Text

Joint Applications Rept for EDGs AOT Extension.
	ML17228B180
Person / Time
Site:	Saint Lucie
Issue date:	05/31/1995
From:	; ABB COMBUSTION ENGINEERING NUCLEAR FUEL (FORMERLY, ASEA BROWN BOVERI, INC., C-E OPERATING PLANTS OWNERS GROUP
To:	;
Shared Package
ML17228B178	List: ML17228B177; ML17228B179; ML17228B180;
References
	CE-NPSD-996, NUDOCS 9506230231
	Download: ML17228B180 (47)
	v • d • e

~ ~

COMBUSTION ENGINEERING OWNERS GROUP CE NPSD-996 Joint Applications Report

'for Emergency Diesel Generators AOT Extension Final Report GEOG TASK 836 prepared for the C-E OWNERS GROUP May 1995 o Copyright 1995 Combustion Engineering, Inc. All rights reserved l2 QDQD ABB Combustion Engineering Nuclear Operations li'QClDOD 950623023i 950621 PDR ADQCK 05000335 P PDR

LEGAL NOTICE This report was prepared as an account of work sponsored by the Combustion Engineering Owners Group and ABB Combustion Engineering.

Neither Combustion Engineering, Inc. nor any person acting on its behalf:

A. makes any warranty or representation, express or implied including the warranties of fitness for a particular purpose or merchantability, with respect to the accuracy, completeness, or usefulness of the information contained in this report, or that the use of any information, apparatus, method, or process disclosed in this report may not infringe privately owned rights; or B. assumes any liabilities with respect to the use of, or for damages resulting from the use of, any information, apparatus, method or process disclosed in this report.

Combustion Engineering, Inc.

TABLE OF CONTENTS Section Page LIST OF TABLES 1.0 PURPOSE 2.0 SCOPE OF PROPOSED CHANGES TO TECHNICAL SPECIFICATIONS 1

3.0 BACKGROUND

4.0

SUMMARY

OF APPLICABLE TECHNICAL SPECIFICATIONS 4.1 Standard Technical Specifications 4.2 "Customized" Technical Specifications 5.0 SYSTEM DESCRIPIION AND OPERATING EXPERIENCE 5.1 System Description 5.2 Operating Experience 5.2.1 Preventive Maintenance 8 5.2.2 Surveillance/Testing of EDGs 11 5.2.3 Corrective Maintenance 11 5.2.4 Commerits on EDG Unavailabilities 11 6.0 TECHNICAL JUSTIFICATION FOR AOT KCZENSION 12 6.1 Statement of Need 12 6.2 Assessment of Deterministic Factors 14 6.2.1 Station Blackout Rule 14 6.2.2 Brookhaven's Analysis of EDG Unavailability and its Risk Impacts 15

TABLE OF CONTEÃXS (cont'd)

Section Page 6.3 Assessment of Risk 17 6.3.1 Overview 17 6.3.2 Assessment of "At Power" Risk 18 6.3.3 Assessment of Transition Risk 27 6.3.4 Assessment of Shutdown Risk 31 6.3.4.1 Assessment of Risk Trade-off 31 6.3.4.2 Assessment of Enhanced EDG Reliability 32 6.3.5 Assessment of Large Early Release 35 6.3.6 Summary of Risk Assessment 37 6.4 Compensatory Measures 37 7.0 TECHNICAL JUSTIFICATION FOR STI EXTENSION 38 8.0 PROPOSED MODIFICATIONS TO NIJREG-1432 39 9.0 SUhQVlARY AND CONCLUSIONS

10.0 REFERENCES

40 ATTACHMENI' A-1 "Mark-up" of NIJREG-1432 SECTIONS 3.8.1 & B 3.8.1 11

LIST OF TABLES TabIe Page 3-1

SUMMARY

OF DG hQBlTJFACTURER AND AOTs FOR CE PWRs 3 CONFIGURATIONS OF EMERGENCY ELECIRICAL SYSTEMS FOR CE PWRS ALTERNATE EMERGENCY POWER FOR ESSENTIAL SAFETY SYSTEMS AND SBO BATIERY POWERED COPING TIME FOR CE PWRs EDG UNAVA'ILABILITY AND UMRELIABILITY 10 6.3.2-1 CEOG AOT CONDITIONALCDF CON'IRIBUTIONS FOR EDGs - CM 24 6.3.2-2 CEOG AOT CONDITIONALCDF CORI'RIBUTIONS FOR EDGs - PM 25 6.3.2-3 ~

CEOG PROPOSED AVERAGE CDFs 26 6.3.3-1 TRANSITION RISK CORIRIBUTIONS FOR EDG CM 30 6.3.4.1-1 DAILYPLANT CORE DAMAGEPROBABILITYAT SHU'H3OWN FOR A REPRESENTATIVE CE PWR 31 6.3 4.2-1 EDG MAIÃZENANCEVS. POTENIIAL IMPROVEMENTS IN EDG RELIABILITY 6.3.4.2-2 SUh&fARY OF ANALYSIS DATA 34

Emergency Diesel Generator (EDG) AOT Extension 1.0 PURPOSE This report provides the results of an evaluation of the extension of the Allowed Outage Time (AOT) for a single Emergency Diesel Generator (EDG) from its present value to seven days.

The AOT is specified in the plant technical specifications. In addition, this report provides justifications for allowing the extension of this same AOT to 10 days on a "once-per-refueling cycle" frequency. This AOT extension is sought to provide needed flexibilityin the performance of both co'rrective and preventive maintenance during power operation. Furthermore, adoption of the proposed AOT extension reduces the risk of unscheduled plant shutdowns. Justification of this request is based on an integrated review and assessment of plant operations, deterministicMesign basis factors and plant risk.

This request for AOT extension is consistent with the objectives and the intent of the 10CFR50.65, Appendix A, "The Maintenance Rule" (Reference 1) and the draft staff guidance for incorporation of EDG reliability requirements within the Maintenance Rule (Reference 2).

That is, the Maintenance Rule will be the vehicle which controls the actual maintenance cycle by defining unavailability and reliability performance criteria and assessing maintenance risk.

The requested AOT extension will allow efficient scheduling of maintenance within the boundaries established by implementing the Maintenance Rule. The CE plants are in the process of implementing the Maintenance Rule, and are presently setting targets for unavailability and reliability of systems and trains. Therefore, this effort is seen as timely, supportive and integral to the Maintenance Rule program.

2.0 SCOPE OF PROPOSED CHANGES TO TECHNICAL SPECIFICATIONS The proposed technical specification changes address revision of existing requirements for the operation of the Emergency Diesel Generator subsystems. Specifically, the proposed changes in technical specification requirements are:

(1) In general, extend AOT for a single INOPERABLE EDG from P2] hours to 7 days.

(2) Provide a once per fuel cycle allowance for an AOT of 10 days for a single

~

INOPEIMBLE EDG.

3.0 BACKGROVND In response to the NRC's initiative to improve plant safety while granting relief to utilities from those requirements that are marginal to safety, the CEOG has undertaken a program of obtaining relief from overly restrictive technical specifications. As:part of this program; several technical specification AOTs and STIs were identified for joint action.

This report provides support for modifying the Technical Specifications for Electric Power Systems in order to extend the AOT for a single emergency diesel generator during power operation. The CE fleet of PWRs utilize one of two possible AOTs within the plant technical specifications (See Table 3-1). More recently designed PWRs have a,72. hour. AOT for the .

EDG, whereas early CE PWRs have a seven day AOT. The intent of this report is to provide technical justification for the extension of the AOT for our more recent PWRs from-a period of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to seven days. In addition, this document provides support for a one time per cycle 10 day AOT extension for all CE Pub. The intent of this modification to the AOT is to enhance overall plant safety by avoiding risks associated with unscheduled plant'shutdowns and providing for increased flexibilityin scheduling and performing necessary "on-line" maintenance and surveillance activities. In addition, adoption of the proposed AOT extension will provide

,uniformity in this AOT for CE PWRs with a minimum of two dedicated EDGs per Unit.

This report provides generic information supporting the proposed AOT changes, as well as, the necessary plant specific information to demonstrate the impact of these changes on an individual, plant basis. The supporting/analytical material contained within the document is considered applicable to participating CEOG member utilities regardless of the category of their Plant Technical Specifications. Utilities participating in this task include Maine Yankee, Palisades, Ft. Calhoun Station, St. Lucie Units 1 and 2, Millstone Point 2, Waterford 3, ANO-2, San Onofre Units 2 and 3, and Palo Verde Units 1, 2 and 3. Baltimore Gas and Electric's Calvert Cliffs Units are in the process of upgrading their EDG capacity to include enhanced redundancy of their EDGs, and the addition of a station blackout diesel generator. Therefore, Baltimore Gas and Electric is not participating in the plant specific aspects of this effort at this time.

Table 3-1

SUMMARY

OF DIESEL GENERATOR MANUFACIURERAND ALLOWED OUTAGE TIMES FOR CE PWRs Plant Manufacturer Tech Spec Type EDG AOT (Days)

Fairbanks Morse Standard Calvert Cliffs 1 Standard '3 Calvert Cliffs 2 Standard Ft. Calhoun General Motors Customized Station Maine Yankee General Motors Customized Millstone 2 Fairbanks Morse Standard Palisades Customized Palo Verde 1 Cooper Energy Services Standard Palo Verde 2 Standard Palo Verde 3 Standard San Onofre 2 General Motors Standard San Onofre 3 General Motors Standard St. Lucie 1 Standard St. Lucie 2 Standard Waterford 3 Cooper Energy Services Standard

For these units, surveillance testing of an alternate EDG is not required when the other EDG is deliberately rendered inoperable in order to perform pre-planned preventive maintenance.

4.0 SUIVMARYOF APPLICABLKTECHNICAL SPECIFICATIONS I

There are three distinct categories of Technical Specifications at CE NSSS plants.

