ML040260016

Request for Review of BAW-2441, Revision 2, Risk Informed Justification for LCO End-State Changes

ML040260016
Person / Time
Site:	Davis Besse, Oconee, Arkansas Nuclear, Crystal River, PROJ0693, Crane
Issue date:	01/19/2004
From:	Mallay J AmerGen Energy Co, B & W Owners Group, Duke Energy Corp, Entergy Operations, FirstEnergy Nuclear Operating Co, Florida Power Corp, Framatome ANP
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
+KBR1SISP20050413, NRC:04:001, OG:04:1839 BAW-2441, Rev 2
Download: ML040260016 (101)

Text

Duke Energy Company Oconee 1, 2,3 AmerGen Energy Company, LLC TMI-1 Entergy Operations, Inc, ANO-1 The B&W FirstEnergy Nuclear Operating Company D-B Florida Power Corporation Crystal River3 Owners Groupl FramatomeANP Working Together to Economically Provide Reliable and Safe Electrical Power January 19, 2004 NRC:04:001 OG:04:1839 Document Control Desk ATTN: Chief, Planning, Program and Management Support Branch U.S. Nuclear Regulatory Commission Washington, D.C. 20555-0001 Request for Review of BAW-2441, Revision 2, "Risk Informed Justification for LCO End-State Changes" The B&WOG requests that the NRC accept for application in licensing activities the topical report BAW-2441, Revision 2, "Risk Informed Justification for LCO End-State Changes." This report is an important part of an industry effort to make the requirements of plant tech specs consistent with risk-informed insights concerning appropriate operating states.

This topical report demonstrates that the appropriate end state for selected LCOs is hot shutdown (Mode 4) instead of cold shutdown (Mode 5) as currently required in the corresponding tech specs. Specifically, the analysis described in this report quantifies for selected LCOs the additional risk that is incurred by transitioning to Mode 5 instead of remaining in Mode 4. 'Acceptance of this topical report will further validate the use of risk-informed techniques in identifying modes of safer operation.

Once this report is accepted for formal review and acceptance, a tech spec traveler in support of all owner group submittals will be submitted for parallel review.

Because this report is part of an industry initiative to apply risk-informed insights, the B&WOG respectfully requests that the usual NRC review fees be waived. The B&WOG anticipates that the provisions of this report will be adopted by its members when approved by the NRC.

The B&WOG requests that the NRC complete its approval of this topical report by September 30, 2004. This acceptance will permit the appropriate tech specs to be modified by those licensees planning refueling outages in the Spring of 2005.

Very truly yours, JIUJ Acett!~ jnS James F. Mallay, Director Regulatory Affairs Framatome ANP B&W Owners Group 3315 Old Forest Road Lynchburg, VA 24501 Phone: 434-832-2981 Fax: 434-832-2475

-V WD

Document Control Desk January 19, 2004 NRC:04:001 OG:04:1839 Page 2 cc:

B&WOG Licensing Working Group Risk Informed Action Committee Project 693

Duke Energy Company Oconee 1, 2,3 AmerGen Energy Company, LLC TMI-1 Entergy Operations, Inc.

ANO-1 The B&W FirstEnergy Nuclear Operating Company D-B Florida Power Corporation Crystal River 3 Owners GroupI FramatomeANP Working Together to Economically Provide Reliable and Safe Electrical Power January 19, 2004 NRC:04:001 OG:04:1839 Document Control Desk ATTN: Chief, Planning, Program and Management Support Branch U.S. Nuclear Regulatory Commission Washington, D.C. 20555-0001 Request for Review of BAW-2441, Revision 2, "Risk Informed Justification for LCO End-State Changes" The B&WOG requests that the NRC accept for application in licensing activities the topical report BAW-2441, Revision 2, "Risk Informed Justification for LCO End-State Changes." This report is an important part of an industry effort to make the requirements of plant tech specs consistent with risk-informed insights concerning appropriate operating states.

This topical report demonstrates that the appropriate end state for selected LCOs is hot shutdown (Mode 4) instead of cold shutdown (Mode 5) as currently required in the corresponding tech specs. Specifically, the analysis described in this report quantifies for selected LCOs the additional risk that is incurred by transitioning to Mode 5 instead of remaining in Mode 4. Acceptance of this topical report will further validate the use of risk-informed techniques in identifying modes of safer operation.

Once this report is accepted for formal review and acceptance, a tech spec traveler in support of all owner group submittals will be submitted for parallel review.

Because this report is part of an industry initiative to apply risk-informed insights, the B&WOG espectfully requests that the usual NRC review fees be waived. The B&WOG anticipates that the provisions of this report will be adopted by its members when approved by the NRC.

The B&WOG requests that the NRC complete its approval of this topical report by September 30, 2004. This acceptance will permit the appropriate tech specs to be modified by those licensees planning refueling outages in the Spring of 2005.

Very truly yours, James F. Mallay, Director Regulatory Affairs Framatome ANP B&W Owners Group 3315 Old Forest Road Lynchburg, VA 24501 Pwrie; 434-832-2981 Fax: 434-832-2475

Document Control Desk January 19, 2004 NRC:04:001 OG:04:1 839 Page 2 cc:

B&WOG Licensing Working Group Risk Informed Action Committee Project 693 J

-4 BAW - 2441 January 2004 Revision 2 Risk Informed Justification For LCO End-State Changes B&W Owners Group Licensing Working Group t

FRAMATOME ANP

-1 BANY-2441 Abstract A risk-informed analysis was conducted to evaluate the difference in risk between using Mode 4 as the end-state instead of making the transition to Mode 5 as required by the limiting conditions for operation that are specified in selected standard technical specifications. Existing LCOs for these tech specs specify that the unit be placed in Mode 5 if the condition is not satisfied. The purpose of this analysis is to confirm that Mode 4 is the preferred end-state from a risk and operational perspective.

The characteristic that distinguishes the difference in plant operation between Modes 4 and 5, in addition to the obvious differences between hot and cold shutdown, is the core cooling mechanism. In hot shutdown heat removal continues through the steam generators. However, in the cold shutdown situation, shutdown cooling (SDC) systems are used. The transition process required to go from Mode 4 (where normal heat removal continues) to Mode 5 (requiring initiation of the SDC system) presents increased risk due to SDC system vulnerabilities and fewer mitigating systems being immediately available.

i

Licensing Working Group Risk Informed Justification For LCO End-state Changes TABLE OF CONTENTS Page

'TABLE OF CONTENTS.................................................................

1 LIST OF FIGURES.................................................................

3 LIST OF TABLES........................................................................................................................3 ACRONYMS/ABBREVIATIONS.................................................................

4 DEF INITIONS................................................................................................................................7

1.0 INTRODUCTION

9

2.0 PROPOSED CHANGE

10 2.1 LCOsAFFECTEDBYTHISCHANGE................................................................

1 0 2.2 REASON FORTHE PROPOSED CHANGE................................................................

10 2.2.1 SGs Not Immediately Available for Recovery of Core Cooling............................... 10 2.2.2 Fewer IE Mitigating Resources Available................................................................

1 2.2.3 SDC System and Realignment Vulnerabilities......................................................

1...

I 2.2.4 Plant Unavailability................................................................

1 1 2.2.5 Summary.................................................................

12 2.3 METHODOFANALYSIS................................................................

12 3.0 ENGINEERING ANALYSIS: REGULATORY GUIDES 1.174 AND 1.177 PRIN'CIPLES................................................................

14 3.1 PRINCIPLE : MEETS CURRENT REGULATIONS.................................

.................. 14 3.2 PRINCIPLE 2: MAINTAINS DEFENSE-IN-DEPTH.................................................... 14 3.3 PRINCIPLE 3: SAFETY MARGINS MAINTAINED.....................................

............... 14 3.4 PRINCIPLE 4: PROPOSED INCREASES IN RISK SMALL AND CONSISTENT WITH NRC EXPECTATIONS........................

........................................ 15 4.0 ENGINEERING ANALYSIS: QUALITATIVE ASSESSMENT......................... 16

4.1 BACKGROUND

16 4.2 GENERAL RISK COMPARISON BETWEEN MODES 3,4 AND 5.................

17 4.2.1 Mode 3 and 4 (SDC not in operation) Considerations.............................................. 17 4.2.2 Mode 4 (on SDC) and Mode 5 Considerations......................................................... 17 4.3 CRITICAL SAFETY FUNCTION (CSF) SUPPORT...................................................... 19 4.3.1 Control Of Reactivity................................................................ 20 4.3.2 Control Of RCS Inventory....................

............................................ 22 4.3.3 Control Of Core Decay Heat Removal................................................................

25 4.3.4 Control Of Containment Integrity......................................

.......................... 27 4.3.5 Power Availability................................................................

32 4.4 BASES FOR PROPOSED LCO END-STATE CHANGES............................................. 34 4.4.1 LCO 3.3.5: Engineered Safety Features Actuation System (ESFAS) Instruments.. 37 DATE: 1/12/04 PAGE-I DATE: 1/12/04 PAGE -

Licensing Working Group Risk Inforned Jusfifcation For LCO End-state Changes 4.4.2 LCO 3.3.6: ESFAS Manual Initiation...................................

39 4.4.3 LCO 3.4.6: RCS Loops - Mode 4...................................

40 4.4.5 LCO 3.5.4: Borated Water Storage Tank (BWST)...................................

43 4.4.6 LCO 3.6.1: Containment...................................

46 4.4.7 LCO 3.6.2: Containment Air Locks...................................

49 4.4.8 LCO 3.6.3: Containment Isolation Valves (CIVs)...................................

50 4.4.9 LCO 3.6.4: Containment Air Pressure...................................

52 4.4.10 LCO 3.6.5: Containment Air Temperature.............................................................

53 4.4.11 LCO 3.6.6: Containment Spray and Cooling........................................................... 55 4.4.12 LCO 3.7.7: Component Cooling Water (CCW) System.

57 4.4.13 LCO 3.7.8: Service Water System (SWS).............................................................

59 4.4.14 LCO 3.7.9: Ultimate Heat Sink (UHS) 60 4.4.15 LCO 3.7.10: Control Room Emergency Ventilation System (CREVS).................. 62 4.4.16 LCO 3.7.11: Control Room Emergency Air Temperature System (CREATCS).... 63 4.4.17 LCO 3.8.1: AC Sources - Operating.............................................................

64 4.4.18 LCO 3.8.4: DC Sources - Operating.............................................................

67 4.4.19 LCO 3.8.7: Inverters - Operating.............................................................

69 4.4.20 LCO 3.8.9: Distribution System - Operating........................................................... 70 5.0 ENGINEERING ANALYSIS: QUANTITATIVE ANALYSIS............................ 74 5.1 RISK ASSESSMENTMETHODOLOGY 74 5.2 MODELING ASSUPTIONS.

.................................................................................................76 5.3 RISK ASSOCIATED WITH MODE CHANGE 77 5.4 MODEDEPENDENTPLANTRISKS 77 5.4.1 Mode 3.77 5.4.2 M ode 4 (not on SDC).................................................................................................78 5.4.3 Mode5.78 5.5 RESULTS OF QUANTITATIVE PSK ASSESSMENT

.79 6.0 SENSITIVITY STUDIES.83 6.1 SENSITIVITY CONSIDERATONS 83 6.1.1 High Pressure Injection (HPI) System.83 6.1.2 Low Pressure Overpressure Protection (LTOP).85 6.1.3 Emergency Feedwater (EFW) System.86 6.2 ADDITIONALPLANT CONFIGURATION DIFFERENCE CONSIDERATIONS

.87 6.2.1 Auxiliary Steam Systems.87 6.2.2 Mode 3 To Mode 4 Transition Point.87 6.3 SENSITIVITY STUDIES RESULTS 88

7.0 CONCLUSION

.92

8.0 REFERENCES

94 DATE: 1/12/04 PAGE-2 DATE: 1/12/04 PAGE - 2

Licensing Working Group Risk Informed Justification For LCO End-state Changes LIST OF FIGURES Page FIGURE 1 -

MASTER SAFETY LOG IC DIAGRAM.

19 FIGURE 2 - CORE DAMAGE FREQUENCY IN CANDIDATE END-STATES 81 FIGURE 3 - SINGLE OUTAGE BENEFIT OF MODE 4 (VS. MODE 5) FOR ANALYZED LCO CONDITIONS..........................................................

82 FIGURE 4 - CORE DAMAGE FREQUENCY IN CANDIDATE END-STATES SENSITIVITY STUDY..........................................................

90 FIGURE

- SINGLE OUTAGE BENEFIT OF MODE 4 (VS. MODE 5) FOR ANALYZED LCO CONDITIONS SENSITIVITY STUDY............................. 91 LIST OF TABLES Page TABLE 1 - LCOS PROPOSED FOR END-STATE CHANGE.

10 DATE: 1/12/04 PAGE-3 DATE: 1/1 2/04 PAGE - 3

Licensing WNforking Group Risk Informed Justification For LCO End-state Changes ACRONYMS/ABBREVIATIONS pci/cc 8k/k AFWP AOO ASME ATWS B&W B&WOG BWST CCW CDF CIV CM CREATCS CREVS CSF DB DBA DDEFWP DHR DND ECCS EDG EFIC ESF ESFAS HPI ICCDP IE Micro-curies Per Cubic Centimeter Reactivity Auxiliary Feedwater Pump Anticipated Operational Occurrence American Society of Mechanical Engineers Anticipated Transient Without Scram Babcock and Wilcox Babcock And Wilcox Owners Group Borated Water Storage Tank Component Cooling Water Core Damage Frequency Containment Isolation Valve Corrective Maintenance Control Room Emergency Air Temperature Control System Control Room Emergency Ventilation System Critical Safety Function Davis-Besse Design Basis Accident Diesel Drive Emergency Feedwater Pump Decay Heat Removal Defense-In-Depth Emergency Core Cooling System Emergency Diesel Generator Emergency Feedwater Initiation and Control Engineered Safety Features Engineered Safety Features Actuation System High Pressure Injection Incremental Conditional Core Damage Probability Initiating Event DATE: 1/12/04 PAGE-4 DATE: 1/12/04 PAGE - 4

Licensing Working Group Risk Informed Jnstification For LCO End-state Changes ACRONYMS/ABBREVIATIONS (cont'd)

IEEE Institute of Electrical and Electronics Engineers ISLOCA Interfacing System Loss of Coolant Accident kcfr Effective Neutron Multiplication Factor LBLOCA Large Break Loss of Coolant Accident LCO Limiting Condition for Operation LERF Large Early Release Frequency LOCA Loss of Coolant Accident LOOP Loss of Offsite Power LPI Low Pressure Injection LWG Licensing Working Group MCR Main Control Room MDEFWP Motor Driven Emergency Fecdwater Pump MFWP Main Feedwatcr Pump MHA Maximum Hypothetical Event MSLD Master Safety Logic Diagram MU Makeup NC Natural Circulation NPSH Net Positive Suction Head NRC Nuclear Regulatory Commission PM Preventive Maintenance PORV Pilot Operated Relief Valve PPM Parts Per Million PRA Probabilistic Risk Assessment P-T Pressure-temperature RB Reactor Building RBES Reactor Building Emergency Sump RC Reactor Coolant RCP Reactor Coolant Pump RCPB Reactor Coolant Pump Boundary RCS Reactor Coolant System DATE: 1/12/04 PAGE-5 DATE:

/12/04 PAGE - 5

Licensing Working Group Risk Informed Justification For LCO End-state Changes ACRONYMS/ABBREVIATIONS (cont'd)

REA Rod Ejection Accident RG Regulatory Guide RPS Reactor Protection System RV Reactor Vessel SAR Safety Analysis Report SCM Subcooling Margin SDC Shutdown Cooling System SDM Shutdown Margin SG Steam Generator SGTR Steam Generator Tube Rupture SLB Steam Line Break SSC Systems, Structures and Components STS Standard Technical Specifications SWS Service Water System TDEFWP Turbine Drive Emergency Feedwater Pump TS Technical Specification UHS Ultimate Heat Sink DATE: 1/12/04 PAGE-6 DATE: 1/12/04 PAGE - 6

Licensing Working Group Risk Infornmed Justification For LCO End-state Changes DEFINITIONS

1. Decay Heat Removal (DHR)/Low Pressure Injection (LPI) Systems DHR and LPI are essentially the same systems. When aligned as DHR, the system provides non-emergency core cooling via heat exchangers to the plant's ultimate heat sink (UHS); this is the normal mode of operations. When aligned as LPI, the system adds inventory to the rcactor coolant system (RCS) from the borated water storage tank (BWST) until sitchover to the reactor building emergency sump (RBES). Once this switchover has occurred, the LPI system recirculates reactor coolant (RC) from the RBES to the RCS after providing core cooling via heat exchangers to the plant's UHS.

2. [onsite standby power source)

This term is used in this document as a generic term for an AC electrical power source that starts automatically in the event the onsite or the offsite power source is lost, or both. One plant uses hydroelectric units; all other plants use emergency diesel generators (EDGs).

3. Reactor Building (RB)

For the purpose of this document, the term RB and containment are generally interchangeable and refer to the primary containment function. The Babcock & Wilcox designs have adopted the term RB rather that containment for identifying containment control systems such as spray and cooling, i.e., containment spray is called RB spray and containment cooling is called RB cooling. Wherever containment is meant in the strict literal sense, the word containment is used.

4. Feed And Bleed Cooling Feed and bleed cooling is a mode of core cooling where low enthalpy water from the BWST is pumped (fed) into the RCS and through the reactor core via emergency core cooling system (ECCS) pumps. After increasing in enthalpy, as it passes through and cools the core, this water then passes out (bleed) of the reactor coolant system via the pressurizer pilot operated relief valve (PORV) or the pressurizer safety valves. This method of core cooling is a backup means used in the event all feedwater, normal and emergency, is lost.

5. Shutdown Cooling (SDC)

The term SDC as used in this report includes the condition where the RCS is tied to the DHR system via the suction valves that supply RC to the DHR system. This is done to provide a clear point of delineation between plant states where inadvertent RCS draining via SDC system (DHR system) misalignments can and cannot occur. When these suction valves are closed, i.e., the SDC system is not aligned for operation, inadvertent RCS draining via SDC system related misalignments cannot occur.

DATE: 1/12/04 PAGE - 7

Licensing Working Group Risk Informed Justification For LCO End-state Changes

6. Use of Brackets [ ]

Where brackets are used, it is intended that plant specific values be inserted.

7. Base Plant The Davis-Besse (DB) plant.

DATE: 1/12/04 PAGE-8 DATE: 1/12/04 PAGE - 8

Licensing Working Group Risk Informed Justification For LCO End-state Changes

1.0 INTRODUCTION

The Licensing Working Group of the B&WOG performed a risk-informed analysis of the two potential end-states that could be considered when certain limiting conditions for operation (LCOs) cannot be met: Mode 4, hot shutdown, and Mode 5, cold shutdown. Since the LCOs that were evaluated in this study all require that the unit be placed in Mode 5, it is instructive to determine the relative risk of using Mode 4 as the preferred end-state instead of Mode 5. The difference in plant operation between these two modes that makes a risk-informed analysis of interest is the transition in the mode of core cooling. In Mode 4 heat removal continues through the steam generators. Mode 5 requires the initiation of shutdown cooling (SDC) systems.

The transition from Mode 4 to Mode 5 exposes the plant to several potential failure modes.

These failures include inadvertent closure of SDC system valves, inadvertent diversion of reactor coolant through the SDC system, and loss of reactor coolant through the SDC system relief valves or other leak paths. Remaining in Mode 4, however, has the advantage of increased redundancy and diversity of mitigating systems.

The analysis presented in this report addresses 20 specific LCOs, all of which require transitioning to Mode 5. Five of these conditions are associated with the reactor coolant system and corresponding safety functions, six are related to the containment and containment systems, three address vital equipment cooling systems, two are associated with control room environmental conditioning systems, and four address electrical sources and distribution systems.

In all 20 cases, the risk-informed analysis demonstrates that Mode 4 is the preferred end-state instead of transitioning to the currently-specified Mode 5. These LCOs are listed in Table 1. The current end-states of Table I correspond to those listed in NUREG-1430 (Reference 1), which describes the standard tech specs for B&WV-designed plants.

DATE: 1/12/04 PAGE-9 DATE: 1/12/04 PAGE - 9

Licensing Working Group Risk InfornzedJustification For LCO End-state Changes

2.0 PROPOSED CHANGE

2.1 LCOs AFFECTED BY THIS CHANGE The LCO end-states proposed for change in this report arc based on those found in NUREG-1430, Standard Technical Specifications Babcock and Wilcox Plants (Reference 1).

The LCOs being proposed for an end-state change are listed in Table 1:

Table I - LCOs Proposed For End-state Change LIMITING CONDITION CURRENT END PROPOSED END FOR OPERATION STATE MODE STATE MODE 3.3.5 Engineered Safety Features Actuation System (ESFAS) 5 4

Instruments 3.3.6 ESFAS Manual Initiation 5

4 3.4.6 Reactor Coolant System (RCS) Loops Mode 4 5

4 3.4.15 RCS Leak Detection Instrumentation 5

4 3.5.4 Borated Water Storage Tank (DWST); boron concentration 5

4 only__

3.6.1 Containment 5

4 3.6.2 Containment Air Locks 5

4 3.6.3 Containment Isolation Valves (ClVs) 5 4

3.6.4 Containment Pressure 5

4 3.6.5 Containment Air Temperature 5

4 3.6.6 Containment Spray and Cooling 5

4 3.7.7 Component Cooling Water (CCW) System 5

4 3.7.8 Service Water System (SWS) 5 4

3.7.9 Ultimate Hleat Sink (UHS) 5 4

3.7.10 Control Room Emergency Ventilation System (CREVS) 5 4

3.7.11 Control Room Emergency Air Temperature System 5

4 (CREATCS) 3.8.1 AC Sources - Operating 5

4 3.8.4 DC Sources - Operating 5

4 3.8.7 Inverters - Operating 5

4 3.8.9 Distribution System - Operating 5

4 2.2 REASON FOR THE PROPOSED CHANGE The reason for these proposed end-state changes is:

To reduce risk associated with unnecessary SDC operations. These operations occur when the plant is transitioned from Mode 4 (not on SDC) to Mode 4 (on SDC) and Mode 5.

Reduce plant unavailability associated with reduced plant down time caused by unnecessary cooldown to Mode 5 and subsequent reheat to Mode 3 or 4.

2.2.1 SGs Not Immediately Available for Recovery of Core Cooling

-As the RCS is cooled down to and operating in Mode 4, the SDC system is aligned at approximately 250'F. Subsequent to this alignment, and prior to reaching 200'F RC DATE: 112/04 PAGE - 10

Licensing Working Group Risk Informed Justification For LCO End-state Changes temperature, the RC pumps (RCPs) are shutdown; net positive suction head NPSH) becomes too low for continued operation. Once the RCPs are shutdown the steam generators (SGs) are no longer in use as heat sinks for the RCS; the SDC system removes all of the core heat. In this situation, if SDC is lost, return to use of SGs can provide a means of restoring controlled core heat removal. However, as long as the RCPs are shutdown, the SGs are not immediately available for core heat removal. In addition, the further the cooldown proceeds, i.e., toward Mode 5 (< 200F), the more time required to re-establish appropriate RCS conditions for RCP restart. Hence, the ability to immediately use SGs for core heat removal decreases as cooldown progresses. The SGs could be used in the natural circulation (NC) mode. Howcvcr, the NC mode may not be immediately available if SGs are not operable (e.g., low SG pressure may make steam driven feed pumps unavailable and the SGs may not be intact) or a significant RC heatup may be necessary to develop appropriate hydraulic heads for NC.

2.2.2 Fewer IE Mitigating Resources Available When operating in Mode 5, due to SG conditions and plant system realignments, there are fewer event mitigating resources available to restore core cooling and/or provide RCS makeup. For example, even if SGs are intact, backup steam driven feedwater pumps arc not available at the existing low SG pressures in the event of a loss of electrical power. High pressure RCS makeup systems will have been disabled from automatic operation due to low temperature overpressure (LTOP) concerns; these systems can be made available after some delay via manual operator action.

2.2.3 SDC System and Realignment Vulnerabilities When core heat removal is by SDC, closure of a single valve, i.e., a single failure, in the SDC system suction line will terminate core cooling. This failure mechanism has contributed to numerous incidents where core cooling was momentarily lost and has been addressed by the NRC in its Gcncric Letter (GL) 88-17 (Reference 2). Also, when operating in Mode 4 on SDC and Mode 5 inadvertent draining of the RCS can occur due to inappropriate SDC system related realignments. While operating in this mode there have been numerous incidents where RC has been inadvertently diverted from the RCS. The NRC has issued GL 98-02 (Reference 3) in response to this situation.

2.2.4 Plant Unavailability When operating in Mode 4 (not on SDC) with SGs in normal operation, few plant system realignments are required. This means that following repairs to clear the LCO condition that is in effect, plant power operations can resume with a minimum of systems/equipment realignments. The time savings associated with this situation can be significant, especially if realignments for power operations require manual manipulation of large valves or equipment in areas difficult to access. Also, unforeseen problems can arise during transition off of SDC and during subsequent plant heat up into Mode 4. While it is not possible to assess unforeseen situations, the cost associated with the additional cooldown and heat up time for transitioning to and from Mode 5 can be assessed. The additional time to transition to and from Mode 5 is DATE: 1/12/04 PAGE-Il DATE: 1/12/04 PAGE - 11

Licensing Working Group Risk IMforined Justification For LCO End-state Changes assumed to be approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. This translates into about 250K dollars of lost revenue per outage associated with the subject LCOs.

