ML092440433

Attachment 2 - License Amendment Request 249, Kewaunee Power Station Conversion to Improved Technical Specifications, Background and Technical Analysis for Adoption of WCAP-10271, WCAP-14333 (TSTF-418), and WCAP-15376 (TSTF-411)

ML092440433
Person / Time
Site:	Kewaunee
Issue date:	08/24/2009
From:	Dominion Energy Kewaunee
To:	Office of Nuclear Reactor Regulation
References
09-491
Download: ML092440433 (31)

Text

Serial No.09-491

ATTACHMENT 2

LICENSE AMENDMENT REQUEST 249 KEWAUNEE POWER STATION CONVERS ION TO IMPROVED TECHNICAL SPECIFICATIONS

BACKGROUND AND TECHNICAL ANALYSIS FOR ADOPTION OF WCAP-10271, WCAP-14333 (TSTF-418), AND WCAP-15376 (TSTF-411)

KEWAUNEE POWER STATION DOMINION ENERGY KEWAUNEE, INC.

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 1 of 30 ATTACHMENT 2 OUTLINE

3.0 TECHNICAL ANALYSIS

3.1 Current Design 3.2 Basis for the Change 3.3 Technical Evaluation for Changes in WCAP-10271-P-A 3.4 Technical Evaluation for Changes in WCAP-14333-P-A 3.5 Technical Analysis fo r Changes in WCAP-15376-P-A 3.5.1 Tier 1, Core Damage Frequency Assessment 3.5.2 Tier 1, Incremental Conditional Core Damage Probability 3.5.3 Tier 1, Large Early Release Frequency Assessment 3.5.4 Tier 1, Incremental Conditional Large Early Release Probability Assessment 3.5.5 Tier 1, PRA Scope and Quality 3.5.5.1 Scope of the PRA Model 3.5.5.2 Technical Adequacy 3.5.5.3 Internal Events 3.5.5.4 Peer Review 3.5.5.5 Self Assessments 3.5.5.6 External Events 3.5.5.7 Seismic PRA 3.5.5.8 Fire PRA Model 3.5.5.9 PRA Maintenance and Update 3.5.5.10 Conclusions on PRA Technical Adequacy and Scope 3.5.6 Tier 1, Cumulative Impacts 3.5.7 Tier 2, Avoidan ce of Risk-Significant Plant Configurations 3.5.8 Tier 3, Risk-Informed Pl ant Configuration Control and Management 3.5.9 WCAP-15376 SER Conditions 3.5.10 Additional Commitment from NRC RAI

4.0 REFERENCES

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 2 of 30 BACKGROUND AND TECHNICAL ANALYSIS FOR ADOPTION OF WCAP-10271, WCAP-14333 (TSTF-418), AND WCAP-15376 (TSTF-411)

1.0 BACKGROUND

In the early 1980s, in response to growing co ncerns regarding the impact of the current testing and maintenance requirements on plant operation, t he Westinghouse Owners Group (WOG) initiated a program to develop a justification to be used to revise generic and plant specific instrumentation TS (part of the Technical Specification Optimization Program (TOPS)). Operati ng plants experienced many i nadvertent reactor trips and safeguards actuations during performance of instrumentation surveillances, causing unnecessary transients and challenges to safety systems. Significant time and effort on the part of the operating staf f was devoted to performing, re viewing, documenting, and tracking the various surveillance activiti es, which in many instances seemed unwarranted based on the high reliability of the equipment. Significant benefits for operating plants appeared to be achievable thr ough revision of instrumentation test and maintenance requirements.

The results of the WOG studies, and the recommended changes to the testing of reactor protecti on and engineered safeguards instrumentation, were documented in WCAP-10271-P-A and WCAP-10271-P-A, Supplement 1, both titled, "Evaluation of Surveillance Frequencie s and Out of Service Times for the Reactor Protection Instrumentation System," (references 1 and 2), and in WCAP-10271-P-A, Supplement 2, Revision 1, "Evaluation of Surveillance Frequencies and Out of Service Times for the Engineered Safety Featur es Actuation System," (reference 3).

In February 1985, the Nuclear Regulatory Commission (NRC) issued the safety evaluation report (SER) (reference 4) for WCAP-10271 and WCAP-10271 , Supplement

1. The SER approved quarterly testing, six hours to place a failed channel in a tripped mode, increased completion times (CTs) (also referred to as allowed outage times (AOTs)) for test and maintenance, and testing in bypass for analog channels of the reactor trip system (RTS) (reactor protection system (RPS) at Kewaunee). The quarterly testing had to be conducted on a staggered basis. The SER specifically stated that for analog channels shared by the RTS and the engineered safety feature actuation system (ESFAS), the approved relaxa tions applied only to the RTS function.

On March 20, 1986, the WOG submitted WCAP-10271, Supplement 2, "Evaluation of Surveillance Frequencies and Out of Service Ti mes for the Engineered Safety Systems Actuation System." On May 12, 1987, the WOG submitted WCAP-10271, Supplement 2, Revision 1. Supplement 2 and Supplemen t 2, Revision 1 specifically demonstrated the applicability of the just ification contained in WCAP-10271 to the ESFAS for two, three, and four loop plants with either relay or solid state protection systems. In February 1989, the NRC issued an SER for WCAP-10271, Supplement 2 and WCAP-10271, Supplement 2, Revision 1 (reference 5). The SER approved quarterly testing, six hours to place a failed channel in a tripped mode, increased CTs for test and maintenance and testing in bypass for analog channels of the ESFAS. Staggered Serial No.09-491 Docket No. 50-305 Attachment 2 Page 3 of 30 testing was not required for ESFAS analog c hannels and the requirement was removed from the RTS analog channels.

The NRC issued a Supplemental SER (SSER) for WCAP-10271, Supplement 2 and Supplement 2, Revision 1 (reference 6) on April 30, 1990. With the issuance of the SER and SSER, the relaxations for the analog channels of the RTS and ESFAS were the same. Additionally, the CTs for test and maintenance of the RTS and ESFAS actuation logic were also the same.

In 1992, the NRC completed an evaluation of surveillance testing at power, which indicated that testing in many areas could be reduced without any significant decrease in safety. These findings and recommendations are documented in NUREG-1366, "Improvement to Technical Specifications Surveillance Requirements," (reference 7) and Generic Letter 93-05, "Line-Item Technical Specifications Improvements to Reduce Surveillance Requirements for Testing Du ring Power Operation" (reference 8).

Reduced surveillance testing of the R PS and ESFAS analog instrumentation was recommended in both of these documents.

In June 1995, the WOG submitted WCAP-14333, "Probabilistic Risk Analysis of the RTS and ESFAS Test Times and Completion Ti mes," Revision O. The report proposed further relaxation of the WCAP-10271 approved TS requirement s by increasing the test bypass times (BTs) and the CTs for both the solid state protection system and relay protection system RTS and ESFAS designs.

In WCAP-14333, the WOG evaluated the impact on core damage frequency (CDF) and public risk of additional time for testing and extended CTs for the RPS and ESFAS. The additional time allowance was an extension fr om 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for the test CT for analog channels, an extension from 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for the allowed bypass time for analog channels, a CT change from 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for logic cabinet, and a CT change from 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for the master relays.

This WCAP did not propose additional extensions of any surveillance test intervals (STls). On July 15, 1998, the NRC completed a review of WCAP-14333, Revision 1 (reference 9) for reference in license applications contingent on meeting conditions listed in the NRC SER (reference 10). The WOG issued implementation guidance for WCAP-14333 on December 2, 1998 (reference 11).

By letter dated November 8, 2000, the WO G submitted WCAP-153 76, Revision 0, "Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times." Topical Report WCAP-15376 provides the technical justification for increasing the CT and bypass time (BT) for the reactor trip breaker (RTB).

It also provides the just ification for increasing the surveillance test interval for the RTB, analog channels, and logic cabinets for components of the RTS and ESFAS. The approach used in this topical report is consistent with the NRC approach for using probabilistic risk assessment in risk-Serial No.09-491 Docket No. 50-305 Attachment 2 Page 4 of 30 informed decisions on plant specific changes to the current licensin g basis as presented in Regulatory Guide (RG) 1.174, "An Appr oach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Current Licensing Basis," (reference 12) and RG 1.177, "An Approac h for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," (reference 13).