The first category is the Standard Technical Specifications. Through February 1995, NUREG-0212, Revision 03, commonly referred to as "Standard Technical Specifications," has provided a model for the general structure and content of the approved technical specifications at all other domestic CE NSSS plants.

The second category corresponds to the Improved Standard Technical Specifications (ISTS) guidance that is provided in NUTMEG-1432, Revision 0, dated September 1992. A licensing amendment submittal to change the Technical Specifications for San Onofre Nuclear Generation Station Units 2 A 3 so as to implement this guidance was submitted to the NRC in December 1993. Additionally, licensing amendment submittals are being developed that will modify the technical specifications for Palisades Station to implement the ISTS guidance.

'he third category includes those technical specifications (TSs) that have structures other than those that are outlined in either NUTMEG-0212 or NUTMEG-1432. These TSs are generally referred to as "customized" technical specifications. The CE NSSS plants that currently have "customized" technical specifications are: Palisades Station, Maine Yankee Station, and Ft.

Calhoun Station.

Each of these three categories of Technical Specifications includes operating requirements for the applicable plant's emergency diesel generators (EDGs).

Table 3-1 provides a summary of the diesel generator manufacturers and allowed outage times for CE PWRs.

4.1 Standard Technical Specifications The requirements for emergency diesel generators during power operations are embedded in the requirements for Electrical Power Systems in the standard technical specifications of NUEEG-0212, Revision 03 and NUEEG 1432, Revision 0.

LCO 3.8.1 of NUTMEG-1432 provides the following definition for a fully OPERABLE set of AC sources for plant operations in Modes 1 through 4:

ao Two qualified circuits between the offsite transmission network and the on-site Class 1E AC Electrical Power Distribution System; [and]

b. Two diesel generators (EDGs) each capable of supplying one train of the on-site Class 1E AC Electrical Power Distribution System; and C. Automatic load sequencers for Train A and Train B.

Both LCO 3.8.1.1 of NUTMEG-0212, Revision 03 and LCO 3.8.1 of NUREG-1432, Revision 0 (Attachment A) allow the continuation of power operation with one inoperable emergency diesel generator for a maximum of 72 continuous hours.

Additionally, LCO 3.8.1 of NUI2EG-1432 (Attachment A) includes a provision that allows continued power operations for a maximum of six days when a contiguous series of different degradations of the full set of AC sources occurs. (An example is the case where one of the required offsite power circuits becomes inoperable at the same time that a diesel generator that was previously inoperable is returned to an OPERABLE state.)

Following a diagnosis that an EDG is INOPERABLE, an assessment or test confirming that the OPERABLE EDG is not subject to a common cause failure would be performed. Ifa common cause failure mode is suspected, the OPERABLE EDG must be declared INOPERABLE and actions must be taken to restore one EDG to OPERABLE status in within a small number of hours. Inability to return one EDG to OPERABLE status results in the entry into a more restrictive LCO ACTION STATEMEN'I'.

4.2 "Customized" Technical Specifications Customized technical specifications for the EDGs differ from the STS in the duration of the specified AOT and the details of the subsequent ACTION statements. Table 3-1 indicates which CE PWRs have customized technical specifiications and lists their respective AOTs.

S.O SYSTEM DESCRIPTION AND OPERATING EXPI&I1WCE This section summarizes EDG configurations and operating experience for CE PWRs. Data contained in this Section is derived from a combination of sources including recent plant specific data and relevant data available from a recent EDG industry survey (Reference 3).

5.1 System Description The role of the EDG is to provide emergency power to essential safety systems in the event that all offsite power sources are lost. All CE PWRs with the exception of Calvert Cliffs Units 1 and 2 employ two dedicated EDGs per plant. Calvert Cliffs is presently undergoing a plant upgrade to provide 2 class 1E diesels per unit with a shared non-class 1E seismically robust third EDG. A summary of current EDG configurations for CE PWRs is presented in Table 5.1-1.

Many CE PWRs include alternate means of providing power to some, ifnot all, essential safety systems. In general, CE PWRs residing on multiple unit sites are capable of being powered by some of the on-site power supplies of the other unit. In addition, in the Station Blackout Rule (10CFR50.63, Reference 4) implementation process, many CE PWRs have procured equipment designed to mitigate the consequences of a station blackout event. For example, at ANO, a "swing" non-class 1E full capacity station blackout diesel that can support either unit has been installed. These plant features, along with the expected plant station blackout coping times are presented in Table S.1-2.

Table 5.1-1 CONFIGURATIONS OF EMERGENCY ELECTRICAL SYSTEMS FOR CE PWRS Plant No. of Dedicated Diesel Total No. of Units per unit Diesels None Calvert Cliffs 18@

Fort Calhoun Station N/A Maine Yankee N/A Millstone 2 None Palisades N/A Palo Verde 1, 2 dQ None San Onofre 2 43 None St. Lucie18c2 2 None Waterford 3 N/A

~ Each generator has two engines

TabIe 5.1-2 ALTXRNATEEMIRGENCY POWER FOR ESSENTIAL SAFETY SYSTEMS AND STATION BLACKOUTBATTI~&YPOWERED "COPING" TINDS FOR CE PWRS MULTIPLE BACKUP POWER UNIT SBO PLANT UNIT SITE SUPPLY CROSS-TIE COPING TIIVIE CAPABILITY (BATTERIES ONLY) (hrs)

ANO-2 Swing" N~ass 1E Station yes Blackout EDG can provldo power to either units during a station blackout Calvert Cliffs 1&2 A site EDG upgrade ls in yes progress which wdl result ln 2 dedicated EDGe por unit and a swing n~ass 1E blackout EDG Fort Calhoun Station FCS employs a backup solf- N/A powered, AFW pump lAFW-54I and a turbine driven AFW pump lFW-10) to maintain feedwater availabTiity during an SBO.

Maine Yankee N Appendix R DG-2 used as N/A AAC Generator Millstone 2 The INBlstono site incfudos a yes 12 14.4 Mw Combusthn Turbine to supply essential safety loads in the event of loss of offsite power and lose of EDGe.

Palisades N NONE NIA Palo Verde 1, 2 &3 The Palo Verde site Includes yes 2 Gas Turbine generators to extend SBO coping times to well beyond 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

San Onofre 2 & 3 Nominal credit is taken for yes power from the opposito unit diesel.

St. Lucie 1 &2 Cross tie between units during yes 4 (Unit 2) blackout. Tie capabigty via o (Unit 1) non~afety 4kv busses.

Waterford 3 N None NIA SBO coping based on availability of alternate AG source.

5.2 Operating ~erience The Emergency Diesel Generators provide on-site emergency ac power in the event that all offsite power sources are lost. As a consequence, the reliability of these on-site power sources is an important factor in assuring the safety of light water reactors. As a result of this concern, the NRC established the Station Blackout Rule in 1988. In the implementation of this rule, the NRC (via Regulatory Guide 1.155, Reference 5) required that all LWRs ensure the reliability of the EDGs to be greater than either .95 or .975 depending on the specific plant class to which the unit was considered to belong. Plant class typically reflects various factors including (1) redundancy of on-site emergency ac power systems, (2) reliability of on-site emergency power sources, (3) frequency of loss of off-site power and (4) the probable time to restore off-power.

At the time of the SBO rule, unavailability of the EDGs throughout the domestic commercial nuclear industry due to "on-line" maintenance was .007. As maintenance programs were implemented to improve EDG reliability, the on line out-of-service (OOS) unavailability of the EDG has increased industry-wide. A recent survey of EDG unavailability of power operation indicates that the mean unavailability of the EDG "at power" due to preventive and corrective maintenance (PM and CM) are .0118 and .0082 respectively. Correspondingly, the unreliability of the EDGs has decreased on an industry average from about 0.020 in the early 1980's to 0.014 in the 1988 to 1991 time frame (Reference 3). Reference 3 further postulated that the increase in reliability in recent years and the increase in unavailability due to maintenance may be related.

Table 5.2-1 provides a comparison of the individual and mean unavailabilities and unreliabilities of CE EDGs to their industry average. As a group, the EDGs at CE PWRs involved in this study have an average EDG "at power" unavailability below the industry average. No individual CE PWR can be considered an outlier.

5.2.1 Preventive Maintenance Most plants in the United States ( 95%) routinely carry out scheduled PM on EDGs during power operation (see Reference 3). Preventive maintenance (PM) for EDGs encompasses a variety of tasks including:

-Lubrication, Oil and Filter Changes

-Replacement of switches

-Calibration of equipment

-Component Cleaning

-Component Inspections

-Manufacturer upgrades A survey of CE PWRs indicates that preventive maintenance tasks, such as those listed, can take from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to more than 70 hours8.101852e-4 days 0.0194 hours 1.157407e-4 weeks 2.6635e-5 months to complete. While certain PM tasks can be performed without taking an EDG out of service (such as those involved with EDG equipment calibrations),

many PM tasks cannot be performed without declaring the applicable EDG out of service. The typical frequency of diesel generator maintenance for CE PWRs varies from less than once per

year (that is, no planned preventive maintenance) to about once every calendar quarter. The mean duration of maintenance tasks is currently less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . This is generally consistent with the observed industry trends. Reference 3 indicates that the mean PM on an EDG was 24.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months with a standard deviation of 37.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . This suggests that maintenance done at power frequently exceed one-half of the AOT and in about one quarter of the occurrences exceed the typical 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months AOT. This is particularly true, ifa PM uncovers equipment degradation which would require further maintenance. At one site, the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months AOT has been approached on nine (9) separate occasions and exceeded once. This later event occurred during a weekend and required a discretionary enforcement to continue plant operation.

