ML020930632

NRC Staff Review Guidance for PRA Results Used to Support Option 2 Based Upon NEI 00-04, Option 2 Implementation Guidance Supported by NEI 00-02 Probabilistic Risk Assessment Peer Review Process Guideline

ML020930632
Person / Time
Issue date:	04/02/2002
From:	Mckenna E NRC/NRR/DRIP/RPRP
To:	Pietrangelo A Nuclear Energy Institute
References
NEI-00-02, NEI-00-04, TAC MA8899
Download: ML020930632 (43)

Text

April 2, 2002 Mr. Anthony R. Pietrangelo, Director Risk and Performance-Based Regulation Nuclear Energy Institute Suite 400 1776 I Street, NW Washington, DC 20006-3708

SUBJECT:

NRC STAFF REVIEW GUIDANCE FOR PRA RESULTS USED TO SUPPORT OPTION 2 BASED UPON NEI 00-04, OPTION 2 IMPLEMENTATION GUIDELINE SUPPORTED BY NEI 00-02 PROBABILISTIC RISK ASSESSMENT PEER REVIEW PROCESS GUIDELINE (TAC NO. MA8899)

Dear Mr. Pietrangelo:

In a letter dated April 24, 2000, NEI requested NRC review of the suitability of the peer review process described in NEI 00-02 to address PRA quality issues for use in Option 2 applications.

NRC issued a request for additional information on September 19, 2000, to which you responded in a letter dated January 18, 2001. Subsequently, in a letter dated December 18, 2001, you requested that NRC expand its review of NEI 00-02 for use in support of all risk-informed regulatory initiatives.

As previously noted, NRC has some concerns with the subtier criteria and with documentation of the peer review process results. In recognition that most (if not all) current utility PRAs have already undergone the peer review process, and in view of staff plans to conduct a focused review of the PRA to be used in any application to implement Option 2, the NRC decided it would be more effective to focus on using the results of the process, rather than on modifying the guidelines (as discussed in NEI 00-02). Accordingly, we have prepared draft guidance for staff review of PRA results used to support an Option 2 submittal based upon NEI 00-04, supported by NEI 00-02. This draft guidance is enclosed for your information.

As discussed in meetings such as that held on February 5, 2002, and in the letter to you from Ashok Thadani dated February 12, 2002, the NRC plans to expand its review to consider NEI 00-02 in support of risk-informed regulation and not just for one application. At the meeting we discussed our plans to develop a regulatory guide (with appendices) and supporting standard review plans, on use of NEI 00-02 as it might be used in support of other applications.

2 Questions concerning this letter should be directed to either Michael Cheok (301-415-8380) or Gareth Parry (301-415-1464).

Sincerely,

/RA/

Cynthia A. Carpenter, Program Director Policy and Rulemaking Program Division of Regulatory Improvement Programs Office of Nuclear Reactor Regulation

Enclosure:

As stated

2 Questions concerning this letter should be directed to either Michael Cheok (301-415-8380) or Gareth Parry (301-415-1464).

Sincerely,

/RA/

Cynthia A. Carpenter, Program Director Policy and Rulemaking Program Division of Regulatory Improvement Programs Office of Nuclear Reactor Regulation

Enclosure:

As stated DISTRIBUTION:

ADAMS BSheron, ADPT TReed MDrouin, RES RGEB r/f WBorchardt, ADIP SWest M.Markley, ACRS (15)

SCollins/JJohnson SNewberry, RES TBergman, OEDO DMatthews/FGillespie JMoore, OGC CCarpenter MRubin TScarbrough PBalmain EMcKenna MCheok GKelly GParry DDiec BBoger/WDean JZwolinski GHolahan/SBlack SMagruder JStrosnider GMizuno, OGC MShuaibi ADAMS Accession Number: ML020930632

• DOCUMENT NAME:G:\RPRP\RIP50\GuidanceNEI 00-02.wpd

• See previous concurrence OFFICE RPRP:DRIP RPRP:DRIP SPSB:DSSA RPRP:DRIP NAME EMcKenna SWest MRubin/SD for/ C. Carpenter DATE 03/08/02 03/28/02 04/01/02 04/02/02 OFFICIAL RECORD COPY

DRAFT Guidance for Staff Review of PRA Results Used to Support Option 2 Submittals Based on NEI-00-04 supported by NEI 00-02 This document provides guidance for a limited Staff review of the conclusions drawn from PRA results used to support an Option 2 submittal based on the process described in Revision B of NEI-00-04 and supported by the use of NEI-00-02 Revision A3. In this context, NEI-00-02 is a tool for the licensees to assess the quality of the PRA input. However, NEI-00-02 does not require documentation of the review findings that is sufficient to give the Staff a sufficiently clear understanding of the PRA to conclude that the PRA input is providing robust results. It is understood that the most useful product of a review of a PRA performed according to NEI-00-02 is the set of Facts and Observations sheets that documents the strengths and, in particular the weaknesses, of the PRA model. It appears that the practice of the NEI review teams is to complete facts and observations (F&Os) sheets primarily for grades other than grade 3 or 4.

Grade 3 is in fact likely to be most useful for Option 2 applications. The problem of lack of documentation of the review findings is further compounded by the fact that the subtier criteria used to determine the grades for the sub-elements in NEI-00-02 do not represent minimum criteria to be met for each of the grades. The verb should (and some times may) is used frequently in the subtier criteria for grade 3, allowing room for interpretation by the reviewers. As a result, even for those elements for which the NEI criteria list the appropriate issues, there is no clear understanding, when a grade 3 is assigned, how the cited issues have actually been addressed. The flexibility allowed by the peer review process is usually related to issues that are dealt with by making certain assumptions or approximations, or by adopting a specific level of detail. In order to reach the conclusion that the PRA results support the proposed categorization, the reviewer is led to either look for evidence that the impact of a given issue on PRA results has been adequately addressed in the peer review report and, when necessary, has been identified for consideration by the IDP, or to request further information from the licensee.

The focus of the NRC review will be in areas where the staff believes that the criteria for allocating grades for those PRA sub elements that could impact Option 2 categorization are either unclear or allow too much subjectivity. This draft document identifies areas for staff review based on the current revisions of NEI 00-02 and the Option 2 implementation guidance provided in NEI 00-04, and focuses on NEI criteria for grade 3 which is the grade primarily recommended by NEI for Option 2 applications. Staff observations of the PRA peer reviews at the Limerick and Hatch NPPs have also been taken into account. Final guidance for the NRC review will be dependent on the staff-endorsed version of NEI 00-04, and will take advantage of lessons-learned from pilot plant implementation of the NEI 00-02 and NEI 00-04 processes.

As a starting point, a list of areas of review, described at a high level, was compiled to identify the PRA inputs and assumptions that are likely to be important to the results and conclusions of that PRA. In addition, PRA elements or technical issues that historically have been subject to varying degrees of treatment (e.g., areas where there are no consensus methodologies) are highlighted as areas on which reviewers may want to focus. The subtier-criteria of NEI-00-02 were then reviewed to see how well this list of inputs, assumptions, and technical issues is addressed to the extent necessary to support the approach to categorization described in NEI-00-04. Those areas that were felt not to be adequately addressed are identified and guidance ENCLOSURE

for review given. The Staff reviewer should either determine that the given topic has been adequately addressed in the peer review report, or perform a focused review, either directly or by issuing RAIs to the licensee, to determine whether the topic has been appropriately addressed in the PRA.

This document also provides the rationale for the review guidance. This rationale is based on the premise that Grade 3 is being proposed as the grade that defines the PRA that can be used to support Option 2 applications.

1. Initiating Events Analysis

1. Assumptions/criteria and methods used to identify initiating events Area of Review:

What are the assumptions/criteria and methods used to identify the initiating events modeled, including:

• generically applicable events

• events from plant-specific operating experience

• support system initiators

• low frequency but potentially high consequence events (e.g., ISLOCAs and SGTRs)

How this issue is treated in NEI 00-02:

• IE-7, IE-8 and IE-9 cover generically applicable events

• IE-8 covers events from plant-specific operating experience

• IE-5, IE-10 and SY-21 cover support system initiators

• IE-14 and ST-9 cover ISLOCAs Discussion:

Use of other PRAs and use of industry and plant-specific experience to identify potential initiating events are adequately covered. However, in the subtier criteria for IE-8, the Staff believes that, if a Grade 3 is to be used as the acceptable grade for Option 2 applications, the should ought to be a shall for the review of plant-specific experience.

Otherwise, there would be no way for the Staff to be confident that plant specific experience had been taken into account.

Identification of support system initiators is covered adequately in IE-10 which calls for a structured approach such as a fault tree or an FMEA, although again, the Staff believes that the should ought to be a shall for Option 2. The requirements in IE-5 specify that support system failures be quantitatively included, although fault tree quantification is only required for a Grade 4. (This requirement however is misplaced in Table 5-1 of NEI-00-02, as it deals with quantification rather than identification.)

IE-14 addresses the quantification of the frequency of ISLOCAs, but does not address how potential ISLOCAs are identified. There are no criteria given for Grade 3 as to what 2

the dominant features of the plant and procedures are. A list similar to that for Grade 4 is needed. The staff also believes that the presence and capacity of relief valves in the low pressure piping and where they discharge should also be considered as part of this list. Without such a list, the NRC reviewer would not know the criteria used for the identification and inclusion/exclusion of these initiators. Since the cutsets for ISLOCAs typically involve only two or three basic events, even if the frequency is evaluated as being low enough to screen them out, the RAW value of the individual SSCs is likely to be high. Furthermore, since the pathways often involve identical valves in series, the impact of any change in treatment is magnified. Therefore, if ISLOCAs are screened out, the reasons for the screening ought to be made clear to the IDP.

