RS-09-152, Dresden, Units 2 & 3 and Quad Cities, Units 1 & 2 - Request for Amendment to Technical Specification 3.1 .7, Standby Liquid Control (SLC) System: Difference between revisions

From kanterella
Jump to navigation Jump to search
(Created page by program invented by StriderTol)
(Created page by program invented by StriderTol)
 
(2 intermediate revisions by the same user not shown)
Line 1: Line 1:
{{Adams
#REDIRECT [[RS-09-152, Request for Amendment to Technical Specification 3.1 .7, Standby Liquid Control (SLC) System]]
| number = ML093140516
| issue date = 11/10/2009
| title = Dresden, Units 2 & 3 and Quad Cities, Units 1 & 2 - Request for Amendment to Technical Specification 3.1 .7, Standby Liquid Control (SLC) System
| author name = Hansen J L
| author affiliation = Exelon Generation Co, LLC, Exelon Nuclear
| addressee name =
| addressee affiliation = NRC/Document Control Desk, NRC/NRR
| docket = 05000237, 05000249, 05000254, 05000265
| license number = DPR-019, DPR-025, DPR-029, DPR-030
| contact person =
| case reference number = RS-09-152
| document type = Letter type:RS, License-Application for Facility Operating License (Amend/Renewal) DKT 50, Technical Specification, Amendment
| page count = 216
}}
 
=Text=
{{#Wiki_filter:Exelon Generation www.exeloncorp.co m 4300 Winfield Road Warrenville, IL 6o555 RS-09-152 November 10, 2009 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D.C. 20555-0001 Dresden Nuclear Power Station, Units 2 and 3 Renewed Facility Operating License Nos. DPR-19 and DPR-25 NRC Docket Nos. 50-237 and 50-249 Quad Cities Nuclear Power Station, Units 1 and 2 Renewed Facility Operating License Nos. DPR-29 and DPR-30 NRC Docke t Nos. 50-254 and 50-265 Exelt5n. N ucl e aT 10 CFR 50.90
 
==Subject:==
Request for Amendment to Technical Specification 3.1.7, "Standby Liquid Control (SLC) System" References
: 1) Letter from M. A. Satorius (U. S. NRC) to C. M. Crane (Exelon Generation Company, LLC), "Notice of Enforcement Discretion for Exelon Generation Company LLC Regarding Quad Cities Nuclear Power Station, Unit 1 (NOED 06-3-01)," dated October 18, 2006 2) Letter from M. A. Satorius (U. S. NRC) to C. M. Crane (Exelon Generation Company, LLC), "Notice of Enforcement Discretion for Exelon Generation Company LLC Regarding Dresden Nuclear Power Station, Unit 2 (NOED 07-3-01; TAC MD4044)," dated January 24, 2007 In accordance with 10 CFR 50.90, "Application for amendment of license or construction permit," Exelon Generation Company, LLC (EGC) requests an amendment to Appendix A, Technical Specifications (TS) of Renewed Facility Operating License Nos. DPR-19 and DPR-25 for Dresden Nuclear Power Station, Units 2 and 3 (DNPS), and Renewed Facility Operating License Nos. DPR-29 and DPR-30 for Quad Cities Nuclear Power Station, Units 1 and 2 (QCNPS).
November 10, 2009 U. S. Nuclear Regulatory Commission Page 2 The proposed amendment revises Technical Specification (TS) 3.1.7, "Standby Liquid Control (SLC) System," to extend the completion time (CT) for Condition B (i.e., "Two SLC subsystems inoperable
.") from eight hours to 72 hours. In References 1 and 2, the NRC exercised discretion to not enforce compliance with the actions required in TS 3.1.7, Condition B for Quad Cities Nuclear Power Station and Dresden Nuclear Power Station, respectively. These notices of enforcement discretion (NOEDs) provided a 72-hour extension to the eight hour CT specified in Required Action B.1. This extension enabled each site to avoid a TS-required shutdown while implementing repair and restoration activities for the SLC system. EGC has utilized the guidance in Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," to develop the technical basis of this license amendment request. The EGC analysis demonstrates, with reasonable assurance, that the proposed license amendment satisfies the risk acceptance guidelines in Regulatory Guide 1.174 and Regulatory Guide 1.177, "An Approach for Plant-Specific, Risk-Informed Decision-making
: Technical Specifications
." The proposed license amendment meets the intent of very small risk increases consistent with the NBC's Safety Goal Policy Statement. EGC Probabilistic Risk Assessment (PRA) maintenance, update processes, and technical capability evaluations provide a robust basis for concluding that the PRA is suitable for use in risk-informed licensing actions. Additionally, a PRA technical adequacy evaluation was performed consistent with the requirements of Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 1. This request is subdivided as follows: o Attachment 1 provides a description and evaluation of the proposed changes. o Attachment 2a provides a mark-up of the DNPS TS page with the proposed change indicated. o Attachment 2b provides a mark-up of the QCNPS TS page with the proposed change indicated. o Attachment 3a provides the marked-up DNPS TS bases pages, with the proposed changes indicated. This attachment is provided for information only. o Attachment 3b provides the marked-up QCNPS TS bases pages, with the proposed changes indicated. This attachment is provided for information only. o Attachment 4 provides the risk assessment that supports the proposed TS change for DNPS (i.e., RM Documentation D-LAR-01, Revision 2). o Attachment 5 provides the risk assessment that supports the proposed TS change for QCNPS (i.e., RM Documentation QC-LAR-02, Revision 2).
November 10, 2009 U. S. Nuclear Regulatory Commission Page 3 The proposed amendment has been reviewed and approved by the DNPS and QCNPS Plant Operations Review Committee and the Nuclear Safety Review Board in accordance with the requirements of the Quality Assurance Program and procedures. EGC requests approval of the proposed amendment by November 11, 2010, with implementation within 60 days of issuance. In accordance with 10 CFR 50.91, "Notice for public comment," EGC is notifying the State of Illinois of this application for amendment by transmitting a copy of this letter and its attachments to the designated State Official. There are no regulatory commitments contained within this letter. If you have any questions or require additional information, please contact Mr. John L. Schrage at (630) 657-2821. I declare under penalty of perjury that the foregoing is true and correct. Executed on the 10th day of November 2009. Jeffrey L'-bfarisen Manager - Licensing Attachment 1: Evaluation of Proposed Amendment Attachment 2a: Proposed Markup of DNPS Technical Specification 3.1.7 Attachment 2b: Proposed Markup of QCNPS Technical Specification 3.1.7 Attachment 3a: Proposed Markup of DNPS Technical Specification Bases B3.1.7 Attachment 3b: Proposed Markup of QCNPS Technical Specification Bases B3.1.7 Attachment 4: RM Documentation No. D-LAR-01, Revision 2 Attachment 5: RM Documentation No. QC-LAR-02, Revision 2 ATTACHMENT 1 Evaluation of Proposed Amendment
 
==1.0 DESCRIPTION==
 
2.0 PROPOSED CHANGES 3.0 BACKGROUND 4.0 TECHNICAL ANALYSIS 5.0 REGULATORY ANALYSIS 5.1 No Significant Hazards Consideration 5.2 Applicable Regulatory Requirements/Criteria 6.0 ENVIRONMENTAL CONSIDERATION
 
==7.0 REFERENCES==
 
Page 1 of 19 
 
==1.0 DESCRIPTION==
 
ATTACHMENT 1 Evaluation of Proposed Amendment In accordance with 10 CFR 50.90, "Application for amendment of license or construction permit," Exelon Generation Company, LLC (EGC) requests an amendment to Facility Operating License Nos. DPR-19, DPR-25, DPR-29, and DPR-30 for Dresden Nuclear Power Station (DNPS) Units 2 and 3, and Quad Cities Nuclear Power Station (QCNPS) Units 1 and 2, respectively. The proposed amendment changes Technical Specification (TS) 3.1.7, "Standby Liquid Control (SLC) System," by extending the Completion Time (CT) for two inoperable SLC subsystems from 8 hours to 72 hours. DNPS and QCNPS TS LCO 3.1.7 require the operability of two SLC subsystems when the reactor is in Modes 1, 2, and 3. In Modes 1 and 2, the SLC system satisfies the requirements of 10 CFR 50.62, "Requirements for reduction of risk from anticipated transients without scram (ATWS) events for light-water-cooled nuclear power plants," and "10 CFR 50, Appendix A, "General Design Criteria for Nuclear Power Plants," Criterion (GDC) 26, "Reactivity control system redundancy and capability
." In Mode 3, the SLC system helps ensure that offsite doses remain within the limits of 10 CFR 50.67, "Accident source term" following a loss-of-coolant accident (LOCA) involving significant fission product releases. TS 3.1.7, Condition B and the associated Required Action B.1 address the inoperability of both SLC subsystems. Specifically, Required Action B.1 requires restoration of one SLC subsystem to operable status, with a CT of eight hours. If Required Action B.1 cannot be satisfied within the CT, Condition C and associated Required Actions C.1 and C.2 require the reactor to be in Mode 3 within 12 hours and Mode 4 within 36 hours. The current CT for Required Action B.1 is based on the low probability of a design basis accident or transient occurring, concurrent with the failure of the control rods to shut down the reactor. Consistent with this current basis, the proposed TS CT change is based upon a risk-informed assessment that evaluates the probability and consequences of transients, accidents, and severe accidents including the design basis accident and transients occurring concurrent with control rod insertion failure. EGC has utilized the guidance in Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," to develop the risk assessment for this proposed change. The EGC assessment demonstrates, with reasonable assurance, that the proposed license amendment satisfies the risk acceptance guidelines in Regulatory Guide 1.174 and Regulatory Guide 1.177, "An Approach for Plant-Specific, Risk-Informed Decision-making
: Technical Specifications
." The proposed license amendment meets the intent of very small risk increases consistent with the NRC's Safety Goal Policy Statement. In addition to evaluating the risk impact, EGC has evaluated the proposed change to determine whether the impact of the change is consistent with the intent of the defense-in-depth philosophy and the principle that sufficient safety margins are maintained (i.e., consistent with the requirements of RG 1.177, Section C, "Regulatory Position," paragraph 2.2, "Traditional Engineering Considerations"). EGC has also determined that the EGC Probabilistic Risk Assessment (PRA) maintenance, update processes, and technical capability evaluations provide a robust basis for concluding that the EGC PRA is suitable for use in risk-informed licensing actions. EGC conducted a PRA technical adequacy evaluation, consistent with the requirements of Regulatory Guide 1.200, "An Page 2 of 19 ATTACHMENT 1 Evaluation of Proposed Amendment Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 1. 2.0 PROPOSED CHANGE The proposed amendment revises the CT for DNPS and QCNPS TS 3.1.7, Required Action 13.1 from 8 hours to 72 hours. 3.0 BACKGROUND The SLC System is designed to provide the capability of bringing the reactor, at any time in a fuel cycle, from full power and minimum control rod inventory to a subcritical condition with the reactor in the most reactive, xenon free state without taking credit for control rod movement. The SLC System satisfies the requirements of 10 CFR 50.62, "Requirements for reduction of risk from anticipated transients without scram (ATWS) events for light-water-cooled nuclear power plants." DNPS and QCNPS TS LCO 3.1.7 require the operability of two SLC subsystems when the reactor is in Modes 1, 2, and 3. TS 3.1.7, Condition B and the associated Required Action 13.1 address the inoperability of both SLC subsystems. Specifically, Required Action 13.1 requires restoration of one SLC subsystem to operable status, with a CT of eight hours. If Required Action 13.1 cannot be satisfied within the CT, Condition C and associated Required Actions C.1 and C.2 require the reactor to be in Mode 3 within 12 hours and Mode 4 within 36 hours. In October 2006 and January 2007, EGC requested Notices of Enforcement Discretion (NOEDs) for QCNPS Unit 1 and DNPS Unit 2, respectively, to allow sufficient time for the repair of minor SLC system tank leaks. The NRC granted these NOEDs, allowing an additional 72 hours to the original 8-hour completion time required for the dual-train inoperability of the SLC systems (References 1 and 2). The purpose of this proposed change is to adopt a permanent, risk-informed CT extension, thus minimizing the potential for thermal transients associated with placing DNPS Units 2 and 3, and QCNPS Units 1 and 2 in Cold Shutdown (i.e., Mode 4). The integrity of the reactor vessel and other components of the primary system of a nuclear plant can be adversely affected by the number of thermal transients that they are subjected to during their lifetime. As each additional thermal transient can affect this integrity, it is prudent to avoid such transients. 4.0 TECHNICAL ANALYSIS The proposed change is consistent with the principle that adequate defense-in-depth is maintained, that sufficient safety margins are maintained, and that increases in risk are very small and meet the acceptance guidelines in RG 1.74, RG 1.77, and the NRC's Safety Goal Policy Statement. This consistency is described below, as well as in Attachments 4 and 5. 4.1 System Description The SLC System consists of a boron solution storage tank, two positive displacement pumps, two explosive valves that are provided in parallel for redundancy, and associated piping and valves used to transfer borated water from the storage tank to the reactor pressure vessel (RPV). The borated solution is discharged near the bottom of the core Page 3 of 19 4.2 Defense-in-Depth ATTACHMENT 1 Evaluation of Proposed Amendment shroud, where it then mixes with the cooling water rising through the core. A smaller tank containing demineralized water is provided for testing purposes. The performance objective of the SLC system is to provide an alternative to the highly reliable control rod drive (CRD) scram system for reactivity control. The SLC system provides the capability of bringing the reactor from full power to a cold, xenon free shutdown condition assuming that none of the withdrawn control rods can be inserted. This is accomplished by injecting a sufficient quantity of sodium pentaborate solution into the reactor core. To meet this objective, it is necessary to inject a quantity of boron that produces a reactivity change equivalent to a concentration of 600 ppm and 918 ppm of natural boron for DNPS and QCNPS, respectively. The shutdown analysis assumes a sodium pentaborate solution with enriched boron is used. A 45% enriched sodium pentaborate solution is also used to satisfy the requirements of 10 CFR 50.62. The SLC system is manually initiated from the main control room, as directed by the emergency operating procedures, if and when the operator determines the reactor cannot be shut down, or kept shut down, with the control rods. The SLC system is used in the event that not enough control rods can be inserted to accomplish shutdown and cooldown in the normal manner. The SLC system is also required to be operable in Mode 3 to ensure that offsite doses remain within 10 CFR 50.67, "Accident source term," limits following a LOCA involving significant fission product releases. The SLC system is credited for maintaining pH balance in the suppression pool at or above 7 following a LOCA to ensure that iodine will be retained in the suppression pool water. The control rods are the primary reactivity control system for the reactors at DNPS and QCNPS. In conjunction with the Reactor Protection System (RPS), the control rods provide the means for reliable control of reactivity changes to ensure that fuel design limits are not exceeded. Operability of the control rods is governed by TS 3.1.3, "Control Rod OPERABILITY," and the control rods are demonstrated operable by the performance of TS Surveillance Requirements (SRs) 3.1.3.1 through 3.1.3.5. These specifications assure that the insertion capability of the control rods is maintained in the event of an accident or transient, thus meeting the assumptions used in the safety analysis. Scram reliability is the object of a number of features in the system, including: Two sources of scram energy (accumulator and reactor pressure) that complement each other for each control rod drive whenever the reactor is operating. Each control rod drive mechanism is equipped with specific scram valves and pilot valves so that only one control rod drive can be affected by a scram valve failure. Under scram conditions the control rod drive mechanism develops 6000 pounds (at zero reactor pressure) to 2800 pounds (at rated pressure) of force, providing a large margin to overcome possible friction. Page 4 of 19 ATTACHMENT 1 Evaluation of Proposed Amendment " The scram system is designed so that the scram signal overrides all other operating signals. " The scram valves fail open on loss of either air or electrical power. Hence, failure of the valves' air system or electric system will produce, rather than prevent, a scram. " The Alternate Rod Insertion (ARI) system provides a separate set of backup scram valves in the event that the normal scram path cannot be initiated by RPS. The ARI system provides a means of control rod insertion which is motivated mechanically by the normal hydraulic control units and control rod drives but which utilizes totally independent and diverse logic from RPS. The ARI system energizes backup valves which vent the scram air header. This feature minimizes the impact of individual scram valve and/or pilot valve failures. As noted above, operability of the trip function of the control rods is demonstrated by specific SRs. For the control rod scram function to fail when a valid signal is sent, a diverse number of failures would have to occur in order in prevent the scram valves from opening. Also as noted above, the ARI system would be available as a separate means for reactor shutdown in the event that the normal scram path cannot be initiated by the RPS. In addition to the ARI system, the ATWS Recirculating Pump Trip (RPT) provides an additional means for rapid power reduction in the event that the normal scram path cannot be initiated by RPS. In this case, the automatic trip of the reactor recirculation pumps causes a quick reduction in core flow which increases core void generation. These increased voids introduce negative reactivity thus decreasing the reactor power. The quick power reduction helps bring reactor pressure, neutron flux, and fuel surface heat flux down rapidly enough to limit the peak pressure, clad oxidation, and peak fuel enthalpy. The proposed change to the SLC CT does not affect the redundancy, independence, and diversity of the RPS and ARI systems, as well as the RPT. These systems and instrumentation remain operable to mitigate the consequences of any previously analyzed accident. In addition to the TS 3.1.3 requirements for control rod operability, the EGC Work Management and Maintenance Rule (i.e., 10 CFR 50.65(a)(4))
programs provide controls and assessments to minimize the probability of simultaneous outages of redundant trains and ensure system reliability. The proposed SLC CT extension does not involve any change to plant equipment or system design functions. This proposed TS CT extension does not change the design function of the SLC system and does not affect the system's ability to perform its design function. As such, the proposed change complies with the defense-in-depth principles described in FIG 1.174, paragraph 2.2.1.1 and RG 1.177, paragraph 2.2.1. These principles, and the impact of the proposed change on each, are described below. Page 5 of 19 ATTACHMENT 1 Evaluation of Proposed Amendment A reasonable balance is preserved between prevention of core damage, prevention of containment failure, and consequence mitigation. The proposed SLC CT extension does not affect the ability of SLC, or any system, to prevent core damage, prevent containment failure, or mitigate the consequences of an accident. The proposed change has only a very small impact on risk. The proposed change does not compensate for this risk impact with an assumption of improved containment integrity, nor does this proposed change degrade containment integrity and compensate with an assumption of improved core damage prevention. Over-reliance on programmatic activities to compensate for weaknesses in plant design is avoided. Plant design for both the primary (i.e., RPS and ARI/RPT) and alternate (i.e., SLC) reactivity control systems at DNPS and QCNPS is robust. The proposed SLC CT extension does not require, nor rely upon programmatic activities. During the extended CT, the dual-channel RPS, in concert with the control rods, ensures reliable and automatic control of reactivity changes to ensure that fuel design limits are not exceeded. The scram system is designed so that the scram signal overrides all other operating signals. Upon loss of either instrument air or electrical power the scram valves will fail open. Hence, failure of the valves' air system or electric system will produce, rather than prevent, a scram. System redundancy, independence, and diversity are maintained commensurate with the expected frequency and consequences of challenges to the system. The redundancy, independence, and diversity of the RPS, the control rods, and the control rod drive system are not affected during the extended 72-hour SLC CT. Since entry into the dual-train SLC CT will typically be due to equipment failure, the EGC Configuration Risk Management Program (CRMP) will assess the emergent condition and direct activities as appropriate from a risk management perspective. Additional redundancy for both reactivity control and suppression pool pH control is established by the DNPS and QCNPS Emergency Operating Procedures (EOPs). The EOPs describe the actions and criteria for manual addition of boron into the condensate systems, should RPS, the control rods, the control rod drive system, and the SLC be unable to perform the specifed design functions. Defenses against potential common cause failures are maintained and the potential for introduction of new common cause failure mechanisms is assessed. The extended SLC CT does not change the design function of the SLC system. Therefore, the proposed change does not affect existing common cause failure mechanisms. In addition, the operating environment and operating parameters for the SLC system, the RPS system, the control rods, and the control rod drive system remain constant; therefore, new common cause failures modes are not expected. Therefore, no new potential common cause failure mechanisms have been introduced by the proposed change. Page 6 of 19 ATTACHMENT 1 Evaluation of Proposed Amendment Independence of barriers is not degraded. The extended CT does not provide a mechanism that degrades the independence of fission product barriers, (i.e., fuel cladding, the reactor coolant system, or containment). Defenses against human errors are maintained. The risk assessment for the extended SLC CT does not credit, nor require new operator actions. Therefore, the proposed change does not impact defense-in-depth against human error. 4.3 Safety Margin Assessment The proposed SLC CT extension does not involve a reduction in the margin of safety. The margin of safety is established through the design of the plant structures, systems, and components, the parameters within which the plant is operated, and the setpoints for the actuation of equipment relied upon to respond to an event. The proposed amendment does not modify the safety limits or setpoints at which protective actions are initiated. Safety margins applicable to the SLC system include pump capacity, boron concentration, boron enrichment, and system response timing. Since this proposed TS amendment does not change the SLC system design, but only extends a CT, safety margins are not challenged. 4.4 Risk Assessment The CT is defined as part of the limiting condition for operation (LCO), and is intended to allow sufficient time to repair failed equipment while minimizing the risk associated with the loss of the component function. An extension of the CT increases the unavailability of a component due to the increased time the component is out-of-service for maintenance. The CT risk is reflected in the core damage frequency (CDF) and the large early release frequency (LERF) by adjusting the component unavailability due to maintenance. The proposed CT extension for the dual-train inoperability of the DNPS and QCNPS SLC system provides additional time to complete test and maintenance activities while at power, potentially reducing the number of forced outages related to compliance with the existing CT. EGC completed risk assessments for DNPS and QCNPS using the respective full power internal events, Level 1 CDF models and the associated Level 2 LERF models. These risk assessments are provided in Attachment 4 for DNPS and Attachment 5 for QCNPS. The risk assessments were performed in accordance with the requirements in RG 1.174, RG 1.177, and RG 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk Informed Activities," Revision 1. The results of these risk assessments are discussed below. Page 7 of 19 4.4.1 Regulatory Standards The RG 1.174 acceptance guidelines for a permanent TS change specify that the delta (A)CDF and the ALERF associated with the change should be less than specified acceptable values, which are dependent on the baseline CDF and LERF. These specified acceptable values are presented for two ranges of risk impacts, those described as "small changes" and those described as "very small changes". EGC utilized the acceptance guidelines for "very small changes" in the risk assessments for the proposed DNPS and QCNPS changes. The RG 1.174 acceptance guidelines prescribe that the risk metrics of ACDF and ALERF be less than 1.0E-06/yr and 1.0E-07/yr, respectively, to establish a very small risk increase with no additional compensatory measures required. RG 1.174 also specifies guidelines for consideration of external events, and stipulates that external events can be evaluated in either a qualitative or quantitative manner. RG 1.177 identifies a three-tiered approach for the evaluation of the risk associated with a proposed TS change. ATTACHMENT 1 Evaluation of Proposed Amendment Tier 1, PRA Capability and Insights Tier 1 is an evaluation of the plant-specific risk associated with the proposed TS change, as shown by the change in CDF and incremental conditional core damage probability (ICCDP). Where applicable, containment performance should be evaluated on the basis of an analysis of LERF and incremental conditional large early release probability (ICLERP). The acceptance guidelines given in RG 1.177 for determining an acceptable TS change is that the ICCDP and the ICLERP associated with the change should be less than 5E-07 and 5E-08, respectively. Tier 2, Avoidance of Risk Significant Plant Configuration Tier 2 identifies and evaluates, with respect to defense-in-depth, any potential risk-significant plant equipment outage configurations associated with the proposed change. As such, procedures should provide reasonable assurance that risk-significant plant equipment outage configurations will not occur when equipment associated with the proposed TS change is out-of-service. Tier 3, Risk-Informed Configuration Risk Management Tier 3 provides for the establishment of an overall CRMP and confirmation that its insights are incorporated into the decision-making process before taking equipment out-of-service prior to or during the CT. Compared with Tier 2, Tier 3 provides additional coverage based on any additional risk significant configurations that may be encountered during maintenance scheduling over extended periods of plant operation. Tier 3 guidance can be satisfied by the Maintenance Rule (10 CFR 50.65(a)(4)), which requires a licensee to assess and Page 8 of 19 4.4.2 ATTACHMENT 1 Evaluation of Proposed Amendment manage the increase in risk that may result from activities such as surveillance, testing, and corrective and preventive maintenance. RG 1.200, Revision 1 describes an acceptable approach for determining whether the quality of the PRA, in total or the parts that are used to support an application, is sufficient to provide confidence in the results, such that the PRA can be used in regulatory decision-making for light-water reactors. This guidance is intended to be consistent with the NBC's PRA Policy Statement and more detailed guidance in RG 1.174. FIG 1.200, Revision 1 endorses Addendum B of the American Society of Mechanical Engineers (ASME) Standard RA-S-2002, "Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications," Addenda RA-Sa-2003, and Addenda RA-Sb-2005, as applicable to full power internal event (FPIE) PRA models. Since that time, the new ASME/American Nuclear Society (ANS) Standard RA-Sa-2009, "Addenda to RA-S-2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," has been released. Although this standard is presently issued and endorsed by RG 1.200, Revision 2, neither of these documents adds further requirements that impact the results of the SLC CT risk assessment. Tier 1: PRA Capability and Insights As stated in RG 1.177, Tier 1 is an evaluation of the impact of the proposed TS change on CDF, ICCDP, and, when appropriate LERF and ICLERP considering PRA validity, and PRA insights and findings. Tables 4.4.2-1 and 4.4.2-2 below provide the plant-specific risk associated with the proposed DNPS and QCNPS TS change using the FPIE PRA models and based on the risk metrics of ACDF, ICCDP, ALERF, and ICLERP. (1) In accordance with RG 1.174, paragraph 2.2.5.5, "Comparisons with Acceptance Guidelines," EGC performed a qualitative assessment of external event risk associated with the proposed DNPS and QCNPS SLC CT extension (i.e., as described below and in Appendix A of Attachments 4 and 5) to demonstrate that the changes in risk remain within the acceptance guidelines. Page 9 of 19 Table 4.4.2-1 DNPS Risk Assessment Summa Results Hazard ACDF ICCDP ALERF ICLERP FPIE 3.2E-08/yr 3.2E-08 1.8E-08/yr 1.8E-08 Acceptance Guideline
<1.0E-06/yr
<5.0E-07 <1.0E-07/yr
<5.0E-08 External Events (1) (1) (1) (1)
ATTACHMENT 1 Evaluation of Proposed Amendment (2) In accordance with RG 1.174, paragraph 2.2.5.5, "Comparisons with Acceptance Guidelines," EGC performed a qualitative assessment of external event risk associated with the proposed DNPS and QCNPS SLC CT extension (i.e., as described below and in Appendix A of Attachments 4 and 5) to demonstrate that the changes in risk remain within the acceptance guidelines. The base results of the risk assessment, as summarized in Tables 4.4.2-1 and 4.4.2-2 above indicate that the ACDF, ICCDP, ALERF, and ICLERP risk metric values for the proposed change are below the acceptance guidelines as defined in RG 1.174 and RG 1.177. This analysis demonstrates that the proposed TS change satisfies the risk acceptance guidelines in RG 1.174 and FIG 1.177, and therefore meets the intent of very small risk increases consistent with the NBC's Safety Goal Policy Statement. As part of the risk assessments, EGC performed a sensitivity analysis to determine the maximum allowable CT prior to exceeding the "very small" acceptance criteria. For this sensitivity, ICCDP and ICLERP were set to their maximum allowable values in RG 1.177, and the CTNEw allowable was calculated. ICLERP was determined to be the bounding parameter, and CTNEW values of 204 hours and 297 hours for DNPS and QCNPS, respectively, were calculated. These values represent significant margin, relative to the proposed CT extension. The DNPS and QCNPS risk assessments also included a qualitative assessment of external event risks in accordance with FIG 1.174, paragraph 2.2.5.5, "Comparisons with Acceptance Guidelines
." These qualitative assessments are summarized below, and described in Appendix A of Attachments 4 and 5. Page 1 0 of 19 Table 4.4.2-2 QCNPS Risk Assessment Summa Results Hazard ACDF ICCDP ALERF ICLERP FPIE 2.0E-08/yr 2.0E-08 1.2E-08/yr 1.2E-08 Acceptance Guideline
<1.0E-06/yr
<5.0E-07 <1.0E-07/yr
<5.0E-08 External Events i (1) (1) (1) (1)
Internal Fires The impact on the internal fires risk profile due to the proposed change was evaluated using the following information sources: Seismic ATTACHMENT 1 Evaluation of Proposed Amendment NUREG/CR-6850, "EPRI Report 1011989, `Fire PRA Methodology for Nuclear Power Facilities'," September 2005 Commonwealth Edison Company, "Dresden Nuclear Power Station Individual Plant Examination for External Events [IPEEE]," Rev. 1, March 2000 ComEd, "Quad Cities Fire IPEEE Quantification Notebook," June 1999 Boiling Water Reactor Owners' Group (BWROG), "Assessment of NRC Information Notice 2007-07," October 16, 2007 (i.e., Appendix C of Attachments 4 and 5) The assessment concluded that fire hazards can be appropriately screened as non-significant contributors to the risk assessment of the proposed SLC CT because of the low frequency of a fire coupled with a failure to scram. The impact on the seismic risk profile for DNPS and QCNPS, due to the proposed change was evaluated using the following information sources: Commonwealth Edison Company, "Dresden Nuclear Power Station Individual Plant Examination for External Events," Rev. 1, March 2000 ComEd, "Quad Cities Fire IPEEE Quantification Notebook," June 1999 NUREG-1150, "Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants," December 1990 The assessment concluded that the seismic hazard can be appropriately screened as a non-significant contributor to the risk assessment of the proposed change. Other External Hazards Other external event risks such as external floods, severe weather, high winds or tornados, transportation accidents, nearby facility accidents, turbine missiles, and other miscellaneous external hazards were also considered in the DNPS and QCNPS IPEEE listed above. No significant quantitative contribution from these external events was identified by the IPEEE evaluations. As such, other external hazards are appropriately screened as non-significant contributors to the risk assessment of the proposed CT. Consistent with the ASME PRA Standard, quantitative parametric uncertainty analyses for both CDF and LERF were evaluated to determine if the point estimates calculated by the PRA model appropriately represent the means for Page 1 1 of 19 ATTACHMENT 1 Evaluation of Proposed Amendment the risk metrics that were evaluated. The results of these analyses are summarized in Appendix B of Attachments 4 and 5. The parametric uncertainty analysis supports the use of the point estimate to represent the mean for the calculation of the changes in the risk metrics for the extended CT. An assessment of modeling uncertainties is also documented in Appendix B of Attachments 4 and 5. This assessment includes site-specific modeling uncertainty evaluations for the PRA Base Case and an examination of the specific cutsets that affect the change in the CDF risk metric associated with the change in the SLC CT extension. The results of the modeling uncertainty assessments do not change the conclusions of this risk assessment for the proposed SLC CT changes. 4.4.3 Tier 2, Avoidance of Risk Significant Plant Configurations Tier 2 requires an examination of the need to impose additional restrictions when operating under the proposed CT in order to avoid risk-significant equipment outage configurations. Consistent with the guidance in Regulatory Position C.2.3 of RG 1.177, and as part of the DNPS and QCNPS risk assessments (i.e., Attachments 4 and 5), EGC performed an evaluation of equipment according to its contribution to plant risk while the equipment covered by the proposed CT change is out of service for test or maintenance (i.e., site-specific modeling uncertainty evaluations for the PRA base case and an examination of the specific cutsets that affect the change in the CDF risk metric associated with the change in the SLC CT extension). This evaluation is provided in Attachments 4 and 5, Appendix B, "Uncertainty Analysis," section B.2, "Model Uncertainties Associated with SLC System Out of Service." This evaluation indicates that the scram system hardware failure is the most important contributor to the ACDF assessment for the SLC system out-of-service case. Since TS 3.1.7, Condition B is typically entered due to SLC equipment failure, the Tier 3 CRMP discussed below will assess the emergent condition, including the impact of any additional out-of-service equipment. With both SLC subsystems inoperable, the DNPS and QCNPS on-line risk would be depicted as "Orange," based on the deterministic assessment portion of the CRMP. In this condition, station procedures require senior management review and approval to remove equipment from service, as well as implementation of compensatory measures to reduce risk, including contingency plans. 4.4.4 Tier 3, Risk-informed Configuration Risk Management Tier 3 requires a proceduralized process to assess the risk associated with both planned and unplanned work activities. The objective of the third tier is to ensure that the risk impact of out-of-service equipment is evaluated prior to performing any maintenance activity. As stated in Section 2.3 of RG 1.177, "a viable program would be one that is able to uncover risk-significant plant equipment Page 1 2 of 19 EGC has developed and implemented a CRMP at DNPS and QCNPS. The CRMP is governed by station procedures that ensure the risk impact of out-of-service equipment is appropriately evaluated prior to performing any maintenance activity. These procedures require an integrated review to uncover risk-significant plant equipment outage configurations in a timely manner both during the work management process and for emergent conditions during normal plant operation. Appropriate consideration is given to equipment unavailability, operational activities like testing or load dispatching, and weather conditions. DNPS and QCNPS currently have the capability to perform a configuration dependent assessment of the overall impact on risk of proposed plant configurations prior to, and during, the performance of maintenance activities that remove equipment from service. Risk is re-assessed if an equipment failure/malfunction or emergent condition produces a plant configuration that has not been previously assessed. For planned maintenance activities, an assessment of the overall risk of the activity on plant safety is currently performed prior to scheduled work. The assessment includes the following considerations. ATTACHMENT 1 Evaluation of Proposed Amendment outage configurations in a timely manner during normal plant operation." The third-tier requirement is an extension of the second-tier requirement, but addresses the limitation of not being able to identify all possible risk-significant plant configurations in the Tier 2 evaluation. Maintenance activities that affect redundant and diverse structures, systems, and components (SSCs) that provide backup for the same function are minimized. The potential for planned activities to cause a plant transient are reviewed, and work on SSCs that are important in mitigating the transient are avoided. Work is not scheduled that is highly likely to exceed a TS or Technical Requirements Manual (TRM) Completion Time requiring a plant shutdown. For Maintenance Rule high risk significant SSCs, the impact of the planned activity on the unavailability performance criteria is evaluated. As a final check, a quantitative risk assessment is performed to ensure that the activity does not pose any unacceptable risk. This evaluation is performed using the impact on both CDF and LERF. The results of the risk assessment are classified by a color code based on the increased risk of the activity. As postulated risk for the activity increases, appropriate actions are required and implemented. Emergent work is reviewed by shift operations to ensure that the work does not invalidate the assumptions made during the work management process. EGC's PRA risk management procedure defines the requirements for ensuring that the PRA model used to evaluate on-line maintenance activities is an accurate model of the current plant design and operational characteristics. Plant modifications and procedure changes are monitored, assessed, and dispositioned. Evaluation of changes in plant configuration or PRA model features are dispositioned by implementing PRA model changes or by the qualitative assessment of the impact of the change on the PRA assessment tool. Page 1 3 of 19 ATTACHMENT 1 Evaluation of Proposed Amendment Changes that have potential risk impact are recorded in an update requirements evaluations (URE) log for consideration in the next periodic PRA model update. The reliability and availability of the SLC system, RIPS, control rods, control and the ARI system are monitored under the Maintenance Rule Program. If the pre-established reliability or availability performance criteria is exceeded for an instrumentation component, that component is considered for 10 CFR 50.65, "Requirements for monitoring the effectiveness of maintenance at nuclear power plants," paragraph (a)(1) actions, requiring increased management attention and goal setting in order to restore performance (i.e., reliability and availability) to an acceptable level. The performance criteria are risk-informed, and therefore are a means to manage the overall risk profile of the plant. An accumulation of large core damage probabilities over time is precluded by the performance criteria. Evaluation of changes in plant configuration or PRA model features are dispositioned by implementing PRA model changes or by qualitatively assessing the impact of the changes on the CRMP assessment tool. Procedures exist for the control and application of CRMP assessment tools. 4.4.5 Technical Adequacy and Quality of PRA Model As stated in Section 1.0 above, RG 1.200, Revision 1 describes an acceptable approach for determining whether the quality of the PRA, in total or the parts that are used to support an application, is sufficient to provide confidence in the results, such that the PRA can be used as an input in regulatory decision-making. With respect to the risk assessment for the proposed SLC CT extension, EGC has documented this determination of PRA quality in Attachments 4 and 5. Table 2-1 of each attachment provides a "RG 1.200 Analysis Actions Roadmap." This roadmap cross references the required RG 1.200 actions to sections in the site-specific attachments that address the actions, which are summarized below. EGC employs a multi-faceted approach to establishing and maintaining the technical adequacy and plant fidelity of the PRA models for all operating EGC nuclear generation sites. This approach includes both a proceduralized PRA maintenance and update process, and the use of self-assessments and independent peer reviews. The EGC risk management process for maintaining and updating the PRA ensures that the PRA model remains an accurate reflection of the as-built and as-operated plants. This process is defined in the EGC Risk Management program, which consists of a governing procedure (i.e., ER-AA-600, "Risk Management")
and subordinate Technical
& Reference Material (T&RM) documents. EGC T&RM ER-AA-600-1015, "FPIE PRA Model Update" delineates the responsibilities and guidelines for updating the full power internal events PRA models at all operating EGC nuclear generation sites. The overall EGC Risk Management program, including ER-AA-600-1015, defines the process for implementing regularly scheduled and interim PRA model updates, for tracking issues identified as potentially affecting the PRA models Page 1 4 of 19 5.1 No Significant Hazards Consideration ATTACHMENT 1 Evaluation of Proposed Amendment According to 10 CFR 50.92, "Issuance of amendment," paragraph (c), a proposed amendment to an operating license involves no significant hazards consideration if operation of the facility in accordance with the proposed amendment would not: (e.g., changes in the plant, errors or limitations identified in the model, industry operating experience), and for controlling the model and associated computer files. 5.0 REGULATORY ANALYSIS Involve a significant increase in the probability or consequence of an accident previously evaluated; (2) Create the possibility of a new or different kind of accident from any accident previously evaluated; or (3) Involve a significant reduction in a margin of safety. Exelon Generation Company, LLC (EGC) has evaluated the proposed changes to the Technical Specifications (TS) for Dresden Nuclear Power Station (DNPS), Units 2 and 3, and Quad Cities Nuclear Power Station (QCNPS), Units 1 and 2, using the criteria in 10 CFR 50.92 and has determined that the proposed changes do not involve a significant hazards consideration. EGC is providing the following information to support a finding of no significant hazards consideration. Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?
Response: No. The proposed amendment revises Technical Specification (TS) 3.1.7, "Standby Liquid Control (SLC) System," to extend the completion time (CT) for Condition B (i.e., "Two SLC subsystems inoperable
.") from eight hours to 72 hours. The proposed change is based on a risk-informed evaluation performed in accordance with Regulatory Guides (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions On Plant-Specific Changes to the Licensing Basis," and RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decision-making
: Technical Specifications
." The proposed amendment modifies an existing CT for a dual-train SLC system inoperability. The condition evaluated, the action requirements, and the associated CT do not impact any initiating conditions for any accident previously evaluated. The proposed amendment does not increase postulated frequencies or the analyzed consequences of an Anticipated Transient Without Scram (ATWS). Requirements associated with 10 CFR 50.62 will continue to be met. In addition, Page 1 5 of 19 (2) Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?
ATTACHMENT 1 Evaluation of Proposed Amendment the proposed amendment does not increase postulated frequencies or the analyzed consequences or a large-break loss-of-coolant accident for which the SLC system is used for pH control. The new action requirement provides appropriate remedial actions to be taken in response to a dual-train SLC system inoperability while minimizing the risk associated with continued operation. Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated. Response: No. The proposed amendment revises TS 3.1.7 to extend the CT for Condition B from eight hours to 72 hours. The proposed amendment does not involve any change to plant equipment or system design functions. This proposed TS amendment does not change the design function of the SLC system and does not affect the system's ability to perform its design function. The SLC system provides a method to bring the reactor, at any time in a fuel cycle, from full power and minimum control rod inventory to a subcritical condition with the reactor in the most reactive xenon free state without taking credit for control rod movement. Required actions and surveillance requirements are sufficient to ensure that the SLC system functions are maintained. No new accident initiators are introduced by this amendment. Therefore, the proposed amendment does not create the possibility of a new or different kind of accident from any previously evaluated. Does the proposed amendment involve a significant reduction in a margin of safety? Response: No. The proposed amendment revises TS 3.1.7 to extend the CT for Condition B from eight hours to 72 hours. The proposed amendment does not involve any change to plant equipment or system design functions. The margin of safety is established through the design of the plant structures, systems, and components, the parameters within which the plant is operated, and the setpoints for the actuation of equipment relied upon to respond to an event. Safety margins applicable to the SLC system include pump capacity, boron concentration, boron enrichment, and system response timing. The proposed amendment does not modify these safety margins or the setpoints at which SLC is initiated, nor does it affect the system's ability to perform its design function. In addition, the proposed change complies with the intent of the defense-in-depth philosophy and the principle that sufficient safety margins are maintained, consistent with RG 1.177 requirements (i.e., Section C, "Regulatory Position," paragraph 2.2, 'Traditional Engineering Considerations"). Page 1 6 of 19 ATTACHMENT 1 Evaluation of Proposed Amendment Based on the above analysis, EGC concludes that the proposed amendment presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of "no significant hazards consideration" is justified. 5.2 Applicable Regulatory Requirements/Criteria 10 CFR 50.62, "Requirements for reduction of risk from anticipated transients without scram (ATWS) events for light-water-cooled nuclear power plants" 10 CFR 50.62 (c)(4) states that boiling water reactors are required to have a standby liquid control (SLC) system with the capability of injecting, into the reactor pressure vessel (RPV), a borated water solution with a flow rate, boron concentration, and boron-10 enrichment that would be necessary to ensure that the resulting reactivity control is at least equivalent to that resulting from injection of 86 gallons per minute of 13 weight percent sodium pentaborate decahydrate solution at the natural boron-10 isotope abundance into a 251-inch inside diameter reactor pressure vessel for a given core design. Furthermore, the SLC system and its injection location must be designed to perform its function in a reliable manner. The proposed change will not impact the ability of the DNPS and QCNPS SLC system to ensure compliance with these requirements. 10 CFR 50.67, "Accident source term" 10 CFR 50.67.b(1) provided guidance to licensees with respect to revision of the licensee's current accident source term in design basis radiological consequence analyses. Specifically, the regulation states that in order to revise the accident source term, a licensee shall apply for a license amendment under 10 CFR 50.90 and that the application shall contain an evaluation of the consequences of applicable design basis accidents previously analyzed in the safety analysis report. By letter dated October 10, 2002, EGC requested an amendment to the DNPS and QCNPS TSs regarding the adoption of an alternate source term (AST) methodology. The NRC approved the requested license amendment by letter and safety evaluation (SE) dated September 11, 2006. As part of the proposed AST methodology, EGC proposed the use of the SLC system to inject sodium pentaborate into the RPV following a LOCA in order to maintain suppression pool pH above 7 (i.e., in order to ensure against re-evolution of elemental iodine). As such, the SLC is required to be operable in Mode 3 to ensure that offsite doses remain within the limits of 10 CFR 50.67, "Accident source term" following a loss-of-coolant accident (LOCA) involving significant fission product releases. However, additional redundancy for the control of suppression pool pH control following a LOCH is established by the DNPS and QCNPS Emergency Operating Procedures (EOPs). The EOPs describe the actions and criteria for manual addition of boron into the condensate systems, should RPS, control rods, the control rod drive system, and the SLC be unable to perform the specifed design functions. Therefore, the proposed SLC CT extension will not impact the ability of DNPS and QCNPS to comply with the requirements of 10 CFR 50.67. Page 1 7 of 19 ATTACHMENT 1 Evaluation of Proposed Amendment 10 CFR 50, Appendix A, "General Design Criteria for Nuclear Power Plants," Criterion (GDC) 26, "Reactivity control system redundancy and capability" GDC 26 requires the provision of two independent reactivity control systems of different design principles. While one of the systems shall use control rods, the second reactivity control system shall be capable of reliably controlling the rate of reactivity changes resulting from planned, normal power changes (including xenon burnout) to assure acceptable fuel design limits are not exceeded. The proposed change will not impact the ability of the DNPS and QCNPS SLC system to ensure compliance with this requirement. Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis" RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decision-making
: Technical Specifications" RG 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 1 Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," specifies risk-informed acceptance guidelines for a permanent TS change. These acceptance guidelines are presented for two ranges of risk impacts, those described as "small changes" and those described as "very small changes." The RG 1.174 acceptance guidelines prescribe that the risk metrics of delta (A) CDF and ALERF be less than 1.0E-06/yr and 1.0E-07/yr, respectively, to establish a very small risk increase with no additional compensatory measures required. RG 1.174, paragraph 2.2.5.5, "Comparisons with Acceptance Guidelines," also specifies guidelines for consideration of external events, and stipulates that external events can be evaluated in either a qualitative or quantitative manner. RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decision-making
: Technical Specifications," identifies a three-tiered approach for the evaluation of the risk associated with a proposed TS change. RG 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 1 describes an acceptable approach for determining whether the quality of the PRA, in total or the parts that are used to support an application, is sufficient to provide confidence in the results, such that the PRA can be used in regulatory decision-making for light-water reactors. The proposed change complies with the acceptance guidelines and requirements of RG 1.174, RG 1.177, and RG 1.200 to demonstrate a very small change in risk. Page 1 8 of 19 Regulatory Summary Based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the NRC's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public. 6.0 ENVIRONMENTAL CONSIDERATION ATTACHMENT 1 Evaluation of Proposed Amendment EGC has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, "Standards for Protection Against Radiation." However, the proposed amendment does not involve: (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluent that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22, "Criterion for categorical exclusion; identification of licensing and regulatory actions eligible for categorical exclusion or otherwise not requiring environmental review," paragraph (c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.
 