The NRC approved WCAP-15376 for referencing in license change submittals on December 20, 2002 (reference 14). The WOG issued implementation guidance for WCAP-15376 on April 3, 2003 (re ference 15). The WOG re issued the implementation guidance with slight editorial c hanges on May 6, 2004 (reference 16).

The NRC required that applicants for TS amendments concerning all of the above WCAPs meet certain plant specific conditi ons. The plant specific conditions are stipulated in the SERs and SSER for all WCAP and supplements discussed above.

DEK addresses the stipulated conditions of WCAP-10271 and WCAP-14333 SERs and SSER for Kewaunee in the technical analysis below since the stipulated plant specific conditions of the previous reports consti tute a basis for the changes evaluated in WCAP-15376. The evaluations are present ed in Section 2.0 under the appropriate WCAP heading.

2.0 PROPOSED CHANGE

DEK is proposing to conver t the Kewaunee current Techni cal Speciations (CTS) to a format and content consistent with NUREG 1431, Revision 3.0, "Standard Technical Specifications - Westinghouse Plants." The specific propos ed changes are identified and explained in Attachment 1.

3.0 TECHNICAL ANALYSIS

3.1 Current Design The Reactor Protection System (RPS) conti nuously monitors selected process variables associated with fission product design barrier limits that define the boundaries for safe reactor power operation. The RPS trips the r eactor and returns the co re to a subcritical condition if the value of any single monitored process variable approaches its associated barrier design limits.

The system consists of electronic equipment (circuitry, cables, relays, etc.) necessary to monitor the selected process variables and to generate the reactor trip signals when a design limit is challenged. If a reactor trip is required, two reactor trip breakers are actuated by two separate logic matrices that interrupt power to the control rod drive Serial No.09-491 Docket No. 50-305 Attachment 2 Page 5 of 30 mechanisms (CRDMs). Opening ei ther reactor trip breake r interrupts power to all CRDMs, allowing them to free fa ll into the core. The RPS also monitors other plant systems for conditions or events that could cause barrier design limits to be challenged.

The RPS is designed for high functional reliability and in-service testability to avoid undue risk to the health and safety of the pub lic. Tests are made by use of signal substitution techniques during power operat ion without negating reactor protection. Removal of one trip channel is accomplish ed by placing that channel in the tripped mode. Therefore, a two-out-of-three c hannel becomes a one-out-of-two channel when testing. Redundancy and independence designed into the RPS must be sufficient to ensure that no single failure or removal from service of any component or channel of the system results in a loss of the protection function. The redundancy provided must include, as a minimum, two channels of prot ection for each protection function to be served. 3.2 Basis for the Change The technical basis for the proposed changes to the completion times, bypass times, STIs, and the RTB CT includes the We stinghouse Owners Group (WOG) studies documented in the originals, supplement s, and revisions of WCAP-10271, WCAP-14333, and WCAP-15376 (references 1, 2, 3, 9, and 17), which have all been reviewed and approved by the NRC staff. Additionally , the NRC staff recommended the TS be changed in NUREG-1366, "Improvements to Technical Specifications Surveillance Requirements," (reference 7) and GL 93-05, "Line-Item Te chnical Specifications Improvements to Reduce Surveillance Requirements for Testing during Power Operation," (reference 8). Standard TS Change Travelers (TSTF-411 and TSTF-418), which incorporate the changes from WCAP-14333 and WCAP-15376 into Standard Technical Specifications (STS), have been is sued by the Nuclear Energy Institute (NEI) and reviewed and approved by the NRC (references 18 and 19).

The STI, CT, and bypass time changes in WCAP-10271 were justified for a large number of RPS and ESFAS signals that are common to most plants.

The STIs, CTs, and bypass times for signals not specifically address ed in WCAP-10271 cannot be changed based on WCAP-10271 without a plant specific tec hnical justification. DEK reviewed WCAP-10271 to ensure the signal applicability and found that two logic configurations required plant specific justification to apply WCAP-10271. The following technical justifications allow applying the changes justified in WCAP-10271, and subsequently WCAP-14333 and WCAP-15376, to the two configurations described below:

1. Low Flow Both Loops (Kewaunee T able TS 3.5-2, item number 10)

WCAP-10271, Supplement 1, Table 3.2-3, "Results of Fault Tree Analysis for A Relay Logic Reactor Protection System,"

does not address the loss of flow in both loops trip for a two loop plant. For Kewaunee's configuration, the logic is Serial No.09-491 Docket No. 50-305 Attachment 2 Page 6 of 30 2 of 3 in 2 of 2 loops, a failure in either loop would cause a failure to trip. Thus, the failure to trip probability can be calculated by doubling the value for an individual loop, which is doc umented in Table 3.2-3 of the WCAP. The following shows the results of this justification:

Table 3.1 Failure to Trip Probability for Comparison Base Case, no CC(1) Case 1, no CC Base Case, CC Case 1, CC 1.5E-4 3.8E-4 3.2E-4 6.4E-4 (1) CC = common cause These values are still within the range of the signals in Table 3.2-3 of the WCAP.

The bases for the conclusions of WCAP-10271, Supplement 1 (less than a factor of six increase with no common cause and less than a factor of four increase with common cause) apply to this signal as we ll. Therefore, the conclusion of WCAP-10271, Supplement 1, that an increase of surveillance interval is acceptable, applies to the Kewaunee low flow both loops trip as well.

2. Containment Spray (Table TS 3.5-3, item number 3.b)

The containment spray logic in the WCAP-10271, Supplement 2 analysis is two-out-of-four, whereas the logic at Kew aunee is one-out-of-two three times. An increase in the failure probabi lity of the containment spray signal is of very little consequence at Kewaunee due to robust design of Kewaunee's large dry

containment. In the current Kewaunee PR A model, a complete failure of the containment spray system has no e ffect on core damage frequency (CDF) or large early release frequency (LERF). As a result, the failure of the initiating signal for containment spray has no effe ct on CDF or LERF and an increased surveillance interval is of very little consequence at Kewaunee.

Based on the above, the two Kewaunee specific c onfigurations are justified to be of low risk significance. The changes justified in WCAP-10271, and subsequently in

WCAP-14333 and WCAP-15376, can be applied to Kewaunee.

Implementation of the propos ed changes does not reduce safety. The proposed STI changes will reduce the required testing on the RPS and ESFAS components without significantly impacting their reliability, and reduce the potential for reactor trips and actuation of engineered safety features associated with more frequent testing of these components. The CT extension for the RTBs pr ovides additional time to complete test and maintenance activities while at power, po tentially reducing the number of forced outages related to compliance with the RTB TS. Additionally, NUREG-1366 and Generic Letter (GL) 93-05 both support this proposed change by stating that safety can be improved, equipment degradat ion decreased, and unnecessary burden on personnel Serial No.09-491 Docket No. 50-305 Attachment 2 Page 7 of 30 and resources eliminated by reducing the amount of testing that the TS require during power operation.

3.3 Technical Evaluation for Changes in WCAP-10271-P-A In February 1985, the NRC issued the SER (reference 4) for WCAP-10271 and WCAP-10271, Supplement 1. In February 1989, the NRC issued the SER for WCAP-10271, Supplement 2 and WCAP-10271, Supplement 2, Revision 1 (reference 5). The following table prov ides a summary of the changes from WCAP-10271 and its supplements.

Table 3.2 Summary of WCAP-10271 (TOP) RTS and ESFAS Surveillance Test Interval, Completion Time, and Bypass Time Ch anges - Relay Protection Systems Component STI Completion Time Bypass Time Analog Channel 1 month to 3 months1 hours1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 2 hours to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Logic Cabinet No change 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> to 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 3 hours to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> Master Relay No change No change 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> Slave Relay No change No change 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Reactor Trip Breakers No change No change No change In WCAP-10271, and its supplements (references 1, 2, and 3), the WOG evaluated the impact of increased STIs and CTs and their e ffect on CDF and public risk. The NRC staff concluded in its evaluat ion that an overall upper bound of CDF increase due to the proposed STI and CT changes is less than six percent for Westinghouse pressurized water reactor (PWR) plants. The NRC also concluded actual CDF increases for individual plants were expected to be substantially less than six percent. The NRC staff considered this CDF increase to be small co mpared to the range of uncertainty in the CDF analyses and, theref ore, was acceptable.

