L-19-189, 54010-CALC-01, Davis-Besse Nuclear Power Station: Evaluation of Risk Significance of Permanent ILRT Extension.

54010-CALC-01, Davis-Besse Nuclear Power Station: Evaluation of Risk Significance of Permanent ILRT Extension.

ML19241A244
Person / Time
Site:	Davis Besse
Issue date:	07/29/2019
From:	Sattler J Jensen Hughes
To:	FirstEnergy Nuclear Operating Co, Office of Nuclear Reactor Regulation
References
L-19-189 54010-CALC-01
Download: ML19241A244 (45)

Text

0 JENSEN HUGHES Advancing the Science of Safety Davis-Besse Nuclear Power Station:

Evaluation of Risk Significance of Permanent ILRT Extension 5401 O-CALC-01 Prepared for:

First Energy Nuclear Operating Company (FENOC)

Project

Title:

Permanent ILRT Extension Revision: 1 Name and Date Preparer: Justin Sattler

~ ~9ighally signed by Justin Sattler L ' ' I

, _J:tate: 2019.07.29 13:19:38-05'00' Reviewer: Kelly Wright n ~)tally signed by Kelly Wright Il_l:oate: 2019.07.2916:47:37-04'00'

._::::_::_.=._]

Review Method Design Review l2J Alternate Calculation D Approved by: Matthew Johnson Revision 1 Page 1 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension REVISION RECORD

SUMMARY

Revision Revision Summary 0 Initial Issue Incorporated editorial FENOC comments in Appendix A Revision 1 Page 2 of45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension TABLE OF CONTENTS 1.0 PURPOSE ...................................................................................................................... 4 2.0 SCOPE ........................................................................................................................... 4

3.0 REFERENCES

............................................................................................................... 6 4.0 ASSUMPTIONS AND LIMITATIONS .............................................................................. 9 5.0 METHODOLOGY and analysis.-.....................................................................................10 5.1 lnputs ..........................................................................................................................10 5.1.1 General Resources Available ............................................................................... 10 5.1.2 Plant Specific Inputs ............................................................................................13 5.1.3 Impact of Extension on Detection of Component Failures that Lead to Leakage (Small and Large) .............................................................................................. 15 5.2 Analysis ......................................................................................................................16 5.2.1 Step 1 - Quantify the Baseline Risk in Terms of F_requency per Reactor Year. .... 17 5.2.2 Step 2 - Develop Plant-Specific Person-Rem Dose (Population Dose) ................ 20 5.2.3 Step 3 - Evaluate Risk Impact of Extending Type A Test Interval from 10 to 15 Years .................................................................................................................21 5.2.4 Step 4- Determine the Change in Risk in Terms of LERF ................................... 23 5.2.5 Step 5 - Determine the Impact on the Conditional Containment Failure Probability

.......................................................................................................................... 24 5.2.6 Impact of Extension on Detection of Steel Liner Corrosion that Leads to Leakage

.......................................................................................................................... 24 5.2. 7 Impact from External Events Contribution ............................................................27 5.2.7.1 Screened External Hazards .......................................................................28 5.2.8 Defense-In-Depth lmpact ........................................................... :......................... 29 5.3 Sensitivities .................................................................................................................31 5.3.1 Potential Impact from Steel Liner Corrosion Likelihood ........................................ 31 5.3.2 Expert Elicitation Sensitivity .................................................................................32 6.0 RESULTS ......................................................................................................................34

7.0 CONCLUSION

S AND RECOMMENDATIONS .............................................................. 35 A. Attachment 1 .................................................................................................................37 Revision 1 Page 3 of45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension 1.0 PURPOSE The purpose of this analysis is to provide a risk assessment of permanently extending the currently allowed containment Type A Integrated Leak Rate Test (ILRT) from ten years to fifteen years. The extension would allow for substantial cost savings as the ILRT could be deferred for additional scheduled refueling outages for the Davis-Besse Nuclear Power Station (DBNPS).

The risk assessment follows the guidelines from NEI 94-01, Revision 3-A [Reference 1], the NEI "Interim Guidance for Performing Risk Impact Assessments in Support of One-Time Extensions for Containment Integrated Leakage Rate Test Surveillance Intervals" from November 2001

[Reference 3], the NRC regulatory guidance on the use of Probabilistic Risk Assessment (PRA) as stated in Regulatory Guide 1.200 as applied to ILRT interval extensions, risk insights in support of a request for a plant's licensing basis as outlined in Regulatory Guide (RG) 1.174

[Reference 4], the methodology used for Calvert Cliffs to estimate the likelihood and risk implications of corrosion-induced leakage of steel liners going undetected during the extended test interval [Reference 5], and the methodology used in EPRI 1018243 [Reference 24],

Revision 2-A of EPRI 1009325 [Reference 46].

2.0 SCOPE Revisions to 10CFR50, Appendix J (Option B) allow individual plants to extend the Integrated Leak Rate Test (ILRT) Type A surveillance testing frequency requirement from three in ten years to at least once in ten years. The revised Type A frequency is based on an acceptable performance history defined as two consecutive periodic Type A tests at least 24 months apart in which the calculated performance leakage rate was less than limiting containment leakage rate of 1La.

The basis for the current 10-year test interval is provided in Section 11.0 of NEI 94-01, Revision 0, and established in 1995 during development of the performance-based Option B to Appendix J. Section 11.0 of NEI 94-01 states that NUREG-1493, "Performance-Based Containment Leak Test Program," September 1995 [Reference 6], provides the technical basis to support rulemaking to revise leakage rate testing requirements contained in Option B to Appendix J. The basis consisted of qualitative and quantitative assessment of the risk impact (in terms of

'increased public dose) associated with a range of extended leakage rate test intervals. To supplement the NRC's rulemaking basis, NEI undertook a similar study. The results of that study are documented in Electric Power Research Institute (EPRI) Research Project TR-104285, "Risk Impact Assessment of Revised Containment Leak Rate Testing Intervals."

The NRC report on performance-based leak testing, NUREG-1493, analyzed the effects of containment leakage on the health and safety of the public and the benefits realized from the containment leak rate testing. In that analysis, it was determined that for a representative PWR plant (i.e., Surry), containment isolation failures contribute less than 0.1 % to the latent risks from reactor accidents. Consequently, it is desirable to show that extending the ILRT interval will not lead to a substantial increase in risk from containment isolation failures for DBNPS.

NEI 94-01 Revision 3-A supports using EPRI Report No. 1009325 Revision 2-A (EPRI 1018243), "Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals," for performing risk impact assessments in support of ILRT extensions [Reference 24]. The Guidance provided in Appendix H of EPRI Report No. 1009325 Revision 2-A builds on the EPRI Risk Assessment methodology, EPRI TR-104285. This methodology is followed to determine the appropriate risk information for use in evaluating the impact of the proposed ILRT changes.

It should be noted that containment leak-tight integrity is also verified through periodic in-service inspections conducted in accordance with the requirements of the American Society of Revision 1 Page 4 of45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension Mechanical Engineers (ASME) Boiler and Pressure Vessel Code Section XI. More specifically, Subsection IWE provides the rules and requirements for in-service inspection of Class MC pressure-retaining components and their integral attachments, and of metallic shell and penetration liners of Class CC pressure-retaining components and their integral attachments in light-water cooled plants. Furthermore, NRG regulations 10 CFR 50.55a(b)(2)(ix)(E) require licensees to conduct visual inspections of the accessible areas of the interior of the containment. The associated change to NEI 94-01 will require that visual examinations be conducted during at least three other outages, and in the outage during which the ILRT is being conducted. These requirements will not be changed as a result of the extended ILRT interval. In addition, Appendix J, Type B local leak tests performed to verify the leak-tight integrity of containment penetration bellows, airlocks, seals, and gaskets are also not affected by the change to the Type A test frequency.

The acceptance guidelines in RG 1.174 are used to assess the acceptability of this permanent extension of the Type A test interval beyond that established during the Option B rulemaking of Appendix J. RG 1.174 defines very small changes in the risk-acceptance guidelines as increases in Core Damage Frequency (GDF) less than 1o-s per reactor year and increases in Large Early Release Frequency (LERF) less than 10-7 per reactor year. Since the Type A test does not impact GDF, the relevant criterion is the change in LERF. RG 1.174 also defines small changes in LERF as below 1o-s per reactor year. RG 1.174 discusses defense-in-depth and encourages the use of risk analysis techniques to help ensure and show that key principles, such as the defense-in-depth philosophy, are met. Therefore, the increase in the Conditional Containment Failure Probability (CCFP), which helps ensure the defense-in-depth philosophy is maintained, is also calculated. I Regarding CCFP, changes of up to 1.1 % have been accepted by the NRG for the one-time requests for extension of ILRT intervals. In context, it is noted that a CCFP of 1/10 (10%) has been approved for application to evolutionary light water designs. Given these perspectives, a change in the CCFP of up to 1.5% is assumed to be small.

In addition, the total annual risk (person-rem/year population dose) is examined to demonstrate the relative change in this parameter. While no acceptance guidelines for these additional figures of merit are p,uqlished, examinations of NUREG:-1493 and $afety Evaluation Repqrts (SER) for one-time interval extension (summarized in Appendix G of Reference 24) indicate a range of incremental increases in population dose that have been accepted by the NRG. The range of incremental population dose increases is from S0.01 to 0.2 person-rem/year and/or 0.002% to 0.46% of the total accident dose. The total doses for the spectrum of all accidents (NUREG-1493 [Reference 6], Figure 7-2) result in health effects that are at least two orders of magnitude less than the NRG Safety Goal Risk. Given these perspectives, a small population dose is defined as an increase from the baseline interval (3 tests per 10 years) dose of S1 .0 person-rem per year or 1% of the total baseline dose, whichever is less restrictive for the risk impact assessment of the proposed extended ILRT interval.

Revision 1 Page 5 of45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension

3.0 REFERENCES

The following references were used in this calculation:

1. Revision 3-A to Industry Guideline for Implementing Performance-Based Option of 10 CFR Part 50, Appendix J, NEI 94-01, July 2012.

2. Risk Impact Assessment of Revised Containment Leak Rate Testing Intervals, EPRI, Palo Alto, CA EPRI TR-104285, August 1994.

3. Interim Guidance for Performing Risk Impact Assessments in Support of One-Time Extensions for Containment Integrated Leakage Rate Test Surveillance Intervals, Revision 4, developed for NEI by EPRI and Data Systems and Solutions, November 2001.

4. An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Regulatory Guide 1.174, Revision 3, January 2018.

5. Response to Request for Additional Information Concerning the License Amendment Request for a One-Time Integrated Leakage Rate Test Extension, Letter from Mr. C. H.

Cruse (Calvert Cliffs Nuclear Power Plant) to NRC Document Control Desk, Docket No.

50-317, March 27, 2002. *

6. Performance-Based Containment Leak-Test Program, NUREG-1493, September 1995.

7. Evaluation of Severe Accident Risks: Surry Unit 1, Main Report NUREG/CRi4551, SAND86-1309, Volume 3, Revision 1, Part 1, October 1990.

8. Letter from R. J. Barrett (Entergy) to U.S. Nuclear Regulatory Commission, IPN-01-007, January 18, 2001.

9. United States Nuclear Regulatory Commission, Indian Point Nuclear Generating Unit No. 3 - Issuance of Amendment Re: Frequency of Performance-Based Leakage Rate Testing (TAC No. MB0178), April 17, 2001.

10. Impact of Containment Building Lec!klflge on LWR Accident Risk, Oak Ridge National Laboratory, NUREG/CR-3539, ORNL/TM-8964, April 1984.

11. Reliability Analysis of Containment Isolation Systems, Pacific Northwest Laboratory, NUREG/CR-4220, PNL-5432, June 1985.

12. Technical Findings and Regulatory Analysis for Generic Safety Issue 11.E.4.3

'Containment Integrity Check', NUREG-1273, April 1988.

13. Review of Light Water Reactor Regulatory Requirements, Pacific Northwest Laboratory, NUREG/CR-4330, PNL-5809, Volume 2, June 1986.

14. Shutdown Risk Impact Assessment for Extended Containment Leakage Testing Intervals Utilizing ORAM', EPRI, Palo Alto, CA, TR-105189, Final Report, May 1995.

15. Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants, NUREG-1150, December 1990.

16. United States Nuclear Regulatory Commission, Reactor Safety Study, WASH-1400, October 1975.

17. Davis-Besse Nuclear Power Station, "PRA Notebook; 08-01: Quantification," Revision 6:

PRA-DB1-AL-R06, February 2019.

Revision 1 Page 6 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension

18. Letter from M. B. Bezilla (Davis-Besse) to U.S. Nuclear Regulatory Commission, Docket No. 50-346, License No. NPF-3, L-18-085, "Response to Request for Additional Information and Supplemental Information Regarding License Amendment Request to Adopt National Fire Protection Association (NFPA) Standard 805 (CAC No. MF7190),"

dated April 2, 2018.

19. Applicant's Environmental Report Operating License Renewal Stage, Appendix E, Davis-Besse Nuclear Power Station, August 2010.

20. Anthony R. Pietrangelo, One-time extensions of containment integrated leak rate test interval - additional information, NEI letter to Administrative Points of Contact, November 30, 2001.

21. Letter from J. A. Hutton (Exelon, Peach Bottom) to U. S. Nuclear Regulatory Commission, Docket No. 50-278, License No. DPR-56, LAR-01-00430, dated May 30, 2001.

22. Risk Assessment for Joseph M. Farley Nuclear Plant Regarding ILRT (Type A)

Extension Request, prepared for Southern Nuclear Operating Co. by ERIN Engineering and Research, P0293010002-1929-030602, March 2002.

