Text

License Amendment Request - Revision to Technical Specification 3.3.2, Engineered Safety Feature Actuation System (ESFAS) Instrumentation
	ML21272A283
Person / Time
Site:	Wolf Creek
Issue date:	09/29/2021
From:	Shawn Smith; Wolf Creek
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	ET 21-0010
	Download: ML21272A283 (54)
	v • d • e

Stephen L. Smith Engineering Vice President September 29, 2021 ET 21-0010 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555

Subject:

Docket No. 50-482: License Amendment Request - Revision to Technical Specification 3.3.2, Engineered Safety Feature Actuation System (ESFAS) Instrumentation Commissioners and Staff:

In accordance with the provisions of Title 10 of the Code of Federal Regulations (10 CFR Part 50.90), Application for amendment of license, construction permit, or early site permit, Wolf Creek Nuclear Operating Corporation (WCNOC) is submitting a request for an amendment to Operating License NPF-42 for the Wolf Creek Generating Station (WCGS). The proposed amendment would modify WCGS Technical Specification (TS) 3.3.2, Engineered Safety Feature Actuation System (ESFAS) Instrumentation, by adding a new Required Action N.1 to require restoration of an inoperable Balance of Plant ESFAS (BOP ESFAS) train to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Currently, Condition N of TS 3.3.2 for Function 6.c. requires the plant to enter a shutdown track to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months with no allowed outage time provided for restoration. Shutdown track Completion Times to be in MODES 3 and 4 would be increased to reflect these longer restoration time.

The proposed amendment represents a deterministic based amendment supplemented by risk insight information. The proposed amendment has been developed using the guidelines established in Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, and Regulatory Guide 1.177, Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications.

Attachment I provides a description and technical basis for the proposed change. Attachment II provides the risk assessment to support the addition of the new Required Action and ESFAS Instrumentation Completion Time. Attachment III provides the existing TS pages marked up to show the proposed change. Attachment IV provides revised (clean) TS pages. Attachment V provides the proposed TS Bases changes for information only.

P.O. Box 411 l Burlington, KS 66839 l 620-364-8831

ET 21-0010 Page 2 of 3 WCNOC requests approval of this license amendment request in an expeditious manner to allow the replacement of the power supply associated with BOP ESFAS cabinet SA036E, if required.

The existing Condition N would require the plant to be in MODE 3 in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months if the power supply were to fail. The request for an expeditious review was discussed with the Nuclear Regulatory Commission (NRC) Project Manager on September 7, 2021. The license amendment, as approved, will be effective upon issuance and will be implemented within 15 days from the date of issuance.

In accordance with 10 CFR 50.91, Notice for public comment; State consultation, Section (b)(1),

a copy of this amendment application, with Attachments, is being provided to the designated Kansas State official.

If you have any questions concerning this matter, please contact me at (620) 364-4156, or Ron Benham at (620) 364-4204.

Sincerely, Stephen L. Smith SLS/rlt Attachments: I Evaluation of Proposed Change II Risk Assessment to Support Addition of ESFAS Instrumentation Completion Time III Proposed Technical Specification Changes (Mark-Up)

IV Revised Technical Specification Pages V Proposed Technical Specification Bases Changes (Mark-Up) for Information Only cc: S. S. Lee (NRC), w/a S. A. Morris, (NRC), w/a N. OKeefe (NRC), w/a K. S. Steves (KDHE), w/a Senior Resident Inspector (NRC), w/a

ET 21-0010 Page 3 of 3 STA TE OF KANSAS )

) ss COUNTY OF COFFEY . )

Stephen L. Smith, of lawful age, being first duly sworn upon oath says that he is Vice President Engineering of Wolf Cre.ek Nuclear Operating Corporation; that he has read the foregoing document and knows the contents thereof; that he has executed the same for and on behalf of said Corporation with full power and authority to do so; and that the facts therein stated are true and correct to the best of his knowledge, information and belief.

By_~3:/

Stephen L. Smith Vice President Engineering SUBSCRIBED and sworn to before me this 29th day of September , 2021.

GJwa da Notary Public cf! ;J,C,,m 12,'(I RHONDA L. TIEMEYER Notary Public, State of Kansas My Appcintment Expires Expiration DateJa O i l ~

Attachment I to ET 21-0010 Page 1 of 15

Subject:

License Amendment Request - Revision to Technical Specification 3.3.2, Engineered Safety Feature Actuation System (ESFAS) Instrumentation 1.0

SUMMARY

DESCRIPTION 2.0 DETAILED DESCRIPTION 2.1 Current Technical Specification Requirements 2.2 Reason for the Proposed Change 2.3 Description of the Proposed Change 2.4 Bases for Proposed Change

3.0 TECHNICAL EVALUATION

3.1 System Description 3.2 Maintenance Rule Program 3.3 Risk Management/Work Control and Scheduling 3.4 Deterministic Assessment of Proposed New Required Action 3.5 Risk Assessment 3.6 Conclusion

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements 4.2 Precedent 4.3 Significant Hazards Consideration 4.4 Conclusions

5.0 ENVIRONMENTAL CONSIDERATION

6.0 REFERENCES

Attachment I to ET 21-0010 Page 2 of 15 EVALUATION OF PROPOSED CHANGE 1.0

SUMMARY

DESCRIPTION This proposed amendment revises the Wolf Creek Generating Station (WCGS) Technical Specification (TS) 3.3.2, Engineered Safety Feature Actuation System (ESFAS)

Instrumentation, by adding a new Required Action N.1 to require restoration of an inoperable Balance of Plant ESFAS (BOP ESFAS) train to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Currently, Condition N of TS 3.3.2 for Function 6.c requires the plant to enter a shutdown track to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months with no allowed outage time provided for restoration. Shutdown track Completion Times to be in MODES 3 and 4 would be increased to reflect these longer restoration time.

The proposed amendment represents a deterministic based amendment supplemented by risk insight information. The proposed amendment has been developed using the guidelines established in Regulatory Guide (RG) 1.174 (Reference 6.1), An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, and RG 1.177 (Reference 6.2), An Approach for Plant-Specific, Risk-Informed Decisionmaking:

Technical Specifications.

2.0 DETAILED DESCRIPTION 2.1 Current Technical Specification Requirements TS 3.3.2 Condition N applies to TS Table 3.3.2-1, Engineered Safety Feature Actuation System Instrumentation, Function 6.c., Automatic Actuation Logic and Actuation Relays (BOP-ESFAS).

With one BOP-ESFAS train inoperable, Required Action N.1 requires placing the plant in MODE 3 in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and Required Action N.2 requires placing the plant in MODE 4 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

2.2 Reason for the Proposed Change The proposed TS changes are being requested to provide flexibility to resolve emergent BOP ESFAS actuation logic and actuation relay deficiencies and avoid a potential unplanned plant shutdown and associated thermal transient, along with the potential challenges to safety systems during an unplanned shutdown, should a condition occur requiring BOP-ESFAS corrective maintenance.

On September 1, 2021, Control Room operators received numerous alarms indicating that a loss of power to SA036E (B train BOP ESFAS cabinet) had occurred. Instrument and Control technicians had test equipment connected inside the cabinet to support surveillance testing of radiation monitoring equipment in accordance with procedure STS IC-455B, Channel Calibration Control Room Air Intake Radiation Monitor GK RE-004. The Instrument and Control technicians reported the power failure on SA036E and removed the test equipment that was connected in the cabinet. Approximately, seven minutes after the receipt of the alarms, power was available to SA036E without any other actions taken. An inoperable BOP ESFAS train would result in the initiation of a plant shutdown in accordance with TS 3.3.2, Condition N.

The power supplies in SA036D and SA036E were replaced in Refueling Outage 24 (Spring 2021) with a new style power supply. These power supplies have a 5 year replacement strategy due to

Attachment I to ET 21-0010 Page 3 of 15 on board fans for cooling. Replacement of the power supply at power is estimated to take 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months .

However, to replace a power supply with the plant in MODE 1 would require entering a shutdown track Condition/Required Action.

The existing TS 3.3.2, Condition N, Required Actions and associated Completion Times specified for an inoperable BOP ESFAS actuation logic train are overly restrictive given the relatively low risk associated with such inoperabilities. A Required Action with a reasonable Completion Time would allow restoration of an inoperable BOP ESFAS actuation logic train during plant operation without subjecting the plant to a forced shutdown.

2.3 Description of the Proposed Change The proposed change to TS 3.3.2 Condition N would add a new Required Action N.1 that requires the restoration of an inoperable BOP ESFAS train (TS Table 3.3.2-1 Function 6.c., Auxiliary Feedwater - Automatic Actuation Logic and Actuation Relays (BOP ESFAS)) to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Existing Required Actions N.1 and N.2 would be changed to Required Actions N.2.1 and N.2.2, respectively, with the joining logic connector (AND) nested as required by TS 1.2, Logical Connectors. Required Actions N.2.1 and N.2.2 would be joined to new Required Action N.1 with an OR logic connector. The Completion Times for Required Actions N.2.1 and N.2.2 would be 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months and 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months , respectively, which reflect the typical shutdown track times (6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to MODE 3 and 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to MODE 4 as discussed in LCO 3.0.3) for reaching MODES 3 and 4 when a restoration action has not been met. The revised Condition N for one train inoperable would read:

CONDITION REQUIRED ACTION COMPLETION TIME N. One train inoperable. --------------------NOTE-------------------

One train may be bypassed for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for surveillance testing provided the other train is OPERABLE.

N.1 Restore train to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OPERABLE status.

OR N.2.1 Be in MODE 3. 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months AND N.2.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months

Attachment I to ET 21-0010 Page 4 of 15 2.4 Bases for Proposed Change The purpose of the proposed change is to provide an allowed outage time Required Action with a Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for restoration of an inoperable BOP-ESFAS train. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is necessary to reduce the likelihood and unnecessary burden of a plant shutdown should an unplanned BOP ESFAS outage occur with the plant at power by providing additional time to troubleshoot, repair (replacement of power supplies) and reestablish OPERABILITY of the inoperable BOP ESFAS train. The proposed Required Action and associated Completion Time is consistent with Condition G (applicable to TS 3.3.2, Function 6.b.,

Automatic Actuation Logic and Actuation Relays (Balance of Plant ESFAS)) in NUREG-1431, Rev. 4, Standard Technical Specification Westinghouse Plants.

Given the conclusions reached by the evaluations that follow, providing a Required Action and 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time for restoration of an inoperable BOP-ESFAS train provides for the efficient use of resources. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time, to permit a BOP-ESFAS train to be removed from service to perform planned preventative maintenance or to perform corrective maintenance resulting from an emergent condition while the plant is in MODE 1-3, will avert unplanned unit shutdowns and minimize the potential need for expedited licensing actions seeking approval of additional time to complete repairs.

3.0 TECHNICAL EVALUATION

3.1 System Description Balance of Plant (BOP) Engineered Safety Feature Actuation System (ESFAS) - Automatic Actuation Logic and Actuation Relays, Function 6.c. of TS Table 3.3.2-1 The BOP ESFAS actuation logic processes signals from several sources, such as the Solid State Protection System (SSPS) logic outputs associated with safety injection, containment isolation -

phase A, and low-low steam generator (SG) water level, the load shedder and emergency load sequencer (LSELS) logic outputs associated with ESF bus undervoltage, inputs from various plant radiation monitors, inputs from main feedwater pump lube oil pressure switches (used for motor-driven auxiliary feedwater (AFW) pump actuation), and inputs from pressure switches in the AFW suction supply from the condensate storage tank (CST) in order to actuate ESF equipment. There are two redundant trains of BOP ESFAS actuation logic (separation groups 1 and 4, cabinets SA036D and SA036E, respectively), and a third actuation logic cabinet (separation group 2, cabinet SA036C) to actuate the turbine-driven AFW pump and reposition automatic valves required for that pumps operation (i.e., open turbine steam supply valves and the turbine trip and throttle valve). The separation group 2 BOP ESFAS actuation logic cabinet SA036C receives isolated inputs from both the SA036D and SA036E cabinets (separation groups 1 and 4) to start the turbine-driven AFW pump upon ESF bus undervoltage or upon low-low SG level in two or more steam generators.

In accordance with the WCGS original licensing basis, which was reconfirmed during the NRC reviews that led to the issuance of WCGS Amendment No. 121 (Reference 6.3) (see pages 2 and 3 of the NRC Safety Evaluation) and the ITS conversion approved in WCGS Amendment 123 (Reference 6.4), the SA036C separation group 2 cabinet is considered to be part of its only end device (the turbine-driven AFW pump) and that cabinets operability requirements are addressed under TS 3.7.5, "Auxiliary Feedwater System." The redundant train BOP ESFAS actuation logic cabinets SA036D and SA036E actuate the motor-driven AFW pumps and reposition automatic

Attachment I to ET 21-0010 Page 5 of 15 valves as required (i.e., steam generator blowdown and sample line isolation valves, essential service water (ESW) supply valves, and CST supply valves). These redundant train cabinets also actuate containment purge isolation, control room emergency ventilation isolation, and Emergency Exhaust System (EES) actuation functions.

