ML15323A416

(Vegp) - Request for Additional Information (CAC Nos. ME9555 and ME9556)

ML15323A416
Person / Time
Site:	Vogtle
Issue date:	12/17/2015
From:	Geoffrey Miller Plant Licensing Branch II
To:	Pierce C Southern Nuclear Operating Co
Miller G
References
CAC ME9555, CAC ME9556
Download: ML15323A416 (7)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 December 17, 2015 Mr. C. R. Pierce Regulatory Affairs Director Southern Nuclear Operating Company, Inc.

Post Office Box 1295, Bin - 038 Birmingham, AL 35201-1295

SUBJECT:

VOGTLE ELECTRIC GENERATING PLANT, UNITS 1 AND 2 - REQUEST FOR ADDITIONAL INFORMATION (CAC NOS. ME9555 AND ME9556)

Dear Mr. Pierce:

By letters dated September 13, 2012, as supplemented by letters dated August 2, 2013, July 17, 2014, November 11, 2014, December 12, 2014, March 16, 2015, and May 5, 2015, Southern Nuclear Operating Company, Inc. (SNC), submitted a license amendment request to modify the Vogtle Electric Generating Plant Technical Specifications requirements to permit the use of Risk Informed Completion Times in accordance with Nuclear Energy Institute (NEI)

Report NEl-06-09, Revision 0, Risk Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS). The U.S. Nuclear Reg"ulatory Commission (NRC) staff finds that additional information is needed as set forth in the Enclosure.

The NRC staff is held a public meeting with SNC to discuss these RAls on the afternoon of December 8, 2015. The NRC staff requests a response to this letter within 60 days.

s&,1f~

G. Edward Miller, Project Ma~ager Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos. 50-424 and 50-425

Enclosure:

Request for Additional Information cc w/encl: Distribution via Listserv

REQUEST FOR ADDITIONAL INFORMATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION SOUTHERN NUCLEAR OPERATING COMPANY, INC.

VOGTLE ELECTRIC GENERATING PLANT, UNITS 1 AND 2 By letter dated September 13, 2012, as supplemented by letters dated August 2, 2013, July 17, 2014, November 11, 2014, December 12, 2014, March 16, 2015, and May 5, 2015 ADAMS Accession Nos. ML12258A055, ML13217A072, ML14198A574, ML14315A051, ML14346A643, ML15075A479, and ML15125A446, respectively), Southern Nuclear Company, Inc. (SNC), proposed changes to the Technical Specifications {TSs) for the Vogtle Electric Generating Plant (VEGP or Vogtle). The proposed amendment would modify TS requirements to permit the use of Risk Informed Completion Times (RICTs) in accordance with Topical Report (TR) Nuclear Energy Institute (NEI) 06-09, Revision 0-A, Risk Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines. The NRC staff has identified the following information needs associated with your amendment request.

Request for Additional Information Regarding PRA Functionality Model Application to TSTF-505, Revision 1, "Proposed Revision to the Model Application for TSTF-505, Revision 1, 'Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b'," Enclosure 1 (ADAMS Accession No. ML12032A065) states:

This enclosure should provide a description of PRA functionality for each associated specified safety function that corresponds to each proposed Required Action that is applicable when all trains of equipment are inoperable as discussed in Section 2.3.1.10 of NE/ 06-09.

The VEGP license amendment report (ADAMS Accession No. ML12258A055) requesting Implementation of NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk Managed Technical Specification Guidelines," was not submitted as a TSTF-505 submittal but the proposed program also utilizes probabilistic risk assessment (PRA) Functional when all trains of equipment are inoperable. The TSTF-505 enclosure guidance is included as part of the model application because the NRC staff seeks clarity in how PRA Functional will be used during full power operation following "loss of a specified safety function or inoperability of all required trains or divisions of a system." In lieu of requesting additional justification for PRA functionality for each associated specified safety function consistent with TSTF-505, the NRC staff requests the following information.

1. To provide confidence that the defense-in-depth philosophy is maintained as the completion times (CTs) are extended, the NRC staff requests the following information for three of the defense-in-depth "circumstances" described in RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decision-making: Technical Specifications," Revision 1, May 2011.

