ML050390356

Probabilistic Risk Assessment (PRA) Capability Assessment Application Using Regulatory Guide 1.200 in Support of Pilot Implementation of 10 CFR 50.69

ML050390356
Person / Time
Site:	Surry
Issue date:	01/28/2005
From:	Hartz L Virginia Electric & Power Co (VEPCO)
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
05-028, RG-1.200
Download: ML050390356 (26)

Text

VIRGINIA ELECTRIC AND POWER COMPANY RICiiMOrND, VIRGINIA 23261 January 28, 2005 10 CFR 50.69 U.S. Nuclear Regulatory Commission Serial No.05-028 Attention: Document Control Desk NLOS/GDM Ri Washington, D.C. 20555

, Docket Nos. 50-280, 281 License Nos. DPR-32, 37 VIRGINIA ELECTRIC AND POWER COMPANY (DOMINION)

SURRY POWER STATION UNITS I AND 2 PROBABILISTIC RISK ASSESSMENT (PRA) CAPABILITY ASSESSMENT APPLICATION USING REGULATORY GUIDE 1.200 IN SUPPORT OF PILOT IMPLEMENATION OF 10 CFR 50.69 In a letter dated November 15, 2004 (Serial No. 04-006A), Dominion reconfirmed its intent to submit a license amendment request to implement 10 CFR 50.69, "Risk-Informed categorization and treatment of structures, systems, and components for nuclear power reactors," for Surry Power Station Units 1 and 2. The proposed license amendment will request a new license condition that permits reclassification of safety-related and nonsafety-related structures, systems, and components (SSCs) on a system basis, according to the risk-informed safety categories (RISC) defined in 10 CFR 50.69. The proposed license condition will also allow relaxation of certain special treatment requirements in accordance with the guidance defined in the rule.

Because 10 CFR 50.69 is a new, voluntary rule, Surry Unit 1 is participating as a pilot plant for testing the categorization process in conjunction with the Westinghouse Owners' Group (WOG) and the Nuclear Energy Institute (NEI). The pilot program will implement the 10 CFR 50.69 categorization process for the charging portion of the Chemical Volume and Control System at Surry Power Station. The categorization process will follow the methodology of NEI 00-04, "10 CFR 50.69 SSC Categorization Guideline," for active SSC functions, and ASME Code Case N-660, "Risk-informed Safety Classification for Use in Risk-Informed Repair/Replacement Activities, Section Xl, Division 1," for passive SSC functions. Previous revisions of this industry guidance have been reviewed and endorsed by the NRC in Revision 0 of Regulatory Guide (RG) 1.201, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to Their Safety Significance." It is Dominion's understanding, based on the NRC public meeting on this subject held at NRC Headquarters on December 14, 2004, that the NRC intends to issue a revised version of RG 1.201 that endorses, with clarifications as appropriate, the revised industry guidance that has been followed in the categorization process for Surry.

Serial No.05-028 Docket Nos. 50-280, 281 Page 2 of 3 In support of the ongoing pilot program test of the 10 CFR 50.69 categorization process, Dominion has also volunteered the Surry Power Station Probabilistic Risk Assessment (PRA) for a test of NRC's process in assessing the scope and technical adequacy of the PRA used in the SSC categorization portion of the pilot implementation.

The PRA assessment has been conducted following guidance in NRC Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-informed Activities."

In the letter referenced above, Dominion committed to submit information to the NRC supporting Surry PRA quality by January 31, 2005, in advance of the NRC pilot program inspection. Consequently, an assessment of the adequacy and technical capability of the Surry PRA to support our planned 10 CFR 50.69 application is provided in the attachment. Reference to PRA sensitivity analyses that are planned in support of the 10 CFR 50.69 application is made in the assessment. It should be noted that the final set of PRA sensitivity analyses to be performed has not yet been established because we plan to use feedback from the NRC's RG 1.200 pilot inspection of the Surry PRA (currently scheduled for the week of February 28, 2005) as an additional input to that process.

We believe the PRA capability assessment included in the attachment confirms that the Surry Power Station PRA is technically adequate and sufficient to: 1) provide confidence that the PRA results can be used in support of regulatory decision-making within a risk-informed process, and 2) support Dominion's 10 CFR 50.69 pilot plant application.

If you have any questions or require further information, please contact Mr. Gary D.

Miller at (804) 273-2771.

Very truly yours, L. N. Hartz Vice President - Nuclear Engineering Attachment Commitments included in this correspondence: None

Serial No.05-028 Docket Nos. 50-280, 281 Page 3 of 3 cc:

U. S. Nuclear Regulatory Commission Region II Sam Nunn Atlanta Federal Center Suite 23T85 61 Forsyth Street, S. W.

Atlanta, Georgia 30303-8931 Mr. S. R. Monarque U. S. Nuclear Regulatory Commission One White Flint North 11555 Rockville Pike Mail Stop 8H12 Rockville, MD 20852 Mr. N. P. Garrett NRC Senior Resident Inspector Surry Power Station Mr. T. Pietrangelo Nuclear Energy Institute 1776 I Street NW Suite 400 Washington, D. C. 20006-3708

Serial No.05-028 Docket Nos. 50-280, 281 ATTACHMENT SURRY POWER STATION UNIT 1 REGULATORY GUIDE 1.200 PRA ADEQUACY EVALUATION

• Contents Introduction........................................................

1 Regulatory Guide 1.200 Submittal and Supportina Documentation............................................. 1 RG 1.200 Submittal Contents........................................................

1 Surry PRA Archival Documentation.........................................................................................2 SPS PRA Model Overview........................................................

3 Identification of Parts of the PRA Used to Support 10 CFR 50.69 Categorization....................... 4 ADproach to Demonstration of SPS PRA Model Technical Adequacy.........................................4 SPS PRA Submittal Assessment.........................................................

6 Plant Changes That Have Not Been Incorporated Into the PRA Model................................... 6 Resolution of PRA Peer Review Comments........................................................

9 Documentation of Consistency with the PRA Standard (Gap Analysis)................................. 12 Identification of Key PRA Assumptions and Approximations................................................. 17 Results of Available Sensitivity Studies.......................................................

23 PRA Quality Assessment Conclusions........................................................

24 Referenceb........................................................

25

Serial No.05-028 Docket Nos. 50-280, 281 Attachment I SURRY PRA REGULATORY GUIDE 1.200 PRA ADEQUACY EVALUATION Introduction An assessment of the Surry Power Station (SPS) Probabilistic Risk Assessment (PRA) model technical capability has been performed in accordance with the requirements of Regulatory Guide 1.200, Section 4.2 (Ref. 1) and is summarized in this attachment.

The following items are included:

• An overview of the SPS PRA model,

• An overview of the key review processes, and

• An initial evaluation of the technical adequacy of the SPS PRA model for use in support of risk-informed categorization of structure, systems, and components (SSCs) under 10 CFR 50.69 (Ref. 2).