The BOP ESFAS has a built-in automatic test insertion (ATI) feature which continuously tests the system logic. Any fault detected during the testing causes an alarm on the main control room overhead annunciator system to alert operators to the problem. Local indications show the test step where the fault was detected.

3.2 Maintenance Rule Program The WCGS Maintenance Rule program has established three performance criteria to monitor the BOP-ESFAS. The Maintenance Rule performance criteria for unavailability provides a control mechanism on the usage of the Completion Time. The BOP-ESFAS unavailability criteria is 0 hours0 days 0 hours 0 weeks 0 months of unavailability of the system per 18 months. The unavailability criteria of 0 hours0 days 0 hours 0 weeks 0 months per system per 18 months reflects the expectation that at least one of the two actuation trains is available at all times. The BOP-ESFAS reliability criteria is 0 functional failures per 18 months.

The BOP-ESFAS condition monitoring criteria is no more than 1 Condition Monitoring Event for loss of a single train of actuation per 18 months.

The Maintenance Rule requires an evaluation be performed when equipment covered by the Maintenance Rule does not meets its performance criteria. If the pre-established performance criteria are not achieved for the BOP-ESFAS trains, they are considered for 10 CFR 50.65(a)(1) actions. These actions require increased management attention and goal setting to restore their performance to acceptable level. The Maintenance Rule performance measure for unavailability provides a control mechanism for the use of the proposed 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time for restoration of an inoperable BOP-ESFAS train.

3.3 Risk Management/Work Control and Scheduling The risk impact associated with performance of system/component maintenance, testing, and equipment outages is assessed in accordance with procedure AP 22C-003, On-Line Nuclear Safety and Generation Risk Assessment. An On-Line Nuclear Safety and Generation Risk Assessment is completed for the current weekly schedule. Compensatory measures, risk mitigating actions, and contingency plans are addressed for risk significant activities. The weekly scheduled activities and associated On-Line Nuclear Safety and Generation Risk Assessment are reviewed by the appropriate organizations with final approval and acceptance made by a management/supervisory member of the Operations Department who possesses an active or current Senior Reactor Operator license. Maintenance and testing activities added to the weekly schedule (preplanned or emergent) are assessed for their impact upon the existing On-Line Nuclear Safety and Generation Risk Assessment.

On-line daily maintenance and testing activities are planned, scheduled and conducted in a manner to ensure both commercial and nuclear safety issues are assessed and the associated risks are managed. Risk assessment and management are accomplished by the following:

a. Ensuring systems, structures and components (SSCs) are maintained to support key functions necessary for safe shutdown, accident mitigation and commercial operation.

Attachment I to ET 21-0010 Page 6 of 15

b. Planning and scheduling daily work activities in a manner that optimizes SSCs availability.

c. Developing compensatory measures to manage and minimize the operational risks associated with planned or emergent activities that are categorized as risk significant.

d. Not removing equipment from service for preventive or corrective maintenance activities unless there are reasonable expectations that equipment reliability can be improved and thus reduce the overall risk to safe operation of the facility.

e. Preplanning and sequencing maintenance activities to minimize repeated entries into TS LCO Conditions/Required Actions and to control system out of service time.

f. Maintaining a high degree of confidence that, prior to removing train related equipment from service, redundant equipment will remain available.

g. Wherever possible, on-line testing and maintenance of redundant equipment shall be avoided when the opposite components are out of service, particularly if the activities to be performed would increase the likelihood of a transient.

Experience has shown that, even with careful planning, maintenance duration sometimes approaches the Completion Time limit. In order to accommodate unanticipated problems, WCNOC has developed the practice of scheduling work for only 50 percent of the Completion Time for planned maintenance.

3.4 Deterministic Assessment of Proposed New Required Action The impact of the proposed change would allow continued power operation up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months while BOP-ESFAS maintenance or testing is performed. The BOP ESFAS processes signals from SSPS, signal processing equipment and plant radiation monitors to actuate certain ESF equipment. There are two redundant trains of BOP ESFAS, and a third separation group to actuate the turbine-driven AFW pump.

Defense-in-Depth The proposed change to add a Required Action for an inoperable BOP-ESFAS train with a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time for restoration maintains system redundancy, independence and diversity commensurate with the expected challenges to system operation. The Work Controls process provides for controls and assessments to preclude the possibility of simultaneous outages of redundant trains and to ensure system reliability. The Maintenance Rule performance measure for unavailability also provides a control mechanism on the usage of the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time.

The proposed 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time for restoration of an inoperable BOP-ESFAS train while the plant is in MODES 1, 2, or 3, will not alter the assumptions relative to the causes or mitigation of an accident.

As defined by RG 1.174, consistency with the defense-in-depth philosophy is maintained if the following occurs regarding the proposed licensing basis change:

Attachment I to ET 21-0010 Page 7 of 15

a. Preserve a reasonable balance among the layers of defense.

The proposed addition of a new Required Action with a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time for restoration of an inoperable BOP-ESFAS train will not significantly reduce the effectiveness of any of the following four layers of defense that exist in the plant design: minimizing challenges to the plant, preventing any events from progressing to core damage, containing the radioactive source term and emergency preparedness. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time for one inoperable BOP-ESFAS train does not increase the likelihood of initiating events and does not create new initiating events. Furthermore, the proposed change does not significantly impact the availability and reliability of SSCs that are relied upon to perform safety functions that prevent plant challenges from progressing to core damage. Lastly, the proposed change does not significantly impact the containment function or SSCs that support the containment function and also does not involve the emergency preparedness program or any of its functions.

Since the requirement to assume a single failure is suspended while operating under a TS Required Action, there will be no effect on the analysis of any accident or that accidents progression since the OPERABLE BOP ESFAS train is capable of actuating the required ESFs. As such, there will be no impact on core damage, containment release, or consequence mitigation for any transient or accident.

b. Preserve adequate capability of design features without an overreliance on programmatic activities as compensatory measures.

Plant safety systems are designed with redundancy so that when one train is inoperable, a redundant train can provide the necessary safety function. The preferred approach for accomplishing safety functions is through engineered systems, rather than overreliance on programmatic activities (i.e., compensatory measures). The risk impact associated with performance of system/component maintenance, testing, and equipment outages is assessed as part of the Work Controls process and compensatory measures, risk mitigating actions, and contingency plans are addressed for risk significant activities. During the period when a BOP-ESFAS train is inoperable, an existing redundant train is maintained OPERABLE.

c. Preserve system redundancy, independence, and diversity commensurate with the expected frequency, consequences of challenges to the system, including consideration of uncertainty.

The OPERABLE BOP ESFAS train will continue to be capable of performing the necessary safety functions consistent with accident analysis assumptions. Redundant, independent, and diverse capabilities will be maintained for performing critical safety functions.

d. Preserve adequate defense against potential common-cause failures (CCFs).

Defenses against common cause failures are preserved. New common cause failure mechanisms are not created as a result of the addition of a new Required Action with a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time for restoration of an inoperable BOP-ESFAS train. The operating environment and operating parameters for the safety related BOP-ESFAS trains remain constant; therefore, new common cause failure modes are not introduced. Redundant and backup systems are not impacted by the proposed change and no new common cause links between the primary and backup systems are introduced.

Attachment I to ET 21-0010 Page 8 of 15

e. Maintain multiple fission product barriers.

The change proposed in this amendment will not result in any undue challenges to the fuel cladding, reactor coolant pressure boundary, or containment. The amendment request does not involve design changes that would affect or degrade the fission product barriers. Further, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time for restoration of an inoperable BOP-ESFAS train does not directly impact these barriers or otherwise cause them to be degraded. Therefore, multiple fission product barriers are maintained by the proposed change.

f. Preserve sufficient defense against human errors.

The proposed 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time for restoration of an inoperable BOP-ESFAS train does not introduce any new operator actions for the BOP-ESFAS system.

g. Continue to meet the intent of the plants design.

The design and operation of the BOP-ESFAS is not altered by the proposed 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time for an inoperable BOP-ESFAS train. The safety analyses safety criteria stated in the Updated Safety Analysis Report (USAR) is not impacted by the proposed changes. Redundancy and diversity of the BOP-ESFAS trains are not altered because the system design and operation are not changed by the proposed change. The proposed change to the TSs will not allow plant operation in a configuration outside the plants design basis.

The requirements credited in the accident analyses regarding the BOP-ESFAS remain the same.

Safety Margin Safety analysis acceptance criteria for the events analyzed in USAR Chapters 6.2 and 15 are not impacted by the proposed change. The proposed 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time for restoring an inoperable BOP-ESFAS train would not impact any of the assumptions or inputs to the safety analyses. There are no design changes associated with the proposed change. Consequently, safety margins are not affected. This proposed amendment does not impact any deterministic analysis nor does it credit safety margins in any deterministic analysis.

The evaluation that follows, using the principles defined in RG 1.174, demonstrates that the proposed licensing bases change is consistent with the principle that sufficient safety margins are maintained.

With sufficient safety margins, the following are true for WCGS:

(1) the codes and standards or their alternatives approved for use by the NRC are met, and The design and operation of the BOP-ESFAS trains is not altered by the proposed change.

Redundancy and diversity of the BOP-ESFAS system will be maintained.

(2) safety analysis acceptance criteria in the licensing basis (e.g., FSAR, supporting analyses) are met or proposed revisions provide sufficient margin to account for uncertainty in analysis and data.

Attachment I to ET 21-0010 Page 9 of 15 The safety analyses acceptance criteria stated in the USAR are not impacted by the proposed change. The proposed change will not allow plant operation in a configuration outside the design bases. The requirements regarding the BOP-ESFAS credited in the accident analyses will remain the same.

Given the above, WCNOC concludes that safety margins are not impacted by the proposed change.

3.5 Risk Assessment A quantitative and qualitative risk assessment was performed to support the conclusion that the change in risk associated with the proposed new Required Action and 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time for the restoration of a BOP-ESFAS train is acceptable. The addition of the new Required Action and 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is essentially the same as extending a Completion Time. The detailed risk assessment is provided in Attachment II. The risk assessment addressed Key Principles 4 and 5 of RG 1.174 (Reference 6.1) and RG 1.177 (Reference 6.2) and the risk was calculated consistent with NRC guidance provided in these RGs.

Key Principle 4: Change in Risk is Consistent with the Safety Goal Policy Statement The risk assessment performed for this change addresses the philosophy of risk-informed decision-making and a summary report of the risk assessment is provided in Section 0 of Attachment II. The results provided in the below table are within the acceptance guidelines listed in NRC RG 1.177 for a permanent TS Completion Time extension. As such, the change in risk is small and consistent with the intent of the Commission's Safety Goal Policy Statement. Section 0 of Attachment II provides a summary of the risk results in support of the proposed permanent TS change to implement a new Required Action and Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for restoring either BOP-ESFAS train.

Key Principle 5: Monitor the Impact of the Proposed Change The impact of the proposed change will be monitored for effectiveness in accordance with the existing plant maintenance rule program pursuant to 10 CFR 50.65(a)(4) and the associated implementation guidance, RG 1.160, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants. The program requires, in part, that performing maintenance activities shall not reduce the overall availability of SSCs, which are important to safety.

Attachment I to ET 21-0010 Page 10 of 15 ICCDP and ICLERP Results for BOP-ESFAS Out-of-Service From 0hrs to 24hrs Internal Events Internal Flood Total(1)

BOP-ESFAS Cabinet SA036D Base Case 6.56E-06 9.07E-06 1.56E-05(4)

CDF SA036D OOS 7.23E-06 9.38E-06 1.66E-05 ICCDP(2) 1.98E-09 9.25E-10 2.90E-09(5)

Base Case 7.24E-08 4.02E-08 1.13E-07(6)

LERF SA036D OOS 7.86E-08 4.07E-08 1.19E-07 ICLERP(3) 1.83E-11 1.24E-12 1.96E-11(7)

BOP-ESFAS Cabinet SA036E Base Case 6.56E-06 9.07E-06 1.56E-05(4)

CDF SA036E OOS 7.19E-06 9.43E-06 1.66E-05 ICCDP(2) 1.86E-09 1.07E-09 2.93E-09(5)

Base Case 7.24E-08 4.02E-08 1.13E-07(6)

LERF SA036E OOS 7.85E-08 4.07E-08 1.19E-07 ICLERP(3) 1.78E-11 1.39E-12 1.92E-11(7)

Notes:

(1) The contribution from Fire, High Winds, and Seismic is evaluated qualitatively in Section 0 of Attachment II (2) The ICCDP values were calculated using the following equation:

ICCDP = (OOS case - Base case)/PAF * (1/365)

(3) The ICLERP values were calculated using the following equation:

ICLERP = (OOS case - Base case)/PAF *(1/365)

(4) Total CDF meets the RG 1.174 acceptance criteria of < 1E-4 per year (5) Total ICCDP meets the RG 1.177 acceptance criteria of < 1E-6 per year (6) Total LERF meets the RG 1.174 acceptance criteria of < 1E-5 per year (7) Total ICLERP meets the RG 1.177 acceptance criteria of < 1E-7 per year 3.6 Conclusion The results of the deterministic assessment supplemented with risk insights described above provide assurance that the equipment required to safely shutdown the plant and mitigate the effects of a design basis accident will remain capable of performing their safety functions when a BOP-ESFAS is removed from service in accordance with the proposed new Required Action and associated Completion Time.

