W3F1-2004-0043, Supplement to Amendment Request NPF-38-249, Extended Power Uprate

Supplement to Amendment Request NPF-38-249, Extended Power Uprate

ML041460407
Person / Time
Site:	Waterford
Issue date:	05/21/2004
From:	Houston B Entergy Nuclear South, Entergy Operations
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
W3F1-2004-0043
Download: ML041460407 (35)

Text

-- Entergy Entergy Nuclear South Entergy Operations, Inc.

17265 River Road Killona, LA 70057 Tel 504 739 6440 Fax 504 739-6698 bhousto@entergy.com Bradford Houston Director, Nuclear Safety Assurance Waterford 3 W3F1-2004-0043 May 21, 2004 U.S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555

SUBJECT:

Supplement to Amendment Request NPF-38-249, Extended Power Uprate Waterford Steam Electric Station, Unit 3 Docket No. 50-382 License No. NPF-38

REFERENCES:

1. Entergy Letter dated November 13, 2003, 'License Amendment Request NPF-38-249 Extended Power Uprate"

2. NRC Letter dated April 20, 2004, 'Waterford Steam Electric Station, Unit 3 (Waterford 3) - Request for Additional Information Related to Revision to Facility Operating License and Technical Specifications -

Extended Power Uprate Request (TAC No. MC1355)"

Dear Sir or Madam:

By letter (Reference 1), Entergy Operations, Inc. (Entergy) proposed a change to the Waterford Steam Electric Station, Unit 3 (Waterford 3) Operating License and Technical Specifications to increase the unit's rated thermal power level from 3441 megawatts thermal (MWt) to 3716 MWt.

By letter (Reference 2), the Nuclear Regulatory Commission (NRC) staff requested additional information (RAI) related to probabilistic risk assessment. Entergy's response to these 13 questions is contained in Attachment 1 to this letter.

There are no technical changes proposed. The original no significant hazards consideration included in Reference 1 is not affected by any information contained in this letter. The submittal includes a new commitment as summarized in Attachment 2.

If you have any questions or require additional information, please contact D. Bryan Miller at 504-739-6692.

AuDI

W3F1 -2004-0043 Page 2 of 3 I declare under penalty of perjury that the foregoing is true and correct. Executed on May 21, 2004 Sincerely, BLH/DBM/ssf

Attachment:

1. Response to Request for Additional Information

2. List of Regulatory Commitments

W3Fl-2004-0043 Page 3 of 3 cc:

Dr. Bruce S. Mallett U. S. Nuclear Regulatory Commission Region IV 611 Ryan Plaza Drive, Suite 400 Arlington, TX 76011 NRC Senior Resident Inspector Waterford 3 P.O. Box 822 Killona, LA 70057 U.S. Nuclear Regulatory Commission Attn: Mr. Nageswaran Kalyanam MS 0-07D1 Washington, DC 20555-0001 Wise, Carter, Child & Caraway Attn: J. Smith P.O. Box 651 Jackson, MS 39205 Winston & Strawn Attn: N.S. Reynolds 1400 L Street, NW Washington, DC 20005-3502 Louisiana Department of Environmental Quality Office of Environmental Compliance Surveillance Division P. 0. Box 4312 Baton Rouge, LA 70821-4312 American Nuclear Insurers Attn: Library Town Center Suite 300S 29t" S. Main Street West Hartford, CT 06107-2445 To W3FI-2004-0043 Response to Request for Additional Information to W3FI-2004-0043 Page 1 of 29 Response to Request for Additional Information Related to the Extended Power Uprate Probabilistic Risk Assessment Question 1:

Section 2.11: Does the probabilistic risk assessment (PRA) model include equipment unavailability due to maintenance, or was a 'zero maintenance" PRA model used? If the latter, justify that the PRA results can be meaningfully compared to the numerical risk acceptance guidelines contained in Regulatory Guide 1.174.

Response 1:

The Section 2.11 PRA evaluation used the base PRA model, which includes maintenance unavailability basic events. The unavailability values are based on plant-specific data.

Question 2:

Page 2.11-2, Loss-of-Offsite Power (LOOP): Please provide the overall LOOP frequency, along with its constituent parts (plant-centered, grid-related, and weather-related frequencies).

Describe the basis for estimating the LOOP frequencies and offsite power (OSP) recovery curves, identifying the methodology and data sources used. Justify that the data used is relevant to the Waterford post-extended power uprate (EPU) grid environment.

(Staff comment: NUREG-1784 indicates that since 1997 (when deregulation of the nation's electrical grid commenced), the nationwide plant-centered LOOP frequency has decreased, the grid-related and weather-related LOOP frequencies have remained constant, and OSP recovery times have increased. Since mixing older data with newer data tends to smooth out (de-emphasize) these trends, the post-EPU PRA results may not reasonably portray the post-EPU plant risk.)

Response 2:

The overall LOOP frequency is 2.70E-2 per year. The constituent parts are:

Plant-centered 2.07E-02 Grid 4.80E-03 Weather 1.50E-03 This LOOP frequency was estimated using the following data and method. Industry data reported by EPRI for the time period between 12/1/85 to 12/31/99 [EPRI TR-1 06306 (LOOP data through 1995), EPRI TR-110398 (LOOP data through 1999)] were reviewed for applicability to Waterford 3. As noted by EPRI, only categories la and lb represent true unavailability of all offsite power; these were the EPRI events considered for inclusion in the LOOP frequency. Although the EPRI data does not classify offsite events according to the plant-centered, grid-related, and weather-related categories, such categories were determined through review of the event descriptions.

to W3F1-2004-0043 Page 2 of 29 LOOP events in these EPRI documents were excluded from the Waterford 3 LOOP frequency if they met the following criteria:

All events related to snow and ice were discarded since the Waterford site has a mild climate and no record of suffering extreme cold weather-related precipitation.

All events related to hurricanes were discarded.

Procedure OP-909-521, "Severe Weather and Flooding," requires plant shutdown to Mode 5 when a hurricane warning is issued and arrival on site is expected within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. These hurricane LOOP events are included in the shutdown risk model.

Events clearly not relevant to Waterford 3 due to differences in plant design were discarded.

During the 12/1/85 to 12/31/99 time frame, 40 LOOP events were counted as applicable to Waterford 3.

In order to determine the number of generating unit years for this time frame, two references were used. Table B from NSAC-203 (LOOP data through 1993) was used to obtain the number of generating unit years from 1986 [95.1 generating unit years], 1987 [102.2 generating unit years], and 1/12 of the generating units for 1985 [1/12*89.6 generating unit years]. This yielded 204.8 generating unit years. EPRI TR-1000158 (LOOP data through 1999) was used for the 12 year period from 1988 through 1999, which yielded 1278.0 generating unit years. The total generating unit years for the time frame of 12/1/85 to 12/31/99 was 204.8 + 1,278.0 or 1,482.8 generating unit years.

Therefore, the LOOP frequency for Waterford was 40/1482.8 or 2.70E-02 losses per generating unit year.

The offsite power (OSP) recovery curves were developed using durations from the LOOP events used for the LOOP frequency, with the addition of LOOP events going back to 1965

[NSAC-85 (LOOP data through 1984), NSAC-166 (LOOP data through 1989)]. The OSP recovery curve was formed from a weighted mixture of Weibull probability distribution functions:

Pr{OSP not recovered by time t} = G(t)= p1G1(t)+P2 G2(t)+P3 G3 (t) where G(t) denotes the complementary cumulative distribution function (CCDF) of the mixture, pj for j=1,2,3 denote weighting factors such that pi + P2 + p3 = 1, and Gj(t) for j=1,2,3 denote the CCDFs of OSP recovery times associated with unique causes of LOOP. The three categories of LOOP causes were: grid-related 0=1), plant-centered 0=2), and weather-related 0=3).

Weibull distributions were used to model the OSP recovery times associated with each category of LOOP (i.e., the Gj(t) functions are Weibull CCDFs). The Weibull probability distribution was used as suggested by NUREG-1032 and NUREG/CR-5032.

