ML041900401

Response to Request for Additional Information Request to Implement a Risk-Informed Inservice Inspection Program Plan as an Alternative to ASME Code Section XI Requirements

ML041900401
Person / Time
Site:	Millstone
Issue date:	07/06/2004
From:	Grecheck E Dominion Nuclear Connecticut
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
04-155
Download: ML041900401 (29)

Text

Dominion Nuclear Connecticut, Inc.

Millm)nc Power Station Ropc Fcrry Road W.ircrford. C'I. 06385 Ih P

borninion 1

July 6, 2004 U.S. Nuclear Regulatory Commission Attention: Document Control Desk Washington, DC 20555 Serial No.

04-1 55 NL&OS/PRW RO Docket No.

50-336 License No.

DPR-65 DOMINION NUCLEAR CONNECTICUT, INC.

MILLSTONE POWER STATION UNIT 2 RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION PROGRAM PLAN AS AN ALTERNATIVE TO ASME CODE SECTION XI REQUIREMENTS REQUEST TO IMPLEMENT A RISK-INFORMED INSERVICE INSPECTION By a letter dated November 10, 2003, Dominion Nuclear Connecticut, Inc. (DNC) requested NRC approval to implement a Risk-Informed lnservice Inspection (RI-ISI)

Program (Relief Request RR-89-40) as an alternative to the American Society of Mechanical Engineers (ASME)Section XI inservice inspection requirements for Class 1 piping at Millstone Unit No. 2 (MPS2). Additionally, DNC requested NRC approval to allow a pressure test and corresponding Visual, VT-2 examination (Relief Request RR-89-41) in lieu of a volumetric examination for socket welds of any size and branch pipe connection welds Nominal Pipe Size (NPS) 2 inches and smaller that will be examined in accordance with the RI-IS1 program.

On March 11, 2004, a Request For Additional Information (RAI) was received from the Nuclear Regulatory Commission (NRC) staff containing eight questions related to Relief Request RR-89-40 and two questions related to RR-89-41. Attachment 1 provides the DNC response to Questions 1 and 3 through 8 for RR-89-40 and Questions 1 and 2 for RR-89-41. As agreed upon in a conference call on June 16, 2004, DNC will provide a response to Question 2 on RR-89-40 in a separate, later correspondence.

The additional information provided in this letter does not affect the previous conclusions made in the Safety Summary and Significant Hazards Consideration contained in the DNC letter of November 10, 2003.

Serial No.04-155 Page 2 of 2 If you have any questions or require additional information, please contact Mr. Paul R.

Willoughby at (804) 273-3572.

Very truly yours, Eugene S. Grecheck Vice President - Nuclear Support Services Attachments: (1)

Commitments made in this letter: None.

cc:

U.S. Nuclear Regulatory Commission Region I 475 Allendale Road King of Prussia, PA 19406-1 41 5 Mr. V. Nerses Senior Project Manager US. Nuclear Regulatory Commission One White Flint North I 1555 Rockville Pike Mail Stop 8C2 Rockville. MD 20852-2738 Mr. S. M. Schneider NRC Senior Resident Inspector Millstone Power Station

ATTACHMENT 1 RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION PROGRAM PLAN AS AN ALTERNATIVE TO ASME CODE SECTION XI REQUIREMENTS REQUEST TO IMPLEMENT A RISK-INFORMED INSERVICE INSPECTION MILLSTONE POWER STATION, UNIT 2 DOMINION NUCLEAR CONNECTICUT, INC. (DNC)

Serial No.04-155 RAI Risk-Informed IS1 Page 1 of 26 RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION PROGRAM PLAN AS AN ALTERNATIVE TO ASME CODE SECTION XI REQUIREMENTS REQUEST TO IMPLEMENT A RISK-INFORMED INSERVICE INSPECTION

1. RR-89-40 Question: 1

1) Regulatory Guide (RG) 1.I 78, An Approach for Plant-Specific Risk-lnformed Decisionmaking for lnservice lnspection of Piping, Revision I, dated September 2003, replaced the original For Trial Use RG dated September 1998. Revision 1 of the RG 1.I78 includes guidance on what should be included in risk informed-inservice inspection (RI-ISI) submittals, particularly in dealing with probabilistic risk assessment (PRA) issues. Specifically, on page 28 of RG 1.178, the following is stated regarding the information that should be included in a submittal:

A description of the staff and industry reviews performed on the PRA. Limitations, weakness, or improvements identified by the reviewers that could change the results of the PRA should be discussed. The resolution of the reviewer comments, or an explanation of the insensitivity of the analysis used to support the submittal to the comment, should be provided.

Your submittal briefly describes two weaknesses identified by the NRC staff during the review of the individual plant examination (IPE) and how these weaknesses have been addressed. Your submittal also discusses a January 2000, Combustion Engineering peer review of your PRA. Please provide the Facts and Observations that peer review team identified as important and necessary to address [(Significance Level A and B in NEl 00-02 Probabilistic Risk Assessment (PRA) Peer Review Process Guidance (Rev.A3)]and describe how these issues have been resolved or why they will not affect the proposed RI-IS1 program.

ResDonse to Question 1 The Millstone Unit 2 IPE was completed in December 1993. The NRC reviewed the model and issued an SER in May 1996. Since then, a number of major updates of the model had occurred. The first update (Rev. 0) was completed in January 2000 and incorporated plant-specific data (the CEOG peer review of October 1999 predated the release of this model).

The second major update (Rev. I), addressing some peer review comments and correcting modeling errors, was released in June 2000. The third update (Rev. 2) was finished in April 2001 to incorporate the separation of the Unit 2 electrical system from Unit 1 and the subsequent tie-in to the Unit 3 41 60V AC system for back-up power.

Serial No.04-155 RAI Risk-Informed IS1 Page 2 of 26 The most recent updates were completed in October of 2002 (to resolve inconsistencies in the logic of the AC power distribution, in modeling the spare pump alignments in the Service Water, HPSl and RBCCW systems and in human reliability) and June 2003 (to include modifications to the charging system). below lists the still outstanding peer review comments from the A and B significance categories along with their estimated impact on the proposed RI-IS1 program. These remaining comments will be resolved in the upcoming PRA model upgrade, currently scheduled for completion by the end of 2004.

For completeness, Enclosure 2 is also provided listing the comments that are considered resolved as a result of updates to the model since the peer review report was issued.

Question: 3

3) On page 8 of attachment 1 you state that the number of examinations in 42 of the 73 high safety significance (HS) segments was not developed using the Perdue methodology. You further stated that, [flor these 42 segments, the guidance in Section 3.7.3 of WCAP-14572, A-version was followed. Section 3.7.3 provides guidance on selecting inspection locations once the number of locations has been determined.

Please explain how you determined the number of inspection locations for the 42 segments for which the Perdue method was not applied.

Response to Question 3 For a segment with a small number of socket welds, the Perdue model analysis was performed and its relevance to the inspection strategy was determined.