==7.0 REFERENCES==
: 1. Letter from M. A. Satorius (U. S. NRC) to C. M. Crane (Exelon Generation Company, LLC), "Notice of Enforcement Discretion for Exelon Generation Company LLC Regarding Quad Cities Nuclear Power Station, Unit 1 (NOED 06-3-01)," dated October 18, 2006 2. Letter from M. A. Satorius (U.S. NRC) to C. M. Crane (Exelon Generation Company, LLC), "Notice of Enforcement Discretion for Exelon Generation Company LLC Regarding Dresden Nuclear Power Station, Unit 2 (NOED 07-3-01; TAC MD4044)," dated January 24, 2007 Page 1 9 of 19 ATTACHMENT 2a Proposed Markup of DNPS Technical Specification 3.1.7 TS Page 3.1 REACTIVITY CONTROL SYSTEMS 3.1.7 Standby Liquid Control (SLC) System LCO 3.1.7 Two SLC subsystems shall be OPERABLE. APPLICABILITY
: MODES l, 2, and 3. ACTIONS SLC System 3.1.7 Dresden 2 and 3 3.1.7-1 Amendment No. 2'~'-~t CONDITION REQUIRED ACTION ~OMPLETION TIME A. One SLC subsystem A.1 Restore SLC subsystem 7 days inoperable. to OPERABLE status. B. Two SLC subsystems B.1 Restore one SLC $ hours inoperable. subsystem to OPERABLE status. C. Required Action and C.1 Be in MODE 3. 12 hours associated Completion Time not met. AND C.2 Be in MODE 4. 36 hours ATTACHMENT 2b Proposed Markup of QCNPS Technical Specification 3.1.7 TS Page 3.1 REACTIVITY CONTROL SYSTEMS 3.1.7 Standby Liquid Control (SLC) System LCO 3.1.7 Two SLC subsystems shall be OPERABLE. APPLICABILITY
: MODES l, 2, and 3. ACTIONS SLC System 3.1.7 Quad Cities 1 and 2 3.1.7-1 Amendment No. 233, 1 229 CONDITION REQUIRED ACTION OMPLETION TIME A. One SLC subsystem A.1 Restore SLC subsystem days inoperable. to OPERABLE status. B. Two SLC subsystems B.1 Restore one SLC 4 hours inoperable. subsystem to OPERABLE status. C. Required Action and C.1 Be in MODE 3. 12 hours associated Completion Time not met. AND C.2 Be in MODE 4. 36 hours Attachment 3a Proposed Markup of DNPS Technical Specification Bases B 3.1.7 TS Bases Pages B 3.1.7-3 B 3.1.7-7 BASES (continued)
APPLICABILITY In MODES 1 and 2, shutdown capability is required. In MODES 3 and 4, control rods are not able to be withdrawn since the reactor mode switch is in shutdown and a control rod block is applied. This provides adequate controls to ensure that the reactor remains subcritical. In MODE 5, only a single control rod can be withdrawn from a core cell containing fuel assemblies. Demonstration of adequate SDM (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") ensures that the reactor will not become critical. Therefore, the SLC System is not required to be OPERABLE when only a single control rod can be withdrawn. ACTIONS A Dresden 2 and 3 In MODES l, 2, and 3, the SLC System must be OPERABLE to ensure that offsite doses remain within 10 CFR 50.67 (Ref. 4) limits following a LOCA involving significant fission product releases. The SLC System is designed to maintain suppression pool pH at or above 7 following a LOCA to ensure that iodine will be retained in the suppression pool water (Ref. 3). If one SLC subsystem is inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this condition, the remaining OPERABLE subsystem is adequate to shutdown the unit. However, the overall reliability is reduced because a single failure in the remaining OPERABLE subsystem could result in reduced SLC System shutdown capability and inability to meet the requirements of Reference
: 1. The 7 day Completion Time is based on the availability of an OPERABLE subsystem capable of shutting down the reactor and the low probability of a Design Basis Accident (DBA) or severe transient occurring concurrent with the failure of the Control Rod Drive (CRD) System to shut down the reactor. If both SLC subsystems are inoperable, at subsystem must be restored to OPERABLE st 8 hours. The allowed Completion Time of considered acceptable given the low probability transient occurring concurrent with the failure control rods to shut down the reactor,. ------.- B 3.1.7-3 (Ref . 5) SLC System B 3.1.7 least one tus within hours is of a DBA or of the Insert (continued)
Revision 34 Insert As stated in Reference 5, the risk assessment that forms the basis for the 72-hour CT assumes one entry per year into Condition B.l. With both SLC subsystems inoperable, the on-line risk would be depicted as "Orange," based on the deterministic assessment portion of the Configuration Risk Management Program. In this condition, station procedures require senior management review and approval to remove equipment from service, as well as implementation of compensatory measures to reduce risk, including contingency plans.
BASES SURVEILLANCE SR 3.1.7.8 and SR 3.1.7.9 (continued)
REQUIREMENTS REFERENCES SLC System B 3.1.7 acceptable method for verifying that the suction piping is unblocked is to pump from the storage tank to the storage tank. The 24 month Frequency is acceptable since there is a low probability that the subject piping will be blocked due to precipitation of the boron from solution in the heat traced piping. This is especially true in light of the temperature verification of this piping required by SR 3.1.7.3. However, if, in performing SR 3.1.7.3, it is determined that the temperature of this piping has fallen below the specified minimum, SR 3.1.7.9 must be performed once within 24 hours after the piping temperature is restored to within the limits of Figure 3.1.7-2. SR 3.1.7.10 Enriched sodium pentaborate solution is made by mixing granular, enriched sodium pentaborate with water. Action to verify the actual B-10 enrichment must be performed prior to addition to the SLC tank in order to ensure that the proper B-10 atom percentage is being used. The proper enrichment (i.e., B-10 atom percentage) of the sodium pentaborate is verified, prior to the addition to the SLC tank, by use of a certificate of conformance provided by the supplier for each batch of enriched sodium pentaborate. The certificate of conformance will include certification that the enrichment of the sodium pentaborate satisfies the acceptance criterion. 5. RM Documentation No. D-LAR-01, Revision 2, "Risk Assessment Input for Dresden Technical Specification Change for Standby Liquid Control System Completion Time from 8 hours to 72 hours," November 6, 2009 Dresden 2 and 3 B 3.1.7-7 Revision 1. 10 CFR 50.62. 2. UFSAR, Section 9.3.5.3. 3. NUREG-1465, Accident Source Terms for Light-Water Nuclear Power Plants, Final Report, February 1, 1995. 4. 10 CFR 50.67.
Attachment 3b Proposed Markup of QCNPS Technical Specification Bases B 3.1.7 TS Bases Pages B 3.1.7-3 B 3.1.7-7 BASES (continued)
APPLICABILITY In MODES 1 and 2, shutdown capability is required. In MODES 3 and 4, control rods are not able to be withdrawn since the reactor mode switch is in shutdown and a control rod block is applied. This provides adequate controls to ensure that the reactor remains subcritical. In MODE 5, only a single control rod can be withdrawn from a core cell containing fuel assemblies. Demonstration of adequate SDM (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") ensures that the reactor will not become critical. Therefore, the SLC System is not required to be OPERABLE when only a single control rod can be withdrawn. ACTIONS A.1 In MODES 1, 2, and 3, the SLC System must be OPERABLE to ensure that offsite doses remain within 10 CFR 50.67 (Ref. 4) limits following a LOCA involving significant fission product releases. The SLC System is designed to maintain suppression pool pH at or above 7 following a LOCA to ensure that iodine will be retained in the suppression pool water (Ref. 3). If one SLC subsystem is inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this condition, the remaining OPERABLE subsystem is adequate to shutdown the unit and meet the requirement of Reference
: 1. However, the overall capability is reduced because a single failure in the remaining OPERABLE subsystem could result in reduced SLC System shutdown capability. The 7 day Completion Time is based on the availability of an OPERABLE subsystem capable of shutting down the reactor and the low probability of a Design Basis Accident (DBA) or severe transient occurring concurrent with the failure of the Control Rod Drive (CRD) System to shut down the reactor. If both SLC subsystems are inoperable, at east one subsystem must be restored to OPERABLE st~tus within hours. The allowed Completion Time of S hours is considered acceptable given the low probability of a DBA or transient occurring concurrent with the failure of the control rods to shut down the reactor. (continued)
Insert Quad Cities 1 and 2 B 3.1.7-3 (Ref SLC System B 3.1.7 Revision -34 Insert As stated in Reference 5, the risk assessment that forms the basis for the 72-hour CT assumes one entry per year into Condition B.l. With both SLC subsystems inoperable, the on-line risk would be depicted as "Orange," based on the deterministic assessment portion of the Configuration Risk Management Program. In this condition, station procedures require senior management review and approval to remove equipment from service, as well as implementation of compensatory measures to reduce risk, including contingency plans.
BASES SURVEILLANCE REQUIREMENTS
: 5. RM Documentation No. QC-LAR-02, Revision 2, "Risk Assessment Input for Quad Cities Technical Specification Change for Standby Liquid Control System Completion Time from 8 hours to 72 hours," November 6, 2009 REFERENCES
: l. 2. 3. Quad Cities 1 and 2 SR 3,1,7_8 and SR 3,1.7.9 (continued)
Demonstrating that all heat traced piping between the boron solution storage tank and the suction inlet to the injection pumps is unblocked ensures that there is a functioning flow path for injecting the sodium pentaborate solution. An acceptable method for verifying that the suction piping is unblocked is to pump from the storage tank to the storage tank. The 24 month Frequency is acceptable since there is a low probability that the subject piping will be blocked due to precipitation of the boron from solution in the heat traced piping. This is especially true in light of the temperature verification of this piping required by SR 3.1.7.3. However, if, in performing SR 3.1.7.3, it is determined that the temperature of this piping has fallen below the specified minimum, SR 3.1.7.9 must be performed once within 24 hours after the piping temperature is restored to within the limits of Figure 3.1.7-2. SR 3.1._7.10 :hed sodium pentaborate solution is made by mixing ilar, enriched sodium pentaborate with water. Action to .y the actual B-10 enrichment must be performed prior to ion to the SLC tank in order to ensure that the proper atom percentage is being used. The proper enrichment B-10 atom percentage) of the sodium pentabotate is ied, prior to the addition to the SLC tank, by use of a ficate of conformance provided by the supplier for each of enriched sodium pentaborate. The certificate of irmance will include certification that the enrichment e sodium pentaborate satisfies the acceptance rc~rion. 10 CFR 50.62. UFSAR, Section 9.3.5.3. SLC System B 3.1.7 NUREG-1465, "Accident Source Terms for Light-Water Nuclear Power Plants, Final Report," February 1, 1995. 10 CFR 50.67. B 3.1.7-7 Revision 32-Attachment 4 RM Documentation No. D-LAR-01, Revision 2 C467090020-8956-10/16/2009 RM DOCUMENTATION NO. DR-LAR-01 REV: 2 PAGE NO. 1 STATION: Dresden UNIT(S) AFFECTED: 2 and 3 TITLE: Risk Assessment Input for Dresden Technical Specification Change for Standby Liquid Control System Completion Time from 8 hours to 72 hours
 
==SUMMARY==
: This assessment is performed in support of the license amendment request (LAR) submittal to extend the Technical Specification 3.1.7, Condition B Completion Time (CT) for the Standby Liquid Control (SLC) System from 8 hours to 72 hours. The risk assessment is performed in accordance with ER-AA-600-1046, Rev. 4, Risk Metrics -NOED and LAR No UREs have been created as a result of this application. [ ) Review required after periodic Update [ X ] Internal RM Documentation f ] External RM Documentation Electronic Calculation Data Files: Method of Review: [ X ] Detailed [ Alternate
[ ] Review of External Document This RM documentation supersedes
: DR-LAR-01 Rev. 1 in its entirety. Prepared by: L. K. Lee/R. A. Narain /6 /.~ oa ~' Sign Date Reviewed by: R A Hill &Ir-, Sign ate Reviewed by: G A Tea; arden -.. Sign Date Reviewed by: V. M. Andersen (External Events Impact) '~ ~ -. t L? _0p Date Approved by: E. T. Burns I I ~ - o~ Sign Date-C467090020-8956-10/16/2009 RM DOCUMENTATION NO. DR-LAR-01 REV: 1 PAGE NO. 1 STATION: Dresden UNIT(S) AFFECTED: 2 and 3 TITLE: Risk Assessment Input for Dresden Technical Specification Change for Standby Liquid Control System Completion Time from 8 hours to 72 hours SUIVtMARY: This assessment is performed in support of the license amendment request (LAR) submittal to extend the Technical Specification 3.1.7, Condition B Completion Time (CT) for the Standby Liquid Control (SLC) System from 8 hours to 72 hours. The risk assessment is performed in accordance with ER-AA-600-1046, Rev. 4, Risk Metrics - NOED and LAR No UREs have been created as a result of this application, [ ] Review required after periodic Update [ X I Internal RM Documentation
[ [ External RM Documentation Electronic Calculation Data Files: Method of Review: [ X ] Detailed [ ] Alternate
[ ) Review of External Document This RM documentation supersedes
: DR-LAR-01 Rev. 0 in its entirety. t'~0/2dv Prepared b L. K. Lee/R. A. Narain / a4i, Sign Date Reviewed by: R A Hill Sign ate Reviewed by: G A Teabarden 0 2~ru&deg;l Sign Date ~ Reviewed by: V. M. Andersen k (External Events Impact) Sign Da e Approved by: E. T. Burns - yl ~-- /0 4 9 Sign Date C467090020-8956-10/16/2009 RM DOCUMENTATION NO. DR-LAR-01 REV: 0 PAGE NO. 1 STATION: Dresden UNIT(S) AFFECTED: 2 and 3 TITLE: Risk Assessment Input for Dresden Technical Specification Change for Standby Liquid Control System Completion Time from 8 hours to 72 hours
 
==SUMMARY==
: This assessment is performed in support of the license amendment request (LAR) submittal to extend the Technical Specification 3.1.7, Condition B Completion Time (CT) for the Standby Liquid Control (SLC) System from 8 hours to 72 hours. The risk assessment is performed in accordance with ER-AA-600-1046, Rev. 4, Risk Metrics - NOED and LAR No LJREs have been created as a result of this application. Review required after periodic a date ( X I Internal RM Documentation
[ j External RM Documentation Electronic Calculation Data Files: Method of Review: [ X ] Detailed [ ] Alternate
[ ] Review of External Document This RM documentation supersedes
: N/A in its entirety. Prepared by: L. K. Lee/R. A. Narain / / &deg;l 11 P/0 I Sign Date r Reviewed by: R A Hill 66POT f r/2- 'r Sign Date Reviewed by: G A Tek arden Sign Date Reviewed by: V. M. Andersen (External Events Impact) Sign Date Approved by: E. T. Burns 2 S--O? Si Date C467090020-8956-10/16/2009 RM DOCUMENTATION NO. DR-LAR-01 REV: 2 PAGE NO. 1 STATION: Dresden UNIT(S) AFFECTED: 2 and 3 TITLE: Risk Assessment Input for Dresden Technical Specification Change for Standby Liquid Control System Completion Time from 8 hours to 72 hours
 
==SUMMARY==
: This assessment is performed in support of the license amendment request (LAR) submittal to extend the Technical Specification 3.1.7, Condition B Completion Time (CT) for the Standby Liquid Control (SLC) System from 8 hours to 72 hours. The risk assessment is performed in accordance with ER-AA-600-1046, Rev. 4, Risk Metrics - NOED and LAR No UREs have been created as a result of this application. [ ] Review required after periodic Update [ X ] Internal RM Documentation
[ ] External RM Documentation Electronic Calculation Data Files: Method of Review: [ X ] Detailed [ ] Alternate
[ ] Review of External Document This RM documentation supersedes
: DR-LAR-01 Rev. 1 in its entirety. Prepared by: L. K. Lee/R. A. Narain / Sign Date Reviewed by: R A Hill Sign Date Reviewed by: G A Teagarden Sign Date Reviewed by: V. M. Andersen (External Events lm~sjact)
Sign Date Approved by: E. T. Burns Sin Date TABLE OF CONTENTS Dresden SLC CT Extension Section Page
 
==1.0 INTRODUCTION==
 
...................................................................................................3 1.1 Purpose ......................................................................................................3 1.2 Background
................................................................................................3 1.3 SLC Technical Specifications
........................................................,4 1.4 Regulatory Guides......................................................................................4 1.5 Scope .........................................................................................................7 1.6 Dresden PRA Model...................................................................................8 2.0 ANALYSIS ROADMAP AND REPORT ORGANIZATION
..................................... 9 3.0 TIER 1 RISK ASSESSMENT
..............................................................................10 3.1 Key Assumptions
......................................................................................10 3.2 Internal Events .........................................................................................11 3.3 Results Comparison to Acceptance Guidelines
........................................ 13 3.4 External Events ........................................................................................13 3.5 Uncertainty Assessment
...........................................................................15 3.6 Risk Summary..........................................................................................15 4.0 TECHNICAL ADEQUACY OF THE PRA MODEL ............................................... 17 4.1 PRA Quality Overview..............................................................................17 4.2 Scope .......................................................................................................19 4.3 Fidelity: PRA Maintenance and Update ................................................... 19 4.4 Standards
.................................................................................................20 4.5 Peer Review and PRA Self-Assessment
................................................20 4.6 Appropriate PRA Quality ..........................................................................22 4.7 General Conclusion Regarding PRA Capability
.......................................60 5.0
 
==SUMMARY==
AND CONCLUSIONS
......................................................................61 5.1 Scope Investigated
................................................................................... 61 5.2 PRA Quality..............................................................................................61 5.3 Quantitative Results vs. Acceptance Guidelines
......................................62 5.4 Conclusions
..............................................................................................62
 
==6.0 REFERENCES==
 
....................................................................................................64 APPENDICES A EXTERNAL EVENT ASSESSMENT B UNCERTAINTY ANALYSIS C BWROG ASSESSMENT OF NRC INFORMATION NOTICE 2007-07 2 C467090020-8956-10/16/2009 
 
==1.0 INTRODUCTION==
 
1.1 PURPOSE Dresden SLC CT Extension The purpose of this analysis is to assess the acceptability, from a risk perspective, of a change to the Dresden Technical Specification (TS) for the Standby Liquid Control (SLC) system to increase the Completion Time (CT), sometimes called the allowed outage time (AOT), from 8 hours to 72 hours when both SLC subsystems (i.e., both trains) are inoperable. An extension will provide flexibility during power operation in the performance of corrective maintenance, preventive maintenance, and surveillance testing of SLC system components that would cause the system to be inoperable. Consistent with the NRC's approach to risk-informed regulation, Exelon Generating Company (EGC) has identified a particular TS requirement that is very restrictive in its nature and, if relaxed, has a minimal impact on the safety of the plant. The Dresden analysis is consistent with similar analyses being conducted for all EGC Boiling Water Reactor (BWR) plants that currently have an 8 hour CT for the SLC system. 1.2 BACKGROUND 1.2.1 Te chnical Specification Changes Since the mid-1980s, the NRC has been reviewing and granting improvements to TS that are based, at least in part, on probabilistic risk assessment (PRA) insights. In its final policy statement on TS improvements of July 22, 1993, the NRC stated that it ... ... expects that licensees, in preparing their Technical Specification related submittals, will utilize any plant-specific PSA or risk survey and any available literature on risk insights and PSAs.. . Similarly, the NRC staff will also employ risk insights and PSAs in evaluating Technical Specifications related submittals. Further, as a part of the Commission's ongoing program of improving Technical Specifications, it will continue to consider methods to make better use of risk and reliability information for defining future generic Technical Specification requirements. The NRC reiterated this point when it issued the revision to 10 CFR 50.36, "Technical Specifications," in July 1995. In August 1995, the NRC adopted a final policy statement on the use of PRA methods in nuclear regulatory activities that encouraged greater use of PRA to improve safety decision-making and regulatory efficiency. The PRA policy statement included the following points: 1. The use of PRA technology should be increased in all regulatory matters to the extent supported by the state of the art in PRA methods 3 C467090020-8956-10/16/2009 and data and in a manner that complements the NRC's deterministic approach and supports the NRC's traditional defense-in-depth philosophy. 2. PRA and associated analyses (e.g., sensitivity studies, uncertainty analyses, and importance measures) should be used in regulatory matters, where practical within the bounds of the state of the art, to reduce unnecessary conservatism associated with current regulatory requirements. 3. PRA evaluations in support of regulatory decisions should be as realistic as practicable and appropriate supporting data should be publicly available for review. Dresden SLC CT Extension The movement of the NRC to more risk-informed regulation has led to the NRC identifying Regulatory Guides and associated processes by which licensees can submit changes to the plant design basis including Technical Specifications. Regulatory Guides 1.174 [Ref. 2] and 1.177 [Ref. 3] both provide processes to incorporate PRA input for decision makers regarding a Technical Specification modification. Dresden, other EGC plants, and numerous other commercial nuclear plants in the industry have used these risk-informed guidelines to support both permanent and one-time CT extensions for EDGs, Emergency SW, and other systems. 1.2.2 EGC SLC Experiences In October 2006 (Quad Cities) and January 2007 (Dresden), EGC requested Notices of Enforcement Discretion (NOEDs) for SLC System Tank leaks allowing an additional 72 hours to the original 8-hour completion time required for a dual-train inoperability. These NOEDs were approved by the NRC. An extended CT would preempt the need for such NOEDs. 1.3 SLC TECHNICAL SPECIFICATIONS The proposed TS change involves extending the completion time for TS 3.1.7 Condition B from 8 hours (current TS) to 72 hours (proposed TS). Condition B is the situation where both SLC subsystems are inoperable. Technical Specification requirements for other SLC conditions will remain unchanged. For Dresden, the TS Condition B applies to Modes 1 and 2 for reactivity control. Consideration of TS applicability for Modes 1, 2 and 3 for pH control is not discussed in this report. 1.4 REGULATORY GUIDES Three Regulatory Guides provide primary inputs to the evaluation of a Technical Specification change. Their relevance is discussed in this section. 4 C467090020-8956-10/16/2009 1.4.1 Regulatory Guide 1.174 Regulatory Guide 1.174 [Ref. 2] specifies an approach and acceptance guidelines for use of PRA in risk informed activities. RG 1.174 outlines PRA related acceptance guidelines for use of PRA metrics of Core Damage Frequency (CDF) and Large Early Release Frequency (LERF) for the evaluation of permanent TS changes. The guidelines given in RG 1.174 for determining what constitutes an acceptable permanent change specify that the ACDF and the ALERF associated with the change should be less than specified values, which are dependent on the baseline CDF and LERF, respectively. These specified values of OCDF and OLERF are given in RG 1.174 Figures 3 and 4, respectively. These values are presented for two ranges of risk impacts, those described as "small changes" and those described as "very small changes". The acceptance guidelines for "very small changes" are utilized in this risk assessment. Based on the D205B (i.e., Dresden Unit 2 PRA model from the 2005 PRA update, Revision B) baseline internal events CDF of 3.96E-6/yr and LERF of 5.32E-7/yr for Dresden, the RG 1.174 minimum acceptance guidelines prescribe that the risk metrics of OCDF and OLERF be less than 1.0E-06/yr and 1.0E-07/yr, respectively, to establish a very small risk increase with no additional compensatory measures required. RG 1.174 also specifies guidelines for consideration of external events. External events can be evaluated in either a qualitative or quantitative manner. 1.4.2 Regulatoryv Guide 1,177 Dresden SLC CT Extension Regulatory Guide 1.174 [Ref. 2] specifies an approach and acceptance guidelines for the evaluation of plant licensing basis changes. RG 1.177 identifies a three-tiered approach for the evaluation of the risk associated with a proposed TS change as identified below: Tier 1 is an evaluation of the plant-specific risk associated with the proposed TS change, as shown by the change in core damage frequency (CDF) and incremental conditional core damage probability (ICCDP). Where applicable, containment performance should be evaluated on the basis of an analysis of large early release frequency (LERF) and incremental conditional large early release frequency (ICLERP). The acceptance guidelines given in RG 1.177 for determining an acceptable TS change is that the ICCDP and the ICLERP associated with the change should be less than 5E-07 and 5E-08, respectively. Tier 2 identifies and evaluates, with respect to defense-in-depth, any potential risk-significant plant equipment outage configurations associated with the proposed change. The licensee should provide reasonable assurance that risk-significant plant equipment outage configurations will 5 0467090020-8956-10/16/2009 Dresden SLC CT Extension not occur when equipment associated with the proposed TS change is out-of-service. " Tier 3 provides for the establishment of an overall configuration risk management program (CRMP) and confirmation that its insights are incorporated into the decision-making process before taking equipment out-of-service prior to or during the AOT. Compared with Tier 2, Tier 3 provides additional coverage based on any additional risk significant configurations that may be encountered during maintenance scheduling over extended periods of plant operation. Tier 3 guidance can be satisfied by the Maintenance Rule (10 CFR 50.65(a)(4)), which requires a licensee to assess and manage the increase in risk that may result from activities such as surveillance, testing, and corrective and preventive maintenance. This risk analysis supports the Tier 1 element of RG 1.177, specifically the acceptance guidelines for ICCDP and ICLERP for permanent changes associated with changing a Technical Specification Completion Time. Other portions of the LAR submittal will address Tier 2 and Tier 3 elements. 1.4.3 Regulatory Guide 1.200, Revision 1 Regulatory Guide 1.200, Rev. 1 [Ref. 1], describes an acceptable approach for determining whether the quality of the PRA, in total or the parts that are used to support an application, is sufficient to provide confidence in the results, such that the PRA can be used in regulatory decision-making for light-water reactors. This guidance is intended to be consistent with the NRC's PRA Policy Statement and more detailed guidance in Regulatory Guide 1.174. It is noted that RG 1.200 Rev. 1 endorses Addendum B of the ASME PRA Standard [Ref. 5] applicable to full power internal events (FPIE) PRA models. Since that time, the new ASME/ANS Combined PRA Standard [Ref. 26] has been released. Although the Combined Standard is presently issued and endorsed by RG 1.200 Revision 2 [Ref. 27], neither of these document revisions impact this analysis. 1.4.4 Acceptance Criteria Based on the guidance provided in Regulatory Guides 1.174 and 1.177, the following quantitative PRA related acceptance criteria are utilized in this risk analysis: " OCDF < 1.0E-06/yr " OLERF < 1.0E-07/yr " ICCDP < 5.0E-07 " ICLERP < 5.0E-08 6 C467090020-8956-10/16/2009 1.5 SCOPE Dresden SLC CT Extension This section addresses the requirements of RG 1.200, Rev. 1 Section 3.2 which directs the licensee to define the treatment of the scope of risk contributors (i.e., internal initiating events, external initiating events, and modes of power operation at the time of the initiator). Discussion of these risk contributors are as follows: " Full Power Internal Events (FPIE) - The Dresden D205B PRA model used for this analysis includes a full range of internal initiating events (including internal flooding) for at-power configurations. The SLC system is credited in the PRA for criticality control. The FPIE model is further discussed in Section 1.6. " Low Power Operation - The FPIE assessment is judged to adequately capture risk contributors associated with low power plant operations. The FPIE analysis assumes that the plant is at full power at the time of any internal events transient, manual shutdown, or accident initiating event. This analytic approach results in conservative accident progression timings and systemic success criteria compared to what may otherwise be applicable to an initiator occurring at low power. As such, low power risk impacts are not discussed further in this risk assessment. " Shutdown / Refueling - In consideration of shutdown and refueling modes (i.e., Modes 3, 4, and 5), the SLC TS does not apply. As such, shutdown risk impacts are not discussed further in this risk assessment. " Internal Fires - The Dresden updated IPEEE (Rev. 1) assessment, [Ref. 11], and a BWROG assessment
[Ref. 19] are used to provide qualitative and semi-quantitative insights to the analysis (refer to Section 3.4.1). " Seismic - Consistent with most sites, Dresden does not currently maintain a Seismic PRA. A qualitative assessment is performed in this analysis (refer to Section 3.2) based on insights from the Dresden IPEEE study [Ref. 11 ]and other industry studies. " Other External Events - Other external event risks were assessed in the original Dresden IPEEE study (Rev. 0) [Ref. 10] and found to be insignificant risk contributors (refer to Section 3.4.3). 7 C467090020-8956-10/16/2009 1.6 DRESDEN PRA MODEL Dresden SLC CT Extension This section addresses the requirements of Section 3.1 of RG 1.200, Rev. 1 which directs the licensee to identify the portions of the PRA used in the analysis. The PRA analysis for the TS change uses the Dresden D205B full power internal events Level 1 Core Damage Frequency (CDF) model and the associated Level 2 Large Early Release Frequency (LERF) model to calculate the risk metrics. This risk assessment applies to both Dresden Unit 2 and Unit 3. Both units are very similar and the risk impact of this TS change is minor. The Unit 2 model is considered the "base" model for the 2005B update. The Unit 3 model is created by converting the Unit 2 model. Table 1-1 shows the CDF and LERF risk metrics for both units. Table 1-1 COMPARISON OF UNIT 2 AND UNIT 3 RISK METRICS (FULL POWER INTERNAL EVENTS MODEL) The CDF and LERF for both units are essentially identical. As such that use of the D205B Unit 2 PRA model to reflect the risk impact of this TS change on either unit is reasonable and acceptable. This analysis is specific to the SLC System and therefore the SLC system fault tree model is the only portion of the D205B PRA model modified for this risk application. The PRA analysis involved identifying the system and components or maintenance activities modeled in the PRA which are most appropriate for use in setting both subsystems of SLC to be inoperable. As discussed later in Section 3.1, the model parameter 2SL-2A-2B----
M-- "SBLC PUMP 2A AND SBLC PUMP 2B IN COINCIDENT MAINTENANCE," was selected as an appropriate parameter to adjust to make the entire SLC system unavailable in the PRA (to reflect SLC inoperable and entry into TS 3.1.7, Condition B). No other aspect of the D205B PRA model required adjustment for this risk application. The entire D205B PRA model is quantified for this assessment using the "average maintenance" PRA model (i.e., no portions of the at-power internal events D205B model were excluded or zeroed out of the quantification). 8 C467090020-8956-10/16/2009 Risk Metric Unit 2 Unit 3 Percent Difference CDF 3.9542E-06 3.9543E-06 LERF 5.3145E-07 5.3148E-07 E
2.0 ANALYSIS ROADMAP AND REPORT ORGANIZATION The analysis and documentation utilizes the guidance provided in RG 1.200, Revision 1 [Ref. 1]. Table 2-1 summarizes the RG 1.200 identified actions and the corresponding location of that analysis or information in this report. Table 2-1 RG 1.200 ANALYSIS ACTIONS ROADMAP Dresden SLC CT Extension 9 C467090020-8956-10/16/2009 RG 1.200 Actions Report Section 1. Identify the parts of the PRA used to support the application Section 3 1.a Systems, structures and components (SSCs), operational Section 3.2 characteristics affected by the application, and how these are implemented in the PRA model 1.b Acceptance criteria used for the application Section 1.4.4 2. Identify the scope of risk contributors addressed by the PRA model. If Section 1.5 not full scope (i.e., internal and external events), identify appropriate compensatory measures or provide bounding arguments to address the risk contributors not addressed by the model. 3. Summarize the risk assessment methodology used to assess the risk Section 3 of the application. Include how the PRA model was modified to appropriately model the risk impact of the change request. 4. Demonstrate the Technical Adequacy of the PRA. Section 4 4.a Identify plant changes (design or operational practices) that have Section 4.6.1 been incorporated at the site, but are not yet in the PRA model and justify why the change does not impact the PRA results used to support the application. 4.b Document that the parts of the PRA used in the decision are Section 4.6 consistent with applicable standards endorsed by the RG (currently, in RG 1.200 Rev. 1. RG 1.200 Rev. 1 addresses the internal events ASME PRA standard). Provide justification to show that where specific requirements in the standard are not met, it will not unduly impact the results. 4.c Document PRA peer review findings and observations that are Section 4.5 applicable to the parts of the PRA required for the application, and for those that have not yet been addressed justify why the significant contributors would not be impacted. 4.d Identify key assumptions and approximations relevant to the results Section 3.1 used in the decision-making process.
3.0 This section evaluates the plant-specific risk associated with the proposed TS change, based on the risk metrics of CDF, ICCDP, LERF, and ICLERP. The following inputs and general assumptions are used in estimating the plant risk to the proposed SLC System CT extension. a. b. TIER 1 RISK ANALYSIS KEY ASSUMPTIONS Dresden SLC CT Extension The SLC System CT is assumed to increase from its current duration of 8 hours to a proposed duration of 72 hours. The base analysis in this risk assessment assumes one entry per year into the proposed CT. The duration of the proposed CT is assumed to be adequate for performing the majority of corrective maintenance, preventive maintenance, and surveillance testing on-line. An examination of SLC unavailability for a period from 1/1/05 to 12/31/08 showed that for Unit 2, Train A was unavailable for 38.3 hours, and Train B was unavailable for 37.7 hours. Unit 3 unavailabilities were 50.4 hours for Train A, and 69.5 hours for Train B. These single train unavailabilities are all below the proposed 72 hour window. The only instance where both SLC subsystems were unavailable was on Unit 2 in January 2007.(') Thus, any impact from extending the CT is assumed to be negligible and it is conservatively assumed that the outage will not be entered more than once a year. Additionally, Configuration Risk Management at Dresden is governed by the Maintenance Rule (10 CFR 50.65(a)(4)). A sensitivity analysis of the risk associated with entering the CT was performed, and indicated that the SLC system could be taken out of service for up to 204 total hours, before the very small risk increase metrics of RG 1.174 and RG 1.177 are exceeded. This represents a significant margin compared to the proposed 72 hour CT. As stated above, the historical analysis of unavailability date shows that the SLC system does not exceed this ceiling value. c. This risk assessment does not credit the averted risk due to a forced shutdown that would be required due to exceeding the existing CT. d. The model manipulations were performed on the Unit 2 model. The results for Unit 3 are expected to generate essentially identical results. due It is recognized that in January 2007, Dresden Unit 2 declared both SLC subsystems unavailable due to a leak in the SLC tank. An NOED to extend the CT an additional 72 hours from the TS 8 hour CT was requested by EGC and approved by the NRC. See Section 1.2.2 for additional discussion. 1 0 0467090020-8956-10/16/2009 3.2 INTERNAL EVENTS The Dresden D205B PRA model(') [Ref. 4] was examined to determine which PRA basic event to modify to reflect the unavailability of both SLC subsystems. The applicable basic event for the 2005B PRA model was identified as 2SL-2A-2B----
M--"SBLC PUMP 2 A AND SBLC PUMP 2B IN COINCIDENT MAINTENANCE
." This event is appropriate because it fails both SLC subsystems and no other equipment in the model. Event 2SL-2A-2B----
M-- was set to a binary logic value of "TRUE" (using a quantification flag file) and the entire D205B model was requantified using the same PRA software codes and revisions as used for the base D205B model [Ref. 4]. These configuration specific CDF and LERF values are used in conjunction with the base D205B values to calculate the risk impacts of the proposed TS change. The calculations of ACDF, ICCDP, ALERF and ICLERP for the CT change are determined as shown below. The ACDF to be compared to the RG 1.174 acceptance guidelines is given by (as defined by [Ref. 21]): OCDF = CDFNEW - CDFBASE [Equation 3-1] OCDF is the difference between the annual average CDF with the CT extended and the CDF with the current CT. The ACDF has units of "per reactor year." In the above equation, CDFNEW is equal to: Dresden SLC CT Extension CDF NE W = CTsLc-oos - CDFSLC-oos
+ [(1-CTSLC-oos)
* CDFBASE] [Equation 3-2] Where: CDFSLC-oos
= the annual average CDF calculated with both SLC subsystems out of service (2SL-2A-2B----
M-- set to True) CDFBASE = baseline annual average CDF with average unavailability for all equipment. This is the CDF result of the D205B baseline PRA. CTSLc_oos
= the new extended CT as an annual unavailability (i.e., 72 hours / 8760 hours/year
= 8.2E-03 yr) The D205B baseline model used in the calculations contains the average maintenance associated with system trains. 1 1 C467090020-8956-10/16/2009 Dresden SLC CT Extension CTSLC_oos
= the new extended CT as a probability (i.e., 72 hours / 8760 hours = 8.2E-03) The ICCDP associated with the SLC System being out of service using the new CT is given by: ICCDP"' = (CDFSLC-oos - CDFBASE) x CTSLC_oos [Equation 3-3] Risk significance relative to ALERF and ICLERP(1) is determined using equations of the same form as noted above for ACDF and ICCDP. The relevant input parameters for the base quantification of this risk analysis are summarized in Table 3.2-1. The corresponding base risk metric results for this risk analysis (based on quantification of the D205B model and use of the above equations) are provided in Table 3.2-2. Table 3.2-1 RISK ASSESSMENT INPUT PARAMETERS ICCDP and ICLERP are probabilities, i.e., no units. 1 2 0467090020-8956-10/16/2009 Input Parameter Value Reference CDF BASE 4.0E-06/yr D205B PRA [Ref. 4] LERF BASE 5.3E-07/yr D205B PRA [Ref. 4] CTS LC_OOs 8.2E-03 One 72-hr TS 3.1.7 Condition B entry assumed per year (i.e., 72 hr/8760 hrs).
Table 3.2-2 RISK ASSESSMENT BASE RESULTS 3.3 RESULTS COMPARISON TO ACCEPTANCE GUIDELINES Dresden SLC CT Extension As can be seen from Table 3.2-2, the base results of the risk assessment indicate that the ACDF, ICCDP, ALERF, and ICLERP risk metric values are below the acceptance guidelines as defined in RG 1.174 and RG 1.177. In addition, quantitative sensitivity cases for model uncertainties are provided in Appendix B. This analysis demonstrates that the proposed TS change satisfies the risk acceptance guidelines in RG 1.174 and RG 1.177, and therefore meets the intent of very small risk increases consistent with the Commission's Safety Goal Policy Statement. A sensitivity analysis was performed to determine the maximum allowable CT before exceeding the acceptance criteria for very small risk increases. For this sensitivity, ICCDP and ICLERP were set to their maximum allowable values in RG 1.177, and the CTNEw allowable was calculated. ICLERP was determined to be the bounding parameter, and a CTNEW of 204 hours was calculated. This represents a significant margin compared to the proposed 72 hour CT. 13 C467090020-8956-1 0/16/2009 Risk Metric Value(') Acceptance Guidelines CDFSLC-oos 7.8E-6/yr N/A CDFNEW 4.0E-6/yr N/A ACDF 3.2E-08/yr
<1.0E-06/yr ICCDP 3.2E-08 <5.0E-07 LERFSLC-oos 2.7E-6/yr N/A LERF N E W 5.5E-7/yr N/A ALERF 1.8E-08/yr
<1.0E-07/yr ICLERP 1.8E-08 <5.0E-08 3.4 EXTERNAL EVENTS A qualitative assessment of external event risks is provided. Further details are found in Appendix A. 3.4.1 Internal Fires The impact on the internal fires risk profile due to the proposed CT is evaluated using the following information sources: NUREG/CR-6850
[Ref. 18] " Dresden IPEEE, Rev. 1 [Ref. 11] BWROG Assessment of Fire-Induced Failure to Scram [Ref. 19] The internal fires risk impact assessment is discussed in Appendix A.4. The assessment concluded that fire hazards can be appropriately screened as non-significant contributors to the risk assessment of the proposed SLC CT because of the low frequency of a fire coupled with a failure to scram. 3.4.2 Seismic Dresden SLC CT Extension EGC does not currently maintain a seismic PRA for Dresden. The impact on the seismic risk profile due to the proposed CT is evaluated using the following information source: Dresden IPEEE Rev. 1 [Ref. 11 ] NUREG-1150
[Ref. 23] The seismic risk impact assessment is discussed in Appendix A.3. The assessment concluded that the seismic hazard can be appropriately screened as a non-significant contributor to the risk assessment of the proposed CT. 3.4.3 Other External Hazards Other external event risks such as external floods, severe weather, high winds or tornados, transportation accidents, nearby facility accidents, turbine missiles, and other miscellaneous external hazards were also considered in the IPEEE (Rev. 0) analysis [Rev. 10]. No significant quantitative contribution from these external events was identified by IPEEE evaluations (refer to Appendix A.2). As such, other external hazards are appropriately screened as non-significant contributors to the risk assessment of the proposed CT. 14 C467090020-8956-10/16/2009 3.5 UNCERTAINTY ASSESSMENT 3.5.1 Parametric Uncertaintv Dresden SLC CT Extension Consistent with the ASME PRA Standard, quantitative parametric uncertainty analyses for both CDF and LERF are evaluated to determine if the point estimates calculated by the PRA model appropriately represent the mean. The results of these analyses are summarized in Appendix B.3. The parametric uncertainty analysis shown in Appendix B.3 supports the use of the point estimate to represent the mean for the calculation of the changes in the risk metrics for the extended CT. 3.5.2 Modeling Uncertainty An assessment of modeling uncertainties is documented in Sections B.1 and B.2. " Section B.1 provides Dresden specific modeling uncertainty evaluations for the Base Case. " Section B.2 provides an examination of the specific cutsets that affect the change in the CDF risk metric associated with the change in the SLC CT. While the ICLERP acceptance guideline is slightly exceeded when imposing the 95% upper bound on the scram failure probability, the results of the modeling uncertainty assessments do not change the conclusions of this risk assessment for the proposed SLC CT changes. 3.6 RISK
 