23. Letter from D. E. Young (Florida Power, Crystal River) to U.S. Nuclear Regulatory Commission, 3F0401-11, dated April 25, 2001.

24. Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals, Revision 2-A of 1009325, EPRI, Palo Alto, CA, 1018243, October 2008.

25. Risk Assessment for Vogtle Electric Generating Plant Regarding the ILRT (Type A)

Extension Request, prepared for Southern Nuclear Operating Co. by ERIN Engineering and Research, February 2003.

26. Perspectives Gained from the IPEEE Program, USNRC, NUREG-1742, April 2002.

27. Procedure DB-PF-10310, Revision 7, Davis-Besse Nuclear Power Station, "Containment Integrated Leakage Rate Test."

28. Letter L-14 -121, ML14111A291, FENOC Evaluation of the Proposed Amendment, Beaver Valley Power Station, Unit Nos. 1 and 2, April 2014.

29. Technical Letter Report ML112070867, Containment Liner Corrosion Operating Experience Summary, Revision 1, August 2011.

30. Order 200429509, Surveillance Test DB-PF1031-001, "Containment Integrated Leakage Rate Test."

31. Letter L-16-337, ML16348A010, Davis-Besse Nuclear Power Station, "Mitigating Strategies Assessment (MSA) for Flooding CT AC No. MF3721)," December 12, 2016.

32. Davis-Besse Nuclear Power Station, "Seismic PRA Notebook; 11-05: Seismic PRA Quantification, Uncertainty, and Sensitivity," Revision 6: PRA-OB1-AL-R06, February 2019.

33 .. Letter L-17-176, ML17192A069, Davis-Besse Nuclear Power Station, "Focused Evaluation Regarding Near-Term Task Force Recommendation 2.1 for Flooding, (GAG No. MF3721)," July 11, 2017.

34. Individual Plant Examination of External Events for the Davis-Besse Nuclear Power Station, December 1996.

35. Email from Quaderer, A., "RE: DB RAI 3 fire model.zip," May 7, 2018.

Revision 1 Page 7 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension

36. Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2, March 2009.

37. ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," 2009.

38. NEI 05-04, "Process for Performing Internal Events PRA Peer Reviews Using the ASME/ANS PRA Standard," Revision 2, November 2008.

39. ML15350A314, FirstEnergy Nuclear Operating Company, Davis-Besse Nuclear Power Station, Transition to 10 CFR 50.48(c)- NFPA 805 Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants, 2001 Edition, Transition Report, December 2015.

40. NEI 07-12, "Fire Probabilistic Risk Assessment (FPRA) Peer Review Process Guidelines," Revision 1, June 2010.

41. NEI 12-13, "External Hazards PRA Peer Review Process Guidelines," August 2012.

42. Letter L-16-123, ML16267A471, Davis-Besse Nuclear Power Station, "Completion of Required Action by NRG Order EA-12-049, Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events (TAC No. MF0961)," September 23, 2016.

43. Davis-Besse Nuclear Power Station, "License Renewal Application," August 2010.

44. Davis-Besse Nuclear Power Station, "Updated Final Safety Analysis Report," Docket No:

50-346, License No: NPF-3, Revision 31, October 2016.

45. Regulatory Guide 1.76, "Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants," Revision 1, March 2007.

46. Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals, EPRI, Palo Alto, CA, 2007, 1009325 Revision 2.

I I Revision 1 Page 8 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension 4.0 ASSUMPTIONS AND LIMITATIONS The following assumptions were used in the calculation:

• The technical adequacy of the DBNPS PRA [Reference 17] is either consistent with the requirements of Regulatory Guide 1.200, or where gaps exist, the gaps have been addressed, as detailed in Attachment 1.

• The DBNPS Level 1 and Level 2 internal events PRA models provide representative results.

• It is appropriate to use the DBNPS internal events PRA model to effectively describe the risk change attributable to the ILRT extension. A study is done in Section 5.2.7 to show the effect of including external event models for the ILRT extension. The additional risk from the Seismic PRA [Reference 32] and the Fire PRA (draft model used to answer NFPA 805 PRA RAI 03, March 2018) [Reference 18] are used for this analysis.

• Accident classes describing radionuclide release end states are defined consistent with EPRI methodology [Reference 24].

• The representative containment leakage for Class 1 sequences is 1La. Class 3 accounts for increased leakage due to Type A inspection failures.

• The representative containment leakage for Class 3a sequences is 1Ola based on the previously approved methodology performed for Indian Point Unit 3 [Reference 8, Reference 9].

• The representative containment leakage for Class 3b sequences is 1OOLa based on the guidance provided in EPRI Report No. 1009325, Revision 2-A (EPRI 1018243)

[Reference 24].

• The Class 3b can be very conservatively categorized as LERF based on the previously approved methodology [Reference 8, Reference 9].

• The impact on population doses from containment bypass scenarios is not altered by the proposed ILRT extension, but is accounted for in the EPRI methodology as a separate entry for comparison purposes. Since the containment bypass contribution to population dose is fixed, no changes in the conclusions from this analysis will result from this I I separate categorization. '

• The reduction in ILRT frequency does not impact the reliability of containment isolation valves to close in response to a containment isolation signal [Reference 24].

• While precise numbers are maintained throughout the calculations, some values have been rounded when presented in this report. Therefore, rounding differences may result in table summations.

Revision 1 Page 9 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension 5.0 METHODOLOGY AND ANALYSIS 5.1 Inputs This section summarizes the general resources available as input (Section 5.1.1) and the plant specific resources required (Section 5.1.2).

5.1.1 General Resources Available Various industry studies on containment leakage risk assessment are briefly summarized here:

1. NUREG/CR-3539 [Reference 10]

2. NUREG/CR-4220 [Reference 11]

3. NUREG-1273 [Reference 12]

4. NUREG/CR-4330 [Reference 13]

5. EPRI TR-105189 [Reference 14]

6. NUREG-1493 [Reference 6]

7. EPRI TR-104285 [Reference 2]

8. NUREG-1150 [Reference 15] and NUREG/CR-4551 [Reference 7]

9. NEI Interim Guidance [Reference 3, Reference 20]

10. Calvert Cliffs liner corrosion analysis [Reference 5]

11. EPRI Report No. 1009325, Revision 2-A (EPRI 1018243), Appendix H [Reference 24]

This first study is applicable because it provides one basis for the threshold that could be used in the Level 2 PRA for the size of containment leakage that is considered significant and is to be included in the model. The second study is applicable because it provides a basis of the probability for significant pre-existing containment leakage at the time of a core damage accident. The third study is applicable because it is a subsequent study to NUREG/CR-4220 that undertook a more extensive evaluation of the same database. The fourth study provides an assessment of the impact of different containment leakage rates on plant risk. The fifth study provides an assessment of the impact on shutdown risk from ILRT test interval extension. The sixth study is the NRC's cost-benefit analysis of various alternative approaches regarding extending the test intervals and increasing the allowable leakage rates for containment in'tegrated and local leak rate tests. The seventh study is an EPRI study of the impact of extending ILRT and local leak rate test (LLRT) intervals on at-power public risk. The eighth study provides an ex-plant consequence analysis for a 50-mile radius surrounding a plant that is used as the basis for the consequence analysis of the ILRT interval extension for DBNPS. The ninth study includes the NEI recommended methodology (promulgated in two letters) for evaluating the risk associated with obtaining a one-time extension of the ILRT interval. The tenth study addresses the impact of age-related degradation of the containment liners on ILRT evaluations. Finally, the eleventh study builds on the previous work and includes a recommended methodology and template for evaluating the risk associated with a permanent 15-year extension of the ILRT interval.

NUREG/CR-3539 [Reference 10]

Oak Ridge National Laboratory documented a study of the impact of containment leak rates on public risk in NUREG/CR-3539. This study uses information from WASH-1400 [Reference 16]

as the basis for its risk sensitivity calculations. ORNL concluded that the impact of leakage rates on LWR accident risks is relatively small.

NUREG/CR-4220 [Reference 11]

NUREG/CR-4220 is a study performed by Pacific Northwest Laboratories for the NRC in 1985.

The study reviewed over two thousand LERs, ILRT reports and other related records to Revision 1 Page 10 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension calculate the unavailability of containment due to leakage.

NUREG-1273 [Reference 12]

A subsequent NRG study, NUREG-1273, performed a more extensive evaluation of the NUREG/CR-4220 database. This assessment noted that about one-third of the reported events were leakages that were immediately detected and corrected. In addition, this study noted that local leak rate tests can detect "essentially all potential degradations" of the containment isolation system.

NUREG/CR-4330 [Reference 131 NUREG/CR-4330 is a study that examined the risk impacts associated with increasing the allowable containment leakage rates. The details of this report have no direct impact on the modeling approach of the ILRT test interval extension, as NUREG/CR-4330 focuses on leakage rate and the ILRT test interval extension study focuses on the frequency of testing intervals.

However, the general conclusions of NUREG/CR-4330 are consistent with NUREG/CR-3539 and other similar containment leakage risk studies:

" ... the effect of containment leakage on overall accident risk is small since risk is dominated by accident sequences that result in failure or bypass of containment."

EPRI TR-105189 [Reference 14]

The EPRI study TR-105189 is useful to the ILRT test interval extension risk assessment because it provides insight regarding the impact of containment testing on shutdown risk. This study conta.ins a quantitative evaluation (using the EPRI ORAM software) for two reference plants (a BWR-4 and a PWR) of the impact of extending ILRT and LLRT test intervals on shutdown risk. The conclusion from the study is that a small, but measurable, safety benefit is realized from extending the test intervals.

NUREG-1493 [Reference 61 NUREG-1493 is the NRC's cost-benefit analysis for proposed alternatives to reduce containment leakage testing intervals and/or relax allowable leakage rates. The NRG conclusions are consistent with other similar containment leakage risk studies:

Reduction in ILRT frequency from 3 per 10 years to 1 per 20 years results in an "imperceptible" increase in risk.

Given the insensitivity of risk to the containment leak rate and the small fraction of leak paths detected solely by Type A testing, increasing the interval between integrated leak rate tests is possible with minimal impact on public risk.

EPRI TR-104285 (Reference 21 Extending the risk assessment impact beyond shutdown (the earlier EPRI TR-105189 study),

the EPRI TR-104285 study is a quantitative evaluation of the impact of extending ILRT and LLRT test intervals on at-power public risk. This study combined IPE Level 2 models with NUREG-1150 Level 3 population dose models to perform the analysis. The study also used the approach of NUREG-1493 in calculating the increase in pre-existing leakage probability due to extending the ILRT and LLRT test intervals.

EPRI TR-104285 uses a simplified Containment Event Tree to subdivide representative core damage frequencies into eight classes of containment response to a core damage accident:

1. Containment intact and isolated

2. Containment isolation failures dependent upon the core damage accident

3. Type A (ILRT) related containment isolation failures Revision 1 Page 11 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension

4. Type B (LLRT) related containment isolation failures

5. Type C (LLRT) related containment isolation failures

6. Other penetration related containment isolation failures

7. Containment failures due to core damage accident phenomena

8. Containment bypass Consistent with the other containment leakage risk assessment studies, this study concluded:

" ... the proposed CLRT (Containment Leak Rate Tests) frequency changes would have a minimal safety impact. The change in risk determined by the analyses is small in both absolute and relative terms. For example, for the PWR analyzed, the change is about 0.02 person-rem per year ... "

NUREG-1150 [Reference 151 and NUREG/CR-4551 [Reference 71 NUREG-1150 and the technical basis, NUREG/CR-4551, provide an ex-plant consequence analysis for a spectrum of accidents including a severe accident with the containment remaining intact (i.e., Tech Spec Leakage). This ex-plant consequence analysis is calculated for the 50-mile radial area surrounding Surry. The ex-plant calculation can be delineated to total person-rem for each identified Accident Progression Bin (APB) from NUREG/CR-4551. With the DBNPS Level 2 model end-states assigned to one of the NUREG/CR-4551 APBs, it is considered adequate to represent DBNPS. (The meteorology and site differences other than population are assumed not to play a significant role in this evaluation.)

NEI Interim Guidance for Performing Risk Impact Assessments In Support of One-Time Extensions for Containment Integrated Leakage Rate Test Surveillance Intervals [Reference 3, Reference 201 '

The guidance provided in this document builds on the EPRI risk impact assessment methodology [Reference 21 and the NRC performance-based containment leakage test program

[Reference 6], and considers approaches utilized in various submittals, including Indian Point 3 (and associated NRC SER) and Crystal River.

Calvert Cliffs Response to Request for Additional Information Concerning the License I I Amendment for a One-Time Integrated Leakage Rate Test Extension [Reference 51 This submittal to the NRC describes a method for determining the change in likelihood, due to extending the ILRT, of detecting liner corrosion, and the corresponding change in risk. The methodology was developed for Calvert Cliffs in response to a request for additional information regarding how the potential leakage due to age-related degradation mechanisms was factored into the risk assessment for the ILRT one-time extension. The Calvert Cliffs analysis was performed for a concrete cylinder and dome and a concrete basemat, each with a steel liner.

EPRI Report No. 1009325, Revision 2-A (EPRI 1018243), Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals [Reference 241 This report provides a generally applicable assessment of the risk involved in extension of ILRT test intervals to permanent 15-year intervals. Appendix H of this document provides guidance for performing plant-specific supplemental risk impact assessments and builds on the previous EPRI risk impact assessment methodology [Reference 21 and the NRC performance-based containment leakage test program [Reference 61, and considers approaches utilized in various submittals, including Indian Point 3 (and associated NRC SER) and Crystal River.

The approach included in this guidance document is used in the DBNPS assessment to determine the estimated increase in risk associated with the ILRT extension. This document includes the bases for the values assigned in determining the probability of leakage for the EPRI Class 3a and 3b scenarios in this analysis, as described -in Section 5.2.