Generally, for these segments a circumferential butt weld consisting of Alloy 82/182/600 material was the controlling location due to PWSCC concerns and the Perdue model was applicable and relevant. For segments that contained greater than 25% socket welds or were completely comprised of socket welds, the Perdue model was dismissed for evaluating the socket welds. The reason that the Perdue model was not used was that a pressure test was scheduled to be performed each refueling outage with a VT-2 visual examination to detect for any evidence of leakage. This approach provides an adequate inspection strategy for these socket welds as described in Relief Request RR-89-41. In the final analysis, the Perdue results showed that even with zero exams in the Region 1 (B) or 2 of Figure 3.7-1, Structural Element Selection Matrix within the WCAP, there is adequate assurance that segment leak rates will not exceed target values. Regardless of the socket weld issues related to the Perdue model application, within each high safety significant segment at least one weld was selected for examination. That weld was a circumferential butt weld when butt welds were located within the segment.

This is consistent with the requirements of the WCAP in section 3.7.3.

Serial No.04-155 RAI Risk-Informed IS1 Page 3 of 26 Question 4

4) The Summary Statement at the end of Table 5-1 states, Current ASME Section XI selects a total of 155 non-destructive exams while the proposed RI-IS1 program selects a total of 128 exams... Does the current ASME Section XI select a total of 155 non-destructive exams in the full population of Class 1 non-exempt welds, or from the population of non-exempt welds in the 73 HSS segments? If the current ASME Section XI selects a total of 155 non-destructive exams from the population of non-exempt welds in the 73 segments, how many non-exempt welds are in the full Class 1 population and how many ASME Section XI exams are selected from this population?

Response to Question 4 Please note that in the summary statement the proposed RI-IS1 program selects a total of [126 exams not] 128... The current ASME Section XI selection of 155 non-destructive exams is from the full population of 528 Class 1 non-exempt welds.

Currently in the 73 HSS segments, ASME Section XI also selects 155 non-exempt welds. In summary a total of 126 weld examinations have been selected under the RI-IS1 program consisting of 54 volumetric examinations and 72 visual examinations.

Question 5

5) In Table 3.4-1 Failure Probability Estimates (without ISI), please explain why stress corrosion cracking (SCC), thermal fatigue and vibration fatigue are not addressed as potential failure mechanisms for the Chemical and Volume Control System and High/Low Pressure Safety Injection systems. How will the failure probability be affected when they are considered as potential degradation mechanisms?

Response to Question 5 Piping failure mechanisms were decided based on review of actual piping configurations and components. This review concluded that SCC, thermal fatigue and vibration fatigue were not a primary concern for the Chemical and Volume Control system and High/Low Pressure Safety Injection systems Class I piping segments included in the RI-IS1 application. As such, there is no need to consider them in the failure probabilities at this time.

Question 6

6) There has been extensive industry experience concerning cracking of alloy 600 weld materials (Inconel 82/182) in the form of primary water stress corrosion cracking (PWSCC) degradation mechanism. This degradation mechanism has not been addressed in the Topical Report WCAP-14572, Rev 1-NP-1 A. In Table 5-1, Structural Element Selection, 95 welds are selected for volumetric examination in B-F

Serial No.04-155 RAI Risk-Informed IS1 Page 4 of 26 examination category in the reactor coolant (RC) system. Are these welds made of lnconel82/182? Please explain how PWSCC is addressed in your program.

Response to Question 6 There are only 28 Examination Category B-F welds in the RCS. All of these welds have lnconel 82/182 weld metal and are scheduled for volumetric examination under the RI-IS1 program and were selected for examination based on having a potential for PWSCC.

Any weld that had the potential of having PWSCC because of these materials was selected for examination regardless of its consequence or failure potential by the expert panel.

Question 7

7) Under what conditions would the RI-IS1 program be resubmitted to the NRC prior to the end of any 10-year interval?

Response to Question 7 DNC will use the guidance developed by the industry under the NE 04-05 Guidance Document, Living Program Guidance To Maintain Risk-Informed lnservice Inspection Programs For Nuclear Plant Piping Systems, which outlines the following to determine the conditions that would require the RI-IS1 program to be resubmitted to the NRC prior to the end of any 1 O-year interval. During an October 3, 2001, meeting between the NRC and the industry, it was agreed that the intent of the RI-IS1 template process is to provide the NRC with the information necessary to conclude with reasonable assurance that the licensees:

Conducted the RI-IS1 evaluation consistent with a topical report and its safety evaluation (SE), and The change in risk as a result of the RI-IS1 program is within acceptance criteria.

As such, the intent of the RI-IS1 template process is to provide a fixed snapshot in time of the RI-IS1 program and therefore, the following may change without requiring NRC approval or notification:

Delta risk numbers, provided they remain within acceptance criteria, Number of inspections, or Allocation of inspections.

Changing from one methodology to another, Changing the scope of application (see note below), for example NRC notification and approval would be required when:

o Class 1 only to Class 1 & 2, o Full scope to Class 1 only, Plant-specific impact of revised methodology on the SE, Significant industry/plant event, not addressed by generic/methodology

update,

Serial No.04-155 RAI Risk-Informed IS1 Page 5 of 26 ASME Section XI 10-Year updates as required by plant-specific SE, or Changes that impact the basis for NRC approval in the plant-specific SE are identified.

Note: Minor changes to Class boundaries (e.g., piping reroute, P&ID revisions) do not require re-submittal, as they do not impact the basis for the NRCs approval of the previous RI-IS1 submittal.

Question 8

8) Section 3.8 of the licensees submittal addresses additional examinations. It states, The evaluation will include whether other elements on the segment or segments are subject to the same root cause and degradation mechanism. Additional examinations will be performed on these elements up to a number equivalent to the number of elements initially required to be inspected on the segment or segments. If unacceptable flaws or relevant conditions are again found similar to the initial problem, the remaining elements identified as susceptible will be examined. No additional; examinations will be performed if there are no additional elements identified as being susceptible to the same service related root cause conditions or degradation mechanism.

ASME Code directs licensees to perform these sample expansions in the current outage. Confirm that the sample expansions of elements identified as being susceptible to the same service related root cause conditions or degradation mechanism will be completed during the outage that identified the flaws or relevant conditions.

Response to Question 8 Additional examinations or sample expansions will be completed during the current outage in which degradation, if any, is found.

Serial No.04-155 RAI Risk-Informed IS1 Page 6 of 26 II. RR-89-41 Question: 1

1) DNC stated in the submittal that VT-2 will be performed in lieu of volumetric examination for socket welds of any size and branch pipe connection welds of NPS 2 or smaller. What is the largest size of the socket welds?

Response to Question 1 The largest Class 1 socket weld is NPS 2.

Question: 2

2) DNC also stated that use of a volumetric examination would not provide any meaningful results... and that the use of the alternative (VT-2) provides an acceptable level of quality and safety. Please explain how a VT-2 examination can provide meaningful results. Please also explain if other non-destructive examination methods have been considered as an alternative which may provide more meaningful results than VT-2.