==SUMMARY==
As discussed above and as summarized in Table 3.6-1, the FPIE quantitative evaluation results are well below the risk acceptance guidelines of RG 1.174 and RG 1.177. External events evaluations are discussed in Appendix A and do not change the results or conclusions of this risk assessment. As such, this risk evaluation demonstrates that the proposed TS change can be made with a very small risk increase. 15 C467090020-8956-10/16/2009 Table 3.6-1 RISK ASSESSMENT
 
==SUMMARY==
RESULTS Dresden SLC CT Extension (1) Evaluated and determined not to change the conclusions of the FPIE risk analysis. 1 6 0467090020-8956-10/16/2009 Hazard ACDF ICCDP ALERF ICLERP FPIE --------------------------
Acceptance Criteria 3.2E-08/yr
-------------------
<1.0E-06/yr 3.2E-08 -----------------
<5.OE-07 1.8E-08/yr I <1.0E-07/yr 1.8E-08 -----------------------------------------
<5.OE-08 Fire Seismic (1) (1) (1) (1) 4.0 TECHNICAL ADEQUACY OF PRA MODEL 4.1 PRA QUALITY OVERVIEW 3. "PRA evaluations in support of regulatory decisions should be ... realistic... and appropriate supporting data should be publicly available for reviews." 5. "Implementation of the (PRA) policy statement will improve the regulatory process in three ways: Dresden SLC CT Extension The 2005B update to the Dresden PRA model (D205B) is the most recent evaluation of the risk profile at Dresden for FPIE challenges('). The Dresden PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, and common cause events. The PRA model quantification process used for the Dresden PRA is based on the event tree / fault tree methodology, which is a well-known methodology in the industry. EGC Generation Company (EGC) employs a multi-faceted approach to establishing and maintaining the technical adequacy and plant fidelity of the PRA models for all operating EGC nuclear generation sites. This approach includes both a proceduralized PRA maintenance and update process, and the use of self-assessments and independent peer reviews. The following information describes this approach as it applies to the Dresden PRA. The quality of the Dresden FPIE PRA is important in making risk-informed decisions. The importance of the PRA quality derives from NRC Policy Statements as implemented by RGs 1.174 and 1.177, rule making and oversight processes. These can be briefly summarized as follows using the words of the NRC Policy Statement (1995): 1. "The use of PRA technology should be increased in all regulatory matters to the extent supported by the state-of-the-art. .. and supports the NRC's traditional defense-in-depth philosophy
." 2. "PRA ... should be used in regulatory matters ... to reduce unnecessary conservatism
... " 4. "The Commission's safety goals... and subsidiary numerical objectives are to be used with appropriate consideration of uncertainties in making regulatory judgments..." An update to the Dresden Model was completed in August of 2009. This model is awaiting final approval and will be peer reviewed in the fourth quarter of 2009. 1 7 C467090020-8956-10/16/2009 Dresden SLC CT Extension Foremost, through safety decision making enhanced by the use of PRA insights, Through more efficient use of agency resources; and Through a reduction in unnecessary burdens on licensees." PRA quality is an essential aspect of risk-informed regulatory decision making. In this context, PRA quality can be interpreted to have five essential elements: " Scope (Section 4.2): The scope (i.e., completeness) of the FPIE PRA. The scope is interpreted to address the following aspects: Challenges to plant operation (Initiating Events): Internal Events (including Internal Floods) External Hazards Fires Plant Operational states: Full Power Low Power Shutdown The metrics used in the quantification
: Level 1 PRA - CDF Level 2 PRA - LERF Level 3 PRA - Health Effects " Fidelity (Section 4.3): The fidelity of the PRA to the as-built, as-operated plant. " Standards (Section 4.4): ASME/ANS PRA Standard [Ref. 5] as endorsed by the NRC in Regulatory Guide 1.200 [Ref. 1]. Peer Review (Section 4.5): An independent PRA peer review provides a method to examine the PRA process by a group of experts. In some cases, a PRA self-assessment using the available PRA Standards endorsed by the NRC can be used to replace or supplement this peer review. " Appropriate Quality (Section 4.6): The quality of the PRA needs to be commensurate with its application. In other words, the needed quality is defined by the application requirements. 18 C467090020-8956-10/
1 6/2009 4.2 SCOPE Dresden SLC CT Extension The Dresden PRA is a full power, internal events (FPIE) PRA that addresses both CDF and LERF. The quantitative insights from the FPIE PRA are directly applicable to the SLC CT Extension PRA application. This scope is judged to be adequate to support the SLC CT PRA application. Because not all PRA standards are available to define the appropriate elements of PRA quality for all applications, the NRC has adopted a phased implementation approach. This phased approach uses available PRA tools and their quantitative results where standards are available and endorsed by the NRC. Where standards are not yet available or endorsed, this approach uses qualitative insights or bounding approaches as needed. The quality assessment performed in this section confirms the adequacy of the FPIE PRA. This assessment does not address the risk implications associated with low power or shutdown operation or with external events (including fire). 4.3 FIDELITY: PRA MAINTENANCE AND UPDATE The EGC risk management process for maintaining and updating the PRA ensures that the PRA model remains an accurate reflection of the as-built and as-operated plants. This process is defined in the EGC Risk Management program, which consists of a governing procedure (ER-AA-600, "Risk Management")
and subordinate implementation procedures. EGC procedure ER-AA-600-1015, "FPIE PRA Model Update" delineates the responsibilities and guidelines for updating the full power internal events PRA models at all operating EGC nuclear generation sites. The overall EGC Risk Management program, including ER-AA-600-1015, defines the process for implementing regularly scheduled and interim PRA model updates, for tracking issues identified as potentially affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, industry operating experience), and for controlling the model and associated computer files. To ensure that the current PRA model remains an accurate reflection of the as-built, as-operated plants, the following activities are routinely performed: " Design changes and procedure changes are reviewed for their impact on the PRA model. " New engineering calculations and revisions to existing calculations are reviewed for their impact on the PRA model. " Maintenance unavailabilities are captured, and their impact on CDF is trended. " Plant specific initiating event frequencies, failure rates, and maintenance unavailabilities are updated approximately every four years. 19 C467090020-8956-10/
1 6/2009 In addition to these activities, EGC risk management procedures provide the guidance for particular risk management and PRA quality and maintenance activities. This guidance includes: " Documentation of the PRA model, PRA products, and bases documents. " The approach for controlling electronic storage of Risk Management (RM) products including PRA update information, PRA models, and PRA applications. " Guidelines for updating the full power, internal events PRA models for EGC nuclear generation sites. " Guidance for use of quantitative and qualitative risk models in support of the On-Line Work Control Process Program for risk evaluations for maintenance tasks (corrective maintenance, preventive maintenance, minor maintenance, surveillance tests and modifications) on systems, structures, and components (SSCs) within the scope of the Maintenance Rule (10CFR50.65 (a)(4)). In accordance with this guidance, regularly scheduled PRA model updates nominally occur on a four year cycle; shorter intervals may be required if plant changes, procedure enhancements, or model changes result in significant risk metric changes. 4.4 STANDARDS The ASME PRA Standard [Ref. 5] provides the basis for assessing the adequacy of the Dresden PRA as endorsed by the NRC in RG 1.200, Rev. 1 [Ref. 1]. The predecessor to the ASME PRA Standard was NEI 00-02 which identified the critical internal events PRA elements and their attributes necessary for a quality PRA. 4.5 PEER REVIEW AND PRA SELF-ASSESSMENT There are three principal ways of incorporating the necessary quality into the PRA in addition to the maintenance and update process. These are the following: " A thorough and detailed investigation of open issues and the implementation of their resolution in the PRA. Dresden SLC CT Extension " A PRA Peer Review to allow independent reviewers from outside to examine the model and documentation. The ASME PRA Standard [Ref. 5] specifies that a PRA Peer Review be performed on the PRA. " The use of the ASME PRA Standard to define the criteria to be used in establishing the quality of individual PRA elements Several assessments of technical capability have been made and continue to be planned for the Dresden PRA model. A chronological list of the assessments performed includes the following: 2 0 C467090020-8956-10/16/2009 
" An independent PRA peer review was conducted under the auspices of the BWR Owners' Group (BWROG) in January 2001, following the Industry PRA Peer Review process [Ref. 6]. This peer review included an assessment of the PRA model maintenance and update process. " In 2004, prior to the 2005 PRA update, a self-assessment analysis was performed against the available version of the ASME PRA Standard, Addendum A [Ref. 5]. " During 2005 and 2006, the Dresden PRA model results were evaluated in the BWROG PRA cross-comparisons study performed in support of implementation of the mitigating systems performance indicator (MSPI) process. " In 2009, an update of the self-assessment analysis was performed against ASME PRA Standard, Addendum B [Ref. 5]. The 2009 self-assessment also addresses the updated Supporting Requirements associated with PRA Model Uncertainty as provided in the "Combined PRA Standard" [Ref. 26] and Regulatory Guide 1.200, Rev. 2 [Ref. 27]. 4.5.1 PRA Peer Review Overview An independent peer review of the Dresden PRA was performed in 2001 following the review guidelines of the BWROG (a predecessor to the ASME PRA Standard). A summary of the disposition of the January 2001 Industry PRA Peer Review facts and observations (F&Os) for the Dresden PRA models was documented as part of the statement of PRA capability for MSPI in the Dresden MSPI Basis Document [Ref. 7]. As noted in that document, there were no significance level A F&Os from the peer review, and all significance level B F&Os were addressed and closed out with the completion of the current models of record (2005B model--D205B). Also noted in that submittal was the fact that, after allowing for plant-specific features, there are no MSPI cross-comparison outliers for Dresden (refer to the third bulleted item above). 4.5.2 Self-Assessment Overview The Dresden PRA and the output of the PRA Peer Review were used in the development of the PRA self-assessment which also used the Supporting Requirements of the ASME PRA Standard [Ref. 5]. A Self-Assessment
("Gap" Analysis) for the Dresden PRA model was completed in 2004 in preparation for the 2005 PRA update. This Gap Analysis was performed against the ASME PRA Standard, addendum A [Ref. 5]. The 2004 gap analysis defined a list of 94 supporting requirements from the Standard for which potential gaps to Capability 2 1 Dresden SLC CT Extension C467090020-8956-10/16/2009 Category II of the Standard were identified. For each such potential gap, a PRA updating requirements evaluation (URE) (EGC model update tracking database) was documented for resolution. A PRA model update was completed in 2005. In updating the PRA, changes were made to the PRA to address most of the identified gaps, as well as to address other open UREs. Following the update, an assessment of the status of the gap analysis relative to the new model and the updated requirements in Addendum B of the ASME PRA Standard concluded that 76 of the gaps were fully resolved (i.e., are no longer gaps), and another one (1) was partially resolved. After accounting for the number of SRs added or deleted as part of Addendum B, the Dresden PRA contains 18 potential gaps to Capability Category II of the Standard. Table 4-2 presents a discussion of these identified "gaps" and concludes that none impact this application. PRAs can be used in applications despite not meeting all of the Supporting Requirements of the Combined ASME/ANS PRA Standard. This is well recognized by the NRC and is explicitly stated in the Combined ASME/ANS PRA Standard and RG 1.174. RG 1.174 states the following in Section 2.2.6: There are, however, some applications that, because of the nature of the proposed change, have a limited impact on risk, and this is reflected in the impact on the elements of the risk model. The proposed SLC CT Extension PRA application may not require more than Capability Category I for some SRs. It is also acknowledged that for PRAs with SRs ranked as "Not Met," the PRA may be used for PRA applications but may require additional justification and support to allow their use. Finally, it is judged that no PRA has Capability Category III for all of its SRs, nor is this currently expected as part of the NRC PRA Quality Program. 4.6 APPROPRIATE PRA QUALITY Dresden SLC CT Extension The PRA is used within its limitations to augment the deterministic criteria for plant operation. This is confirmed by the PRA Peer Review and the PRA Self-Assessment. As indicated previously, RG 1.200 also requires that additional information be provided as part of the License Amendment Request (LAR) submittal to demonstrate the technical adequacy of the PRA model used for the risk assessment. Each of these items (plant changes not yet incorporated in to the PRA model, consistency with applicable PRA Standards, relevant peer review findings, and the identification of key assumptions) is discussed below. 4.6.1 Pla nt Changes Not Yet Incorporat ed into the PRA_ Model A PRA updating requirements evaluation (URE) is EGC's PRA model update tracking database. These UREs are created for all issues that are identified with a potential to 2 2 C467090020-8956-10/16/2009 Dresden SLC CT Extension impact the PRA model. The URE database includes the identification of those plant changes that could impact the PRA model. A review of the current open items in the URE database associated with plant changes for Dresden is summarized in Table 4-1 along with an assessment of the impact for this application. , The results of the assessment documented in Table 4-1 show that none of the plant changes have any measurable impact on the SLC CT extension request. 4.6.2 Consistency with Ap-plicable PRA Standards As indicated above, an independent peer review of the Dresden PRA was performed in 2001 following the review guidelines of the BWROG (a predecessor to the ASME PRA Standard). All of the significance level "A" and "B" F&Os have been resolved. No further investigation of Peer Review findings is required. The self-assessment provides the connection between the PRA and the ASME PRA Standard by also considering the PRA Peer Review comments. Table 4-2 summarizes the evaluation of the identified "gaps" from the self-assessment and their impact on the SLC CT extension request. In summary, of the 18 gaps identified and evaluated in Table 4-2, none have a measurable impact on the SLC CT extension request. 2 3 C467090020-8956-10/16/2009 Table 4-1 IMPACT OF PLANT CHANCES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 2 4 C467090020-8956-10/16/2009 URE Number Plant change Impact on the DR PRA Impact on the A" ylication DR-2004-28 The purpose of this EC 333201 is to replace the swing charger Procedure DOP 6900-18 sent to LKL on Non-significant
#2/3. The existing charger is being replaced because spare 12/11/18. impact replacement parts are no longer available. The new charger will be an equivalent replacement for the existing charger and will Equivalent replacement of equipment. No meet the existing requirements of supplying the normal loads impact on calculated failure probabilities. and maintaining/restoring the battery. In addition to the normal 480 VAC input, 250 VDC output and alarm contact terminal blocks, the new charger will have 480 VAC input, 250 VDC output and alarm contact receptacles. These receptacles will allow a portable charger to be temporarily connected in parallel with the new charger. The EC provides direction to connect the portable charger. Evaluate crediting action to install portable charger. DR-2004-29 EC 8230 and EC 337655: The service water system provides System Notebook now states: In addition to Non-significant strained river water for cooling requirements of plant equipment. the standard motor bearing oil reservoirs, impact The service water system is shared by Units 2 and 3. The five each pump is equipped with bearing oiler service water pumps (two on Unit 2, two on Unit 3, and one and reservoirs for the pump shaft. The oil The trend is to common unit) discharge into a common header that feeds both feed to the upper bearing (shaft tube reduce the risk Unit 2 and Unit 3 equipment. The pumps are located in the bearing) is four to six drops per minute, and impact of the cribhouse. They are vertically mounted pumps driven by 1000 the lower bearing (suction bell bearing) SLC CT hp motors, each with a capacity of approximately 15,000 gpm at three to four drops per minute. The oiler is extension 91 psig. The above changes are being performed at the equipped with a solenoid operated valve application. recommendation of the pump manufacturer to modernize the that permits oil flow only when the pump is pump. These changes will improve pump performance and in operation and a small adjustment valve reliability. The pump oiler has historically been a high downstream of the solenoid valve to control maintenance item, and the installation of the upgraded pump will the oil flow. replace this with an improved lubrication system. Installation of a slightly larger impeller will improve pump performance (both flow Table 4-1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 2 5 C467090020-8956-10/16/2009 URE Number Plant change impact on the DR PRA Impact on the Afflication DR-2004-29 and developed head). The change did not impact SW pump This improved reliability will reduce the (cont'd) success criteria. Note, Per DOP 3900-01 Revision 27, the 2/3 initiating event frequency. This reduction in SW pump is the only pump with an oiler system. (The remainder challenges to the scram system will reduce use water lubrication with a Cuno Filter.) Notebook should be the impact on the SLC CT extension risk changed. See additional comments. metrics (e.g., OCDF and ICCDP). This should be changed. The 2/3 pump is the only pump with an oiler system. Reference DOP 3900-01 Rev. 27. Assessed to be reliability improvement, however, it is a negligible quantitative impact on SW pump reliability currently included in the model. DR-2004-30 The purpose of EC 333200 is to replace the backup charger #3A. The applicable Operating Procedure is Non-significant The existing charger is being replaced because spare parts are DOP 6900-18 125 VDC AND 250 VDC impact no longer available. The new charger will be an equivalent PORTABLE BATTERY CHARGER USE. replacement for the existing charger and will meet the existing Procedure DOP 6900-18 sent to LKL on requirements of supplying the normal loads and 12/11/18. maintaining/restoring the battery. This EC also adds as a Crediting backup battery charger may have contingency, connection of the 125V Portable Battery Changer to a limited impact on CDF and LERF. float charge the battery as a precautionary risk mitigation action. This is a negligible effect on the ATWS URE written to evaluate potential for crediting the portable battery charger. related accident sequences.
Table 4-1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 2 6 C467090020-8956-10/16/2009 URE Number Plant change Impact on the DR PRA Impact on the Aalication DR-2004-31 EC 334860 provides the design information necessary to replace Low Safety Significance. Potentially could Non-significant the existing Unit 3A reciprocating type Instrument Air (IA) lower individual IA compressor importance. impact compressor (EPN 3-4706-A) with a new rotary screw type The trend is to compressor package. The new compressor package is Atlas This improved reliability will reduce the reduce the risk Co p co Model ZR 90 p procured under EGC PO No. 51081, Atlas initiating event frequency. This reduction in impact of the Copco Sales Order No. 702067. 1.3 The new IA compressor challenges to the scram system will reduce SLC CT package has capacity of 460 cfm at 100 psig. It is significantly the impact on the SLC CT extension risk extension more than the existing IA compressor. This instrument air metrics (e.g., ACDF and ICCDP). application. compressor replacement, along with the 3B and 3C compressors, will provide full air compressor redundancy for the Unit 3 instrument air system. DR-2004-33 EC 349505: Written to evaluate impact to external events: This Does not impact internal events model. Non-significant engineering change (EC) installs a six-foot diameter culvert pipe impact and backfill in the Unit 1 intake canal to the Cribhouse to support certain physical changes to the plant security system, which were identified by Global Security Consultants. This includes a new delay fence that will use this culvert and "road" to traverse the canal. These changes are needed to bring the security system into compliance with the new Design Basis Threat (DBT) as defined in NRC Power Plant Security Order EA-03-086, dated 4/29/03. The culvert is needed so that water supply can be maintained to the Unit 1 Cribhouse for operation of the Unit 1 diesel-driven fire pump and the " 1 B" screen wash pump. Both pumps are used to maintain fire protection header pressure for Unit 2/3.
Table 4-1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 2 7 C467090020-8956-10/16/2009 Impact URE on the Number Plant change Impact on the DR PRA Agplication DR-2004-34 EC 349120 and EC 349121: The values for the Analytical Limit Not significant. Time delay changed only Non-significant (AL) and Improved Technical Specification Allowable Value (AV) one second. Negligible impact to plant impact are not changed by this EC and no change to the Technical response, i.e., MAAP results. Specification is required. The nominal field setpoint is reduced from 13 seconds to 12 seconds. This increases margin between the nominal field setpoint and the Technical Specification Allowable Value for the time delay. DR-2004-35 EC 341545: This engineering change will install a bypass valve Low Significance. Dryer failure: Non-significant on the Unit 2B Instrument Air (IA) Dryer. The new valve will be impact an air-operated valve that is designed to open upon sensing low This improved reliability will reduce the pressure downstream of the dryer indicative of dryer clogging. A initiating event frequency. This reduction in The trend is to Control Room alarm and SER message will be generated when challenges to the scram system will reduce reduce the risk the dryer is bypassed. Resetting the bypass will require manual the impact on the SLC CT extension risk impact of the action. metrics (e.g., OCDF and ICCDP). SLC CT extension application. DR-2004-36 During 4th quarter procedure review, DOP 1100-02 Injection of HEP already indicates decision to inject Non-significant SBLC R14 noted that direction for boron injection comes from boron will be made quickly. impact DGP 02-03 as well as DEOP 400-05. HEP calculations reference the first procedure, but do not reference the second. No quantitative impact on SLC initiation HRA Notebook Appendix 1 HEP calculations associated with HEPs. SBLC injection include calcs 35 and 36. Both reference DEOP 400-05. DGP 02-03 REACTOR SCRAM provides for SLC injection, Rx level water control and other pertinent activities. This URE is written to assure HEP documentation is updated. DGP 02-03 has been added to the procedures that are reviewed quarterly for impact to the PRA.
Table 4-1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 2 8 C467090020-8956-10/16/2009 URE Number Plant change Impact on the DR PRA Impact on the AV-iplication DR-2004-37 During 4th quarter procedure review of DOA 0600-01 R44, it was Note procedure also states,"IF reactor Non-significant found that Feedwater Level Setpoint Setdown logic changes water level exceeds +48 inches AND impact have been updated in the DOA. Note, these changes are continues to rise uncontrollably, THEN related to the HPCI overflow event tracked in URE DR-2004-11 perform the following steps:"... "IF time and 24. Recommend reviewing changes to determine if MAAP permits, THEN place STEAM ISOL VLV, runs have been impacted. MO 2(3)-2301-4 control switch in PTL to prevent filling the HPCI steam line with water (bottom of line is approximately
+55"). May reduce CDF and LERF by reducing probability of RPV overfill events. DR-2004-38 During 4th qtr review of DOP 1000-03 Rev. 57, it was noted that SDC following successful HPCI requires Non-significant step 12.G.9 allows for installation of 350 degree F Rx Recirc depressurization as HPCI may not be able impact Temp Isolation Bypass. This step is further detailed in DOA to depressurize low enough to avoid SDC 1000-01 RESIDUAL HEAT REMOVAL ALTERNATIVES. It is isolation due to high temperature. not credited in the PRA. This URE is written to evaluate crediting this Operator Action. Limited benefit given that loss of DHR events are minor contributors to Dresden risk prof i l e.
Table 4-1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 2 9 0467090020-8956-10116/2009 URE Number Plant change Impact on the DR PRA Impact on the A"lication DR-2005-10 EC 354173 Revision 0. A modification at Dresden Station Unit 2 This change may impact the PRA model Non-significant to allow automatic or manual (from Control room) operation of because this part of DGA-12 applies to impact the transformer 86 load tap changing. The transformer is recovering offsite power. The non-recovery designed to provide adequate voltage (i.e. no transfer to the probabilities used in the PRA model are The trend is to diesels on undervoltage) for the anticipated range of switchyard NOT based on HRA analysis of DGA-12 reduce the risk voltages from 95% to 105% of the 345kV rating. Unit 3 LTC but, instead, were based on analysis of impact of the installation is covered under URE DR-2004-21. Reference industry experience. Evaluate the SLC CT Procedure DGA-12 Revision 56. probability of a Loss of Power to the Safety extension Busses given a LOCA signal. Note also application. that DOP 3900-01 Service Water System Operation indicates LTC must be in manual if three SW pumps are powered from the same unit. This improved reliability will reduce the initiating event frequency. This reduction in challenges to the scram system will reduce the impact on the SLC CT extension risk metrics (e.g., OCDF and ICCDP). Minor or negligible quantitative impact.
Table 4-1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 3 0 C467090020-8956-10/16/2009 URE Number Plant change Impact on the DR PRA Impact on the A" !tlication DR-2005-32 EC 347925 and EC 347926: Open and Close pressure setpoints The proposed nominal field setpoints and Non-significant for each valve are raised by 1.7 psig and the acceptable as- associated tolerances ensure with a high impact found band (expanded tolerance or ET) is enlarged from +7.8/ - degree of probability that the setpoints will 8.8 psig to +/- 10.2 psig. The proposed activity involves only the not exceed Technical Specification pressure control portion of the circuitry that controls the ERV and Allowable Value between successive the Target Rock valves. The Automatic Depressurization CHANNEL CALIBRATIONS. They also System (ADS) portion of the relief valve control logic is not ensure with a high degree of probability affected by the proposed activity. that the two low-set ERV's will open at The values for the Analytical Limit (AL) and Improved Technical pressures higher than that assumed Specification Allowable Value (AV) are not changed by this EC (1083.75 psig) in the loss of feedwater and no change to the Technical Specifications are required. transient analyses (GE-NE-0000-0025-5443-RO). Thus, the proposed setpoints are an optimization between upper and lower limit considerations. Negligible impact on RPV overpressure scenarios, which are dominated by CCF events.
Table 4-1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 3 1 0467090020-8956-10/16/2009 URE Number Plant change impact on the DR PRA Impact on the A" " lication DR-2006-05 This URE documents the PRA assessment of the Service Water EC 00357209 ALTERNATE SERVICE Non-significant Pipe Modification. URE DR-2006-05 has been created to track a WTR ROUTE TIE-IN'S FOR PIPING impact future revision to the PRA model. The PRA evaluation has found INSIDE CRIBHOUSE AND TURBINE the modification to be of low risk significance. The new section BUILDING, is also covered by this URE. of pipe is likely to be more susceptible to Earthquake and high JES 4/24/06. winds/tornado events. The added risk is likely to be of low safety Loss of Service Water due to failure of the significance as Operations will be able to isolate the new section underground piping is not likely, as the of pipe following a failure caused by one of these low probability alternate path can be utilized following events. Service Water can then be restored utilizing the existing detection of leakage from the existing underground piping. The Earthquake and high winds/tornado piping. The PRA conclusion with these event risk may be offset. considerations is that the overall risk of this plant modification is of very low risk significance.
Table 4-1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 3 2 0467090020-8956-10/16/2009 URE Number Plant change impact on the DR PRA Impact on the Afflication DR-2006-15 This modification is being performed to resolve a single point Failure of the basic event for Valve 3-4722 Non-significant vulnerability that was identified with the existing Drywell is not risk significant at this time (RAW of impact Pneumatic Air Supply valve 3-4722. This is a'Fail Closed' valve 1.06). The modification will reduce risk and any inadvertent failure will isolate air to the drywell resulting slightly. The trend is to in a loss of air to the Main Steam Isolation Valves (MSIV) and reduce the risk closure of these valves after several minutes. This modification This improved reliability will reduce the impact of the will add a redundant Drywell Pneumatic Air Supply valve 3-4724 initiating event frequency. This reduction in SLC CT so that it would require a failure of both valves before a loss of air challenges to the scram system will reduce extension to the drywell would occur. the impact on the SLC CT extension risk application. This modification will ensue that air is provided to the drywell in metrics (e.g., ACDF and ICCDP). the event that a single failure of either valve actuator/air regulator, pilot solenoid or associated solenoid electrical supply/wiring (not including failure of the U3 Instrument bus) occurs. Each Drywell Pneumatic Air Supply valve will be powered from different breakers off the U3 Instrument bus. DR-2006-22 EC356822 (U2) EC356823 (U3) Replacement of Steam Dryer Only impact on PRA is in mass of stainless Non-significant Modification. The new dryers are more rugged and weigh steel in the vessel, which can slightly impact approximately 40% more than the ones that they are replacing. modify core damage progression. The trend is to The Unit 3 dryer will be replaced in fall of 2006 and the Unit 2 MAAP parameter file was finalized prior to reduce the risk Dryer in fall of 2007. this URE being written. This URE to impact of the remain open until the next update. SLC CT This improved reliability will reduce the extension initiating event frequency. This reduction in application. challenges to the scram system will reduce the impact on the SLC CT extension risk metrics (e.g., ACDF and ICCDP).
Table 4-1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 3 3 C467090020-8956-10/16/2009 URE Number Plant change Impact on the DR PRA Impact on the Aalication DR-2006-44 EC 0000350136 CHANGE B-10 ENRICHMENT IN STANDBY Modeling of two pump operation can be This EC would LIQUID CONTROL TANK, changes the concentration from 19% considered for removal from the model. decrease the to 30% (both minimums). This change was to gain back margin This potential change in SLC success baseline CDF lost with EPU and also to address adding 8 additional fuel criteria would reduce CDF and LERF. and LERF and bundles in the future. This may change HRA timing and pump have a minor success criteria. Calc DRE-0197 "Standby Liquid Control Tank quantitative Boron Injection Volume" provides additional information. impact on the SLC CT risk application. This EC when implemented would decrease the CDF and LERF associated with ATW S sequences but would not significantly affect the risk metrics used in RG 1.174 and 1.177.
Table 41 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 3 4 C467090020-8956-10/16/2009 URE Number Plant change impact on the DR PRA Impact on the AZ~Ylication DR-2006-52 EC 361010 changes a manual valve 2(3)-1301-500 in the Iso The risk significance of manually isolating Non-significant Condenser system from "Locked Open" to "Closed". This is a this make-up source is insignificant. The impact change to a normal system lineup. Prior to using the System Notebook states the following: Contaminated Condensate Storage Tank Transfer pumps for IC 2.22 Makeup Water to the IC Condenser make-up an additional Operator Action is required. (see (Figure 2-2) additional comments). For makeup to the shell side, the IC depends upon availability of the clean demineralized water pumps, the Fire/Service Water system, the CST and the condensate transfer pumps, or the dedicated diesel-driven makeup pumps. Makeup from the CST with the condensate transfer pumps is not modeled in the system fault tree. The CST make-up was not modeled due to the redundancy already provided by the preferred sources. As noted, the CST is the least preferred source. Adding an additional source to the PRA would have a negligible impact to calculated Risk Metrics. To conclude, isolating the CST make-up as described, would be of negligible risk significance.
Table 4-1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 3 5 C467090020-8956-10/16/2009 Impact URE on the Number Plant change Impact on the DR PRA A" lication DR-2006-58 Westinghouse OPTIMA2 fuel will be burned at the Dresden Very little impact on HEP timing expected Non-significant Stations beginning with next outage (D3R19). This fuel will with decay heat bounded by the present impact reside with/in addition to the existing fuels (GE, SPC) in the Rx fuel type. vessel and the spent fuel pool. EC# 350134 will implement the fuel addition on Dresden U3 and Dresden U2 will be changed under EC# 350133 the following year. Steven Bier. It is understood that fuel parameters like core zirconium mass and decay heat serve as inputs to MAAP analyses and therefore PRA impact must be evaluated for this activity. Note, Steven Biers of Nuclear Fuel Department (610-765-5598), noted GE-14 Fuel decay heat bounds the new replacement fuel. DR-2006-60 EC 360613 - upgrade Condensate Pump Impellor, Verify MAAP Condensate flow is adequate where Non-significant parameter file and System Notebook information remain correct. credited. Extra margin will not impact the impact PRA. DR-2006-64 DOP 1300-02 was revised to provide direction associated with Lowering HEP would have very low risk Non-significant recovering the IC after a group V isolation. PRA basic event significance and no impact on ATWS impact 21COP-GROUP5-H--, OP ACT: RESET IC LOGIC AFTER related sequences. SPURIOUS GROUP V ISOLATION with prob. 3E-02 addresses this recovery. With procedural direction, the HRA Calculation should be revisited.
Table 4-1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 3 6 0467090020-8956-10/16/2009 URE Number Plant change Impact on the DR PRA Impact on the A " " lication DR-2006-65 There are slight discrepancies in the Initiation prerequisites The System Notebook states (in System Non-significant between the System Notebook and DOP 1300-03 Revision 22 Engineer's interview section, "System impact (through 24). It was also noted that DOP 1300-03 revision 22 initiates automatically if 1070 psi RPV had modified the initiation setpoint information. 1. IF RPV pressure occurs for 13 seconds." Earlier in pressure is > or = to 1055 psig (1047 to 1063 psig), THEN IC will the notebook, it is stated: PS 2(3)-263-53A automatically initiate after 12 seconds (11-13 sec) (Tech Spec through D initiate IC Initiates IC operation Allowable Values 1068 psig for <_ 15 sec) .... See additional due to high vessel pressure (1070 psig for comments. 15 seconds). The initiation logic details have a negligible impact on the IC success criteria. IC success criteria do not influence the ATWS risk assessment. DR-2006-66 DOP 1500-02 Revision 51 provides precautions on starting the Note, a second division of CCSW pumps is Non-significant 3rd and 4th CCSW pumps when an auto initiation signal is not not required for success, so PRA impact impact present. It reads: judged not likely. a. IF TR 86(32) Load Tap Changer is operating in MANUAL, THEN PRIOR to starting the third OR fourth CCSW Pump, verify voltage on the applicable ECCS bus is greater than 4000 Volts, with a preferred target voltage of 4160 Volts: 02(3)A OR 2(3)B CCSW Pump - Bus 23-1(33-1). p2(3)C OR 2(3)D CCSW Pump - Bus 24-1(34-1)
Table 41 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 3 7 C467090020-8956-10/16/2009 URE Number Plant change Impact on the DR PRA Impact on the App , lication DR-2006-69 EC 350136 Revision 1 enriches Boron in the SBLC tank for Unit In addition, the quantity of natural enriched This EC would 3. EC350135 RO enriches Boron in the Unit 2 SBLC tank. The Boron acid and Borax chemical required for have a minor purpose of this modification is to change the isotopic enrichment the alternate standby liquid control injection quantitative of B10 in the Standby Liquid Control Tank (1103). the use of (per DEOP 0500-01) will be increased to impact on the enriched B10 will allow a single SBLC pump operation to meet obtain an equivalent cold shutdown born SLC CT risk the shutdown reactivity equivalency requirement of 10CFR50.62 concentration as that in the Standby Liquid application by (ATWS rule), hence, this modification will revise the current Control Tank. decreasing the emergency operating procedure from starting two SBLC pumps Currently at EPU condition, the cold baseline CDF to starting only one SBLC pump. shutdown, xenon free shutdown margin and LERF but with optimized loading patterns using GE14 would not alter See similar discussion in URE DR-2006-44. fuel cannot be met alone with the existing the chemical content in the Standby Liquid conclusions. Control tank. To compensate for the negative reactivity shortfall, 4 - 8 additional Already new fuel bundles were utilized per cycle to assessed in get more Gadolinium (reactivity poison) into URE DR-2006- the core at a substantial fuel cost penalty. 44. It is expected the same shortfall will exist when Dresden Unit 3 switches to the Optima2 fuel design. Further, the EPU Margin recovery team and the initiative to increase the Safety Relief Valve (SRV) setpoint tolerance also can benefit from the extra boron to control the peak ATWS pressure and containment load margins.
Table 4-1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 3 8 C467090020-8956-10/16/2009 URE Number Plant change Impact on the DR PRA Impact on the App , lication DR-2006-69 The current minimum concentration of (cont'd) natural boron (with a 1310 enrichment of 19atom%) required in the SBLC tank for injection into the reactor core to meet the cold shutdown margin requirement is being changed to allow future adjustment of the fuel reload analyses. The OPTIMA 2 fuel transition project team has determined that a 1310 enrichment of 30 a% will provide sufficient shutdown margins for D3C20 and subsequent core reloads for both Units 2 and 3. DR-2006-75 EC 351639 adds a redundant AOV for drywell pump back air With valve 4722 currently failed, the CDF Non-significant supply. 2PCAV4722----
V-- PUMP BACK AOV FLOW TO RAW is 1.06 and LERF RAW is 1.14. The impact TARGET ROCK FAILURE TO FUNCTION currently models a valve has low risk significance. See DR- The trend is to valve, that if failed, would impact the inboard MSIVs and 2006-15. reduce the risk potentially the target rock valve. This improved reliability will reduce the impact of the initiating event frequency. This reduction in SLC CT challenges to the scram system will reduce extension the impact on the SLC CT extension risk application. metrics (e.g., ACDF and ICCDP).
Table 4-1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 3 9 C467090020-8956-10/16/2009 URE Number Plant change Impact on the DR PRA Impact on the A---lication DR-2006-76 Startup of SBO Diesel Procedure Review. Steps in DOP 6620-5 Operator Feedback well documented in Non-significant and failure mechanisms may not have been captured in the HRA Table 50-1 of calculations. Manipulation impact calculation
#50. Manipulation times appear to be inconsistent in time of 11 minutes used in the calculation the documentation. Manipulation times used are conservative. for the ASEP calculation appears to be See SRME review comments in the additional comments section conservative because the hard card usage below. supports a time of - 5 minutes. Note, manipulation of inventory make-up after Bus restoration removes some of the conservatism. HRA calculation credits Operator Training (simulator requalification exercises) in selecting the lower bound ASEP time reliability correlation curve. SRME review of DOP 6620-5 noted that prior to energizing the SBO, multiple handswitches are to be placed in PTL. "Steps G.1 to G.5 place 4kV loads into PULL-TO-LOCK according to a table, which allows a controlled re-start per DGA- 12. The steps in these tables may be performed concurrently by multiple operators." " IF ALL Division 1 (Buses 23 & 23-1) AND ALL Division 2 (Bus 24 & 24-1) are lost, THEN use Table 1, Loss of Division 1 AND Division 2 4 kV Buses 23, 23-1, 24 AND 24-1 (Page 5)." This step is not in the HRA calculation. Unclear if failure would result in failure of SBO D/G.
Table 4-1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 40 C467090020-8956-10/16/2009 Impact URE on the Number Plant change Impact on the DR PRA Agolication DR-2006-76 SBO D/Gs have no impact on SLC (cont'd) response for ATWS. Even if the additional execution steps are added, the impact on the HEP is judged to be negligible. DR-2006-81 EC 0361593 REVISED ENCLOSURES AND HEAT TRACING Preliminary Assessment is that loss of Heat Non-significant FOR HPCI CROSS-TIE PIPING and Calculation DRE06-0013 Trace for the CST suction for HPCI is not impact HEAT TRACING FOR THE HPCI RE-ROUTE PIPING LINES risk significant. Heat Trace is normally ABOVE GRADE may indicate a failure mode of HPCI function monitored. with CST suction. This needs to be evaluated. DR-2006-87 The Fire Risk Analysis was performed prior to issuance of DOP The U2 alternate battery is important in the Negligible 6900-18 125 VDC AND 250 VDC PORTABLE BATTERY 2000 Dresden IPEEE Fire Risk Analysis. impact on CHARGER USE. Use of the 125 VDC Portable Battery Charger, The scenario is associated with a large oil ATWS may be an alternative to the alternate battery in this scenario. fire involving Unit 2 Reactor Feedwater scenarios. Further research is needed to determine if the permanent plant Pump C or a fire involving MCC 26-1. This Therefore, non- receptacle for the portable battery charger remains accessible. is because of the location of the cables significant The importance of the alternate batteries in the Fire PRA would needed for the Unit 2 DC power system. impact on SLC be significantly reduced if this was an acceptable alternative. The Unit 3 DC power feed to one train of CT risk the Unit 2 DC system as well as the Unit 2 evaluation. AC power cable to the battery charger for the redundant DC train are exposed to a common hazard. Although the circuits are located in separate trays, they are stacked vertically. The occurrence of a postulated large fire event requires an operator action to either align the spare battery charger or to connect the spare Unit 2 battery bank.
Table 4-1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 4 1 C467090020-8956-10/16/2009 URE Number Plant change Impact on the DR PRA Impact on the Agolication DR-2006-87 Therefore, the spare battery bank and this (cont'd) action is relatively important as demonstrated above. With the loss of the U2 battery charger, the time frame available for aligning the Unit 2 Alternate Battery is 4 hours. (RHJ, 12/11/08)
Ops now has a portable generator. Specific procedural guidance on its use in operating ERVs on loss of 125 VDC is given in TGS-3, sent to LKL on 12/10/08. The procedure apparently involves making splices at containment electrical penetrations. Potential impact on CDF and LERF is alternate battery can be credited in a timely manner. DR-2006-88 Replacement and Upgrade of 2A Service Water Pump (2-3901- The "oiler' subsystem will be eliminated. Non-significant A). Installation of a slightly larger diameter pump impeller than As a result, the lubrication of the line shaft, impact that which is currently installed. This will actually bring the transition, and upper suction bell bearings impeller size back to original design. The impeller material will will change from oil to water lubricated. The trend is to be changed from bronze to ASTM A-316L stainless steel. The Water will be taken from a tap off the pump reduce the risk "oiler" subsystem will be eliminated (see additional comments). - discharge nozzle. impact of the No action required. Success Criteria judged not to be impacted. SLC CT No new dependencies added. This improved reliability will reduce the extension See URE DR-2004-29. initiating event frequency. This reduction in application.
Table 4-1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 4 2 C467090020-8956-10/16/2009 URE Number Plant change Impact on the DR PRA Impact on the Application DR-2006-88 challenges to the scram system will reduce (cont'd) the impact on the SLC CT extension risk metrics (e.g., OCDF and ICCDP). Note System Notebook contains following paragraph that should be changed: "In addition to the standard motor bearing oil reservoirs, each pump is equipped with bearing oiler and reservoirs for the pump shaft. The oil feed to the upper bearing (shaft tube bearing) is four to six drops per minute, and the lower bearing (suction bell bearing) three to four drops per minute. The oiler is equipped with a solenoid operated valve that permits oil flow only when the pump is in operation and a small adjustment valve downstream of the solenoid valve to control the oil flow." Review all 5 pump status to determine if description should vary between pumps. No impact on CDF and LERF. DR-2007-10 EC 364135 and EC 364136 LPCI Logic Changes are being Negligible impact on execution error Non-significant issued as contingency modifications. If relays fail, the relays will probability. SLC initiation HEP dominated impact be replaced. Two relays will replace four relays, but the function by cognitive error probability, which is of the relays will not change. If installed, the System Notebook influenced by the time available. and modeling may need to be updated.
Table 4-1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 4 3 C467090020-8956-10/16/2009 URE Number Plant change Impact on the DR PRA Impact on the A12lication DR-2007-13 DGP 02-03, Rev 076, REACTOR SCRAM DOP 1100-02, Rev 016, INJECTION OF Non-significant Under contingency plan for failure to scram, changed "initiate STANDBY LIQUID CONTROL impact on SLC SBLC" to: "(2) Initiate ONLY One SBLC Pump." Also changed initiation HEPs, the hardcard titled "SCRAM ACTIONS (NSO)" to note one SBLC Added the following clarification
: negligible Pump is to be initiated. See below for similar changes to DOP impact on SLC 1100-02 Rev. 16. Note also, Calculation DRE98-0090, 1. Select the appropriate injection path with CT risk INJECTION TIME FOR THE STANDBY LIQUID CONTROL SBLC INJECTION CONTROL switch on application. (SLC) SYSTEM INTO THE REACTOR VESSEL DURING A Panel 902(3)-5. POSTULATED ATWS EVENT. DRE98-0129 HOT SHUTDOWN For injection due to ATWS, SYS 1 OR SYS BORON WEIGHT (HSBW) WORKSHEET 1, PART 2, DRE98- 2 (only one SBLC Pump will inject). 0197, "STANDBY LIQUID CONTROL TANK BORON For injection due to Alternate Injection INJECTION VOLUME, DRE98-0127 BORON INJECTION Systems, SYS 1 & 2 OR SYS 2 & 1 (both INITIATION TEMPERATURE (BIIT) WORKSHEET 1, PART 3, SBLC Pump will inject). See also DR-2006-44 Boron Enrichment. Also, added the following: 8. &#xa9; IF potential fuel damage is suspected See similar discussion in URE DR-2006-44 for impact on SLC (i.e., RPV Level is below TAF), THEN inject success criteria. the entire SBLC Tank contents prior to initiating makeup to the SBLC tank OR securing SBLC. &#xa9; (W-2)
Table 4-1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 4 4 C467090020-8956-10/16/2009 URE Number Plant change Impact on the DR PRA Impact on the A"lication DR-2007-13 Added "when tank level reaches 8%" in (cont'd) discussion section. Boron injection is terminated when all control rods are at or beyond position 04, OR as determined by the Qualified Nuclear Engineer OR when tank level reaches 8%. Negligible impact on execution error probability. SLC initiation HEP dominated by cognitive error probability, which is influenced by the time available. DR-2007-20 The internal events model contains an Operator Action to open Current Fire PRA model is conservative. Non-significant the IC 1301-3 valve when the battery power is depleted. No impact on ATWS related sequences. impact Consider adding this operator Action when updating the Fire PRA model. See insight # 3 of the IPEEE Report.
Table 4-1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 4 5 C467090020-8956-10/16/2009 URE Number Plant change Impact on the DR PRA Impact on the Agolication DR-2007-26 This design change replaces the existing analog control system The performance requirements for the new Non-significant with a digital control system that will perform the same turbine DEHC System remain unchanged from the impact generator control and pressure regulation functions as currently existing EHC System. These include the The trend is to performed by the existing system. basic control system functions, speed reduce the risk control accuracy and gains, load control, impact of the load reference range, valve regulation SLC CT requirements, load setback rates, reactor extension pressure regulation functions, flow control application. valve position limitation requirements, valve stroke times, pressure control response time, bypass valve response times, turbine trips and trip delay times. The new design change should improve control and reliability. This improved reliability will reduce the initiating event frequency. This reduction in challenges to the scram system will reduce the impact on the SLC CT extension risk metrics (e.g., OCDF and ICCDP).
Table 4-1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 4 6 0467090020-8956-10/16/2009 URE Number Plant change Impact on the DR PRA Impact on the Afflication DR-2007-29 URE DR-2007-29 This improved reliability will reduce the Non-significant Description
: Full 100% flow pre-filter system is being put in place. initiating event frequency. This reduction in impact Currently 40% of FW flow is filtered. This change is covered by challenges to the scram system will reduce The trend is to EC362414, EC362415, EC362416 and EC362418 and EC the impact on the SLC CT extension risk reduce the risk 368335, Plant Process Computer Tie-in for 100% Condensate metrics (e.g., OCDF and ICCDP). impact of the Filtration System. This system will filter the water before the FW Decreasing the plugging probability from SLC CT Reg. Valves. Therefore, use of SBCS will be less likely to plug 0.5 to 0.1 decreases CDF by 1 % and LERF extension the reg. valves. Modeling of plugging is captured with basic by 3%. application. event 2FWPH-CLOGFRVF--
SW CLOGS FRVs which has a A common cause CD/CB failure maybe failure probability of 0.5. introduced with this modification. Impact is judged to be insignificant. Overall impact will be to reduce the CDF and LERF. Operating procedure is DOP 3300-13. DR-2007-36 Recent groundwater tests have identified the presence of tritium Heat Tracing may introduce additional Non-significant at levels that indicate there is a leak in the buried piping in the dependency in freezing weather. Following impact vicinity of the Contaminated Condensate Storage Tank (CCST). LOSP, HPCI injects from CST. Moving EC 360021 rerouted the buried aluminum cross-tie piping that water, not likely to freeze. URE DR-2007- supports the HPCI suction and test return lines in the vicinity of 36 generated to consider addressing in the tanks with above ground piping and to abandon the current next update. underground piping. This EC provides heat tracing and insulation No significant impact on CDF and LERF. for the piping and revises or replaces the existing weather proof enclosures to protect the valves during freezing weather.
Table 4-1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 4 7 C467090020-8956-10/16/2009 URE Number Plant change Impact on the DR PRA Impact on the A"lication DR-2007-44 The following pre-requisite was added to the alternate battery No impact to internal events model. Non-significant surveillance procedure, DES 8300-52: "Verify Unit 2 2A 125 VDC impact Battery Charger (2-83125-2A) is available. [Ref. Dresden IPEEE Fire PRA Insight for fire at U2 Feedwater motor driven pump or MCC 26-1]" DR-2007-45 OP-DR-103-102-1002 STRATEGIES FOR SUCCESSFUL The purpose of the document is to improve Non-significant TRANSIENT MITIGATION Revision 0 may impact HRA response to transients. Therefore, the PRA impact assumptions. The purpose of the document is to improve modeling is potentially conservative. response to transients. Waiting until the next PRA update to perform a detailed review is acceptable. Currently credited crew response actions are judged to be excellent as assessed in the simulator observations and crew interviews. Further enhancement should not be discernible within the uncertainties of the PRA.
Table 4-1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 4 8 0467090020-8956-10/16/2009 URE Number Plant change Impact on the DR PRA Impact on the Aff2lication DR-2007-46 EC 00366367 Evaluation of IC Diesel Oil Make-Up provides Supports current assumptions. No change Non-significant support for IC PRA Notebook Assumptions. The notebook to the PRA model. impact currently states: "Each diesel has a day tank that holds -75 No effect on ATWS sequences. gallons of fuel oil. The 75 gallons is sufficient to provide --8 hours of continuous operation. Each day tank is filled from the Unit-2 Diesel Generator fuel oil system using the Unit 2 Diesel oil transfer pump. Provisions are available for filling the tanks from either a tanker truck or the U-2 Diesel Generator fuel oil storage tank using a portable pump. The DG fuel oil pump supplies fuel oil at approximately 75 gpm. Therefore, the in-plant operators should be reminded to be very alert during filling."
Table 4-1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 4 9 C467090020-8956-10/16/2009 URE Number Plant change Impact on the DR PRA Impact on the Agolication DR-2007-47 EC EVALUATION
# 365996 STATION BLACKOUT (SBO) RHJ (12/3/08) - Assumption 12 on page 6- Non-significant DIESEL MINIMUM AIRFLOW COMPUTATION 4 of the EP notebook includes the impact The SBO diesel/generator sets should be used for continuous following: operation with a single vent supply fan capable of supplying "SBO EDG 2(3) operability, as modeled in 42,000 cfm in service under normal environmental conditions the fault trees, requires operability of both when the outside air temperature does not exceed 87&deg;F. The cooling trains (including both Radiator Fans outside air temperature limit for using a single fan application to 1 and 2 in each train), Room Ventilation maintain the SBO diesel/generator rooms below the maximum Fans 6001 and 6002 (including Exhaust design temperature of 120&deg;F with the diesel/generator sets Damper 2(3)-5790-6018A/B and Inlet loaded up to 110% will be 87&deg;F. The SBO Vent primary and Dampers 2(3)-5790-6013 and 2(3)-5790-secondary supply fans must be used in a two-fan configuration 6014 for Fan 6001; and Exhaust Damper for outside air temperatures above 87&deg;F. 2(3)-5790-6018C/D and Inlet Damper 2(3)- 5790-6015 for Fan 6002), and Equipment Room Vent Fans 6004 and 6005 (including Recirc Damper 6025 and Inlet Damper 6024A and B for Fan 6004 and Exhaust Damper 2(3)-5790-6029 and Inlet Damper 2(3)-5790-6028 for Fan 6005)." The fault tree has failure of the two room ventilation fans 6001 and 6002 under an OR gate. The current modeling applies to outside air temperatures equal to or greater than 87F.The model is conservative for lower temperatures. SBO D/Gs have no impact on SLC response for ATWS.
Table 4-1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 5 0 C467090020-8956-10/16/2009 URE Number Plant change Impact on the DR PRA Impact on the A"lication DR-2007-49 EC 366256, Revision 0 and EC 366676 Rev. 0 provide guidance No Impact. The PRA model does not Non-significant and documentation for installing a General Electric (GE) HGA model at the relay level. impact Relay in the 125-V do control circuit of the Unit 2 and Unit 3 EDG output breakers. This breaker, EPN 3-67341-7, is located at Switchgear 34-1, Cubicle 7, in the Unit 3 Reactor Building (Fl. El. 545'-6"). The new HGA relay will act as an interposing relay. The existing Unit 3 EDG breaker closing logic will energize this relay. A contact from this new relay will be added in series with the breaker's closing coil. The breaker closing coil will energize following the energization of the interposing relay. This modification is being performed to address a low voltage condition at the closing coil of the output breaker. The current draw of the HGA relay is substantially less than that of the breaker's closing coil. This installation will result in an improved voltage at the breaker coil, allowing it to energize and close the breaker during all plant emergency conditions as designed. Reference ECs 5476 and 5856 for Unit 2 and Unit 3 EDGs. DR-2007-51 DOP 6620-14, Rev 006, SBO D/G 2(3) LOCAL EMERGENCY Note, minor impact to baseline CDF would Non-significant OPERATION stated, "Due to the failure of the Unit 2 SBO be expected. (Note added by RHJ - See impact inverter, EC 367006 has been installed which supplies all previous URE DR-2000-26 in which the required AC power to Panel 6B-1 from Unit 3 SBO Panel 7B-1. impact was estimated.) All normal and emergency functions for the Unit 2 SBO are available." Note, this is a temporary Change. SBO D/Gs have no impact on SLC response for ATWS.
Table 4-1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE DRESDEN PRA MODEL Dresden SLC CT Extension 5 1 C467090020-8956-10/16/2009 URE Number Plant change Impact on the DR PRA Impact on the A"lication DR-2008-02 DOP 0500-10,10/26/07, INSTALLATION OF SCRAM BYPASS Significant impact not expected. Non-significant JUMPERS impact DAN 902-7 C-5, 11/06/07,PRESSURE CONTROL MAJOR TROUBLE DOS 0010-38,12/14/07, DIESEL DRIVEN PORTABLE PUMP DR-2008-23 An initial review of DCPs found a number of DCPs and CALCs No significant changes were found. This Non-significant that had the potential for PRA impact and require further review. eval will be updated after further review. impact The lists are found on the PRA shared drive next to the URE database and are named "DCPs from 7-1-08 and 10-31-08.xls" and "Calcs Dm403 7-1-08 to 10-30-08.xls" Table 4-2 Status of Identified Gaps to Capability Category II of the ASME PRA Standard Dresden SLC CT Extension 5 2 0467090020-8956-10/16/2009 Tittle . ~. Ap IM Gap #1 Although a reviewer may determine that the existing Dresden IE-C12 Open. This is mainly a documentation No impact on ATWS ISLOCA IE calculation and documentation is sufficient for issue and is judged to have a sequences which Capability Category II, it is recommended that the following negligible impact on the quantitative influence SLC CT documentation enhancements be performed to remove doubt: results. extension request. " Address each applicable ISLOCA contributor explicitly and show the associated calculations " Specify each of the failure modes considered in the analysis " Provide the logic model used in the evaluation " Provide additional information regarding the pipe rupture assessment and derivation of the associated failure probabilities. " Address any changes in ISLOCA frequency due to CIV Tech Spec changes.
Table 4-2 Status of Identified Gaps to Capability Category 11 of the ASME PRA Standard Dresden SLC CT Extension 5 3 C467090020-8956-10/16/2009 Tit e - qt q4 ApPRUk?le a FT 1 gm nt importance to i , dart.' Gap #2 Reaching a safe stable end state defines the "success" of a SC-A5 Open. Enhance documentation to Not significant given sequence and therefore the mission time of the sequence to justify why extending FTR mission that the current achieve the Level 1 end state. The mission times for failure to run times beyond 24 hours for loss of DHR approach is judged calculations are assessed at 24 hours or less if specifically sequences is not necessary. The to be reasonable for justified. considerations that support the choice long term scenarios Extending the FTR mission time beyond 24 hours for loss of DHR of the mission time are as follows: (e.g., long term loss of DHR). sequences is considered to be an unnecessary ry complication and Equipment failure rates does not affect PRA insights nor does it significantly affect its (failures/hour) are judged to No impact on ATWS quantitative evaluation. be too conservative for times sequences which greater than a few hours of influence SLC CT operation. extension request. For times greater than a few hours, the ability to repair and recover equipment can compete with the failure rate such that there can be considered to be a steady state equilibrium condition reached.
Table 4-2 Status of Identified Gaps to Capability Category II of the ASME PRA Standard Dresden SLC CT Extension Applicable lmportanqeto s l. t 1 5 4 C467090020-8956-10/16/2009 Gap #3 Although a reviewer may determine that the existing Dresden SC-A6 Open. No impact on ATWS ISLOCA IE calculation and documentation is sufficient for Same as IE -C12. sequences which Capability Category II, it is recommended that the following influence SLC CT documentation enhancements be performed to remove any doubt: extension request. " Provide greater specificity on which lines were considered and the associated line configurations and interlocks (e.g., a table) " Provide greater specificity on the surveillance test implications (e.g., a table) " Provide greater specificity regarding the actual ISLOCA frequency calculation (e.g., locate the fault tree referenced in App. A of the IE Notebook and include in the documentation) " Although not necessarily required for Capability Category 11, provide additional detail on the low pressure piping calculations (e.g., example calculation
; key assumptions - such as <1 E-4 threshold). Include system engineer and operational experience as well as EOPs and other pertinent operational procedures that mitigate the risk of core damage into system analysis. Additionally, document this information in the System Notebook. Gap #4 Explicitly define and document component boundaries in the SY-A8 Open. This is mainly a documentation No impact on ATWS Component Data Notebook (DR PSA-010) and then verify that issue and is judged to have a sequences which component failure rate quantification based on plant-specific negligible impact on the quantitative influence SLC CT failure data obtained from the Maintenance Rule database is not results. extension request. affected.
Table 4-2 Status of Identified Gaps to Capability Category II of the ASME PRA Standard Dresden SLC CT Extension 5 5 C467090020-8956-10/16/2009 Applicak le importance to Title Qtt rj t , r #f , went tus l Cr Win._ Gap #5 The PRA model is judged to include proper treatment of SY-A12 Open. Enhance documentation to Not significant. The components and failure modes for Capability Category II justify why certain components and PRA model is requirements. Additional investigation in determining whether all failure modes may be excluded. judged to include appropriate components and failure modes are included could be proper treatment of performed; however, this is judged not to have significant components and beneficial impact on the model. failure modes for Capability Category II requirements. Gap #6 The PRA model is judged to include proper treatment of SY-A14 Open. Enhance documentation to Not significant. The components and failure modes for Capability II requirements. justify why certain components and PRA model is Additional investigation in determining whether all appropriate failure modes may be excluded. judged to include components and failure modes are included could be performed; proper treatment of however, this is judged not to have significant beneficial impact on components and the model. failure modes for Capability Category II require ents. Gap #7 Consider expanding the basis for SSC survivability evaluation. SY-A20 Open. Enhance the documentation for Not significant. SLC survivability in Event Tree No impact on ATWS Notebook. sequences which influence SLC CT extension request. Gap #8 Add initiation logic to EDG. SY-1311 Open. Enhance documentation to None. The updated indicate that the EDG initiation logic PRA model meets failure probability is subsumed into the SY-1311 at Capability EDG failure probability. Category I, which is sufficient for this a lication.
Table 4-2 Status of Identified Gaps to Capability Category II of the ASME PRA Standard Dresden SLC CT Extension 5 6 0467090020-8956-10/16/2009
; Tt 5073U , - " AP licable ;~ Gym t . ImpQrtance to Gap #9 Areas for potential enhancement in the future are: SY-C1 Open. Enhance the System Notebook None. This is judged documentation to provide more to be a " Completing Section 2.5 in System Notebooks (spatial transparency. documentation dependencies) consideration only " Adding discussion related to the treatment of logic loops and does not affect the technical adequacy of the PRA model. Gap #10 Although this will not significantly impact the HRA results, future HR-D3 Open. Possible upgrade to the pre- None. The updated PRA updates should include an assessment of the quality of plant initiator HRA to include specific PRA model meets written procedures and administrative controls as well as human- quantifications for each pre-initiator HR-D3 at Capability machine interface for both pre-initiator and post-initiator human HEP would be strict compliance with Category I, which is actions. the standard. This is not considered sufficient for this necessary for most applications. It is application. Possible upgrade to the pre-initiator HRA to include specific recommended that Dresden await quantifications for each pre-initiator HEP would be a strict further ASME clarification on this item compliance with the standard. This is not considered necessary before proceeding. for most applications. It is recommended that Dresden await further ASME clarification on this item before proceeding. This There is no measurable impact on the can be confirmed for each application in lieu of performing the SLC CT extension application. quantifications.
Table 4-2 Status of Identified Gaps to Capability Category II of the ASIVIE PRA Standard Dresden SLC CT Extension 5 7 C467090020-8956-10/16/2009 Title J ~ -- D CStJ99"': :I: AppliCable
--- tmportwe to A n Gap #11 Employ and document the methodology used for determining the DA-C6 Open. A detailed determination is Not significant. The standby component number of demands to include plant specific: judged to require a significant level of PRA model is resources with marginal quantitative judged to " surveillance tests benefit. An estimate of the number of appropriately " maintenance acts demands based on a review of estimate the number surveillance tests and other means is of demands for " surveillance tests or maintenance on other components judged to be sufficient. standby equipment " operational demands for calculating the standby failure rate. Additional demands from post-maintenance testing should not be Any additional included. refinements to the number of demands would have a limited or negligible vmI111I?fk
" L'-7w " act. Gap #12 Failure data developed should be based on plant surveillance DA-C7 Partially resolved. The failure data Not significant. The actual practices (as opposed to plant requirements) and was based on actual plant data. PRA model is documented appropriately. However, the number of demands and judged to exposure data was based on actual appropriately data or estimates from the Dresden estimate the number System Managers. Estimating number of demands for and of demands and exposure data meets exposure time for Category I for the ASME PRA calculating the Standard. component failure probabilities. Any additional refinements to the number of demands would have a limited or negligible uantitative impact.
Table 4-2 Status of Identified Gaps to Capability Category II of the ASME PRA Standard Dresden SLC CT Extension 5 8 0467090020-8956-10/16/2009 Title Qr ,-. , of $ ., l n Gap #13 Standby failure data development should base the time that DA-C8 Open. A detailed determination is Not significant. The components were in standby on plant operational records. This judged to require a significant level of PRA model is should be documented appropriately. resources with marginal quantitative judged to benefit. An estimate of the time that appropriately components were in standby is judged estimate the time to be sufficient. that components were in standby for calculating the standby failure rate. Any additional refinements to the time in standby would have a limited or negligible quantitative impact. Gap #14 Failure data development using surveillance test data should fulfill DA-C10 Open. A detailed determination is Not significant. The the requirements of DA-C10, and be documented appropriately. judged to require a significant level of surveillance test Review surveillance test procedures and identify all failure modes resources with marginal quantitative procedures are that are fully tested by the procedures. Include data for the failure benefit. The surveillance tests judged to address modes that are fully tested. The results of unplanned demands address the primary failure modes the appropriate on equipment should also be accounted for. (e.g., pump fails to run or start, valve failure modes with fails to open/close) in the PRA model. respect to the estimated number of demands. Any additional refinements to the number of demands for each failure mode would have a limited or negligible uantitative impact.
Table 4-2 Status of Identified Gaps to Capability Category II of the ASIIAE PRA Standard Dresden SLC CT Extension 5 9 C467090020-8956-10116/2009
'Fit I pgon Gap #15 As needed in maintenance unavailability determination, perform DA-C12 Open. This deviation from the SR is None. The updated interviews of maintenance staff for equipment with incomplete or not considered to significantly alter the PRA model meets limited maintenance information and document appropriately. PRA qualitative or quantitative results. DA-C12 at Capability Category I, which is sufficient for this application. The uncertainty distribution on the maintenance unavailability does not affect the mean estimate of the PRA. Gap #16 QU-F5 states to DOCUMENT limitations that would impact QU-F5 Open. Plant specific limitations are None. The model is applications. expected well defined in the existing not used beyond its PRA notebooks. A consolidated list known limitations for could be provided. PRA applications. This is a documentation consideration only. Gap #17 Addendum B of the ASME PRA Standard added SRs to QU-F6 Open - These new SRs will be None. This is a document the quantitative definition used for significant basic addressed during the next full PRA documentation event, significant cutset, significant accident sequence, and model update, but providing these issue. The model is significant accident progression sequence in the CDF and LERF definitions should not have an impact not being changed analysis. on the quantitative results from the to address this item. PRA model. Gap #18 Addendum B of the ASME PRA Standard added SRs to LE-G6 Open - These new SRs will be None. This is a document the quantitative definition used for significant basic addressed during the next full PRA documentation event, significant cutset, significant accident sequence, and model update, but providing these issue. The model is significant accident progression sequence in the CDF and LERF definitions should not have an impact not being changed analysis. on the quantitative results from the to address this item. PRA model.
4.7 GENERAL CONCLUSION REGARDING PRA CAPABILITY Dresden SLC CT Extension The Dresden PRA maintenance and update processes and technical capability evaluations provide a robust basis for concluding that the PRA is suitable for use in risk-informed licensing actions, specifically in support of the requested extended CT for the SLC system. Previously identified gaps to specific requirements in the ASME PRA Standard have been reviewed to determine which gaps might merit application-specific sensitivity studies in the presentation of the application results. No gaps were identified as needing specific sensitivity studies for this SLC CT extension request. 6 0 C467090020-8956-10/16/2009 5.0
 