The proposed Required Action and Completion Time is consistent with NRC policy and will continue to provide protection for the health and safety of the public. The proposed changes meet the following principles:

Attachment I to ET 21-0010 Page 11 of 15

a. The proposed change meets the current regulations.

b. The proposed change is consistent with the defense-in-depth philosophy.

c. The proposed change maintains sufficient safety margins.

d. The proposed change results in acceptable risk metrics provided above that are consistent with the criteria in RG 1.174 and RG 1.177.

Therefore, based on the above evaluations, WCNOC believes that the proposed change to the WCGS licensing basis is acceptable and operation in the proposed manner will not present undue risk to public health and safety or be inimical to the common defense and security.

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements The proposed change has been evaluated to determine whether the applicable regulations and requirements, noted below, continue to be met.

Section 182a of the Atomic Energy Act requires applicants for nuclear power plant operating licenses to include TSs as part of the license. The TSs ensures the operational capability of SSCs that are required to protect the health and safety of the public. The NRC's requirements related to the content of the TSs are contained in Section 50.36 of Title 10 of the Code of Federal Regulations (10 CFR 50.36) which requires that the TSs include items in the following specific categories: (1) safety limits, limiting safety systems settings, and limiting control settings; (2) limiting conditions for operation; (3) surveillance requirements per 10 CFR 50.36(c)(3); (4) design features; and (5) administrative controls. The proposed change does not affect WCGSs compliance with the intent of 10 CFR 50.36.

10 CFR 50.65, Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, requires that preventive maintenance activities must not reduce the overall availability of the SSCs. It also requires that before performing maintenance activities, the licensee shall assess and manage the increase in risk that may result from the proposed maintenance activities. The proposed change does not affect WCGSs compliance with the intent of 10 CFR 50.65.

10 CFR 50, Appendix A, General Design Criterion (GDC) 13, Instrumentation and control, of Appendix A, General Design Criteria for Nuclear Power Plants, to 10 CFR 50 states, in part, Instrumentation shall be provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated operational occurrences, and for accident conditions as appropriate to assure adequate safety, including those variables and systems that can affect the fission process, the integrity of the reactor core, the reactor coolant pressure boundary, and the containment and its associated systems.

10 CFR 50, Appendix A, GDC 20, Protection system functions, of Appendix A, General Design Criteria for Nuclear Power Plants, to 10 CFR 50 states, The protection system(s) shall be designed (1) to initiate automatically the operation of appropriate systems including the reactivity control systems, to assure that specified acceptable fuel design limits are not exceeded as a result

Attachment I to ET 21-0010 Page 12 of 15 of anticipated operational occurrences and (2) to sense accident conditions and to initiate the operation of systems and components important to safety.

10 CFR 50, Appendix A, GDC 21, Protection system functions, of Appendix A, General Design Criteria for Nuclear Power Plants, to 10 CFR 50 states, in part, The protection system shall be designed for high functional reliability and inservice testability commensurate with the safety functions to be performed.

10 CFR 50, Appendix A, GDC 22, Protection system independence, of Appendix A, General Design Criteria for Nuclear Power Plants, to 10 CFR 50 states, in part, The protection system shall be designed to assure that the effects of natural phenomena, and of normal operating, maintenance, testing, and postulated accident conditions on redundant channels do not result in loss of the protection function, or shall be demonstrated to be acceptable on some other defined basis.

10 CFR 50, Appendix A, GDC 23, Protection system failure modes, of Appendix A, General Design Criteria for Nuclear Power Plants, to 10 CFR 50 states, in part, The protection system shall be designed to fail into a safe state or into a state demonstrated to be acceptable on some other defined basis if conditions such as disconnection of the system, loss of energy (e.g., electric power, instrument air), or postulated adverse environments (e.g., extreme heat or cold, fire, pressure, steam, water, and radiation) are experienced.

10 CFR 50, Appendix A, GDC 24, Separation of protection and control systems , of Appendix A, General Design Criteria for Nuclear Power Plants, to 10 CFR 50 states, in part, The protection system shall be separated from control systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel which is common to the control and protection systems leaves intact a system satisfying all reliability, redundancy, and independence requirements of the protection system.

10 CFR 50, Appendix A, GDC 25, Protection system requirements for reactivity control malfunctions, of Appendix A, General Design Criteria for Nuclear Power Plants, to 10 CFR 50 states, in part, The protection system shall be designed to assure that specified acceptable fuel design limits are not exceeded for any single malfunction of the reactivity control systems, such as accidental withdrawal (not ejection or dropout) of control rods.

10 CFR 50, Appendix A, GDC 27, Combined reactivity control systems capability, of Appendix A, General Design Criteria for Nuclear Power Plants, to 10 CFR 50 states, in part, The reactivity control systems shall be designed to have a combined capability, in conjunction with poison addition by the emergency core cooling system, of reliably controlling reactivity changes to assure that under postulated accident conditions and with appropriate margin for stuck rods the capability to cool the core is maintained.

As discussed in the USAR Section 7.3.8.1, the ESFAS meets the requirements of GDCs 13, 20, 21, 22, 23, 24, 25, and 27.

4.2 Precedent The NRC has previously approved a change similar to the proposed change in this license amendment request in Amendment No. 201 on July 28, 2011 for the Callaway Plant, Unit 1

Attachment I to ET 21-0010 Page 13 of 15 (ADAMS Accession No. ML111680536). The Callaway Amendment included additional changes to Conditions J and O, added new Condition M, and TS Table 3.3.2-1, Function 6.g., Trip of all Main Feedwater Pumps. These additional changes are not included in this proposed amendment.

4.3 Significant Hazards Consideration This proposed amendment revises the Wolf Creek Generating Station (WCGS) Technical Specification (TS) 3.3.2, Engineered Safety Feature Actuation System (ESFAS)

Instrumentation, by adding a new Required Action N.1 to require restoration of an inoperable Balance of Plant ESFAS (BOP ESFAS) train to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Currently, Condition N of TS 3.3.2 for Function 6.c. requires the plant to enter a shutdown track to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months with no allowed outage time provided for restoration. Shutdown track Completion Times to be in MODES 3 and 4 would be increased to reflect these longer restoration time.

Wolf Creek Nuclear Operating Corporation (WCNOC) has evaluated whether or not a significant hazards consideration is involved with the proposed changes by focusing on the three standards set forth in 10 CFR 50.92, Issuance of amendment, as discussed below:

1. Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No The proposed change involves adding a new Required Action and associated Completion Time for restoration of an inoperable BOP-ESFAS train. The BOP-ESFAS processes signals from SSPS, signal processing equipment and plant radiation monitors to actuate certain ESF equipment. The proposed change does not affect the design of the BOP-ESFAS trains, the operational characteristics or function of the BOP-ESFAS trains, the interfaces between the BOP-ESFAS trains and other plant systems or the reliability of the trains. The BOP-ESFAS trains are not accident initiators; the train are designed to mitigate the consequences of previously evaluated accidents. Adding a new Required Action and associated Completion Time for a single inoperable BOP-ESFAS train would not affect the previously evaluated accidents since the remaining train would continue to be available to perform the accident mitigation functions. Thus, allowing a BOP-ESFAS trains to be inoperable for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for performance of maintenance or testing does not increase the probability of a previously evaluated accident.

Overall protection system performance will remain within the bounds of the previously performed accident analyses since no hardware changes are proposed to the protection systems. The same Reactor Trip System (RTS) and ESFAS instrumentation will continue to be used. The protection systems will continue to function in a manner consistent with the plant design basis. There will be no changes to the BOP-ESFAS surveillance and operating limits.

The proposed change will not adversely affect accident initiators or precursors nor alter the design assumptions, conditions, and configuration of the facility or the manner in which the plant is operated and maintained. The proposed change will not alter or prevent the ability of structures, systems, and components (SSCs) from performing their intended functions to mitigate the consequences of an initiating event within the assumed acceptance limits.

Attachment I to ET 21-0010 Page 14 of 15 Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No The proposed change involves adding a new Required Action and associated Completion Time for restoration of an inoperable BOP-ESFAS train. The proposed change does not involve a change in the plant design, plant configuration or system operation of the BOP-ESFAS. The proposed change allows a BOP-ESFAS train to be inoperable for additional time. Equipment will be operated in the same configuration and manner that is currently allowed and designed for. The functional demands on credited equipment is unchanged.

There are no new failure modes or mechanisms created due to plant operation for an extended period to perform BOP-ESFAS maintenance or testing. Extended operation with an inoperable BOP-ESFAS train does not involve any modification to the operational limits or physical design of plant systems. There are no new accident precursors generated due to the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time.

No new accident scenarios, transient precursors, failure mechanisms, or limiting single failures will be introduced as a result of this amendment. There will be no adverse effect or challenges imposed on any safety related system as a result of this amendment.

Therefore, the proposed change will not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed amendment involve a significant reduction in a margin of safety?

Response: No The proposed change involves adding a new Required Action and associated Completion Time for restoration of an inoperable BOP-ESFAS train. The BOP-ESFAS trains continue to meet their design requirements; there is no reduction in capability or change in design configuration. There is no change to the BOP-ESFAS trains operating parameters. In the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time, the remaining OPERABLE BOP-ESFAS train is adequate to actuate certain ESF equipment. The proposed change to add a new Required Action for an inoperable BOP-ESFAS train does not alter a design basis safety limit; therefore, it does not significantly reduce the margin of safety. The BOP-ESFAS trains will continue to operate per the existing design and regulatory requirements.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based upon the reasoning presented above, WCNOC concludes that the requested change does not involve a significant hazards consideration as set forth in 10 CFR 50.92(c), Issuance of amendment.

Attachment I to ET 21-0010 Page 15 of 15 4.4 Conclusion Based on the considerations discussed herein, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5.0 ENVIRONMENTAL CONSIDERATION

The proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20. However, the proposed change does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amount of effluent that may be released offsite, or (iii) a significant increase in the individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environment impact statement environmental assessment need be prepared in connection with the proposed amendment.

6.0 REFERENCES

6.1 RG 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Bases, Revision 3, January 2018.

6.2 RG 1.177, Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications, Revision 2, January 2021.

6.3 Letter from K. M. Thomas, USNRC, to O. L. Maynard, Amendment No. 121 to Facility Operating License No. NPF Wolf Creek Generating Station, Unit 1 (TAC NO.

MA0804), March 23, 1999. ADAMS Accession No. ML022050072.

6.4 Letter from J. N. Donohew, USNRC , to O. L. Maynard, WCNOC, Conversion to Improved Technical Specifications for Wolf Creek Generating Station - Amendment No. 123 to Facility Operating License No. NPF-42 (TAC NO. M98738), March 31, 1999. ADAMS Accession No. ML022050061.

Attachment II to ET 21-0010 Page 1 of 28 ATTACHMENT II RISK ASSESSMENT TO SUPPORT ADDITION OF ESFAS INSTRUMENTATION COMPLETION TIME

Attachment II to ET 21-0010 Page 2 of 28 Table of Contents 1.0 PROBABILISTIC RISK ASSESSMENT CAPABILITY AND INSIGHTS .............................. 3 2.0 DEVELOPMENT AND USE OF PRA INSIGHTS ................................................................ 3 3.0 RISK ASSESSMENT RESULTS ........................................................................................ 4 4.0 QUALITATIVE CONSIDERATIONS ................................................................................... 6 4.1 External Hazards ................................................................................................ 6 4.1.1 Seismic ............................................................................................... 6 4.1.2 High Winds ......................................................................................... 7 4.1.3 Fire ..................................................................................................... 9 4.2 Shutdown Events Considerations ......................................................................11 5.0 RISK ASSESSMENT

SUMMARY

REPORT FOR ESFAS ...............................................111 5.1 Purpose ...........................................................................................................111 5.2 PRA Scope, Applicability and Acceptability ......................................................111 5.3 PRA Scope ......................................................................................................111 5.4 PRA Applicability................................................................................................12 5.5 PRA Acceptability ..............................................................................................12 5.6 PRA Level of Detail and Plant Representation ...................................................17 5.7 Level of Detail in the WCGS Models ..................................................................17 5.8 PRA Maintenance and Update Process .............................................................17 5.9 Risk Application PRA Model ..............................................................................19 5.10 Quantification Setup...........................................................................................19 5.11 Risk Insights ....................................................................................................211 5.12 Sensitivities ........................................................................................................21 5.13 Review of Assumptions and Uncertainty ............................................................22 5.13.1 Identification of Key Assumptions ......................................................22 5.13.2 Application Specific Assumptions ....................................................255 5.13.3 Completeness Uncertainty .................................................................26 5.13.4 Parametric Uncertainty ......................................................................26

6.0 REFERENCES

................................................................................................................. 27

Attachment II to ET 21-0010 Page 3 of 28 Risk Assessment A quantitative and qualitative risk assessment was performed to support the conclusion that the change in risk associated with the proposed new Required Action and 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time for the restoration of the balance of plant engineered safety features actuation system (BOP ESFAS, herein referred to as ESFAS) train is acceptable. The addition of the new Required Action and 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is essentially the same as extending a Completion Time.