Response to Question 2 Specifically, this request centers on the requirements for volumetric examination as applied to socket welds and branch pipe connection welds under Item Number R1.ll of Table 4.1-1 of WCAP-14572, Rev. 1-NP-A. Welds determined to be potentially subject to thermal fatigue or welds with no known potential mechanism under this Table default to this mechanisms prescribed volumetric examination requirement. The requirement would be viable for areas of thermal mixing or rapid temperature changes and would be limited to pipe base material in these areas, but not for normal heatup and cooldown operation. The socket welds and branch pipe welds at MPS2 have not been found to be potentially affected by any of these conditions and, if they were, the geometry of these welds makes a volumetric examination virtually useless. If these conditions did exist, there are industry recommended volumetric examinations for the base metal adjacent to these welds that could be performed and would be considered to provide meaningful results (i.e., early detection of base metal cracking). That is not the case at MPS2. For the welds in this request, volumetric examinations will add personnel radiation exposure, outage time, additional expense, but provide no beneficial result. Additionally, the MPS2 evaluation under this process found that none of these welds would be subject to any outside initiated flaw. Thus, a surface examination would not provide meaningful or timely results, because a weld with one of these internally initiated mechanisms would have already leaked prior to finding anything with a surface examination. All of the socket welds and branch pipe welds evaluated under the MPS2 RI-IS1 program were determined to be either subject to potential vibratory fatigue, normal operating type thermal fatigue, PWSCC, or no mechanism at all.

Serial No.04-155 RAI Risk-Informed IS1 Page 7 of 26 This request was provided in accordance with 10 CFR 50.55a(a)(3)(ii) and is based on performance of a less than beneficial examination that represents a hardship and creates an unusual difficulty without providing an equivalent level of quality and safety.

What was stated in this request with specific limitations was that there would be no compensating increase in the level of quality and safety as a result of performing volumetric examinations on socket welds or branch connection welds. Although a VT-2 examination will also not identify an inside-initiated flaw, such visual examination may be useful in observing the onset of leakage prior to additional weld degradation.

Therefore, in conclusion for all of the mechanisms that were considered to have a potential for occurrence at MPS2, a VT-2 type visual examination is a viable alternative to the volumetric examinations required by Table 4.1-1 for socket welds and branch pipe welds NPS 2 and smaller.

Serial No.04-155 RAI Risk-Informed IS1 Page 8 of 26 ENCLOSURE 1 PRA Model Peer Review Comments Not Yet Resolved Peer Review Comment Level A Comments A. 1) The significant combinations of inverter failures should be modeled. (AS-4)

A.2) Incorporate the dependencies on AFW instrument air and indication power on the AFW flow control action. (AS-5)

A.3) Per the CEOG best estimate ATWS success criteria evaluation, a limit of 3700 psia is recommended to be used. In order to use 4300 psia as success, RV upper head lift issues must be considered in the analysis.

If a lower pressure is used, confirm the impact on the assumption of 1 of 2 PORVs instead of 2 of 2 PORVs as recommended by the CEOG best estimate evaluation. (AS-I 1)

A.4) Screening values are overused for operator actions. (HR-01)

Impact on RI-IS1 I

Inverter failures are modeled in the MP2 model; however, the loss of the combination of inverters may not be reflected accurately i.e.,

an inadvertent SIAS/SRAS. The impact on the LOCA event trees is not significant. Negligible impact on RI-ISI.

Given that only the LOCA event trees are evaluated for RI-ISI, the cumulative effect of a loss of instrument air or a station blackout event (i.e., where the batteries would be necessary), plus the failure of the operator to manually control AFW flow after 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> (loss of IA) or after 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> (loss of batteries) is considered insignificant. Negligible impact on RI-ISI.

For a Class 1 RI-IS1 Analysis, the only LOCA scenario, which addresses a subsequent ATWS is a small break LOCA. The frequency of a small break LOCA is 3E-O3/yr and the reactor trip failure probability is 1.65E-5/yr.

Given this, the combined frequency of having a small break LOCNATWS is 4.95E-8/yr which is considered negligible. Negligible impact on RI-ISI.

The subsequent model updates included the HRA analysis to provide a more detailed modeling of the more significant operator actions. For the large break LOCA tree there is one operator action, OABP (for boron precipitation control use of a screening value is acceptable because of the very long time involved - 8 to10 hrs) for the medium break LOCA tree there are no operator actions. For the small break LOCA tree, there is OABAF (failure to establish once-through cooling),

Serial No.04-155 RAI Risk-Informed IS1 Page 9 of 26 Peer Review Comment A.5) There does not exist any documented evidence in the Human Reliability analysis on the use of operator input for the calculation of human error probabilities. In addition, the Millstone PRA staff has stated that operator input was not used for the current HEP values. (HR-03)

A.6) The HRA analysis in some cases discusses the total time to take the action after the initiating event for the action but does not account for the diagnosis time and time required to take the action. (HR-09)

A.7) Use of the simplified recovery action estimator found in Appendix B of the HRA calculation seems overly simplistic. (HR-10)

A.8) HRA calculation identifies specific HRA dependencies that are not addressed by the recovery rules to preclude dependent recoveries, or make appropriate adjustments. (DE-6)

A.9) The MFW recovery factor, RECMFW, is being used to recover from LOCV and LMFW initiating events. Consider removing this recovery factor or significantly improve the documentation. (QU-09)

A.lO) The quantification report does not address (or appear to intend to address):

asymmetric modeling or evaluate the validity of cutset results due to asymmetric modeling or actual plant asvmmet ries Impact on RI-IS1 OADEP (failure to depressurize the secondary side), and OALTDAFW (operator action associated with a consequential SBO or a loss of DC) for which the screening value is acceptable, are very low frequency events.

Negligible impact on RI-ISI.

Operator input has been added to the model as a result of conversations with the MP2 Simulator Training personnel. Such input has been incorporated into Human Error Probabilities (HEP) such as OABAF.

Negligible impact on RI-ISI.

Since this comment has been made, changes have been made to provide a more detailed modeling to account for diagnosis time and required action time of some significant operator actions, OABAF being one of them.

Negligible impact on RI-ISI.

These recoveries are not dominant within the LOCA trees.

Negligible impact on RI-ISI.

There are no HRA dependencies within the current LOCA tree modeling. Negligible impact on RI-ISI.

The RECMFW factor was only used for a recovery following a loss of MFW. Since the MP2 RI-IS1 project only impacts the LOCA trees, the impact of this recovery action is insignificant. Negligible Impact on RI-ISI.

These comments on the quantification report should be documented but do not impact the RI-IS1 project.