Revision 1 Page 12 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension 5.1.2 Plant Specific Inputs The plant-specific information used to perform the DBNPS ILRT Extension Risk Assessment includes the following:

• GDF and LERF Model results [Reference 17]

• Release category definitions used in the Level 2 Model [Reference 19]

• Dose within a 50-mile radius [Reference 19]

• ILRT results to demonstrate adequacy of the administrative and hardware issues

[Reference 30]

DBNPS Model The Internal Events PRA Model that is used for DBNPS is characteristic of the as-built plant.

The current Level 1, LERF, and Level 2 model (model name PRA-DB1-AL-R06) is a linked fault tree model [Reference 17]. The total GDF is 5.55E-6/year; the total LERF is 2.84E-7 [Reference 17]. Table 5-1 and Table 5-2 provide a summary of the Internal Events GDF and LERF results for DBNPS PRA Model.

Fire GDF is 4.83E-5/year, and Fire LERF is 3.92E-6/year [Reference 18]. Seismic CDP is 1.71 E-5/year, and Seismic LERF is 6.90E-7/year [Reference 32]. Refer to Section 5.2.7 for further details on external events as they pertain to this analysis.

Table 5 Internal Events CDF Internal Events F.requency (per year)

Internal Floods 2.15E-06 Transients 1.38E-06 LOCAs 1.31E-06 SGTR 6.78E-08 RPV Rupture 2.90E-08 I ,ISLOCA 9.99E-10 Loss of Offsite Power 6.15E-07 Total Internal Events CDF 5.55E-06 Table 5 Internal Events LERF Internal Events Frequency (per year)

Internal Floods 2.04E-07 SGTR 6.27E-08 Transients 1.65E-08 ISLOCA 1.03E-09 LOCAs 7.67E-11 Total Internal Events LERF 2.84E-07 Revision 1 Page 13 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension Population Dose Calculations The population dose calculation was reported in the License Renewal Application [Reference 19]. Table 5-3 presents dose exposures calculated from methodology described in Reference 1 and data from Reference 19. Reference 19 Release Category 9 ("No Failure" Containment Failure Type) corresponds to EPRI Accident Class 1. Release Category 3 ("Large Isolation" Containment Failure Type) corresponds to EPRI Accident Class 2. Release Category 4 ("Small Isolation" Containment Failure Type) corresponds to EPRI Accident Class 6. Since they are not associated with other classes, four containment end-states correspond to EPRI Accident Class 7 ("Early," "Sidewall," "Late," and "Basemat" Containment Failure Types, which correspond to Release Categories 5, 6, 7, and 8, respectively); the EPRI Accident Class 7 dose is calculated via a weighted average using the frequencies provided in Reference 19. Release Categories 1

("Bypass - SGTR" Containment Failure Type) and 2 ("Bypass - ISLOCA" Containment Failure Type) correspond to EPRI Accident Class 8; dose used in this analysis is weighted via the ISLOCA and SGTR frequencies in this calculation. Class 3a and 3b population dose values are calculated from the Class 1 population dose and represented as 1Ola and 1OOLa, respectively, as guidance in Reference 1 dictates.

Table 5 Population Dose Accident Class Description Release (person-rem)

Containment Remains Intact 2.40E+03 2 Containment Isolation Failures 3.00E+06 3a Independent or Random Isolation Failures SMALL 2.40E+04 1 3b Independent or Random Isolation Failures LARGE 2.40E+05 2 Isolation Failure in which pre-existing leakage is not n/a 4

dependent on sequence progression. Type B test Failures Isolation Failure in which pre-existing leakage is not n/a 5

dependent on sequence progression. Type C test Failures 6 Isolation Failure that can be verified by IST/IS or surveillance 9.60E+05 7 Containment F~ilu,re induced by severe accident 4.16E+05 8 Accidents in which containment is by-passed 2.05E+06

1. 10*La

2. 100*L.

Release Category Definitions Table 5-4 defines the accident classes used in the ILRT extension evaluation, which is consistent with the EPRI methodology [Reference 24]. These containment failure classifications are used in this analysis to determine the risk impact of extending the Containment Type A test interval, as described in Section 5.2 of this report.

Revision 1 Page 14 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension Table 5 EPRI Containment Failure Classification [Reference 24]

Class Description Containment remains intact including accident sequences that do not lead to containment failure in the long term. The release of fission products (and attendant consequences) is determined by the maximum allowable leakage rate values La, under Appendix J for that plant.

Containment isolation failures (as reported in the Individual Plant Examinations) including those accidents 2

in which there is a failure to isolate the containment.

Independent (or random) isolation failures include those accidents in which the pre-existing isolation 3

failure to seal (i.e., provide a leak-tight containment) is not dependent on the sequence in progress.

Independent (or random) isolation failures include those accidents in which the pre-existing isolation failure to seal is not dependent on the sequence in progress. This class is similar to Class 3 isolation 4

failures, but is applicable to sequences involving Type B tests and their potential failures. These are the Type B-tested components that have isolated, but exhibit excessive leakage.

Independent (or random) isolation failures including those accidents in which the pre-existing isolation 5 failure to seal is not dependent on the sequence in progress. This class is similar to Class 4 isolation failures, but is applicable to sequences involving Type C test and their potential failures.

Containment isolation failures including those leak paths covered in the plant test and maintenance 6

requirements or verified per in-service inspection and testing (ISI/IST) program.

Accidents involving containment failure induced by severe accident phenomena. Changes in Appendix J 7

testing requirements do not impact these accidents.

Accidents in which the containment is bypassed (either as an initial condition or induced by phenomena) 8 are included in Class 8. Changes in Appendix J testing requirements do not impact these accidents.

5.1.3 Impact of Extension on Detection of Component Failures that Lead to Leakage (Small and Large)

The ILRT can detect a number of component failures such as liner breach, failure of certain bellows arrangements, and failure of some sealing surfaces, which can lead to leakage. The proposed ILRT test interval extension may influence the conditional probability of detecting these types of failures. To ensure that this effect is properly addressed, the EPRI Class 3 accident class, as defined in Table 5-4, is divided into two sub-classes, Class 3a and Class 3b, 1

representing small and large leakage failures respectively.

The probability of the EPRI Class 3a and Class 3b failures is determined consistent with the EPRI Guidance [Reference 24]. For Class 3a, the probability is based on the maximum likelihood estimate of failure (arithmetic average) from the available data (i.e., 2 "small" failures in 217 tests leads to "large" failures in 217 tests (i.e., 2 / 217 = 0.0092). For Class 3b, the probability is based on the Jeffreys non-informative prior (i.e., 0.5 / 218 = 0.0023).

In a follow-up letter [Reference 20] to their ILRT guidance document [Reference 3], NEI issued additional information concerning the potential that the calculated delta LERF values for several plants may fall above the "very small change" guidelines of the NRG Regulatory Guide 1.174

[Reference 4]. This additional NEI information includes a discussion of conservatisms in the quantitative guidance for b.LERF. NEI describes ways to demonstrate that, using plant-specific calculations, the b.LERF is smaller than 1that calculated by the simplified method.

The supplemental information states:

The methodology employed for determining LERF (Class 3b frequency) involves conservatively multiplying the GDF by the failure probability for this class (3b) of accident. This was done for simplicity and to maintain conservatism. However, some plant-specific accident classes leading to core damage are likely to include individual sequences that either may already (independently) cause a LERF or could never cause a LERF, and are thus not associated with a Revision 1 Page 15 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension postulated large Type A containment leakage path (LERF). These contributors can be removed from Class 3b in the evaluation of LERF by multiplying the Class 3b probability by only that portion of GDF that may be impacted by Type A leakage.

The application of this additional guidance to the analysis for DBNPS, as detailed in Section 5.2, involves subtracting LERF risk from the GDF that is applied to Class 3b because this portion of LERF is unaffected by containment integrity. To be consistent, the same change is made to the Class 3a GDF, even though these events are not considered LERF.

Consistent with the NEI Guidance [Reference 3], the change in the leak detection probability can be estimated by comparing the average time that a leak could exist without detection. For example, the average time that a leak could go undetected with a three-year test interval is 1.5 a

years (3 years I 2), and the average time that leak could exist without detection for a ten-year interval is 5 years (10 years/ 2). This change would lead to a non-detection probability that is a factor of 3.33 (5.0/1.5) higher for the probability of a leak that is detectable only by ILRT testing.

Correspondingly, an extension of the ILRT interval to 15 years can be estimated to lead to a factor of 5 ((15/2)/1.5) increase in the non-detection probability of a leak.

It should be noted that using the methodology discussed above is very conservative compared to previous submittals (e.g., the IP3 request for a one-time ILRT extension that was approved by the NRG [Reference 91) because it does not factor in the possibility that the failures could be detected by other tests (e.g., the Type B local leak rate tests that will still occur). Eliminating this possibility conservatively over-estimates the factor increases attributable to the ILRT extension.

5.2 Analysis The application of the approach based on the guidance contained in EPRI 1018243 [Reference 24] and previous risk assessment submittals on this subject [References 5, 8, 21, 22, and 23]

have led to the following results. The results are displayed according to the eight accident classes defined in the EPRI report, as described in Table 5-5.

The analysis performed examined DBNPS-specific accident sequences in which the containment remains intact or the containment is impaired. Specifically, the breakdown of the severe accidents, contributing to risk, was considered in the following manner: , ,

• Core damage sequences in which the containment remains intact initially and in the long term (EPRI 1018243, Class 1 sequences [Reference 24]).

• Core damage sequences in which containment integrity is impaired due to random isolation failures of plant components other than those associated with Type B or Type C test components. For example, liner breach or bellow leakage (EPRI 1018243, Class 3 sequences [Reference 24]).

• Accident sequences involving containment bypassed (EPRI 1018243, Class 8 sequences [Reference 24]), large containment isolation failures (EPRI 1018243, Class 2 sequences [Reference 24]), and small containment isolation "failure-to-seal" events (EPRI 1018243, Class 4 and 5 sequences [Reference 24]) are accounted for in this evaluation as part of the baseline risk profile. However, they are not affected by the ILRT frequency change.

• Class 4 and 5 sequences are impacted by changes in Type B and C test intervals; therefore, changes in the Type A test interval do not impact these sequences.

Revision 1 Page 16 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension Table 5 EPRI Accident Class Definitions Accident Classes (Containment Release Type) Description No Containment Failure 2 Large Isolation Failures (Failure to Close) 3a Small Isolation Failures (Liner Breach) 3b Large Isolation Failures (Liner Breach) 4 Small Isolation Failures (Failure to Seal - Type 8) 5 Small Isolation Failures (Failure to Seal - Type C) 6 Other Isolation Failures (e.g., Dependent Failures) 7 Failures Induced by Phenomena (Early and Late) 8 Bypass (Interfacing System LOCA)

GDF All GET End States (Including Very Low and No Release)

The steps taken to perform this risk assessment evaluation are as follows:

Step 1 - Quantify the baseline risk in terms of frequency per reactor year for each of the accident classes presented in Table 5-5.

Step 2 - Develop plant-specific person-rem dose (population dose) per reactor year for each of the eight accident classes.

Step 3 - Evaluate risk impact of extending Type A test interval from 3 in 10 years to 1 in 15 years and 1 in 10 years to 1 in 15 years.

Step 4 - Determine the change in risk in terms of Large Early Release Frequency (LERF) in accordance with RG 1.174 [Reference 4].

Step 5 - Determine the impact on the Conditional Containment Failure Probability (CCFP).

5.2.1 Step 1 - Quantify the Baseline Risk in Terms of Frequency per Reactor Year As previously described, the extension of the Type A interval does not infl4ence .those accident progressions that involve large containment isolation failures, Type B or Type C testing, or containment failure induced by severe accident phenomena.

For the assessment of ILRT impacts on the risk profile, the potential for pre-existing leaks is included in the model (these events are represented by the Class 3 sequences in EPRI 1018243 [Reference 24]). The question on containment integrity was modified to include the probability of a liner breach or bellows failure (due to excessive leakage) at the time of core damage. Two failure modes were considered for the Class 3 sequences. These are Class 3a (small breach) and Class 3b (large breach).

The frequencies for the severe accident classes defined in Table 5-5 were developed for DBNPS by first determining the frequencies for Classes 1, 2, 6, 7, and 8. Table 5-6 presents the grouping of each release category in EPRI Classes based on the associated description. Table 5-7 presents the frequency and EPRI category for each sequence and the totals of each EPRI classification. Table 5-8 provides a summary of the accident sequence frequencies that can lead to radionuclide release to the public and have been derived consistent with the NEI Interim Guidance [Reference 3] and the definitions of accident classes and guidance provided in EPRI Report No. 1018243, Revision 2-A [Reference 24]. Adjustments were made to the Class 3b and hence Class 1 frequencies to account for the impact of undetected corrosion of the steel liner per the methodology described in Section 5.2.6. Note: calculations were performed with more Revision 1 Page 17 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension digits than shown in this section. Therefore, minor differences may occur if the calculations in these sections are followed explicitly.

The total CDF is 5.55E-6 and LERF is 2.84E-7 [Reference 17].

Class 3 Sequences. This group consists of all core damage accident progression bins for which a pre-existing leakage in the containment structure (e.g., containment liner) exists that can only be detected by performing a Type A ILRT. The probability of leakage detectable by a Type A ILRT is calculated to determine the impact of extending the testing interval. The Class 3 calculation is divided into two classes: Class 3a is defined as a small liner breach (La < leakage

< 1Ola), and Class 3b is defined as a large liner breach ( 1Ola < leakage < 1OOLa).

Data reported in EPRI 1018243 [Reference 24] states that two events could have been detected only during the performance of an ILRT and thus impact risk due to change in ILRT frequency.

