ML17004A209

Safety Evaluation Input for Palo Verde Nuclear Generating Station, Unit 3, Llcense Amendment Request for a One-Time Extension of the 3B Emergency Diesel Generator Completion Time

ML17004A209
Person / Time
Site:	Palo Verde
Issue date:	01/03/2017
From:	Rosenberg S L NRC/NRR/DRA/APLA
To:	Pascarelli R J Plant Licensing Branch IV
Todd Hilsmeier, NRR/DRA 415-6788
References
CAC MF9019
Download: ML17004A209 (16)

Text

January 3, 2017 MEMORANDUM TO: Robert J. Pascarelli, Chief Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

FROM: Stacey Rosenberg, Chief

/RA/ PRA Licensing Branch Division of Risk Assessment Office of Nuclear Reactor Regulation

SUBJECT:

SAFETY EVALUATION INPUT FOR PALO VERDE NUCLEAR GENERATING STATION, UNIT 3, LICENSE AMENDMENT REQUEST FOR A ONE-TIME EXTENSION OF THE 3B EMERGENCY DIESEL GENERATOR COMPLETION TIME (CAC NO. MF9019)

By letter to the U.S. Nuclear Regulatory Commission (NRC) dated December 30, 2016 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML16365A240), Arizona Public Service Company (APS, the licensee) submitted a License Amendment Request (LAR) for Palo Verde Nuclear Generating Station (PVNGS), Unit 3. This LAR proposed a one-time extension of the completion time from 10 days to 62 days to restore the Unit 3, Train B Emergency Diesel Generator (EDG) to operable status associated with Technical Specifications (TS) 3.8.1.B.4. This proposed change will only be used one time for the purpose of completing repairs and testing to re-establish operability of the 3B EDG.

The Probabilistic Risk Assessment Licensing Branch (APLA) in the Office of Nuclear Reactor Regulation has evaluated the licensee's proposed TS change against the guidelines of Regulatory Guide (RG) 1.177 and RG 1.174. The APLA review scope and findings are limited to the evaluation of the risk impacts and did not evaluate the traditional engineering analysis, which is the responsibility of a different division. The licensee's estimated risk impacts met the acceptance guidelines of RG 1.177 and RG 1.174. The licensee also provided information related to the scope, level of detail, and technical adequacy of the PRA models used to make this estimate. On the basis of this informat ion, the NRC staff finds that the licensee's risk insights support the proposed change and are acceptable. This memorandum and the attached safety evaluation complete our work on CAC No. MF9019.

Docket No.: 50-530

Enclosure:

Safety Evaluation

CONTACT: Todd Hilsmeier, NRR/DRA 301-415-6788

ML17004A209 OFFICE NRR/DRA/APLA NRR/DRA/APLA NRR/DRA/APLA NAME THilsmeier CFong SRosenberg DATE 1/03/2017 1/03/2017 1/03/2017

ENCLOSURE SAFETY EVALUATION INPUT FOR PALO VERDE NUCLEAR GENERATING STATION, UNIT 3, LICENSE AMENDMENT REQUEST FOR A ONE-TIME EXTENSION OF THE 3B EMERGENCY DIESEL GENERATOR COMPLETION TIME (CAC NO. MF9019)

1.0 INTRODUCTION

By letter dated December 30, 2016 (Reference 1), Arizona Public Service Company (APS, the licensee) submitted a License Amendment Request (LAR) for Palo Verde Nuclear Generating Station (PVNGS), Unit 3. This LAR proposed a one-time extension of the completion time from 10 days to 62 days to restore the Unit 3, Train B Emergency Diesel Generator (EDG) to operable status associated with Technical Specifications (TS) 3.8.1.B.4. This proposed change will only be used one time for the purpose of completing repairs and testing to re-establish

operability of the 3B EDG.

2.0 REGULATORY EVALUATION

The Nuclear Regulatory Commission (NRC) staff fi nds that the licensee, in its December 30, 2016 submittal, identified the applicable risk-informed regulatory guidelines. The regulatory guidance that the NRC staff considered in its review of the application are discussed below.

2.1 Applicable Regulation

The PRA (Probabilistic Risk Assessment) Licensing Branch (APLA) technical staff has no input to this section. The input to this section should be provided by the technical staff from the appropriate traditional engineering/deterministic branch(es).

2.2 Applicable Regulatory Guidelines and Review Plans The regulatory guidelines on which the APLA staff based its acceptance are:

• Regulatory Guide (RG) 1.174, Revision 2, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis" (Reference 2), describes a risk-informed approach, acceptable to the NRC, for assessing the nature and impact of proposed permanent licensing-basis changes by considering engineering issues and applying risk insights. This regulatory guide also provides risk acceptance guidelines for evaluating the results of such evaluations.

