CNRO-2006-00050, Request for Alternative ANO2-R&R-004, Request to Use ASME Code Case N-752, Risk-Informed Safety Classification and Treatment for Repair/Replacement Activities in Class 2 and 3 Moderate Energy Systems
| ML063250351 | |
| Person / Time | |
|---|---|
| Site: | Arkansas Nuclear  |
| Issue date: | 11/15/2006 |
| From: | Burford F Entergy Operations |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| AN02-R&R-004, N-752 CNRO-2006-00050 | |
| Download: ML063250351 (30) | |
Text
tergy Entergy Operations, Inc.
1340 Echelon Parkway Jackson, Mississippi 39213-8298 Tel 601-368-5758 F. G. Burford Acting Director Nuclear Safety & Licensing CNRO-2006-00050 November 15, 2006 U. S. Nuclear Regulatory Commission Attn.: Document Control Desk Washington, DC 20555-0001
SUBJECT:
Request for Alternative ANO2-R&R-004 Request to Use ASME Code Case N-752, Risk-Informed Safety Classification and Treatment for Repair / Replacement Activities in Class 2 and 3 Moderate Energy Systems Arkansas Nuclear One, Unit 2 Docket No. 50-368 Ucense No. NPF-6
Dear Sir or Madam:
Pursuant to 10 CFR 50.55a(a)(3)(1), Entergy Operations, Inc. (Entergy) requests the NRC staff authorize the use of the risk-informed process contained In draft ASME Code Case N-752, Risk-Infonned Safety Classification and Treatment for Repair/ Replacement Activities in Class 2 and 3 Moderate Energy Systems, at Arkansas Nuclear One, Unit 2 (ANO-2). This request, Request for Alternative ANO2-R&R-004, is provided in Enclosure 1. Draft ASME Code Case N-752 is provided In Enclosure 2.
This is a pilot application for the use of draft Code Case N-752; therefore, Entergy requests that the NRC waive any fees associated with the review of this request.
Entergy requests the NRC staff approve ANO2-R&R-004 by December 1, 2007. Should you have any questions regarding this submittal, please contact Guy Davant at (601) 368-5756.
This letter contains one commitment identified In Enclosure 3.
Very truly yours, FGB/GHD/ghd
Enclosures:
- 1.
Request for Alternative ANO2-R&R-004
- 2.
Draft ASME Code Case N-752
- 3.
Llcensee-Odentified Commitment A1C/47
CNRO-2006-00050 Page 2 of 2 cc:
Mr. W. A. Eaton (ECH)
Mr. J. S. Forbes (ANO)
Dr. Bruce S. Mallett U. S. Nuclear Regulatory Commission Region IV 611 Ryan Plaza Drive, Suite 400 Arlington, TX 76011 U. S. Nuclear Regulatory Commission Attn: Mr. Drew Holland MS O-7D1 Washington, DC 20555-0001 NRC Senior Resident Inspector Arkansas Nuclear One P. 0. Box 310 London, AR 72847
w ENCLOSURE 1 CNRO-2006-00050 AN02-R&R-004
p ENTERGY OPERATIONS, INC.
ARKANSAS NUCLEAR ONE, UNIT 2 REQUEST FOR ALTERNATIVE ANO2-R&R-004 I.
COMPONENTS Component Numbers:
Class 2 and 3 pressure boundary components in moderate energy systems Code Classes:
2 and 3
References:
- 1.
- 2.
Draft ASME Code Case N-752, Risk-Informed Safety Classification and Treatment for Repair / Replacement Activities in Class 2 and 3 Moderate Energy Systems
- 3.
10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components of Nuclear Power Reactors
- 4.
EPRI TR-1 12657, Rev B-A, Revised Risk-Informed Inservice Inspection Evaluation Procedure, dated December 1999 Examination Category:
Various Item Number:
Various
==
Description:==
Alternative Requirements for Repair / Replacement Activities in Class 2 and 3 Moderate Energy Systems Unit / Inspection Interval Arkansas Nuclear One, Unit 2 (ANO-2) -
3 rd and future intervals Applicability:
I1.
CODE REQUIREMENT(S)
ASME Section XI, IWA-4000 provides requirements for repair/ replacement activities in Class 1, 2, and 3 components.
Ill.
REQUESTED AUTHORIZATION Pursuant to 10 CFR 50.55a(a)(3)(i), Entergy Operations, Inc. (Entergy) proposes to use the categorization process contained in draft ASME Code Case N-752 at ANO-2 to be applied to components scoped within Class 2 and 3 moderate energy systems.
Specifically, this code case provides a process for determining the risk-informed safety classification (RISC) and treatment for repair/replacement activities in Class 2 and 3 moderate energy systems. It also defines applicability of requirements for repair /
replacement activities based upon the results of the RISC process. This code case Page 1 of 3
may be applied to Class 2 and 3 pressure-retaining items or their associated supports (exclusive of Class CC and MC items), in moderate energy systems. This code case shall be applied on a system basis, including all pressure-retaining items and their associated supports within the selected systems.
Upon completing the categorization process, components are ranked as either high safety significant (HSS) or low safety significant (LSS). Those components that are HSS will continue to meet existing ASME requirements for repair / replacement activities. Those components that are LSS will be exempt from ASME Section Xl repair / replacement requirements. This approach is consistent with the process defined in 10 CFR 50.69.
Entergy requests that the NRC grant this request for the life of the facility.
II1.
BASIS FOR THE PROPOSED ALTERNATIVE ASME Code Case N-660, Risk-Informed Safety Categorization for Repair/Replacement Activities, was developed to support NRC and industry promulgation of 10 CFR 50.69. Since the time N-660 was developed, trial application of the code case has been conducted and §50.69 has transitioned from an Advanced Notice of Public Rulemaking (ANPR) to a final rule. Lessons learned from these trial applications have resulted in various attempts to revise N-660 and ultimately have resulted in developing Code Case N-752, which is limited in application to Class 2 and 3 moderate energy systems.