The SGTR initiating event is not specifically addressed in the sub-tier criteria.

Review Focus for Option 2 submittals:

Reviewers should determine whether: a) plant-specific experience has been taken into account to identify unique plant-specific initiating events; and b) a systematic process such as an FMEA has been used to identify support system initiators. Attention should be given to the ISLOCA events to determine whether, if they are screened, the reasons are well documented, and take into account the factors identified in Grade 4 for IE-14 and those discussed above. For PWRs, the Staff should determine that modeling of SGTR events have been included.

b. Assumptions/criteria used to group/classify initiators, and proper characterization of initiator group for subsequent analyses Area of Review:

What are the criteria used to group initiating events so that events in the same group have similar mitigation requirements?

How this issue is treated in NEI 00-02:

IE-4, IE-7, IE-11, and IE-12 deal with the grouping of initiating events.

Discussion:

The intent of the criteria in IE-4 for a Grade 3 is adequate and, as suggested in NEI 02, these criteria should apply to all grades. However, the differentiation between the grades is not clear. For example, the interpretation of phrases such as relatively high level of conservatism and excess conservatism is not provided. For the purposes of the Option 2 submittal, the results could become distorted if the events are grouped so that a low frequency contributor to the group produces the greatest challenge and is used to set the success criteria. It is in this context that the phrases should be interpreted.

In IE-7, the general categories are appropriate, although there are no categories for the ATWS and SGTR initiating events. However, this is not an important omission since it 3

should be obvious to reviewers that, once these events are identified, they should be grouped separately from the other transients.

In IE-11 and IE-12, it is not clear how subsuming initiating events differs from grouping the events since these two approaches seem essentially the same.

Review Focus for Option 2 submittals:

The review may wish to sample the most challenging transient initiating event groups to determine that there are no clear outlier contributors.

c. Assumptions/criteria used to exclude initiating events Area of Review:

What are the criteria used to eliminate initiating events from further consideration?

How this issue is treated in NEI 00-02:

IE-8 and IE-9 discuss the exclusion of initiating events and IE-15 discusses the exclusion of extremely rare events, with a footnote that provides criteria for exclusion.

Discussion:

The criteria in IE-8 and IE-9 require the bases for exclusion of initiating events be discussed. However, no criteria are given as to what can appropriately be excluded.

In IE-15, the estimation of initiating event frequencies is discussed. Included in this discussion for Grades 3 and 4 is the guideline, in the form of a footnote, of how extremely rare events can be excluded. This guidance lists three characteristics which may be used as screening criteria.

Review Focus for Option 2 submittals:

Reviewers should look at the criteria used by the PRA to eliminate initiating events from further consideration, and confirm that they are compatible with the screening criteria discussed in footnote 5 to Table 5-1 of the subtier criteria document. Attention should be given to low frequency but potentially high consequence events like ISLOCA events and SGTR events. Reviewers should also determine if the information supplied to the IDP adequately addresses the SSCs that can contribute to the occurrence of screened-out initiators as part of the Option 2 categorization process, particularly those such as ISLOCAs.

4

d. Treatment of initiators that affect multiple units Area of Review:

For plants where systems are shared or cross-tied, how are initiators that affect multiple units modeled?

How this issue is treated in NEI 00-02:

IE-6 deals with multi-unit site initiators.

Discussion:

For Grades 3 and 4, the guideline simply states that multi-unit site initiators should be treated and quantified explicitly. There are no guidelines as to when explicit treatment of such initiators is not needed, or how these initiators are to be modeled (e.g., there is no guidance in the AS or QU elements to guide the review of the modeling and quantification of these initiators).

Review Focus for Option 2 submittals:

This issue is a concern for those multi-unit sites where systems that are required to respond to the initiator are shared or cross-tied between units, e.g., the sharing of a swing diesel generator, or the cross-tieing of Service Water between units. Such initiators include a loss of offsite power. The appropriate modeling of the impact of such initiating events is reflected in the definition of accident sequence success criteria and in the development of the accident sequences. The reviewer should determine whether the definition of the success criteria has taken into account the requirements of the other units at the plant site, and that this is reflected in the accident sequence development.

Reviewers should also verify that these shared and cross-tied systems have been considered in the Option 2 categorization process.

e. Determination of initiating event frequencies Area of Review:

What are the methods and data used to estimate the frequencies for the initiating event groups?

How this issue is treated in NEI 00-02:

IE-5, IE-13 to IE-17 discuss the requirements for the determination of initiating event frequencies.

Discussion:

The subtier criteria address the important issues associated with estimation of initiating event frequencies. The main concern is that the frequencies not be outliers with respect to industry norms, unless there is a good plant-specific reason. If the shoulds for Grade 5

3 were to be interpreted as shalls, the Staff would have confidence that the initiating event frequencies were reasonable. However, other than the suggested use of EPRI TR-102266 for LOCA frequencies, sources of acceptable generic data are not provided.

Specific issues concerning the collection of plant-specific data and the combination of this data with generic data will be discussed in Section 5 (parameter estimation).

(It is not clear what the intent of IE-17 is, and how this is different from the requirements in IE-10. Furthermore, an FMEA is not a quantification technique. IE-17 could be deleted without a loss of information.)

IE-5 addresses the quantification of support system initiating events, though only the criteria for Grade 4 mention use of a fault tree as an acceptable method. When the support system functions for all other initiators are modeled using fault trees, it seems reasonable from the point of view of consistency to expect that their impact as initiating events should be modeled to the same level. The use of fault trees to evaluate initiating event frequencies requires modification of the fault trees used for system unavailability in response to an initiating event. The modifications typically include changing the mission time to 1 year, and modeling repair of a failed train, so that, for example, in a two train system, the initiating event occurs because of the failure of the redundant train before the failed operating train is repaired.

Use of plant-specific data should be emphasized for the more commonly occurring initiating events.

Review Focus for Option 2 submittals:

Reviewers should review the peer review report to determine whether it presents enough detail to make a determination that the frequencies are reasonable. If the peer review report does not provide sufficient detail, the reviewer should compare the initiating event frequencies with those in NUREG/CR-5750 to determine that there are no significant outliers. Any unexplained outliers may be candidates for the performance of sensitivity studies to determine whether they impact the Option 2 categorization significantly.

The process for estimation of support system initiator frequencies should be reviewed.

When fault tree models are used, the reviewer should make sure that the mission times used for the SSCs appropriately reflect either a reactor year or the mean time to repair, as appropriate, rather than the 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> typically used for the mission time for evaluating unavailability, and that the repair of the failed train has been modeled appropriately.

Furthermore, the reviewer should confirm that the SSCs that contribute to the support system initiating events have been considered in the Option 2 categorization.

6

2. Accident Sequence Development

a. Definitions of core damage and large early release Area of Review:

How are core damage (CD) and large early release (LER) defined?

How this issue is treated in NEI 00-02:

AS-20 and AS-22 provide guidance for the definition of core damage.

L2-22 and L2-23 provide guidance for the definition of large early release.

L2-16 provides guidance on containment failure modes to be considered.

Discussion:

The guidance for the definition of CD is acceptable (although it appears that AS-22 is largely redundant to AS-20), with the caveat that the should in the second paragraph of the Grade 3 criterion ought to be a shall.

The guidance on an appropriate definition of LER needs to be clarified. While the references to Reg Guide 1.174 and to the EPRI PSA Applications Guide are unambiguous, alternative definitions provided by the Owners Group are not further explained.

The guidance on the containment failure modes to be considered is acceptable.

Review Focus for Option 2 submittals:

Because the Grade 3 criterion relating to definition of CD is written as a should, if not addressed in the peer review report, the reviewer should determine whether the definition of CD is consistent with the examples of the PRA Applications Guide. The reviewer should identify the definition of LER as used in the PRA. When a definition of LER differs from that given in Reg Guide 1.174 or the PSA Applications Guide, reviewers should determine if the definition is appropriate, or that sensitivity analyses (either qualitative or quantitative) are performed as part of the Option 2 process to determine if SSC categorization is affected by the choice of LER definition.

b. Modeling of necessary and sufficient equipment and operator actions Area of Review:

What are the guidelines used to determine the equipment and operator actions that have to be modeled to mitigate initiators (in accordance with plant procedures and training)?

7

How this issue is treated in NEI 00-02:

The pertinent elements are AS-4 to AS-7, AS-17 and AS-19 Discussion:

AS-4 states that, for Grades 3 and 4, event trees shall match the initiating event groups (note that since this is an internal consistency issue, this should be a requirement for Grade 2 also); AS-5 states that the model shall be consistent with the as-built plant; AS-6 states that the necessary critical safety functions shall be included; and AS-7 states that all relevant systems should be credited. These requirements appear to be reasonable, however, terms such as necessary critical safety functions and relevant systems are not defined until sub-element AS-17 which states that functional success criteria should be identified and then provides examples of safety critical functions. It would seem that, if AS-17 preceded both AS-6 and AS-7, the guidance in AS-6 and AS-7 would be much clearer.

Similarly, guidance provided in AS-19 (which calls for the models to be consistent with Emergency Operating Procedures and Abnormal Operating Procedures), would be of help in clarifying the requirements in AS-6 and AS-7 if AS-19 preceded these sub-elements.

A note on AS-7: Some of the issues for determining whether a system has to be credited in the accident sequence models do not appear to be relevant. For example, it is stated that the determination of systems to be credited depends on whether a system influences the success criteria used in the PRA. It is not clear how a system would influence the success criteria; rather, the success criteria should determine what systems (or parts of a system) must function to ensure that the undesired state (core damage or large early release) does not occur. Another example is in the second bullet which questions whether a system by itself can result in system success. The staff is unsure as to whether this statement refers to functional success (e.g., removal of decay heat). Finally, the last statement implies that when the answer to any of the questions is no, then the system does not have to be included in the PRA. This does not appear to be correct: a system should not be excluded from being credited because it is not being supplied by safety-related power, for example. This criterion would exclude many systems usually depended upon to mitigate accidents (e.g., the feedwater system).