The truncation limit was specified for the RI-IS1 calculations. Negligible Impact on RI-IS1

Serial No.04-155 RAI Risk-Informed IS1 Page 10 of 26 Peer Review Comment 0

truncation limit validation ImDact on RI-IS1 0

sensitivity analyses 0

uncertainty analysis 0

dominant component importance analysis (QU-11) 0 A. l l ) The quantification report and HRA report do not address the development of all the recovery actions.

Examples:

OACHGSWING and the OA*** events.

(QU-13)

Level B Comments 6.1) SGTR Frequency is based on the current version of the CEOG Standard.

Revised values were provided by e-mail in 1998, but the report has not been updated yet. Report will updated in 2000. (IE-1)

B.2) Spurious opening of PSVs or PORVs is not modeled. (IE-2)

B3) Pelform Bayesian update of IEs using industry values. (IE-5)

B.4)

Section 6.2.1 0, General Plant Transient, does not appear to address secondary system steam removal.

In Section 2, it states that the event tree node SGC addresses steam generator cooling. It identifies MFW and AFW as systems used to achieve this function. It does not include steam removal of ADVs, TBVs or main steam relief valves. (AS-3)

OACHGSWING is not in the current MP2 model. No other recovery actions were found within the LOCA trees that are not addressed in the Final Quantification. Negligible Impact on RI-IS1 An SGTR initiating event is not a Class 1 pipe break induced initiating event. Negligible impact on RI-IS1 Spurious opening of PORVs as a small LOCA initiator is not addressed in the small LOCA frequency because it is considered a

consequential LOCA, not an initiating event.

The conditional core damage probability in RI-IS1 would not be impacted by a consequential event such as spurious opening of a PORV or PSV. Negligible impact on RI-ISI.

The LOCA frequencies were based on industry data as well as on plant-specific data.

Negligible impact on RI-ISI.

Ample redundancy of steam relief is assumed.

Negligible impact on RI-ISI.

B.5) It is amarent that an undocumented I Amde redundancv of steam relief assumed.

Serial No.04-155 RAI Risk-Informed IS1 Page 11 of 26 Peer Review Comment assumption is made that ARN will succeed without reliance on ADVs, possibly due to the fact that AFW can feed against the MSSV lift setpoints. If this assumption is not valid, then loss of ADVs must be included in the failure mechanisms for AFW and SGC nodes in various event trees. The same assumption is made for the MFW pumps also.

Ref. T/H Calculation MP2-PRA 014 pg 10. (AS-9)

B.6) MFW Success Criteria does not require makeup to the condenser when steam dump valves fail. No documentation of the verification that adequate volume exists in the condenser was identified.

Ref. T/H calculation MP2-PRA-89-014 pg 10. (AS-

10)

B.7) In the old MP2 flood analysis, NU apparently assumes that all flood barriedflood doors will maintain their integrity under all conditions. There is no documentation of the flood door design bases that would support this implied assumption. (ST-03) 8.8) HS /CS Injection treated conservatively and applied. to small LOCAs. Use of HS/CS injection for large and medium LOCAs is in accordance with conservative design basis assumptions. HS/CS for small LOCAs is not necessary for small LOCAs even with DB assumptions. A more realistic treatment of the issue should reduce risk contribution, and simplify modeling. (TH-5)

B.9) ATWS does not reference the CEOG standard and uses head lift failure criteria.

The general approach used appears conservative since it relies on early generation CESEC calculations in early CE documents.

Modified calculations show reduced ATWS pressure threat.

This is Impact on RI-IS1 Negligible impact on RI-ISI.

MFW is not credited in any of the LOCA event trees. Negligible impact on RI-ISI.

Recommendation for the next model update.

Negligible impact on RI-ISI.

The injection model is recognized as overly conservative. This will be addressed in the next model update.. Negligible impact on RI-ISI.

For a Class 1 RI-IS1 analysis, the only LOCA scenario that addresses a subsequent ATWS is a small LOCA. The frequency of a small LOCA is 3E-O3/yr and the reactor trip failure probability is 1.65E-5.

Given this, the frequency of having a small LOCNATWS is 4.95E-8/yr and is considered negligible.