The following figure shows the duration of LOOP events used in the Waterford 3 OSP curve, separated by type and as function of time. This data goes through the end of 1999. The grid event durations show no discernible trend. Although the weather events are longer at later times, there are too few events (5) to draw conclusions about trends. (Recall that hurricane events are not included here.) In addition, there is no reason to assume that these few data points represent a trend of lengthening durations rather than simply reflecting the randomness to W3Fl-2004-0043 Page 3 of 29 of these rare events. For example, the 23 hr duration loss in 1998 was tornado at Davis-Besse.

Although there are many severe tornado events every year in the U.S., it is highly unlikely that such a tornado will hit a nuclear plant. Since the return period (mean time between occurrences) for such an event is not known, the occurrence of the next such tornado event which strikes a nuclear plant cannot be predicted. In other words, it is impossible to conclude from the weather data that a trend of increasing duration is occurring.

Plant-centered LOOP events, however, do appear to exhibit a trend of increasing duration. This may reflect to some degree increases in the number of nuclear plants in operation from early (e.g., before 1975) to later (1984 and later); with a larger population of plants, it is more likely that the relatively rare long-duration plant-centered LOOPs would occur. In addition, the likelihood of plant-centered LOOP events appears to be plant-specific. Sixteen nuclear plants have experienced multiple plant-centered LOOP events; the remaining plant-centered LOOP events are shared by eighteen plants. Waterford 3 has not experienced any at power LOOP events (plant-centered or otherwise). Therefore, use of the whole set of plant-centered LOOPs, even events going back to 1965, is conservative for Waterford 3.

LOOP Duration - Waterford 3 Model 25 20 V

Cx 1E 15 10 S

-



S 1$

.1-I i

%=
Grid:'_ -

I 4'tWeather, 0'1a2_rd:'- !'

5 A 0 4 S



U, U

Li..A 1965 1975 1984 Year 1994 In summary, grid-centered events do not show an increasing duration trend in the LOOP data used for Waterford 3. Weather-centered events are too rare to be able to determine whether a trend in duration is present. Plant-centered events do exhibit a trend of increasing duration for the industry data, but Waterford 3 has not experienced any LOOP events and thus appears to have lower than average probability of a plant-centered LOOP; use of the pooled plant-centered is therefore reasonable for Waterford 3.

to W3F1 -2004-0043 Page 4 of 29 Finally, although NUREG-1784 indicates that LOOP durations have increased since 1997 (with deregulation), examination of the data (Table C-1) indicates that these events have occurred in the Northeast, Midwest, and West Coast-regions where deregulation has occurred. Waterford 3 is in a region where deregulation has not been significant. In Entergy's service area, for example, deregulation proposals have been cancelled or deferred as a result of problems with deregulation in other parts of the country, especially California.

Question 3:

Page 2.11-2, LOOP: Does the PRA consider consequential LOOPs (a LOOP after reactor trip caused by grid collapse due to loss of the plant's generation)? If so, provide the consequential LOOP probability, describe how it was developed, and perform a study to investigate the sensitivity of the overall PRA results to the consequential LOOP probability. If not, justify the omission.

(Staff comment: NUREG-1 784 indicates that the fraction of time when the nationwide electrical grid operates in a degraded condition has increased since when deregulation of nation's electrical grid commenced in 1997, and that there [sic] an increased likelihood of suffering consequential LOOPs whenever the grid is degraded. It is not clear how the licensee's PRA has considered the impact of the proposed EPU on grid stability and grid degradation, which in turn affects the likelihood of consequential LOOP events and overall plant risk.)

Response 3:

Consequential LOOP is included in the generic LOOP frequency, which includes LOOP events at nuclear plants as a result of trips at those plants. Nevertheless, the Waterford 3 PRA includes a plant-centered consequential LOOP event based on Waterford experience with failure of the unit auxiliary transformer (UAT) to startup transformer (SUT) transfer (2 failures in 65 reactor trips). The UAT is the transformer that normally supplies plant loads from the main generator; the SUT is the transformer that supplies power to the plant from offsite (the switchyard, which is connected to the grid). After a plant trip, failure of the UAT to SUT transfer for both divisions (A and B) of AC power would produce a LOOP. Note that the two UAT to SUT transfer failures at Waterford were only partial LOOPs.

Since this UAT to SUT transfer failure event is based on actual plant experience, and models the only LOOP-related events that have actually occurred at Waterford 3, it dominates the plant-centered LOOP probability. In other words, the induced LOOP probability should be dominated by the probability of this event that has actually happened at Waterford, rather than by potential events that have not actually happened. The probability of a UAT to SUT transfer failure (partial LOOP) is 1.5E-2. This probability is calculated as 2 failures / 130 demands, where the number of demands is 65 trips x 2 transfers (demands) per trip.

The UAT to SUT transfer failures are included in the Waterford 3 PSA as independent failures for the two divisions. Common cause failure (CCF) events are included for the SUTs and the SUT breakers, as well as the main generator lockout relays (which activate the transfer); CCF of the UAT to SUT transfer failure-which was estimated from plant data-was not included, since there was no plant-specific data with which to estimate a CCF beta factor. An estimate of the to W3F1 -2004-0043 Page 5 of 29 importance of the induced LOOP, from UAT to SUT transfer failure, was made by performing a sensitivity calculation of the effect of including a common cause failure (CCF) of the UAT to SUT transfers on the risk results. Since both transfer failure events involved failure of 4.16KV breakers, the CCF type that is applicable to the transfer is 4.16KV breaker. A CCF event was added to the model in the locations of the UAT to SUT transfer failures (i.e., as inputs to the same gates). A CCF beta factor of 3.85E-2 was used, based on NUREG/CR-5497, Table 3-2 (4160 Volt AC Breaker Fail to Close), for a CCCG=2. The result was to increase the pre-EPU internal events CDF from 5.522E-6 to 6.149E-6, an increase of 11%, and the post-EPU internal events CDF from 5.87E-6 to 6.497E-6. Since both pre-and post-EPU CDFs are affected equally (each is increased by 6.27E-7), the EPU incremental core damage frequency (ICDF), which is the difference between the post-and pre-EPU CDFs, is unchanged. Thus, adding this CCF event for the UAT to SUT transfer failure has no effect on the risk associated with EPU. By extension, since the UAT to SUT transfer failure CCF dominates the consequential LOOP probability, consequential LOOP has little effect on the overall PRA results for EPU.

A final question related to consequential LOOP is whether, as suggested by NUREG-1784, there is an increased likelihood of consequential LOOP as a result of deregulation. Studies of the impact of EPU on the offsite power system have been performed, as described in the EPU submittal, Section 2.3.2.1, and the April 15, 2004, RAI response (Letter, Bradford Houston to U.S. NRC, W3Fl-2004-0029, "Supplement to Amendment Request NPF-38-249, Extended Power Uprate, Waterford Steam Electric Station, Unit 3, Docket No. 50-382, License No. NPF-38," April 15, 2004), Question 2. These studies show that the transmission grid will remain stable following EPU. System stability criteria will be met even with the higher grid injection from Waterford 3 and offsite voltage will remain acceptable after a Waterford 3 trip.

Question 4:

Pages 2.11-3 and 2.11-4, Component Failure Rates: As part of the plant modification needed to implement the EPU, new digital atmospheric dump valve (ADV) controllers will be installed.

However, this section indicates that no component failure rates were revised. It is not clear that the ADV failure rate for the post-EPU plant will be the same as for the pre-EPU plant. The reliability of the ADVs is important in the post-EPU plant since the licensing basis calculations indicate that the ADVs are needed to mitigate small break loss-of-coolant accidents (SBLOCAs).

Response 4:

The PRA does not use the licensing basis calculations that indicate that the ADVs are needed to mitigate SBLOCAs (see response to Question 5). In the PRA, the ADVs are NOT needed for SBLOCA success.