• RG 1.177, Revision 1, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications" (Reference 3), describes an acceptable risk-informed approach specifically for assessing proposed one-time TS changes in completion times (CTs). This regulatory guide also provides risk acceptance guidelines for evaluating the results of such assessments. RG 1.177 provides the following three-tiered TS acceptance guidelines specific to one-time only CT changes for evaluating the risk associated with the revised CT:

1. The licensee has demonstrated that implementation of the one-time only TS CT change impact on plant risk is acceptable (Tier 1):

• Incremental conditional core damage probability (ICCDP) of less than 1.0x10-6 and an incremental conditional large early release probability (ICLERP) of less than 1.0x10

-7, or

• ICCDP of less than 1.0x10

-5 and an ICLERP of less than 1.0x10

-6 with effective compensatory measures implemented to reduce the sources of increased risk.

2. The licensee has demonstrated that there are appropriate restrictions on dominant risk-significant configurations associated with the change (Tier 2).

3. The licensee has implemented a risk-informed plant configuration control program. The licensee has implemented procedures to utilize, maintain, and control such a

program (Tier 3).

RG 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities" (Reference 4), describes one acceptable approach for determining whether the quality of the PRA, in total or the parts that are used to support an application, is sufficient to provide confidence in the results, such that the PRA can be used in regulatory decisionmaking for light-water reactors.

General guidance for evaluating the technical basis for proposed risk-informed changes is provided in Chapter 19, Section 19.2, "Review of Risk Information Used to Support Permanent Plant-Specific Changes to the Licensing Basis: General Guidance," of the NRC Standard Review Plan (SRP), NUREG-0800 (Reference 5). Guidance on evaluating PRA technical adequacy is provided in Chapter 19, Section 19.1, "Determining the Technical Adequacy of Probabilistic Risk Assessment for Risk-Informed License Amendment Requests After Initial Fuel Load," of the SRP (Reference 6). More specific guidance related to risk-informed TS changes is provided in SRP Section 16.1, "Risk-Informed Decisionmaking: Technical Specifications" (Reference 7), which includes CT changes as part of risk-informed decisionmaking. Chapter 19 of the SRP states that a risk-informed application should be evaluated to ensure that the proposed changes meet the following key principles:

• The proposed change meets the current regulations, unless it explicitly relates to a requested exemption or rule change.

• The proposed change is consistent with the defense-in-depth philosophy.

• The proposed change maintains sufficient safety margins.

• When proposed changes increase core damage frequency (CDF) or risk, the increase(s) should be small and consistent with the intent of the Commission's Safety Goal Policy Statement.

• The impact of the proposed change should be monitored using performance measurement strategies.

3.0 TECHNICAL EVALUATION

The PVNGS, Unit 3, LAR requested approval for a one-time extension of the TS CT from 10 days to 62 days to restore the 3B EDG to operable status associated with TS 3.8.1.B.4. The technical evaluation by the APLA staff presented in this safety evaluation (SE) evaluates those portions of the licensee's submittal that pertain to risk-informed evaluation of the proposed TS change (i.e., PRA considerations, evaluation of the risk impact of the proposed change consistent with RG 1.177, determination of the technical adequacy of the PRA models consistent with the requirements of RG 1.200, and the other applicable aspects of the PRA related to the proposed change).

3.1 Detailed Description of the Proposed Change The LAR proposed a one-time extension of the 3B EDG CT described in TS 3.8.1.B.4.

Specifically, this amendment proposed to extend the TS required action 3.8.1.B.4 CT from 10 days to 62 days for the purpose of completing repairs and testing to re-establish operability of the 3B EDG. During surveillance testing on December 15, 2016, the 3B EDG suffered a failure of the number nine right cylinder connecting rod and piston. Current plans to collect and analyze data associated with the engine failure and continue the repair would exceed the TS required action CT of 10 days. As a result, the licensee requested a one-time risk-informed license amendment to extend the CT.

3.2 Determination of Common Cause Mode of Failure The APLA technical staff has no input to this section. The input to this section should be provided by the technical staff from the appropriate traditional engineering/deterministic branch(es).

3.3 Review Methodology

Per SRP Section 19.1 and Section 16.1, the NRC staff reviewed the submittal using the three-tiered approach and the five key principles of risk-informed decision making presented in RG 1.174 and RG 1.177. The scope of APLA's review and findings are limited only to the evaluation of the risk-related portion of the review and do not include evaluation of the traditional

engineering analysis.

3.3.1 Key Principle 1: Compliance with Current Regulations

The APLA technical staff has no input to this section. The input to this section should be provided by the technical staff from the appropriate traditional engineering/deterministic branch(es).

3.3.2 Key Principle 2: Evaluation of Defense-in-Depth

The APLA technical staff has no input to this section. The input to this section should be provided by the technical staff from the appropriate traditional engineering/deterministic branch(es).