Serial No.04-155 RAI Risk-Informed IS1 Page 12 of 26

~

~~~~~~~

Peer Review Comment offset by a more aggressive approach to utilize the 4300 psia failure limit. Using this approach will require consideration of failure to reseat issues (hot side LOCA). (TH-7)

B. 10) Sump recirculation time calculation does not include CS injection.

Underestimate of operator time available.

(TH-11)

B.11) Timing results for actions following LOCAs appear conservative.

CY results may not be applicable to MP2. (TH-14)

B.12) Need to evaluate the need for ventilation for critical rooms including the AFW rooms and Control room. (TH-15)

B.13) It appears that the AFW motor and turbine driven pumps are both lngersoll Rand. The pumps appear similar enough to warrant common cause consideration of the pump itself. (SY-02)

B.14) Document basis for excluding the HVAC dependency to the AFW model. (SY-

03)

B.15) Following a reactor trip, the operators take control of AFW.

Without this, the steam generators could overfill. This is not modeled or documented in the AFW analysis. (SY-04)

B. 16) The failure probability of a component should be related to the surveillance interval. (SY-05)

Impact on RI-IS1 Negligible impact on RI-ISI.

Switchover to sump recirculation (SRAS) is automatic.

No credit is taken for manually switchover, so the operator action time has a Negligible impact on RI-ISI.

See the response to Comment #A.4 above.

Negligible impact on RI-ISI.

The AFW room does not have a ventilation system and the control room is manned and any loss would be noticed quickly. HVAC has been modeled and further enhancements are needed. Negligible impact on RI-IS1 There is a possibility of the shaft and impeller of the pumps having a common cause failure potential; however, this is relatively small when compared to the other portions of CCF, which are not comparable.

Negligible impact on RI-IS1 The AFW rooms do not have an HVAC system. Negligible impact on RI-IS1 The impact of operator action to control AFW would be of low significance due to the familiarity of this action and the training. Other failures of the AFW system would probably dominate. Negligible impact on RI-IS1 This contradicts the WOG-peer review comment for Unit 3, which resulted in Millstone removing the impact on surveillance intervals.

This conflict in comments will be addressed in the future. Nevertheless the comment poses no significance. Negligible impact on RI-IS1

Serial No.04-155 RAI Risk-Informed IS1 Page 13 of 26 Peer Review Comment B.17) In the ESAS fault tree, the failures of isolators and power supplies are not considered.

The analysis states that isolators are passive and therefore do not need to be considered. Isolators are no more passive than transformers, which are typical considered.

Power

supplies, especially those associated with ESAS actuation, can be a significant contributor.

ESAS power supplies often cross safety signals. (SY -08)

B.18) PSA Guideline #4 System Modeling, Section 4.8.2, application of modeling assumption to neglect passive components may be too general. Example - Failure of 2-MS-202/201 to remain open is likely not to be two decades less than the failure of 2-MS-4B/4A to open. The basis for screening the passive components is that the failure likelihood of the passive component is two decades less than the next most dominant contributor. In certain cases, this is not met.

Model may provide a reasonable estimate of plant risk, but component risk may be obscured. (SY-09)

B. 19) PSA Guideline #4 System Modeling Section 4.8.2, assumption to neglect modeling passive components may hide their importance when performing analyses with equipment 00s. Given an application of the model in which the component is configured as running, but must continue operation then this modeling technique could indicate that essential will not fail, since passive failures are neglected and fail to stadtransfer would be false. Model may provide reasonable estimate of plant risk as long as the limitations are recognized and addressed when evaluating the risk insights.

(SY-10)

B.20)

Common cause failure of the Impact on RI-IS1 The treatment of isolators and power supplies should be appropriately addressed but these elements are not dominant contributors to risk.

Negligible impact on RI-IS1 Passive components are generally not assumed to contribute a significant amount to CDF by adding. Negligible impact on RI-ISI.

For this RI-IS1 application, the analyses is only performed with equipment in service (no analyses performed with equipment 00s).

Negligible impact on RI-ISI.

The CCF methodology will be reviewed in the

Serial No.04-155 RAI Risk-Informed IS1 Page 14 of 26 Impact on RI-IS1 next model update. For this application, this comment is not considered significant since the combination of a LOCA and a loss of normal power is considered a low frequency event. Negligible impact on RI-ISI.

Peer Review Comment sequencers not modeled. (SY-11) 6.21) In the RWST and Containment Sump recirculation analysis, PRA97YQA-02032-S2 Section 6.2.1, page 20 states that containment sump screens will not become plugged during recirculation. This is not a standard assumption and would need strong justification.

It is recommended that this failure mode be included in the model. The industry currently has several ongoing programs to look at the issues associated with Sump blockage for PWRs which may provide resolution to this issue. (SY-13)

B.22) Provide justification for PSA Guideline

1. 12 Section 5.3 method to screen inadequate plant data to perform updates.

Assuming plant data indicates a high failure rate (although the number of demands appears inadequate by the criteria stated) failure to incorporate this plant specific data and apply the generic mean failure rate to the component fails to properly assign a valid failure rate. (DA-01)

B.23) Calculation PRA98YQA-0261O-S2, MP2 Data Analysis, page 7, Assumption 4.

The assumed value of.33 when no failures have been experienced is rather unusual.

There are several processes for dealing with the zero failure condition, one of these is discussed on page 17 of PRA99YQA-02900-S2. The equation used is E(n,t) =

(2n+l)/2t.

For the zero failures, this The industry failure rates are on the order of 1 OE-5 to lOE-O6/hr. This would result in sump screen clogging contributing a 1-1 0% increase in the overall sump recirculation unavailability.

However, recovery actions such as refilling the RWST and switching back to the injection mode could be credited to reduce this contribution. Los Alamos National Lab (LA-UR-02-7562) performed a study entitled The Impact of Recovery From Debris-Induced Loss of ECCS Recirculation on PWR Core Damage Frequency which concluded that recovery actions will substantially reduce the CDF with debris effects for all plants. We conclude that these recovery actions would mitigate any increase assumed due to this effect. Assume negligible impact on RI-ISI.

The guideline is no longer used. The model database is scheduled for review in the upcoming 2004 model update.

Negligible impact on RI-ISI.

Need to document the basis for the.33 value or switch to a more standard approach.

Negligible impact on RI-ISI.

Serial No.04-155 RAI Risk-Informed IS1 Page 15 of 26 Peer Review Comment essentially assumes.5 failures in time t.

(DA-02)

B.24) Electrical power fault tree does not appear to include an event to account for a LNP induces by grid instability caused by the plant trip. One plant trip induced LNP has occurred in the industry. Model the probability of a plant trip induced loss of offsite power in the electrical system fault tree. (DA-05)

B.25) PORV Unavailability:

A statement from the plant PSA staff indicated that one reason for using a 1 of 2 instead of 2 of 2 PORV success for ATVVS pressure relief was due to high PORV unavailability. The data calculation states that there was no unavailability for the 3 yrs of MR data used and thus a 1E-04 value was used. It should be confirmed that this low value is appropriate. For Feed and Bleed: PORV unavailability is ANDed with the block valve to open. This assumes that all PORV unavailability would be recoverable. If the PORV is determined to be inoperable (e.g.

other than just some leakage), the block valve would likely be closed with its breaker open and thus the PORV would not be recoverable.

PORV U navailabi I i ty Basic Events:

There are different PORV unavailability basic events used in the fault tree (one for failure of auto pressure relief and one for failure of F&B). (DA-08)

B.26) There is no operator error for miscalibration of RWST level sensors leading to an early SRAS. An early SRAS would result in the LPSl pumps being tripped and the HPSl and CS pump suction being switched to the sump.

If there is limited inventory in the sump, there is potential for the pumps to failure on low NPSH in the sump. (HR-021 Impact on RI-IS1 The LNP frequency in the model has been modified to the grid-related, weat her-related and plant-centered initiating events.

Negligible impact on RI-ISI.

For a Class 1 RI-IS1 analysis, the only LOCA scenario, which addresses a subsequent ATWS is a small LOCA. The frequency of a small LOCA is 3E-O3/yr and the reactor trip failure prob. is 1.65E-5.

Given this, the frequency of having a small LOCA/ATWS is 4.95E-8/yr.., which is considered negligible.

For once-through cooling, not all PORVs that are out-of-service due to maintenance (1 E-04) can be recovered by opening the PORV.

However by not crediting the block valve opening, this 00s unavailability contributes about 1% to the overall OTC unavailability assuming no recovery. A value of 2E-03 is used for both the auto pressure relief and OTC.

Negligible impact on RI-ISI.

This was addressed in an earlier MP2 LPSl fault tree analysis, which noted that a gross miscalibration of 2 of the 4 RWST level transmitters would have to occur. This was not considered a credible event. The combined allowable error between the bistables and level transmitters is approximately 39%, with most error allowed in bistable calibration.

Additionally. A channel check of the level

Serial No.04-155 RAI Risk-Informed IS1 Page 16 of 26 ImDact on RI-IS1 transmitter as it relates to the low level bistable trip is done by each shift; a channel functional check is done on a monthly basis and calibration is performed every refueling outage.

Negligible impact on RI-ISI.

Peer Review Comment B.27) Document the basis for the calculator used in HRA analysis (HR-07) 8.28) The time available to perform a human action, the time required to perform the action and the bases for both are not always provided for the applicable actions.

This lack of information makes it impossible to verify the appropriateness of the HEP values used for each action. (HR-08)

B.29) OAADV1 (potentially not used) is an action Local Manual Operation of an ADV that is used for feed and bleed.

In the dependency section of the action description, it states that OABYPASS and OATDAFW, operator fails to start the terry turbine, appear in cutsets with OAADV1. It appears that if the Terry Turbine action fails, due to other than hardware, then the OAAVD1 should fail. OACST (operator fails to provide makeup to the CST) is redundant to the initiation of SDC. This dependency is addressed by increasing the combined failure rate by a factor of 10 (OACSTSDC).