To incorporate the extended times from WCAP-10271 and its supplements, the NRC required that an applicant for a TS amendment meet certain plant specific conditions stipulated in the SERs and SSER. The five conditions in the NRC SER dated February 21, 1985 (reference 4) were to be applied to R PS instrumentation.

The two conditions in the NRC SER and SSER dated February 22, 1989 (reference 5), and April 30, 1990 (reference 6), were to be applied to the ESFAS instrumentation.

The generically approved changes to the anal og channel STIs, CTs, and BTs specified in WCAP-10271, including its supplements, have not been amended into the Kewaunee TS. DEK has addressed each SER condition bel ow since these stipulated plant specific conditions constitute part of the basis for the changes evaluated in WCAP-15376 (specifically, the analog channel STI from o ne month to three months is adopted with Kewaunee's proposed change from one month to six months).

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 8 of 30

1. The RPS SER requires the use of a staggered test plan for the RPS channels changed to the quarterly testing frequency.

DEK Response: The NRC staff subsequently concluded that a staggered test strategy need not be implemented for ESFAS analog channel testing and is no longer required for RPS analog channel testing (reference 5). This NRC conclusion was based on the small relative contribution of the analog channels to RPS/ESFAS unavailability, process par ameter signal diversity, and normal operational channel testing spacing.

2. The RPS SER requires that plant procedures require a common cause evaluation for failures in the RPS analog channels changed to quarterly testing frequency and additional testing for plausible common cause failures.

DEK Response:

In accordance with Kewaunee's Corrective Action Program (CAP), and existing plant procedures, all equipment operability concerns (including equipment in the RPS and ESF AS) are immediately reported to the Shift Manager and entered into the corrective action process. Initiation of a condition report (CR) results in entry into the CAP. In the CAP, the request is screened for operability and reportability as well as a determination of the conditions' significance. If the significance of the condition reaches a level requiring an apparent cause evaluation (A CE) to be performed, an extent of condition evaluation is also performed.

The extent of condition ev aluation describes how the problem (condition) extends to other equipment, procedures, processes or organizations (the condition is the identified problem/event).

This review identifies the susceptible population (people, equipment, or processes) that could potentially be affected and then determines if they actually are affected.

The intent is to identify additional vulnerabilities and take prompt corrective action prior to the onset of additional consequences.

A review of Kewaunee's procedures dete rmined that a failure in the RPS analog channel may not cause an ACE to be performed and that Kewaunee procedures do not contain direction to perform additi onal testing for plausible common cause failures.

On implementation of a license amendment approving extension of these STIs, DEK will add procedure direction to perfo rm an extent of condition evaluation and perform additional testing for plausi ble common failure modes (refer to attachment 5, commitment 8).

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 9 of 30

3. The RPS SER requires installed hardware capability for testing in the bypass mode. That approval of routine channel testing in a bypassed condition is contingent on the capability of the RPS design to allow such testing without lifting leads or installing temporary jumpers.

DEK Response: Kewaunee's RPS is designed to test analog channels in the trip mode. Testing is performed by placing the channel being tested in the tripped mode rather than bypassing the channel. The result is the logic being reduced to one-out-of-two logic for a two-out-of-three logic channel and

one-out-of-three logic for a two-out-of-four logic channel. If a channel failure occurs, and the failed channel is not the one being tested, the logic is reduced to one-out-of-one. This logic results in permitting the remaining operable channel to trip the reactor if necessary. A channel fa iling to a trip condition during testing of another channel results in a reactor trip.

Testing in bypass is allowed by TS 3.5.

b and TS 3.5.d for a short period of time (approximately 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />) for on-line testi ng or in the event of failure of a subsystem instrumentation channel where the failed channel must be blocked to prevent unnecessary reactor trip. The TS would apply during a maintenance

activity. Therefore, it is acceptable to use temporary jumpers as required to complete testing. The TS is not rout inely entered for surveillance testing.

4. The RPS SER indicated that, for cha nnels that provide input to both the RPS and the ESFAS, the more stringent ESFAS requirements still apply.

DEK Response: The extensions generically approved in the SER and SSER for the ESFAS analog channels (references 5 and 6) were the same as those

approved for the RPS analog channels. Therefore, this condition from the RPS SER is no longer applicable.

5. The RPS SER requires confirmati on that the instrument setpoint methodology includes sufficient margin to offset the drift anticipated as a result of less frequent surveillance.

DEK Response:

This condition of WCAP-10271 is also a stipulated condition of WCAP-15376 and is addressed in the technical analysis of WCAP-15376.

6. The ESFAS SER and SSER required confirmation of the applicability of the generic analyses to the plant.

DEK Response:

The generic analyses used in WCAP-10271 and its supplements are applicable to Kewaunee.

Kewaunee Power Station uses the Foxboro H-Line Process Control System and the Westinghouse Relay Protection System for both the Engineered Safety F eatures and Reactor Protection System.

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 10 of 30 Both of these systems were modeled in the generic analyses. For logic configurations not modeled in the generic analysis, DEK has provided a technical justification for applying the generic changes to Kewaunee. Additionally, information provided in attachments 3 (proprietary) and 4 (non-proprietary) demonstrates the applicability of the generic WCAP analysis to Kewaunee's ESFAS and RPS. These tables are based on implementation guidelines that were issued by the WOG for licensees im plementing the TS CT and BT changes that were justified in WCAP-14333 and the STI and CT changes justified in WCAP-15376.

7. The ESFAS SER and SSER required confirmation that any increase in instrument drift due to the extended STIs is properly accounted for in the setpoint calculation methodology.

DEK Response:

This condition of WCAP-10271 is also a stipulated condition of WCAP-15376 and is addressed in the technical analysis of WCAP-15376.

3.4 Technical Evaluation for Changes in WCAP-14333-P-A In WCAP-14333, the WOG proposed and justified further extensions of the RPS and ESFAS CTs and BTs. This WCAP did not pr opose additional extensions of any STIs. The NRC approved these generic CT and BT extensions in an SER dated July 15, 1998 (reference 10). The table below summarize s the changes evaluated in WCAP-14333.

Table 3.3 Summary of WCAP-14333 RPS and ESFAS Completion Time and Bypass Test Time Changes - Relay Protection Systems Component STI Completion Time Bypass Time Analog Channel No change 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> 4 hours to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Logic Cabinet No change 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> No change Master Relay No change 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> No change Slave Relay No change 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> No change Reactor Trip Breakers No change No change No change

The SER for WCAP-14333 indicated that the increase in CDF and LERF for those plants that have not implemented the changes evaluated in WCAP-10271, and its supplements, is small. Specifically, for two-out-of-three and two-out-of-four logic, the increases in CDF are approximately 3.1 percent and 2.3 percent, respectively. The LERF would increase by only four percent for both two-out-of-th ree and two-out-of-four logic schemes. The NRC staff concluded the implementation of the changes specified in WCAP-14333 would result in a very small quantitative impact on plant risk.

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 11 of 30 The NRC staff required that an applicant for a proposed amendment incorporating the extended times into their TS mu st meet certain plant specific conditions stipulated in the SER. DEK has addressed each of the condi tions stipulated in the WCAP-14333 SER below.

1. Confirm the applicability of the WCAP-14333 analyses for the plant.

DEK Response:

The information provided in a ttachment 3 (proprietary) and 4 (non-proprietary) demonstrates the applicability of the generic WCAP-14333 and WCAP-15376 analysis to Kewaunee. The tabl es in the attachments are from the implementation guidelines issued by the WOG for licensees implementing the TS changes supported by the WCAPs.

2. Address the Tier 2 and 3 analy ses including the Configuration Risk Management Program (CRMP) insights which confirm that these insights are incorporated into the decision making process before taking equipment out of service.

DEK Response: This stipulated condition is addressed below in the technical analysis section for WCAP-15376.

3.5 Technical Analysis fo r Changes in WCAP-15376-P-A In WCAP-15376, the WOG provided the technical basis to just ify extending the STIs for the analog channels, the logic cabinets, and RTBs, and for extending the CT and BT for the RTBs. The NRC approved WCAP-15376 on December 20, 2002 (reference 14).

The table below summarizes the changes evaluated in WCAP-15376.

