ML090260674

Safety Evaluation, Topical Report WCAP-16308-NP, Revision 0, Pressurized Water Reactor Owners Group 10 CFR 50.69 Pilot Program - Categorization Process.

ML090260674
Person / Time
Site:	Nuclear Energy Institute
Issue date:	03/26/2009
From:	Blount T Division of Policy and Rulemaking
To:	Bradley B Nuclear Energy Institute
Mensah T
Shared Package
ML090280265	List: ML090260632 ML090260674
References
TAC MD4229
Download: ML090260674 (32)

Text

FINAL SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION TOPICAL REPORT WCAP-16308-NP, REVISION 0 PRESSURIZED WATER REACTOR OWNERS GROUP 10 CFR 50.69 PILOT PROGRAM -

CATEGORIZATION PROCESS - WOLF CREEK GENERATING STATION NUCLEAR ENERGY INSTITUTE PROJECT NO. 689

1.0 INTRODUCTION AND BACKGROUND

By letter dated September 25, 2006 (Reference 1), as supplemented by letters dated October 22, 2007 (Reference 2), and July 15, 2008 (Reference 3), the Nuclear Energy Institute (NEI) submitted the Pressurized Water Reactor Owners Group (PWROG) Topical Report (TR)

WCAP-16308-NP, Pressurized Water Reactor Owners Group 10 CFR 50.69 [Title 10 of the Code of Federal Regulation] Pilot Program - Categorization Process - Wolf Creek Generating Station, for U.S. Nuclear Regulatory Commission (NRC) staff review.

Reference 1 states that the primary objective of the submittal is to provide, for NRC review, a demonstration of a method for categorizing systems, structures, and components (SSCs) based on the safety significance of the pressure retaining function they perform (passive categorization). The TR refers to a pilot application of the proposed passive categorization methodology to two systems at the Wolf Creek Generating Station (WCGS). However, WCGS did not submit a request for licensing actions and no documentation on this pilot application was submitted. Therefore, as requested as the primary objective in Reference 1, the NRC staff has only reviewed the proposed passive categorization methodology described in the TR. This SE provides conclusions, findings, or endorsements of issues, methods, or results described in the TR for the proposed alternative method for passive categorization.

TR WCAP-16308-NP also provided a discussion of monitoring of Risk-Informed Safety Class (RISC)-1 and RISC-2 SSCs (provided in Section 7.2 of TR WCAP-16308-NP), monitoring of RISC-3 SSCs (provided in Section 7.3 of TR WCAP-16308-NP), and discussion of treatment of RISC-3 SSCs (provided in Section 8 of WCAP-16308-NP). Although it was not the primary objective of this TR, the NEI requested NRC feedback on the discussion located in Sections 7.2, 7.3, and 8 of TR WCAP 16308-NP. Therefore, Sections 3.4, 3.5, and 3.6 of this NRC staff safety evaluation (SE), provide the NRC staffs comments with respect to Sections 7.2, 7.3, and 8 of TR WCAP-16308-NP.

ENCLOSURE

2.0 REGULATORY EVALUATION

On November 22, 2004, the Commission adopted new Section 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors, of 10 CFR on risk-informed categorization and treatment of SSCs for nuclear power plants (69 FR 68008). This new section permits power reactor licensees and license applicants to implement an alternative regulatory framework with respect to special treatment, where special treatment refers to those requirements that provide increased assurance beyond normal industrial practices that SSCs perform their design basis functions. Implementation of 10 CFR 50.69 requires that licensees first categorize safety-related and non-safety SSCs according to their safety significance. SSCs are classified into high-safety-significant (HSS) and low-safety significant (LSS) SSCs. Special treatment requirements for the LSS SSCs may be modified from those treatments otherwise required by the regulations as permitted by the rule.

In May of 2006, the NRC staff issued Regulatory Guide (RG) 1.201, Guidelines For Categorizing Structures, Systems, And Components In Nuclear Power Plants According To Their Safety Significance, For Trial Use, Revision 1 (Reference 4). RG 1.201 describes a method that the NRC staff considers acceptable for use in complying with the Commissions requirements in 10 CFR 50.69 with respect to the categorization of SSCs that are considered in risk-informing special treatment requirements. RG 1.201 endorses a categorization method, with conditions, described in NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline, Revision 0, July 2005 (Reference 5).

NEI 00-04 describes, in detail, a methodology to categorize SSCs based on the active functions they perform (e.g., opening and closing of valves). Section 4.0 and Section 5.1 of NEI 00-04 references the American Society of Mechanical Engineers (ASME) Code Case N-660, Risk-Informed Safety Classification for Use in Risk-Informed Repair/Replacement Activities (Reference 6), as an acceptable approach to categorize SSCs based on their passive functions.

RG 1.201 clarifies that the version of ASME Code Case N-660 that is acceptable to the NRC staff for use in this application is the version identified in RG 1.147, Inservice Inspection Code Case Acceptability, ASME Section XI, Division 1 (Reference 7).

TR WCAP-16308-NP proposes modifications to the methodology described in Code Case N-660 which results in an alternative method for passive categorization. The NRC staff evaluated the acceptability of this alternative method based on consistency with the requirements in 10 CFR 50.69, with the guidance endorsed in RG 1.201, and with the generic risk-informed decisionmaking guidelines established in RG 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis (Reference 8).

2.1 Monitoring of RISC-1 and RISC-2 SSCs The regulation at 10 CFR 50.69(e)(1) requires that licensees shall review changes to the plant, operational practices, applicable plant and industry operational experience and, as appropriate, update the probabilistic risk assessment (PRA) and SSC categorization and treatment processes. Specifically for RISC-1 and RISC-2 SSCs, 10 CFR 50.69(e)(2) requires that licensees shall monitor the performance of these SSCs and make adjustments as necessary to either the categorization or treatment processes so that the categorization process and results are maintained valid. In addition, RISC-1 SSCs are classified as safety-related and, therefore, are subject to the inservice inspection (ISI) and inservice testing (IST) requirements in

10 CFR 50.55a, Codes and Standards, and the quality assurance requirements in 10 CFR Part 50, Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, including Criterion XVI, Corrective Action.

2.2 Monitoring of RISC-3 SSCs The regulation at 10 CFR 50.69(e)(1) requires that licensees shall review changes to the plant, operational practices, applicable plant and industry operational experience and, as appropriate, update the PRA and SSC categorization and treatment processes. Specifically for RISC-3 SSCs, 10 CFR 50.69(e)(3) requires that licensees shall consider data collected in 10 CFR 50.69(d)(2)(i) to determine if there are any adverse changes in performance such that the SSC unreliability values approach or exceed the values used in the evaluations to satisfy 10 CFR 50.69(c)(1)(iv). The licensee shall make adjustments as necessary to the categorization or treatment processes so that the categorization and results are maintained valid.

Under 10 CFR 50.69(d)(2)(i), licensees are required to conduct periodic inspections and tests to determine that RISC-3 SSCs will remain capable of performing their safety-related functions under design basis conditions. In addition, 10 CFR 50.69(d)(2)(ii) requires that conditions that would prevent a RISC-3 SSC from performing its safety-related functions under design basis conditions be corrected in a timely manner and, that for significant conditions adverse to quality, measures be taken to provide reasonable confidence that the cause of the condition is determined and corrective action taken to preclude repetition.

Furthermore, 10 CFR 50.69(c)(1)(iv) requires that for RISC-3 SSCs, the categorization process must include evaluations that provide reasonable confidence that sufficient safety margins are maintained and that any potential increases in core damage frequency (CDF) and large early release frequency (LERF) resulting from changes in treatment are small.

2.3 Application of RISC-3 Treatment Requirements The regulation at 10 CFR 50.69(d)(2) requires that licensees or applicants shall ensure, with reasonable confidence, that RISC-3 SSCs remain capable of performing their safety-related functions under design basis conditions, including seismic conditions and environmental conditions and effects throughout their service life. The treatment of RISC-3 SSCs must be consistent with the categorization process. Inspection and testing, and corrective action shall be provided for RISC-3 SSCs.

3.0 TECHNICAL EVALUATION

The TR proposes a number of changes to ASME Code Case N-660. All of the proposed changes are described in Reference 3, Table A-2. Making the changes in Table A-2 to ASME Code Case N-660 will result in a description of the proposed alternative method. Table A-2 also briefly describes and explains the reason for each of the proposed changes.

Table 1 attached to this SE includes all the proposed changes from Table A-2 although, in some cases, several entries in Table A-2 have been combined into a single entry in Table 1.