In summary, the criteria/guidance in this area are not very well organized, and AS-7 could provide distracting information and could result in misleading review conclusions.

However, the sub-element criteria, when considered in total by an experienced reviewer, should be adequate to determine whether the appropriate equipment and operator actions are included.

Finally, the Grade 3 requirements for AS-7 states that all relevant systems should be credited for each function. When relevant systems are not credited, the reasons for this should not only be available to the PRA peer reviewers, but should also be passed on to the users of the PRA results. For example, if a PRA does not credit systems such as control rod drive, main feedwater, or the power conversion system (which are needed to mitigate an accident and are identified in abnormal and emergency procedures), the 8

overall results will be conservative in terms of plant risk, however, this may also produce a biased ranking of systems, structures, systems, and components.

Review Focus for Option 2 submittals:

The general criterion for determining which systems and operator actions are credited is that they are called out in plant procedures and that the systems can meet the safety function success criteria. Since the development of accident sequences is dependent on the definition of the success criteria, the reviews of these PRA elements should be performed together. Treatment of success criteria is discussed in Section 3. In terms of credit for systems in Option 2 applications, the reviewer should verify that the appropriate systems as called out in plant procedures are credited (e.g., by checking on peer review findings from AS-19), and that conservative biases are not introduced that could skew the results of PRA importance analyses, e.g., by omission of systems that are called on in EOPs and that could fulfil a safety function. Not taking credit for a system conservatively boosts the importance of those functions for which it performs an equivalent function.

However, of more concern is the fact that it can change the relative significance of other SSCs in the non-conservative direction. Credit for operator actions is discussed in Section 6.

c. Modeling of dependencies and interfaces Area of Review:

How are functional, phenomenological, and operational dependencies and interfaces modeled? For example, how are the following taken into account:

• functional dependencies between initiating events, mitigating systems, and operator actions

• the impact of plant conditions during accident progression on operating equipment (e.g., room cooling issues for SBO; high containment pressure which can lead to failure of SRVs to open, and to a HPCI and RCIC turbine trip (BWR); high containment temperature which can lead to loss of level indication; and high suppression pool or sump temperature leading to loss of pump NPSH)

• hardwired or system configuration dependencies and interlocks (shared components; common support systems; requirements for actuation, isolation, power, cooling and indication; operational dependencies; and spatial dependencies)

How this issue is treated in NEI 00-02:

• AS-11 treats the issue of dependency in general terms but specific guidance is not provided.

• DE-5 deals with the interaction between the initiating event and mitigating systems 9

• AS-10, SY-10, SY-11, SY-17, and SY-23 provide guidance to deal with the impact of accident progression conditions on operating equipment

• AS-10, SY-12, SY-13, DE-4, DE-6, and DE-8 provide guidance to deal with hardwired or system configuration dependencies and interlocks

• SY-10 and AS-10 provide guidance for the review of spatial dependencies. DE-11 contains walkdown guidelines to determine spatial dependencies Discussion:

In general, modeling the requirements for mitigating systems and operator actions as a function of the initiating event are the essence of the development of the success criteria and accident sequence models. The treatment of this type of functional dependency is relatively straightforward. In DE-5, the interaction between the initiating event and mitigating systems (front line and support systems) is discussed. However, for Grades 3 and 4, the term critical is used to discriminate support system initiating events. It is not clear what constitutes a critical support system initiator. The requirement here should be that, when dependencies exist between support system initiators and the systems needed for mitigation of the initiator, these initiators should not be subsumed into other groups.

AS-10, SY-10, SY-11, SY-17, SY-23 deal with the dependency between accident progression conditions and the operability of mitigating system equipment. Although a comprehensive list of scenarios and examples is not provided, guidance in these elements is sufficient for use by experienced reviewers.

AS-10, SY-12, SY-13, DE-4, DE-6, and DE-8 provide guidance on hardwired or system configuration dependencies and interlocks (shared components; common support systems; requirements for actuation, isolation, power, cooling and indication). This guidance appears to be adequate for use by experienced reviewers.

SY-10 and AS-10 provide guidance for the review of spatial dependencies. These elements depend in part on the results of plant walkdowns, for which guidance is provided in DE-11. In DE-11, the criterion a complete plant walkdown of critical areas shall be performed is used for Grade 4 and a walkdown of critical areas should be performed is used for Grades 2 and Grade 3. No criteria are given to differentiate between a walkdown and a complete walkdown. Also, for a walkdown to be effective and useful, there should be guidelines as to what the participants should be looking for and requirements for the documentation of the information obtained during this activity.

The peer reviewer can then judge whether such information is adequately incorporated into the PRA.

AS-10 addresses the influence of the accident scenarios on the HEPs. This is dealt with further in Section 6. The influence of the operator on sequence development is addressed in AS-19.

10

Review Focus for Option 2 submittals:

Except for the case of spatial dependencies, guidance provided in NEI 00-02 is adequate for an experienced reviewer for the review of dependencies and interfaces. Therefore, reviewers are not expected to concentrate on these areas. However, as part of the review of the PRA, the staff should review the plant documentation of the walkdown that was performed as part of the PRA (or look for evidence that the peer review team has performed such a review). Based on this review, a judgement should be made as to whether the walkdown is of sufficient scope and applicability to support the PRA models.

The reviewer should also verify that the walkdown was of sufficient scope to support the internal flooding analysis.

d. Time phasing of events Area of Review:

Are time phased dependencies appropriately modeled? Examples include:

• timing of significant recoveries, e.g., AC power recovery for SBO sequences,

• limitations on runtime due to capacity of CST, RWST, station batteries, etc.

How this issue is treated in NEI 00-02:

AS-13 and SY-13 deal with time phased analyses for accident sequences.

Discussion:

The intent in AS-13 is for the peer reviewers to examine the model for its use of time phased accident sequence evaluation. However, the use of the verb may in the lists of events to be included in the assessment for Grade 3 is a cause for concern.

Understanding how these events impact the development and the quantification of accident sequences is an important part of the PRA model and is necessary for Option 2 applications. It is after the examination of the issues on these lists and the determination that they have no significant impact on results that an analyst could choose to not explicitly incorporate them into the PRA.

Review Focus for Option 2 submittals:

The staff reviewer should look for evidence in the peer review documentation that time phasing of events was reviewed using guidance similar to the list provided in AS-13.

Otherwise, for the risk dominant sequences (e.g., the LOSP, SBO and ATWS sequences), reviewers should ensure that time-phased dependencies are addressed.

The AS-13 list can be used as guide (including reactor coolant pump seal LOCA considerations for PWRs). Assumptions made to model these time-phased events and their impact on the risk model should be identified as they are candidates for sensitivity studies if they are in some way limiting, e.g., bounding.

11

e. Treatment of transient induced events Area of Review:

How are transient-induced events, e.g., transient induced LOCAs (stuck open safety or relief valves) and transient induced SGTRs (in PWRs) modeled?

How this issue is treated in NEI 00-02:

This issue is not explicitly called out in NEI 00-02.

Discussion:

Transient induced events have been shown to be risk-significant at some plants.

Temperature induced SGTR could also be an important LERF issue. Therefore, these events could be important in Option 2 applications.

Review Focus for Option 2 submittals:

The staff should review whether transient induced events have been considered in the PRA (i.e., modeled explicitly, or dispositioned by showing that they are not important). If these events have been screened out, the review focus provided in item 1.c should also apply.

f. Treatment of sequence dependencies in transferred sequences Area of Review:

How are sequence dependencies modeled in transferred sequences?

How this issue is treated in NEI 00-02:

AS-8, AS-15, and QU-20 address the treatment of dependencies when sequences are transferred among event trees.

Discussion:

Guidance in AS-15 and QU-20 state that dependencies shall be treated explicitly when sequences are transferred among event trees. Although the last paragraph in Grade 3 of AS-8 also states that dependencies should be preserved, it is not clear what is meant in the second paragraph which states that transfers may be treated quantitatively or qualitatively.

12

Review Focus for Option 2 submittals:

Peer review findings from AS-15 and QU-20, confirming that the dependencies have been correctly transferred would be a sufficient indicator as to whether this area is adequately covered. It should be noted that, although the guidance in these subtier criteria calls for explicit treatment of dependencies, the subtier criteria are not clear as to how this is to be achieved. Therefore, this is an area which, if not addressed in the peer review report, should be subject to review (especially if transferred sequences are dominant risk contributors). Examples of acceptable approaches include, transfer of cutsets for a fault tree linking approach, or event tree linking for a support state model. In the former case, it is not adequate to transfer numbers if there are dependencies between the two event trees.

3. Determination of Success Criteria

a. Attributes of codes or other models used to define success criteria Area of Review:

What are the codes and/or models used to define success criteria?

• are the codes validated and verified to sufficient detail?

• are the codes applicable in the pressure, temperature and flow ranges of interest?

How this issue is treated in NEI 00-02:

TH-5, TH-6 and TH-7 provide guidance for the use of models and codes in the determination of PRA success criteria.

Discussion:

When plant specific analyses are used, there shall be explicit consideration as to whether the models and codes used are capable of providing the correct results. The sub tier criteria for Grade 3 for TH-5, TH-6 and TH-7 are somewhat ambiguous in that the descriptor should is used when discussing the need to verify code/model applicability.