2.2.5 Summary The concerns associated with unnecessary plant operation in Mode 5 are related to:

Use of SGs as a backup core cooling method is more difficult.

Fewer event mitigation resources being available.

SDC system vulnerabilities.

Inadvertent RCS draining.

By minimizing unnecessary transitions to Mode 4 (on SDC) and Mode 5 the increment of risk associated with these areas of operation can be reduced. Along with risk reduction, another benefit of the proposed change is a decrease in plant unavailability associated with decreased plant cooldown and heat up time.

2.3 METHOD OF ANALYSIS The analysis includes both a qualitative (Section 4.0) and quantitative (Section 5.0) analysis.

The qualitative evaluation compares the risks associated with operation in Mode 4 (not on SDC) with operation in Mode 5. It includes consideration of operations with the conditions of the proposed LCOs (see Table 1) invoked. The intention of the qualitative analysis is to show that operation with the proposed LCO conditions invoked, while operating in Mode 4, versus Mode 5, is acceptable from an overall plant risk standpoint. This analysis also seeks to show that the increment of risk associated with unnecessary SDC can be removed from the overall plant risk as a result of making the proposed LCO changes.

The quantitative analysis was conducted using the Transition and Shutdown Risk models developed for the Davis-Besse (DB) plant (References 4, 5 and 6). Assessments for the proposed LCO conditions were first conducted using the Transition Risk model with the plant operating in Mode 3 or Mode 4 (not on SDC). From these assessments core damage frequency (CDF) was determined. The plant states assessed during these transition runs did not include SDC as a primary model, i., cooldown proceeded to as low as reasonable in Mode 4 while maintaining SG operation without establishing SDC; RCPs remained in operation. In this way plant alignments remained normal and/or associated event mitigating equipment, e.g., feedwater and RC make up systems, were available automatically or via minimum realignment. Assessing transition risk in this way provided a point of clear demarcation between transition operations and shutdown operations. It also provided for the immediate availability of multiple trains and levels of mitigation equipment to respond to events that could challenge core cooling or inventory, thus maintaining plant defense-in-depth (DND) capability.

SDC was available as a backup mode only; model runs were not initiated with the SDC (DHR) providing core cooling.

DATE: 1/12/04 PAGE-12 DATE: 1/12/04 PAGE - 12

Licensing Working Group Risk Informed Justification For LCO End-state Changes Following determination of CDF during transition operations, i.e., Modes 3 and 4 (not on SDC),

assessments were made for the proposed LCO conditions with the plant operating on SDC; again CDF was deternined. For this assessment the Shutdown Risk model was initialized in Mode 4 with SDC in operation, RCPs shutdown and SGs operable, i.e., intact with feedwater available.

However, due to equipment realignments during the cooldown to Mode 5, the number of trains and levels of equipment immediately available to mitigate challenges to loss of core cooling and inventory were less than when in Mode 4 above SDC operations. Such mitigation equipment, e.g., feedwater and high pressure injection (HPI), may be available on a delayed basis via manual operator control.

Once CDF was determined for transition and shutdown operations, it was compared to determine the risk differences between Modes 3 and 4 (not on SDC) and Mode 5. The results of this comparison are found in Figure 2.

Following quantification of CDF for the DB plant, sensitivity studies were performed. These studies factored other Babcock and Wilcox (B&W) plant design differences into the DB analysis.

This allowed for extrapolating representative results for the other B&W designed plants. The results of this sensitivity study are found in Section 6.0, Sensitivity Studies.

DATE: 1/12/04 PAGE - 13

Licensing Working Group Risk Informed Justification For LCO End-stale Changes 3.0 ENGINEERING ANALYSIS: REGULATORY GUIDES 1.174 AND 1.177 PRINCIPLES The analysis discussed in this report has been conducted in accordance with Regulatory Guides 1.174 and 1.177 (Refcrcnces 7 and 8).

3.1 PRINCIPLE 1: MEETS CURRENT REGULATIONS Proposed LCO altered end-states have been evaluated relative to the plant design basis including DND capability and its effects on margin to core damage and/or radiation release. This includes evaluation relative to Safety Analysis Report (SAR) accident and event analyses. The altered cnd-states do not change any accident or event analysis inputs or assumptions from those currently considered in the SAR. For these reasons, there is no change from operating in accordance with NRC regulations as stated in 10 CFR 50.36, Technical Specifications (Reference 9).

3.2 PRINCIPLE 2: MAINTAINS DEFENSE-IN-DEPTH Evaluation of candidate LCOs indicates that the proposed end-states do not require the magnitude of systems/equipment realignments when compared with plant operation in Mode 5 when SDC is in operation. Because of this, plant DND capability is improved with the proposed end-states (SDC not in operation) as unnecessary systems/equipment realignments are eliminated. This makes increased resources available, i.e., feedwatcr (for continued SG fding) and HPI (for RCS make up and core cooling), for mitigating lEs that could challenge core heat removal and RCS inventory. Hence, system/equipment redundancy, independence and diversity are maintained and increased over that available when operating in Mode 5. Since there is no change in plant configuration, i.e., systems, structures and components (SSCs), defense against common mode failures is unaltered and there is no introduction of new common mode failure mechanisms or degradation of independence of physical barriers. These evaluations indicate that capability of multiple means to accomplish safety functions and prevent the release of radioactive material remains adequate.

As discussed earlier, with the proposed end-states, there is a reduced need for systems/equipment realignments. This reduces burden on plant personnel, especially operations personnel, thus defenses against human errors are maintained and increased as operator burden is decreased for the proposed end-states.

For these reasons, DND philosophy is not altered by the proposed change.

3.3 PRINCIPLE 3: SAFETY MARGINS MAINTAINED The proposed change does not affect the plant design as delineated by SAR design basis accidents/events and associated acceptance criteria. However, the proposed change does provide for system/equipment redundancy, independence and diversity beyond that available when operating on SDC in Modes 4 and 5. Also, the proposed change causes no conflict with any of DATE: 1/12/04 PAGE-14 DATE: 1/12104 PAGE - 14

Licensing Working Group Risk Informed Justification For LCO Etd-state Cliaitges the codes and standards (e.g., ASME and IEEE) approved for use by the NRC and applied to plant design. For these reasons, plant safety margins are not compromised and may be increased.

3.4 PRINCIPLE 4: PROPOSED INCREASES IN RISK SMALL AND CONSISTENT WITH NRC EXPECTATIONS The proposed change will result in a decrease in plant risk when candidate LCO conditions are invoked and not unnecessarily operating the plant in Mode 4, on SDC, and Mode 5. Because of this, the proposed change is consistent with Commission's Safety Goal Policy Statement (Reference 10); see Chapter 5.0, Engineering Analysis: Quantitative Analysis.

DATE: 1/12/04 PAGE-IS DATE: 1/12/04 PAGE - 15

Licensing Working Group Risk Informed Justificationa For LCO End-state Changes 4.0 ENGINEERING ANALYSIS: QUALITATIVE ASSESSMENT

4.1 BACKGROUND

When one of the candidate LCO (see Table ) conditions is invoked the plant is placed in a plant end-state considered commensurate for continued safe operation with the LCO condition in effect. Typically, the plant end-state delineated by STS for these LCO conditions has been Mode 5, Cold Shutdown. This requirement is generally based on the idea that the lower the RCS pressure, the lower the risk associated with operating with a given LCO condition in effect. This is a reasonable assumption when considered in conjunction with certain IEs assessed in probabilistic risk assessments (PRAs) such as Loss of Coolant Accident (LOCA) and SG tube rupture (SGTR). However, multiple events leading to loss of core heat removal andlor RCS inventory (due to inadvertent draining) during shutdown in Mode 4 (on SDC) and Mode 5 led to the NRC position that "core damage frequency for shutdown operation can be a fairly substantial fraction of total core damage frequency" (Reference 11). This position was based on PRAs and plant events over a period of ten years. The NRC cited two predominant causes for this situation (Reference 1):

I) non-routine activities and off-nornal plant status, with availability of less equipment, increase in the probability of complex events which challenge operators in unfamiliar ways, and

2) lack of rigorous consideration of accident sequences during shutdown operation resulted in potentially incomplete or inadequate instrumentation, emergency response procedures, and mitigative equipment.

As a result of the occurrence of these multiple events the NRC ultimately issued a number of Information Notices and Generic Letters (References 12, 13, 14, and 15) to address this situation.

The industry also issued NUMARC 91-06 (Reference 16) providing guidance for assessing management of plant conditions while in shutdown operations. As a result of regulatory and industry attention to risk during shutdown operations, plants now have shutdown PRAs that provide risk reduction insights during shutdown operations, especially during Mode 4 (on SDC) and Mode 5. It is in these operational modes where vulnerabilities to loss of SDC and inadvertent RCS drain down are the highest. While this situation does not eliminate the increment of risk associated with loss of SDC and inadvertent RCS draining, it does reduce this risk and provide a means of managing it at the reduced levels.

Due to improvements that address risk during shutdown, the concerns listed above under 2) have generally been addressed2. The concerns listed under 1), while somewhat mitigated by shutdown risk management programs and monitoring systems, cannot be totally eliminated. For example, while on SDC closure of a single valve will lead to loss of DHR and inadvertent system misalignments can lead to loss of RCS inventory. Because these items can challenge risk 2

It is assumed that mitigative equipment here refers to operations on SDC in Modes 4 and 5. In these modes non-traditional use of equipment such as spent fuel cooling systems for DHR and gravity draining the BWST for core cooling and inventory recovery have been delineated for use as mitigative equipment.

DATE: 1/12/04 PAGE - 16

Licensing Working Group Risk Informed Justification For LCO End-state Changes profiles during SDC operations, it is prudent to avoid SDC operations when they are not necessary. By altering the end-states of the proposed LCOs (see Table 1), the increment of risk associated with these concerns during unnecessary operation in Mode 4 on SDC and Mode 5 will be effectively eliminated.

Another important benefit of altering the candidate LCO end-states is the associated reduced plant unavailability (see 2.2.4).

4.2 GENERAL RISK COMPARISON BETWEEN MODES 3,4 AND 5 4.2.1 Mode 3 and 4 (SDC not in operation) Considerations Operations of the plant in Mode 2 below 0% power (power level is decay heat only and kfr < 1.0), in Mode 3 and in Mode 4 are considered transition operations and are assessed using a Transition Risk PRA model (see 2.3). During these operations RCS pressure is decreased as plant cooldown proceeds. The further into the cooldown, the lower the RCS temperature and consequently pressure required to maintain adequate subcooling margin (SCM). For this reason, as plant cooldown progresses, especially into Mode 4, the likelihood of events associated with high RCS and SG pressure occurring decreases. The lEs most directly associated with these parameters, i.e., LOCA (all classes), SGTR and steam line break (SLB), have their frequency of occurrence reduced in PRA models when operating in these lower modes to account for reduced pressure. Hence, the risk increment associated with these Es during operation for sustained periods of time in the transition modes, e.g., Modes 3 and 4, are generally offset by this reduction, especially at the lower end of Mode 4. When operating in Modes 3 and 4, the plant is shutdown, i.e., kff < 0.99 and the main turbine-generator is off line. For this reason, Anticipated Transient Without Scram (ATWS) is not possible and reactor-turbine trip and load rejection cannot be initiators.

When operating in Mode 3 loss of feedwater is offset by the availability of both motor driven and steam driven feed pumps and in Mode 4 below [280] 'F motor driven feed pumps (steam pressure is too low for steam driven feed pumps). Also, vhen operating in Modes 3 and 4 RCS makeup systems are immediately available, either by automatic or manual means.

When operating in these transition Modes plant realignments are at a minimum and operations continue in a fairly normal manner with a near complete complement of SSCs available and/or operating. This greatly reduces operator burden concerns related to non-routine activities and off-normal plant status during periods when less equipment is available. During operation in these Modes multiple trains and levels of equipment for mitigating events that challenge core heat removal and RCS inventory are available.

4.2.2 Mode 4 (on SDC) and Mode 5 Considerations When operating in Mode 4 on SDC, risks associated with LOCAs, SGTRs and SLBs are at a minimum and as cooldown progresses into Mode 5 become so negligible as to be considered non-initiators. Also, the feedwater system is secured, thus its failure cannot be an initiator.

These aspects of operation in these Modes appear to provide for favorable risk profiles and, if DATE: 1/12/04 PAGE - 7

I Licensing Working Group Risk Informed Justiflcation For LCO End-state Changes there were no other considerations of interest, should provide a reduced or neutral risk space for the current subject LCO end-states. However, in these modes, where there is less equipment available and operations are different from normal plant at-power conditions, additional risk factors must be considered.

When operating in these Modes plant realignments lead to general unavailability of the feedwatcr and HPI systems. Feed systems could be of value if SDC is lost and the SGs are intact and cooldown has not proceeded too far. In this situation, core cooling could be switched back to the SGs, likely subsequent to some RCS heatup to establish NC conditions (RCS conditions would not allow operation of RCPs). The most notable system that is generally not immediately available (it may be started after some delay via operator alignment) is the HPI system. This is true because of the possibility of inadvertent RCS draining when on SDC, e.g., due to misalignment and inappropriate maintenance activities.

When the plant is operating in Mode 4 on SDC or Mode 5, i.e., when the core is being cooled by the SDC system, closure of a single valve (single failure) in the SDC system suction line will terminate core cooling. Also, when the SDC system is aligned to the RCS there is a possibility of inadvertent RCS draining caused by inappropriate valve alignments and/or maintenance activities while on SDC. Such possibilities do not exist when operating in Mode 4 (not on SDC) and Mode 3.

Summary For plant operations in Modes 3 and 4 (not on SDC), as compared to unnecessary Mode 4 (on SDC) and Mode 5 operations, there are some clear risk advantages associated with operations in the former Modes. They are:

More IE mitigating resources available.

Human error during SDC initiation and subsequent operation cannot occur.

Loss of SDC (DHR) system core cooling vulnerabilities are avoided.

Inadvertent RCS draining via SDC system related misalignments cannot occur.3 3 DB cannot be in Mode 4 without aligning the SDC system. This is because DB uses a relief valve in the DHR system to mitigate RCS overpressure when in this Mode; all other plants use the PORV which does not require RCS alignment to the SDC system.

DATE: 1/12/04 PAGE-18 DATE: 112/04 PAGE - 18

Licensing Working Group Risk Inforned Jstification For LCO End-sfate Changes 4.3 CRITICAL SAFETY FUNCTION (CSF) SUPPORT NUMARC 91-06 delineates five CSFs to be considered in plant PRAs. They are:

control of reactivity control of RCS inventory control of core decay heat removal control of containment integrity power availability STSLCO PROPOSED FOR END-STA rE ClANGt 33.5 ESFASlnstruntens X

3.3.6 ESFAS fAan. Initiutlo,,

X 3.4.6 RCS Loops -blode 4 X

3.4.15 RCS Leak Dctcction X

3.5.4 BWST; baron concen.

X 3.6.1 Containnent X

..6.2 CntainoentXir Lckr X

3.6.3 CIVx X

3.6.4 ContainmentPresvure X

3.6.5 ContainnentAir Temp.

X 3.6.6 ContanmentSprayJ Cig.

X 3.7.7CCIV X

X X

X X

3.7.8 SWS X

X X

X X

3.7.9 UIIS X

X X

X J. 7. 1 0 CRE IS X

X 3.7.11 CREATS x

x 3.1.1 ACSources Operating X

3.1.4 DCSources Operatnt X

3.1.7 iavners Operating X

3.S.9 Diu. System Operatinr X

Figurc 1 - Master Safety Logic Diagram DATE: 1/12/04 PAGE-19 DATE: 1/12/04 PAGE - 19

Licensing Working Group Risk Informed Justfication For LCO Enitd-state Ch anges This section evaluates the possible effects4 of the proposed LCO end-states on support of the CSFs. In order to facilitate understanding of this issue, a Master Safety Logic Diagram (MSLD) has been constructed as shown in Figure 1. This MSLD shows the relationship between the LCOs being proposed for end-state changes, the CSFs and the top tier events, i.e., core damage and fission product release; fission product release is assumed to be external to the reactor building (RB). In the MSLD, the placement of proposed LCOs under a particular CSF does not represent failure of a process function associated with the subject LCO (nornal convention). As applied in this instance, the intention is to indicate that the function/parameter of the LCO supports the particular CSF and then to evaluate the possible effects on the CSF if the end-state of this LCO is altered from Mode 5 to Mode 4. In evaluating the effects of the proposed LCO end-states on each CSF, the question to be addressed is, "Are the CSF(s) any less supported by operating in Mode 4, i.e., the proposed end-state, than when operating in Mode 5?" This is the basis on which this evaluation has been undertaken as discussed in the following CSF sections.

These discussions focus on operations in Mode 4 with the intent of showing that there is no disadvantage', from a risk perspective, of having one of the proposed LCO conditions invoked when operating in Mode 4 (not on SDC) rather than Mode 5.

A major characteristic related to plant operations and support of CSFs is the thermal-hydraulic condition of the reactor system when IEs are assumed to occur. When considering CSF support for IEs assumed to occur at 100 % full power, consideration must be given to conditions that generally describe those associated with the maximum hypothetical event (MHA). Such conditions include > 95% of the energy associated with 100% full power being stored in the reactor system when the 1E occurs. Because of this, analyses assume availability of equipment that can respond successfully to the large and rapid changes in RCS inventory and RB energy deposition that accompany certain lEs, e.g., large break LOCA and SLB. In contrast to this, when operating in Mode 4, the reactor is already shutdown (i.e., kff <0.99) and RCS pressure and temperature will likely be significantly decreased or decreasing to target values. Because of this, only decay heat energy and energy stored in RCS components need be considered in associated PRA analyses. The effect of these considerations is to reduce IE frequency for LOCA, SGTR and SLB during operational pcriods when the reactor system thermal loads have been dramatically decreased, i.e., by-95%. These conditions provide for consideration of reduced risk profiles that arc born out by this analysis, i.e., the combination of qualitative and quantitative analysis.

4.3.1 Control Of Reactivity General When operating in Mode 4, the plant is shutdown, i.e., kfrr 0.99, thus ATWS is not possible.

Also, when in Mode 4 (not on SDC) the control rods will either be inserted or the regulating rod groups will be inserted with one or more of the safety rod groups cocked and armed for 4

This evaluation includes, where appropriate, consideration of lEs assessed in Transition Risk PRAs.

5 Discussion of the advantages of being in Mode 4 (not on SDC), rather than Mode 5, with a condition of an LCO proposed for an end-state change being invoked are discussed in Sections 2, 4.1 and 4.2. For this reason, the advantages referenced by these sections are not generally repeated in this section.

DATE: 1/12/04 PAGE - 20

I Licensing Working Group Risk Informed Justification For LCO End-state Changes automatic Reactor Protection System (RPS) insertion. Boron in the RCS will have been increased to at least the value that will provide for 1% shutdown margin *vhen the target cooldown RCS temperature is achieved and assuming the most reactive control rod is stuck out with minimum xenon reactivity in effect. Additional RCS boration is available via the emergency boration system and the HPI system. RC boron changes occur fairly slowly, even those associated with failure of bleed and feed systems; hence, there will be ample time for plant personnel to mitigate IEs leading to boron dilution.

The most limiting accident for the shutdown margin (SDM) requirements is based on a SLB, as described in the SAR. As SG pressure decreases in Mode 4, the likelihood of an SLB decreases.

The core reactivity situation described here is not altered by invoking a condition of any of the LCOs proposed for change. Additionally, there is no change in the means of maintaining the core reactivity balance by allowing operation in Mode 4. However, when operating in Mode 5, the HPI system is no longer immediately available. Therefore, from an SSC standpoint, reactivity control is more robust in the higher modes since all boron addition systems are immediately available (in Mode 5 HPI must always be manually initiated via operator action).

Associated LCOs Proposed For Altered End-states The LCOs being proposed for an end-state change that are considered to directly support this CSF are:

3.5.4 BWST; boron concentration only 3.7.7 CCW System 3.7.8 SWS 3.7.9 UIHS 3.7.4 BWST:

The [2270] ppm limit for minimum boron concentration was established to ensure that, following a LOCA, with a minimum BWST level, the reactor will remain shutdown in the cold condition following mixing of the BWST and RCS water volumes. Also, large break LOCA (LBLOCA) accident analyses assume that all control rods remain withdrawn from the core.

Clearly this situation provides for fairly conservative negative reactivity insertions (e.g., in excess of -9.0% 5k/k) via the BWST when considering the decreased frequency for LOCAs (especially LBLOCAs) in Mode 4. Because of this, and a) the premise that deviations in boron concentration from the minimum prescribed will be small and b) boric acid addition systems would normally be available (e.g., can be tied to [onsite standby power source]), the proposed LCO change is considered acceptable.

3.7.7 CCW system:

This system provides cooling for equipment that supplies boron to the RCS, i.e., HPI and emergency boration system. Because there are redundant trains of this equipment, invoking a DATE: 1/12104 PAGE -21 DATE: 1/12/04 PAGE - 21

Licensing Working Group Risk Informed Justification For LCO End-state Chianges condition of this LCO when operating in Mode 4 does not render its intended function unavailable.

3.7.8 SWS:

This system provides cooling for equipment that supplies boron to the RCS, i.e., HPI and emergency boration system. Because there are redundant trains of this equipment, invoking a condition of this LCO when operating in Mode 4 does not render its intended function unavailable.

3.7.9 UHS:

The UHS system supports cooling of the BPI and emergency boration systems via its support of the CCW/SWS. Because there are multiple UHS trains, invoking a condition of this LCO when operating in Mode 4 does not render its intended function unavailable.

4.3.2 Control Of RCS Inventory General In Mode 4 RCS inventory is controlled normally by the Makeup (MU) system with suction supplied by the MU tank. When abnormal challenges to RCS inventory occur, two trains of HPI and Low Pressure Injection (LPI) provide RC makeup with suction supplied by the Borated Water Storage Tank (BWST). Es that challenge RCS inventory are LOCAs (all classes including interfacing system LOCA (ISLOCA)) and SGTRs. The frequency of occurrence of these events decreases as the plant transitions from at-power operation to the lower modes.

When operating in Modes 3 and 4 versus Mode 5, systems that control RCS inventory are more abundantly available. That is, two trains of HPI arc either immediately available, via automatic means or can be placed in operation via operator action, and two trains of LPI are immediately available via automatic means or operator control from the main control room (MCR). When in Mode 5, depending on conditions, HPI may not be available except via lengthy operator alignment and one train of LPI will be unavailable as it will be aligned to the SDC mode. Thus, even though when operating in Mode 5 where LOCA and SGTR risks become so negligible as to be considered non-initiators, the availability of RCS inventory control methods in Modes 3 and 4 provide an overriding reason not to unnecessarily transition to Mode 5. This is because RCS inventory control systems become particularly important in Mode S due SDC system related inadvertent RCS draining event concerns.

DATE: 1/12/04 PAGE -22 DATE: 1/12/04 PAGE - 22

Licensing W orking Group Risk Informed Justification For L CO Etnd-state Changes Associated LCOs Proposed For Altered End-states The LCOs being proposed for an end-state change that are considered to directly support this CSF are:

3.3.5 ESFAS Instruments 3.3.6 ESFAS Manual Initiation 3.4.15 RCS Leak Detection Instrumentation 3.7.7 CCW System 3.7.8 SWS 3.7.9 UHS 3.7.10 CREVS 3.7.11 CREATCS 3.3.5: ESFAS Instruments:

ESFAS instruments initiate HP1, LPI, containment spray and cooling, containment isolation, and

[onsite standby power source] start. ESFAS also provides a signal to the Emergency Feedwater Isolation and Control (EFIC) System. This signal initiates EFW vhen HPI is initiated. All functions associated with these SSCs can be initiated via operator action. This may be accomplished at the channel level or the individual component level. For this reason, these CSF support functions remain available, with equivalent or greater levels and trains available, for the proposed altered end-state of this LCO.

3.3.6: ESFAS Manual Initiation:

The ESFAS manual initiation capability allows the operator to actuate ESFAS functions from the main control room in the absence of any other initiation condition. Manually actuated functions include HPI, LPI, containment spray and cooling, containment isolation, and control room isolation. The ESFAS manual initiation ensures that the control room operator can rapidly initiate Engineered Safety Features (ESF) functions at any time. In the absence of manual ESFAS initiation capability, the operator can initiate any and all ESF functions individually at a lower level. Hence, the proposed altered end-state of this LCO does not reduce support of the subject CSF.

3.4.15 RCS Leak Detection Instrumentation:

One method of protecting against large RCS leakage derives from the ability of instruments to rapidly detect extremely small leaks. This LCO requires instruments of diverse monitoring principles to be operable to provide a high degree of confidence that extremely small leaks are detected in time to allow actions to place the plant in a safe condition when RCS leakage indicates possible RC pressure boundary (RCPB) degradation. The LCO requirements are satisfied when monitors of diverse measurement means are available. Thus, the containment sump monitor, in combination with a particulate or gaseous radioactivity monitor, provides an acceptable minimum.