Table 3.4 Summary of WCAP-15376 RPS and ESFAS Surveillance Test Frequency, Completion Time, and Bypass Test Time Changes - Relay Protection Systems Component STI Completion Time Bypass Time Analog Channel 3 months to 6 months No change No change Logic Cabinet 1 month to 6 monthsNo change No change Master Relay No change No change No change Slave Relay No change No change No change Reactor Trip Breakers 2 months to 4 months 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 2 hours to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />

The Kewaunee STIs or test frequencies ar e closely aligned with the pre-technical specification optimization program (pre-TOP) values since the extensions generically approved in WCAP-10271, its suppl ements, and WCAP-14333 have not been Serial No.09-491 Docket No. 50-305 Attachment 2 Page 12 of 30 incorporated into the Kewaunee TS. The tables below compare the current Kewaunee TS times with the pre-TOP times, and t he WCAP-15376 times (i.e., the proposed TS times).

Table 3.5 STI Comparison for KEWAUNEE Component Current STI Pre-TOP STI WCAP-15376 (Proposed TS) Analog Channels 1 month 1 month 6 months Logic Cabinets 1 month 2 months 6 months Reactor Trip Breakers 1 month 2 months 4 months (a) Note:

(a) DEK will not include the RTB STI change because the WCAP analysis for this change is not applicable to Kewaunee.

Table 3.6 CT Comparison for KEWAUNEE Component Current TS Pre-TOP WCAP-15376 (Proposed TS) Reactor Trip Breakers 0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> (a) 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 24 hours Note:

(a) The current Kewaunee TS does not provide for a restoration time.

The risk-informed approach used in WCAP-15376 is consistent with the NRC approach for using probabilistic risk assessment in ri sk-informed decisions on plant-specific changes to the current licensing basis. The NRC's approach is pres ented in RG 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Current Licensing Basis," (r eference 12) and RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decision making: Technical Specifications," (reference 13). The risk evaluation considers t he three-tiered approach as presented in RG 1.177. Tier 1, "PRA Capabilities and Insights," assesses the impact of the proposed CT (AOT) change on CDF, incremental conditional core damage probability (ICCDP), LERF, and incremental conditional large early release probability (ICLERP). Tier 2, "Avoidanc e of Risk-Significant Plant Configurations," considers potential risk-significant plant operating conf igurations. Tier 3, "Risk-Informed Plant Configuration Control and Manag ement," considers risk evaluations of configurations when entered on a plant-specific basis.

3.5.1 Tier 1, Core Damage Frequency Assessment WCAP-15376 compares the cumulative im pact of the proposed STI changes and the RTB CT changes on CDF using the pre-TOP values as t he basis. This comparison Serial No.09-491 Docket No. 50-305 Attachment 2 Page 13 of 30 credits the expected reduction in reactor trips due to the r educed analog channel testing resulting from extending t he analog channel STIs from m onthly to quarterly, as evaluated in WCAP-10271 and its supplements. The comparison indicates that the cumulative impact on CDF when using the pre-TOP values as the base case is 5.7E-7 per year for two-out-of-four logic and 1.1E-6 per year for two-out-of-three logic. These values are for the reference plant. T hey are applicable to Kewaunee because the Kewaunee parameters are within the limits described in WCAP-15376. They are conservative because they assume an increase in the STI for reactor trip breakers, which is not being implement ed at Kewaunee. Since th e Kewaunee parameters in attachments 3 (proprietary) and 4 (non-pr oprietary) are bounding for Kewaunee, the Kewaunee values for the change in core damage frequency (CDF) are less than or equal to the reference plant values. These are small increases to the CDF, per the acceptance criteria of 1.0E-5 per year given in RG 1.174.

The reference plant values are for internal events only. Internal fires and external events have been evaluated on a plant specific basis and the results follow. The frequency of a seismic event is several orders of magnitude below that of a reactor trip.

Furthermore, the RPS is seismically designed so its failure rate would also be very low.

As a result, the seismic initiator is not im portant to anticipated transient without scram (ATWS). A seismic event that would result in the need for engineered safety feature (ESF) actuation (e.g., a LOCA) would be extrem ely unlikely. As a result, ESF actuation is also not important to the seismic ev ent. The Kewaunee seis mic PRA shows that instrumentation has a very high seismic capacity. As a result, the impact of this change on seismic risk is negligible.

The frequency of an internal fire is also se veral orders of magnitude below that of a reactor trip. The combined frequency of a fire and an ATWS would be very small compared to the internal events ATWS frequency.

If a severe fire occurs, affecting the ability to shut down safely, operators are directed to enter operating procedures OP-KW-AOP-FP-002, "Fire in an Alternate Zone" or OP-KW-AOP-FP-003, "Fire in a Dedicated Zone." These procedures do not rely on ESF actuation, but on manual action to start all necessary equipment.

Other external events, (high winds, floodi ng, etc.) were evaluated in the Kewaunee individual plant evaluation for external events and determined to be unimportant due to their low initiating event frequen cy. The frequency of these initiators is not affected by the proposed changes.

The overall CDF for the internal events average maintenance model used in this assessment is 4.2E-05/yr. As stated in Refe rence 20 the external events CDF is 4.7E-05/yr. Thus, the total CDF is 8.9E-05/yr. Since the CDF is less than 1.0E-05/yr and the total CDF is less than 1.0E-04/yr, the incr ease is within Region II of Figure 3 of RG 1.174. Therefore, the proposed changes are acceptable.

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 14 of 30 3.5.2 Tier 1, Incremental Conditional Core Damage Probability The ICCDP calculations are a direct function of the duration of a CT, and therefore, only apply to the CT change for the reactor trip breakers. Calculat ions were performed considering two CTs; 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> for maintenan ce and 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for a test. The resulting calculated values were below 5.0E-07 for both CTs. The WCAP-15376 calculation of the ICCDP increase for the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> CT (i.e., the proposed CT for Kewaunee) was 6.92E-08, which is below the RG 1.174 value of 5.0E-07. They are applicable to Kewaunee because the Kewaunee parameters are withi n the limits descri bed in WCAP-15376. Since the Kewaunee parameters in attachme nts 3 (proprietary) and 4 (non-proprietary) are bounding for Kewaunee, the Kewaunee value for the ICCDP is less than or equal to the reference plant values. This is considered very small for a single TS CT per RG

1.177. 3.5.3 Tier 1, Large Early Release Frequency Assessment The WCAP-15376 base case used LERF values of 2.38E-06 per year for two-out-of-four logic and 2.44E-06 per year for two-out-o f-three logic. WCAP-15376 documented the combined impact on LERF due to the changes proposed by the WCAP. The LERF

impact was an increase of 3.09E-08 per year for two-out-of-four l ogic and 5.68E-08 for two-out-of-three logic. They are applicable to Kewaunee because the Kewaunee parameters are within the limits described in WCAP-153

76. Since the Kewaunee parameters in attachments 3 (proprietary) and 4 (non-proprietary) are bounding for Kewaunee, the Kewaunee value for the c hange in large early release frequency (LERF) is less than or equal to the reference plant values. These increases in LERF are very small based on t he RG 1.174 guidance of 1.0E-07 per year.

The overall LERF for the internal events average maintenance model used in this assessment is 4.8E-06/yr. As stated in Reference 20 the external events LERF is 5.2E-06/yr. Thus, the total LERF is 1.0E-05/yr. Since the LERF is less than 1.0E-07/yr and the total LERF is not significantly greater th an 1.0E-05/yr, the incr ease is within Region III of Figure 4 of RG 1.174. Theref ore, the proposed changes are acceptable.

3.5.4 Tier 1, Incremental Conditional Large Early Release Probability Assessment Detailed calculations to determine the impact on ICLERP for the proposed changes are not required. For the proposed changes, ICLERP calculations only apply to the RTBs because they are the only components for which the CT is being extended. Reactor trip breakers are used to mitigate core damage, not containment failure. Reactor trip breakers success or failure has no direct impact on the functioning of containment systems. Large releases are related to containment bypass events, containment isolation failures, and containment failures. Reactor trip breaker success or failure has no direct effect on these functions. The extended RTB CT will result in a slight increase Serial No.09-491 Docket No. 50-305 Attachment 2 Page 15 of 30 in frequency of some core damage sequences. The LERF will increase only in direct proportion to the increased frequency of core damage sequences involving RTB failures because the success or failure of the containment systems is independent of the reactor

trip breakers. Therefore, bec ause the impact of the reactor tr ip breaker CT increase on CDF and LERF is small and the ICCDP is acceptable, the ICLERP will also be acceptable.