3.3.3 Key Principle 3: Evaluation of Safety Margins The APLA technical staff has no input to this section. The input to this section should be provided by the technical staff from the appropriate traditional engineering/deterministic branch(es).

3.3.4 Key Principle 4: Change in Risk Consistent with the Commission's Safety Goal Policy Statement

The evaluation below addresses the NRC staff's philosophy of risk-informed decision making:

that when the proposed changes result in a change in CDF or risk, the increase should be small and consistent with the intent of the Commission's Safety Goal Policy Statement. The NRC staff evaluation of Key Principal 4 for the proposed one-time TS change is described below.

3.3.4.1 Tier 1: PRA Capability and Insights The first tier evaluates the impact of the proposed change on plant operational risk. The Tier 1 review involves two aspects: (1) evaluation of the technical adequacy of the PVNGS PRA models and their application to the proposed change, and (2) evaluation of the PRA results and insights based on the licensee's proposed change.

PRA Quality RG 1.174 states that, "[t]he scope, level of detail, and technical adequacy of the PRA are to be commensurate with the application for which it is intended and the role the PRA results play in the integrated decision process." The technical adequacy of the PRA must be compatible with the safety implications of the TS change being requested and the role that the PRA plays in justifying that change. That is, the more the potential change in risk or the greater the uncertainty in that risk from the requested TS change, or both, the more rigor that must go into ensuring the technical adequacy of the PRA. This applies to Tier 1, and it also applies to Tier 2 and Tier 3 to the extent that a PRA model is used.

RG 1.200, Revision 2, describes one acceptable approach for determining whether the technical adequacy of the PRA, in total or the parts that are used to support an application, is sufficient to provide confidence in the results such that the PRA can be used in regulatory decision-making for light-water reactors. RG 1.200, Revision 2, endorses with comments and qualifications the use of: the American Society of Mechanical Engineers/American Nuclear Society (ASME/ANS)

PRA standard ASME/ANS RA-Sa-2009, "Addenda to ASME/ANS RA-S-2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications" (Reference 8); Nuclear Energy Institute (NEI) 00-02, Revision 1, "Probabilistic Risk Assessment Peer Review Process Guidance" (Reference 9); and NEI 05-04, Revision 2, "Process for Performing Follow-On PRA Peer Reviews Using the ASME PRA Standard" (Reference 10). The ASME/ANS PRA standard provides technical supporting requirements in terms of three Capability Categories (CCs). The intent of the delineation of the Capability Categories within the Supporting Requirements (SRs) is generally that the degree of scope and level of detail, the degree of plant specificity, and the degree of realism increase from CC I to CC III. In general, the staff anticipates that current good practice, i.e., CC II of the ASME/ANS standard is adequate for the majority of applications.

Internal Events PRA (Including Internal Flooding)

The full-power, internal events PRA (IEPRA) and internal flooding PRA (IFPRA) for PVNGS, Unit 3, address both CDF and large early release frequency (LERF). The licensee stated that their risk management process for maintaining and updating the PRA ensures that the IEPRA and IFPRA accurately reflect the as-built, as-operated plant. The licensee used RG 1.200, Revision 2, to address the technical adequacy of the IEPRA and IFPRA to assure these PRAs are capable of accurately characterizing the risk impact from internal events (including flooding) associated with the TS CT change for 3B EDG. Capability Category II of ASME/ANS RA-Sa-2009 was applied as the standard, and any identified deficiencies to those requirements were assessed further to determine any impacts to the risk evaluation.

In 1999, the Combustion Engineering Owners Group (CEOG) conducted a peer review of the IEPRA in accordance with NEI 00-02. Attachment 8 of the LAR provided the findings from this peer review and the licensee's disposition of these findings. In 2010, the licensee performed a self-assessment on the IEPRA in accordance with Appendix B of RG 1.200, Revision 2, to assess gaps between the CEOG peer review results and the SRs in ASME/ANS RA-Sa-2009, as qualified by RG 1.200, Revision 2. Attachment 9 of the LAR provided the findings from the self-assessment of the IEPRA for SRs determined not met to CC II and the licensee's disposition of these findings.

In 2010, Westinghouse performed a full-scope peer review of the IFPRA against the SRs of ASME/ANS RA-Sa-2009, as qualified by RG 1.200, Revision 2. Attachment 10 of the LAR provides the facts and observations (F&Os) from the peer review of the IFPRA for SRs determined not met to CC II and the licensee's disposition to these F&Os. The licensee stated that no changes have been made to the IEPRA and IFPRA subsequent to the peer reviews that would constitute an upgrade as defined by ASME/ANS RA-Sa-2009. Therefore, no additional peer reviews were performed to support the risk evaluation under this LAR.