Since the MAAP code is commonly used in many PRAs to determine success criteria, and since there are some known limitations with the certain versions of the MAAP code, reviewers should be aware of these limitations.

Review Focus for Option 2 submittals:

Reviewers should first look at the documentation and findings from the peer review to determine the scope of the review already performed and the extent of staff review (if any). For example, in staff observations of the peer reviews at Hatch and at Limerick, it appeared that this area was treated adequately and the peer review documentation clearly showed the extent and scope of the review. In cases such as these, staff review will not be required.

13

When peer review documentation does not provide sufficient evidence that the codes and models used are adequately applied, the staff should look at the PRA success criteria and compare them to those in PRAs such as those found in NUREG-1150 and to engineering evaluations found in available staff-approved vendor topical reports. When results differ to the point that success criteria are affected, additional review may be necessary.

Prior to a review of results and conclusions from the use of the MAAP code, reviewers should become familiar with available guidance on the subject. For example, a BNL report (FIN L-1499, MAAP 3.0B Code Evaluation Final Report, Valente and Yang, October 1992) states that MAAP should not be used for determining mission success criteria in events where clad damage has occurred (e.g., to determine whether or not a core can be successfully reflooded after fuel melting has occurred). In addition, this report states that, although MAAP 3.0B is adequate for predicting thermal-hydraulic behavior prior to clad damage, it should not be relied upon when certain thermal-hydraulic conditions are encountered. The four conditions cited by the BNL report are listed below together with a description of what each means to the reviewer.

" The break location gives rise to a quasi steady state two-phase flow condition The lack of a two-phase critical flow model in the MAAP code and other model simplifications may affect the calculation of in-vessel coolant inventory especially in the case of coolant loss under two-phase conditions. Therefore, MAAP calculations of transients where extended periods of two-phase break flow are expected should be accompanied by break flow sensitivity analyses. In addition, when MAAP is used to determine mission success criteria for transients like large, medium or small break LOCAs, steam generator tube rupture events, feed and bleed scenarios, or any other events that exhibit periods of two-phase break flow, MAAP results should be validated using results from codes such as TRAC, RELAP, or NOTRUMP.

In view of the differences in the way MAAP models critical flow and the way the discharge coefficient is calculated in the classical critical flow models, EPRI has recommended that the MAAP code users should verify that MAAP is calculating the proper flow rate under nominal conditions.

" The RPV water level and vessel flow conditions may expose the fuel to departure from nucleate boiling (DNB) conditions while MAAP continues to predict adequate core cooling This condition relates to the lack of a comprehensive heat transfer package for the core region and the inability of MAAP to predict DNB. In addition, MAAP may also have difficulties with the prediction of reactor vessel coolant inventory and the modeling of thermal-hydraulic behavior during core uncovery events and during reflood transients. The simplified boiloff models used in MAAP will become less accurate when conditions such as changing flow patterns associated with water injection, rapid blowdown, or changes in core geometry are present. MAAP boiloff models, in conjunction with the assumption that the flow patterns do not change as the core melts may predict a coolable geometry in the core when in fact the 14

geometry may not be coolable. Therefore, MAAP may be non-conservative when used to evaluate core uncovery rates and the effects of reflood. MAAP should not be used for determining success criteria after clad damage or when any degree of core uncovery is predicted.

However, for transients such as a station blackout where the water level in the core is determined primarily by the power in the core rather than changing conditions in the RCS, the simplified boiloff models may give reasonable results.

" The reactor has not scrammed (fuel stored energy will not be released)

In MAAP, the fuel stored energy is a user-supplied value. However, the release rate is code-specified and this release is modeled only after a reactor scram.

Power reductions alone (as may occur in an ATWS scenario) will not release this energy.

" Clad temperature is above 1200K This "condition" is somewhat inconsistent with the statements made above in the second bullet, in that MAAP may predict no core uncovery as a result of improperly computing the two-phase level in the system, and thus a clad temperature above 1200K would rarely be calculated. As stated previously, MAAP should not be used for determination of success criteria when any degree of core uncovery is predicted, i.e., when success criteria allow for some core uncovery. Therefore, for transients like LOCAs of any size where long term two-phase flow behavior is anticipate, justification should be requested to show that the two-phase level remains above the top elevation of the core.

The reviewer should look at licensee justification for using MAAP if the above thermal-hydraulic conditions are encountered.

Industry guidance documented in references such as EPRI TR-100742 and EPRI TR-100743 provides a discussion of the: major limitations of MAAP and its qualified range of application including guidelines on whether MAAP is appropriate for the sequences under consideration; guidelines for the setup of MAAP calculations for specific events; recommended sensitivity calculations for cases where the code is used to develop success criteria for various accident sequences; and interpretation of MAAP results. A summary of the guidance that would be of interest to the reviewer is provided below.

PWR: small LOCAs and SGTR - A higher level of caution is warranted for these sequences which nearly always involve two-phase flow phenomena in the RCS.

large LOCA - It is recommended that MAAP analyses alone not be used to determine success criteria that implicitly involve the evaluation of the potential for fuel damage in the initial blowdown and reflood portions of the accident.

main steam line break - The user should consider variations in initial steam generator inventory and maximum timestep as well as break size. Caution is advised in view of the apparent dependence of the results on control system 15

modeling and the overall lack of experience. The potential effects of overcooling transients are not modeled in MAAP.

BWR: loss of injection - Users should confirm MAAP calculated initial RPV water inventory with other available plant information. Users are urged to either conservatively assume an immediate cessation of FW flow or to input the expected behavior obtained from either plant experience or detailed system code analysis. Where the depressurization rate is a critical parameter, the user should investigate sensitivity to a reduction in the S/RV flow area. For sequences that are relying on low pressure systems for injection, the user is cautioned to accurately represent the system flow characteristics.

ATWS - Caution is warranted for ATWS events which are more sensitive to RPV level and pressure conditions due to their influence on core power. When investigating success criteria for cases with successful initiation of SLC, the user should be aware of the modeling assumptions on reactor shutdown. Due to increased power in an ATWS, the RPV pressure may hold at some elevated point depending on the number of S/RVs which are opened. If the "hold-up" pressure is near a shutoff head of a particular injection system, then the sensitivity to the effective S/RV flow area may be important.

small and medium LOCA - Consider variations in break area and elevation. In addition, the cautions stated under "loss of injection" also applies.

loss of heat removal - Same as in loss of injection.

The reviewer should look for evidence that the application of MAAP including the interpretation of the results have taken into account the BNL and industry (EPRI) guidance. In cases where the code was used contrary to the guidance, quantitative verification of the results should be requested to justify the key parameter behaviors used to support the calculation of the success criteria (e.g., verification of the minimum two-phase level in the vessel).

b. Technical basis for plant capability applicable for plant design and severe accident conditions Area of Review:

What is the technical basis used to support plant capability evaluations for plant design and severe accident conditions, e.g., requirements for reactivity control; core cooling or decay heat removal; reactor and containment pressure control; and accident sequence timing. Other issues include: ability of room cooling requirements; and load shedding evaluations.

How this issue is treated in NEI 00-02:

TH-4, TH-7, TH-8 and SY-11 provide general review guidance in terms of the use of generic and plant-specific evaluations.

16

AS-12, AS-13, AS-17 and AS-18 cover the technical basis to support plant capability evaluations to some degree.

Discussion:

Guidance provided calls for use of realistic evaluations that is consistent with the as-built and as-operated plant and is consistent with generic evaluations from similar plants. The guidance states that conservative analyses are allowed but should be minimized.

Although a significant portion of the engineering evaluations/assumptions made during the conduct of a PRA are associated with success criteria, the subtier criteria do not explicitly address such evaluations and assumptions. Without specific guidance, the determination of the appropriateness of the engineering calculations and assumptions is very dependent on reviewer expertise and experience.

As an example, AS-17 (which is referenced in TH-4) provides a list of functions whose success criteria should be established. However, TH-4 does not address the fact that these functions will differ with different sequences or boundary conditions in which different systems are challenged to perform the functions. For example, given a main steam line break and the failure of one or more MSIVs to close, the blowdown of the steam generators could present a PTS challenge. An analysis may be needed to determine the number of un-isolated steam generators that would represent such a challenge. This may result in a situation where the risk importance of the MSIVs will be dependent on the modeling of the scenarios. TH-4 does not provide guidance that would lead the peer review to identify these types of scenarios that may not have been analyzed.

Review Focus for Option 2 submittals:

In previous reviews of PRAs, the staff has found areas that historically have been subject to varying degrees of treatment. These include:

• ability of PWRs to depressurize for small LOCAs and transients when high pressure cooling is lost (primary/secondary depressurization and use of low pressure injection and/or condensate to the steam generators)

• number of relief valves required for depressurization (BWRs)

• requirements for feed and bleed (PWRs)

• credit for CRD, firewater system, and/or service water cross-ties as sources of injection (BWRs)

• modeling of RCP seal LOCAs (PWRs)

• percent of time moderator temperature coefficient is unfavorable (PWRs)

• success criteria for ATWS in BWRs (operator actions in lowering water level to control power, initiation of SLC, inhibiting ADS, and depressurization to stay below 17

the HCTL; modeling of the power/level correlation; assumptions on the consequences of failing to inhibit ADS (all BWRs), and failing to inhibit HPCS (BWR 5-6))

Staff reviewers should ascertain if there are areas where there is considerable uncertainty as to the appropriate modeling assumption(s) that might impact the risk spectrum. One example is the modeling of RCP seal LOCAs. These areas should have been identified during the peer review process, and during the preparation of input to the IDP as candidates for sensitivity studies.

c. Mission time to achieve safe, stable state Area of Review:

How is successful endpoints for Level 1 sequences defined, i.e., what is the mission time to achieve safe, stable state?