Although the Surry PRA addresses the effects of external events and operation at low power and shutdown conditions, the scope of the PRA covered by this assessment is the at-power model for internal initiating events (including internal flooding). Unless otherwise noted, reference to the SPS PRA in the remainder of this document is to the internal events at-power model. Assessment of the technical adequacy of the other parts of the SPS PRA will be performed and documented separately, and provided to the NRC as appropriate, in support of the 10 CFR 50.69 categorization process pilot.

Reaulatory Guide 1.200 Submittal and SuDportina Documentation RG 1.200 Submittal Contents In accordance with Regulatory Position C.4.2 of Regulatory Guide 1.200, the information described below is being provided to demonstrate that the parts of the SPS PRA are of sufficient quality to support the analyses used in the SPS 10 CFR 50.69 application.

Table 1 RG 1.200 Submittal Requirement LocatIon In This Submittal Identification of permanent plant changes (such as design or Section titled: Permanent operational practices) that have an impact on those things Plant Changes That Have Not modeled in the PRA but have not been incorporated in the Been Incorporated Into the PRA model.

PRA Model Documentation that the parts of the PRA required to produce Section titled: Documentation the results used in the decision are performed consistently of Consistency with the PRA with the standard as endorsed in the appendices of this Standard (Gap Analysis) regulatory guide.

Identification of the key assumptions and approximations Section titled: Identification of relevant to the results used in the decision-making process.

Key PRA Assumptions and Approximations Page 1 of 25 I

Serial No.05-028 Docket Nos. 50-280, 281 Table 1 RG 1.200 Submittal Requirement Location In This Submittal A discussion of the resolution of the peer review comments Section titled: Resolution of that are applicable to the parts of the PRA required for the PRA Peer Review Comments application.

Surry PRA Archival Documentation In accordance with Regulatory Position C.4.1 of RG 1.200, SPS has retained supporting (archival) documentation relevant to the PRA and its use in this application.

The archival documentation is not provided in this submittal but has been collected in a form that may be reviewed by the NRC at their convenience.

The archival documentation includes a description of the process used to determine the adequacy of the PRA.

The documentation maintained is legible, retrievable (i.e.,

traceable), and of sufficient detail for the staff review of the bases supporting the results used in the application.

The archival documentation associated with the assessment of PRA capability for this specific application includes enough information to demonstrate that the scope of the PRA is sufficient with respect to:

. The plant design, configuration, and operational practices,

. The acceptance guidelines and method of coniparison,

. The scope of the risk assessment in terms of initiating events and operating modes

modeled,

. The parts of the PRA required to provide the results needed to support comparison with the acceptance guidelines, and

• The description of the process for maintenance, update, and control of the PRA.

A full discussion of the PRA technical elements listed below is provided in the archival documentation for the PRA.

Level 1 PRA Technical Elements -

• Initiating event analysis

. Success criteria analysis

. Accident sequence analysis

. Systems analysis

• Parameter estimation (data) analysis

• Human reliability analysis

• Quantification and Interpretation of results Page 2 of 25

Serial No.05-028 Docket Nos. 50-280, 281 Level 2 PRA Technical Elements -

. Plant damage state analysis

• Accident progression analysis

• Quantification and Interpretation of results The following archival documentation will be available to the NRC staff in order to facilitate review of this risk-informed pilot application.

• Initiating Events Analysis Notebook and supporting calculations

. Accident Sequence Analysis Notebook including Event Trees, Success Criteria and supporting calculations

• A Systems Analysis Notebook for each system modeled in the PRA

• Data Analysis Notebooks and supporting calculations

• Human Reliability Analysis Notebooks

• Large Early Release Frequency (LERF) Analysis Notebook and supporting calculations

• Level 2 Model descriptions and supporting calculations (per the Individual Plant Examination)

• Results and Quantification Notebook including Importance Reports

• PRA Self-Assessment (Gap Analysis) Technical Report

• Assessment of Key Assumptions and Areas of Uncertainty

• Description of the process for maintenance, update, and control of the PRA The archival information also includes the SPS Individual Plant Examination (IPE), the SPS PRA Peer Review report, the SPS Individual Plant Examination for External Events (IPEEE) (the scope of which is relevant to the 10 CFR 50.69 application but not directly covered by RG1.200 at this time), and supporting information such as piping and instrumentation diagrams, electrical one-lines, logic diagrams, plant procedures, etc.

SPS PRA Model Overview The PRA model addressed in this assessment is the 2003 update to the SPS PRA model (designated S03A, and released in April 2004), which is the most recent evaluation of the risk profile at SPS for internal events at power. There have been a series of probabilistic evaluations beginning with the original SPS PRA, followed by the IPE in August 1991, as requested by the NRC in Generic Letter 88-20 (Ref. 3), and subsequent updates to that model. An historical summary of core damage frequency (CDF) and LERF results for SPS PRA model revisions is provided in the archival documentation for the PRA.

The SPS PRA is a highly detailed model that addresses a full spectrum of initiating events, modeled systems, operator actions, and common cause events.

The PRA Page 3 of 25

Serial No.05-028 Docket Nos. 50-280, 281 model quantification process used for the SPS PRA is based on the fault tree linking methodology using the WinNUPRA software package, which Is widely used in industry and has undergone an appropriate quality assurance process.

This model allows modeling of individual accident sequences using functional event tree representation, mapping of the functional event sequences to detailed fault tree logic, and solution and mathematical combination of the sequence cutsets to obtain integrated risk results. A Safety Monitor (risk monitor) top event fault tree model of the Surry PRA model is also maintained and used for plant configuration risk management and related purposes.

The risk metrics quantified in the PRA are CDF and LERF. The PRA is maintained and updated under a PRA configuration control program in accordance with Dominion procedures.

Plant changes, including physical and procedural modifications and changes in performance data, are reviewed and the PRA is updated to reflect such changes on a regular schedule by qualified personnel with independent review and approval.

Identification of Parts of the PRA Used to Support 10 CFR 50.69 Categlorization The 10 CFR 50.69 categorization process is described in NEI-00-04, "10 CFR 50.69 SSC Categorization Guideline" (Ref. 4) and relies on the PRA for determination of risk significance of functions and associated components for the individual systems being categorized. Thus, the technical capability of the PRA models for the systems being categorized is an important consideration.

However, since the process for categorization relies on the PRA prediction of relative risk significance for modeled components, the technical capability of most other elements of the PRA is also important to ensure that the risk importances of the components of interest are not substantially under-or over-stated due to limitations elsewhere in the PRA models.

Thus, all technical elements of the SPS PRA are relevant to the 10 CFR 50.69 pilot effort. Note that some SSCs are explicitly modeled in the PRA (e.g., charging pumps),

while others are implicitly modeled (e.g., piping). The 10 CFR 50.69 categorization process includes methods to address both explicitly and implicitly modeled SSCs. A listing of components explicitly modeled in the PRA is available in the archival documentation.

ADDroach to Demonstration of SPS PRA Model Technical Adeguac' PRA model technical adequacy is established through multiple processes. The primary mechanism for achieving technical adequacy of the SPS PRA is the application of Dominion procedures and practices for ensuring that the models are technically correct and have been developed using inputs and assumptions that reflect the plant as it is currently configured and operated.