The NRC staff reviewed the licensee's dispositi on of the findings and F&Os, as supplemented by Attachment 16 of the LAR, associated with the IEPRA and IFPRA, and concludes that they

were properly dispositioned to support the internal events and in ternal flooding PRA technical adequacy for the proposed one-time CT extension. Also, the LAR risk results (i.e., ICCDP and ICLERP for the proposed one-time CT extension) for internal events and internal flooding met the RG 1.177 risk acceptance guidelines by a large margin, which provides additional confidence that any uncertainties associated with the IEPRA and IFPRA would not change the conclusions of this assessment.

Fire PRA The PVNGS, Unit 3, internal fire PRA (FPRA) addresses both CDF and LERF. The licensee stated that its risk management process for maintaining and updating the PRA ensures that the FPRA remains an accurate reflection of the as-built and as-operated plant. The licensee used RG 1.200, Revision 2, to address the technical adequacy of the FPRA to ensure that it is capable of accurately characterizing the risk impact from internal fires associated with the TS CT change for 3B EDG. Capability Category II of ASME/ANS RA-Sa-2009 was applied as the standard, and any identified deficiencies to those requirements were assessed further to determine any impacts to the risk evaluation.

The licensee stated that its FPRA was developed consistent with the guidance in NUREG/CR-6850 (Reference 11) including the frequently asked question (FAQ) guidance developed for the National Fire Protection Association Standard (NFPA) 805, "Performance Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants."

However, some of the more recent endorsed methods have not yet been incorporated into the fire PRA model. In December 2012, a full-scope peer review of the FPRA was performed in accordance with NEI 07-12 (Reference 12) against the SRs of ASME/ANS RA-Sa-2009, as qualified by RG 1.200, Revision 2. Subsequently, in December 2014, a focused-scope peer review of the FPRA was conducted in accordance with NEI 07-12 to address ASME/ANS RA-Sa-2009 SRs determined not met to CC II in the first peer review, including a complete re-review of the affected SRs.

2 of the LAR provided the F&Os from the peer reviews of the FPRA for SRs determined not met to CC II and the licensee's disposition to these F&Os. The licensee stated that no changes were made subsequent to the peer reviews that would constitute an upgrade as defined by ASME/ANS RA-Sa-2009. Therefore, no additional peer reviews were performed to support the risk evaluation under this LAR.

The NRC staff evaluated the licensee's disposition of the F&Os associated with the FPRA and concludes these F&Os were properly dispositioned to support the internal fire PRA technical adequacy for the proposed one-time CT extension. Also, the licensee performed a sensitivity analysis in Attachment 16 of the LAR that quantitatively evaluated risk associated with the unavailability of 3B EDG for 62 days and credit for the portable diesel generators. This analysis showed that the internal fire risk results (i.e., ICCDP and ICLERP) meet the RG 1.177 risk acceptance guidelines by a large margin. This provides additional confidence that any uncertainties associated with the FPRA would not change the conclusions of this assessment.

Seismic and Other External Hazards

The licensee stated that the PVNGS, Unit 3, seismic PRA (SPRA) addressed both CDF and LERF. The licensee also stated that their risk management process for maintaining and updating the PRA ensured that the SPRA remains an accurate reflection of the as-built and as-operated plant. The licensee used RG 1.200, Revision 2, to address the technical adequacy of the SPRA to assure this PRA is capable of evaluating the risk impact from seismic hazards associated with the TS CT change for 3B EDG. Capability Category II of ASME/ANS RA-Sa-2009 was applied as the standard, and any identified deficiencies to those requirements were assessed further to determine any impacts to the risk evaluation.

In December 2013, a full-scope peer review of the SPRA was performed in accordance with NEI 12-13 (Reference 13) against the SRs of ASME/ANS RA-Sa-2009, as qualified by

RG 1.200, Revision 2. Attachment 11 of the LAR provided the F&Os from this peer review for SRs determined not met to CC II and the licensee's disposition to these F&Os. The licensee stated that no changes have been made to the SPRA subsequent to the peer review that would constitute an upgrade as defined by ASME/ANS RA-Sa-2009. Therefore, no additional peer reviews were performed to support the risk evaluation under this LAR.

The NRC staff evaluated the licensee's disposition of the F&Os associated with the SPRA and concludes that they were properly dispositioned to support the seismic PRA technical adequacy for the proposed one-time CT extension. Also, the seismic risk results presented by the licensee (i.e., ICCDP and ICLERP for the propos ed one-time CT extension) met the RG 1.177 risk acceptance guidelines by a large margin, providing confidence that any uncertainties associated with the SPRA would be unlikely to change the conclusions of this assessment.