==SUMMARY==
AND CONCLUSIONS 5.1 SCOPE INVESTIGATED This analysis evaluates the acceptability, from a risk perspective, of a change to the Dresden TS for the SLC system to increase the CT from 8 hours to 72 hours when both SLC subsystems (i.e., both trains) are inoperable. The analysis examines a range of risk contributors as follows: " The Dresden Full Power Internal Events (FPIE) PRA model is used to quantitatively address risk impacts. " Low Power operation and Shutdown / Refueling modes are determined to be negligible contributors and are not quantitatively assessed. " The IPEEE Fire analysis and other fire studies (e.g., NUREG/CR-6850) are used to provide qualitative and semi-quantitative insights, determining that fire hazards are negligible contributors. " Seismic risk contributors are determined to be negligible based on qualitative insights from the NUREG-1150 study. " Other External Event risks were found to be negligible contributors based on the Dresden IPEEE. 5.2 PRA QUALITY Dresden SLC CT Extension The PRA quality has been assessed and determined to be adequate for this risk application, as follows: " Scope - The Dresden PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, and common cause events. The PRA has the necessary scope to appropriately assess the pertinent risk contributors. " Fideli - The Dresden PRA model (D205B) is the most recent evaluation of the risk profile at Dresden for FPIE challenges. The PRA reflects the as-built, as-operated plant. " Standards - The PRA has been reviewed against the ASME PRA Standard [Ref. 5] and the PRA elements are shown to have the necessary attributes to assess risk for this application. " Peer Review - The PRA has recently received a Peer Review. Based on the Peer Review results, and subsequent PRA updates to resolve all significance 61 C467090020-8956-10/16/2009 level "A" and "B" F&O's, the PRA is found to have the necessary attributes to assess risk for this application. " Appropriate Quality - The PRA quality is found to be commensurate with that needed to assess risk for this application. 5.3 QUANTITATIVE RESULTS VS. ACCEPTANCE GUIDELINES As shown in Table 5.3-1 below, the base results of the risk assessment indicate that the ACDF, ICCDP, ALERF, and ICLERP risk metric values are below the acceptance guidelines as defined in the corresponding risk significance guidelines from RG 1.174 and RG 1.177. This analysis demonstrates that the proposed TS change satisfies the risk acceptance guidelines in RG 1.174 and RG 1.177, and therefore meets the intent of very small risk increases consistent with the Commission's Safety Goal Policy Statement.
 
==5.4 CONCLUSION==
S Table 5.3-1 RISK ASSESSMENT BASE RESULTS Dresden SLC CT Extension This analysis demonstrates the acceptability, from a risk perspective, of a change to the Dresden Technical Specification (TS) for the Standby Liquid Control (SLC) system to increase the Completion Time (CT) from 8 hours to 72 hours when both SLC subsystems (i.e., both trains) are inoperable. This analysis demonstrates that the proposed TS change satisfies the risk acceptance guidelines in RG 1.174 and RG 1.177. The TS change meets the intent of very small risk increases consistent with the Commission's Safety Goal Policy Statement. 6 2 C467090020-8956-10/16/2009 Risk Metric Value Acceptance Guidelines Reference OCDF 3.2E-08/yr
<1.0E-06/yr RG 1.174 ICCDP 3.2E-08 <5.0E-07 RG 1.177 ALERF 1.8E-08/yr
<1.0E-07/yr RG 1.174 ICLERP 1.8E-08 <5.0E-08 RG 1.177 Dresden SLC CT Extension Additionally, a PRA technical adequacy evaluation was performed consistent with the requirements of RG 1.200, Revision 1. This included a process to identify potential key sources of model uncertainty and related assumptions associated with this application. This investigation of modeling uncertainties resulted in the identification of issues that could both decrease and increase the calculated risk metrics. None of these identified sources of uncertainty were significant enough to change the conclusions from the risk assessment results presented here. 6 3 0467090020-8956-10/16/2009 
 
==6.0 REFERENCES==
 
Dresden SLC CT Extension
[1] RG 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk Informed Activities," Revision 1, January 2007. [2] RG 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 1, November 2002. [3] RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking
: Technical Specifications," August 1998. [4] EGC Risk Management Team, DR-PSA-014, Dresden Probabilistic Risk Assessment Quantification Notebook, DR05B, April 2006. [5] "Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications," (ASME RA-S-2002), Addenda RA-Sa-2003, and Addenda RA-Sb-2005, December 2005. [6] Boiling Water Reactors Owners' Group, "BWROG PSA Peer Review Certification Implementation Guidelines," Revision 3, January 1997. MSPI Bases Document, Dresden Nuclear Generating Station, Revision 4, August 2008 [8] Dresden PRA Peer Review, January 2001. [9] Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, EPRI, Report 1016737, Palo Alto, CA, 2008. [10] ComEd, "Dresden Nuclear Power Station Individual Plant Examination for External Events," Rev. 0, December 1997 [11] ComEd, "Dresden Nuclear Power Station Individual Plant Examination for External Events," Rev. 1, March 2000 [12] "PRA Procedures Guide", NUREG/CR-2300, September 1981. [13] "Analysis of Core Damage Frequency: Peach Bottom, Unit 2, External Events," NUREG/CR-4550, Volume 4, Revision 1, Part 3, Table 4.14, page 4-83. [14] NUREG/CR-5042, "Evaluation of External Hazards to Nuclear Power Plants in the United States," December 1987. 6 4 C467090020-8956-10/16/2009 Dresden SLC CT Extension
[15] Kennedy, R.P., et al., "Capacity of Nuclear Power Plant Structures to Resist Blast Loading," Sandia National Laboratories, NUREG/CR-2462, September 1983. [16] NUREG/CR-5500, "Reliability Study: General Electric Reactor Protection System, 1984-1995, Volume 3" May 1999. [17] Gorham, E.D., et al., "Evaluation of Severe Accident Risks: Methodology for the Containment, Source Term, Consequence, and Risk Integration Analyses", NUREG/CR-4551, December 1993. [18] NUREG/CR-6850, EPRI Report 1011989, "Fire PRA Methodology for Nuclear Power Facilities", September 2005. [19] Gorman, Thomas, BWROG Assessment of IN 2007-07,10/16/2007
[20] "Guidance for Post-Fire Safe Shutdown Analysis", NEI 00-01, Rev. 2. [21] EGC, ER-AA-600-1046, "Risk Metrics- NOED and LAR", Revision 4. [22] Chen, J.T., et al., "Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities", NUREG-1407, June 1991. [23] "Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants", NUREG-1150, December 1990. [24] NUREG/CR-5088, "Fire Risk Scoping Study: Investigation of Nuclear Power Plant Fire Risk, Including Previously Unaddressed Issues," U.S. Nuclear Regulatory Commission, January 1989. [25] FAQ 08-0051, "Hot Short Duration," June 2008, Draft, ADAMS Doc. # ML083400188. [26] ASME/ANS RA-Sa-2009, "Addenda to RA-S-2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," February 2009. [27] RG 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk Informed Activities," Revision 2, March 2009. 6 5 C467090020-8956-10/16/2009 Appendix A External Event Assessment A.1 INTRODUCTION This appendix discusses the external events assessment in support of the Dresden SLC System CT extension risk assessment. This appendix uses as the starting point of this assessment the external event work documented in the Dresden IPEEE [Ref. A-1]. Because the effects of the SLC CT extension are evident only in the failure to scram (Anticipated Transients Without Scram (ATWS)) related sequences, the following examination of external events focuses on the ATWS accident sequence insights. A.2 EXTERNAL EVENT ASSESSMENT The purpose of this portion of the assessment is to examine the spectrum of external event challenges to determine which external event hazards should be explicitly addressed as part of the Dresden SLC System CT extension risk assessment. Seismic There is no currently maintained quantitative Seismic PRA for Dresden. Section A.3 discusses seismic ATWS insights from the Dresden IPEEE (Rev. 0) [Ref. A-1] and NUREG-1150. Internal Fires This internal fire assessment is based on the Updated Dresden Fire IPEEE (Rev. 1) [Ref. A-3] and generic assessments in NUREG/CR-6850 and the BWROG assessment of IN 2007-07. This assessment is discussed in Section A.4. Other External Hazards Other external event risks such as external flooding, severe weather, high winds or tornados, transportation accidents, nearby facility accidents, turbine missiles, and other miscellaneous external hazards were also considered in the IPEEE (Rev. 0) analysis [Ref. A-1]. No significant quantitative contribution from these external events was identified by IPEEE evaluations. The compensatory actions and risk insights in this Dresden SLC CT Extension C467090020-8956-10/16/2009 LAR are also judged applicable to qualitatively reduce the risk associated with these events. Conclusions of Screening Assessment Given the foregoing discussions, other external hazards are assessed to be non-significant contributors to plant risk. Explicit treatment of the "other' external hazards is not necessary for most PSA applications (including the SLC System CT extension risk assessment) and would not provide additional risk-informed insights for decision making. Further information is presented in this appendix to further justify the screening of Fire and Seismic hazards for the SLC CT extension application. A.3 SEISMIC ASSESSMENT There is no currently maintained quantitative Seismic PRA for Dresden. The following section discusses seismic ATWS insights from the Dresden IPEEE (Rev. 0) and NUREG-1150. A.3.1 Dresden Seismic IPEEE Overview Dresden SLC CT Extension Dresden performed a seismic margins assessment (SMA) as part of the IPEEE (Rev. 0) [Ref. A-1], following the guidance of EPRI NP-6041. The SMA is a deterministic evaluation process that does not calculate risk on a probabilistic basis. No core damage frequency sequences were quantified as part of the seismic risk evaluation. The conclusions of the Dresden seismic risk analysis are as follows: [Ref. A-1] "...it is concluded that the Dresden plant possesses reasonable margin with respect to its design basis earthquake and safe shutdown capacity will not be lost." Based on a review of the Dresden IPEEE and the conclusions identified earlier in this assessment, the conclusions of the SMA are unaffected by the SLC CT extension. The SLC CT extension has no impact on the seismic qualifications of the SSCs. A.3.2 Peach Bottom NUREG-1150 Seismic Overview The NUREG/CR-4551 study completed an update of the NUREG-1150 severe accident analysis for five nuclear power plants, including the Peach Bottom Atomic Power Station. It is assumed that insights from this analysis are generically appropriate for most BWRs (including Dresden) due to the similarity of systems. A-2 C467090020-8956-10/16/2009 Dresden SLC CT Extension This analysis addressed both internal and external events, including seismic initiators. Peach Bottom utilized the Seismic Margins Analysis as part of the Individual Plant Examination for External Events (IPEEE). The NUREG/CR-4551 Peach Bottom seismic analysis screened seismic-induced ATWS accident sequences as non-significant contributors
(<1%) to the plant seismic CDF. Based on the Peach Bottom results, it is judged that seismic-induced ATWS accident sequences are similarly non-significant contributors to the Dresden plant seismic CDF. A.3.3 Seismic Risk Impact Conclusion Based on the preceding discussions, it is concluded that the risk of a seismically induced ATWS is non-significant and does not impact the decision-making for the proposed Dresden SLC CT extension. A.4 INTERNAL FIRES ASSESSMENT This internal fire assessment is based on the efforts of the Updated Dresden Fire IPEEE [Ref. A-3], and generic assessments in NUREG/CR-6850
[Ref. A-4] and the BWROG assessment of IN 2007-07 [Ref. A-2]. A.4.1 Dresden Fire IPEEE In Supplement 4 to Generic Letter (GL) 88-20, the NRC requested that each nuclear utility perform an Individual Plant Examination of External Events (IPEEE). Included was a request that the risk of internal fires to safe shutdown be evaluated. An approach was selected which used both a quantitative and qualitative evaluation of each postulated fire. First, the qualitative evaluation was performed to determine whether a postulated fire could impact safe shutdown equipment. For those fire zones which did not screen out in this step, a quantitative evaluation was performed using the existing probabilistic risk assessment (PRA) model. The evaluation process for Dresden concluded the following: "All RPS circuits are normally energized, thereby requiring a hot short to prevent a single circuit from de-energizing. Therefore, RPS redundancy requires multiple hot shorts to preclude reactor scram. Therefore, fire-induced Anticipated Transient Without Scram (ATWS) is considered unlikely with negligible contribution to fire risk." [Ref. A-3] As such, ATWS sequences, which are the only sequences impacted by the SLC system, were not evaluated by the IPEEE. Fire-induced failure to scram is further discussed in section A.4.3. A.4.2 NUREG/CR-6850 Screening A-3 0467090020-8956-10/16/2009 Dresden SLC CT Extension NUREG/CR-6850, Volume 2, Section 2.5.1 (page 2-7) [Ref. A-4] provides the following directions for selecting components and accident scenarios to be examined in an internal fire PRA: "The types of sequences that could generally be eliminated from the PRA include the following... Sequences associated with events that, while it is possible that the fire could cause the event, a low-frequency argument can be justified. For example, it can often be easily demonstrated that anticipated transient without scram (ATWS) sequences do not need to be treated in the Fire PRA because fire-induced failures will almost certainly remove power from the control rods (resulting in a trip), rather than cause a "failure-to-scram" condition. Additionally, fire frequencies multiplied by the independent failure-to-scram probability can usually be argued to be small contributors to fire risk. " As can be seen from the NUREG/CR-6850 excerpt above, fire-induced ATWS contributors are generally acknowledged as non-significant contributors to the fire risk profile. A.4.3 BWROG Position on Fire-Induced Failure to Scram Fire scenarios that could threaten the function of the reactor protection system have been addressed in a BWROG assessment (refer to Appendix C) of NRC Information Notice 2007-07. [Ref. A-2] The assessment outlines the types of scenarios in which a fire could energize a circuit through a "hot short" that would compromise scram capabilities. The assessment also indicates that there are multiple actions that would have to occur in conjunction to the very specific fire scenarios for the scram function to be lost. The assessment concluded that these scenarios are of low-likelihood, low safety-significance, and have multiple layers of defense-in-depth which would either prevent the condition, or adequately mitigate it. A.4.4 Fire Risk Impact Conclusion Based on the preceding discussions, it is concluded that fire-induced ATWS is a non-significant contributor to the plant risk profile and thus does not impact the decision-making of the proposed Dresden SLC CT extension. A-4 C467090020-8956-10/16/2009 REFERENCES
[A-1] ComEd, "Dresden Nuclear Power Station Individual Plant Examination for External Events," Rev. 0, December 1997 [A-2] Gorman, Thomas, BWROG Assessment of IN 2007-07,10/16/2007 Dresden SLC CT Extension
[A-3] ComEd, "Dresden Nuclear Power Station Individual Plant Examination for External Events," Rev. 1, March 2000 [A-4] NUREG/CR-6850, EPRI Report 1011989, "Fire PRA Methodology for Nuclear Power Facilities", September 2005. A-5 C467090020-8956-10/16/2009 Appendix B Uncertainty Analysis Dresden SLC CT Extension This appendix evaluates uncertainties that could impact the SLC CT extension assessment. Sections B.1 and B.2 evaluate model uncertainties. Section B.3 evaluates parametric uncertainty. " Section B.1 provides Dresden specific modeling uncertainty evaluations for the Base Case. " Section B.2 provides an examination of the specific cutsets that affect the change in the CDF risk metric associated with the change in the SLC CT. B.1 MODEL UNCERTAINTIES
 
==SUMMARY==
Postulated key modeling uncertainties were identified through a systematic structured process. Table B-1 presents the candidate key model uncertainties for the D205B model. The two modeling uncertainties that rise to the definition of a key model uncertainty are summarized in Table B-2 along with associated impacts on the CDF and LERF risk metrics. It is noted that neither of these cases evaluates modeling issues associated with the SLC system or ATWS sequences. C467090020-8956-10/16/2009 Table B-1 Dresden SLC CT Extension
 
==SUMMARY==
OF SENSITIVITY CASES TO IDENTIFY RISK METRIC CHANGES ASSOCIATED WITH CANDIDATE KEY MODELING UNCERTAINTIES B-2 C467090020-8956-10/16/2009 CDF Impact (/yr)(') LERF Impact (/yr)(2) Source of Key Modeling UncertaintV
: 3) Upper Bound Lower Bound Upper Bound Lower Bound 1A) Applicability of industry experience 4.40E-6 3.80E-6 5.57E-7 5.24E-7 to environmentally influenced (11.1%) (-4.0%) (4.7%) (-1.5%) events (i.e., loss of service water, LOOP, etc.) - Loss of Service Water 1 B) Applicability of industry experience 3.96E-6 3.95E-6 5.32E-7 5.32E-7 to environmentally influenced (E) (-0.3%) (E) (&#xa3;) events (i.e., loss of service water, LOOP, etc.) - Loss of Intake Structure 1 C) Applicability of industry experience 4.42E-6 3.80E-6 5.48E-7 5.27E-7 to environmentally influenced (11.6%) (-4.0%) (3.0%) (-0.9/&deg;&deg;) events (i.e., loss of service water, LOOP, etc.) - Severe and Extreme Weather Induced DLOOP 2A) Treatment of Rare and Extremely 3.97E-6 3.95E-6 5.46E-7 5.27E-7 , Rare Events - Excessive LOCA (0.3%) (-0.3%) (2.6%) (-0.9% 2B) Treatment of Rare and Extremely 4.14E-6 3.89E-6 5.35E-7 5.31 E-7 Rare Events - SW Flood in RB (4.5%) (-1.8%) (0.6%) (-0.2%) 3), 4), 6), 13), 19), 29) Beyond Design 4.69E-6 3.70E-6 5.34E-7 5.32E-7 Basis Environment (18.4%) (-6.6%) (0.4/&deg;&deg;) (&#xa3;) 5) and 8) Case A) Impact of LOOP/SBO 4.10E-6 (Extreme 5.38E-7 (Extreme conditions - RCP seal LOCH (3.5%) Upper (1.1 %) Upper Bound) Bound) 4.77E-6 5.61 E-7 (20.5%) ~5-)and 8) Case B) Impact of LOOP/SBO N/A 3.91 E-6 N/A 5.32E-7 ".. Cooling Assumptions " I" . ; (2.0%) (-1.3%) (0.9%) (-0.8%) 9) Accumulator adequacy for venting 3.98E-6 3.96E-6 5.32E-7 5.32E-7 (0.5%) (E) (E) (E) 10)&17) Impact of venting on systems 4.42E-6 3.93E-6 5.32E-7 5.32E-7 (11.6%) (-0.8%) (E) (E) 11),22),&25)
Multi Unit creditor 1.40E-5 3.96E-6 8.44E-7 5.32E-7 dependencies (253.5%) (&#xa3;) (58.6%) (&#xa3;)
Table B-1 Dresden SLC CT Extension
 