The Waterford 3 PRA model uses generic data (e.g., NUREG/CR-4639) for components such as controllers. This data does not distinguish between digital and analog controllers, so it is not apparent that a change in failure rate would be necessary. In addition, due to recent issues regarding the EPU SBLOCA analysis (reference Entergy letter W3Fl-2004-0035 to the NRC dated May 7, 2004 for further details), Waterford 3 no longer expects to need to install digital ADV controllers. The final determination regarding the need for digital controllers will be communicated to the NRC staff by July 15, 2004. If digital ADV controllers are to be used, a detailed response to this question will be provided at that time.

to W3Fl-2004-0043 Page 6 of 29 Question 5:

Page 2.11-4, Success Criteria: A new Technical Specification is being added concerning ADV operability since the licensing basis thermal-hydraulic (T-H) calculations indicate that either 2 ADVs and 1 high pressure safety injection (HPSI) pump or 2 HPSI pumps are required to mitigate an SBLOCA. This section indicates that the post-EPU PRA success criteria for SBLOCAs do not include the ADVs, based on best-estimate T-H calculations performed specifically for the PRA. Why is there is such a difference between the SBLOCA success criteria for the licensing basis and the PRA?

Response 5:

The LOCA model used for the licensing basis has many conservatisms required by 10CFR50 Appendix K, including a 1.2 multiplier on decay heat. The LOCA model used for the PRA includes realistic models and input; it does not, for example, use the multiplier on decay heat.

The more realistic model and inputs show that the ADVs are not required for success during a SBLOCA.

Question 6:

Page 2.11-4, Success Criteria: Please describe how the core damage frequency (CDF) contribution from anticipated transients without scram (ATWS) events is determined in the PRA by addressing the following questions:

a. Does the PRA model of ATWS sequences consider only the reactor trip failure probability, or does it include the failure of other systems (turbine bypass, ADVs, feedwater, etc.) required to mitigate an ATWS?

b. Were new T-H calculations of the post-EPU plant's behavior during ATWS performed to specifically support the PRA? How do the primary and secondary pressure responses during an ATWS change as a result of the EPU?

c. How does the increase the boron concentration in the boric acid makeup tank (BAMT) affect the plant's behavior during ATWS? Is emergency boration considered in the PRA's treatment of ATWS?

Response 6:

a. The PRA model for ATWS includes the systems needed to mitigate an ATWS. These are:

(1) primary pressure relief (both pressurizer safety valves open to limit pressure increase and reclose to prevent SBLOCA); (2) emergency boration; and (3) Emergency Feedwater (EFW).

Primary pressure relief includes modeling of whether moderator temperature coefficient (MTC) is adverse enough to cause overpressurization, with different critical MTC values for various combinations of turbine trip success or failure and early EFW success or failure.

b. Yes, new T-H calculations for ATWS were performed using the CENTS code. These calculations were used to determine the critical MTC values (above which MTC is adverse enough to cause overpressurization) and the time available to start emergency boration.

to W3F1 -2004-0043 Page 7 of 29 Determination of the specific effect of EPU on primary and secondary pressures is not possible, because we do not have pre-EPU T-H calculations (we use a CEOG standard on ATWS modeling that was based on generic 3400MW-class T-H analysis, which is not reported in the standard). Comparison of the CEOG standard results for critical MTC with the post-EPU T-H calculation results indicates that peak RCS pressure for an MTC of -1.8E-4 delta-rho/deg-F increases from about 3150 psia to 3607 psia, although some of this difference may be due to methodology differences. The conclusion of the post-EPU T-H analysis is that the critical MTC is smaller (more negative). This T-H analysis has a negligible effect on the PSA model: the ATWS sequences that use the critical MTC values determined by the T-H analyses have probabilities below the 1E-10 truncation level. ATWS risk is dominated by two scenarios-(1) ATWS with failure of 1 of 2 primary safety valves to open, leading to overpressurization of the RCS (no matter how good [negative] the MTC is); and (2) ATWS with I of 2 primary safety valves sticking open after relief, causing a small LOCA, which is conservatively assumed to cause core damage even with safety injection, because of the core power level. In neither of these scenarios is T-H modeling used; they are both assumed to lead to core damage.

c. The post-EPU T-H analysis included consideration of emergency boration. This analysis conservatively used the pre-EPU minimum boric acid concentration of 3950 ppm instead of the proposed post-EPU minimum concentration of 4900 ppm. Inclusion of this 4900 ppm boron concentration in the post-EPU T-H analysis would improve the predicted plant response. The risk contribution of the emergency boration failure ATWS sequence is very small, below the 1 E-10 truncation.

Question 7:

Page 2.11-4, Success Criteria: This section indicates that new T-H calculations were performed for the PRA using the CENTS code. In general, NRC has approved use of the CENTS code for transient analyses. It is not approved for demonstrating compliance with Section 50.46 of Title 10 of the Code of Federal Regulations criteria; however, it is acceptable for use in modeling SBLOCAs (including steam generator tube ruptures - SGTRs) for the purpose of demonstrating compliance to non-LOCA regulatory acceptance criteria. Were new T-H calculations made using CENTS to determine PRA success criteria and operator action timings for medium and large LOCAs? If so, please justify. Also, define the term "core-damage" as used in the PRA and explain how the results of T-H calculations were interpreted to determine whether or not core-damage occurred.

Response 7:

CENTS was not used for medium and large LOCA success criteria and operator action timings; it was only used for the non-LOCA transients (including SGTR). CEFLASH-4ASIPARCH was used for small and medium LOCAs. The licensing-basis large LOCA thermal-hydraulic results were used for the large LOCA sequences.

For non-LOCA transients, core uncovery is conservatively assumed to be equivalent to core damage, i.e., core damage is defined as core uncovery. For LOCAs, core damage is conservatively assumed to occur when the peak clad temperature reaches 2200 deg-F.

to W3F1 -2004-0043 Page 8 of 29 Question 8:

Pages 2.11-6 and 2.11-7, Table 2.11-1, Impact of EPU on human reliability analysis Time Available: Please update this table to include the human failure event probabilities in the pre-and post-EPU PRA models, and the Fussell-Vesely importance measures and the risk achievement worths for the post-EPU PRA model.

Response 8:

The pre-EPU and post-EPU human failure event (HFE) probabilities and post-EPU Fussell-Vesely and risk achievement worth (RAW) importances are shown in the following table. (In the table, 'Existing" = pre-EPU and 'EPU" = post-EPU.) Some of the HFEs do not appear in the cut sets and thus do not have importance values; these HFEs were adjusted in the model and included in the EPU submittal for completeness. Note that in many cases the post-EPU HFE probability is lower than the pre-EPU probability; the reason for this is that the pre-EPU times are based on more conservative thermal-hydraulic analyses than realistic thermal-analyses performed for the post-EPU case using the CENTS and CEFLASH codes.

The determination of the risk importance of many of the HFEs was complicated by the use of combination events in the Waterford 3 PRA. Since many individual operator actions exhibit dependency when performed close in time (i.e., the HFE probabilities are not independent, but are dependent on the failure of preceding actions), multiple HFEs in a single cut set are replaced by a single combination HFE that has a probability representing the combined probability of failure of the individual HFEs considering their potential dependency. In other words, multiple independent HFEs are not allowed in a cut set. The individual HFE risk importance values in the following table use the maximum importance value for the HFE either individually or in a combination event. In cases where the importance value is taken from the combination event importance, the importance of the individual HFE within that combination event may be overestimated. Importance values that were taken from the combination event importance are shown in bold italics.

In the calculation of the risk impact of EPU, it was found that the changes in HFE probabilities shown in the following table had a very small effect on CDF. Making the changes shown in the table changed the overall Level 1 internal events CDF from 6.732E-6 to 6.729E-6, or a decrease of 3E-9 (as noted above, many of the HFE probabilities are lower for the post-EPU CDF calculation because of the more realistic thermal-hydraulic analyses). Use of realistic pre-PU times (e.g., via use of thermal-hydraulic methods comparable to the post-EPU calculation) would not be expected to produce a significant CDF delta for HFE changes only. The risk impact of EPU is dominated by the changes in LOOP non-recovery probabilities, which were calculated using consistent pre-and post-EPU thermal-hydraulic model times.

to W3Fl-2004-0043 Page 9 of 29 Impact of EPU on HRA Time Available Existing.

