Text

to Topical Report WCAP-16308-NP, Pressurized Water Reactor Owners Group 10 CFR 50.69 Pilot Program - Categorization Process - Wolf Creek Generating Station.
	ML062770360
Person / Time
Site:	Wolf Creek, Nuclear Energy Institute
Issue date:	07/31/2006
From:	Jonathan Brown, Lutz R; Westinghouse
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	PA-SEE-0027 WCAP-16308-NP, Rev 0
	Download: ML062770360 (64)
	v • d • e

Westinghouse Non-Proprietary Class 3 WCAP-16308-NP July 2006 Revision 0 Pressurized Water Reactor Owners Group 10 CFR 50.69 Pilot Program -

Categorization Process-Wolf Creek Generating Station

)Westinghouse

WESTINGHOUSE NON-PROPRIETARY CLASS 3 WCAP-16308-NP Revision 0 Pressurized Water Reactors Owners Group 10 CFR 50.69 Pilot Program - Categorization Process -

Wolf Creek Generating Station Robert J. Lutz, Jr.

Reliability and Risk Assessment Jason A. Brown Reliability and Risk Assessment July 2006 Approved: Gary Ament*, Manager Reliability and Risk Assessment Prepared for Pressurized Water Reactor Owners Group Developed under PWROG Program PA-SEE-0027

Electronically approved records are authenticated in the electronic document management system.

LEGAL NOTICE This report was prepared as an account of work performed by Westinghouse Electric Company LLC.

Neither Westinghouse Electric Company LLC, nor any person acting on its behalf:

A. Makes any warranty or representation, express or implied including the warranties of fitness for a particular purpose or merchantability, with respect to the accuracy, completeness, or usefulness of the information contained in this report, or that the use of any information, apparatus, method, or process disclosed in this report may not infringe privately owned rights; or B. Assumes any liabilities with respect to the use of, or for damages resulting from the use of, any information, apparatus, method, or process disclosed in this report.

COPYRIGHT NOTICE This report has been prepared by Westinghouse Electric Company LLC and bears a Westinghouse Electric Company copyright notice. As a member of the PWR Owners Group, you are permitted to copy and redistribute all or portions of the report within your organization; however all copies made by you must include the copyright notice in all instances.

DISTRIBUTION NOTICE This report was prepared for the PWR Owners Group. This Distribution Notice is intended to establish guidance for access to this information. This report (including proprietary and non-proprietary versions) is not to be provided to any individual or organization outside of the PWR Owners Group program participants without prior written approval of the PWR Owners Group Program Management Office.

However, prior written approval is not required for program participants to provide copies of Class 3 Non Proprietary reports to third parties that are supporting implementation at their plant, and for submittals to the NRC.

WCAP-16308-NP July 2006 Revision 0

v PWR Owners Group Member Participation* for Project/Task PA-SEE-0027 Participant Utility Member Plant Site(s) Yes No AmerenUE Callaway (W) X American Electric Power D.C. Cook l&2 (W) X Arizona Public Service Palo Verde Unit 1, 2, & 3 (CE) X Constellation Energy Group Calvert Cliffs I & 2 (CE) X Constellation Energy Group Ginna (W) X Dominion Connecticut Millstone 2 (CE) X Dominion Connecticut Millstone 3 (W) X Dominion Kewaunee Kewaunee (W) X Dominion VA North Anna I & 2, Surry I & 2 (W) X Duke Energy Catawba I & 2, McGuire I & 2 (W), Oconee 1, 2, X 3 (B&W)

Entergy Nuclear Northeast Indian Point 2 & 3 (W) X Entergy Operations South Arkansas 2, Waterford 3 (CE), Arkansas I (B&W) X Exelon Generation Co. LLC Braidwood I & 2, Byron 1 & 2 (W), TMI I (B&W) X FirstEnergy Nuclear Operating Co Beaver Valley I & 2 (W), Davis-Besse (B&W) X Florida Power & Light Group St. Lucie I & 2 (CE) X Florida Power & Light Group Turkey Point 3 & 4, Seabrook (W) X Nuclear Management Company Prairie Island 1&2, Pt. Beach 1&2 (W) X Nuclear'Management Company Palisades (CE) X Omaha Public Power District Fort Calhoun (CE) X Pacific Gas & Electric Diablo Canyon 1 & 2 (W) X Progress Energy Robinson 2, Shearon Harris (W), Crystal River 3 X (B&W)

PSEG - Nuclear Salem I & 2 (W) X Southern California Edison SONGS 2 & 3 (CE) X South Carolina Electric & Gas V.C. Summer (W) X So. Texas Project Nuclear Operating Co. South Texas Project 1 & 2 (W) X Southern Nuclear Operating Co. Farley I & 2, Vogtle I & 2 (W) X Tennessee Valley Authority Sequoyah I & 2, Watts Bar (W) X TXU Power Comanche Peak I & 2 (W) X Wolf Creek Nuclear Operating Co. Wolf Creek (W) X

Project participants as of the date the final deliverable was completed. On occasion, additional members will join a project. Please contact the PWR Owners Group Program Management Office to verify participation before sending this document to participants not listed above.

WCAP-16308oNP July 2006 Revision 0

vi PWR Owners Group International Member Participation* for Project/Task PA-SEE-0027 Participant Utility Member Plant Site(s) Yes No British Energy Sizewell B X Electrabel (Belgian Utilities) Doel 1, 2 & 4, Tihange 1 & 3 X Kansai Electric Co., LTD Mihama 1, Ohi I & 2, Takahama 1 (W) X Korea Hydro & Nuclear Power Corp. Kori 1, 2,3 & 4 X Yonggwang 1 & 2 (W)

Korea Hydro & Nuclear Power Corp. Yonggwang 3, 4, 5 & 6 X Ulchin 3, 4,5 & 6(CE)

Nukleama Electrama KRSKO Krsko (W) X Nordostschweizerische Kraftverke AG (NOK) Beznau I & 2 (W) X Ringhals AB Ringhals 2, 3 & 4 (W) X Spanish Utilities Asco I & 2, Vandellos 2, X Almaraz I & 2 (W)

Taiwan Power Co. Maanshan I & 2 (W) X Electricite de France 54 Units X

This is a list of participants in this project as of the date the final deliverable was completed. On occasion, additional members will join a project. Please contact the PWR Owners Group Program Management Office to verify participation before sending documents to participants not listed above.

July 2006 WCAP-l 6308-NP WCAP-16308-NP July 2006 Revision 0

vii TABLE OF CONTENTS LIST O F TA B LES ....................................................................................................................................... ix LIST O F FIG U RES ..................................................................................................................................... xi A C R ON Y M S ............................................................................................................................................. xiii I INTRODUCTION ........................................................................................................................ 1-1

1.1 BACKGROUND

............................................................................................................. 1-2 2 WOLF CREEK GENERATING STATION PILOT PROGRAM SCOPE & APPROACH ......... 2-I

2.1 INTRODUCTION

........................................................................................................... 2-1 2.2 SCOPE OF SSCS SELECTED FOR §50.69 CATEGORIZATION ................................ 2-1 2.3 APPROACH .................................................................................................................... 2-2 3 CATEGORIZATION OF ACTIVE FUNCTIONS ....................................................................... 3-1 3.1 ASSEMBLY OF PLANT-SPECIFIC INPUTS ................................................................ 3-1 3.2 SYSTEM ENGINEERING ASSESSMENT ................................................................... 3-4 3.3 COMPONENT SAFETY SIGNIFICANCE ASSESSMENT .......................................... 3-8 3.4 DEFENSE-IN-DEPTH ASSESSMENT ........................................................................ 3-13 3.5 PRELIMINARY ENGINEERING CATEGORIZATION OF FUNCTIONS ................ 3-14 3.6 RISK SENSITIVITY STUDY ....................................................................................... 3-15 3.7 IDP REVIEW AND APPROVAL .................................................................................. 3-16 3.8 SSC CATEGORIZATION ............................................................................................. 3-19 4 CATEGORIZATION OF PASSIVE FUNCTIONS ...................................................................... 4-1 4.1 SCOPE IDENTIFICATION ............................................................................................. 4-1 4.2 COMPONENT MAPPING .............................................................................................. 4-1 4.3 REQUIRED DISCIPLINES ............................................................................................ 4-2 4.4 CONSEQUENCE EVALUATION .................................................................................. 4-3 4.5 CLASSIFICATION CONSIDERATIONS ...................................................................... 4-4 4.6 SAFETY MARGINS ....................................................................................................... 4-8 5 RISK CATEGORIZATION BASIS .............................................................................................. 5-1 5.1 PLANT-SPECIFIC RISK INFORMATION .................................................................... 5-1 6 PROGRAM DOCUMENTATION AND CHANGE CONTROL ............................................. 6-1 6.1 DOCUMENTATION OF CATEGORIZATION PROCESS ....................................... 6-1 6.2 CHANGE CONTROL PROVISIONS ............................................................................. 6-1 7 PERIODIC UPDATES .................................................................................................................. 7-1 7.1 UPDATES BASED ON PLANT DESIGN AND OPERATION ..................................... 7-1 7.2 MONITORING OF RISC-I AND RISC-2 SSCs ............................................................ 7-2 7.3 MONITORING OF RISC-3 SSCs ................................................................................... 7-2 8 APPLICATION OF RISC-3 TREATMENT REQUIREMENTS ................................................. 8-1 9 REFERENCES ............................................................................................................................. 9-1 APPENDIX A DIFFERENCES IN GUIDANCE USED FOR WCGS IDP AND ENDORSED VERSIONS OF GUIDANCE ..................................................................................................... A-I WCAP-16308-NP July 2006 Revision 0

ix LIST OF TABLES Table 3-1 Design and Operational Inputs to the WCGS Categorization Process ............................. 3-3 Table 5-1 Initiating Event Contribution to Core Damage ................................................................ 5-2 Table 5-2 Contributors to LERF ........................................... 5-2 Table A-I Impact of Changes in NEI 00-04 on the WCGS Categorization .................................... A-2 Table A-2 Impact of Changes in ASME Code Case N-660 on the WCGS Categorization ............. A-6 WCAP- 16308-NP July 2006 Revision 0

xi LIST OF FIGURES Figure 1-1 Risk-Informed Safety Classifications (RISC) .................................................................. 1-2 Figure 3-1 Risk-Informed Categorization Process ............................................................................ 3-2 Figure 3-2 Active Assessment Summary Report, Page 1 ................................................................ 3-20 Figure 3-3 Active Assessment Summary Report, Page 2 ................................................................ 3-21 Figure 4-1 Passive Assessment Summary Report, Page 1................................................................. 4-9 Figure 4-2 Passive Assessment Summary Report, Page 2 ............................................................... 4-10 WCAP-16308-NP July 2006 Revision 0

xiii ACRONYMS AOV Air Operated Valve ASME ASME (formerly known as the American Society of Mechanical Engineers)

CCF Common Cause Failure CFR Code of Federal Regulations EN Wolf Creek designation for the Containment Spray System EOP Emergency Operating Procedure EPA Environmental Protection Agency FIVE Fire Induced Vulnerability Evaluation GK Wolf Creek designation for the Control Building Ventilation System HEP Human Error Probability HSS High Safety Significant IDP Integrated Decision-making Panel IPEEE Individual Plant Examination for External Events LSS Low Safety Significant MOV Motor Operated Valve MR Maintenance Rule NEI Nuclear Energy Institute NRC Nuclear Regulatory Commission PAG Protective Action Guides PRA Probabilistic Risk Assessment PWROG Pressurized Water Reactor Owners Group (formerly Westinghouse Owners Group)

RI-ISI Risk-Informed In-Service Inspection RISC Risk Informed Safety Classification SAMG Severe Accident Management Guideline SSC Systems, Structures and Components SSEL Safe Shutdown Equipment List SMA Seismic Margins Analysis WCGS Wolf Creek Generating Station WCNOC Wolf Creek Nuclear Operating Corporation WinNUPRA A computer code used to model the PRA WCAP-16308-NP July 2006 Revision 0

1-1 1 INTRODUCTION The new 10 CFR 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors," is a voluntary regulation that provides an approach by which licensees can categorize safety-related and non-safety-related structures, systems and components (SSCs) according to their safety significance. The intent of 50.69 is to provide a means for appropriately focusing attention on those SSCs that are most important to safety, while maintaining a high degree of confidence that all SSCs will be capable of performing their design basis functions. To achieve this, 50.69 permits relaxation of the special treatment (controls) specified in certain other sections of the regulations for those SSCs that can be categorized as low safety significant. Per 50.69 (b)(2), a licensee desiring to take advantage of this voluntary regulation would make a one-time submittal to the Nuclear Regulatory Commission (NRC) for review and approval. In accordance with 50.69 (b)(2), the submittal is to contain documentation related to: a) the categorization process to be used to define the safety significance of SSCs for which treatment could be relaxed, b) the process used to establish the technical capability of the licensee's Probabilistic Risk Assessment (PRA) that is used as a basis for the categorization, c) the process used to assure that adequate safety margins are maintained and the potential increases in risk resulting from changes in treatment permitted by 50.69 are small. Upon NRC review and approval of these processes, the licensee could then apply the categorization process to as many (or as few) systems as desired, provided that an entire system is considered. Although the proposed 50.69 rule also contains requirements for assuring that any changes in treatment for low safety significant SSCs do not result in unacceptable changes in margins or risk, there is no requirement for the licensee's treatment process to be included in the submittal for NRC review and approval. The effectiveness of the treatment processes would be assured through NRC inspections and performance requirements as described in the 50.69 rule.

The objective of this report is to provide documentation of the categorization process used by Wolf Creek Nuclear Operating Corporation (WCNOC) in support of a future licensee submittal requesting approval to implement 50.69 at the Wolf Creek Generating Station (WCGS). A separate report on the quality of the PRA to be used in the categorization process will be submitted to the NRC by WCNOC to support the license amendment request to implement 50.69 at WCGS. Since the categorization process, as opposed to the categorization results, is the subject of the NRC review and approval, the two can be reviewed and approved separately. That is, approval for implementation of 50.69 requires a robust categorization process AND a technically capable PRA to provide input to the categorization process. However, both are independent of each other and can be reviewed separately without compromising the adequacy of the review. Thus, review and approval of the categorization process, as described in this report, can be completed without a coincident review of the PRA.

While the categorization process described in this report has been applied to two systems at WCGS, it is recognized by WCNOC that the results of the categorization cannot be directly used in the implementation of 50.69 since the quantitative risk assessment was not based on a PRA that meets the technical adequacy requirements of the 50.69 rule. Following future NRC approval of the PRA technical adequacy, per 50.69 (b)(2), the categorization results for these two systems will be re-visited to finalize the SSC categorization.

The categorization process to be used by WCNOC was developed based on categorization of two systems at WCGS. The Containment Spray System (EN System) represents a stand-by emergency system whose WCAP-16308-NP July 2006 Revision 0

1-2 primary function is to mitigate the consequences of an accident by reducing containment pressure and scrubbing fission products released from the core that are airborne in the containment. The Control Building Ventilation System (GK System) is a normally operating system with some additional post-accident functions whose primary function is cooling of various components in the control building and providing a habitable environment in and near the control room. These systems were chosen, in part, based on their absence from the PRA as a result of various PRA assessment and screening processes.