There were a total of 217 successful ILRTs during this data collection period. Therefore, the probability of leakage is determined for Class 3a as shown in the following equation:

2 Pclass3a = 217 = 0.0092 Multiplying the CDF by the probability of a Class 3a leak yields the Class 3a frequency contribution in accordance with guidance provided in Reference 24. As described in Section 5.1.3, additional consideration is made to not apply failure probabilities on those cases that are already LERF scenarios. Therefore, these LERF contributions from CDF are removed. The frequency of a Class 3a failure is calculated by the following equation:

Freqclass3a = Pclass3a * (CDF - LERF)

= 2 ~ 7 *(5.SSE 2.84E-7) = 4.85E-8 In the database of 217 ILRTs, there are zero containment leakage events that could result in a large early release. Therefore, the Jeffreys non-informative prior is used to estimate a failure rate and is illustrated in the following equations:

Number of Failures+ 1/2 Jeffreys Failure Probability= b f Num er o Tests+ 1 0 + 1/2 Pclass3b = 217 + l = 0.0023 The frequency of a Class 3b failure is calculated by the following equation:

Freqclass3b = Pclass3b * (CDF - LERF)

= ~ *(5.SSE 2.84E-7) = 1.21E-8 218 For this analysis, the associated containment leakage for Class 3a is 1Ola and for Class 3b is 1OOLa. These assignments are consistent with the guidance provided in Reference 24.

Class 1 Sequences. This group consists of all core damage accident progression bins for which the containment remains intact (modeled as Technical Specification Leakage). The Level 2 end states sum to greater than CDF because some of the results are non-minimal (e.g., a small early release may also progress to a medium intermediate release). The intact frequency, 5.13E-6, is preserved because its frequency could not also be classified as a significant release.

The frequency per year is initially determined from the EPRI Accident Class 1 frequency listed in Table 5-7 and then subtracting the EPRI Class 3a and 3b frequency (to preserve total CDF),

calculated below:

Freqclass1 = Freqlntact - (Freqclass3a - Freqclass3b)

Revision 1 Page 18 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension Class 2 Sequences. This group consists of core damage accident progression bins with large containment isolation failures. This is determined from flag AAAPDS-70, the contribution of large containment isolation failure flag for LERF. Since this event is in cutsets that contribute 57.9% of LERF, the Class 2 contribution is 1.65E-7. The frequency per year for these sequences is obtained from the EPRI Accident Class 2 frequency listed in Table 5-7.

Class 4 Sequences. This group consists of all core damage accident progression bins for which containment isolation failure-to-seal of Type B test components occurs. Because these failures are detected by Type B tests which are unaffected by the Type A ILRT, this group is not evaluated any further in the analysis, consistent with approved methodology.

Class 5 Sequences. This group consists of all core damage accident progression bins for which a containment isolation failure-to-seal of Type C test components occurs. Because the failures are detected by Type C tests which are unaffected by the Type A ILRT, this group is not evaluated any further in this analysis, consistent with approved methodology.

Class 6 Sequences. These are sequences that involve core damage accident progression bins for which a failure-to-seal containment leakage due to failure to isolate the containment occurs.

These sequences are dominated by misalignment of containment isolation valves following a test/maintenance evolution. All other failure modes are bounded by the Class 2 assumptions.

This accident class is also not evaluated further.

Class 7 Sequences. This group consists of all core damage accident progression bins in which containment failure is induced by severe accident phenomena (e.g., overpressure). This frequency is calculated by subtracting the Class 1, 2, and 8 frequencies from the total GDF. For this analysis, the frequency is determined from the EPRI Accident Class 7 frequency listed in Table 5-7.

Class 8 Sequences. This group consists of all core damage accident progression bins in which containment is bypassed via ISLOCA or SGTR. Since the ISLOCA initiator is in cutsets that contribute 0.018% of GDF, its Class 8 contribution is 9.99E-10. Since the SGTR initiators are in cutsets that contribute 1.22% of GDF, its Class 8 contribution is 6. 78E-8. For this analysis, the frequency is determined from the EPRI Accident Class 8 frequency listed in Table 5-7.

LERF quantification is distributed into EPRI categories based on release categories. Table 5-6 shows this distribution.

Table 5 Release Category Frequencies Containment End State EPRI Category Frequency (/yr)

Intact Containment 1 5.13E-06 Large Isolation Failure 2 1.65E-07 Failures Induced by Phenomena 7 1.86E-07 ISLOCA 8 9.99E-10 SGTR 8 6.78E-08 Revision 1 Page 19 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension Table 5 Accident Class Frequencies EPRI Category Frequency (/yr)

Class 1 5.13E-06 Class 2 1.65E-07 Class 6 £1 Class 7 1.86E-07 Class 8 6.88E-08 Total (GDF) 5.55E-06

1. £ represents a probabilistically insignificant value.

Table 5 Baseline Risk Profile Class Description Frequency (/yr)

No containment failure 5.0?E-06 2 2 Large containment isolation failures 1.65E-07 3a Small isolation failures (liner breach) 4.85E-08 3b Large isolation failures (liner breach) 1.21E-08 4 Small isolation failures - failure to seal (type B) 5 Small i,solation failures - failure to seal (type C) 6 Containment isolation failures (dependent failure, personnel errors) 7 Severe accident phenomena induced failure (early and late) 1.86E-07 8 Containment bypass 6.88E-08 Total 5.55E-06

1. £ represents a probabilistically insignificant value or a Class that is unaffected by the Type A ILRT.

2. The Class 3a and 3b frequencies are subtracted from Class 1 to preserve total GDF.

5.2.2 Step 2- Develop Plant-Specific Person-Rem Dose (Population Dose)

Plant-specific release analyses were performed to estimate the person-rem doses to the population within a 50-mile radius from the plant. Table 5-3 provides population dose for each EPRI accident class. Table 5-9 provides a correlation of DBNPS population dose to EPRI Accident Class.

The population dose for EPRI Accident Classes 3a and 3b were calculated based on the guidance provided in EPRI Report No. 1018243 [Reference 24] as follows:

EPRI Class 3a Population Do~e = 10

• 2.40£+3 = 2.40£+4 EPRI Class 3b Population Dose= 100

• 2.40£+3 = 2.40E+S Revision 1 Page 20 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension Table 5 Mapping of Population Dose to EPRI Accident Class EPRI Category Frequency (/yr) Dose (person-rem)

Class 1 5.07E-06 2.40E+03 Class 2 1.65E-07 3.00E+06 Class 7 1.86E-07 4.16E+05 Class 8 6.88E-08 2.05E+06 5.2.3 Step 3 - Evaluate Risk Impact of Extending Type A Test Interval from 10 to 15 Years The next step is to evaluate the risk impact of extending the test interval from its current 10-year interval to a 15-year interval. To do this, an evaluation must first be made of the risk associated with the 10-year interval, since the base case applies to 3-year interval (i.e., a simplified representation of a 3-to-10 interval).

Risk Impact Due to 10-Year Test Interval As previously stated, Type A tests impact only Class 3 sequences. For Class 3 sequences, the release magnitude is not impacted by the change in test interval (a small or large breach remains the same, even though the probability of not detecting the breach increases). Thus, only the frequency of Class 3a and Class 3b sequences is impacted. The risk contribution is changed based on the NEI guidance as described in Section 5.1.3 by a factor of 10/3 compared to the base case values. The Class 3a and 3b frequencies are calculated as follows:

I 10 2 10 2 Freqc~ass3a1oyr = 3

• 217 * (CDF - LERF) = 3

• 217

• 5.26E-6 = 1.62E-7

= 3°* 2*:8 * (CDF - = 3°* 2*:8

• 5.26E-6 = 4.02E-8 1 1 Freqctass3b1oyr LERF)

The results of the calculation for a 10-year interval are presented in Table 5-10 ..

Table 5 Risk Profile for Once in 10 Year ILRT Class Description Frequency Contribution Population Population

(/yr) (%) Dose (person- Dose Rate rem) (person-rem/yr) 1 No containment failure 2 4.93E-06 88.81% 2.40E+03 1.18E-02 2 Large containment isolation failures 1.65E-07 2.97% 3.00E+06 4.94E-01 Small isolation failures (liner 3a 1.62E-07 2.91% 2.40E+04 3.88E-03 breach)

Large isolation failures (liner 3b 4.02E-08 0.73% 2.40E+05 9.65E-03 breach)

Small isolation failures - failure to 4 seal (type B)

E1 E1 E1 E1 Small isolation failures - failure to E1 E1 5 seal (type C)

E1 E1 Containment isolation failures 6 (dependent failure, personnel E1 E1 9.60E+05 E1 errors)

Severe accident phenomena 7.72E-02 7 1.86E-07 3.34% 4.16E+05 induced failure (early and late)

Revision 1 Page 21 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension Table 5 Risk Profile for Once in 10 Year ILRT Class Description Frequency Contribution Population Population

(/yr) (%) Dose (person- Dose Rate rem) (person-rem/yr) 8 Containment bypass 6.BBE-08 1.24% 2.05E+06 1.41 E-01 Total 5.55E-06 7.38E-01

1. E represents a probabilistically insignificant value or a Class that is unaffected by the Type A ILRT.

2. The Class 1 frequency is reduced by the frequency of Class 3a and Class 3b in order to preserve total CDF.

Risk Impact Due to 15-YearTest Interval The risk contribution for a 15-year interval is calculated in a manner similar to the 10-year interval. The difference is in the increase in probability of leakage in Classes 3a and 3b. For this case, the value used in the analysis is a factor of 5 compared to the 3-year interval value, as described in Section 5.1.3. The Class 3a and 3b frequencies are calculated as follows:

2 2 Freqczass3a15yr = 315

• 217 * (CDF - LERF) = 5

• 217

• 5.26E-6 = 2.43E-7 15 Freqczass3bl5yr = 3

• 2*:8 * (CDF - LERF) = 5

• 2*:8

• 5.26E-6 = 6.04E-8 The results of the calculation for a 15-year interval are presented in Table 5-11.

Table 5 Risk Profile for Once in 15 Year ILRT Class Description Frequency Contribution Population Dose Population

(/yr) (%) (person-rem) Dose Rate (person-rem/yr) 1 No containment failure 2 4.83E-06 86.99% 2.40E+03 1.16E-02 Large containment isolation 2 1.65E-07 2.97% 3.00E+06 4.94E-01 failures Small isolation failures (liner

'3a 2.43E-07 4.37% 2.40E+04 5.82E-03 breach)

Large isolation failures (liner 3b 6.04E-08 1.09% 2.40E+05 1.45E-02 breach)

Small isolation failures - g1 g1 g1 g1 4 failure to seal (type B)

Small isolation failures - g1 g1 g1 g1 5 failure to seal (type C)

Containment isolation g1 g1 9.60E+05 g1 6 failures (dependent failure, personnel errors).

Severe accident phenomena 7 induced failure (early and 1.86E-07 3.34% 4.16E+05 7.72E-02 late) 8 Containment bypass 6.88E-08 1.24% 2.05E+06 1.41 E-01 Total 5.55E-06 7.44E-01

1. E represents a probabilistically insignificant value or a Class that is unaffected by the Type A ILRT.

2. The Class 1 frequency is reduced by the frequency of Class 3a and Class 3b in order to preserve total CDF.

Revision 1 Page 22 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension 5.2.4 Step 4 - Determine the Change in Risk in Terms of LERF The risk increase associated with extending the ILRT interval involves the potential that a core damage event that normally would result in only a small radioactive release from an intact containment could, in fact, result in a larger release due to the increase in probability of failure to detect a pre-existing leak. With strict adherence to the EPRI guidance, 100% of the Class 3b contribution would be considered LERF.

Regulatory Guide 1.174 [Reference 4] provides guidance for determining the risk impact of plant-specific changes to the licensing basis. RG 1.174 [Reference 4] defines very small changes in risk as resulting in increases of GDF less than 10-6/year and increases in LERF less than 10-7/year, and small changes in LERF as less than 10-6/year. Since containment overpressure is not required in support of ECCS performance to mitigate design basis accidents and no equipment in the shield building is credited in the GDF model at DBNPS, the ILRT extension does not impact GDF. Therefore, the relevant risk-impact metric is LERF.

For DBNPS, 100% of the frequency of Class 3b sequences can be used as a very conservative first-order estimate to approximate the potential increase in LERF from the ILRT interval extension (consistent with the EPRI guidance methodology). Based on a 10-year test interval from Table 5-10, the Class 3b frequency is 4.02E-8/year; based on a 15-year test interval from Table 5-11, the Class 3b frequency is 6.04E-8/year. Thus, the increase in the overall probability of LERF due to Class 3b sequences that is due to increasing the ILRT test interval from 3 to 15 years is 4.83E-8/year. Similarly, the increase due to increasing the interval from 10 to 15 years is 2.01 E-8/year. As can be seen, even with the conservatisms included in the evaluation (per the EPRI methodology), the estimated change in LERF meets the criteria for a very small change when comparing the 15-year results to the current 10-year requirement and the original 3-year requirement. Table 5-12 summarizes these results.

Table 5 Impact on LERF due to Extended Type A Testing Intervals ILRT Inspection Interval 3 Years (baseline) 10 Years 15 Years Class 3b (Type A LERF) 1.21E-08 4.02E-08 6.04E-08 b.LERF (3 year baseline) 2.82E-08 4.83E-08 b.LERF (10 year baseline) 2.01 E-08 1

. The increase in the overall probability of LERF due to Class 3b sequences is less than 10- .

Therefore, the .&LERF is considered very small [Reference 4].