Dominion PRA program procedures and practices include:

Formal guidance for performing, maintaining, and applying plant PRAs (e.g., Dominion Nuclear Analysis & Fuel (NAF) PRA Manual, which defines technical approaches and standards to be followed for the PRA, addresses PRA configuration control and use of Page 4 of 25

Serial No.05-028 Docket Nos. 50-280, 281 Attachment I the PRA for plant configuration risk evaluations, and addresses products that are supported by the PRA; and NAF Implementing Procedures for preparation, review, and approval of calculations and for document control)

• Scheduled PRA updates to address plant changes, incorporate new consensus models, correct identified errors

• Additional updates if necessary to address changes to the plant that may have a significant impact on model results

• Formal processes and requirements for qualification of personnel performing, reviewing, and approving PRA analyses

• Routine formal and informal interaction between PRA personnel and plant operations, licensing, engineering and other personnel who rely on PRA information in their activities

• Active participation by PRA personnel in various industry risk forums, through which knowledge is maintained regarding PRA technical issues, industry experience and best practices, and PRA standards, including:

Nuclear Energy Institute Task Forces engaged in developing methods and guidance for performing risk-informed applications (e.g., NEI Option 2 Task Force, NEI Risk Applications Task Force),

Electric Power Research Institute risk working groups (e.g., PRA Scope and Quality Working Group; Configuration Risk Management Forum),

Westinghouse Owners Group Risk Management Subcommittee, PRA Software Vendor User Groups (e.g., Safety Monitor Users Group, Risk &

Reliability Workstation User Group), and ASME and ANS PRA Consensus Standards development committees.

Another important mechanism for achieving PRA technical adequacy is the performance of formal reviews of the PRA against established criteria and standards. The SPS internal events PRA received a formal industry PRA peer review through the Westinghouse Owners Group PRA peer review program in July 1998. The purpose of the PRA peer review process is to provide a method for establishing the technical quality of a PRA for the spectrum of potential risk-informed plant licensing applications for which the PRA may be used. The PRA peer review process is described in Ref. 6. It has been endorsed by the NRC in Ref. 1, with certain qualifications and clarifications, as an acceptable input to the assessment of PRA capability relative to the requirements in, Ref. 5. Results of the SPS PRA Peer Review are discussed in additional detail in a later section.

In addition to the peer review, a "gap analysis" has been performed for the SPS PRA in accordance with Appendix B of RG 1.200 to establish the technical adequacy of the PRA for risk-informed initiatives by determining the extent to which the PRA meets Capability Category II of the ASME PRA Standard for all ASME supporting requirements.

It is assumed that meeting the ASME supporting requirements (at Capability Category II for those supporting requirements for which Capability Category Page 5 of 25

I Serial No.05-028 Docket Nos. 50-280, 281 distinctions are made) is inherently sufficient to meet adequacy requirements for most risk-informed applications including risk-informed SSC categorization under 10 CFR 50.69. Results of the gap analysis are discussed in additional detail in a later section. For the limited set of PRA attributes for which the gap analysis of the SPS PRA has identified supporting requirements as either not met or met at less than Capability Category II, PRA technical adequacy for the application may still be sufficient given that the basis of the reduced Capability Category determination can be shown to have little or no impact on the calculated results and the decision-making supporting the application. The impact assessment is addressed by one or more of the following techniques: 1) model change so that the supporting requirement is met at an appropriate level; 2) sensitivity calculations to demonstrate that the gap in PRA capability is not important to the application; or 3) bounding risk-informed arguments.

SPS PRA Submittal Assessment Consistent with the requirements of Regulatory Guide 1.200, Section 4.2, the technical adequacy of the SPS PRA model used as the basis for risk-informed applications is established by the following:

• Identification of permanent plant changes that affect the PRA but are not yet incorporated into the PRA model, and consideration of their impacts,

• A discussion of the resolution of the PRA peer review comments that are applicable to the parts of the PRA required for the application,

• Documentation of the consistency of the PRA with the ASME PRA Standard as identified in the Gap Analysis, and

• Identification of key assumptions and approximations.

In addition to the Regulatory Guide 1.200 information summary, a summary of the sensitivity study evaluations currently planned in support of assessing the technical adequacy of the Surry PRA to support the risk-informed categorization for 10 CFR 50.69 is also provided.

Pernanent Plant Changes That Have Not Been Incorporated Into The PRA Model The SPS PRA model and documentation are updated at a frequency of once per every other refueling outage in accordance with Dominion Nuclear Analysis & Fuel PRA Manual Part Ill Chapter A. Plant changes are identified through a number of processes, including review of proposed Design Change Packages (DCPs) and plant procedures.

If changes are identified that involve SSCs modeled in the PRA, and that have the potential to affect PRA results, they are noted and tracked in a PRA Configuration Database of open items not yet addressed in the model.

The PRA Configuration Database also includes such items as suggested plant-specific and generic PRA modeling improvements and identified model errors. This database was reviewed as part of the SPS S03A PRA model update to determine the plant changes judged to impact this application, and again after the update in support of this RG 1.200 assessment.

Page 6 of 25

Serial No.05-028 Docket Nos. 50-280, 281 Attachment I The most recent model update (SO3A) included the following enhancements:

• Revised reactor coolant pump (RCP) seal LOCA model to be consistent with the WOG 2000 RCP seal LOCA methodology Updated station blackout (SBO) accident sequence analysis to allow consideration of auxiliary feedwater available beyond 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />

• Credited station batteries in an SBO where appropriate

• Upgraded the common cause fault model for the following fault trees:

both units' bearing cooling emergency diesel generators (EDG) both units' emergency power-H and J trains both units' electrical power both units' instrument air reactor protection both units' service air seal injection (from opposite unit charging) both units' circulating water Revised fault trees, event trees and quantification files to support modeling of the need to restart normally running components after a Loss Of Offsite Power (LOOP)

• Replaced the 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> EDG mission time with a general mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> corrected as necessary for actual sequence-specific mission times for SBO sequences

• Updated human error probabilities (HEPs)

Removed credit for the possibility that the Number 3 (swing) EDG could automatically align to Unit 1 in a dual-unit LOOP based on plant modification

• Updated plant damage state (PDS) assignments for all event tree sequences; new PDS assignments include updated conditional probabilities of LERF Corrected models by deleting emergency switchgear room (ESGR) HVAC chiller dependency from all event trees except Large Loss of Cooling Accident (LOCA), Medium LOCA, Small LOCA, RCP Seal LOCA, and Loss of Circulating Water

• Modeled dependency between Human Actions using a new rule-based recovery file

• Revised steam generator isolation logic to reflect that both MOVs in the line to each S/G must close

• Implemented a revised Interfacing System LOCA (ISLOCA) model Because the model has recently been updated, relatively few plant changes have not been previously addressed for the current model. Table 2 lists plant design changes Page 7 of 25

Serial No.05-028 Docket Nos. 50-280, 281 (DCPs) that have been implemented at the plant and may have a PRA model impact but have not yet been implemented in the model.

The most notable plant modification relative to its PRA impact that is not addressed in the S03A model is a recent change (per DCP 03-089) to reduce the likelihood of occurrence of the internal flooding scenario that dominates the S03A results. Although this change, which is being incorporated into an update of the SPS PRA model, has a significant impact on overall CDF results, it is not expected to have an un-addressed impact on the 10 CFR 50.69 categorization results.