WCAP-15376, Revision 1, does contain calcul ated values for ICLERP for an RTB out of service. The calculation was used to answer an NRC request for additional information (RAI) (reference 6) during the review of the WCAP. The ICLERP assuming an RTB out of service for the full duration of a comple tion time was incorporated into the WCAP report.

3.5.5 Tier 1, PRA Scope and Quality 3.5.5.1 Scope of the PRA Model The Kewaunee PRA model used in this evaluation is a Level 1 and Level 2 PRA model

that addresses internal events at full power. The LERF fi gure of merit is calculated using the full Level 2 PRA model.

The Kewaunee PRA model was developed to support the Individual Plant Examination in 1992 and the Individual Plant Examinatio n for External Events (IPEEE) in 1994.

3.5.5.2 Technical Adequacy RG 1.177 (reference 13) prov ides a framework for the risk evaluation of proposed changes to surveillance intervals. RG 1.177 requires identific ation of the risk contribution from the impacted surveillances, determination of the risk impact due to the proposed change to the surveillance interval, and performance of sensitivity and uncertainty evaluations. Regulatory Position 2.3.1 of RG 1.177 stat es that PRA quality must be compatible with the safety implicat ions of the TS change being requested. The use of the Kewaunee model for this submittal is limited to the following:

1. The total CDF and LERF are used to determine acceptability under RG 1.174 (reference 21) 2. The Level 2 model is used to show t hat containment spray is not important. 3. The ATWS model is used to compare wit h the reference model in Attachment 3. 4. The transient frequency is used to compare with the reference model in . 5. The ATWS and ESF models are used to calculate the plant specific risk of concurrent testing of a logic cabinet and the associated reac tor trip breaker.

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 16 of 30 This assessment was done to ensure that those portions of t he model used for the calculations listed above meet the requirem ents of RG 1.200, Revi sion 1, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities."

3.5.5.3 Internal Events Since 1994, updates have been made to in corporate plant and procedure changes, update plant-specific reliability and unavailabilit y data, improve the fidelity of the model, incorporate Westinghouse Owners Group (WOG)

Peer Review comments, and support other applications, such as On-line Mainten ance, Risk-Informed In-Service Inspection (RI-ISI), Maintenance Rule Risk Significance, and Mitigating System Performance Index (MSPI). The enhancements to the Kewaunee PRA model include a major internal flooding update and a number of updates to the Level 2 PRA model to allow a more realistic assessment of the LERF figure of merit.

3.5.5.4 Peer Review Peer Review (Certification) of the Kewaunee PRA model, using the WOG Peer Review Certification Guidelines, was performed in June 2002 (reference 22). The Peer Review found 54 significant issues (A and B Facts and Observations (F&Os)). On the basis of its evaluation, the Certification Team determined that, with A and B F&Os addressed, the technical adequacy of all elements of the PRA would be sufficient to support risk significant evaluations with def ense-in-depth input. All of the F&Os except two B level F&Os have been addressed. The following is a summary of the open F&Os and their potential impact on the risk insights prov ided in support of this application. IE Loss of ventilation initiating event is not well discussed. This F&O is a documentation issue, does not impact the model logic, and does not have an impact on the proposed amendment. TH HVAC calculations need to be revised. The peer review identified that the HVAC calculation for AFW room was over ly conservative in nature. This conservatism may result in an early failu re assumption of components and result in a higher CDF. The overall effect is added conservatism to the calculations that support the proposed amendment.

3.5.5.5 Self Assessments In addition to the Peer Review, Kewaunee pe rformed an assessment of PRA quality in support of the MSPI implementation. The following is a summary of section 3.2, "Technical Adequacy of the Kewaunee PR A," from the MSPI basis document (reference 23).

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 17 of 30 The Kewaunee PRA results for the Emergency Diesel Gener ator, Auxiliary Feedwater, High Pressure Safety Inject ion, and Service Water systems were identified as having appropr iate component importance with respect to similar plants, as assessed by Westinghouse in the MSPI Cross Comparison in WCAP-16464-NP. The Low Pressure Safety Injection (Residual Heat Removal) MSPI system was identified as an outlier in the MSPI cross-comparison because the Birnbaum importance is lower than that of similar plants. The reason for the lower Birnbaum importance is because initiation of containment sump recirculation requires manual alignment of valves by operators.

Human error probabilities dominate over equipment failures. Additionally, containm ent sump strainer plugging, although a low probability, also has an impact on CDF. Thus, the probability of operators failing to align for containment sump reci rculation or containment sump strainers plugging is higher than t he probability of the monitored components failing. Since the human error and containment sump st rainers plugging probabilities dominate, the monitored component Birnbaum values are appropriate for Kewaunee.

Additionally, in January 2008, an independe nt assessment of Kewaunee PRA K107A, released in August of 2007, against RG 1.

200, Revision 1 (Reference 24) was performed. The assessment wa s conducted by a team of experts with experience in performing NEI PRA Certifications and ASME PRA Standard Reviews. The assessment included a review of the D EK PRA procedures, cu rrent documentation notebooks, and other asso ciated documentation.

The scope of this assessment was to co mpare the current PRA against the ASME standard (ASME RA-Sa-2003) to determine if each of the requirements of Capability Category II had been met and sufficiently doc umented. The assessment identified a number of Supporting R equirements (SRs) that did not meet Capability Category II requirements. The "NOT MET" characterization was conserva tively assigned to an SR if one or more apparent documentation or modeling issue(s) could not be readily disposed of, even if the overall analysis had been found to be appropriate. Due to the scope of (i.e., focus on Capability Category II) and conservative nat ure of the initial assessment, the "NOT MET" SRs were reviewed to: 1. Determine if "NOT-MET" Category II SRs would meet Capability Category I requirements and would therefore affect the CDF or LERF determination. 2. Determine if "NOT-MET" Category II SRs would affect model portions 2 through 5 from section 3.5.5.2 above. 3. Identify those "NOT-MET" SRs that do not have an impact on the risk insights provided in support of this proposed amendment (e.g., documentation only issues). 4. Identify potential sensitivity studies that can be performed to ensure that the risk insights are not significantly affected by the "NOT MET" findings.

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 18 of 30 Based on this review, it was determined that:

1. A number of SRs that did not meet Capability Category II requirements may not meet Capability Category I requirements, since the applicable requirement applied to both capability categories.

2. Of those SRs that meet No.1 above, none were determined to have an impact on CDF and LERF based on one or more of the following: a. The potential issue was documentation only. b. The potential issue was assessed to have no impact on the CDF/LERF estimate. For example, AS-A6 SR is characterized as "NOT-MET" because reviewers found that, although the sequence of top events shown on the Kewaunee event trees appears to follow the expected accident sequence, the High Pressure Injection (HPI) node in the Station Blackout (SBO) event trees is placed immediately after the initiating ev ent (prior to the secondary decay heat removal node). This issue was assessed to have a minimal impact on the CDF/LERF results on the basis that the ordering of the top ev ents; 1) was determined by the original reviewers to be adequate in almost all cases, and; 2) in one instance the reviewers indicated that the order may not be justified. However, based on discussion with the plant PRA Engineer and a sensitivity run, the order does not change the CDF/LERF results. c. The potential issue impacts very low frequency events, such as a LOCA with sequence with loss of containment sump recirculation. As a result, the impact on the overall CDF/LERF estimate is assessed to be negligible. d. The potential issue could be eliminated based on formal inquiries to the ASME requirements. For example, AS-A6 SR is characterized as "NOT-MET" partially because reviewers found that the initiating event screening discounts initiators based on whether a plant trip occurs. T he reviewers believe that the Failure Modes and Effects Analysis (FMEA) s hould instead use the screening criteria stated by AS-A6 SR, and a system or train loss that requires shutdown within a relatively short time-frame due to TS requirements (e.g., within six and potentially up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />), should be modeled as an IE. However, based on

inquiry Record Number 07-213, the risk from such an event needs to be captured in a transition ri sk or low power risk. 3. The assessment of model portions 2 through 6 resulted in the following findings: a. The "NOT MET" Category II SRs pertaining to the Level 2 model do not affect the determination that containment spray does not contribute to CDF or LERF. b. The "NOT MET" Category II SRs pertaining to initiating events do not affect the calculation of the transient frequency.