NEI 94-01 [Reference 1] states that a small population dose is defined as an increase of s 1.0 person-rem per year, ors 1% of the total population dose, whichever is less restrictive for the risk impact assessment of the extended ILRT intervals. As shown in Table 5-13, the results of this calculation meet the dose rate criteria.

Table 5 Impact on Dose Rate due to Extended Type A Testing Intervals ILRT Inspection Interval 10 Years 15 Years b.Dose Rate (3 year baseline) 9.13E-03 1.56E-02 b.Dose Rate (10 year baseline) 6.52E-03 o/ob.Dose Rate (3 year baseline) 1.253% 2.148%

o/ob.Dose Rate (10 year baseline) 0.884%

Revision 1 Page 23 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension 5.2.5 Step 5 - Determine the Impact on the Conditional Containment Failure Probability Another parameter that the NRC guidance in RG 1.174 [Reference 4] states can provide input into the decision-making process is the change in the conditional containment failure probability (CCFP). The CCFP is defined as the probability of containment failure given the occurrence of an accident. This probability can be expressed using the following equation:

CCFP = 1-f(ncf)

CDF where f(ncf) is the frequency of those sequences that do not result in containment failure; this frequency is determined by summing the Class 1 and Class 3a results.

Table 5-14 shows the steps and results of this calculation.

Table 5 Impact on CCFP due to Extended Type A Testing Intervals ILRT Inspection Interval 3 Years (baseline) 10 Years 15 Years f(ncf) (/yr) 5.12E-06 5.09E-06 5.07E-06 f(ncf)/CDF 0.922 0.917 0.914 CCFP 0.078 0.083 0.086 8.CCFP (3 year baseline) 0.508% 0.870%

8.CCFP (10 year baseline) 0.363%

As stated in Section 2.0, a change in the CCFP of up to 1.5% is assumed to be small. The increase in the CCFP from the 3 in 10 year interval to 1 in 15 year interval is 0.870%. Therefore, this increase is judged to be small.

5.2.6 Impact of Extension on Detection of Steel Liner Corrosion that Leads to Leakage An estimate of the likelihood and risk implications of corrosion-induced leakage of the steel liners occurring and going undetected during the extended test interval is evaluated using a methodology similar \o the Calvert Cliffs liner ~orrosion analysis [Referer:ic~ 5]. The Calvert Cliffs analysis was performed for a concrete cylinder and dome and a concrete basemat, each with a steel liner.

The following approach is used to determine the change in likelihood, due to extending the ILRT, of detecting corrosion of the containment steel liner. This likelihood is then used to determine the resulting change in risk. Consistent with the Calvert Cliffs analysis, the following issues are addressed:

• Differences between the containment basemat and the containment cylinder and dome

• The historical steel liner flaw likelihood due to concealed corrosion

• The impact of aging

• The corrosion leakage dependency on containment pressure

• The likelihood that visual inspections will be effective at detecting a flaw Assumptions

• Consistent with the Calvert Cliffs analysis, a half failure is assumed for basemat concealed liner corrosion due to the lack of identified failures (See Table 5-15, Step 1).

• In the 5.5 years following September 1996 when 10 CFR 50.55a started requiring visual inspection, there were three events where a through wall hole in the containment liner was identified. These are Brunswick 2 on 4/27/99, North Anna 2 on 9/23/99, and D. C.

Revision 1 Page 24 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension Cook 2 in November 1999. The corrosion associated with the Brunswick event is believed to have started from the coated side of the containment liner. Although DBNPS has a different containment type, this event could potentially occur at DBNPS (i.e.,

corrosion starting on the coated side of containment). Construction material embedded in the concrete may have contributed to the corrosion. The corrosion at North Anna is believed to have started on the uninspectable side of containment due to wood imbedded in the concrete during construction. The D. C. Cook event is associated with an inadequate repair of a hole drilled through the liner during construction. Since the hole was created during construction and not caused by corrosion, this event does not apply to this analysis. Based on the above data, there are corrosion events from the 5.5 years that apply to DBNPS.

• Consistent with the Calvert Cliffs analysis, the estimated historical flaw probability is also limited to 5.5 years to reflect the years since September 1996 when 10 CFR 50.55a started requiring visual inspection. Additional success data was not used to limit the aging impact of this corrosion issue, even though inspections were being performed prior to this date (and have been performed since the time frame of the Calvert Cliffs analysis)

(See Table 5-4, Step 1).

• Consistent with the Calvert Cliffs analysis, the steel liner flaw likelihood is assumed to double every five years. This is based solely on judgment and is included in this analysis to address the increased likelihood of corrosion as the steel liner ages (See Table 5-15, Steps 2 and 3). Sensitivity studies are included that address doubling this rate every ten years and every two years.

• In the Calvert Cliffs analysis, the likelihood of the containment atmosphere reaching the outside atmosphere, given that a liner flaw exists, was estimated as 1.1 % for the cylinder and dome, and 0.11 % ( 10% of the cylinder failure probability) for the base mat. These values were determined from an assessment of the probability versus containment

_pressure. For DBNPS, the ILRT maximum pressure is 40 psig [References 27].

Probabilities of 1% for the cylinder and dome, and 0.1 % for the basemat are used in this analysis, and sensitivity studies are included in Section 5.3.1 (See Table 5-15, Step 4 ).

• Consistent with the Calvert Cliffs analysis, the likelihood of leakage escape (due to crack formation) in the basemat region is *considered to be less likely than the containment cylinder and dome region (See Table 5-15, Step 4).

• In the Calvert Cliffs analysis, it is noted that approximately 85% of the interior wall surface is accessible for visual inspections. Consistent with the Calvert Cliffs analysis, a 5% visual inspection detection failure likelihood given the flaw is visible and a total detection failure likelihood of 10% is used. To date, all liner corrosion events have been detected through visual inspection (See Table 5-15, Step 5).

• Consistent with the Calvert Cliffs analysis, all non-detectable containment failures are assumed to result in early releases. This approach avoids a detailed analysis of containment failure timing and operator recovery actions.

Revision 1 Page 25 of45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension Table 5 Steel Liner Corrosion Base Case Step Description Containment Cylinder and Containment Basemat Dome (85%) (15%)

Historical liner flaw likelihood Events: 2 Events: 0 Failure data: containment location (Brunswick 2 and North Anna 2) Assume a half failure specific 2 / (70 X 5.5) = 5.19E-03 0.5 / (70 X 5.5) = 1.30E-03 1 Success data: based on 70 steel-lined containments and 5.5 years since the 10CFR 50.55a requirements of periodic visual inspections of containment surfaces Year Failure rate Year Failure rate Aged adjusted liner flaw likelihood During the 15-year interval, assume 1 2.0SE-03 1 5.13E-04 failure rate doubles every five years average 5-1 0 5.19E-03 average 5-10 1.30E-03 2 15 1.43E-02 15 3.57E-03 (14.9% increase per year). The average for the 5th to 10th year set to the historical failure rate. 15 year average = 6.44E-03 15 year average = 1.61 E-03 Increase in flaw likelihood between 3 and 15 years Uses aged adjusted 0.71% (1 to 3 years) 0.18% (1 to 3 years) 3 liner flaw likelihood (Step 2), 4.14% (1 to 10 years) 1.04% (1 to 10 years) assuming failure rate doubles every 9.66% (1 to 15 years) 2.42% (1 to 15 years) five years.

Likelihood of breach in containment 0.1%

4 1%

given liner flaw 10%

5% failure to identify visual flaws plus 5% likelihood that the flaw is not visible (not through-cylinder 100%

Visual inspection detection failure 5 but could be detected by ILRT).

likelihood Cannot be visually inspected All events have been detected through visual inspection. 5%

visible failure detection is a conservative assumption.

0.00071% (3 years) 0.00018% (3 years) 0.71% X 1% X 10% 0.18% X 0.1 o/o X 100%

Likelihood of non-detected 0.00414% (10 years) 0.00104% (10 years) 6 containment leakage (Steps 3 x 4 x 4.18% X 1% X 10% 1.04%x0.1%x100%

5) 0.00966% (15 years) 0.00242% (15 years) 9.66% X 1% X 10% 2.42% X 0.1% X 100%

The total likelihood of the corrosion-induced, non-detected containment leakage is the sum of Step 6 for the containment cylinder and dome, and the containment basemat, as summarized below for DBNPS.

Table 5 Total Likelihood on Non-Detected Containment Leakage Due to Corrosion for DBNPS Description At 3 years: 0.00071 % + 0.00018% = 0.00089%

At 10 years: 0.0041% + 0.00104% = 0.00517%

At 15 years: 0.00966% + 0.00242% = 0.01207%

Revision 1 Page 26 of45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension The above factors are applied to those core damage accidents that are not already independently LERF or that could never result in LERF.

The two corrosion events that were initiated from the non-visible (backside) portion of the containment liner used to estimate the liner flaw probability in the Calvert Cliffs analysis are assumed to be applicable to this containment analysis. These events, one at North Anna Unit 2 (September 1999) caused by timber embedded in the concrete immediately behind the containment liner, and one at Brunswick Unit 2 (April 1999) caused by a cloth work glove embedded in the concrete next to the liner, were initiated from the nonvisible (backside) portion of the containment liner. A search of the NRC website LER database identified two additional events have occurred since the Calvert Cliffs analysis was performed. In January 2000, a 3/16-inch circular through-liner hole was found at Cook Nuclear Plant Unit 2 caused by a wooden brush handle embedded immediately behind the containment liner. The other event occurred in April 2009, where a through-liner hole approximately 3/8-inch by 1-inch in size was identified in the Beaver Valley Power Station Unit 1 (BVPS-1) containment liner caused by pitting originating from the concrete side due to a piece of wood that was left behind during the original construction that came in contact with the steel liner [Reference 29]. Two other containment liner through-wall hole events occurred at Turkey Point Units 3 and 4 in October 2010 and November 2006, respectively. However, these events originated from the visible side caused by the failure of the coating system, which was not designed for periodic immersion service, and are not considered to be applicable to this analysis. More recently, in October 2013, some through-wall containment liner holes were identified at BVPS-1, with a combined total area of approximately 0.395 square inches. The cause of these through-wall liner holes was attributed to corrosion originating from the outside concrete surface due to the presence of rayon fiber foreign material that was left behind during the original construction and was contacting the steel liner. For risk evaluation purposes, these five total corrosion events occurring in 66 operating plants with steel containment liners over a 17.1 year period from September 1996 to October 4, 2013 (i.e., 5/(66*17.1) = 4.43E-03) are bounded by the estimated historical flaw probability based on the two events in the 5.5 year period of the Calvert Cliffs analysis (i.e.,

2/(70*5.5) = 5.19E-03) incorporated in the EPRI guidance [Reference 28].

5.2. 7 Impact from External Events Contribution

, I An assessment of the impact of external events is performed. The primary purpose for this investigation is the determination of the total LERF following an increase in the ILRT testing interval from 3 in 10 years to 1 in 15 years.

Davis Besse is transitioning to NFPA 805 licensing basis for fire protection and submitted a License Amendment Request (LAR) [Reference 39]. This transition includes performing a Fire PRA and installing modifications to reduce the fire-induced CDF and LERF to those reported in the NFPA 805 LAR. All except one modification have been fully implemented at the plant. Due to Appendix R rules, the final modification cannot be made until after the SER is received for NFPA 805. The final implementation is currently scheduled for 2019 [Reference 35], which is years in advance of the deferred ILRT interval that begins in 2021.

The RAI 3 Fire PRA model was used to obtain the fire CDF and LERF values because it is the most updated version of the Fire PRA [Reference 18]. As described in Section 5.1.3, additional consideration is made to not apply failure probabilities on those cases that are already LERF scenarios. Therefore, LERF contributions from CDF are removed. The following shows the calculation for Class 3b:

Freqclass3b = Pc1ass3b * (CDF - LERF) = i~~ * (4.83E 3.92£-6) = 1.02£-7 0.5 Freqclass3b10yr = 310

• Pc1ass3b * (CDF - LERF) = 310

• 218 * (4.83E 3.92£-6) = 3.39E-7 Revision 1 Page 27 of45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension 15 QS Freqciass3b1Syr = -3

• Pciass3b * (CDF - LERF) = 5 * -218 * (4.83£ 3.92£-6) = 5.09E-7 The Seismic model in Reference 32 includes calculations of Seismic CDF and LERF. To reduce conservatism in the model, the methodology of subtracting existing LERF from CDF is applied to the Seismic PRA model. The following shows the calculation for Class 3b:

Freqciass3b = Pciass3b * (CDF - LERF) = ~218

• (1.71£ 6.90£-7) = 3.77E-8 10 10 0.5 Freqclass3b10yr = 3

• Pclass3b * (CDF - LERF) = 3

• 218 * (1.71£ 6.90£-7)= 1.26E-7 15 0.5 Freqczass3b1syr = 3

• Pc1ass3b * (CDF - LERF) = 5

• 218 * (1.71£ 6.90£-7)= 1.89E-7 The fire and seismic contributions to Class 3b frequencies are then combined to obtain the total external event contribution to Class 3b frequencies. The change in LERF is calculated for the 1 in 10 year and 1 in 15 year cases and the change defined for the external events in Table 5-17.

Table 5 Unit 1 DBNPS External Event Impact on ILRT LERF Calculation Hazard EPRI Accident Class 3b Frequency LERF Increase (from 3 per 10 years to 1 per 15 years) 3 per 10 year 1 per 10 year 1 per 15 years External Events 1.39E-07 4.65E-07 6.97E-07 5.58E-07 Internal Events 1.21E-08 4.02E-08 6.04E-08 4.83E-08 Combined 1.52E-07 5.0SE-07 7.58E-07 6.06E-07 The internal event results are also provided to allow a composite value to be defined. When both the internal and external event contributions are combined, the total change in LERF due to increasing the ILRT interval from 3 to 15 years is 6.06E-7, which meets the guidance for small change in risk, as it exceeds 1.0E-7/yr and remains less than a 1.0E-6 change in LERF.