The risk assessment addressed Key Principles 4 and 5 of NRC Regulatory Guide (RG) 1.174 (Reference 0) and RG 1.177 (Reference 2) and the risk was calculated consistent with NRC guidance provided in these RGs.

Key Principle 4: Change in Risk is Consistent with the Safety Goal Policy Statement The risk assessment performed for this change addresses the philosophy of risk-informed decision-making and a summary report of the risk assessment is provided in Section 0. The results are within the acceptance guidelines listed in NRC RG 1.177 (Reference 2) for a permanent Technical Specification (TS) Completion Time extension. As such, the change in risk is small and consistent with the intent of the Commission's Safety Goal Policy Statement. Section 0 of this Attachment provides a summary of the risk results in support of the proposed permanent TS change to implement a new Required Action and Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for restoring either ESFAS train.

Key Principle 5: Monitor the Impact of the Proposed Change The impact of the proposed change will be monitored for effectiveness in accordance with the existing plant maintenance rule program pursuant to 10 CFR 50.65(a)(4) and the associated implementation guidance, NRC RG 1.160, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants (Reference 3). The program requires, in part, that performing maintenance activities shall not reduce the overall availability of structures, systems, and components (SSCs),

which are important to safety.

1.0 PROBABILISTIC RISK ASSESSMENT CAPABILITY AND INSIGHTS The risk assessment of the proposed Completion Time extension is based on quantitative probabilistic risk assessment (PRA) models for internal events and internal flooding and qualitative assessments for internal fire and external hazards (i.e., high winds and seismic). Note that since the internal fire PRA model is still in progress and has not been peer reviewed, a qualitative evaluation is provided to support this application. The Wolf Creek Generating Station (WCGS) internal events and internal flooding PRA models meet the scope and quality requirements of RG 1.200, Revision 2 An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities (Reference 4). WCGS guidance documents are in place for controlling and updating the models, when appropriate, and for assuring that the models represent the as-built, as-operated plant. The conclusion, therefore, is that the WCGS IE and IF PRA models are acceptable for use in providing risk assessments for applications, including assessment of proposed TS amendments.

2.0 DEVELOPMENT AND USE OF PRA INSIGHTS The evaluation for the proposed Completion Time extension consisted of a review of the impacted plant systems and their safety functions. The review concludes that:

Attachment II to ET 21-0010 Page 4 of 28 x No new accidents or transients will be introduced by the proposed change.

x No physical changes are being made to any of the systems affected by the proposed Completion Time extension.

x The function and operation of these systems will remain the same, as described in the plant design basis.

3.0 RISK ASSESSMENT RESULTS Table 1 documents the results of the PRA conducted in support of the proposed permanent TS change to establish the restoration Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for each train of ESFAS.

Currently, the TS do not contain a Completion Time to restore a train of ESFAS before a shutdown track is entered. Details of the risk assessment are provided in Section 0 to this enclosure.

Because the proposed change is a permanent change, the following acceptance guidelines from NRC RG 1.177 (Reference 2) are applicable for evaluating the core damage frequency (CDF) and large early release frequency (LERF) risk associated with proposed changes:

x An Incremental conditional core damage probability (ICCDP) of less than 1.0E-06 and incremental conditional large early release probability (ICLERP) of less than 1.0E-07.

The ICCDP and ICLERP risk quantification results, presented in Section 0, are based on an ESFAS train restoration Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The base case results reflect the average test and maintenance PRA model. Cases were run for both ESFAS trains and all results are presented below. The results indicate that the impact of each ESFAS cabinet out-of-service (OOS) are generally symmetric. See Section 0 for additional discussion.

Attachment II to ET 21-0010 Page 5 of 28 Table 1: ICCDP and ICLERP Results for ESFAS Out-of-Service From 0hrs to 24hrs Internal Events Internal Flood Total(1)

BOP ESFAS Cabinet SA036D Base Case 6.56E-06 9.07E-06 1.56E-05(4)

CDF SA036D OOS 7.23E-06 9.38E-06 1.66E-05 ICCDP(2) 1.98E-09 9.25E-10 2.90E-09(5)

Base Case 7.24E-08 4.02E-08 1.13E-07(6)

LERF SA036D OOS 7.86E-08 4.07E-08 1.19E-07 ICLERP(3) 1.83E-11 1.24E-12 1.96E-11(7)

BOP ESFAS Cabinet SA036E Base Case 6.56E-06 9.07E-06 1.56E-05(4)

CDF SA036E OOS 7.19E-06 9.43E-06 1.66E-05 ICCDP(2) 1.86E-09 1.07E-09 2.93E-09(5)

Base Case 7.24E-08 4.02E-08 1.13E-07(6)

LERF SA036E OOS 7.85E-08 4.07E-08 1.19E-07 ICLERP(3) 1.78E-11 1.39E-12 1.92E-11(7)

Notes:

(1) The contribution from Fire, High Winds, and Seismic is evaluated qualitatively in Section 0 (2) The ICCDP values were calculated using the following equation:

ICCDP = (OOS case - Base case)/PAF * (1/365)

(3) The ICLERP values were calculated using the following equation:

ICLERP = (OOS case - Base case)/PAF *(1/365)

(4) Total CDF meets the RG 1.174 acceptance criteria of < 1E-4 per year (5) Total ICCDP meets the RG 1.177 acceptance criteria of < 1E-6 per year (6) Total LERF meets the RG 1.174 acceptance criteria of < 1E-5 per year (7) Total ICLERP meets the RG 1.177 acceptance criteria of < 1E-7 per year These results were obtained with the following quantifier settings:

Label=WC FTREX 1.8 Wrapper EvaluateCommand="C:\FTREX\18\FTREW.exe" "C:\FTREX\18\FTREX64.exe" "%infile%" "%outfile%"

/FLAG=C:\FTREX\WC_FLAG.flg /FLAG_IN_CUTSETS=1 /WRAP_METHOD=3 ResultsCommand=CSED32.EXE "%outfile%" /auto /loadattributes /sort Filter=FTFTPL32 InputExt=FTP FilterIn=CSRAW32 OutputExt=RAW Optim=64 DeletesMInits=True The following customized options were used in PRAQuant:

Attachment II to ET 21-0010 Page 6 of 28 DeleCurVal=T SeqRecoveries=T Singlefile=F QuantMethod=9 ClearLog=T RunMissing=F CopyBE=T FlagEvents=FG-*

ExpandMods=F SaveAll=F NoTwoInitiators=1 ShellWindowState=1 The following codes were used:

x CAFTA, Version 6.0b x PRAQuant, Version 5.1a x FTREX, Version 1.8 x HRA Calculator, Version 5.2 x QRecover, Version 3.5 4.0 QUALITATIVE CONSIDERATIONS 4.1 External Hazards NRC RG 1.200 (Reference 4), Section 1.2.5, recognizes that hazards with low contributions to risk may be screened out of the detailed PRA modeling. WCGS utilizes a systematic, site-specific screening process for WCGS. To support the permanent extension of the ESFAS Completion Time, the criteria and basis for each screened hazard were reviewed. This review focused on determining if the screening was potentially impacted by changing the assumed availability of ESFAS train components contained in ESFAS logic panels SA036D and SA036E. Seismic and high winds hazard impacts are discussed in the following sections.

4.1.1 Seismic The IPEEE (Reference 6) used a Seismic Margins Assessment (SMA) with a screening capacity of 0.3g for SSCs and the following considerations:

x Path success is defined as the ability to achieve and maintain a stable hot or cold shutdown condition for at least 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months following the seismic event.

x Offsite power is assumed failed and unrecoverable for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

Attachment II to ET 21-0010 Page 7 of 28 x Small Break LOCA equivalent to a one-inch diameter line break from leakage from instrument line breaks, not failures of primary system piping, is assumed.

The control building is a seismic Category I structure. The seismic Category I structures house or support Category I equipment and, therefore, maintaining their structural integrity is considered essential for the ability to safely shut down the plant in the event of a design basis earthquake or review level earthquake. All of the seismic Category I structures are founded on shallow soil columns over bedrock.

The control building is a multiple-story, rectangular, structural steel and reinforced concrete structure which houses ESFAS instrumentation and controls. The bottom of the base mat is 31.5 feet (Reference 32) below plant grade, and the mat thickness is 6 feet. The top of the roof is 81.7 feet above plant grade. The intermediate floors and roof are reinforced concrete slabs supported by structural steel beams and girders. The floor and roof framing are supported by exterior reinforced concrete bearing walls and interior steel columns. Concrete block walls are reinforced to withstand seismic loadings. The roof and exterior walls are designed to prevent penetration by tornado-generated missiles.

In accordance with the screening guidelines in EPRI NP-6041-SL (Reference 7), Table 2-3, the seismic Category I structures can be screened-out with a high-confidence of low probability of failure (HCLPF) capacity of 0.30g peak ground acceleration (pga) without any seismic margin evaluation if the design considers a safe shutdown earthquake (SSE) of 0.10g or greater.

The IPEEE SMA walkdown reviewed the anchorage of the ESFAS Cabinets (Section 3.5.6.21 of the Reference 6). Interaction between ESFAS (including SA036D/E) and load shed cabinets was reviewed. The ESFAS cabinets were screened out from further evaluation and assigned a HCLPF equivalent to the design basis SSE of 0.2g.

A loss of offsite power (LOOP) is the primary impact expected as a result of a seismic event.

Following a LOOP, all signals required to actuate the engineered safety features (ESF) are automatic and no manual operator response is required unless automatic actuation has failed.

Seismic-induced failure of the ESFAS logic cabinets is correlated; therefore, one ESFAS train OOS does not impact the quantitative risk of a seismic event. Given this, the relatively short Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , and the availability of a train of safety related equipment, the overall change in seismic risk due to the extended Completion Time is small.

4.1.2 High Winds The IPEEE (Reference 6) for high winds focused on definition of climatic conditions which affect the plant site, evaluation of high wind loading, evaluation of tornadic wind loading and evaluation of tornado-generated missiles.

The evaluation was performed by comparison of the WCGS design to the Standard Review Plan (SRP) requirements and by confirmatory walkdowns which focused on outdoor facilities which could be affected by high winds. The evaluation confirmed that the WCGS design conforms to the SRP criteria. The walkdowns did not reveal potential vulnerabilities that were not considered in the original design basis.

Attachment II to ET 21-0010 Page 8 of 28 The control building is a multiple-story, rectangular, structural steel and reinforced concrete structure which houses ESFAS instrumentation and controls. The control building is a seismic Category I structure. According to the WCGS Updated Safety Analysis Report (USAR)

(Reference 8), all seismic Category I structures which are required for post-accident safe shutdown, contain equipment required for post-accident safe shutdown, are required to protect reactor coolant system integrity, or which protect stored fuel assemblies are designed to withstand the effects of a tornado and the most severe wind phenomena encountered at the site (General Design Criterion (GDC)-2).

Category I structures are designed to withstand straight winds and tornadoes. The design parameters for tornadoes are given in Section 3.3.2.1 of Reference 8. In summary, Category I structures are designed to withstand tornado winds up to 360 mph and a differential pressure of 3.0 psi at a linear rate of 2.0 psi per second (Reference 8). Category I structures are designed for straight winds up to 100 mph at 30 feet above ground for a 100-year recurrence interval (Reference 8).

Based on the design criteria for Category I structures, equipment located inside of Category I structures is not vulnerable to failures due to direct missile strikes, differential pressure or straight wind loading. The maximum wind speed considered in the high winds analysis is 360 mph, corresponding with the maximum wind speed in the design-basis tornado for WCGS (Section 3.3.2.1, Reference 8). This wind speed exceeds the upper-bound of the strongest tornado in both the Fujita scale and the Enhanced Fujita scale; a tornado stronger than an F5/EF5 is not credible (Reference 9).

The concrete spalling failure mode is considered to be the only valid failure mode for equipment housed within Category I structures. Spalling is defined as the ejection of concrete or other wall debris from the interior side of a wall as a result of missile impact on the exterior side of the wall.

This failure mode may impact equipment located on or near a wall that is exposed to the outside.

Possibly impacted equipment includes:

x Wall-mounted equipment where spalling due to missile strikes can knock it off the wall.

x Floor equipment where wall-mounted equipment can fall onto it.

x Floor equipment where concrete debris from the wall can damage it.