How this issue is treated in NEI 00-02:

AS-6 and AS-23 address this issue. AS-6 requires that the necessary critical safety functions to reach a safe stable state be modeled. AS-23 implies that 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> should be used as this mission time.

Discussion:

The use of a mission time criterion of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is somewhat arbitrary and is not always adequate. The mission time should be determined based on the time required to achieve a safe stable state, or, for example, in the case of diesel generators, until offsite power is restored. In the latter case, this is often taken as a suitable time for which it is judged that the likelihood of non-recovery is sufficiently small. In determining the time window for establishing a safe stable state, a defined and well established process for achieving that state should be defined. It is inappropriate to argue that, after a certain point in time, recovery will be assured.

Review Focus for Option 2 submittals:

Reviewers should determine if the peer review report has addressed this issue, especially for systems that are depended on to maintain long term containment integrity. In Option 2 applications, it is not anticipated that the use of mission times greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (unless it is substantially greater) would affect the results of the importance analyses.

(i.e., Given that a component has already operated successfully for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the probability of failure after this time period will typically be a small increment to the failure probability to start and run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, particularly since, in most cases, the probability of failure to run would be small when compared to the probability of failure to start). The issue of concern is not so much the impact of the mission time on the unavailabilities, but rather whether sequences have been screened out as not leading to core damage if core damage would not occur before 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. It is this latter point that the reviewer should focus on.

18

4. Systems Analysis

a. Definition of component boundaries Area of Review:

Is the definition of component boundaries consistent with that used in the parameter estimation task?

How this issue is treated in NEI 00-02:

SY-6, SY-14 and DA-5 deal with this issue.

Discussion:

This area is adequately covered in NEI 00-02.

Review Focus for Option 2 submittals:

Staff reviewers are not expected to have to focus on this issue unless peer review findings or previous Staff experience with the PRA indicate otherwise. However, see also item 5b.

b. Definition of SSC failure Area of Review:

Is the definition of SSC failure (in terms of the inability to complete its mission) consistent with the success criteria analysis?

How this issue is treated in NEI 00-02:

SY-15 and SY-16 deal with this issue, though only in a non-specific way.

Discussion:

Staff observations of the peer review process also indicate that this is an area that is throughly reviewed.

Review Focus for Option 2 submittals:

Staff reviewers are not expected to have to focus on this issue unless there are adverse peer review findings.

19

c. Assumptions/criteria used to identify and screen SSCs and/or specific failure modes Area of Review:

What are the criteria used to identify and screen SSCs and/or specific failure modes?

Are failure modes chosen such that they are:

• consistent with system design and operation

• incorporate plant-specific operational experience (e.g., recurring check valve back leakages, water hammer events, flow blockage by sludge or debris)

How this issue is treated in NEI 00-02:

SY-5, SY-6, SY-7, SY-15 and SY-16 deal with the identification and screening of SSCs to be included in the system fault trees.

Discussion:

SY-5, SY-6 and SY-7 provide general guidelines as to the components expected to be included in the system models. SY-15 and SY-16 provide guidance on the inclusion of plant-specific and generic system failure modes. However, there is no guidance on what SSC failure modes to include. The selection of components to include in a system model is an area that is generally covered well based on previous staff reviews of PRAs and on staff observations of the peer review. However, since there are no criteria for the screening of components or SSC failure modes, it will not be readily apparent why SSCs (including passive components or highly reliable components) or failure modes are not modeled.

Review Focus for Option 2 submittals:

The review should focus on how unmodeled components (for the critical safety functions) or failure modes are taken into account in the input to the IDP in the Option 2 process.

The scope of the IDP review becomes broader when fewer SSCs are included in the system model. Therefore, for Option 2 applications, it will be expected that the IDP is aware of the screening criteria used in the PRA, and the contribution of the unmodeled SSC to system success or failure. This awareness will be facilitated if there exists a thorough peer review report that addresses the issue of screening. Results of IDP deliberations to classify unmodeled SSCs is expected to be consistent with the success paths (modeled SSCs) that are HSS as identified by the PRA. See also item 4c.

d. Modeling of support system dependencies Area of Review:

How are support system dependencies accounted for?

How this issue is treated in NEI 00-02:

SY-12, DE-4 and DE-6 address this issue.

20

Discussion:

For Grade 3, SY-12 and DE-6 state that support systems should be explicitly accounted for, and DE-4 states that a dependency matrix should be evaluated and documented.

Although there is ambiguity because of the use of should, the availability and use of the fault tree linking process or the use of event tree logic rules in PRA codes makes the explicit treatment of dependency a non-issue as long as the dependencies are correctly identified to begin with. In past reviews of PRAs and in staff observations of PRA peer reviews, it was noted that this is an area that is understood as being important by most reviewers, and is an area that is usually throughly reviewed.

Review Focus for Option 2 submittal:

Staff reviewers are not expected to have to focus on this issue.

e. Modeling of functional dependent failures Area of Review:

How are functional dependent failures modeled?

• instrumentation and control requirements

• plant/system conditions and impact on initiation, isolation, trip, and continued operation

• room cooling requirements

• inventory limitations (water, air, power, cooling, diesel fuel oil)

How this issue is treated in NEI 00-02:

TH-8, SY-11, SY-12, SY-13, DE-4 and DE-6 deal with this issue.

Discussion:

TH-8 covers room cooling requirements. SY-11 covers operation in degraded environments including room temperatures above EQ limits. SY-13 covers inventory limitations, though only specifically mentions air. Power, and cooling. SY-12, DE-4 and DE-6 cover the general aspects of support system dependencies. The HRA sub-tier criteria generally cover the instrumentation and control requirements.

Although the guidance is not specific, when taken as a whole, the available criteria should be sufficient to allow an experienced reviewer to come up with a finding of adequacy.

However, because of a lack of specifics in the subtier criteria, documentation of the peer review findings may become an issue.

Review Focus for Option 2 submittals:

Similar to item 4a, this is an area where, in addition to F&Os (if any), additional documentation by the PRA peer review team will greatly facilitate the Option 2 IDP process and the NRC review. In the Option 2 categorization, it is important to know the SSCs directly credited and those that are implicitly credited. Reasons why SSCs which 21

are credited but not modeled are important to the decision-maker. Therefore, staff review in this area is expected to focus on how information is transferred to and utilized by the IDP.

f. Modeling and screening of common cause failures Area of Review:

How are common cause failures identified and represented in the system models, and what screening criteria are used?

How this issue is treated in NEI 00-02:

SY-8, DE-8, DE-9, DA-10, DA-11, DA-12 and DA-13 address this issue.

Discussion:

Criteria for the identification of common cause failure component groups are stated generally in DE-8, DA-10 and DA-11, with a reference to NUREG/CR-4780 in DE-9 and DA-13-2. That document itself provides more detailed guidance, but is not prescriptive.

Generally, PRAs include CCF basic events for the failure modes of active standby components, with some special CCF events to represent such events as steam binding (AFW systems), or sump screen blockage. Some of these candidates may be screened for inclusion in the model on the basis of a quantitative screening, using conservative CCF probabilities. Some PRAs do not include a common cause event for the failure of a component to continue to operate, arguing that it is unlikely that the components would fail during the mission time. This latter may be a more acceptable argument for normally operating components than it is for standby components In any case, CCF candidates should only be screened if there is a reasonable technical basis for doing so.

In addition, depending on plant design, for certain systems, the use of more detailed modeling of CCFs discussed for Grade 4 in DA-13 may be advisable for a Grade 3.

Review Focus for Option 2 submittals:

In general, PRA analysts are sensitive to the need to include CCF events in the model.

However, the Staff should focus on whether the set of CCF events is adequate. Staff reviewers should focus on rules used to identify and to screen out potential CCF groups.

As a minimum, CCF events should be included for the modeled failure modes of active standby components, unless screening them out is justified quantitatively, or on a supportable qualitative engineering argument. If the peer review documentation provides sufficient evidence that this has been done adequately, the Staff review will be minimal.

In Option 2 applications, the CCF screening rules should also be made available to the IDP.

22

5. Parameter Estimation

a. Grouping of components for parameter estimation Area of Review:

What are the guidelines used to group components for parameter estimation?

How this issue is treated in NEI 00-02:

DA-5 deals with the grouping of components for the purpose of data collection. However, since it only specifies in general the factors that should be considered, a lot of flexibility is left for the peer reviewers. DA-6 addresses to some extent the issue of components that are infrequently tested, and which should not be treated as members of a larger group. It also proposes a method for adjusting the unavailability by use of the standby failure rate model for components testing at long intervals.

Discussion:

The criteria for grouping are a function of whether generic or plant-specific data is used.

When generic data is used, it is usually in the form of estimates for a type of component for which only some general characteristics are defined (e.g., a motor-driven pump). In this case, the group is essentially defined by the generic data source. The criteria are more critical for the collection of plant specific data. The thing that is to be avoided is the grouping of components that have significantly different reliability characteristics. This criterion should be supplemented with a caution to look for unique components and/or operating conditions and to avoid grouping them. Alternatively, a new subtier criterion could be added to test the data for outlier behavior.

Review Focus for Option 2 submittals:

The concern for Option 2 is that potential outliers in either design or operational conditions have been identified, and that bad actors should not be overlooked by choosing failure probabilities that are too low. Reviewers, therefore, need to have confidence that those SSCs that are operated or tested infrequently, operate in poor environments, or have unique design features have been identified and categorized appropriately. The peer review should have addressed the SSCs with extended test intervals in response to sub-element DA-6. Peer review findings related to the identification of unique components, and the derivations of the groups, should be reviewed.

b. Selection of appropriate generic parameter values Area of Review:

How are generic parameter values chosen?