==SUMMARY==
OF SENSITIVITY CASES TO IDENTIFY RISK METRIC CHANGES ASSOCIATED WITH CANDIDATE KEY MODELING UNCERTAINTIES B-3 C467090020-8956-10/16/2009 CDF Impact (/yr)(') LERF Impact (/yr) (2) Source of Key Modeling Uncertainty
~3~ Upper Bound Lower Bound Upper Bound Lower Bound 12) Time Dependency failures due to N/A N/A N/A N/A environmental conditions
: 15) Recirc Pump Seal Leakage N/A N/A N/A N/A 16) Suppression Pool Strainer 4.12E-6 3.90E-6 6.13E-7 5.04E-7 Performance (4.0%) (-1.5%) (15.2%) (-5.3%) 18) Treatment of Instrumentation 5.36E-6 3.32E-6 9.19E-7 4.14E-7 required for operator action (35.4%) (-16.2% (72.7 /&deg;) (-22.2%) 21) Water Hammer Impact on System 8.73E-6 3.48E-6 6.55E-7 5.20E-7 Performance (Failure Probability of (120.5%) (-12.1%) (23.1%) (-2.3%) Pipe Rupture) 23) Alternate Alignments N/A N/A N/A N/A 24) Procedural Changes 4.14E-6 N/A 6.14E-7 N/A (4.5%) (15.4%) 28) Flood Frequency Data 4.58E-6 3.74E-6 5.53E-7 5.25E-7 (15.7%) (-5.6%) (3.9%) (-1.3%) 30) Transient induced LOOP causes a N/A 3.89E-6 N/A 5.30E-7 single unit LOOP and not a dual (-1.8%) (-0.4%) unit LOOP 31) Increase the CST unavailability 4.06E-6 N/A 5.39E-7 N/A from 1 E-5 to 2.4E-2 per Section (2.5%) (1.3%) G.5 of the Component Data Notebook. 32) Treatment of SBCS clogging of FW 3.99E-6 3.93E-6 5.49E-7 5.15E-7 reg. valves (0.8%) (-0.8%) (3.2%) (-3.2%) 33) Combined Sensitivity Case 1A and 4.59E-6 N/A 5.54E-7 N/A Case 5/8A for SBO related (15.9%) (4.1%) features (Extreme (Extreme Upper Upper Bound) Bound) 5.38E-6 5.81 E-7 (35.9%) 34) Treatment of HRA methods as 5.19E-6 N/A 6.55E-7 N/A producing a point estimate that is (31.1%) (23.1%) interpreted as the median not the mean. 35) Elimination of dependent HEP N/A 2.23E-6 N/A 4.15E-7 Recovery file. Base (-43.7%) Base (-22%)
Notes to Table B-1: Dresden SLC CT Extension Compared with a base CDF of 3.96E-6/yr quantified with a 1 E-11/yr truncation limit. Compared with a base LERF of 5.32E-7/yr quantified with a 1 E-11/yr truncation limit. Case LD.s 26 and 27 are not used. B-4 C467090020-8956-10/16/2009 Table B-2 TOP KEY MODELING UNCERTAINTY CASES Dresden SLC CT Extension
(') Compared with abase CDF of 3.96E-6/yr quantified with a 1 E-11/yr truncation limit. (2) Compared with a base LERF of 5.32E-7/yr quantified with a 1 E-11/yr truncation limit. B.2 MODEL UNCERTAINTIES ASSOCIATED WITH SLCS OUT OF SERVICE To determine the relative importance of individual contributors for this LAR, the focus needs to be on the results of the CDF assessment for the SLC system out of service. To obtain insights regarding this change to the base case results, the first step is to take the SLC out-of-service case cutsets and remove the base case cutsets. This is done in CAFTA through the delete term function of the cutset editor. The results of this process are cutsets that are unique to the SLC out-of-service case and do not appear in the base case. These cutsets can be used to determine information regarding significant accident sequences or cutsets that determine the change in risk metrics, i.e., drive the delta-CDF assessment. Table B-3 presents the top ten cutsets for the delta-CDF assessment. Table B-4 presents the most important contributors to the delta-CDF assessment sorted by the Fussell-Vesely importance measure. Tables B-3 and B-4 show that the Scram system hardware failure is the most important contributor for the SLC system out of service case. The top ten cutsets are almost exclusively failures of the SCRAM system associated with various initiating events. Cutset 6 is the exception, as it also includes SRV reclosure probability at low pressure. Of the events with a Fussell-Vesely greater than 2E-2 (>2% contribution to CDF), only one basic event (the mechanical Scram failure) is a failure, with the rest being initiators. It can be concluded that the CDF is dominated by failures of the Scram system. The basic events used to model the Scram system failures are already considered in the base uncertainty assessment B-5 C467090020-8956-10/16/2009 CDF LERF Factor Factor Sensitivity Case Increase(')
Increase (2) Sensitivity Cases 11, 22 & 25: Multi Unit credit or dependencies 3.53 1.59 Sensitivity Case 21: Water Hammer Impact on System Performance 2.21 1.23 l (Failure Probability of Pipe Rupture) ( I II Similarly, the LERF results are dominated by failures of the Scram system for the SLC system out-of-service case and provide similar insights to the CDF results insights. Because of the large potential impact of the mechanical failure to scram probability on the assessment of the risk metrics for this application, it is prudent to perform a sensitivity recognizing the uncertainty in the mechanical common cause failure to scram probability. This sensitivity is performed by including the 95% upper bound on the common cause mechanical scram failure probability in both the base case and the case with the SLC system set to TRUE. Results The results of the sensitivity case are shown in Table B-5. Dresden SLC CT Extension Based on the results of the sensitivity analysis, it is found that the acceptance criteria are met even for this extreme assumption regarding the common cause mechanical scram failure probability except for the ICLERP. However, given the conservatisms inherent in the assumptions regarding the use of the 95% upper bound and the ICLERP definition of the acceptance guideline, the recommended CT is found to be acceptable. B-6 C467090020-8956-10/16/2009 Table B-3 Dresden SLC CT Extension TOP TEN CDF CUTSETS CONTRIBUTING TO CHANGE IN CDF FOR THE SLC SYSTEM OUT OF SERVICE(')
These cutsets lead to core damage because the SLC system has been guaranteed to fail, i.e., SLC is set to TRUE. Therefore, the SLC failure does not explicitly show up in the cutsets. B-7 C467090020-8956-10/16/2009
# Cutset Prob Event Prob Event Descri tion 1 3.30E-06 1.57E+00 %TT INIT: TRANSIENT WITH FW AND MC AVAILABLE 2.10E-06 2RPCDRPS-MECHFCC RPS MECHANICAL FAILURE 2 2.08E-07 9.90E-02 %TC INIT: LOSS OF CONDENSER VACUUM 2.10E-06 2RPCDRPS-MECHFCC RPS MECHANICAL FAILURE 3 1.95E-07 9.27E-02 %TM INIT: MSIV CLOSURE 2.10E-06 2RPCDRPS-MECHFCC RPS MECHANICAL FAILURE 4 8.42E-08 4.01 E-02 %TI INIT: INADVERTENTLY OPEN RELIEF VALVE 1.00E+00 2ADSV-M-SCRAMF--
CONDITIONAL PROBABILITY OF A MANUAL SCRAM GIVEN AN IORV 2.10E-06 2RPCDRPS-MECHFCC RPS MECHANICAL FAILURE 5 7.54E-08 3.59E-02 %LOOP INIT: SINGLE UNIT LOSS OF OFFSITE POWER 2.10E-06 2RPCDRPS-MECHFCC RPS MECHANICAL FAILURE 6 7.16E-08 4.01 E-02 %TI INIT: INADVERTENTLY OPEN RELIEF VALVE 8.50E-01 2PLSV-S-RECL-K--
SRVs SUCCESSFULLY RECLOSE ON REDUCED PRESSURE 2.1 0E06 2RPCDRP S ME CHFCC RPS MECHANICAL FAILURE ~8 7 6.91 E-08 3.29E-02 2.10E-06 %TF 2RPCDRPS-MECHFCC INIT: TRANSIENT WITH FW UNAVAILABLE AND MC AVAILABLE RPS MECHANICAL FAILURE 5.12E-08 2.44E-02 %TIA INIT: LOSS OF INSTRUMENT AIR DRESDEN RAI 2.10E-06 2RPCDRPS-MECHFCC RPS MECHANICAL FAILURE 9 1.82E-08 8.66E-03 %DLOOP INIT: DUAL UNIT LOSS OF OF FSITE POWER 2.10E-06 2RPCDRPS-MECHFCC RPS MECHANICAL FAILURE 10 7.77E-09 3.70E-03 %S2-ST INIT: SMALL BREAK LOCA - ABOVE CORE INSIDE DRYWELL 2.10E-06 2RPCDRPS-MECHFCC RPS MECHANICAL FAILURE '
Table B-4 Dresden SLC CT Extension BASIC EVENT IMPORTANCE MEASURES FOR CDF ASSESSMENT FOR CUTSETS CONTRIBUTING TO CHANGE IN CDF WITH SLC OUT OF SERVICE B-8 C467090020-8956-10/16/2009 Event Name Probability Fus Ves Description 2RPCDRPS-MECHFCC 2.10E-06 1.00E+00 RPS MECHANICAL FAILURE %TT 1.57E+00 7.99E-01 INIT: TRANSIENT WITH FW AND MC AVAILABLE
%TC 9.90E-02 5.04E-02 INIT: LOSS OF CONDENSER VACUUM %TM 9.27E-02 4.72E-02 INIT: MSIV CLOSURE %TI 4.01 E-02 3.78E-02 INIT: INADVERTENTLY OPEN RELIEF VALVE 2ADSV-M-SCRAMF--
1.00E+00 2.04E-02 CONDITIONAL PROBABILITY OF A MANUAL SCRAM GIVEN AN IORV %LOOP 3.59E-02 1.83E-02 INIT: SINGLE UNIT LOSS OF OFFSITE POWER 2PLSV-S-RECL-K--
8.50E-01 1.74E-02 SRVs SUCCESSFULLY RECLOSE ON REDUCED PRESSURE %TF 3.29E-02 1.68E-02 INIT: TRANSIENT WITH FW UNAVAILABLE AND MC AVAILABLE
%TIA 2.44E-02 1.24E-02 INIT: LOSS OF INSTRUMENT AIR DRESDEN RAI %DLOOP 8.66E-03 4.41 E-03 INIT: DUAL UNIT LOSS OF OFFSITE POWER %S2-ST 3.70E-03 1.88E-03 INIT: SMALL BREAK LOCA - ABOVE CORE INSIDE DRYWELL %TBCCW 3.01 E-03 1.53E-03 INIT: LOSS OF TBCCW %RBCCW 2.97E-03 1.51 E-03 INIT: LOSS OF RBCCW %TRLA 2.24E-03 1.14E-03 MEDIUM RANGE RX WATER REF LEG 12A LEAK DOWN %TRLB 2.24E-03 1.14E-03 MEDIUM RANGE RX WATER REF LEG 12B LEAK DOWN %TSW 1.55E-03 7.89E-04 INIT: LOSS OF SERVICE WATER %FLSWTB 1.43E-03 7.28E-04 INIT: SW RUPTURE IN TB %FLSPRAY24 1.25E-03 6.36E-04 INIT: FPS & CCSW SPRAY OF BUS 24 %TAC28 1.07E-03 5.45E-04 INIT: LOSS OF 480 VAC BUS 28 %TAC282 1.07E-03 5.45E-04 INIT: LOSS OF 480 VAC MCC 28-2 %TDC2 1.00E-03 5.09E-04 INIT: LOSS OF U2 MAIN DC BUS %TDC3 1.00E-03 5.09E-04 INIT: LOSS OF U3 MAIN DC BUS %FLSPRAY23 8.88E-04 4.52E-04 INIT: FPS & CCSW SPRAY OF BUS 23 %TAC23 8.16E-04 4.15E-04 INIT: LOSS OF BUS 23 %FLFPTB L 5.40E-04 2.75E-04 INIT: FPS & DGCW RUPTURE IN RB Table B-4 Dresden SLC CT Extension BASIC EVENT IMPORTANCE MEASURES FOR CDF ASSESSMENT FOR CUTSETS CONTRIBUTING TO CHANGE IN CDF WITH SLC OUT OF SERVICE B-9 C467090020-8956-10/16/2009 Event Name Probability Fus Ves Description
%FLSPRAY2324 4.59E-04 2.34E-04 INIT: CCSW SPRAY OF BUSES 23 & 24 %FLCCRBSW 3.34E-04 1.70E-04 INIT: UNISOLATED CCSW, FPS, DGC FLOOD IN RB U2 SOUTHWEST CORNER %IC 1.80E-04 9.17E-05 INIT: UNISOLATED IC TUBE RUPTURE %TAC21 8.16E-05 4.15E-05 INIT: LOSS OF BUS 21 %TAC22 8.16E-05 4.15E-05 INIT: LOSS OF BUS 22 %TAC24 8.16E-05 4.15E-05 INIT: LOSS OF BUS 24 %FLDGRB476 6.39E-05 3.25E-05 INIT: UNISOLATED DGCW & FPS BREAK ON RB-476' %FLSWRB545 6.10E-05 3.11 E-05 INIT: SW FLOOD IN RB ABOVE 545' %FLCCTB-OV 3.74E-05 1.90E-05 INIT: CCSW RUPTURE OUTSIDE VAULT IN TB %FLFPRB545 2.57E-05 1.31 E-05 INIT: UNISOLATED FPS FLOOD IN RB ABOVE 545' 2RPOP-MANSCRMH--
1.35E-01 7.72E-06 FAILURE OF COND. PROB. OF MANUAL SCRAM 2RPPARPS-ELECFCC 3.70E-06 7.72E-06 RPS ELECTRICAL FAILURE %FLCCRB476 9.00E-06 4.58E-06 INIT: CCSW RUPTURE IN ZONE 1.1.2.1 IN RB-476' OVERHEAD 2ATSV39952412DCC 2.03E-05 3.86E-06 0399-524A AND -524B FAIL TO REPOSITION DUE TO CC FAULT L 2ATSV48AB49ABDCC 2.03E-05 3.86E-06 CCF OF 4 out of 4 ARI SV 0399-548A.B AND 0399-549A.B Table B-5 RISK ASSESSMENT SENSITIVITY RESULTS WITH MECHANICAL SCRAM FAILURE PROBABILITY AT 95% UPPER BOUND Dresden SLC CT Extension B-1 0 C467090020-8956-10/16/2009 Risk Metric Value Acceptance Guidelines Reference ACDF 1.3E-07/yr
<1.0E-06/yr RG 1.174 ICCDP 1.3E-07 <5.0E-07 RG 1.177 ALERF 6.9E-08/yr
<1.0E-07/yr RG 1.174 ICLERP 6.9E-08 <5.0E-08 RG 1.177 B.3 PARAMETEC UNCERTAINTY Dresden SLC CT Extension Consistent with the ASME PRA Standard, quantitative parametric uncertainty analyses for both CDF and LERF have been performed and are summarized in this section. The parametric uncertainty distributions for the Base PRA models have been developed in the PRA Quantification Notebook. The results of the uncertainty analysis for the proposed CT configuration (SLC system out of service) are compared with the results of the uncertainty analysis performed for the 2005B PRA Update. The parametric uncertainty analyses are performed using Monte Carlo simulation. The analysis is performed using the EPRI R&R workstation UNCERT software. B.3.1 Core Damage Frequency (CDF) Parametric Uncertainty Dist ribution The resulting uncertainty distribution for the proposed CT configuration (i.e., CDFsLc-oos) calculated by UNCERT Version 2.3a for CDF is shown in Figure B-1. It summarizes
: " Distribution statistics (e.g., mean, error factor, etc.) " Probability density chart of the CDF The approximate error factor (or range factor) for the CDF uncertainty distribution for the proposed CT is 3.0 (calculated using SQR(95%/5%)), as compared to the error factor of the base D205B Model of Record of 2.2. One of the critical aspects of the parametric uncertainty assessments is the desire to ensure that the point estimate calculation performed with the base PRA model (i.e., using CAFTA) produces a point estimate result that is not too dissimilar from the true mean calculation when the correlation effect is accounted for. Table B-6 provides this comparison for the proposed CT model: Table B-6 PARAMETER UNCERTAINTY COMPARISON FOR CDF WITH SLC OUT OF SERVICE B-1 1 C467090020-8956-10/16/2009 CDF Parameter CDF Result Code Point Estimate 7.8E-6/yr CAFTA Uncertainty Mean 7.8E-6/yr UNCERT Dresden SLC CT Extension The propagated uncertainty mean for CDFSLc-oos is the same as the CDFSLc-oos point estimate calculation. If the CDFSLc-oos propagated uncertainty mean instead of the D205B CDFBASE propagated uncertainty mean were used to calculate the risk metrics, the results would not differ from those presented in Table 5.3-1. B.2.2 Large Early Release Frequency (LERF) Parametric Uncertainty D istribution The same process as used for CDF is also used for LERF. The resulting uncertainty distribution calculated by UNCERT Version 2.3a for LERF is shown in Figure B-2. It summarizes
: " Distribution statistics (e.g., mean, error factor, etc.) " Probability density chart of the LERF The approximate error factor (or range factor) for the LERF uncertainty distribution is 5.0 (calculated using SQR(95%/5%)), as compared to the error factor of 2.5 for the D205B model. Table B-7 provides a comparison of the PRA LERF point estimate and the propagated uncertainty mean for the proposed CT case (i.e., LERFSLc-oos)
: Table B-7 PARAMETER UNCERTAINTY COMPARISON FOR LERF WITH SLC OUT OF SERVICE If the LERFSLc-oos propagated uncertainty mean (2.7E-6/yr) and the D205B LERFB ASE propagated uncertainty mean (5.3E-7/yr) are used to calculate the risk metrics, the results would change in the second decimal place compared to the results shown in Table 5.3-1 (i.e., non-significant change). B-12 C467090020-8956-1 0/16/2009 LERF Parameter LERFSLc_oos Result Code Point Estimate 2.7E-6/yr CAFTA Uncertainty Mean 2.7E-6/yr UNCERT A &#xa3; -
UNCERT 2.3a COREDAMAGE.CUT D20513-UNCERT.B E Samples 50,000 Random Seed Auto Figure B-1 CDF PARAMETRIC UNCERTAINTY DISTRIBUTION FOR THE PROPOSED COMPLETION TIME Dresden SLC CT Extension B-13 C467090020-8956-1 0/16/2009 UNCERT 2.3a LERF-TOT.CUT D20513-UNCERT.B E Samples 50,000 Random Seed Auto LERF PARAMETRIC UNCERTAINTY DISTRIBUTION FOR THE PROPOSED COMPLETION TIME Figure B-2 Dresden SLC CT Extension 844 0467090020-8956-1 0/16/2009 Dresden SLC CT Extension Appendix C BWROG Assessment of NRC Information Notice 2007-07 The BWROG assessment of NRC Information Notice 2007-07 is provided in this appendix. This assessment discusses the low-likelihood scenario of fire-induced failure to scram. Refer to Section A.4.3 of this risk assessment. C-1 C467090020-8956-10/16/2009 1.0) Summary: BWROG Assessment of NRC Information Notice 2007-07 This assessment addresses the condition described by the NRC in NRC Information Notice 2007-07 and in the inspection report referenced therein. The overall assessment of the condition described in NRC Information Notice 2007-07 by the BWROG is that it represents a condition with a low likelihood of occurrence, with low safety significance and with multiple layers of defense-in-depth currently in place each with the capability to either prevent the condition from occurring or to effectively mitigate the effects of the occurrence without consequence. It is the position of the BWROG that all BWRs should have a manual operator action tied to their post-fire safe shutdown procedures instructing the operator to implement the requirements of EO-113 should the fire impact the ability to scram. This manual operator action should be endorsed by the NRC for use in both III.G. l and 2 areas, as well as, III.G.3 and 111.1, areas. The evaluation provided in this paper and the limited likelihood of occurrence of the condition are considered to be sufficient justification for concluding that this manual operator action is both feasible and reliable. It is recommended that each BWR review this assessment and assure that their plant specific conditions are consistent with the measures described herein. As a minimum, each licensee should assure that the EOP action to implement the requirements of EO-113 is linked to their post-fire safe shutdown procedures. 2.0) Description of Issue: NRC Information Notice 2007-07 postulates a condition where two (2) hot shorts could result in the failure of one of four control rods groups to insert during a manual scram from the Control Room. The IN further postulates that with the reactor in this condition the operator rapidly depressurizes the reactor and re-floods the reactor with cold water using a low pressure system. The IN further states: "By design, the negative reactivity, added by all four rod groups during a scram, provides adequate shutdown margin to offset the positive void and temperature reactivity
[that] would have been added to the vessel [during such a shutdown sequence]". 3.0) Scram System Design Description
: Typically, the Reactor Protection System (RPS) for a BWR consists of two (2) Trip Systems (A and B), each containing two Trip Channels (Al, A2, B1, 132) of sensors and logic. The four channels contain automatic scram logic for the monitored parameters listed below, each of which has at least one input to each of the logic channels: Scram Discharge Volume Water Level Dresden SLC CT Extension C-2 C467090020-8956-10/16/2009 BWROG Assessment of NRC Information Notice 2007-07 " Main Steam Line Isolation Valve Position " Turbine Stop Valve Position " Turbine Control Valve Fast Closure " Reactor Vessel Water Level " Main Steam line Radiation " Neutron Monitoring System " Primary Containment Pressure " Reactor Vessel Pressure The RPS automatic trip logic requires at least one channel in each trip system to be tripped in order to cause a scram. This is referred to as one-out-of-two-taken-twice trip logic. The two RPS Trip Systems are independently powered from their respective RPS Buses. The trip channels (AI, A2, BI, 132) associated with each Trip System (A, B) operate the automatic scram Trip Logic Relays (K14 A-H). The RPS auto scram logic string is sometimes referred to as "trip actuator" or "actuation" logic because the output of the logic is what actually causes the control rods to scram by de-energizing the pilot scram solenoid valves. The RPS circuits are a fail-safe design in that the circuits are normally energized, and the loss of power, including the loss of offsite power, will initiate the scram. Once the scram has occurred, re-energization of the RPS logic will not, in and of itself, cause the control rod movement necessary to re-establish reactor criticality. 4.0) Evaluation
: The evaluation performed is divided into two sections. The first section performs a circuit analysis of the scram circuitry. This portion of the evaluation examines the scram circuitry in an effort to determine the set of hot shorts that, should they occur, have the potential to prevent one or more rod groups from inserting. The first section also addresses the significance of the postulated condition and the features currently in place with the capability to prevent or mitigate the effects of the condition. The second section addresses the implications for Appendix R Compliance given the required circuit design for this important safety system and given the potential ramifications of the hot shorts postulated in the fast section. 4.1) Circuit Analysis: Figures 1 through 4 attached to this paper shows portions of the scram circuitry for a typical BWR. Three (3) separate cases involving up to two hot shorts are discussed in this paper. Dresden SLC CT Extension C-3 C467090020-8956-10/16/2009 Case I: (Refer to Figure 1) BWROG Assessment of NRC Information Notice 2007-07 Case I attempted to identify the condition described in IN 2007-07. IN 2007-07 concluded that two (2) hot shorts were required to prevent a single rod group from scramming. The BWROG, however, was unable to identify any circuitry where two (2) fire-induced hot shorts would prevent one of four scram rod groups from inserting. The BWROG identified that a single hot short in either of the divisionalized trip logics can prevent the scram of a single rod group. This finding is different than the conclusion in IN 2007-07. The finding of the BWROG assessment is a direct consequence of the 1 out of 2 taken twice logic used in the design for the scram function. The single hot short with the potential for preventing the scramming of a single rod group could occur in either the Trip System A or B Relay Panel. [Refer to Figure 1 attached for a description of the location of the subject hot short, labeled as "Hot Short 1".] The hot short must occur prior to the operator scramming the reactor. The location of the hot short shown in Figure 1 would be either in one of the Trip System Relay Panels or in a raceway carrying the circuit from the Trip System Relay Panel to the Scram Pilot Solenoid Valves. (Note: For some licensees, the relay panels are located in separate relay rooms outside of the main control room.) For the hot short in this case to affect the reactivity function, it must remain in effect until such time when the operator depressurizes the reactor and begins re-flooding with a low pressure system. The Emergency Operating Procedures for a BWR instruct the operator not to depressurize the reactor until reactor level reaches the top of active fuel. In a typical BWR, it will take approximately 20 to 25 minutes of boil-off for reactor level to decrease to the top of active fuel. Industry and NRC cable fire testing have shown that hot shorts last for only a few minutes prior to shorting to ground. [EPRI Testing determined the maximum duration of a hot short was 11.3 minutes. C AROLFIRE Testing determined that the maximum duration of a hot short was 7.6 minutes.] Therefore, it appears unlikely that the required hot short could last for a sufficient amount of time that the impacted control rod group would fail to insert prior to the time when the EOPs directed the operator to depressurize the reactor. Case 11: (Refer to Figure 2) Case II is one of two cases identified where two (2) fire-induced hot shorts could prevent a full scram. (Note: No conditions were identified where two (2) fire-induced hot shorts were required to prevent a single rod group from scramming.) Dresden SLC CT Extension C-4 C467090020-8956-10/16/2009 BWROG Assessment of NRC Information Notice 2007-07 Refer to Figure 2 attached for the case where two (2) fire-induced hot shorts could prevent a full scram. This case postulates a condition where two hot shorts just below the manual scam switches for two trip channels can prevent a full scram. The postulated hot shorts could occur in either the main control room operating bench board or in a raceway carrying the trip circuit to one of the Trip System Relay Panels. The hot short will keep the K15 relays from de-energizing and this will subsequently keep the K14 relays energized. By keeping the K14 relays energized, as shown in Figure 1, none of the rod groups will de-energize and none will insert. Figure 2 shows the location of the two individual hot shorts. One affects the K 15B relay and one affects the K15D relay. The K15 relays are de-energized by actuating the manual scram switches in the Control Room on the main control board. Keeping the K15 relays energized by the hot shots shown in Figure 2, will keep the K14 relays energized, as shown in Figures 3. Keeping the K14 relays energized, as shown in Figure 3, will prevent rod group insertion, as shown in Figure 1. For this case, however, there are numerous other inputs into the scram logic that can override the effects of the hot short affecting the K15 relays. Refer to Figures 3 and 4 for the additional input signals to the scram function. For example, as shown on Figure 4, closure of the MSIVs or reactor level reaching the +13" level will override the effects of the hot shorts affecting the K15 relays and result in a de-energization of the K 14 relays and full rod insertion. Therefore, it appears unlikely that the required hot shorts, even if they were to co-exist, could prevent the scram and cause the reactivity transient described in the IN. This is true because the effect of the hot short would be overriddened by the reduction in reactor level that would be necessary before the operator would take the action to depressurize the reactor prior to making up with a low pressure system. Case III: (Refer to Figure 3) (Limited to the Trip System Relay Panels) Case III is similar to Case II. Hot shorts are postulated in the locations shown in Figure 3, the K14 relays will again remain energized. The energization of the K14 relays will prevent the scram for all rod groups. For this case to occur, the fire must sufficiently damage two separate circuits and the fire induced damage must occur on each circuit simultaneously. Industry and NRC cable fire testing have shown that hot shorts last for only a few minutes prior to shorting to ground. [EPRI Testing determined the maximum duration of a hot short was 11.3 minutes. CAROLFIRE Testing determined that the maximum duration of a hot short was 7.6 minutes.] Dresden SLC CT Extension C-5 C467090020-8956-10/16/2009 BWROG Assessment of NRC Information Notice 2007-07 for each of these postulated fire areas would be ineffective in preventing the occurrence of the condition. The condition postulated in Case I can only be mitigated by the use of a manual operator action consistent with the manual operator actions currently invoked under Emergency Operating Procedure, EO-113. The conditions described for Cases II and III are similar. Neither of these cases represents a condition that is prevented by the type of redundant train separation invoked under Appendix R, since the postulated hot shorts occur within a single division. Therefore, the provision of Appendix R cannot be used to address the conditions described in this paper. Re-design of the scram circuitry is not a viable option without compromising the design function of this important safety function. In addition to the features of the RPS system described above, the Alternate Rod Insertion (ARI) system (vents SCRAM air header), Backup Scram Solenoids (vents SCRAM air header), and Standby Liquid Control (SLC) system (inserts sodium pentaborate) provide additional redundant means to achieve reactor shutdown. For areas such as the main Control Room and the Relay Rooms, however, similar fire-induced impacts could be postulated. This paper has highlighted one example of an area where verbatim compliance with the requirements of Appendix R is insufficient in preventing fire induced damage from potentially impacting safe shutdown. The BWROG believes that this case and, potentially, other like it are the reason why from the initial issuance of Appendix R that certain conditions were considered to be initial boundary conditions for the Appendix R Post-Fire Safe Shutdown Analysis. Assuming that the reactor is scrammed was one of those initial boundary conditions given for the Post-Fire Safe Shutdown Analysis. NRC Generic letter 86-10 in the Response to Question 3.8.4, Control Room Fire Considerations, endorsed the assumption of a reactor trip prior to evacuating the Control Room. Based on this and on the fail-safe nature of the reactor protection system, many licensees assumed and the NRC accepted that a reactor trip was an initial boundary condition for the start of the post-fire safe shutdown analysis, i.e. the plant is scrammed prior to the scram circuitry being damaged by the fire. Although the BWROG believes that the prior industry position related to the scram is correct and its use provides for a safe plant design, the BWROG also recognizes that fires have some limited potential to impact the scram capability. As a precaution, it is the position of the BWROG that all BWRs should have a manual operator action tied to their post-fire safe shutdown procedures instructing the operator to implement the requirements of EO-113 should the fire impact the ability to scram. This manual operator action should be endorsed by the NRC for use in both III.G.1 and III.G.2 areas, as well as, III.G.3 and IILL areas. The evaluation provided in this paper and the limited likelihood of occurrence of the condition are considered to be sufficient justification for the feasibility and reliability of this manual operator action. Dresden SLC CT Extension C-6 C467090020-8956-10/16/2009 5.0) Risk Assessment
: 6.0) Safety Assessment
: BWROG Assessment of NRC Information Notice 2007-07 Given the unlikely set of circumstances required for this condition to occur and to remain in effect until such time that it could pose a beyond design basis concern to the reactor, the risk associated with this issue is judged to be low. Given the fact that there are multiple barriers (circuit failure characteristics, design features, procedural guidance and rigorous operator training) in place to prevent the occurrence of this condition, the safety significance of this issue is also judged to be very low. 7.0) Conclusions and Recommendations
: This assessment addresses the condition described by the NRC in NRC Information Notice 2007-07 and in the inspection report referenced therein. The overall assessment of the condition described in NRC Information Notice 2007-07 by the BWROG is that it represents a condition with a low likelihood of occurrence, with low safety significance and with multiple layers of defense-in-depth currently in place each with the capability to either prevent the condition from occurring or to effectively mitigate the effects of the occurrence without consequence. It is the position of the BWROG that all BWRs should have a manual operator action tied to their post-fire safe shutdown procedures instructing the operator to implement the requirements of EO-113 should the fire impact the ability to scram. This manual operator action should be endorsed by the NRC for use in both M.G. 1 and 2 areas, as well as, III.G.3 and IILI, areas. The evaluation provided in this paper and the limited likelihood of occurrence of the condition are considered to be sufficient justification for concluding that this manual operator action is both feasible and reliable. It is recommended that each BWR review this assessment and assure that their plant specific conditions are consistent with the measures described herein. As a minimum, each licensee should assure that the EOP action to implement the requirements of EO-113 is linked to their post-fire safe shutdown procedures. Prepared by: Thomas A. Gorman Date: 10/16/2007 Thomas A. Gorman, PE, SFPE Reviewed by: Gary Birmingham Date: 11/13/200 7 Gary S. Birmingham Dresden SLC CT Extension C-7 C467090020-8956-10/16/2009 IT / Ke" G Ginvl 2L l1 RQC !~ 4,woI,}P 1 G:WVP L PII~".T 3CGhU.t vr~x.~ E. 'GC;.~n.cGSCS -6T 9CilhM ti'A,w$ X GkOx TYM+i.AL ~" 15 i3t~lh.M~+G&deg;_, T'x1i+/-Ci'l Cw a6 -R.~xY7f. BWROG Assessment of NRC Information Notice 2007-07 AT: ATz~`-._~... :S~H6rs",1L tis 2fis"$~O'tlikV
~?aili C-8 Hot Short #1 location (ttcal_oof 4 per division GCP~.R A : ri6R &#xa2;aw Z tw 1T a O eecrs Tsae e USE. r' &7P A4,T JA'LClfi tF]G.eL ff. uGttFR %FLfLT 7iLF:46. Y P. Y v :TgOlt ~..~ t740: E4 W- [ 2nw K4stf ~ M" 1t ~-Fi n. J . xrT us ee 1 tK4 F+ao R &#xa2;.G t c. F, N+2~PG11 LU ( ZT; a2 7.6 v8 F+mri Ft~t' K IbB Dresden SLC CT Extension H v.2-r" w "L=77 7 711 FFigure 1 - Relay Panel Circuitry Controllina Individual Rod Groups (typical of two Trip Svstemsl _ Qpxjif 3 '??dm SGT L&#xa2;A1" s e!A'~V'&#xa3; G&deg;rtG?lYiu65 4T aSCiOiM V~-u.V~, Q~+.EwovO~ vl`V CA+- pF: 4-t SQ<'GxiQli}S TYP.LhL. 5F' Am LL,V14,MS C467090020-8956-10/16/2009 
~r~--- REACTOR MANVAL SCRAM TWO CMA"EL "At- YM BWROG Assessment of NRC Information Notice 2007-07 ort #2 locations (typical of 4. 2 per division_
Note: This combination assumes RPS does not pick up another scram signal, e.g. MSIV Closure; Turbine Stop Valve Closure. C-9 Fic u re 2 -_Manua l cra m Circuitry - Typical of two Trip Systems Dresden SLC CT Extension REACTOR MANUAL SCRAM ~,..~-. TRIP CHANNEL &deg;82* C467090020-8956-10/16/2009 REACTOR AUTO-URAM TRIP LOGIC -W BVVROG Assessment of NRC Information Notice 2007-07 Refer to Figure 4 for the remaining set of contacts that affect the automatic scram function Hot Short #3 location (typical 2 per Trip Systems) Finure 3 - Reactor Auto-Scram Circuitry - Typic al of four Trio Channels in two Trip Systems C-1 0 REACTOR AUTO-SCRO MIR LOGIC "92* Dresden SLC CT Extension C467090020-8956-10/16/2009 
.. C' RD s.G.i(Rl~ a V I OI U RHL carCr( wd~Ert t c~ev~a BWROG Assessment of NRC Information Notice 2007-07 C-1 1 KWB i yl4GV CLOSURE KIOF 3I ` C $1 fRtCL0SURE ET 5CR.RlC. BYPaSST_ 1 ;-L! F27R ++(REF) Floure 4- Balance of Auto-Scram Circuitry - itvoical of 4 Trio Channels l Dresden SLC CT Extension -I+.- -IK310 fzc6rr y iCFl"- Pt C467090020-8956-10/16/2009 Attachment 5 RM Documentation No. QC-LAR-02, Revision 2 C467090020-8953-10/16/2009 RM DOCUMENTATION NO. QC-LAR-02 REV: 1 PAGE NO. 1 STATION: Quad Cities UNIT(S) AFFECTED: 1 and 2 TITLE: Risk Assessment Input for Quad Cities Technical Specification Change for Standby Liquid Control System Completion Time from 8 hours to 72 hours
 
==SUMMARY==
: This assessment is performed in support of the license amendment request (LAR) submittal to extend the Technical Specification 3.1.7, Condition B Completion Time (CT) for the Standby Liquid Control (SLC) System from 8 hours to 72 hours. The risk assessment is performed in accordance with ER-AA-600-1046, Rev. 4, Risk Metrics - NOED and LAR No UREs have been created as a result of this application. [ ] Review required after periodic Update [ X ] Internal RM Documentation
[ ] External RM Documentation rTf'f M R71 Method of Review: [ X ] Detailed [ ] Alternate
[ ] Review of External Document This RM documentation supersedes
: QC-LAR-02 Rev. 0 ink its entirety. Of 6 f20oy Prepared by: L. K. Lee/R. A. Narain / l t % sla 00q Sign Date Reviewed by: R A Hill Sign Date Reviewed by: G A Tea;-~arden i Sign ate Reviewed by: V M Andersen (External Events lm~,act) ~ 10 I -, P/0/ _ Sign Date Approved by: E T Burns l o - 16 a Q Date C467090020-8953-10/16/2009 RM DOCUMENTATION NO. QC-LAR-02 REV: 2 PAGE NO. 1 STATION: Quad Cities UNIT(S) AFFECTED: 1 and 2 TITLE: Risk Assessment Input for Quad Cities Technical Specification Change far Standby Liquid Control System Completion Time from 8 hours to 72 hours
 
==SUMMARY==
: This assessment is performed in support of the license amendment request (LAR) submittal to extend the Technical Specification 3.1.7, Condition B Completion Time (CT) for the Standby Liquid Control (SLC) System from 8 hours to 72 hours. The risk assessment is performed in accordance with ER-AA-600-1046, Rev. 4, Risk Metrics - NOED and LAR No UREs have been created as a result of this application. [ Review required after periodic U date [ X ] Internal RM Documentation
[ ] External RM Documentation Electronic Calculation Data Files: Method of Review: [ X ] Detailed [ ] Alternate
[ ] Review of External Document This RM documentation supersedes
: QC-LAR-02 Rev. 1 in its entirety. Prepared by: L. K. LeeVR. A. Narai n -11 .zoo Sign Date Reviewed by: R A Hill 3;~~ l/ Sign a e Reviewed by: G A Teatarden Sign Date Reviewed by: V M Andersen (External Events Im wact - l h 6 Sign Date Approved by: E T Burns (, - O 9 Sign Date 0467090020-8953-10/16/2009 RM DOCUMENTATION NO. QC-LAR-02 REV: 0 PAGE NO. 1 STATION: Quad Cities UNITS) AFFECTED: 1 and 2 TITLE: Risk Assessment Input for Quad Cities Technical Specification Change for Standby Liquid Control System Completion Time from 8 hours to '12 hours
 
==SUMMARY==
: This assessment is performed in support of the license amendment request (LAR) submittal to extend the Technical Specification 3.1.7, Condition C Completion Time (CT) for the Standby Liquid Control (SLC) System from 8 hours to 72 hours. The risk assessment is performed in accordance with ER-AA-600-1046, Rev. 4, Risk Metrics - NOED and LAR No UREs have been created as a result of this a fcation. [ ] Review re aired after periodic Update [ X ] Internal RM Documentation
[ ] External RM Documentation Method of Review: [ X ] Detailed [ ] Alternate
[ ] Review of External Document This RM documentation supersedes
: NIA in its entirety. '7,----- a~l 6 ~Z a og Prepared by: L. K. Lee/R. A. Narain / , ,. r~~ _ .- _ l ? i6 zoo9 Sign Date Reviewed by: R A Hill ~" 9/1009 Sign Date Reviewed by: G A Teabarden Sign Date Reviewed by: V M Andersen (External
[0 Events Impact) ~~ ~. Date Sign Approved by: E T Bums Sign Date C467090020-8953-10/16/2009 RM DOCUMENTATION NO. QC-LAR-02 REV: 2 PAGE NO. 1 STATION: Quad Cities UNIT(S) AFFECTED: 1 and 2 TITLE: Risk Assessment Input for Quad Cities Technical Specification Change for Standby Liquid Control System Completion Time from S hours to 72 hours
 
==SUMMARY==
: This assessment is performed in support of the license amendment request (LAR) submittal to extend the Technical Specification 3.1.7, Condition B Completion Time (CT) for the Standby Liquid Control (SLC) System from 8 hours to 72 hours. The risk assessment is performed in accordance with ER-AA-600-1046, Rev. 4, Risk Metrics - NOED and LAR No UREs have been created as a result of this application. [ ] Review required after periodic Update [ X ] Internal RM Documentation
[ ] External RM Documentation Electronic Calculation Data Files: Method of Review: [ X ] Detailed [ ] Alternate
[ ] Review of External Document This RM documentation supersedes
: QC-LAR-02 Rev. 1 in its entirety. Prepared by: L. K. Lee/R. A. Narain / / Sign Date Reviewed by: R A Hill Sign Date Reviewed by: G A Tea; arden Sign Date Reviewed by: V M Andersen (External Events Im~wact) Sign Date Approved by: E T Burns Si Date TABLE OF CONTENTS Quad Cities SLC CT Extension Section Page APPENDICES A EXTERNAL EVENT ASSESSMENT B UNCERTAINTY ANALYSIS C BWROG ASSESSMENT OF NRC INFORMATION NOTICE 2007-07 C467090020-8953-10/16/2009
 
==1.0 INTRODUCTION==
 
...................................................................................................2 1.1 Purpose ......................................................................................................2 1.2 Background
................................................................................................2 1.3 SLC Technical Specifications
.....................................................................3 1.4 Regulatory Guides......................................................................................3 1.5 Scope .........................................................................................................6 1.6 Quad Cities PRA Model..............................................................................7 2.0 ANALYSIS ROADMAP AND REPORT ORGANIZATION
..................................... 8 3.0 TIER 1 RISK ASSESSMENT
................................................................................9 3.1 Key Assumptions
........................................................................................9 3.2 Internal Events .........................................................................................10 3.3 Results Comparison to Acceptance Guidelines
........................................ 12 3.4 External Events ........................................................................................12 3.5 Uncertainty Assessment
...........................................................................14 3.6 Risk Summary..........................................................................................14 4.0 TECHNICAL ADEQUACY OF THE PRA MODEL ............................................... 16 4.1 PRA Quality Overview..............................................................................16 4.2 Scope .......................................................................................................18 4.3 Fidelity: PRA Maintenance and Update ................................................... 18 4.4 Standards
.................................................................................................19 4.5 Peer Review and PRA Self-Assessment
..................................................19 4.6 Appropriate PRA Quality ..........................................................................21 4.7 General Conclusion Regarding PRA Capability
.......................................42 5.0
 
==SUMMARY==
AND CONCLUSIONS
......................................................................43 5.1 Scope Investigated
...................................................................................43 5.2 PRA Quality..............................................................................................43 5.3 Quantitative Results vs. Acceptance Guidelines
......................................44 5.4 Conclusions
..............................................................................................44
 
==6.0 REFERENCES==
 
....................................................................................................46 
 