Although it appears that the OACST action is very conservative, it appears that there two actions have complete dependency. If a failure to makeup to the CST occurs due to human error not hardware, a relative easy action then it is hard to fathom the operators pursuing initiation of SDC. However, if CST makeur, fails due to hardware then initiation The method to calculate the HRA probabilities uses the HRA Toolbox program.

This comment is one of documentation and has a Negligible impact on RI-IS1 Within the LOCA trees, large LOCA contains one operator action - OABP (screening value acceptable due to the long time involved 8-1Ohrs.) medium LOCA contains none and small LOCA contains OABAF, OADEP (=1.0) and operator action associated with a

consequential SBO or Loss of DC (OALTDAFW screening value acceptable, very low frequency event). Negligible Impact on RI-IS1 OASWSYS is no longer in the model. There is no detailed discussion on the factor of 10 when dependency between operator actions is found. However, these operator actions are found in other event trees than the LOCAs such as SGTR and LNP. The small LOCA event tree is now combined with the small LOCA tree and is no longer modeled separately. Negligible impact on RI-ISI.

Serial No.04-155 RAI Risk-Informed IS1 Page 17 of 26 Peer Review Comment of SDC as a recovery would be reasonable.

The factor of 10 increase in failure probability for dependent actions which is used for several dependent actions has no identified bases (example: OACSTSDC, OARWSTSDC, OASWSYS) (HR-12)

B.30) Action OARDC1 (0.1) is used in the recovery rule file to replace actions OADCALTCHG and OARDCI.

The apparent dependency between OADCALTCHG and OARDC1 is not discussed in the HRA calculation discussion for these actions.

OARDC1 is not discussed in HRA or QU calculations, it only appears in the rule file.

Confirm other dependencies between actions listed in rule file are discussed in HRA calculation. Also, OARWST, OATDAFW, OALTDAFW, and OATRIPRCP are only addressed in the rule, i.e., no discussion in the HRA or QU calculation. (HR-13)

B.31) References in EOPs and AOPs used to support various human actions are weak and when stated do not include the revision number. This makes configuration control difficult. (HR-16)

B.32) The description of operator should clearly identify the bounding conditions for which the HEP was calculated. (HR-17)

B.33)

Detailed guidance on the development of dependencies is not available. Support system dependencies on Initiating Events are not fully identified.

LOSSDC top logic is not identified in the flag file to document the system dependencies.

(DE-02, DE-05)

B.34) There is no current flood evaluation.

ImDact on RI-IS1 OARDC1 and OADCALTCHG have been deleted from the model.

OATRPRCP has been deleted and OAPRCPTRIP is now modeled in more detail.

OARWST (only modeled after SGTR), OATDAFW (modeled after SBO) and OALTDAFW (modeled after total loss of DC) are discussed in the updated HRA analysis. Negligible impact on RI-ISI.

Revisions have been made to the HRA documentation, as discussed in previous responses above.

The documentation references the EOP or AOP and the revision number. This will continue to be done in the future of HRA updates. Negligible impact on RI-IS1 Although this is a good practice to follow, it has a Negligible impact on RI-IS1 This guidance is being addressed as part of the Dominion capital project on PRA model improvement,. Dependencies have now been accounted for in the model. Negligible Impact on RI-IS1 The imDact of floodina was addressed bv the

Serial No.04-155 RAI Risk-Informed IS1 Page 18 of 26 Impact on RI-IS1 RI-IS1 Expert Panel.

The existing flood evaluation will provide input into this assessment as well as input from experts on the panel. Negligible impact on RI-IS1 Peer Review Comment The old flood evaluation is largely qualitative approach. (DE-08)

B.35)

Directly link references to dependencies and provide a summary for the scope of the dependency evaluation for each system. (DE-09)

B.36) In the old MP2 Flood analysis, NU apparently assumes that all flood barrier/flood doors will be maintain their integrity under all conditions. There is no documentation of the flood door design bases that would support this implied assumption. (ST-03)

B.37) The quantification report does not describe the actual process undertaken to perform the quantification including the development of the sequence failure and success cutsets, mutually exclusive and recovery files and delete term for the purpose of performing the validation of the event trees prior to the conversion of the master fault tree. (QU-02) 8.38) In cutset 12, the OARDC recovery is being used to recover from a hardware failure, DCBKDO103NF. (QU-08)

B.39) Millstone did not perform any uncertainty analyses for this quantification of the PSA and they did not document any sensitivity studies on the impact of key assumptions as part of this PSA update.

Although the data calculation included error factors and their code has the capability to easily perform numerical uncertainty analyses, Millstone did not populate the database with the error factors. (QU-16)

This guidance is being addressed as part of the Dominion capital project on PRA model improvement. Dependencies have now been accounted for in the model.

Negligible Impact on RI-IS1 The impact of flooding was addressed by the RI-IS1 Expert Panel.

The existing flood evaluation will provide input into this assessment as well as input from experts on the panel. Negligible impact on RI-IS1 Although the quantification documentation is not detailed, this does not mean it was done incorrectly.

The documentation is being upgraded as part of the capital project.

Negligible impact on RI-ISI.

OARDC is no longer modeled. No impact on RI-ISI.

This recommendation will be addressed during the next model update. The present analysis is considered to be bounding.

Negligible impact on RI-ISI.

Serial No.04-155 RAI Risk-Informed IS1 Page 19 of 26 Peer Review Comment 6.40) As part of the planned update, prepare a table listing the CET fault tree basic event values for each of the PDSs which are propagated through the CETs.

(L2-02)

B.41) T-l SGTR sequences based on 50%

degraded tubes and WOG 1/7 scale results.

This assumption may under-estimate SG releases that may be included in early releases. (L2-04)

B.42) NU does not have a LERF analysis for the latest PRA update. (L2-05) 6.43) During the initial presentations several pending changes or open items were identified including:

updating the flood analysis addressing the induced steam generator tube rupture updating the success criteria to reflect changes such as the new steam generators updating Level 2 analysis from MAAP 38 to version 4.0 improving the human action analysis that currently is heavily dependent on screening values These and potentially other open items are not being formally captured thus allowing the PRA results to be viewed in light of the identified weaknesses. This process of identifying and capturing PRA weaknesses is critical to achieving an as-built, as-operated PRA.

(MU-02)

ImDact on RI-IS1 This is a documentation issue with no significant impact on RI-ISIL. Negligible impact on RI-ISI.

For a Class 1 RI-IS1 analysis, only the LOCA initiators are of importance, not SGTR.

Negligible impact on the RI-ISI.

The LERF Analysis has been tied to the latest update. Negligible impact on RI-ISI.

Dominion PRA has implemented a PRA Configuration Control

database, which captures all proposed PRA changes.

Negligible impact on RI-ISI.

Serial No.04-155 RAI Risk-Informed IS1 Page 20 of 26 ENCLOSURE 2 PRA Model Peer Review Comments Which Are Resolved 4

Level A Comments A.l) Operator actions for ISLOCA are treated with screening values. Error rate seems high and should be conservative (0.01). Include statement with reference that opening of the relief has been judged to be sufficient to avoid. (IE-3)

A.2) All of the documents associated with the Millstone 2 PSA have a signoff block for independent review and independent review is required. None of the documents were signed, but this is because NU is in the process of finalizing the latest update of the PSA. (IE-8)

A.3) SMALL LOCA: The success criteria for containment cooling is PP OR 1 CAR FAN.

Top branch shows no CD if CS OR FANS are successful. Bottom branch shows no CD if CS is successful and CD (SLFL1-15) if fans are successful. Should SLFL1-15 BE PD instead of CD? (AS-7)

A.4) F&B Methodology reflects new steam generator design (lower inventory at SG low level). No success credited under any circumstances without ADVs. No modified criteria for longer term F&B scenarios.

Analyses consider EOP only trip two, leave two. Table is confusing in that a 14.5 minute minimum time is provided. However table discusses 20 and 30 minute times only. 15 minute is used in actions. Longer times based on early generation analyses and need to be redone (TH-10)

A.5) Credit was taken for the MP1 emergency generator as a backup power supply to unit 2. fail to run and fail to start events (AC5DG15Gll FN Operator actions for ISLOCA refer mostly to the failures to diagnose such event in the charging line relief valves. The current value in the model is 0.1. This factor will be evaluated again in the next model upgrade.

Documentation issue. The documentation has been completed and signatures affixed.

The small LOCA event tree has been changed through recent model updates. The SLFL1 sequence in the new tree indicates that if the sump recirculation is not successful, eventual core damage will occur.

New success criteria for feed-and-bleed have been established, based on MAAP 4 analysis of various mitigating equipment availability.

The results show that it is possible to perform successful F&B without ADVs if at least one MSSV is available in each steam line.

MP1 emergency generator is no longer used as a back-up power supply for Unit 2. This function is now provided by Unit 3 SBO diesel generator and the units station transformers.

Serial No.04-155 RAI Risk-Informed IS1 Page 21 of 26 Peer Review Comment AC5DG15Gll NN) were included in the fault tree. The failure rates for these are different than used for the unit 2 A AND 9 DGs.

The bases for the unit 1 DG failure rates do not appear to be documented in the data calculation. (DA-03)

A.6) Human Action OARDC1 is used to recover the Number 1 Sequence. The write-up for the description of this action is Blank. It is unclear what action is taken for this recovery. This problem also exists for Actions OARDC1 and OASWALIGN. (HR-

05)

A.7) OPERATOR ACTION OAMP1 XTIE (ALIGN POWER FROM UNIT 1): HRA calculation shows a 1.0 failure prob. Per the calculation discussion, the reason for the 1.0 probability is at least in part due to this being a stressful and complex task, and the entire procedure has never been accomplished. The quantification results show that the number 2 cutset contains this action with a 0.104 prob. The 0.104 must be justified in the HRA calculation or set to 1.0.

(HR-11)

A.8) The actions in the recovery rule file that are considered to be dependent are replaced with a new action with a higher probability. It should be confirmed that potentially important cutsets were not truncated due to quantification with the two dependent actions ANDed (i.e., the cutsets were truncated and not found by QRECOVER, thus the new action with the higher probability could not be added). (HR-

14)

A.9) OPERATOR ACTION OABAF: This bleed and feed action is in the model with a 0,l probability, This action is not documented in the HRA calculation. (HR-How Resolved The failure rates for these components are documented in the Unit 3 PRA model.