It is assumed that equipment located more than several feet away from an exterior-facing, Category I wall cannot be directly affected by high wind or tornado events. Additionally, the doors separating Category I structures from the plant exterior and from Non-Category I structures are missile doors. These doors can be credited with preventing missiles from entering the structure.

Equipment housed below-grade is not susceptible to external missile hits that would result in any spalling and as such need not be considered.

Cabinets SA036D and SA036E are located in the Equipment Cabinet Area (3605), behind the Main Control Room (3601) (Reference 26). SA036D/E are not wall mounted cabinets and are mounted in a row perpendicular to the exterior wall so are not considered highly vulnerable to spalling. In addition, these cabinets are located within a few feet of one another so any impact to one cabinet would likely impact the other (i.e., correlated failures) which would subsume any potential impact of one cabinet being OOS.

Attachment II to ET 21-0010 Page 9 of 28 The change in risk associated with a train being OOS for the extended Completion Time is therefore likely equivalent to the change in risk from the internal events model for random failures plus the probability of a high wind event where spalling from a missile strike on the control building fails only the OPERABLE ESFAS train. Given that the frequency of such a high wind event occurrence over the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is considered small, the overall change in risk due to the extended Completion Time can be considered small.

4.1.3 Fire Unavailability of SB036D or SB036E would eliminate the AFAS start of MDAFW pump PAL01A or PAL01B, respectively. The unaffected MDAFW pump would then have increased risk importance. As indicated in Section 1.0, the internal fire PRA is still in progress and has not been peer reviewed; however, the internal fire PRA relationships between fire areas and failed components (Reference 31) are considered to be the best representation for this application.

The fire areas associated with loss of PAL01A or PAL01B are shown in Table 2.

Table 2: Fires Affecting the MDAFW Pumps Fire Area Fire Area Description MDAFW Pump A-1 1974 Aux. Bldg. General Area PAL01A A-14 AFW Pump Room A PAL01A A-28 Auxiliary Shutdown Panel A PAL01A A-33 Pipe Chase and Vestibule PAL01A A-8 2000 Aux. Bldg. Misc. Rooms and Corridors PAL01A C-12 2000 Aux. Bldg. Electrical Chase PAL01A C-16 2016' Aux. Bldg. Electrical Equipment Area PAL01A C-18 2016 Aux. Bldg. Electrical Chase PAL01A C-21 Lower Cable Spreading Room PAL01A C-24 2032' Control Bldg. Electrical Chase PAL01A C-27 Control Room Complex PAL01A C-5 Control Building Offices and Labs PAL01A C-9 ESF Switchgear Room A PAL01A A-1 1974 Aux. Bldg. General Area PAL01B A-13 AFW Pump Room B PAL01B A-16 CCW Pump Area PAL01B A-21 Control Room A/C Room B PAL01B A-28 Auxiliary Shutdown Panel A PAL01B A-33 Pipe Chase and Vestibule PAL01B

Attachment II to ET 21-0010 Page 10 of 28 Table 2: Fires Affecting the MDAFW Pumps Fire Area Fire Area Description MDAFW Pump C-10 ESF Switchgear Room B PAL01B C-11 2000 Aux. Bldg. Electrical Chase PAL01B C-15 2016' Aux. Bldg. Electrical Equipment Area PAL01B C-17 2016' Control Bldg. Electrical Chase PAL01B C-22 Upper Cable Spreading Room PAL01B C-23 2032' Control Bldg. Electrical Chase PAL01B C-27 Control Room Complex PAL01B C-30 2047' Control Bldg. Electrical Chase PAL01B C-33 2073'-6" Control Bldg. Electrical Chase PAL01B C-6 Control Bldg. Offices and HP Areas PAL01B ESWB ESW Pump House B PAL01B Each of the fire areas in Table 2 is included in the plant fire protection program that incorporates control of welding and hot work, limitation of transient combustibles, and provision of fire detection and suppression systems. The probability of a fire in one of these areas causing failure of an MDAFW pump during the proposed Completion Time extension is low.

The IPEEE (Reference 6) for internal fire focused on initial screening, determination of ignition source frequencies, compartment interactions analysis and plant walkdown. The approach implemented by WCGS for the IPEEE evaluation of internal fire used the EPRI FIVE two-phase progressive screening methodology to identify risk-significant fire areas.

Cabinets SB036D and SB036E are located in the control room. The IPEEE control room fire analysis (Reference 30) concluded that the CDF resulting from a control room fire was 2.22E-06/yr, or approximately 3.5% of the internal events CDF. The major contributor (~75%) of this CDF was due to a fire in two panels: solid state protection panels SB029A/B/C, and the station electrical distribution panel. Given the small fraction of total CDF associated with fires in control room cabinets, the unavailability of SB036D or SB036E for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months would cause a negligible increase in risk due to control room fires.

In the event that a fire failed the unaffected MDAFW pump train concurrent with an out of service AFAS train, there would still be numerous options to maintain secondary side heat removal.

These options include:

x Manual start of the MDAFW pump associated with the out of service AFAS train from the control room x Manual start of the MDAFW pump associated with the out of service AFAS train from the alternate shutdown panel x Automatic start of the TDAFW pump

Attachment II to ET 21-0010 Page 11 of 28 x Manual start of the TDAFW pump x Manual alignment and start of the NSAFW pump x Restoration of the condensate and main feedwater pumps Based on this qualitative assessment the overall change in risk from an internal fire event due to the extended Completion Time can be considered small.

4.2 Shutdown Events Considerations WCGS does not maintain a shutdown PRA model. WCGS operates under a shutdown risk management program to support implementation of NUMARC 91-06 (Reference 5). The shutdown risk management implementing procedure provides guidelines for outage risk management which focuses on proper planning, conservative decision-making, maintaining defense in depth, and controlling key safety functions.

5.0 RISK ASSESSMENT

SUMMARY

REPORT FOR ESFAS 5.1 Purpose The purpose of this report is to document the technical adequacy of the WCGS PRA models and the acceptability of the analyses performed to support the implementation of a Completion Time extension to restore one ESFAS train to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

5.2 PRA Scope, Applicability and Acceptability WCGS employs a multi-faceted, structured approach in establishing and maintaining the technical adequacy and plant fidelity of the PRA models. This approach includes a robust PRA maintenance and update process, as well as the use of independent peer reviews. The following information describes this approach as it applies to the WCGS PRA.

5.3 PRA Scope WCGS has peer reviewed PRA models for internal events and internal flooding evaluating both core damage frequency (CDF) and large early release frequency (LERF). WCGS is currently developing a fire PRA (FPRA) and seismic PRA (SPRA); however, the PRA models are still under development and have not been peer reviewed. WCGS has also developed a high winds PRA Model and conducted an external events screening assessment in accordance with Parts 6 and 7 of the ASME/ANS PRA Standard (Reference 10). A peer review was performed in 2015 as documented in Reference 14 which determined that 95% of the SRs were considered MET at CCII or higher; however, the high winds PRA model still has outstanding F&Os that need to be addressed. The high winds PRA is not sufficiently robust to provide direct support of risk applications.

Attachment II to ET 21-0010 Page 12 of 28 5.4 PRA Applicability Section 3.2 of RG 1.200 (Reference 4) requires identification of the pieces of the PRA model for each hazard group that are needed to support the application. Because this evaluation impacts the safety-related ESFAS which supports many modeled functions, all the model pieces and hazards are relevant.

5.5 PRA Acceptability WCGS conducted a full scope independent peer review on the internal events and internal flooding PRA models in June of 2019 (Reference 11). This peer review concluded that 98% of the Supporting Requirements (SRs) satisfied Capability Category (CC) II requirements of the ASME/ANS PRA Standard (Reference 10). During this Peer Review a total of thirty-four (34) findings, thirty (30) suggestions and one (1) best practice were generated. The conclusion of the review was that the WCGS PRA substantially met the ASME/ANS PRA standard (Reference 10) at CC-II, as endorsed by RG 1.200 (Reference 4), and could be used to support risk-informed applications.

Subsequently an independent F&O closure was held in December 2019 to close out findings from the internal events and internal flooding Peer Review (Reference 12). This review followed the guidance in Appendix X of NEI 05-04 (Reference 13). During this review a total of thirty-three (33) of the thirty-four (34) findings from the 2019 peer review were reviewed (F&O 4-10 was not in scope as it hadnt been addressed at the time). Of these findings, thirty-one (31) were determined to have been satisfactorily closed by the independent assessment team (IAT) while two (2) remained OPEN. During the F&O closure review, two (2) unique F&Os were judged to be closed with a PRA upgrade, which required a focused scope peer review. This triggered a focused scope peer review of the supporting requirements (SRs) associated with the upgrade.

Two (2) SRs in Part 2 and one (1) SR in Part 3 of the ASME/ANS PRA Standard (Reference 10) were therefore re-peer reviewed. Following the focused scope peer review, all the involved SRs were judged to be met at CC-II or higher, however one (1) new F&O was assigned. This results in a total of four (4) open F&Os remaining (1 not in scope of the F&O closure, 2 not closed during the F&O closure and 1 new from the F&O closure upgrade reviews).

Table 3 lists the four (4) finding-level F&Os that remain for the Wolf Creek PRA models. The table indicates:

x The F&O number x The relevant Supporting Requirements (SRs) from the ASME/ANS PRA Standard (Reference 10) that each F&O pertains to x The F&O text x A summary of the actions taken to address each F&Os concern x An evaluation of what, if any, impact there may be to the assessment of an ESFAS Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months

Attachment II to ET 21-0010 Page 13 of 28 Table 3: Assessment of Open Finding-Level F&Os for the Wolf Creek IE PRA Model Impact on Proposed F&O SR F&O Description Resolution Completion Time Number (status)

Extension 3-8 AS-C3

Description:

Identify plant specific sources The F&O was originally generated due to a lack of a clear This F&O is considered (Met) of uncertainty. This identification can be method for identification and characterization of key plant- resolved pending a (Applicable documented in a manner similar to the specific assumptions and sources of uncertainty. formal Appendix X F&O to both HR-I3 tables that characterize the generic sources Closure. There is no Internal (Met) To resolve this F&O, Wolf Creek collected and of model uncertainty and related impact on this events and characterized plant-specific sources of uncertainty in the IE-D3 assumptions. application.

Internal individual PRA notebooks. However, the F&O review team (Met)

Flood) Basis: Sources of uncertainty are required (Reference 11) did not agree that this resolution was SC-C3 to be identified. sufficient to fully close this F&O. The IAT indicated that (Met) there was a gap in the quantitative assessment of Possible Resolution: Identify plant specific uncertainty in the quantification notebook; especially for SY-C3 sources of uncertainty. This identification assumptions marked as non-conservative, which needed (Met) can be documented in a manner similar to a statement on the importance on the results to ensure that the tables that characterize the generic QU-F4 risk insights are not masked. Specifically, assumptions sources of model uncertainty and related (Not Met) marked as non-conservative need to have a clear assumptions.

characterization of the impact on results to ensure that risk insights are not masked.

Although the assumptions were identified and characterized in the individual PRA notebooks, there was not a clear process used to evaluate the impact of the assumptions and sources of uncertainty in the quantification notebook.

As a result, this F&O remains open. Wolf Creeks position is that the main issue of identification and characterization has been resolved through the identification and qualitative characterization in each PRA notebook.

The quantitative characterization process has now been fully consolidated and more clearly documented in the Wolf Creek Assumptions and Uncertainty Notebook (Reference 22).

Attachment II to ET 21-0010 Page 14 of 28 Table 3: Assessment of Open Finding-Level F&Os for the Wolf Creek IE PRA Model Impact on Proposed F&O SR F&O Description Resolution Completion Time Number (status)

Extension 4-10 (F&O LE-C13

Description:

The approach to scrubbing of The Wolf Creek LERF PRA model treats those SGTRs The impact of these was not in SGTR releases is consistent with the CC-II where SG isolation has failed as generating a large early assumptions is expected (Met CCII-scope for requirements and, therefore, allows the SR release, for these sequences scrubbing for SGTR releases to be minimal. Given the III) the F&O to be considered MET at CC-II. However, is not credited (Reference 23). Releases from SGTRs with very small LERF impact closure) the current SGTR documentation does not successful SG isolation (i.e., SGTRs with successful of this application, these provide sufficient technical basis to justify closure of MSIV, ARVs and SRVs), it is assumed that assumptions are not the credit taken. Additionally, the simplified because there is not a direct release pathway, the considered to have an approach for ISLOCA releases does not containment is not completely bypassed, thus these are impact on the risk results.

discuss any consideration of potential assumed to have small releases.

scrubbing credit.

Dominant ISLOCA sequences contributing to LERF are:

Basis: Additional documentation of SGTR x ISLOCA through the RHR suction due to failures of the scrubbing is needed. The approach taken redundant isolation MOVs or due to MOV rupture in for ISLOCA releases does not credit conjunction with redundant MOV unintentionally left scrubbing. While CC-II/III does not require open. The high frequency of these cutsets is due to a credit for ISLOCA scrubbing, some 1/year exposure time on one of the valves.

consideration for significant ISLOCA x ISLOCA through the LPSI cold leg injection due to failure sequences is needed to meet more than of redundant check valves. Again, the high frequency of CC-I. these cutsets is due to a 1/year exposure time on one of Possible Resolution: For ISLOCA events: the valves.