==1.0 INTRODUCTION==
 
1.1 PURPOSE 1.2 BACKGROUND 1.2.1 Technical_
Specification Changes 2 Quad Cities SLC CT Extension The purpose of this analysis is to assess the acceptability, from a risk perspective, of a change to the Quad Cities Technical Specification (TS) for the Standby Liquid Control (SLC) system to increase the Completion Time (CT), sometimes called the allowed outage time (AOT), from 8 hours to 72 hours when both SLC subsystems (i.e., both trains) are inoperable. An extension will provide flexibility during power operation in the performance of corrective maintenance, preventive maintenance, and surveillance testing of SLC system components that would cause the system to be inoperable. Consistent with the NRC's approach to risk-informed regulation, Exelon Generating Company (EGC) has identified a particular TS requirement that is very restrictive in its nature and, if relaxed, has a minimal impact on the safety of the plant. The Quad Cities analysis is consistent with similar analyses being conducted for all EGC Boiling Water Reactor (BWR) plants that currently have an 8 hour CT for the SLC system. Since the mid-1980s, the NRC has been reviewing and granting improvements to TS that are based, at least in part, on probabilistic risk assessment (PRA) insights. In its final policy statement on TS improvements of July 22, 1993, the NRC stated that it ... ... expects that licensees, in preparing their Technical Specification related submittals, will utilize any plant-specific PSA or risk survey and any available literature on risk insights and PSAs.. . Similarly, the NRC staff will also employ risk insights and PSAs in evaluating Technical Specifications related submittals. Further, as a part of the Commission's ongoing program of improving Technical Specifications, it will continue to consider methods to make better use of risk and reliability information for defining future generic Technical Specification requirements. The NRC reiterated this point when it issued the revision to 10 CFR 50.36, "Technical Specifications," in July 1995. In August 1995, the NRC adopted a final policy statement on the use of PRA methods in nuclear regulatory activities that encouraged greater use of PRA to improve safety decision-making and regulatory efficiency. The PRA policy statement included the following points: 1. The use of PRA technology should be increased in all regulatory matters to the extent supported by the state of the art in PRA methods and data and in a manner that complements the NRC's deterministic C467090020-8953-10/16/2009 approach and supports the NRC's traditional defense-in-depth philosophy. Quad Cities SLC CT Extension
: 2. PRA and associated analyses (e.g., sensitivity studies, uncertainty analyses, and importance measures) should be used in regulatory matters, where practical within the bounds of the state of the art, to reduce unnecessary conservatism associated with current regulatory requirements. 3. PRA evaluations in support of regulatory decisions should be as realistic as practicable and appropriate supporting data should be publicly available for review. The movement of the NRC to more risk-informed regulation has led to the NRC identifying Regulatory Guides and associated processes by which licensees can submit changes to the plant design basis including Technical Specifications. Regulatory Guides 1.174 [Ref. 2] and 1.177 [Ref. 3] both provide processes to incorporate PRA input for decision makers regarding a Technical Specification modification. Quad Cities, other Exelon plants, and numerous other commercial nuclear plants in the industry have used these risk-informed guidelines to support both permanent and one-time CT extensions for EDGs and other systems. 1.2.2 Exelon SLC E xperiences In October 2006 (Quad Cities) and January 2007 (Dresden), EGC requested Notices of Enforcement Discretion (NOEDs) for SLC System Tank leaks allowing an additional 72 hours to the original 8-hour completion time required for a dual-train inoperability. These NOEDs were approved by the NRC. An extended CT would preempt the need for such NOEDs. 1.3 SLC TECHNICAL SPECIFICATIONS The proposed TS change involves extending the completion time for TS 3.1.7 Condition B from 8 hours (current TS) to 72 hours (proposed TS). Condition B is the situation where both SLC subsystems are inoperable. TS requirements for other SLC conditions will remain unchanged. For Quad Cities, the TS Condition B applies to Modes 1 and 2 for reactivity control. Consideration of TS applicability for Modes 1, 2 and 3 for pH control is not discussed in this report. 1.4 REGULATORY GUIDES Three Regulatory Guides provide primary inputs to the evaluation of a Technical Specification change. Their relevance is discussed in this section. 3 C467090020-8953-10/16/2009 1.4.1 Regulatory Guide 1.174 Quad Cities SLC CT Extension Regulatory Guide 1.174 [Ref. 2] specifies an approach and acceptance guidelines for use of PRA in risk informed activities. RG 1.174 outlines PRA related acceptance guidelines for use of PRA metrics of Core Damage Frequency (CDF) and Large Early Release Frequency (LERF) for the evaluation of permanent TS changes. The guidelines given in RG 1.174 for determining what constitutes an acceptable permanent change specify that the ACDF and the oLERF associated with the change should be less than specified values, which are dependent on the baseline CDF and LERF, respectively. These specified values of ACDF and oLERF are given in RG 1.174 Figures 3 and 4, respectively. These values are presented for two ranges of risk impacts, those described as "small changes" and those described as "very small changes". The acceptance guidelines for "very small changes" are utilized in this risk assessment. Based on the Q105B (i.e., Quad Cities Unit 1 PRA model from the 2005 PRA update, Revision B) baseline internal events CDF of 5.6E-6/yr and LERF of 6.5E-7/yr for Quad Cities, the FIG 1.174 acceptance guidelines prescribe that the risk metrics of OCDF and OLERF be less than 1.0E-06/yr and 1.0E-07/yr, respectively, to establish a very small risk increase with no additional compensatory measures required. RG 1.174 also specifies guidelines for consideration of external events. External events can be evaluated in either a qualitative or quantitative manner. 1.4.2 Requ atorv Guide 1.177 Regulatory Guide 1.174 [Ref. 2] specifies an approach and acceptance guidelines for the evaluation of plant licensing basis changes. RG 1.177 identifies a three-tiered approach for the evaluation of the risk associated with a proposed TS change as identified below: " Tier 1 is an evaluation of the plant-specific risk associated with the proposed TS change, as shown by the change in core damage frequency (CDF) and incremental conditional core damage probability (ICCDP). Where applicable, containment performance should be evaluated on the basis of an analysis of large early release frequency (LERF) and incremental conditional large early release frequency (ICLERP). The acceptance guidelines given in RG 1.177 for determining an acceptable TS change is that the ICCDP and the ICLERP associated with the change should be less than 5E-07 and 5E-08, respectively. Tier 2 identifies and evaluates, with respect to defense-in-depth, any potential risk-significant plant equipment outage configurations associated with the proposed change. The licensee should provide reasonable assurance that risk-significant plant equipment outage configurations will 4 C467090020-8953-10/16/2009 1.4.3 Re ula tots/ Guide 1.200, Revision 1 1.4.4 Acceptance Criteria " ACDF < 1.0E-06/yr " ALERF < 1.0E-07/yr " ICCDP < 5.0E-07 " ICLERP < 5.0E-08 Quad Cities SLC CT Extension not occur when equipment associated with the proposed TS change is out-of-service. " Tier 3 provides for the establishment of an overall configuration risk management program (CRMP) and confirmation that its insights are incorporated into the decision-making process before taking equipment out-of-service prior to or during the CT. Compared with Tier 2, Tier 3 provides additional coverage based on any additional risk significant configurations that may be encountered during maintenance scheduling over extended periods of plant operation. Tier 3 guidance can be satisfied by the Maintenance Rule (10 CFR 50.65(a)(4)), which requires a licensee to assess and manage the increase in risk that may result from activities such as surveillance, testing, and corrective and preventive maintenance. This risk analysis supports the Tier 1 element of RG 1.177, specifically the acceptance guidelines for ICCDP and ICLERP for permanent changes associated with changing a Technical Specification Completion Time. Other portions of the LAR submittal will address Tier 2 and Tier 3 elements. Regulatory Guide 1.200, Rev. 1 [Ref 1], describes an acceptable approach for determining whether the quality of the PRA, in total or the parts that are used to support an application, is sufficient to provide confidence in the results, such that the PRA can be used in regulatory decision-making for light-water reactors. This guidance is intended to be consistent with the NRC's PRA Policy Statement and more detailed guidance in Regulatory Guide 1.174. It is noted that RG 1.200 Rev. 1 endorses Addendum B of the ASME PRA Standard [Ref. 5] applicable to full power internal event (FPIE) PRA models. Since that time, the new ASME/ANS Combined PRA Standard [Ref. 26] has been released. Although the Combined Standard is presently issued and endorsed by RG 1.200 Revision 2 [Ref. 27], neither of these document revisions impact this analysis. Based on the guidance provided in Regulatory Guides 1.174 and 1.177, the following quantitative PRA related acceptance criteria are utilized in this risk analysis: 5 C467090020-8953-10/16/2009 1.5 SCOPE Quad Cities SLC CT Extension This section addresses the requirements of RG 1.200, Rev. 1 Section 3.2 which directs the licensee to define the treatment of the scope of risk contributors (i.e., internal initiating events, external initiating events, and modes of power operation at the time of the initiator). Discussion of these risk contributors are as follows: " Full Power Internal Events (FPIE) -The Quad Cities Q1 05B PRA model used for this analysis includes a full range of internal initiating events (including internal flooding) for at-power configurations. The SLC system is credited in the PRA for criticality control. The FPIE model is further discussed in Section 1.6. " Low Power Operation - The FPIE assessment is judged to adequately capture risk contributors associated with low power plant operations. The FPIE analysis assumes that the plant is at full power at the time of any internal events transient, manual shutdown, or accident initiating event. This analytic approach results in conservative accident progression timings and systemic success criteria compared to what may otherwise be applicable to an initiator occurring at low power. As such, low power risk impacts are not discussed further in this risk assessment. " Shutdown / Refueling - In consideration of shutdown and refueling modes (i.e., Modes 3, 4, and 5), the SLC TS does not apply. As such, shutdown risk impacts are not discussed further in this risk assessment. " Internal Fires - The Quad Cities IPEEE fire assessment, [Ref. 10], and a BWROG assessment
[Ref. 19] are used to provide qualitative and semi-quantitative insights to the analysis (refer to Section 3.4.1). " Seismic - Consistent with most sites, Quad Cities does not currently maintain a Seismic PRA. A qualitative assessment is performed in this analysis (refer to Section 3.2) based on insights from the Quad Cities IPEEE study [Ref. 11] and other industry studies. " Other External Events - Other external event risks were assessed in the Quad Cities IPEEE study [Ref. 11] and found to be insignificant risk contributors (refer to Section 3.4.3). 6 C467090020-8953-10/16/2009 1.6 QUAD CITIES PRA MODEL Quad Cities SLC CT Extension This section addresses the requirements of Section 3.1 of RG 1.200, Rev. 1 which directs the licensee to identify the portions of the PRA used in the analysis. The PRA analysis for the TS change uses the Quad Cities Q105B full power internal events Level 1 Core Damage Frequency (CDF) model and the associated Level 2 Large Early Release Frequency (LERF) model to calculate the risk metrics. This risk assessment applies to both Quad Cities Unit 1 and Unit 2. Both units are very similar and the risk impact of this TS change is minor. The Unit 1 model is considered the "base" model for the 2005B update. The Unit 2 model is created by converting the Unit 1 model. Table 1-1 shows the CDF and LERF risk metrics for both units. Table 1-1 COMPARISON OF UNIT 1 AND UNIT 2 RISK METRICS (FULL POWER INTERNAL EVENTS MODEL) The CDF and LERF for both units are essentially identical. Therefore, the use of the Q1 056 Unit 1 PRA model to reflect the risk impact of this TS change on either unit is reasonable and acceptable. This analysis is specific to the SLC System and therefore the SLC system fault tree model is the only portion of the 01 05B PRA model modified for this risk application. The PRA analysis involved identifying the system and components or maintenance activities modeled in the PRA which are most appropriate for use in setting both subsystems of SLC to be inoperable. As discussed later in Section 3.1, the model parameter 1 SL-1A-1 B---- M-- "SBLC TRAIN A AND TRAIN B IN COINCIDENT MAINTENANCE," was selected as an appropriate parameter to adjust to make the entire SLC system unavailable in the PRA (to reflect SLC inoperable and entry into TS 3.1.7, Condition B). No other aspect of the Q1 05B PRA model required adjustment for this risk application. The entire 01 05B PRA model is quantified for this assessment using the "average maintenance" PRA model (i.e., no portions of the at-power internal events Q1 05B model were excluded or zeroed out of the quantification). 7 C467090020-8953-10/16/2009 Risk Metric Unit 1 Unit 2 Percent Difference CDF 5.5556E-06 5.5547E-06 0.02% LERF 6.4736E-07 6.4736E-07 2.0 ANALYSIS ROADMAP AND REPORT ORGANIZATION The analysis and documentation utilizes the guidance provided in RG 1.200, Revision 1 [Ref. 1]. Table 2-1 summarizes the RG 1.200 identified actions and the corresponding location of that analysis or information in this report. Table 2-1 RG 1.200 ANALYSIS ACTIONS ROADMAP Quad Cities 5LC CT Extension 8 C467090020-8953-10/16/2009 RG 1.200 Actions Report Section 1. Identify the parts of the PRA used to support the application Section 3 1.a Systems, structures and components (SSCs), operational Section 3.2 characteristics affected by the application, and how these are implemented in the PRA model 1.b Acceptance criteria used for the application Section 1.4.4 2. Identify the scope of risk contributors addressed by the PRA model. If Section 1.5 not full scope (i.e., internal and external events), identify appropriate compensatory measures or provide bounding arguments to address the risk contributors not addressed by the model. 3. Summarize the risk assessment methodology used to assess the risk Section 3 of the application. Include how the PRA model was modified to appropriately model the risk impact of the change request. 4. Demonstrate the Technical Adequacy of the PRA. Section 4 4.a Identify plant changes (design or operational practices) that have Section 4.6.1 been incorporated at the site, but are not yet in the PRA model and justify why the change does not impact the PRA results used to support the application. 4.b Document that the parts of the PRA used in the decision are Section 4.6 consistent with applicable standards endorsed by the RG (currently, in RG 1.200 Rev. 1. RG 1.200 Rev. 1 addresses the internal events ASME PRA standard). Provide justification to show that where specific requirements in the standard are not met, it will not unduly impact the results. 4.c Document PRA peer review findings and observations that are Section 4.5 applicable to the parts of the PRA required for the application, and for those that have not yet been addressed justify why the significant contributors would not be impacted. 4.d Identify key assumptions and approximations relevant to the results Section 3.1 used in the decision-making process.
3.0 TIER 1 RISK ASSESSMENT This section evaluates the plant-specific risk associated with the proposed TS change, based on the risk metrics of CDF, ICCDP, LERF, and ICLERP. a. b. c. d. KEY ASSUMPTIONS Quad Cities SLC CT Extension The following inputs and general assumptions are used in estimating the plant risk to the proposed SLC System CT extension. The SLC System CT is assumed to increase from its current duration of 8 hours to a proposed duration of 72 hours. The base analysis in this risk assessment assumes one entry per year into the proposed CT. The duration of the proposed CT is assumed to be adequate for performing the majority of corrective maintenance, preventive maintenance, and surveillance testing on-line. An examination of SLC rolling unavailability for a two year period ending February 28, 2009 showed that for Unit 2, Train A was unavailable for 47.3 hours, and Train B was unavailable for 54.3 hours. There were no instances when both trains were unavailable
.(') Unit 1 unavailabilities were lower, and also were never coincident. Thus, any impact from extending the CT is assumed to be negligible and it is conservatively assumed that the outage will not be entered more than once a year. Additionally, Configuration Risk Management at Quad Cities is governed by the Maintenance Rule (10 CFR 50.65(a)(4)). A sensitivity analysis of the risk associated with entering the CT was performed, and indicated that the SLC system could be taken out of service for up to 297 hours before the very small risk increase metrics of RG 1.174 and RG 1.177 are exceeded. This represents a significant margin compared to the proposed 72 hour CT. As stated above, the historical analysis of unavailability data shows that the SLC system does not exceed this ceiling value. This risk assessment does not credit the averted risk due to a forced shutdown that would be required due to exceeding the existing CT. The model manipulations were performed on the Unit 1 model. The results for Unit 2 are expected to generate essentially identical results. due It is recognized that in October 2006, Quad Cities Unit 1 declared both SLC subsystems unavailable due to a leak in the SLC tank. An NOED to extend the CT an additional 72 hours to the original 8 hour CT was requested by EGC and approved by the NRC. See Section 1.2.2 for additional discussion. 9 C467090020-8953-10/16/2009 3.2 INTERNAL EVENTS Quad Cities SLC CT Extension The Quad Cities Q1 05B PRA model' [Ref. 4] was examined to determine which PRA basic event to modify to reflect the coincident unavailability of both SLC subsystems. The applicable basic event for the 2005B PRA model was identified as 1 SL-1 A-1 B----M-- "SBLC TRAIN A AND TRAIN B IN COINCIDENT MAINTENANCE
." This event is appropriate because it fails both SLC subsystems and no other equipment in the model. Event 1 SL-1 A-1 B---- M-- was set to a binary logic value of "TRUE" (using a quantification flag file) and the entire Q105B model was requantified using the same PRA software codes and revisions as used for the base Q105B model [Ref. 4]. These configuration specific CDF and LERF values are used in conjunction with the base Q1 05B values to calculate the risk impacts of the proposed TS change. The calculations of ACDF, ICCDP, OLERF and ICLERP for the CT change are determined as shown below. The ACDF to be compared to the RG 1.174 acceptance guidelines is given by (as defined by [Ref. 21]): OCDF = CDFNEW - CDFB A SE [Equation 3-1] OCDF is the difference between the annual average CDF with the CT extended and the CDF with the current CT. The ACDF has units of "per reactor year." In the above equation, CDFNEW is equal to: CDFNEn, = CTsLC-oos " CDFSLC-oos
+ [(1-CTsLc-oos)
* CDFBASE] [Equation 3-2] Where: CDFSLC-oos=
the annual average CDF calculated with both SLC subsystems out of service (1 SL-1 A-1 B---- M-- set to True) CDFBASE = baseline annual average CDF with average unavailability for all equipment. This is the CDF result of the 01 05B baseline PRA. CTSLc_oos
= the new extended CT as an annual unavailability (i.e., 72 hours / 8760 hours/year
= 8.2E-03 yr) CTSLc-oos
= the new extended CT as a probability (i.e., 72 hours / 8760 hours = 8.2E-03) ' The Q105B baseline model used in the calculations contains the average maintenance associated with system trains. 1 0 C467090020-8953-10/16/2009 Quad Cities SLC CT Extension The ICCDP associated with the SLC System being out of service using the new CT is given by: ICCDP(i) = (CDFSLC-oos - CDFBASE) x CTSLC_oos [Equation 3-3] Risk significance relative to ALERF and ICLERP(2) is determined using equations of the same form as noted above for ACDF and ICCDP. The relevant input parameters for the base quantification of this risk analysis are summarized in Table 3.2-1. The corresponding base risk metric results for this risk analysis (based on quantification of the Q105B model and use of the above equations) are provided in Table 3.2-2. Table 3.2-1 RISK ASSESSMENT INPUT PARAMETERS ICCDP and ICLERP are probabilities, i.e., no units. 1 1 C467090020-8953-10/16/2009 Input Parameter Value Reference CDF BASE 5.6E-06/yr Q105B PRA [Ref. 4] LERF BASE 6.5E-07/yr Q105B PRA [Ref. 4] CTS LC_OO S 8.2E-03 One 72-hr TS 3.1.7 Condition B entry assumed per year (i.e., 72 hr/8760 hrs).
Table 3.2-2 RISK ASSESSMENT BASE RESULTS 3.3 RESULTS COMPARISON TO ACCEPTANCE GUIDELINES Quad Cities SLC CT Extension As can be seen from Table 3.2-2, the base results of the risk assessment indicate that the ACDF, ICCDP, ALERF, and ICLERP risk metric values are below the acceptance guidelines as defined in RG 1.174 and RG 1.177. In addition, quantitative sensitivity cases for model uncertainties are provided in Appendix B. This analysis demonstrates that the proposed TS change satisfies the risk acceptance guidelines in RG 1.174 and RG 1.177, and therefore meets the intent of very small risk increases consistent with the Commission's Safety Goal Policy Statement. A sensitivity analysis was performed to determine the maximum allowable CT before exceeding the acceptance criteria for very small risk increases. For this sensitivity, ICCDP and ICLERP were set to their maximum allowable values in RG 1.177, and the CTNEw allowable was calculated. ICLERP was determined to be the bounding parameter, and a CTNEW of 297 hours was calculated. This represents a significant margin compared to the proposed 72 hour CT. 1 2 C467090020-8953-10/16/2009 Risk Metric Value Acceptance Guidelines CDFSLC_oos 8.0E-6/yr N/A CDFNEW 5.6E-6/yr N/A ACDF 2.0E-08/yr
< 1.0E-06/yr ICCDP 2.0E-08 <5.0E-07 LERFSLC_oos 2.1 E-6/yr N/A LERFNEW 6.6E-7/yr N/A ALERF 1.2E-08/yr
<1.0E-07/yr ICLER P 1.2E-08 <5.OE-08 3.4 EXTERNAL EVENTS A qualitative assessment of external event risks is provided. Further details are found in Appendix A. 3.4.1 Internal Fires The impact on the internal fires risk profile due to the proposed CT is evaluated using the following information sources: " NUREG/CR-6850
[Ref. 18] " Quad Cities Fire IPEEE [Ref. 10] " BWROG Assessment of Fire-Induced Failure to Scram [Ref. 19] The internal fires risk impact assessment is discussed in Appendix A.4. The assessment concluded that fire hazards can be appropriately screened as non-significant contributors to the risk assessment of the proposed SLC CT because of the low frequency of a fire coupled with a failure to scram. 3.4.2 Seismic Exelon does not currently maintain a seismic PRA for Quad Cities. The impact on the seismic risk profile due to the proposed CT is evaluated using the following information source: " Quad Cities IPEEE [Ref. 11] " NUREG-1150
[Ref. 23] Quad Cities SLC CT Extension The seismic risk impact assessment is discussed in Appendix A.3. The assessment concluded that seismic risk can be appropriately screened as a non-significant contributor to the risk assessment of the proposed CT. 3.4.3 Other External Hazards Other external event risks such as external floods, severe weather, high winds or tornados, transportation accidents, nearby facility accidents, turbine missiles, and other miscellaneous external hazards were also considered in the IPEEE analysis. The Quad Cities site characteristics and design meet all the applicable criteria of the NRC Standard Review Plan (SRP). No significant quantitative contribution from these external events was identified by IPEEE evaluations (refer to Appendix A.2). As such, other external hazards are appropriately screened as non-significant contributors to the risk assessment of the proposed CT. 13 C467090020-8953-10/16/2009 3.5 UNCERTAINTY ASSESSMENT 3.5.1 Parametric Uncertaintv Quad Cities SLC CT Extension Consistent with the ASME PRA Standard, quantitative parametric uncertainty analyses for both CDF and LERF are evaluated to determine if the point estimates calculated by the PRA model appropriately represent the mean. The results of these analyses are summarized in Appendix B.3. The parametric uncertainty analysis shown in Appendix B.3 supports the use of the point estimate to represent the mean for the calculation of the changes in the risk metrics for the extended CT. 3.5.2 Modeling Uncertainty An assessment of modeling uncertainties is documented in Sections B.1 and B.2. " Section B.1 provides Quad Cities specific modeling uncertainty evaluations for the Base Case. " Section B.2 provides an examination of the specific cutsets that affect the change in the CDF risk metric associated with the change in the SLC CT. The results of the modeling uncertainty assessments do not change the conclusions of this risk assessment for the proposed SLC CT changes. 3.6 RISK
 
==SUMMARY==
As discussed above and as summarized in Table 3.6-1, the FPIE quantitative evaluation results are well below the risk acceptance guidelines of RG 1.174 and RG 1.177. External events evaluations are discussed in Appendix A and do not change the results or conclusions of this risk assessment. As such, this risk evaluation demonstrates that the proposed TS change can be made with a very small risk increase. 14 C467090020-8953-10/16/2009 Table 3.6-1 RISK ASSESSMENT
 