Table 1 provides the NRC staff position on each proposed change, including NRC revisions as applicable. These positions are:

• No objection. The NRC staff has no objection to the requirement.

• Objection requiring qualification. The NRC staff has a technical concern with the requirement and has provided a qualification to resolve the concern.

As stated in Table 1, the NRC staff accepts most proposed changes with No objection.

However, the NRC staff accepts the remaining proposed changes with Objection requiring qualification. The qualifications are provided as revisions to the proposed text where additions are identified by bolded text, deletions by struck out text. Making the changes in Table 1 to the methodology described in ASME Code Case N-660 will result in a description of the alternative method that can be endorsed in this SE.

Many of the proposed changes improve the consistency between the categorization methodology in NEI 00-04 and methodology proposed in the TR. For example, the TR reorganized the sections dealing with the treatment of various qualitative considerations which resulted in numerous individual changes. The NRC staff accepted most of these changes with no objection. In several proposed changes, the NRC staff has added a qualification to improve the consistency between the two categorization methods. For example, the NRC staff added text from NEI 00-04 into Section I-3.1.2. Section I-3.1.2 directs that risk information from all initiating events be included in the categorization. The additional text clarifies one acceptable method to capture risk importance from initiating events that are not modeled in a PRA.

In addition to conforming changes, the TR also proposed several substantive changes to the methodology in Code Case N-660. Substantive changes include proposals to delete some qualitative considerations, expand credit for operator actions, and permit consequence determination based on small break sizes. These proposed changes are discussed below.

3.1 Deletion of Some Qualitative Considerations Consistent with NEI 00-04, ASME Code Case N-660 provides a series of questions that need to be considered by the licensees personnel when assigning an SSC into the HSS or LSS category. The response to these questions support the systematic determination on whether SSCs that are not assigned HSS by the quantitative PRA results, should be assigned HSS based on qualitative considerations, including defense-in-depth and safety margins considerations.

The question in ASME Code Case N-660 Section I-3.1.3(a)(2) was deleted. The response to this question would require that all piping as defined in ASME Code Case N-660 Section 1200(b) be assigned to the HSS category. Section 1200(b) already assigns this piping to HSS and the NRC staff concurs that this question is redundant and may be deleted.

The question in ASME Code Case N-660 Section I-3.1.3(b)(1) was deleted. The TR states that the response to this question would require that all piping in every system that supports the retention of fission products during severe accidents be assigned to the HSS category. The NRC staff agrees that the ASME Code Case N-660 guidance is conservative because it would place whole systems into the HSS category based on small, and perhaps very small, parts of the system acting as a barrier to fission product release.

All of the effects of piping rupture, including the potential to cause or permit a release during a severe accident, are addressed as part of the passive categorization process. The conditional large early release probability (CLERP) guidelines should identify those piping parts in a system whose failure contributes significantly to fission product release as HSS segments. The NRC

staff concurs that the question in ASME Code Case N-660 Section I-3.1.3(b)(1) may be deleted because it is excessively conservative, and a question with the excessive conservatism removed is not expected to identify any piping as HSS piping that would not otherwise be identified.

The question in ASME Code Case N-660 Section I-3.1.3(a)(1) was deleted. ASME Code Case N-660 and the alternative method, as endorsed in this SE, categorize the passive functions of SSCs based on the quantitative PRA metrics conditional core damage probability (CCDP) and CLERP1. This question introduced PRA metrics based on the potential for pipe rupture events to increase the frequency of non-pipe rupture initiating events. However, all the effects of a pipe rupture, including all initiating events it causes, are already addressed as part of the passive categorization process. The NRC staff concurs that this question may be deleted because categorization based on PRA results is adequately addressed in Section I-3.1, and these additional quantitative metrics are not expected to identify any HSS piping that would not otherwise be identified.

3.2 Expanded Credit for Operator Actions The TR WCAP-16308-NP proposed to add guidance that would direct the expert panel to credit possible operator actions in the qualitative responses to the questions in ASME Code Case N-660 Sections I-3.1.3(a)(5) and I-3.1.3(b)(3) (modified and moved to questions I-3.2.2(b)(3) and I-3.2.2(b)(6) respectively in the TR). This proposal would allow the licensees expert panel to qualitatively decide that the undesired consequence postulated in the question could be avoided because, and only because, the operators took action. The TR argues that its proposal only permits credit if a procedure directs the operators response. However, symptom based procedures often direct the operators, in general, to develop and attempt mitigative actions and, therefore, any conceivable mitigative actions would arguably satisfy the criterion.

The NRC staff does not accept the proposal to credit operator action in these two questions.

The direct consequences of pipe failures addressed in these questions are (a) inability to reach and maintain shutdown and (b) large radioactive material release. Therefore, the conditional core damage probability and large early release frequency for these pipe breaks, without operator action, is 1.0. In order to reduce the conditional risk from these pipe breaks to below the HSS guideline values, the probability of the operators failing to accomplish the task should be 10-4 or less, a very small human error probability. The NRC staff does not believe that a qualitative judgment by the expert panel about operator actions following such uncommon events such as pipe ruptures can routinely support this determination.

The NRC staff concludes that the expert panels qualitative judgment is not sufficient to identify operator actions that have very low failure probabilities but also generally recognizes that risk-informed evaluations should reasonably credit operator actions. Therefore, the NRC staff further modified the question proposed in I-3.2.2(b)(3) of the TR to be consistent with both these positions.

1 Code Case N-660 and the proposed alternative method permit the use of tables instead of the quantitative guidelines directly, but the entries in the tables were derived from the quantitative CCDP and CLERP guidelines values.

The question is modified from:

• Even when taking credit for plant features and operator actions, failure of the piping segment will not prevent or adversely affect the plants capability to reach or maintain safe shutdown conditions.

To:

• Even when taking credit for plant features and operator actions, failure of the piping segment will not prevent or adversely affect the plants capability to reach or maintain reaching or maintaining safe shutdown conditions.

A piping failure which only adversely affects a plants shutdown capabilities would have a CCDP and CLERP less than 1.0 and the operator actions to mitigate only degraded, and not failed, shutdown capability need not be so highly reliable in order to be consistent with the quantitative guidelines. Degraded safety-significant functions are addressed in the TR question I-3.2.2(b)(1) which does permit qualitative consideration of operator actions.

When extensive engineering judgment is required in an evaluation, the NRC staff may require that the evaluation be submitted to the NRC to allow prior staff review and approval. Extensive engineering judgment is required to properly characterize very reliable operator actions following such unusual events as piping ruptures. If a licensee wants to credit operator actions in these particular circumstances described in ASME Code Case N-660 Sections I-3.1.3(a)(5) and I-3.1.3(b)(3), it may take this step and report its evaluation to the NRC as a deviation from the method described in the approved methodology. The NRC would then review the particular operator action, associated circumstances and the documentation supporting the conclusion and agree or disagree with the licensee expert panels conclusion that the documentation demonstrates that the likelihood of success of the operator action is indeed very high.

3.3 Consequence Evaluation Based on Small Break Size Section I-3-1.1(a) in ASME Code Case N-660 required that the consequence analysis be performed assuming a large pressure boundary failure unless one or more of the three criteria could be met. If any one of these criteria was met, a smaller break could be assumed when determining the affects of the pressure boundary failure. Smaller breaks tend to result in damage to fewer nearby SSCs and slower transients than larger breaks. Assessing the consequence for small instead of large breaks could result in assigning a lower safety significance to pressure boundary failures.

The first of the three criteria in ASME Code Case N-660 simply permits the consequences of a smaller leak to be used if more conservative than using a larger break. The second and third criteria, when met, provide confidence that a large break is very unlikely according to NRC endorsed methods regardless of how the piping in question is repaired or replaced.

The TR proposes to add a fourth criterion in I-3-1.1(a)(4):

{Alternatively, the consequence analysis can be performed assuming a smaller leak, when}

a small break with a calculated leak rate at design basis conditions for a through-wall flaw with a length six times its depth can be used when certain design and operational considerations are satisfied:

• the pipe segment is not susceptible to any large break mechanisms or plant controls are in place to minimize the potential for occurrence of large break mechanisms,

• a large break mechanism is one that produces significant loadings above the normal loading on the system and specifically includes water hammer for which no mitigation is provided and internal deflagrations, but excludes seismic,

• the pipe segment is not part of a high energy system, and

• the pipe segment is greater than 4 inches in diameter.

The NRC staff has evaluated the reasonableness of the specific criteria proposed by the NEI as supported by the Request for Additional Information (RAI) response in Reference 2.