How this issue is treated in NEI 00-02:

23

DA-4 addresses this issue, but only by stating that reasonable generic sources that represent recent nuclear power experience, if available, should be used.

Discussion:

There are several possible generic data sources that are could have been used. Each has its own pedigree. The bases for some, such as NUREG-1150 are available for staff review. For others, such as vendor proprietary data bases, they are not. Minor differences in failure rates and probabilities are not significant for Option 2 purposes.

When the differences from the expected values are significant, for example different by a factor greater than 3, the reason needs to be explored.

Review Focus for Option 2 submittals:

Reviewers must have confidence that, whatever the source of generic data used, it should provide reasonable estimates with respect to a data base such as that from NUREG-1150. Factors to consider will be the consistency in definition of the component boundaries and the failure modes. The occurrence of a significant difference between estimates used and those from familiar sources may indicate a significantly different boundary definition. When documentation in the peer review report is not sufficient to provide the confidence that appropriate generic parameter estimates have been used, reviewers should compare the parameter estimates with those from a source that is well documented and generally accepted as being appropriate, for example, that of NUREG-4450, Volume 1. Justification should be requested from the licensee when parameter estimates are more than a factor 3 different from those provided in NUREG-4550, Volume 1.

c. Interpretation of plant records Area of Review:

How is plant-specific data collected and interpreted?

• test and maintenance unavailabilities

• definition of failures

• definition of demands

• time period for data gathering

• data censoring How this issue is treated in NEI 00-02:

DA-5 to DA-7 deal with this issue in very general terms. There are no subtier criteria that relate to specifics, so the peer reviewers would have to be very familiar with the issues related to data collection and interpretation in order to perform a good review.

Discussion:

There are many pitfalls in data collection and interpretation that can lead to erroneous parameter estimates. In addition, there are different interpretations as to what constitutes failure, demand, or appropriate time period for data gathering.

24

Review Focus for Option 2 submittals:

It is not expected that NRC staff will review the parameter estimation in detail.

Reviewers should identify parameter estimates that are significantly different from the generic estimates (see above item b) as a result of using plant specific data, and request a justification of why this is the case. Reviewers may also wish to verify that actual plant performance is consistent with the data used, e.g., by looking at plant-specific LERs or talking to project managers or staff in the regional offices to see if equipment failures and unavailabilities (the bad actors as described in item a above) are reflected in the PRA.

Finally, reviewers should be familiar with data and observations found in the system reliability studies (NUREG/CR-5500 series) to see if the PRA data used is consistent with industry experience. Significant differences should be explained by the applicant.

d. Methodology for combining generic and plant-specific data Area of Review:

What is the methodology used for combining generic and plant-specific data?

How this issue is treated in NEI 00-02:

This issue is not called out in NEI 00-02 although there is an oblique reference in DA-5 to Bayesian methods. IE-16 and DA-4 address the use of plant specific experience to some extent.

Discussion:

IE-16 specifically mentions Bayesian updating for Grades 3 and 4 but DA-4 does not. In fact, DA-4 seems rather to suggest that either plant-specific experience or generic data is used. The criterion for Grade 2 of IE-16 specifies two reasons for giving that grade, but does not specify a minimum criterion. DA-4, by contrast, seems to specify a number of alternate criteria. Therefore, there appears to be inconsistent treatment in the data requirements between the initiating event task and the data task. Inconsistency may also be a problem if the data specialist on the peer review team does not also review this aspect of the initiating event subtier criteria.

Criteria for the generic data sources and their use in performing Bayesian updates are not provided in NEI-00-02.

Review Focus for Option 2 Submittals:

Rather than review the process for combining plant-specific and generic data in detail, reviewers should focus on the parameter estimates used to identify any clear outliers (see above items b and c).

e. Estimation of common cause failure probabilities 25

Area of Review:

What is the methodology used for the estimation of common cause failure probabilities?

How this issue is treated in NEI 00-02:

DA-8 to DA-12, and DA-14 deal with this issue.

Discussion:

The subtier criteria are not well differentiated, and should be rationalized. Unless the CCF probabilities used are extremely low, the important factors concerning the modeling of common cause failures are the establishment of the CCF groups, and accounting for asymmetries. If this is what DA-13 refers to then it should be included for Grade 3 also.

In addition, in DA-14, the full intent of NUREG/CR-4780 should be included for Grade 3 if realistic values are desired. However, as long as appropriate care (e.g., performance of sensitivity studies) is taken in the categorization process of NEI-00-04, refined values of CCF probabilities may not be needed since the uncertainties associated with the parameter values are relatively large.

Review Focus for Option 2 submittals:

Reviewers should ensure that like active components of the same system have been included as CCF groups (see also 2d). Appropriate sensitivity studies should then be performed to address uncertainties in CCF probabilities and their impact on the Option 2 categorization process.

f. Estimation of non-recovery probabilities Area of Review:

What is the methodology used for the estimation of non-recovery probabilities (e.g.,

offsite power, repair of equipment, etc.) ?

How this issue is treated in NEI 00-02:

IE-13, IE-15, IE-16, AS-16 and DA-15 address the issue of recovery.

Discussion:

Although generic guidance is provided, there are no specific references for generic data sources, and there is no specific guidance for a reviewer on the estimation process.

Review Focus for Option 2 submittals:

Recovery is generally applied only in specific cases, for example, recovery of offsite power, where data exists to support the estimation of non-recovery probabilities.

Reviewers should identify and review the approach taken to see if it is based on industry experience or plant-specific experience, and if it is applied appropriately. This should 26

have been done by the peer reviewers of NEI-00-02. The degree of NRC review should depend on the degree the peer review report explains the basis for their approval.

It is relatively rare to see credit taken for repair of failed equipment in PRAs, except in modeling of support system initiating events. However, if significant credit is given for repair during the mission time defined by the accident sequence, this could lead to the failed SSCs being inappropriately classified as low safety significant. Any credit taken for repair should be well justified, based on ease of diagnosis, the feasibility of repair, ease of repair, and availability of resources. The reviewers should determine if, and where, repair has been included in the model, and if not considered justifiable, ensure that the use of repair is identified for use in sensitivity studies in the categorization process. As in the case for the recovery events discussed above, the level of Staff review should depend on the documentation available from the peer review.

g. Characterization of uncertainty Area of Review:

What is the method used for the representation of the uncertainty intervals?

How this issue is treated in NEI 00-02:

There are no subtier criteria related to this in NEI 00-02.

Discussion:

The characterization of uncertainty is important for a number of reasons. In particular it is necessary to have an idea of the range of possible parameter values to allow a sensible choice of sensitivity studies, should they be required. In addition, if the change in CDF is evaluated as the true mean (i.e., by propagating parameter distributions), it is important to have realistic probability distributions.

Review Focus for Option 2 submittals:

Reviewers should ascertain that a reasonable measure or characterization of the uncertainty on parameter values is given. Typically ranges that are too narrow (e.g., error factors substantially less than 3 ) are indicative of an optimistic assessment of uncertainty, and the uncertainty assessment process should be reviewed. Particular items to address in the review are the degree of pooling of data (creating a large sample by pooling can produce low uncertainty ranges), and the characterization of uncertainty in the industry wide data that has been incorporated in the assessment.

If there is no characterization of uncertainty, the reviewer should determine what the point estimates represent, for example, are they intended to represent mean values. See also the implications of this discussed in 8e below.

27

6. Human Reliability Analysis

a. Identification and screening of human activities for opportunities for human error Area of Review:

What are the assumptions/criteria and methods used to identify and screen human activities for opportunities for, and consequences of, human error (identification of pre-and post-initiating event human failure events (HFEs)) ?

How this issue is treated in NEI 00-02:

HR-4 to HR-10, HR-14, HR-27 and AS-19 address this issue.

Discussion:

HR-5 & HR-6 address pre-initiator HFEs. They are not explicit with regard to which procedures and training to review (HR-5), and the screening rules (HR-6) are imprecise.

HR-7 is essentially a counter screening rule (i.e., what should be left in) based on impact on CDF and LERF HR-9, HR-10, HR-14 address post-initiator HFEs. Neither HR-9 nor HR-10 describes a process to identify HFEs. The example process in Grade 3 for HR-9 (identify those operator actions identified by others) is not good practice and contrary to HR-10. Again HR-10 is not explicit as to which procedures should be reviewed, although in HR-16, the EOPs and AOPs are specifically called out. AS-19 also calls for the accident sequence models to be consistent with the EOPs and AOPs.

There is no discussion of screening for post-initiator HFEs. A qualitative screening is implicit in the process of identification of HFEs if the systematic process followed (HR-9) is such as to identify the impact of not performing correctly procedural directives, and identifying those that have an impact on accident sequence development.

Review Focus for Option 2 submittals:

For pre-initiating event HFEs, the HFEs of concern are: component or system failures resulting from being left in an inoperable state following maintenance or test; and miscalibration of sensors such that a signal is not generated when required resulting in a loss of automatic function, or a failure to provide the operators with information necessary for following EOPs. The reviewer has to have confidence that HFEs of potential significance have not been prematurely screened. If the peer review report does not provide enough detail for the Staff to conclude that an acceptable process has been followed, the focus of the Staff review should be to determine whether the screening rules applied by the licensee (if any) can be defended using simple HRA models (e.g., a simple application of THERP), and whether the application of the rules accurately reflects plant practices. Focus should be on those HFEs that can lead to common cause failures of vital systems or instrumentation.