Thus, the categorization of these systems identifies the processes to be used for categorization when there is little or no PRA information to use as a quantitative basis or where risk impacts must be inferred from components that are modeled in the PRA.

The categorization of the structures, systems, and components documented in this report were performed in accordance with the final draft version of NEI 00-04, "10 CFR 50.69 SSC Categorization Guideline" (Reference I), as transmitted to the NRC by the Nuclear Energy Institute in April of 2004, and a proposed Revision 2 to the ASME N-660 Code Case, "Risk-Informed Safety Classification for Use in Risk-Informed Repair/Replacement Activities." Differences between the categorization guidelines in those reports and the most recent versions of those guidelines that are endorsed by the NRC in Regulatory Guide 1.201 (Reference 2) and Revision 14 to Regulatory Guide 1.147 (Reference 3) are discussed in Appendix A of this report.

1.1 BACKGROUND

The intent of the 10 CFR 50.69 regulatory initiative is to adjust the scope of equipment subject to special regulatory treatment (controls) to better focus attention and resources on equipment that is safety significant. The implementation of 10 CFR 50.69 does not replace the existing "safety-related" and "nonsafety-related" categorizations. Rather, it divides these categorizations into two subcategories based on high or low safety significance as depicted in Figure 1-1. This is called the Risk-Informed Safety Classification (RISC) process.

.... 4: ; :"q 1 Nonsafefy-Related NEI 00-04 Categorization Process Safety Significant ..... . R C Low Safety ..

Significant : RISC,4.

Figure 1-1 Risk-Informed Safety Classifications (RISC)

WCAP-16308-NP July 2006 Revision 0

1-3 During the 50.69 rulemaking process, the industry developed two sets of categorization guidance to assist licensees in implementing 50.69. The first set of guidance, developed under the auspices of the Nuclear Energy Institute (NEI), is for use in categorizing the active functions of SSCs. The second set of guidance, developed under the auspices of ASME, is for use in categorizing the passive, or pressure boundary, functions of SSCs. Both sets of guidance have been extensively tested by pilot applications of the 50.69 process prior to the issuance of the final rule in November of 2004. The guidance has been improved as a result of each pilot activity.

Both sets of guidance use an integrated decision-making process to define the scope of equipment that will be subject to the special treatment provisions in the regulations. This integrated decision-making process blends risk insights, deterministic considerations, and operational feedback through the involvement of a group of experienced plant personnel representing diverse plant functions and responsibilities.

The NEI 00-04 guidance requires that the final decision regarding the categorization of components performing an active function functions be presented to an expert panel, known as the Integrated Decision-making Panel (IDP). The IDP is composed of a group of experienced plant personnel representing diverse plant functions and responsibilities. The IDP is supported by additional working level groups of personnel to provide detailed investigations and assessments necessary for IDP consideration of the categorization of the SSCs under consideration. A preliminary categorization is performed by a working group consisting primarily of working level personnel (e.g., engineers, plant operators, etc.). This preliminary categorization is then presented to the IDP, which is composed of qualified professionals and supervisory personnel who are selected by plant management to consider the information and come to a final decision. The NEI 00-04 guidance also provides guidance for the purpose, composition, and conduct of the IDP.

ASME guidance is contained in Code Case N-660 (Reference 4). Code Case N-660 also prescribes the use of an expert panel to finalize the scope of pressure boundary components (and their supports) that will be subject to ASME special treatment provisions. As with the assessment of active components described in NEI 00-04, this process blends risk insights, deterministic considerations, and operational feedback.

Since the ASME Code Case N-660 also requires the involvement of a group of experienced plant personnel representing diverse plant functions and responsibilities, both the preliminary engineering categorization according to NEI 00-04 and ASME Code Case N-660 were presented at one IDP session.

Performing the final categorization for both active and pressure boundary components for a given system at the same IDP session helps to ensure consistency in the IDP considerations for both active and pressure boundary components. However, due to differences in the process of grouping components between the NEI and ASME guidance, the IDP considerations for active and pressure boundary components were not done at the same time. Each IDP session on a given system first considered all of the components active functions in the first part of the IDP session. The pressure boundary functions were then considered in the second part of the IDP session.

WCAP- 16308-NP July 2006 Revision 0

2-1 2 WOLF CREEK GENERATING STATION PILOT PROGRAM SCOPE & APPROACH

2.1 INTRODUCTION

The preliminary categorization of SSCs for the selected systems was completed in the latter half of 2003, using the draft NEI 00-04 guidance available at that time and the approved ASME Code Case N-660, Revision 0. The initial WCGS Integrated Decision-making Panel (IDP) to consider the initial categorization recommendations was held in December of 2003. That IDP identified a number of issues with the use of the NEI and ASME guidance documents. Most of the issues involved the possibility of multiple interpretations for certain guidance elements. In order to achieve stability in the categorization process, the December 2003 IDP tabled all matters and requested that the affected guidance elements be revised to resolve the issues identified by the IDP. Following revisions to the NEI and ASME guidance, the IDP was reconvened in April of 2004. This IDP session was a complete review of all SSCs for both systems and did not rely upon any recommendations made at the initial IDP session. Following the completion of the second IDP, the minutes were documented and archived. The development of this submittal report was delayed pending finalization of the 50.69 rule and the resolution of all major industry and regulatory comments on both the NEI and ASME guidance documents. An earlier submittal of this report for regulatory review would have made the review difficult because an endorsed set of guidance would not have been available to use as a standard for the regulatory review.

The following sections discuss the process to be used at WCGS to categorize SSCs for 50.69 implementation. The process followed the NEI and ASME guidance for categorization of SSCs that was available in April of 2004. Appendix A provides a discussion of the differences between the 2004 guidance and the guidance that has been endorsed by NRC in Regulatory Guides 1.201 and 1.147, Revision 14 and the impact of changes in the WCGS categorization process and/or results.

2.2 SCOPE OF SSCS SELECTED FOR §50.69 CATEGORIZATION Two systems were selected to define and validate the categorization process to be used at WCGS for the implementation of the proposed 10 CFR 50.69:

Containment Spray System

Control Building Ventilation System The Containriient Spray System (EN System) represents a stand-by emergency system whose primary function is to mitigate the consequences of an accident by reducing containment pressure and scrubbing airborne fission products released from the core. The EN system is composed of the components required to deliver water to the containment via the containment spray headers from either the Refueling Water Storage Tank (RWST) or the containment sump, and those components required to provide sodium hydroxide to buffer the pH of the containment sump water.

The Control Building Ventilation System (GK System) is a normally operating system whose primary function is cooling of various components in the control building and providing a habitable environment (i.e., temperature) in and near the control room. In the post accident mode, some of the ventilation flow paths are altered to provide primary functions associated with control room habitability (both temperature WCAP-16308-NP July 2006 Revision 0

2-2 and radiation) and to provide cooling for class I E components (i.e., switchgear) in the control building that support accident mitigation functions.

These systems were chosen to demonstrate the categorization process to be used at WCGS for implementation of 50.69, based in part, on their limited modeling in the PRA as a result of various PRA assessment and screening processes. The categorization of system functions whose components are explicitly modeled in PRA is straight-forward using the NEI and ASME guidance. The categorization of these systems identifies the processes to be used for categorization when there is little or no PRA information to use as a quantitative basis for categorizing system functions and components.

2.3 APPROACH The NEI guidance described in NEI 00-04 was used in the categorization of the active functions of the SSCs in the EN and GK systems for WCGS. The April 2004 version of NET 00-04 was used for the pilot evaluation described in this report. The manner in which WCNOC applied NEI 00-04 to the categorization of SSCs at WCGS is described in Section 3 of this report.

The classification of SSCs having a pressure retaining function (also referred to as passive components) was performed using an April 2004 draft revision of ASME Code Case N-660. The Code Case N-660 process may be applied to any of Class 1, 2, 3, or non-class pressure-retaining items or their associated supports, except core supports. Specifically excluded from the risk informed safety classification process in Code Case N-660 are reactor coolant system pressure boundary components (which make up the majority of the Class I pressure boundary components in a PWR). The regulatory position in Revision 14 to Regulatory Guide 1.147, that endorses Code Case N-660, Revision 0, takes exception to its use for any Class 1 pressure retaining items. No Class 1 pressure retaining items were found in the EN or GK Systems, so this exception was not addressed in the present categorization. For future use of the categorization process described in this report, WCNOC will not consider re-classification of any Class I pressure retaining item unless endorsed by NRC in further revisions to Regulatory Guide 1.147. The manner in which WCNOC applied Code Case N-660 to the categorization of SSCs at WCGS is described in Section 4 of this report.

July 2006 WCAP-1 6308-NP WCAP-16308-NP July 2006 Revision 0

3-1 3 CATEGORIZATION OF ACTIVE FUNCTIONS The overall process used in categorizing the active functions and components, as described in NEI 00-04, is depicted in Figure 3-1. This process builds upon the insights and methods from many previous categorization efforts, such as the risk ranking in the risk-informed in-service inspection (RI-ISI),

Maintenance Rule (MR), motor operated valve (MOV) and air operated valve (AOV) programs. It is a comprehensive, robust process that includes consideration of various contributors to plant risk and defense-in-depth.

The process includes eight main steps:

Assembly of Plant-Specific Inputs

System Engineering Assessment 0 Component Safety Significance Assessment

Defense-In-Depth Assessment 0 Preliminary Engineering Categorization of Functions

Risk Sensitivity Study

IDP Review and Approval

SSC Categorization The manner in which each of these steps was implemented for the categorization of SSCs in the EN and GK systems for WCGS are discussed in the following sections. The process used for the GK and EN systems, as described in the following sections, is the basis for implementation of 50.69 for other systems at WCGS.

3.1 ASSEMBLY OF PLANT-SPECIFIC INPUTS Section 3 of the NEI 00-04 guidance discusses process for the collection and assessment of the necessary inputs to the risk-informed categorization process to fulfill the requirements of paragraphs 50.69(b)(2)(ii) and (iii) and 50.69(c)(1)(i). This includes design and licensing information, PRA analyses, and other relevant plant data sources, as well as the critical evaluation of plant-specific risk models to assure that they are adequate to support this application.

WCNOC Implementation The WCNOC assembly of plant specific inputs followed the guidance, without exception, in Section 3 of NEI 00-04. The details of the implementation are described in the following paragraphs.

The sources of information related to the plant design and operation that are used as inputs in the WCGS SSC categorization process are listed in Table 3-1. The intent of Table 3-1 is to show that all of the inputs to the 50.69 categorization are controlled processes at WCGS and have administrative procedures to define the control processes.

WCAP-16308-NP July 2006 Revision 0

3-2 Design Basis Maintenance Rule Adequacy of PRA Results Operational PRA Preliminary Engineering I J Preliminary Component Safety Categorization of Functions 1H Significance Assessment RISC-3/4 Components ,

Study

(

I IDP Review and Approval SSC Categorization HSLSS .

All Components in Components Pathway HSS S I _, , Optional Detailed Engineering

, Review of HSS Components Figure 3-1 Risk-Informed Categorization Process (Adapted from NEI 00-04)

WCAP-16308-NP July 2006 Revision 0

3-3 Table 3-1 Design and Operational Inputs to the WCGS Categorization Process Inputs Controlled Process Admin Procedure Asset Management List V "

Tag Numbers V V Design Basis Functions V V Process and Instrumentation Diagrams (P&IDs) VI V Maintenance Rule Functions V V System Descriptions V "

Risk Informed ISI V V Probabilistic Risk Assessment (PRA) V V Individual Plant Examination for External Events (IPEEE) V V Safe Shutdown Pathway Determination V/ V/

The identification of the components in each system is taken from the WCGS Asset Management List which identifies all of the safety-related and non-safety-related SSCs in the plant, including identification of augmented quality SSCs. The Asset Management List includes a component identifier (i.e., Tag Number), the associated system, component type, component description, and safety class. All components in the WCGS are identified by a unique Tag Number that identifies the system to which the component belongs, the type of component (e.g., check valve) and its unique identifying number.

For each system categorized, all components in the Asset Management List with a system identifier (asset tag) matching the system being categorized are included in the scope of each system categorization.

Thus, the Asset Management List serves as the definition of the system boundaries for 50.69 assessments.

As part of the process, all system components belonging to the selected system are identified on the P&IDs associated with the associated system to further validate the Asset Management List. This mapping of components to the P&IDs also serves to familiarize the engineering staff doing the preliminary categorization with the location of the component in the system to facilitate the functional mapping described below.

The WCGS Maintenance Rule (MR) functions and Design Basis (DB) functions are used to define a set of active functions for use in the 50.69 categorization of a system. These functions are later used in the component mapping process.

The system descriptions for the associated systems are then used to assist in the identification of the "flow paths" on the P&IDs that represent each of the system functions.

The WCGS model used for this analysis was the 1998 internal events model, called Revision 4 (Reference 5). The results have been provided as input to this assessment. The Individual Plant Examination for External Events (IPEEE), has been used for the fire, seismic, other external events risk assessments (Reference 6). The shutdown risks are taken from the safe shutdown equipment list.

WCAP-16308-NP July 2006 Revision 0

3-4 The PRA input used for the RISC of the components in the EN and GK systems has not been updated to reflect the findings of the PRA peer review nor other quality assessments as described in Regulatory Guide 1.200. Thus, a separate submittal related to the PRA technical adequacy will be made by WCNOC, when the decision is made to implement 50.69, to satisfy the PRA requirements of 50.69. However, the input from the 1998 PRA model is adequate to define the categorization process to be used at WCGS.

Following the completion of any PRA modifications that are required to meet the PRA technical adequacy requirements for use in the proposed 10 CFR 50.69 categorization, the present RISC results, which reflect the risk insights from the current PRA, will be updated as appropriate to assure that the results of the categorization process reflect the updated PRA.

3.2 SYSTEM ENGINEERING ASSESSMENT Section 4 of the NEI 00-04 guidance discusses the requirements for the initial engineering evaluation of a selected system to support the categorization process to fulfill the requirements of paragraph 50.69(c)(1)(i). This includes the definition of the system boundary to be used and the components to be evaluated, the identification of system functions, and an initial mapping of components to functions. The system functions are identified from a variety of sources including design/licensing basis analyses, Maintenance Rule assessments and PRA analyses. The mapping of components is performed to allow the correlation of PRA importance measures to system functions.

WCGS Implementation The WCNOC system engineering assessment followed the guidance, without exception, in Section 4 of NET 00-04. The details of the implementation are described in the following paragraphs.

Definition of System Boundaries Preliminary system boundaries were determined from the system component list for each system provided from the WCGS Asset Management List. Any component on the Asset Management List with a system identifier matching the system being categorized (i.e., EN or GK) is included within the scope of the system categorization. The major components on the system equipment list are located on the system P&IDs to further verify the list.