Regulatory Position 2.3.2 of RG 1.177 states that the scope of the analysis should include all hazard groups (i.e., internal events, internal flooding, internal fires, seismic events, and other external hazards) unless it can be shown that the contribution from specific hazard groups does not affect the decision. All hazards not addressed using PRA were screened for applicability by a peer reviewed plant-specific evaluation in accordance with RG 1.200, Revision 2. There were no findings from this peer review. Attachment 13 of the LAR provides the results of the external hazards screening analysis. The NRC staff finds that the licensee followed RG 1.177 by performing quantitative or qualitative bounding analyses of other external hazards and determining that those hazards do not impact this application. In addition, the proposed compensatory actions listed in the LAR would reduce any risk associated with these external hazards.

PRA Results and Insights

The licensee evaluated the impact of the proposed change on plant risk using the internal events, internal flooding, internal fire, and seismic events PRA models. This risk evaluation is specific to the PVNGS 3B EDG outage with all relevant configurations represented in the PRA models, including:

• The 3B EDG was unavailable for the 62 day period.

• The increased potential for a common cause failure of 3A EDG was minimal during the 62 day period that 3B EDG was unavailable, based on the 3B EDG failure cause evaluation presented in Attachment 4 of the LAR. The staff's review of this failure cause

evaluation is provided in this SE. The sensitivity of calculated risk to this assumption was evaluated in Attachment 16 of the LAR by increasing the common cause failure probability for 3A EDG to the alpha factor value in the NRC common cause database. When crediting the portable diesel generators (DGs), the licensee's sensitivity analysis indicated that ICCDP and ICLERP met the RG 1.177 risk acceptance guidelines by a large margin as discussed in detail later in this SE.

• The risk evaluation used a zero test and maintenance model, because the licensee stated that elective maintenance on other risk-significant plant equipment will be prohibited during the 62 day period. The licensee stated that surveillance tests conducted during the 62 day period that will cause the tested equipment to be inoperable can be completed within the specified 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> completion time specified by TS 3.8.1.B.2. The testing elements that require this equipment to be declared inoperable during testing relate to use of temporary testing instruments or valve alignments that can be quickly restored, if needed. Therefore, the use of the average test and maintenance model was considered conservative based on controls being taken to eliminate unavailability of equipment for planned maintenance, and the low likelihood of corrective maintenance occurring during the 62 day repair period. The sensitivity to this assumption on risk was evaluated in Attachment 16 of the LAR by using the average test and maintenance PRA model. When crediting the portable DGs, the licensee's

sensitivity analysis indicated that ICCDP and ICLERP met the RG 1.177 risk acceptance guidelines by a large margin as discussed in detail later in this SE.

• The risk evaluation did not credit:

- The three portable DGs that were deployed at Unit 3 and connected to the 4.16 kV AC FLEX connection box, - The diesel-driven FLEX steam generator (SG) makeup pump, and

- Recovering from the failure of A or B EDGs.

• The risk evaluation credited the following compensatory measures, which were identified as commitments in Attachment 3 of the LAR:

- An additional dedicated auxiliary operator was added to each shift to implement the auxiliary feedwater cross-tie function.

- A continuous fire watch was posted in fire zone FCCOR2 (120' Corridor Building).

- Transient combustible and hot work exclusion zones were established in risk-significant fire zones through use of procedures and barriers/signage. These zones were walked down each shift.

In response to request for additional information APLA RAI-1 (Reference 14), the licensee explained how the FPRA model was adjusted to credit these three compensatory measures. The NRC staff concludes that these compensatory measures are appropriately reflected in the FPRA, because the adjustments are consistent with NRC guidance in NUREG-1921, "EPRI/NRC-RES Fire Human Reliability Analysis Guidelines" (Reference 17), NUREG/CR-6850, "EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, Volume 2: Detailed Methodology" (Reference 11), and NUREG/CR-6850, Supplement 1, "Fire Probabilistic Risk Assessment Methods Enhancements" (Reference 18). Also, the licensee included in the response a sensitivity analysis that quantitatively evaluated the impact of not crediting these three compensatory measures during the 3B EDG outage with credit for the portable DGs.

This sensitivity analysis indicated that the total ICCDP and ICLERP met the RG 1.177 risk acceptance guidelines by a factor of 1.6 and 5, respectively, providing additional confidence that any uncertainties associated with the modeling of these compensatory measures would be unlikely to change the conclusions of this assessment.

The licensee calculated total ICCDP and ICLERP based on the entire 62 day completion time for 3B EDG. These risk values are presented below.

ICCDP = 9.8 x 10

-6 (RG 1.177 Acceptance Guideline: < 1 x 10

-5 with effective compensatory measures implemented to reduce the sources of increased risk)

ICLERP = 2.8 x 10

-7 (RG 1.177 Acceptance Guideline: < 1 x 10

-6 with effective compensatory measures implemented to reduce the sources of increased risk)

The staff finds that the licensee met the appropriate risk measures specific to one-time only CT changes considering the compensatory measures discussed later in this SE, and is, therefore, acceptable.