Existing.

-EPU EPU HEE:

EPU HFE.

EPU

.Event Name.-'

Description-Time

HFE Time..

Probability Fussell-,

HFE Available Probability: Available Vesely RAW EHFALPABMP Failure to energize bus 3AB3-S from 40 min 7.6E-1 2.83 min 1.0 N/A N/A bus opposite initial supply (Note 1)

(Note 2)

EHFALPABSP Failure to energize bus 3AB3-S from 60 min 1.1E-1 14 min 1.0 1.34E-2 1.01 bus opposite initial supply EHFMANTRNP Failure to transfer loads to startup 50 min 8.6E-2 68.3 min 3.2E-2 2.49E-3 1.61 transformers when auto transfer fails EHFMTRNLTP Failure to transfer loads to startup 9 hr 4.1E-5 14 hr 4.1E-5 2.16E-4 2150 transformers when auto transfer (Note 3)

(Note4) fails, with long time available EHF-TEDG-P Failure to Start/Align/Load TEDG 50 min 1.8E-2 68.3 min 5.8E-3 N/A N/A (Note 5)

HHFALNABMP Failure to align HPSI pump AB to 40 min 4.4E-1 2.83 min 1.0 8.56E-3 1.0 replace pump A or B following (Note 1) medium LOCA HHFALNABSP Failure to align HPSI pump AB to 60 min 4.9E-2 14 min 1.0 4.OOE-3 1.0 replace pump A or B following small LOCAorSGTR 1 The 2.83 min time available does not include the effect of the safety injection tanks, which would extend this time.

2 Not in cut sets.

3 HFE probability is based on cause-based calculation (not time-dependent); time-dependent probability is below 1 E-5, due to long time available.

4 In combination with QHFCSPEMPP (Failure to make up to CSP from CST) and QHFCSPWCTP (Failure to switch EFW suction to ACCW).

5 Temporary emergency diesel generator (TEDG) not used in EPU model; only applicable to EOOS risk monitor for TEDG configuration.

to W3F1 -2004-0043 Page 10 of 29 Impact of EPU on HRA Time Available (cont.)

Existing

. Existing. EPUEPU:

EPUHFE.

EPUHFE.

EPU EventName Description Time Probability.

Fussell-HFE

___.______:_......_______:_:Available

-Probability Available

. Vesely :

RAW IHFSTCOMPP Failure to Restart Instrument Air 50 min 7.5E-3 68.3 min 1.OE-3 2.30E-5 1.0 Compressor after fast transfer (Note 6 failure NHFCDMKUPP Failure to make up to condenser 50 min 3.9E-2 68.3 min 3.5E-2 N/A N/A hotwell from CST when automatic (Note 2) makeup fails OHFCONDSTP Failure to attempt to restore feed to 50 min 1.2E-1 68.3 min 7.5E-3 6.72E-4 323.7 steam generators via condensate (Note 7) pumps OHFRELTFWP Failure to attempt to restore 9 hr 6.5E-5 14 hr 1.OE-5 1.93E-3 18,600 feedwater (e.g., via auxiliary (Note 3)

(Note 8) feedwater) after late loss of EFW OHFRESTFWP Failure to attempt to restore 50 min 9.2E-3 68.3 min 1.8E-3 2.61 E-3 2.45 feedwater (e.g., via auxiliary feedwater) 6 Screening value of 1.0 was used.

7 In combination with QHFCSPEMPP (Failure to align CSP makeup) and QHFCSPWCTP (Failure to switch EFW suction to ACCW).

8 In combination with QHFCSPEMPP (Failure to make up to CSP from CST) and QHFCSPWCTP (Failure to switch EFW suction to ACCW).

to W3FI-2004-0043 Page 11 of 29 Impact of EPU on HRA Time Available (cont.)

Existing

-Existing EPU EPU HFE.- EPU HFE.

EPU Event Name" Decription Time HFE

, 'Time' Probability Fussell-HFE Available.

Probability. Available Vesely RAW.

PHFMFIVOPP Failure to unisolate MFW to allow 50 min 1.4E-2 68.3 min 1.7E-3 1.82E-4 1740 feeding steam generators after IIMSIS PHFSGTRBDP Failure to blow down steam 60 min 1.5E-2

>24 hr 7.5E-3 8.94E-4 1.12 generator to prevent overfilling affected generator QHFCSPEMPP Failure to align makeup to CSP 9 hr 3.OE-5 9.33 hr 3.OE-5 1.33E-3 18,600 during EFW operation (Note 3)

(Note 9 (Note 10 QHFCSPWCTP Failure to align suction to EFW from 9 hr 3.1E-3 14 hr 3.1E-3 3.19E-3 18,600 WCT after CSP depletion (Note 3)

(Note 11 RHFSTCVCPP Failure to start charging pumps to 60 min 1.1 E-3 3 hr 5.1 E-4 N/A N/A provide backup injection following (assume (Note 2)

SGTR d) 9 In combination with QHFCSPWCTP (Failure to switch EFW suction to ACCW).

10 In combination with QHFCSPWCTP (Failure to switch EFW suction to ACCW) and OHFRELTFWP (Failure to establish backup feedwater flow from AFW).

11 In combination with QHFCSPEMPP (Failure to make up to CSP from CST) and OHFRELTFWP (Failure to establish backup feedwater flow from AFW).

to W3F1-2004-0043 Page 12 of 29 Question 9:

Page 2.11-7, LOOP Recovery: Please provide additional details about the convolution approach used to conduct the LOOP recovery analysis. Using the internal events post-EPU PRA model, conduct a sensitivity analysis to assess the impact of the convolution approach on the results by determining the CDF before any LOOP recoveries are considered.

Response 9:

The LOOP convolution recovery process is used to model recovery of offsite power (OSP).

OSP recovery actions are modeled by adding OSP non-recovery events to the LOOP-initiated cut sets, automatically (using the QRecover software) according to pre-defined rules.

PRA model basic events may be sorted into two distinct types according to how their probabilities are determined:

1. Type-I Events: Time-dependent failures occurring prior to the initiator or time-independent failures occurring at the start of or during the accident. Type-1 events include both standby failures (e.g., 'normally-open valve transfers closed prior to a demand") and demand failures (e.g., "pump fails to start on demand" or 'pump unavailable due to maintenance"). The probability of a Type-1 event does not depend on the timing of other events in the cut set or the duration of the accident. Operator failures, whether prior to or during the accident, are considered Type-1 events since they are assumed to be independent of the duration of the accident.

2. Type-2 Events: Time-dependent failure occurring during the accident (e.g., "diesel generator fails to continue running" and "OSP not recovered before battery depletion").

The probabilities of Type-2 events depend on the timing of other Type-2 events in the cut set and on the accident duration.

The probabilities of almost all Type-2 events are calculated by assuming that equipment has a constant failure rate. Under this assumption, the time to failure has an exponential distribution and the probability of failure over the interval [0,Tm] is given by:

Pr {Type - 2 event) = 1-exp(-ATm) where X denotes the constant failure rate. The quantity Tm is called the mission time, which is usually assumed to be 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in PRA. The notable exception to the assumption of constant failure rates is OSP recovery since the recovery time is described by a mixture of Weibull distributions.

With respect to cut sets initiated by LOOP and containing run failures, it is difficult to select an appropriate mission time. Following LOOP, the standby diesel generators start and supply emergency electrical power to systems that ensure adequate core cooling. These diesel generators only need to run until OSP is recovered. However, the time when OSP is recovered is random, described by the mixture of Weibull distributions. Therefore, it is not possible to to W3FI-2004-0043 Page 13 of 29 select a characteristic mission time for direct substitution into the above failure probability equation.