28

For each post-initiating event HFE, the reviewer should have confidence that the impact of the EOPs and AOPs is correctly included in the event sequences. Therefore, for each HFE, there has to be a clear link to a step or steps in an EOP or AOP. In the absence of peer review documentation, the reviewers should review the process used by the licensee to identify the HFEs, in particular to determine whether a plant-specific review of the EOPs and AOPs was performed, and whether criteria were applied to determine which procedural steps could lead to HFEs that should be included in the model. Failures to perform different procedural directives may only be grouped into the same HFE if they have the same impact. Alternately, if the essential steps of the identification process were specified in the peer review report, and there was confidence that they were used by the peer reviewers, there would be no need for staff review.

b. Quantification of human error probabilities, accounting for plant conditions and performance shaping factors Area of Review:

How are human error probabilities quantified, and how are plant conditions and performance shaping factors accounted for (particularly for post-initiating event HFEs) ?

How this issue is treated in NEI 00-02:

HR-5, HR-6, HR-10 to HR-20, and HR-22 address this issue.

Discussion:

There is no discussion of PSFs or quanitification methods for pre-initiators. HR-6 discusses screening and distinguishes between Grades on the basis of whether screening or best estimate values are used, and to what extent.

The discussion for post-initiator HFEs is more extensive. HR-13 and 15 are, however, two aspects of the same subject; use best estimate values instead of screening values for dominant HFEs. HR-12 requires an internal comparison between HEPs. What the correct relative error probabilities means is not specified, but presumably the relative is with respect to the PSFs etc. The PSFs and/or plant conditions to be considered for post-initiator HFEs are mainly in HR-17, with some discussion in HR-16. In HR-16, the should ought to be a shall, at least for procedures and training. In HR-17, the contributors to the total HEP should also include detection, as well as diagnosis and manipulation (execution). HR-18 through 20 discuss the various time considerations.

Whether, and to what extent these factors are considered will depend on the HRA model used. Some models address many PSFs explicitly; in others, they are addressed implicitly, if at all.

29

Review Focus for Option 2 submittals:

Since the NEI 00-04 process requires that sensitivity studies on HEPs be performed as part of the Option 2 categorization process, the estimated values of the HEPs themselves, assuming they are neither extremely low nor extremely high, are not really that important as long as: a) the process does not eliminate HFEs from the model without valid reasons, b) the relative values of the HEPs for differing scenarios are appropriate for the corresponding PSFs.

If these issues are not addressed in the peer review report, Staff reviewers should address them. To perform this review it will be necessary to identify what HRA quantification model was used, and have an appreciation for its strengths and limitations.

In particular, the reviewer should note which plant conditions and PSFs are explicitly addressed in the model. As a minimum, the model should be able to discriminate between scenarios that represent significantly different challenges to the operators as a result of, for example, time pressure, environmental conditions, the number of manipulations, the clarity of the indications and the procedures, and the degree of training.

c. Integration of HFEs into PRA model and treatment of dependencies Area of Review:

How are HFEs integrated into the PRA model and how are dependencies accounted for?

How this issue is treated in NEI 00-02:

AS-19, DE-7, HR-9, HR-10, HR-21, HR-26 and HR-27 deal with this issue.

Discussion:

HR-9 and HR-10 deal in general terms with identifying post-initiator HFEs to include in the model.

Identifying cutsets or scenarios with multiple HFEs is a prerequisite to the analysis of dependencies among HFEs. HR-27 addresses this but giving a lower bound combined HEP of 1E-06 is probably too low without considerable justification. HR-26 gives no guidance on what factors to address in assessing dependence.

There are no explicit subtier criteria that address the degree of dependence between HFEs that appear in the same accident sequence cutset.

Review Focus for Option 2 submittals:

Reviewers should determine, either from the peer review report, or by questions to the licensee, if the criteria used to determine the degree of dependence between HFEs in the same accident sequence cutset or scenario, are appropriate. Factors that are typically assumed to lead to dependence include: use of common indications and/or cues to alert control room staff to need for action; a common procedural direction that leads to the 30

actions; the same staff member is responsible for detection, diagnosis, or execution; and closeness in time of required responses. Reviewers need to understand the basis for cases in which the degree of dependence is assumed to be low. When the basis is suspect and scenarios are argued away on the basis of multiple HFEs, the sensitivity studies for the Option 2 categorization process would need to be adjusted accordingly.

d. Modeling of recovery actions Area of Review:

How are recovery actions modeled (use of complex recovery rules, treatment of long term recovery actions, etc.)? Recovery actions referred to in this case are those that are not included in the accident sequence models initially, but are included to lower the contribution of specific cutsets or accident scenarios by postulating operator actions to recover one or more of the cutset elements, or to provide an alternate way of meeting their function.

How this issue is treated in NEI 00-02:

AS-16, SY-24, HR-21, HR-23, HR-24, QU-18 and QU-19 deal with this issue.

Discussion:

AS-16 and SY-24 seem to refer to those actions that are included in the basic logic structure as opposed to those that are added on to the solution of the model. However, it seems worth pointing out that the warning in SY-24 to avoid conservative evaluations is less of a concern to the staff than non-conservative evaluations would be, particularly for the purposes of Option 2 classification. The requirement HR-21 is vague, stating only that recovery actions be included in a systematic manner, and is echoed by QU-19. The evaluation of the probability of failure to repair is not normally a function of the HRA task, although the human reliability analyst may provide an assessment of feasibility. HR-23 and QU-18 state that recovery actions should only be included if there is a procedure, or training, or the action can be regarded as skill-of-the-craft. (However, HR-23 as written, with a should, would allow recovery actions that do not meet these criteria to be modeled, whereas QU-18, written with a shall, would not.) These are consistent with NRC staff views.

Review Focus for Option 2 submittals:

Peer review findings for HR-23 and QU-18 should be reviewed to identify the extent to which recovery and/or repair actions have been included in the model. If any repair actions appear to have a significant effect on the results, the reviewer should determine that the appropriate plant and cutset specific conditions have been considered in any feasibility assessment for a repair that has been credited that can impact the results.

Reviewers need to ensure that, if operator conducted recovery actions are included, dependency with the other HFEs in the scenario has been looked at. See item 6c.

31

7. Internal Flooding Analysis Areas of Review:

Since NEI 00-02 does not specifically address the modeling of the internal flooding initiating event, the areas of review will be combined.

• What are the guidelines used to identify and screen flood sources, propagation pathways, and flood scenarios?

• How is the effect of flooding on the operation and availability of mitigating systems, and on operator actions accounted for?

• What assumptions are used in the estimation of initiating event frequencies including those for maintenance induced flooding events?

How this issue is treated in NEI 00-02:

IE-7 deals with the identification and grouping of initiating events and states that internal flood contributors should be quantified for non-screened compartments.

SY-10 deals in general with spatial dependencies within the system model.

DE-10 deals with the spatial challenges from flooding, and states that flood sequences should be defined based on: flood sources; flood initiating event frequency including maintenance induced flooding; propagation pathways; and affected mitigation equipment.

ST-10 provides examples of potential propagation pathways for floods, and states that propagation should take into account flood barrier integrity.

Discussion:

Although internal flooding was brought up as an initiator that should be considered, there are no specifics provided for the unique modeling issues related to this initiator. For example, there is no guidance on the definition of flood zones, the evaluation of flood growth and egress rates, the capability of various equipment to withstand flooding effects, and the accounting of the direct (submergence and loss of inventory to affected systems) and indirect effects of flooding (spraying and splashing). Even for the guidance provided in DE-10 and ST-10, specifics are not available, and grading is dependent on the experience of the reviewer.

Review Focus for Option 2 submittals:

Staff reviewers should look for evidence in the peer review documentation to determine if the review had accounted for: the assumptions and methodology used for the definition of flood scenarios and the estimation of initiating event frequencies; the criteria used for screening of flood areas, flood sources and flood scenarios; the effect of flooding on the operation and availability of mitigating systems, and on operator actions; and the 32

adequacy and scope of the licensee's plant walkdown with respect to the internal flooding initiator. If the peer review report does not contain documentation of the above, the staff should review the licensee's flooding analysis in the areas not covered by the peer review.

For Option 2 applications, the reviewer should also determine how SSCs credited for the mitigation of floods and screening of flood scenarios (e.g., spray shields, sump pumps, and flood alarms), and SSCs credited for preserving independence of flood areas (e.g.,

backflow check valves, drain valves, and flood dikes) are treated by the IDP in the categorization process.

8. Accident Sequence Quantification and Analysis of Results

a. Use of appropriate models and codes Area of Review:

Is model quantification performed with the appropriate models and codes, and are method-specific limitations and features accounted for?

How this issue is treated in NEI 00-02:

QU-4, QU-5 and QU-6 deal with this issue.

Discussion:

Although the stated purpose of the criterion for QU-4 is to verify that the base computer code and its inputs have been tested and demonstrated to produce reasonable results, the sub-tier criteria do not address this criterion, but instead provide some dos and donts for quantification.

QU-5 concerns the use of a pre-solved cutset model in applications, e.g., for calculating basic event importances. QU-6 discuss ways in which method-specific limitations can be accounted for.

Review Focus for Option 2 submittals:

Results from industry PRA quantification models and codes have been reviewed by the staff in the IPEs and in applications submitted over the last 10 to 15 years. The staff is sufficiently confident that existing codes used for the quantification of accident sequences will generate the appropriate results. Therefore, staff reviewers are not expected to have to focus on this issue.

b. Result truncation Area of Review:

Has it been demonstrated by the licensee that the truncation level is appropriate in that the quantified results have converged to a stable value?

33

How this issue is treated in NEI 00-02:

QU-4, QU-5, QU-7, QU-21 to QU-24 deal with this issue.

Discussion:

This area appears to be adequately covered in NEI 00-02.