Code Cases N-660 and N-752 are founded on the EPRI risk-informed ISI (RI-ISI) methodology documented in EPRI report TR-1 12657. Entergy, through its active participation in EPRI, has been instrumental in the research and development that formed the EPRI methodology as well as its application and use within the industry.
Additionally, a number of Entergy units served significant roles in attaining NRC acceptance of the technology and actual plant application. These include:
The first-ever approved RI-ISI application [Vermont Yankee (VY)];
The first full-scope application to a CE nuclear steam supply system (NSSS) design (ANO-2);
The first partial-scope applications to a B&W NSSS design (ANO-1);
The first full-scope follow-on BWR application (James A. FitzPatrick).
As part of the above activities, Entergy submitted, and NRC staff reviewed, the supporting calculations and analyses for the VY, ANO-1, and ANO-2 applications. As such, the staff is intimately familiar with the EPRI RI-ISI methodology and in particular, its application at Entergy.
The diligent effort put forth by EPRI, Entergy, and the NRC staff has identified the robustness of the EPRI methodology to the point that now 80% of plants with approved RI-ISI programs, or with programs being implemented, are using the EPRI RI-ISI methodology or related products (e.g., ASME Code Case N-663).
Page 2 of 3
As stated above, the classification process in Code Case N-752 is founded on the EPRI RI-ISI methodology. In essence, it consists of the consequence assessment portion of the RI-ISI methodology, supplemented with the "additional considerations" contained in NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline.
Upon approval of ANO2-R&R-004, Entergy staff will conduct the evaluation of the "additional considerations" at ANO-2 and, as applicable, revise the consequence ranking assignments for Class 2 and 3 moderate energy components when used in risk-informed repair / replacement activities. [Note: This will not impact/change the existing approved RI-ISI programs].
Consistent with 10 CFR 50.69, for those components identified as LSS, Entergy will replace the existing Section XI requirements, with owner defined periodic inspection and testing activities to confirm with reasonable confidence that the LSS item will remain capable of performing its safety-related functions under design basis conditions. Conditions that are identified that would prevent a LSS component from performing its safety-related function(s) under design basis conditions will be corrected in a timely manner. For significant conditions adverse to quality that may be identified, measures will be taken via the Appendix B corrective action program to provide reasonable confidence that the cause of the condition is determined and corrective action taken to preclude repetition.
In accordance with Section 1500 of Code Case N-752, Entergy shall review changes to the plant, operational practices, applicable plant and industry operational experience, and, as appropriate, update the probabilistic risk assessment (PRA) and categorization and treatment processes. Entergy shall perform this review in a timely manner but no longer than once every two refueling outages.
IV.
CONCLUSION 10 CFR 50.55a(a)(3) states:
"Proposed alternatives to the requirements of (c), (d), (e), (f), (g), and (h) of this section or portions thereof may be used when authorized by the Director of the Office of Nuclear Reactor Regulation. The applicant shall demonstrate that:
(i)
The proposed alternatives would provide an acceptable level of quality and safety, or (ii) Compliance with the specified requirements of this section would result in hardship or unusual difficulty without a compensating increase in the level of quality and safety."
As discussed above, Entergy believes Request for Alternative ANO2-R&R-004 provides a level of safety and quality consistent with Code requirements. Additionally, the alternative is consistent with the NRC's risk-informed classifications and treatment specified in 10 CFR 50.69. Therefore, Entergy requests the NRC authorize the proposed alternative in accordance with 10 CFR 50.55a(a)(3)(i) for the third and future intervals at ANO-2.
Page 3 of 3
ENCLOSURE 2 CNRO-2006-00050 DRAFT ASME CODE CASE N-752
BC06-250 Case N-752 Risk-Informed Safety Classification and Treatment For Repair/Replacement Activities In Class 2 and 3 Moderate Energy SystemsSection XI, Division 1 Inquiry: What alternative requirements may be used in lieu of IWA-1320, IWA-1400 (f),
(j) and (n), IWA-4000, IWA-6210(e), and IWA-6350 [2003 Addenda and later] for repair/replacement activities on items and their associated supports (exclusive of Class CC and MC items) in Class 2 and 3 moderate energy systems?
Reply: It is the opinion of the Committee that, as an alternative to IWA-1320, IWA-1400 (f), (j) and (n), 1WA-4000, IWA-6210(e), and 1WA-6350 [2003 Addenda and later] for Class 2 and 3 moderate energy systems, repair/replacement activities may be performed in accordance with the following requirements, when the item (exclusive of Class CC and MC items) has been classified in accordance with this case.
[Applicability: 1989 Edition with 1991 Addenda through 2004 Edition with 2005 Addenda]
-1000 SCOPE AND RESPONSIBILITY
-1100 Scope This Case provides a process for determining the Risk-Informed Safety Classification (RISC) and treatment for repair/replacement activities in Class 2 and 3 moderate energy systems. The Case also defines applicability of requirements for repair/replacement activities based upon the results of the RISC process. This Case may be applied to Class 2, 3, or non-class (1) pressure-retaining items or their associated supports (exclusive of Class CC and MC items), in moderate energy systems. This Case shall be applied on a system basis, including all pressure retaining items and their associated supports within the selected systems.
-1200 Classifications Pressure retaining and component support items in Class 2 and 3 moderate energy systems shall be classified High Safety Significant (HSS) or Low Safety Significant (LSS) in accordance with this case. These classifications might not be directly related to other risk-informed applications. Any differences in an item's classification between this Case and previous risk-informed applications (e.g. RI-ISI) shall be identified (e.g. PSI),
reconciled and documented.