The convolution approach consists of integrating (or convoluting) the product of the probability density functions (pdfs) associated with the run failures in a given cut set with the OSP non-recovery probability. The convolution integral equals the mean probability that OSP is not recovered in time to prevent core damage for the given cut set. In a broad sense, the convolution process may be viewed as a time-averaging approach.

Convolution can be understood by considering a hypothetical plant having a single diesel generator. It is assumed that core damage will occur if a LOOP initiating event occurs, the diesel generator fails to run, and OSP is not recovered within Tc hours after the diesel generator fails. The quantity Tc is the time required to boil away the primary inventory following a total loss of AC power. This cut set might be represented by:

cut set = LOOP

• DGR

• NROSP in which LOOP is the LOOP initiator, DGR is the diesel run failure event, and NROSP is the non-recovery of OSP in time to prevent core damage.

The frequency of this cut set is given by:

f(cut set) = f (LOOP) x P(DGR

• NROSP)

The convolution approach is based on understanding the timing interactions of Type-2 events in cut sets. For this simple example it is convenient to define a loss of off-site power recovery factor (RLOSP), given by:

a)

P(DGR

• NROSP) _

DG(tD +c)dtD RLOSP==

P(DGR) 1-eA That is, RLOSP is the numerical value assigned to the OSP non-recovery event in the cut set.

In the above example, RLOSP is used to determine the cut set frequency as follows:

f(cut set) = f(LOSP) x P(DGR

• NROSP) = f(LOSP)x P(DGR)x RLOSP The simple example given above may be generalized to address all types of cut sets initiated by LOOP. The frequency of a cut set initiated by LOOP is given by:

f(cut set) = f(LOSP)x [P X1 f f-.. Jf lfj(tj )]9(tR) dt1 dt2... dtn dtR to W3Fl-2004-0043 Page 14 of 29 where:

f(LOSP) = LOSP frequency Pi = failure probability of the ith Type -1 event m = number of Type -1 events in the cut set fj(tj)= pdf of the jth Type-2 event tj = time when the jth Type -2 event occurs n = number of Type - 2 events in the cut set g(tR) = pdf of OSP recovery tR = time when LOSP recovery occurs The general LOOP recovery factor, RLOSP, is defined as:

RLOfSP llj(tj)1g(tR)dtl dt2**-dtndtR RLOSP =

i =

n Tm ri ffjf(tj ) dt i=1 0 The number of iterated integrals in these equations equals n + 1, where n is the number of Type-2 time-dependent failures in the cut set. The additional integral is for the time-dependent LOOP pdf. Note that the integration region, R, is not specified above. The upper and lower limits of each of the iterated integrals may be determined by inspection for each permutation of Type-2 events in the cut set. It is often useful to establish these integration limits by drawing a

'time line" for each cut set permutation. The time line provides a means of accounting for timing dependencies that occur between Type-2 events occurring in the cut set. Two example time lines for a simple station blackout cut set follow.

MDEFW-B FTR The assumed order of failure is rTDE-B MDEFWP-B, followed by TDEFWP-AB. Core damage occurs if the time Case 1:

when offsite is recovered exceeds

%T5 - iosp 3

the sum of the TDEFWP failure time and the core uncovery time:

tB tB < tT

_tR

> tT + tc > core damage

[LT tC 4

tR to W3Fl-2004-0043 Page 15 of 29 TDEFW-AB FTR The assumed order of failure is MDEFW-B TDEFWP-AB, followed by MDEFWP-B. Core damage occurs if the time Case 2:

when offsite is recovered exceeds

%T5 - LOSP l

the sum of the MDEFWP-B failure time and the core uncovery time:

tT-tT < tB 4-tB tC tR>tB+tc =coredamage 4

tR In these time lines, %T5 = LOOP initiator, TDEFW-AB FTR = turbine-driven EFW pump fails to run, and MDEFW-B FTR = motor-driven EFW pump B fails to run.

Quantification of the convolution integral requires specification of the integration limits.

However, since there are two possible ways of ordering the timing of the Type-2 events in this example, this quantification requires separate assessment of each ordered case. The two ordered cases are as follows:

%T5

• QMMPPASTRF

• QMMPPBRUNF

• QTP3PMPABF

• ZLOOP_D2

%T5

• QMMPPASTRF

• QTP3PMPABF

• QMMPPBRUNF

• ZLOOP_D2 For both cases, by definition, both the LOOP initiator (%T5) and the MDEFW Pump A failure to start (QMMPPASTRF) event occur at the beginning of the accident. In Case 1, MDEFW Pump B fails to run (QMMPPBRUNF) prior to the TDEFW Pump AB's failure to run (QTP3PMPABFF); in Case 2, TDEFW Pump AB fails to run prior to MDEFW Pump B's failure to run. Since recovery of offsite power terminates the accident, event ZLOOPD2 (OSP non-recovery) is always placed at the end of the cut set.

Since these permutations define all possible failure-timing combinations and since they are mutually exclusive, the convolution integral for the cut set equals the sum of the convolution integrals associated with its possible permutations. Thus, lCS = P(1 st cut set ordering) + P(2nd cut set ordering)

= ICS1 + ICS2 The last step in the LOOP recovery analysis consists of creating rules for use by QRecover (a post-processor for cut set files that adds recovery events according to user-defined rules).

QRecover works by examining each cut set for the presence of basic event combinations, i.e.,

the LOOP initiator and various combinations of Type-1 and Type-2 basic events. If a basic event combination for which an OSP non-recovery factor is defined (and included in the rules) is present in the cut set, then the associated non-recovery event is added to the cut set.

to W3F1 -2004-0043 Page 16 of 29 To determine the sensitivity of the EPU risk assessment result to the LOOP recoveries (OSP non-recovery events), the ZLOOP events (OSP non-recovery events) in the post-EPU cut sets were set to TRUE. When this was done, the post-EPU CDF increased from 5.87E-6 to 9.21 E-

5. Setting all the ZLOOP events to TRUE is extremely unrealistic, because it has the effect of modeling LOOP events as never recovered, i.e., after a LOOP initiator, offsite power is never restored. A more realistic sensitivity calculation is to increase the ZLOOP event (non-recovery) probabilities by 50%. This increases EPU CDF from 5.87E-6 to 6.81 E-6, or a 16% increase.

Question 10:

Pages 2.11-8 through 2.11-10, Level 1 Internal Events Results: Do the results for the internal events PRAs (pre-and post-EPU) include the contribution from internal floods? If not, please provide them.

Response 10:

The submittal does not include internal flooding, since the internal flood analysis (summarized in the IPE submittal in response to Generic Letter 88-20 in August of 1992) used a conservative screening approach that is not affected by power uprate changes. The CDF total for unscreened areas was 1.9E-6. Note that screened scenarios are not included in the CDF total because the CDF values for these scenarios are very conservative, because of the very conservative nature of the screening process. There were four unscreened flooding scenarios.

Each one will be discussed in terms of the possible impact of power uprate.

1. Control Room. The flood source, potable water pipes in the control room, is assumed to flood the control room envelope and to propagate and fill the lowest elevation of the reactor auxiliary building (RAB), including safety injection and emergency feedwater pumps (which is assumed to cause core damage without recoveries). This scenario includes 3 operator recoveries, none of which is affected by the power uprate timing changes described for the internal events PRA: (1) isolation of the flood before equipment outside the control room is damaged; timing of the action is dependent on the flooding rate, which has no dependence on power uprate; (2) replenishment of the emergency feedwater water source; this is equivalent to QHFCSPEMPP or QHFCSPWCTP in the internal events model (see response to Question 8), which are not affected by power uprate; (3) tripping the reactor coolant pumps following loss of seal cooling; this is a function of the time to seal failure, which is independent of power uprate.