1) Reference 2 cites insights taken from NUREG-1829, Estimating Loss-of-Coolant Accident (LOCA) Frequencies Through the Elicitation Process, regarding the low likelihood of pipe ruptures. However, NUREG-1829 only applies to the reactor coolant pressure boundary (high pressure system) and can not be used as a basis to draw conclusions regarding the probability of failure for low pressure systems (e.g., service water systems). The reactor coolant pressure boundary is built and maintained to the highest quality standards. In addition, leak-before-break evaluations have been performed for numerous facilities in order to demonstrate a low probability of failure. The low pressure systems are not subject to the same quality standards as the reactor coolant pressure boundary.

2) Reference 2 also cites the use of earthquake experience in resolution of Generic Letter (GL) 87-02, "Verification of Seismic Adequacy of Mechanical and Electrical Equipment in Operating Reactors, Unresolved Safety Issue (USI) A-46," as providing evidence of the capacity of the piping to withstand seismic loads. The NRC staff did not endorse the use of earthquake experience for piping in the resolution of GL 87-02. However, the existing earthquake experience data indicates that low pressure systems are more likely to fail during earthquakes than high pressure systems (see NUREG-1061, Volume 2 Addendum, Section 2.2.7).

3) Reference 2 also states that a pipe diameter of 4 inches was selected to coincide with the ASME definition of small bore piping. The NRC staff does not concur that this is the ASME definition of small bore piping.

4) Reference 2 states that the appropriate small break size for consideration in passive components is the calculated leak rate at normal conditions for a through-wall flaw with a length six times its depth. This discussion cites NUREG-1829 as part of the basis for this assumption.

However, as discussed above, NUREG-1829 only applies to the reactor coolant pressure boundary and its evaluations and conclusions cannot be extrapolated to low pressure service water systems.

Implementation of 10 CFR 50.69 permits licensees to change the special treatment requirements applied to LSS SSCs. The failure frequency of piping is generally not well known.

Instead of attempting to estimate the frequency of piping failure, passive categorization is based on the consequence of failure. Any piping segment with a CCDP or CLERP greater than 1E-4 and 1E-5 respectively, will be HSS. Therefore, at the (unlikely) limit where the failure likelihood of a LSS segment approaches 1.0, there is a known upper bound on the risk increase. If, however, the consequences of a small break are used instead of a large break, the CCDP or CLERP of a large break in an LSS segment could exceed the guideline values by an indeterminate magnitude. In ASME Code Case N-660, the NRC staff only accepted use of the consequences based on the small break only if the larger break is very unlikely based on the

results of analyses endorsed by the NRC staff.

The NRC staff relies on the limitation in the potential risk increase provided by categorization based solely on the consequences of a pipe break to satisfy the criterion in 10 CFR 50.69(c)(1)(iv) that any potential increase in risk is small. The guidelines proposed in the TR are not endorsed for use in the piping systems that will be categorized because they do not provide the necessary confidence that the large break is very unlikely. Therefore, the NRC staff concludes that the proposal to include additional guidelines permitting the use of smaller breaks is not acceptable.

3.4 Monitoring of RISC-1 and RISC-2 SSCs TR WCAP-16308-NP states that the Wolf Creek Nuclear Operating Corporation (WCNOC), the licensee for WCGS, intends to comply with 10 CFR 50.69 without exception. RISC-1 and RISC-2 SSCs will be monitored in the same manner as they are presently monitored under 10 CFR 50.65, Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, (the Maintenance Rule). As clarification, the NEI stated that monitoring will address all functional failures, not just maintenance preventable functional failures; and that to the extent that any RISC-1 or RISC-2 SSCs are not in the Maintenance Rule scope, appropriate monitoring requirements will be developed for those SSCs.

In addition to monitoring under 10 CFR 50.65, RISC-1 SSCs are subject to the regulatory requirements for safety-related equipment specified in 10 CFR Part 50. For example, SSCs within the scope of the ASME Boiler and Pressure Vessel Code and ASME Code for Operation and Maintenance of Nuclear Power Plants are required to meet the ISI and IST requirements specified in 10 CFR 50.55a. Among those requirements is the IST provision for periodically assessing the operational readiness of pumps and valves to perform their safety functions, and the ISI provisions that require a mandatory program of examinations, pressure testing, and inspections for determining component acceptability for continued service and to manage deterioration and aging effects, along with repair/replacement activity requirements. Further, Quality Assurance Criterion XVI, Corrective Action, in 10 CFR Part 50, Appendix B, states that measures shall be established to assure that conditions adverse to quality are promptly identified and corrected. In the case of significant conditions adverse to quality, Criterion XVI requires that the measures shall assure that the cause of the condition is determined and corrective action taken to preclude repetition.

The NRC staff finds that monitoring of RISC-1 and RISC-2 SSCs as specified under 10 CFR 50.65, or through appropriate equivalent requirements for non-maintenance rule scoped items, together with the safety-related requirements for monitoring RISC-1 SSCs, provide an adequate means of monitoring these SSCs such that the results of this monitoring can be used to adjust the categorization or treatment processes so that the categorization and results are maintained valid. This conclusion is based on the safety-related requirements for RISC-1 SSCs and the requirements in 10 CFR 50.65 applicable to RISC-1 and RISC-2 SSCs that the performance or condition of SSCs be monitored in a manner sufficient to provide reasonable assurance that in-scope SSCs are capable of fulfilling their intended functions. Therefore, the NRC staff finds that the performance of monitoring, in accordance with safety-related requirements for RISC-1 SSCs, and the implementation of a monitoring program that satisfies 10 CFR 50.65, or an appropriate equivalent, for the purpose of RISC-1 and RISC-2 SSCs, provide an adequate means of satisfying the monitoring requirements of 10 CFR 50.69(e)(2).

3.5 Monitoring of RISC-3 SSCs TR WCAP-16308-NP states that performance monitoring of RISC-3 SSCs will be established to provide assurance that potential increases in failure rates will be detected and addressed before reaching the rate assumed in the sensitivity study. Failures of RISC-3 SSCs will be identified and tracked in a corrective action program. Failure data will be periodically assessed to ensure the failure rate of RISC-3 SSCs has not unacceptably increased due to the changes in treatment and to validate that the rate of equipment failures has not increased by a factor greater than that used in the sensitivity studies. Component group failure data will also be reviewed to detect the occurrence of potential inter-system common cause failures and to allow timely corrective action if necessary.

The NRC staff notes that NRC Regulatory Guide (RG) 1.201, revision 1, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to Their Safety Significance, describes an acceptable method for the categorization of SSCs based on safety significance; and that the endorsed Nuclear Energy Institute (NEI) guidance document NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline, provides an acceptable method for adjusting categorization based on the performance monitoring of RISC-3 SSCs. RG 1.201 does not, however, endorse a particular treatment strategy for RISC-3 SSCs, including the specific inspection, testing and corrective action plans that would be used to ensure that degradation and common cause failure concerns will be addressed.

Although the TR discusses how failure data for RISC-3 SSCs will be used to satisfy the monitoring requirements of 10 CFR 50.69(e)(3) with respect to the adjustment of categorization and treatment based on unreliability values used in the sensitivity study, it does not contain a specific discussion of how monitoring for degradation of RISC-3 SSCs and corrective actions will be accomplished. In a response to an NRC staff RAI regarding corrective action for degradation of RISC-3 SSCs, the NEI stated that WCGS has not developed plant specific methods for corrective actions to address degradation of RISC-3 SSCs. For example, specific information on periodic inspections and tests that could be used to detect and correct degradation of RISC-3 SSCs was not provided. Although the staff concludes that Section 7.3 of TR WCAP-16308-NP describes a process for adjusting categorization and treatment, based on the results of monitoring RISC-3 SSCs and impacts on the unreliability values used in the sensitivity study, that satisfies 10 CFR 50.69(e)(3), there is insufficient information to determine if the monitoring and corrective actions for degradation of RISC-3 SSCs would provide timely correction of conditions that would prevent these SSCs from performing their safety functions, as required by 10 CFR 50.69(d)(2)(ii). In particular, licensees implementing 10 CFR 50.69 will need to address the cause of SSC degradation and preclude its repetition.

3.6 Application of RISC-3 Treatment Requirements The NRC staff notes that 10 CFR 50.69(b)(2) does not require that a licensee voluntarily choosing to implement the rule submit their plan for treatment of SSCs to the NRC for review and approval. Although the primary objective of TR WCAP-16308-NP is to provide documentation of the categorization process used by WCGS to support implementation of 10 CFR 50.69, Section 8 of the TR also contains a brief description of the application of RISC-3 treatment requirements. Therefore, the staff is providing the following evaluation regarding treatment of RISC-3 SSCs as described in WCAP-16308-NP.