(a) All items that are within the break exclusion region(2) that are greater than NPS 4 (DN 100) shall be classified as HSS.
(b) Any piping segment whose pressure boundary failure contributes to an accident sequence with a core damage frequency of greater than or equal to 1 E-06/yr, shall be categorized as HSS. These core damage frequencies shall be determined from the plant-Page 1 of 21
BC06-250 specific PRA, which shall meet the requirements of -1330, by increasing the assumed break frequency by a factor of 10.
(c) Shutdown operation shall be evaluated. Any piping segment not HSS per (a) or (b) above shall be reviewed and adjusted to reflect the pressure boundary failure's impact on plant operation during shutdown. 3)
If the plant has performed a shutdown PRA, the important initiators and systems will have already been identified for shutdown operation, and their accompying impact on core damage and containment performance. If a shutdown PRA is not available, the impact of pressure boundary failures on core damage and containment performance shall be evaluated. The major characteristics to be considered are defined as follows:
> The system operations, safety functions, and success criteria change in different stages of other modes of operation.
> The exposure time for the majority of the piping associated with shutdown operation is typically less than 10 percent per year. The exposure time associated with being in a more risk significant configuration is even lower, depending on the function or system that is being evaluated.
> The unavailability of mitigating trains could be higher due to planned maintenance activities. Shutdown guidelines need to be evaluated to assure that sufficient redundancy is protected during different modes of operation. (4)
Recovery time may be longer, and allows for multiple operator actions.
(d) External events shall be evaluated. Any piping segment not HSS per (a), (b) or (c) above shall be reviewed and adjusted to reflect the pressure boundary failures impact on the mitigation of external events.(3)
The impact of external events on core damage and containment performance shall be evaluated from two perspectives as follows:
> External events that can cause a pressure boundary failure (e.g. seismic events),
and
> External events that do not affect pressure boundary failure likelihood, but create demands which may cause pressure boundary failure and events (e.g.
fires).
(e) Piping segments determined to not be HSS per (a) through (d) above shall be determined to be HSS or LSS by considering the information in (1) through (10) below.
The size of the pressure boundary failure, credit for plant features, and operator actions shall be consistent with the requirements of -1330. The following conditions shall be evaluated and answered TRUE or FALSE.
(1) Failure of the pressure retaining function of the segment will not directly or indirectly (e.g., through spatial effects) fail a basic safety function.
(2) Failure of the pressure retaining function of the segment will not prevent the plant from reaching or maintaining safe shutdown conditions; and the pressure Page 2 of 21
BC06-250 retaining function is not significant to safety during mode changes or shutdown.
Assume that the plant would be unable to reach or maintain safe shutdown conditions if a pressure boundary failure results in the need for actions outside of plant procedures or available backup plant mitigative features.
(3) The pressure retaining function of the segment is not called out or relied upon in the plant Emergency/Abnormal Operating Procedures or similar guidance as the sole means for the successful performance of operator actions required to mitigate an accident or transient.
(4) The pressure retaining function of the segment is not called out or relied upon in the plant Emergency/Abnormal Operating Procedures or similar guidance as the sole means for assuring long term containment integrity, monitoring of post-accident conditions, or offsite emergency planning activities.
(5) Failure of the pressure retaining function of the segment will not result in an unintentional release of radioactive material that would result in the implementation of offsite radiological protective actions.
The RISC process shall demonstrate that the defense-in-depth philosophy is maintained. Defense-in-depth is maintained if:
(6) Reasonable balance is preserved among prevention of core damage, prevention of containment failure or bypass, and mitigation of an offsite release.
(7) There is no over-reliance on programmatic activities and operator actions to compensate for weaknesses in the plant design.
(8) System redundancy, independence, and diversity are preserved commensurate with the expected frequency of challenges, consequences of failure of the system, and associated uncertainties in determining these parameters.
(9) Potential for common cause failures is taken into account in the risk analysis categorization.
(10) Independence of fission-product barriers is not degraded.
If any of the above ten (10) conditions are answered FALSE, then HSS shall be assigned. Otherwise, LSS may be assigned.
(f) Any piping segment whose pressure boundary failure contributes to an accident sequence with a core damage frequency of less than 1 E-06/yr per (b) above, and not identified as HSS in (a), (c), (d) or (e) above, shall be categorized as LSS.
(g) In lieu of the above (i.e. -1200 (a) through (f)), the categorization process of Appendix I may be used.
Page 3 of 21
BC06-250
-1300 OWNER'S RESPONSIBILITY
-1310 Determination of Classification The Owner shall determine and document the appropriate RISC of this Case.
-1320 Required Disciplines The owner shall provide personnel to perform the RISC, review and documentation. As a minimum, personnel with expertise in the following disciplines shall be included:.
(a) probabilistic risk assessment (PRA)
(b) plant operations (c) system design (d) safety or accident analysis Personnel may be experts in more than one discipline, but are not required to be experts in all disciplines.
-1330 PRA Scope and Technical Adequacy The PRA shall at a minimum model severe accident scenarios resulting from internal initiating events occurring at full power operation. The PRA shall be of sufficient technical adequacy and level of detail to support the categorization process including verification of assumptions on equipment reliability for equipment not within the scope of this case. The PRA must be subjected to a review process assessed against a standard (5) or set of acceptance criteria (6) that is endorsed by the regulatory agency having jurisdiction over the plant site. All deficiencies necessary to support the categorization process shall be reconciled. The resolution of all PRA issues shall be documented.
Appendix I contains PRA Scope and Technical Adequacy requirements unique to that Appendix.
Page 4 of 21
BC06-250
-1400 ALTERNATIVE REQUIREMENTS
-1410 High Safety Significant Items There are no alternative requirements for HSS items.