On a yearly basis the amount of "on-line" preventive maintenance for EDGs varies from less than 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to a maximum of about 200 hours0.00231 days 0.0556 hours 3.306878e-4 weeks 7.61e-5 months per EDG for CE PWRs with a 7 day AOT for a single EDG, with the average per EDG PM equal to 135 hours0.00156 days 0.0375 hours 2.232143e-4 weeks 5.13675e-5 months . For CE plants with a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months AOT, the average and maximum yearly PM per EDG are 100 and 140 hours0.00162 days 0.0389 hours 2.314815e-4 weeks 5.327e-5 months respectively. This level of "on-line" maintenance is consistent with United States industry average estimate (Reference 3) of about 100 hours0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months per year.

Table 5.2-1 EDG UNAV~ILITYAND UNRELIABILITY EDG ID UNAVAILABILITY PM CM PM+ CM B 0.0 .0041 .0041 0.0 .00188 .00188 Ft. Calhoun Station 0.0009 .0068 0.0009 .0053 Maine Yankee DG-1B .0126 DG-1A .0134 .0012 .0146

.00636 .0106

.0106 DG1-I .0105 .0214 DGI-2 .00867 .0089 .01757 Palo Verde 1 IMDGAH01 .00936+ .00515 .0145m

.00936o'0109 1MDGBH02 .00936 .00515 .0145m Palo Verde 2 2MDGBH01 .00515c" .0145m

.0051K'0145m Palo Verde 3 3MDGAH01 .00936m .0051$ .0145'e 3MDGBH02 .00936m .00515r" .0145m

.0046 .00767

.00767

.00767 0.0046 .00767 St. Lucio 1 1A .0118 .0045 .0163 1B .00835 .0084 .0168 St. Lucie 2 .0157 .0166

.0109 .0109 Waterford 3 .0038 .0038 .0076

.0008 .0016 CEOG MEANDATA PLANTS WII3 DAYAOT .0038 .0107 PLANTS WITH 7 DAY AOT .0051 .0143 CEOG GROUP .0075 .0116 INDUSTRY NUREG/CR-5994 (MM) .0118

. Data m Rc crencc Unrehab&ty data take m Re crence

2. Average for all 6 units 10

$.2.2 Surveillance!Testing of EDGs Surveillance testing of EDGs is typically performed as required in the plant technical specifications.

Industry average data confirms that the durations of EDG tests are typically short (on the order of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months ) and the total unavailability of an EDG is under 20 hours2.314815e-4 days 0.00556 hours 3.306878e-5 weeks 7.61e-6 months per year (See Reference 3).

K

$.2.3 Corrective Maintenance Corrective maintenance refers to maintenance that is unscheduled and is therefore condition directed.

Such maintenance can occur when the EDG fails a surveillance test or a degradation in EDG performance is noted. This definition of CM includes conditions where the EDG can perform its safety function, as well as, cases where the safety function is affected. In either case of CM, the EDG would typically be considered to be INOPERABLE. The analysis presented in Section 6 assumes CM is performed due to inoperability of the EDG.

Industry survey data suggests that corrective maintenance is performed on an EDG at a mean frequency of 3.3 times per year with a mean duration of 23.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months and a standard deviation of 46.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months . The large uncertainty associated with CM clearly indicates the potential for EDG repair to exceed the existing 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months AOT. For the CEOG member utilities, the yearly unavailability due to CM is lower than 0.006 per year per EDG, regardless of the current AOT. This low value of CM reflects a high EDG reliability and the effectiveness of existing EDG maintenance programs.

$ .2.4 Comments on EDG Unavailabi7ities The CE fleet includes plants with both 3 and 7 day AOTs. Plants with 3 day AOTs have a mean yearly scheduled maintenance unavailability of about 77 hours8.912037e-4 days 0.0214 hours 1.273148e-4 weeks 2.92985e-5 months per EDG per year compared to 132 hours0.00153 days 0.0367 hours 2.18254e-4 weeks 5.0226e-5 months per EDG per year for plants with a 7 day EDG AOT. Both groups of plants show similar yearly repair time outages for unscheduled maintenance (46 vs. 51 hours5.902778e-4 days 0.0142 hours 8.43254e-5 weeks 1.94055e-5 months ). In the future, all plants within the CE fleet are expected to set maximum maintenance rule targets for EDG unavailability in the .025-.03 range (220 to 260 hrs per EDG per year). Therefore, adoption of a 7 day AOT for a single inoperable EDG is not expected to have a significant impact in overall EDG unavailability.

11

6.0 TECHNICALJUSTIFICATION FOR AOT EXTENSION This section provides the technical bases for the request for the AOT extension. The presentation of this information generally follows the guidance in the Handbook of Methods of Risk Analyses in Technical Specifications (Reference 8 ).

6.1 Statement of Need The EDGs provide on-site emergency alternating current (ac) electric power to a nuclear plant in the event all off-site power sources are lost. The importance of this equipment to plant safety has resulted in the "Station Blackout Rule", which among other features, required that the reliability of EDGs reliability be acceptably high. In the implementation process, Regulatory Guide 1.155 specified target reliability values of .95 and .975 dependent upon a set of defined criteria. In response to meeting these reliability goals, many reactor sites implemented or extended EDG surveillances and "on-line" PM activities.

The participating CEOG utilities request that the present EDG AOT be uniformly extended as follows:

(1) Extend AOT for a single INOPERABLE EDG from P2] hours to P] days.

and~

(2) Provide a once per fuel cycle allowance for an AOT of 10 days for a single INOPERABLE EDG.

Implementation of this AOT modification will:

(1) Allow increased flexibility in the scheduling and performance of preventive maintenance (2) Reduce the number of individual entries into LCO action statements by providing sufficient time to perform related maintenance tasks within a single entry.

(3) Reduce stress on plant maintenance personnel by allowing adequate time to perform the more complicated maintenance activities (including those associated with EDG manufacturer recommended surveillances and upgrades)

(4) Enable the plant to minimize EDG operability restoration time by scheduling maintenance which de-emphasizes multiple simultaneous EDG tasks (resulting in potentially long associated restoration times). By emphasizing single or combined repairs and inspections, there will be shorter times for EDG restoration.

12

(5) Allow the plant to better control maintenance tasks between power and shutdown operation thereby increasing EDG reliability both "at power" and in the early (risk dominant) stages of shutdown.

(6) Avert unplanned plant shutdown and minimize potential for requests for Notices of Enforcement Discretion (NOEDs). Risks incurred by unexpected plant shutdowns can be comparable to and often exceed those associated with continued power operation.

(7) Improve EDG availability during shutdown modes.

The mean EDG PM or CM is about 1 day with a standard deviation of nearly 2-days. Therefore, industry-wide, a large number of corrective maintenance events would be expected to challenge the existing 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months AOT. This difficultyhas been noted at various CE sites. At one CE site, it was reported that the existing EDG AOT was nearly exceeded nine (9) times and, actually exceeded once requiring a discretionary enforcement to continue plant operation.

Plants with existing 7 day AOTs report that their present EDG AOT is adequate for most EDG repairs. However, instances have occurred when a 7 day AOT is inadequate. Such an event occurred at a CEOG utility (Reference 11) which required a one time emergency change to the Technical Specifications extending the EDG AOT to 10 days to allow completion of repair of a cracked cylinder head. Implementation of a 10 day AOT on a once per cycle basis will allow the plant to continue operation while repairing a non-functional EDG. The once per cycle extension is not expected to expand the level of PM or CM to be performed at any plant. It is expected to provide margin to ensure that serious EDG degradations uncovered during equipment surveillance or a scheduled PM can be successfully completed without exceeding the plant LCO ACTION STATEMENT. "At power" operation provides a resource rich environment for accident management and minimizes the risk of initiating loss of power and loss of feedwater events that can accompany a forced shutdown. It is also possible that, under certain controlled conditions (such as availability of a full capacity "swing" EDG or alternate AC power source), the 10 day per cycle AOT extension may be entered following unanticipated delays encountered in performing a EDG preventive maintenance activity.

13

62 Assessment of Deterministic Factors The Emergency Diesel Generators (EDGs) provide on-site alternating current (ac) electric power in the event that all off-site power sources are lost in a nuclear power plant.

A dedicated diesel generator is the on-site standby ac power source for each engineered safety feature power supply bus. In the event of an accident with loss of off-site power, EDGs are designed to automatically connect to and power safeguards equipment. In addition, automatic load sequencing assures that.EDGs are connected to the plant ESFs in sufficient time to provide a safe plant shutdown. In the event of loss of preferred power EDGs are intended to provide emergency backup power for the plant essential safety feature electrical loads until such time that the preferred power supply is restored.

Each CEOG plant's EDG configuration satisfies the requirements of Regulatory Guide 1.9. Each of the diesel generators is capable of starting, accelerating to rated speed and voltage, and connecting to its respective engineered safety feature bus on detection of bus undervoltage within a specified period of time (i.e. 10 - 15 seconds). Each diesel generator is capable of accepting required loads within the loading sequence intervals assumed in the safety analyses, and continuing to operate until offsite power can be restored to the ESF buses. These capabilities exist, under a variety of initial conditions including the diesel generator being in standby with hot engine temperatures, the diesel generator being in standby with the engine at ambient conditions, or the diesel generator operating in the parallel test mode.

6.2.1 Station Bhckout Rule The loss of off-site ac power to the essential and non-essential electrical buses concurrent with turbine trip and the unavailability of the redundant on-site emergency power system, i.e. EDGs, is termed "Station Blackout". Reliability of on-site power sources is an important factor in assuring an acceptable level of plant safety. In recognition of the importance of these on-site power sources the Station Blackout (SBO) Rule was established in 1988. Guidance for implementation of the SBO rule was defined in Regulatory Guide 1.155. Specifically, the SBO rule required the licensees to:

1. Ensure the reliability of the EDG was ) 0.95 (or >0.975) dependent on plant specific features.

2. Establish an EDG Reliability Program.

and, in the event of an SBO event

3. Ensure that the plant has adequate coping capability.

The station blackout (SBO) rule addressed the need for maintaining a highly reliable ac electrical power system. At the time the rule was developed, the unavailability due to maintenance was 14

estimated at 0.007. At that time it was recommended that EDGs be reliable and that maintenance unavailability be kept low by performing the maintenance at plant shutdown.

