' loop 'A' NSWS pumps inoperable, both units' 'A' emergency dieselgenerators and both units' 'A' RHR systems should be declaredinoperable and appropriate Actions entered. This is an exception toLCO 3.0.6 and ensures the proper actions are taken for thesecomponents. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is based on the redundantcapabilities afforded by the OPERABLE train, and the low probability of aDBA occurring during this time period.B._1While the NSWS is operating in the single supply header alignment, oneof the supply headers is removed from service in support of plannedmaintenance or modification activities associated with the supply headerthat is taken out of service. In this configuration, each NSWS train isconsidered OPERABLE with the required NSWS flow to safety relatedequipment being fed through the remaining OPERABLE NSWS supplyheader. While the NSWS is operating in the single supply headeralignment, an NSWS train is considered OPERABLE during MODES 1, 2,3, and 4 when:a. The associated train related NSWS pumps are OPERABLE; andb. The associated piping (except for the supply header that is takenout of service), valves, and instrumentation and controls required toperform the safety related function are OPERABLE.If one NSWS supply header is inoperable due to the NSWS being alignedfor single supply header operation, the NSWS supply header must berestored to OPERABLE status within 30 days. Dual supply headeroperation is the normal alignment of the NSWS. The Completion Time of30 days is supported by probabilistic risk analysis. While in Condition B,the single supply header is adequate to perform the heat removalfunction for all required safety related equipment for both safety trains.Due to the shared nature of the NSWS, both units are required to enterthis Condition when the NSWS is aligned for single supply headeroperation. In order to prevent the potential for NSWS pump runout, thesingle NSWS pump flow balance alignment is prohibited while the NSWSis aligned for single supply header operation.Catawba Units 1 and 2B 3.7.8-4Revision No. 5 NSWSB 3.7.8BASESACTIONS (continued)Condition B is modified by three Notes. Note 1 states that entry into thisCondition shall only be allowed for pre-planned activities as described inthe Bases of this Specification. Condition B is only allowed to be enteredin support of planned maintenance or modification activities associatedwith the supply header that is taken out of service. An example of asituation for which entry into this Condition is allowed is refurbishment ofa supply header. Entry into this Condition is not allowed in response tounplanned events or for other events involving the NSWS. Examples ofsituations for which entry into this Condition is prohibited are emergentrepair of discovered piping leaks and other component failures. Forunplanned events or other events involving the NSWS, Condition A mustbe entered. Note 2 requires immediate entry into Condition A of this LCOif one or more NSWS components become inoperable while in thisCondition and one NSWS train remains OPERABLE. With oneremaining OPERABLE NSWS train, the NSWS can still perform its safetyrelated function. However, with one inoperable NSWS train, the NSWScannot be assured of performing its safety related function in the event ofa single failure of another NSWS component. The most limiting singlefailure is the failure of an NSWS pit to automatically transfer from LakeWylie to the SNSWP during a seismic event. While the loss of anyNSWS component subject to the requirements of this LCO can result inthe entry into Condition A, the most common example is the inoperabilityof an NSWS pump. This occurs during periodic testing of the emergencydiesel generators. Inoperability of an emergency diesel generatorrenders its associated NSWS pump inoperable. Note 3 requiresimmediate entry into LCO 3.0.3 if one or more NSWS componentsbecome inoperable while in this Condition and no NSWS train remainsOPERABLE. In this case, the NSWS cannot perform its safety relatedfunction.C.1While the NSWS is operating in the single Auxiliary Building dischargeheader alignment, one of the Unit 2 Auxiliary Building discharge headersis removed from service in support of planned maintenance ormodification activities associated with the Auxiliary Building dischargeheader that is taken out of service. In this configuration, each NSWStrain is considered OPERABLE with the required NSWS flow to safetyrelated equipment being discharged through the remaining OPERABLENSWS Auxiliary Building discharge header. While the NSWS isoperating in the single Auxiliary Building discharge header alignment, anNSWS train is considered OPERABLE during MODES 1, 2, 3, and 4when:Catawba Units 1 and 2B 3.7.8-5Revision No. 5 NSWSB 3.7.8BASESACTIONS (continued)a. The associated train related NSWS pumps are OPERABLE(except that for the Auxiliary Building discharge header that isremoved from service, its associated train related NSWS pumpmay also be removed from service); andb. The associated piping (except for the Auxiliary Building dischargeheader that is taken out of service), valves, and instrumentationand controls required to perform the safety related function areOPERABLE.When in the single Auxiliary Building discharge header alignment with theNSWS Train A discharge header inoperable, the NSWS piping betweenvalves 1RNP19 and 1RN63A is isolated. Likewise, when in the singleAuxiliary Building discharge header alignment with the NSWS Train Bdischarge header inoperable, the NSWS piping between valves 1 RNP20and 1 RN58B is isolated.Operation of the NSWS in the single supply header alignment and thesingle Auxiliary Building discharge header alignment at the same time isprohibited.If one NSWS Auxiliary Building discharge header is inoperable due to theNSWS being aligned for single Auxiliary Building discharge headeroperation, the NSWS Auxiliary Building discharge header must berestored to OPERABLE status within 14 days. Dual Auxiliary Buildingdischarge header operation is the normal alignment of the NSWS. TheCompletion Time of 14 days is supported by probabilistic risk analysis.While in Condition C, the