-1420 Low Safety Significant Items LSS items are exempt from the requirements of IWA-1320, IWA-1400(f), (j) and (n),
IWA-4000, IWA-6210(e) and IWA-6350 [2003 Addenda and later].
-1500 FEEDBACK AND PROCESS ADJUSTMENT The owner shall review changes to the plant, operational practices, applicable plant and industry operational experience, and, as appropriate, update the PRA and categorization and treatment processes. The owner shall perform this review in a timely manner but no longer than once every two refueling outages.
(a) High Safety Significant Items -The owner shall monitor the performance of HSS items. The owner shall make adjustments as necessary to either the categorization or treatment processes so that the categorization process and results are maintained valid.
(b) Low Safety Significant Items - The owner shall consider data collected (e.g.
operational data) to determine if there are any adverse changes in performance such that the item's unreliability values approach or exceed the values used in the evaluations conducted to satisfy -1200. The owner shall make adjustments as necessary to the categorization or treatment processes so that the categorization process and results are maintained valid.
Page 5 of 21
BC06-250
-9000 GLOSSARY accident sequence - a representation in terms of an initiating event followed by a sequence of failures or successes of events (such as system, function, or operator performance) that can lead to undesired consequences, with a specified end state (e.g.
core damage or large early release).
basic safety function - one of the key safety functions of the plant; reactivity control, core cooling, heat sink, and RCS inventory [Note: loss of a single train would typically not constitute a loss of a function]
completion time (CT) - the amount of time allowed for completing a required action. In the context of this Case, the required action is to restore operability (as defined in the technical specifications) to the affected system or equipment train conditional consequence - an estimate of an undesired consequence, such as core damage or a breach of containment, assuming failure of an item (e.g., conditional core damage probability (CCDP))
conditional core damage probability (CCDP) - an estimate of the probability of an undesired consequence of core damage given a specific failure (e.g., piping segment failure) conditional large early release probability (CLERP) - an estimate of the probability of an undesired consequence of large early release given a specific failure (e.g., piping segment failure) containment barrier - a component(s) that provides a containment boundary/isolation function including normally closed valves or valves that are designed to go closed upon actuation core damage - uncovery and heatup of the reactor core to the point at which prolonged oxidation and severe fuel damage involving a large fraction of the core is anticipated core damage frequency (CDF) - expected number of core damage events per unit time failure - an event involving leakage, rupture, or other condition that would prevent an item from performing its intended safety function failure mode - a specific functional manifestation of a failure (i.e., the means by which an observer can determine that a failure has occurred) by precluding the successful operation of a piece of equipment, a component, or a system (e.g., fails to start, fails to run, leaks) failure modes and effects analysis (FMEA) - a process for identifying failure modes of specific items and evaluating their effects on other components, subsystems, and systems failure potential - likelihood of ruptures or leakage that result in a reduction or loss of the pressure-retaining capability of the item or the likelihood of a condition that would prevent an item from performing its safety function (e.g., fails to start, fails to run)
Page 6 of 21
BC06-250 high-energy system - A system that is either in operation or maintained pressurized under conditions where either or both of the following are met:
- a. operating temperature exceeds 200 TF (95 C), or
- b.
operating pressure exceeds 275 psig (1.9 MPa) high-safety-significant (HSS) function - a function that has been determined to be safety significant from the plant probabilistic risk assessment or from other relevant information (e.g., defense in depth considerations) [Note: loss of a single train would typically not constitute a loss of a function]
initiating event (IE) - any event either internal or external to the plant that perturbs the steady-state operation of the plant, if operating, thereby initiating an abnormal event such as a transient or LOCA within the plant. Initiating events trigger sequences of events that challenge plant control and safety systems whose failure could potentially lead to core damage or large early release large early release - the rapid, unmitigated release of airborne fission products from the containment to the environment occurring before the effective implementation of off-site emergency response and protective actions such that there is a potential for early health effects low-safety-significant (LSS) function - a function not determined to be high-safety significant from the plant probabilistic risk assessment or from other relevant information (e.g., defense in depth considerations) moderate-energy system -
A system that during normal plant conditions is either operated or maintained at conditions below that specified for a high energy system. For the purposes of break postulation, a systems that qualifies as a high energy system for only a short period of time but qualifies as a moderate-energy system for the major operational period may be treated as a moderate-energy system.
Short operational periods are defined as about 2 percent of the time that the system operates as a high-energy system (e.g., reactor decay heat removal). However, systems such as auxiliary feedwater systems operated during PWR reactor startup, hot standby, or shutdown qualify as high-energy systems.
operator recovery action - a human action performed to regain equipment or system operability from a specific failure or human error in order to mitigate or reduce the consequences of the failure piping segment - a portion of piping, components, or a combination thereof, and their supports, in which a failure at any location results in the same consequence (e.g., loss of a system, loss of a pump train, indirect effects) plant mitigative features - systems, structures, and components that can be relied on to prevent an accident or that can be used to mitigate the consequences of an accident pressure-boundary failure - piping segment failures involving ruptures or leakage that result in a reduction or loss of the item's pressure-retaining capability Page 7 of 21
BC06-250 probabilistic risk assessment (PRA) - a quantitative assessment of the risk associated with plant operation and maintenance that is measured in terms of frequency of occurrence of risk metrics, such as core damage or a radioactive material release and its effects on the health of the public (also referred to as a probabilistic safety assessment, PSA) risk metrics - a determination of what activity or conditions produce the risk, and what individual, group, or property is affected by the risk spatial effect - a failure consequence affecting other systems or components, such as failures due to pipe whip, jet impingement, jet spray, harsh environment, debris generation or flooding success criteria - criteria for establishing the minimum number or combination of systems or components required to operate, or minimum levels of performance per component during a specific period of time, to ensure that the safety functions are satisfied train - As used in Appendix I, a train consists of a set of equipment (e.g., pump, piping, associated valves, motor, and control power) that individually fulfills a safety function (e.g., high-pressure safety injection) with an unavailability of IE-02 as credited in Tables 1-2 and 1-3. A half train (0.5 trains) shall have a mean unavailability of 1 E-0 1, 1.5 trains shall have a mean unavailability of IE-03, etc.
unaffected backup train - a train that is not adversely impacted (i.e., failed or degraded) by the postulated piping failure in the FMEA evaluation. Impacts can be caused by direct or indirect effects of the postulated piping failure.