==SUMMARY==
RESULTS Quad Cities SLC CT Extension (1) Evaluated and determined not to change the conclusions of the FPIE risk analysis. 1 5 C467090020-8953-10/16/2009 Hazard ACDF ICCDP ALERF ICLERP FPIE _____________________
2.0E-08/yr
________________
2.0E-08 _________________
1.2E-08/yr
___________-______
1.2E-08 ____________________
Acceptance
<1.0E-06/yr
<5.0E-07 <1.0E-07/yr
<5.0E-08 Criteria Fire (1) (1) (1) (1) Seismic (1) (1) (1) (1) 4.0 TECHNICAL ADEQUACY OF PRA MODEL The 2005B update to the Quad Cities PRA model (Q1 05B) is the most recent evaluation of the risk profile at Quad Cities for FPIE challenges. The Quad Cities PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, and common cause events. The PRA model quantification process used for the Quad Cities PRA is based on the event tree / fault tree methodology, which is a well-known methodology in the industry. Exelon Generation Company (EGC) employs a multi-faceted approach to establishing and maintaining the technical adequacy and plant fidelity of the PRA models for all operating EGC nuclear generation sites. This approach includes both a proceduralized PRA maintenance and update process, and the use of self-assessments and independent peer reviews. The following information describes this approach as it applies to the Quad Cities PRA. 4.1 PRA QUALITY OVERVIEW Quad Cities SLC CT Extension The quality of the Quad Cities FPIE PRA is important in making risk-informed decisions. The importance of the PRA quality derives from NRC Policy Statements as implemented by RGs 1.174 and 1.177, rule making and oversight processes. These can be briefly summarized as follows using the words of the NRC Policy Statement (1995): 1. "The use of PRA technology should be increased in all regulatory matters to the extent supported by the state-of-the-art. .. and supports the NRC's traditional defense-in-depth philosophy. " 2. "PRA ... should be used in regulatory matters ... to reduce unnecessary conservatism
..." 3. "PRA evaluations in support of regulatory decisions should be ... realistic
... and appropriate supporting data should be publicly available for reviews." 4. "The Commission's safety goals... and subsidiary numerical objectives are to be used with appropriate consideration of uncertainties in making regulatory judgments..." 5. "Implementation of the [PRA] policy statement will improve the regulatory process in three ways: 1 6 C467090020-8953-10/16/2009 Through more efficient use of agency resources; and Through a reduction in unnecessary burdens on licensees." Challenges to plant operation (Initiating Events): Internal Events (including Internal Floods) External Hazards Fires Plant Operational states: Full Power Low Power Shutdown The metrics used in the quantification
: Level 1 PRA - CDF Level 2 PRA - LERF Level 3 PRA - Health Effects 1 7 Quad Cities SLC CT Extension Foremost, through safety decision making enhanced by the use of PRA insights; PRA quality is an essential aspect of risk-informed regulatory decision making. In this context, PRA quality can be interpreted to have five essential elements: " Scope (Section 4.2): The scope (i.e., completeness) of the FPIE PRA. The scope is interpreted to address the following aspects: Fidelity (Section 4.3): The fidelity of the PRA to the as-built, as-operated plant. " Standards (Section 4.4): ASME/ANS PRA Standard [Ref. 5] as endorsed by the N RC in Regulatory Guide 1.200 [Ref. 1]. " Peer Review (Section 4.5): An independent PRA peer review provides a method to examine the PRA process by a group of experts. In some cases, a PRA self-assessment using the available PRA Standards endorsed by the NRC can be used to replace or supplement this peer review. " Appropriate Quay (Section 4.6Z The quality of the PRA needs to be commensurate with its application. In other words, the needed quality is defined by the application requirements. C467090020-8953-10/16/2009 4.2 SCOPE Quad Cities SLC CT Extension The Quad Cities PRA is a full power, internal events (FPIE) PRA that addresses both CDF and LERF. The quantitative insights from the FPIE PRA are directly applicable to the SLC CT Extension PRA application. This scope is judged to be adequate to support the SLC CT PRA application. Because not all PRA standards are available to define the appropriate elements of PRA quality for all applications, the NRC has adopted a phased implementation approach. This phased approach uses available PRA tools and their quantitative results where standards are available and endorsed by the NRC. Where standards are not yet available or endorsed, this approach uses qualitative insights or bounding approaches as needed. The quality assessment performed in this section confirms the adequacy of the FPIE PRA. This assessment does not address the risk implications associated with low power or shutdown operation or with external events (including fire). 4.3 FIDELITY: PRA MAINTENANCE AND UPDATE The EGC risk management process for maintaining and updating the PRA ensures that the PRA model remains an accurate reflection of the as-built and as-operated plants. This process is defined in the EGC Risk Management program, which consists of a governing procedure (ER-AA-600, "Risk Management")
and subordinate implementation procedures. EGC procedure ER-AA-600-1015, "FPIE PRA Model Update" delineates the responsibilities and guidelines for updating the full power internal events PRA models at all operating EGC nuclear generation sites. The overall EGC Risk Management program, including ER-AA-600-1015, defines the process for implementing regularly scheduled and interim PRA model updates, for tracking issues identified as potentially affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, industry operating experience), and for controlling the model and associated computer files. To ensure that the current PRA model remains an accurate reflection of the as-built, as-operated plants, the following activities are routinely performed: " Design changes and procedure changes are reviewed for their impact on the PRA model. " New engineering calculations and revisions to existing calculations are reviewed for their impact on the PRA model. " Maintenance unavailabilities are captured, and their impact on CDF is trended. " Plant specific initiating event frequencies, failure rates, and maintenance unavailabilities are updated approximately every four years. 18 C467090020-8953-10/
1 6/2009 In addition to these activities, EGC risk management procedures provide the guidance for particular risk management and PRA quality and maintenance activities. This guidance includes: " Documentation of the PRA model, PRA products, and bases documents. " The approach for controlling electronic storage of Risk Management (RM) products including PRA update information, PRA models, and PRA applications. " Guidelines for updating the full power, internal events PRA models for EGC nuclear generation sites. " Guidance for use of quantitative and qualitative risk models in support of the On-Line Work Control Process Program for risk evaluations for maintenance tasks (corrective maintenance, preventive maintenance, minor maintenance, surveillance tests and modifications) on systems, structures, and components (SSCs) within the scope of the Maintenance Rule (10CFR50.65 (a)(4)). In accordance with this guidance, regularly scheduled PRA model updates nominally occur on a four year cycle; shorter intervals may be required if plant changes, procedure enhancements, or model changes result in significant risk metric changes. 4.4 STANDARDS The ASME PRA Standard [Ref. 5] provides the basis for assessing the adequacy of the Quad Cities PRA as endorsed by the NRC in RG 1.200, Rev. 1 [Ref. 11. The predecessor to the ASME PRA Standard was NEI 00-02 which identified the critical internal events PRA elements and their attributes necessary for a quality PRA. 4.5 PEER REVIEW AND PRA SELF-ASSESSMENT There are three principal ways of incorporating the necessary quality into the PRA in addition to the maintenance and update process. These are the following: " A thorough and detailed investigation of open issues and the implementation of their resolution in the PRA. Quad Cities SLC CT Extension " A PRA Peer Review to allow independent reviewers from outside to examine the model and documentation. The ASME PRA Standard [Ref. 5] specifies that a PRA Peer Review be performed on the PRA. " The use of the ASME PRA Standard to define the criteria to be used in establishing the quality of individual PRA elements 19 C467090020-8953-10/
1 6/2009 4.5.1 PRA Pe er Review Overview 4.5.2 Self-Asse ssment Overview 2 0 Quad Cities SLC CT Extension Several assessments of technical capability have been made and continue to be planned for the Quad Cities PRA model. A chronological list of the assessments performed includes the following: " An independent PRA peer review was conducted under the auspices of the BWR Owners' Group (BWROG) in February 2000, following the Industry PRA Peer Review process [Ref. 6]. This peer review included an assessment of the PRA model maintenance and update process. " In 2004, prior to the 2005 PRA update, a self-assessment analysis was performed against the available version of the ASME PRA Standard, Addendum A [Ref. 5]. " During 2005 and 2006, the Quad Cities PRA model results were evaluated in the BWROG PRA cross-comparisons study performed in support of implementation of the mitigating systems performance indicator (MSPI) process. " In 2009, an update of the self-assessment analysis was performed against ASME PRA Standard, Addendum B [5]. The 2009 self-assessment also addresses the updated Supporting Requirements associated with PRA Model Uncertainty as provided in the "Combined PRA Standard" [26] and Regulatory Guide 1.200, Rev. 2 [27]. An independent peer review of the Quad Cities PRA was performed in 2000 following the review guidelines of the BWROG (a predecessor to the ASME PRA Standard). A summary of the disposition of the February 2000 Industry PRA Peer Review facts and observations (F&Os) for the Quad Cities PRA models was documented as part of the statement of PRA capability for MSPI in the Quad Cities MSPI Basis Document [7]. As noted in that document, there were no significance level A F&Os from the peer review, and all significance level B F&Os were addressed and closed out with the completion of the current models of record (2005B model--Q105B). Also noted in that submittal was the fact that, after allowing for plant-specific features, there are no MSPI cross-comparison outliers for Quad Cities (refer to the third bulleted item above). The Quad Cities PRA and the output of the PRA Peer Review was used in the development of the PRA self-assessment which also used the Supporting Requirements of the ASME PRA Standard [Ref. 5]. C467090020-8953-10/16/2009 Quad Cities SLC CT Extension A Self-Assessment
("Gap" Analysis) for the Quad Cities PRA model was completed in 2004 in preparation for the 2005 PRA update. This Gap Analysis was performed against the ASME PRA Standard, addendum A [Ref. 5]. The 2004 gap analysis defined a list of 85 supporting requirements from the Standard for which potential gaps to Capability Category II of the Standard were identified. For each such potential gap, a PRA updating requirements evaluation (URE) (EGC model update tracking database) was documented for resolution. A PRA model update was completed in 2005. In updating the PRA, changes were made to the PRA to address most of the identified gaps, as well as to address other open UREs. Following the update, an assessment of the status of the gap analysis relative to the new model and the updated requirements in Addendum B of the ASME PRA Standard concluded that 69 of the gaps were fully resolved (i.e., are no longer gaps), and another one (1) was partially resolved. After accounting for the number of SRs added or deleted as part of Addendum B, the Quad Cities PRA contains 21 potential gaps to Capability Category II of the Standard. Table 4-2 presents a discussion of these identified "gaps" and concludes that none impact this application. PRAs can be used in applications despite not meeting all of the Supporting Requirements of the Combined ASME/ANS PRA Standard. This is well recognized by the NRC and is explicitly stated in the Combined ASME/ANS PRA Standard and RG 1.174. RG 1.174 states the following in Section 2.2.6: There are, however, some applications that, because of the nature of the proposed change, have a limited impact on risk, and this is reflected in the impact on the elements of the risk model. The proposed SLC CT Extension PRA application may not require more than Capability Category I for some SRs. It is also acknowledged that for PRAs with SRs ranked as "Not Met," the PRA may be used for PRA applications but may require additional justification and support to allow their use. Finally, it is judged that no PRA has Capability Category III for all of its SRs, nor is this currently expected as part of the NRC PRA Quality Program. 4.6 APPROPRIATE PRA QUALITY The PRA is used within its limitations to augment the deterministic criteria for plant operation. This is confirmed by the PRA Peer Review and the PRA Self-Assessment. As indicated previously, RG 1.200 also requires that additional information be provided as part of the License Amendment Request (LAR) submittal to demonstrate the technical adequacy of the PRA model used for the risk assessment. Each of these items (plant changes not yet incorporated in to the PRA model, consistency with applicable PRA Standards, relevant peer review findings, and the identification of key assumptions) is discussed below. 2 1 C467090020-8953-10/16/2009 4.6.1 Plant Changes Not Yet In corporated into the PRA Model A PRA updating requirements evaluation (URE) is EGC's PRA model update tracking database. These UREs are created for all issues that are identified with a potential to impact the PRA model. The URE database includes the identification of those plant changes that could impact the PRA model. A review of the current open items in the URE database associated with plant changes for Quad Cities is summarized in Table 4-1 along with an assessment of the impact for this application. The results of the assessment documented in Table 4-1 is that none of the plant changes have any measurable impact on the SLC CT extension request. 4.6.2 Consistency with Aoo licable PRA Standards Quad Cities SLC CT Extension As indicated above, an independent peer review of the Quad Cities PRA was performed in 2000 following the review guidelines of the BWR Owners' Group (a predecessor to the ASME PRA Standard). All of the significance level "A" and "B" F&Os have been resolved. No further investigation of Peer Review findings is required. The self-assessment provides the connection between the PRA and the ASME PRA Standard by also considering the PRA Peer Review comments. Table 4-2 summarizes the evaluation of the identified "gaps" from the self-assessment and their impact on the SLC CT extension request. In summary, of the 21 gaps identified and evaluated in Table 4-2, none have a measurable impact on the SLC CT extension request. 2 2 C467090020-8953-10/16/2009 Quad Cities SLC CT Extension Table 4-1 IMPACT ON THE QUAD CITIES PRA MODEL OF PLANT CHANGES SINCE THE LAST UPDATE 2 3 C467090020-8953-10/16/2009 URE Impact on the Number Plant change impact on the QC PRA Application QC2000-064 DCP 9800022 adds fusing of 250 V DC 1C and 1A circuits for Include in next Fire PRA update. - No Impact App. R. Per Table 2-3 of QC Fire IPEEE Quantification Consensus comments - 9/21/01 Notebook there is impact on circuit coordination. No impact on internal events PRA. QC2000-065 DCP 9800023 modifies switching of normal and reserve power Very small impact on quantification. No Impact for 125 V DC HFA relays. Per Table 2-3 of QC Fire IPEEE Include in next Fire PRA update. - Quantification Notebook this removes a manual switching action. Consensus comments - 9/21/01 No impact on internal events PRA. QC2000-067 DCP 9800025 adds additional cables for 125 V DC control power Very small impact on quantification. No Impact for 4 KV breakers.. Per Table 2-3 of QC Fire IPEEE Consider in next Fire PRA update, as Quantification Notebook this may improve fire response. Impact well as FPIE update.- Consensus on internal events analysis is unknown. comments - 9/21/01 No impact on internal events PRA. QC2000-068 DCP 9800026 adds additional cables for 125 V DC control power Very small impact on quantification. No Impact for 4 KV breakers.. Per Table 2-3 of QC Fire IPEEE Consider in next Fire PRA update, as Quantification Notebook this may improve fire response. Impact well as FPIE update. - Consensus on internal events analysis is unknown. comments - 9/21/01 No impact on internal events PRA. QC2000-069 DCP 9800027 re-routes 125 V DC control cable to UAT/RAT. Very small impact on quantification. No Impact Per Table 2-3 of QC Fire IPEEE Quantification Notebook this Consider in next Fire PRA update, as may improve fire response. Impact on internal events analysis is well as FPIE update. - Consensus unknown. comments - 9/21/01 No impact on internal events PRA.
Quad Cities SLC CT Extension Table 4-1 IMPACT ON THE QUAD CITIES PRA MODEL OF PLANT CHANGES SINCE THE LAST UPDATE 2 4 C467090020-8953-10/16/2009 URE Impact on the Number Plant change Impact on the QC PRA AM lication QC2000-070 DCP 9800028 modifies 125 V DC control power in Aux Electric Very small impact on quantification. No Impact room panels for switching normal and reserve 4 KV power. Per Consider in next Fire PRA update, as Table 2-3 of QC Fire IPEEE Quantification Notebook this may well as FPIE update. - Consensus improve fire response by removing a manual action. Impact on comments - 9/21/01 internal events analysis is unknown. No impact on internal events PRA. QC2000-072 DCP 9800032 adds fusing of 250 V DC circuits for App. R. Per Include in next Fire PRA update. - No Impact Table 2-3 of QC Fire IPEEE Quantification Notebook there is Consensus comments - 9/21/01 impact on circuit coordination. (Ref URE 2000-64). No impact on internal events PRA. QC2000-073 DCP 9800033 re-routes 125 V DC control power to 4 KV Very small impact on quantification. No Impact breakers. Per Table 2-3 of QC Fire IPEEE Quantification Consider in next Fire PRA update, as Notebook there is impact on power availability. well as FPIE update. - Consensus comments - 9/21/01 No impact on FPIE PRA. QC2000-074 DCP 9800034 re-routes cabling for 125 V DC relay control. Per Very small impact on quantification. No Impact Table 2-3 of QC Fire IPEEE Quantification Notebook there is Consider in next Fire PRA update, as impact on local control. Impact on internal events PRA is well as FPIE update. - Consensus unknown. comments - 9/21/01 No impact on internal events PRA. QC2000-075 DCP 9800035 re-routes cabling for 125 V DC relay control. Per Very small impact on quantification. No Impact Table 2-3 of QC Fire IPEEE Quantification Notebook there is Consider in next Fire PRA update, as impact on local control. Impact on internal events PRA is well as FPIE update. - Consensus unknown. comments - 9/21/01 No impact on internal events PRA.
Quad Cities SLC CT Extension Table 4-1 IMPACT ON THE QUAD CITIES PRA MODEL OF PLANT CHANGES SINCE THE LAST UPDATE 2 5 C467090020-8953-10/16/2009 URE Number Plant change Impact on the OC PRA Impact on the Application QC2000-076 DCP 9800057 modifies 250 V DC fusing for App. R. Per Table 2- Negligible impact on internal events No Impact 3 of QC Fire IPEEE Quantification Notebook there is impact on quantification. Include in next Fire power availability which should be positive for App. R fires. PRA update. - Consensus comments Specific impact on internal events PRA is unknown. -9/21/01 No impact on internal events PRA. QC2000-085 DCPs 99-00528, 529, 530, and 531 re-install auto start on the Documentation, only. - Consensus No Impact backup lube-oil pumps for the WA, U1B, U2A, and U2B recirc- comments - 9/21/01 MG sets. These pumps also supply the oil used in the MG set fluid coupling for controlling recirc pump speed. Installation of No Impact on this Application the auto-start prevents pump trip/scram on loss of lube oil. The ARI-RPT logic is not affected, nor is Recirc System valve control or logic, thus there should be no material effect on the PRA. Only impact may be documentation. This URE is written to mirror a URE written for Dresden for a similar set of mods (See URE DR- 2000-72).
Quad Cities SEC CT Extension Table 4-1 IMPACT ON THE QUAD CITIES PRA MODEL OF PLANT CHANGES SINCE THE LAST UPDATE 2 6 C467090020-8953-10/16/2009 URE Number Plant chan e impact on the QC PRA Impact on the Application QC2001-001 DCP 9900583 revises pressure setpoint at which MSIVs close It appears that the current MSIV No Impact FROM 850 psig TO 854 psig. Changes are required for Ext. closure pressure setpoint has not Power Uprate. Setpoint is point at which MSIVs close on been changed. Directly out of the decreasing steam pressure with mode switch in RUN, activating MAAP parameter input file, the on PS 1-0261-30A(B,C,D). Probably no change to model or following information was obtained. results. URE written to ensure PRA notebook documentation is ** updated, if required. -- E. R. Jebsen 1/15/01 PLMSIV ** PLMSIV is the low RPV pressure setpoint that initiates
** MSIV closure. By default, reactor scram is ** simultaneously initiated with the MSIV closure. ** Q.C. Ref: Quad Cities Technical Specifications, ** Amendment No. 199/195, Table 3.3.6.1-1, page 1. ** 831 psig = 845.7 psia. ** ** Q.C. Note: In the Quad Cities PSA System Information
** Notebook Main Condenser and Main Steam System, QC2001-001
** QC PSA-005.15 the value is 825 No Impact Quad Cities SLC CT Extension Table 4-1 IMPACT ON THE QUAD CITIES PRA MODEL OF PLANT CHANGES SINCE THE LAST UPDATE 2 7 C467090020-8953-10/16/2009 URE Number Plant change Impact on the QC PRA Impact on the Application (cont'd) psig = 839.7 psia. ** Q.C. Note: Quad Cities URE 2001-01 indicates that the "* MSIV closure setpoint should be updated from 850 to " 854 psig. 854 + 14.7 = 868.7 psia. After discussions with Rick Swart, EC 344103, dated 3/14/04, changed the Unit 2 Group 1 Isolation Low Pressure Setpoint to 808 psig and EC 343683, dated 3/14/04 changed Unit 1 Group 1 Isolation Setpoint similarly. I have requested copies of these two EC's for your use and will send them to you once received. Attached is the reference from Tech Spec. 3.3.6.1. However, this revision only shows a value greater than 791 psig. No Impact on this application QC2002-045 Fire PRA: In 2000, several fire area designations were changed, No impact on internal events PRA. - No Impact e.g. the cable tunnels, part of fire area TB-I in the 1999 fire PRA are now designated CT-1 and CT-2. Other changes are also in place. Any fire PRA update should reflect the latest fire area designations. -- ERJ 9/12/02 Quad Cities SLC CT Extension Table 4-1 IMPACT ON THE QUAD CITIES PRA MODEL OF PLANT CHANGES SINCE THE LAST UPDATE 2 8 C467090020-8953-10/16/2009 URE Impact on the Number Plant change Impact on the QC PRA A " " lication QC2002-046 Fire PRA: procedure QCOA 0010-12 rev. 21 includes changes to No impact on internal events PRA. - No Impact SSD equipment in fire area CT-2 (cable tunnel 2). Impact on fire PRA should be investigated at next fire PRA update. -- ERJ 9/12/02 QC2004-021 QC U1 Reserve Aux Transformer (RAT) T-12 will be replaced EC-351820 has not been completed No Impact under EC-351820 to add an automatic load tap changer (LTC) to or issued for Quad Cities. Scheduled accommodate changes in grid voltage which may result in times for completion of this EC are: reduced voltage to emergency loads during accident conditions. Per the "Design Consideration Summary" from Bipin Desai at - Unit 2 RAT will be replaced during Sergeant & Lundy 11-17-2004, the replacement RAT will have Q2R18 (3/27/06 to 4/14/06) the same normal and emergency function as prior to - Unit 1 RAT will be replaced during replacement. However, the LTC apparently adds an additional Q1 R19 (1/19/05 to 2/16/07) source of transformer oil, and the mod requires additional cables, and changes to the transformer fire protection deluge system. In This URE will remain open till the summary, it appears that the internal events PRA for QC is *not- next Quad Cities PRA update. - AJG/ affected by the RAT replacement. However, the impact of the 8/22/05 change on the QC fire PRA should be investigated whenever the fire PRA is updated (currently not scheduled). -- E. R. Jebsen No Impact on this Application QC2004-024 ECN 341220 replaces the 250 gallon day tank for each diesel This change has a negligible impact No Impact driven fire pump with a 650 gallon day tank for each pump. The on reliability of the fire pumps, since tanks can be cross-tied. Filling would be accomplished locally fuel tank problems would only be a instead of with the emergency diesel transfer pumps. small part of the fire pump failure-to-start and failure-to-run terms. No Impact on this Application Quad Cities SLC CT Extension Table 4-1 IMPACT ON THE QUAD CITIES PRA MODEL OF PLANT CHANGES SINCE THE LAST UPDATE 2 9 C467090020-8953-10/16/2009 URE Number Plant change Impact on the QC PRA Impact on the A " " lication QC2005-003 Per QCOP 1000-05, Rev. 35, the plant has temporarily changed Past 2005 freeze date. No Impact alignment of a manual valve on the RHRSW return from the RHR pump seal cooler, to prevent leakage from the 1 B RHR hx. flowing upstream, through the seal cooler, and then to the river, providing a release path for radioactivity. Use of this hx. for shutdown cooling now requires a local manual action. HRA may need revision. QC2005-005 EC 346408 and EC 346409 are replacing the Fire Pumps (1/2- The Fire Pumps are only used in the No Impact 4101-A and 1/2-4101-B) with a higher capacity pump. The PRA to provide 1) a suction source to current pumps are 2,000 gpm @ 125 psi and the replacement the SSMP when the CCST is not pumps are 2,500 gpm @ > 125 psi. available and 2) Cooling to the SSMP Room Coolers when Service Water is not available. Jim Limes, from NEXUS, also states that it provides an alternate source for the Fuel Pool Make Up (FPMU). However, the FPMU is not modeled in the PRA. The PRA Success Criteria only requires one Diesel Fire Pump. Therefore, the increased flow would not change the PRA Success Criteria. And, as a result, does not affect the PRA.
Quad Cities SLC CT Extension Table 4-1 IMPACT ON THE QUAD CITIES PRA MODEL OF PLANT CHANGES SINCE THE LAST UPDATE 3 0 0467090020-8953-10/16/2009 URE Number Plant change Im act on the QC PRA Impact on the A" " lication QC2005-006 EC 351168, Rev. 1, covers installation of the replacement steam Only impact on PRA is in mass of No Impact dryer for Unit 2. EC 351167 covers Unit 1. The new dryers are stainless steel in the vessel, which more rugged and weigh approximately 40% more than the ones can slightly modify core damage that they are replacing. The Unit 2 dryer will be replaced in early progression. May of 2005; date for Unit 1 is in late May. MAAP parameter file was finalized prior to this URE being written. This URE to remain open until the next update. OC2005-007 Formulation of MSPI program for Quad RCIC led to review of No Impact mini-flow-valve monitoring in the PRA. In the PRA RCIC fault tree, failure of valve 1-1301-60 to open causes RCIC failure. This appears to be overly conservative, and this failure mode should be removed from the PRA. "Quarterly RCIC Pump Operability Test, QCOS 1300-05, Step B.7, notes that the "60" valve is required to be functional for RCIC to be considered operable and available. It states that the pump can survive for up to 10 seconds dead-headed, and that as the pump discharge valve automatically starts to open, flow will be produced, negating the need for the mini-flow. Furthermore, Step H.32 of this test procedure has the operators create 1225 psig at the pump discharge pressure and demonstrate that it will pump 400 gpm at that pressure. Therefore, the mini-flow is not needed for high reactor pressure conditions. (The mini-flow is orificed for -80 gpm, per System Manager Tracy Rushing.) The same test also demonstrates that the flow controller can produce 400 gpm with the mini-flow open; therefore, failure of the mini-flow valve to close also does not need to be modeled in the PRA.
Quad Cities SLC CT Extension Table 4-1 IMPACT ON THE QUAD CITIES PRA MODEL OF PLANT CHANGES SINCE THE LAST UPDATE 3 1 C467090020-8953-10/16/2009 URE Impact on the Number Plant change Impact on the QC PRA A" " lication QC2005-008 EC 341220 adds combustible loading in the form of diesel fuel oil Analysis Number: QDC-4100-M-0691 No Impact due to installation of larger diesel fire pump day tanks in the Crib House. A total of 820 gallons of fuel oil is added to Fire Zone 11 A.B. QC2005-011 Westinghouse OPTIMA2 fuel will be burned at the Quad Cities The change in fuel is judged to have No Impact Stations beginning with U2 next spring (Q2R18). This fuel will a negligible impact on MAAP thermal reside with/in addition to the existing fuels (GE, SPC) in the Rx hydraulic runs, success criteria, and vessel and the spent fuel pool. EC# 349583 will implement the calculated operator action timings. fuel addition on QC U2. The change in fuel will be considered It is understood that fuel parameters like core zirconium mass for the next PRA update. and decay heat serve as inputs to MAAP analyses and therefore PRA impact must be evaluated for this activity. QC2005-014 QC EC349362 makes some upgrades to the Unit 2 FWLC The fault tree does not include this No Impact system to match previously installed improvements to Unit 1. level of detail, so the numerical These are of the nature of "tuning" (improve system reliability, impact will be negligible. This is a stability, and performance) and have no impact on the PRA. documentation issue, only. However, part of this EC involves a power supply change for the feedwater regulation valves "lock-up solenoids." When power is lost to these solenoids, the feed reg valve position will fail "as is." For Unit 1, the power to the lock-up solenoids for both the 642A valve and 642B valve come from the ESS bus. For Unit 2, however, as part of this EC, the 642A lock-up solenoid will continue to be powered by the ESS bus, but the 642B lock-up solenoid will now be powered from the instrument bus. The reason for this change is to ensure that, given loss of the feed from one or the other of these buses only one of the feed reg valves will lock up.
Quad Cities SLC CT Extension Table 4-1 IMPACT ON THE QUAD CITIES PRA MODEL OF PLANT CHANCES SINCE THE LAST UPDATE 3 2 C467090020-8953-10/16/2009 URE Number Plant change Impact on the QC PRA Impact on the App , lication QC2005-015 QC U1 Reserve Aux Transformer (RAT) T-12 will be replaced No Impact under EC-351820, as noted in URE QC2004-021. This URE covers the analogous replacement of U1 RAT T-22 under EC 351281. The new transformer functions like the old one, except for the addition of an automatic load tap changer (LTC) to accommodate changes in grid voltage which may result in reduced voltage to emergency loads during accident conditions. As for Unit 1, the replacement RAT will have the same normal and emergency function as prior to replacement. However, the LTC apparently adds an additional source of transformer oil, and the mod requires additional cables, and changes to the transformer fire protection deluge system. In summary, it appears that the internal events PRA for QC is "not' affected numerically by the RAT replacement. However, the AC Power Notebook should be revised to mention the automatic-tap-changer feature. Also, as for Unit 1, the impact of the change on the QC fire PRA should be investigated whenever the fire PRA is updated; however, given the current dominant fire zones, that numeric impact is expected to be small. QC2006-003 The purpose of this EC package is to trip the CWPs on a LOCA Based on additional information No Impact signal to aid in system voltage recovery when utilizing the RAT provided from Dave Wolf and Bipin automatic Load Tap Changes (LTC). See EC 358697 for Disani (S&L), the site is modifying the complete details. This tripping of a CW pump is for the same EC to trip 2 Circ Water Pumps on a reason as the power uprate mod. t o trip a condensate pump on a LOCA signal. JKM 3/20/06. LOCA signal. Since the condensate pump trip is included in the system fault tree, the circulating water pump trip will also affect the logic , as well as the documentation in system notebooks.
Quad Cities SLC CT Extension Table 4-1 IMPACT ON THE QUAD CITIES PRA MODEL OF PLANT CHANGES SINCE THE LAST UPDATE 3 3 0467090020-8953-10/16/2009 URE Number Plant change Imp act on the QC PRA Impact on the A" " lication OC2006-007 The 2005 update shows an impact on HPCI and RCIC from Minor decrease in the probability of No Impact recirc. pump seal failures because, without drywell cooling or loss of recirculation pump seal drywell spray, the seal leakage could cause drywell temperature cooling. Judged to have a negligible to rise to the point that reactor depressurization is required, thus quantitative impact. eliminating HPCI and RCIC as injection sources. Such recirc. pump seal failures are correlated strictly to loss of RBCCW in the current model. This is not quite correct. Quad Cities also has seal injection from CRD, which was probably installed around the year 2000. For the seals to overheat, both CRD injection, and RBCCW to the seal coolers, must be lost. CRD is dependent on TBCCW. So, the common cooling system loss required for recirc. pump seal failures is loss of SW. Of course, SBO will also cause loss of both methods of seal cooling. For the next update, Lesson Plans and System Descriptions should be consulted for the details of seal injection, and the fault tree should be revised to require that both RBCCW and seal injection must be lost before there is a threat of seal damage. Corres ondin documentation should also be revised. QC2006-011 EC 361260 will install new/replacement MPT on QC Unit 1. Please see EC 361260 for complete No Impact details The replacement MPT hardware is not judged to have a significant change to the existing failure modes and failure probabilities. Any impact on the failure probabilities will be incorporated via the data update as part of the next PRA update.
Quad Cities SLC CT Extension Table 4-1 IMPACT ON THE QUAD CITIES PRA MODEL OF PLANT CHANGES SINCE THE LAST UPDATE 3 4 C467090020-8953-10/16/2009 URE Impact on the Number Plant change Impact on the QC PRA A " " lication QC2007-009 Mainly title changes and RP/Chem staffing requirements. EO is Judged to have a negligible No Impact now NLO. An RPT is required by TS, not a Chem Tech. Rev. 35 quantitative impact. required one SRO in CR at all times. Rev. 38 generally requires two SROs in CR, but one may relieve the other briefly. QC2007-010 Main changes from Rev. 13 were adding steps for Emergency Judged to have a negligible No Impact Start, verifying flow, and checking Day Tank. Also changes (in quantitative impact. Rev. 15 due to replacement of the 1/2 B DFP). Appears to have no impact on HEPs involving SSMP, and Fire PRA model impact is judge to be insignificant. QC2007-011 Main technical change between Rev. 18 and Rev. 23 was the Judged to have a negligible No Impact addition of Prerequisite C.6 to place RAT Load Tap Changer quantitative impact. (LTC) in manual if in automatic. Without that prereq, the HEP calc A.3 estimated that cross-tie operation would require 20 min. and that 40 minutes were available. (For this HEP, the Quant Notebook gives a CDF F-V of 2.97E-3 and a LERF F-V of 1.64E-4.) New procedures QCOP 6500-28 and QCOP 6500-29 also have potential to increase or decrease amount of time required; see QOA 6500 series of procedures. Also could add reference to QOP 6700-02 in that calc. HEP calc A.3 may need to be revised to include this new rere uisite and the impact of the new procedures.
Quad Cities SLC CT Extension Table 4-1 IMPACT ON THE QUAD CITIES PRA MODEL OF PLANT CHANGES SINCE THE LAST UPDATE 3 5 C467090020-8953-10116/2009 URE Impact on the Number Plant change Impact on the QC PRA A" " lication QC2007-012 The Procedure list in Appendix B of the HRA notebook should be Judged to have a negligible No Impact improved to facilitate quarterly procedure reviews. quantitative impact. Procedure QCTS 0310-04 was deleted in 2002 and replaced with QCOS 0203-11. Appendix B needs to reflect change. Procedure QGA 500-3 was deleted and replaced by SAMGs in 1998. Appendix B of HRA notebook needs to be updated to refer to SAMG-1 (and SAMG-2?) instead. The incorrect revision (29) is listed in Appendix B for procedure QOA 0010-05. The current revision is 24. The normal method of numbering procedures is a three or four letter prefix followed by a SPACE. Appendix B incorrectly lists a dash after the prefix for some of the procedures. The procedure number listed in the table should match the actual number exactly to facilitate quarterly procedure reviews. QC2007-020 Currently, both the 1/2A and 1/213 diesel-driven fire pumps will Judged to have a negligible No Impact automatically start at 70 lb. header pressure. (Current PRA FP quantitative impact. System Notebook states 65 psig.) EC 367027, to be implemented within the next 4 months or so, will stagger the setpoints. The 1/2A pump will auto-start at 70 lb. The 1/213 pump will auto-start at 65 lb. QC2007-034 QCOA 0010-16 Rev.12 upgraded to include operating guidelines Judged to have a negligible No Impact and equipment locations. quantitative impact. QC2008-001 The Emergency Portable pump was added to the SAMG-1 as an Potentially beneficial for mitigating No Impact alternate low-pressure injection source. Its operation is Level 2 scenarios. Judged to have a described in QCOP 4100-19. negligible quantitative impact.
Quad Cities SLC CT Extension Table 4-1 IMPACT ON THE QUAD CITIES PRA MODEL OF PLANT CHANGES SINCE THE LAST UPDATE 3 6 C467090020-8953-10/16/2009 URE Impact on the Number Plant change Impact on the QC PRA Application QC2008-002 The ADS valves on alternate power can be used if the normal ADS unavailability dominated by No Impact means are non-functional or otherwise unavailable. The ADS CCF. Judged to have a negligible valves on alternate power were added to SAMG-2 and the TSG. quantitative impact. QC2008-003 QCOA 6100-03 Rev 22 added steps on loading the EDG in case Judged to have a negligible No Impact of LOOP. quantitative impact. QC2008-010 Under EC #366310, the Unit 1 recirc. pump M-G sets will be Judged to have a negligible No Impact replaced by an electronic speed control system called "ASD" for quantitative impact. "Adjustable Speed Drives." In the PRA, this affects Recirc. Pump Trip for TVVS mitigation. QC2008-011 EC #364602 will replace the 1 B Instrument Air Compressor (IAC) Judged to have a negligible No Impact with an Atlas Copco ZR 110-145 two stage oil-free rotary screw quantitative impact. compressor rate for 674 cfm at 125 psig. It will then be redesignated as the 1/213 IAC or OB IAC and serve as a swing compressor for both units. Approximate date of modification is December 2008.
Table 4-2 Status of Identified Gaps to Capability Category 11 of the ASME PRA Standard Quad Cities SLC CT Extension 37 C467090020-8953-1 1!7120094-4,628 Title Description of Gap Applicable SRs Current Status / Comment Importance to Application Gap #1 Reaching a safe stable end state defines the SC-A5 Open. Enhance documentation to Not significant given that the current "success" of a sequence and therefore the mission justify why extending FTR mission approach is judged to be reasonable time of the sequence to achieve the Level 1 end times beyond 24 hours for loss of or long term scenarios (e.g., long state. The mission times for failure to run DHR sequences is not necessary. term loss of DHR). calculations are assessed at 24 hours or less if he considerations that support the specifically justified. choice of the mission time are as Extending the FTR mission time beyond 24 hours follows: for loss of DHR sequences is considered to be an " Equipment failure rates unnecessary complication and does not affect PRA (failures/hour) are judged insights nor does it significantly affect its quantitative to be too conservative for evaluation. times greater than a few hours of operation. " For times greater than a few hours, the ability to repair and recover equipment can compete with the failure rate such that there can be considered to be a steady state equilibrium condition reached. Gap #2 Strict interpretation of SY-A12 would require SY-A12 Open. Enhance documentation to Not significant. The PRA model is additional investigation in determining whether all justify why certain components and judged to include proper treatment appropriate components and failure modes are failure modes may be excluded. of components and failure modes for included could be performed. Capability Category 11 requirements. Gap #3 Document the criteria for how components and SY-A14 Open. Enhance documentation to Not significant. The PRA model is failure modes may be excluded from the model justify why certain components and judged to include proper treatment (e.g., failure mode is less than 1 % of the total failure failure modes may be excluded. of components and failure modes for probability for that component). Capability Category 11 requirements. Gap #4 Investigate to determine whether the initiation logic SY-1311 Open. Enhance documentation to None. The updated PRA model for systems other than ECCS and RCIC should be justify why initiation logic is not meets SY-1311 at Capability modeled. required to be modeled for all Category I, which is sufficient for this Note that initiation logic for the EDGs could be systems with automatic initiation. application. modeled if the EDG failure data does not already ake into account failure of the automatic initiation Table 4-2 Status of Identified Gaps to Capability Category II of the ASME PRA Standard Quad Cities SLC CT Extension 3 8 C467090020-8953-1117/20094-1 Title Description of Gap Applicable SRs Current Status / Comment Importance to Application instrumentation. Gap #5 Strict interpretation of SY-C2 would require the SY-C2 Open. Enhance the System None. This is judged to be a following in the System Notebooks: Notebook documentation to provide documentation consideration only " References to the data notebook of the actual more transparency. and does not affect the technical operating history indicating any past problems adequacy of the PRA model. with system operation " Relationship between system success criteria and accident sequences modeled " A listing of components and failure modes included in the model and justification for any exclusions " Results of the system model evaluation. Gap #6 Although this will not significantly impact the HRA HR-D3 Open. Possible upgrade to the pre- None. The updated PRA model results, future PRA updates should include an initiator HRA to include specific meets HR-D3 at Capability Category assessment of the quality of plant written quantifications for each pre-initiator I, which is sufficient for this procedures and administrative controls as well as HEP would be strict compliance with application. human-machine interface for both pre-initiator and he standard. This is not considered post-initiator human actions. necessary for most applications. It is recommended that Quad Cities await further ASME clarification on his item before proceeding. This an be confirmed for each application in lieu of performing the uantifications. Gap #7 Employ and document the methodology used for DA-C6 Open. A detailed determination is Not significant. The PRA model is determining the standby component number of udged to require a significant level judged to appropriately estimate the demands to include plant specific: of resources with marginal number of demands for standby (a) surveillance tests quantitative benefit. An estimate of equipment for calculating the (b) maintenance acts he number of demands based on a standby failure rate. Any additional review of surveillance tests and refinements to the number of (c) surveillance tests or maintenance on other other means is judged to be demands would have a limited or components sufficient. negligible quantitative impact. (d) operational demands (e) Additional demands from post-maintenance testing should not be included.
Table 4-2 Status of Identified Gaps to Capability Category 11 of the ASME PRA Standard Quad Cities SLC CT Extension 39 C467090020-8953-1117/20091 1./&2(#38 Title Description of Gap Applicable SRs Current Status / Comment Importance to Application Gap #8 Failure data developed should be based on plant DA-C7 Partially resolved. The failure data Not significant. The PRA model is surveillance actual practices (as opposed to plant as based on actual plant data. judged to appropriately estimate the requirements) and documented appropriately. However, the number of demands number of demands for and Currently based on system engineer experience and exposure data was based on exposure time for calculating the input. actual data or estimates from the component failure probabilities. Any Quad Cities System Managers. additional refinements to the number Estimating number of demands and f demands would have a limited or exposure data meets Category I for negligible quantitative impact. he ASME PRA Standard. Gap #9 Standby failure data development should base the DA-C8 Open. A detailed determination is Not significant. The PRA model is time that components were in standby on plant judged to require a significant level judged to appropriately estimate the operational records. This should be documented f resources with marginal time that components were in appropriately in the Component Data Notebook quantitative benefit. An estimate of standby for calculating the standby (QC PSA-010). he time that components were in failure rate. Any additional standby is judged to be sufficient. refinements to the time in standby would have a limited or negligible quantitative impact. Gap #10 Failure data development using surveillance test DA-C10 Open. A detailed determination is Not significant. The surveillance data should fulfill the requirements of DA-C10, and judged to require a significant level test procedures are judged to should be documented appropriately. Review of resources with marginal address the appropriate failure surveillance test procedures and identify all failure quantitative benefit. The modes with respect to the estimated modes that are fully tested by the procedures. surveillance tests address the number of demands. Any additional Include data for the failure modes that are fully primary failure modes (e.g., pump refinements to the number of tested. The results of unplanned demands on ails to run or start, valve fails to demands for each failure mode equipment should also be accounted for. open/close) in the PRA model. would have a limited or negligible quantitative impact. Gap #11 No interviews of plant staff were performed to DA-C12 Open. This deviation from the SR is - None. The updated PRA model generate uncertainty estimates of unavailability per not considered to significantly alter meets DA-C12 at Capability maintenance act. he PRA qualitative or quantitative Category I, which is sufficient for this An exception is taken to DA-C12. The plant staff results. application. does not have reasonable insights applicable to the level of uncertainty associated with the maintenance he uncertainty distribution on the durations. Most plant staff have rotated positions maintenance unavailability does not and do not have sufficient longevity to provide this affect the mean estimate of the insight. PRA.
Table 4-2 Status of Identified Gaps to Capability Category II of the ASME PRA Standard Quad Cities SLC CT Extension 40 C467090020-8953-1 IIM20091-1E6f2W9 Title Description of Gap Applicable SRs Current Status/ Comment Importance to Application Gap #12 IF-B2 states to include human-induced mechanisms IF-B2 Open. Update flood frequencies to Not significant. Using the pipe that could lead to flooding events. use EPRI TR-1013141, which is failure data from the latest EPRI stated to account for human-induced report is judged to have a minor failure modes. impact on the overall quantitative flood results. Gap #13 Add pressure and temperature characteristics of IF-B3 Open. Judged to have a negligible None. This is a documentation flood water sources. impact because most of the water consideration only. sources in the scope of the flooding analysis are low pressure and low temperature. Gap #14 Evaluate and document the effects of check valve IF-C1 Open. Multiple check valve failures Not significant. The dominant flood failure in drain lines leading to backflow. Backflow would be required to fail multiple scenarios (e.g., failure of long term failures are discussed in the Quad Cities internal significant flood areas (e.g., ECCS isolation) would flood multiple ECCS flood analysis (e.g., QC PSA-012, Section 2.2.11), corner rooms). Explicit modeling of corner rooms and envelop the check however, the potential propagation paths should be heck valve failure scenarios that valve backflow failure modes. documented in more detail. lead to backflow is judged to have a minor quantitative impact. Gap #15 Document the potential for component failure due to IF-C3 Open. Jet impingement is judged to None. This is judged to be a flooding induced jet impingement, humidity, have a minor or negligible documentation consideration only. condensation, and temperature concerns. quantitative impact. High energy line breaks from the RPV have been evaluated as breaks outside containment. They have included an assessment of jet impingement, humidity, condensation, and temperature concerns. Steam line break in the turbine building has not been addressed. Gap #16 Evaluate and document the effects of check valve IF-C3b Open. Multiple check valve failures None. The updated PRA model failure in drain lines leading to backflow. Backflow would be required to fail multiple meets IF-C3b at Capability Category failures are discussed in the Quad Cities internal significant flood areas (e.g., ECCS l, which is sufficient for this flood analysis (e.g., QC PSA-012, Section 2.2.11), corner rooms). Explicit modeling of application. however, the potential propagation paths should be heck valve failure scenarios that documented in more detail. Identifying inter-area lead to backflow is judged to have a propagation is required to meet Capability Category minor quantitative impact. II. ap #17 IF-D6 states to include consideration of human- IF-D6 Open. Update flood frequencies to Not significant. Using the pipe use EPRI TR-1013141 generic data, ailure data from the latest EPRI Table 4-2 Status of Identified Gaps to Capability Category II of the ASINE PRA Standard Quad Cities SLC CT Extension 41 C467090020-8953-1117/20094-4~~6;2008 Title Description of Gap Applicable SRs Current Status / Comment Importance to Application induced floods during maintenance through which is stated to account for report is judged to have a minor application of generic data. human-induced failure modes. impact on the overall quantitative flood results. Gap #18 Maintenance alignments for the impact on flood IF-E4 Open. Update flood frequencies to Not significant. Using the pipe frequency may need to be addressed, via additional use EPRI TR-1013141 generic data, failure data from the latest EPRI data analysis, if not adequately covered in the which is stated to account for report is judged to have a minor pipe/component failure data. human-induced failure modes. impact on the overall quantitative flood results. Gap #19 QU-F5 states to DOCUMENT limitations that would QU-F5 Open. Plant specific limitations are None. The model is not used impact applications. expected to be well defined in beyond its known limitations for PR response to QU-F4 (i.e., SR for applications. This is a documenting key assumptions and documentation consideration only. key sources of uncertainty). Discuss and document the limitations of the model as they relate to future applications. (See QU-F4.). Gap #20 Addendum B of the ASME PRA Standard added QU-F6 Open - These new SRs will be None. This is a documentation SRs to document the quantitative definition used for addressed during the next full PRA issue. The model is not being significant basic event, significant cutset, significant model update, but providing these changed to address this item. accident sequence, and significant accident definitions should not have an progression sequence in the CDF and LERF impact on the quantitative results analysis. from the PRA model. Gap #21 Addendum B of the ASME PRA Standard added LE-G6 Open - These new SRs will be None. This is a documentation SRs to document the quantitative definition used for addressed during the next full PRA issue. The model is not being significant basic event, significant cutset, significant model update, but providing these hanged to address this item. accident sequence, and significant accident definitions should not have an progression sequence in the CDF and LERF impact on the quantitative results analysis. from the PRA model.
4.7 GENERAL CONCLUSION REGARDING PRA CAPABILITY Quad Cities SLC CT Extension The Quad Cities PRA maintenance and update processes and technical capability evaluations provide a robust basis for concluding that the PRA is suitable for use in risk-informed licensing actions, specifically in support of the requested extended CT for the SLC system. Previously identified gaps to specific requirements in the ASME PRA Standard have been reviewed to determine which gaps might merit application-specific sensitivity studies in the presentation of the application results. No gaps were identified as needing specific sensitivity studies for this SLC CT extension request. 4 2 C467090020-8953-10/16/2009 5.0
 
==SUMMARY==
AND CONCLUSIONS 5.1 SCOPE INVESTIGATED Quad Cities SLC CT Extension This analysis evaluates the acceptability, from a risk perspective, of a change to the Quad Cities TS for the SLC system to increase the CT from 8 hours to 72 hours when both SLC subsystems (i.e., both trains) are inoperable. The analysis examines a range of risk contributors as follows: " The Quad Cities FPIE PRA model is used to quantitatively address risk impacts. " The FPIE assessment is judged to adequately capture risk contributors associated with low power plant operation " The SLC TS only applies to Modes 1 and 2. Shutdown and refueling modes (Modes 3, 4 and 5) are not applicable to the SLC TS. " The IPEEE Fire analysis and other fire studies (e.g., NUREG/CR-6850) are used to provide qualitative and semi-quantitative insights, determining that fire hazards are negligible contributors. " Seismic risk contributors are determined to be negligible based on qualitative insights from the NUREG-1150 study. " Other External Event risks were found to be negligible contributors based on the Quad Cities IPEEE. 5.2 PRA QUALITY The PRA quality has been assessed and determined to be adequate for this risk application, as follows: " Scope - The Quad Cities PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, and common cause events. The PRA has the necessary scope to appropriately assess the pertinent risk contributors. " Fideli - The Quad Cities PRA model (Q105B) is the most recent evaluation of the risk profile at Quad Cities for FPIE challenges. The PRA reflects the as-built, as-operated plant. " Standards - The PRA has been reviewed against the ASME PRA Standard [Ref. 5] and the PRA elements are shown to have the necessary attributes to assess risk for this application. 43 C467090020-8953-10/16/2009 
" Peer Review - The PRA received a Peer Review in 2000. Based on the Peer Review results and subsequent PRA updates to resolve all significance level "A: and "B" F&Os, the PRA is found to have the necessary attributes to assess risk for this application. " Appropriate Quality - The PRA quality is found to be commensurate with that needed to assess risk for this application. 5.3 QUANTITATIVE RESULTS VS. ACCEPTANCE GUIDELINES As shown in Table 5.3-1 below, the base results of the risk assessment indicate that the OCDF, ICCDP, ALERF, and ICLERP risk metric values are below the acceptance guidelines as defined in the corresponding risk significance guidelines from RG 1.174 and RG 1.177. This analysis demonstrates that the proposed TS change satisfies the risk acceptance guidelines in RG 1.174 and RG 1.177, and therefore meets the intent of very small risk increases consistent with the Commission's Safety Goal Policy Statement.
 
==5.4 CONCLUSION==
S Table 5.3-1 RISK ASSESSMENT BASE RESULTS Quad Cities SLC CT Extension This analysis demonstrates the acceptability, from a risk perspective, of a change to the Quad Cities TS for the SLC system to increase the CT from 8 hours to 72 hours when both SLC subsystems (i.e., both trains) are inoperable. This analysis demonstrates that the proposed TS change satisfies the risk acceptance guidelines in RG 1.174 and RG 1.177. This meets the intent of very small risk increases consistent with the Commission's Safety Goal Policy Statement. 4 4 C467090020-8953-10/16/2009 Risk Metric Value Acceptance Guidelines Reference ACDF 2.0E-08/yr
<1.0E-06/yr RG 1.174 ICCDP 2.0E-08 <5.0E-07 RG 1.177 OLERF 1.2E-08/yr
<1.0E-07/yr RG 1.174 L ICLERP 1.2E-08 <5.0E-08 RG 1.177 J Quad Cities SLC CT Extension Additionally, a PRA technical adequacy evaluation was performed consistent with the requirements of ASME PRA Standard, Addendum B and RG 1.200, Revision 1. This included a process to identify potential key sources of model uncertainty and related assumptions associated with this application. This resulted in the identification of issues that could both decrease and increase the calculated risk metrics. None of these identified sources of uncertainty were significant enough to change the conclusions from the risk assessment results presented here. 4 5 C467090020-8953-10/16/2009 
 
==6.0 REFERENCES==
 
[1] RG 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk Informed Activities," Revision 1, January 2007. [2] RG 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 1, November 2002. [3] RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking
: Technical Specifications," August 1998. [4] Exelon Risk Management Team, QC-PSA-014, Quad Cities Probabilistic Risk Assessment Quantification Notebook, 20058, December 2007. [5] "Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications," (ASME RA-S-2002), Addenda RA-Sa-2003, and Addenda RA-Sb-2005, December 2005. [6] Boiling Water Reactors Owners' Group, "BWROG PSA Peer Review Certification Implementation Guidelines," Revision 3, January 1997. [7] MSPI Bases Document, Quad Cities Generating Station, Revision 4a, November 2008. [8] Quad Cities PRA Peer Review, February 2000. [9] Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, EPRI Report 1016737, Palo Alto, CA, 2008 [10] ComEd, "Quad Cities Fire IPEEE Quantification Notebook," June 1999 [11] ComEd, "Quad Cities Station Individual Plant Examination for External Events," February 1997 [12] "PRA Procedures Guide", NUREG/CR-2300, September 1981. Quad Cities SLC CT Extension
[13] "Analysis of Core Damage Frequency: Peach Bottom, Unit 2, External Events," NUREG/CR-4550, Volume 4, Revision 1, Part 3, Table 4.14, page 4-83. [14] NUREG/CR-5042, "Evaluation of External Hazards to Nuclear Power Plants in the United States," December 1987. 4 6 C467090020-8953-10/16/2009 
[15] Kennedy, R.P., et al., "Capacity of Nuclear Power Plant Structures to Resist Blast Loading," Sandia National Laboratories, NUREG/CR-2462, September 1983. [16] NUREG/CR-5500, "Reliability Study: General Electric Reactor Protection System, 1984-1995, Volume 3" May 1999. [17] Gorham, E.D., et al., "Evaluation of Severe Accident Risks: Methodology for the Containment, Source Term, Consequence, and Risk Integration Analyses", NUREG/CR-4551, December 1993. [18] NUREG/CR-6850, EPRI Report 1011989, "Fire PRA Methodology for Nuclear Power Facilities", September 2005. [19] Gorman, Thomas, BWR Owner's Group Assessment of IN 2007-07,10/16/2007
[20] "Guidance for Post-Fire Safe Shutdown Analysis", NEI 00-01, Rev. 2. [211 Exelon, ER-AA-600-1046, "Risk Metrics - NOED and LAR", Revision 4. [22] Not Used Quad Cities SLC CT Extension
[23] "Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants", NUREG-1150, December 1990. [24] NUREG/CR-5088, "Fire Risk Scoping Study: Investigation of Nuclear Power Plant Fire Risk, Including Previously Unaddressed Issues," U.S. Nuclear Regulatory Commission, January 1989. [25] FAQ 08-0051, "Hot Short Duration," June 2008, Draft, ADAMS Doc. # ML083400188. [26] ASME/ANS RA-Sa-2009, "Addenda to RA-S-2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," February 2009. [27] RG 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk Informed Activities," Revision 2, March 2009. 4 7 C467090020-8953-10/16/2009 Appendix A External Event Assessment A.1 INTRODUCTION A.2 EXTERNAL EVENT ASSESSMENT Seismic Internal Fires Other External Hazards Quad Cities SLC CT Extension This appendix discusses the external events assessment in support of the Quad Cities SLC System CT extension risk assessment. This appendix uses as the starting point of this assessment the external event work documented in the Quad Cities IPEEE [Ref. A-ll. Because the effects of the SLC CT extension are evident only in the failure to scram (Anticipated Transients Without Scram (ATWS)) related sequences, the following examination of external events focuses on the ATWS accident sequence insights. The purpose of this portion of the assessment is to examine the spectrum of external event challenges to determine which external event hazards should be explicitly addressed as part of the Quad Cities SLC System CT extension risk assessment. There is no currently maintained quantitative Seismic PRA for Quad Cities. Section A.3 discusses seismic ATWS insights from the Quad Cities IPEEE and NUREG-1150. This internal fire assessment is based on the Updated Quad Cities Fire IPEEE [Ref. A-3] and generic assessments in NUREG/CR-6850 and the BWROG assessment of IN 2007-07. This assessment is discussed in Section A.4. The Quad Cities IPEEE concluded that based on a bounding analysis performed in the UFSAR, adequate time is available for the plant to be safeguarded against a PMF. All actions are delineated and the emergency plan incorporated all necessary provisions. Therefore, external flooding was judged to represent acceptable levels of risk. 0467090020-8953-10/16/2009 Other external event risks such as severe weather, high winds or tornados, transportation accidents, nearby facility accidents, turbine missiles, and other miscellaneous external hazards were also considered in the IPEEE analysis. The IPEEE concluded that the SRP criteria had little applicability to Quad Cities, as the plant was built before the criteria were formulated. However, based on evaluations in the UFSAR, the NRC SER and bounding analyses, it was demonstrated that the plant could withstand the postulated external events. No significant quantitative contribution from these external events was identified by IPEEE evaluations. The compensatory actions and risk insights in this LAIR are also judged applicable to qualitatively reduce the risk associated with these events. Conclusions of Scre ening Assessment Given the foregoing discussions, other external hazards are assessed to be non-significant contributors to plant risk. Explicit treatment of the "other" external hazards is not necessary for most PSA applications (including the SLC System CT extension risk assessment) and would not provide additional risk-informed insights for decision making. Further information is presented in this appendix to justify the screening of Fire and Seismic hazards for the SLC CT extension application
----------------------. A.3 SEISMIC ASSESSMENT There is no currently maintained quantitative Seismic PRA for Quad Cities. The following sections discuss seismic ATWS insights from the Quad Cities IPEEE and NUREG-1150. A.3.1 Quad C ities Seismic IPEEE Overview The objective of the IPEEE seismic margin assessment (SMA) was to rank each plant component in terms of its seismic capacity. The control rod drive (CRD) housings and mechanisms were assigned a seismic capacity of 0.3g, equal to the seismic capacity of the first earthquake level. Stresses due to the review level earthquake (RLE) were relatively small and were, therefore, screened out at the 0.3g PGA level. The IPEEE did not evaluate specific seismic impacts associated with the SLC system, but seismic impacts on SLC system components would be similar to the seismic impacts on CRD. Per other studies (see below), seismic induced ATWS sequences are generally found to be negligible contributors. A.3.2 Peach Bottom NUREG-1 150 Seismic Overview Quad Cities SLC CT Extension The NUREG/CR-4551 study completed an update of the NUREG-1150 severe accident analysis for five nuclear power plants, including the Peach Bottom Atomic Power Station. It is assumed that this analysis is generically appropriate for all BWRs due to A-2 C467090020-8953-10/16/2009 A.3.3 Seism ic_ Risk Impact Conclusion A.4 INTERNAL FIRES ASSESSMENT A.4.1 Quad Cities Fire IPEEE The evaluation process concluded the following: Quad Cities SLC CT Extension the similarity of systems. This analysis addressed both internal and external events, including seismic initiators. The NUREG/CR-4551 Peach Bottom seismic analysis screened seismic-induced ATWS accident sequences as non-significant contributors
(<1 %) to the plant seismic CDF. Peach Bottom and Quad Cities NSSS designs are quite similar and constructed over similar time frames. The Peach Bottom seismic analysis developed by the NRC for NUREG/CR-4551 is judged to be directly applicable to Quad Cities for the purposes of screening out the seismic induced ATWS events as significant contributors. Based on the Peach Bottom results, it is judged that seismic-induced ATWS accident sequences are similarly non-significant contributors to the Quad Cities seismic CDF. Based on the preceding discussions, it is concluded that the risk of a seismically induced ATWS is non-significant and does not impact the decision making for the proposed Quad Cities SLC CT extension. This internal fire assessment is based on the efforts of the updated Quad Cities Fire IPEEE [Ref. A-3], and generic assessments in NUREG/CR-6850
[Ref. A-4] and the BWROG assessment of IN 2007-07 [Ref. A-2]. In Supplement 4 to Generic Letter (GL) 88-20, the NRC requested that each nuclear utility perform an Individual Plant Examination of External Events (IPEEE). Included was a request that the risk of internal fires to safe shutdown be evaluated. An approach was selected which used both a quantitative and qualitative evaluation of each postulated fire. First, the qualitative evaluation was performed to determine whether a postulated fire could impact safe shutdown equipment. For those fire zones which did not screen out in this step, a quantitative evaluation was performed using the existing probabilistic risk assessment (PRA) model. "All RPS circuits are normally energized, thereby requiring a hot short to prevent a single circuit from de-energizing. Therefore, RPS redundancy requires multiple hot shorts to preclude reactor scram. Therefore, fire-induced Anticipated Transient Without Scram (ATWS) is considered unlikely with negligible contribution to fire risk." A-3 0467090020-8953-10/16/2009 As such, ATWS sequences, which are the only sequences impacted by the SLC system, were not evaluated by the IPEEE. Fire-induced failure to scram is further discussed in section A.4.3. A.4.2 NUREG/CR-6850 Screening Quad Cities SLC CT Extension NUREG/CR-6850, Volume 2, Section 2.5.1 (page 2-7) provides the following directions for selecting components and accident scenarios to be examined in an internal fire PRA: "The types of sequences that could generally be eliminated from the PRA include the following
... Sequences associated with events that, while it is possible that the fire could cause the event, a low-frequency argument can be justified. For example, it can often be easily demonstrated that anticipated transient without scram (ATWS) sequences do not need to be treated in the Fire PRA because fire-induced failures will almost certainly remove power from the control rods (resulting in a trip), rather than cause a "failure-to-scram" condition. Additionally, fire frequencies multiplied by the independent failure-to-scram probability can usually be argued to be small contributors to fire risk." As can be seen from the NUREG/CR-6850 excerpt above, fire-induced ATWS contributors are generally acknowledged as non-significant contributors to the fire risk profile. A.4.3 BWROG Position on Fire-Ind uced Failure to Scram Fire scenarios that could threaten the function of the reactor protection system have been addressed in a BWROG assessment (refer to Appendix C) of NRC Information Notice 2007-07. The assessment outlines the types of scenarios in which a fire could energize a circuit through a "hot short" that would compromise scram capabilities. The assessment also indicates that there are multiple actions that would have to occur in conjunction to the very specific fire scenarios for function to be lost. The assessment concluded that these scenarios are of low-likelihood, low safety-significance, and have multiple layers of defense-in-depth which would either prevent the condition, or adequately mitigate it. A.4.4 Fire Ris k Impact Conclusion Based on the preceding discussions, it is concluded that fire-induced ATWS is a non-significant contributor to the plant risk profile and thus does not impact the decision-making of the proposed Quad Cities SLC CT extension. A-4 C467090020-8953-10/16/2009 REFERENCES
[A-1] ComEd, "Quad Cities Station Individual Plant Examination for External Events," February 1997 [A-2] Gorman, Thomas, BWROG Assessment of IN 2007-07,10/16/2007 Quad Cities SLC CT Extension
[A-3] ComEd, "Quad Cities Fire IPEEE Quantification Notebook," June 1999 [A-4] NUREG/CR-6850, EPRI Report 1011989, "Fire PRA Methodology for Nuclear Power Facilities", September 2005. A-5 C467090020-8953-10/16/2009 Appendix B Uncertainty Analysis " Section B.1 provides Quad Cities specific modeling uncertainty evaluations for the Base Case. B.1 MODEL UNCERTAINTIES
 