Any discrepancies between the system equipment list and the system diagrams are resolved before proceeding further. For example, a limited number of components may be included on the Asset Management List that are not on the system P&IDs. In many cases, these components are piece parts of components already identified on the P&IDs. Congruence between the two sources of information is sought in all cases to validate the Asset Management List. The Asset Management List for the system is further verified, and modified if necessary, as part of the mapping process described below. This list serves as the definition of the system boundaries for this system categorization.

WCAP-16308-NP July 2006 Revision 0

3-5 The system boundaries where components within the system being categorized interface with another system are especially important. In some cases, these interfacing components cannot be completely categorized because their impact on the interfacing system is unknown at the time of categorization of the system to which they are assigned based on their tag numbers. Some examples include:

Electrical components may not be completely categorized where the isolation device is not part of the system being categorized. In this case, the impact of a failure of the component in the system being categorized on the remainder of the electrical system cannot be determined. This can apply to power circuits, control circuits and instrumentation circuits. In cases where the isolation device can be identified, even though it is not part of the system being categorized, the assessment can be completed, but the basis for the importance of the isolation device must be documented and carried forward to the categorization of the interfacing system.

In certain instances, the component tag may indicate that the component belongs to the system being categorized, but it is really part of a support or interfacing system. An example of this is the support system piping connected to heat exchangers. When the heat exchanger is part of the system being categorized, some of the piping and instrumentation associated with the interfacing system side of the heat exchanger may also be assigned to the system being categorized even though it more appropriately belongs to the interfacing system. The impact of the failure of those components on the system being categorized can be assessed and documented but the overall categorization of the component may not be able to be completed until the interfacing system is categorized. In this case, the component would at its original classification until the impact on the interfacing system could be determined.

In certain instances, the failure of a component in the system being categorized may be postulated to result in a failure of an interfacing system. If the importance of an interfacing system is not known at the time of categorization of the system under consideration, the impact of the failure of the component on the other system may not be able to be determined. An example is the failure of an air-operated solenoid in one system that results in a degraded condition in the air system where the impact of the degradation cannot be determined at the time of categorization of the air-operated valve.

In each of these cases, two options for proceeding with RISC are available:

Complete the assessment of the impact on the interfacing system, or Leave the component categorization unchanged until the categorization of the interfacing system is undertaken.

In the latter case, the component remains at its previous safety level (e.g., a safety-related SSC would remain RISC-1) until the interfacing system categorization is completed. A note would be generated to identify that the component had been identified as a candidate RISC-3 component with respect to the system to which it belongs (per its tag number), but would also have to be categorized as RISC-3 with respect to its impact on the supporting system.

WCAP- 16308-NP July 2006 Revision 0

3-6 There is typically no systematic process to identify the boundaries between the components in the system being categorized and the support systems that interface with a component. Support systems include electrical power, control power, instrumentation, cooling water and compressed air. This identification must be individually performed for each applicable component to identify the isolation device, if one exists, that prevents a failure in the system being categorized from impacting the support system, and whether that isolation device is part of the system being categorized. If an isolation device can be identified and the isolation device is not part of the system being categorized, then the categorization can still proceed but the importance of the isolation device is recorded for any future categorization of the system to which the isolation device belongs.

Identification of Active System Functions The system functions from the Maintenance Rule are compared to the Design Basis functions for the WCGS. Differences normally exist between the two sources and are primarily a result of the different objectives of the Maintenance Rule and Design Basis programs. The Design Basis functions identify the high level requirements for plant operation or safety that a system needs to fulfill. The Maintenance Rule functions are designed to track SSC performance according to the functions that a group of SSCs would perform. All differences between sources are noted and resolved to establish a comprehensive list of active functions that reflect both the Maintenance Rule and the Design Basis functions.

The purpose of defining functions for the 50.69 categorization process is to permit the determination of the safety significant of the function with the understanding that the safety significance of the components that support that function is categorized the same as the function. This simplifies the categorization task in that each component does not have to be examined individually. The subsequent mapping of components to functions ensures that each system component has at least one associated system function.

Thus the methodology provides the opportunity to define the appropriate functions for the 50.69 categorization as illustrated in the examples discussed below.

In the assessment of the EN and GK systems, the Maintenance Rule functions were used as the active component functions since these were found to cover all of the Design Basis functions. In one case, Maintenance Rule function GK-04, "Provide conditioned environment for cable spreading rooms, access control, and other areas of Control Building," covered four design basis functions:

The control building supply system functions to provide conditioned outside air for ventilation and cooling to each level of the control building.

The access control A/C system functions to provide a suitable environment for personnel comfort.

0 The counting room cooling coil and fan coil unit function to provide a suitable environment for personnel and equipment located in the counting room.

The Security Access Secondary (SAS) room A/C system functions to provide a suitable environment for personnel and equipment located within the SAS room.

The design basis intent was for air from the control building supply system to be supplied to the space above the access control area to remove the heat generated by the Class 1E power cables. This cooling is WCAP-16308-NP July 2006 Revision 0

3-7 provided to minimize the amount of cooling required for the spaces below. This function also isolates on receipt of Control Room Ventilation Isolation Signal. The functional pathway is from the outside air intake through the Control Building Supply Air Unit to various heat exchangers and areas throughout the Control and Auxiliary Building. Based on engineering judgment, it was determined that none of the four individual Design Basis functions would be categorized differently if they were considered separately.

Therefore, only the single Maintenance Rule function was carried forward in the assessment. If one of the four functions would be determined to be safety significant, then either all four would be categorized as safety significant or they could have been split into the four Design Basis functions and assessed individually. The initial combining of the functions is conservative in terms of the categorization.

In addition to the active functions defined using the process previously described, additional functions can be identified to further facilitate the categorization process where it is known that certain groups of components do not support any of the previously defined Maintenance Rule or Design Basis functions. If it can be shown that the failure of the components mapped to these new functions would not fail or significantly degrade any of the other functions to which they share a functional flow path, then the definition of additional functions simplifies the categorization process to the extent that these components may be considered as a group rather than individual exceptions to the previously defined active functions.

Examples of additional active functions are:

Provide system vent and drain capability - Vent and drain lines are typically 1 inch lines connected to the major system piping to facilitate maintenance activities.

Provide alarm and indication - Any alarm or indication that is determined to support a safety significant operator action would not be included in this function. All other components that provide alarm and indication would be included based on the rationale that they simply provide information or status of the plant condition.

Provide instrumentation isolation - Instrumentation lines are typically small piping less than one half inch in diameter and contain isolation root valves.

These new functions are categorized in the same way as the other functions, as described in succeeding sections.

Mapping of Components to Active Functions Mapping system components to active functions allows the risk categorization results to be applied to components that would otherwise not have risk information available to properly assess their risk significance. All components are mapped to at least one active function. Components may have more than one active function.

The mapping of system components to active functions is done by using both the component list and P&IDs from WCGS and the active functions developed for the 50.69 implementation as discussed above.

The first step in the mapping process is to identify the major pieces of equipment (e.g., pumps, isolation valves, and heat exchangers) required to support each active function. These major pieces of supporting equipment were identified in the Maintenance Rule program, the design basis documentation, or the plant system descriptions. After the major components of each function were identified, the system P&IDs, or WCAP-16308-NP July 2006 Revision 0

3-8 other drawings or schematics (e.g., electrical schematics) were then used to physically draw a functional flowpath of the function, from start to finish. This process identifies all components along the supporting flowpath of each function. In some cases, a function only applies to a set of components sharing some common attributes (e.g., system isolation) and therefore would not be associated with a flowpath. All components are then mapped to all functional flowpaths they support as identified on the P&IDs. For some function groupings (e.g., instrument isolation valves), there is no functional flowpath and the components are mapped to the groupings based on the component description or component type label in the database. This does not require association with the P&IDs.

In some cases, component may not appear on the P&IDs because they are either piece parts of a larger component or are not typically included on the drawings. These components are mapped to functions by associating them with other components based on component description or name. For instance, a motor or limit switch for a given motor operated valve will be linked to the same active functions as the motor operator based on the associated valve name or description. The process continues until all components are mapped to at least one active function or grouping.

At this point of the process it is important for every component to be mapped to at least one active function and for each component to be included with all active functions that it supports. The system P&IDs are studied to identify components that have not been mapped. The rationale applied to these components differs based upon the inclusion of each identified component on the system equipment list.

Components found on the P&IDs that are not included on the system equipment list are closely scrutinized to decide if these components belong to the system being analyzed. If the components should be included within system bounds, the component is added. If a component that has not been mapped is included on the system original component list, the active system functions are reviewed and modified if necessary to include the component. If the component cannot be mapped to an identified active function, an active function is added to group components that support a similar function. This process continues until all components are accounted for.

The marked-up P&IDs are included with the IDP package to be used as a tool to facilitate the review of components associated with each function. A listing of the components mapped to each function is also provided for IDP review and approval.

3.3 COMPONENT SAFETY SIGNIFICANCE ASSESSMENT Section 5 of the NEI 00-04 guidance discusses the use of the plant-specific risk information to identify components that are candidate safety significant to fulfill the requirements of paragraph 50.69(c)(1)(ii).

The process includes consideration of the component contribution to full power internal events risk, fire risk, seismic risk and other external hazard risks, as well as shutdown safety.

WCGS Implementation The WCNOC component safety significance assessment followed the guidance in Section 5 of NEI 00-04, except for the PRA technical adequacy requirements. Per 50.69 (c)(l)(ii), the fulfillment of the PRA technical adequacy requirements will be discussed in a separate submittal in order to gain full NRC approval for implementation of 50.69 at WCGS. The details of the implementation are described in the following paragraphs.

WCAP- 16308-NP July 2006 Revision 0

3-9 For the WCGS, the following PRA assessments are used in the categorization process:

0 The Internal Events At-Power risk assessment uses the quantitative PRA Model, 0 The Fire Initiating Event risk assessment uses the qualitative fire risk assessment based on the EPRI FIVE screening tool to define a set of safe shutdown components and pathways, 0 The Seismic Initiating Event risk assessment uses the qualitative seismic risk assessment based on the SMA approach to define a set of safe shutdown components and pathways, 0 Other External Events risk assessment uses the qualitative external events risk assessment that includes high wind and tornado initiated events to define a set of safe shutdown components and pathways, 0 Shutdown Initiated Events risk assessment uses the qualitative shutdown risk assessment based on the identification of safe shutdown pathways from the safe shutdown equipment list.

Internal Events Assessment The risk assessment of internal initiating events is based upon the WCGS At-Power PRA Model. The 1998 PRA model is used for the current categorization of the study of the EN and GK Systems. This PRA does not meet the PRA technical adequacy requirements described in NEI 00-04. Therefore the results of the categorization of these two systems using the process described in this document will not be implemented until the risk significance of components can be validated using against PRA models that meet the PRA technical adequacy requirements in NEI 00-04. However, the process described in this report for using the PRA results in the categorization process will be applied to any system for which the proposed 50.69 categorization process is being implemented.

WCNOC uses the WinNUPRA PRA model calculator (Reference 7) to evaluate component importance from the PRA model. Components that are modeled in the PRA with failure modes that are above the truncation limit established for the WinNUPRA PRA model calculator are evaluated based on the safety significance criteria established in NEI 00-04. Additional components modeled in the PRA that fall below the truncation limit and components not modeled in the PRA are not evaluated to the internal events assessment criteria since their risk importance associated with the internal events analysis is assumed to be sufficiently low that their risk importance will be certainly be low. The CDF and LERF truncation limit to be used for establishing the risk importance of components and functions for implementation of 50.69 will be 1.0 E-10 per year.

NEI 00-04 provides the guidance for evaluating component importance. The Fussell-Vesely (FV) values for each modeled basic event of a given component are summed together and evaluated against the acceptance criterion of 0.005. If the sum of the basic event FV values is greater than 0.005 for a component, then it is categorized as high safety significant (HSS). The Risk Achievement Worth (RAW) for each modeled basic event of a given component is reviewed to determine the maximum value. If the maximum value of RAW for a basic event for a component is greater than 2, then the component is categorized as HSS. Finally, the maximum common cause failure (CCF) RAW portion of the component failure mode is compared against an acceptance criterion of 20, as discussed in NEI 00-04. If the sum of WCAP- 16308-NP July 2006 Revision 0

3-10 the FV values for the basic events for a component is less than 0.005, the maximum RAW value for the basic events is less than 2, and the common cause failure RAW value is less than 20, then the component is identified as low risk significant and is then a candidate low safety significant (LSS) component.

This ranking is then applied to all active functions that the component supports. However, not all failure modes for a given component apply to all active functions. Care is taken at this point of the analysis to apply the safety significance of a component failure mode to active functions where the same component failure mode is applicable. The preliminary component mapping is closely reviewed when assigning safety significance. For example, if a valve is required to open to support a function, then only basic events that would result in the valve failing to open should be included in the FV, RAW and CCF RAW assessments.

In cases where the PRA importance measures fall just below the cut-off values for high versus low safety significance, the component is categorized as low safety significant, but the close proximity of the RAW or FV is highlighted for the IDP consideration. This is considered important information for the IDP because one of the overall goals of the categorization process is to assure stability of the categorization results as changes to the PRA model are made to reflect future operating experience and PRA model improvements. One school of thought is that the components whose RAW or FV is just below the acceptance criteria are the most likely to change from low safety significant to high safety significant. By highlighting the close proximity of the RAW and FV to the acceptance criteria to the IDP, an informed, measured decision can be taken.

As specified in NEI 00-04, a series of sensitivity assessments are also performed for any quantitative model used. The purpose of the sensitivities is to identify any significant changes in the PRA results (i.e., component FV or RAW values) when PRA models and assumptions that may have large uncertainties are varied over a reasonable range of values. Should a component exceed the HSS criteria for either FV, RAW or CCF FAW based on one or more sensitivity study then the results are highlighted to the IDP members for their consideration. While all of the sensitivity results are presented to the IDP, this highlighting is meant to focus IDP attention on these components.

The following is a list of the sensitivity studies required by NEI 00-04 for each quantitative model, with some additional studies required based on the findings from the PRA technical adequacy assessment:

Increase all human error basic events to their 95th percentile value

Decrease all human error basic events to their 5th percentile value

Increase all component common cause events to their 95th percentile value

Decrease all component common cause events to their 5th percentile value

Set all maintenance unavailability terms to 0.0

Any applicable sensitivity studies identified in the characterization of PRA adequacy The human error sensitivities are performed by using the error factor assigned to the human error probabilities (HEP) from the PRA model to determine the 5th and 95th percentile values. This applies to all HEPs in the PRA model and just not those HEPs that may be associated with the systembeing categorized. Similarly, the 5th and 95th percentile values for common cause failure for components are also derived from the error factors used on the common cause model in the PRA. As in the case of the WCAP-16308-NP July 2006 Revision 0

3-11 HEPs, the CCF is changed for all components modeled in the PRA. The maintenance unavailability for components is set to zero for all components modeled in the PRA simultaneously.

Since PRA technical adequacy has not been addressed prior to this initial categorization, no additional sensitivity studies were identified. If additional sensitivity studies are identified during the technical adequacy review of the PRA, they would be included in future the categorization processes.