For this change in LERF to be acceptable, total LERF must be less than 1.0E-5. The tota'I LERF values are calculated below:

LERF = LERFinternal + LERFfire +LERFseismic + LERFc1ass3Bincrease LERF1syr = 2.84E-7/yr+ 3.92E-6/yr+ 6.90E-7/yr + 6.06E-7/yr= 5.SOE-6/yr As specified in Regulatory Guide 1.174 [Reference 4], since the total LERF is less than 1.0E-5, it is acceptable for the ~LERF to be between 1.0E-7 and 1.0E-6.

5.2.7.1 Screened External Hazards Several "other" external events were evaluated in the DBNPS IPEEE [Reference 34]. The IPEEE reported frequency of hazards from external floods, high winds, transportation accidents, and nearby facility accidents is "acceptably low [Reference 34]. Since the time the IPEEE was performed, FLEX has been installed at DBNPS to provide additional accident mitigation capabilities [Reference 42]. Additionally, some hazard reevaluations have been performed. As part of the flood hazard reevaluation, FENOC developed and implemented mitigating strategies in accordance with NRC Order EA-12-049. As a result of this assessment, alternate staging areas and trigger points for pre-deployment of FLEX N+1 equipment were developed; this further limits DBNPS's external flood risk [Reference 31]. Recent external flood calculations Revision 1 Page 28 of45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension concluded no flooding onsite will affect any key structures, systems, or components or key safety functions at DBNPS [Reference 33].

The major concern in a high-wind or tornado scenario are the wind loads imposed on the buildings/major structures and the potential for wind-generated missiles to disable systems or components necessary to shut down the plant or maintain the plant in a safe shutdown condition. DBNPS wind and tornado loadings are evaluated under Section 3.3 of UFSAR

[Reference 44]. All Class I buildings and structures were designed to withstand tornado winds corresponding to 300 mph tangential velocities, traverse velocities of 60 mph, and a differential pressure drop of 3 psi in 3 seconds with no loss of function. In addition, all Class I buildings and structures were also designed to withstand various postulated tornado generated missiles, including a plank and a 4000-lb passenger car. Since the DBNPS IPEEE [Reference 34], RG 1.76 [Reference 45] was updated to lower the required design basis tornado wind speeds to 230 mph for the region in which DBNPS is located. All DBNPS FLEX equipment is stored in structures with designs that are robust such that no one external event can reasonably fail the FLEX capability [Reference 42]. There have been no major changes to the buildings/major structures or location of important safety equipment within them since the IPEEE submittal in 1996. The only significant changes are the addition of the Emergency Feedwater System/Facility and FLEX equipment and procedure additions or changes which provide the station with additional response capability to an event. Therefore, it is concluded that no new factors have been introduced at DBNPS since the submittal of the IPEEE in 1996 that would result in an increase in the risk associated with high winds, tornadoes, tornado missiles.

No significant changes have been made that would affect the IPEEE evaluations of highway transportation, railroads, waterways, pipe.lines, military facilities, or industrial facilities. This evaluation is maintained in Section 2.2 of the UFSAR [Reference 44]. According to the Federal Aviation Administration's Air Traffic Activity System, air traffic at the Toledo Express Airport, the closest airport serving commercial airlines, has significantly decreased since the time of the IPEEE. Based on the information summarized here from the IPEEE [Reference 34] and maintained in the UFSAR [Reference 44], these hazards are screened from this analysis.

5.2.8 Defense-In-Depth Impact Regulatory Guide 1.174, Revision 3 [Reference 4] describes an approach that is acceptable for developing risk-informed applications for a licensing basis change that considers engineering and applies risk insights. One of the considerations included in RG 1.174 is Defense in Depth.

Defense in Depth is a safety philosophy that employs successive compensatory measures to provide accidents or mitigate damage if a malfunction, accident, or naturally caused event occurs at a nuclear facility. The following seven considerations will serve to evaluate the proposed licensing basis change for overall impact on Defense in Depth.

1. Preserve a reasonable balance among the layers of defense.

The usage of the risk metrics of LERF, population dose, and conditional containment failure probability collectively ensures the balance between prevention of core damage, prevention of containment failure, and consequence mitigation is preserved. The change in LERF is "small" per RG 1.174, and the change in population dose and CCFP are "small" as defined in this analysis and consistent with NEI 94-01 Revision 3-A.

2. Preserve adequate capability of design features without an overreliance on programmatic activities as compensatory measures.

The adequacy of the design feature (the containment boundary subject to Type A testing) is Revision 1 Page 29 of45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension persevered as evidenced by the overall "small" change in risk associated with the Type A test frequency change. *

3. Preserve system redundancy, independence, and diversity commensurate with the expected frequency and consequences of challenges to the system, including consideration of uncertainty.

The redundancy, independence, and diversity of the containment subject to the Type A test is preserved, commensurate with the expected frequency and consequences of challenges to the system, as evidenced by the overall "small" change in risk associated with the Type A test frequency change.

4. Preserve adequate defense against potential CCFs.

Adequate defense against CCFs is preserved. The Type A test detects problems in the containment which may or may not be the result of a CCF; such a CCF may affect failure of another portion of containment (i.e., local penetrations) due to the same phenomena. Adequate defense against CCFs is preserved via the continued performance of the Type B and C tests and the performance of inspections. The change to the Type A test, which bounds the risk associated with containment failure modes including those involving CCFs, does not degrade adequate defense as evidenced by the overall "small" change in risk associated with the Type A test frequency change.

5. Maintain multiple fission product barriers.

Multiple Fission Product barriers are maintained. The portion of the containment affected by the Type A test extension is still maintained as an independent fission product barrier, albeit with a "small" change in the reliability of the barrier.

6. Preserve sufficient defense against human errors.

Sufficient defense against human errors is preserved. The probability of a human error to operate the plant, or t9 r~spond to off-normal conditions and accidents is not significantly affected by the change to the Type A testing frequency. Errors committed during test and maintenance may be reduced by the less frequent performance of the Type A test (less opportunity for errors to occur).

7. Continue to meet the intent of the plant's design criteria.

The intent of the plant's design criteria continues to be met. The extension of the Type A test does not change the configuration of the plant or the way the plant is operated.

Revision 1 Page 30 of45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension 5.3 Sensitivities 5.3.1 Potential Impact from Steel Liner Corrosion Likelihood A quantitative assessment of the contribution of steel liner corrosion likelihood impact was performed for the risk impact assessment for extended ILRT intervals. As a sensitivity run, the internal event CDF was used to calculate the Class 3b frequency. The impact on the Class 3b frequency due to increases in the ILRT surveillance interval was calculated for steel liner corrosion likelihood using the relationships described in Section 5.2.6. The EPRI Category 3b frequencies for the 3 per 10-year, 10-year, and 15-year ILRT intervals were quantified using the internal events CDF. The change in the LERF, change in CCFP, and change in Annual Dose Rate due to extending the ILRT interval from 3 in 10 years to 1 in 10 years, or to 1 in 15 years are provided in Table 5 Table 5-20. The steel liner corrosion likelihood was increased by a factor of 1000, 10000, and 100000. Except for extreme factors of 10000 and 100000, the corrosion likelihood is relatively insensitive to the results.

Table 5 Steel Liner Corrosion Sensitivity Case: 38 Contribution 3b 3b 3b LERF LERF LERF Frequency Frequency Frequency Increase Increase Increase (3-per-10 (1-per-10 (1-per-15 (3-per-10 to (3-per-10 to (1-per-10 to year ILRT) year ILRT) year ILRT) 1-per-10) 1-per-15) 1-per-15)

Corrosion Likelihood 1.21E-08 4.02E-08 6.04E-08 2.82E-08 4.83E-08 2.01E-08 X1 Corrosion Likelihood 1.22E-08 4.23E-08 6.77E-08 3.01 E-08 5.55E-08 2.53E-08 X 1000 Corrosion Likelihood 1.31E-08 6.11E-08 1.33E-07 4.79E-08 1.20E-07 7.22E-08 X 10000 Corrosion Likelihood 2.28E-08 2.49E-07 7.89E-07 2.26E-07 7.66E-07 5.41 E-07 X 100000 1

Table 5-19-Steel Lin'er Corrosion Sensitivity: CCFP CCFP CCFP CCFP CCFP CCFP CCFP Increase Increase Increase (3-per-10 (1-per-10 (1-per-15 (3-per-10 to (3-per-10 to (1-per-10 to year ILRT) year ILRT) year ILRT) 1-per-10) 1-per-15) 1-per-15)

Corrosion Likelihood 7.77E-02 8.28E-02 8.64E-02 5.08E-03 8.70E-03 3.63E-03 X1 Corrosion Likelihood 7.77E-02 8.28E-02 8.65E-02 5.12E-03 8.78E-03 3.66E-03 X 1000 Corrosion Likelihood 7.79E-02 8.34E-02 8.74E-02 5.53E-03 9.48E-03 3.95E-03 X 10000 Corrosion Likelihood 7.96E-02 8.92E-02 9.61E-02 9.59E-03 1.64E-02 6.85E-03 X 100000 Revision 1 Page 31 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension Table 5-20 -Steel Liner Corrosion Sensitivity: Dose Rate

~

Dose Rate Dose Rate Dose Rate Dose Rate Dose Rate Dose Rate Increase Increase Increase (3-per-10 (1-per-10 (1-per-15 (3-per-10 to (3-per-10 to (1-per-10 to year ILRT) year ILRT) year ILRT) 1-per-10) 1-per-15) 1-per-15)

Corrosion 1.56E-02 6.52E-03 3.91E-03 1.30E-02 1.96E-02 9.13E-03 Likelihood X 1 Corrosion Likelihood X 3.95E-03 1.32E-02 1.97E-02 9.21 E-03 1.58E-02 6.58E-03 1000 Corrosion Likelihood X 4.26E-03 1.42E-02 2.13E-02 9.94E-03 1.70E-02 7.10E-03 10000 Corrosion Likelihood X 7.39E-03 2.46E-02 3.70E-02 1.72E-02 2.96E-02 1.23E-02 100000 5.3.2 Expert Elicitation Sensitivity Another sensitivity case on the impacts of assumptions regarding pre-existing containment defect or flaw probabilities of occurrence and magnitude, or size of the flaw, is performed as described in Reference 24. In this sensitivity case, an expert elicitation was conducted to develop probabilities for pre-existing containment defects that would be detected by the ILRT only based on the historical testing data.

Using the expert knowledge, this information was extrapolated into a probability-versus-magnitude relationship for pre-existing containment defects [Reference 24]. The failure mechanism analysis also used the historical ILRT data augmented with expert judgment to develop the results. Details of the expert elicitation process and results are contained iri Reference 24. The expert elicitation process has the advantage of considering the available data for small leakage events, which have occurred in the data, and extrapolate those events and probabilities of occurrence to the potential for large magnitude leakage events.

The expert elicitation results are used to develop sensitivity cases for the risk impact assessment. Employing the results requires the application of the l~RT interval methodology using the expert elicitation to change the probability of pre-existing leakage in the containment.

The baseline assessment uses the Jeffreys non-informative prior and the expert elicitation sensitivity study uses the results of the expert elicitation. In addition, given the relationship between leakage magnitude and probability, larger leakage that is more representative of large early release frequency, can be reflected. For the purposes of this sensitivity,.Jhe same leakage magnitudes that are used in the basic methodology (i.e., 10 La for small and 100 La for large) are used here. Table 5-21 presents the magnitudes and probabilities associated with the Jeffreys non-informative prior and the expert elicitation used in the base methodology and this sensitivity case.

Table 5 DBNPS Summary of ILRT Extension Using Expert Elicitation Values (from Reference 24)

Leakage Size (La) Expert Elicitation Mean Probability of Occurrence Percent Reduction 10 3.88E-03 86%

100 2.47E-04 91%

Taking the baseline analysis and using the values provided in Table 5-10 and Table 5-11 for the expert elicitation sensitivity yields the results in Table 5-22.

Revision 1 Page 32 of45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension Table 5 DBNPS Summary of ILRT Extension Using Expert Elicitation Values Accident ILRT Interval Class 3 per 10 Years 1 per 10 Years 1 per 15 Years Base Adjusted Dose Dose Frequency Dose Frequency Dose Frequency Base (person- Rate Rate Rate Frequency rem) (person- (person- (person-rem/yr) rem/yr) rem/yr) 1 5.13E-06 5.11E-06 2.40E+03 1.22E-02 5.0BE-06 1.21 E-02 5.02E-06 1.20E-02 2 1.65E-07 1.65E-07 3.00E+06 4.94E-01 1.65E-07 4.94E-01 1.65E-07 4.94E-01 3a N/A 2.04E-08 2.40E+04 4.90E-04 6.81E-08 1.63E-03 1.02E-07 2.45E-03 3b N/A 1.30E-09 2.40E+05 3.12E-04 4.33E-09 1.04E-03 6.50E-09 1.56E-03 7 1.86E-07 1.86E-07 4.16E+05 7.72E-02 1.86E-07 7.72E-02 1.86E-07 7.72E-02 8 6.88E-08 6.88E-08 2.05E+06 1.41 E-01 6.88E-08 1.41 E-01 6.88E-08 1.41E-01 Totals 5.55E-06 5.55E-06 6.69E+06 7.25E-01 5.55E-06 7.27E-01 5.55E-06 7.28E-01 b.LERF (3 per 10 N/A 3.03E-09 5.20E-09 vrs base) b.LERF (1 per 10 N/A N/A 2.17E-09 vrs base)

CCFP 7.57% 7.63% 7.67%

The results illustrate how the expert elicitation reduces the overall change in LERF and the overall results are more favorable with regard to the change in risk.