DATE: 1/12/04 PAGE-23 DATE: 1/12104 PAGE - 23

Licensing Working Group Risk Informed Justification For LCO End-state Changes During Mode 4 operations there is decreased potential for and probability of a RCS leak, i.e.,

LOCA. Also there are additional/multiple RCS leak detection instruments/means available for protecting against RCS leakage. This situation is no different than when operating in Mode 5 with this LCO condition invoked.

3.7.7 CCW:

This system provides cooling for ECCS equipment and containment control equipment. Because there are redundant trains of this equipment, invoking a condition of this LCO when operating in Mode 4 does not render its intended function unavailable.

3.7.8 SWS:

This system provides cooling for ECCS equipment and containment control equipment. Because there are redundant trains of this equipment, invoking a condition of this LCO when operating in Mode 4 does not render its intended function unavailable.

3.7.9 UHS:

The UHS system supports cooling of the ECCS and containment control equipment via its support of the CCW/SWS. Because there are multiple UHS trains, invoking a condition of the LCO when operating in Mode 4 does not render its intended function unavailable.

3.7.10 CREVS:

The CREVS provides a protected environment from which operators can control the unit following an uncontrolled release of radioactivity, [chemicals, or toxic gas]. The CREVS components are arranged in redundant safety related ventilation trains.

Also, the IE frequencies for [chemicals, or toxic gas] are the same for Modes 4 and 5.

3.7.11 CREATCS:

The CREATCS provides temperature control for the control room following isolation of the control room. The CREATCS consists of two independent and redundant trains that provide cooling of recirculated control room air. For this reason, i.e., redundant trains, invoking a condition of this LCO when operating in Mode 4 does not render the CREATCS intended function unavailable.

DATE: 1/12/04 PAGE-24 DATE: 1/12/04 PAGE -24

Licensing 'orking Group Risk Informed Justification For LCO End-state Changes 4.3.3 Control Of Corc Decay Heat Removal General The E of interest for this CSF is total loss of feedwater causing a loss of core cooling function.

In Mode 4 (not on SDC) the SSCs available to support this CSF, in conjunction with the SGs, are:

Two trains of Main Feedwater Pumps (MFWPs)

At least two trains of condensate/condensate booster pumps Motor Driven Emergency Feedwater Pump(s) (MDEFWP)6 Turbine Driven Emergency Fcedwater Pump(s) (TDEFWP)6 Diesel Driven Emergency Feedwater Pump (DDEFWP)7 Auxiliary Feedwatcr Pump(s) (AFWP)8 The TDEFWPs arc normally available via SGs during cooldown to [280] F; they are available via auxiliary boiler and other auxiliary steam sources during the entire cooldown to Mode 5. All other pumps are normally available during the entire cooldown regardless of SG conditions.

Clearly the number and kinds of SSCs available when operating in Mode 4 indicates that this CSF is well supported when operating in Mode 4; this is born out by PRA results (see Figure 2).

The number of SSCs available to provide support of this CSF, when operating in Mode 4 (not on SDC), is not reduced by any of the proposed LCO changes, but may be increased. When operating in Mode 5 the SGs arc not immediately available and depending on conditions may not be available for some period of time (see 2.2.1). Because of these considerations, maintaining operations in Mode 4 provides a definite advantage, relative to this CSF, when SDC operations are not necessary.

There are two redundant DHR systems designated to provide SDC. These systems also provide LPI when appropriately aligned. Because of this, during Mode 5, when on SDC there is one backup SDC system available and either of the DHRILPI pumps can be aligned in the feed and bleed cooling mode with suction from the BWST. Generally, in Mode 5, other than securing SDC and attempting to revert to SG cooling or RCS MU cooling via gravity drain from the BWST there are few if any other backup core cooling options available.

Based on the foregoing discussion, it is clear that this CSF is afforded a depth of backup support in Mode 4 (not on SDC) that is not present when operating in Mode 5.

6 DB has redundant safety grade TDEFWPs; these pumps are not available via SGs in Mode 4. All other plants have a combination of a TDEFWP and one or more MDEFWPs; all are configured into redundant safety grade systems with TDEFWPs available via SGs in Mode 4.

CR-3 has an additional DDEFWP.

DB and CR-3 have additional AFWPs diverse from any other feedwater pumps.

DATE: 1/12/04 PAGE-25 DATE: 1/12/04 PAGE - 25

Licensing Working Group Risk Informed Justification For LCO End-state Changes Associated LCOs Proposed For Altered End-states The LCOs being proposed for an end-state change that arc considered to directly support this CSF are:

3.4.6 RCS Loops - Mode 4 3.7.7 CCW System 3.7.8 SWS 3.7.9 UHS 3.4.6 RCS Loops - Mode 4:

The purpose of this LCO is to provide forced flow from at least one RCP or one DHR pump for core decay heat removal and transport. This LCO allows the two loops that are required to be operable to consist of any combination of RCS or DHR system loops. Any one loop in operation provides enough flow to remove the decay heat from the core. The second loop that is required to be operable provides redundant paths for heat removal. An ancillary function of the RCS and/or DHR loops is to provide mixing of boron in the RCS.

When operating in Mode 4 if both RCS loops and one DHR loop is inoperable, the existing LCO requires cooldown to Mode 5. In this situation, SGs are available for core heat removal and transport via NC in Mode 4 without a need for significant RCS heatup. Proceeding to Mode 5 makes few if any additional systems available for decay heat removal (assuming a failure of the remaining DHR/LPI 9system). The one system that can be made available in Mode 5 to provide backup to the DHR system is the BWST. It can provide gravity draining to the RCS after cooldown to Mode 5 and subsequent RCS drain down and removal of SG primary side manway covers. This would require a considerable time delay, during which RC temperature would be increasing. Given these considerations and magnitude of feedwater systems available to feed the SGs, continued use of SGs for this situation will adequately support this CSF.

3.7.7 CCW:

This system provides cooling for EFW pumps that function to mitigate loss of feedwater IEs.

Because there are redundant trains of this equipment, invoking a condition of this LCO when operating in Mode 4 does not render its intended function unavailable.

3.7.8 SWS:

This system provides cooling for EFW pumps that function to mitigate loss of feedwater IEs.

Because there are redundant trains of this equipment, invoking a condition of this LCO when operating in Mode 4 does not render its intended function unavailable.

9 See page 7, "Definitions", for the definition of the DHRILPI systems.

DATE: 1/12/04 PAGE -26 DATE: 1/12/04 PAGE - 26

I Licensing Working Group Risk Informted Justlflcationa For LCO End-state Changes 3.7.9 UHS:

The UHS system supports cooling of the EFW pumps that function to mitigate loss of feedwater lEs via its support of the CCW/SWS. Because there are multiple UHS trains, invoking a condition of the LCO when operating in Mode 4 does not render its intended function unavailable.

4.3.4 Control Of Containment Integrity General Controlling this CSF requires maintaining several parameters within limits and assuring certain systems remain operable such that occurrence of a design basis LOCA will not cause the RB design pressure or air and fission product leakage to be exceeded.

Fundamental to evaluation of support of this CSF is the IE of interest, i.e. a design basis LOCA.

Since the plant is operating in Mode 4, the release of stored energy to the RB, i.e., the containment building, would be only that associated with decay heat and energy stored in the RCS components. That is, over 95% of the energy assumed to be released to the RB during a design basis LOCA is associated with the core thermal power resulting from 100% full power.

Since the reactor is already shutdown, such a thermal release to the RB is not possible; only a small fraction of this energy could be released. Also, occurrence of the design basis accident (DBA), a 28 inch cold leg guillotine break at a RCP discharge, is considered to be very unlikely to occur at anytime much less while operating in Mode 4.

This CSF is controlled by redundant containment spray and cooling systems, containment isolation systems, and by maintaining RB pressure and temperature within appropriate limits.

Because of the low likelihood of, and limited energy release for a LOCA in Mode 4, support of this CSF afforded by the containment spray, cooling and isolation systems will not be adversely affected by invoking the conditions of any of the subject LCOs.

The containment air temperature and high pressure limits are initial conditions used in the DBA analyses to establish the maximum peak containment internal pressure. Because only a small percentage of the energy assumed for the DBA could be released to the containment, these limits are overly conservative during operation in Mode 4. Further, their control while in these Modes is not different than when operating in Mode 5 and the SSCs available to control these parameters in Mode 4 will be at least as numerous as when in Mode 5. The low containment pressure limit is based on inadvertent full (both trains) actuation of the RB, i.e., containment, spray system. Invoking any condition associated with the LCOs being proposed for an end-state change cannot initiate this event. Also, actually reaching the low pressure limit while operating in Mode 4 would require an extended period of time, hence there is ample time for operators to terminate containment spray before the low pressure limit is violated.

For this reason, these parameters will be sufficiently controlled such that in Mode 4 the support of the subject CSF will not be decreased.

DATE: 1/12/04 PAGE-27 DATE: 112/04 PAGE - 27

Licensing Working Group Risk Informed Justificaion For LCO End-state Changes Associated LCOs Proposed For Altered End-states The LCOs being proposed for an end-state change that are considered to directly support this CSF are:

3.6.1 Containment 3.6.2 Containment Air Locks 3.6.3 CIVs 3.6.4 Containmcnt Pressure 3.6.5 Containment Air Temperature 3.6.6 Containment Spray and Cooling 3.7.7 CCW System 3.7.8 SWS 3.7.9 UHS 3.7.10 CREVS 3.7.11 CREATCS

3.6.1 Containment

The containment consists of the concrete RB, its steel liner, and the penetrations through this structure. The structure is designed to contain radioactive material that may be released from the reactor core following a design basis LOCA. Additionally, this structure provides shielding from the fission products that may be present in the containment atmosphere following accident conditions.

Containment operability is maintained by limiting leakage to 1.0 L., except prior to the first startup after performing a required Containment Leakage Rate Testing Program leakage test. At this time the applicable leakage limits must be met. Compliance with this LCO will ensure a containment configuration, including equipment hatches, that is structurally sound and that will limit leakage to those leakage rates assumed in the safety analysis.

The safety design basis for the containment is that the containment must withstand the pressures and temperatures of the limiting DBA without exceeding the design leakage rate. In the DBA analyses, it is assumed that the containment is operable such that, for the DBAs involving release of fission product radioactivity, release to the environment is controlled by the rate of containment leakage. The containment was designed with an allowable leakage rate of [0.25]%

of containment air weight per day. This leakage rate, used in the evaluation of offsite doses resulting from accidents, is defined as La: the maximum allowable leakage rate at the calculated maximum peak containment pressure (Pa) resulting from the limiting design basis LOCA. The allowable leakage rate represented by La forms the basis for the acceptance criteria imposed on all containment leakage rate testing. As discussed previously, LOCAs initiated from Mode 4 are much less challenging to the containment than those initiated from at-power design basis conditions. The substantially lower core energy release to the RB results in much lover containment pressure and, therefore, lower potential leakage rates. Assuming a RB breach that would cause La at DBA conditions exists (triggering plant shutdown in accordance with this DATE: 1/12/04 PAGE -28 DATE: 1/12104 PAGE - 28

Licensing Working Group Risk Inforrmed Justification For LCO End-state Changes LCO), such a breach would produce RB leakage flow rates considerably less than La10 when operating in Mode 4 with occurrence of a LOCA. Also, since the reactor is shutdown in advance of the IE, any associated fission product releases associated with La RB leakage would be considerably lower (due to radionuclide decay) than those delineated in the SAR.

3.6.2 Containment Air Locks:

Containment air locks form part of the containment pressure boundary and provide a means for personnel access during all Modes of operation. As such, air lock integrity and leak tightness is essential for maintaining the containment leakage rate within limits in the event of a DBA. Each air lock is fitted with redundant seals and doors as a design feature for mitigating the DBA.

When operating in Mode 4 the energy that can be released to the RB is a fraction of that which would be released for a DBA. Also, the redundant containment spray and cooling systems, required to be operable in Mode 4 but not in Mode 5, will be available to ensure that containment pressure remains low should a LOCA occur. Given this and the highly unlikely possibility of a LOCA, this CSF is considered to remain adequately supported for the proposed cnd-state of this LCO.

3.6.3 CIVs:

The CIVs form part of the containment pressure boundary and provide a means for fluid penetrations not serving accident consequence limiting systems to be provided with two isolation barriers that are closed on an automatic isolation signal. Two barriers in series are provided for each penetration so that no single credible failure or malfunction of an active component can result in a loss of isolation or leakage that exceeds limits assumed in the safety analyses. One of these barriers may be a closed system. These barriers (typically CIVs) make up the Containment Isolation System.

Containment isolation occurs upon receipt of a high containment pressure or diverse containment isolation signal. The containment isolation signal closes automatic containment isolation valves in fluid penetrations not required for operation of ESF to prevent leakage of radioactive material.

Upon actuation of HPI, automatic containment valves also isolate systems not required for containment or RCS heat removal. Other penetrations are isolated by the use of valves in the closed position or blind flanges. As a result, the CIVs (and blind flanges) help ensure that the containment atmosphere will be isolated in the event of a release of radioactive material to containment atmosphere from the RCS following a DBA.

Operability of the containment isolation valves (and blind flanges) supports containment operability during accident conditions. The operability requirements for containment isolation valves help ensure that containment is isolated within the time limits assumed in the safety analyses. Therefore, the operability requirements provide assurance that the containment function assumed in the safety analyses will be maintained.

30 For example, assuming a LOCA occurred in Mode 4 causing RB pressure to rise to PSIG, then the RB leak rate would be < L. by approximately a factor of 3.5.

DATE: 1/12/04 PAGE - 29

Licensing Working Group Risk Informed Justification For LCO E nd-state Changes When operating in Mode 4, there is decreased potential for challenges to the containment (see 4.3.4 General) than assumed in the licensing basis; thus, containment pressures associated with lEs that transfer energy to the containment will be only slightly higher when operating in Mode 4 versus operating in Mode 5. When operating in Mode 4, versus Mode 5, there are more systems available to mitigate precursor events, e.g., loss of feedwater and LOCA, that could cause potential challenges to containment; also, potential fission product release is reduced due to radionuclide decay. For these reasons, support of this CSF is not adversely affected by the proposed altered end-state of this LCO.

3.6.4 Containment Pressure:

The containment pressure is limited during normal operation to preserve the initial conditions assumed in the accident analyses for a LOCA or SLB. The containment air pressure limit also prevents the containment pressure from exceeding the containment design negative pressure differential with respect to the outside atmosphere in the event of inadvertent actuation of the containment spray system. Maintaining containment pressure less than or equal to the LCO upper pressure limit (in conjunction with maintaining the containment temperature limit) ensures that:

In the event of a DBA, the resultant peak containment accident pressure will remain below the containment design pressure.

• The containment environmental qualification operating envelope is maintained.

• The ability of containment to perform its design function is ensured.

As discussed previously (see 4.3.4 General for additional detail), the containment high pressure limit is an initial condition used in the DBA analyses to establish the maximum peak containment internal pressure. Because only a small percentage of the energy assumed for the DBA could be released to the containment, this limit is overly conservative during operations in Mode 4. The low containment pressure limit is based on inadvertent full (both trains) actuation of the RB spray system. Invoking any condition associated with the LCOs being proposed for an end-state change cannot initiate this event; however, should it occur, there is ample time for operator response to mitigate it.

For the reasons discussed here, support of this CSF is not compromised by the proposed altered end-state of the subject LCO.

3.6.5 Containment Air Temperature:

The air temperature is limited during normal operation to preserve the initial conditions assumed in the accident analyses for a LOCA or SLB. Maintaining containment air temperature less than or equal to the LCO temperature limit (in conjunction with maintaining the containment upper pressure limit) ensures that:

In the event of a DBA, the resultant peak containment accident pressure will remain below the containment design pressure.

DATE: 1/12/04 PAGE-30 DATE: 1/12/04 PAGE - 30

Licensing Working Group Risk Informed Justification For LCO End-state Changes

• The containment environmental qualification operating envelope is maintained.

• The ability of containment to perform its design function is ensured.

As discussed previously (see 4.3.4 General for additional detail), the containment air temperature limit is an initial condition used in the DBA analyses to establish the maximum peak containment internal pressure. Because only a small percentage of the energy assumed for the DBA could be released to the containment, this limit is overly conservative during operations in Mode 4.

For the reasons discussed here, support of this CSF is not compromised by the proposed altered end-state of the subject LCO.

3.6.6 Containment Spray and Cooling:

The containment spray and cooling systems provide containment atmosphere cooling to limit post accident pressure and temperature in containment to less than the design values. Reduction of containment pressure and the iodine removal capability of the spray reduces the release of fission product radioactivity from containment to the environment, in the event of a DBA.

When operating in Mode 4, the release of stored energy to the RB can be only a small fraction of the energy associated with a DBA. This, along with the fact there are redundant trains of containment spray and cooling, assures this CSF will be supported during operation in Mode 4.

Also, the function associated with containment spray iodine removal capability will be less challenged when operating in Mode 4 due to radionuclide decay. For these reasons, this CSF is not compromised by the proposed altered end-state of this LCO.

3.7.7 CCW:

This system provides cooling for containment spray and cooling equipment. Because there are redundant trains of this equipment, invoking a condition of this LCO when operating in Mode 4 does not render its intended function unavailable.

3.7.8 SWS:

This system provides cooling for containment spray and cooling equipment. Because there are redundant trains of this equipment, invoking a condition of this LCO when operating in Mode 4 does not render its intended function unavailable.

3.7.9 UHS:

The UHS system supports cooling of the containment spray and cooling equipment via CCW/SWS. Because there are multiple UHS trains, invoking a condition of the LCO when operating in Mode 4 does not render its intended function unavailable.

DATE: 1/12/04 PAGE -31 DATE: 1/12/04 PAGE - 31

Licensing Working Group Risk Infornted Justifcation For LCO End-state Changes 3.7.10 CREVS:

The CREVS provides a protected environment from which operators can control the unit following an uncontrolled release of radioactivity. The CREVS components are arranged in redundant safety related ventilation trains. Also, the 1E frequencies for [chemicals, or toxic gas) are the same for Modes 4 and 5.

3.7.11 CREATCS:

The CREATCS provides temperature control for the control room following isolation of the control room. The CREATCS consists of two independent and redundant trains that provide cooling of recirculated control room air. For this reason, i.e., redundant trains, invoking a condition of this LCO when operating in Mode 4 does not render the CREATCS intended function unavailable.

4.3.5 Power Availability Challenges to power availability when operating in Modes 4 and 5 are conservatively assumed to be equivalent. This means that the frequency for the loss of offsite power event is set at the same value in the Transition and Shutdown risk models for Modes 4 and 5. It is important to maintain station electrical power when operating in transition and shutdown Modes so that safe plant operations can be maintained at all times.

The LCOs being proposed for an end-state change that are considered to directly support this CSF are:

3.7.7 CCW System 3.7.8 SWS 3.7.9 UHS 3.8.1 AC Sources - operating 3.8.4 DC Sources - operating 3.8.7 Inverters - operating 3.8.9 Distribution System - operating 3.7.7 CCW:

This system provides cooling for [onsite standby power sources]. Because there are redundant trains of this equipment, invoking a condition of this LCO when operating in Mode 4 does not render its intended function unavailable.

3.7.8 SWS:

This system provides cooling for [onsite standby power sources]. Because there are redundant trains of this equipment, invoking a condition of this LCO when operating in Mode 4 does not render its intended function unavailable.

DATE: 1/12/04 PAGE-32 DATE: 112/04 PAGE - 32

Licensing Working Group Risk Informed Justification For LCO End-state Changes 3.7.9 UHS:

The UHS system supports cooling of the [onsite standby power sources] via CCW/SWS.

Because there are multiple UHS trains, invoking a condition of this LCO when operating in Mode 4 does not render its intended function unavailable. This situation is no different than when operating in Mode 5.

3.8.1 AC Sources - operating The unit Class I E AC Electrical Power Distribution System AC sources consist of the offsite power sources (preferred power sources, normal and alternate(s)) and the [onsite standby power sources]. The AC electrical power system provides independence and redundancy to ensure an available source of power to the ESF systems.

The onsite Class 1E AC Distribution System is divided into redundant load groups (trains) so that the loss of any one group does not prevent the minimum safety functions from being performed. Each train has connections to two preferred offsite power sources and a single

[onsite standby power source]. Offsite power is supplied to the unit switchyard(s) from the transmission network by [two] transmission lines. From the switchyard(s), two electrically and physically separated circuits provide AC power, through [step down station auxiliary transformers] to the 4.16 kV ESF buses.

The initial conditions of DBA and transient analyses in the SAR assume ESF systems are operable. The AC electrical power sources are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded. There is no need to respond to a DBA while operating in Mode 4. However, during operations in this Mode there is always a need to assure power is available to SSCs that support the CSFs. To this end, AC power sources are assured during occurrence of a loss of offsite power (LOOP) by operation of one of two redundant [onsite standby power sources]. This situation is no different than when operating in Mode 4 or 5.

3.8.4 DC Sources - operating The station DC electrical power system provides the AC emergency power system with control power. It also provides both motive and control power to selected safety related equipment and preferred AC vital bus power (via inverters). The DC electrical power system is designed to have sufficient independence, redundancy, and testability to perform its safety functions, assuming a single failure. The [125/250] VDC electrical power system consists of two independent and redundant safety related Class I E DC electrical power subsystems ([Train A and Train B]).

The need for DC power to support the CSFs is assured during a LOOP by operation of one redundant train of station DC power as backed from the [onsite standby power sources] via the associated battery charger. This situation is no different for Mode 4 or Mode 5.

DATE: 1/12/04 PAGE - 33

Licensing Working Group Risk Informed Justification For LCO End-state Changes 3.8.7 Inverters - operating The inverters ensure the availability of AC electrical power to the vital buses for the systems instrumentation required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA. The inverters are the preferred source of power for the AC vital buses because of the stability and reliability they achieve. The function of the inverter is to provide AC electrical power to the vital bus. The four inverters

[two per train] ensure an uninterruptible supply of AC electrical power to the AC vital buses even if the 4.16 kV safety buses are de-energized. They can be powered from an internal AC source/rectifier or from the station battery.

There is no need to respond to a DBA while operating in Mode 4. However, during operations in this Mode there is always a need to assure AC vital power is available to SSCs that support the CSFs. In order to assure this, during a LOOP one of two trains of inverters can be powered by

[onsite standby power sources] via their associated battery and battery charger. This situation is no different when operating in Mode 4 than when operating in Mode 5.

3.8.9 Distribution Systems - operating The onsite Class LE AC, DC, and AC vital bus electrical power distribution systems are divided by train into [two] redundant and independent AC, DC, and AC vital bus electrical power distribution subsystems. The required power distribution systems ensure the availability of AC, DC, and AC vital bus electrical power for the systems required to shut down the reactor and maintain it in a safe condition after an AOO or a postulated DBA. Maintaining the train A and B AC, DC, and AC vital bus electrical power distribution subsystems operable ensures that the redundancy incorporated into the design of ESF is not defeated. Therefore, a single failure within any system or within the electrical power distribution subsystems will not prevent safe shutdown of the reactor.

Providing for reactor shutdown and DBA mitigation are not a concern while operating in Mode 4. However, maintaining safe plant conditions is always a concern and requires that at least one redundant electrical distribution system be operable. This is assured by the redundant electrical distribution system design and the ability to power one of these systems via batteries backed by [onsite standby power sources] for DC distribution and AC vital buses, and [onsite standby power sources] for AC distribution. There is no difference in this situation whether the plant is operating in Mode 4 or 5.

4.4 BASES FOR PROPOSED LCO END-STATE CHANGES This section provides the bases for the proposed LCO end-state changes. LCOs being proposed for an end-state change are:

3.3.5 Engineered Safety Features Actuation System (ESFAS) Instruments 3.3.6 ESFAS Manual Initiation 3.4.6 RCS Loops - Mode 4 DATE: 1/12/04 PAGE - 34

Licensing Working Group Risk Informed Justifcation For LCO End-state Changes 3.4.15 RCS Leak Detection Instrumentation 3.5.4 Borated Water Storage Tank (BWST) 3.6.1 Containment 3.6.2 Containment Air Locks 3.6.3 Containment Isolation Valves (CIVs) 3.6.4 Containment Pressure 3.6.5 Containment Air Temperature 3.6.6 Containment Spray and Cooling 3.7.7 Component Cooling Water (CCWV) System 3.7.8 Service Water System (SWS) 3.7.9 Ultimate Heat Sink (UHS) 3.7.10 Control Room Emergency Ventilation System (CREVS) 3.7.11 Control Room Emergency Air Temperature System (CREATCS) 3.8.1 AC Sources - Operating 3.8.4 DC Sources - Operating 3.8.7 Inverters - Operating 3.8.9 Distribution System - Operating General Basis Discussion The following Mode 4 considerations are germane to all the LCOs being proposed for an end-state change with the exception of LCO 3.4.6, RCS Loops - Mode 4. These considerations are discussed here to provide an overall cohesive basis for the proposed end-state changes of these LCOs. They are referred to as appropriate, in whole or in part, in the individual Basis For Proposed End-state discussions, i.e., sections 4.4.1 - 4.4.20:

1. For the LCOs being considered for a change in end-state, the major concern related to the mitigative response of LCO associated equipment is a design basis LOCA (occurs at 100%

full power). It is this IE that most rigorously challenges the ability of LCO associated equipment to successfully mitigate its affects on core structural and containment integrity.