TR WCAP-16308-NP states that WCGS will develop and implement documented processes to control the design, procurement, inspection, and maintenance to ensure, with reasonable confidence, that RISC-3 SSCs remain capable of performing their safety-related functions under design basis conditions. In its response to an NRC staff RAI, the NEI stated that WCGS has not developed plant specific methods for inspection, testing, and corrective actions for RISC-3 SSCs to ensure, with reasonable confidence, that RISC-3 SSCs remain capable of performing their safety-related functions under design-basis conditions. In addition, the response stated that WCGS would apply commercial grade practices to the procurement, maintenance, and testing of RISC-3 SSCs.

The NRC staff finds that the general information provided in TR WCAP-16308-NP and in the RAI response does not provide a sufficient basis for determining that the regulatory requirements of 10 CFR 50.69(d)(2) would be satisfied.

The general reference by the NEI to the use of commercial grade practices in its response to the RAI on Section 8 of TR WCAP-16308-NP does not provide reasonable confidence in the functionality of RISC-3 SSCs, given the wide range of quality activities applied to these practices and their varying levels of effectiveness. For example, in the Federal Register notice (69 FR 68008, 68041) announcing issuance of 10 CFR 50.69, the NRC noted that some public comments on the proposed rule suggested that a reference to general industry practices would be sufficient to satisfy the requirements for treatment of RISC-3 SSCs. The NRC referred to NUREG/CR-6752, A Comparative Analysis of Special Treatment Requirements for Systems, Structures, and Components (SSCs) of Nuclear Power Plants With Commercial Requirements of Non-Nuclear Power Plants, which found that significant variation exists in the application of industrial practices at nuclear power plants. The NRC stated that a simple reference to these practices does not provide a basis to satisfy the rules requirements.

The regulation at 10 CFR 50.69(d)(2)(ii) requires that conditions that would prevent a RISC-3 SSC from performing its safety-related function under design-basis conditions must be corrected in a timely manner. Section 8 of WCAP-16308-NP refers to Section 7 of the TR for a discussion of the WCGS approach to RISC-3 corrective action. As described previously, the NRC staff finds that the TR and RAI responses rely primarily on monitoring of SSC failures and do not provide sufficient information to draw a conclusion that degradation of RISC-3 SSCs will be monitored and corrected in a manner that provides reasonable confidence that these SSCs would continue to perform their safety-related functions under design-basis conditions.

Therefore, licensees electing to implement 10 CFR 50.69 would be expected to implement a treatment program for RISC-3 SSCs that contains elements beyond a simple reference to commercial practices and monitoring of failure rates to provide reasonable confidence that RISC-3 SSCs will remain capable of performing their safety-related functions under design basis conditions, including seismic conditions and environmental conditions and effects throughout their service life.

4.0 LIMITATIONS AND CONDITIONS

1. This NRC staff safety evaluation (SE) only provides conclusions, findings, or endorsements for the proposed passive categorization methodology described in the TR. It does not provide conclusions, findings, or endorsements for issues, methods, or results outside the scope of the passive categorization methodology.

2. The alternative method proposed by the TR is described by modifying the method described in ASME Code Case N-660 according to the changes described in Reference 3, Table A-2. The NRC staff does not find this alternative method acceptable but, instead, would endorse the method described by modifying ASME Code Case N-660 according to the changes described in Table 1 of this SE. The TR should be modified in the approved (-A) version of the TR, to incorporate the changes identified in Table 1 of this SE. The NRC staff will not accept submittals referencing TR WCAP-16308-NP as an approved passive categorization methodology unless the method used in the submittal incorporates the changes identified in Table 1 as Objection requiring qualification.

3. As described in Section 3.2 of the SE, the NRC staff does not accept the proposal to add guidance that would direct the expert panel to credit possible operator actions in the qualitative responses to the questions in ASME Code Case N-660 Sections I-3.1.3(a)(5) and I-3.1.3(b)(3). Operator actions would need to be very reliable in order to be appropriately relied on to reduce the consequences of these pipe ruptures below the guideline values. The NRC staff does not believe that a qualitative judgment by the expert panel about operator actions following such uncommon events such as pipe ruptures can routinely support a determination that the action is very reliable. Licensees that want to credit operator actions in the response to these questions should report their evaluation to the NRC as a deviation from the NRC-approved methodology.

4. As described in Section 3.3 of the SE, the NRC staff relies on the limitation in the potential risk increase provided by categorization based solely on the consequences of a pipe break to satisfy the criterion in 10 CFR 50.69(c)(1)(iv) that any potential increase in risk is small. The guidelines proposed in the TR are not endorsed for use in the piping systems that will be categorized because they do not provide the necessary confidence that the large break is very unlikely. Therefore, the NRC staff concludes that the proposal to include additional guidelines permitting the use of smaller breaks is not acceptable.

5. Licensees that implement 10 CFR 50.69 must develop and implement plant-specific programs to ensure that monitoring and corrective actions for degradation of RISC-3 SSCs will ensure the requirements of 10 CFR 50.69(d)(2)(ii) will be met. In particular, licensees implementing 10 CFR 50.69 will need to address the cause of SSC degradation and preclude its repetition.

6. Licensees that implement 10 CFR 50.69 must develop and implement plant-specific programs to ensure that treatment of RISC-3 SSCs is in accordance with 10 CFR 50.69(d)(2) and provides reasonable confidence that RISC-3 SSCs will remain capable of performing their safety-related functions under design-basis conditions.

5.0 CONCLUSION

S The NRC staff has found that only portions of the alternative methodology proposed in TR WCAP-16308-NP, Revision 0, are acceptable. The NRC staff has identified the specific items in the proposal that are not acceptable in this SE. Table 1 of this SE, identifies changes to the method proposed in WCAP-16308-NP that, if made, will result in an acceptable method to categorize SSCs as HSS or LSS based on the safety-significance of the passive functions they perform. Each change, and the NRC staff position on each change, is described in Table 1. A description of the approved methodology can be obtained by modifying the guidance in ASME Code Case N-660 as described in Table 1.

The NRC staff will not repeat its review of the matters described in WCAP-16308-NP, Revision 0 as modified by Table 1 in this SE, when the report appears as a reference in a request to amend a licensees operating license to comply with the requirements of 10 CFR 50.69.

5.1 Monitoring of RISC-1 and RISC-2 SSCs The NRC staff has reviewed the description of monitoring of RISC-1 and RISC-2 SSCs provided in Section 7.2 of TR WCAP-16308-NP. The NRC staff concludes that the TR has adequately addressed the monitoring of RISC-1 and RISC-2 SSCs for the WCGS 10 CFR 50.69 pilot program. Therefore, the NRC staff finds Section 7.2 of TR WCAP-16308-NP to be acceptable with respect to the monitoring of RISC-1 and RISC-2 SSCs together with the safety-related requirements for RISC-1 SSCs.

5.2 Monitoring of RISC-3 SSCs The NRC staff has reviewed the discussion of monitoring of RISC-3 SSCs provided in Section 7.3 of TR WCAP-16308-NP. Based on its review, the NRC staff concludes that the TR describes an adequate means for adjusting the categorization or treatment process, based on the results of monitoring RISC-3 SSCs and the unreliability values used in the sensitivity study, in accordance with 10 CFR 50.69(e)(3) for the WCGS 10 CFR 50.69 pilot program. However, the NRC staff finds that Section 7.3 of TR WCAP-16308-NP does not provide sufficient information on monitoring and correction of degradation of RISC-3 SSCs to conclude that conditions that would lead to adverse changes in performance of RISC-3 SSCs will be monitored and corrected in accordance with 10 CFR 50.69(d)(2)(ii). Licensees that implement 10 CFR 50.69 must develop and implement plant-specific programs to ensure that monitoring and corrective actions for conditions that could prevent RISC-3 SSCs from performing their safety-related functions under design basis conditions will be implemented in a timely manner as required by 10 CFR 50.69(d)(2)(ii).