Sensitivity and Uncertainty Analyses

Regulatory Position 2.3.5 of RG 1.177 states that the risk resulting from TS CT changes is often relatively insensitive to uncertainties, because uncertainties associated with CT changes tend to similarly affect the base case and the change case. Section 4.3.3, Attachment 15, and Attachment 16 of the LAR presented the uncertainty and sensitivity analyses associated with the risk evaluation for this proposed change.

Model uncertainties and related assumptions for the PVNGS PRAs were identified using guidance in NUREG-1855 (Reference 15) and EPRI TR-1016737 (Reference 16). In 5 of the LAR the licensee demonstrated that no additional sensitivity analyses were required to address these model uncertainties and related assumptions. To address potential uncertainties associated with the risk estimates for the proposed change, the licensee discussed numerous conservatisms of the PRA models, including:

• Firewater cross-connect to auxiliary feedwater was not credited in the Unit 3 IEPRA and IFPRA. This modification was only credited in the Unit 3 FPRA.

• Temporary equipment such as the three portable DGs and FLEX SG makeup pump were not credited in the PRAs. The DGs were only credited in the sensitivity analyses in 6 of the LAR.

• Fire events were assumed to, at a minimum, cause a loss of main feedwater and subsequent reactor trip.

• Simplified relay fragility analyses were performed that resulted in higher failure probabilities than if detailed fragility analyses had been performed. This over-estimates the failure probability of an emergency diesel generator during seismic events.

• Hot shorts were conservatively assumed to occur with enough electrical contact to impose full voltage on the "target conductor."

• Non-rated fire barriers were always assumed to fail.

• The main control room ventilation system was assumed unavailable or isolated during a fire event. This assumption was conservative since the use of the smoke purge system would remove heat and smoke from the room, improving habitability.

• It was assumed that containment isolation fails during all fire scenarios that necessitate main control room abandonment.

In response to NRC technical concerns, the licensee provided in Attachment 16 of the LAR the following sensitivity analyses associated with the proposed change:

• The licensee performed a sensitivity analysis of the proposed change that credited the portable DGs using the zero test and maintenance model. The portable DGs were conservatively credited in the FPRA and not credited in the IEPRA, IFPRA, and SPRA. Failure data used for the portable DGs was dominated by human error probability (0.322) to start the DGs. The only fire scenarios credited for portable DGs were those that allowed sufficient time to restore power to the Class 1E bus in order to recover safety functions and mitigate the event. The licensee stated that:

- Operators have been trained on the procedures for loss of offsite power that specify use of alternate power sources, including the portable DGs. - Training, briefings, and walkdowns have been provided to the operators responsible for operating the portable DGs.

- Designated operators were made familiar with instructions for starting and operating the portable DGs.

• It should be noted that use of the FLEX SG makeup pump was not credited in this sensitivity analysis. The sensitivity analysis indicated that ICCDP and ICLERP met the RG 1.177 risk acceptance guidelines by a factor of 3.7 and 8.3, respectively.

• The licensee performed a sensitivity analysis of the proposed change that credited the portable DGs using the average test and maintenance model. The portable DGs were modeled in the same manner as the first sensitivity analysis and use of the FLEX SG makeup pump was not credited. This sens itivity analysis indicated that ICCDP and ICLERP met the RG 1.177 risk acceptance guidelines by a factor of 1.5 and 5, respectively.

• The licensee performed a sensitivity analysis of the proposed change that credited the portable DGs using the zero test and maintenance model, and the common cause failure rate for 3A EDG was set to the alpha factor value (this represents common mode failure of the 3B EDG). The portable DGs were modeled the same as described in the first sensitivity analysis, and use of the FLEX SG makeup pump was not credited. The sensitivity analysis indicated that ICCDP and ICLERP met the RG 1.177 risk acceptance guidelines by a factor of 3.4 and 7.7, respectively.

Based on the margin by which the sensitivity analyses met the RG 1.177 risk acceptance guidelines and the multiple compensatory measures that the licensee committed to implement (or has already implemented), the NRC staff concludes that PRA model uncertainties are not sufficient to change the conclusions of the LAR. The LAR described how the PRA models were sufficiently complete and no new initiating events or failure modes were introduced by the proposed change and, therefore, the PRA models were able to adequately predict the change in CDF and LERF for the one-time CT extension. Based on the discussion above, the NRC staff finds that the licensee's assessment of sensitivity and uncertainty meets the guidance in RG 1.177.

3.3.4.2 Tier 2: Avoidance of Risk-Significant Plant Configurations Under the Tier 2 acceptance guideline in RG 1.177, the licensee should provide reasonable assurance that risk-significant plant equipment outage configurations would not occur when specific plant equipment is taken out of service in accordance with the proposed TS change.