Over the past decade the utilities have begun programs to improve the reliability of the EDGs via regular preventive maintenance. As a result of lengthening of the time between refuelings some of this maintenance was performed at power. Furthermore, recent shutdown risk assessments suggest that shutdown risks are in general comparable to those of power operation, resulting in questions about the benefit of delaying PM on EDGs to shutdown conditions. This increase in "on-line" PM has resulted in an increase in maintenance unavailability to 0.02 with a corresponding industry-wide increase in EDG reliability from 0.98 to 0.986.

6'.2.2 Brookhaven's Analysis of EDG UnavaiEability and its Risk impacts The safety implications of performing EDG maintenance at power was investigated by BrooMiaven National Laboratory (BNL). The BNL report (Reference 3), which is discussed below, investigated:

1. The sensitivity of the plant core damage frequency (CDF) to maintenance and the probability of failure to start and run on demand.

2. The relative benefits of performing maintenance at power vs shutdown.

The analysis found that the increased CDF level during maintenance, as well as the duration of the maintenance are important factors in the assessment of the risk impact of EDG unavailability due to maintenance. The integrated risk impact over the duration is calculated as the product of the increased CDF and the maintenance duration.

It was concluded that during power operation, changes in CDF are more sensitive to failures to start and run than to EDG maintenance unavailability. Specifically, it was concluded that EDG failure unavailability has a factor of 2.6 greater impact on the CDF than does the "at power" maintenance unavailability (Reference 6). Furthermore, an increase in unavailability to .02 per EDG per year had no significant impact on plant risk (i.e. CDF). Ifone presumes that the increase in maintenance related unavailability is offset by a decrease in the failure to start and load-run unavailability, the net impact on the CDF would be benefiicial.

This report also developed insights for scheduling EDG preventive maintenance items (PMs). PMs were divided into three categories:

(1) Scheduled PMs that need to be performed at an interval less than 18 months, (2) Scheduled PMs that need to be performed at an interval of 18 months or longer, (3) Condition-directed PMs, based on test results, as needed to correct degradations of equipment which may lead to failures.

15

BNL recommended that short duration PMs be performed at power. Longer duration PMs were recommended to be scheduled during the later portion of the refueling outage when the risk impact is relatively low. Risks associated with EDG maintenance during the early, low inventory shutdown modes were found to be generally comparable to that of performing the maintenance at power.

For condition-directed PMs (and CMs), somewhat longer maintenance outages may be allowed during power operation since a plant shutdown, in this case, involves the additional risk of maneuvering to a safe shutdown state.

Insights obtained from this and associated efforts were presented in a memorandum for Thomas E.

Murley from Eric S. Beckjord in Research=Information Letter Number 173 entitled Risk-based Methods to Evaluate Requirements in Technical Specifications" (Reference 9). The memorandum stated that scheduling DG maintenance during power operation is risk neutral for preventive maintenances of short duration and they can be scheduled during power operation.

Results of the CEOG plant specific analyses presented in Sections 6.3.2 through 6.3.5 are in general

-agreement with those of the BNL study. When the full scope of plant risk is considered, the risks incurred by extending the AOT for either corrective or preventive maintenance willbe substantially offset by plant benefits associated with avoiding unnecessary plant transitions and/or by reducing risks during plant shutdown operations, improved EDG reliability upon entering shutdown, and implementation of compensatory measures. The combined CEOG results indicate that the risk of performing EDG maintenance at power varies from risk benefiicial to risk neutral depending upon the duration and type of maintenance.

16

6.3 Assessment of Risk 6.3.I Overview The purpose of this section is to provide an integrated assessment of the overall plant risk associated with the adoption of the proposed AOT extension. The methodology used to evaluate the EDG System AOT extension was based in part on a'draft version of the "Handbook of Methods for Risk-Based Analyses of Technical Specifications" (Reference 8) and related industry guidance. As guidance for the acceptability of a Tech Spec modification, Reference 8 noted that any proposed Technical Specification change (and the ultimate change package) should either:

(1) be risk neutral, OR (2) result in a decrease in plant risk (via "risk trade-off considerations"), OR (3) result in a negligible (to small) increase in plant risk.

(4) be needed for utility to more efficiently and/or more safely manage plant operations.

A statement of need has been provided in Section 6.1. This section addresses the risk aspects of the proposed AOT extension.

In this evaluation, a risk assessment of the EDG AOT extension is performed with consideration of

, associated "at power", "transition" and "shutdown". The assessment includes consideration of risk increase associated with potential increased EDG unavailability and the associated risk benefits due to avoiding a forced mode transition, improvements in EDG reliability and performing the same maintenance at shutdown (see below).

Section 6.3.2 provides an assessment of the increased risk associated with continued operation with a single EDG out of service (OOS) .for preventive and corrective maintenance. The evaluation of the "at power" risk increment resulting from the extended AOT was evaluated on a plant specific basis using the most current individual plant PSAs as their respective baselines. Plant specific evaluations were performed by each participating utility. Results of these evaluations were then compared using appropriate risk measures as prescribed in Reference 8.

Section 6.3.3 assesses the risk of transitioning the plant from Mode 1 into a lower mode with a single EDG inoperable. The "at power" risk assessment presented in Section 6.3.2 provides an evaluation of continued operation of the plant with an extended EDG AOT for the purpose of performing corrective maintenance on the EDG. A conservative lower bound estimate of this risk was evaluated by modifying the reactor trip core melt scenario for a representative CE PWR. Based on this analysis, a core damage probability for the plant shutdown was established and compared to the single AOT risk associated with continued operation.

17

The relative risk of EDG PM for "at power" and "at shutdown" conditions is provided in Section 6.3.4.1. Recent experience has shown that the risk of maintaining the reactor in a shutdown condition can rival that of power operation.

EDG PM programs have been effective in reducing EDG unavailability due to failure to start and load-run. Section 6.3.4.2 provides a demonstration of the risk reduction possible by implementing a planned "on-line" PM program. In that analysis a parametric study is performed to demonstrate the impact of modest (10 to 30%) improvements in EDG reliability on decreased plant risk.

For completeness, the impact of the extended AOT on the plant large early release fraction is qualitatively assessed. The assessment includes an evaluation of the events leading to large early fission product releases and the role of the EDG in the mitigation of those events. This assessment.

is presented in Section 6.3.5.

tL3.2 Assessment of "At Power" Risk Methodology This section provides an assessment of the increased risk associated with continued operation=with a single EDG out of service (OOS). The evaluation of the "at power" risk increment resulting from the extended EDG AOT was evaluated on a plant specific basis using the most current individual plant PSAs for their respective baselines. Plant specific evaluations were performed by each participating utility. Results of these evaluations were then compared using the following risk measures (from Reference 8):

Average Core Damage Frequency (CDF): The average CDF represents the frequency of core-damage occurring. In a PSA, the CDF is obtained using mean unavailabilities for all standby-system components.

Core Damage Probability (CDP): The CDP represents the probability of core-damage..

occurring. Core-damage probability is approximated by multiplying core-damage frequency by a time period.

CondNonal Core-Damage Frequency (CCDS): The Conditional CDF is the Core Damage Frequency (CDF) conditional upon some event, such as the outage of equipment. It is calculated by re-quantifying the cutsets after adjusting the unavailabilities of those basic events associated with the inoperable equipment.

18

Increase in Core Dainage Frequency (ECDF): The increase in CDF represents the difference between the CCDF evaluated for one train of equipment ~mvail~a1 minus the CCDF evaluated for one train of equipment wa s avail 1 . For the EDGs:

hCDF = Conditional CD' ~> - Conditional CD' ~~

where CDF = Core Damage Frequency (per year)

Single AOT Risk Contribution: The Single AOT Risk contribution is the increment in risk associated with a train being unavailable over a period of time (evaluated over either the full AOT, or over the actual maintenance duration). In terms of core damage, the Single AOT Risk Contribution is the increase in probability of core-damage occurring during the AOT, or outage time, from the baseline. The value is obtained by multiplying the increase in the CDF by the AOT or outage time.

Single AOT Risk = hCDF x ~

where, hCDF = Increase in Core Damage Frequency (per year), and

~ = full AOT or actual maintenance duration (years)

Yearly AOTRisk Contnbution: The Yearly AOT risk contribution is the increase in average yearly risk from a train being unavailable accounting for the average yearly frequency of the AOT. It is the frequency of core-damage occurring per year due to the average number of entries into the LCO Action Statement per year. The value is estimated as the product of the Single AOT Risk Contribution and the average yearly frequency (fj of entering the associated LCO Action Statement. Therefore:

Yearly AOT Risk = Single AOT Risk x f where f = frequency (events/year)

Incremental changes in these parameters are assessed to establish the risk impact of the Technical Specification change.

Calculation of Conditional CDF, Single and Yearly AOT Risk Contributions Each CEOG utility used its current PSA to assess the Conditional CDF based on the condition that one EDG is unavailable. Each plant verified that the appropriate basic events are contained in the PSA cutsets used to determine the AOT risk contributions. This verification was performed as the first task in calculating. the Conditional CDFs. If basic events had been filtered out of the PSA cutsets, one of the two methods described below were used to ensure the calculation of Conditional CDF was correct or conservative:

19

1. Select the basic event for the failure mode of the component with the highest failure probability if the test/maintenance failure mode of the component had been filtered out; or

2. Retrieve cutsets containing relevant basic events at the sequence level and merge them with the final PSA cutsets.

The Conditional CDF given 1 EDG is unavailable was obtained by performing the following steps:

1. Set basic event probability for the failure mode for an EDG equal to 1.0.

2. Set any basic event probabilities for other failure modes for that train set equal to 0.0.

3. Set basic event probability for EDG unavailable due to test and maintenance equal to 0.0.

4. For the case where the LCO Action Statement was prompted by need for Corrective Maintenance (CM) (i.e., equipment failure), adjust the other train s corresponding basic event common cause failure unavailability to the probability of failure given one train has failed (i.e., equal to the beta factor, P, for the Multiple Greek Letter Method).