2. Control Room Emergency Living Quarters. The final CDF for this scenario was 2E-10, which is negligible.

3. RAB-31 (-4 elevation corridors and Passageways). This flood is assumed to fill the RAB to the +21 elevation (grade elevation), at which elevation the flood water would flow out of the RAB to the surroundings. An operator action is included to isolate the flood before the flood elevation reaches +21, thus sparing some essential equipment (e.g., switchgear) from flooding. The timing of this action is dependent on the flooding rate, which has no dependence on power uprate.

4. RAB-32 (-35 elevation pipe penetrations and auxiliary component cooling water Dumps).

This flood is also assumed to fill the RAB to the +21 elevation (grade elevation). An to W3Fl-2004-0043 Page 17 of 29 operator action is included to isolate the flood before the flood elevation reaches +21, thus sparing some essential equipment (e.g., switchgear) from flooding. The timing of this action is dependent on the flooding rate, which has no dependence on power uprate.

Since the flooding analysis is not affected by the EPU timing changes described in the response to Question 8, there is no significant effect of EPU on internal flooding risk.

The flooding analysis used a very coarse method. Flood frequencies were estimated based on gross piping densities. Consequences were estimated by assuming massive flooding of whole floor elevations. Ex-control room operator actions that would have to occur in the flooded areas were assumed failed. No plant design changes since the flooding analysis could affect the analysis. The most significant design change, from a PRA standpoint, that has been made over the years was a change to the operator type (from air operated to motor operated) for the safety injection suction isolation valves from containment; since either operator type is assumed failed under flood conditions, the design change has no effect on the flooding analysis. Other design changes are much less significant and would not affect the flooding analysis.

Question 11:

Page 2.11-16, Evaluation of Probabilistic Safety Assessment (PSA) Model Quality: This section states "A peer review of the individual plant examination results was performed."

Confirm that the peer review cited in this statement refers to the peer review done in January 2000 using the Combustion Engineering Owner's Group approach. Provide a list of A-level (4 of 19) and B-level (20 of 80) comments that have not yet been addressed.

Response 11:

The peer review of the individual plant examination (IPE) is not the same as the January 2000 owners group peer review. The IPE was subjected to a number of reviews. In addition to normal engineering and cross-discipline reviews, the IPE received a peer review by PRA experts from a PRA consultant, and comments addressed, prior to its August 1992 submittal to NRC. The NRC review of the IPE, transmitted to Waterford 3 in March 1997, identified a number of weaknesses. All of the weaknesses in the Level 1 analysis (with one exception noted below) were addressed by the June 2003 model update, which included major updating and upgrading of data analysis, common cause failure modeling, LOOP recovery modeling, and human reliability analysis methods and modeling. (NRC comments on the Level 2 are not applicable to the EPU submittal because a conservative LERF calculation, not affected by the Level 2 comments, was used.) The NRC identified a lack of simulator exercises for in-control room operator response times and walkdowns for ex-control room times. Current PRA quality standards identify either walkthroughs, talkthroughs (detailed procedure reviews with operators), or simulator observations as acceptable bases for operator response times (ASME PRA Standard, Supporting Requirement HR-G5, Categories II & Ill). The Waterford 3 PRA used operator talkthroughs for all post-initiator operator actions.

Most of the A and B comments from the January 2000 owners group peer review were addressed by the June 2003 model update. The remaining open A and B peer review comments are listed in the below table, with explanation as to why they do not impact the EPU risk assessment. Note that, since the EPU submittal was prepared, two peer review comments to W3F1 -2004-0043 Page 18 of 29 (one A and one B) have been closed; thus, there are 3 open A and 19 open B comments in the following table.

Peer Review Peer F&O Change Request Text Review Impact on EPU Calculation No.

Priority IE-09 WSES used primarily generic initiating B

IE analysis was completely event frequencies and did not use re-done, including use of Bayesian update to include plant specific Bayesian update to include experience. WSES did make limited use plant-specific experience.

of plant data for selected events but has Comment is open because not updated this data in several years.

we have no program to review There is no evidence that WSES has industry events for process for reviewing industry precursors applicability to Waterford, or events to ensure that they are although industry experience addressed in the Waterford 3 PSA.

was used (via the use of generic data from WSES needs to update the initiating NUREG/CR-5750).

frequencies to reflect the latest Waterford 3 operating experience. A program to The Waterford PSA was review industry events for applicability to updated to "reflect the latest Waterford should also be instituted.

Waterford 3 operating experience", where possible, and included industry generic experience. There is no current requirement (e.g., in the ASME PRA standard) to continually review operating experience; this is done during the periodic model update.

AS-07 WSES does not model simultaneous hot B

This comment does not leg and cold leg injection for core flush.

significantly affect the EPU Based on early information, WSES calculation because hot leg estimated that core flush would not be injection does not have a needed for at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, so its failure significant effect on CDF. Hot potential was negligible and it did not leg injection is probably need to be modeled. However, in the needed for large LOCA (and Long Term Cooling Analysis as possibly medium LOCA) to discussed in sections 6.3.1.4.2, 6.3.2.9.5 prevent core damage, but and 6.3.3.4 of the FSAR, core flush these initiators are not needs to be established between 2 and 4 significant contributors to hours post-LOCA for successful long CDF.

term cooling. Figure 6.3-11 shows that if core flush is initiated at 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, a HPSI core flush flow of approximately 275 gpm

...... to W3F1 -2004-0043 Page 19 of 29 Peer Review F&O No.

Change Request Text pact on EPU Calculation is needed to prevent boron precipitation.

Simultaneous hot and cold leg injection needs to be modeled for large LOCAs.

The need for hot leg injection for medium LOCAs should be evaluated using the information on figure 6.3-12 in the FSAR.

AS-08 EFW fault-tree shows that EFAS-1 signal is required for SG-1 and SG-2 flow paths to be effective (page 269). No power dependencies are modeled associated with the generation of this signal.

Add the appropriate dependencies for generation of the EFAS-1 signal.

B The potential impact of this comment is small because the addition of power dependency for EFAS should not have a significant effect.

The EFAS failure rate is low and power dependency (at the DC bus level) already exists for the pumps.

4 4

AS-11 Grid challenge as a result of a transient is not considered. Section 7.0 of EC-589-025, PRA Accident Sequence and Top Logic, states that for SBO "... it can also be initiated by any reactor trip event combined with a failure in the Waterford 3 switchyard to connect to offsite power."

These induced LOOPs are only associated with the switchyard. Induced LOOPs other than the switchyard are not considered.

Address induced LOOP events.

B This comment is addressed in the response to Question 3 of this RAI.

4 4

4 AS-16 Plant specific T/H [thermal-hydraulic]

analyses to support accident sequence development are virtually non-existent.

Thermal-hydraulic calculations are needed for determination of system/function success for accident sequence analysis. Realistic, plant-specific best estimate analyses provide the best information and results in the most accurate risk insights. The analyses performed for the FSAR are conservative and, in some cases, would tend to bias the risk insights somewhat.

B Plant-specific T/H analyses were performed using the CENTS and CEFLASH codes for EPU. This comment applies to the base PRA model, which will be updated with the results of the EPU T/H analyses when EPU is implemented.

to W3F1 -2004-0043 Page 20 of 29 Peer Review Peer F&O Change Request Text Review Impact on EPU Calculation No.

Priority However, in other cases, the differences between the FSAR and best estimate analyses are masked by the level of detail possible in the PSA models. (e. g.

TH analyses can differentiate the Ibm delivery of safety pumps, but the PSA will only model pumps in whole units.) Also available is an extensive body of generic TH analyses related to the performance of various plants in response to various challenges. These generic analyses can provide valuable insights and can be used to the extent that they can be demonstrated to be applicable to the plant in question.

TH-02 A review of the TH analyses performed for SGTR, as referenced in EC-S89-025, R1, showed that the version of the CEPAC code used in these analyses (EC-S90-002, EC-S90-003 and EC-S90-004) was plant specific and limitations of the code were assessed (See EC-S88-014). MAAP was used for several calculations using a WSES specific base deck. However, there was no formally documented assessment of the applicability of MAAP for the application or assessment of limitations. (Note: Per discussions with Nasser Pazooki, MAAP output for containment pressure was informally compared to design basis calculations and found to be somewhat conservative. This comparison was not documented.)