Fire Risk Assessment The WCGS fire risk assessment is based upon an evaluation of the risk importance using the FIVE methodology. Following the completion of the technical adequacy assessment for the at-power internal events PRA, a review of the FIVE assessment will be completed to assure that it is consistent with the at-power internal events PRA and represents the current plant design and operation. Therefore, the process for using the FIVE results is described in this section. The results of the categorization for the EN and GK Systems will be re-visited when the quality of the FIVE assessment is completed.

The results of the FIVE assessment are provided in the WCGS IPEEE. Qualitatively, each area or zone of the plant is evaluated to determine its susceptibility to a fire scenario. If a zone is not susceptible, then the zone is screened out of the FIVE analysis and considered low risk. If a zone is susceptible, the zone becomes part of a screened scenario which prompts a quantitative assessment of that particular zone.

Section 5.2 of NEI 00-04 provides the guidance for evaluating fire risk when using the FIVE assessment.

If a component participates in an unscreened event it is identified as a candidate safety significant component. If a component participates in a screened event it may also be potentially safety significant unless not crediting the component will not result in its associated scenarios becoming unscreened. The EN and GK Systems were reviewed to determine which components would support these scenarios.

If a quantitative fire PRA model that meets applicable quality standards is developed for WCGS in the future, the fire risk assessment guidance would be similar to that described for the internal initiating events assessment. The results of the fire risk assessment would be combined with other quantitative risk assessment results in an integral assessment to assess the overall risk impact. Section 5.2 of NEI 00-04 provides guidance for using the quantified fire PRA model. Sensitivity studies similar to those presented above for the internal events would be performed using the fire PRA model, with the addition of a study with no credit for manual suppression.

Seismic Risk Assessment The WCGS seismic risk assessment was performed using the seismic margins analysis (SMA) approach.

The results of the SMA are the Safe Shutdown Equipment List (SSEL) documented in Table 3.6 of the WCGS IPEEE. The SSEL identifies all supporting components required to achieve a safe shutdown as determined by the SMA. Section 5.3 of NEI 00-04 provides the guidance for evaluating the seismic risk when using the SMA. If a component supports the safe shutdown path then it must be considered HSS.

The EN and GK Systems were reviewed to determine which components would support these functions.

Following the completion of the technical adequacy assessment for the at-power internal events PRA, a review of the SMA assessment will be completed to assure that it is consistent with the at-power internal WCAP-16308-NP July 2006 Revision 0

3-12 events PRA and represents the current plant design and operation. Therefore, the process for using the SMA results is described in this section. The results of the categorization for the EN and GK Systems will be re-visited when the quality of the SMA assessment is completed.

If a quantitative seismic PRA model that meets applicable quality standards is developed for WCGS in the future, the seismic risk assessment guidance would be similar to that described for the internal initiating events assessment. The results of the seismic risk assessment would be combined with other quantitative risk assessment results in an integral assessment to assess the overall risk impact. Section 5.3 of NEI 00-04 provides guidance for using the quantified seismic PRA model. Sensitivity studies similar to those presented above for the internal events would be performed for the seismic PRA model, with the addition of a study using correlated fragilities for all SSCs in an area.

Other External Risks Assessment The WCGS IPEEE has considered both high winds and flooding as external events that could also affect plant risk. NEI 00-04 states that the safety significance of components related to other external events should be evaluated similar to the qualitative seismic risk assessment by determining whether or not components support the safe shutdown path. The EN and GK Systems were reviewed to determine which components would support these functions.

Following the completion of the technical adequacy assessment for the at-power internal events PRA, a review of the external events assessment will be completed to assure that it is consistent with the at-power internal events PRA and represents the current plant design and operation.

If a quantitative PRA model for other external events that meets applicable quality standards is developed for WCGS in the future, the applicable external events risk assessment guidance would be similar to that described for the internal initiating events assessment. The results of the external events risk assessment would be combined with other quantitative risk assessment results in an integral assessment to assess the overall risk impact. Section 5.4 of NEI 00-04 provides guidance for using the quantified other external events PRA model. Sensitivity studies similar to those presented above for the internal events are to be performed for the other external events PRA model, as well.

Shutdown Risks Assessment For a qualitative shutdown risk assessment, it is important to identify the key safety functions and the components that support those functions. The key safety functions are; decay heat removal, inventory control, power availability, reactivity control and containment. The EN and GK Systems were reviewed to determine which components would support these functions. Also, the Safe Shutdown Equipment List (SSEL) from the IPEEE was reviewed to identify the list of equipment required to support safe shutdown (although this is redundant to the seismic risk assessment using the SMA methodology). Components that support any of the key safety functions or are listed on the SSEL are considered safety significant.

One final consideration for all other components is whether or not the component could initiate a shutdown accident condition requiring mitigation.

WCAP-16308-NP July 2006 Revision 0

3-13 Following the completion of the technical adequacy assessment for the at-power internal events PRA, a review of the shutdown assessment will be completed to assure that it is consistent with the at-power internal events PRA and represents the current plant design and operation.

If a quantitative PRA model for shutdown events that meets applicable quality standards is developed for WCGS in the future, the applicable shutdown risk assessment guidance would be similar to that described for the internal initiating events assessment. The results of the shutdown risk assessment would be combined with other quantitative risk assessment results in an integral assessment to assess the overall risk impact. Section 5.5 of NEI 00-04 provides guidance for using the quantified shutdown PRA model.

Sensitivity studies similar to those presented above for the internal events would be performed for the shutdown PRA model.

Integral Assessment When multiple quantitative risk results are available for a given component, an integral assessment is required to provide an overall assessment of the risk importance. The integral assessment weights the importance from each risk contributor by the fraction of the total core damage frequency of that contributor.

This step is not necessary at present because the internal events PRA model is the only source of quantitative risk insights. However, if quantitative PRA models for fire, seismic, external events or shutdown are developed for WCGS in the future, the integral risk assessment would be performed using the methodology described in the Section 5.6 of NEI 00-04.

3.4 DEFENSE-IN-DEPTH ASSESSMENT Section 6 of the NEI 00-04 guidance discusses the process to assure that defense in depth is maintained for safety-related components that are found to be low safety significant to fulfill the requirements of paragraph 50.69(c)(1)(iii). The process includes consideration of defense-in-depth related to core damage, large early release and long term containment integrity.

For functions identified as being safety-related and candidate low safety significant after the quantitative and qualitative risk assessment results are considered, defense-in-depth must be considered. If D-I-D is found to be maintained, then the candidate low safety significance may be considered. If defense-in-depth (D-I-D) cannot be shown to be maintained, the function (and its associated components) would be considered potentially high safety significant.

WCGS Implementation The WCNOC defense in depth assessment followed the guidance, without exception, in Section 6 of NEI 00-04. The process was applied in a straight-forward manner and no additional clarification of the implementation process is required.

In cases where any of the defense in depth considerations was not maintained according to the NEI 00-04 process, the component/function was categorized as candidate high safety significant. If all of the considerations were met (i.e., defense in depth was maintained), then the component or function was WCAP-16308-NP July 2006 Revision 0

3-14 identified as candidate low safety significance. In cases where components or functions are identified as safety significant because of defense in depth considerations, the safety significant attributes are defined by identifying the performance aspects and failure modes of the SSC that contribute to it being safety significant.

3.5 PRELIMINARY ENGINEERING CATEGORIZATION OF FUNCTIONS Section 7 of the NEI 00-04 guidance discusses the process of integrating the results of the Component Safety Significance Assessment and Defense-In-Depth Assessment tasks to provide a preliminary categorization of the safety significance of system functions to fulfill the requirements of paragraph 50.69(c)(1)(ii).

WCGS Implementation The WCNOC system engineering assessment followed the guidance, without exception, in Section 7 of NEI 00-04. The details of the implementation are described in the following paragraphs.

Any function/SSC that was determined to be potentially high safety significant from the internal events PRA-based safety significance assessment is assigned HSS. If the function SSC was found to be low safety significant from the internal events PRA, but high safety significant from fire, seismic, external events or shutdown risk assessments, then the results of this assessment, along with the integral PRA assessment results are documented and presented to the IDP for final categorization. Similarly, if the function SSC was found to be low safety significant from the internal events PRA, but the defense in depth or the PRA sensitivity studies identified that the function/SSC is potentially safety significant then the results and their basis are identified to the IDP for their consideration. All other functions/SSCs are preliminarily assigned candidate low safety significance and the basis for that determination is documented.

Once a system function is identified as safety significant, then all components that support this system function are assigned a preliminary safety significant categorization. Due to the overlap of functions and components, a significant number of components support multiple functions. In this case, the SSC (or part thereof) is assigned the highest risk significance for any function that the SSC or part thereof supports. All preliminary categorization results are then presented to the IDP for review and final categorization.

For safety significant functions/SSCs, the critical attributes that make the function/SSC safety significant are identified and used as input to the treatment redefinition process. Critical attributes are to include high level features of the SSCs that contribute to the safety significance of the function, such as provide flow, isolate flow, etc.

The results of the compilation of risk information and safety significant attributes are documented for the IDP. Figure 7-2 from NEI 00-04 was used for the WCGS assessment.

WCAP-16308-NP July 2006 Revision 0

3-15 3.6 RISK SENSITIVITY STUDY Section 8 of the NEI 00-04 guidance discusses the process of determining the risk sensitivity of the categorization results in terms of changes in risk. This risk sensitivity is an integral assessment and considers the potential impact of the categorization for all systems to which 50.69 is applied. This risk sensitivity fulfills the requirements of paragraph 50.69 (b)(2)(iv) and 50.69(c)(1)(iv).

WCGS Implementation The WCNOC system engineering assessment followed the guidance, without exception, in Section 8 of NEI 00-04. The details of the implementation are described in the following paragraphs.

The risk sensitivity study was not performed due to the nature of modeling the EN and GK systems in the PRA. The PRA results only identified a select number of components, all of which met the criteria for HSS. Thus, there was no need to perform the sensitivity study for these systems. However, this section describes the approach that will be used in future system evaluations.

The final step in the process of categorizing SSCs into risk-informed safety classifications would involve the evaluation of the bounding possible change in risk if the unreliability of all RISC-3 SSCs simultaneously increases by a significant amount. Increasing the unreliability of all low safety significant SSCs by a factor of 3 to 5 provides an indication of the bounding change in risk (CDF and LERF) if there were a degradation in the performance of all low safety significant SSCs. The basic events for both random failure events and common cause events would be increased for failure modes of the component relevant to the function being considered. The increase in the common cause failure rate would occur as a result of the increase in the basic event failure rate from which the common cause failure rate is determined.

In identifying the specific factor to be used in the risk sensitivity study, two considerations should be addressed. The first factor is the cumulative risk increase that would be computed if the unreliability of those SSCs were assumed to simultaneously increase by that factor. That is, the factor used can not lead to exceeding the quantitative acceptance guidelines of Reg. Guide 1.174. The second factor is the ability of a monitoring program to detect a change of that factor. This includes consideration of: a) the currently expected number of failures for the number of demands/hours of operation, and b) the expected number of failures for the expected future number of demands/hours of operation for the population of SSCs that are expected to be classified as low safety significant.

WCNOC proposes to use a factor of 3 for the increase in unreliability of RISC-3 SSCs in this assessment.

The corrective action requirements of 50.69 (d)(2)(ii) would result in an early determination of degraded performance of a RISC-3 SSC such that an increase in unreliability by a factor of 3 would not be likely to occur for any single RISC-3 component. The simultaneous increase in unreliability for all RISC-3 SSCs is considered to be an incredible event.

When system PRA information is available for a specific system, this sensitivity study would be performed for each individual plant system as the categorization of its functions is provided to the IDP.

This is not a requirement of NEI 00-04, but rather would be preformed to provide additional information to the IDP. Thus, a sensitivity study would be performed for the system, and a cumulative sensitivity WCAP-16308-NP July 2006 Revision 0

3-16 would be performed for all the SSCs categorized (past and present) using this process. This would provide the IDP with both the overall assessment of the potential risk implications and the relative contribution of each system.

These sensitivity studies will be re-visited when the IDP has completed its final categorization for a given system to assure that the conclusions regarding the potential aggregate impact have not changed.

3.7 IDP REVIEW AND APPROVAL Section 9 of the NEI 00-04 guidance discusses the Integrated Decision-making Panel for determining the final RISC classification for each of the system functions and/or components. The IDP fulfills the requirements of paragraph 50.69 (c)(2).

WCGS Implementation The WCNOC IDP followed the guidance, without excepiion, in Section 9 of NEI 00-04. The details of the implementation are described in the following paragraphs.

The WCGS IDP makes the final determination on SSC categorization. The IDP is responsible for oversight of the categorization process, review and approval of SSC categorization, and procedure and working practice development. The pilot IDP was directed in accordance with the draft WCNOC 10 CFR 50.69 IDP Duties and Responsibilities procedure. The procedure is currently a draft procedure because the feedback from its use in the pilot IDP activities will be used to finalize the procedure prior to further usage.

IDP Selection The WCGS IDP serves as a review and approval group for §50.69 Program activities. The panel reports to the WCNOC Manager of Nuclear Engineering. The IDP is composed of members recommended by respective Division Managers and the §50.69 Program Coordinator. The following functional expertise is specified in the WCGS IDP draft procedure:

Plant Operations (SRO qualified),

Safety Analysis (Emphasis on plant design),

System Engineering (the system engineer for the system being reviewed by the IDP),

Licensing, and

Probabilistic Risk Assessment (PRA)

According to the IDP procedure, a chairperson is designated as a member of the §50.69 IDP. The chairperson is not required to represent 1 of the 5 required functional areas. In addition, the procedure recommends that a member from the Maintenance Rule functional area be included. For the Pilot IDP, the member representing the Licensing function also had Maintenance Rule experience.

As a result of the IDP session for the EN and GK systems, WCNOC has determined that a member from the Licensing group will not be required for future IDPs. The rationale is that Licensing provides little or no additional input in the categorization of SSCs. Important licensing issues, such as licensing WCAP-16308-NP July 2006 Revision 0

3-17 commitments, are already well known by the systems engineer and/or the safety analysis engineer. Also, Licensing is not a required discipline for the IDP in NEI 00-04, Revision 0.

The IDP members are expected to represent the views and opinions of their respective department.

Members may be experts in more than one field; however, excessive reliance on any one member's judgment should be avoided. Each member is responsible for reviewing the categorization information relative to their area of responsibility, including:

Plant Operations - Use of system components in Abnormal and Emergency Operating Procedures, System Operating Procedures, and Severe Accident Management Procedures.

Safety Analysis - Use of system components in design and/or licensing basis analyses.

Systems Engineering - System design basis, system functions and system health report. Also, the occurrence of system components in event or inspection reports, licensing commitments and other licensing documentation Licensing - Occurrence of system components in event or inspection reports, licensing commitments and other licensing documentation.

Probabilistic Risk Assessment -The representation of the system and system components in the plant PRA model and relevant risk importance and uncertainties for the system components.

Training of IDP Members All members of the IDP received training regarding their responsibilities and the §50.69 categorization process. The WCNOC IDP training uses Pressurized Water Reactor Owners Group 10 CFR 50.69 Pilot Program IDP Training Wolf Creek Generating Station.