5.3 Application of RISC-3 Treatment Requirements The NRC staff has reviewed the discussion of treatment of RISC-3 SSCs provided in Section 8 of WCAP-16308-NP. The NRC staff concludes that the TR has not adequately addressed the treatment of RISC-3 SSCs for the WCGS 10 CFR 50.69 pilot program. Specifically, the NRC staff finds that Section 8 of WCAP-16308-NP does not contain sufficient information on treatment of RISC-3 SSCs to provide reasonable confidence that RISC-3 SSCs will continue to perform their safety-related functions under design-basis conditions consistent with 10 CFR 50.69. Licensees that implement 10 CFR 50.69 must develop and implement plant-

specific programs to ensure that treatment of RISC-3 SSCs is in accordance with 10 CFR 50.69(d)(2) and provides reasonable confidence that RISC-3 SSCs will remain capable of performing their safety-related functions under design-basis conditions.

6.0 REFERENCES

1. B. Bradley (Nuclear Energy Institute) to U. S. Nuclear Regulatory Commission, Submittal of Topical Report on 10 CFR 50.69 Application, September 25, 2006 (ML062770345).

2. B. Bradley, (Nuclear Energy Institute) to U. S. Nuclear Regulatory Commission, Response to NRC Request for Additional Information Regarding WCAP-16308-NP, 10 CFR 50.69 Application, October 22, 2007 (ML080780403).

3. B. Bradley, (Nuclear Energy Institute) to U. S. Nuclear Regulatory Commission, Revisions to WCAP-16308-NP, Pressurized Water Reactor Owners Group 10 CFR 50.69 Pilot Program - Categorization Process, July 15, 2008 (ML082200518).

4. RG 1.201, Guidelines For Categorizing Structures, Systems, And Components In Nuclear Power Plants According To Their Safety Significance, For Trial Use, Revision 1 (ML061090627).

5. NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline, Revision 0, July 2005 (ML0529001630).

6. ASME Code Case, N-660, Risk-Informed Safety Classification for Use in Risk-Informed Repair/Replacement Activities, July 2002.

7. RG 1.147, Inservice Inspection Code Case Acceptability, ASME Section XI, Division 1 (Ml072070419).

8. RG 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis (ML023240437).

Attachments: 1. Table 1

2. Resolution of Comments Principal Contributors: T. Scarbrough K. Hoffman S. Dinsmore J. Fair Date: March 26, 2009

Table 1 - NRC Staff Position on Proposed Changes in ASME Code Case N-660 in TR WCAP-16308 Resolution of WCAP-16308 Section WCAP-16308 Changes to Code

{N-660, R0 Case N-660 Text not marked Section} NRC Staff additions in Bold,

[WCAP-16308 deletions in Strikeout, and Section] ASME Code Case N-660 Revision 0 Position comments in Italic

{-1320} -1320 Required Disciplines No -1320 Required Disciplines

[-1320] Personnel with expertise in the Objection (a) An Integrated Decisionmaking following disciplines shall be included Panel (IDP) shall use the information in the classification process. and insights compiled in the initial (a) probabilistic risk assessment categorization process and combine (PRA) that with other information from design (b) plant operations bases, defense-in-depth, and safety (c) system design margins to finalize the categorization (d) safety or accident analysis of functions/SSCs.

Personnel may be experts in more (b) The designated as members of the than one discipline, but are not IDP shall have joint expertise in the required to be experts in all following fields:

disciplines. - Plant Operations (SRO qualified),

- Design Engineering,

- Safety analysis,

- Systems Engineering, and

- Probabilistic Risk Assessment.

(c) Requirements for ensuing adequate expertise levels and training of IDP members in the categorization process shall be established.

(d) To the extent possible, the classification of pressure retaining and support items in a system should be performed by the same IDP members as the categorization of active SSCs in that system.

ATTACHMENT 1

Resolution of WCAP-16308 Section WCAP-16308 Changes to Code

{N-660, R0 Case N-660 Text not marked Section} NRC Staff additions in Bold,

[WCAP-16308 deletions in Strikeout, and Section] ASME Code Case N-660 Revision 0 Position comments in Italic

{-9000} high-safety-significant function - a No objection high-safety-significant function - a

[-9000] function that has been determined to function that has been determined to be safety significant from traditional be safety significant from traditional plant risk-assessment evaluations of plant risk-assessment evaluations of core damage or large early release core damage or large early release events (e.g., evaluations performed events (e.g., evaluations performed to to support the Maintenance Rule - 10 support the Maintenance Rule - 10 CFR 50.65). CFR 50.65) or from other relevant information (e.g., defense in depth probabilistic risk assessment (PRA) - considerations) a qualitative and quantitative assessment of the risk associated with plant operation and probabilistic risk assessment (PRA) -

maintenance... an assessment of the risk associated with plant operation and spatial effect - a failure consequence maintenance...

affecting other systems or components, such as failures due to pipe whip, jet impingement, or flooding. spatial effect - a failure consequence affecting other systems or components, such as failures due to pipe whip, jet impingement, jet spray, loss of inventory due to draining of a tank, or flooding.

{ } No objection Plant features - systems, structures,

[-9000] and components that can be used to prevent or mitigate an accident.

{I-1.0} Once categorized, the safety No objection Once categorized, the safety

[I-1.0] significance of piping of each piping significance of piping of each piping segment is identified. segment is identified. Figure I-1 illustrates the RISC methodology presented in the following sections.

[Figure I-1]

Resolution of WCAP-16308 Section WCAP-16308 Changes to Code

{N-660, R0 Case N-660 Text not marked Section} NRC Staff additions in Bold,

[WCAP-16308 deletions in Strikeout, and Section] ASME Code Case N-660 Revision 0 Position comments in Italic

{I-2.0} The owner shall define the Objection The owner shall define the boundaries

[I-2.0] boundaries included in the scope of requiring included in the scope of the RISC the RISC evaluation process. qualification evaluation process subject to the constraints in paragraph 50.59(c)(1)(v) that the categorization must be performed for entire systems. Items optionally classified to Class 1 and Class 1 items connected to the reactor coolant pressure boundary, as defined in paragraphs 10 CFR 50.55a (c)(2)(i) and (c)(2)(ii), are within the scope of the RISC evaluation process. All other Class 1 items shall be classified High Safety Significant (HSS) and the provisions of the RISC evaluation shall not apply.

{I-3.0} CONSEQUENCE ASSESSMENT No objection EVALUATION OF RISK INFORMED

[I-3.0] SAFETY CLASSIFICATIONS

{I-3.0} Piping segments can be grouped No objection All pressure retaining items, including

[I-3.0] based on common conditional supports for a piping system, shall be consequence evaluated by defining piping segments that are grouped based on common conditional consequence

Resolution of WCAP-16308 Section WCAP-16308 Changes to Code

{N-660, R0 Case N-660 Text not marked Section} NRC Staff additions in Bold,

[WCAP-16308 deletions in Strikeout, and Section] ASME Code Case N-660 Revision 0 Position comments in Italic

{I-3.0} Additionally, information shall be Objection Changed to read, Additionally,

[I-3.0] collected for each piping segment requiring information considered relevant to the that is not modeled in the PRA, but qualification classification shall be collected for considered relevant to the each piping segment (e.g., information classification (e.g., information regarding design basis accidents, at-regarding design basis accidents, power risk, shutdown risk, shutdown risk, containment isolation, containment isolation, flooding, fires, flooding, fires, seismic conditions). seismic conditions, etc.). Consistent with 50.69(c)(1)(ii), the classification must address all initiating events and plant operating modes. This other relevant information is considered in conjunction with the Consequence Category to determine the Risk Informed Safety Classification. The Consequence Category is Determined from the Consequence Evaluation.

{I-3.1.1} Potential failure modes for each No objection Potential failure modes for each

[I-3.1.1] piping segment shall be identified system or piping segment shall be identified

Resolution of WCAP-16308 Section WCAP-16308 Changes to Code

{N-660, R0 Case N-660 Text not marked Section} NRC Staff additions in Bold,

[WCAP-16308 deletions in Strikeout, and Section] ASME Code Case N-660 Revision 0 Position comments in Italic

{ } Objection Entire proposed section should be

[I-3.1.1(a)(4)] requiring deleted qualification (4) a small break with a calculated leak rate at design basis conditions for a through-wall flaw with a length six times its depth can be used when certain design and operational considerations are satisfied:

- the pipe segment is not susceptible to any large break mechanisms or plant controls are in place to minimize the potential for occurrence of large break mechanisms,

+ a large break mechanism is one that produces significant loadings above the normal loading on the system and specifically includes water hammer for which no mitigation is provided and internal deflagrations, but excludes seismic,

- the pipe segment is not part of a high energy system,

- the pipe segment is greater than 4 inches in diameter.

{-3.1.1(c)} Indirect Effects. These include No objection Indirect Effects. A failure consequence

[I-3.1.1(c)] spatial interactions such as pipe affecting other systems or whip, jet spray, and loss of inventory components, such as spatial effects.

effects (e.g., draining of a tank).