Where non-Design basis codes are used to determine parameters for the PSA, there should be some formal assessment of the applicability of the code for the intended application and an assessment of how any known code limitations might affect the results and conclusions.

B The CENTS code was used for SGTR in the EPU calculation. MAAP was used in the base PRA (as referred to in this comment) only for Level 2, which is not used for the EPU calculation (a conservative LERF calculation was used).

I _________________________________________

I

.1.

to W3Fl-2004-0043 Page 21 of 29 Peer Review Peer F&O Change Request Text Review Impact on EPU Calculation No.

Priority TH-03 No Room Heatup calculations were B

Room heatup calculations performed to support decisions with have been performed, respect to the need for room cooling.

documented, and reviewed for reasonableness. The This item was identified by the WSES comment is open because self-assessment.

final review and approval is not completed.

Room heat up calculations need to be performed to support the modeling decisions with respect to the need for room cooling during accident mitigation and to determine timing for human actions as needed.

TH-04 The CEPAC T-H analyses that were B

T/H analyses for EPU were referenced and reviewed (see EC-S90-formally documented in 001 through EC-S-90-004) were formal calculations, with independent calculations that included independent review.

review and signoff. However, the MAAP analyses were less formal and did not appear to include an independent review and signoff.

T-H analyses used to support the PRA should have an independent review to ensure that the results are appropriate and defendable.

SY-10 The following Safety-Related Room B

Room heatup calculations Cooling System success criteria do not have been performed, have technical calculations to support the documented, and reviewed assumptions:

for reasonableness. The comment is open because It is assumed that the heat load in the A, final review and approval is B and AB Battery Rooms and EFW not completed.

Turbine Driven Pump 'room' is no higher than the design basis SBO for all postulated severe accident sequences.

Dependence on room cooling for HPSI, LPSI and Containment Spray is not necessary during injection mode.

Cooling is not needed for CCW heat to W3Fl-2004-0043 Page 22 of 29 Peer Review Peer F&O Change Request Text Review Impact on EPU Calculation No.

Priority exchanger rooms A and B.

Provide better justification for exclusion of HVAC requirements.

SY-11 The PRA model credits recovery from a SBO event. Following recovery, it is assumed that safety related loads would be re-established and perform their intended function including Containment Heat removal (CS and CFCs). However, the CFCs could fail after EFW recovery due to harsh containment environment not analyzed beyond the design basis accident. During that portion of the SBO event where decay heat removal is lost, the PSVs will cycle to removal heat from the RCS. This will cause the pressure and temperature in containment to rise.

Without CFCs and CSPs, it is unknown how high temperature and pressure will rise. This environment could cause the actuation of MSIS or in an extreme case cause the failure of the CFCs due to a harsh environment.

The Level 1 accident sequence analysis requires either one train of CSS or one train of CFC during re-circulation.

CEN-239 states the PSVs open within 12 minutes of a total loss of feed water and do not re-close until 53 minutes of the total loss of feed (pg. 273).

General Comment: MAAP results for large break LOCA with only 1 CFC credited (Calculation W3Cl-92-0014) shows design containment pressure is exceeded. If the CFCs can not withstand the harsh environment beyond design capacity, the CFCs can not be credited for the applicable sequences in which equipment qualification limits of the B

The SBO sequence does not assume that containment heat removal (CHR) is available.

The effect of CHR failure for SBO sequences that are recovered before core damage would be, worst case, containment failure, but without core damage, this would not be a large release.

For SBO sequences that go to core damage, CHR is not credited and containment failure is assumed in the EPU LERF calculation with a conservative probability of 0.1 (this probability is realistically on the order of 0.02, based on NUREG/CR-6595 and NUREG/CR-6475).

The Level I requirement for CHR is to prevent containment failure, sudden containment depressurization, and loss of safety injection NPSH during successful safety injection recirculation-leading to safety injection failure and core damage. This would require, in addition to CFC failure, failure of both containment spray trains; since the harsh environment in containment can not affect containment spray (no operating parts inside containment; rated head of 485 feet is more than enough for any containment to W3Fl-2004-0043 Page 23 of 29 Peer Review Peer F&O Change Request Text Review Impact on EPU Calculation No.

Priority CFCs are exceeded.

overpressure condition), it is very unlikely that this would happen, so this issue does not significantly affect the CDF calculation.

SY-1 3 The Waterford Data Notebook, which is not a controlled document, uses component boundaries defined by SAIC "Generic Data Notebook for Commercial Nuclear Power Plant PRAM.

The data notebook which uses the SAICs definition of control circuitry and associated failure event codes is misleading as the Waterford PRA does not explicitly model associated control circuit failure for valves, pumps and other motive devices. A review of a cross section of the fault trees revealed that control circuit failures are not included as separate events. Determination that systems adequately modeled relevant control circuitry is not possible without the reference to basis of the generic data.

Verify and document if generic data utilized in the model includes control circuit faults. If generic data does not include control circuit faults, update data or explicitly model control circuits.

B This MCR appears to no longer be applicable. The two primary generic data sources for the Rev. 3 (current) model, NUREG/CR-4550 and NUREG/CR-4639, include start/control circuits in their valve/pump control circuits.

There are a handful of generic data failure modes that rely on IEEE 500, for which I don't know whether control circuits are included, but these are either components for which the issue is irrelevant (e.g.,

electronic components) or for which control circuit failures would be included in other failure modes that used the two primary references. The plant specific failure data also includes control circuits, because it is based on the maintenance rule, for which the system engineers include such failures as a valve or pump failure. This comment was left open until documentation of this basis is completed.

SY-1 7 The basis for the system dependencies B

This is a documentation should be directly linked to plant problem, which does not documentation. Currently, the plant affect the EPU calculation.

documentation is listed in mass at the end of a system notebook.

It would be a simple matter to expand the component level dependency matrix to

Attachment I to W3Fl-2004-0043 Page 24 of 29 Peer Review Peer F&O Change Request Text Review Impact on EPU Calculation No.

Priority include a reference column where the specific plant document can be listed.

SY-18 In many cases, the basis for assumptions B

This is a documentation and success criteria are not listed in the problem, which does not system analysis calculation, EC-S99-affect the EPU calculation.

002. In the EFW system, there is no reference directly linked to the statement that 50 minutes is available to recover a feed loss. The time available to recover from a feed loss depends on the type of transient. The plant could trip on high, normal, or low SG water level. An EFW assumption is flow diversion through locked valve EFW220 is not modeled, but the plant document which shows this valve is locked shut is not directly referenced.

Directly identify references.

DA-03 There are a few cases (e.g. sump suction B

Actually, most components check valves), where a per demand are modeled with demand failure rate rather than time dependent failures. What the peer failure rate is used.

reviewers were talking about were components with very WSES should consider modifying long surveillance intervals, for demand failure rates to address test which the long time between interval differences among like tests could produce significant components.

standby failure probabilities.

The sump suction check valve (SI-604A/B) case was the only one they observed.

The CDF impact is very small (estimated to be on the order of 4E-8, which is negligible).

Since the SI sump suction valves are some of the most risk significant components, other components that might be found to have the same concern with long surveillance intervals would also experience a negligible to W3F1-2004-0043 Page 25 of 29 Peer Review Peer F&O Change Request Text Review Impact on EPU Calculation No.

Priority impact if the demand failure model were changed to a standby model.

DE-01 Dependency Matrices can be a valuable B

This is a documentation tool for reviewers both internal and problem, which does not external to quickly identify system affect the EPU calculation.

relations. Although a component level dependency matrix is provided for each system. A matrix that readily links cross system dependencies (including IE impacts) is not available.

Develop Comprehensive Dependency Matrix. The DBDs can provide a great deal of readily available useful information.

DE-05 Modeling assumptions and B

This is a documentation dependencies are not directly linked to problem, which does not plant documentation. For example, High affect the EPU calculation.