During such an occurrence analyses assume that over 95% of the energy stored in the reactor system is released to containment where it challenges containment control equipment; the remaining energy must be removed by the ECCS. This scenario further assumes that a full compliment of radionuclides exists. For the operating condition for which the proposed end-state changes are being considered, i.e., Mode 4, this is contrasted with the reactor having been shutdown for some time when the IE is assumed to occur. For this reason, the thermal-hydraulic conditions of the reactor system are very different when operating in Mode 4 than when operating at 100% full power; only a small fraction of the energy associated with at-power operations could be released to containment. Further, the energy remaining in the reactor system is only that associated with reduced decay heat and energy stored in RCS components; decay heat would have decayed from the maximum value.

2. A design basis LOCA is considered highly unlikely to occur during at-power operations, much less during Mode 4; indeed, the occurrence of a LOCA of any kind during operation in Mode 4 is considered highly unlikely. This is especially true of operations toward the lower end of Mode 4 while operating on SGs (SDC not in operation). At this point, RCS pressure DATE: 1/12/04 PAGE-35 DATE: 1/12/04 PAGE - 35

Licensing Working Group Risk Informed Justification For LCO End-state Changes has been reduced to < 400 PSIG. Also, the core radionuclide inventory would have decreased due to radioactive decay when the assumed IE would occur in Mode 4, thus the probability of occurrence of a LOCA is decreased while the consequence of such and event is not increased.

3. When operating in Mode 4 the potential for the transfer of energy from the reactor system to containment is reduced substantially from that associated with DBAs. DBAs assume 100%

full power initial conditions, however, during Mode 4 operation the core power is reduced from the DBA condition by at least 95% (more likely to be 98% due to neutron precursor radionuclide decay since reactor shutdown). For this reason, the containment pressure associated with IEs that transfer energy to containment during such occurrences, while operating in Mode 4, is only a small fraction of that associated with the DBAs for which containment is designed. Thus, challenges to containment control systems, i.e., containment spray, containment cooling and containment isolation systems, are greatly reduced from the DBA situation for which these systems are designed. Because of this and because the core radionuclide inventory would have substantially decreased due to radioactive decay, large early release frequency (LERF) is not expected to increase.

4. Plant risk is lower when operating in Mode 4 (not on SDC) than when operating in Mode 5 (see Figure 2); risk associated with SDC operation is avoided.

5. When operating in Mode 4 there are more mitigation systems available to respond to Es that could challenge RCS inventory or decay heat removal, than when operating in Mode 5.

These systems include the HPI system and fdwater systems, including EFW/AFW systems.

DATE: 1/12/04 PAGE-36 DATE: 1/12/04 PAGE - 36

Licensing Working Group Risk Inforned Justyflcation For LCO End-state Changes 4.4.1 LCO 3.3.5: Engineered Safety Features Actuation System (ESFAS) Instruments LCO Operability Statement From STS (see Reference I for exact wording)

Three channels of ESFAS instrumentation for each Parameter below shall be operable in each ESFAS train:

Table 3.3.5-1 (from Reference 1)

APPLICABLE MODES OR OTHER ALLOWABLE PARAMETER SPECIFIED CONDITIONS VALUE

1. Reactor Coolant System Pressure - Low Setpoint

> [l 800] PSIG

> [1600] PSIG (HPI Actuation, RB Isolation, RB Cooling, onsite standby power source] Start)

2. Reactor Coolant System Pressure - Low Low

[900] PSIG

> [400] PSIG Setpoint (HPI Actuation, LPI Actuation, RB Isolation, RB Cooling)

3. Reactor Building (RB) Pressure - High Setpoint 1,2,3,4 5 [5] PSIG (HPI Actuation, LPI Actuation, RB Isolation, RB Cooling)

4. Reactor Building Pressure - High High Setpoint (RB 1,2,3,4 l

S30] PSIG Spray Actuation) l Description The ESFAS initiates necessary safety systems, based on the values of selected unit parameters, to protect against violating core design limits and reactor coolant pressure boundary and to mitigate accidents, including challenges to containment. ESFAS actuates the following systems:

HPI,

LPI, RB Cooling, RB Spray, RB Isolation, and

[onsite standby power source] start.

ESFAS also provides a signal to EFIC; this signal initiates EFW when HPI is initiated.

The ESFAS operates in a distributed manner to initiate the appropriate systems. The ESFAS does this by determining the need for actuation in each of three channels monitoring each actuation parameter. Once the need for actuation is determined, the condition is transmitted to DATE: 1/12/04 PAGE-37 DATE: 1/12/04 PAGE - 37

Licensing Working Group Risk Informed Justification For LCO Eid-state Changes automatic actuation logics, which perform a two-out-of-thrce logic to determine the actuation of each end device. Each end device has its own automatic actuation logic, although all automatic actuation logics take their signals from the same point in each channel for each parameter. Four parameters are used for actuation:

Low Reactor Coolant System (RCS) Pressure, Low Low RCS Pressure,

• High RB Pressure, and High High RB Pressure.

LCO 3.3.5 covers only the instrumentation channels that measure these parameters. These channels include all intervening equipment necessary to produce actuation before the measured process parameter exceeds the limits assumed by the accident analysis. This includes sensors, bistable devices, operational bypass circuitry, block timers, and output relays.

Setpoints, in accordance with the allowable values, ensure that the consequences of DBAs will be acceptable, providing the plant is operated from within the LCOs at the onset of the DBA and the equipment functions as designed.

Current and Proposed LCO End-state Change Current End-state:

This proposed end-state change is associated with LCO 3.3.5 Condition B, Required Action B.2.3 and addresses only the RB High Pressure and RB High-High Pressure setpoints.

Specifically, if two or more channels are inoperable or one channel is inoperable and the required action is not met, then the Mode 5 cnd-state is prescribed within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> subsequent to an initial cooldown to Mode 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

Proposed End-state:

The end-state associated with Required Action B.2.3 of this LCO is being proposed to be changed from Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> to Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

Basis For Proposed End-state When operating in Mode 4, the reactor system thermal-hydraulic conditions are very different from those associated with a DBA (at-power). That is, the energy in the RCS is only that associated with decay heat in the core and the stored energy in the RCS components and RCS pressure is reduced (especially toward the lower end of Mode 4). This means that the likelihood of an IE occurring, for which ESFAS would provide mitigating functions, is greatly reduced when operating in Mode 4. Nonetheless, all redundant functions initiated by ESFAS can be manually initiated to mitigate transients that will proceed more slowly and with reduced challenge to the reactor and containment systems than those associated with at-power operations.

DATE: 1/12/04 PAGE-38 DATE: 112/04 PAGE - 38

Licensing Working Group Risk Inforined Justifcation For LCO En nd-state Ch anges Also, when operating toward the lower end of Mode 4, with the SGs in operation and SDC not in operation, risk is reduced (see Figure 2); risk associated with SDC operation is avoided.

When operating in Mode 4 there are more mitigation systems (.g., HPI and EFW/AFW) available to respond to IEs that could challenge RCS inventory or decay heat removal, than when operating in Mode 5. These systems include the HPI system and EFW/AFW systems.

4.4.2 LCO 3.3.6: ESFAS Manual Initiation LCO Operability Statement From STS (see Reference I for exact wording)

Two manual initiation channels of each one of the ESFAS functions below shall be operable:

a.

HPI,

b.

LPI,

c.

RB Cooling

d.

RB Spray,

e.

RB Isolation, and

f.

Control Room Isolation.

Modes 1, 2, and 3, Mode 4 when associated engineered safeguard equipment is required to be operable.

Description The ESFAS manual initiation capability allows the operator to actuate ESFAS functions from the MCR in the absence of any other initiation condition. Manually actuated functions include HPI, LPI, RB Cooling, RB Spray, RB Isolation, and Control Room Isolation. This ESFAS manual initiation capability is provided in the event the operator determines that an ESFAS function is needed and has not been automatically actuated. Furthermore, the ESFAS manual initiation capability allows operators to rapidly initiate ESF functions if the trend of unit parameters indicates that ESF actuation will be needed.

LCO 3.3.6 covers only the system level manual initiation of these functions. ESFAS, in conjunction with the actuated equipment, provides protective functions necessary to mitigate DBAs, specifically, LOCA and SLB.

Current and Proposed LCO End-state Current End-state:

This proposed end-state change is associated with LCO 3.3.6 Condition B, Required Action B.2.

Specifically, if one or more ESFAS functions with one channel arc inoperable and the required DATE: 1/12/04 PAGE-39 DATE: 1/12/04 PAGE - 39

Licensing Vorking Group Risk Informed Justifcation For LCO End-state Changes action and associated completion time are not met, then Mode 3 is prescribed within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

Proposed End-state:

The end-state associated with Required Action B.2 of this LCO is being proposed to be changed from Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> to Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

Basis For Proposed End-state When operating in Mode 4, the thcrmal-hydraulic conditions are very different than those associated with a DBA (at-power). That is, the energy in the RCS is only that associated with decay heat in the core and the stored energy in the RCS components and RCS pressure is reduced (especially toward the lower end of Mode 4). This means that the likelihood of an IE occurring, for which ESFAS manual initiation would provide mitigating functions, is greatly reduced when operating in Mode 4. Nonetheless, all redundant functions initiated by ESFAS manual initiation can be manually initiated via individual component controls. In this way transients, that will proceed more slowly and with reduced challenge to the reactor and containment systems than those associated with at-power operations, will be mitigated. Also, when operating toward the lower end of Mode 4, with the SGs in operation and SDC not in operation, risk is reduced (see Figure 2); risk associated with SDC avoided.

When operating in Mode 4 there are more mitigation systems (e.g., HPI and EFW/AFW) available to respond to Es that could challenge RCS inventory or decay heat removal, than when operating in Mode 5. These systems include the HPI system and EFW/AFW systems.

4.4.3 LCO 3.4.6: RCS Loops - Mode 4 LCO Operability Statement From STS (see Referenc I for exact wording)

Two loops consisting of any combination of RCS loops and DHR loops shall be operable and one loop shall be in operation.

Description In Mode 4, the primary function of the reactor coolant is the removal of decay heat and transfer of this heat to the SGs or DHR heat exchangers. The secondary function of the reactor coolant is to act as a carrier for soluble neutron poison, boric acid. In Mode 4, either RCPs or DHR pumps can be used for coolant circulation. The number of pumps in operation can vary to suit the operational needs. The intent of this LCO is to provide forced flow from at least one RCP or one DHR pump for core heat removal and transport and to provide for RC boron mixing. The flow provided by one RCP or one DHR pump is adequate for both of these purposes. The other intent of this LCO is to require that two paths (loops) be available to provide redundancy for heat removal.

DATE: 1/12/04 PAGE-40 DATE: 1/12/04 PAGE - 40

Licensing Working Group Risk Informed Justification For LCO End-state Changes Current and Proposed LCO End-state Current End-state:

This proposed end-state change is associated with LCO 3.4.6 Condition A, Rcquired Action A.2.

Specifically, if one required loop is inoperable, then action is taken immediately to restore a second loop to operable status. Further, if the remaining operable loop is a DHR loop, then Mode 5 is prescribed within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

Proposed End-state:

It is proposed that Required Action A.2 be deleted, thus allowing continued operations in Mode 4.

Basis For Proposed End-state When operating in Mode 4 if both RCS loops and one DHR loop is inoperable, the existing LCO requires cooldown to Mode 5. In this situation, SGs are available for core heat removal and transport via NC in Mode 4 without the need for significant RCS hcatup. Proceeding to Mode 5 makes few if any additional systems available for decay heat removal (assuming a failure of the remaining DHR system). The one system that can be made available in Mode 5 to provide backup to the DHR system is the BWST. It can provide gravity draining to the RCS after cooldown to Mode 5 and subsequent RCS drain down and removal of SG primary side manway covers. This would require a considerable time delay, during which RC temperature would be increasing. Given these considerations and magnitude of feedwater systems available to feed the SGs, continued use of SGs for this situation will adequately cool the core while avoiding the additional risk associated with SDC. RC boron concentration will have been adjusted prior to cooldown to Mode 4 to provide 1% SDM at the target cooldown temperature. Thus, boron concentration adjustments would not be necessary; RC boron would be sufficiently mixed to an equilibrium concentration by this time.

When operating in Mode 4 there are more mitigation systems available to respond to IEs that could challenge RCS inventory or decay heat removal, than when operating in Mode 5. These systems include the HPI system and EFW/AFW systems.

DATE: 1/12/04 PAGE-41 DATE: 1/12/04 PAGE - 41

Licensing Working Group Risk Infortned Justifications For LCO End-state Changes 4.4.4 LCO 3.4.15: RCS Leak Detection Instrumentation LCO Operability Statement From STS (see Reference 1 for exact wording)

The following RCS leakage detection instrumentation shall be operable:

a.

One containment sump monitor and

b.

One containment atmosphere radioactivity monitor (gaseous or particulate).

Modes 1, 2, 3, and 4.

Description An early indication or warning signal is necessary to permit proper evaluation of all unidentified leakage. Industry practice has shown that water flow changes of 0.5 to 1.0 gpm can readily be detected in contained volumes by monitoring changes in water level, in flow rate, or in the operating frequency of a pump. The containment sump used to collect unidentified leakage is instrumented to alarm for increases of 0.5 to 1.0 gpm in the normal flow rates. This sensitivity is acceptable for detecting increases in unidentified leakage.

The RC contains radioactivity that, when released to the containment, can be detected by radiation monitoring instrumentation. Instrument sensitivities of 10'9 pCi/cc particulate and 106 liCi/cc gaseous radioactivity monitoring are practical for these leakage detection systems.

An increase in humidity of the containment atmosphere would indicate release of water vapor to the containment. Dew point temperature measurements can thus be used to monitor humidity levels of the containment atmosphere as an indicator of potential RCS leakage. A 1F increase in dew point is well within the sensitivity range of available instruments. Humidity level monitoring is considered most useful as a secondary alarm or indication to alert the operator to a potential problem. Humidity monitors are not required for this LCO. Air temperature and pressure monitoring methods may also be used to infer unidentified leakage to the containment.

Containment temperature and pressure fluctuate slightly during plant operation, but a rise above the normally indicated range of values may indicate RCS leakage into the containment. The relevance of temperature and pressure measurements are affected by containment free volume and, for temperature, detector location. Alarm signals from these instruments can be valuable in recognizing rapid and sizable leakage to the containment. Temperature and pressure monitors are not required by this LCO. The need to evaluate the severity of an alarm or an indication is important to the operators, and the ability to compare and verify with indications from other systems is necessary.

The safety significance of RCS leakage varies widely depending on its source, rate, and duration.

Therefore, detecting and monitoring reactor coolant leakage into the containment area is necessary. One method of protecting against large RCS leakage derives from the ability of DATE:-1/12/04

-PAGE

-42 DATE: 1/12/04 PAGE - 42

Licensing Working Group Risk Informed Justificationz For LCO End-state Changes instruments to rapidly detect extremely small leaks. This LCO requires instruments of diverse monitoring principles to be operable to provide a high degree of confidence that extremely small leaks are detected in time to allow actions to place the plant in a safe condition when RCS leakage indicates possible RCPB degradation. Thus, the containment sump monitor, in combination with a particulate or gaseous radioactivity monitor, provides an acceptable minimum.

Current and Proposed End-state Current End-state:

This proposed end-state change is associated with LCO 3.4.15 Condition C, Required Action C.2. Specifically, if either the sump monitor or containment atmosphere radioactivity monitor are inoperable and cannot be restored to operability within 30 days, then Mode 3 is prescribed within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

Proposed End-State:

The end-statc associated with Required Action C.2 of this LCO is being proposed to be changed from Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> to Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

Basis For Proposed End-state Due to reduced RCS pressures when operating in Mode 4, especially toward the lower end of Mode 4, the likelihood of occurrence of a LOCA is very small; LOCA IE frequencies are reduced compared to at-power operation. Because of this and because the reactor is shutdown with significant radionuclide decay having occurred, the probability of occurrence of a LOCA is decreased while the consequence of such an event is not increased.

Additional instruments are available to provide secondary indication of a LOCA, e.g., additional containment radioactivity monitors, grab samples of containment atmosphere, humidity, temperature and pressure.

Plant risk is lower when operating in Mode 4 (not on SDC) than when operating in Mode 5 (see Figure 2); risk associated with SDC operation is avoided. When operating in Mode 4 (not on SDC) there are more mitigation systems (e.g., HPI and EFW/AFW) available to respond to lEs that could challenge RCS inventory or decay heat removal, than when operating in Mode 5.

4.4.5 LCO 3.5.4: Borated Watcr Storage Tank (BWST)

LCO Operability Statement From STS (see Reference I for exact wording)

The BWST shall be operable, including maintaining boron concentration, water temperature and water volume within limits when in Modes 1, 2, 3, and 4.

DATE: 1/12/04 PAGE -43 DATE: 1/12/04 PAGE - 43

Licensing Working Group Risk Infortned Justflication For LCO End-state Changes Description (the proposed end-state change addresses only the BWST boron concentration)

The BWST supports the ECCS and the RB spray (RBS) system by providing a source of borated water for ECCS and containment spray pump operation. The BWST supplies two ECCS trains, each by a separate, redundant supply header. Each header also supplies one train of RBS. A normally open, motor operated isolation valve is provided in each header to allow the operator to isolate the BWST from the ECCS after the ECCS pump suction has been transferred to the containment sump following depletion of the BWST during a LOCA. The ECCS and RBS are provided with recirculation lines that ensure each pump can maintain minimum flow requirements when operating at shutoff head conditions. This LCO ensures that:

a.

The BWST contains sufficient borated water to support the ECCS during the injection

phase,

b.

Sufficient water volume exists in the containment sump to support continued operation of the ECCS and containment spray pumps at the time of transfer to the recirculation mode of cooling, and

c.

The reactor remains subcritical following a LOCA.

Insufficient water inventory in the BWST could result in insufficient cooling capacity of the ECCS when the transfer to the recirculation mode occurs. Improper boron concentrations could result in a reduction of SDM or excessive boric acid precipitation in the core following a LOCA, as well as excessive caustic stress corrosion of mechanical components and systems inside containment.

Current and Proposed LCO End-state Current End-state:

This proposed end-state change is associated with LCO 3.5.4 Condition C, Required Action C.2.

Specifically, if boron concentration is not within limits for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, then Mode 3 is prescribed within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

Proposed End-state:

The end-state associated with Required Action C.2, as it relates to the boron concentration requirement of this LCO, is being proposed to be changed from Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> to Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. No change is being proposed for the water temperature requirement of the LCO. The end-state associated with existing C.2 is proposed to be changed as follows:

1. Split existing Condition A into two conditions (A and C) such that boron concentration and water temperature are addressed separately, i.e., Condition A would address boron concentration and Condition C would address water temperature. In either case the Required Action, i.e., A.l and C.1, would be to restore the BWST to operable status within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

DATE: 1/12/04 PAGE -44 DATE: 1/12/04 PAGE - 44

Licensing Working Group Risk Inforied Justification For LCO End-state Changes

2. A new Condition B would address boron concentration not within limits and the Required Action and associated Completion Time not met. Required Action B. would be to be in Mode 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and B.2 would be to be in Mode 4 in 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

3. Existing Condition B would be renamed Condition D and would address BWST inoperable for reasons other than Conditions A and C with a Required Action B.1 to restore the BWST to operable status within I hour.

4. Existing Condition C wvould be renamed Condition E and would address Required Action and associated Completion Time for Conditions other than Condition A not met. It would have the Required Action to be in Mode 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

For clarification purposes, the foregoing proposed LCO change is presented in the following table:

CONDITIONS REQUIRED ACTION COMPLETION TIME A. BWST boron A.1 Restore BWST to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> concentration not within OPERABLE status.

limits B. Required Action and BI Be in MODE 3.

6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> associated Completion Time not mct.

AND B.2 Be in MODE 4.

12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> C. BWST water temperature C.

Restore BWST to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> not within limits.

OPERABLE status.

D. BWST inoperable for D.l Restore BWST to I hour reasons other than OPERABLE status Conditions A and C.

E.

Required Action and E.A Be in Mode 3.

6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> associated Completion Time not met.

AND E.2 Be in Mode 5 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> Basis For Proposed End-state The limit for minimum boron concentration in the BWST was established to ensure that, following a DBA LBLOCA, with a minimum BWST level, the reactor will remain shutdown in the cold condition following mixing of the BWST and RCS water volumes. LBLOCA accident analyses assume that all control rods remain withdrawn from the core. When operating in Mode 4, the control rods will either be inserted or the regulating rod groups will be inserted with DATE: 1/12/04 PAGE-45 DATE: 1/12/04 PAGE - 45

Licensing Working Group Risk Informed Justification For LCO End-state Changes one or more of the safety rod groups cocked and armed for automatic RPS insertion. Hence, all rods vill not be out should an IE occur. Also, given the highly unlikely possibility of a LBLOCA occurring, it can be assumed all control rods will be inserted should an IE occur while in Mode 4. This provides for the reactor shutdown margin to be very conservative, i.e., in excess of approximately -9.0% 8k/k. For these reasons, and the assumptions that a) deviations in boron concentration will be relatively slow and small and that b) boric acid addition systems would normally be available (can be powered by [onsite standby power sources]), the proposed LCO change is considered acceptable.

4.4.6 LCO 3.6.1: Containment LCO Operability Statement From STS (see Reference I for exact wording)

Containment shall be operable in Modes, 2, 3 and 4.

Description The containment consists of the concrete reactor building (RB), its steel liner, and the penetrations through this structure. The structure is designed to contain radioactive material that may be released from the reactor core following a design basis LOCA. Additionally, this structure provides shielding from the fission products that may be present in the containment atmosphere following accident conditions.

The containment is a reinforced concrete structure with a cylindrical wall, a flat foundation mat, and a shallow dome roof. For containments with ungrouted tendons, the cylinder wall is prestressed with a post tensioning system in the vertical and horizontal directions, and the dome roof is prestressed using a three way post tensioning system. The inside surface of the containment is lined with a carbon steel liner to ensure a high degree of leak tightness during operating and accident conditions. The concrete RB is required for structural integrity of the containment under DBA conditions. The steel liner and its penetrations establish the leakage limiting boundary of the containment. The isolation devices for the penetrations in the containment boundary are a part of the containment leak tight barrier. To maintain this leak tight barrier:

a. All penetrations required to be closed during accident conditions are either:

1. Capable of being closed by an operable automatic containment isolation system, or

2. Closed by manual valves, blind flanges, or de-activated automatic valves secured in their closed positions, except as provided in LCO 3.6.3, Containment Isolation Valves (Reference 1).

b. Each air lock is operable, except as provided in LCO 3.6.2, Containment Air Locks (Reference 1).

DATE: 1/12/04 PAGE -46 DATE: 1/12/04 PAGE - 46

Licensing Working Group Risk Informed Justification For L CO Eitd-state Ch anges

c. All equipment hatches are closed, and,

d. The pressurized sealing mechanism associated with each penetration, except as provided in LCO 3.6.[ ] (Reference 1), is operable.

The design basis for the containment is that the containment must withstand the pressures and temperatures of the limiting DBA without exceeding the design leakage rate. The DBAs that result in a challenge to containment operability from high pressures and temperatures are LOCA, SLB and a rod ejection accident (REA). In addition, release of significant fission product radioactivity within containment can occur from a LOCA or REA. In the DBA analyses, it is assumed that the containment is operable such that, for the DBAs involving release of fission product radioactivity, release to the environment is controlled by the rate of containment leakage.

The containment was designed with an allowable leakage rate of [0.25]% of containment air weight per day. This leakage rate, used in the evaluation of offsite doses resulting from accidents, is defined as La: the maximum allowable leakage rate at the calculated maximum peak containment pressure (Pa) resulting from the limiting design basis LOCA. The allowable leakage rate represented by L., forms the basis for the acceptance criteria imposed on all containment leakage rate testing. La is assumed to be [0.25]% per day in the safety analyses at Pa = [53.9] PSIG. Satisfactory leakage rate test results are a requirement for the establishment of containment operability.

Current and Proposed End-state Current End-state:

This proposed end-state change is associated with LCO 3.6.1 Condition B, Required Action B.2.

Specifically, if containment is not operable for 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, then Mode 3 is prescribed within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

Proposed End-state:

The end-state associated with Required Action B.2 of this LCO is being proposed to be changed from Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> to Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

Assumed Limitations:

The proposed end-state assumes the equipment hatch will remain closed while in Mode 4.

Basis For Proposed End-statel Since the plant is assumed operating in Mode 4, the release of stored energy to the RB would be only that associated with decay heat energy and energy stored in the RCS components. That is, over 95% of the energy assumed to be released to the RB during the DBA LOCA is associated 3 The basis discussion for LCO 3.6.1 is generally applicable to the "Basis ForProposed End-state" for LCOs 3.6.1, 3.6.2, 3.6.3, 3.6.4, 3.6.5 and 3.6.6.

DATE: 1/12/04 PAGE-47 DATE:

/12/04 PAGE - 47

Licensing Working Group Risk Informed Justification For LCO End-state Changes with the core thermal power resulting from 100% full power. Since the reactor is already shutdown, such a thermal release to the RB is not possible; only a small fraction of this energy could be released. Occurrence of the DBA, a 28 inch cold leg guillotine break at a RCP discharge, is considered to be very unlikely to occur at anytime much less while operating in Modes 4. Indeed, the occurrence of a LOCA of any kind during operation in this Mode is considered highly unlikely. In addition, redundant RBS and RB cooling systems are available to control and maintain RB pressure well below the design limit. Relative to containment isolation, each process line has redundant isolation that can be implemented manually from the MCR andlor locally such that each process line, including air locks, can be isolated.