Enclosure

a. System redundancy, independence, and diversity are maintained commensurate with the expected frequency and consequences of challenges to the system (e.g., there are no risk outliers). The licensee should consider ... whether there are appropriate restrictions in place to preclude simultaneous equipment outages that would erode the principles of redundancy and diversity.

Beyond prohibiting voluntary entry, the guidance on PRA Functionality in NEI 06-09 does not address how PRA Functionality should be defined when the systems, structures, and components (SSCs) normally relied on to perform a specified safety function are unavailable. Specifically, the PRA often includes alternative SSCs that could be used to fulfill a specified safety function when the SSCs referenced in the TSs are unavailable. Crediting alternative SSCs when the SSCs normally relied on are unavailable would represent a loss of redundancy or diversity. Please confirm that SSCs credited in a PRA Functional determination are the same SSCs relied upon to perform the specified safety function. If a PRA Functional determination for a loss of a specified safety function or inoperability of all required trains or divisions of a system credits SSCs other than the SSCs covered by the TSs (e.g., crediting the Fire Protection system as an alternative water source), please summarize each such TS and justify how appropriate redundancy and diversity is maintained if alternative SSCs are credited.

b. Over-reliance on programmatic activities as compensatory measures associated with the change in the licensing basis is avoided (e.g., the change does not use high reliability estimates that are primarily based on optimistic program assumptions).

It appears that, some CT length calculations rely on high reliability estimates (i.e., low human error probabilities) for human actions required to achieve the specified safety function without evaluating the likelihood of these actions and the context within which they are needed well enough to model them in the PRA.

i) Please confirm that all human actions (other than the room cooling actions addressed in 1.b.ii) required to achieve PRA functional upon loss of specified safety function are modeled in the PRA (i.e., are proceduralized and trained on or are so simple as to be skill of the craft). If any actions other than the room cooling actions were evaluated, but not modeled, please summarize the actions and the evaluation.

ii) In response to NRC PRA RAI 1 (ADAMS Accession No. ML13217A072, page E-20) VEGP stated that human actions to open the doors to five rooms to prevent excessive heat up was required on loss of room cooling but the actions are not included in the PRA logic model. The response stated that the human error probability for failing to open the doors is extremely small and implies that VEGP procedures include guidance on opening the doors. Please confirm that these actions are explicitly proceduralized and trained on and summarize the evaluation concluding the HEPs are extremely small. Note that when room cooling is unavailable during a 30-day CT, these actions would be required if room cooling is required. Please clarify why these actions have a "negligible"

impact on core damage frequency and large early release frenquency and the associated CT that will be used when room cooling is unavailable.

iii) If any other human actions are directly or indirectly credited in the CT length calculations, please provide the same information requested in 1.b.ii about each action.

c. The intent of the plant's design criteria is maintained.

The intent of the design basis design criteria is that all design basis accident scenarios could be mitigated, i.e., the minimum specified safety function capability is available.

To maintain this intent, PRA Functionality should not include any scenarios that allow any design basis accident initiator to proceed directly to core damage (e.g., no initiating events that model design basis accident initiators in the PRA models should have a conditional core damage probability (CCDP) of 1.0 or conditional containment failure probability (CCFP) of 1.0). Please confirm that PRA Functionality does not include any scenarios that allow any design basis accident to proceed directly to core damage or containment failure, or identify the scenarios and justify that the intent of the design criteria is maintained and describe how the PRA functionality determination will verify these requirements are met.

2. .To provide confidence that sufficient safety margins are maintained, NRC Staff requests the following information for the detailed "circumstance" described in RG 1.177.

Safety analysis acceptance criteria in the final safety analysis report (FSAR) are met or

• proposed revisions provide sufficient margin to account for analysis and data uncertainties (e.g., the proposed TS CT or SF change does not adversely affect any assumptions or inputs to the safety analysis, or, if such inputs are affected, justification is provided to (3nsure sufficient safety margin will continue to exist). For TS CT changes, an assessment should be made of the effect on the FSAR acceptance criteria assuming the plant is in the condition addressed by the proposed CT (i.e., the subject equipment is inoperable) and there are no additional failures. Such an assessment should result in the identification of all situations in which entry into the condition addressed by the proposed CT could result in failure to meet an intended safety function.