This is because when the categorization was performed in accordance with the NEI-00-04 guidance, internal flooding was treated as a separate initiator (similar to internal fire), rather than as part of the PRA, to specifically prevent the dominant internal flooding sequence in the S03A model from artificially skewing the component importance results. The impact of this change will be investigated by a 10 CFR 50.69 sensitivity study prior to submittal of the 10 CFR 50.69 license amendment request.

For the other items summarized in Table 2, the impact evaluation indicates that the items not currently modeled either do not affect the PRA or would not alter the results of plant applications that rely on PRA results. For one of these changes, further evaluation and/or sensitivity studies are planned In support of the 10 CFR 50.69 categorization process. In addition, certain PRA Configuration Database items will be reviewed for possible impact on the 10 CFR 50.69 application, as discussed in the section on Sensitivity Studies below.

Table 2 Summary Evaluation Of Impact On The Surry PRA Model Due To Implemented Plant Changes Since The Last Update DCP or Plant Change or Issue Impact on the SPS PRA Configuration Database ID DCP 04-002 Install check valves Low probability diversion pathway downstream of auxiliary scenario, not expected to have a feed-water discharge MOVs.

significant impact on results. (This change has been completed for Unit 1 and is pending for Unit 2.)

DCP 03-089 Plant change to implement Significant reduction in CDF/LERF flooding risk reduction contribution from this scenario, and measures to address significant overall reduction in CDF/

dominant Turbine Building LERF from internal events at power.

internal flooding scenario.

DCPs01-025, -026, Add main station battery Potential risk reduction via ability to 99-086,99-096 125V DC bus cross-tie circuit cross-tie on failure of a battery.

breakers.

Investigate via sensitivity study for 10 CFR 50.69.

Page 8 of 25

Serial No.05-028 Docket Nos. 50-280, 281 Attachment I Resolution of PRA Peer Review Comments A total of 72 Fact & Observations (F&Os) were identified during the PRA peer review for SPS. The following is a summary of the number of F&Os at each significance level:

Significance Level 1 Number of F&Os A

0 B

23 C

31 D

13 S

5 The PRA peer review observations, for which a recommendation was provided by the peer reviewers, were assigned tracking entries in the PRA Configuration Database.

Priority has been given to addressing those observations that the reviewers assigned a significance level of A or B, consistent with the definitions of the significance levels as used in the peer reviews.

Resolutions2 for 20 of the 23 Surry B-level F&Os have been developed, and the resolutions are discussed in archival documentation supporting this assessment. A summary of the remaining B-level observations and a discussion of their possible impact on the PRA applications is provided in Table 3. In addition to the F&Os noted in Table 3, there was one B-significance F&O (TH-02) in which the reviewers noted that, although HVAC dependencies appear to be adequately modeled, additional documentation should be developed for the bases for not modeling HVAC for systems 1 The following table defines the levels of significance used by the SPS PRA peer reviewers for the facts and observations from the review.

Significance Level Definition A.

Extremely important and necessary to address to assure the technical adequacy of the PSA or the quality of the PSA or the quality of the PSA update process.

(Contingent Item for Certification.)

B.

Important and necessary to address but may be deferred until the next PSA update (Contingent Item for Certification.)

C.

Recommended, and considered desirable to maintain maximum flexibility in PSA Applications and consistency in the Industry, but not likely to significantly affect results or conclusions.

D.

Editorial or Minor Technical Item, left to the discretion of the host utility.

S.

Superior treatment, exceeding requirements for anticipated applications and exceeding what would be found in most PSAs.

2 Consistent with RG 1.200, resolutions of peer review observations may take the form of a discussion of how the PRA model has been changed, or a justification in the form of a sensitivity study that demonstrates the significant accident sequences or contributors were not impacted (remained the same) by the particular issue.

Page 9 of 25

Serial No.05-028 Docket Nos. 50-280, 281 in which it has been determined not to be needed. This observation was evaluated, and it was determined that HVAC dependencies have been appropriately modeled; therefore, there is no PRA technical capability impact.

Table 3 Summary Of Surry PRA Peer Review B-Significance Observations Not Yet Resolved F&O #

Summary of Issue Potential Impact on the SPS PRA IE-09 and The core power has been The issue deals with a 4.3% power uprate MU-02 (the upgraded since the PRA performed after the PRA success criteria same issue success criteria analyses were were developed. The set of analyses was performed. Effects of this performed in support of PRA success criteria discussed in change have not been explicitly is relatively small, and the results of these two separate incorporated into the PSA analyses were generally interpreted observations) model. At the next upgrade, conservatively. Thus, it has been judged evaluate the effects of the core that no PRA success criteria would change upgrade and incorporate into based on a small power uprate. There is the model.

also a potential for a small impact on calculated UETs 3 for the PRA Anticipated Transient Without Scram (ATWS) model, but ATWS is not a major core damage contributor so any PRA impact is not expected to be significant. Implementation of the WOG ATWS model is planned for a future PRA update after NRC approval of that model, at which time the current core parameters will be reflected in the model.

This issue will be evaluated for the 10 CFR 50.69 application.

3 UET denotes "unfavorable exposure time", as defined in WCAP-15831, Revision 1, VWOG Risk-Informed ATWS Assessment and Licensing Implementation Process", September 2004.

Page 10 of 25

Serial No.05-028 Docket Nos. 50-280, 281 Table 3 Summary Of Surry PRA Peer Review B-Significance Observations Not Yet Resolved F&O #

Summary of Issue Potential Impact on the SPS PRA L2-02 The consequences of operator The SPS PRA Level I model accounts for actions after core damage are actions called for in the EOPs to prevent not considered in the PSA or core damage. As is typical of the modeling LERF assessment. After core found in most PRAs for PWR plants, human damage has occurred, the failure events related to SAMG actions control room staff will continue following core damage are not included in to attempt to implement EOP the model. Although we recognize that and SAMG actions. Include SAMG actions may affect (positively or appropriate consideration of negatively) consequences relative to source-EOP and SAMG actions in the term releases to the atmosphere, there is PSA Level 2/ LERF models.

significant uncertainty associated with modeling of such actions. In the absence of a consensus modeling approach, we have elected not to model these actions at this time. This issue will be treated as a recognized source of uncertainty in the LER F m odel.

Approximately two-thirds of the C-level F&Os have also been resolved in the recent model updates. However, resolutions for all of these have not been drafted at this time. The remaining F&Os have been retained in the PRA Configuration Database, along with other items identified outside the peer review, for evaluation during future model updates for incorporation into the model.

The Surry PRA was the pilot for the WOG peer review program. Several enhancements to the WOG process were made as a result of the Surry pilot, but the review criteria were not significantly changed. However, to account for the possibility that the WOG peer review teams may have applied the criteria more stringently following the pilot review, or may have simply identified additional relevant issues, the peer review results for the North Anna Power Station (NAPS) PRA, conducted near the end of the WOG peer review program, have also been reviewed for applicability to the Surry PRA. Since the SPS and NAPS PRA methodology, models, and plant designs are similar, it was judged to be prudent to consider the NAPS peer review observations for applicability to Surry as well.