The redundant RBS and RB cooling systems will be available to ensure that containment pressure remains low should a LOCA occur. Because the energy that can be released to the RB when operating in Mode 4 is only a fraction of that associated with a DBA, RB pressure will be only slightly higher should a LOCA occur when operating in Mode 4 as compared to when operating in Mode 5. Also, assuming a RB breach that would cause La at DBA conditions exists (triggering plant shutdown in accordance with this LCO), it would produce RB leakage flow rates considerably less than L3 12 when operating in Mode 4 with occurrence of a LOCA. For these reasons, and because significant radionuclide decay has occurred, (i.e., because the plant has been shutdown), no increase in LERF is expected.

Plant risk is lower when operating in Mode 4 (not on SDC) than when operating in Mode 5; risk associated with SDC operation is avoided. When operating in Mode 4 (not on SDC) there are more mitigation systems (e.g., HPI and EFW/AFW) available to respond to Es that could challenge RCS inventory or decay heat removal, than when operating in Mode 5.

Due to reduced RCS pressures when operating in Mode 4, especially at the lower end of Mode 4, the likelihood of occurrence of a LOCA is very small, i.e., LOCA IE frequencies arc reduced compared to at-power operation. Hence, the probability of occurrence of a LOCA is decreased while the consequence of such an event is not increased.

When operating in Mode 4 the potential for the transfer of energy from the reactor system to containment is reduced from that associated with DBAs (100% full power initial conditions) by at least two magnitudes, i.e., EO (1.0 full power for DBA) to < 5E-2 (< 0.05 full power for Mode 4). For this reason, the containment pressure associated with Es that transfer energy to containment during such occurrences, while operating in Mode 4, is only a small fraction of that associated with the DBAs for which containment is designed. Thus, challenges to containment control systems, i.e., containment spray, containment cooling and containment isolation systems, are greatly reduced from the DBA situation for which these systems are designed.

For these reasons, and because significant radionuclide decay would have occurred since reactor shutdown, fission product release including that associated with L RB leakage would be less than that associated with DBAs. Hence, no increase in LERF is expected.

12 For example, assuming a LOCA occurred in Mode 4 causing RB pressure to rise 10 5 PSIG, then the RB leak rate would be < L, by approximately a factor of 3.5.

DATE: 1/12/04 PAGE-48 DATE: 1/12/04 PAGE - 48

Licensing Working Group Risk Informed Jutstification For LCO End-state Changes 4.4.7 LCO 3.6.2: Containment Air Locks LCO Operability Statement From STS (see Reference I for exact wording)

[Two] containment air lock[s] shall be operable in Modes 1, 2, 3, and 4.

Description Each containment air lock forms part of the containment pressure boundary. As a part of the containment pressure boundary, the air lock safety function is related to control of the containment leakage rate resulting from a DBA. Thus, each air lock's structural integrity and leak tightness are essential to the successful mitigation of such an event. Each air lock is required to be operable. For the air lock to be considered operable, the air lock interlock mechanism must be operable, the air lock must be in compliance with appropriate air lock leakage tests, and both air lock doors must be operable. The interlock allows only one air lock door of an air lock to be opened at one time. This provision ensures that a gross breach of containment does not exist when containment is required to be operable. Closure of a single door in each air lock is sufficient to provide a leak tight barrier following postulated events.

Nevertheless, both doors are kept closed when the air lock is not being used for normal entry into or exit from containment.

Current and Proposed End-state Current End-state:

This proposed end-state change is associated with LCO 3.6.2 Condition D, Required Action D.2.

Specifically, if one or more containment air locks are inoperable for reasons other than condition A or B, then restore the air lock to operable within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or Mode 3 is prescribed within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

Proposed End-state:

The end-state associated with Required Action D.2 of this LCO is being proposed to be changed from Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> to Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

Basis For Proposed End-state (see Footnote 11)

The energy that can be released to the RB when operating in Mode 4 is only a fraction of that associated with a DBA, thus RB pressure will be only slightly higher should a LOCA occur when operating in Mode 4 as compared to when operating in Mode 5. Required Action C.2 requires at least one air lock door to be closed, which combined with reduced RB pressure should result in small containment air lock leakage. Also, significant radionuclide decay will have occurred, i.e., due to plant shutdown. For these reasons, no increase in LERF is expected.

In the unlikely event that at least one door cannot be closed, evaluation of the effect on plant risk DATE: 1/12/04 PAGE -49 DLATE: 1/12/04 PAGE - 49

Licensing Working Group Risk informed Justificatio,: For LCO End-state Changes and implementation of any required compensatory measures will be accomplished in accordance with 10 CFR 50.65, i.e., the "Maintenance Rule."

Plant risk is lower when operating in Mode 4 (not on SDC) than when operating in Mode 5 (see Figure 2) and there are more mitigation systems (e.g., HPI and EFW/AFW) available to respond Es that could challenge RCS inventory or decay heat removal. Also, the likelihood of occurrence of a LOCA is very remote, thus the probability of occurrence of a LOCA is decreased while the consequence of such and event is not increased.

4.4.8 LCO 3.6.3: Containment Isolation Valves (CIX's)

LCO Operability Statement From STS (see Reference I for exact wording)

Each containment isolation valve shall be operable in Modes 1, 2, 3 and 4.

Description The containment isolation valves form part of the containment pressure boundary and provide a means for fluid penetrations not serving accident consequence limiting systems to be provided with two isolation barriers that are closed on an automatic isolation signal. These isolation devices consist of either passive devices or active (automatic) devices. Two barriers in series are provided for each penetration so that no single credible failure or malfunction of an active component can result in a loss of isolation or leakage that exceeds limits assumed in the safety analyses. One of these barriers may be a closed system. These barriers (typically containment isolation valves) make up the Containment Isolation System.

Containment isolation occurs upon receipt of a high containment pressure or diverse containment isolation signal. The containment isolation signal closes automatic containment isolation valves in fluid penetrations not required for operation of ESF systems to prevent leakage of radioactive material. Upon actuation of HPI, automatic containment valves also isolate systems not required for containment or RCS heat removal. Other penetrations are isolated by the use of valves in the closed position or blind flanges. As a result, the containment isolation valves (and blind flanges) help ensure that the containment atmosphere will be isolated in the event of a release of radioactive material to containment atmosphere from the RCS following a DBA. Operability of the containment isolation valves (and blind flanges) supports containment operability during accident conditions. The operability requirements for containment isolation valves help ensure that containment is isolated within the time limits assumed for DBAs in the safety analysis.

The RB Purge system is part of the RB Ventilation system. The RB purge system was designed for intennittent operation, providing a means of removing airborne radioactivity caused by minor leakage from the RCS prior to personnel entry into containment. The RB purge system consists of one [48] inch line for exhaust and one [48] inch line for supply. The containment purge supply and exhaust lines each contain two isolation valves that receive an isolation signal on a unit vent high radiation condition. Failure of the purge valves to close following a design basis event would cause a significant increase in the radioactive release because of the large DATE

1/12/04 PAGE-SO DATE: 1/12/04 PAGE - 50

Licensing Working Group Risk Informed Justification For LCO End-state Changes containment leakage path introduced by these [48] inch purge lines. Failure of the purge valvcs to close would result in leakage considerably in excess of the containment design leakage rate of

[0.25]% of containment air weight per day (La). Because of their large size, the [483 inch purge valves in some units are not qualified for automatic closure from their open position under DBA conditions. Therefore, the [48] inch purge valves are maintained sealed closed in Modes 1, 2, 3, and 4 to ensure the containment boundary is maintained.

Current and Proposed End-state Current End-state:

This proposed end-state change is associated with LCO 3.6.3 Condition E, Required Action E.2.

Specifically, if the required action and associated completion time cannot be met for penetration flow paths with inoperable isolation valves or RB purge valve leakage limits (Conditions A, B, C and Required Actions A.1, A.2, B.1, C.] and C.2), then Mode 3 is prescribed within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

Proposed End-state:

The end-state associated with Required Action E.2 of this LCO is being proposed to be changed from Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> to Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

Basis For Proposed End-state (see Footnote 11)

Plant risk is lower when operating in Mode 4 (not on SDC) than when operating in Mode 5 (see Figure 2); risk associated with SDC operation is avoided.

When operating in Mode 4 (not on SDC) there are more mitigation systems available to respond to Es that could challenge RCS inventory or decay heat removal, than when operating in Mode 5.

The redundant RBS and RB cooling systems will be available to ensure that containment pressure remains low should a LOCA occur. Because the energy that can be released to the RB when operating in Mode 4 is only a fraction of that associated with a DBA, RB pressure will be only slightly higher should a LOCA occur when operating in Mode 4 as compared to when operating in Mode 5. For these reasons, containment leakage associated with CIVs is small and significant radionuclide decay will have occurred, (i.e., because the plant has been shutdown), no increase in LERF is expected.

Due to reduced RCS pressures when operating in Mode 4, especially toward the lower end of Mode 4, the likelihood of occurrence of a LOCA is very small, i.e., LOCA IE frequencies are reduced compared to at-powcr operation. The probability of occurrence of a LOCA is decreased while the consequence of such and event is not increased.

DATE: 1/12/04 PAGE - 51

Licensing Working Group Risk Informed Justification For LCO End-state Changes 4.4.9 LCO 3.6.4: Containment Air Pressure LCO Operability Statement From STS (see Reference I for exact wording)

Containment pressure shall be 2 [-2.0] PSIG and

[+3.0] PSIG in Modes 1, 2, 3 and 4.

Description The containment pressure is limited during normal operation to preserve the initial conditions assumed in the accident analyses for a LOCA or steam SLB. These limits also prevent the containment pressure from exceeding the containment design negative pressure differential with respect to the outside atmosphere in the event of inadvertent actuation of the RB Spray system.

Containment internal pressure is an initial condition used in the DBA analyses to establish the maximum peak containment internal pressure. The worst case LOCA generates larger mass and energy release than the worst case SLB. Thus, the LOCA event bounds the SLB event from the containment peak pressure standpoint. The initial pressure condition used in the containment analysis was [17.7] psia ([3.0] PSIG). This resulted in a maximum peak pressure from a LOCA of [53.9] PSIG. The LCO limit of [3.0] PSIG ensures that, in the event of an accident, the design pressure of [55] PSIG for containment is not exceeded. In addition, the building was designed for an internal pressure equal to [3] PSIG above external pressure during a tornado. The containment was also designed for an internal pressure equal to [2.5] PSIG below external pressure, to withstand the resultant pressure drop from an accidental actuation of the RB Spray system. The LCO limit of [-2.0] PSIG ensures that operation within the design limit of

[-2.5] PSIG is maintained.

Maintaining containment pressure less than or equal to the LCO upper pressure limit ensures that, in the event of a DBA, the resultant peak containment accident pressure will remain below the containment design pressure. Maintaining containment pressure greater than or equal to the LCO lower pressure limit ensures that the containment will not exceed the design negative differential pressure following the inadvertent actuation of the RB Spray system.

Current and Proposed End-state Current End-state:

This proposed end-state change is associated with LCO 3.6.4 Condition B, Required Action B.2.

Specifically, if containment pressure exceeds the limit and cannot be restored within one hour, then Mode 3 is prescribed within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

Proposed End-state:

The end-state associated with Required Action B.2 of this LCO is being proposed to be changed from Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> to Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

DATE: 1/12/04 PAGE-52 DATE: 112/04 PAGE - 52

f Licensing Working Group Risk Informed Justification For LCO End-state Ch anges Basis For Proposed End-state (see Footnote 1)

The redundant RBS and RB cooling systems will be available to ensure that containment pressure remains low should a LOCA occur. Because the energy that can be released to the RB when operating in Mode 4 is only a fraction of that associated with a DBA, RB pressure will be only slightly higher should a LOCA occur when operating in Mode 4 as compared to when operating in Mode 5. In such a situation, the margin to the RB design pressure3 will be large, i.e., on the order of several tens of PSI. Also, the occurrence of a LOCA of any kind during operation in Mode 4 is considered highly unlikely. Because of this and the occurrence of significant radionuclide decay (i.e., the plant has been shutdown), no increase in LERF is expected should the LCO for high containment pressure be invoked while in Mode 4. This is especially germane considering that operations personnel will commence actions to restore RB pressure to within the limit immediately upon notification that it has exceeded the limit.

RB vacuum conditions will not compromise containment integrity of large dry containments either pre-stressed or reinforced concrete designs. One plant has a steel containment configuration fitted with a vacuum breaker to mitigate vacuum conditions. The risk associated with Mode 4 operation and RB pressure below the LCO low pressure limit coincident with inadvertent RB spray actuation is considered to be so low as to be inconsequential (A search of available data bases found no record of this situation having occurred to date at any B&W design plants). Also, operations personnel will commence actions to restore RB pressure to within the limit on notification that it has exceeded the limit.

Plant risk is lower when operating in Mode 4 (not on SDC) than when operating in Mode 5 (see Figure 2); risk associated with SDC operation is avoided. Also, when operating in Mode 4 (not on SDC) there are more mitigation systems (e.g., HPI and EFW/AFW) available to respond to an IE that could challenge RCS inventory or decay heat removal, than when operating in Mode 5.

These considerations ultimately lead to reduced challenges to the RB when operating in Mode 4 versus Mode 5.

4.4.10 LCO3.6.5: ContainmentAirTemperaturc LCO Operability Statement From STS (see Reference I for exact wording)

Containment average air temperature shall be < [130]0F in Modes, 2, 3 and 4.

Description The containment average air temperature is limited during normal operation to preserve the initial conditions assumed in the accident analyses for a LOCA or SLB. The containment average air temperature limit is derived from the input conditions used in the containment functional analyses and the containment structure external pressure analysis. This LCO ensures that initial conditions assumed in the analysis of a DBA are not violated during unit operations.

" It is worth noting that the mean failure pressure for large dry containments is typically somewhat greater than a factor of 2 above the design pressure.

DATE: 1/12/04 PAGE-53 DATE: 1/12/04 PAGE - 53

Licensing Working Group Risk Inforned Justification For LCO End-state Changes The total amount of energy to be removed from the RB Cooling system during post accident conditions is dependent upon the energy released to the containment due to the event as well as the initial containment temperature and pressure. The higher the initial temperature, the higher the resultant peak containment pressure and temperature. Exceeding containment design pressure may result in leakage greater than that assumed in the accident analysis. Operation with containment temperature in excess of the LCO limit violates an initial condition assumed in the accident analysis. The limit for containment average air temperature ensures that operation is maintained within the assumptions used in the DBA analysis for containment; LOCA results in the greatest sustained increase in containment temperature. By maintaining containment air temperature at less than the initial temperature assumed in the LOCA analysis, the reactor building design condition will not be exceeded. As a result, the ability of containment to perform its design function is ensured.

Current and Proposed End-state Current End-state:

This proposed end-state change is associated with LCO 3.6.5 Condition B, Required Action B.2.

Specifically, if containment air temperature exceeds the limit and cannot be restored within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, then Mode 3 is prescribed within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

Proposed End-state:

The end-state associated with Required Action B.2 of this LCO is being proposed to be changed from Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> to Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

Basis For Proposed End-state (see Footnote 1 1)

The redundant RBS and RB cooling systems will be available to ensure that containment temperature remains low should a LOCA occur. Because the energy that can be released to the RB when operating in Mode 4 is only a fraction of that associated with a DBA, the attendant RB temperature (and associated pressure) rise will be well below that associated with a DBA. Also, the occurrence of a LOCA of any kind during operation in Mode 4 is considered highly unlikely.

For these reasons and because of the occurrence of significant radionuclide decay (i.e., the plant has been shutdown), no increase in LERF is expected.

Plant risk is lower when operating in Mode 4 (not on SDC) than when operating in Mode 5 (see Figure 2); risk associated with SDC operation is avoided. Also, when operating in Mode 4 (not on SDC) there are more mitigation systems (e.g., HPI and EFV/AFW) available to respond to an IE that could challenge RCS inventory or decay heat removal, than when operating in Mode 5.

These considerations ultimately lead to reduced challenges to the RB when operating in Mode 4 versus Mode 5.

DATE: 1/12/04 PAGE - 54

Licensing Working Group Risk Informed Justification For LCO End-state Ch anges 4.4.11 LCO 3.6.6: Containment Spray and Cooling LCO Operability Statement From STS (see Reference I for exact wording)

Two containment spray trains and two containment cooling trains shall be operable in Modes 1, 2, 3 and 4.

Description The containment spray and cooling systems provide containment atmosphere cooling to limit post accident pressure and temperature in containment to less than the design values. Reduction of containment pressure and the iodine removal capability of the spray reduces the release of fission product radioactivity from containment to the environment, in the event of a DBA, to within limits. The containment spray and cooling systems are ESF systems. They are designed to ensure that the heat removal capability required during the post accident period can be attained and provide redundant means to limit and maintain post accident conditions to less than the containment design values.

The containment spray system consists of two separate trains of equal capacity, each capable of meeting the design basis. Each train includes a containment spray pump, spray headers, nozzles, valves, and piping. Each train is powered from a separate ESF bus. The BWST supplies borated water during the injection phase of operation. In the recirculation mode of operation, the containment spray pump suction is manually transferred from the BWST to the containment sump. The containment spray system provides a spray of relatively cold borated water mixed with sodium hydroxide from the spray additive tank into the upper regions of containment to reduce the containment pressure and temperature and to reduce the concentration of fission products in the containment atmosphere during a DBA. In the recirculation mode of operation, heat is removed from the containment sump water by the DHR coolers. Each train of the containment spray system provides adequate spray coverage to meet the system design requirements for containment heat removal. The containment spray system is actuated automatically by a containment high-high pressure signal coincident with a containment high pressure signaf and a low pressure injection signal. An automatic actuation opens the pump discharge valves and starts the two spray pumps.

The containment cooling system consists of three containment cooling trains connected to a common duct suction header with four vertical return air ducts. Each cooling train is equipped with demisters, cooling coils, and an axial flow fan driven by a two speed water cooled electric motor. Each unit connection (two per unit) to the common header is provided with a backpressure damper for isolation purposes. During normal operation, two containment cooling trains are required to operate. The third unit is on standby and isolated from the operating units by means of the backpressure dampers. The swing unit is equipped with a transfer switch. It can be manually placed to either the "A" or "B" power train to operate in case one of the operating units fails. Upon receipt of an emergency signal, the two operating cooling fans running at high speed will automatically stop. The two cooling unit fans connected to the ESF buses will automatically restart and run at low speed, provided normal or emergency power is available; DATE: 1/12/04 PAGE-55 DATE: 1/12104 PAGE - 55

Licensing Working Group Risk Informed Justifcation For LCO End-state Ch:anges operation at the lower speed during accident conditions prevents motor overload due to higher density atmosphere.

The containment spray cooling systems limit the temperature and pressure that could be experienced following a DBA. The limiting DBAs considered are a LOCA and SLB. The postulated DBAs are analyzed, with regard to containment ESF systems, assuming the loss of one ESF bus. This is the worst-case single active failure, resulting in one train of containment spray and one train of containment cooling being inoperable. The analysis and evaluation show that, under the worst-case scenario, the highest peak containment pressure is [53.9] PSIG (experienced during a LOCA). The analysis shows that the peak containment temperature is

[276]0 F (experienced during a LOCA). Both results are less than the design values. The analyses and evaluations assume a power level of [2568] MWt, one containment spray train and one containment cooling train operating, and initial (pre-accident) conditions of [130]°1; and

[17.7] psia.

During a DBA, a minimum of one containment cooling train and one containment spray train are required to maintain the containment peak pressure and temperature below the design limits.

Additionally, one containment spray train is required to remove iodine from the containment atmosphere and maintain concentrations below those assumed in the safety analysis. To ensure that these requirements are met, two containment spray trains and two containment cooling units must be operable. Therefore, in the event of an accident, the minimum requirements are met, assuming the worst-case single active failure occurs.

Current and Proposed End-state Current End-state:

This proposed end-state change is associated with LCO 3.6.6 Condition B, Required Action B.2 (containment spray system) and Condition E, Required Action E.2 (containment cooling system).

Specifically:

Containment Spray System If one containment spray train is inoperable and cannot be restored within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or within 10 days of discovery of failure to meet the LCO, then Mode 3 is prescribed within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Mode 5 within 84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br />.

Containment Cooling System If two containment cooling trains are inoperable and cannot be restored within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, then Mode 3 is prescribed within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

DATE: 1/12/04 PAGE-56 DATE: 112/04 PAGE -

6

Licensing Working Group Risk Informed Justifcation For LCO End-state Changes Proposed End-state:

Containment Spray System The cnd-state associated with Required Action B.2 of this LCO is being proposed to be changed from Mode 5 within 84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br /> to Mode 4 within 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br />.

Containment Cooling System The end-state associated with Required Action E.2 of this LCO is being proposed to be changed from Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> to Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

Basis For Proposed End-state (see Footnote I 1)

Since the plant is assumed operating in Mode 4, the release of stored energy to the RB would be only that associated with decay heat energy and energy stored in the RCS components. That is, over 95% of the energy assumed to be released to the RB during the DBA LOCA is associated with the core thermal power resulting from 100% full power. Since the reactor is already shutdown, such a thermal release to the RB is not possible; only a small fraction of this energy could be released. Occurrence of the DBA, a 28 inch cold leg guillotine break at a RCP discharge, is considered to be very unlikely to occur at anytime much less while operating in Modes 4. Indeed, the occurrence of a LOCA of any kind during operation in this Mode is considered highly unlikely. Due to the redundancy of the containment spray and cooling systems, both their functions are available to control and maintain RB pressure well below the design limit; the function to remove radioactive iodine from the containment atmosphere will also be available.

Because the energy that can be released to the RB when operating in Mode 4 is only a fraction of that associated with a DBA, RB pressure wvill be only slightly higher should a LOCA occur when operating in Mode 4 as compared to when operating in Mode 5. For these reasons, containment leakage is small and because significant radionuclide decay will have occurred, (i.e., because the plant has been shutdown), no increase in LERF is expected.

Plant risk is lower when operating in Mode 4 (not on SDC) than when operating in Mode 5 (see Figure 2); risk associated with SDC operation is avoided. Also, when operating in Mode 4 (not on SDC) there are more mitigation systems (e.g., HPI and EFW/AFW) available to respond to an IE that could challenge RCS inventory or decay heat removal, than when operating in Mode 5.

These considerations ultimately lead to reduced challenges to the containment spray and cooling systems when operating in Mode 4 versus Mode 5.

4.4.12 LCO 3.7.7: Component Cooling Water (CCW) System LCO Onerability Statement From STS (see Reference I for exact wording)

Two CCW trains shall be operable in Modes 1, 2, 3 and 4.

DATE: 1/12/04 PAGE-57 DATE:

/12/04 PAGE - 57

Licensing Working Group Risk Informed Justification For LCO End-state Changes Description The CCW System provides a heat sink for the removal of process and operating heat from safety related components during a DBA or transient. The CCW System serves as a barrier to the release of radioactive byproducts between potentially radioactive systems and the SWS, and thus to the environment.

A typical CCW System is arranged as two independent full capacity cooling loops, and has isolable non-safety related components. The pump in each train is automatically started on receipt of an ESFAS actuation signal, and all nonessential components are isolated. The design basis of the CCW System is to provide cooling water to the ECCS and [onsite standby power sources] during DBA conditions. The CCW System also supplies cooling water to [onsite standby power sources) during a loss of offsite power. The CCW System is designed to perform its function with a single failure of any active component assuming a loss of offsite power.

Depending on plant specific designs, the CCW system may also function to cool the unit from

[DHR] entry conditions (Tcold < [350]'F) to MODE 5 (Tc,,d < [200]0F) during normal and post accident operations.

The CCW trains are independent of each other to the degree that each has separate controls and power supplies and the operation of one train does not depend on the other. In the event of a design basis LOCA, one train of CCW is required to provide the minimum heat removal capability assumed in the safety analysis for systems to which it supplies cooling water. To ensure this is met, two CCW trains must be operable. At least one CCW train will operate assuming the worst case single active failure occurs coincident with loss of offsite power.

Current and Proposed End-state Current End-state:

This proposed cnd-state change is associated with LCO 3.7.7 Condition B, Required Action B.2.

Specifically, if a CCW train becomes inoperable and cannot be restored within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, then Mode 3 is prescribed within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

Proposed End-state:

The end-state associated with Required Action B.2 of this LCO is being proposed to be changed from Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> to Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

Basis For Proposed End-state Since the plant is assumed operating in Mode 4, the stored energy of the reactor system would be only that associated with reduced decay heat energy and energy stored in the RCS components.

Because of this, heat loads on the CCW system will be greatly reduced from those associated with the DBA, i.e., a LOCA. Also, occurrence of a design bases LOCA is considered to be very unlikely to occur at anytime much less while operating in Mode 4. Indeed, the occurrence of a LOCA of any kind during operation in this Mode is considered highly unlikely.

DATE: 1/12/04 PAGE-58 DATE: 1/12/04 PMAGE - 58

Licensing Working Group Risk Intforined Justification For LCO End-state Changes Plant risk is lower when operating in Modc 4 (not on SDC) than when operating in Mode 5 (see Figure 2); risk associated with SDC operation is avoided. Also, when operating in Modc 4 (not on SDC) there are more mitigation systems (e.g., HPI and EFW/AFW) available to respond to an IE that could challenge RCS inventory or decay heat removal, than when operating in Mode 5.