Some TS safety functions are credited in design basis accident scenarios modelled in the PRA but are also required in other design basis accident scenarios not modelled in the PRA because the other scenarios do not contribute to CDF and LERF or are not needed within the PRA mission time.

a) Please confirm that the acceptable PRA Functional modelled in the PRA is also available and sufficient for the remaining design basis accident scenarios that are not modelled in the PRA because other design basis accident scenario does not affect CDF or LERF (e.g., containment spray may be credited as decay heat removal in some plants which is modeled in the PRA It may also provide an iodine removal function for the same plants, which is not modeled in the PRA) or describe how the PRA functionality determination will verify these requirements* are met.

b) Please confirm there are no safety functions required to reach a safe and stable state but not included in the PRA because they are only required after the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time generally used in the PRA (e.g., some alternative primary water sources may lead to excessive boron dilution after some loss-of-coolant accidents but only after at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> so boron is not modelled in the PRA) or describe how the PRA functionality determination will verify these requirements are met.

c) In Table E1 .1. of its application dated September 13, 2012, the licensee noted differences between the design basis success criteria and the PRA success criteria for certain specified safety functions. In the response to PRA RAI 5, in its letter dated July 17, 2014 (ADAMS Accession No. ML14198A574), the licensee noted that the Configuration Risk Management Program (CRMP) will ensure that prior to entering a Risk-Informed CT, adequate margins of safety are maintained by ensuring that systems and subsystems redundant to the inoperable component are available, and that the PRA success criteria are met. The licensee also noted that conditions which represent a loss of function cannot be entered voluntarily. However, the response did not address how safety margin was maintained for the case of a PRA functional determination for a loss of a specified safety function or inoperability of all required trains or divisions of a system.

For this case, please elaborate on how adequate safety margins are maintained and provide some clarifying examples of adequate safety margins for where the PRA success criteria (e.g., flow rates, temperature limits) differ from the design criteria.

Request for Additional Information Regarding Emergency Diesel Completion Times The Current Vogtle Technical Specification 3.8.1 contains the following requirements:

Vogtle TS Limiting Condition for Operation 3.8.1 specifies operability requirements for AC electrical sources. With one Diesel Generator (DG) inoperable, Condition B is applicable. Condition B requires, in part:

• Verify the Standby Auxiliary Transformer (SAT) is available within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> thereafter (Required Action 8.2); and, either Verify an enhanced black-start Combustion Turbine Generator (CTG) is functional by verifying the CTG and the black-start diesel generator starts and achieves steady state voltage and frequency within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> prior to entry into Condition B (Required Action B.5.1)

-OR-Start and run at least one CTG while in Condition B within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> prior to entry into Condition B for preplanned maintenance (Required Action B.5.2).

Additionally Condition B requires:

• Restore DG to operable status within 14 days from discovery of failure to meet LCO (Required Action B.6).

LCO 3.8.1 Condition C applies when Required Actions B.2, B.5.1 or B.5.2 and associated Completion Times are not met. Required Action C.1 requires:

• Restore DG to Operable Status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

If Required Action C.1 and its Completion Time are not met, the unit must be placed in Mode 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

Request for Additional Information:

The LAR proposes to add the option of either applying the existing front stop CT or applying a RICT for Required Action C.1. The proposed change to the CT for Required Action C.1 could permit operation for an extended period of time with one DG inoperable without verifying the availability of SAT or of the combustion turbine generator. Please provide technical justification, including a discussion of defense-in-depth and safety margin considerations, for the addition of a risk-informed CT for the Required Actions associated with LCO 3.8.1 Condition C, or propose a modification to the license amendment request that retains the existing CTs for verifying availability of SAT and functionality of a CTG.

ML15323A416 OFFICE DORL/LPL2-1/PM DORL/LPL2-1/LA DRNAPLA/BC DSS/STSB/BC DORL/LPL2-1 /BC DORL/LPL2-1 /PM NAME GE Miller SFigueroa SRosenberg RElliott MMarkley GEMiller DATE 12/09/15 11/23/15 11/02/15 12/07/15 12/17/15 12/17/15