This additional assessment has been performed as part of the planning for the latest updates to the Surry PRA, and also as part of the comparison against the requirements in the ASME PRA Standard (Ref. 5) using the self-assessment process defined in Appendix B of NRC Regulatory Guide 1.200. The A-significance observations from the NAPS PRA peer review have been addressed for the Surry PRA.

Discussion of the remaining NAPS B-significance observations is included in the results of the Surry PRA Page 11 of 25

Serial No.05-028 Docket Nos. 50-280, 281 self-assessment, which Is summarized in the next section of this submittal and available for NRC review as part of the archival documentation.

Documentation of Consistency with the PRA Standard (Gap Analysis)

As part of this assessment of-,technical adequacy of the SPS PRA, a self-assessment was performed.

(This self-assessment is sometimes also referred to as a "gap analysis", since the intent is to identify attributes of a PRA that do not meet the Capability Category II supporting requirements defined in the ASME PRA Standard, Ref. 5.) This assessment was done using the criteria presented in Appendix B of Regulatory Guide 1.200 (Ref. 1). In particular, focus was on the criteria in Table B-4 of RG 1.200 and the PRA capability criteria and requirements in the Industry PRA Peer Review Guidance (Ref. 6) and the ASME PRA Standard (Ref. 5) to which Table B-4 refers.

In doing so, consideration has been given to the additional guidance and regulatory positions stated in Tables B-1, B-2, and B-3 of Ref. 1.

The SPS PRA self-assessment has been documented in a technical report that is included with the archival documentation available for NRC inspection. In performing the self-assessment, it was determined that the, human reliability analysis (HRA) methodology used in the SPS PRA had changed significantly enough since the original SPS PRA peer review that a new, focused peer review of the HRA should be performed.

The results of that focused HRA peer review are documented in a consultant report that is also available for NRC inspection as part of the archival documentation. The updated HRA peer review results have also been factored into the SPS PRA self-assessment.

Table 4 summarizes the PRA supporting requirements (SR) from Ref. 5 that were determined through the self-assessment to either not be met, or not met at the level of Capability Category II for those SRs for which differentiation is made across capability categories in Ref. 5. For each of these, or in some cases for each group of related SRs, a brief discussion is provided regarding the possible impact on PRA results. Where a possible impact on the 10 CFR 50.69 application has been identified, this is noted as well.

Page 12 of 25

Serial No.05-028 Docket Nos. 50-280, 281 Attachment I Table 4 Summary of ASME PRA Standard Supporting Requirements (SR) Not Met SR Summary of Requirement and PRA Possible PRA Impact Assessment QU-D2 and related QU-E2, QU-E4, and QU-F3; LE-F2 and related LE-G7 and LE-G8 These are collectively the set of SR that deal with identification and evaluation of key assumptions and key sources of uncertainty in the CDF and LERF models.

• Identify modeling assumptions that drive the CDF results and evaluate validity of important assumptions over the entire range of conditions that might be addressed with the PRA.

. Evaluate sensitivity of results to key assumptions and uncertainties. Provide uncertainty analyses (Category II) /

uncertainty assessment (Category I) for LERF.

. Document key assumptions and causes of uncertainty for CDF and LERF and identify limitations that would affect applications.

The SPS PRA does not meet these SR.

While the analysts using the PRA are aware of important CDF and LERF modeling assumptions and PRA limitations, and sensitivity analyses are routinely performed as part of each PRA model update, a formal assessment of key assumptions and key uncertainties and their impacts has not been documented.

Although evaluation of sensitivity to sources of uncertainty was performed for the Level 2 analysis in the SPS IPE, and many of the conclusions derived are still applicable, the evaluations have not been updated with respect to the LERF portion of the current PRA.

No direct impact because the PRA is maintained and applied by senior PRA analysts who are familiar with important assumptions and limitations of the model.

However, a formal assessment of PRA assumptions is being performed and will identify a list of 'key assumptions" to be referred to when using the PRA for risk-informed applications. A related characterization of "key uncertainties" is also being prepared.

The key assumptions / key uncertainties assessment will be used to determine whether additional sensitivity analyses for the 10 CFR 50.69 SSC categorization process are appropriate, and the results will be described in the 10 CFR 50.69 submittal.

Page 13 of 25

Serial No.05-028 Docket Nos. 50-280, 281 Table 4 Summary of ASME PRA Standard Supportin Requirements (SR) Not Met SR Summary of Requirement and PRA Possible PRA Impact Assessment QU-D4 Review a sampling of non-significant accident No important PRA impact. The sequences for validity.

purpose of this SR is to identify sequences (or cutsets) that are in-SPS PRA does not meet this SR.

significant only because of incorrect modeling. Although the specific Such a review is not currently included in the review called for in this SR is not PRA update quantification process.

routinely performed for the SPS PRA, other checks are performed to find and correct such issues, including a search for dependencies among modeled human actions.

However, a review as specified in this SR will be performed as part of the 10 CFR 50.69 application.

QU-E3 Estimate parameter uncertainty in the PRA No important PRA impact. In results, accounting for "state of knowledge general, the parameters used in the correlation".

quantification of the Surry PRA are characterized by "typical" uncertainty SPS PRA does not meet this SR.

intervals (e.g., lognormal distributions apply to most modeled equipment The PRA does not include a full propagation failures, few parameters have large of parameter uncertainty through the CDF error factors or equivalent). The and LERF calculations (although uncertainty overall range of CDF accounting for intervals are defined for the individual parameter uncertainty typically parameters used in the PRA model, and the reported for nuclear power plant state of knowledge correlation is accounted PRAs where the uncertainty is for in the ISLOCA initiating event frequency propagated is a factor of about analysis).

2 to 5. Consequently, for most applications a point-estimate mean propagation, and appropriate consideration of modeling uncertain-ties, provides a sufficient basis for making risk-informed decisions.

If specific applications arise that cause the above to be invalidated, additional evaluation may be needed.

Page 14 of 25

Serial No.05-028 Docket Nos. 50-280, 281 Table 4 Summary of ASME PRA Standard Supporting Requirements (SR) Not Met SR Summary of Requirement and PRA Possible PRA Impact Assessment LE-B2 Determine containment challenges (including For most current PRA applications, temperature) for severe accidents in a including the 10 CFR 50.69 pilot realistic manner.

application, there will be no LERF impact, since temperature effects are The SPS PRA meets the Capability primarily of concern for late Category I criteria for this SR. Temperature containment failure scenarios. This effects on containment strength, which are is not an issue for the 10 CFR 50.69 required for Category II for this SR, are not SSC categorization analysis as long addressed in the PRA Level 2 model.

as changes in treatment are not being considered for SSCs providing containment heat removal functions.

Consideration of containment temperature effects on containment strength may need to be addressed on an application-specific basis, i.e.,

for applications where late containment failure resulting from containment overheating is an issue.