These considerations ultimately lead to reduced challenges to the CCW system when operating in Mode 4 versus Mode 5.

4.4.13 LCO 3.7.8: Service Water System (SWS)

LCO Operability Statement From STS (see Reference 1 for exact wording)

Two SWS trains shall be operable in Modes 1,2,3 and 4.

Description The SWS provides a heat sink for the removal of process and operating heat from safety related components during a DBA or transient. During normal operation and normal shutdown, the SWS also provides this function for various safety related and non-safety related components.

The safety related position is covered by this LCO.

An SWS consists of two separate, 100% capacity safety related cooling water trains. The pumps are automatically started upon receipt of a ESFAS signal, and all essential valves are aligned to their post accident positions. The SWS also provides cooling directly to the CREVS water cooled condensing unit, the ECCS pump room coolers, containment air cooler, and turbine driven cooling water systems. The system provides cooling for, and is also a source of water to, the EFW pumps.

The design basis of the SWS is for one SWS train, in conjunction with the CCW system and a 100% capacity containment cooling system, (containment spray, containment air coolers, or a combination) to remove core decay heat following a design basis LOCA. The SWS is designed to perform its function with a single failure of any active component, assuming loss of offsite power. Depending on plant specific designs, the SWS, in conjunction with the CCW System, may also cool the unit from [DHR] entry conditions to Mode 5 during normal and emergency conditions.

Two SWS trains are required to be operable to provide the required redundancy to ensure that the system functions to remove post accident heat loads, assuming the worst case single active failure occurs coincident with the loss of offsite power.

DATE: 1/12/04 PAGE -59 DATE: 1/12/04 PAGE - 59

Licensing Working Group Risk Inifortned Justification For LCO End-state Changes Current and Proposed End-state Current End-state:

This proposed end-state change is associated with LCO 3.7.8 Condition B, Required Action B.2.

Specifically, if an SWS train becomes inoperable and cannot be restored within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, then Mode 3 is prescribed within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

Proposed End-state:

The end-state associated with Required Action B.2 of this LCO is being proposed to be changed from Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> to Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

Basis For Proposed End-state Since the plant is assumed operating in Mode 4, the stored energy of the reactor system would be only that associated with reduced decay heat energy and energy stored in the RCS components.

Because of this, heat loads on the SWS will be greatly reduced from those associated with the DBA, i.e., a LOCA. Also, occurrence of a design bases LOCA is considered to be very unlikely to occur at anytime much less while operating in Mode 4. Indeed, the occurrence of a LOCA of any kind during operation in this Mode is considered highly unlikely.

Plant risk is lower when operating in Mode 4 (not on SDC) than when operating in Mode 5 (see Figure 2); risk associated with SDC operation is avoided. Also, when operating in Mode 4 (not on SDC) there are more mitigation systems (e.g., HPI and EFW/AFW) available to respond to an IE that could challenge RCS inventory or decay heat removal, than when operating in Mode 5.

These considerations ultimately lead to reduced challenges to the SWS when operating in Mode 4 versus Mode 5.

4.4.14 LCO 3.7.9: Ultimate Heat Sink (UHS)

LCO Operability Statement From STS (see Reference I for exact wording)

The UHS shall be operable in Modes 1, 2, 3 and 4.

Description The UIHS provides a heat sink for process and operating heat from safety related components during a transient or accident as well as during normal operation. This is done utilizing the SWS. The UHS has been defined as that complex of water sources, including necessary retaining structures (e.g., a pond with its dam, or a river with its dam), and the canals or conduits connecting the sources with, but not including, the cooling water system intake structures. The two principal functions of the UHS are the dissipation of residual heat after a reactor shutdown, and dissipation of residual heat after an accident. The UHS is the sink for heat removal from the reactor core following all accidents and AOs in which the unit is cooled down and placed on DATE: 1/12/04 PAGE -60 DATE: 1/12/04 PAGE - 60

Licensing Working Group Risk Inforned Justifcation For LCO End-state Changes

[D1R]. Its maximum post accident heat load occurs approximately 20 minutes after a design basis LOCA. Near this time, the unit switches from injection to recirculation and the containment cooling systems are required to remove the core decay heat.

The operating limits are based on conservative heat transfer analyses for the worst case LOCA.

The UHS is required to be operable and is considered operable if [it contains a sufficient volume of water at or below the maximum temperature] that would allow the SWS to operate for at least 30 days following the design basis LOCA without the loss of NPSH and without exceeding the maximum design temperature of the equipment served by the SWS.

Current and Proposed End-state Current End-state:

This proposed end-state change is associated with LCO 3.7.9 Condition C, Required Action C.2.

Specifically, if the UHS complex becomes inoperable due to condition A and cannot be restored within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, then Mode 3 is prescribed within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

Proposed End-state:

The end-state associated with Required Action C.2, as it relates to Condition A only, of this LCO is being proposed to be changed from Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> to Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. It is proposed that a new Action B be added, that addresses Condition A only. The Required Action of the new Condition B if Required Action and associated Completion Time of Condition A is not met is proposed to be Mode 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. Existing Condition B would be re-lettered to Condition C and existing Condition C would be re-lettered to Condition D. The first Boolean statement of Condition D would refer only to Condition C.

Basis For Proposed End-state Since the plant is assumed operating in Mode 4, the stored energy of the reactor system would be only that associated with reduced decay heat energy and energy stored in the RCS components.

Because of this, heat loads on the UHS will be greatly reduced from those associated with the DBA, i.e., a LOCA. Also, occurrence of a design bases LOCA is considered to be very unlikely to occur at anytime much less while operating in Mode 4. Indeed, the occurrence of a LOCA of any kind during operation in this Mode is considered highly unlikely.

Plant risk is lower when operating in Mode 4 (not on SDC) than when operating in Mode 5 (see Figure 2); risk associated with SDC operation is avoided. Also, when operating in Mode 4 (not on SDC) there are more mitigation systems (e.g., HPI and EFW/AFW) available to respond to an IE that could challenge RCS inventory or decay heat removal, than when operating in Mode 5.

These considerations ultimately lead to reduced challenges to the UHS when operating in Mode 4 versus Mode 5.

DATE: 1/12/04 PAGE-61 DATE: 1/12/04 PAGE - 61

Licensing Working Group Risk Inform ed Justification For LCO End-state Changes 4.4.15 LCO 3.7.10: Control Room Emergency Ventilation System (CREVS)

LCO Operability Statement From STS (see Reference I for exact wording)

Two CREVS trains shall be operable in Modes 1, 2, 3, and 4, [5, and 6],[During movement of

[recently] irradiated fuel assemblies].

Description The CREVS provides a protected environment from which operators can control the unit following an uncontrolled release of radioactivity, [chemicals, or toxic gas]. The CREVS consists of two independent, redundant, fan filter assemblies. Upon receipt of the activating signal(s), the normal control room ventilation system is automatically shut down and the CREVS can be manually started. The CREVS is designed to maintain the control room for 30 days of continuous occupancy after a DBA without exceeding a 5 rem whole body dose or its equivalent to any part of the body.

The CREVS components are arranged in redundant safety related ventilation trains. The location of components and ducting within the control room envelope ensures an adequate supply of filtered air to all areas requiring access. The CREVS provides airborne radiological protection for the control room operators as demonstrated by the control room accident dose analyses for the most limiting design basis LOCA fission product release. The worst case single active failure of a CREVS component, assuming a loss of offsite power, does not impair the ability of the system to perform its design function.

Two independent and redundant CREVS trains are required to be operable to ensure that at least one is available if a single failure disables the other train. The CREVS is considered operable when the individual components necessary to control operator exposure are operable in both trains. In addition, the control room boundary, including the integrity of the walls, floors, ceilings, ductwork, and access doors, must be maintained within the assumptions of the design analysis. The LCO is modified by a Note allowing the control room boundary to be opened intermittently under administrative controls.

Current and Proposed End-state Current End-state:

This proposed end-state change is associated with LCO 3.7.10 Condition C, Required Action C.2. Specifically, if one train of CREVS becomes inoperable and cannot be restored within 7 days or two CREVS trains become inoperable (due to inoperable control room boundary) and cannot be restored within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, then Mode 3 is prescribed within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

DATE: 1/12/04 PAGE - 62

Licensing Working Group Risk Inform ed Justification For LCO End-state Changes Proposed End-state:

The end-state associated with Required Action C.2 of this LCO is being proposed to be changed from Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> to Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

Basis For Proposed End-state This system would be required in the event the MCR was isolated. Such an isolation would be directly due to an uncontrolled release of radioactivity, [chemicals, or toxic gas]. Uncontrolled release of radioactivity would be associated with a LOCA. A LOCA is considered highly unlikely to occur during Mode 4 operations. This is especially true of operations toward the lower end of Mode 4 while operating on SGs (SDC not in operation). Regardless of the CREVS status, the risks associated with Mode 4 are lower than the Mode 5 operating state (see Section 5.5 and Figure 2). Relative to the uncontrolled release of [chemicals, or toxic gas], this situation is the same as when operating in Mode 5, i.e., frequencies for occurrence of these IEs are the same in Mode 5 as Mode 4.

Plant risk is lower when operating in Mode 4 (not on SDC) than when operating in Mode 5 (see Figure 2); risk associated with SDC operation is avoided. Also, when operating in Mode 4 there are more mitigation systems available to respond to IEs that could challenge RCS inventory or decay heat removal, than when operating in Mode 5. These systems include the HPI system and EFW/AFW systems. These considerations should ultimately lead to reduced challenges to CREVS when operating in Mode 4 versus Mode 5.

4.4.16 LCO 3.7.11: Control Room Emergency Air Temperature System (CREATCS)

LCO Operability Statement From STS (see Reference 1 for exact wvording)

Two CREATCS trains shall be operable in Modes 1, 2, 3, and 4, [5, and 6], [During movement of [recently] irradiated fuel assemblies].

Description The CREATCS provides temperature control for the control room following isolation of the control room. The CREATCS consists of two independent and redundant trains that provide cooling of recirculated control room air. A cooling coil and a water cooled condensing unit are provided for each system to provide suitable temperature conditions in the control room for operating personnel and safety related control equipment. Ductwork, valves or dampers, and instrumentation also form part of the system. Two redundant air cooled condensing units are provided as a backup to the water cooled condensing unit. Both the water cooled and air cooled condensing units must be operable for the CREATCS to be operable. During emergency operation, the CREATCS maintains the temperature between 70'F and 851F. The CREATCS is a subsystem of CREVS providing air temperature control for the control room.

DATE: 1/12/04 PAGE -63 DATE:

/12104 PAGE - 63

Licensing Working Group Risk Informed Justification For LCO End-state Changes The design basis of the CREATCS is to maintain control room temperature for 30 days of continuous occupancy. The CREATCS components are arranged in redundant, safety related trains. Two independent and redundant trains of the CREATCS are required to be operable to ensure that at least one is available, assuming a single failure disables the other train.

Current and Proposed End-state Current End-state:

This proposed end-state change is associated with LCO 3.7.11 Condition B, Required Action B.2. Specifically, if a CREATCS train becomes inoperable and cannot be restored within 30 days, then Mode 3 is prescribed within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

Proposed End-state:

The end-state associated with Required Action B.2 of this LCO is being proposed to be changed from Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> to Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

Basis For Proposed End-state This system is a subsystem of CREVS and would be required in the event the MCR was isolated.

Such an isolation would be directly due to an uncontrolled release of radioactivity, [chemicals, or toxic gas]. Uncontrolled release of radioactivity would be associated with a LOCA. A LOCA is considered highly unlikely to occur during Mode 4 operations. This is especially true of operations toward the lower end of Mode 4 while operating on SGs (SDC not in operation).

Relative to the uncontrolled release of [chemicals, or toxic gas], this situation is the same as when operating in Mode 5, i.e., frequencies for occurrence of these Es are the same in Mode 5 as in Mode 4.

When operating in Mode 4 there are more mitigation systems available to respond to Es that could challenge RCS inventory or decay heat removal, than when operating in Mode 5. These systems include the HPI system and EFW/AFW systems. This should ultimately lead to reduced challenges to CREACTS when operating in Mode 4 versus Mode 5.

Plant risk is lower when operating in Mode 4 (not on SDC) than when operating in Mode 5 (see Figure 2); risk associated with SDC operation is avoided.

4.4.17 LCO 3.8.1: AC Sources - Operating LCO Operability Statement From STS (see Reference for exact wording)

The following AC electrical power sources shall be operable:

a. Two qualified circuits between the offsite transmission network and the onsite Class IE AC Electrical Power Distribution System, DATE: 1/12/04 PAGE -64 DATE: 1/12/04 PAGE - 64

Licensing Working Group Risk Infonned Justification For LCO End-state Changes

b. Two [onsite standby power sources, e.g., emergency diesel generator (EDG) and hydroelectric unit]14 each capable of supplying one train of the onsite Class E AC Electrical Power Distribution System, and

[c. Automatic load sequencers for Train A and Train B.]

Modes 1, 2, 3 and 4.

Description The unit Class I E AC Electrical Power Distribution System AC sources consist of the offsite power sources (preferred power sources, normal and alternate(s)) and the onsite standby power sources (Train A and B)]). The design of the AC electrical power system provides independence and redundancy to ensure an available source of power to the ESF systems. The onsite Class E AC Distribution System is divided into redundant load groups (trains) so that the loss of any one group does not prevent the minimum safety functions from being performed. Each train has connections to two preferred offsite power sources and a single [onsite standby power source].

Offsite power is supplied to the unit switchyard(s) from the transmission network by [two]

transmission lines. From the switchyard(s), two electrically and physically separated circuits provide AC power, through [step down station auxiliary transformers], to the 4.16 kV ESF buses.

Certain required unit loads are returned to service in a predetermined sequence in order to prevent overloading the transformer supplying offsite power to the onsite Class E Distribution System. Within [1] minute after the initiating signal is received, all automatic and permanently connected loads needed to recover the unit or maintain it in a safe condition are returned to service via the load sequencer. The [onsite standby power source] for each 4.16 kV ESF bus is a dedicated to ESF buses. An [onsite standby power source] starts automatically on an ESFAS signal or on an [ESF bus degraded voltage or undervoltage signal]. Afler the [onsite standby power source] has started, it will automatically tie to its respective bus after offsite power is tripped as a consequence of ESF bus undervoltage or degraded voltage, independent of or coincident with a ESFAS signal. The [onsite standby power source] will also start and operate in the standby mode without tying to the ESF bus on an ESFAS signal alone. Following the trip of offsite power, [a sequencer/an undervoltage signal] strips nonpermanent loads from the ESF bus.

When the [onsite standby power source] is tied to the ESF bus, loads are then sequentially connected to its respective ESF bus by the automatic load sequencer. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading the [onsite standby power source] by automatic load application. In the event of a loss of preferred power, the ESF electrical loads are automatically connected to the [onsite standby power sources] in sufficient time to provide for safe reactor shutdown and to mitigate the consequences of a DBA such as a LOCA. Certain required unit loads are returned to service in a predetermined sequence in order to prevent overloading the [onsite standby power source] in the process. Within

[1] minute after the initiating signal is received, all loads needed to recover the unit or maintain it in a safe condition are returned to service.

14 One plant uses redundant fully qualified hydroelectric power sources instead of EDGs.

DATE: 1/12/04 PAGE -65 DATE: 1/12/04 PAGE - 65

Licensing Working Group Risk Informed Justilication For LCO End-state Changes The initial conditions of DBA and transient analyses assume ESF systems are operable. The AC electrical power sources are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded. The operability of the AC electrical power sources is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This results in maintaining at least one train of the onsite or offsite AC sources operable during accident conditions in the event of:

a.

An assumed loss of all offsite power or all onsite AC power and

b.

A worst-case single failure.

Two qualified circuits between the offsite transmission network and the onsite Class IE Electrical Power Distribution System and separate and independent [onsite standby power sources] for each train ensure availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an AOO or a postulated DBA. Each [onsite standby power source] must be capable of starting, accelerating to rated speed and voltage, and connecting to its respective ESF bus on detection of bus undervoltage. This will be accomplished within [10] seconds. Each [onsite standby power source] must also be capable of accepting required loads within the assumed loading sequence intervals, and continue to operate until offsite power can be restored to the ESF buses. Additional [onsite standby power sources]

capabilities must be demonstrated to meet required surveillances, e.g., capability of the [onsite standby power sources] to revert to standby status on an ECCS signal while operating in parallel test mode. The AC sources in one train must be separate and independent (to the extent possible) of the AC sources in the other train. For the [onsite standby power sources], separation and independence are complete. For the offsite AC sources, separation and independence are to the extent practical.

Current and Proposed End-state Current End-state:

This proposed end-state change is associated with LCO 3.8.1 Condition G, Required Action G.2.

Specifically, if the required actions and associated completion times of Condition A, B, C, D, E or F cannot be met, then Mode 3 is prescribed within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

Proposed End-state:

The end-state associated with Required Action G.2 of this LCO is being proposed to be changed from Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> to Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

Basis For Proposed End-state The operability requirements of the AC electrical power sources is predicated on initial assumptions of the accident analyses most notably design basis LOCAs. A design basis LOCA DATE: 1/12/04 PAGE -66 DATE: 1/12/04 PAGE - 66

Licensing Working Group Risk Inforined Justificationr For LCO End-state Changes is considered highly unlikely to occur during at-power operations, much less during Mode 4; indeed, the occurrence of a LOCA of any kind during operation in Mode 4 is considered highly unlikely. This is especially true of operations toward the lower end of Mode 4 while operating on SGs (SDC not in operation).

Plant risk is lower when operating in Mode 4 (not on SDC) than when operating in Mode 5 (see Figure 2); risk associated with SDC operation is avoided. Also, when operating in Mode 4 there are more mitigation systems (e.g., HPI and EFW/AFWV) available to respond to IEs that could challenge RCS inventory or decay heat removal, than when operating in Mode 5. These systems include the HPI system and EFWV/AFW systems. This consideration is particularly germane as it relates to loss of AC power sources because with the SGs operating in Mode 4, TDEFWPs are immediately available with SG pressure of [50 PSIG (- 2981F RCS temperature)]. These considerations ultimately lead to reduced challenges to CDF and LERF when operating in Mode 4 versus operations in Mode 5.

The redundant nature of the AC power sources, including [onsite standby power sources],

provides for availability of AC power even if one source becomes inoperable.

4.4.18 LCO 3.8.4: DC Sources - Operating LCO Operability Statement From STS (see Reference I for exact wording)

The Train A and Train B DC electrical subsystems shall be operable in Modes 1, 2, 3 and 4.

Description The station DC electrical power system provides the AC emergency power system with control power. It also provides both motive and control power to selected safety related equipment and preferred AC vital bus power (via inverters). The DC electrical power system is designed to have sufficient independence, redundancy, and testability to perform its safety functions, assuming a single failure.

The [ 125/250] VDC electrical power system consists of two independent and redundant safety related Class IE DC electrical power subsystems ([Train A and Train B]). Each subsystem consists of [two] 125 VDC batteries [(each battery [50]% capacity)], the associated battery charger[s] for each battery, and all the associated control equipment and interconnecting cabling.

During normal operation, the [125/250] VDC load is powered from the battery chargers with the batteries floating on the system. In case of loss of normal power to the battery charger, the DC load is automatically powered from the station batteries. The [Train A and Train B] DC electrical power subsystems provide the control power for its associated Class IE AC power load group, [4.16] kV switchgear, and [480] V load centers. The DC electrical power subsystems also provide DC electrical power to the inverters, which in turn power the AC vital buses. Each 125/250 VDC battery is separately housed in a ventilated room apart from its charger and distribution centers. Each subsystem is located in an area separated physically and electrically DATE: 1/12/04 PAGE -67 DATE: 1/12/04 PAGE - 67

Licensing Working Group Risk Informed Justficaiot For LCO E nd-state Changes from the other subsystem to ensure that a single failure in one subsystem does not cause a failure in a redundant subsystem. There is no sharing between redundant Class IE subsystems, such as batteries, battery chargers, or distribution panels.

The initial conditions of DBA and transient analyses in the SAR assume that ESF systems are operable. The DC electrical power system provides normal and emergency DC electrical power for the, emergency auxiliaries, [onsite standby power sources] and control and switching during all Modes of operation. The operability of the DC sources is consistent with the initial assumptions of the accident analyses and is based on meeting the design basis of the unit. This includes maintaining the DC sources operable during accident conditions in the event of:

a. An assumed loss of all offsite AC power or all onsite AC power and

b. A worst-case single failure.

Current and Proposed End-state Current End-state:

This proposed end-state change is associated with LCO 3.8.4 Condition D, Required Action D.2.

Specifically, if one DC electrical power subsystem becomes inoperable and cannot be restored within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, then Mode 3 is prescribed within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

Proposed End-state:

The end-state associated with Required Action D.2 of this LCO is being proposed to be changed from Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> to Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

Basis For Proposed End-state The operability requirements of the DC electrical power sources is predicated on initial assumptions of the accident analyses most notably design basis LOCAs. A design basis LOCA is considered highly unlikely to occur during at-power operations, much less during Mode 4; indeed, the occurrence of a LOCA of any kind during operation in Mode 4 is considered highly unlikely. This is especially true of operations toward the lower end of Mode 4 while operating on SGs (SDC not in operation).

Plant risk is lower when operating in Mode 4 (not on SDC) than when operating in Mode 5 (see Figure 2); risk associated with SDC operation is avoided. Also, when operating in Mode 4 there are more mitigation systems available to respond to IEs that could challenge decay heat removal, than when operating in Mode 5. These systems include the HPI and EFW/AFW systems. This consideration is particularly germane as it relates to loss of DC power sources (control and circuit breaker closure power for plant equipment) because with the SGs operating in Mode 4, TDEFWPs are immediately available with SG pressure of [50 PSIG (- 298°F RCS temperature)]. These considerations should ultimately lead to reduced challenges to CDF and LERF when operating in Mode 4 versus operations in Mode 5.

DATE: 1/12/04 PAGE-68 DATE: 112/04 PAGE - 68

Licensing Working Group Risk Informed Justification For LCO End-state Changes The redundant nature of the DC power sources, provides for availability of DC power even if one source becomes in inoperable.

4.4.19 LCO 3.8.7: Inverters - Operating LCO Operability Statement From STS (see Reference I for exact wording)

The required Train A and Train B inverters shall be operable in Modes 1, 2, 3 and 4.

Description The inverters are the preferred source of power for the AC vital buses because of the stability and reliability they achieve. The function of the inverter is to provide AC electrical power to the vital bus. The inverters can be powered from an internal AC source/rectifier or from the station battery. The station battery provides an uninterruptible power source for the instrumentation and controls for the RPS and the ESFAS.

The initial conditions for DBAs and transient analyses assume ESF systems are operable. The inverters are designed to provide the required capacity, capability, redundancy, and reliability to ensure the availability of necessary power to the RPS and ESFAS instrumentation and controls so that the fuel, RCS, and containment design limits are not exceeded. The operability of the inverters is consistent with the initial assumptions of the accident analyses and is based on meeting the design basis of the unit. This includes maintaining required AC vital buses operable during accident conditions in the event of:

a. An assumed loss of all offsite AC electrical power or all onsite AC electrical power and

b. A worst-case single failure.

The inverters ensure the availability of AC electrical power for the systems instrumentation required to shut down the reactor and maintain it in a safe condition after an AOO or a postulated DBA. Maintaining the required inverters operable ensures that the redundancy incorporated into the design of the RPS and ESFAS instrumentation and controls is maintained. The four inverters

[(two per train)] ensure an uninterruptible supply of AC electrical power to the AC vital buses even if the 4.16 kV safety buses are de-energized. Operable inverters require the associated vital bus to be powered by the inverter with output voltage and frequency within tolerances, and power input to the inverter from a 125 VDC station battery. Alternatively, power supply may be from an internal AC source via rectifier as long as the station battery is available as the uninterruptible power supply.

DATE: 1/12/04 PAGE -69 DATE: 1/12/04 PAGE - 69

Licensing Working Group Risk Intormed Justification For LCO End-state Changes Current and Proposed End-state Current End-state:

This proposed end-state change is associated with LCO 3.8.7 Condition B, Required Action B.2.

Specifically, if one required] inverter becomes inoperable and cannot be restored within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, then Mode 3 is prescribed within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

Proposed End-state:

The end-state associated with Required Action B.2 of this LCO is being proposed to be changed from Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> to Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

Basis For Proposed End-state Inverter operability requirements are based on providing necessary power to the ESFAS instrumentation and controls so that the fuel, RCS, and containment design limits are not exceeded in the event of a design basis LOCA. A design basis LOCA is considered highly unlikely to occur during at-power operations, much less during Mode 4; indeed, the occurrence of a LOCA of any kind during operation in Mode 4 is considered highly unlikely. This is especially true of operations toward the lower end of Mode 4 while operating on SGs (SDC not in operation).

Plant risk is lower when operating in Mode 4 (not on SDC) than when operating in Mode 5 (see Figure 2); risk associated with SDC operation is avoided. Also, when operating in Mode 4 there are more mitigation systems available to respond to Es that could challenge RCS inventory or decay heat removal, than when operating in Mode 5. These systems include the HPI and EFW/AFW systems. This consideration is particularly germane as it relates to loss of vital AC power sources (120 VAC instrument and control power) because with the SGs operating in Mode 4, TDEFWPs are immediately available with SG pressure of [50 PSIG (- 298'F RCS temperature)] even without vital power. These considerations should ultimately lead to reduced challenges to CDF and LERF when operating in Mode 4 versus operations in Mode 5.