All members of the IDP will receive refresher training every three years or whenever plant personnel who received the initial training have not served on an active IDP in the past 18 months. Records of training for the IDP are maintained in accordance with WCNOC training requirements.

Members of the WCNOC IDP were trained prior to the IDP sessions for the EN and GK systems. The training focused on the background and rationale needed for each member of the IDP. Introductory discussion of the proposed §50.69 rule included discussion of special treatment exemptions, key requirements, key §50.69 program documents, Risk-Informed Safety Classifications (RISC),

categorization guiding principles and an overview of the categorization process. The NEI 00-04 categorization process and the ASME Code Case N-660 categorization processes were discussed to introduce the preliminary categorization completed prior to the IDP. WCGS PRA adequacy and relevant PRA results were presented to provide a summary of the information that is in the PRA model for use in the categorization process. Once the background was discussed, IDP scope, responsibilities, and process were presented. The active component categorization training included RISC-3 considerations for risk analysis, defense-in-depth, and additional considerations for some candidate LSS components. Passive categorization training focused on ASME Code Case N-660 considerations using defense-in-depth for medium and low consequence category SSCs and aging and condition monitoring. Training was WCAP-16308-NP July 2006 Revision 0

3-18 concluded with a discussion of the new categorization considerations based on changes in ASME Code Case N-660 and NEI 00-04 resulting from the WCGS IDP from December 2003.

The IDP understood that the PRA information, upon which the categorization results that the IDP was being asked to review and make decisions, would be updated at some future time before implementation of 50.69, as required by the rule. The IDP members also understood that for this unique case, the IDP would be re-convened after: 1) the PRA technical adequacy requirements were assessed according to NEI 00-04, 2) the necessary PRA updates were completed, and 3) the categorization results presented at this session were updated to reflect those PRA updates. Therefore, the categorization and IDP decisions discussed in this report describe and validate a process for categorization to be used by WCNOC to comply with the requirements of the 50.69 rule. The categorization results are of secondary importance since they may change when 50.69 is actually implemented at WCGS, using a PRA that meets the technical adequacy requirements of NEI 00-04 and the 50.69 rule.

IDP Decision-making Process The §50.69 Program Coordinator provides material to be reviewed by the §50.69 IDP. The material provided to the IDP will meet the WCNOC quality assurance requirements for basic dispositions.

Sufficient time is allowed for a comprehensive review by the §50.69 IDP members prior to the meeting.

The level of detail to which each member performs technical reviews of the material will be consistent with the member's knowledge and experience. Members are not required to review technical material in detail for areas outside their areas of expertise.

The proposed categorization is presented to the IDP in logical pieces to facilitate the decision-making process. The IDP members discuss the proposed categorization and supply rationale to the process where needed. Each IDP member identifies to the entire IDP any issues related to the system, system components, or functions from their area of responsibility. Following discussion, the IDP chairman calls for a vote on the proposed categorization.

Approval of any recommendation by the IDP requires concurrence by a majority decision of members present. The IDP Chairman votes only to resolve a tie vote. All dissenting opinions are recorded and reviewed by the plant management. If appropriate, plant management has the authority to suspend the IDP decision and require further consideration.

IDP Records A recording secretary is present at all IDP sessions to capture the IDP decisions on each function or SSC as well as the basis for the decision and any other relevant IDP discussions. While the entries at the bottom of the form for active and passive component assessments (e.g., Figure 7-2 of NEI 00-04) provide a summary of the IDP decision and discussion, the IDP minutes are intended to provide a more detailed record of the IDP proceedings.

Per the draft WCNOC 10 CFR 50.69 IDP Duties and Responsibilities procedure, the IDP minutes will be reviewed and approved by each IDP member to verify that the minutes accurately reflect the IDP discussions and any insights derived from the discussions. The IDP minutes and the completed active and passive component will be maintained for the life of the plant in the WCGS document control system.

WCAP-16308-NP July 2006 Revision 0

3-19 3.8 SSC CATEGORIZATION Section 10 of the NEI 00-04 guidance discusses the SSC categorization for determining the final RISC classification for each of the system components. This fulfills the requirements of paragraph 50.69 (c)(2).

WCGS Implementation The WCNOC SSC categorization followed the guidance, without exception, in Section 10 of NEI 00-04.

The details of the implementation are described in the following paragraphs.

Once the preliminary engineering categorization of functions is reviewed by the IDP and the final classification is assigned to each function by the IDP, the final safety significance (either high or low safety significance) is assigned to each active function, as well as all supporting components.

If a component supports a HSS function, then the component will be designated as high safety significant (i.e., either RISC-I or RISC-2 as appropriate). If the component only supports low safety significant functions, then the component may be classified as low safety significant (i.e., either RISC-3 or RISC-4 as appropriate). Thus, if at least one function supported by a component is ranked high safety significant, then the SSC will also be ranked high safety significant, regardless of how many other low safety significant functions it may support.

In the future, WCNOC may perform a more detailed mapping and categorization process to identify SSC ranked high safety significant that may not actually support the critical attributes of the high safety significant function. In this case, the RISC process described above will need to be repeated and another

]DP would be convened to review and approve the modified results.

July 2006 WCAP- 16308-NP WCAP- 16308-NP July 2006 Revision 0

3-20 Risk-Informed Safety Classification - 50.69 Summnar" Report Plant Name - Unit No. SS TEM'ANME S1 A C 7 VE ASSESSMENT SUMMA R Y FUNCTIONID -1,01 - 7-FUNCTION Sample active functionSI for sample system S1.

DESCRIITION See attached sheet for associated components.

A CTI IERISKASSEYSA IENT RilkAssessmentElements Rank Comment I.\7ErV4I.EýlrNT"S ý 1lasi.oritCMrnalIPRArmki.;.

ANAL I.*S 71?LrA1V.4IA 51F5 'IssSs Basis for Ike rank.

SE2SIICANAtL sis S

asilror aceISnic rank.

FLOD!NGANALISIS f J 1a1.s f- "ohlr cteanal evmcn raik.

SqllI TDOS1117VOW IVN Arak FHW iBsis for shutd-n ralk.

ANA'L 1'1S I,\T7EGRI TED RISK I tiss'S Basi foraimgrl ,scmeant.

ASS FWSSIIKAT RIS'AING , iHSSLSS :*

Additional Risk Assesnent Information PII S-VNSIT IT 7T E ] Bsa-si ftr PRA sclsitivilyrank.

ANALYSIS DEfl":AsEINDIEI'TIi [* -j* asifor defense in depth raxdk.

IDI'ANSESSA 'EAT RISK R4INKING RiSK RAINKING BASIS

[i ss/ I BaSiS for the final risk ranking of Active Function ID S1-01.a CRITICAL A7TRIBUTES COMMEATS if risk raiki.g IsItSS. MP asi feordie FSScriticat atricltits.

idetiiliet the critical atrtribotes. ifrik*ran ng I is LS.' thea no allry is icegred.

Date Page X of Y Figure 3-2 Active Assessment Summary Report, Page 1 WCAP-16308 8-NP July 2006 Revision 0

3-21 Risk-Informed Safetv Classification - 50.69 Summary Report Plant Name - Unit No. SISTEMNAAME Si ASSOCIATED COMPONENTS SIFETYCISS COMPONENTID COMPONENTDESVCRIPTION SR SI PJ'UMP-A Mic' ionf.Sl PUMP-A SR SI PUMP-B Description ofSI PUMP-B Date Page X dY Figure 3-3 Active Assessment Summary Report, Page 2 WCAP-16308-NP July 2006 Revision 0

4-1 4 CATEGORIZATION OF PASSIVE FUNCTIONS ASME Code Case N-660 was approved by the ASME Board on Nuclear Codes and Standards in 2002 and issued for trial use. Through its trial use, a number of modifications have been proposed, primarily as a result of trial usage at the December 2003 WCGS IDP. These changes were reflected in the draft revision to Code Case N-660 that was used in the April 2004 IDP at WCGS. Significant changes from the approved version as discussed in Appendix A. All discussion of Code Case N-660 in Section 4 of this report, unless otherwise noted, will refer to Revision 0 as approved by the ASME and endorsed by the NRC.

4.1 SCOPE IDENTIFICATION Code Case N-660 paragraph 1-2.0 requires the definition of the boundaries to be included in the scope of the RISC evaluation and also defines the requirements for Class 1 items.

WCGS Implementation The WCNOC SSC scope identification followed the guidance, without exception, in Paragraph 1-2.0 of Code Case N-660. There was no Class I piping in either the EN or the GK systems. Consistent with the NRC endorsement of Code Case N-660 in Regulatory Guide 1.147, Revision 14, WCNOC will classify all Class I piping as high safety significant, unless changes are endorsed by NRC in further revisions to Regulatory Guide 1.147.

4.2 COMPONENT MAPPING Code Case N-660 paragraph 1-3.0 requires that all pressure retaining items and their supports be evaluated by defining piping segments that are grouped based on common conditional consequences.

WCGS Implementation The WCNOC SSC component mapping followed the guidance, without exception, in Paragraph 1-3.0 of Code Case N-660.

The WCGS RI-ISI program was used as a starting point for identifying the appropriate grouped piping segments for the pressure boundary component assessment, as defined in ASME Code Case N-660. The WCGS RI-ISIS program is a controlled program at WCGS and uses the "EPRI RI-ISI methodology."

WCNOC implemented the RI-ISI program for Class I and 2 piping, including the Class 2 piping in the EN System. Information for these passive piping segments was gathered and used for the Code Case N-660 passive assessment. There was no Class 1 or 2 piping in the GK System, so no RI-ISI information was available for use in the passive categorization of the GK system.

Passive piping segments are runs of piping whose failure would result in nearly identical consequences, including consideration of spatial effects. Room boundaries (walls) are one means used in the RI-ISI program to establish the boundaries of piping segments based on potential differences in spatial effects.

Pumps also establish boundaries of piping segments since the system operating conditions (pressure, flow velocity, etc.) would be different on the suction and discharge sides of a pump. Passive piping segments WCAP- 16308-NP July 2006 Revision 0

4-2 were identified for the system boundaries established by the system equipment list and checked by the active component mapping.

For those piping segments that had not been originally identified in the WCGS RI-ISI program, additional passive piping segments were created based on piping segments having similar failure consequences. The failure consequences are used later in the analysis as part of the passive risk ranking process to determine the consequence categories.

All components with a pressure boundary function were mapped to one of the passive piping segments based on the information gathered for the active component mapping discussed in Section 3 of this report.

All components with a pressure boundary function were mapped to one and only one pipe segment with the exception of those components that are at the boundary between two pipe segments. In this case, the component is uniquely associated with each pipe segment and is assigned the highest safety significance of the two pipe segments. For example, if one pipe segment was classified as high safety significant and the adjacent pipe segment is classified as low safety significant, the component that is the boundary between the two segments would be categorized as high safety significant.

4.3 REQUIRED DISCIPLINES Paragraph 1320 of Code Case N-660 requires that the following disciplines be involved in the classification process:

0 Probabilistic Risk Assessment

Plant Operations 0 System Design

Safety or Accident Analysis Personnel may be experts in more than one discipline, but are not required to be experts in all disciplines.

WCGS Implementation The WCNOC classification process followed the guidance, without exception, in Paragraph 1320 of Code Case N-660.

The WCGS pilot effort satisfied this requirement by having the 50.69 IDP participate in the passive assessment for the EN and GK Systems. Although Code Case N-660 does not require the use of an IDP, the 50.69 rule does require the use of one when implementing N-660 with NEI 00-04.

Figure 4-1 illustrates the content and format of the information used for the IDP review of the WCGS passive assessment. This form was completed for each pipe segment. The form summarizes the results and insights that were generated in the categorization process and identifies the key information that should be communicated to the IDP for use in the decision-making process.

WCAP-16308-NP July 2006 Revision 0

4-3 4.4 CONSEQUENCE EVALUATION Paragraph 1-3.1 of The Code Case N-660 specifies that the potential failure modes for each system or piping segment shall be identified, and their effects shall be evaluated. The results of the failure modes evaluation for each piping system, or portion thereof, shall be classified into one of three impact groups:

piping failures that cause an initiating event, those that disable a system without causing an initiating event, or those that cause an initiating event and disable a system. The consequence category assignment for each piping segment within each impact group shall be selected in accordance with guidance in the Code Case. In assessing the appropriate consequence category, available risk information for all initiating events, including fire and seismic should be considered.

WCGS Implementation The WCNOC consequence evaluation followed the guidance in Paragraph 1-3.1 of Code Case N-660 with the following exception/clarification:

Consideration of fire, seismic, external events and shutdown was also considered in the evaluation.

A discussion of the consequence assessment, including the exceptions to the Code Case, is discussed in the following paragraphs.

For the Wolf Creek assessment, the conditional core damage probability (CCDP) and conditional large early release probability (CLERP) values for those pipe segments previously categorized as part of the RI-ISI program were used as input to determine the consequence ranking. Table 1-5 of Code Case N-660 shows the ranges of HIGH, MEDIUM, LOW, and NONE consequence categories, based on CCDP. For CLERP, the values in Table 1-5 of Code Case N-660 are lowered one order of magnitude. The higher of the CCDP or CLERP ranking category for any given segment was assigned to the segment. For example if the CCDP for a given segment was MEDIUM but the CLERP was LOW, the segment was ultimately assigned a MEDIUM consequence category.

For piping segments that were not part of the WCNOC RI-ISI program and therefore did not have a consequence assessment, the consequence assessment was performed by using Tables I-1 and 1-2 of Code Case N-660. In using Table 1-2 the exposure time to challenge was taken from plant Technical Specification Allowable Outage Times, when the Tech Specs applied to a component in a pipe segment.

Otherwise, an exposure time of "all year" was used.

The RI-ISI consequence assessment only included the CCDP and CLERP from the at-power internal initiating events PRA. Also, only qualitative risk assessments exist for fire, seismic, external events and shutdown at WCGS. Therefore, to capture the risk importance of piping segments from the fire, seismic, external events and shutdown qualitative risk assessments, any piping segment supporting a high risk significant safe shutdown pathway would be a candidate medium safety significant pipe segment. This is equivalent to the active component classification process where active SSCs that support safe shutdown pathways are not automatically classified as high safety significant, but rather are left to the IDP for a final classification.

WCAP- 16308-NP July 2006 Revision 0

4-4 4.5 CLASSIFICATION CONSIDERATIONS Paragraph 1-3.2 of the Code Case N-660 specifies that the Risk Informed Safety Classification is determined by considering the consequence category, in conjunction with other relevant information.

Piping segments determined to be a Medium, Low, or None (no change to base case) consequence category shall be determined HSS or LSS by considering the other relevant information for determining classification. A set of conditions, as detailed in the Code Case shall be evaluated and answered TRUE or FALSE. If any of the conditions are answered FALSE, then HSS shall be assigned. Otherwise, LSS may be assigned.

If LSS has been assigned, then the RISC process shall verify that there are sufficient safety margins to account for uncertainty in the engineering analysis and in the supporting data.