5. For Preventive Maintenance (PM) (i.e., no equipment failure), set the failure rate of the train remaiiiing in service to the total single train failure rate (including both independent and common cause failure data).

6. Requantify the PSA cutsets.

The Conditional CDF was therefore assessed for both CM and PM. The difference between the two values is a result of the aforementioned difference in treating common cause failure. It should be noted that the definition of CM for use in the PSA is considerably more stringent than the pragmatic TAGGED INOPERABLE definition of CM used in Section 5.0. In this context, CM refers to maintenance performed on a component that cannot otherwise perform its safety function.

The Conditional CDF given 1 EDG is never out for test or maintenance was obtained by setting the basic event probability for the failure mode for an EDG equal to 0.0, and requantifying the PSA cutsets. No adjustment was made to common cause failure from the value used in the baseline PSA.

The Conditional CDFs were evaluated for each EDG, and the most conservative result was used.

The Conditional CDF was then used to calculate the increase in CDF. The Single AOT Risk Contribution for each plant was then calculated for the following cases:

20

~ ~

- Current full AOT,

- Proposed full AOT (both 7-day and once per cycle 10-day),

- Mean downtime for CM, and

- Mean downtime for PM.

A mean downtime of 24 hours/event was assumed for CM. For PM, the mean duration per event was calculated by dividing the proposed downtime (unavailability target, hours/year/EDG) by the proposed frequency of PM. A proposed downtime of 160 hour0.00185 days 0.0444 hours 2.645503e-4 weeks 6.088e-5 months s/year/EDG and a frequency of 2.8 per year was assumed for PM. These values are mean values presented in Reference 3. Plants with actual data available used plant specific values.

The Single AOT Risk Contributions were then used to calculate the Yearly AOT Risk Contributions (Single AOT Risk x frequency) based on each plant's actual frequency of entry into the AOT, for both CM and PM. Plant specific frequencies were used in this calculation for CM and PM whenever available. If not available, maintenance frequencies were assumed to be 2.5 events/year for CM, and 2.8 events/year for PM. Ifavailable data for downtime frequency did not distinguish between CM and PM, a split of 50/50 was conservatively assumed for CM/PM.

The overall Yearly AOT Risk Contribution is assumed to be the sum of the Yearly AOT Risk Contribution due to CM and the Yearly AOT Risk Contribution due to PM. Tables 6.3.2-1 and 6.3.2-2 provide the Conditional CDFs and the Single and Yearly AOT Risk Contributions for each plant for CM and PM, respectively.

At many plants both EDGs may power different equipment and therefore risk predictions will not be symmetric. In the current analyses, the risk measures presented are those of the "worst" (i.e.

most important) EDG.

Calculation ofAverage CDF In order to calculate the Average CDF for the extended EDG AOT, a new value for EDG unavailability due to test/maintenance was derived. A 2.5% unavailability was assumed, which equates to a maintenance duration of 220 hours0.00255 days 0.0611 hours 3.637566e-4 weeks 8.371e-5 months per year per EDG. For plants with a maintenance schedule already in place or defined, then actual plant data was used in lieu of the above assumptions.

The impact on the PSA was then calculated to obtain the Average CDF for this new EDG unavailability. This new Average CDF was then compared to the base case value in the plant's PSA. Table 6.3.2-3 provides the proposed Average CDF and the base average CDF for each plant.

21

The results from each plant were assimilated, and the Single AOT and Yearly AOT Risks were calculated for each plant. Tables 6.3.2-1 through 6.3.2-3 present the results of these cases on a plant specific basis, and summarizes the EDG AOT CDF contributions for each plant. These risk contributions include the Conditional CDFs, Increase in CDF, Single AOT and Yearly AOT risks for both CM and PM, based on full AOT and mean downtime, and current Average CDF and proposed Average CDF.

The results for the conditional CDF and Single AOT risks presented in Table 6.3.2-1 are.

conservative. Specifically, the evaluation of the conditional CDF for corrective maintenance considers that the operable EDG is subject to a common cause failure for the entire duration of the AOT. In several CEOG member plant technical specifications it is required that either an assessment of the absence of a common cause failure mechanism or an EDG start/run test be performed following discovery of the EDG inoperability. In practice, even when the technical specifications do not require a common mode failure assessment, it is likely that such an assessment is performed upon the discovery of the cause of the EDG inoperability. Thus, plant operation with one EDG in CM, while the OPERABLE EDG has a high likelihood of common cause failure, would be restricted to a narrow time window which is considerably less than the full 7 day AOT.

For CM, most CE PWRs indicate that repair of a non-functional EDG results in an increase in conditional core damage frequency (CCDF) from the baseline CDF by a factor of less than 5. The increase in Single AOT Risk Contribution for all CE PWRs (from Table 6.3.2-1, Proposed Single AOT Risk based on a full 7 day AOT - Current Single AOT Risk) varies from 0.0 (for plants that already have a 7 day AOT for EDGs) to 2.16E-06. The increase in Single AOT Risk Contribution for a Single AOT Risk based on a 10 day AOT varies from 3.38E-07 to 3.78E-06.

For all CE PWRs, declaring the EDG INOPERABLE and taRing the EDG out of service for maintenance increases the conditional CDF by a factor of between 1.5 and 4. The increase in Single AOT Risk Contribution for all CE PWRs (from Table 6.3.2-2, Proposed Single AOT Risk based on a full 7 day AOT - Current Single AOT Risk) varies from 0.0 (for plants that already have a 7 day AOT for EDGs) to 1.38E-06. For a full 10 day AOT, the increase from Current to Proposed Single AOT Risk Contribution varies from 2.09E-07 to 2.42E-06.

As will be shown in the following sections, these risks are offset by reductions in transition and shutdown risks.

Table 6.3.2-3 summarizes the impact of the proposed AOT extensions on the plant yearly core damage frequencies. The change in the Average CDF due to increasing the EDG AOT varies from a factor of 1.01 to 1.078. When interpreting Table 6.3.2-3, it is important to note that some plants evaluated their IPEs based on actual plant data and not on the full AOT, whereas the Proposed Average CDFs presented in the table for all plants are based on the fullproposed AOT. Two plants (ANO-2 and FCS) that based their IPEs on actual EDG downtimes had recent plant histories with very limited EDG PM. Therefore, the change factor for these plants is overestimated. A more 22

appropriate estimate of the change factor can be established by evaluating the baseline PRA PM at one full AOT per year. This value is presented in parenthesis for these plants.

Waterford Unit 3 indicates a higher impact on the CDF than other plants. This increased impact is primarily due a conservative treatment of the SBO event within the IPE. Specifically, the Waterford-3 IPE assumes that all EDG failures occur at the time of loss of offsite power (i.e. all EDG failures are conservatively assumed to be start failures). Even with this conservative modeling approach, Waterford-3 has a relatively low plant baseline CDF (1.54 x 10 per year). A preliminary evaluation of a more realistic approach to the treatment of EDG failures was performed to support this assessment. In this realistic method, the product of the EDG run failure probability density function and the offsite power non-recovery function was integrated over the mission time.

This accounts for the fact that EDG run failures can occur at any time during the mission time, including late in the sequence when the probability that offsite power will be recovered is high.

Using this realistic methodology, the expected CDF increase factor willreduce from 1.14 to 1.078 (see Table 6.3.2-3). This translates to an absolute yearly risk increase of about 1 x 10 per year.

For Waterford-3 taking the EDG out for maintenance would result in an increase in CCDFs by a factor of about 7.2 for CM and 2.9 for PM. These risks are generally comparable to those associated with the CE group as a whole.

23

Table 6.3.2-1 CEOG AOT CONDITIONALCDF CONTRIBUTIONS FOR EDGS - Corrective Maintenance PARAMETER ANO-2 Fozt Maino Millstono Palisades Palo San St. Lucio St. Lucio Watczfozd Calhoun Yanhe 2 Verde Onofzo 1 2 3 1,2, &,3 2&,3 EDQ Success Czitczia 1 of2 1 of2 1 of2 1 of2 1 of2 1 of2 1 of 2 1 of2 1 of2 1 of 2 Present AOT, days Pzoposed AOT, days . 7/10 7/10 7/10 7/10 7/10 7/10 7/10 7/10 7/10 7/10 Conditional CDF, pcr yr 1.26E44 5.28E45 1.15844 9.43E45 1.64E44 2.43E44 5.92845 6.3E45 1.56E44 (1 EDG unavailable)

Conditional CDF, per yr 3.27845 1.17845 7.36E45 3.24E45 S.OOE45 4.58FAS 2.69845 2.1E45 2.3E45 1.50E45 (1 EDG never out for T/M)

Increase in CDF, pcr yr 9.30E45 4.11E45 4.14E45 6.19E45 1.14E44 1.97844 3.23E45 3.8E45 4.0E45 1.41E44 Singlo AOT Risk, Cuzzent 7.65E47 7.88E47 7.94847 5.09E47 2.19E46 1.62E46 2.65847 3.1E47 3.3E47 1.16E46

,:;";:f'.'78846,:; <<,7.,'8 8FA7k,. "'2!f9E46";: '"378FA6.<< 3'."7:'3847."',: ~7.7847;',, z'2'.70846"j;

-',.'.2,":55846':,'; ..'"3, 12845"', ".'5'AOF46."."," ".."".8i85847.'" <<";:l'0846/ Pluri'l8'46/~",.: +1<<55846~~>

Downtimo Fluency, pcr yr 0.63 2.5 2.5 2.5 2.0 1.8 0.63 2.5 2.5 2.5 per diesel*

Yearly AOT Risk, Current, 4.78E47 1.97E46 1.98E46 1.27E46 4.37E46 2.92E46 1.66E47 7.8847 8.2E-07 2.90E46 per yr/diesel**