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 19 of 30

c. The "NOT MET" Category II SRs pertaining to initiating events do not affect the modeling of ESF signals. d. There is one "NOT-MET" Category II SR pertaining to the ATWS model that has a potential to affect this analysis and required a model change to be made. This change is discussed below.

Two major changes to the internal events portion of the Kewau nee PRA model occurred between the January 2008 independent assessment and this assessment (re-evaluation of the contribution of internal flooding hazard and recalculati on of the HEPs). Both of these major changes occurred after t he January 2008 independent assessment was performed. These were the same changes included in the model used for the 2008 integrated leak rate testing interval extension submittal (Reference 25).

Neither of the above changes wa s made to address a specific finding/issue raised as a result of the aforementioned independent assessment. The changes were made to address the independent assessment in areas of PRA model fi delity with respect to the "as built/as operated" plant and realistic estimati on of human error failure probabilities.

In addition to the changes discussed above, an additional change was made to address a "NOT-MET" Category II SR. Supporting r equirement AS-A11 from ASME RA-Sa-2003 states in part, "USE a method for implementing an event tree transfer that preserves the dependencies that are part of the transferred sequence." Cont rary to this, the model had transferred all initiators except large LO CA and flooding directly to the ATWS event tree upon failure of a reactor trip. The self-assessment pointed out that the ATWS analysis assumes a transient and no LOCA ATWS or steam line break ATWS has been analyzed. To conservatively address this issue in this analysis, failure of the reactor to trip is assumed to result in core damage for the following initiating events: medium break LOCA, small break LOCA, steam gener ator tube rupture, interfacing systems LOCA, and steam line break. Flooding events with a failure to trip the reactor had previously been modeled as resulting in co re damage. Large LOCAs, due to the large negative reactivity due to voiding in t he core, had been modeled as not requiring a reactor trip. Therefore, no change was made to the flooding or large LOCA model.

The model is current as of September of 2008. An assessment was made of design and procedure changes since then and none have an impact on the model.

3.5.5.6 External Events The Kewaunee PRA model used in this evaluation is a full scope Level 1 and Level 2 PRA model that addresses internal, seismic, and fire events at full power except where otherwise stated.

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 20 of 30 3.5.5.7 Seismic PRA The main elements of a seismic PRA are t he seismic hazard evaluation, structure and component fragility analysis, plant logic analysis, and event tree quantification. A summary of each of these risk assessment elements is provided below. 1. The seismic hazard evaluation provides Kewaunee-specific seismic hazard levels and the probable frequency of occurrence. 2. The structure and component fragility analysis provides unique fragility curves for the components and structures assessed in the PRA model. 3. The seismic plant logic analysis determines the consequence of various structural and component failures. This logic is added to the general transient event trees developed for the internal events PRA, as used in the Individual Plant Examination (IPE) report. 4. The seismic event tree quantification determines the CDF and LERF by quantifying the frequencies of various sequ ences, combinations of system failures, that result in core damage.

Note that, compared with the internal events analysis, the seismic PRA is very conservative on the basis that: 1. Almost all non-safety related components and systems (e.g., Main Feedwater System) were assumed to fail during a seis mic event with probabi lity of 1.0. 2. Almost all elements of the internal events analysis have been updated several times whereas only some elements of the seismic PRA have been updated (e.g., fragility or hazard curves have not been updat ed). More recent hazard curves indicate significantly lower frequencies. 3. Recovery of damaged components is not considered in the Kewaunee seismic PRA. 4. The correlation of damage between systems is not evaluated. The current model conservatively assumes multiple concurrent component failures given a specific seismic event.

Therefore, the estimate of the seismic hazard to the CDF and LERF figure of merit is considered conservative. However, the CDF and LERF estimates are also judged to be

acceptable for the proposed amen dment on the basis that a conservative estimate of CDF and LERF would result in a more restrictive region in RG 1.174.

3.5.5.8 Fire PRA Model The fire PRA model was developed to suppor t the IPEEE study. The fire analysis was based on a combination of a PRA and an EPRl fire-induced vulnerability evaluation (FIVE) approach. A screening study, based on plant walkdowns and the FIVE approach Serial No.09-491 Docket No. 50-305 Attachment 2 Page 21 of 30 was used, and for the areas that passed screening a full PRA was used. Based on a review of the Kewaunee IPEEE submittal, the NRC staff concluded that Kewaunee's IPEEE process was capable of identifying the most likely severe accidents and severe accident vulnerabilities, and that the IPEEE study met the intent of Supplement 4 to GL 88-20 (reference 26).

3.5.5.9 PRA Maintenance and Update The Kewaunee PRA configurat ion management process ensur es that the applicable PRA model remains an accurate reflection of the as-built and as-operated plant. This process is defined in the configuration cont rol program, which consists of a governing procedure and subordinate implementation procedures. T he governing procedure delineates the responsibilities and guidelines for updating t he PRA models. The overall objective is to define a process for implementing regularly scheduled and interim PRA model updates, for tracking issues identifi ed as potentially affecting the PRA models (e.g., due to changes in the plant, errors or limitations identif ied in the model, and industry operating experience), and for controll ing the model and associated computer files. To ensure that the cu rrent PRA model remains an accu rate reflection of the as-built, as-operated plant, the following ac tivities are routinely performed: 1. Design changes and procedure changes are reviewed for their impact on the PRA model. 2. New engineering calculations and revisions to existing calculations are reviewed for their impact on the PRA model. 3. Maintenance unavailability is captured, and its impact on CDF is trended. 4. Plant-specific initiating event frequencies, failure rates, and maintenance unavailabilities are updated on a regular basis.

In addition to these activities, Kewaune e PRA configuration management procedures provide the guidance for particular risk management and PRA quality and maintenance activities. This guidance includes: 1. Documentation of the PRA model, PRA produc ts, and bases documents. 2. The approach for controlling electronic storage of Risk Management (RM) products including PRA update information, PRA models, and PRA applications.

3.5.5.10 Conclusions on PRA Technical Adequacy and Scope As a result of the conservative IPE and IPE EE PRA models, as well as the considerable effort to incorporate the latest industry insights into the PRA, self-assessments, and Peer Reviews, DEK concludes that the current Kewaunee PRA model meets the PRA technical adequacy requirements.

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 22 of 30 3.5.6 Tier 1, Cumulative Impacts RG 1.174 requires that for changes in Regi on II of RG 1.174 Figures 3 and 4, the cumulative effects of all risk informed change s are evaluated. The following table shows the cumulative risk impact of risk informed Te chnical Specification changes on the core damage and large early release risk:

Table 3.7 Subject Amend. No.CDF LERF Containment Isolation 155 0 5.4E-08 Integrated Leak Rate Testing 173 0 4.0E-09 Accumulators 176 5.2E-09 0 Second ILRT extension 204 0 8.3E-07 ESFAS/RPS 1.1E-06 5.7E-08 Cumulative 1.1E-06 9.5E-07 Amendment 155 allowed a train of containment isolation to be removed from service (i.e., one of two isolation valves open without the ability to close) for up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. This change resulted in a negligible risk increase, since containment isolation valves are rarely removed from service. The incr eased risk due to this change is examined each major PRA update to ensure that the change remains acceptable.

Amendment 173 instituted a one-ti me change of the containm ent integrated leak rate testing interval from 10 years to 15 years.

This change result ed in a negligible risk increase, and no model changes were required. The increased risk due to this change is examined each major PRA update to ensure that the change remains acceptable.

Amendment 176 allowed a safety injection accu mulator to be removed from service for up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. This change resulted in no act ual risk increase, since accumulators have not been removed from service since the change. The increased risk due to this change is examined each major PRA update to ens ure that the change remains acceptable.

Amendment 204 instituted an additional one-time change of t he containment integrated leak rate testing interval from 15 years to 15 years, 9 mont hs. This change resulted in a negligible risk increase, and no model changes we re required. The increased risk due to this change is examined each major PRA update to ensure that the change remains acceptable.

3.5.7 Tier 2, Avoida nce of Risk-Significant Plant Configurations The Tier 2 requirements of RG 1.177 state that the licensee shoul d provide reasonable assurance that a risk-significant plant equi pment outage configuration will not occur Serial No.09-491 Docket No. 50-305 Attachment 2 Page 23 of 30 when specific plant equipment is out of servic

e. Tier 2 requires an examination of the need to impose additional restrictions when operating under the proposed RTB CT such that risk-significant equipment outage configurations are avoided.