WCGS Implementation The WCNOC consequence evaluation followed the guidance in Paragraph 1-3.2 of Code Case N-660 with the following exceptions and clarifications:

A small break was assumed for some pipe segments based on the low potential for a large break because it carries low pressure and low temperature fluid, Operator actions were credited for isolation of a pipe segments if clear indication of the pipe break is evident in the control room, procedures for isolation of the pipe break are available, and ample time exists for the operators to diagnose and isolate the break, Consideration of fire, seismic, external events and shutdown was also considered in the evaluation, and Some of the considerations have been clarified and/or changed as a result of the trial usage at the December 2003 IDP, as discussed in Appendix A of this report.

The classification considerations as described in ASME Code Case N-660 are used in the WCGS analysis for further classification of segments with a consequence category other than HIGH. If the consequence category as described in the previous section is HIGH, this section does not apply and the piping segment is assigned a high safety significant (HSS) overall ranking. For piping segments with a MEDIUM, LOW, or NONE consequence category, HSS or LSS is determined by the following eleven additional.

considerations from Code Case N-660. The following statements should be answered either TRUE or FALSE with appropriate justification:

1. Failure of the piping segment will not directly fail another high safety significant function.

The intent of this statement is to provide another check that all direct failure consequences have been identified as the result of a pipe segment's failure. The purpose of the consequence evaluation, as described in the previous section, is to determine all failure consequences of a pipe segment's failure. Plant system functions, other than those solely within the system being WCAP-16308-NP July 2006 Revision 0

4-5 evaluated, have already been considered and evaluated. Therefore, this only serves as a final verification that the consequence evaluation considered all impacts on other systems.

Credit was also taken, in some instances, for the detection of leaks and isolation of breaks to prevent the loss of other high safety significant functions. For credit to be taken, alarm functions must be available to alert the operators to the condition and the need to take action to isolate the leak prior to rendering another high safety significant inoperable.

2. Failure of the piping segment will not result in failure of another high safety significant function (e.g., through indirect effects).

The intent of this statement is to consider indirect effects such as pipe whip, jet impingement spray and flooding that could result in the failure of another high safety significant function. For piping segments classified in the risk informed ISI program, the indirect effects assessment from that program, which included a system walk-down, was used as a basis for this assessment. For any systems or pipe segment not classified in a risk informed ISI program, a walk-down should be performed to identify any indirect effects. Information from the systems engineer and a senior reactor operator may be substituted for a plant walk-down. In assessing possible indirect effects, credit may be taken for protective barriers and plant layout to mitigate the effects of possible spatial interactions.

3. Failure of the piping segment will not prevent or adversely affect the plant's capability to reach or maintain safe shutdown conditions.

The intent of this statement is to consider the plant's ability to reach or maintain safe shutdown conditions given failure of the piping segment. Components that support a primary or alternate safe shutdown pathway for WCGS were considered high safety significant.

4. The piping segment does not individually support a significant mitigating or diagnosis function addressed in the Emergency Operating Procedures or the Severe Accident Management Guidelines, with no redundant or alternate means of mitigation or diagnosis.

The WCGS Emergency Operating Procedures (EOPs) and Severe Accident Management Guidelines (SAMGs) were reviewed to determine the significant mitigating and diagnosis functions. The significant functions from the EOPs and SAMG are: sub-criticality, core cooling, heat sink, RCS integrity and RCS inventory, and containment integrity. Piping segments were evaluated to determine if their failure would result in the failure to diagnose or mitigate one of these functions for the system being categorized. If it was the sole means of diagnosing the function, then the pipe segment would be classified as high safety significant; otherwise a low safety significant classification would be assigned based on this consideration.

5. The plant condition monitoring program would identify any known active degradation mechanisms in the pipe segment prior to its failure in test or an actual demand event (e.g., flow assisted corrosion program).

WCAP-16308-NP July 2006 Revision 0

4-6 The purpose of this consideration is to assure that any pipe segment for which there is a known active degradation mechanism, but no condition monitoring program, would not be classified as low safety significant. The known active degradation mechanisms and condition monitoring for the system were identified by the system engineer. For the EN and GK systems, no pipe segments were identified as susceptible to a known active degradation mechanism for which a condition monitoring program was not already in place.

6. Failure of the piping segment will not result in releases of radioactive material that would result in the declaration of a general emergency condition.

The intent of this statement is to consider the radioactive level of the fluid that is contained in the system piping and the location of the system piping, both during normal plant operation and also following a core damage accident.

None of the piping in the GK system would contain any significant levels of radioactive material during normal operation or after a core damage accident. For the containment spray system, some of the piping segments could contain high levels of radioactivity following a core damage accident as the highly radioactive containment sump water is circulated through the piping segments that perform the spray recirculation function. However, the radionuclides in the containment sump water are not a significant threat to become airborne (i.e., very low volatility and vapor pressures) and they would be contained within the WCGS auxiliary building area where the containment spray recirculation piping is located. Thus, a general emergency condition based on the Environment Protection Agency's (EPA) Protective Action Guides (PAGs)

(Reference 8) would not be initiated.

7. A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

No changes are being made to the plant design basis as a result of this program. The implementation of 50.69 simply changes the level of assurance required to maintain component functionality. No components are being removed and all components must maintain function in accordance with the revised treatment program. Therefore, reasonable balance will still be preserved among the prevention of core damage, prevention of containment failure, and consequence mitigation. In spite of the generic nature of the response to this consideration, there was IDP discussion concerning whether the balance had been changed by classifying containment spray system pressure boundary components as LSS. The conclusion of those discussions was that the balance was still maintained based on the 50.69 requirement for maintaining functional capability of the system.

8. Over-reliance on programmatic activities to compensate for weaknesses in plant design is avoided.

No changes are being made to the plant design basis as a result of this program. No components are being removed and all components must maintain their design basis function in accordance with the revised treatment program. In addition, the changes permitted by the categorization due not increase reliance on any programmatic activities. Therefore, no plant design weaknesses are WCAP-16308-NP July 2006 Revision 0

4-7 exposed because of an over-reliance on programmatic activities. Also, since low safety significant pressure boundary components would remain within the scope of condition monitoring programs, there is no over-reliance of programmatic activities.

9. System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g., no risk outliers).

No changes are being made to the plant design basis as a result of this program. The implementation of 50.69 simply changes the level of assurance required to maintain component functionality. No components are being removed and all components must maintain function in accordance with the revised treatment program. Therefore, system redundancy, independence, and diversity will be preserved. Any adverse changes to the reliability of redundant, independent of diverse components would have only a negligible impact the plant risk (per the PRA assessment for the component) and would be detected by the monitoring of low safety significant pressure boundary components.

10. Defenses against potential common cause failures are preserved, and the potential for the introduction of new common cause failure mechanisms is assessed (e.g., biofouling).

No changes are being made to the plant design basis as a result of this program. The implementation of 50.69 simply changes the level of assurance required to maintain component functionality. No components are being removed and all components must maintain function in accordance with the revised treatment program. Defenses against common cause failures will be preserved.

11. Independence of fission-product barriers is not degraded.

No changes are being made to the plant design basis as a result of this program. The implementation of 50.69 simply changes the level of assurance required to maintain component functionality. No components are being removed and all components must maintain function in accordance with the revised treatment program. The consequence of a failure of any pressure boundary components that may serve as a fission product boundary has already been considered in the initial phase of the classification; any pressure boundary component whose failure would result in significant fission product releases would already be classified as high safety significant.

Therefore, independence of fission product barriers will not be degraded. For example the containment isolation valves inside and outside containment on the containment spray system was classified as high safety significant in the initial phase of the classification based on the consequences of a pressure boundary failure.

If any of the above I1 considerations were FALSE for a given piping segment, HSS was assigned.

The version of Code Case N-660 that was used in the WCGS provided a final consideration that could be used to over-ride the eleven considerations discussed above. This final consideration was that if historical data shows that these failure modes are unlikely to occur and such failure modes can be detected in a timely fashion, the component could be classified as low safety significant. This consideration was not used in the WCGS IDP as a basis for categorizing a pressure boundary component as low safety WCAP-16308-NP July 2006 Revision 0

4-8 significant. WCNOC will not use this consideration as part of their 50.69 categorization process (present or future) to over-ride any of the primary considerations discussed above.

4.6 SAFETY MARGINS Paragraph 1-3.2.1 (c) of Code Case N-660 requires that the categorization process shall verify that there are sufficient safety margins to account for uncertainty in the engineering analysis and in the supporting data for all piping segments determined to be low safety significant based on the previously discussed criteria and considerations.

WCGS Implementation The WCNOC consequence evaluation followed the guidance in Paragraph 1-3.2.1 (c) of Code Case N-660 without exception.

For the WCGS analysis, existing safety margins for technical and functional requirements will remain because the only requirements that are relaxed for low safety significant piping and components are those related to treatment. There are no changes made to the plant design basis, licensing basis or safety analysis. Also, the individual PRA sensitivity studies, as well as the overall risk sensitivity study, provide reasonable assurance that the proposed revisions in treatment requirements account for analysis and data uncertainty.

July 2006 WCAP-16308-NP July 2006 Revision 0

4-9 Risk-Informed Safety Classification - 50.69 Summary Report Plant Name - Unit No. XISTEAMNAIE Si PASSIVE ASSESSMENTSUMMAR Y SEGIEAi'ID 1, SI-011 SEGMENT. Desclif R.R segment S1-O01 DESCRITHON PASSIJ "ERISKASSESSMEAT IRi*'AkAs~esm ct Ale.,ment ?.cllfuII Comment CONSEQUENCE 1 Baais flr crenitincer nking.

R.INKING lSS FUNCTION Itasfor IIS, ftncion questiol.

INDIRECT EFFECTS astfirx indirect edfctcsquelion.

S4"FE SIIUTDO for sf'* hutdoen quesl ion.

sisasl$

FOPs OR S.4.IGs isis for EOPS SAIG queslkn.

INADI ER*ANT i asis for radioadive rcldae question.

RELE4SE RF**SON.IBI.E ai fr reasmahle balance quesitn.

114 i4ANCE PROGR4MAIAIC TIC F actosie f activities question.

aorgrammatic ACTII7TIES SYSTE*I Basis urrredundancy question.

REDUNDNVCI" COMMONCIUSE SMS Basis fotrconinotn iau*e failure quection.

F.4ILURE FISSIONPRODUCT wts fro ision product barrie quegtion.

14 R4IMIER StIFETV8.t.RGIS F a for safstymarins question.

Bsis PRELIMIAARY Basis tfr oveatl risk r*nking.

O VERA LL RANK PASSIV"E IDPASSESSMENT RISK RIANKING RISK RINKING I{4SIS I[ SIje final risk ranking of R/R Segment IDSI-001.

I Date Page X of Y Figure 4-1 Passive Assessment Summary Report, Page I WCAP- 16308-NP July 2006 Revision 0

4-10 Risk-Informed Safet' Classification - 50.69 Summar" Report Plant Narne - Unit No. SYSTEMNAVE S1 ASSOCIATED COMPONEATS SAFETY'CLASS COMPONEVTID COMPONEATDESCRIPTION NS SIMOV-1234 Msefiption otS1IMOV-1234 SR SI rUMP-A rk-scdiption of SIPUMP-A Date PageXofY Figure 4-2 Passive Assessment Summary Report, Page 2 WCAP- 16308-NP July 2006 Revision 0.

5-1 5 RISK CATEGORIZATION BASIS WCGS has a quantitative PRA that models internally initiated events from an at-power condition. The current at-power internal events PRA is known as Revision 4 and was completed in 1998. Other important risk contributors, such as seismic risk, fire risk, other external event risks (high winds, tornadoes, etc.) during power operation, and risk during shutdown conditions have been assessed using qualitative methods that were acceptable at the time the WCGS IPEEE was performed. These were completed in the mid-1990's timeframe.

The PRA input used for the RISC of the components in the EN and GK systems has not been updated to reflect the findings of the PRA peer review nor other quality assessments as described in Regulatory Guide 1.200. Thus, a separate submittal related to the PRA technical adequacy will be made by WCNOC, when the decision is made to implement 50.69, to satisfy the PRA technical adequacy requirements of 50.69. However, the input from the 1998 PRA model is adequate to define the categorization process to be used at WCGS. Following the completion of any PRA modifications that are required to meet the PRA technical adequacy requirements for use in the proposed 10 CFR 50.69 categorization, the present RISC results, which reflect the risk insights from the current PRA, will be updated as appropriate to assure that the results of the categorization process reflect the updated PRA.

The results of the at-power internal events PRA are summarized in this section to show that the results are not significantly different from those reported for other similar plants. Thus, there is reasonable confidence that the process used to categorize SSCs for the EN and GK systems at WCGS will not be affected by changes in the PRA once the acceptable level of PRA adequacy is achieved.

5.1 PLANT-SPECIFIC RISK INFORMATION The results of the quantification of the PRA model show a CDF value of 5.5E-05/year and a LERF value of 8.3E-07/year.

The initiating event contribution to CDF is dominated by the station blackout event as shown in Table 5-I.

The initiating event contribution to LERF is dominated by the containment bypass events initiated by either a steam generator tube rupture accident or an interfacing system LOCA event as shown in Table 5-2.

The results of the 1998 PRA, in terms of the CDF and LERF, the dominant initiating events and core damage sequences are not significantly different than other industry PRAs.

July 2006 WCA P-I 6308-NP WCAP-16308oNP July 2006 Revision 0

5-2 Table 5-1 Initiating Event Contribution to Core Damage CDF Initiating Event Contribution Station Blackout 48%

Large LOCA 9%

Medium LOCA 8%

Loss of RCP Seal Cooling - At Least One CCW Train Available 7%

Small LOCA 4%

Loss of RCP Seal Cooling Following a Transient Initiator 4%

Loss of All Service Water 4%

Loss of Vital DC Bus NKO1 3%

Steam Generator Tube Rupture 3%

Anticipated Transient Without Scram 2%

Table 5-2 Contributors to LERF CDF Containment Failure Mode Contribution Bypass - Steam Generator Tube Rupture 55%

Bypass - Interfacing Systems LOCA 43%

Containment Failure 2%

WCAP-16308-NP July 2006 Revision 0

6-1 6 PROGRAM DOCUMENTATION AND CHANGE CONTROL 6.1 DOCUMENTATION OF CATEGORIZATION PROCESS 50.69 (f)(1) requires that the licensee or applicant shall document the basis for its categorization of any SSC under 50.69 (c) before removing any requirements under 50.69 (b)(1) for those SSCs.

WCGS Implementation The WCNOC documentation process complies with 50.69 (f)(1) without exception for both the active and the passive categorization.

The documentation on the 50.69 categorization process and the list of SSCs that have been subject to the categorization process will be stored in a readily retrievable form for use by WCNOC. A Microsoft Access database has been developed to capture all of the categorization results as well as IDP meeting notes. Each component in a categorized system will be identified as either RISC-I, 2, 3, or 4, based on its safety class and safety significance as determined by the IDP. The documentation will be retained for the life of the facility per the requirements in the WCGS 50.69 IDP procedure.