Pressure Injection is assumed not to fail even if the RWSP suction valves are not isolated following RAS. It is possible that the references (pg. 9-6) provide the basis for this assumption, but it is difficult to determine which reference and the location within the reference. Given the analysts has done the research to prove this, it is a simple matter to list the reference within the assumption text and note the significant pages.

This is also useful in the system dependency matrix. It would aid in the review to list the specific reference associated with each identified component dependency.

Directly link references to plant documentation.

ST-02 WSES uses a hand calculation for the B

The EPU calculation does not pressure ratio at yield to determine the use the Level 2. The containment ultimate failure yielding a simplified LERF method used to W3F1 -2004-0043 Page 26 of 29 Peer Review Peer F&O Change Request Text Review Impact on EPU Calculation No.

Priority P/Pd in the range of between 2.05 and for the EPU calculation does 3.78. A P/Pd value of 3.08 was selected.

not use the containment Although the resulting ultimate pressure ultimate pressure.

appears reasonable, there was limited justification for the selection of this value.

Given the ultimate pressure, the containment failure fragility curve was developed based on the guidance in NUREG/CR-3653.

The containment failure model does not address the most likely failure location.

WSES needs to provide appropriate justification for the P/Pd ratio that was selected to ensure that the calculated ultimate pressure is appropriate. WSES also needs to address the most likely location of the containment failure should one occur.

QU-02 Per discussions with two Waterford PRA engineers, the base computer code (CAFTA) has not been formally verified and validated. This process would include solution of a known input and comparing the outputs with known solutions. Also, the known input would challenge various features of the code such that all such features can be verified to be working properly.

B Waterford now uses the qualified (verified and validated) version of Cafta (4.0b) and has tested PRAQUANT. The comment is left open because a fully qualified PRAQUANT version is not yet available.

In addition, installation of CAFTA on individual workstations are not verified and validated.

4-QU-06 No evidence of uncertainty analysis has been performed. This is confirmed by Waterford.

Include uncertainty analysis in next update.

This does not impact the EPU calculation of ICDF.

to W3F1 -2004-0043 Page 27 of 29 Peer Review Peer F&O Change Request Text Review Impact on EPU Calculation No.

Priority L2-01 It is recognized that the L2 bridging and A

The EPU calculation does not binning process and the resulting PDS use the Level 2. The endpoints may have been sufficient for simplified, conservative LERF IPE submittal. Since the IPE submittal, method used for the EPU the PDS model has not been maintained calculation does not use PDS or reviewed to determine the impact of mappings, but uses core revisions made to other PRA models. It damage sequences; i.e.,

would be extremely difficult to reproduce containment heat removal the base case results and to ensure the system availability, which is adequacy of changes from start to finish what distinguishes PDSs from with the current documentation.

core damage sequences, is References to gate names and functional not credited in the EPU events and calculation cross-references calculation.

are not current or traceable for revisions made to the level 1 model.

L2-02 The framework of Waterford 3 L2 model, A

The EPU calculation did not which has not been maintained or use the Level 2 model, but updated since the IPE submittal, does rather used a simple LERF not directly calculate LERF. The CET method that did not credit the treatment of Waterford 3 PRA was emergency response timing to developed to calculate the various move potentially early containment failure modes including containment failure scenarios bypass events. A one time calculation into a late failure bin.

since the L2 IPE submittal was informally performed to determine LERF by summing the early containment failure and bypass frequencies. The methodology of the LERF calculation, which is neither process defined or documented, does not address population emergency classification and evacuation considerations (see note below). Without consideration of Emergency response, an appreciable LERF assessment can not be achieved.

Note: Timing of radiological release and its relation to the time required for Emergency declaration and evacuation timing is important in determining LERF.

Simply assuming all late containment failures do not result in LERF without factoring emergency response timing for to W3Fl-2004-0043 Page 28 of 29 Peer Review Peer F&O Change Request Text Review Impact on EPU Calculation No.

Priority both internal and external initiating events may not prudent and could lead to a non-conservative estimation of LERF. Conversely, an over-estimation of LERF can result from assuming all early containment failures result in LERF.

If LERF calculations are performed to support risk-based informed applications, the current L2 model should be re-evaluated and updated to address Emergency response considerations.

L2-03 The Waterford 3 Level 2 PRA has not A

The EPU calculation did not been updated or maintained since the use the Level 2 model, but IPE submittal. Weak documentation, used a simplified, process definition and model control has conservative LERF method made the review difficult. It was roughly analogous to the concurred by the Waterford 3 PRA staff NUREG/CR-6595 approach, that reproducing the results or performing but more simplified and any sensitivity runs would be difficult to conservative.

achieve in a reasonable amount of time.

Due to the weak documentation and the unavailability of a on-site Level 2 expert that was involved in all phases of the level 2 IPE model development, all areas of the review are considered not reviewed, except where indicated.

The utility may want to consider developing a more simplified approach in determining LERF as outlined in NUREG/CR 6595. The level of significance rating of "A' was assigned to this element if the utility plans to use the current model to provide appreciable risk insights in a fashion that affords flexibility, efficiency and tractability for both permanent and temporary model changes.

to W3Fl-2004-0043 Page 29 of 29 Question 12:

Page 2.11-16, Evaluation of PSA Model Quality: This section states "In addition, the most recent update involved extensive revision..." What quality process (internal reviews, peer reviews, etc.) was used to make these revisions? Also, what quality process was used to check that the modifications made to the PRA in order to assess the risk impact of the EPU were correctly performed?

Response 12:

For the model update, internal reviews and expert panel (Ops, engineering, maintenance, PSA) review of model results were used. For the EPU risk assessment, internal reviews were used. In both cases, formal engineering calculations (following our engineering calculation procedure) were used, which includes independent technical review and supervisor approval.

The model update calculation included thorough documentation of all model elements. The EPU calculation included description of the methodology and the details of the calculation, including changes to the PRA model to represent the effect of the EPU. The thermal-hydraulic analysis for EPU was documented by Westinghouse in a formal, independently reviewed calculation.

Question 13:

Page 2.11-16, Evaluation of PSA Model Quality: This section states "in addition, the most recent update involved extensive revision... in order to bring the PSA up to current PSA standards, including the new ASME [American Society of Mechanical Engineers] PSA standard (Category 11)." Please confirm that the Waterford 3 PRA meets Capability Category II defined in the ASME PSA standard by providing supporting evidence such as the results of any self-assessments or peer reviews.

Response 13:

At the time that the update was performed, the ASME standard was only a draft document and undergoing frequent, significant revisions in order to address industry and NRC comments.

The contract for the update of the Waterford 3 PRA specified that the update be performed to meet draft ASME PSA Standard (Rev. 12) requirements. It was Entergy's intent that the updated Waterford 3 PRA would meet Capability Category II; however, a review of the Waterford 3 PRA model against the final ASME standard has not yet been performed.

Nevertheless, the fact that most of the industry peer review comments have been addressed and that the remaining open comments, as described in the response to Question 11, do not significantly affect the EPU risk assessment, indicates that the Waterford 3 PRA is of sufficient quality for this application.

W3Fl-2004-0043 List of Regulatory Commitments to W3F11-2004-0043 Page 1 of I List of Regulatory Commitments The following table identifies those actions committed to by Entergy in this document. Any other statements in this submittal are provided for information purposes and are not considered to be regulatory commitments.

TYPE (C eck one)

SCHEDULED ONE-CONTINUING COMPLETION COMMITMENT TIME COMPLIANCE DATE (If ACTION Required)

In addition, due to recent issues regarding the EPU X

July 15, 2004 SBLOCA analysis (reference Entergy letter W3F1-2004-0035 to the NRC dated May 7, 2004 for further details), Waterford 3 no longer expects to need to install digital ADV controllers. The final determination regarding the need for digital controllers will be communicated to the NRC staff by July 15, 2004. If digital ADV controllers are to be used, a detailed response to this question will be provided at that time.