Review Focus for Option 2 submittals:

The most likely effect of the use of truncated cutset equations is in the calculation of RAW importance rankings. However, the requirement that the change in risk for Option 2 applications be estimated will offset this potential limitation. Therefore, staff reviewers are not expected to have to focus on this issue.

c. Proper use of supercomponents or modules Area of Review:

Are supercomponents or modules utilized appropriately, i.e., do modules contain HFEs, CCFs, and grouping of events with different recovery potential?

How this issue is treated in NEI 00-02:

SY-6 and SY-9 deal with this issue.

Discussion:

This area appears to be adequately covered in NEI 00-02. Also, with the advancement of computer codes and computer hardware, the use of supercomponents and modules is becoming a lot less common.

Review Focus for Option 2 submittals:

Staff reviewers are not expected to have to focus on this issue. Guidance for Option 2 applications already calls for the IDP to determine the importance of SSCs modeled as part of modules or supercomponents.

d. Accounting for dependencies Area of Review:

How are dependencies accounted for, particular for HFEs added after the fact?

How this issue is treated in NEI 00-02:

AS-8, AS-15, QU-9, HR-26, QU-10, QU-16, QU-17 and QU-20 deal with this issue.

34

Discussion:

AS-8, AS-15 and QU-20 deal with dependencies in transferred sequences.

QU-9 and QU-16 deal with common cause failures.

HR-26, HR-27, DE-7, QU-10 and QU-17 deal with the treatment of dependencies in human actions.

Review Focus for Option 2 submittals:

Dependencies are addressed in all areas of the PRA. What is of concern here is those that are specifically introduced during the final quantification process. The major concern is dependency between human failure events. Even though the guidance states that dependence among human actions shall be evaluated, there is no criterion for the review other than the fact that a cap (a lower limit) is provided for multiple HEPs. It is therefore expected that, in Option 2 applications, the licensee or the peer review report will document how these dependencies are taken into account. See also 6d.

e. Uncertainties Area of Review:

How are uncertainties accounted for in the quantified results?

• propagation

• identification of sources of uncertainties and their impact on the results

• results of sensitivity studies How this issue is treated in NEI 00-02:

QU-27 to QU-30 deal with this issue.

Discussion:

QU-27 and QU-28 focus on the unusual sources of uncertainty but it is not clear what an unusual source of uncertainty is. Consideration should be given to all sources of uncertainty that can have a significant impact on the results.

In QU-30, there are three choices in Grade 3, but they are all approximate and will not give an understanding of the impact of uncertainties on specific PRA results. A propagation of parameter uncertainty is not explicitly called for, although it is one of the options in Grade 2.

Review Focus for Option 2 submittals:

In calculating the impact of the change in CDF and LERF for Option 2 applications, as is the case in RG 1.174, it is expected that there is a propagation of parameter uncertainties in the quantified results or that it has been shown that a point estimate is an acceptable approximation of the mean value using qualitative arguments about the risk contributors.

35

For example, if a formal propagation has not been performed, it is necessary for the licensee to demonstrate that the result is not affected by the so-called state of knowledge correlation (specifically, that there are no significant contributing cutsets or scenarios that involve multiple events for which the probabilities are determined using the same parameter, particularly if the parameter value is very uncertain). One example where the state of knowledge correlation may be important in Option 2 applications is the ISLOCA sequences where scenario cutsets could include a combination of multiple check valve failures, each having the same parametric distribution.

In addition to the above, the staff should also determine if the categorization is strongly impacted by the specific models or assumptions adopted for the assessment of important elements of the PRA, and whether the sensitivity analyses that have been performed (if any) are sufficient to address the most significant uncertainties with respect to these elements. Model uncertainties arise when there are several alternative approaches to the analysis of certain elements of the PRA model. They are typically addressed by adopting a specific model or making a specific assumption. Those model uncertainties that can significantly affect the PRA results used in the categorization, and the estimate of CDF and LERF, should have been identified for possible sensitivity analyses to demonstrate the robustness of the conclusions. In assessing whether reasonable alternatives were used in the sensitivity analyses, reviewers should consider whether the alternatives have some precedent and whether they have a reasonable engineering basis. (See also 3b)

f. Review and understanding of the results Area of Review:

Are results consistent with plant design and procedures ?

Are key contributors to CDF/LERF identified ? (in terms of initiating events, accident sequences, equipment failures, and human errors)

Is the impact of the key assumptions understood ?

Are model asymmetries understood ?

How this issue is treated in NEI 00-02:

QU-8, QU-11 to QU-15, QU-28, QU-31 deal with this issue.

Discussion:

This area would be adequately covered in NEI 00-02 if the shoulds in Grade 2 were replaced by shalls as in Grade 3.

Review Focus for Option 2 submittals:

Staff reviewers are not expected to have to perform an independent review if the peer review report documents its review of the overall results. However, a limited, focused review of one or two sequences would help give confidence to the Staff reviewer that the model was producing acceptable results. Furthermore, a general understanding of the dominant contributors and the dominant sequences is essential for performing a sanity check on the results of the application, in particular in developing an understanding of 36

why SSCs are or are not safety significant in the Option 2 process.

9. Level 2 Analysis

a. Use of verified, validated codes Area of Review:

What are the codes and/or models used in the Level 2 analysis?

1. validated and verified to sufficient detail

2. applicable in the pressure, temperature and environmental conditions of interest How this issue is treated in NEI 00-02:

The issue is not called out in NEI 00-02.

Discussion:

When plant-specific analyses are used, there shall be explicit consideration as to whether the models and codes used are capable of providing the correct results.

Review Focus for Option 2 submittals:

Because the focus in Option 2 applications is on LERF, and on a general understanding of the role of containment systems in preventing containment failure, a review of much of the Level 2 analysis is not required.

b. Criteria for grouping core damage scenarios into plant damage states Area of Review:

What are the criteria used to group core damage sequences into plant damage states?

How this issue is treated in NEI 00-02:

AS-14, AS-21 and L2-7 deal with this issue.

Discussion:

AS-14 and AS-21 state that LERF should be able to be determined from the Level 1 end states, but no criteria are given for the grouping into PDSs, i.e., there are no criteria provided as to what information has to be transferred from the Level 1 to the Level 2 analysis. L2-7 states the transfer from level 1 to level 2 should be done to maximize the transfer of relevant information, but again no criteria are given.

Review Focus for Option 2 submittals:

Reviewers should look at the criteria used by the PRA to group level 1 scenarios into PDSs, and check to see if the factors such as the ones listed below have been taken into 37

account. As a starting point, staff reviewers should determine if the peer review has considered these factors.

The physical characteristics of Level 1 end states that can influence LERF include: RCS pressure at core damage; status of the coolant inventory; status of containment isolation; and the status of containment heat removal. The accident sequence characteristics that lead to these physical characteristics include: type of initiator (e.g., transients can result in high RCS pressure, LOCAs usually result in lower RCS pressure, ISLOCAs, SGTRs can result in containment bypass); status of electric power; and status of containment systems such as sprays, fan coolers, igniters, or venting systems.

c. Assessment of credible severe accident phenomena Area of review The containment event tree should reflect those phenomena that are generally considered to be credible, and that may be influential in determining severe accident progression.

How is this issue treated in NEI-00-02?

L2-8 through L2-10 and L2-17 address this issue.

Discussion L2-8 provides a very comprehensive list of issues, however, no guidance is given on how to prioritize them.

L2-9 and L2-10 do not provide new guidance and rely solely on the expertise of the reviewer The criteria in L2-17 state that geometric details impacting hydrogen related phenomena should be documented for BWR Mark III and PWR ice condenser containments, and provide guidance as to how these geometric details are to be used in the treatment of hydrogen phenomena. It would be desirable to also provide some guidance on the treatment of hydrogen phenomena in other containment types, for instance on the issue of local hydrogen build-up in large dry containments.

Review focus for Option 2 submittals Because the focus is on LERF and on those systems that can impact long term containment integrity, no review is anticipated in this area for Option 2 applications.

d. Assessment of containment system performance Area of review What is the framework for the evaluation of containment performance (CET or equivalent)?

38

How is this issue treated in NEI-00-02?

This issue is addressed in L2-4, L2-11, L2-13, L2-23 to L2-25.

Discussion L2-11 focuses on the impact of containment conditions on system performance, while L2-13 states that containment system functional failures should be treated realistically. L2-4 addresses success criteria. L2-24and L2-25 address the containment event tree. L-24 requires all the phenomena (presumably those in L2-8 and L2-9) to be included in the CETs for Grade 3. The requirement of L2-24 seems to be an overkill - there should be an allowance for prioritization of the issues for inclusion in the CETs.

Review focus for Option 2 submittals The CETs (or equivalent) should be reviewed to determine if their structure, and the issues they address are typical of good industry practice. Review the accident progression timing, including timing of containment failure. Issues related to timing are significant from the point of view of identifying LERF contributors, but also for determining the effectiveness of mitigative features, such as the use of SAMAs. Focus should be on the potential containment bypass events.

e. Establishment of the capacity of the containment to withstand severe accident environments Area of review Is the containment sufficiently robust to withstand severe accident environments?

How is this issue treated in NEI-00-02?

ST-5 and ST-6 address this issue; ST-5 identifies challenges that should be addressed, and ST-6 discusses failure modes. L2-14 through L2-20 address a variety of issues related to challenges and failure modes.

Discussion Both the mode of containment failure and the capacity of the containment in each mode are necessary input to the logic and quantification of the CET. There is little guidance on what the possible failure modes are, though some potential mechanisms are listed in ST-5 (overpressure, dynamic loading, etc.).

The guidance in NEI-00-02 would be very difficult to follow. Therefore, a thorough peer review can only be performed by a true level2 expert.

Review focus for Option 2 submittals There is expected to be no focus in this area for Option 2 applications.

39

40