Page 8 of 21
BC06-250 APPENDIX I RISK-INFORMED SAFETY CLASSIFICATION (RISC) PROCESS FOR CLASS 2 AND 3 MODERATE ENERGY SYSTEMS 1-
1.0 INTRODUCTION
This Appendix describes a risk-informed process used to determine Risk-Informed Safety Classification (RISC) for Class 2 and 3 moderate energy systems. This RISC process is based on the conditional consequence of failure, given the postulated failure has occurred.
Piping segments are categorized based on the conditional consequence of failure.
This process divides each selected system into piping segments that are determined to have similar consequence of failure.
Once categorized, the safety significance of each piping segment is identified.
Figure I-1 illustrates the RISC methodology presented in the following sections.
[
~
Scope IdentificationI Select system and define boundaries for evaluation Consequence Evaluation Perform FMEA considering Direct & Indirect Effects Identify Impact Groups: Initiating Event, System/Train, Combination, Containment Consequence Categorization Determine Consequence Ranking from Quantitative Indices and Consequence Category Tables Classification Considerations Consider other relevant information, including defense-in-depth principles, for Medium/Low/None consequence categories I
Final Classification Definitions HSS - high-safety-significant LSS - low-safety-significant Reevaluation of Risk-Informed Safety Classifications Perform Periodic Reviews Assess Significance of Plant Design Changes and New Technical Information Figure I-1 Risk-Informed Safety Classification Process 1-2.0 SCOPE IDENTIFICATION The Owner shall define the boundaries included in the scope of the RISC evaluation process.
Page 9 of 21
A BC06-250 1-3.0 CONSEQUENCE EVALUATION 1-3.0.1 Introduction All pressure retaining items shall be evaluated by defining piping segments that are grouped based on similar conditional consequence (i.e., given failure of the piping segment). To accomplish this grouping, direct and indirect effects shall be assessed for each piping segment. A Consequence Category for each piping segment is determined from the Failure Modes and Effects Analysis and Impact Group Assessment as defined in 1-3.1.1 and 1-3.1.2, respectively. The failure consequence can be quantified using the available PRA(s) to support the impact group assessment of 1-3.1.2. Throughout the evaluations of 1-3.0, 3.1, and 3.2, credit may be taken for plant features and operator actions to the extent these would not be affected by failure of the segment under consideration. When crediting operator action, the likelihood for success and failure needs to be determined consistent with the PRA information as required in -1330. The scenario that results in the highest consequence ranking shall be used (7). To take credit for operator actions, the following features shall be provided:
" an alarm or other system feature to provide clear indication of failure, equipment activated to recover from the condition must not be affected by the
- failure, time duration and resources are sufficient to perform operator action, plant procedures to define operator actions, and operator training in the procedures.
1-3.0.2 PRA Scope and Technical Adequacy The technical adequacy of the PRA used to support the evaluations required by this Appendix shall be assessed. If there is a previously approved risk-informed inservice inspection (RI-ISI) program, then the PRA technical adequacy basis for that application shall be reviewed to confirm it is applicable to the safety significant categorization of this Case, including verification of assumptions on equipment reliability for equipment not within the scope of this case. If there is no approved RI-ISI program at the plant, where the regulatory authority having jurisdiction at the plant site has already accepted the use of the PRA, in the RI-ISI application, the Owner shall review the results of previous independent reviews (e.g. peer, regulatory) of the PRA including verification of assumptions on equipment reliability for equipment not within the scope of this case and ensure that any comments that could influence the results of the classification are incorporated or otherwise dispositioned. (8)
Page 10 of 21
BC06-250 1-3.1 Analysis and Assessments 1-3.1.1 Failure Modes and Effects Analysis (FMEA) (9). Potential failure modes for each system or piping segment shall be identified, and their effects shall be evaluated.
This evaluation shall consider the following:
(a) Pressure Boundary Failure Size. For moderate energy systems that have been designed and constructed to the requirements (i.e., administrative and technical) of one of the following codes or standards applicable to that item: ASME, ANSI, AWS AISC, AWWA, API-650, API-620, MSS-SPs, TEMA, and those standards referenced within these documents, the consequence evaluation may be performed assuming a small leak that is; (1) equivalent to the fluid flow from a circular opening of an area equal to that of a rectangle one-half pipe diameter in length and one-half pipe wall thickness in width, or (2) determined by analytical evaluations (10) that include all relevant design basis conditions (e.g. pressure, temperature, SSE), or (3) ensured due to a documented physical configuration that precludes the possibility of a large pressure-boundary failure (e.g., flow restricting orifice),
or (4) in lieu of (1), (2), or (3), a large pressure boundary failure shall be assumed.
(b) Isolability of the Break. A break can be automatically isolated by a check valve, a closed isolation valve, or an isolation valve that closes on a given signal.
In lieu of automatic isolation, operator action may be credited consistent with 1-3.0.1.
(c)
Indirect Effects. These include spatial effects (e.g., spray) and loss-of-inventory effects (e.g., draining of a tank).