6.2 CHANGE CONTROL PROVISIONS Following implementation of 50.69, the paragraph (0(2) requires that licensees shall update their final safety analysis report (FSAR) to reflect which systems have been categorized, in accordance with 50.71 (e).

When a licensee first implements 50.69 for a SSC, paragraph (0(3) states that changes to the FSAR for the implementation of the changes in accordance with 50.69 (d) need not include a supporting 50.59 evaluation of the changes directly related to implementation. Thereafter, changes to the programs and procedures for implementation of 50.69(d), as described in the FSAR, may be made if the requirements of this section and 50.59 continue to be met.

When a licensee first implements 50.69 for a SSC, paragraph (0(4) states that changes to the quality assurance plan for the implementation of the changes in accordance with §50.69 (d) need not include a supporting 50.54(a) review of the changes directly related to implementation. Thereafter, changes to the programs and procedures for implementation of 50.69 (d), as described in the quality assurance plan may be made if the requirements of this section and 50.54(a) continue to be met.

WCGS Implementation The WCNOC implementation process complies with 50.69 (0(2) through (0(4) without exception for both the active and the passive categorization.

In general, the implementation of 10 CFR 50.69 can be divided into two phases: 1) the initial implementation that includes the categorization of SSCs and the application of treatment based on that categorization; and 2) the control of changes to the plant that may impact those SSCs or their categorization basis following the initial implementation. This section discusses how the requirements of WCAP- 16308-NP July 2006 Revision 0

6-2 10 CFR 50.69(f) are met for these two phases. For the purposes of this guidance, initial implementation refers to the first application of the 10 CFR 50.69 rule to a particular system. This may be at the time the first system(s) are categorized under 10 CFR 50.69 or it may be at later time if the licensee chooses a phased approach to categorization wherein only a few systems are categorized each year, for several years.

Initial Implementation Following NRC approval to implement 10 CFR 50.69, any changes to the FSAR that reflect alternative treatment of categorized systems will be captured in the WCNOC FSAR update process. Changes to the FSAR associated with initial implementation for an SSC need not include a supporting review or evaluation under 10 CFR 50.59, but rather a direct reference to the 50.69 categorization process may be substituted since it fulfills the intent of a 50.59 review.

Initial implementation will also entail changes to the licensee's quality assurance plan to reflect alternative treatment for categorized systems. Changes to the quality assurance plan associated with initial implementation for an SSC need not include a supporting review under 10 CFR 50.54(a), but rather a direct reference to the 50.69 categorization process may be used. In addition, any regulatory commitments associated with the special treatment requirements in 10 CFR 50.69(b)(1) for SSCs categorized as RISC-3 are no longer applicable to these SSCs and may be dropped at WCNOC's discretion. However, WCNOC will ensure that any design basis commitments continue to be maintained as defined by 10 CFR 50.2, NRC Regulatory Guide 1.186, and NEI 97-04, Rev. 1 (Reference 9).

The waiver of supporting reviews under 10 CFR 50.59 and 10 CFR 50.54(a) is only applicable to the initial implementation of 10 CFR 50.69 for a system, i.e., for changes in treatment to SSCs based on the results of the categorization process. Any other changes to these SSCs are subject to the applicable change control requirements through the application of NEI 99-04, Revision 1, "Guidelines for Managing NRC Commitment Changes" (Reference 10).

Following Initial Implementation Subsequent to initial implementation, any changes to alternative treatment for categorized SSCs are subject to applicable change control requirements, e.g., 10 CFR 50.59 and 10 CFR 50.54(a), and will continue to meet the alternative treatment requirements in 10 CFR 50.69.

Changes to categorized SSCs not associated with treatment continue to be governed by the same applicable change control requirements. For RISC-1 and RISC-2 SSCs that have safety significant beyond design bases functions, the WCNOC will maintain reasonable assurance that these functions will be satisfied following the change.

WCAP-16308-NP July 2006 Revision 0

7-1 7 PERIODIC UPDATES 7.1 UPDATES BASED ON PLANT DESIGN AND OPERATION 10 CFR 50.69 (e) requires that the licensee shall review changes to the plant, operational practices, applicable industry operational experience, and, as appropriate, update the PRA and SSC categorization.

The licensee shall perform this review in a timely manner but no longer than once every two refueling outages.

WCGS Implementation The WCNOC update for plant design and operation complies with 50.69 (e) without exception for both the active and the passive components categorized under 50.69.

If significant changes to the plant risk profile as described in the WCGS PRA are identified, in accordance with WCNOC procedures, an immediate evaluation and review will be performed prior to the normally scheduled periodic review. Additionally, if it is identified that a RISC-3 or RISC-4 SSC can (or actually did) prevent a safety significant function from being satisfied, in accordance with WCNOC procedures an immediate evaluation and review will be performed. Otherwise, the assessment of potential equipment performance changes and new technical information will be performed during the normally scheduled periodic review cycle.

Scheduled periodic reviews will be performed in accordance with Regulatory Guide 1.200 and will evaluate new insights resulting from available risk information (e.g., PRA model or other analysis used in the categorization) changes, design changes, operational changes, and SSC performance. If it is determined that these changes have affected the risk information or other elements of the categorization process such that the categorization results are more than minimally affected, then the risk information and the categorization process will be updated. This review will include:

0 A review of plant modifications since the last review that could impact the SSC categorization.

A review of plant specific operating experience that could impact the SSC categorization.

0 A review of the impact of the updated risk information on the categorization process results.

0 A review of the importance measures used for screening in the categorization process.

An update of the risk sensitivity study performed for the categorization.

In addition to the normally scheduled periodic reviews, if a PRA model or other risk information is upgraded, a review of the SSC categorization will be performed. It is expected that risk information upgrades would normally be timed such that the upgrade would coincide with the normal periodic review schedule. However, in the case that the upgrade was performed on a separate schedule, then the review will be performed in a timely manner, and will include similar considerations as those listed above for the periodic reviews.

In most cases, the categorization is expected to be unaffected by changes in the plant-specific risk information. However, in some instances, an updated PRA model could result in new RAW and F-V importance measures that are sufficiently different from those in the original categorization so as to suggest a potential change in the categorization. In these cases, the assessment of whether a change in WCAP- 16308-NP July 2006 Revision 0

7-2 categorization is appropriate will be based on the changes in absolute value of the importance measures and the changes in risk as described in Table 12-1 of NEI 00-04.

7.2 MONITORING OF RISC-1 AND RISC-2 SSCs The 50.69 rule, at paragraph (e)(2) requires that the licensee shall monitor the performance of RISC-I and RISC-2 SSCs, and make adjustments as necessary to either the categorization or treatment processes so that the categorization process and results are maintained valid.

WCGS Implementation The WCNOC implementation process complies with 50.69 (e)(2) without exception.

RISC-i and RISC-2 SSCs will be monitored in the same manner as they are presently monitored under 10 CFR 50.65, the Maintenance Rule, with the following clarifications:

1. The monitoring will address all functional failures, not just maintenance preventable functional failures.

2. The scoping requirements of the maintenance rule are expected to envelop practically all RISC-i and RISC-2 SSCs. However, to the extent that any of these SSCs are not in the maintenance rule scope, appropriate monitoring requirements will be developed for those SSCs.

As appropriate, the results of this monitoring will be used to determine if adjustments to the categorization assumptions, or treatment processes for RISC-I and RISC-2 SSCs, are necessary.

WCNOC will submit a licensee event report under § 50.73(b) for any event or condition that prevented, or would have prevented, a RISC-i or RISC-2 SSC from performing a safety significant function.

7.3 MONITORING OF RISC-3 SSCs 50.69 (e)(3) requires that licensees shall consider data collected in § 50.69(d)(2)(i) for RISC-3 SSCs to determine whether there are any adverse changes in performance such that the SSC unreliability values approach or exceed the values used in the evaluations conducted to satisfy § 50.69(c)(l)(iv). The licensee shall make adjustments as necessary to the categorization or treatment processes so that the categorization process and results are maintained valid.

WCGS Approach The WCNOC implementation process complies with 50.69 (e)(3) without exception.

Performance monitoring of RISC-3 SSCs, as required by 10 CFR 50.69(e)(3), will be established to provide assurance that potential increases in failure rates will be detected and addressed before reaching the rate assumed in the above sensitivity study. As a means to monitor equipment Iperformance changes, failures of RISC-3 SSCs will be identified and tracked in the WCNOC corrective action program. As part of the corrective action program, failures of RISC-3 SSCs will be reviewed to determine the extent of WCAP-16308-NP July 2006 Revision 0

7-3 condition (i.e., whether this failure is indicative of a potential common cause failure). For the purposes of assessing data from the corrective action program, failures will be assessed for groups of like component types (e.g., motor operated valves, air operated valves, pumps, etc). The intent of the periodic review is twofold. First, to ensure that the failure rate of RISC-3 SSCs in a given time period has not unacceptably increased due to the changes in treatment. The periodic review validates that the rate of RISC-3 SSC equipment failures has not increased by a factor greater than that used in the sensitivity study. Second, the review of component group failure data is performed to detect the occurrence of potential inter-system common cause failures, and to allow timely corrective action if necessary, as required by §50.69(d)(2)(ii).

Since most RISC-3 components have low failure rates, any changes to these rates are most readily detected through grouping of components. In reviewing corrective action program information, attention will be given to common changes in treatment to groups of components to assure that the potential for inter-system common cause failure remains low. This corrective action review will also consider previous experience with performance of components.

This review of failure experience will account for changes in test frequencies, routine demands and exposure times, as appropriate. This will be accomplished by proactively assessing the documented failures in a given group of SSCs, and comparing the number of failures documented in the current review period against failures in previous periods, accounting for changes in treatment. If the number of failures for a group of SSCs exceeds a factor of two increase over the expected number of failures, a potential adverse trend is identified requiring further assessment. The factor of two is selected so to assure an assessment is initiated prior to exceeding the factor used in the risk sensitivity study (e.g., a factor of 3).

The WCNOC will take the appropriate actions, (which could include changes in treatment or categorization), to preclude reaching unacceptable performance.

July 2006 WCAP-16308-NP WCAP- 16308-NP July 2006 Revision 0

8-1 8 APPLICATION OF RISC-3 TREATMENT REQUIREMENTS 10 CFR 50.69 requires that licensees shall ensure, with reasonable confidence, that RISC-3 SSCs remain capable of performing their safety-related functions under design basis conditions, including seismic conditions and environmental conditions and effects throughout their service life. The treatment of RISC-3 SSCs must be consistent with the categorization process.

WCGS Implementation RISC-3 SSCs will be exempt from special treatment requirements as described in §50.69 (b)(1). In lieu of those special treatment requirements, WCNOC will develop and implement documented processes to control the design, procurement, inspection and maintenance to ensure, with reasonable confidence, that RISC-3 SSCs remain capable of performing their safety-related functions under design basis conditions.

The process will specifically consider seismic and environmental factors that are part of the design basis conditions. The WCNOC approach to inspection, testing and corrective actions is described in Section 7 of this report.

WCAP-16308-NP July 2006 Revision 0

9-1 9 REFERENCES

1. "10 CFR 50.69 SSC Categorization Guideline," NEI 00-04, Revision 0, Nuclear Energy Institute, February 2005.

2. "Guidelines For Categorizing Structures, Systems, And Components In Nuclear Power Plants According To Their Safety Significance" Regulatory Guide 1.201 For Trial Use, Nuclear Regulatory Commission, June 2004.

3. "Inservice Inspection Code Case Acceptability, ASME Section XI, Division 1," Regulatory Guide 1.147, Revision 14), Nuclear Regulatory Commission, August 2005.

4. "Risk-Informed Safety Classification for Use in Risk-Informed Repair/Replacement Activities,"

ASME Code Case N-660, July 2002.

5. "Wolf Creek Generating Station Probabilistic Risk Assessment," Revision 4, WCNOC, 1998.

6. "Wolf Creek Individual Plant Examination for External Events (IPEEE) Summary Report,"

TR-95-0015 WO1, WCNOC, June 1995.

7. "WinNUPRA 2.1 PRA Model Calculator," Scientech Inc., 2001.

8. "Manual of Protective Action Guides and Protective Actions for Nuclear Incidents,"

EPA 400-R-92-00 1, U. S. Environmental Protection Agency, 199 1.

9. "Design Basis Program Guidelines," NEI-97-04, Revision 1, Nuclear Energy Institute, February 2001.

10. "Guidelines for Managing NRC Commitment Changes," NEI 99-04, Revision 0, Nuclear Energy Institute, July 1999.

WCAP-16308-NP July 2006 Revision 0

A-I APPENDIX A DIFFERENCES IN GUIDANCE USED FOR WCGS IDP AND ENDORSED VERSIONS OF GUIDANCE NEI 00-04 The WCGS IDP was conducted with the April 2004 version of the NEI 00-04 guidance, which was known as the "Final Draft." This version was transmitted to the NRC from NET on April 14, 2004 (designated ML041120208 in the NRC's ADAMS document retrieval system). The latest version of NEI 00-04 is known as Revision 0 and was transmitted to the NRC from NEI on February 2, 2005. The primary differences between the version used in the WCGS IDP and the latest version are shown in Table A-I. Only those differenced that could impact the categorization process used at WCGS are shown in Table A-I.

Table A-I shows both the "Final Draft" and the "Revision 0" guidance and a discussion the impact of the changed guidance on the WCGS categorization process.

16308-NP July 2006 WCAP-WCAP- 16308-NP July 2006 Revision 0

A-2 Table A-I Impact of Changes in NEI 00-04 on the WCGS Categorization NEI 00-04 Section New Guidance Impact on WCGS Categorization 1.5 Clarifies the parts of the categorization process in which SSCs NO IMPACT - There were no cases during the WCGS IDP where a identified as HSS cannot be changed by the IDP versus those parts of candidate HSS SSC was considered for categorization as LSS.

the categorization process in which SSCs identified as potentially HSS WCNOC would follow the latest NEI guidance in future considerations.

can be considered for categorization as LSS by the IDP.

1.5 Summary information added on the role of the various PRA NO IMPACT - The additional information is consistent with the assessments (internal events, seismic, fire, etc.) in the risk detailed information in later sections which remained unchanged from categorization process. the earlier version.

Table 1-I Summary information added on the types of PRA assessments (internal NO IMPACT-The information in Table 1-1 is consistent with the events, seismic, fire, etc.) that can be used in the risk categorization detailed information in later sections which remained unchanged from process. the earlier version.

2.0 Information added related to the final 50.69 rule. NO IMPACT - The information was added for completeness. The relevant parts of the final 50.69 rule related to the categorization process did not change the categorization process in NEI 00-04.

3 to 12 References to specific paragraphs of the 50.69 rule were added NO IMPACT-The new information provides additional information throughout Sections 3 through 12 to show how the NEI 00-04 guidance but does not change the categorization process described in NEI 00-04.

satisfies the rule requirements 3.3.1 References to Regulatory Guide 1.200 and other requirements for a NO IMPACT - This report describes the categorization process used at quality PRA were added. WCGS and does not discuss the quality aspects of the PRA that would be used in an actual categorization exercise. The WCGS PRA will be updated to acceptable scope and quality levels and information will be provided to NRC to support the WCNOC LAR for implementing 50.69 at WCGS.