Identify significant ISLOCA sequences and No credit for scrubbing is taken for these (or any) ISLOCA document some consideration of scrubbing sequences. Crediting scrubbing for these ISLOCA for significant release locations based on sequences would require complex modeling of the release the general configuration and location of pathway through the Auxiliary building in order to track subject piping systems. If credit is fission product plate out prior to offsite release. This is justifiable, document credit of radionuclide considered beyond state of practice in the industry.

scrubbing. If scrubbing is not justifiable, Reference to WCAP-17154-P, ISLOCA Risk Model, has document the consideration given. For been added to the LERF model notebook. WCAP-17154-P SGTR events: Provide additional concludes that analyses to demonstrate ISLOCA releases documentation of the engineering basis by are small are not worth pursuing.

citing appropriate plant-specific or generic analyses. The LERF model notebook (PSA-09-0005) has been updated to include this information.

Attachment II to ET 21-0010 Page 15 of 28 Table 3: Assessment of Open Finding-Level F&Os for the Wolf Creek IE PRA Model Impact on Proposed F&O SR F&O Description Resolution Completion Time Number (status)

Extension 6-8 SY-C2

Description:

The notebook states that All system notebooks have been reviewed by the system Given that this F&O is (Met) walkdowns and interviews were performed engineer and no significant feedback has been noted that understood not to have but not documented. Without the would impact the model or this application. any impact on the PRA documentation there is no evidence that model, it is also not these tasks were performed and that the expected to have any walkdown was included the present as built adverse impact on the plant. proposed extension.

Basis: There is no evidence that a walkdown or operator interview was performed and when these tasks were performed.

Possible Resolution: The results of the walkdowns and interviews should be included in the system analysis documentation.

Attachment II to ET 21-0010 Page 16 of 28 Table 3: Assessment of Open Finding-Level F&Os for the Wolf Creek IE PRA Model Impact on Proposed F&O SR F&O Description Resolution Completion Time Number (status)

Extension AS-B3-01 AS-B3

Description:

Feed and Bleed scenarios The Revision 9 MOR explicitly accounts for sump blockage Given that this F&O has (Met) involving open PORVs did not consider the for LOCA events, including consequential pressurizer a negligible impact on the potential for sump strainer blockage. The PORV and RCP seal leak events. This F&O was generated PRA model, is it not review identified no model logic or a because other non-LOCA type events that credit Feed and expected to have an documented basis that would address open Bleed through the pressurizer PORV may also experience impact on the proposed PORV transients including considerations of sump blockage that is not accounted for. A sensitivity was extension.

the complications associated with conducted on the Revision 9 MOR for a previous submittal containment sump blockage with the to determine the impact of not limiting sump blockage to actuation of containment spray. LOCA type events. The results revealed only a slight increase in CDF (0.025%) and no change at all to LERF.

Basis: A review of plant documentation and event tree models did not result in evidence of treatment of Feed and Bleed scenarios where sump plugging cases with the possibility of spray actuation were considered. As an example, the application or disposition of SUMP-NPSH-NONLOCA to Feed and Bleed sequences with open PORVs is not addressed.

Possible Resolution: Add to the model or document the basis for not modeling containment sump blockage for Feed and Bleed scenarios.

Attachment II to ET 21-0010 Page 17 of 28 5.6 PRA Level of Detail and Plant Representation The WCGS models contain adequate detailed modeling for this application and are kept up-to-date with the as-built as-operated plant as described herein.

5.7 Level of Detail in the WCGS Models The PRA model is highly detailed and includes a wide variety of initiating events, mitigation systems, support systems, as well as fully developed common cause events. The PRA quantification process used is based upon the large linked fault tree methodology, which is a well-known and accepted methodology in the industry. The model is maintained and quantified using the Electric Power Research Institute (EPRI) integrated risk technologies (IRT) suite of software programs.

5.8 PRA Maintenance and Update Process The WCGS PRA models are controlled and maintained in accordance with a series of desktop guidance documents in compliance with the requirements provided in Section 1-5 of the ASME/ANS PRA Standard (Reference 10). While a wide array of desktop guidance documents have been developed to govern all aspects of the WCGS PRA program the primary desktop guidance documents used to facilitate this maintenance and update process are PRA-DG-01, PRA-DG-02, PRA-DG-03 and PRA-DG-07 (References 16 through 19). These documents were reviewed during the internal events and internal flooding peer review (Reference 11) as part of a review of the WCGS compliance with the ASME/ANS PRA Standard requirements for PRA configuration and control (Section 1-5 of Reference 10). The program was determined to meet the intent of SRs confirming that a robust and detailed process is in place to identify and track pending changes.

PRA-DG-01: Probabilistic Risk Assessment Program x This Desktop Guidance establishes the structure under which the WCGS PRA program is developed and maintained.

x The PRA program develops and maintains the WCGS PRA model of record (MOR) and, as deemed appropriate, an interim model. Additionally, the PRA program provides input to various risk-informed applications.

PRA-DG-02: Maintenance and Update of PRA Models x This Desktop Guidance establishes the maintenance and update process for the WCGS PRA model in support of PRA-DG-01 (Reference 16). Through systematic reviews of plant changes, PRA analysts identify impacts, determine significance and schedule timely implementation.

x Model updates occur on a periodic basis. Maintenance of the PRA model is performed to ensure the PRA model continually matches the as-built, as operated plant. Focused updates are primarily driven by specific plant changes/modifications. Maintenance of the PRA model is performed to ensure model fidelity such that risk-informed decisions better support safe and reliable plant operation. In addition, planned periodic updates of broader scope also occur as driven by data review, methodology changes, external

Attachment II to ET 21-0010 Page 18 of 28 inputs or other considerations. Less significant changes are tracked for cumulative effect to be implemented during one of the planned or maintenance updates.

PRA-DG-03: MSPI Basis Document Update x This Desktop Guidance documents the process used to ensure that the evaluation of pending changes that impact the PRA under PRA-DG-02 are in compliance with Industry MSPI Requirements for Technical Adequacy (MSPI FAQ 14-01 (Reference 15)).

x A living model is maintained to ensure that the cumulative impact of any pending model changes is well understood so that the MOR represents the as-built as-operated plant.

PRA-DG-07: Applications Maintenance x The purpose of this desktop guideline is to assist individuals in applying insights from the WCGS PRA model(s) to risk inform plant activities and implement beneficial risk-informed applications.

x The desktop guidance identifies the means to apply PRA insights to improve the effectiveness of processes and strengthen risk-informed decision-making in a variety of contexts.

As discussed above, these documents define the process to be followed to implement scheduled and interim PRA model updates and to control the PRA model files. In addition, these documents also define a rigorous process for identifying, tracking, and implementing model changes, and for identifying and tracking model improvements or potential issues that may affect the model. Model changes that are identified are tracked via a Configuration and Control Database which is discussed in considerable detail in PRA-DG-02 (Reference 17).

To ensure that the current PRA model remains an accurate reflection of the as-built, as-operated plant, the following activities are routinely performed:

x Design changes and procedure changes are reviewed for their impact on the PRA model x New engineering calculations and revisions to existing calculations are reviewed for their impact on the PRA model x Maintenance unavailabilities are captured, and their impact on the PRA is assessed x Plant specific initiating event frequencies, failure rates, and maintenance unavailabilities are updated, typically every two (2) refueling cycles In accordance with this guidance, regularly scheduled PRA model updates occur typically every two refueling cycles with more frequent updates occurring based on the risk significance of permanent changes, initiating events, and failure data such that the PRA continues to adequately represent the as-built, as-operated plant.

Attachment II to ET 21-0010 Page 19 of 28 5.9 Risk Application PRA Model The current approved version of the WCGS internal events and internal flooding PRA model is the Revision 9 Model of Record (MOR). Note that the internal events and internal flooding PRA model logic is maintained together.

WCGS thoroughly tracks pending changes in a configuration and control database (CCD) such that any outstanding items can be evaluated in a quarterly MSPI rollup in accordance with PRA-DG-03 (Reference 17). This CCD contains a reporting feature that can be used to quickly return all entries that are pending model changes.

Subsequent quarterly updates and evaluations are then made directly to the previously developed MSPI Living Model (hence the term Living) to ensure that this model represents the cumulative impact of all pending changes since the MSPI MOR was released in accordance with MSPI FAQ 14-01 (Reference 15).

The current Living Model version (Reference 20) has incorporated all outstanding impacts assessed for MSPI as of March 31st, 2021 and was therefore used to support this LAR for the internal events analysis.

The internal flooding PRA model was under refinement during the finalization of the MSPI work in Reference 20, and thus cannot be used. Instead, the finalized internal flooding model based on Reference 27 was used for the internal flooding quantifications.

5.10 Quantification Setup The PRA model can be used to evaluate the impact of ESFAS Train OOS because these trains are directly modeled. The ESFAS System Notebook (Reference 21) documents the ESFAS signals emanating from cabinets SA036D (Channel I) and SA036E (Channel IV). For example, Figure 3.1-4 of Reference 21 illustrates the logic for the auxiliary feedwater actuation signal (AFAS) for motor-driven auxiliary feedwater (MDAFW) pump PAL01A coming from SA036D and the signal for MDAFW pump PAL01B coming from SA036E. This figure also indicates the specific gates in the model that correspond to these signals. This information was used to develop flag files containing the ESFAS signals for each cabinet:

ESFAS Cabinet SA036D x SA-A-AL-PAL01A-AFAS x SA-A-AL-HV0031-LSP x SA-A-AL-HV0032-LSP x SA-A-AL-HV0035-LSP x SA-A-AL-HV0036-LSP

Attachment II to ET 21-0010 Page 20 of 28 ESFAS Cabinet SA036E x SA-A-AL-PAL01B-AFAS x SA-A-AL-HV0030-LSP x SA-A-AL-HV0033-LSP x SA-A-AL-HV0034-LSP Note that Figure 3.1-11 of Reference 21 illustrates logic for the control room ventilation isolation signal (CRVIS) which is no longer modeled and, therefore, was not included in this analysis. CCD Item #128 has been entered to remove this figure from the ESFAS Notebook.

In addition, since the ATWS mitigation system actuation circuitry (AMSAC) system functions on the AFW system through the AFAS, the loss of one train of AFAS increases the failure probability of AMSAC. Conservatively assuming that the outputs of ESFAS cabinets SA036D and SA036E are the only logic inputs to AMSAC, when the failure of ESFAS cabinet SA036E is TRUE, the failure probability of AMSAC is equal to the failure probability of ESFAS cabinet SA036D, which is the square root of the nominal probability of AMS-FAILS. This assumes that both separation group ESFAS cabinets have the same failure probability. Therefore, AMS-FAILS was set to 1E-01.

Finally, if the plant has entered into a ESFAS 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time due to an inoperable separation train, some consideration of CCF of the redundant train during the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time should be considered. There are various CCF groups assigned to components within the S036D and S036E cabinets. The model was reviewed to identify a bounding representative CCF group that could be modified to increase the likelihood of failure of the redundant train given failure of one train has occurred. Basic event CCF-SA-SCD-FOP-02-05_1_2 represents the CCF for the actuation modules for the MDAFW pumps (PAL01A/B). Per the Data Analysis Notebook (Reference 24), the alpha factor (2 out of 2) for Type Code SCD-FOP-02-02 is 0.0244. A flag file command was used to increase the CCF for the actuation model from 1.44E-05 to 2.44E-02. This modification is consistent with the process recommend in Appendix E of NUREG/CR-5485 (Reference 29).

The above settings were incorporated into quantification flag files for each ESFAS Cabinet:

ESFAS_BOP_OOS_SA036D.txt ESFAS_BOP_OOS_SA036E.txt Tier 1 - Risk Evaluation Results and Insights As defined in RG 1.177 (Reference 2), Tier 1 is the evaluation of the impact on plant risk of the proposed TS change as expressed by the risk metrics discussed below. The following sections present the results of those quantitative risk analyses. The risk metrics of interest for permanent changes to TS are the incremental conditional core damage probability (ICCDP) and the incremental conditional large early release probability (ICLERP).

Attachment II to ET 21-0010 Page 21 of 28 5.11 Risk Insights The differences between the baseline results in normal alignment and the ESFAS train OOS cases are consistent with the flag file changes described in Section 0. The delterm cutsets illustrate a higher reliance on manual actions (OPA-AFWACT and OPA-LSP), an increase in the CCF of the actuation signals and the increase in AMSAC failure.

For internal floods, the dominant accident sequences created by loss of one ESFAS train involve loss of room cooling for the unaffected MDAFW pump. The loss of cooling is generally caused by flood-induced failure of essential service water or component cooling water.