' I Revision 1 Page 33 of45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension 6.0 RESULTS The results from this ILRT extension risk assessment for DBNPS are summarized in Table 6-1.

Table 6 ILRT Extension Summary Class Dose Base Case Extend to Extend to (person- 3 in 10 Years 1 in 10 Years 1 in 15 Years rem)

CDFNear Person- CDFNear Person- CDFNear Person-RemNear RemNear RemNear 1 2.40E+03 5.0?E-06 1.22E-02 4.93E-06 1.1 BE-02 4.83E-06 1.16E-02 2 3.00E+06 1.65E-07 4.94E-01 1.65E-07 4.94E-01 1.65E-07 4.94E-01 3a 2.40E+04 4.85E-08 1.16E-03 1.62E-07 3.88E-03 2.43E-07 5.82E-03 3b 2.40E+05 1.21 E-08 2.89E-03 4.02E-08 9.65E-03 6.04E-08 1.45E-02 7 4.16E+05 1.86E-07 7.72E-02 1.86E-07 7.72E-02 1.86E-07 7.72E-02 8 2.05E+06 6.88E-08 1.41E-01 6.88E-08 1.41E-01 6.88E-08 1.41E-01 Total 5.SSE-06 7.29E-01 5.SSE-06 7.38E-01 5.SSE-06 7.44E-01 ILRT Dose Rate from 3a and 3b From 3 N/A 9.13E-03 1.56E-02

.&Total Years Dose Rate From 10 N/A N/A 6.52E-03 Years From 3 N/A 1.25% 2.15%

%.&Dose Years Rate From 10 N/A N/A 0.88%

Years 3b Frequency CLERF)

From 3 N/A . 2.82E-08

• 4.83E-08 Years

.&LERF From 10 N/A N/A 2.01E-08 Years CCFP%

From 3 N/A 0.508% 0.870%

Years

.&CCFP%

From 10 N/A N/A 0.363%

Years Revision 1 Page 34 of45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension

7.0 CONCLUSION

S AND RECOMMENDATIONS Based on the results from Section 5.2 and the sensitivity calculations presented in Section 5.3, the following conclusions regarding the assessment of the plant risk are associated with extending the Type A ILRT test frequency to 15 years:

• Regulatory Guide 1.174 [Reference 4] provides guidance for determining the risk impact of plant-specific changes to the licensing basis. Regulatory Guide 1.174 defines very small changes in risk as resulting in increases of CDF less than 1.0E-06/year and increases in LERF less than 1.0E-07/year. Since the ILRT does not impact CDF, the relevant criterion is LERF. The increase in LERF resulting from a change in the Type A ILRT test interval from 3 in 10 years to 1 in 15 years is estimated as 4.83E-8/year using the EPRI guidance; this value increases negligibly if the risk impact of corrosion-induced leakage of the steel liners occurring and going undetected during the extended test interval is included. Therefore, the estimated change in LERF is determined to be "very small" using the acceptance guidelines of Regulatory Guide 1.174 [Reference 4]. The risk change resulting from a change in the Type A ILRT test interval from 3 in 1O years to 1 in 15 years bounds the 1 in 10 years to 1 in 15 years risk change. Considering the increase in LERF resulting from a change in the Type A ILRT test interval from 1 in 10 years to 1 in 15 years is estimated as 2.01 E-8, the risk increase is "very small" using the acceptance guidelines of Regulatory Guide 1.174 [Reference 4].

• When external event risk is included, the increase in LERF resulting from a change in the Type A ILRT test interval from 3 in 10 years to 1 in 15 years is estimated as 6.06E-7/year using the EPRI guidance, and total LERF is 5.50E-6/year. As such, the estimated change in LERF is determined to be "small" using the acceptance guidelines of Regulatory Guide 1.174 [Reference 4]. The risk change resulting from a change in the Type A ILRT test interval from 3 in 10 years to 1 in 15 years bounds the 1 in 10 years to 1 in 15 years risk change. When external event risk is included, the increase in LERF resulting from a change in the Type A ILRT test interval from 1 in 10 years to 1 in 15 years is estimated as 2.53E-7 and the total LERF is 5.15E-6. Therefore, the risk increase is "small" using the acceptance guidelines of Regulatory Guide 1.174

[Reference 4].

• The effect resulting from changing the Type A test frequency to 1-per-15 years, measured as an increase to the total integrated plant risk for those accident sequences influenced by Type A testing, is 0.016 person-rem/year. NEI *94-01 [Reference 1] states that a small population dose is defined as an increase of s 1.0 person-rem per year, or s 1% of the total population dose, whichever is less restrictive for the risk impact assessment of the extended ILRT intervals. The results of this calculation meet these criteria. Moreover, the risk impact for the ILRT extension when compared to other severe accident risks is negligible.

• The increase in the conditional containment failure probability from the 3 in 10 year interval to 1 in 15 year interval is 0.870%. NEI 94-01 [Reference 1] states that increases in CCFP of s 1.5% is small. Therefore, this increase is judged to be small.

Therefore, increasing the ILRT interval to 15 years is considered to be small since it represents a small change to the DBNPS risk profile.

Revision 1 Page 35 of45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension Previous Assessments The NRC in NUREG-1493 [Reference 6] has previously concluded that:

• Reducing the frequency of Type A tests (ILRTs) from 3 per 10 years to 1 per 20 years was found to lead to an imperceptible increase in risk. The estimated increase in risk is very small because ILRTs identify only a few potential containment leakage paths that cannot be identified by Type B or Type C testing, and the leaks that have been found by Type A tests have been only marginally above existing requirements.

• Given the insensitivity of risk to containment leakage rate and the small fraction of leakage paths detected solely by Type A testing, increasing the interval between integrated leakage-rate tests is possible with minimal impact on public risk. The impact of relaxing the ILRT frequency beyond 1 in 20 years has not been evaluated. Beyond testing the performance of containment penetrations, ILRTs also test integrity of the containment structure.

The conclusions for DBNPS confirm these general conclusions on a plant-specific basis considering the severe accidents evaluated for DBNPS, the DBNPS containment failure modes, and the local population surrounding DBNPS.

Revision 1 Page 36 of45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension A. ATTACHMENT 1 A.1. PRA Quality Statement for Permanent 15-Year ILRT Extension The Davis-Besse PRA model of record and supporting documentation have been maintained as a living program, with updates directed every other refueling cycle (approximately every four years) to reflect the as-built, as-operated plant. The PRA-DB1-AL-R06 PRA model currently includes internal events, internal flooding, and seismic. Level 1 and Level 2 results are provided via this model. A fire model, which is based on the internal events model, has also been developed for implementation at Davis-Besse to support risk-informed applications, and will be subject to the same configuration controls described below.

Interim updates may be prepared and issued in between regularly scheduled model updates on an as needed basis. Typically, an interim revision would be used for an update that would cause a change in core damage frequency of greater than 10 percent, a change in large early release frequency of greater than 20 percent, or for changes that could significantly impact a risk-informed application. Interim models may also be released following focused peer reviews once the associated findings and suggestions have been addressed. Note that under the FENOC PRA Program, if a portion of the model has been upgraded to satisfy the PRA Standard (Internal Flooding models at Davis-Besse for example), that portion of the model will not be released until after a focu~ed peer review has been conducted and any findings and suggestions have been addressed.

The Davis-Besse model is highly detailed and includes a wide variety of initiating events, modeled systems, operator actions, and common cause events. The PRA quantification process used is based on the large linked fault tree methodology, which is a well-known and accepted methodology in the industry. The model is maintained and quantified using the EPRI Integrated Risk Technologies suite of software programs.*

FENOC employs a multi-faceted, structured approach for establishing and maintaining the technical adequacy and plant fidelity of the PRA models for all FENOC nuclear generation sites, including Davis-Besse. This approach includes both a proceduralized PRA maintenance and update process, as well as the use of self-assessments and independent peer reviews.

A.1.1 PRA Maintenance and Update The FENOC risk management process ensures that the Davis-Besse PRA model is an accurate reflection of the as-built, and as-operated plant. This process is defined in the FE NOC PRA Program, which consists of a governing procedure NOPM-CC-6000, "Probabilistic Risk Assessment Program," and subordinate implementation procedures.

Procedure NOPM-CC-6000 serves as the higher tier procedure and establishes the FENOC PRA Program and provides administrative requirements for the maintenance and upgrade of the FENOC PRA models and risk-informed applications. The overall objective of the PRA Program is to provide technically adequate PRA models such that the requirements set forth in RG 1.200 are satisfied for use in risk-informed applications.

Working in conjunction with the above procedure, NOBP-CC-6001, "Probabilistic Risk Assessment Model Management" establishes the administrative and technical requirements for the maintenance and upgrade of the FENOC PRA models.

A procedurally controlled process is used to maintain configuration control of the Davis-Besse PRA model, data, and software. In addition to model control, administrative mechanisms are in place to assure that plant modifications, procedure changes relevant to the PRA, changes to calculations, and industry operating experience (OE) are appropriately screened, dispositioned, Revision 1 Page 37 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension and tracked for incorporation into the PRA model if that change would impact the model. As part of this process, if any proposed ch~nges are identified, which are perceived to significantly

• increase or decrease risk, they are incorporated into a working model (given their known level of detail at the time), and the results are compared to the effective model of record to identify if the pmposed change should be pursued. These processes help to assure that the Davis-Besse PRA reflects the as-built, as,..operated plant within the limitations of the PRA methodology, and that the significance of future expected changes or enhancements are understood and managed.

The interfacing process involves an ongoing solicitation of review of any changes that may have an impact upon the PRA model. Any changes to the PRA model or its supporting documentation are captured within a tracking database for PRA implementation tracking and future disposition.

Additionally, the PRA staff provides the top risk significant operator actions to the Operations Training staff, for simulator validation to ensure that the current human reliability modeling reflects actual expected response and timing.

A.2. Applicability of Peer Review Findings and Observations (F&Os)

The technical acceptability of the Davis-Besse PRA models has been demonstrated by the peer review process. The purpose of the industry PRA peer review process is to provide a method for establishing the technical capability and adequacy of a PRA relative to expectations of knowledgeable practitioners, using a set of guidance that establishes a set of minimum requirements. PRA peer reviews continue to be performed as PRAs are updated (and upgraded) to ensure the ability to support risk-informed applications and has proven to be a 1

valuable process for establishing technical adequacy of nuclear power plant PRAs.

A.2.1 Internal Events PRA The Davis-Besse Internal Events PRA model has been peer reviewed in accordance with the guidance and NRC-endorsed standards in effect at the time of each of the reviews as follows:

• April 2008 - full scope peer review addressing all technical elements excluding large early release and internal flooding based on RG 1.200 Rev. 1 and ASME RA-Sb-2005

' I

• October 2011 - focus scope peer review addressing technical element large early release frequency based on RG 1.200 Rev. 2 [Reference 36] and ASME/ANS-RA-Sa-2009 [Reference 37]

• July 2012 -focus scope peer review addressing technical element internal flooding based on RG 1.200 Rev. 2 and ASME/ANS-RA-Sa-2009

• October 2017 - CCF focus scope peer review for method upgrade identified during independent assessment

• October 2017 - independent assessment of F&Os and closeout review based on Appendix X of NEI 05-04 [Reference 38]; any re-assessed SRs were based on RG 1.200 Rev. 2 and ASME/ANS-RA-Sa-2009 Each of the above reviews are discussed below.

The most recent full-scope peer review of the Davis-Besse Internal Events PRA model was the April 2008 gap assessment against the ASME RA-Sb-2005, "Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications," and RG 1.200, Revision 1. Typically, a gap assessment is performed to review the differences between two versions of the PRA ASME standard. However, the purpose of the 2008 gap assessment was to assess the current status of the internal events PRA with regard to the supporting requirements (SRs), assign an Revision 1 Page 38 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension indication of the significance of the gaps and F&Os identified (levels A - D), describe the scope of effort needed to close the gap and F&O to achieve capability category II of the SR, and estimate the resources necessary to accomplish closure of the gap and F&O. Thus, this gap assessment is far more encompassing than a typical peer review of the PRA model. All requirements for conducting a peer review were met.

The review team consisted of five independent reviewers qualified per NEI 05-04, "Process for Performing Follow-on PRA Peer Reviewers Usirig the ASME PRA Standard," January 2005, and they evaluated the current status of the PRA against the requirements in ASME RA-Sb-2005 and RG 1.200, Revision 1.

The review was a full scope Internal Events Level 1 review, excluding large early release and internal flooding, but covering initiating events, accident sequences, success criteria, system analysis, human reliability analysis, data analysis, quantification and results, and the maintenance and update technical areas of the ASME RA-Sb-2005 PRA standard. If the PRA model and documentation did not meet at least capability category II of ASME RA-Sb-2005, an F&O was identified.

Because the peer review in 2008 predated the current RG 1.200 endorsed internal events standard, a comparison was made between the ASME/ANS RA-Sb-2005 standard used for the peer review and the endorsed ASME/ANS RA-Sa-2009 standard. For the majority of the SRs, the wording was unchanged, or the intent remained the same. There were no changes to the SRs that were found to have an impact on the internal events PRA model. Therefore, the 2008 peer review and the review of the updated PRA standard combined assure the current internal events PRA model satisfies capability category II of the current RG 1.200 endorsed internal events standard ASME/ANS RA-Sa-2009.

The 2008 gap assessment did not review the technical areas of large early release and internal flooding. These two technical areas had separate focused scope peer reviews in 2011 (LERF) and 2012 (internal flooding) against the relevant portions of the ASME/ANS-RA-Sa-2009 standard.