==SUMMARY==
Quad Cities SLC CT Extension This appendix evaluates uncertainties that could impact the SLC CT extension assessment. Section B.1 and B.2 evaluate model uncertainties. Section B.3 evaluates parametric uncertainty. " Section B.2 provides an examination of the specific cutsets that affect the change in the CDF risk metric associated with the change in the SLC CT. Postulated key modeling uncertainties are identified through a systematic structured process. Table B-1 presents the candidate key modeling uncertainties for the Q1 05B model. The four modeling uncertainties that rise to the definition of a key model uncertainty are summarized in Table B-2 along with associated impacts on the CDF and LERF risk metrics. It is noted that none of these four cases evaluates modeling issues associated with the SLC system or ATWS sequences. C467090020-8953-10/16/2009 Table B-1 Quad Cities SLC CT Extension
 
==SUMMARY==
OF SENSITIVITY CASES TO IDENTIFY RISK METRIC CHANGES ASSOCIATED WITH CANDIDATE MODELING UNCERTAINTIES B-2 C467090020-8953-10/16/2009 CDF Impact (/yr)(1) LERF Impact (/yr~2~ ) Source of Modeling Uncertainty p) Upper Bound Lower Bound Upper Bound Lower Bound 1A) Applicability of industry experience 8.74E-6 4.46E-6 8.26E-7 5.94E-7 to environmentally influenced (57.2%) (-19.8%) (27.7%) (-8.2%) events (i.e., loss of service water, LOOP, etc.) - Loss of Service Water 1 B) Applicability of industry experience 6.05E-6 5.38E-6 6.73E-7 6.38E-7 to environmentally influenced (8.8%) (-3.2%) (4.0%) (-1.4%) events (i.e., loss of service water, LOOP, etc.) - Loss of Intake Structure 1C) Applicability of industry experience 7.71 E-06 4.86E-6 7.05E-7 6.34E-7 to environmentally influenced (38.7%) (-12.6%) (9.0%) (-2.0%) events (i.e., loss of service water, LOOP, etc.) - Severe and Extreme Weather Induced DLOOP 2A) Treatment of Rare and Extremely 5.56E-6 5.55E-6 6.54E-7 6.45E-7 Rare Events - Excessive LOCA (E) (-0.2) (1.1%) (-0.3%) 2B) Treatment of Rare and Extremely 6.10E-6 5.37E-6 6.75E-7 6.38E-7 Rare Events - SW Flood in RB (9.7%) (-3.4%) (4.3%) (-1.4%) 3), 4), 6), 13), 19), 29) Beyond Design 6.81 E-6 5.13E-6 7.03E-7 6.31 E-7 Basis Environment (22.5%) (-7.7%) (8.7%) (-2.5%) 5) and 8) Case A) Impact of LOOP/SBO 7.36E-6 5.13E-6 6.64E-7 6.45E-7 conditions - Impact of weather on (32.4%) (-7.7%) (2.6%) (-0.3/o&deg;) SBODG 5) and 8) Case B) Impact of LOOP/SBO N/A 4.77E-6 N/A 6.19E-7 conditions - DFP injection
(-14.2%) (-4.3%) 7),14), 20) Room Cooling Assumptions 7.23E-6 4.81 E-6 7.30E-7 6.02E-7 (30.0%) (-13.5%) (12.8%) (-7.0%) 9) Accumulator adequacy for venting 6.83E-6 5.04E-6 7.07E-7 6.28E-7 (22.8%) (-9.4%) (9.3%) (-2.9%) 10)&17) Impact of venting on systems N/A 4.79E-6 N/A 6.20E-7 (-13.8%) (-4.2%) 11),22),&25)
Multi Unit creditor 1.56E-5 5.20E-6 8.26E-6 6.43E-7 dependencies (180.6%) (-6.5%) (27.7%) (-0.6%) 12) Time Dependency failures due to N/A N/A N/A N/A environmental conditions
: 15) Recirc Pump Seal Leakage N/A N/A N/A N/A Table B-1 Quad Cities SLC CT Extension
 
==SUMMARY==
OF SENSITIVITY CASES TO IDENTIFY RISK METRIC CHANGES ASSOCIATED WITH CANDIDATE MODELING UNCERTAINTIES
(') Compared with a base CDF of 5.56E-6/yr quantified with a 5E-12/yr truncation limit. (2) Compared with a base LERF of 6.47E-7/yr quantified with a 5E-12/yr truncation limit. (3) Case I.D.s 26 and 27 are not used. B-3 C467090020-8953-10/16/2009 CDF Impact (/ yr)(') LERF Impact (/yr)(2) (3) Upper Lower Upper Lower Source of Modeling 9 Uncertaint y Bound Bound Bound Bound 16) Suppression Pool Strainer 5.60E-6 5.54E-6 6.78E-7 6.37E-7 Performance (0.7%) (-0.4%) (4.8%) (-1.5%) 18) Treatment of Instrumentation 9.11 E-6 4.23E-6 9.53E-7 5.62E-7 required for operator action (63.8%) (-23.9% (47.3 /&deg;) (-13.1%) 21) Water Hammer Impact on System 1.47E-5 4.64E-6 7.49E-7 6.38E-7 Performance (Failure Probability of (164.4%) (-16.5%) (15.8%) (-1.4%) Pipe Rupture) 23) Alternate Alignments N/A N/A N/A N/A 24) Procedural Changes 5.56E-6 N/A 6.47E-7 N/A (&#xa3;) (&#xa3;) 28) Flood Frequency Data 9.64E-6 4.15E-6 8.12E-7 5.99E-7 (73.4%) (-25.4%) (25.5%) (-7.4%) 30) Transient induced LOOP causes a N/A 5.49E-6 N/A 6.46E-7 single unit LOOP and not a dual (-1.3%) (-0.2%) unit LOOP 31) CST Inventory Capacity 4.00E-5 4.46E-6 4.29E-6 5.24E-7 (619.4%) (-19.8%) (563.1%) (-19.0%) 32) Treatment of SBCS clogging of FW 5.91 E-6 5.21-6 8.56E-7 4.41 E-7 reg. valves (6.3%) (-6.3%) (32.3%) (-31.8%) 33) Combined Sensitivity Case 1C and 1.45E-5 4.84E-6 7.88E-7 6.34E-7 Case 5/8A for SBO related (160.8/&deg; &deg; ) (-12.9%) (21.8%) (-2.0%) features 34) Dependent HEP Recovery file. 7.82E-6 5.31 E-6 7.14E-7 6.41 E-7 (40.6%) (-4.5%) (10.4%) (-0.9%)
Table B-2 FOUR KEY MODELING UNCERTAINTY CASES Quad Cities SLC CT Extension
(') Compared with abase CDF of 5.56E-6/yr quantified with a 5E-12/yr truncation limit. (2) Compared with a base LERF of 6.47E-7/yr quantified with a 5E-12/yr truncation limit. B.2 MODEL UNCERTAINTIES ASSOCIATED WITH SLC SYSTEM OUT OF SERVICE To determine the relative importance of individual contributors for this SLC CT extension, the focus needs to be on the results of the CDF assessment for the SLC system out of service. To obtain insights regarding this change to the base case re su lt s, the first step is to take the SLC out-of-service case cutsets and remove the base case cutsets. This is done in CAFTA through the delete term function of the cutset editor. The result of this process are cutsets that are unique to the SLC out-of-service case and do not appear in the base case. These cutsets can be used to determine information regarding significant accident sequences or cutsets that determine the change in risk metrics, i.e., drive the delta-CDF assessment. Table B-3 presents the top ten cutsets for the delta-CDF assessment. Table B-4 presents the most important contributors to the delta-CDF assessment sorted by the Fussell-Vesely importance measure. Tables B-3 and B-4 show that the Scram system hardware failure is the most important contributor for the SLC system out of service case. The top ten cutsets are exclusively failures of the Scram system associated with various initiating events. Of the events with a Fussell-Vesely greater than 2E-2 (>2% contribution to CDF), only one is a basic event (the Mechanical Scram failure), with the rest being initiators. It can be concluded that the CDF is dominated by failures of the Scram system. The basic events used to model the Scram system failures are already considered in the base uncertainty assessment. Similarly, the LERF results are dominated by failures of the Scram system for the SLC system out of service case. The LERF results provide similar insights to the CDF results insights. B-4 C467090020-8953-10/16/2009 Sensitivity Case CDF Increase(')
LERF Increase (2) Sensitivity Cases 11, 22 & 25: Multi Unit credit or dependencies 1.81 0.27 Sensitivity Case 21: (Failure Probability of Water Hammer Impact on System Performance Pipe Rupture) 1.64 0.15 Sensitivity Case 31: CST Inventory Capacity 6.14 5.63 Sensitivity Case 33: SBO related features 1.61 0.22 Because of the large potential impact of the mechanical failure to scram probability on the assessment of the risk metrics for this application, it is prudent to perform a sensitivity recognizing the uncertainty in the mechanical common cause failure to scram probability. This sensitivity is performed by including the 95% upper bound on the common cause mechanical scram failure probability in both the base case and the case with the SLC system set to TRUE. The results of the sensitivity case are shown in Table B-5 Quad Cities SLC CT Extension Based on the results of the sensitivity analysis, it is found that the acceptance criteria are all met even for this extreme assumption regarding the common cause mechanical scram failure probability. B-5 C467090020-8953-10/16/2009 Quad Cities SLC CT Extension Table B-3 TOP TEN CUTSETS FOR CDF FOR THE SAC SYSTEM OUT OF SERVICE B-6 C467090020-8953-10/16/2009
# Cutset Prob Event Prob Event Description 1 1.82E-06 8.65E-01 %TT TURBINE TRIP WITH BYPASS 2.10E-06 1 RPCDRPS-MECHFCC MECHANICAL SCRAM FAILURE 2 1.87E-07 8.91 E-02 %TC LOSS OF CONDENSER VACUUM 2.10E-06 1 RPCDRPS-MECHFCC MECHANICAL SCRAM FAILURE 3 1.68E-07 7.99E-02 %TM MSIV CLOSURE 2.10E-06 1 RPCDRPS-MECHFCC MECHANICAL SCRAM FAILURE 4 9.39E-08 4.47E-02 %TI INADVERTENTLY OPEN RELIEF VALVE 2.10E-06 1 RPCDRPS-MECHFCC MECHANICAL SCRAM FAILURE 5 7.64E-08 3.64E-02 %LOOP LOSS OF OFFSITE POWER INITIATING EVENT 2.10E-06 1 RPCDRPS-MECHFCC MECHANICAL SCRAM FAILURE 6 4.12E-08 1.96E-02 %TF LOSS OF FEEDWATER 2.10E-06 1 RPCDRPS-MECHFCC MECHANICAL SCRAM FAILURE 7 2.86E-08 1.36E-02 %TIA LOSS OF INSTRUMENT AIR INITIATOR 2.10E-06 1 RPCDRPS-MECHFCC MECHANICAL SCRAM FAILURE 8 2.31 E-08 1.10E-02 %FLSWTB INITIATOR - SW RUPTURE IN TB ABOVE 595' II I 2.10E-06 1 RPCDRPS-MECHFCC MECHANICAL SCRAM FAILURE 9 1.84E-08 8.76E-03 %DLOOP DUAL UNIT LOSS OF OFFSITE POWER 2.10E-06 1 RPCDRPS-MECHFCC MECHANICAL SCRAM FAILURE 10 1.20E-08 5.71 E-03 %TBCCW LOSS OF TBCCW INITIATING EVENT 2.10E-06 1 RPCDRPS-MECHFCC MECHANICAL SCRAM FAILURE -J Quad Cities SLC CT Extension Table B-4 BASIC EVENT IMPORTANCE MEASURES FOR CDF ASSESSMENT FOR SLC OUT OF SERVICE B-7 C467090020-8953-10/16/2009 Event Name Probability Fus Ves Description 1 RPCDRPS-MECHFCC 2.10E-06 1.00E+00 MECHANICAL SCRAM FAILURE %TT 8.65E-01 7.25E-01 TURBINE TRIP WITH BYPASS %TC 8.91 E-02 7.46E-02 LOSS OF CONDENSER VACUUM %TM 7.99E-02 6.69E-02 MSIV CLOSURE %TI 4.47E-02 3.74E-02 INADVERTENTLY OPEN RELIEF VALVE %LOOP 3.64E-02 3.05E-02 LOSS OF OFFSITE POWER INITIATING EVENT %TF 1.96E-02 1.64E-02 LOSS OF FEEDWATER
%TIA 1.36E-02 1.14E-02 LOSS OF INSTRUMENT AIR INITIATOR
%FLSWTB 1.10E-02 9.21 E-03 INITIATOR - SW RUPTURE IN TB ABOVE 595' %DLOOP 8.76E-03 7.33E-03 DUAL UNIT LOSS OF OFFSITE POWER %TBCCW 5.71 E-03 4.78E-03 LOSS OF TBCCW INITIATING EVENT %TSW 5.49E-03 4.60E-03 LOSS OF SERVICE WATER INITIATING EVENT %S2-ST 3.84E-03 3.22E-03 INIT: SMALL BREAK LOCA - ABOVE CORE INSIDE DRYWELL %FLDGRB595 1.40E-03 1.17E-03 INITIATOR - UNISOLATED DGCW RUPTURE ON RB-595' %FLFPRB595 1.40E-03 1.17E-03 INITIATOR - UNISOLATED FPS FLOOD IN RB ABOVE 595' %TAC18 1.06E-03 8.88E-04 LOSS OF BUS 18 INITIATING EVENT %TAC182 1.06E-03 8.88E-04 LOSS OF MCC 18-2 INITIATING EVENT %TDC1 1.00E-03 8.37E-04 LOSS OF 125VDC BUS 1 INITIATING EVENT %TDC2 1.00E-03 8.37E-04 LOSS OF 125VDC BUS 2 INITIATING EVENT %TAC13 8.06E-04 6.75E-04 LOSS OF BUS 13 INITIATING EVENT %TAC14 8.06E-04 6.75E-04 LOSS OF BUS 14 INITIATING EVENT %FLFPTB 6.80E-04 5.69E-04 INITIATOR - FPS, DGCW, OR RHRSW RUPTURE IN TB 1 RPOP-MANSCRMH--
1.35E-01 3.75E-04 MANUAL ACTION TO SCRAM REACTOR 1 RPPARPS-ELECFCC 3.70E-06 3.75E-04 RPS ELECTRICAL FAILURE %RBCCW 4.23E-04 3.54E-04 INIT: LOSS OF RBCCW 1ATSV302-25ABDCC 9.50E-04 2.19E-04 0302-25A AND -25B FAIL TO REPOSITION DUE TO CC FAULT L 1 FW--SINGELEMF--
5.00E-02 1.88E-04 CONDITIONAL PROBABILITY THAT FW IN SINGLE ELEMENT CONTROL Quad Cities SLC CT Extension Table B-4 BASIC EVENT IMPORTANCE MEASURES FOR CDF ASSESSMENT FOR SLC OUT OF SERVICE B-8 C467090020-8953-10/16/2009 Event Name Probability Fus Ves Description
%FLDGRB554 2.10E-04 1.76E-04 INITIATOR - UNISOLATED DGCW BREAK ON RB-572' %FLSWRBHPCI 1.90E-04 1.59E-04 INITIATOR - SW INDUCED FLOOD OF HPCI COMPARTMENT(s) 1ATSV-2513
---- D-- 2.34E-02 1.28E-04 0302-2513 FAILS TO REPOSITION DUE TO LOCAL FLT 1ATSV302-25A-D--
2.34E-02 1.24E-04 0302-25A FAILS TO REPOSITION DUE TO LOCAL FAULT %TRLA 2.24E-03 9.75E-05 MEDIUM RANGE RX WATER REFERENCE LEG A LINE BREAK %TRLB 2.24E-03 9.75E-05 MEDIUM RANGE RX WATER REFERENCE LEG B LINE BREAK %SPFPTBB13 9.80E-05 8.21 E-05 FPS SPRAY OF BUS 13 IN TB %TAC11 8.06E-05 6.75E-05 LOSS OF BUS 11 INITIATING EVENT %TAC12 8.06E-05 6.75E-05 LOSS OF BUS 12 INITIATING EVENT %FLRSRB554 6.90E-05 5.78E-05 INITIATOR - RHR SW RUPTURE IN ZONE 1.1.1.1 IN RB-554' OVERHEAD %SPFPTBB182 6.60E-05 5.53E-05 FPS SPRAY OF BUS 18-2 IN TB %FLFPCSR 2.30E-05 1.93E-05 FPS BREAK IN CSR AREA 3.0 1ATSV81AB82ABDCC 1.09E-04 1.87E-05 CCF OF 4 OUT OF 4 ARI SV 0301-181A, BAND 0302-182A, B %FLSWRB 5.00E-06 1.81 E-05 INITIATOR - SW FLOOD IN RB ABOVE 595' %SPFPTBB1314 2.10E-05 1.76E-05 FPS SPRAY OF BUSES 13 AND 14 IN TB 1CNPH-NPSH---F--
1.00E+00 1.40E-05 CONTAINMENT FAILURE CAUSES LOSS OF NPSH 1 ECOP-OCST---H--
1.00E+00 1.40E-05 FAILURE TO ALIGN CST FOR INJECTION PRIOR TO CORE DAMAGE %SP--TBB11 1.10E-05 9.21 E-06 SPRAY OF BUS 11 IN TB %SPFPTBB14 1.00E-05 8.37E-06 FPS SPRAY OF BUS 14 IN TB 1ATSV-181A---D--
2.34E-02 6.62E-06 181A FAILS TO REPOSITON DUE TO LOCAL FAULT 1ATSV-181B---D--
2.34E-02 6.62E-06 181B FAILS TO REPOSITON DUE TO LOCAL FAULT 1ATSV-182A---D--
2.34E-02 6.62E-06 182A FAILS TO REPOSITION DUE TO LOCAL FAULT 1ATSV-18213---D--
2.34E-02 6.62E-06 18213 FAILS TO REPOSITION DUE TO LOCAL FAULT %SPFPTBB131418 7.00E-06 5.86E-06 FPS SPRAY OF BUSES 13,14 AND 18-2 IN TB 1ATCV302-26--K--
1.00E-03 4.03E-06 0302-26 FAILS TO CLOSE/REMAIN CLOSED WHEN 0302-25A REPOSITION
%A-ADS 1.00E-05 3.99E-06 INADVERTANT ADS 1--RX-SP-FP--H--
1.00E-06 3.99E-06 OPERATOR FAILS TO INITIATE SPC AND ALIGN FPS TO SSMP BSSRF-BYPA SS-F-- 1.00E+00 3.99E-06 SSMP BYPASS VALVE 1/2-2999-9 OPEN v Quad Cities SLC CT Extension Table B-4 BASIC EVENT IMPORTANCE MEASURES FOR CDF ASSESSMENT FOR SLC OUT OF SERVICE B-9 C467090020-8953-10/16/2009 Event Name Probability Fus Ves Description 1 FWHU263-59A-H--
2.00E-03 3.75E-06 PREINIT: MISCAL OF LI 263-59A 1 FWHU263-59B-H--
2.00E-03 3.75E-06 PREINIT: MISCAL OF LI 263-59B %SP--TBB12 4.20E-06 3.52E-06 SPRAY OF BUS 12 IN TB 1CVOP-CNTROL-H--
1.00E+00 1.99E-06 OPERATOR FAILS TO CONTROL VENTING EVOLUTION 1 FPPH-FPS-HD-F--
1.00E+00 1.99E-06 FPS INADEQUATE FLOW TO PREVENT CORE DAMAGE 1FWPH-CLOGFRVF--
5.00E-01 1.99E-06 SW CLOGS FW REG VALVES 1--RX-SP-ADDUH--
1.00E-06 1.99E-06 OPERATOR FAILS TO INITIATE ADS, SPC, AND CONTROL SSMP SWITCHING 1--RX-SP-ADFPH--
1.00E-06 1.99E-06 OPERATOR FAILS TO INITIATE ADS, SPC, AND ALIGN FPS TO SSMP 1--RX-SP-ADSSH--
1.00E-06 1.99E-06 OPERATOR FAILS TO INITIATE ADS, SPC, AND SSMP 1--RX-SP-BYP-H--
1.00E-06 1.99E-06 OPERATOR FAILS TO INITIATE SPC AND SSMP 1--RX-SPC-SS-H--
1.00E-06 1.99E-06 OPERATOR FAILS TO INITIATE SPC AND ALIGN FPS TO SSMP ROOM COOLER 1--RX-SPL-DU-H--
1.00E-06 1.99E-06 OPERATOR FAILS TO INITIATE SPC AND CONTROL SSMP SWITCHING 1VS-DWNCMR---R--
5.00E-07 1.99E-06 DOWNCOMER PIPE 1 OF 96 LEAK/ RUPTURE W/124 HRS Table B-5 RISK ASSESSMENT SENSITIVITY RESULTS Quad Cities SLC CT Extension B-1 0 0467090020-8953-10/16/2009 Risk Metric Value Acceptance Guidelines Reference OCDF 7.7E-08/yr
<1.0E-06/yr RG 1.174 ICCDP 7.7E-08 <5.0E-07 RG 1.177 OLERF 4.7E-08/yr
<1.0E-07/yr RG 1.174 ICLERP 4.7E-08 <5.0E-08 RG 1.177 B.3 PARAMETRIC UNCERTAINTY Quad Cities SLC CT Extension Consistent with the ASME PRA Standard, quantitative parametric uncertainty analyses for both CDF and LERF have been performed and are summarized in this section. The parametric uncertainty distributions for the Base PRA models have been developed in the PRA Quantification Notebook. The results of the uncertainty analysis for the proposed CT are compared with the results of the uncertainty analysis performed for the 2005B PRA Update. The parametric uncertainty analyses are performed using Monte Carlo simulation. The analysis is performed using the EPRI R&R workstation UNCERT software. B.3.1 Core Damage Frequency Parametric Uncerta inty Distribution The resulting uncertainty distribution for the proposed CT configuration (i.e. CDFsLc-oos) calculated by UNCERT Version 2.3a for CDF is shown in Figure B-1. It summarizes
: " Distribution statistics (e.g., mean, error factor, etc.) " Probability density chart of the CDF The approximate error factor (or range factor) for the proposed CT is 2.7, as compared to the error factor of the base Q1 05B Model of Record of 2.6. One of the critical aspects of the parametric uncertainty assessments is the desire to ensure that the point estimate calculation performed with the base PRA model (i.e., using CAFTA) produces a point estimate result that is not too dissimilar from the true mean calculation when the correlation effect is accounted for. Table B-6 provides this comparison for the proposed CT model (i.e. CDFSLc-oos)
: Table B-6 PARAMETER UNCERTAINTY COMPARISON FOR CDF The propagated uncertainty mean for CDFSLc-oos is the same as the CDFSLc-oos point estimate calculation. If the CDFSLc-oos propagated uncertainty mean instead of the B- C467090020-8953-1 0/16/2009 CDF Parameter CDF Result Code Point Estimate 8.0E-6/yr CAFTA Uncertainty Mean 8.0E-6/yr UNCERT 
" Probability density chart of the LERF Quad Cities SLC CT Extension Q1 05B CDFBASE propagated uncertainty mean were used to calculate the risk metrics, the results would not differ from those presented in Table 5.3-1. B.3.2 Large Early Release Frequency (LERF) Parametric Uncertainty Distribution The same process as used for CDF is also used for LERF. The resulting uncertainty distribution calculated by UNCERT Version 2.3a for LERF is shown in Figure B-2. The figure summarizes the following: " Distribution statistics (e.g., mean, error factor, etc.) The approximate error factor (or range factor) for the proposed CT for the LERF uncertainty distribution is 4.4 (calculated using SQR(95%/5%)), as compared to the error factor of 2.9 for the Q105B model. Table B-7 provides a comparison of the PRA LERF point estimate and the propagated uncertainty mean for the proposed CT case (i.e., LERFSLC-oos)
: Table B-7 PARAMETER UNCERTAINTY COMPARISON FOR LERF If the LERFSLC-oos propagated uncertainty mean (2.1 E-6/yr) and the 01056 LERF BASE propagated uncertainty mean (6.6E-7/yr) are used to calculate the risk metrics, the results would change in the second decimal place compared to the results shown in Table 5.3-1 (i.e., non-significant change). B-1 2 C467090020-8953-10/16/2009 LERF Parameter LERFSLc_oos Result Code Point Estimate 2.1 E-6/yr CAFTA Uncertainty Mean 2.1 E-6/yr UNCERT UNCERT 2.3a COREDAMAGE.CUT 010513-UNCERT.B E Samples 50,000 Random Seed Auto Relative Frequency Figure B-1 CDF PARAMETRIC UNCERTAINTY DISTRIBUTION FOR THE PROPOSED COMPLETION TIME I 1.E-6 1.E-5 1.E-4 E Frequency
/ Probability Quad Cities SLC CT Extension B-13 C467090020-8953-1 0/16/2009 Mean - M : 8.01E-06 5% - [ : 2.58E-06 50i - x : 5.96E-06 95-/.-1 : 1.94E-05 Std Dev : 8.24E-06 UNCERT 2.3a LERF-TOT.CUT 010513-UNCERT.B E 1.E-7 1.E-6 1.E-5 1.E-4 Figure B-2 LERF PARAMETRIC UNCERTAINTY DISTRIBUTION FOR THE PROPOSED COMPLETION TIME E Frequency
/ Probability Quad Cities SLC CT Extension 13-1 4 C467090020-8953-10/16/2009 Samples 50,000 Random Seed Auto Relative Frequency Mean - M : 2.13E-06 5% - [ : 3.51 E-07 50% - x : 1.15E-06 95%-] : 6.69E-06 Std Dev : 4.07E-06 B.5 REFERENCES Quad Cities SLC CT Extension
[B-1] Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, EPRI Report 1016737, Palo Alto, CA: 2008. [B-2] ASNIE/ANS RA-Sa-2009, "Addenda to RA-S-2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," February 2009 B-1 5 0467090020-8953-10/16/2009 Quad Cities SLC CT Extension Appendix C BWROG Assessment of NRC Information Notice 2007-07 The BWROG assessment of NRC Information Notice 2007-07 is provided in this appendix. This assessment discusses the low-likelihood scenario of fire-induced failure to scram. Refer to Section A.4.3 of this risk assessment. C-1 0467090020-8953-10/
1 6/2009 1.0) Summary: BWROG Assessment of NRC Information Notice 2007-07 This assessment addresses the condition described by the NRC in NRC Information Notice 2007-07 and in the inspection report referenced therein. The overall assessment of the condition described in NRC Information Notice 2007-07 by the BWROG is that it represents a condition with a low likelihood of occurrence, with low safety significance and with multiple layers of defense-in-depth currently in place each with the capability to either prevent the condition from occurring or to effectively mitigate the effects of the occurrence without consequence. It is the position of the BWROG that all BWRs should have a manual operator action tied to their post-fire safe shutdown procedures instructing the operator to implement the requirements of EO-113 should the fire impact the ability to scram. This manual operator action should be endorsed by the NRC for use in both III.G.1 and 2 areas, as well as, II1.G.3 and IILL areas. The evaluation provided in this paper and the limited likelihood of occurrence of the condition are considered to be sufficient justification for concluding that this manual operator action is both feasible and reliable. It is recommended that each BWR review this assessment and assure that their plant specific conditions are consistent with the measures described herein. As a minimum, each licensee should assure that the EOP action to implement the requirements of EO-113 is linked to their post-fire safe shutdown procedures. 2.0) Description of Issue: NRC hiformation Notice 2007-07 postulates a condition where two (2) hot shorts could result in the failure of one of four control rods groups to insert during a manual scram from the Control Room. The IN further postulates that with the reactor in this condition the operator rapidly depressurizes the reactor and re-floods the reactor with cold water using a low pressure system. The IN further states: "By design, the negative reactivity, added by all four rod groups during a scram, provides adequate shutdown margin to offset the positive void and temperature reactivity
[that] would have been added to the vessel [during such a shutdown sequence]". 3.0) Scram System Desiv Description
: Typically, the Reactor Protection System (RPS) for a BWR consists of two (2) Trip Systems (A and B), each containing two Trip Channels (Al, A2, B1, B2) of sensors and logic. The four channels contain automatic scram logic for the monitored parameters listed below, each of which has at least one input to each of the logic channels: Scram Discharge Volume Water Level Quad Cities SLC CT Extension C-2 C467090020-8953-10/16/2009 BWROG Assessment of NRC Information Notice 2007-07 " Main Steam Line Isolation Valve Position " Turbine Stop Valve Position " Turbine Control Valve Fast Closure " Reactor Vessel Water Level " Main Steam line Radiation " Neutron Monitoring System " Primary Containment Pressure " Reactor Vessel Pressure The RPS automatic trip logic requires at least one channel in each trip system to be tripped in order to cause a scram. This is referred to as one-out-of-two-taken-twice trip logic. The two RPS Trip Systems are independently powered from their respective RPS Buses. The trip channels (A1, A2, B l, 132) associated with each Trip System (A, B) operate the automatic scram Trip Logic Relays (K14 A-H). The RPS auto scram logic string is sometimes referred to as "trip actuator" or "actuation" logic because the output of the logic is what actually causes the control rods to scram by de-energizing the pilot scram solenoid valves. The RPS circuits are a fail-safe design in that the circuits are normally energized, and the loss of power, including the loss of offsite power, will initiate the scram. Once the scram has occurred, re-energization of the RPS logic will not, in and of itself, cause the control rod movement necessary to re-establish reactor criticality. 4.0) Evaluation
: The evaluation performed is divided into two sections. The first section performs a circuit analysis of the scram circuitry. This portion of the evaluation examines the scram circuitry in an effort to determine the set of hot shorts that, should they occur, have the potential to prevent one or more rod groups from inserting. The first section also addresses the significance of the postulated condition and the features currently in place with the capability to prevent or mitigate the effects of the condition. The second section addresses the implications for Appendix R Compliance given the required circuit design for this important safety system and given the potential ramifications of the hot shorts postulated in the first section. 4.1) Circuit Analysis: Figures 1 through 4 attached to this paper shows portions of the scram circuitry for a typical BWR. Three (3) separate cases involving up to two hot shorts are discussed in this paper. C-3 Quad Cities SLC CT Extension C467090020-8953-10/16/2009 Case I: (Refer to Figure 1) BWROG Assessment of NRC Information Notice 2007-07 Case I attempted to identify the condition described in IN 2007-07. IN 2007-07 concluded that two (2) hot shorts were required to prevent a single rod group from scramming. The BWROG, however, was unable to identify any circuitry where two (2) fire-induced hot shorts would prevent one of four scram rod groups from inserting. The BWROG identified that a single hot short in either of the divisionahzed trip logics can prevent the scram of a single rod group. This finding is different than the conclusion in IN 2007-07. The fording of the BWROG assessment is a direct consequence of the 1 out of 2 taken twice logic used in the design for the scram function. The single hot short with the potential for preventing the scramming of a single rod group could occur in either the Trip System A or B Relay Panel. [Refer to Figure I attached for a description of the location of the subject hot short, labeled as "Hot Short 1".] The hot short must occur prior to the operator scramming the reactor. The location of the hot short shown in Figure 1 would be either in one of the Trip System Relay Panels or in a raceway carrying the circuit from the Trip System Relay Panel to the Scram Pilot Solenoid Valves. (Note: For some licensees, the relay panels are located in separate relay rooms outside of the main control room.) For the hot short in this case to affect the reactivity function, it must remain in effect until such time when the operator depressurizes the reactor and begins re-flooding with a low pressure system. The Emergency Operating Procedures for a BWR instruct the operator not to depressurize the reactor until reactor level reaches the top of active fuel. In a typical BWR, it will take approximately 20 to 25 minutes of boil-off for reactor level to decrease to the top of active fuel. Industry and NRC cable fire testing have shown that hot shorts last for only a few minutes prior to shorting to ground. [EPRI Testing determined the maximum duration of a hot short was 11.3 minutes. CAROLFIRE Testing determined that the maximum duration of a hot short was 7.6 minutes.] Therefore, it appears unlikely that the required hot short could last for a sufficient amount of time that the impacted control rod group would fail to insert prior to the time when the EOPs directed the operator to depressurize the reactor. Case II: (Refer to Figure 2) Case II is one of two cases identified where two (2) fire-induced hot shorts could prevent a full scram. (Note: No conditions were identified where two (2) fire-induced hot shorts were required to prevent a single rod group from scramming.) Quad Cities SLC CT Extension C-4 C467090020-8953-10/16/2009 BWROG Assessment of NRC Information Notice 2007-07 Refer to Figure 2 attached for the ease where two (2) fire-induced hot shorts could prevent a full scram. This case postulates a condition where two hot shorts just below the manual scam switches for two trip channels can prevent a full scram. The postulated hot shorts could occur in either the main control room operating bench board or in a raceway carrying the trip circuit to one of the Trip System Relay Panels. The hot short will keep the K15 relays from de-energizing and this will subsequently keep the K14 relays energized. By keeping the K14 relays energized, as shown in Figure 1, none of the rod groups will de-energize and none will insert. Figure 2 shows the location of the two individual hot shorts. One affects the K 1513 relay and one affects the K15D relay. The K15 relays are de-energized by actuating the manual scram switches in the Control Room on the main control board. Keeping the K 15 relays energized by the hot shots shown in Figure 2, will keep the K14 relays energized, as shown in Figures 3. Keeping the K14 relays energized, as shown in Figure 3, will prevent rod group insertion, as shown in Figure 1. For this case, however, there are numerous other inputs into the scram logic that can override the effects of the hot short affecting the K15 relays. Refer to Figures 3 and 4 for the additional input signals to the scram function. For example, as shown on Figure 4, closure of the MSIVs or reactor level reaching the +13" level will override the effects of the hot shorts affecting the K 15 relays and result in a de-energization of the K 14 relays and full rod insertion. Therefore, it appears unlikely that the required hot shorts, even if they were to co-exist, could prevent the scram and cause the reactivity transient described in the IN. This is true because the effect of the hot short would be overriddened by the reduction in reactor level that would be necessary before the operator would take the action to depressurize the reactor prior to making up with a low pressure system. Case III: (Refer to Figure 3) (Limited to the Trip System Relay Panels) Quad Cities SLC CT Extension Case III is similar to Case II. Hot shorts are postulated in the locations shown in Figure 3, the K14 relays will again remain energized. The energization of the K14 relays will prevent the scram for all rod groups. For this case to occur, the fire must sufficiently damage two separate circuits and the fire induced damage must occur on each circuit simultaneously. Industry and NRC cable fire testing have shown that hot shorts last for only a few minutes prior to shorting to ground. [EPRI Testing determined the maximum duration of a hot short was 11.3 minutes. CAROLFIRE Testing determined that the maximum duration of a hot short was 7.6 minutes.] C-5 0467090020-8953-10/16/2009 BWROG Assessment of NRC Information Notice 2007-07 for each of these postulated fire areas would be ineffective in preventing the occurrence of the condition. The condition postulated in Case I can only be mitigated by the use of a manual operator action consistent with the manual operator actions currently invoked under Emergency Operating Procedure, EO-113. 'I11e conditions described for Cases II and III are similar. Neither of these cases represents a condition that is prevented by the type of redundant train separation invoked under Appendix R, since the postulated hot shorts occur within a single division. Therefore, the provision of Appendix R cannot be used to address the conditions described in this paper. Re-design of the scram circuitry is not a viable option without compromising the design function of this important safety function. In addition to the features of the RPS system described above, the Alternate Rod Insertion (ARI) system (vents SCRAM air header), Backup Scram Solenoids (vents SCRAM air header), and Standby Liquid Control (SLC) system (inserts sodium pentaborate) provide additional redundant means to achieve reactor shutdown. For areas such as the main Control Room and the Relay Rooms, however, similar fire-induced impacts could be postulated. This paper has highlighted one example of an area where verbatim compliance with the requirements of Appendix R is insufficient in preventing fire induced damage from potentially impacting safe shutdown. The BWROG believes that this case and, potentially, other like it are the reason why from the initial issuance of Appendix R that certain conditions were considered to be initial boundary conditions for the Appendix R Post-Fire Safe Shutdown Analysis. Assuming that the reactor is scrammed was one of those initial boundary conditions given for the Post-Fire Safe Shutdown Analysis. NRC Generic letter 86-10 in the Response to Question 3.8.4, Control Room Fire Considerations, endorsed the assumption of a reactor trip prior to evacuating the Control Room. Based on this and on the fail-safe nature of the reactor protection system, many licensees assumed and the NRC accepted that a reactor trip was an initial boundary condition for the start of the post-fire safe shutdown analysis, i.e. the plant is scrammed prior to the scram circuitry being damaged by the fire. Although the BWROG believes that the prior industry position related to the scram is correct and its use provides for a safe plant design, the BWROG also recognizes that fires have some limited potential to impact the scram capability. As a precaution, it is the position of the BWROG that all BWRs should have a manual operator action tied to their post-fire safe shutdown procedures instructing the operator to implement the requirements of EO-113 should the fire impact the ability to scram. This manual operator action should be endorsed by the NRC for use in both III.G.1 and III.G.2 areas, as well as, III.G.3 and IILL areas. The evaluation provided in this paper and the limited likelihood of occurrence of the condition are considered to be sufficient justification for the feasibility and reliability of this manual operator action. Quad Cities SLC CT Extension C-6 C467090020-8953-10/16/2009 5.0) Risk Assessment
: Given the unlikely set of circumstances required for this condition to occur and to remain in effect until such time that it could pose a beyond design basis concern to the reactor, the risk associated with this issue is judged to be low. 6.0) Safety Assessment
: BWROG Assessment of NRC Information Notice 2007-07 Given the fact that there are multiple barriers (circuit failure characteristics, design features, procedural guidance and rigorous operator training) in place to prevent the occurrence of this condition, the safety significance of this issue is also judged to be very low. 7.0) Conclusions and Recommendations
: 'This assessment addresses the condition described by the NRC in NRC Information Notice 2007-07 and in the inspection report referenced therein. Quad Cities SLC CT Extension The overall assessment of the condition described in NRC Information Notice 2007-07 by the BWROG is that it represents a condition with a low likelihood of occurrence, with low safety significance and with multiple layers of defense-in-depth currently in place each with the capability to either prevent the condition from occurring or to effectively mitigate the effects of the occurrence without consequence. It is the position of the BWROG that all BWRs should have a manual operator action tied to their post-fire safe shutdown procedures instructing the operator to implement the requirements of EO-113 should the fire impact the ability to scram. This manual operator action should be endorsed by the NRC for use in both M.G. 1 and 2 areas, as well as, 11I.G.3 and 1111 areas. The evaluation provided in this paper and the limited likelihood of occurrence of the condition are considered to be sufficient justification for concluding that this manual operator action is both feasible and reliable. It is recommended that each BWR review this assessment and assure that their plant specific conditions are consistent with the measures described herein. As a minimum, each licensee should assure that the EOP action to implement the requirements of EO-113 is linked to their post-fire safe shutdown procedures. Prepared by: Thomas A. Gorma n Date: 10/1612007 Thomas A. Gorman, PE, SFPE Reviewed by: Gary Birmingha m Date: 11/13/2007 Gary S. Birmingham C-7 C467090020-8953-10/16/2009 
+.". C~3-fi-a "u1. N_1' V c'soUF F CSYAIV ca L ~Q'e SeCRMrf v.~a~rE. iC~l1.a.+3.O5 P'"~c< 1eY~an.~ 4A:...+.lE ~ot.t,wg r~ T'vptca.y ax K ^x346.1-O=.D TYDxr~ CP' oS W4t41t?s'Oc BWROG Assessment of NRC Information Notice 2007-07 3fiNC?'tE k,;+ Y4v$i0 -~jeu `" 443,* Not Short #1 locati on (typical of 4 per div f"aqlO.acr a '"uT SCAAA1 Yh~YY. c~~<<wasas
`LTSS,GF~
oc aM 'CGL.44L10.5- Quad Cities SLC CT Extension T scavs.a va.wq g~~l~..lo.n! PlII4~ dR 4B, 4M.gwFeQ$ Figure 1 - Relay Panel Circuitry Controlling Individual Rod Groups (typical of t wo T r i o Syste ms) C-8 C467090020-8953-10/16/2009 
-- REACTOR MANUAL SCRAM "61- .1 ~r. r tit- Pt. i9`,iceCiTY"'
U4 1 3 6 12 " BWROG Assessment of NRC Information Notice 2007-07 Hot hort #2 locations (typical of 4, 2 per division Note: This combination assumes KZ- 8v-iw RPS does not pick up another q` scram signal, e.g. MSIV Closure; Turbine Stop Valve Closure. Lz sa RE FiQure 2 - Manual Scram Circuitry - Typical of two Trip Systems REfiCTQR MANUAL SCRAM TRIP CNAOEf "H2' Quad Cities SLC CT Extet2sion C-9 C467090020-8953-1011612009 REACTOR aura-StRAN
_ _ TRIP LOGIC "0i" BWROG Assessment of NRC Information Notice 2007-07 Refer to Figure 4 for the remaining set of contacts that affect the automatic scram function Hot Short #3 location (typical 2 per Trio Systems) C-1 0 Finure 3 - Reactor Auto-Scram Circuitry - Typical of four Trip Channels in two Trip System s (RESE7) K14&#xac;1 - Kf4M 31 3t. Quad Cities SLC CT Extension e1 7rMS U EV :ACTOR AUTO-SCR.A TRxrr L0GiC *42' 0467090020-8953-10/16/2009 
~P+t?lNAFtY
~ ~ i-T T ! 41 2L LOW way" I I A j- L-J=E!0---j L,4T BWROG Assessment of NRC Information Notice 2007-07 ', 4 a- 0- -1 i VALVE DO & CONTRO M ~ }6&F Figure 4- Balance of Auto-Scram Circuitry - (typical of 4 Trip Channelsl Quad Cities SLC CT Extension FnS . 3r278 tj;Rcr) (=W, ) TION C-1 1 0467090020-8953-1 0/16/2009}}

Latest revision as of 20:09, 16 April 2019

Redirect to:

Retrieved from "https://kanterella.com/w/index.php?title=RS-09-152,_Dresden,_Units_2_%26_3_and_Quad_Cities,_Units_1_%26_2_-_Request_for_Amendment_to_Technical_Specification_3.1_.7,_Standby_Liquid_Control_(SLC)_System&oldid=1465962"