Based on configuration-specific risk insights provided by the PVNGS IEPRA, IFPRA, FPRA, and SPRA, and as part of the PVNGS Configuration Risk Management Program, the licensee identified risk-significant combinations of equipment that if out-of-service during the 3B EDG

outage would significantly increase risk. Next, the licensee identified further compensatory actions and restrictions to avoid these high risk equipment outage combinations. Attachment 3 of the LAR discussed in detail these compensatory measures and commitments that would be implemented during the 3B EDG outage to ensure the risk impacts are acceptably low.

The NRC staff finds that the licensee provided an acceptable (i.e., consistent with RG 1.177) Tier 2 analysis of potential risk-significant configurations that could occur during the 3B EDG outage and used these risk insights to identify compensatory measures to preclude their occurrence. The staff notes that the licensee performed this Tier 2 analysis using PRA models of the appropriate scope, level of detail, and technical adequacy as discussed under the "PRA Quality" section of this SE. The staff also notes that the licensee's Tier 2 analysis used the base PRA, which conservatively does not credit FLEX equipment. The licensee used an approach consistent with RG 1.177, which provides reasonable assurance that risk-significant plant equipment outage configurations will not occur during the 3B EDG outage.

3.3.4.3 Tier 3: Risk-Informed Configuration Risk Management RG 1.177 states that Tier 3 is the establishment of an overall configuration risk management program to ensure that other potentially lower probability, but nonetheless risk-significant, configurations resulting from maintenance and other operational activities are identified and managed. RG 1.177 further states that the licensee program for compliance with 10 CFR 50.65(a)(4) ensures that the risk impact of out-of-service equipment is appropriately assessed and managed.

The licensee stated in Section 4.3.3 of the LAR that PVNGS has an established configuration

risk management program (CRMP) that implements 10 CFR 50.65(a)(4) requirements. The licensee stated that all maintenance activities associated with Unit 3 are assessed and managed per 10 CFR 50.65(a)(4) (Maintenance Rule) to evaluate the overall impact on risk of proposed plant configurations prior to, and during, the performance of maintenance activities that remove equipment from service.

Based on the above, the staff finds the licensee's Tier 3 program for complying with 10 CFR 50.65(a)(4) is consistent with the guidance of Section 16.1 of the SRP and RG 1.177 and, thus, is acceptable.

3.3.4.4 Conclusions

The licensee has demonstrated that the scope, level of detail, and technical adequacy of its PRA models are sufficient to support the proposed one-time completion time change to TS 3.8.1.B.4. The risk metrics used to support the LAR are consistent with RG 1.177. The NRC staff finds that the licensee has followed the three-tiered approach outlined in RG 1.177 to evaluate the risk associated with the proposed change and, therefore, the proposed change satisfies the fourth key safety principle of RG 1.177.

3.3.5 Key Principle 5: Performance Measurement Strategies - Implementation and Monitoring Program RG 1.174 and RG 1.177 establish the need for an implementation and monitoring program to ensure that no adverse safety degradation occurs because of the changes to the TS. An implementation and monitoring program is intended to ensure that the impact of the proposed TS change continues to reflect the reliability and availability of SSCs impacted by the change.

RG 1.177 states that the licensee is to use a three-tiered approach in implementing the proposed TS CT change. Application of the three-tiered approach is in keeping with the fundamental principle that the proposed change is consistent with the defense-in-depth philosophy. Application of the three-tiered approach provides assurance that defense-in-depth will not be significantly impacted by the proposed change. Furthermore, RG 1.177 states that, to ensure that extension of a TS CT does not degrade operational safety over time, the licensee should ensure, as part of its Maintenance Rule program (10 CFR 50.65), that when equipment does not meet its performance criteria, the evaluation required under the Maintenance Rule includes prior related TS changes in its scope.

The licensee provided a brief evaluation of the proposed TS change against the three tiered approach in the LAR. In addition, the 3B EDG is monitored under the PVNGS Maintenance Rule Program. If the pre-established reliability or availability performance criteria for the 3B EDG is exceeded, they are evaluated for 10 CFR 50.65(a)(1) actions, which requires increased management attention and goal setting in order to restore their performance to an acceptable level. Furthermore, the licensee described additional post maintenance monitoring and re-testing activities (e.g., isochronous load testing, 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> loaded run with 100% load reject) that will provide assurance that the long-term reliability of the SSC impacted by the change (i.e., the 3B EDG) is not degraded.

The staff concludes that the implementation and monitoring program for the proposed TS change described by the licensee satisfies the fifth key safety principle of RG 1.177.

3.4 Comparison with Regulatory Guidance

As discussed in detail in this SE, within the scope of APLA's review, the licensee's proposed change is consistent with RG 1.174, RG 1.177, SRP Sections 19.1 and 16.1.