All F&Os originating from the internal events, large early release, and internal flooding peer reviews were addressed using FENOC's PRA program to disposition each individual F&O, thus ensuring the model satisfies the PRA standard requirements.

The October 2017 independent assessment and closeout review addressed FENOC's disposition to all F&Os from the three peer reviews discussed above. The review was conducted consistent with NEI 05-04/07-12/12-13 Appendix X, "Fact & Observation (F&O) Close-Out with Independent Assessment." Each member of the independent assessment team met the ASME standard criteria for independence from the Davis-Besse PRA and the relevant peer reviewer qualifications for the F&Os being reviewed. Each F&O documented closure was reviewed by the team to determine if the F&O had been adequately addressed and can therefore be closed out using the appropriate parts of the ASME/ANS-RA-Sa-2009 PRA standard. The relevant SRs were also re-assessed for cases where the peer review identified the SR as not meeting capability category II. The independent assessment for internal events PRA closed all F&Os, and determined each associated SR to meet at least capability category II.

During the independent assessment, the F&O dispositions for two SRs (SY-B4 and DA-D5) related to common cause failure modeling were determined by the independent assessment team to be an upgrade, rather than an update. A focused scope peer review was held, and the team concluded these two SRs were met to at least capability category II with no new findings.

Ultimately, the independent assessment and subsequent focused scope peer review for internal events PRA closed all but one of the F&Os and determined that all but one of the supporting Revision 1 Page 39 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension requirement met capability category II or better. Finding SY-B11, associated with supporting requirement SY-B10, was found to remain open. Supporting requirement SY-B10 requires that those systems that are required for initiation and actuation of a system are identified. Because the PRA model justifies excluding some actuation logic due to negligible contribution for the emergency diesel generator, instead of explicitly modeling this logic, this supporting requirement was concluded to meet capability category I only. Since NEI 94-01 endorses using PRA models conformed to capability category I of the ASME/ANS standard, the Davis-Besse PRA model is of sufficient quality to use for this Type A test analysis. However, the F&O remains open, since it is desired that all supporting requirements meet capability category II.

Therefore, each supporting requirement of the internal events standard other than SY-B 1O has been determined to meet at least capability category II by the peer review team or the independent assessment team. SY-B10 meets capability category I with an open F&O to support meeting capability category II. There are no other open F&Os remaining.

A.2.2 Fire PRA The Davis-Besse fire PRA model was peer reviewed by the PWR Owners Group in June 2013.

The review was performed against the requirements of ASME/ANS RA-Sa-2009, Part 4, including Clarifications and Qualifications provided in the NRC endorsement of the Standard contained in Revision 2 to RG 1.200. The peer review was performed using the process defined in NEI 07-12, Revision 1 [Reference 40].

All F&Os originating from the Fire PRA peer review were addressed using FENOC's PRA program to disposition each individual F&O, thus ensuring the model satisfies the PRA standard 1 requirements.

The October 2017 independent assessment and closeout review addressed FENOC's disposition to all F&Os from the Fire PRA peer review. The review was conducted consistent with NEI 05-04/07-12/12-13 Appendix X, "Fact & Observation (F&O) Close-Out with lndepen,dent Assessment." Each member of the independent assessment team met the ASME standard criteria for independence from the Davis-Besse Fire PRA and the relevant peer reviewer qualifications for the F&Os being reviewed. Each F&O documented closure was reviewed by the team to determine if the F&O had been ade'quately addressed and can therefore be closed out using the appropriate parts of the ASME/ANS-RA-Sa-2009 PRA standard. The relevant SRs were also re-assessed for cases where the peer review identified the SR as not meeting at least capability category 11. The independent assessment for fire PRA determined each associated SR to meet at least capability category II.

During the independent assessment, the F&O dispositions associated with two SRs (PRM-B14, and PRM-B15) related to new accident progressions were determined by the independent assessment team to be an upgrade, rather than an update. In addition, at the request of FENOC, three SRs (CF-A 1, CF-A2, and CF-B1) related to DC hot short methodology were requested to be addressed by a focused scope review. A focused scope peer review was held, and the team concluded these SRs were met to at least capability category II with no new findings.

There were five finding level F&Os that remained open after the independent assessment, which are identified below in Table A-1. Note the independent assessment also identified a suggestion level F&O to improve the PRA documentation.

F&Os ES-A1-01, ES-A1-02, ES-A1-03, and FQ-A1-01 in Table A-1 have been resolved by making appropriate changes to the PRA model as identified in the F&O. The associated SRs ES-A 1 and FQ-A 1 continue to be met, as identified in the independent assessment team report.

Revision 1 Page 40 of45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension The remaining F&O ES-D1-01, is identified by the independent assessment team as documentation issue only. SR ES-D1 continues to be met, as identified in the independent assessment team report.

Therefore, each SR of the fire PRA standard has been determined to meet at least capability category II by the peer review team or the independent assessment team. The remaining five open finding level F&Os for the fire PRA have been resolved or involve only a documentation update.

Revision 1 Page 41 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Davis-Besse Fire PRA Focused-Scope Peer Review Facts & Observations F&O# Review Level Other Issue Element Affected SRs ES-A1-01 ES F PRM-810 Discussion of Issue Some of the logic gates referenced in the Tables 3-through 10 in the MSO Report (ARS-DB 0005) do not properly address the essence of the MSO scenario. Minor model changes will be required to fully address the MSO scenario.

Examples include:

• MSO Scenario 4 - DC control power dependency for RCPs to allow tripping the RCPs from the MCR is not included under Gate Q01-2-38 (So, gates E766 (for DAN) and E748 (for DBN) should be included under gate Q01-2-38).

• The spurious opening of the PORV is modeled under gate R750 which is under gate Q10. Gate Q10 feeds into sequences for a loss of RCS integrity with a failure of injection or recirculation. Gate Q11 feeds into sequences for a loss of feedwater, loss of RCS integrity, and a failure of injection or recirculation. In those sequences the PORV is assumed to open to relieve the RCS pressure increase due to a loss of feedwater. Review of the logic indicates that R750 should also feed into gate Q11, since a spurious signal holding the PORV open after the pressure release is a valid failure mode. Thus, the current modeling does not properly address the MSO in cases where feedwater is lost, but this can be remedied by placing R750 as an input to gate Q11.

Basis For Significance:

Improper modeling of scenarios could lead to inaccurate quantification results and potential misapplication of results.

Possible Resolution:

Correct the identified modeling issues and address similar issues that may exist.

ES-A1-02 ES F PRM-810 Discussion of Issue Some of the logic gates referenced in the Tables 3- through 10 in the MSO Report (ARS-DB 0005) do not include all the support systems.

• Ml:?0 Scenario 4 - DC control power dependency for RCPs to allow tripping the RCPs from the MCR is not included under Gate Q01-2-3B. Gates E766 (for DAN) and E748 (for DBN) should be included under gate Q01-2-3B.

• MSO Scenario 16 - Failure of power to the associated SFAS cabinets (from panels Y1 and Y3, or Y2 and Y4) should be conservatively modeled to fail the diesel due to failure of the sequencer. This is not currently in the PRA model.

Basis For Significance:

Missing support system dependencies could underestimate the impact of the MSO scenario.

Possible Resolution:

Revision 1 Page 42 of45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Davis-Besse Fire PRA Focused-Scope Peer Review Facts & Observations F&O# Review Level Other Issue Element Affected SRs Add the required support system dependencies.

ES-A1-03 ES F PRM-810 Discussion of Issue A review of Tables 3- through 10 in the MSO Report (ARS-DB-11-0005) and the DB Fire PRA fault tree model indicate that some pseudo logic was used to capture cable impacts in lieu of detailed logic modeling.

Examples include:

• MSO Scenario 4 - The cables from the DC busses that supply control power to the RCP breakers are included in the cable selection for the breakers.

• MSO Scenario 46 - The cables associated with the sequencer were traced. The cables include the cabling from the power supply busses to the SFAS cabinets, as well as control cabling to the EDGs and C1 and D1 busses. The cables were associated with 'components' SXSEQ1SEQ1 (for SFAS channels 1 and 3) and SXSEQ2SEQ2 (for SFAS channels 2 and 4) in the SAFE software and level 1 failure reports, and were mapped to EOG 1 and EOG 2 Failures to start in FRANX, respectively.

Since the complimentary channels were bundled together in this mapping, it will conservatively fail an EOG if the power cable to only one SFAS cabinet is impacted by the fire.

Basis For Significance:

Incomplete mapping of fire impacted cables could underestimate the MSO impact.

Possible Resolution:

Explicitly model support system dependencies or confirm that the necessary cables have been captured under the pseudo logic.

ES-D1-01 ES F PRM-810 Discussion of Issue Some of the logic gates referenced in the Tables 3- through 10 in the MSO Report (ARS-DB 0005) do not properly address the essence of the MSO scenario. Minor model changes will be required to fully address the MSO scenario.

Examples include:

• MSO Scenarios 18 and 19 - This MSO references gate R700, which does not address spurious PORV opening. The correct gate should have been gate R750.

• MSO Scenario 38 - This MSO references gates M154 and M070. The correct gates should have been gates M108 and M118.

Basis For Significance:

This is a documentation issue which could introduce uncertainties about the completeness of the MSO analysis.

Revision 1 Page 43 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Davis-Besse Fire PRA Focused-Scope Peer Review Facts & Observations F&O# Review Level Other Issue Element Affected SRs Possible Resolution:

Update the MSO documentation to properly reflect the model elements that address the MSO issue.

FQ-A1-01 FQ F CF-A1, CS- Discussion of Issue A2 During a review of MSO Scenario 18 related to spurious operation of a pressurizer PORV, it was identified that a spurious operation value of 0.29 was applied to BE RRZRC2AS-2SUUTSAG.

The basis for spurious operation probability (0.29) was provided as It is an ungrounded DC control circuit for a Solenoid Operated valve, and uses the mean value from NUREG/CR-7150 Table 5-2, row 1 column 6 (Aggregate of all failure modes).

That value is for ungrounded DC double break circuits (thermoset). It was identified that, based on E52B Sh. 13 that only the "M" and "Q" cables are associated with a double break design and that the valve control circuit used to energize the "4" relay and open the valve are a single break design, and that, as a minimum, the "P" and the "M" cables are thermoset single break circuits and should be using Table 4~1 of NUREG/CR-7150 Volume 2. It appears that inter-cable, intra-cable and GFEHS could result in spurious PORV opening on both of these cables. The aggregate value (mean) for that configuration is 0.56.

Therefore, it appears that values for spurious operation probability for the pressurizer PORVs did not use the correct values from NUREG/CR-7150 in all instances.

Basis For Significance:

Applying incorrect values to circuit failure probabilities could potentially affect fire risk quantification results, depending upon the specific fire scenarios.

Possible Resolution:

Review the PORV circuitry to ensure the single break and double break circuitry is correct in the Detailed Circuit analysis and circuit failure mode likelihood analysis. Ensure these results are accurately included in the Fire PRA model. Review the circuit failure likelihood analysis results for other unique types of failure modes.

Revision 1 Page 44 of 45

5401 O-CALC-01 Evaluation of Risk Significance of Permanent ILRT Extension A.2.3 Seismic PRA The Davis-Besse seismic PRA model was peer reviewed by the PWR Owners Group peer review program in July 2014. The review was performed against the requirements of ASME/ANS RA-Sa-2009, Part 5, including Clarifications and Qualifications provided in the NRC endorsement of the Standard contained in Revision 2 to RG 1.200. The peer review was performed using the process defined in NEI 12-13, Revision O [Reference 41].

All F&Os originating from the Seismic PRA peer review were addressed using FENOC's PRA program to disposition each individual F&O, thus ensuring the model satisfies the PRA standard requirements.

The October 2017 independent assessment and closeout review addressed FENOC's disposition to all F&Os from the Seismic PRA peer review. The review was conducted consistent with NEI 05-04/07-12/12-13 Appendix X, "Fact & Observation (F&O) Close-Out with Independent Assessment." Each member of the independent assessment team met the ASME standard criteria for independence from the Davis-Besse Seismic PRA and the relevant peer reviewer qualifications for the F&Os being reviewed. Each F&O documented closure was reviewed by the team to determine if the F&O had been adequately addressed and can therefore be closed out using the appropriate parts of the ASME/ANS-RA-Sa-2009 PRA standard. The relevant SRs were also re-assessed for cases where the peer review identified the SR as not meeting capability category 11. The independent assessment for Seismic PRA closed all F&Os, and determined each associated SR to meet at least capability category II.

1 During the independent as sessment, the F&O dispositions associated with four SRs (SHA-G1, SHA-H 1, SHA-I 1, and SPR-E6) related to seismic hazard assessment and large early release analysis, were determined by the independent assessment team to be an upgrade rather than an update. A focused scope peer review was held, and the team concluded these SRs were met to at least capability category II with no new findings.

Therefore, each SR of the seismic PRA standard has been determined to meet at least capability category II by the peer review team or the independent assessment team, and there I ' are no remaining open F&Os. ,

• A.3. Consistency with Applicable PRA Standards Based on the peer reviews, independent assessment of F&O resolutions, the focused scope peer reviews, and the disposition of the remaining five open findings for the fire PRA, FENOC concludes that the current Davis-Besse Internal Events, Fire, and Seismic PRA models conform to capability category II of ASME RA-Sb-2009, ASME/ANS Standard for Probabilistic Risk Assessment of Nuclear Power Plant Applications as endorsed by RG 1.200 Revision 2 for all supporting requirements except SY-B10, which conforms to capability category I. Since NEI 94-.

01 endorses using PRA models conformed to capability category I of the ASME/ANS standard, and all supporting requirements meet or exceed capability category I, using these models for this Type A test analysis meets technical adequacy requirements.

Revision 1 Page 45 of 45