Yearly AOT Risk, 1. 12E46 1.97E46 1.98846 4.37E46 6.81E46 3.87E47 1.8E46 1.9E46 6.76846 Proposed, per yr/diesel**

Actual Duration, hzs/event*** 15 Singlo AOT Risk 1.61E47 1.13E47 1.13E47 1.70847 3.12E47 SAOE47 8.78E48 1.0847 1.1E47 3.86E47 (bascd on actual data)

Yearly AOT Risk/yr/dicscl** 1.00E47 2.82E47 2.84E47 6.25E47 9.72E47 5.48E48 2.7E47 9.66847 (based on actual data)

Generic data = . peryrpcr diesel

<<Value pzescnted for worst caso diesel

- - Generic data = 24 hzs/event

Table'6.3.2-2 CEOG AOT CONDITIONALCDF CONTRIBUTIONS FOR EDGS - Preventive Maintenance PARAMETER ANO-2 Fort Maino Millstono Palo San St. Lucia St. Lucio Waterford Calhoun Yankoo 2 Verde Onofm 1 2 3 1,2,8c3 2&,3 EDG Success Criteria 1 of2 1 of 2 1 of2 1 of2 1 of 2 1 of 2 1 of2 1 of2 1 of2 1 of2 Present AOT, days Pmpoeed AOT, days 7/10 7/10 7/10 7/10 7/10 7/10 7/10 7/10 7/10 7/10 Conditional CDF, pcr yr 1.01E44 3.71E45 1.13E44 8.58E45 1.57844 1.72E44 5.41FAS 4.1E45 4.7E45 6.76E45 (1 EDG unavailable)

Conditional CDF, per yr 3.27845 1.17E45 7.36E45 3.24E45 5.00E45 4.58E45 2.69845 2.1845 2.3845 1.50E-OS (1 EDG ncvcr out for T/M)

Increase in CDF, per yr 6.86845 2.54E45 3.94E45 5.34E45 1.07E44 1.26844 2.72845 2.0E45 2.4E45 5.26E45 Single AOT Risk, Current 5.64847 4.87847 7.56E47 4.39E47 2 05846 1.04E46 2.24E47 1.6E47 2.0E47 4.32847

.':,':;"'s,::,-,:;Smgle."',AO7'.;Rtelt~j@'~:,i",:::i;","":j!:7,'tlayP'kj<:'. ~~1's32846:;:-' 4'878fg :,:.'l56847g ~f':;028)5" "..-;:2t05846,'::: '-"0,"42846:> :":;5s'22847,'."". 8'3::i847,',":!,: ~ f';0"1hW";'",:.

~ '. '~~4JmnoscQ; J>>@km Ji&l4ZI e'.av:,>pea% " >

&~J

-'; 4';6847.".'t'6",68'47'::

""'l?88846'"' '?:,';6';9684)7,". .=:,i;0884)6~ !",.i,:;46~,-';,:; g;:93846j 53;"46846;.. '7."'45EPgm ::".?$ ';4847$ ':-'.,'. 1'A'4E46'=::.

Downtime Frequency, per yre 2.0 2.8 2.8 2.8 4.0 3.0 2.8 2.8 2.8 Yearly AOT Risk, Current, per yr/diesel** 1.13846 1.36846 2.12E46 1.23E46 8.21E46 3.11E46 2.79E47 4.6E47 5.5847 1.21E46 Yearly AOT Risk, Pmposcd, pcr yr/dicscl** 2.63E46 1.36E46 2.12E46 2.87E46 8.21E46 7.26846 6.52E47 1.1E46 1.3E46 2.82E46 Pmposcd Downtime tus/tcain/yrs** 175 114.75 Actual Duration hrs/cvcntss** 57 63 51 48 53 86 86 50 Single AOT Risk 7.52E47 1.66E47 2.81E47 3.14E47 5.86E47 7.68E47 2.85E47 2.0E47 2.4E47 3.00E47 (based on actual duration)

Yearly AOT Risk/yr/diesel*+ 1.50E46 4.64E47 7.87847 8.78E47 2.35E46 2.31E46 3.56847 5.5847 6.6E47 8.41E47 (based on actual duration)

+ Generic data = 2.8 pcr yr pcr dicscl +s>> Duration (hrs/cvcnt) ~ Pmposcd Downtime (hre/yr)/Frequency (cvcnte/yr) esvalucs prescntcd are for worst caco dicscl esse Generic data = 220 hre/yr/diesel 25

Table 6.3.2-3 CEOG PROPOSED AVERAGE CDFS PARAMETER ANO-2 Fort 'aine Millstone Palo San St. Lucio St. Lucio Waterford Calhoun Yankee 2 Verde Onofm 1 2 3 1,2, Ec3 2Ec3 EDG Success Criteria 1 of2 I of2 1 of2 1 of 2 1 of2 1 of2 I of2 1 of2 1 of2 1 of2 Print AOT, days Pmposcd AOT, days 7/10 7/10 7/10 7/10 7/10 7/10 7/10 7/10 7/10 7/10 Proposed Downtime, hrs/yr 219 220 235 168 220 220 Avcxage CDF (base), per yr 3.28E45 1.18E45 7AOE45 3.41E45 5.15E45 4.74E45 2.74E45 2. 14E45 2.35E45 1.54E45 Pmposcd Average CDF 3.50E45 1.27E45 7.45E45 3.50E45 5.28E45 4.85E45 2.86E45 2.2E45 2.4E45 1.75E45 Change factor fmm baseline 1.07 1.08 1.01 1.03 1.02 1.02 I,I4sssa CDF (1.05) (1.02) (1.078)

+ Generic data = 220 hrs/yr/diesel

++ The Pmposed Average CDF is pzescntcd hem is based on using the full Atyi'hexeas the baseline IPE Average CDF was based on actual plant data which had very little PM on line (sce Table 5.2-1).

- - The Numbers in parenthesis represent % change fmm baseline IPE ifthe baseline IPE was evaluated over the full AOT.

- - - See page 25 for discussion of results 26

tf.3.3 Assessment of TransMon Risk For any given AOT extension, there is theoretically an "at power" increase in risk associated with it. This increase may be negligible or significant. A complete approach to assessing the change in xisk accounts for the effects of avoided shutdown, or "transition risk". Transition Risk represents the risk associated with reducing power and going to hot or cold shutdown following equipment failure; in this case, one EDG unavailable. Transition risk is of interest in understanding the tradeoff between shutting down the plant and restoring the EDG to operability while the plant continues operation. The risk of transitioning from "at power" to a shutdown mode must be balanced against the risk of continued operation and performing corrective maintenance while the plant is at power.

To illustrate this point, a representative CE PWR has performed an analysis for transition risk associated with one inoperable EDG. The methodology and results obtained by this plant are presented below and are considered generically applicable to the other CE plants.

Methodology The philosophy behind the transition risk analysis is that if a plant component becomes unavailable, the CDF will increase since less equipment is now available to respond to a transient if one were to occur. However, as long as the plant remains at power, this CDF is constant. At the point in time that a decision is made to shut down, the CDF increases since a "transient" (manual shutdown) has now occurred, and the equipment is still out of service.

The Core Damage Probability (CDP) associated with the risk of plant transition from plant full power operation to shutdown is obtained by modifying the "uncomplicated reactor trip" core damage scenario in the PSA model. In this evaluation the incremental risk is dominated by the increased likelihood of loss of main feedwater and the reliance on auxiliary (and/or emergency) feedwater to avert a core damage event. A cutset editor was used to adjust cutsets representing manual shutdown or miscellaneous plant trips to reflect the CDP associated with a forced shutdown assuming one EDG is out of service and requantifying the PSA cutsets. Conservatisms that had been included in the base PSA model were deleted to reflect the greater control that the plant staff has in the shutdown process. Specifically, the baseline PSA assumed total loss of main feedwater (MFW) within 30 minutes of reactor trip. In the transition analysis, MFW was assumed to be recoverable following failure of AuxiliaryFeedwater. A human error probability (value of 0. 1) was added to cutsets that contained no basic events, including human actions, that would cause MFW to be unavailable. The duration of the transition process was assumed to be 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to hot standby and 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to hot shutdown), and result in a Mode 3 or Mode 4 end state with core cooling provided via the steam generators.

Additional human errors that would be associated with a detailed portrayal of the shutdown process and the entry into shutdown cooling were not included in order to establish a conservative lower bound assessment of the transition risk. Errors of commission, such as diversion of RCS flow during SDC valve alignment, are also not considered in this analysis.

27

Such errors would add to the disadvantages of the shutdown alternative, and therefore, to include them would be non-conservative for the purpose of this comparison. Similarly, any transitional risks associated with the return to plant operation are conservatively neglected.

Based on the above methodology the CDP associated with the lower mode transition was calculated for the representative plant to be 1.00E-06. Results of transition risk analyses can be generalized for the other CE PWRs by assuming that the ratio of the CDP for Transition Risk to the baseline Average CDF is constant for all plants. The baseline CDFs were selected rather than the Conditional CDFs for the ratio between the other CE plants because the analysis for the representative plant indicated that transition risk was more a function of Loss of MFW rather than a function of the specific equipment out of service.

That is, 4 CDP~~ = (CDF~CDF~~

4CDP~q~~

where:

4CDP~~ Incremental risk due to mode transition for plant CDF~ Baseline CDF for plant CDF~

CD'or

~ pep ptaat Representative plant baseline CDF Incremental risk due to mode transition for representative plant The transition risk may be used to evaluate the relative risks of performing EDG repair at power to that of performing the same repair at some lower mode. The risk of continued operation for the full duration of the AOT is bounded by the single AOT risk for CM (if a common cause failure is suspected) and by the single AOT risk for PM when common cause failure can be ruled out. The comparable risk of the alternate maintenance option involves consideration of four distinct risk components:

(1) Risk of remaining at power prior to initiating the lower mode transition.