5.3 Added guidance on seismic PRA assessments for SSCs screened out of NO IMPACT - This applies to quantitative seismic PRAs. The seismic the seismic PRA because of their seismic robustness. risk assessment for WCGS uses the SMA approach and not the quantitative PRA.

5.4 Added guidance regarding LSS for qualitative external events risk NO IMPACT - The categorization for the two systems was reviewed assessments for screened and unscreened scenarios, and it was determined that no SSCs were credited in either screened or unscreened scenarios.

6.1 Clarification was added regarding the use of Figure 6-1 for Defense In NO IMPACT - The method described in the new guidance corresponds Depth assessments. to the method used in the WCGS categorization for the two systems.

WCAP-16308-NP July 2006 Revision 0

A-3 Table A-I Impact of Changes in NEI 00-04 on the WCGS Categorization (cont.)

NEI 00-04 Section New Guidance Impact on WCGS Categorization 6.2 Am additional consideration was added for ISLOCA Defense In Depth NO IMPACT -The categorization for the two systems was reviewed to include the potential for an SSC to have an ISLOCA mitigation role. and it was determined that no SSCs could be credited for mitigation of an ISLOCA event.

8.0 Additional clarification was added to explain the purpose of the risk NO IMPACT-No RISC-3 SSCs from the two systems were modeled sensitivity study and the basis for the method discussed in Section 8.1 in the PRA. Therefore, a risk sensitivity assessment was not performed.

versus the 50.69 rule requirements.

8.1 The considerations for maintaining the validity of the sensitivity study NO IMPACT - See discussion under Section 12 addition.

following initial categorization were deleted from Section 8 and added to Section 12 9.1 The makeup of the IDP was changed to delete "Licensing" and to NO IMPACT - The WCGS IDP included both Licensing and Safety specifically include "Safety Analysis" as a separate discipline. Analysis disciplines. As noted in Section 2.3.7 of this document, WCNOC does not intend to include a Licensing representative on future IDPs.

9.2.2 The issues for the IDP consideration for candidate low safety NO IMPACT - The IDP considerations for WCGS were reviewed and it significant SSCs have been changed based on experience during the was determined that none of the changes would impact the IDP pilot applications at WCGS and Surry. Additionally, some changes decisions for either system. Also, none of the issues raised during the were made to assure consistency between the NEI 00-04 and the December 2003 IDP at WCGS at that were resolved with the April 2004 ASME Code Case guidance. version of NET 00-04 were changed in such as way as to re-open any of the issues.

9.2.2 The provision to use a plant condition monitoring program as a reason NO IMPACT - This provision was not used in the WCGS IPD to override the other considerations was deleted by moving this considerations.

consideration from the end of 9.2.2 to one of the actual considerations.

9.2.2 The provision to use historical data to show that failure modes are NO IMPACT - This provision was not used in the WCGS IPD unlikely to occur and such failure modes can be detected in a timely considerations.

fashion was deleted from the guidance.

WCAP-16308-NP July 2006 Revision 0

A-4 Table A-I Impact of Changes in NEI 00-04 on the WCGS Categorization (cont.)

NEI 00-04 Section New Guidance Impact on WCGS Categorization 11.1 Clarification was added to refer to 10 CFR 50.2, NRC Regulatory NO IMPACT - The categorization process described in this report, Guide 1.186, and NEI 97-04, Rev I for definitions of design basis which was performed under the April 2004 version of NEI 00-04, does commitments not address maintenance of design commitments. Therefore the change in NEI guidance is has no impact. The WCNOC method of addressing this guidance item is discussed in the main section of this report.

12.1 Clarification was added related top scheduling of periodic reviews. NO IMPACT- The categorization process described in this report, which was performed under the April 2004 version of NE! 00-04, does not address periodic reviews. Therefore the change in NEI guidance is has no impact. The WCNOC method of addressing this guidance item is discussed in the main section of this report.

12.2 Clarification was added related to phased implementation and the NO IMPACT - The categorization process described in this report, impact of later categorization results on earlier categorizations, which was performed under the April 2004 version of NEI 00-04, was the initial categorization. Therefore the change in NEI guidance has no impact. The WCNOC method of addressing this guidance item is discussed in the main section of this report.

12.3 Clarification was added related to monitoring failures versus NO IMPACT - The categorization process described in this report, Maintenance Rule monitoring for categorized SSCs. which was performed under the April 2004 version of NEI 00-04, does not address monitoring. Therefore the change in NEI guidance has no impact. The WCNOC method of addressing this guidance item is discussed in the main section of this report.

12.4 Clarification was added related to performance monitoring and NO IMPACT -The categorization process described in this report, corrective action for failures of categorized SSCs. which was performed under the April 2004 version of NEI 00-04, does not address monitoring or corrective actions. Therefore the change in NEI guidance has no impact. The WCNOC method of addressing this guidance item is discussed in the main section of this report.

WCAP-16308-NP July 2006 Revision 0

A-5 ASME Code Case N-660 ASME Code Case N-660 Revision 0 was approved by ASME in 2002 and was later endorsed by the NRC in Regulatory Guide 1.147, Revision 14. The first WCGS IDP was conducted in December of 2003 and used this version of the Code Case. Several issues with the Code Case were identified at that IDP and a revision was proposed to ASME. The April 2004 draft of the ASME Code Case N-660, Revision 1 was used in the subsequent WCGS IDP that is the basis for the categorization process described in this report.

The primary differences between the version used in the WCGS IDP and Revision 0 are shown in Table A-2. Not all modifications to the Code Case are reported. Only those differences that could impact the categorization process used at WCGS are shown in Table A-2.

Table A-2 shows both the "Final Draft" and the "Revision 0" guidance and a discussion of the impact of the changed guidance on the WCGS categorization process.

WCAP-16308-NP July 2006 Revision 0

A-6 Table A-2 Impact of Changes in ASME Code Case N-660 on the WCGS Categorization N-660 Section Endorsed Revision 0 WCGS IDP Version Basis for Change 1-1.0 N/A Added figure illustrating the modified RISC Figure added to provide high level methodology process, including scope overview of RISC methodology process.

identification, consequence evaluation, New process calls for all segments to be consequence categorization, classification included in the consequence evaluation.

considerations, and final classification definitions.

1-3.0 "Additionally, information shall be collected "Additionally, information considered relevant Statement clarified for other relevant for each piping segment that is not modeled in to the classification shall be collected for each considerations besides internal events PRA.

the PRA, but considered relevant to the piping segment (e.g., information regarding classification (e.g., information regarding design basis accidents, at-power risk, shutdown design basis accidents, shutdown risk, risk, containment isolation, flooding, fires, containment isolation, flooding, fires, seismic seismic conditions, etc.). This other relevant conditions)." information is considered in conjunction with the Consequence Category to determine the Risk Informed Safety Classification."

1-3.1.2(b) "System Impact Group Assessment. The "System Impact Group Assessment. The For consistency with RI-ISI program consequence category of a failure that does not consequence category of a failure: criteria for system impact group cause an initiating event, but degrades or fails a assessment.

system essential to prevention of core damage, modeled in a PRA that degrades or fails a high-shall be based on the following:" safety significant function but does not cause an initiating event, or not modeled explicitly or implicitly in a PRA, or that results in failure of another high-safety significant piping segment, e.g., through indirect effects, or that will prevent or adversely affect the plant's capability to reach or maintain safe shutdown conditions, shall be based on the following:"

WCAP-16308-NP July 2006 Revision 0

A-7 Table A-2 Impact of Changes in ASME Code Case N-660 on the WCGS Categorization (cont.)

N-660 Section Endorsed Revision 0 WCGS IDP Version Basis for Change 1-3.1.2(d) The above evaluations determine failure The above evaluations determine failure For inclusion of new wording under system importance relative to core damage. importance relative to core damage or the impact group assessment considering plant's capability to reach or maintain safe reaching or maintaining safe shutdown shutdown, conditions.

1-3.1.3, 3.1.4, All Sections has been modified and moved into Original intent of section was to provide

& 3.1.5 new section 1-3.2.2(b). The process used at the additional considerations for segments not WCGS IDP calls for all segments to be created modeled in the PRA. However, the and assigned a consequence category in grouping of components into piping Sections 1-3.1.1 & 3.1.2. Then, for those segments and the use of surrogate segments with a consequence category of components in the PRA provide MEDIUM, LOW, or NONE, the user must quantitative evaluations for each piping evaluate a modified Sections 1-3.1.3, 3.1.4, and segment. The intent of this section now is 3.1.5 (now in 1-3.2.2(b)) to assign final high or to provide further considerations for piping low safety significance. segments with MEDIUM, LOW, or NONE consequence categories. See the following entries for specific changes to the original considerations of 1-3.1.3, 3.1.4, and 3.1.5.

1-3.1.3 All Questions changed such that all TRUE For consistency with NEI 00-04 process.

responses will support LSS and at least one FALSE response will support HSS.

I-3.1.3(a)(1) "Failure of the piping segment will Not used Piping segments are not modeled in the significantly increase the frequency of an PRA.

initiating event, including those initiating events originally screened out in the PRA, such that the CDF or large early release frequency (LERF) would be estimated to increase by more than 10-6/yr or 10-7/yr, respectively."

I-3.1.3(a)(2) "Failure of the piping segment will Not used All reactor coolant pressure boundary compromise the integrity of the reactor coolant segments are ranked high safety significant pressure boundary as defined in -1200(b)." per -1200(b).

WCAP-16308-NP July 2006 Revision 0

A-8 Table A-2 Impact of Changes in ASME Code Case N-660 on the WCGS Categorization (cont.)

N-660 Section Endorsed Revision 0 WCGS IDP Version Basis for Change 1-3.1.3(a)(3) "Even when considering operator actions used New Section I-3.2.2(b)(1), "Event when taking Added plant features along with operator to mitigate an accident, failure of the piping credit for plant features and operator actions, actions. Footnote provided for credible segment will fail a high safety significant failure of the piping segment will not directly operator actions.

function." fail another high safety-significant function."

I-3.1.3(a)(4) "Failure of the piping segment will result in New Section I-3.2.2(b)(2), "Failure of the Minor change.

failure of other safety-significant piping piping segment will not results in failure of segments, e.g., through indirect effects." another high safety-significant piping segment, e.g., through indirect effects."

I-3.1.3(a)(5) "Failure of the piping segment will prevent or New Section I-3.2.2(b)(3), Event when taking WCGS IDP was given ability to credit valid adversely affect the plant's capability to reach credit for plant features and operator actions, operator action when evaluating failure or maintain safe shutdown conditions." failure of the piping segment will not prevent impact on shutdown conditions. Footnote or adversely affect the plant's capability to provided for credible operator actions.

reach or maintain safe shutdown conditions.

1-3.1.3(b)(1) "The piping segment is a part of a system that Not used This statement was too conservative to acts as a barrier to fission product release force all segments to be ranked as HSS during severe accidents." given that just one segment in the entire system meets this criterion. Also, there is redundancy with new subsection I-3.2.2(b)(l 1) 1-3.1 .3(b)(2) "The piping segment supports a significant New Section 1-3.2.2(b)(4), "The piping The original statement was too limiting to mitigating or diagnosis function addressed in segment does not individually support a any segment supporting functions the Emergency Operating Procedures or the significant mitigating or diagnosis function addressed in the EOPs or SAMGs. The Severe Accident Management Guidelines." addressed in the Emergency Operating term significant was too vague. New Procedures or the Severe Accident statement clarifies the interpretation for the Management Guidelines, with no redundancy WCGS IDP and allows for reasonable or alternate means of support." consideration of plant features and operator actions.

WCAP-16308-NP July 2006 Revision 0

A-9 Table A-2 Impact of Changes in ASME Code Case N-660 on the WCGS Categorization (cont.)

N-660 Section Endorsed Revision 0 WCGS IDP Version Basis for Change I-3.1.3(b)(3) "Failure of the piping segment will result in New Section I-3.2.2(b)(6), "Even when taking The off-site emergency response and unintentional releases of radioactive material in credit for plant features and operator actions, protective actions limits are more excess of plant offsite dose limits specified in failure of the piping segment will not result in conservative compared to those in Part 100.

10 CFR Part 100." releases of radioactive material that would result in the implementation of off-site emergency response and protective actions."

1-3.1.4 All No change to methodology but the appropriate For clarity and process improvement.

items called out in Reg Guide 1.174 were placed in 1-3.2.2(7) through (11), see below.

1-3.1.5 All No change to methodology but section was For clarity and process improvement.

moved to 1-3.2.2(c). Format change also made to paragraph to more clearly identify questions for consideration.

1-3.2.2(b) All Rather than referring to Sections 1-3.1.3, 1- To improve the process, the additional 3.1.4, and 1-3.1.5, new considerations have considerations were moved into this section been provided as listed above. Process still from 1-3.1.3, 1-3.1.4, and 1-3.1.5. See required user to evaluate the additional above for basis of consideration changes.

considerations for any segment with consequence category Medium, Low, or None.

1-3.2.2(b)(7) N/A "A reasonable balance is preserved among Taken from Reg Guide 1.174.

prevention of core damage, prevention of containment failure, and consequence mitigation."

1-3.2.2(b)(8) N/A "Over-reliance on programmatic activities to Taken from Reg Guide 1.174.

compensate for weaknesses in plant design is avoided."

WCAP-16308-NP July 2006 Revision 0

A-10 Table A-2 Impact of Changes in ASME Code Case N-660 on the WCGS Categorization (cont.)

N-660 Section Endorsed Revision 0 WCGS IDP Version Basis for Change 1-3.2.2(b)(9) N/A "System redundancy, independence, and Taken from Reg Guide 1.174.

diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g., no risk outliers)."

I-3.2.2(b)(10) N/A "Defenses against potential common cause Taken from Reg Guide 1.174.

failures are preserved, and the potential for the introduction of new common cause failure mechanisms is assessed."

I-3.2.2(b)(! I) N/A "Independence of fission-product barriers is not Taken from Reg Guide 1.174.

degraded."

1-3.2.2(c) All The original text was combined in 1-3.2.2(b). For simplification and process The new 1-3.2.2(c) is a copy of the original improvement.

1-3.1.5 section for safety margin assessment.

1-3.2.2 A component support or snubber shall have the Moved into 1-3.2.2(d) with no change to text. For consistency.

same classification as the highest-ranked piping segment within the piping analytical model in which the support is included. The Owner may further refine the classification ranking by more extensive application of the process defined in these requirements. These analyses shall be documented.

WCAP-16308-NP July 2006 Revision 0

ML062770360

Contents

Text

1.1 BACKGROUND

2.1 INTRODUCTION

1.1 BACKGROUND

2.1 INTRODUCTION

Navigation menu

ML062770360

Text

1.1 BACKGROUND

2.1 INTRODUCTION

1.1 BACKGROUND

2.1 INTRODUCTION

Navigation menu

Search