(d) Initiating Events. Applicable initiating events are identified using a list of initiating events from the plant-specific PRA and the plant design basis. For systems or piping segments that are not modeled, either explicitly or implicitly, in the plant-specific PRA, analysis might be required to identify applicable initiating events.
This analysis shall be conducted in accordance with this appendix.
(e)
System Impact or Recovery. The means of detecting a failure, and the Technical Specifications associated with the system and other affected systems. Possible automatic and operator actions to prevent a loss of system function shall be evaluated.
(f) System Redundancy. The existence of redundancy for accident mitigation purposes shall be considered.
(g) System Configuration. The consequence evaluation and ranking is organized into four basic consequence impact groups as discussed in 1-3.1.2. The three corresponding system configurations for these impact groups are defined in Table I-6.
Page 11 of 21
BC06-250 1-3.1.2 Impact Group Assessment (9). The results of the FMEA evaluation for each system, or portion thereof, shall be classified into one of three core damage impact groups: initiating event, system, or combination.
In addition, failures shall also be evaluated for their importance relative to containment performance. Each system, or portion thereof, shall be partitioned into postulated piping failures that cause an initiating event, disable a system/train/loop without causing an initiating event, or cause an initiating event and disable a system/train/loop. The consequence category assignment (high, medium, low, or none) for each piping segment within each impact group shall be selected in accordance with (a) through (f) below.
(a)
Initiating Event (TE) Impact Group Assessment. When the postulated failure results in only an initiating event (e.g., loss of feedwater, reactor trip), the consequence shall be classified into one of four categories: high, medium, low, or none. The initiating event category shall be assigned according to the following:
(1) The initiating event shall be placed in one of the Design Basis Event Categories in Table I-1.
All applicable design basis events previously analyzed in the Owner's updated final safety analysis report or PRA shall be included.
(2)
Breaks that cause an initiating event classified as Category I (routine operation) need not be considered in this analysis.
(3) For breaks that result in Category II (Anticipated Event), Category III (Infrequent Event), or Category IV (Limiting Fault or Accident), the consequence category shall be assigned to the initiating event according to the conditional core damage probability (CCDP) criteria specified in Table 1-5.
Differences in the consequence rank between the use of Table I-1 and I-5 shall be reviewed, justified and documented or the higher consequence rank assigned. The quantitative index for the initiating event impact group is the ratio of the core damage frequency due to the initiating event to the frequency for that initiating event.
(b) System Impact Group Assessment. The consequence category of a failure that does not cause an initiating event, but degrades or fails a system/train/loop essential to prevention of core damage, shall be based on the following:
(1) Frequency of challenge that determines how often the affected function of the system is called upon. This corresponds to the frequency of events that require the system operation.
(2) Number of backup systems (portions of systems, trains, or portions of trains) available, which determines how many unaffected systems (portions of systems, trains, or portions of trains) are available to perform the same mitigating function as the degraded or failed system.
(3) Exposure time, which determines the time the system would be unavailable before the plant is changed to a different mode in which the failed system's function is no longer required, the failure is recovered, or other compensatory action is taken.
Exposure time is a function of the detection time and completion time, as defined in the plant Technical Specification.
Page 12 of 21
BC06-250 Consequence categories shall be assigned in accordance with Table 1-2 as High; Medium, or Low.
Frequency of challenge is grouped into design basis event categories II, III, and IV. Quantitative indices may be used to assign consequence categories in accordance with Table 1-5 in lieu of Table 1-2 provided the quantitative basis of Table 1-2 (e.g., one full train unavailability approximately 10-2, exposure time) is consistent with the failure scenario being evaluated. Differences in the consequence rank between the use of Table 1-2 and 1-5 shall be reviewed, justified and documented or the higher consequence rank assigned. The quantitative index for the system impact group is the product of the change in conditional core damage frequency (CCDF) and the exposure time.
Additionally, for defense in depth purposes, all postulated failures leading to "zero defense" (i.e., no backup trains) shall be assigned a high consequence.
(c) Combination Impact-Group Assessment. The consequence category for a piping segment whose failure results in both an initiating event and the degradation or loss of a system shall be determined using Table 1-3. The consequence category is a function of two factors:
(1) Use of the system to mitigate the induced initiating event; (2) Number of unaffected backup systems or trains available to perform the same function.
Quantitative indices may be used to assign consequence categories in accordance with Table 1-5 in lieu of Table 1-3 provided the quantitative basis of Table 1-3 (e.g.,
one full-train unavailability approximately 10-2) is consistent with the failure scenario being evaluated. Differences in the consequence rank between the use of Table 1-3 and I-5 shall be reviewed, justified and documented or the higher consequence rank assigned.
(d) Containment Performance Impact Group Assessment.
The above evaluations determine failure importance relative to core damage.
Failures shall also be evaluated for their importance relative to containment performance. This shall be evaluated as follows.
(1) For postulated failures that do not result in a LOCA that bypasses containment, the quantitative indices of Table 1-5 for CLERP shall be used.
(2)
Table 1-4 shall be used to assign consequence categories for those piping failures that can lead to a LOCA that bypasses containment.
(e)
Shutdown operation shall be evaluated. The previously established consequence rank shall be reviewed and adjusted to reflect the pressure boundary failures impact on plant operation during shutdown.(3 )
If the plant has a shutdown PRA, the important initiators and systems will have already been identified for shutdown operation, and their effect on core damage and containment performance. If a shutdown PRA is not available, the effect of pressure-boundary failures on core damage and containment performance shall be evaluated. The major characteristics to be considered are defined as follows:
Page. 13 of 21
BC06-250 The system operations, safety functions, and success criteria change in different stages of other modes of operation.
The exposure time for the majority of the piping associated with shutdown operation is typically less than 10 percent per year. The exposure time associated with being in a more risk-significant configuration is even shorter, depending on the function or system that is being evaluated.