This risk will vary depending on the ability of the staff to diagnose the EDG fault and the confidence of the operating staff to expeditiously complete the repair. The time interval for power operation with a degraded component, prior to mode transition will vary from one to several days.

(2) Risk of lower mode transition.

This risk is accumulated over a short time interval (approximately 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ).

(3) Risk of continued lower mode operation with an impaired EDG.

28

~ ~

In this mode, the reactor is shutdown and the core is generating decay power only.

However, risks in this mode remain significant. Depending on the particular operational mode, resources to cope with plant transients willtypically be less than at power. These modes are characterized by decreased restrictions on system operability, longer times for operator recovery actions, lower initiating frequency for pressure driven initiators (such as LOCA) and a greater frequency for plant transients such as those initiated by loss of offsite power and loss of main feedwater.

(4) Risk of return to power The power ascension procedure is a well controlled transient. Reference 8 conceptually discusses that risks associated with this transition are greater than those associated with at power operation, but significantly below that associated with the initial lower mode transition (item 2).

The analysis of transition risk presented in this report quantifies only the risk of lower mode transition (item 2).

Results.

Table 6.3.3-1 presents the risk associated with transitioning the plant to a lower mode for each plant. The numbers in the table represent only the lower mode transition risk component of the transition sequence (item 2). The risk associated with the transition portion represents a significant fraction of the risk that would be incurred for a seven day "at power" (Single AOT Risk from Tables 6.3.2-1 and 6.3.2-2) EDG maintenance period.

When the risk at power and the risk at the lower mode of operation are comparable, then these results indicate that performing a 7 day EDG maintenance activity "at power" would be risk beneficial.

29

Table 6.3.3-1 TRANSITION RISK CORIRIBUTIONS FOR EDG CM Transition Risk Contribution (LIICDP) 6.92E-07 Fort Calhoun Station 2.49E-07 Maine Yankee 1.56E-06 Millstone 2 7.19E-07 Palisades 1.09E-06 Palo Verde 1,2 & 3 1.00E-06 San Onofre 2 & 3 5.78E-07 St. Lucie 1 4.5E-07 St. Lucie 2 5.0E-07 Waterford 3 3.25E-07 30

6.3.4 Assessment of Shutdown Risk 6.3.4.1 Assessment ofRisk-RadeoQ The risk of EDG maintenance at shutdown was investigated using the shutdown PSA of a CEOG participant. This study was directed at estimating the advantage of performing EDG maintenance at power by estimating the corollary impact of performing the same PM during shutdown. Shutdown risks were evaluated for two shutdown configurations: Mode 5 mid-loop operation (representative of the early reduced inventory phase of the shutdown) and for a condition representative of a spent fuel pool operation with a complete fuel off-load. The impact of EDG PM was assessed by analyzing the incremental reduction in core damage probability (CDP) when two EDGs are available vs. the plant operating state when one EDG is operable and available while the second EDG is undergoing maintenance. Recovery of offsite power was considered. However, recovery of failed or inoperable EDGs was assumed not to occur in time to avert core damage.

Results of this investigation are summarized in Table 6.3.5-1. The tabular information is presented in terms of the daily core damage probability. The daily CDP is assumed applicable anytime while the plant is in the shutdown mode analyzed.

Maintenance of the EDGs early in the shutdown operation and while the plant is at reduced inventory (e.g. mid-loop operation), results in an incremental risk of core damage equal to about 1.2 x 10 per day while the EDG is inoperable. In this instance, the high impact of the EDG is a result of the short time expected to core damage. Late in the sequence the shutdown PSA predicts a similar trend for the EDG importance (1.7 x 10~ per day). This later evaluation further assumed that once the fuel in the spent fuel pool uncovers (about 70 hours8.101852e-4 days 0.0194 hours 1.157407e-4 weeks 2.6635e-5 months into the event), efforts to refill the spent fuel pool would be unsuccessful. These events can be further complicated in that failure of fuel during shutdown can result in higher radiation exposures than similar events occurring at power in a closed containment.

TABLE 6.3.4.1-1 DAILYPLANT CORE DAMAGEPROBABILITYAT SHVIDOWN FOR A REPRESENTATIVE CE PWR CONDITION NO PM I EDG IN PM INCREMENT IN (2 EDGs AVAILABLE) CDP REDUCED INVENTORY 1.04 X 10 2.26 X 10 1.2 X 10 (MID-LOOP)

SPENT FUEL POOL 5.1 X 107 4.36 X 10 3.8 X 10 31

Conclusion Early in the shutdown, risk of PM is generally equivalent to that for similar maintenance at power. At later times, incremental risks associated with EDG PM may be optimistically expect to be lower than what is reported in this assessment. However, these risks cannot be neglected and may be comparable to that of power operation.

6.3.4.2 Assessment ofEnhanced EDG Reliability Reference 2 noted that over the past several years "on-line" PM on EDGs has increased. During the same time interval, the unreliability of the EDGs has also decreased. While a precise relationship between the PM process and EDG reliability has not been established there appears to be a positive correlation between increased PM performed in recent years and the enhanced EDG reliability which has been observed. While not all PM activities willdirectly impact EDG reliability, certain PM originating from plant reliability improvement programs and including manufacturer suggested inspections and modifications do likely have a beneficial effect. This section explores the risk impact of small to modest increases in EDG reliability on risk "at power" and on risk during the early low inventory phases of a plant shutdown.

At Power" Risk Assessment An analysis was performed to determine what increase in EDG reliability would be required in order to offset the risk increment associated with 5 days (120 hrs) of "on line" maintenance.

The five day interval generally bounds the average PM unavailability for the CE PWRs.

Assumptions employed in the analysis are as follows:

1. The nominal EDG failure probability to start and load/run foi 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is .09 per demand,

2. The reliability benefit is realized for six months out of a year.

In this assessment the risk increment incurred by removing one EDG from service for a 5 day "at power" repair period was related to the integrated reduction in risk achieved by improving the EDG reliability (reducing the failure to start and failure to load and run values) by 10, 20 and 30%.

Results of this assessment are summarized in Table 6.3.4-1. Comparing the risks of at power PM with risk reductions due to reliability improvements, it is apparent that a PM program that improves the average performance of the EDG by 15% offsets the risk of EDG unavailability due to PM.

Table 6.3.4.2-1 EDG MP IN'PENANCE VS. POTENIIALIMPROVEMENTS IN EDG RELIABILITY Yearly Risk Increase due to Risk Reduction at Power due to Reliability Improvement 120 hrs of "at power" PM 10% 20% 30%

3.4 X 107 2.3 X 107 4.9 X 107 7X 107 Shutdown Risk Assessment It has been shown in Section 6.3.4.1 that a modest improvement in EDG reliability from performing PM probably offsets the contribution to the "at power" risk from having an EDG out of service to perform the PM. A second benefit of performing on-line EDG Preventive Maintenance (PM) is that upon entering shutdown modes, the EDGs will have a greater reliability than if maintenance had been done at the end of a refueling outage. To assess this effect, it is assumed that "at power" PM will result in a 15% improvement in the EDG reliability. In other words, the fact that the PM is performed several months closer to the time the EDG is needed is assumed to result in a 15% lower failure probability.

Additional assumptions employed in this analysis are as follows:

The only initiating event that is considered to be the EDG reliability is the Loss of Offsite Power.

2. Reduced inventory operation is assumed for 7 days

3. No other alternate ac is credited.

4. Core damage occurs 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after LOOP.

5. Recovery of offsite power is credited based on Reference 10.

The data used in the calculation is summarized in Table 6.3.4-2.

33

TABLE 6.3.4.2-2

SUMMARY

OF ANALYSIS DATA Probability of EDG1 to Fail to Start and Load (Base) .014 Probability of EDG1 to Fail to Start and Load (Given PM) .012 Probability of Loss of Offsite Power over the interval of reduced inventory OPERATION Probability to Recover Off-site Power in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months 0.58 Common cause failure of EDG2 given Mure of EDG1 .05 Applying these assumptions, the impact of EDG reliability improvement on the risk reduction at shutdown can be approximated. 'he B,CDP for a shutdown with reduced inventory operation is approximated as:

hCDP = P (h~(1-P )

WHERE,

~~ = (P~d"P~P) -(P~u>'- ~dP>

34

Substituting values from Table 6.3.4-2 into the above relation results in an estimated risk reduction benefit at shutdown of 2.6 x 107. For longer periods at reduced inventory, or if batteries are unavailable, the net risk benefit would correspondingly increase.

Assessment of Wade oJJ'etween PM at power and improved EDG Reliability Parametric evaluations presented in sections 6.3.4.1 and 6.3.4.2 indicate that PM that results in modest improvements in EDG reliability over the long term can more than offset the short term risk from having an EDG out of service to perform the PM.

6.3.$ Assessment of Large Early Release A review of large early release scenarios for the CE PWRs indicates that early releases arise as a result of one of the following class of scenarios:

1. Containment Bypass Events These events include interfacing system LOCAs and steam generator tube ruptures (SGTRs) with a concomitant loss of SG isolation (e.g. stuck open MSSV),

2. Severe Accidents accompanied by loss of containment isolation These events include any severe accident in conjunction with an initially unisolated containment.

3. Containment Failure associated with Energetic events in the Containment.

Events causing containment failure include those associated with the High Pressure Melt Ejection (HPME) phenomena (including direct containment heating (DCH)) and hydrogen conflagrations/detonations.

Of the three release categories, Class 1 tends to represent a large early release with potentially direct, unscrubbed fission products, to the environment. Class 2 events encompass a range of releases varying from early to late that may or may not be scrubbed. Class 3 events result in a high pressure failure of the containment, typically immediately upon or slightly after reactor vessel failure. Detailed Level 2 analyses for the plant condition with an increased availability of the EDG are not performed. However, assessment of the expected change in the large early release fraction was made by assessing the impact of the EDG availability on the above event categories.