{-3.1.1(d)} Initiating Events. These are identified No objection Initiating Events. For systems or

[I-3.1.1(d)] using a list of initiating events from piping segments that are modeled any existing plant specific either explicitly or implicitly in any Probabilistic Risk Assessment (PRA) existing plant-specific Probabilistic or Individual Plant Examination (IPE) Risk Assessment (PRA), any and the Owners Requirements. applicable initiating event is identified using a list of initiating events from that PRA.

{-3.1.2} (high, medium, low)... No objection (high, medium, low, or none)

[I-3.1.2]

Resolution of WCAP-16308 Section WCAP-16308 Changes to Code

{N-660, R0 Case N-660 Text not marked Section} NRC Staff additions in Bold,

[WCAP-16308 deletions in Strikeout, and Section] ASME Code Case N-660 Revision 0 Position comments in Italic

{I-3.1.2} ... in accordance with (a) through (d) Objection ... in accordance with (a) through (d)

[I-3.1.2] below. requiring below. In assessing the appropriate qualification consequence category, risk information for all initiating events, including fire and seismic, should be considered. To capture the risk importance from initiating events for which no quantitative PRA is available, any piping segment supporting a safe shutdown pathway would be classified as HSS.

{I-3.1.2(a)(1)} The initiating event shall be placed in No objection The initiating event shall be placed in

[I-3.1.2(a)(1)] one of the categories in Table I-1. one of the Design Basis Event Categories in Table I-1.

{I-3.1.2(a)(1)} updated final safety analysis No objection updated final safety analysis report

[I-3.1.2(a)(1)] report, PRA, or IPE shall be included. or PRA shall be included

{I-3.1.2(b)(1)} Frequency of challenge that No objection Frequency of challenge that

[I-3.1.2(b)(1)] determines how often the mitigating determines how often the affected function of the system is called upon. function of the system is called upon.

This corresponds to the frequency of This corresponds to the frequency of initiating events that require the events that require the system system operation. operation.

{I-3.1.2(b)(3)} Exposure time shall be obtained from No objection Direction may be deleted because the

[ ] Technical Specification limits. same direction appears earlier in the paragraph.

{I-3.1.2(b)(3)} In lieu of Table I-2, quantitative No objection In lieu of Table I-2, quantitative indices

[I-3.1.2(b)] indices may be used to assign may be used to assign consequence consequence categories in categories in accordance with Table I-accordance with Table I-5. 5.

{I-3.1.2(d)} The above evaluations determine No objection The above evaluations determine

[I-3.1.2(d)] failure importance relative to core failure importance relative to core damage. damage or the plants capability to reach or maintain safe shutdown conditions.

Resolution of WCAP-16308 Section WCAP-16308 Changes to Code

{N-660, R0 Case N-660 Text not marked Section} NRC Staff additions in Bold,

[WCAP-16308 deletions in Strikeout, and Section] ASME Code Case N-660 Revision 0 Position comments in Italic

{I-3.1.3} If any of the conditions in (a) or (b) Objection Piping segments determined to be below are true, the piping shall be requiring Medium, Low or None (no change to classified HSS. qualification base case) consequence category in any table by the consequence

{I-3.1.3(b)} evaluation in Section I-3.1 shall be In addition to being HSS in terms of determined HSS or LSS by their contribution to CDF or LERF, considering the other relevant piping segments might also be HSS information for determining in terms of other risk metrics or classification. The following conditions conditions. Therefore, the following shall be evaluated and answered true conditions shall be evaluated.

{I-3.2.2(b)} or not true. If any of the following above eleven (11) conditions are Piping segments determined to be not true, HSS should be assigned.

Medium consequence category in .

any table by the consequence evaluation (I-3.1.1) and (I-3.1.2) shall be determined HSS or LSS by If any of the above eleven (11) considering the RISC evaluation and conditions are not true, HSS should be the other relevant information (I- assigned.

[I-3.2.2(b)] 3.1.3, I-3.1.4, and I-3.1.5) provided for determining classification.

{I-3.1.3(a)(1)} Failure of the piping segment will No objection Consideration may be deleted

[ ] significantly increase the frequency of because additional quantitative risk an initiating event, including those guidelines are unnecessary when initiating events originally screened passive classification is performed out in the PRA, such that the CDF or based on consequences large early release frequency (LERF) would be estimated to increase by more than 10-6/yr or 10-7/yr, respectively.

{I-3.1.3(a)(2)} Failure of the piping segment will No objection Consideration may be deleted

[ ] compromise the integrity of the because -1200(b) is retained and reactor coolant pressure boundary as already assigns the same piping to the defined in -1200(b). HSS category.

Resolution of WCAP-16308 Section WCAP-16308 Changes to Code

{N-660, R0 Case N-660 Text not marked Section} NRC Staff additions in Bold,

[WCAP-16308 deletions in Strikeout, and Section] ASME Code Case N-660 Revision 0 Position comments in Italic

{I-3.1.3(a)(3)} Even when considering operator Objection Even when taking credit for plant

[I-3.2.2(b)(1)] actions used to mitigate an accident, requiring features and operator actions, failure failure of the piping segment will fail a qualification of the piping segment will not directly high safety significant function. fail another high safety-significant function.

{I-3.1.3(a)(4)} Failure of the piping segment will Objection Failure of the piping segment will not

[I-3.2.2(b)(2)] result in failure of other safety- requiring result in failure of another high safety-significant piping segments, e.g., qualification significant piping segment, e.g.,

through indirect effects. through indirect effects.

{I-3.1.3(a)(5)} Failure of the piping segment will Objection Consideration changed and moved to prevent or adversely affect the plants requiring new Section I-3.2.2(b)(3), Even when

[I-3.2.2(b)(3)]

capability to reach or maintain safe qualification taking credit for plant features and shutdown conditions. operator actions, failure of the piping segment will not prevent or adversely affect the plants capability to reach or maintain reaching or maintaining safe shutdown conditions.

{I-3.1.3(b)(1)} The piping segment is a part of a No objection Consideration may be deleted. The system that acts as a barrier to original guidance is excessively

[ ]

fission product release during severe conservative. Once the excessive accidents. conservatism is removed, the response to this consideration is not expected to identify any piping as HSS piping that would not be assigned HSS by the CLERP related guidelines.

{I-3.1.3(b)(2)} The piping segment supports a No objection The piping segment does not

[I-3.2.2(b)(4)] significant mitigating or diagnosis individually support a sole means for function addressed in the Emergency successful performance of operator Operating Procedures or the Severe actions addressed in the Emergency Accident Management Guidelines. Operating Procedures or the Severe Accident Management Guidelines required to mitigate an accident or transient, including instrumentation and other equipment associated with the required actions.

Resolution of WCAP-16308 Section WCAP-16308 Changes to Code

{N-660, R0 Case N-660 Text not marked Section} NRC Staff additions in Bold,

[WCAP-16308 deletions in Strikeout, and Section] ASME Code Case N-660 Revision 0 Position comments in Italic

{I-3.1.3(b)(3)} Failure of the piping segment will Objection Even when taking credit for plant

[I-3.2.2(b)(6)] result in unintentional releases of requiring features and operator actions, fFailure radioactive material in excess of plant qualification of the piping segment will not result in offsite dose limits specified in 10 CFR releases of radioactive material that Part 100. would result in the implementation of off-site emergency response and protective actions.

Resolution of WCAP-16308 Section WCAP-16308 Changes to Code

{N-660, R0 Case N-660 Text not marked Section} NRC Staff additions in Bold,

[WCAP-16308 deletions in Strikeout, and Section] ASME Code Case N-660 Revision 0 Position comments in Italic

{I-3.1.4} Maintain Defense in Depth. When No objection The RISC process shall demonstrate

[I-3.2.2(b) categorizing piping segments LSS, that the defense-in-depth philosophy is the RISC process shall demonstrate maintained. Defense-in-depth may be (7-11)]

that the defense-in-depth philosophy demonstrated by following the is maintained. Defense-in-depth may guidelines of U.S.N.R.C. Regulatory be demonstrated by following the Guide 1.174, Revision 1, An guidelines of U.S.N.R.C Regulatory Approach for Using Probabilistic Risk Guide 1.174, An Approach for Using Assessment In Risk-Informed Probabilistic Risk Assessment In Decisions On Plant-Specific Changes Risk-Informed Decisions On Plant to the Licensing Basis, dated Specific Changes to the Licensing November 2002. Defense-in-depth is Basis. Dated July 1998. maintained if:

(7) A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

(8) Over-reliance on programmatic activities to compensate for weaknesses in plant design is avoided.