The redundant nature of the inverters that supply AC power to the 120 VAC vital buses provides for availability of vital AC power even if one inverter system becomes inoperable. For this reason, the ESFAS function will be supported by the vital AC system. Also, when operating in Mode 4 the reactor is already shutdown, thus the function to provide power for RPS is no longer necessary.

4.4.20 LCO 3.8.9: Distribution System - Operating LCO Operability Statement From STS (see Reference I for exact wording)

The Train A and Train B AC, DC and AC vital bus electrical power distribution subsystems shall be operable in Modes 1, 2, 3 and 4.

DATE: 1/12/04 PAGE -70 DATE:

/2/04 PAGE - 70

Licensing Working Group Risk Informed Justification For LCO End-state Changes Applicability The electrical power distribution subsystems are required to be operable in Modes, 2, 3, and 4 to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients and

b. Adequate core cooling is provided, and containment operability and other vital functions are maintained in the event of a postulated DBA.

Description The onsite Class IE AC, DC, and AC vital bus electrical power distribution systems are divided by train into [two] redundant and independent AC, DC, and AC vital bus electrical power distribution subsystems. The AC electrical power subsystem for each train consists of a primary ESF 4.16 kV bus and secondary [480 and 120] V buses, distribution panels, motor control centers and load centers. Each 4.16 kV ESF bus has at least [one separate and independent offsite source of power] as well as a dedicated [onsite standby power source]. Each 4.16 kV ESF bus is normally connected to a preferred offsite source. After a loss of the preferred offsite power source to a 4.16 kV ESF bus, a transfer to the alternate offsite source is accomplished by utilizing a time delayed bus undervoltage relay. If all offsite sources are unavailable, the [onsitc standby power source] supplies power to the 4.16 kV ESF bus. Control power for the 4.16 kV breakers is supplied from the Class E batteries.

The 120 VAC vital buses are arranged in two load groups per train and are normally powered from the inverters. The alternate power supply for the vital buses arc Class IE constant voltage source transformers powered from the same train as the associated inverter. Each constant voltage source transformer is powered from a Class E AC bus.

There are two independent 125/250 VDC electrical power distribution subsystems (one for each train).

The initial conditions for DBAs and transient analyses assume ESF systems are operable. The AC, DC, and AC vital bus electrical power distribution systems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESE systems so that the fuel, RCS, and containment design limits are not exceeded.

The operability of the AC, DC, and AC vital bus electrical power distribution systems is consistent with the initial assumptions of the accident analyses and is based on meeting the design basis of the unit. This includes maintaining power distribution systems operable during accident conditions in the event of:

a. An assumed loss of all offsite power or all onsite AC electrical power and

b. A worst-case single failure.

DATE: 1/12/04 PAGE-71 DATE: 1/12/04 PAGE - 71

)

Licensing Working Group Risk Infornied Jusitflcation For LCO End-state Changes The required power distribution subsystems ensure the availability of AC, DC, and AC vital bus electrical power for the systems required to shut down the reactor and maintain it in a safe condition after an anticipated AOO or a postulated DBA. The AC, DC, and AC vital bus electrical power distribution subsystems are required to be operable.

Maintaining the Train A and B AC, DC, and AC vital bus electrical power distribution subsystems operable ensures that the redundancy incorporated into the design of ESF is not defeated. Therefore, a single failure within any system or within the electrical power distribution subsystems will not prevent safe shutdown of the reactor. Operable AC electrical power distribution subsystems require the associated buses, load centers, motor control centers, and distribution panels to be energized to their proper voltages. Operable DC electrical power distribution subsystems require the associated buses to be energized to their proper voltage from either the associated battery or charger. Operable vital bus electrical power distribution subsystems require the associated buses to be energized to their proper voltage from the associated [inverter via inverted DC voltage, inverter using internal AC source, or Class E constant voltage transformer]. In addition, tie breakers between redundant safety related AC, DC, and AC vital bus power distribution subsystems, if they exist, must be open. This prevents any electrical malfunction in any power distribution subsystem from propagating to the redundant subsystem, that could cause the failure of a redundant subsystem and a loss of essential safety function(s). If any tie breakers are closed, the affected redundant electrical power distribution subsystems are considered inoperable. This applies to the onsite, safety related redundant electrical power distribution subsystems. It does not, however, preclude redundant Class E 4.16 kV buses from being powered from the same offsite circuit.

Current and Proposed End-state Current End-state:

This proposed end-state change is associated with LCO 3.8.9 Condition D, Required Action D.2.

Specifically, if the required actions and associated completion times of Condition A, B or C cannot be met, then Mode 3 is prescribed within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

Proposed End-state:

The end-state associated with Required Action D.2 of this LCO is being proposed to be changed from Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> to Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

Basis For Proposed End-state The operability requirements of the AC, DC, and AC vital bus electrical power distribution systems are predicated on providing the necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded in the event of a design basis LOCA. A design basis LOCA is considered highly unlikely to occur during at-power operations, much less during Mode 4; indeed, the occurrence of a LOCA of any kind during operation in Mode 4 is considered DATE: 1/12/04 PAGE -72 DATE: 1/12/04 PAGE - 72

Licensing Working Group Risk Informed Justiication For LCO End-state Changes highly unlikely. This is especially true of operations at the lower end of Mode 4 while operating on SGs (SDC not in operation).

Plant risk is lower when operating in Mode 4 (not on SDC) than when operating in Mode 5 (see Figure 2); risk associated with SDC operation is avoided. Also, when operating in Mode 4 there are more mitigation systems available to respond to Es that could challenge RCS inventory or decay heat removal, than when operating in Mode 5. These systems include the HPI system and EFW/AFW systems. This consideration is particularly germane as it relates to loss of electrical power distribution systems because with the SGs operating in Mode 4, TDEFWPs are immediately available with SG pressure of [50 PSIG (- 2980F RCS temperature)]. This consideration should ultimately lead to reduced challenges to CDF and LERF when operating in Mode 4 versus operations in Mode 5.

The redundant nature of the AC, DC, and AC vital bus electrical power distribution systems, including [onsite standby power sources], provides for availability of electrical power even if one power distribution system becomes inoperable.

DATE: 1/12/04 PAGE-73 DATE: 1/12104 PAGE - 73

Licensing Working Group Risk Informed Justification For LCO End-state Changes 5.0 ENGINEERING ANALYSIS: QUANTITATIVE ANALYSIS 5.1 Risk Assessment Methodology The purpose of the quantitative risk assessment is to show that Principle 4 of Regulatory Guide 1.174 is met: "When proposed changes result in an increase in core damage frequency or risk, the increases should be small and consistent with the intent of the Commission's Safety Goal Policy Statement." In fact, the quantitative assessment shows that there is a net improvement in risk associated with the proposed change of Technical Specification end-states. The proposed change will result in a decrease in CDF when the candidate LCO conditions are invoked by avoiding unnecessary operation of the plant in Mode 4, on SDC, and in Mode 5.

The methodology calculates the CDF associated with plant operation while in the candidate LCO conditions. CDF is used exclusively as the risk metric because the shutdown and transition risk models do not calculate LERF. This is acceptable because most of the energy assumed to be released to the RB during a design basis accident is associated with the core thermal power resulting from full power operation. For plant operation in Mode 3, 4 or 5, the release of stored energy to the RB would be only that associated with decay heat and energy stored in the RCS components, which is less than 5% of the energy of a design basis accident at power. Since RCS stored energy and RCS pressure are lower than at power, the major LERF contributors such as energetic containment failure, steam generator tube rupture, and interfacing systems LOCA are less likely. If a severe accident occurs, the challenge to the containment systems (spray, cooling and isolation) will not be significantly affected by whether the LCO invokes an end-statc of Mode 4 (not on SDC) rather than Mode 5. Other factors such as whether the containment is open and maintenance activities that could bypass containment will drive the conditional probability of LERF in the shutdown modes. These contributions will be controlled by the utility's outage risk management function and are not directly related to the proposed change of end-state. That is, there should be no increase in LERF due to the proposed altered end-state.

For the risk analysis, it is concluded that the relative comparison of CDF for the subject end-states is representative of the overall risk.

The risk analysis was performed using DB as the representative B&WOG plant. The risk analysis uses the DB PRA models for Mode 3 (Reference 4), Mode 4 (Reference 5), and Mode 5 (Shutdown Plant Operating State A of the DB Shutdown PSA, Reference 6). These are the same PRA models that are used by DB for outage risk-management. They are controlled and maintained by the utility.

The DB PRA models for the non-power modes are based upon and evolved from generic shutdown and transition risk templates developed by the B&WOG (References 17 and 18).

These templates were developed in a cooperative effort to provide shutdown PRA "top logic" that is consistent across the B&WOG. These were then adapted for plant specific needs and differences, and then expanded with plant specific system models and data.

DATE: 1/12/04 PAGE -74 DATE:

/12/04 PAGE - 74

Licensing Working Group Risk Infornied Justification For LCO End-state Changes The DB models are representative or conservative for the B&WOG because of their generic origins, and because the major DB plant specific differences suggest conservatism for the proposed end-state of interest (i.e., Mode 4 not on SDC). Most notably:

• Both of the safety-related EFW pumps at DB are turbine-driven. Therefore, all else being equal, it is expected that the DB risk in Mode 4 is conservative for all other B&WOG plants, which have one TDEFWP and one or more [onsite standby power source] backed motor-driven pumps. In Mode 4, when steam generator pressure is too low to drive an EFW pump turbine, plants with more motor-driven pumps should fair better.

• For DB the DHR suction line valves are opened to establish a tie between the RCS and the DHR system when in Mode 4; this is done regardless of whether or not core cooling is to be provided by the SDC (DHR) system. The reason for this alignment is to provide sufficient relief capacity for LTOP considerations, which rely on a DHR system relief valve located on the DHR suction line. Because all other B&WOG plants use the PORV for LTOP consideration, they can operate in Mode 4 without making an equivalent alignment.

Therefore the DB PRA incurs an additional frequency of SDC-related loss of inventory events in Mode 4 (not on SDC) that is not applicable to the other B&WOG plants until later in Mode 4 (on SDC).

Sensitivity studies, discussed in Section 6, were performed on the DB models to determine the sensitivity of the results to the major differences in B&WOG plant design, and to establish the robustness of the conclusions.

For comparison of the candidate LCO end-states, the CDF was calculated for three modes of operation:

• Mode 3: For Mode 3 the PRA models the lower part of Mode 3, when RCS pressure is below about 1000 PSI. Mode 3 applies when the reactor is subcritical and average RC temperature is above about 3300FT

• Mode 4: For Mode 4 the PRA models Mode 4 before core heat removal is transferred from the SGs to the SDC (DHR) system. Mode 4 begins at the lower part of Mode 3 and goes down to about 200'F average RC temperature.

• Mode 5: The modeled operating state is the upper end of Mode 5 with core heat removal completely on SDC. Mode 5 begins at < 200'F and continues to lower average RC temperatures.

To ensure valid risk comparisons, the initial plant alignment assumed prior to entering the LCO is typical of power operation and is consistent across the three end-state models. The PRA models for each of these three operating modes consist of fault trees. The system fault trees that support the top logic fault tree for each mode are the same except for the mode-specific differences. For example, at DB, a major mode-specific difference is the normal feedwater system alignment. No credit is taken for the main feedwater (MFW) pumps in Mode 3 and below because the MFW turbines are normally shutdown. The DB systems credited for supplying feedwater in Mode 3 and Mode 4 include a non-safety related motor-driven feed pump and two safety-related turbine-driven EFW pumps called Auxiliary Feedwater (AFW) Pumps at s Mode 3/Mode 4 transition varies by plant from about 280F to 350F.

DATE:

1/12/04 PAGE -75~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

DATE: 112/04 PAGE - 75

Licensing Working Group Risk Informned Justifcation For LCO End-state Clhanges DB. The turbine-driven AFW pumps are removed from service in Mode 4 (because of low steam generator pressure), but are available for backup use if the auxiliary boiler is available. In Mode 5, the steam generators are generally unavailable, but may be available for backup cooling if SDC is lost and cool down has not proceeded too far.

To compare the candidate end-states, the PRA model for each mode was run for the various LCO conditions by setting the equipment associated with each LCO condition to the unavailable or failed condition. Each separate condition within the STS LCO that required the Mode 5 end-state was analyzed (e.g., one train inoperable, both trains inoperable, etc). For many of the candidate LCOs, the equipment of interest is explicitly modeled in the PRA (e.g., AC and DC power systems). These LCO conditions16 were modeled explicitly, by taking the equipment out of service and determining the revised CDF in each candidate end-state.

However, for some of the LCOs, the equipment of interest is not explicitly modeled in the PRA for Modes 3, 4 and 5. These systems are not modeled in the PRA because they have a negligible or intangible contribution to CDF in these modes (e.g., boron concentration, containment). For these LCO conditions, the general trend exhibited by the modeled LCOs, and the base case (i.e.,

no LCO condition) is relied upon. That is, since the base case and the modeled system LCOs (e.g., power sources, CCW, SWS) all show reduced CDF in Mode 4 (not on SDC) versus Mode 5, then it is logical that the differences in CDF for the unmodeled systems are in the same direction and less significant. This taken with the qualitative analysis, supports the assertion that the CDF is better in the Mode 4 end-state with the RCS on SG cooling than the Mode 5 end-state, for all of the proposed LCO end-state changes.

5.2 Modeling Assumptions

• Entry into an LCO can occur due to the need to perform corrective maintenance (CM) or preventive maintenance (PM). The PRA treatment of these two situations is slightly different. Since the CM may be unexpected and driven by a component failure, there is a possibility that the redundant train may fail due to common cause while in the LCO condition. For PM driven entries into an LCO condition, a failure of the redundant train is generally treated as a random event. PRA runs were made for both the PM and the CM assumption and the impact upon the results was determined to be relatively minor and not pertinent to the conclusions of the study. Therefore, the results presented below are for the CM case, which is the more conservative assumption. Hence, if a train of equipment is out of service for an LCO, then it is assumed that the redundant train may fail during the LCO due to common cause, and that the probability of failure is equal to the common cause failure factor (beta factor) assigned by the PRA.

16 LCO conditions explicitly modeled: 3.4.6 (RCS Loops) condition A, 3.7.7 (CCW) condition A, 3.7.8 (SWS) condition A, 3.8.1 (AC Sources) conditions A through E, 3.8.4 (DC Sources) conditions A through C, 3.8.7 (Inverters) condition A, 3.8.9 (AC/DC Distribution) condition A through C (Reference 1).

17 LCOs not explicitly modeled: 3.3.5 & 3.3.6 (ESFAS), 3.4.15 (RCS Leak Detection), 3.5.4 (BWST Concentration), 3.6.1 to 3.6.6 (Containment Systems), 3.7.9 (UHS), 3.7.10 & 3.7.11 (Control Room).

DATE: 1/12/04 PAGE-76 DATE: 1/12104 PAGE - 76

Licensing Working Group Risk Informed Justification For LCO E nd-state Changes

• The loss of off-site power (LOOP) frequency for Modes 3, 4 and 5 is increased from the at-power value (5.OE-2/yr. to 0.1/yr. for DB) (Reference 19). Normally this adjustment would only be applied to Mode 5 and lower because of increased likelihood of switchyard activity.

However, for this analysis, the LOOP frequency was conservatively increased for Modes 3 and 4 as well under the reasoning that if these candidate end-states were implemented, then some increased switchyard activity might occur in these modes as well. This is a conservative assumption for this alternate end-state comparison.

5.3 Risk Associated with Mode Change The CDFs calculated are for operation in the candidate end-state modes. The integrated risk associated with a complete plant evolution to the required end-state and back to power is not calculated. Thus, there may be some additional risk associated with the act of changing modes, including additional time spent in intermediate modes, that is omitted. This omission, if included, may increase disproportionately the risk associated with the lower end-states. This is because thcre would be more mode transitions involved with the shutdown and startup evolution, and because of any additional time spent in intermediate modes of operation.

These intangible risks are not included in the calculations, because their omission is conservative relative to justifying Modc 4 (not on SDC) over Mode 5 as the preferred end-state. Also, it is more straightforward to simply make a one-for-one comparison of the risk in the ultimate end-states.

5.4 Mode Dependent Plant Risks While operating in Modes 3, 4 and 5 reactor power is very near 0%. In these modes ATWS is not possible and reactor-turbine trip and load rejection cannot be initiators. RCS pressure is decreasing in these modes as plant cool down proceeds. The likelihood of events associated with high RCS and SG pressure decreases. The IEs most directly associated with these parameters, i.e., LOCA, SGTR and SLB, have their frequency of occurrence reduced in the PRA models when operating in these lower modes to account for reduced pressure. On the other hand, the frequency of loss of inventory events associated with system misalignments increases after SDC (i.e., the DHR system) is aligned to the RCS at the lower end of Mode 4.

5.4.1 Mode 3 The PRA model used for Mode 3 is applicable to "lower" Mode 3, corresponding to when RCS pressure is below approximately 1000 PSI. In this mode, the RCPs are running and the SGs are the primary means of decay heat removal. When operating in Mode 3, available motor-driven and steam-driven feed pumps are used to provide feedwater to the SGs. (For example, at DB the feedwater systems used in Mode 3 include a non-safety related motor-driven startup feed pump and two safety-related turbine-drivcn AFW pumps.) Also, when operating in Mode 3, RCS makeup systems are immediately available for backup once-through cooling (i.e., feed and bleed) if SG cooling fails.

DATE: 1/12/04 PAGE-77 DATE: 1/12/04 PAGE - 77

Licensing Working Group Risk Informed Justification For LCO End-state Changes In Mode 3, the likelihood of initiating events occurring that are associated with high RCS and SG pressure decreases. The IEs most driven by pressure, i.e., LOCA, SGTR and SLB, have their frequency of occurrence reduced in the Mode 3 PRA model (e.g. by factor of 7.5 in DB PRA).

For DB, the top contributors to CDF in Mode 3 are loss of feedwater events with operator failure to recover via feedwater recovery or once-through makeup cooling. During the analyzed LCO conditions, loss of feedwater events also dominate the CDF, as well as similar events initiated by LOOP followed by emergency diesel generator failures.

5.4.2 Modc 4 (not on SDC)

The Mode 4 PRA model applies to Mode 4, before the transition to SDC is implemented. In this mode at least one RCP is running and the SGs are the primary means of decay heat removal.

SDC is modeled as a backup to SG cooling if all feedwater is lost.

When operating in Mode 4 below 280'F the normal feedwater source is the available motor-driven feed pump(s). The turbine-driven AFW pumps are removed from service because of low steam generator pressure. They may be available for backup use if the auxiliary boiler is available. Also, when operating in Mode 4 RCS makeup systems are immediately available for backup once-through cooling (feed and bleed) if SG cooling fails.

In Mode 4 RCS pressure is decreased further as plant cool down proceeds. The IEs most driven by high RCS and SG pressure, i.e., LOCA, SGTR and SLB, become increasingly unlikely. (Loss of inventory events via SDC system misalignments are relevant as soon as the RCS is aligned to the SDC system at the lower end of Mode 4.1S)

For DB, the top contributors to CDF in Mode 4 (not on SDC) are failures of AC power (LOOP plus failure of emergency diesel generators). Total loss of AC power is the dominant contributor because of the diversity of cooling options readily available in this operating mode and because of unavailability of turbine-driven AFW pumps. These remain the top contributors to CDF during the analyzed LCO conditions. Failures of CCW also become more important contributors during LCO conditions that reduce the redundancy of the system.

5.4.3 Mode 5 The Mode 5 PRA model applies to the lower end of Mode 4 (on SDC) and upper Mode 5, although Mode 5 is the mode of interest. The plant is on SDC and the DHR system is the primary means of decay heat removal.

In upper Mode 5, the RCS is not vented and SG manways have not yet been removed. The SGs are no longer being used to remove decay heat, however the SGs are still available as a backup if SDC is lost. Recovery of SG cooling is an option if the SGs are intact and cool down has not l At DB the DHR suction is aligned to the RCS before SDC is put into service to enable a low pressure relief valve in the DHR suction line (LTOP consideration). Hence loss of inventory events associated with SDC system misalignment are included in Mode 4 for DB.

DATE: 1/12/04 PAGE -78 DATE: 1/12/04 PAGE - 78

Licensing Working Group Risk Informed Justification For LCO End-state Ch anges proceeded too far. Therefore, feedwater systems could be of value as a backup to SDC if the SGs can be returned to service. In this situation, core cooling could be switched back to the SGs, likely subsequent to some RCS heatup to establish NC conditions (RCS conditions would not allow operation of RCPs).

This Mode 5 risk assessment does not include the CDF for plant operating states lower than the required end-state. For example if cold shutdown (i.e., Mode 5) is required, then the assumed end-state is just into Mode 5, on SDC. This assumption is conscrvativc and consistent with the purpose of the analysis, which is to evaluate the risk associated with the required end-states. The CDF for Mode 5 will increase if operators decide to go lower than required into Mode 5 (e.g.,

RCS venting and drain, SG manways removed), such that recovery of SG cooling as an option for decay heat removal becomes more remote.

When operating in Mode 5 plant realignments also lead to general unavailability of the HPI systems. The HPI system is generally not immediately available, but it may be started after some delay via operator alignment.

When operating in Mode 5, the risks associated with LOCAs, SGTRs and SLBs are negligible.

However, the frequency for loss of inventory events associated with SDC and related systems misalignment is important. There is a possibility of inadvertent RCS draining caused by inappropriate valve alignments and/or maintenance activities while on SDC.

Since the feedwater system is secured, its failure also cannot be an initiator. However, loss of SDC via failure of the running DHR train is an important initiator.

For DB, the top contributors to CDF in Mode 5 are failure of the running DHR train and operator failure to recover via the other DHR train, the SGs, or once-through makeup cooling. Failures of CCW and AC power become more important contributors during LCO conditions that reduce the redundancy of the systems.

5.5 Results of Quantitative Risk Assessment For all of the analyzed LCO conditions, the end-state of Mode 4 with the RCS on SG cooling (i.e., not on SDC) has a lower CDF than Mode 5. This includes the base case (no LCOs invoked) as well as each of the analyzed LCO conditions. Figure 2 shows the CDF for the base case and a composite (i.e., the numerical average) of the analyzed LCO conditions. These CDF estimates apply to the time when the plant is operating in the respective end-states.' 9 These CDF estimates were also used to determine incremental conditional core damage probability (ICCDP), which is discussed in Regulatory Guide 1.177 (Reference 8). The ICCDP is used for comparison of Mode 5 to Mode 4, and is the difference in the conditional CDF (i.e.,

19 These estinates omit an additional risk increment that may be associated with the plant evolution required to transition to the respective end-state and back to power. The CDF estimates are conservative for comparison of the proposed Mode 4 end-state to the current Mode 5 end-state because more mode changes and time are required to transition from power operation to Mode 5 versus Mode 4.

DATE: 1/12/04 PAGE -79 DATE: 1/12/04 PAGE - 79

Licensing Working Group Risk Informed Justif cation For LCO E td-state Changes given the LCO condition of interest) multiplied by the duration of a single LCO-relatcd outage.

In this case, the duration of the outage is unknown and is dependent upon the necessary maintenance or repair activity. However, the ICCDP is negative (that is a net benefit) for every LCO condition examined. For example, for a 24-hour period (i.e., 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in the respective end-state) the average ICCDP of all of the LCO conditions is a benefit of 8.8e-7 for Mode 4 versus Mode 5. As shown in Figure 3, the ICCDP for a 24-hour outage varies from a low of 2.7e-8 benefit to a high of 4.1e-6 benefit over the range of LCO conditions analyzed. Each condition analyzed indicates a net risk benefit for end-state Mode 4. This benefit increases in magnitude with the length of the outage required to perform the necessary PM or CM.

A review of the detailed results of the PRA (i.e., the cut sets) indicates the following insights for why the CDF is better in Mode 4 than in Mode 5:

LOOP is an important initiating event for all of the shutdown modes analyzed. The risk impact of the LOOP event is less in Mode 4 because there is more redundancy and diversity of the mitigating systems.

Loss of feedwater is an important initiating event while on SG cooling, and loss of DHR is an important initiating event while on SDC. Since the frequency of both of these initiating events is about the same, the risk is better in Mode 4 while on SG cooling because there is greater redundancy and diversity of mitigating systems.

• Initiating events associated with high pressure (LOCA, SGTR, SLB) are not significant contributors in these modes because reactor coolant pressure is low. However, loss of inventory events related to SDC system misalignrments become contributors to CDF when the SDC system is aligned to the RCS at the lower end of Mode 4 and in Mode 5.

The conclusion of the quantitative risk assessment is that Principle 4 of Regulatory Guide 1.174 is met. The risk assessment shows that there is a net improvement in risk associated with the proposed change of Technical Specification end-states. The proposed change will result in a decrease in CDF when the candidate LCO conditions are invoked by avoiding unnecessary operation of the plant in Mode 4, on SDC, and in Mode 5.

DATE: 1/12/04 PAGE-SO DATE: 1/12/04 PAGE - 80

Licensing Vorking Group Risk Informed Justflcation For Licensing W orking Group Risk Informied Jstifcation For LCO End-state Clianges Figure 2 - Core Damage Frequency in Candidate End-States Base Case (No LCO)

Mode 3 Mode 4 Mode 5 1.OE I 1.0E 1.0E-06 D7 Composite LCO Mode 3 Mode 4 Mode 5 1.OE 1.0E-04 C.)