35

Containment Bypass Events Events contained in this category are not expected to significantly rely on the EDG for event mitigation. Events included in this category are the Large Interfacing System LOCA (i.e. failure of an SDC line). Testing and or maintenance of EDGs willnot impact the ISLOCA frequency.

ISLOCAs are characterized by a continuous and unreplenished loss of RCS inventory and makeup. In these scenarios, core damage ultimately results following the depletion of reactor coolant. Thus, provided that a continuous independent water supply is not available during the accident, the ISLOCA willprogress into early core damage regardless of the EDG availability.

Severe Accidents accompanied by Loss of Containment Isolation Another event contributing to large early fission product releases could occur when an unmitigated severe accident occurs in conjunction with an initially unisolated. containment.

Increased unavailability of the EDGs may result in a marginally greater frequency of core damage events due to station blackout. Since the probability of the loss of containment isolation is low, the net impact of enhanced SBO coupled with a loss of containment isolation on the overall plant radiological releases is considered negligible.

Containment Failure associated with Energetic events in the Containment.

Class 3 events are dominated by RCS transients that occur at high pressure. These events are typically restricted to events that initiate as a station blackout or a loss of feedwater. An increased probability of SBO induced core melts willresult in a proportional increase in the SBO contribution to large early radiation releases due to direct containment heating (DCH). As a result of the conservative treatment of DCH issues in many PSAs there is a noticeable correlation between early containment failure induced by DCH and station blackout initiators.

This relationship exists since DCH containment failure is a result of a high pressure melt ejection (HPME) at reactor vessel lower head failure, and that SBO events can lead to high pressure core melts. The fraction of SBO events leading to a high pressure core melt and subsequent HPME in practicality should be small when one considers the high propensity of hot leg/surge line creep failure occurring in advance of lower head failure.

In this assessment, the impact of increased EDG maintenance unavailability on the large early releases was established by assuming that the increase in the yearly CDF (typically on the order of 1 to 10%) was totally due to an increase in unmitigated station blackout events. Furthermore, it can be conservatively assumed for the CE plants involved in this study that less than 20% of SBO events result in large early containment failures. Therefore, increased EDG on-line maintenance will result in a small increase in large early containment failure scenarios.

36

6.3.6 Summary of Risk Assessment The proposed increase in the EDG AOT was evaluated from the perspective of various risks associated with plant operation. For the plants evaluated, incorporation of the extended AOT into the technical specification can potentially result in negligible to small increases in the "at power" risk. However, when the full scope of plant risk is considered, the risks incurred by extending the AOT for either corrective or preventive maintenance will be substantially offset by risk benefits associated with avoiding unnecessary plant transitions and/or by reducing risks during plant shutdown operations, and imposition of limited restrictions for performing EDG PMs.

The unavailability of one EDG was found to not significantly impact the three classes of events that give rise to large early releases. These include containment bypass sequences, severe accidents accompanied by loss of containment isolation, and containment failure due to energetic events in the containment. It is therefore concluded that increased unavailability of one EDG (as requested via Section 2) results in a negligible impact on the large early release probability for CE PWRs.

The impact of implementation of the proposed extended AOT will vary from being risk beneficial to posing a negligible increase in plant risk. The precise impact will depend on the specific circumstances of the entry into the LCO Action Statement.

6.4 Compensatory Measures As part of implementing the Maintenance Rule, each CE PWR utility has developed or is in the process of developing a method for configuration control during maintenance. If maintenance is performed on a system/train concurrent with other maintenance, the impact on risk will be evaluated prior to performing maintenance. Some plants achieve this via procedures which require that PSA evaluation is performed prior to performing maintenance. Other plants have a matrix showing the risk associated with different combinations of systems/trains unavailable due to maintenance. This matrix is used in planning the rolling maintenance schedule which is part of implementing the Maintenance Rule.

The following conditions/restrictions are typical of those that will be imposed on the operator governing "at-power" maintenance procedures:

1. Do not enter the LCO Condition for voluntary inoperability of an EDG if the auxiliary systems for the diesel generator that will remain available are not fully operational (but do not require LCO entry for operability).

2. Do not voluntarily enter the EDG LCO ifany component that can significantly increase plant risk is simultaneously expected to be out of service.

37

3. When performing extended EDG maintenance ensure that existing resident plant alternate AC power sources (e.g. "swing" DGs, combustion turbines or independently powered FW pumps) are functional.

4. Do not perform maintenance on components of the Electrical Distribution System (EDS)

(e.g., main transformer) that could significantly increase the likelihood of a LOOP initiating event while an EDG is out for maintenance. Minimize challenges to the EDG.

5. Do not perform maintenance on a diesel generator if an auxiliary feedwater pump and associated support system and component are unavailable.

Additional operational restrictions and cautions may include the following:

1. Schedule PM to coincide with favorable weather conditions, e.g., not during "ice" or electrical storms which may induce LOOP. Consider preservation of the grid.

2. Put procedures or pre-planned activities defining restoration of equipment in place before PM is done.

3. Hold briefings with appropriate plant personnel to ensure they are aware of impact associated with taking an EDG out of service.

4. Ensure availability of replacement parts and special tools, and establish procedures prior to taking an EDG out of service.

5. Check safety-related equipment in division of operable EDG for proper alignment.

6. Restrict the removal of any equipment from service during EDG maintenance.

7. Restrict main switchyard activities (maintenance or re-configuration) to life-threatening or safety-threatening responses (i.e., responding to fires) while an EDG is inoperable for maintenance.

In addition to the above, when the one time 10 day AOT is to be exercised, the plant should take all reasonable efforts to not perform concurrent voluntary maintenance activities on other plant risk significant components and should restrict any unnecessary activities in the plant or the switchyard that can increase the risk of loss of off-site power.

7.0 TECHNICALJUSTIFICATION FOR STI EXTENSION EDG STI extensions are not within the scope of this effort.

38

8.0 PROPOSED MODIFICATIONS TO NUREG-'1432 Attachment A includes proposed changes to NVREG-1432 Sections 3.8.1 and B 3.8.1 that correspond to the findings of this report.

9.0

SUMMARY

AND CONCLUSIONS This report provides the results of an evaluation of the extension of the Allowed Outage Time (AOT) for one emergency diesel generator (EDG) contained within the current CE plant technical specifications, from its present value, to seven days. In addition, a once per cycle AOT of 10 days for corrective maintenance is also requested. This AOT extension is sought to provide needed flexibility in the performance of both corrective and preventive maintenance during power operation. Justification of this request was based on an integrated review and assessment of plant operations, deterministic/design basis factors, plant risk and EDG reliability.

Results of this study demonstrate that the proposed AOT extension provides plant operational flexibilitywhile simultaneously adequately controlling overall plant risk.

The proposed increase in the EDG AOT to 7 days with a once per cycle 10 day AOT was evaluated from the perspective of various risks associated with plant operation. For the plants evaluated, incorporation of the extended AOT into the technical specifications potentially results in small increases in the "at power" risk. However, when the full scope of plant risk is considered, the risks incurred by extending the AOT for either corrective or preventive maintenance will be substantially offset by plant benefits associated with avoiding unnecessary plant transitions and/or by reducing risks during plant shutdown operations, improved EDG reliability upon entering shutdown, and implementation of compensatory measures.

The unavailability of one EDG was found to not significantly impact the three classes of events that give rise to large early releases. These include containment bypass sequences, severe accidents accompanied by loss of containment isolation, and containment failure due to energetic events in the containment. It is concluded that increased unavailability of an EDG (as requested via Section 2) will result in a negligible impact on the large early release probability for CE PWRs.

39

10.0 REH~~KCES

1. 10 CFR 50.65, Appendix A, "The Maintenance Rule".

2. SECY-93-044, "Resolution of Generic Safety Issue B-56, "Diesel Generator Reliability",

letter to ACRS from J. Taylor (NRC), Enclosure 8

3. NUREG/CR-5944, "Emergency Diesel Generator: Maintenance and Failure Unavailability, and Their Risk Impacts, P. Samanta, et. al., BNL, November, 1994.

4. 10 CFR 50.63 "Loss of all Alternating Current Power".

5. Regulatory Guide 1.155, "Station Blackout", August, 1988.

6. SECY-93-044, "Resolution of Generic Safety Issue B-56, "Diesel Generator Reliability",

letter to ACRS from J. Taylor (NRC)

7. Letter C. Shirake (NRC) to Cooper-Bessemer Working Group,

Subject:

Summary of Nov. 22, 1994, Meeting", December 15, 1994.

8. NU~REG/CR-6141, BNL-NUREG-52398, "Handbook of Methods for Risk-Based Analyses of Technical Specifications", P. K. Samanta, I. S. Kim, T. Mankaino, and W.

E. Vesely, Published December 1994.

9. Memorandum for Thomas E. Murley from Eric S. Beckjord in Research Information Letter Number 173 entitled "Risk-based Methods to Evaluate Requirements in Technical Specifications", January 6, 1994.

10. Advanced Light Water Reactor Utility Requirements Document, Volume II "ALWR Evolutionary Plant", Chapter 1, Appendix A, PRA Key Assumptions and Groundrules (KAG), prepared for EPRI, Rev. 3, 11/91.

11. Letter Zwolinski, J. A. (NRC) to Vandewalle, D. J., Re: Emergency Diesel Generator-Limiting Condition for Operation, LS05-85-06-006, June 5, 1985 40

ATTACHMENTA, "Mark-up" of NUREG-1432 SECTIONS 3.8.1 & B 3.8.1

l'

ML17228B180

Contents

Text

3.0 BACKGROUND

SUMMARY

10.0 REFERENCES

SUMMARY

SUMMARY

SUMMARY

SUMMARY

Subject:

Navigation menu

ML17228B180

Text

3.0 BACKGROUND

SUMMARY

10.0 REFERENCES

SUMMARY

SUMMARY

SUMMARY

SUMMARY

Subject:

Navigation menu

Search