LE-C2 Together these SRs deal with level of realism No impact on the CDF calculation.

and and level of detail in the severe accident The approach used in the SPS related progression modeling, including operator Level 2 (and LERF) model relative to LE-C3 actions to mitigate effects.

modeling of mitigating actions is consistent with that applied in most

• Include realistic (for Category Ii) /

other PWR PRAs. Peer review conservative (for Category I) treatment of comments recommending refining feasible operator actions following core the modeling to address post-core-damage.

damage operator actions represent a source of uncertainty in the LERF

• Provide realistic estimation of significant (and Level 2) models, which may accident progression (radionuclide release) need to be considered on an sequences, including significant mitigating application-specific basis. However, actions.

because LERF is dominated by contribution from Steam Generator The SPS PRA meets (and possibly exceeds)

Tube Rupture (SGTR) and ISLOCA the Capability Category I criteria for-these sequences, which result in SRs; post-core damage operator actions are containment bypass, additional not modeled, but some mitigating features accident progression modeling detail have been credited and justified.

would not likely change LERF contributions significantly enough to influence the relative LERF-significance for SSCs under the 10 CFR 50.69 categorization process.

Page 15 of 25

Serial No.05-028 Docket Nos. 50-280, 281 Table 4 Summary of ASME PRA Standard Supporting Requirements (SR) Not Met SR Summary of Requirement and PRA Possible PRA Impact Assessment LE-C4 Use realistic (for Category Ii) / conservative No impact on the CDF calculation.

(Category I) system success criteria for The applicable peer review issues for accident progression (radionuclide release) this SR related to degree of realism sequences.

(vs. conservatism) in success criteria for modeling of thermally-induced The Surry PRA meets the Capability SGTR and in-vessel recovery; this Category I requirements for SR LE-C4. The may represent a source of SPS peer reviewers perceived a somewhat uncertainty in the LERF (and Level 2) conservative bias in the Level 2 models, and models that may need to be provided comments that are interpreted as considered on an application-specific indicating that for the Surry PRA to fully meet basis. For the purposes of the realism requirements for Capability applications such as 10 CFR 50.69, Category II for this SR, the modeling of which are concerned with relative certain phenomena may need to be reviewed LERF-importance of SSCs, most to determine if additional realism is needed changes in phenomenological results for the application, at least for the significant will not be significant enough to have accident progression sequences.

a large impact, since LERF is dominated by SGTR and ISLOCA initiating event contributors, which result in containment bypass.

LE-C8 These SRs deal with degree of realism in No impact on the CDF calculation.

and modeling effects of containment The modeling of environmental LE-C9 environmental conditions or failure on the impacts and containment failure are ability to mitigate a severe accident.

believed to be conservatively-biased,

• Model containment environmental impacts i.e., likely overstate the Level 2 on equipment and human actions impact and thus represent a source realistically (Category II) l conservatively of uncertainty in the Level 2 model, (Category I).

which may need to be considered on

• Model containment failure impacts on an application-specific basis. The equipment and human actions realistically impact on LERF Is not likely to be as (Category II) / conservatively (Category I).

significant, since LERF is dominated The Surry PRA meets Capability Category I by SGTR and ISLOCA initiating for these SRs: environmental effects on event contributors, which result in continued equipment operation and operator containment bypass. When actions are modeled conservatively (e.g.,

considering risk significance of SSCs RHR, which is inside containment, is providing containment-related safety assumed to fail given a core damage event; functions for categorization under post-core-damage actions are generally not 10 CFR 50.69, it may be necessary modeled); and effects of containment failure to assess whether such relative to continued equipment operation conservatisms might affect and operator actions are modeled categorization decisions.

conservatively (e.g., containment failure following core damage is treated as LERF, without further modeling of possible mitigation).

Page 16 of 25

Serial No.05-028 Docket Nos. 50-280, 281 Identification of Key PRA Assumptions and Approximations An evaluation of key assumptions and key uncertainties in the SPS PRA, relative to the 10 CFR 50.69 application, is being prepared in support of that application.

The evaluation summary will be included as part of the archival documentation and available for NRC inspection during the PRA review visit planned as part of the RG 1.200 Pilot Program for Surry.

The following definitions have been adopted4 for the evaluation of key assumptions and key sources of uncertainty:

key assumption: an assumption made in response to a key source of uncertainty in the knowledge that a different reasonable alternative assumption would produce different results; or an assumption that results in an approximation made for modeling convenience in the knowledge that a more detailed model would produce different results. For the base PRA, the term "different results" refers to a change in the plant risk profile (e.g., total CDF and total LERF, the set of initiating events and accident sequences that contribute most to CDF and to LERF) and the associated changes in insights derived from the changes in risk profile.

A "reasonable alternative" assumption is one that has broad acceptance within the technical community and for which the technical basis for consideration is at least as sound as that of the assumption being challenged.

• key source of uncertainty: a source of uncertainty that is related to an issue for which there is no consensus approach or model, and where the choice of approach or model is known to have an impact on the risk profile (e.g., total CDF and total LERF, the set of initiating events and accident sequences that contribute most to CDF and to LERF) or a decision being made using the PRA. Such an impact might occur, for example, by introducing a new functional accident sequence or a change to the overall CDF or LERF estimates significant enough to affect insights gained from the PRA.

4 Regulatory Guide 1.200, Section 4.2, provides the following definitions for "key assumption" and "key source of uncertainty":

key assumption: an assumption made in response to a key source of uncertainty.

key source of uncertainty: a source of uncertainty that is related to an issue where there is no consensus approach or model (e.g., choice of data source, success criteria, RCP seal LOCA model, human reliability model) and where the choice of approach or model is known to have an impact on the determination of PRA results in terms of introducing new accident sequences, changing the relative importance of sequences, or affecting the overall CDF or LERF estimates that might have an impact on the use of the PRA in decision making.

The definitions used for the SPS PRA evaluation are taken from the proposed Addendum B of the ASME PRA Standard (Ref. 5), which is currently under review by the ASME consensus committee, since they provide some additional clarification of intent.

Page 17 of 25

-I

-_

Serial No.05-028 Docket Nos. 50-280, 281 Table 5 lists several aspects of the PRA that have been identified during the PRA self-assessment as representing potentially important assumptions or sources of uncertainty for the PRA. These may or may not be determined to be kej' for a particular application.

These items will be among those included in the investigation of key assumptions and uncertainties for the 10 CFR 50.69 SSC categorization process. Although the SPS PRA Peer Review Team did not explicitly comment on a list of assumptions, relevant Peer Review Team related comments are included in Table 5.

Table 5_

Summary Of Important Assumptions In The SPS PRA-POTENTIALLY IMPORTANT DISCUSSION ASSUMPTION / SOURCE OF UNCERTAINTY Definitions of "core damage"- and The measure of core damage for particular accident ---

'large early release frequency" as sequences is dependent on the supporting analyses, used in the SPS PRA are consistent which include UFSAR analyses, analyses performed with those specified in Section 2 of using non-licensing basis codes for severe accident the ASME PRA Standard [Ref. 5].

sequence thermal-hydraulics, and other engineering calculations and engineering judgments, depending on the sequence.