The ICCDP and ICLERP results (See Table 1) were approximately 3 to 4 orders of magnitude below the requirements of the regulatory guide, respectively. This was anticipated given that there is inherent defense-in-depth at Wolf Creek in the scenario in which an ESFAS train is unavailable, due to the available redundant ESFAS train and provision for manual operator action.

In addition, the redundant turbine-driven auxiliary feedwater (TDAFW) pump function is still available.

5.12 Sensitivities Timing to Start and Align the NSAFW Pump (OPA-NSAFW-BF)

CCD Item#122 documents a discrepancy identified for the timing of the operator action to start and align the non-safety auxiliary feedwater (NSAFW) pump. The revision 9 MOR used expert elicitation to develop a time of 10 minutes for the execution. However, observations made during an inspection of time sensitive operator actions revealed that this time was not realistic as this took approximately 25 minutes to implement. An update to the human reliability analysis (HRA) dependency analysis (DA) was conducted in Reference 25 to developed recovery rules to account for the observed timing.

A sensitivity was conducted for this application by substituting this updated HRA DA using recovery rules files WCPRA_8_26_21.recv which called on the updated HRA DA file, WC_HEP_8-26-21.txt. The quantifications produced in Table 1 were then reconducted (all other quantification files remained unchanged) to demonstrate that the risk impacts would not be impacted by this issue. The results of these sensitivity runs are illustrated in Table 4. These results show that the baseline internal events and internal flood results are increased but that the increases are still well below the thresholds.

Attachment II to ET 21-0010 Page 22 of 28 Table 4: ICCDP and ICLERPT Results for BOP ESFAS OOS HRA DA Sensitivity From 0hrs to 24hrs Internal Events Internal Flood Total(1)

BOP ESFAS Cabinet SA036D Base Case 7.32E-06 1.26E-05 1.99E-05(4)

CDF SA036D OOS 8.08E-06 1.30E-05 2.10E-05 ICCDP(2) 2.26E-09 1.17E-09 3.43E-09(5)

Base Case 7.92E-08 3.96E-08 1.19E-07(6)

LERF SA036D OOS 8.66E-08 3.98E-08 1.26E-07 ICLERP(3) 2.18E-11 5.71E-13 2.24E-11(7)

BOP ESFAS Cabinet SA036E Base Case 7.32E-06 1.26E-05 1.99E-05(4)

CDF SA036E OOS 8.04E-06 1.30E-05 2.11E-05 ICCDP(2) 2.14E-09 1.33E-09 3.47E-09(5)

Base Case 7.92E-08 3.96E-08 1.19E-07(6)

LERF SA036E OOS 8.65E-08 3.99E-08 1.26E-07 ICLERP(3) 2.15E-11 8.85E-13 2.24E-11(7)

Notes:

(1) The contribution from Fire, High Winds, and Seismic is evaluated qualitatively in Section 0 (2) The ICCDP values were calculated using the following equation:

ICCDP = (OOS case - Base case)/PAF * (1/365)

(3) The ICLERP values were calculated using the following equation:

ICLERP = (OOS case - Base case)/PAF *(1/365)

(4) Total CDF meets the RG 1.174 acceptance criteria of < 1E-4 per year (5) Total ICCDP meets the RG 1.177 acceptance criteria of < 1E-6 per year (6) Total LERF meets the RG 1.174 acceptance criteria of < 1E-5 per year (7) Total ICLERP meets the RG 1.177 acceptance criteria of < 1E-7 per year 5.13 Review of Assumptions and Uncertainty 5.13.1 Identification of Key Assumptions A review of the PRA modeling assumptions in Reference 22 was performed to identify applicable assumptions to this LAR. This review involved identifying and dispositioning items applicable to the ESFAS and AFW system notebooks that were considered potential sources of model uncertainty. In addition, a general search for assumptions in other notebooks involving relative components and functions was performed.

Attachment II to ET 21-0010 Page 23 of 28 The following assumptions were identified as a potential impact and were evaluated further with respect to this LAR:

Assumption IE#371:

The LSELS sequencer boundary as specified in NUREG/CR-6928 includes the relays, logic modules, etc. that comprise the sequencer function of the emergency diesel generator (EDG) load process. However, the load shed and loading relays are conservatively modeled as separate components to facilitate risk assessments for configuration risk management and for regulatory risk assessments in the event of an individual relay failure. This should be considered a source of model uncertainty for applications where sequencer and sequencer relay failures are significant to the results.

Disposition: This assumption is applicable to the sequencer rather than the PAL01/B actuation modules and has no impact on this application.

Assumption IE#350:

The pump room coolers, SGF02A for the train "A" MDAFP room and SGF02B for the train "B" MDAFP room, are safety-related and are required to function following a design basis accident, to achieve and maintain the plant in a safe shutdown condition. The cooling units are powered by the same class 1E electrical separation group as the associated AL pump. The EF system source is lake water that contains silt, sediment and other matter which may, over time, build up and act to block flow through the room cooler. Each train of components cooled by the ESW is flushed on a quarterly basis to clear any sediment or debris that might have accumulated.

Disposition: This is conservative treatment. If the pump room coolers were not required as a support, the pumps would be more reliable. This impact would be applicable to both the baseline and sensitivity results so the overall impact would be relative. This is not considered a source of uncertainty for this application given the margin demonstrated.

Assumption IE#351:

Per emergency operating procedures, inadequate level in one or more SGs when any one SG has adequate level directs the operator to a lower priority (yellow path) procedure to restore all SG levels. Due to the uncertainty in timing of transitioning to this procedure based on other priorities in the accident sequence, no credit is assumed for recovery of all SGs for purpose of assuring symmetric reactor coolant loop cooling for protection of the reactor coolant pump shutdown seals. The logic for gate AL-ASYMMETRIC assumes that if safety-related AFW was successful (one SG supplied), then no attempt would be made to use NSAFW or MFW to supply other SGs. Similarly, if safety-related AFW fails but NSAFW is successful, no attempt would be made to use MFW. This is a conservative assumption, since time is available prior to overheating and failure of the shutdown seals to implement the recovery procedures.

Disposition: This is conservative treatment. If credit was given for restoring secondary side cooling to all SGs the probability of RCP failure due to asymmetric cooling would be reduced. This is not considered a source of uncertainty for this application given the margin demonstrated.

Attachment II to ET 21-0010 Page 24 of 28 Assumption IE#355:

The backup air supply for the TDAFP control valves (ALHV0006, ALHV0008, ALHV0010, and ALHV0012) from the nitrogen accumulators are credited for the SBO cases. Even though the nitrogen accumulators design capacity only allows the control valves to operate for eight-hour mission time, with one valve cycle every 20 minutes, it is assumed that they provide the operator additional time and air to prevent overfill in SGs B and C.

Disposition: This is a nonconservative treatment as loss of the control valves due to failure of instrument air would require additional operator support. Section 6.2.12 of Reference 22 discusses a bounding sensitivity that was run on the Revision 9 MOR to remove credit for the accumulators. The sensitivity demonstrated a 23% increase for CDF and a 7%

increase for LERF given the higher reliance on operator actions to locally start a compressor (OPA-IA). The actual impact would be lower as the accumulators will afford additional time for operators to restore instrument air support. This is not considered a significant source of uncertainty for this application given the margin demonstrated.

Assumption #IE357:

Table A-1 item 14 of EPRI TR-1016737 addresses uncertainty associated with treatment of equipment operability in beyond design basis environments. The AL and AP System could experience a harsh environment for some modeled initiating events (such as a steam line break initiator in the Turbine Building) but since is not designed to operate in such environments it this is not credited in the PRA model. The generic SY uncertainties listed in EPRI TR-1016737 Table A-4 are applicable, but there are none that are considered to have additional or special significance for the AL and AP System model.

Disposition: A review of the delterm cutsets indicates that harsh environment events such as feedwater line or steam line breaks are very low contributors. Therefore, the impact of this assumption is relative and would equally impact both the baseline and sensitivity results. This is not considered a source of uncertainty for this application given the margin demonstrated.

Assumption IE#358:

CST refill from Demineralized Water system is not credited for long term cooling as it may be difficult to show that this makeup can sustain the AL system for an extended period of time.

Disposition: This assumption is conservative as additional inventory would increase reliability of the CST. For this application this would be beneficial since the failure of ESFAS cabinets impact the ESW supply to the MDAFW pumps. Section 6.2.11 of Reference 22 discusses that the Revision 9 MOR results were reviewed for impact and it was determined that this impact was negligible. This is not considered a source of uncertainty for this application given the margin demonstrated.

Assumption IF#59:

It is assumed that for all human failure events (HFEs) being modified to account for flooding impact, emergency lighting would be in use during the event and the response would be complex.

Attachment II to ET 21-0010 Page 25 of 28 For events with local action outside of the Control Room, the environment would be hot/humid and the atmosphere would be steamy where appropriate. This is a conservative assumption applied to increase Performance Shaping Factors (PSFs) associated with internal flooding HFEs.

Disposition: This is conservative treatment as negative PSFs increase the probability of failure. For this application the HFEs of interest are OPA-AFWACT and OPA-LSP as they are only needed following ESFAS failures. Table 8-1 of the internal Flooding HRA Notebook (Reference 28) documents that these HFEs were not modified for internal flooding. Therefore, this assumption is not a source of model uncertainty for this application.

Assumption #IF60:

Per EPRI guidance, for human actions within an hour after the initiator, the operator response time should be increased significantly [by a factor to be determined]. Since the EPRI guidance does not specify how much the response time should be increased to, engineering judgment is applied to assess the likely impact to the HFEs if they are required during an internal flood initiator.

The time adjustments are included to account for flood-related distractions. For HFEs where the Td is equal or less than 10 minutes, Tcog and Texe are increased by 2 minutes. For HFEs where the Td is over 10 minutes, Tcog and Texe are increased by 5 minutes. This is a realistic assumption that is applied to increase the HEPs associated with internal flooding HFEs.

Disposition: For this application the HFEs of interest are OPA-AFWACT and OPA-LSP.

Table 8-1 of the internal Flooding HRA Notebook (Reference 28) documents that these HFEs were not modified for internal flooding. Therefore, this assumption is not a source of model uncertainty for this application.

Assumption #IF61:

Some of the 1983TGA EA and KC floods were having a significant impact by failing the NSAFW pump. This was largely due to conservative modeling in which each 1983TGA flood is mapped to all the turbine building components as the entire turbine building is treated as one flood area as a simplification. In fact, only a small fraction (assumed 0.1, LF-1983TGA-PAP01FRAC) of the EA and KC pressure boundary failures would cause direct failure of the NSAFW pump.

Disposition: This is conservative treatment as the current treatment of 10% of the floods in this area impacting NSAFW is still considered bounding. Given that the additional cutsets identified during this analysis are heavily dominated by failure of operator actions to start or align MDAFW, additional credit for the NSAFW pump is unlikely to have a significant impact given that this pump also requires an operator action to start and align.

This is reflected in the HRA DA sensitivity in Section 0 where an update to the HRA DA had a fairly equivalent impact to both the baseline and Completion Time extension cases.

Therefore, this assumption is not a source of model uncertainty for this application.

5.13.2 Application Specific Assumptions The following items are assumptions that are specific to this application:

1. Since the AMSAC system functions on the AFW system through AFAS, the loss of one train of AFAS increases the failure probability of AMSAC. Conservatively assuming that

Attachment II to ET 21-0010 Page 26 of 28 the outputs of ESFAS cabinets SA036D and SA036E are the only logic inputs to AMSAC, when the failure of ESFAS cabinet SA036E is TRUE, the failure probability of AMSAC is equal to the failure probability of ESFAS cabinet SA036D, which is the square root of the nominal probability of AMS-FAILS. This assumes that both separation group ESFAS cabinets have the same failure probability. Therefore, AMS-FAILS was set to 1E-01. This adjustment of AMS-FAILS has negligible impact upon CDF and LERF.

2. Section 0 discusses that a representative CCF group has been used to account for the possible CCF failure between cabinets SA036D and SA036E. There are several CCF groups that are modeled between these cabinets but the CCF of the actuation of PAL01A and PAL01B actuation module failure was utilized as this was the most bounding CCF event. If a less bounding failure were to occur, the CCF may be lower which would lessen the impact of the CCF contribution to system failure. Therefore, this is conservative treatment.

3. As noted in Section 0, the CCF of the PAL01A and PAL01B actuation modules has been set to the CCF Alpha factor for 2 out of 2 for the Completion Time extension cases where one train has failed. This is considered conservative treatment.

5.13.3 Completeness Uncertainty Completeness uncertainty is addressed by evaluating the completeness of the risk assessment.

The internal events and internal flooding completeness uncertainty reviews were captured in Section 0. Because all unscreened hazards have been qualitatively screened for this application, there is no completeness uncertainty that would impact the results of this assessment.