(9) System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g., no risk outliers).

(10) Defenses against potential common cause failures are preserved, and the potential for the introduction of new common cause failure mechanisms is assessed.

(11) Independence of fission-product barriers is not degraded.

Resolution of WCAP-16308 Section WCAP-16308 Changes to Code

{N-660, R0 Case N-660 Text not marked Section} NRC Staff additions in Bold,

[WCAP-16308 deletions in Strikeout, and Section] ASME Code Case N-660 Revision 0 Position comments in Italic

{I-3.1.5} Maintenance of Adequate Safety No objection If LSS has been assigned from I-

[I-3.2.2(c)] Margins. When categorizing piping 3.2.2(b), then the RISC process shall segments LSS, the RISC process verify that there are sufficient safety shall verify that there are sufficient margins to account for uncertainty in safety margins to account for the engineering analysis and in the uncertainty in the engineering supporting data. Safety margin shall analysis and in the supporting data. be incorporated when determining Safety margin shall be incorporated performance characteristics and when determining performance parameters, e.g., piping segment, characteristics and parameters, e.g., system, and plant capability or piping segment, system, and plant success criteria. The amount of margin capability or success criteria. The should depend on the uncertainty amount of margin should depend on associated with the performance the uncertainty associated with the parameters in question, the availability performance parameters in question, of alternatives to compensate for the availability of alternatives to adverse performance, and the compensate for adverse consequences of failure to meet the performance, and the consequences performance goals. Sufficient safety of failure to meet the performance margins are maintained by:

goals. Sufficient safety margins are (1) Ensuring that safety analysis maintained by ensuring that safety acceptance criteria in the plant analysis acceptance criteria in the licensing basis are met, or plant licensing basis are met, or (2) Ensuring that proposed proposed revisions account for revisions account for analysis analysis and data uncertainty.

and data uncertainty.

If LSS has been assigned from I-3.2.2(b) and at least one of the above safety margin conditions are true, then LSS should be assigned; if both of the above safety margin conditions are not true, then HSS shall be assigned.

{I-3.2} I-3.2 Classification Objection I-3.2 Classification

[I-3.2] requiring Risk Informed Safety Classification is qualification determined by considering the Consequence Category in conjunction with other relevant information.

Resolution of WCAP-16308 Section WCAP-16308 Changes to Code

{N-660, R0 Case N-660 Text not marked Section} NRC Staff additions in Bold,

[WCAP-16308 deletions in Strikeout, and Section] ASME Code Case N-660 Revision 0 Position comments in Italic

{I-3.2.2(b)} Any piping segment initially No objection The plant condition monitoring

[I-3.2.2(b)(5)] determined to be a Medium program would identify any known consequence category and that is active degradation mechanisms in the subject to a known active pipe segment prior to its failure in test degradation mechanism shall be or an actual demand event (e.g., flow classified HSS. accelerated corrosion program).

{ } No objection To credit operator actions, the following criteria must be met:

[I-3.2.2(b) footnote]

• There must be an alarm or clear indication of the failure.

• A procedure must direct the response to the alarm or indication.

• Equipment activated to alleviate the condition must not be affected by the failure.

There must be sufficient time to perform the compensatory action.

{Table I-1 row N/A No objection None I}

[Table I-1 row I]

Note 1 - Figure I-1, Risk-Informed Safety Classification Process Scope Identification Select system and define boundaries for evaluation Consequence Evaluation Perform FMEA considering Direct &

Indirect Effects Identify Impact Groups: Initiating Event, System/Train, Combination, Containment Consequence Categorization Determine Consequence Ranking from Quantitative Indices or Consequence Category Tables Classification Considerations Consider other relevant information, including defense-in-depth principles, for Medium/Low/None consequence categories Final Classification Definitions HSS - high-safety-significant LSS - low-safety-significant Figure I-1 Risk-Informed Safety Classification Process

RESOLUTION OF COMMENTS ON DRAFT SAFETY EVALUATION (SE) FOR TOPICAL REPORT (TR) WCAP-16308-NP, REVISION 0 PRESSURIZED WATER REACTOR OWNERS GROUP 10 CFR [TITLE 10 OF THE CODE OF FEDERAL REGULATIONS] 50.69 PILOT PROGRAM -

CATEGORIZATION PROCESS - WOLF CREEK GENERATING STATION [(WCGS)]

NUCLEAR ENERGY INSTITUTE (NEI)

PROJECT NO. 689 By letter dated October 14, 2008, the NEI provided three substantive comments on the draft SE for TR WCAP-16308-NP, Revision 0. The following are the U.S. Nuclear Regulatory Commission (NRC) staffs resolution of these comments.

NEI Comment #1: Credit for Operator Actions On page 5 of the Draft SE at lines 28 through 34, the NRC staffs technical evaluation of operator actions can be misinterpreted by licensees with respect to the types of operator procedures and guidance that can be credited for operator actions. Emergency procedures, some of which are very prescriptive if-then instructions requiring verbatim compliance by the operators, are frequently referenced by symptom-based procedures. When these human actions are quantified in a probabilistic risk assessment using acceptable human error analyses methods, they are usually shown to be highly reliable. We believe that the NRC staff position is to limit the types of procedures and guidance to only those that result in well defined and predictable actions rather than any operator actions. Therefore, it is proposed that the paragraph on page 5 at lines 28 through 35 be changed to provide this clarification as follows:

The TR argues that its proposal only permits credit if a procedure directs the operators response. While some plant procedures provide very prescriptive if-then instruction to the operators, other plant procedures and guidance may direct the operators, in general, to develop and attempt mitigative actions. In the latter case, any conceivable mitigative actions would satisfy the criterion. The NRC staff only accepts the proposed credit for operator actions when it can be shown that the actions that have a high likelihood of success, e.g., well defined and predictable actions. Qualitatively crediting actions with a low likelihood of success could place high-safety significant (HSS) structures, systems, and components (SSCs) into low-safety significant (LSS).

In addition, we would propose a similar clarification to the Limitations and Conditions on page 10 at lines 33 through 37 as follows:

3. As described in Section 3.2 of the SE, the NRC staff only accepts credit for operator actions that have a high likelihood of success, e.g., well defined and predictable actions. Qualitatively crediting actions with a low likelihood of success could place HSS SSCs into LSS.

ATTACHMENT 2

Finally, it is proposed that the entries regarding operator actions in Table 1 of the SE at pages 8 and 9 should be changed to state:

For the row beginning with {I-3.1.3(a)(5)} [I-3.2.2(b)(3)]:

Consideration changed and moved to new Section I-3.2.2(b)(3), Even when taking credit for plant features and highly reliable operator actions, failure of the piping segment will not prevent or adversely affect the plants capability to reach or maintain safe shutdown conditions.

For the row beginning with {I-3.1.3(b)(3)} [I-3.2.2(b)(6)]:

Even when taking credit for plant features and highly reliable operator actions, failure of the piping segment will not result in releases of radioactive material that would result in the implementation of off-site emergency response and protective actions.

NRC Response:

The NRC staff does not agree with the NEI proposed changes regarding operator actions. The operator actions in the questions would need to be very highly reliable to yield categorization that is consistent with the quantitative guidelines. The staff does not agree that the generic guidance provided in the TR provides confidence that only very highly reliable actions will be credited. The comments provided by NEI do not address a factual error but the staff has expanded is discussion in Section 3.2 of the SE to clarify its reasons for not accepting the original changes proposed in the TR.

NEI Comment #2: Monitoring of Risk-Informed Safety Class (RISC)-3 SSCs Page 8 of the draft SE, at lines 35 through 45, states the following:

The NRC staff finds that the information provided in TR WCAP-16308-NP and in the RAI response does not provide a sufficient basis for assuming that the regulatory requirements of 10 CFR 50.69(d)(2)(i) or (d)(2)(ii) would be satisfied. The monitoring of RISC-3 SSCs appears to be primarily focused on the monitoring of SSC failures and does not allow the NRC staff to conclude that degradation of RISC-3 SSCs would be monitored and corrected in a manner that will provide reasonable confidence that these SSCs would remain capable of performing their safety-related functions under design-basis conditions. For example, specific information on periodic inspections and tests that could be used to detect and correct degradation of RISC-3 SSCs was not provided.

Therefore, the NRC staff cannot reach a finding that the monitoring of RISC-3 SSCs as described in Section 7.3 of TR WCAP-16308-NP will result in the required degree of reasonable confidence to satisfy 10 CFR 50.69(d)(2).