1.0 2-0 5 Note: Results are based on representative B&WOG PRA (Davis-Besse). The composite LCO is the numerical average of the CDF for the following LCO conditions: 3.4.6 (RCS Loops) Condition A, 3.7.7 (CCW) Condition A, 3.7.8 (SWS) Condition A, 3.8.1 (AC Sources) Conditions A through E, 3.8.4 (DC Sources) Conditions A through C, 3.8.7 (Inverters) Condition A, 3.8.9 (AC/DC Distribution) Condition A through C (Reference 1).

DATE: 1/12104 PAGE-SI DATE: 1/12104 PAGE - 81

Licensing Working Group Risk Inforined Justification For LCO End-state Cianges Figure 3 - Single Outage Benefit of Mode 4 (vs. Mode 5) for Analyzed LCO Conditions 1.OOE-05 U-0 C

w 1.OOE-06 1.OOE-07 Ie 1.OOE-08 Lowest LCO Average Highest LCO Note: Assumes a 24-hour outage. The benefit increases with longer outage.

DATE: 1/12/04 PAGE -82 DATE: 1/12/04 PAGE - 82

Licensing Working Group Risk Informed Justification For LCO End-state Changes 6.0 SENSITIVITY STUDIES 6.1 Sensitivity Considerations Sensitivity studies were performed to demonstrate that the risk assessment results, which favor Mode 4 over Mode 5 for the subject Technical Specification end states, are generally applicable to all of the B&WOG plants. Sensitivity considerations are predicated on IE mitigating system differences between the base plant, i.e., DB, and [all other plant]s. Such differences are found in the following systems:

High Pressure Injection (HPI)

Low Temperature Overpressure Protection (LTOP)

Emergency Feedwater (EFW)

This section describes these differences, discusses their effects on IE mitigation and provides an indication of their effect on CDF in Modes 4 and 5. The intent is to show that the analysis results for the base plant can be extrapolated to reasonably represent all other plants.

6.1.1 High Pressure Injection (HPI) System Base Plant Configuration The DB plant has separate IIPI and MU pumps. The two HPI pumps each supply -750 GPM at 600 PSIG. With suction supplied from the BWST they have a shutoff head of -3791 FT or

-1630 PSIG; when suction is supplied from the LPI pumps, their shutoff head is - 4256 FT or

-1830 PSIG. The HPI pumps arc designed for the purpose of providing flow to the RCS as part of the ECCS. The two MU pumps are intended to be used for normal RCS makeup, pressurizer spray and supplying RCP seals. Each MU pump provides flow of -225 GPM at 2150 PSIG.

With suction supplied from the BWST the MU pumps have a shutoff head of - 6377 FT or -2742 PSIG; when suction is supplied by the LPI pumps, their shutoff head is - 6841 FT or

-2942 PSIG.

Due to the available shutoff head of the HPI pumps, they cannot provide backup core cooling flow via feed and bleed cooling20 without the PORV being opened prior to RCS pressure exceeding their shutoff head. If the RC heats up and saturates at a pressure greater than the HPI pump shutoff head, then opening the PORV will not reduce RCS pressure sufficiently to allow HPI cooling. Thus for HPI cooling to be successful at DB, HPI pumps must be started and the PORV opened before RC saturation occurs at a pressure greater than the HPI pump shutoff head.

For this same reason, i.e., available shutoff head too low, the HPI pumps cannot provide feed and bleed cooling via the pressurizer safety valves.

20 See the "Definitions" section on page 7 for a definition of "feed and bleed" cooling.

DATE: 1/12/04 PAGE-83 DATE: 112/04 PAGE - 83

Licensing Vorking Group Risk Inforned Justification For LCO End-state Changes Configuration Of All Other Plants All plants except DB have three pumps that serve as IHPI and MU pumps. These pumps each provide - 550 GPM at 600 PSIG; they have a shutoff head of - 6744 FT (-2900 PSIG) when taking suction from the BWST. Normally, two of these pumps are aligned for and designated as BPI pumps with the third pump operating in the MU mode to supply RCS makeup, pressurizer spray and RCP seals. Due to the shutoff head of the HPI/MU pumps, they can provide feed and bleed cooling via the PORV and, if the PORV is unavailable, the pressurizer safety valves.

Risk Impact of Configuration Differences The difference in HPI system configuration between DB and all other plants affects PRA outcomes associated with the total loss of normal and emergency feedwater lEs. For the DB plant the MU pumps can supply feed and bleed cooling via both the PORV and the pressurizer safety valves; however, these pumps are not IE qualified.

The HPI pumps at DB cannot provide feed and bleed cooling flow unless the PORV is opened before RCS pressure exceeds the design shutoff head2' of the HPI pumps (see discussion under 6.1.1 Base Plant Configuration). At all other plants the only requirement for initiating feed and bleed cooling is initiation of HPI flow to the RCS. For this reason, there is an increment of risk in the DB PRA associated with operator error that is not needed in other plant PRAs, i.e.,

operator fails to open the PORV before RC saturates at a pressure greater then the HPI shutoff head.

In Modes 4 and 5, because of the low RCS pressure, the shutoff head of the pumps is less important. When the low temperature overpressure protection system is activated (see next section) it provides a bleed path that opens at a lower pressure than the nonnal PORV setpoint.

Another effect of the different HPI system configurations is that the separate MU pumps at DB may offer an extra measure of redundancy compared to the plants with combined HPI/MU systems.

Therefore, sensitivity runs were made with the PRA model configured for high head HPI pumps, i.e. pumps with a shutoff head of-2900 PSIG (all plants except DB have this design). To simulate the plants with high-head HPI pumps, the Mode 4 and Mode 5 fault tree models were modified to delete credit for the DB makeup pumps. These runs also deleted the operator action required for opening the PORV. (Starting HPI pumps for feed and bleed still requires operator action.) Results are discussed in Section 6.3.

2? As noted, the HPI pumps at DB can have their suction supplied via the LPI system versus the BWST. This has the effect of increasing the HPI pumps effective shutoff head to 1830 PSIG. This pressure is below the lift point of the pressurizer safety valves, thus still requiring operator action to open the PORV to establish feed and bleed cooling.

DATE: 1/12/04 PAGE - 84

Licensing Working Group Risk Informed Justification For LCO End-state Changes 6.1.2 Low Pressure Overpressure Protcction (LTOP)

Base Plant Configuration At DB a relief valve on the DHR system suction line is used for LTOP control purposes. This valve, sized to pass the entire flow of both HPI pumps at a pressure below the RV pressure-temperature (P-T) limit curve, is used in conjunction with required reduced RCS makeup capability. This requirement prevents the MU system from providing sufficient makeup to cause the RCS to become water solid.

This configuration, i.e., LTOP control relief valve located on the DHR suction line, requires DB to align the DHR system (SDC) to the RCS in order to implement LTOP control. This must be done whether or not SDC is in effect, i.e., even if core cooling remains on the SGs.

Configuration Of All Other Plants All plants except DB use the PORV for LTOP control purposes. During plant cooldown the PORV is reset from its normal operational value to a reduced value commensurate with maintaining RCS pressure below the RV P-T limit curve. The reduced setpoint is typically used in conjunction with requiring reduced RCS makeup flow capability (including locking out HPI) and requiring reduced pressurizer level. This provides at least 10 minutes, in the event of an inadvertent initiation of RCS makeup, for operators to take action to terminate the makeup flow before RCS water solid conditions can occur. Although the HPI is locked out, i.e., automatic supply of HPI is prevented, HPI can be initiated via manual operator action.

The LTOP control configuration used at all other plants, i.e., use of PORV, means that LTOP control is available as an integral part of the RCS. For this reason, this configuration does not require any additional alignment of systems outside the RCS to provide LTOP control.

Risk Impact of Configuration Differences When operating with the SDC aligned to the RCS, inadvertent draining of the RCS can occur due to inappropriate SDC system related realignments (see 2.2.3 and 4.1). At DB the SDC system must be aligned to implement LTOP control, while all other plants can implement LTOP control without making such an alignment. The LTOP control configuration of all other plants eliminates the increment of risk associated with this vulnerability as long as core cooling remains on the SGs. For this configuration there is no need to align the RCS to the SDC system to provide LTOP control.

The DB configuration requires RCS to SDC system alignment even if core cooling is via the SGs in order to provide LTOP control. Because of this situation, inadvertent draining of the RCS can occur due to inappropriate SDC system related realignments even when core cooling is via the SGs. Thus, for operations in Mode 4 with core cooling via the SGs there is an increment of risk associated with the DB configuration that is not present with any other plant configuration.

DATE: 1/12/04 PAGE-85 DATE: 1/12/04 PAGE - 85

Licensing Working Group Risk Informed Justifcation For LCO End-state Chlanges Therefore, sensitivity runs were made with the PRA models to approximate the effect of core cooling via the SGs but with SDC not aligned. To approximate the plants that use the PORV for LTOP instead of the SDC relief valve, the DB Mode 4 PRA model was modified to decrease the likelihood of loss of inventory initiating events outside of containment. The initiating event frequencies for large and small loss of inventory outside of containment in the DB models were replaced with generic values (Reference 20), which are less by about a factor of two than those used by DB. Results are discussed in Section 6.3.

6.1.3 Emergency Feedwater (EFW) System Base Plant Configuration The EFW22 system configuration at DB includes only TDEFWPs; it does not include any MDEFWPs. DB does have a separate motor-driven startup feedwater pump that is not E qualified.

Configuration Of All Other Plants The EFW system at all other plants uses a configuration that includes both turbine-driven and

[onsite standby power source] supported MDEFWPs. That is, all plants except DB have one TDEFWP and at least one MDEFWP.

Risk Impact of Configuration Differences Since the DB plant has two TDEFWPs, it is at a disadvantage when the SG pressure is insufficient to provide driving steam, compared to plants with diverse EFW pump drivers. The configuration of all other plants provides for EFW when a source of steam, e.g., from SGs, auxiliary boilers and adjacent plants, is not available to operate the TDEFWPs. Because of this, for JEs that lead to a loss of normal feedwater, the configuration of all other plants provides an element of robustness not included in the DB configuration. Chiefly, when operating in Mode 3 or 4 with SGs providing core cooling, the configuration of all other plants provides for improved risk due to additional sources of EFW beyond the TDEFWPs. This is particularly true as these MDEFWPs2 3 are supported by the [onsite standby power source].

Therefore, sensitivity runs were made with the PRA model configured for motor-driven and turbine-driven EFW pumps. To simulate the plants with diverse EFW pumps, the DB fault tree models were modified to delete one of the TDEFWPs and replace it with a MDENVP aligned to the appropriate emergency power bus. As with the DB configuration, for these runs it was assumed for the configuration of all other plants that SG pressure is insufficient to support TDEFWP operation in Mode 4 and below. Results are discussed in Section 6.3.

22 At DB the term "AFW" system is equivalent to the tern "EFW" system at all other plants.

23 At Crystal River there is also a diesel-driven EFW pump.

DATE: 1/12/04 PAGE-86 DATE:

/12/04 PAGE - 86

Licensing Working Group Risk Informed Justification For LCO Eind-state Changes 6.2 Additional Plant Configuration Difference Considerations This sections provides some discussion on additional configuration differences between all plants including DB. It is intended to provide both an element of completeness in treatment of this issue and explore possible areas for further reducing the increment of risk associated with shutdown plant operations. Because this is a generic report for all B&W designed plants, these additional plant configuration differences are addressed at a high level, thus there is no attempt to address each and every difference between all the plants, including DB.

6.2.1 Auxiliary Steam Systems Not having TDEFWPs available for Es that lead to loss of all feedwater is a significant risk contributor. These turbines rely on a supply of steam at appropriate conditions to provide the energy for their operation. If the SGs cannot supply this steam, then auxiliary sources of steam such as auxiliary boilers and adjacent plants may be used. Assuring such steam sources are available can further improve the increment of risk associated with Mode 4 operations. For the sensitivity runs, no credit was given for auxiliary boilers.

6.2.2 Mode 3 To Mode 4 Transition Point The following table is from the Definitions Section of Reference I (B&W designed plants STS):

Table 1.1-I (from Reference 1)

MODES

% RATED AVERAGE REACTIVITY THERMAL REACTOR COOLANT MODE TITLE CONDITION POWERO' TEMPERATURE (kff)

(OF)

I Power Operation 2 0.99

>5 NA 2

Startup 20.99 5

NA 3

Hot Standby

< 0.99 NA 2 [330]

4 Hot ShutdohWn(b)

< 0.99 NA

[330] > Tay > [200) 5 Cold Shutdoxwn)

< 0.99 NA S [200]

6 Rcfueling()

NA NA NA (a)

Excluding decay heat.

(b)

All reactor vessel head closure bolts fully tensioned.

(c)

One or more reactor vessel bead closure bolts less than fully tensioned.

DATE: 1/12/04 PAGE - 87

Licensing Working Group Risk Inforned Justification For LCO End-state Changes The point of transition from Mode 3 to Mode 4 varies on a plant specific basis, and may be as high as 350'F. Some B&WOG plants have a higher transition temperature than DB, which is 280'F. With a transition temperature of 2800F, the TDEFWPs cannot be operated in Mode 4 with steam from the SGs. For all other plants TDEFWP availability may be limited during continued cooldown in Mode 4; the normal steam supply for these pumps eventually becomes unavailable during Mode 4 cooldown due to decreasing SG pressure. For plants with a higher transition point between Modes 3 and 4, the availability of TDEFWPs would be improved for the upper part of Mode 4. However, for the sensitivity runs no credit was taken for TDEFWPs in Mode 4.

6.3 Sensitivity Studies Results The base plant for the risk assessment results is DB. Sensitivity runs were performed to demonstrate that the conclusions derived from the risk assessment are applicable to the other B&WOG plants. Major differences between DB and the other B&WOG plants, that may affect risk in Modes 4 and 5, have been identified above. Changes have been made to the DB PRA models for Mode 4 and Mode 5, as described in the sections above, to approximate the risk profile for the other plants. These PSA model changes effectively remove the major plant specific design features that are unique to DB and replace them in the PRA model with features that are more typical of the B&WOG fleet. All of these changes were rolled up together, and a complete set of new runs was made for the base case (no LCO) and each of the analyzed LCO conditions.

For all of the analyzed LCO conditions, the end-state of Mode 4 with the RCS on SG cooling (i.e., not on SDC) has a lower CDF than Mode 5. Figure 4 shows the CDF for the base case and a composite (i.e., the numerical average) of the analyzed LCO conditions. These CDF estimates apply to the time when the plant is operating in the respective end-states. 24 These CDF estimates were also used to calculate ICCDP. The ICCDP is used for comparison of Mode 5 to Mode 4, and is the difference in the conditional CDF (i.e., given the LCO condition of interest) multiplied by the duration of a single LCO-related outage, in this case calculated for a 24-hour period. The ICCDP is negative (that is a net benefit) for every LCO condition examined. The average ICCDP of all of the LCO conditions is a benefit of 5.3e-7 for Mode 4 versus Mode 5, for a 24-hour period. As shown in Figure 5, the ICCDP benefit for a 24-hour outage varies from a low of 1.8c-8 to a high of 3.2e-6 over the range of LCO conditions analyzed. This benefit increases in magnitude with the length of the outage required to perform the necessary PM or CM.

These sensitivity results are similar to those of the base case. Major design differences in mitigative systems such as HPI and EFW did not change the basic result that the Mode 4 end state involves less risk than Mode 5. This is not surprising considering that Mode 4 operation 24 These estimates omit an additional risk increment that may be associated with the plant evolution required to transition to the respective end-state and back to power. The CDF estimates are conservative for comparison of the proposed Mode 4 end-state to the current Mode 5 end-state because more mode changes and time are required to transition from power operation to Mode 5 versus Mode 4.

DATE: 1/12/04 PAGE-88 DATE: 112/04 PAGE - 88

Licensing Working Group Risk Inforined Justification For LCO End-state Changes (on SG cooling) provides more redundancy and diversity of mitigating systems than Mode 5.

Therefore, it is concluded that the DB analysis is representative of the B&WOG plant fleet.

DATE: 1/12/04 PAGE - 89

Licensing Working Group Risk Informed Justification For LCO End-state Changes Figure 4 - Core Damage Frequency in Candidate End-States Sensitivity Study Base Case (No LCO)

Mode 4 Mode 5 1.0E-04

_. 1.OE-05 IL 0z 1.OE.06 I.OE-03 Composite LCO Mode 4 Mode 5 IS I

I_

r, I-cU.0 1.OE-04 -l 1.OE-05 Note: Results are based on representative B&WOG PRA (Davis-Besse) with alterations for major design sensitivities. The composite LCO is the numerical average of the CDF for the following LCO conditions: 3.4.6 (RCS Loops) Condition A, 3.7.7 (CCW) Condition A, 3.7.8 (SWS) Condition A, 3.8.1 (AC Sources) Conditions A through E, 3.8.4 (DC Sources) Conditions A through C, 3.8.7 (nverters) Condition A, 3.8.9 (ACIDC Distribution)

Condition A through C (Reference 1).

DATE: 1/12/04 PAGE-90 DATE: 112/04 PAGE - 90

Licensing 'Working Group Risk Informed Justification For LCO End-state Clanges Figure 5 - Single Outage Benefit of Mode 4 (vs. Mode 5) for Analyzed LCO Conditions Sensitivity Study 1.00E-05 IL 0

L)

C 1.00E06 1.00E-07 1.OOE-08 Lowest LCO Average Highest LCO Note: Assumes a 24-hour outage. The benefit increases with longer outage.

DATE: 1/12/04 PAGE -91 DATE: 1/12104 PAGE - 91

Licensing Working Group Risk Informed Justification For LCO End-state Changes

7.0 CONCLUSION

The question that this analysis attempted to answer was, "Given that certain conditions associated with the LCOs being proposed for end-state changes are met (i.e., invoked), is operation in Mode 4 a satisfactory safe end-state, rather than proceeding to the currently prescribed end-state of Mode 5?"

In order to answer this question a quantitative and qualitative analysis was conducted. The results of the quantitative analysis (see Figure 2) indicate that Mode 4 operation provides for reduced overall plant risk when unnecessary Mode 5 operations are avoided. This includes operations with conditions of the LCOs being considered for an end-state change invoked.

The qualitative analysis indicates that operation in Mode 4, versus unnecessary operation in Mode 5, provides the following risk reduction advantages:

More IE mitigating resources available.

Human error during SDC initiation and subsequent operation cannot occur.

SDC system vulnerabilities are avoided.

Inadvertent RCS draining via SDC system related misalignments cannot occur.

These risk reduction advantages are further supported by existing plant conditions that are vastly different from those assumed in the bases of the LCOs being proposed for an end-state change.

When operating in Mode 4, versus the assumed plant condition of the LCO bases (100% full power with a full compliment of decay heat), the reactor system energy is only that associated with decay heat and radionuclide inventory is reduced due to radioactive decay. Thus, in the event of a LOCA during Mode 4 only reduced decay heat energy (reactor has been shutdown for some time) and energy stored in RCS components is available to challenge emergency core cooling and containment control systems. Also, challenges to the RB as a barrier to fission product release are decreased due to the reduced radionuclide inventory.

A LOCA of the size associated with a design basis LOCA is considered highly unlikely to occur during at-power operations, much less during Mode 4; indeed, the occurrence of a LOCA of any kind during operation in Mode 4 is considered highly unlikely. This is especially true of operations toward the lower end of Mode 4 while operating on SGs (SDC not in operation). At this point, RCS pressure has been reduced to < 400 PSIG. Also, the core radionuclide inventory is decreased when the assumed IE occurs in Mode 4. Thus, the probability of occurrence of a LOCA is decreased while the consequence of such and event is not increased. Because of this, LERF is not expected to increase.

The LCOs being proposed to have an end-state change are:

3.3.5 Engineered Safety Features Actuation System (ESFAS) Instruments 3.3.6 ESFAS Manual Initiation 3.4.6 RCS Loops - Mode 4 3.4.15 RCS Leak Detection Instrumentation DATE: 1/12/04 PAGE -92 DATE: 1/12/04 PAGE - 92

Licensing Working Group Risk Itforined Justification For LCO End-state Changes 3.5.4 Borated Water Storage Tank (BWST) 3.6.1 Containment 3.6.2 Containment Air Locks 3.6.3 Containment Isolation Valves (CIVs) 3.6.4 Containment Pressure 3.6.5 Containment Air Temperature 3.6.6 Containment Spray and Cooling 3.7.7 Component Cooling Water (CCW) System 3.7.8 Service Water System (SWS) 3.7.9 Ultimate Heat Sink (UHS) 3.7.10 Control Room Emergency Ventilation System (CREVS) 3.7.11 Control Room Emergency Air Temperature System (CREATCS) 3.8.1 AC Sources - Operating 3.8.4 DC Sources - Operating 3.8.7 Inverters - Operating 3.8.9 Distribution System - Operating All of these LCOs except 3.4.6, RCS Loops - Mode 4, have their bases predicated on a design basis LOCA as explained in the foregoing discussion.

LCO 3.4.6 is based on maintaining adequate reactor system flow such that all the core heat can be transferred to either the SGs or the DHR system. When operating in Mode 4 if both RCS loops and one DHR loop is inoperable, the existing LCO requires cooldown to Mode 5. In this situation, SGs are available for core heat removal and transport via NC in Mode 4 without the need for significant RCS heatup. Proceeding to Mode 5 makes few if any additional systems available for decay heat removal (assuming a failure of the remaining DHR system). The one system that can be made available in Mode 5 to provide backup to the DHR system is the BWST via gravity draining to the RCS. However, this requires a time delay while appropriate plant alignments are made. Given these considerations and the fact that multiple feedwater systems are available to feed the SGs, continued use of SGs for this situation will adequately cool the core while avoiding the additional risk associated with SDC (see 4.4.3, LCO 3.4.6: RCS Loops - Mode 4, for additional details).

Based on the previous discussions it is considered that the answer to the question postulated at the outset of this conclusion is answered in the affirmative, i.e., yes, Mode 4 is a satisfactory end-state for the LCOs being proposed for an end-state change.

DATE: 1/12/04 PAGE -93 DATE: 1/12/04 PAGE - 93

Licensing Working Group Risk Informed Jusiqication For Licensing Workeing Group Risk Inform ed Justift cation For LCO End-state Changes

8.0 REFERENCES

1. NUREG-1430, Standard Technical Specifications Babcock and Wilcox Plants, Revision 2, June 2001.

2. GL 88-17, Generic Letter - Loss of Decay Heat Removal, USNRC, October 17, 1998.

3. GL 98-02, Generic Letter - Loss of Reactor Coolant and Potential Loss of Emergency Mitigation Functions While in a Shutdown Condition, USNRC, May 28, 1998.

4. Davis-Besse Mode 3 PSA, Rev. 0

5. Davis-Besse Mode 4 PSA, Rev. 0

6. Davis-Besse Shutdown PSA, Rev 0

7. RG 1.174, Revision 1, "An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions On Plant-Specific Changes To The Licensing Basis," USNRC, November 2002.

8. RG 1.177, "An Approach For Plant-Specific, Risk-Informed Decision Making: Technical Specifications," USNRC, August 1998.

9. USNRC, 10 CFR 50.36, "Technical Specifications," Federal Register, 60FR36953, July 19, 1995.

10. USNRC, "Safety Goals for Operations of Nuclear Power Plants; Policy Statement," Federal Register, 51 FR 30028, August 4, 1986.

1 1. "Staff Plan for Evaluating Safety Risks During Shutdown and Low Power Operation," Letter from James M. Taylor to the NRC Commissioners, U.S. NRC, Oct. 22, 1990.

12. GL 88-17, "USNRC Generic Letter 88-17: Loss of Decay Heat Removal," USNRC, October 17, 1988.

13. IN 95-03, "USNRC Information Notice 95-03: Loss of Reactor Coolant Inventory and Potential Loss of Emergency Mitigation Functions While in a Shutdown Condition,"

USNRC, January 18, 1995.

14. 95-03 (Supplement ), "USNRC Information Notice 95-03: Loss of Reactor Coolant Inventory and Potential Loss of Emergency Mitigation Functions While in a Shutdown Condition," USNRC, March 25, 1996.

15. GL 98-02, "USNRC Generic Letter 98-02: Loss of Reactor Coolant Inventory and Potential Loss of Emergency Mitigation Functions While in a Shutdown Condition," USNRC, May28, 1998.

DATE: 1/12/04 PAGE -94 DATE: 1/12/04 PAGE - 94

Licensing Working Group Risk Infortned Justification For LCO End-state Changes

16. NUMARC 91-96, "Guidance for Industry Actions to Assess Shutdown Management,"

Nuclear Energy Institute, December 1991.

17. BAW-2393, "Generic Template for Shutdown Risk Assessment," Framatome ANP, Nov.

2001

18. BAW-2415, "Generic Method to Assess Transition Risk," Framatome ANP, Dec. 2001

19. TR-1003113, J Wells, et. al., "An Analysis of Loss of Decay Heat Removal Trends and Initiating Event Frequencies," EPRI, Nov. 2001

20. NSAC 176L, "Safety Assessment of PWR Risk During Shutdown Operations," August 1992.

DATE: 1/12/04 PAGE-95 DATE: 1/12/04 PAGE - 95