The definition of "significant" The quantification of the SPS PRA S03A model accident sequences, cutsets, and (including internal flooding) captures cutsets that basic events is consistent with the contribute 1% or more to CDF or LERF, and identifies definition specified in RG 1.200 basic events with a Fussel-Vesely importance greater Table A-1.

than 0.005 or risk achievement worth greater than 2.

Analyses of the sensitivity of results to reduced truncation limits have been performed to demonstrate adequacy of the quantification.

W01" 2000 Reactor Coolant Pump The WOG 2000 model has been reviewed and (RCP) Seal LOCA Model is used.

approved by the NRC. It includes assumptions that are believed to be conservative (i.e., likely overstates RCP seal LOCA-related CDF), but represents a consensus modeling approach.

The human action for tripping RCPs This represents an inconsistency with the WOG 2000 on loss of RCP seal cooling/injection RCP Seal LOCA model assumptions. The impact on has not been explicitly included in CDF is believed to be small, however, because the the T4 (Loss of RCP Seal Cooling) probability for failure of this action would be small; event model.

further, there is substantial redundancy in the SPS component cooling and charging systems, such that the T4 initiator is a relatively small CDF contributor.

All Loss of Offsite Power events are The PRA model assumes all LOOP events affect both treated as dual-unit initiators.

units due to the degree of inter-dependency in the switchyards for SPS Units 1 and 2. This likely overstates LOOP-related CDF somewhat. The model is set up to allow evaluation of sensitivity to this assumption.

Page 18 of 25

Serial No.05-028 Docket Nos. 50-280, 281 Table 5 Summary Of Important Assumptions In The SPS PRA POTENTIALLY IMPORTANT DISCUSSION ASSUMPTION / SOURCE OF UNCERTAINTY' A diesel generator mission time of The 24-hour EDG mission time is weighted by the 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is used, and the probability of non-recovery of AC power, assuming EDG/LOOP recovery models are defensible success criteria for battery depletion and integrated to ensure accurate ability to cope with plant conditions following battery quantification of the LOOP initiating depletion. This addresses PRA peer review comments events.

regarding previously inconsistent selection of EDG mission time, offsite power recovery, and time to core uncovery.

SBC) Battery Depletion Modeling.

This is a recognized modeling approach. Although it is For many sequences, successful expected that the operators would find ways to cope operation of the batteries in the first with the described scenarios, continued operation few hours of an accident allows for without procedural guidance is not credited in the PRA.

prevention of core damage. In the SBC) sequences, the PRA credits the batteries for their rated period of operation, and considers the possibility that AFW may fail without DC power, given that continued operation is outside of existing procedures. It is conservatively estimated that if AFW fails, core damage will occur within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> after depletion (based on available analyses) unless AC power is restored prior to that time.

Several systems at Surry (including Crediting cross-ties consistent with plant procedures component cooling, charging, and operator training results in lower (and more auxiliary feedwater) can be cross-realistic) CDF results. Availability of the opposite unit is tied between units. The SPS PRA considered in crediting cross-ties. The PRA does not model credits such cross-ties where credit all possible cross-ties available in all scenarios, this is supported by plant and is therefore still conservative.

procedures and operator training.

Page 19 of 25

Serial No.05-028 Docket Nos. 50-280, 281 Attachment.1 Table 5 Summary Of Important Assumptions In The SPS PRA POTENTIALLY IMPORTANT ASSUMPTION / SOURCE OF UNCERTAINTY DISCUSSION Impact of 4.3% core power uprate has not been directly factored into the model.

Although there is a potential for this to affect analyses performed in support of PRA success criteria, the results of the limited number of such analyses were generally interpreted conservatively, such that it is judged that no PRA success criteria impact is anticipated. There is also a potential for a small impact on calculated UETs for the PRA ATWS model; however, ATWS is not a major core damage contributor.' Consequently, any PRA impact is not expected to be significant. Implementation of the WOG ATWS model is planned for a future PRA update after NRC approval of that model, at which time the current core parameters will be reflected in the model.

For the 10 CFR 50.69 categorization, a review of the analyses supporting the PRA success criteria will be performed to determine whether there are other impacts that might affect that application.

The MAAP 3b code has been used to support a limited number of PRA success criteria.

The code has been used within known limits, primarily to define accident sequence time windows not sensitive to core modeling or rapid RCS depressurization.

The HRA methodology is a hybrid The methodology addresses both cognitive and HCR / CBDT 5 approach.

execution errors. It has been specifically peer-reviewed and concluded to be valid. A set of sensitivity studies has been recommended by the peer reviewer and will be performed in conjunction with the 10 CFR 50.69 categorization submittal.

The SPS PRA assumes The model conservatively assumes that paths down to containment isolation failure given a

-inch diameter must be isolated for all non-bypass 1-inch leakage pathway scenarios.

5 HCR denotes 'Human Cognitive Reliability approach; CBDT denotes Cause-Based Decision-Tree" approach, both of which are described in EPRI technical reports.

Page 20 of 25

Serial No.05-028 Docket Nos. 50-280, 281 Table 5 Summary Of Important Assumptions In The SPS PRA V

POTENTIALLY IMPORTANT ASSUMPTION / SOURCE OF UNCERTAINTY DISCUSSION Operator actions (e.g., per SAMGs) to mitigate release potential following core damage are not modeled.

The approach used in the SPS Level 2 (and LERF) model relative to modeling of mitigating actions is consistent with that applied in most other PWR PRAs.

Peer review comments recommending refining the modeling to address post-core-damage operator actions represent a source of uncertainty in the LERF (and Level 2) models, which may need to be considered on an application-specific basis. However, because LERF is dominated by contribution from SGTR and ISLOCA sequences, which result in containment bypass, additional accident progression modeling detail would not likely change LERF contributions significantly enough to influence the relative LERF-significance for SSCs under the 10 CFR 50.69 categorization process.

The SPS PRA peer reviewers perceived a somewhat conservative bias in the success criteria for accident progression (radionuclide release) sequences (Level 2 models). Peer review comments indicated that the modeling of certain phenomena may need to be reviewed to determine if additional realism is needed for the significant accident progression sequences.

The applicable peer review issues were related to degree of realism (vs. conservatism) in success criteria for modeling of thermally-induced SGTR and in-vessel recovery; this may represent a source of uncertainty in the LERF (and Level 2) models that may need to be considered on an application-specific basis. For the purposes of applications such as 10 CFR 50.69, which are concerned with relative LERF-importance of SSCs, most changes in phenomenological results will not be significant enough to have a large impact, since LERF is dominated by SGTR and ISLOCA initiating event contributors, which result in containment bvpass.

The SPS PRA S03A model includes The change is being built into the PRA model but will be a dominant internal flooding addressed through sensitivity evaluations for the scenario that is no longer realistic 10 CFR 50.69 submittal.

following implementation of a plant modification (DCP-03-089).

Several plant changes (see Table 2) The plant changes that could potentially impact the have not yet been factored into the PRA will be addressed through sensitivity evaluations PRA model.

for the 10 CFR 50.69 submittal.