We believe the above paragraph should be clarified to provide factual consistency with NRC Regulatory Guide (RG) 1.201, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance. This RG provides formal NRC positions on the categorization methodology provided by NEI 00-04. Regulatory position 7 states the following (emphasis added):

Common-Cause Failure and Degradation Mechanism Considerations in Revision 0 of NEI 00-04 The NRC staff notes that mechanisms that could lead to large increases in core damage frequency (CDF) and large early release frequency (LERF), which could potentially invalidate the assumptions underlying the categorization process, including the risk sensitivity study, are the emergence of extensive common-cause failures (CCFs) impacting multiple systems and significant unmitigated degradation. However, for these types of impacts to occur, the mechanisms that lead to failure, in the absence or relaxation of treatment, would have to be sufficiently rapidly developing or not self-revealing, such that there would be few opportunities for early detection and corrective action. Section 12.4 of NEI 00-04 describes an acceptable performance-based approach to address these concerns.

Alternatively, those aspects of treatment that are necessary to prevent significant SSC degradation or failure from known mechanisms, to the extent that the results of the risk sensitivity study would be invalidated, could be identified by the licensee or applicant, and such aspects of treatment would be retained. This alternative approach would require an understanding of the degradation and common-cause failure mechanisms and the elements of treatment that are sufficient to prevent them.

The paragraph quoted above from the draft SE for the TR is based on the assumption that Section 12.4 of NEI 00-04 is, in itself, insufficient to address degradation mechanisms, and that the alternative method described in the RG is in fact mandatory. This contradicts the position of the RG, which clearly states the acceptability of the performance-based NEI method and the alternative nature of the programmatic method. We request that the Final SE be clarified to be consistent with regulatory position 7 of RG 1.201. One method to accomplish this would be to delete the second and third paragraphs of Section 3.5 of the SE, and to affirm the acceptability of the NEI 00-04 method.

Corresponding Section 5.2 of the draft SE, at lines 33 through 43 should also be clarified, or removed, for the reasons stated above.

NRC Response:

RG 1.201 does not discuss or approve any treatment method, but only discusses monitoring as it relates to updating the categorization process. RG 1.201 discusses CCFs and degradation, and that measures need to be taken to address them when implementing the guidance contained in Section 12.4 of NEI 00-04 related to the categorization process. Section 7.3 of TR WCAP-16308-NP, refers to periodic updates of the categorization process based on results of monitoring, and does not discuss specific treatment methods used to provide the monitoring necessary to meet this function.

The NEI comments on the draft SE imply that there is a conflict between the SE and RG 1.201.

This most likely was caused by specific references to aspects of treatment in Section 3.5 of the SE, such as references to 50.69(d)(2)(i) and (ii) the "alternative treatment" section of the rule.

Although the NRC staff observations in Section 3.5 are factually correct, part of the discussion was more pertinent to the treatment method than to the update of categorization based on monitoring. To avoid confusion, the NRC staff revised Section 3.5 and its corresponding Section 5.2 of the SE to place more emphasis on the specific role of monitoring with respect to

categorization adjustments. The NRC staff, however, did retain elements related to monitoring and corrective action to ensure that degradation of RISC-3 SSCs is corrected in a manner that supports reasonable confidence of operability as required by the rule. This revision does not constitute an endorsement of the monitoring aspects of the treatment method since no plant-specific treatment plan was provided.

NEI Comment #3: Application of RISC-3 Treatment Requirements The NRC Draft SE, page 9, at lines 10 through 20, states the following:

The NRC staff finds that the general information provided in TR WCAP-16308-NP and in the RAI response does not provide a sufficient basis for determining that the regulatory requirements of 10 CFR 50.69(d)(2) would be satisfied. The lack of a more specific description of the treatment of RISC-3 SSCs at WCGS prevents the NRC staff from reaching a determination that reasonable confidence exists that RISC-3 SSCs will remain capable of performing their safety-related design basis functions, and that the treatment will be consistent with the categorization process. One example of an acceptable description of treatment to be applied to safety-related low safety significant SSCs is provided in the NRC SE dated August 3, 2001, that accepted the request by the South Texas Project (STP), Units 1 and 2, for exemption from special treatment requirements specified in certain NRC regulations.

Paragraph (b)(2) of 10 CFR 50.69 provides a discussion of the information that must be submitted by a licensee to implement the rule. As correctly noted in the draft SE, the licensee is not required to submit their plan for treatment of SSCs to the NRC for review and approval under this provision of the rule. There are no other requirements for submittal content beyond those specified in paragraph (b)(2). In accordance with this approach, the NRC has not developed regulatory guidance addressing treatment of RISC-3 SSCs. The industry, through EPRI, has developed such guidance for industrys use in implementing the rule.

Paragraph (d)(2) of 10 CFR 50.69 addresses the need for RISC-3 SSCs to be subject to inspection, testing and corrective action to provide reasonable confidence of performance under design basis conditions. Licensees implementing the rule must conform to these requirements; however, the rule does not require description of these programs as part of the license amendment request. Therefore, while the TR does not contain specific descriptions of these treatment methods, there is no expectation that it should. The SE references information provided in the Final Safety Analysis Report for STP in their implementation of an exemption to the special treatment rules. However, 10 CFR 50.69 is structured differently than the STP exemption, in that there were no high level regulatory requirements (e.g., 10 CFR 50.69 (d)(2))

for treatment of low risk SSCs available for STP. Therefore, this reference is not pertinent. The NRC staff does not need to make a finding of conformance to these rule provisions as part of a license amendment request, nor as part of their approval of the TR.

Given that the SE concludes that no description of treatment is necessary, we believe the extensive discussion of RISC-3 treatment in Section 3.6 of the SE is not necessary and will create potential confusion due to its contradiction with the rule. Section 5.3 of the SE, which contains a similar discussion of RISC-3 SSC treatment, should be similarly changed or omitted.

NRC Response:

Section 3.6 was modified to emphasize the fact that licensees are not required to submit their plan for SSC treatment to the NRC for review and approval, but that nonetheless, RISC-3 SSC treatment, in the form of inspection, testing and corrective action, must provide reasonable confidence that these SSCs will continue to perform their safety-related functions under design basis conditions as required by 10 CFR 50.69(d)(2).

The fact that licensees are not required to submit treatment plans as part of a 10 CFR 50.69 application does not eliminate the need for the NRC staff to make a finding on the treatment section that was included in TR WCAP-16308-NP. Specifically, the staff cannot give licensees implementing 10 CFR 50.69 the impression that a simple reference to application of commercial practices and monitoring of failure rates would constitute an adequate plan for treatment of RIC3 SSCs. Based on the minimal amount of information provided in the TR, the NRC staff cannot make a conclusion that the proposed treatment plan would be acceptable.

In addition, the discussion of the South Texas Project (STP) exemption from special treatment requirements specified in certain NRC regulations was removed from Section 3.6 of the SE. It was originally provided as one example of an acceptable description of treatment to be applied to safety-related low safety significant (LSS) SSCs that was evaluated by the NRC in an SE dated August 3, 2001. In this evaluation, which pre-dates the 10 CFR 50.69 rule, the NRC staff reviewed the elements and high-level objectives of the treatment processes for safety-related LSS SSCs specified by STP in a proposed revision to its Final Safety Analysis Report (FSAR).

The proposed FSAR revision provided a high-level description of eight treatment processes (design control; procurement; installation; maintenance; inspection, test, and surveillance; corrective action; management and oversight; and configuration control) intended to provide reasonable confidence that safety-related LSS SSCs will maintain their functionality under design-basis conditions. In the SE, the NRC staff concluded that the treatment processes described in the proposed FSAR revision for STP contained elements and high-level objectives that, if effectively implemented, will provide reasonable confidence that safety-related LSS SSCs are capable of performing their safety functions under design-basis conditions, including environmental and seismic conditions, throughout their service life. Although the scope of treatment elements described in the STP exemption exceeds the scope specified in 10 CFR 50.69(d)(2) (inspection, testing and corrective action), this example was cited as one acceptable approach to RISC-3 treatment, albeit one that exceeds the minimum requirements set forth in 10 CFR 50.69(d)(2). In the absence of other regulatory guidance, it may be useful as a framework for describing certain elements of a RISC-3 treatment program that would satisfy 10 CFR 50.69. The staff acknowledges that the STP approach goes beyond that which is required by 10 CFR 50.69(d)(2), and is not requiring that licensees electing to implement 10 CFR 50.69 adopt the approach to RISC-3 treatment described in the STP exemption.