The Tier 2 requirements of RG 1.177 have been addressed at Kewaunee. Kewaunee currently has a risk-informed on-line risk management process in place, which supports implementation of the requirements of 10 CFR 50.65(a)(4). This risk-informed assessment process is governed and implem ented by plant procedures. These procedures assure that the risk associated with the various plant configurations planned during power conditions are assessed and appropriately managed. Additionally, Kewaunee performs a shutdown safety assessment during scheduled and unscheduled outages that includes an i ndependent review of t he plant outage schedule and performance of a safety assessment checklist.

The WCAP-15376 identified the following restrict ions on concurrent removal of certain equipment when an RTB is out of service.

The recommended Tier 2 restrictions are provided in Section 8.5 of WCAP-15376.

Activities that could degrade the availa bility of the auxiliary feedwater system, reactor coolant system pressure relief (pressurizer PORVs and safety valves), AMSAC (ATWS Mitigating System Actuation Circuitry), or turbine trip should not be scheduled when a RTB is out of service.

Activities that could degrade other components of the RPS, including master relays or slave relays and activities that cause analog channels to be unavailable should not be scheduled when a logic cabinet is unavailable.

Activities on electrical systems that support the systems or functions listed in the first two bullets should not be schedul ed when a RTB is unavailable.

Kewaunee will implement administrative controls to include the above restrictions (refer to attachment 5, commitment 9). Like the reference plant, Kewaunee's RPS consists of slave relays, master relays and analog channels and is supported by electrical power. No other components have been identified that would degrade the RPS system. Therefore, this restricti on is bounding for Kewaunee.

3.5.8 Tier 3, Risk-Informed Plant Configuration Control and Management The objective of the third-ti er requirements is to ensur e that the risk impact of out-of-service equipment is evaluated prior to performing any maintenance activity. The third-tier requirement is an extension of the second-tier requirement, but addresses the limitation of being able to identify all possible risk-significant plant configurations in the second-tier evaluation. As with Tier 2, Tier 3 requirements of RG 1.177 have been addressed at Kewaunee through administrative controls (procedures and guidelines)

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 24 of 30 used to support the Maintenance Rule r equirements specified by the NRC in 10 CFR 50.65(a)(4). The Kewaunee Maintenanc e Rule (a)(4) program meets all of the Key Components in Section 2.3.7.2 of Regulatory Guide 1.177 as follows:

Key Component 1: Implementation of Configuration Risk Management Program (CRMP)

The scope of the CRMP (all SSCs in the probabi listic risk assessment (PRA) model and all high safety significant SSCs within the scope of the Maintenance Rule) is identical to the scope of the Kewaunee Maintenance Rule (a)(4) program. All SSCs in the PRA model are included in the quantitative risk assessment and a qualitative evaluation exists for other high safety significant SSC

s. This program is implemented via fleet procedure WM-AA-100, "Work Management," which calls for a direct PRA, supplemented by qualitative assessments fo r components not modeled in the PRA.

This procedure provides for risk a ssessments to be perfo rmed on both planned maintenance and emergent maintenance.

Key Component 2: Control and Use of the CRMP Assessment Tool

Kewaunee's Plant Modification Procedure require s that the PRA group be notified for all pending plant modifications that affect PRA systems. The changes are required to be made to the PRA within 60 days of the modification closeout.

Limitations of the CRMP assessment tool ar e accounted for in plant procedures, which calls for qualitative assessments for components not modeled in the PRA.

Key Component 3: Level 1 Risk-Informed Assessment

The current PRA model used for the Kewaun ee Maintenance Rule (a)(4) program is a Level 1 and 2, internal events model.

Qualitative assessments are made for components that are not explicitly modeled in the PRA, but ma y contribute to risk (e.g., indication, steam exclusion barriers).

Key Component 4: Level 2 Issues and External Events

Level 2 is addressed by explicitly includi ng LERF in the quantificat ion tool and limiting the allowable increase in LERF. Risk Rankin g in support of the Maintenance Rule has revealed that there are no non-High Safety Significant components that would become High Safety Significant components by adding ex ternal events. Ba rriers affecting the external events model only (e.g

., fire doors, exte rnal flood barriers) are qualitatively analyzed for risk significance.

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 25 of 30 3.5.9 WCAP-15376 SER Conditions Kewaunee is implementing the changes in t he analog channel and logic cabinet CTs, BTs, STIs and the CT for the RTBs. Kewa unee is not implementi ng the changes to the RTB test frequency (STI). The NRC SER approving WCAP-15376 contains several plant specific conditions that require evaluation prior to implementation. The conditions of the WCAP-15376 SER are evaluat ed by DEK for Kewaunee below.

1. Confirm the applicability of the topical report to the plant and perform a plant-specific assessment of containment failures and address any design or performance differences that may affect the proposed changes.

DEK Response:

In order to address condition 1 for WCAP-14333 and WCAP-15376, the WOG issued implementat ion guidelines to help licensees confirm the WCAP analyses were applicable to their plants. Tables 1 through 5 in attachment 3 list the important paramete rs and assumptions made in the generic analyses that are relevant to the requested changes. The information presented in Tables 1 through 5 confirms the applicability of both WCAP-14333 and WCAP-15376 analyses to Kewaunee.

Component Failure Probability Component failure probability data used in the WCAP-15376 report was reviewed against Kewaunee specific data.

The Kewaunee specific component failure probability was 7.33E-06 for input logic relays. This calculated probability is less than that calculated and reported in Section 8.2, Table 8.

6, of the WCAP.

Therefore, it was determi ned that the WCAP data is r epresentative of Kewaunee.

Containment Failure Assessment

The LERF analysis completed to suppor t WCAP-15376 was based on a large dry containment with LERF contributions from containment isolation failure and containment bypasses from an Interfac ing Systems LOCA (ISLOCA) and steam generator tube rupture (SGTR) events, excluding steam gener ator (SG) tube creep rupture. Kewaunee's large dry cont ainment is similar to that of the reference plant, and therefore, the WCAP results are applicable. Additionally, in the June 2002 Kewaunee PRA Peer Revi ew, the Kewaunee Level 2 PRA model was evaluated against NEIs Peer Review Guidance (NEI-00-02). Two category B facts and observations were generated.

These facts and observations have been resolved and, with these enhancements to the Kewaunee LERF model, the Kewaunee Level 2 analysis supports risk significance evaluations with deterministic inputs.

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 26 of 30

2. Address the Tier 2 and Tier 3 analyses including risk significant configuration insights and confirm that these insights are incorporated into the plant-specific configurat ion risk management program.

DEK Response: See the discussion regarding Tier 2 and Tier 3 requirements in sections 3.5.7 and 3.5.8 above in this atta chment. DEK commits to incorporating the recommended restrictions from WCAP-15376 into the appropriate administrative controls (refer to attachment 5, commitment 9).

3. The risk impact of concurrent test ing of one logic cab inet and associated reactor trip breaker needs to be eval uated on a plant-specific basis to ensure conformance with the WCAP-15376-P, Rev. 0 evaluation, and RGs 1.174 and 1.177.

DEK Response: The Kewaunee base case internal events CDF, using the zero test and maintenance model, is 3.80E-05/year. With reactor trip breaker A and reactor trip logic train A out of servic e, the CDF becomes 4.71E-05/year. On average, this condition lasts 2.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> and will be entered 4 times per year (twice for each train). This increase in CDF while in this configuration is 4.71E-05/year -

3.80E-05/year = 9.1E-06/year. The CDF is then ((2.7 x 4) hours/year)/8760 hours/year x 9.1E-06/year

= 1.1E-08/year. The ICCDP is 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> /8760 hours/year x 9.1E-6/year = 2.5E-08. T he base case internal events LERF is 4.42E-06/year. With reactor trip breaker A and reactor trip logic train A out of service, the LERF becomes 5.60E-06/year. The increase in LERF while in this configuration is 5.60E-06/year - 4.42E-06/year

= 1.18E-06/year. The LERF is then ((2.7 x 4) hours/year)/8760 hours/year x 1.18E-06/year = 1.5E-09/year. The ICLERP is 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> /8760 hours/year x 1.18E-06/year = 3.2E-09.