5.13.4 Parametric Uncertainty Parametric uncertainty is typically evaluated by use of software tools designed for this purpose, such as UNCERT, which propagate the parametric uncertainties of each PRA model input through the model to estimate a mean risk metric result rather than a point estimate. The component failure and common cause basic events in the WCGS models are constructed to facilitate the state of knowledge correlation during the uncertainty calculations.

The evaluation of parametric uncertainty determined that the parametric uncertainty results on the current PRA MOR show a propagated mean estimate that is very near, and only slightly greater than, the point-estimate based mean. In addition, the propagated mean estimate is based on uncertainty parameter inputs that are largely generic or assumed values, so the propagated mean is not necessarily a better risk estimate. For this analysis, gates related to the out of service ESFAS Cabinets were set to TRUE and the failure of AMSAC was adjusted. All other basic events retained their original values and parametric values. Therefore, since the specific changes due to this application do not directly impact parametric uncertainties, the point-estimate based mean risk results are judged to be appropriate for this application and no additional parametric uncertainty calculations were performed.

Attachment II to ET 21-0010 Page 27 of 28

6.0 REFERENCES

1. Regulatory Guide 1.174, Revision 3, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, U.S. Nuclear Regulatory Commission, January 2018.

2. Regulatory Guide 1.177, Revision 2, Plant-Specific, Risk-Informed Decisionmaking:

Technical Specifications, U.S. Nuclear Regulatory Commission, January 2021.

3. Regulatory Guide 1.160, Revision 4, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, U.S. Nuclear Regulatory Commission, August 2018.

4. Regulatory Guide 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, U.S.

Nuclear Regulatory Commission, March 2009.

5. NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management, December 1991.

6. Wolf Creek Generating Station, Individual Plant Examination of External Events (IPEEE), June 1995.

7. EPRI NP-6041-SL, Revision 1, A Methodology for Assessment of Nuclear Power Plant Seismic Margin, EPRI, August 1991.

8. Wolf Creek Updated Safety Analysis Report, Revision 33, March 2020.

9. A Recommendation for an Enhanced Fujita Scale (EF-Scale), June 2004, Wind Science and Engineering Center, Texas Tech University.

10. ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Application, February 2009.

11. WCNOCPES029-REPT-001, Revision 0, Wolf Creek Internal Events Probabilistic Risk Assessment Peer Review.

12. PWROG-19038-P, Revision 0, Independent Assessment of Facts and Observations Closure of the Wolf Creek Probabilistic Risk Assessment.

13. NEI 05-04, Revision 3, Process for Performing Internal Events PRA Peer Reviews Using the ASME/ANS PRA Standard, Nuclear Energy Institute, November 2009.

14. PWROG-15082-P, Revision 0, Peer Review of the Wolf Creek Generating Station External Events Screening and High Winds Probabilistic Risk Assessment.

15. FAQ 14-01, MSPI PRA Technical Adequacy, Effective 3/31/2016.

16. PRA-DG-01, Revision 0, Probabilistic Risk Assessment Program.

17. PRA-DG-02, Revision 1, Maintenance and Update of PRA Models.

Attachment II to ET 21-0010 Page 28 of 28

18. PRA-DG-03, Revision 0, MSPI Basis Document Update.

19. PRA-DG-07, Revision 0, PRA Applications.

20. LTR-RAM-20-47-NP, Revision 4, WCGS MSPI Evaluation, Q1 2021.

21. WCNOC-PSA-145, Revision 3, Load Shedding & Emergency Load Sequencer (NF),

Engineered Safety Feature Actuation System (SA), and Reactor Protection System (SB)

Systems Analysis Notebook.

22. WCNOC-PSA-099, Revision 0, Assumptions and Uncertainty Notebook.

23. LTR-RAM-21-54, Revision 0, Transmittal of Wolf Creek Generating Station Probabilistic Risk Assessment Peer Review for Finding F&O 4-10.

24. WCNOC-PSA-021, Revision 6, At-Power Internal Events PRA, Data Analysis.

25. LTR-RAM-21-59, Revision 1, Analysis of Revised Operator Action Timing for the Wolf Creek PRA Model.

26. J-14001, Revision 11, Control Room Equipment Arrangement.

27. LTR-RAM-21-55, Revision 0, Transmittal of Wolf Creek Final Internal Flooding Quantification, WCNOC-PSA-035, Revision 4.

28. WCNOC-PSA-034, Revision 3, Human Reliability Analysis Flood Mitigation Strategies Notebook.

29. NUREG/CR-5485, Guidelines on Modeling Common-Cause Failures in Probabilistic Risk Assessment, U.S. Nuclear Regulatory Commission, November 1998.

30. Calc. No. AN-95-029, Control Room Fire Analysis, March 31, 1998.

31. WCNOC-PSA-067, Revision 0, Internal Fire - Qualitative Screening, Quantitative Screening and Quantification Notebook, File WCNOCFPRA_R9_CDF.franx.

32. WCGS Update Safety Analysis Report, Revision 33, Section 3.8.4.1.3.

Attachment III to ET 21-0010 Page 1 of 2 ATTACHMENT III PROPOSED TECHNICAL SPECIFICATION CHANGES (MARK-UP)

Attachment II to ET 21-0010 ESFAS Instrumentation Page 2 of 2 3.3.2 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME L. One or more required L.1 Verify interlock is in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months channel(s) inoperable. required state for existing unit condition.

OR L.2.1 Be in MODE 3. 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months AND L.2.2 Be in MODE 4. 13 hours1.50463e-4 days 0.00361 hours 2.149471e-5 weeks 4.9465e-6 months M. One channel inoperable. M.1 Place channel in trip. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND M.2 Restore channel to During OPERABLE status. performance of next COT N. One train inoperable. -------------------NOTE---------------------

One train may be bypassed for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for surveillance testing provided the other train is OPERABLE.

30 N.2.1 N.1 N1 Be in MODE 3. h 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months AND 36 N.2.2 N.2 N 2 Be in MODE 4. 12 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months (continued)

N.1 Restore train to OPERABLE 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months status.

OR Wolf Creek - Unit 1 3.3-28 Amendment No. 123, 156, 6 227

Attachment IV to ET 21-0010 Page 1 of 2 ATTACHMENT IV REVISED TECHNICAL SPECIFICATION PAGES

(6)$6,QVWUXPHQWDWLRQ

$&7,216 FRQWLQXHG

&21',7,21 5(48,5('$&7,21 &203/(7,217,0(

/ 2QHRUPRUHUHTXLUHG / 9HULI\LQWHUORFNLVLQ KRXU

FKDQQHO V LQRSHUDEOH UHTXLUHGVWDWHIRUH[LVWLQJ

XQLWFRQGLWLRQ

25

/ %HLQ02'( KRXUV

$1'

/ %HLQ02'( KRXUV

0 2QHFKDQQHOLQRSHUDEOH 0 3ODFHFKDQQHOLQWULS KRXU

$1'

0 5HVWRUHFKDQQHOWR 'XULQJ

23(5$%/(VWDWXV SHUIRUPDQFHRI

QH[W&27

1 2QHWUDLQLQRSHUDEOH 127(

2QHWUDLQPD\EHE\SDVVHGIRUXS

WRKRXUVIRUVXUYHLOODQFHWHVWLQJ

SURYLGHGWKHRWKHUWUDLQLV

23(5$%/(

1 5HVWRUHWUDLQWR KRXUV

23(5$%/(VWDWXV

25

1 %HLQ02'( KRXUV

$1'

1 %HLQ02'( KRXUV

FRQWLQXHG

ROI&UHHN8QLW $PHQGPHQW1R

Attachment V to ET 21-0010 Page 1 of 4 ATTACHMENT V PROPOSED TS BASES CHANGES (MARKUP)

(for information only)

Attachment V to ET 21-0010 ESFAS Instrumentation Page 2 of 4 B 3.3.2 BASES ACTIONS L.1, L.2.1, and L.2.2 (continued) conditions in an orderly manner and without challenging unit systems.

Placing the unit in MODE 4 removes all requirements for OPERABILITY of this interlock.

M.1 and M.2 Condition M applies to the Auxiliary Feedwater Pump Suction Transfer on Low Suction Pressure Function. The condensate storage tank is the highly reliable and preferred suction source for the AFW pumps. This function has a 2 out of 3 trip logic. Therefore, continued operation is allowed with one inoperable channel until the performance of the next monthly COT on one of the other channels, as long as the inoperable channel is placed in trip within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

N.1, N.21, and N.2.2 INSERT B 3.3.2-44 N.1 N 1 and NN.22 alan of Plant ESFAS Condition N applies to the Auxiliary Feedwater Balance W one train inoperable, automatic actuation logic and actuation relays. With inoperable h

the unit must be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 4 within the followingg 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The Required Actions are ar modified by a Note that ttra allows one traina to be bypassed for up to 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months srs for surveillance testing provided thehe other train is OPERABLE. 30 36 O.1 Condition O applies to the Auxiliary Feedwater Manual Initiation Function.

The associated auxiliary feedwater pump(s) must be declared inoperable immediately when one or more channel(s) is inoperable. Refer to LCO 3.7.5, Auxiliary Feedwater (AFW) System.

P.1, P.2.1, and P.2.2 Condition P applies to the Auxiliary Feedwater Loss of Offsite Power Function. With the inoperability of one or both train(s), 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is allowed to return the train(s) to OPERABLE status. The specified Completion Time is reasonable considering the fact that this Function is associated only with the turbine driven AFW pump, the available Wolf Creek - Unit 1 B 3.3.2-44 Revision 20

Attachment V to ET 21-0010 Page 3 of 4 INSERT B 3.3.2-4

If one train is inoperable, 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months are allowed to restore the train to OPERABLE status. The 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowed for restoring the inoperable train to OPERABLE status is justified in Reference14. The Completion Time for restoring a train to OPERABLE status is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval. If the inoperable train cannot be restored to OPERABLE status within 24

hours,

Attachment V to ET 21-0010 ESFAS Instrumentation Page 4 of 4 B 3.3.2 BASES REFERENCES 1. USAR, Chapter 6.

2. USAR, Chapter 7.

3. USAR, Chapter 15.

4. IEEE-279-1971.

5. 10 CFR 50.49.

6. WCNOC Nuclear Safety Analysis Setpoint Methodology for the Reactor Protection System, TR-89-0001.

7. WCAP-10271-P-A Supplement 2, Revision 1, "Evaluation of Surveillance Frequencies and Out of Service Times for the Engineered Safety Features Actuation System," June 1990.

8. WCAP-13632-P-A, Revision 2, Elimination of Pressure Sensor Response Time Testing Requirements, January 1996.

9. Wolf Creek Setpoint Methodology Report, SNP (KG)-492, August 29, 1984.

10. Amendment No. 43 to Facility Operating License No. NPF-42, March 29, 1991.

11. WCAP-14333-P-A, Revision 1, Probabilistic Risk Analysis of the RPS and ESFAS Test Times and Completion Times, October 1998.

12. 10 CFR 50.55a(b)(3)(iii), Code Case OMN-1.

13. Performance Improvement Request (PIR) 2005-2067.

14. Amendment No. XXX to Renewed Facility Operating License No. NPF-42, XXXXXXX, XX, XXXX.

Wolf Creek - Unit 1 B 3.3.2-52 Revision 89

v t e Letter Sequence Request
EPID:L-2021-LLA-0172, License Amendment Request - Revision to Technical Specification 3.3.2, Engineered Safety Feature Actuation System (ESFAS) Instrumentation (Approved, Closed)
Initiation Request, Request, Request Acceptance Administration Questions 23 November 2021 Answers 22 December 2021 Results Approval Other:
MONTHYEAR2021-12-22 [Table View]

ET 21-0010, License Amendment Request - Revision to Technical Specification 3.3.2, Engineered Safety Feature Actuation System (ESFAS) Instrumentation

Text

Subject:

Subject:

SUMMARY

3.0 TECHNICAL EVALUATION

4.0 REGULATORY EVALUATION

5.0 ENVIRONMENTAL CONSIDERATION

6.0 REFERENCES

SUMMARY

3.0 TECHNICAL EVALUATION

4.0 REGULATORY EVALUATION

5.0 ENVIRONMENTAL CONSIDERATION

6.0 REFERENCES

SUMMARY

6.0 REFERENCES

SUMMARY

Description:

Description:

Description:

Description:

6.0 REFERENCES

Navigation menu

ET 21-0010, License Amendment Request - Revision to Technical Specification 3.3.2, Engineered Safety Feature Actuation System (ESFAS) Instrumentation

Text

Subject:

Subject:

SUMMARY

3.0 TECHNICAL EVALUATION

4.0 REGULATORY EVALUATION

5.0 ENVIRONMENTAL CONSIDERATION

6.0 REFERENCES

SUMMARY

3.0 TECHNICAL EVALUATION

4.0 REGULATORY EVALUATION

5.0 ENVIRONMENTAL CONSIDERATION

6.0 REFERENCES

SUMMARY

6.0 REFERENCES

SUMMARY

Description:

Description:

Description:

Description:

6.0 REFERENCES

Navigation menu

Search