The unavailability of mitigating trains could be higher due to planned maintenance activities. Shutdown guidelines need to be evaluated to assure that sufficient redundancy is protected during different modes of operation. (4)
Recovery time may be longer, thus allowing for multiple operator actions.
(f)
External events shall be evaluated. The previously established consequence rank shall be reviewed and adjusted to reflect the pressure boundary failures impact on the mitigation of external events.(3)
The effect of external events on core damage and containment performance shall be evaluated from two perspectives, as follows:
External events that can cause a pressure boundary failure (e.g. seismic events),
and External events that do not affect likelihood of pressure-boundary failure, but create demands that might cause pressure-boundary failure and events (e.g.
fires).
1-3.2 Classification 1-3.2.1 Final Risk-Informed Safety Classification. Piping segments may be grouped together within a system, if the analysis and assessment performed in 1-3.1 determines the effect of the postulated failures to be the same. The Risk-Informed Safety Classification shall be as follows:
Classification Definitions HSS - Piping segment considered high-safety-significant LSS - Piping segment considered low-safety-significant 1-3.2.2 Classification Considerations.
(a)
Piping segments determined to be a High consequence category in any table by the analysis and assessment in 1-3.1 shall be considered HSS.
(b) Piping segments determined to be a Medium, Low, or None (no change to base case) consequence category in any table by the consequence evaluation in 1-3.1 shall be determined to be HSS or LSS by considering the information in (1) through (10) below. Under the same conditions of 1-3.1.1 (a), a large pressure boundary leak does not need to be assumed. Also, credit may be taken for plant features and operator actions to the extent these would not be affected by failure of the segment under Page 14 of 21
BC06-250 consideration. If plant features and operator actions are credited, they shall be consistent with those credited in 1-3.1. The following conditions shall be evaluated and answered TRUE or FALSE.
(1) Failure of the pressure retaining function of the segment will not directly or indirectly (e.g., through spatial effects) fail a basic safety function.
(2) Failure of the pressure retaining function of the segment will not prevent the plant from reaching or maintaining safe shutdown conditions; and the pressure retaining function is not significant to safety during mode changes or shutdown. Assume that the plant would be unable to reach or maintain safe shutdown conditions if a pressure boundary failure results in the need for actions outside of plant procedures or available backup plant mitigative features.
(3) The pressure retaining function of the segment is not called out or relied upon in the plant Emergency/Abnormal Operating Procedures or similar guidance as the sole means for the successful performance of operator actions required to mitigate an accident or transient.
(4)
The pressure retaining function of the segment is not called out or relied upon in the plant Emergency/Abnormal Operating Procedures or similar guidance as the sole means for assuring long term containment integrity, monitoring of post-accident conditions, or offsite emergency planning activities.
(5) Failure of the pressure retaining function of the segment will not result in an unintentional release of radioactive material that would result in the implementation of offsite radiological protective actions.
The RISC process shall demonstrate that the defense-in-depth philosophy is maintained. Defense-in-depth is maintained if:
(6) Reasonable balance is preserved among prevention of core damage, prevention of containment failure or bypass, and mitigation of an offsite release.
(7)
There is no over-reliance on programmatic activities and operator actions to compensate for weaknesses in the plant design.
(8) System redundancy, independence, and diversity are preserved commensurate with the expected frequency of challenges, consequences of failure of the system, and associated uncertainties in determining these parameters.
(9)
Potential for common cause failures is taken into account in the risk analysis categorization.
(10) Independence of fission-product barriers is not degraded.
If any of the above ten (10) conditions are answered FALSE, then HSS shall be assigned. Otherwise, LSS may be assigned.
(c) If LSS has been assigned from 1-3.2.2(b), then the RISC process shall verify that there are sufficient safety margins to account for uncertainty in the engineering Page 15 of 21
BC06-250 analysis and in the supporting data. Safety margin shall be incorporated when determining performance characteristics and parameters, e.g., piping segment, system, and plant capability or success criteria. The amount of margin should depend on the uncertainty associated with the performance parameters in question, the availability of alternatives to compensate for adverse performance, and the consequences of failure to meet the performance goals. Sufficient safety margins are maintained by ensuring that safety analysis acceptance criteria in the plant licensing basis are met, or proposed revisions account for analysis and data uncertainty.
If sufficient safety margins are maintained then LSS should be assigned; if not, then HSS shall be assigned.
(d) A component support, hanger, or snubber shall have the same classification as the highest-ranked piping segment within the piping analytical model in which the support is included.
Page 16 of 21
BC06-250 TABLE I-1 CONSEQUENCE CATEGORIES FOR INITIATING EVENT IMPACT GROUP Design Basis Initiating Event Representative Example Initiating Consequence Event Category Type Initiating Event Events Category Frequency Range (Note 1)
(1/yr)
I Routine Operation
>1 None II Anticipated Event 10-1<valuel Reactor Trip, Low/
Turbine Trip, Medium Partial Loss of Feedwater III Infrequent Event 1-02<value<10-1 Excessive Low/Medium Feedwater or Steam Removal Loss of Off Site Medium/High Power IV Limiting Fault or
<10.2 Small LOCA, Accident Steam Line Break, Medium/
Feedwater Line Break, Large High LOCA Note 1: Refer to I-3.1.2(a)(3)
Page 17 of 21
BC06-250 TABLE 1-2 GUIDELINES FOR ASSIGNING CONSEQUENCE CATEGORIES TO FAILURES RESULTING IN SYSTEM OR TRAIN LOSS Affected Systems l
Frequency* iExposureTlime of Challenge to Challenge Anticipated All Year (DB Cat II)
Between tests (1-3 months)
Long CT
(:< I week)
Short CT
(< 1 day)
Infrequent All Year (DB Cat. III)
Between tests (1-3 months)
Long CT
(-< I week)
Short CT
(< __I day)
Unexpected All Year (DB Cat. IV)
Between tests (1-3 months)
Long CT
(_< I week)
Short CT
(__< I day)
Number of Unaffected Backup Trains*
______iii____________ I 0.0 0.5 J
1.0 1
1.5 2.0 2.5 3.0 3.5 LOW*
LOW LOW LOW LOW LOW LOW LOW LOW I LOW MI
[11 LOW*
LOW LOW LOW*
LOW LOW LOW LOW LOW LOW LOW LOW jLOW LOW MEDIUM LOW*
LOW LOW LOW LOW LOW LOW LOW LOW Note: If there is no containment barrier and the consequence category is marked by an *, the consequence category should be increased (medium to high or low to medium).