The CDF and LERF are in Region III (very small changes) of figures 3 and 4 of RG 1.174, indicating that the change is acceptabl

e. The ICCDP and ICLERP are below the acceptance guidelines in RG 1.177 for allowed outage times.

Therefore, the risk due to concurrent testing of one logic cabinet and associated reactor trip breaker is acceptable.

4. To ensure consistency with the refe rence plant, the model assumptions for human reliability in WCAP-15376-P, Rev. 0 should be confirmed to be applicable to the plant-specific configuration.

DEK Response:

See Attachment 3 (proprie tary) and 4 (non-proprietary), Table 5. 5. For future digital upgrades with increased scope, integration and architectural differences beyond that of Eagle 21, th e staff finds the generic Serial No.09-491 Docket No. 50-305 Attachment 2 Page 27 of 30 applicability of WCAP-15376-P, Rev. 0 to future digital systems not clear and should be considered on a plant-specific basis.

DEK Response:

The applicability of the changes justified in WCAP-15376 to future digital systems is not address ed in the WCAP and will need to be addressed separately for new designs.

Condition 5 does not apply to the Kewaunee at this time.

3.5.10 Additional Commitment from NRC RAI:

WOG guidelines (reference 15) for impl ementation of WCAP-15376 impose an additional commitment from the respons e to NRC RAI Question 18 (reference 27) which requires that each plant will review their setpoint calculation methodology to ascertain the impact of extending the COT Surveillance Interval from 92 days to 184 days.

DEK Response

The WOG response to this NRC RAI (reference 28) noted that plant-specific RPS and ESFAS setpoint uncer tainty calculations and assumptions, including instrument drift, will be reviewed to determine the impact of extending the surveillance interval of the channel f unctional test from 92 days to 184 days.

DEK has reviewed the Kewaunee setpoint methodology and determined that the impact of extending the surveillanc e test intervals to 184 days would have no effect on the allowed acceptance criteria for the asso ciated instruments.

Kewaunee setpoint methodology includes drift values that are either the manufacturer's values or plant specific values. The calibration acceptanc e values Kewaunee uses for the instruments are instrument accuracy values which are more restrictive than that which would be allowed using the setpoint methodology determined value.

An evaluation of the drift characteristics of the Kewaunee instru ments using plant data indicated that extending the testing from one month to the requested interval of six months would remain acceptable.

4.0 REFERENCES

, ATTACHMENT 2:

1. WCAP-10271-P-A, "Evaluatio n of Surveillance Frequencies and Out of Service Times for the Reactor Protection Inst rumentation System," dated May 1985. 2. WCAP-10271-P-A, Supplement 1, "Evaluation of Surveillance Frequencies and Out of Service Times for the Reactor Protection Instrumentation System," dated July 1985.

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 28 of 30

3. WCAP-10271-P-A, Supplement 2, Revisi on 1, "Evaluation of Surveillance Frequencies and Out of Service Times for t he Reactor Protection Instrumentation System," dated June 1990. 4. Letter from C. O. Thomas (NRC) to J. J. Sheppard (WOG), "Acceptance for Referencing of Licensing Topical Report WCAP-10271, 'Evaluation of Surveillance Frequencies and Out of Service Times for t he Reactor Protection Instrumentation Systems,'" dated February 21, 1985. 5. Letter from Charles E. Rossi (NRC) to Roger A. Newton (WOG), "Safety Evaluation by the Office of Nuclear Reactor Regulation Review of Westinghouse Report WCAP-10271 Supplement 2 and WCAP-10271 Supplement 2, Revision 1, 'Evaluation of Surveillance Frequencie s and Out of Service Times for the Engineered Safety Features Actuation Systems, '" dated February 22, 1989. 6. Letter from Charles E. Rossi (NRC) to Gerard T. Goering (WOG), "Westinghouse Topical Report WCAP-10271 Su pplement 2, Revision 1, 'Evaluation of Surveillance Frequencies and Out of Servic e Times for the Engineered Safety Features Actuation System

,'" (NRC Supplemental Safety Evaluation), dated April 30, 1990. 7. NUREG-1366 "Improvement to Techni cal Specifications Surveillance Requirements," NRC Divis ion of Operational Events A ssessment, Office of Nuclear Reactor Regulation, December 1992. 8. NRC Generic Letter 93-05 "Line-Item Technical Specifications Improvements to Reduce Surveillance Requirements for Testing During Power Operation," September 27, 1993. 9. WCAP-14333-P-A, Revision 1, "Probabilistic Risk Analysis of the RPS and ESFAS Test Times and Completion Times," October 1998. 10. Letter from T.H. Essig (NRC) to L.

F. Liberatori Jr. (WOG), "Review of Westinghouse Owners Group Topical Reports WCAP-14333P and WCAP-14334NP, Dated May 1995, 'Probabilistic Risk Analysis of the RPS and ESFAS Test Times and Completion Times,' (TAC No. M92782)," dated July 15, 1998. 11. WOG-98-245, Letter to WOG Primary Representatives and Licensing Subcommittee Representatives, "Implem entation Guideline for WCAP-14333-P-A, Rev. 1 (Proprietary), 'Probabilistic Risk Analysis of the RPS and ESFAS Tests Times and Completion Times,' (MUHP-0 3054)," dated December 2, 1998. 12. NRC Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," dated July 1998. 13. NRC Regulatory Guide 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," dated August 1998.

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 29 of 30

14. Letter from W.H. Ruland (NRC) to RH. Byran (WOG), "Acceptance for Referencing of Topical Report WCAP-15376-P, Revision 0, 'Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Interval s and Reactor Trip Breaker Test and Completion Times,' (TAC. No. MB 0983)," dated December 20, 2002. 15. WOG-03-202, letter to WOG Management Committee and Licensing Subcommittee, "Transmittal of Approved Topical Report: WC AP-15376-P-A, Rev.

1, (Proprietary) 'Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times,' and Implementation Guidelines (MU HP-3046)," dated April 3, 2003.

16. WOG-04-233, letter to WOG Management Committee and Licensing Subcommittee, "Transmittal of Revised Implementation Guidelines for WCAP-15376-P-A, Rev. 1, 'Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reacto r Trip Breaker Test and Completion Times'(MUHP-3046)," dated May 6, 2004.

17. WCAP 15376-P-A, Revisi on 1, "Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times,"

March 2003. 18. Industry/Technical Sp ecification Task Force (TSTF) Standard TS (STS) Change Traveler 411, Revision 1, "Surveillance Test Interval Extensions for Components of the Reactor Protection System (WC AP-15376)," dated A ugust 7, 2002. 19. Industry/Technical Sp ecification Task Force (TSTF) Standard TS (STS) Change Traveler 418, Revision 2, "Surveillance Test Interval Extensions for Components of the Reactor Protection System (W CAP-15376)," dated February 21, 2003.

20. Letter from D. A. Christian (DEK) to Document Control Desk (NRC), "Dominion Energy Kewaunee, Inc., (DEK) Kewaunee Power Station Application for Renewed Operating License," dated August 12, 2008. (ADAMS Accession Number ML082341038) 21. NRC Regulatory Guide 1.174, "An Approach fo r Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 1, dated November 2002. 22. Kewaunee Nuclear Power Plant Probabilistic Risk Assessment Peer Review Report, December 2002. 23. NRC Mitigating System Performance Index (MSPI) Basis Document, Kewaunee Power Station, Revision F, June 2008. 24. Regulatory Guide 1.200, Revision 1, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Re sults for Risk-Informed Activities,"

dated January 2007. [ADAMS Accession No. ML070240001] 25. Letter from Leslie N.

Hartz (DEK) to Document C ontrol Desk (NRC), "License Amendment Request 242: Extension of O ne-Time Fifteen Year Containment Serial No.09-491 Docket No. 50-305 Attachment 2 Page 30 of 30

Integrated Leak Rate Test Interval." dated September 11, 2008. [ADAMS Accession No. ML082550700] 26. Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10CFR 50.

54(f), Generic Letter No. 88

-20, Supplement 4, dated June 28, 1991. 27. WOG letter OG-01-058, from R.H. Bryan (WOG) to Document Control Desk (NRC), "Transmittal of Response to Request for Additional Information (RAI) Regarding WCAP-15376-P, Rev.

0, 'Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times,'" (MUHP-3046), September 28, 2001.