The SPS PRA model quantifies the The two units at Surry are very similar in design and plant risk for Surry Unit 1 only, operation. The PRA documentation includes an accounting for Unit 2 components evaluation of unit-to-unit differences for the various that may be used for mitigating core portions of the model. Thus, the risk model has been damage on Unit 1 due to their cross determined to be sufficiently applicable to either unit.

tie capability.

Page 21 of 25

Serial No.05-028 Docket Nos. 50-280, 281 Table 5 Summary Of Important Assumptions In The SPS PRA POTENTIALLY IMPORTANT DISCUSSION ASSUMPTION / SOURCE OF UNCERTAINTY A number of PRA model changes Issues are tracked in the PRA Configuration Database have been proposed, but not yet with an initial implementation priority, tracking number, implemented, which are intended to and entry date. The PRA is used routinely to support improve model realism / reduce plant Maintenance Rule (a)(4) evaluations and other conservatism, or otherwise address decisions; therefore, Dominion PRA analysts and plant various modeling issues.

staff regularly evaluate PRA models, assumptions, and results relative to the as-built, as-operated plant. Issues believed to have an important impact on PRA results are given high priority for resolution. Other issues individually do not result in substantial impacts on CDF or LERF. However, for the 10 CFR 50.69 categoriza-tion, it is recognized that issues that could collectively result in a reduction in CDF/LERF (e.g., due to removal of multiple conservatisms) might result in an increase in the relative risk importance of the SSCs being categorized. Thus, an evaluation of the impact of open issues in the SPS PRA Configuration Database will be performed for the 10 CFR 50.69 submittal with sensitivity studies as appropriate.

Page 22 of 25

Serial No.05-028 Docket Nos. 50-280, 281 Results of Available Sensitivity Studies For the 10 CFR 50.69 SSC categorization, a set of sensitivity studies is prescribed in the categorization guidance document, NEI-00-04 (Ref. 4).

The sensitivity studies prescribed by NEI 00-04 are included in the archival documentation. Results of those sensitivity studies, along with additional sensitivity studies identified through the evaluation of PRA key assumptions and sources of uncertainty discussed earlier, will be provided with the categorization submittal.

Table 6 below summarizes the sensitivity analyses and additional evaluations that have been performed or are currently planned in support of the 10 CFR 50.69 analysis, and indicates whether these analyses/evaluations are among the sensitivities specified by NEI-00-04. For the sensitivities not required by NEI-00-04, consideration will be given to the order and grouping of the cases so that relevant dependent effects are captured.

Table 6.

Summary of SPS PRA Sensitivity Cases or Evaluations Planned For 10 CFR 50.69 CASE DISCUSSION Increase all human error basic events to Ensure that assumptions made in the human 95t percentile values (NEI 00-04).

reliability analysis do not mask importance of components.

Decrease all human error basic events to Ensure that assumptions made in the human 5t percentile values (NEI 00-04).

reliability analysis do not mask importance of components.

Increase all component common cause Ensure that assumptions made in the common basic events to 95W percentile values cause analysis do not mask importance of (NEI 00-04).

components.

Decrease all compRonent common cause Ensure that assumptions made in the common basic events to 5 percentile (NEI 00-cause analysis do not mask importance of 04).

components.

Set all maintenance unavailability terms Ensure that assumptions made regarding to zero (NEI 00-04, but case is also component maintenance do not mask importance normally performed with each PRA of components.

update).

Simultaneously increase the failure Ensure that the resulting increase in CDF and probability by a factor of 5 for all LERF does not exceed the "small risk increase" components proposed as Low Safety criteria in Regulatory Guide 1.174 [Ref. 7].

Significant.

Examine sensitivity to explicitly including Ensure that simplifying assumption in the model HEF' for failure to trip RCPs in RCP Seal does not mask importance of components.

LOCA model.

Determine sensitivity of assumption that Ensure that assumption does not mask importance all LOOP events affect both units.

of components.

Page 23 of 25

Serial No.05-028 Docket Nos. 50-280, 281 Table 6 Summary of SPS PRA Sensitivity Cases or Evaluations Planned For 10 CFR 50.69 CASE DISCUSSION Sensitivities recommended by the )IRA Ensure that results of the HRA are not overly peer reviewer to validate assumptions sensitive to certain HRA modeling assumptions.

made in the HRA methodology.

Evaluate sensitivity of 10 CFR 50.69 Although there is a risk reduction that might affect categorization results to using new SSC categorization, the approach used in the internal flooding results that reflect recent categorization analysis examined the effect of plant DCP.

internal flooding separately so that the effects of a change in internal flooding results would be minimized. This will be examined.

Examine sensitivity to credit for plant Risk reduction potential due to recent plant DCP related to cross-tie of 125V DC change, with potential SS risk importance impact.

station batteries.

Examine sensitivity to other plant Risk reduction potential due to recent plant changes since the PRA update.

changes, with potential SSC risk importance impact.

Examine sensitivity to proposed PRA Potential that collective impact of small changes model changes / other open issues in the could be important to component importances and PRA Configuration database, including categorization for 10 CFR 50.69.

the small core power uprate.

I PRA Quality Assessment Conclusions The specific PRA application for which this PRA quality assessment is being developed is the SPS pilot application for categorization of SSCs under 10 CFR 50.69. The PRA is used in the SSC categorization phase of 10 CFR 50.69 as one input to the determination of the safety-signiticance of functions (and associated components) provided by systems being considered under the voluntary rule. The internal events at power PRA results are used to establish an initial high or low risk-significance determination for the affected system functions. This determination is considered in light of additional risk inputs (i.e., risk significance based on other operating modes and initiating events) and traditional engineering and plant operations inputs by a multi-disciplinary integrated decision-making panel to reach a conclusion on the risk-informed safety classification for the function.

The results of the PRA technical capability assessment described in this document demonstrate that the SPS PRA model Is of sufficient quality to be exercised and used to support a full range of risk-informed applications, including the 10 CFR 50.69 SSC categorization process. For the Surry 10 CFR 50.69 application, additional support for this conclusion will be provided through the sensitivity studies planned for the categorization submittal.

Page 24 of 25

Serial No.05-028 Docket Nos. 50-280, 281 References (1)

U.S. Nuclear Regulatory *Commission, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Regulatory Guide 1.200 For Trial Use, February 2004.

(2) 10 CFR 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors, Final Rule,"

U.S.

Nuclear Regulatory Commission, November 2004 (3)

NRC Generic Letter 88-20, Individual Plant Examination for Severe Accident Vulnerabilities - 10 CFR 50.54(F), November 23,1988 (4)

Nuclear Energy Institute, 10 CFR 50.69 SSC Categorization Guideline, Final Draft R2, NEI-00-04, October 2004 (5)

American Society of Mechanical Engineers, Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME RA-S-2002, April 2002, and Addenda as provided via ASME RA-Sa-2003, December 2003.

(6)

Nuclear Energy Institute, Probabilistic Risk Assessment (PRA) Peer Review Process Guidance, NEI-00-02, Revision A3, Nuclear Energy Institute, October 2000.

(7)

U.S. Nuclear Regulatory Commission, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions On Plant-Specific. Changes To The Licensing Basis, Regulatory Guide 1.174, Revision 1, November 2002.

Page 25 of 25