single Auxiliary Building discharge header isadequate to perform the heat removal function for all required safetyrelated equipment for its respective safety train. Due to the design of theNSWS, only the operating unit is required to enter this Condition whenthe NSWS is aligned for single Auxiliary Building discharge headeroperation. Pre-planned activities requiring entry into this Condition areonly performed with Unit 2 in an outage (MODE 5, 6, or defueled).Condition C is modified by three Notes. Note 1 states that entry into thisCondition shall only be allowed for Unit 1 and for pre-planned activities asdescribed in the Bases of this Specification. Condition C is only allowedto be entered in support of planned maintenance or modification activitiesassociated with the Auxiliary Building discharge header that is taken outof service. An example of a situation for which entry into this Condition isallowed is refurbishment of an Auxiliary Building discharge header. Entryinto this Condition is not allowed in response to unplanned events or forother events involving the NSWS. Examples of situations for which entryCatawba Units 1 and 2B 3.7.8-6Revision No. 5 NSWSB 3.7.8BASESACTIONS (continued)into this Condition is prohibited are emergent repair of discovered pipingleaks and other component failures. For unplanned events or otherevents involving the NSWS, Condition A must be entered. In addition,Note 1 states that entry into this Condition shall not be allowed while Unit2 is in MODE 1, 2, 3, or 4. Entry into this Condition is only allowed whilethe LCO is not applicable to Unit 2. Note 2 requires immediate entry intoCondition A of this LCO if one or more Unit 1 required NSWScomponents become inoperable while in this Condition and one NSWStrain remains OPERABLE. With one remaining OPERABLE NSWS train,the NSWS can still perform its safety related function. However, with oneinoperable NSWS train, the NSWS cannot be assured of performing itssafety related function in the event of a single failure of another NSWScomponent. While the loss of any NSWS component subject to therequirements of this LCO can result in the entry into Condition A, themost common example is the inoperability of an NSWS pump. Thisoccurs during periodic testing of the emergency diesel generators.Inoperability of an emergency diesel generator renders its associatedNSWS pump inoperable. Note 3 requires immediate entry into LCO 3.0.3if one or more Unit 1 required NSWS components become inoperablewhile in this Condition and no NSWS train remains OPERABLE. In thiscase, the NSWS cannot perform its safety related function.D.1 and D.2If the NSWS train cannot be restored to OPERABLE status within theassociated Completion Time, if the NSWS supply header cannot berestored to OPERABLE status within the associated Completion Time, orif the NSWS Auxiliary Building discharge header cannot be restored toOPERABLE status within the associated Completion Time, the unit mustbe placed in a MODE in which the LCO does not apply. To achieve thisstatus, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and inMODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.The allowed Completion Times are reasonable, based on operatingexperience, to reach the required unit conditions from full powerconditions in an orderly manner and without challenging unit systems.Catawba Units 1 and 2B 3.7.8-7Revision No. 5 NSWSB 3.7.8BASESSURVEILLANCE SR 3.7.8.1REQUIREMENTSThis SR is modified by a Note indicating that the isolation of the NSWScomponents or systems may render those components inoperable, butdoes not affect the OPERABILITY of the NSWS.Verifying the correct alignment for manual, power operated, andautomatic valves in the NSWS flow path provides assurance that theproper flow paths exist for NSWS operation. This SR does not apply tovalves that are locked, sealed, or otherwise secured in position, sincethey are verified to be in the correct position prior to being locked, sealed,or secured. This SR does not require any testing or valve manipulation;rather, it involves verification that those valves capable of beingmispositioned are in the correct position. This SR does not apply tovalves that cannot be inadvertently misaligned, such as check valves.The Surveillance Frequency is based on operating experience,equipment reliability, and plant risk and is controlled under theSurveillance Frequency Control Program.SR 3.7.8.2This SR verifies proper automatic operation of the NSWS valves on anactual or simulated actuation signal. The signals that cause the actuationare from Safety Injection and Phase 'B' isolation. The NSWS is anormally operating system that cannot be fully actuated as part of normaltesting. This Surveillance is not required for valves that are locked,sealed, or otherwise secured in the required position under administrativecontrols. The Surveillance Frequency is based on operating experience,equipment reliability, and plant risk and is controlled under theSurveillance Frequency Control Program.This SR is modified by a Note that states that the SR is not required to bemet for valves that are maintained in position to support NSWS singlesupply or discharge header operation. When the NSWS is placed in thisalignment, certain automatic valves in the system are maintained inposition and will not automatically reposition in response to an actuationsignal while the NSWS is in this alignment.SR 3.7.8.3This SR verifies proper automatic operation of the NSWS pumps on anactual or simulated actuation signal. The signals that cause the actuationare from Safety Injection and Loss of Offsite Power. The NSWS is anormally operating system that cannot be fully actuated as part of normalCatawba Units 1 and 2B 3.7.8-8Revision No. 5 NSWSB 3.7.8BASESSURVEILLANCE REQUIREMENTS (continued)testing during normal operation. The Surveillance Frequency is based onoperating experience, equipment reliability, and plant risk and iscontrolled under the Surveillance Frequency Control Program.REFERENCES1. UFSAR, Section 9.2.2. UFSAR, Section 6.2.3. UFSAR, Section 5.4.4. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).Catawba Units 1 and 2B 3.7.8-9Revision No. 5