~~~~

~~

The AC power distribution fault tree has been updated to reflect the current alignment with the Unit 3 back-up power sources. These human action events are no longer credited in the new model.

Unit 1 is being decommissioned and is no longer the back-up power source to Unit 2.The new operator action modeled is OAM3SBODG and denotes the alignment of the Unit 3 SBO diesel generator to supply power to Unit 2 during station blackout. The HEP factor is documented in the Unit 2 HRA notebook.

This is typically considered as part of the overall review of the new PRA model update before its release into the production mode.

The bleed-and-feed model has been modified as a result of new success criteria for once-through cooling. The operator action is OAPBAF and is documented in Unit 2

Serial No.04-155 RAI Risk-Informed IS1 Page 22 of 26 Peer Review Comment

15)

A.lO) The following inadequacies were noted in the model update process:

How Resolved notebooks.

These issues have been addressed in the guidance developed as part of the capital The guideline on capturing PRA changes A.11) The quantification report describes the projects for PRA model upgrades within basic quantification method, but the process is difficult to follow unless knowledgeable about the CAFTA code and the specific steps to follow. No basis was provided for the process of developing the delete term logic and the recovery patterns, although an explanation of the purpose of the mutually exclusive file (MPZMUT) and recovery rule file (MP2RULE). (QU-01) is limited to plant changes.

Many changes to the PRA are the result of modeling issues, industry information and equipment performance issues.

These issues do not appear to be captured.

The guideline has a table that lists various PRA Model Inputs.

In the Conclusion section of this table it indicates that many of the inputs do not have in-place processes to identify the potential changes. For example: Design changes - Process in place is not working. Change to the DCM Procedure is necessary and Tech. Spec. Changes

- SAB Manager is the formal link that needs to be linked to PRA The specification for what a high priority change and low priority change is not provided.

The time frame for incorporating changes appears to be aggressive, 60 days after change (high) and 90 days after refueling outage if low except that they can be extended indifferently.

Therefore, changes could be pending for an extended period of time.

etc. (MU-01)

This is a

documentation issue.

The quantification method is being documented as part of the transition of the existing PRA calculations to the notebook format, based on the new ASME PRA standard.

Dominion PRA.

Serial No.04-155 RAI Risk-Informed IS1 Page 23 of 26 Peer Review Comment

~~

~~

~

A.12) The current status of the quantification was inadequate to perform a quality review of these PSA subelements. The PRA had been quantified with the top 500 cutsets provided, but final documentation of the results, analysis of the dominant cutsets, evaluation of the initiating event contributions, etc., were not complete at the time of the review. (QU-03)

A.13) Many of the dominant sequences are a result of the loss of 125 VDC. Apparently, on January 1, 1981 the supply breaker (DO 103) to the 125V DC load center 201 A was open during ground checks resulting in a reactor trip. NE personnel feel that this is readily recoverable. As a result, a recovery factor of 10% (OARDC1) is used for 125 VDC IEs %LDCA and %LDCB. The appropriateness of this factor is not documented in the HR report. All of the description fields are blank. Further, even if DC power is recovered this should cause a plant trip. Therefore, the plant trip frequency should be increased. (QU-05)

A.14) In general, operators or someone knowledgeable in recovery possibilities should review the Millstone sequences.