4.0 CONCLUSION

The NRC staff finds that the risk impact of the licensee's request for a one-time extension of the completion time of TS 3.8.1.B.4 from 10 days to 62 days, as estimated by ICCDP and ICLERP, is consistent with the acceptance guidelines specified in RG 1.177 and the staff guidance outlined in Sections 19.1 and 16.1 of NUREG-0800. The licensee's methodology for assessing the risk impact is accomplished using PRA models of sufficient scope and technical adequacy.

For external hazards not explicitly modeled by PRA, the licensee used qualitative or bounding analyses. The NRC staff finds that the licensee has followed the three-tiered approach and performance monitoring programs outlined in RG 1.177.

5.0 REFERENCES

1. Letter from G. Andrews, Arizona Public Service Company, to NRC, "Palo Verde Nuclear Generating Station (PVNGS), Unit 3, Docket No. STN 50-530, Renewed Operating License No. NPF-74, Emergency License Amendment Request to Extend Diesel Generator 3B Completion Time," December 30, 2016 (ADAMS Accession No. ML16365A240).

2. Regulatory Guide 1.174, Revision 2, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," May 2011 (ADAMS Accession No. ML100910006).

3. Regulatory Guide 1.177, Revision 1, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," May 2011 (ADAMS Accession No. ML100910008).

4. Regulatory Guide 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities,"

March 2009 (ADAMS Accession No. ML090410014). 5. NUREG-0800, Standard Review Plan 19.2, "Review of Risk Information Used to Support Permanent Plant-Specific Changes to the Licensing Basis: General Guidance," June 2007 (ADAMS Accession No. ML071700658).

6. NUREG-0800, Standard Review Plan Section 19.1, Revision 3, "Determining the Technical Adequacy of Probabilistic Risk Assessment for Risk-Informed License Amendment Requests After Initial Fuel Load," September 2012 (ADAMS Accession No. ML12193A107).

7. NUREG-0800, Standard Review Plan Section 16.1, Revision 1, "Risk-Informed Decision Making: Technical Specifications," March 2007 (ADAMS Accession No. ML070380228).

8. ASME/ANS PRA Standard ASME/ANS RA-Sa-2009, "Addenda to ASME/ANS RA-S-2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications."

9. NEI 00-02, "Probabilistic Risk Assessment Peer Review Process Guidance," Revision A3, Nuclear Energy Institute, Washington, DC, March 20, 2000.

10. Nuclear Energy Institute, Letter from Anthony Pietrangelo, Director of Risk- and Performance-Based Regulation Nuclear Generation, Nuclear Energy Institute, to Mary Drouin, Office of Nuclear Regulatory Research, U.S. Nuclear Regulatory Commission, Washington, DC, "NEI 00-02, 'Probabilistic Risk Assessment Peer Review Process Guidance,' Revision 1," May 19, 2006 (ADAMS Accession No. ML061510621).

11. Nuclear Energy Institute, Letter from Bi ff Bradley, Manager of Risk Assessment, Nuclear Energy Institute, to Mary Drouin, Office of Nuclear Regulatory Research, U.S. Nuclear Regulatory Commission, Washington, DC, "Update of Appendix D to Revision 1 of NEI 00-02, Probabilistic Risk Assessment Peer Review Process Guidance," November 15, 2006.

12. NEI 05-04, "Process for Performing Follow-On PRA Peer Reviews Using the ASME PRA Standard," Revision 2, Nuclear Energy Institute, Washington, DC, November 2008.

13. NUREG/CR-6850, "EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, Volume 2: Detailed Methodology," September 2005 (ADAMS Accession No. ML052580118).

14. NEI 07-12, "Fire Probabilistic Risk Assessment (FPRA) Peer Review Process Guidelines," Revision 1, Nuclear Energy Institute, July 2010.

15. NEI 12-13, "External Hazards PRA Peer Review Process Guidelines," Nuclear Energy Institute, August 2012.

16. Letter from G. Andrews, Arizona Public Service Company, to NRC, "Palo Verde Nuclear Generating Station (PVNGS), Unit 3, Docket No. STN 50-530, Renewed Operating License No. NPF-74, Response to NRC Requests for Additional Information (RAIs) Regarding Emergency License Amendment Request (LAR) to Extend Diesel Generator 3B Completion Time," January 2, 2017 (ADAMS Accession No. ML17002A001).

17. NUREG-1855, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making," March 2009.

18. EPRI TR-1016737, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments," December 2008.

19. NUREG-1921, "EPRI/NRC-RES Fire Human Reli ability Analysis Guidelines," July 2012 (ADAMS Accession No. ML12216A104).

20. NUREG/CR-6850, Supplement 1, "Fire Probabilistic Risk Assessment Methods Enhancements," September 2010 (ADAMS Accession No. ML103090242).

Principal Contributor: Todd Hilsmeier, NRR/DRA