Page 18 of 21
BC06-250 TABLE 1-3 CONSEQUENCE CATEGORIES FOR COMBINATION IMPACT GROUP Event Consequence Category Initiating Event and 1 Unaffected Train of High Mitigating System Available Initiating Event and 2 Unaffected Trains of Medium' Mitigating Systems Available (or LIE Consequence Category from Table I-1)
Initiating Event and More Than 2 Unaffected Low' Trains of Mitigating Systems Available (or IE Consequence Category from Table I-1)
Initiating Event and No Mitigating System N/A Affected Note 1: The higher classification of this table or Table I-1 shall be used.
TABLE 1-4 CONSEQUENCE CATEGORIES FOR FAILURES RESULTING IN INCREASED POTENTIAL FOR AN UNISOLATED LOCA OUTSIDE OF CONTAINMENT Protection Against LOCA Outside Containment One Active' One Passive 2
Two Active Consequence Category One Active, One Passive Two Passive More than Two Note 1: An example of Active Protection is a valve that needs to close on demand.
Note 2: An example of Passive Protection is a valve that needs to remain closed.
TABLE 1-5 QUANTITATIVE INDICES FOR CONSEQUENCE CATEGORIES CCDP, no units CLERP, no units Consequence
>1_-4
_Category
>>10 4
High 106 < value:< 10-4 10-7 < value < 10-Medium
<106
<10-7 Low No change to base case No change to base case None Page 19 of 21
BC06-250 Table 1-6 Definition of Consequence Impact Groups and Configurations Initiating Event Operating A PBF* occurs in an operating (pressurized) system resulting in an initiating event Loss of Standby A PBF occurs in a standby system and does not result in Mitigating an initiating event, but degrades the mitigating Ability capabilities of a system or train. After failure is discovered, the plant enters the applicable Allowed Outage Time defined in the Technical Specification Demand A PBF occurs when system/train operation is required by an independent demand Combination Operating A PBF causes an initiating event with an additional loss of mitigating ability (in addition to the expected mitigating degradation due to the initiator)
Containment Any A PBF, in addition to the above impacts, also affects containment performance PBF - pressure-boundary failure Page 20 of 21
4P 1*
BC06-250 Footnotes:
(1) Non-class items are items not classified in accordance with IWA-1320.
(2) Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, NUREG-0800, Revision 2, section 3.6.2, provides an acceptable method for defining this scope of piping.
(3) Further details are discussed in USNRC Safety Evaluation Report dated October 28, 1999 and EPRI Report TR-112657, Rev B-A.
(4) Further details are discussed in NUMARC 91-06, "Guidelines for Industry Actions to Address Shutdown Management" dated 1991.
(5) A standard that provides an acceptable method for determining PRA scope, technical adequacy and peer review requirements is ASME RA-S-2002, Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications with the RA-Sa-2003 Addenda and the RA-Sb-2005 Addenda. This standard sets forth requirements for PRAs used to support risk-informed decisions for commercial nuclear power plants, Peer review and PRA review processes and requirements and prescribes a method for applying these requirements for various categories of applications.
(6) An acceptable set of requirements and acceptance criteria is the peer review process described in NEI 00-02, "Probabilistic Risk Assessment Peer Review Process Guidance, "as amended to incorporate NRC comments provided in the NRC's letter to NEI, dated April 2, 2002 and as endorsed in Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessments. "
(7) Further details on the evaluation of operator actions and its impact on the consequence ranking are provided in USNRC Safety Evaluation Report dated October 28, 1999 on EPRIReport TR-112657, Rev B-A.
(8) EPRI TR-1006937, "Extension of the EPRI RI-ISI Methodology to Break Exclusion Region (BER)
Programs, "Rev. O-A, provides an acceptable approach for conducting this review.
(9) Further details on the evaluation and ranking of the consequence impact groups and configurations are discussed in USNRC Safety Evaluation report dated October 28, 1999 and EPRI Report TR-112657, Rev B-A.
(10) Generic Letter 90-05, "Guidance for Performing Temporary Non-Code Repair of ASME Code Class 1, 2 and 3 Piping, "provides an example of acceptable guidance in determining alternate leak sizes.
Page 21 of 21
'IL ENCLOSURE 3 CNRO-2006-00050 LICENSEE-IDENTIFIED COMMITMENT to CNRO-2006-00050 Page 1 of 1 LICENSEE-IDENTIFIED COMMITMENTS TYPE (Check one)
SCHEDULED ONE-TIME CONTINUING COMPLETION COMMITMENT ACTION COMPLIANCE DATE In accordance with Section 1500 of Code Case
/
Upon N-752, Entergy shall review changes to the plant, implementation operational practices, applicable plant and industry of operational experience, and, as appropriate, update ANO2-R&R-004 the probabilistic risk assessment (PRA) and categorization and treatment processes. Entergy shall perform this review in a timely manner but no longer than once every two refueling. outages.