Many of the top sequences appear recoverable. For example, many of the top sequences relate to loss of 125 VDC. This fails MFW and disables breaker control for an AFW motor driven pump. No credit is taken for manually closing the breaker even though no other decay heat removal recoveries are credited. This leads to significant overestimation of the CDF contribution for these seauences. (QU-061 B.l) Many initiators are subsumed into the General Plant Transient (GPT) category and How Resolved This is a documentation issue. See the resolution of the A.10 comment above.

The DC power fault tree has been updated.

The OARDCI recovery factor has been deleted, since the plant modification after the 1981 event precludes such operator error from occurring again.

Top sequences are now being routinely reviewed for recoveries during the quality reviews of an updated PRA model.

Initiators such as a loss of condenser vacuum are now part of the steam generator cooling

Serial No.04-155 RAI Risk-Informed IS1 Page 24 of 26 Peer Review Comment the Loss of Main Feedwater. There is no evidence that the progression of initiators, such as loss of condenser vacuum, were evaluated to ensure that they were consistent with the progression models for GPT or LMFW as appropriate. Note that for general transients, NU used only plant specific data and did show exactly where each trip was mapped. (IE-4)

B.2) The total frequency for LNP at Millstone is given as 0.024. This is about 1/2 of the latest generic frequency for LNP. A review of PRA99YQA-02900-S2, shows that NU excluded a large number of Industry Loss of Power events, including 4 of the 5 events that occurred at Millstone, from the calculation of the LNP frequency. There is limited documentation on the basis for excluding specific events. The process did assume that all events that occurred when a plant was shutdown should be excluded.

This is not necessarily a valid assumption.

(IE-6)

B.3)

Section 6.2.1 0, General Plant Transient, states that many different initiators that cause a similar plant transient are included in the GPT event tree. On review of the initiating event analysis it appears that the initiating event of loss of condenser vacuum is included as one of the GPT initiating events. If this is the case, then when the questioning Event Tree Node SGC, Steam Generator Cooling, Main Feedwater would need to be set to failure to make the event tree bounding or the loss of condenser vacuum needs to be addressed with a separate event tree. If loss of condenser vacuum is not included in the GPT, then this initiating event needs to be addressed. (AS-I)

B.4) SMALL-SMALL AND SMALL LOCA:

How Resolved node. The SGC model has been revamped to add credit for the Condenser pumps as an additional option for removing the decay heat.

The LNP frequency in the model has been modified to include the grid-related, weather-related and plant-centered initiating events.

The data used to calculate the frequency of each category is based on the EPRl report TR-110398: Losses of Offsite Power at US Nuclear Plants and spans years 1984-1 997.

The SGC node has been modified. The total loss of MFW is one of the gates in the node, with the total failure probability of 0.288, combined with the probability of operator Failure to recover the system.

Small-small LOCA has been combined with

Serial No.04-155 RAI Risk-Informed IS1 Page 25 of 26 Peer Review Comment why isnt B&F credited for heat removal if AFW fails?

TH CALC STATES:... Therefore, small breaks (as well as small-small breaks) require decay heat removal via main or auxiliary feedwater. For small break LOCA, opening a PORV would also be adequate. (AS-6) 8.5) The event tree analysis uses an RCP Seal failure probability of 8.91E-5 for four seal stages failing given that the affected RCP(s) have been tripped within 60 minutes. The reference for this value is stated as CENPSD-755, Reactor Coolant Pump Seal Failure Probability Given a Loss of Seal Injection. This reference is known to have calculated an optimistic number. (AS-

8)

B.6) Boron precipitation control is assumed required for small and medium LOCAs. This assumption for small LOCAs is probably overly conservative.

Some additional evaluation could likely justify that this requirement is conservative for medium LOCAs. Additional evaluation for large LOCAs could possibly demonstrate that the time for initiation could be extended beyond 24 hrs. (AS-I 2)

B.7) Plant specific analyses used for many scenarios. Generally this is a strength.

However, some calculations used for event timings were referenced to CY. Unclear how this information is used in MP2 PSA.

RELAP 5-Mod 2 used for F&B (strength) however many analyses use early plant conditions and less sophisticated codes.

Timings for these analyses will be distorted.

For RELAP calculations, this issue appears to be met. (TH-8)

B.8) Do not use IREP for Calvert Cliffs as How Resolved the small LOCA tree. In the revised event tree the bleed and feed question is asked if the Steam Generator cooling is lost. This is now factored in the fault tree for small LOCA.

The RCP seal failure methodology in the model has been modified. It is now based on the CEOG report CE NPSD-1199-P. This model will be subject to another review and update in the next PRA model upgrade.

The boron precipitation control model has been removed from the small and medium LOCA fault trees.

The thermo-hydraulic analysis has been updated using the MAAP and RELAP codes.

The references to CY event timings are not used anymore. The success criteria were updated based on the new analysis.

The reference to IREP for Calvert Cliffs is

Serial No.04-155 RAI Risk-Informed IS1 Page 26 of 26 Peer Review Comment Calvert Cliffs doesnt support its general conclusions.

CR item conclusion is generally consistent with current Calvert Cliffs PSA. (TH-12)

B.9) In AFW, the common cause factors noted in 98YQA-02394-S2 Section 6.2.4 do not match the basic event factors in 98YQA-02394-S2, Attachment B, pg. 2.

(SY-16)

B.lO) The LNP initiating event frequency is given as 3.7E-02 in MP2 data Analysis (PRA98YQA-0261O-S2)

Table 6.4.1, Initiating Event Frequencies. This is based on Reference 16 (NUSCO Calculation PRA98YQA-Ol013-SG LOP Frequency Calculation Rev.

0).

However, the quantification uses a lower LNP value of 2.4E-02. (As shown in the Cutsets with Descriptions Report). The 3.7E-02 is closer to the industry value. (DA-06)

B.ll) Millstone uses the CAFTA R&R Workstation with the RELMCS solution engine. This tool is one of the industry standards. However, Millstone does not have a formal software control process in place to ensure that the version being used is producing consistent and correct results.

(QU-04)

B.12) It is overly conservative to always assume a 24-hr. mission for the EDGs.

(QU-07)

How Resolved assumed to refer to the upper boundary of the medium LOCA breaks. The primary reference for these break size classification is the Combustion Engineering report CEN-114-P.

The Calvert Cliffs IREP is mentioned as a secondary reference.

The data in Section 6.2.4 is correct. The data in Appendix B (the U-Factor) is incorrect. The RI-IS1 analysis used the correct data.

See the response to comment #B.2 above.

The grid-centered LNP frequency is 3.1 E-3.

The weather-related LNP frequency is 5.2E-3.

The plant-centered LNP is 2.25E-2.

The RELMCS solution engine has been replaced with the FORTE solution engine.

There is now a formal software control process in place.

The 24-hour EDG mission time assumption has been deleted and replaced with the probability of recovering AC power as a function of time. The analysis is part of the documentation basis for the updated PRA model.