ML13323A186

Enclosure 4-1 - Risk-Informed Closure of GSI-191, Volume 1

ML13323A186
Person / Time
Site:	South Texas
Issue date:	11/12/2013
From:	South Texas
To:	Office of Nuclear Reactor Regulation
References
GSI-191, NOC-AE-13003043, TAC MF0613, TAC MF0614, TAC MF2400, TAC MF2401, TAC MF2402, TAC MF2403, TAC MF2404, TAC MF2405, TAC MF2406, TAC MF2407, TAC MF2408, TAC MF2409 STP-RIGSI191-V01, Rev 1
Download: ML13323A186 (119)

Text

NOC-AE-13003043 ENCLOSURE 4-1 Risk-Informed Closure of GSI-191 Volume 1 Project Summary RISK-INFORMED CLOSURE OF GSI-191 VOLUME 1.0 PROJECT

SUMMARY

November 12, 2013 ST DOCUMENT:

STP-RIGSI191-VO1 REVISION:

1 EDITED & REVISED BY: Ernie Kee, Supervisor, Risk Projects, STPNOC Risk Management REVIEWED BY: Zahra Mohaghegh, Ph.D., University of Illinois at Urbana-Champaign Seyed Reihani, Ph.D., University of Illinois at Urbana-Champaign Bruce C. Letellier, Ph.D., Alion Science & Technology APPROVED BY: Wes Schulz, STPNOC Design Engineering Contents Acknowledgements xiii Executive Summary xiv I Proposed Change 1 1 Method of Analysis 3 II Engineering Analysis 3 1 Analysis in Module 2 5 1.1 Structured Information Process Flow ..................

6 1.2 Method Comparisons with Prior Practice ................

11 1.2.1 Unqualified Coatings .......................

11 1.2.2 Blowdown Debris Capture ....................

11 1.2.3 W ashdown Transport

.......................

12 1.2.4 Debris Distribution at the Start of Recirculation

...........

12 1.2.5 Time-Dependent Transport

...................

12 1.2.6 Chemical Release and Precipitation Model ...........

13 1.2.7 Conventional Head Loss Model .................

13 1.2.8 Chemical Effects Head Loss Model ...............

13 1.2.9 Fiber Penetration

.........................

14 1.2.10 Boric Acid Precipitation

.....................

14 1.2.11 In-Vessel Fiber Limits ........ ......................

15 1.3 Uncertainty Quantification

........ ........................

15 1.3.1 LOCA Frequency

........ .........................

15 1.3.2 Debris Penetration

........ ........................

16 1.3.3 Modeling Dependencies

.............................

17 2 Engineering Analysis 18 2.1 Defense-in-Depth and Safety Margin ....... ..................

18 2.1.1 Defense-in-Depth

................................

18 2.1.2 Safety Margin .........

...........................

20 2.2 Evaluation of Risk Impact ........ ........................

21 2.3 PRA Adequacy .........

..............................

22 2.3.1 Scope of the PRA ........ .........................

22 2.3.2 Level of Detail .........

..........................

23 2.3.3 Technical Adequacy ................................

23 2.3.4 Plant Representation

....... .......................

24 2.3.5 LOCA models ........ ...........................

24 i

2.4 Acceptance

Guidelines

.........

..........................

29 2.5 Comparison with Guidelines

....... ..... ...................

31 2.5.1 Uncertainties

& Analyses ............................

32 2.5.2 Parameter Uncertainty

........ ......................

34 2.5.3 Model Uncertainty

........ ........................

34 2.5.4 Completeness Uncertainty

....... ....................

35 2.5.5 Acceptance Guidelines

........ ......................

36 2.6 Integrated Decision Making ........ .......................

37 III Implementation and Monitoring 37 IV Proposed Change 37 V Quality Assurance 37 VI Documentation 38 1 Introduction 38 2 Archival Documentation 38 VII Submittal Documentation 39 VIII Independent Technical Oversight 40 IX Acronyms & Notations 43 References 50 List of appendices A Reg. Guide 1.174 Checklist Al B NEI 04-07 Comparison BI C Defense-in-Depth and Safety Margin ci C.1 Introduction

.........

................................

C1 C.2 Effectiveness of Defense-In-Depth Actions ....................

C3 C.3 Evaluations

..........

................................

C3 ii C.3.1 Guidance in RG1.174 ............................

C3 C.4 General Design Criteria ................................

C7 C.4.1 Criterion 16-Containment Design .....................

C8 C.4.2 Criterion 35-Emergency Core Cooling .................

C8 C.4.3 Criterion 38-Containment Heat Removal ...............

C8 C.4.4 Criterion 41-Containment Atmosphere Cleanup ........ ..C9 C.4.5 Criterion 50-Containment Design Bases ................

C9 C.5 NEI Guidance for Defense-in-Depth Measures in Support of GSI-191 Resolution

........................................

CIO C.5.1 Strainer Blockage ..............................

CIO C.5.2 Prevention of Strainer Blockage .....................

Cll C.5.3 Detection of Strainer Blockage ......................

C12 C.5.4 Mitigation of Strainer Blockage .....................

C13 C.5.5 Inadequate Reactor Core Flow ......................

C14 C.5.6 Prevention of Inadequate Reactor Core Flow ............

C15 C.5.7 Detection of Inadequate Reactor Core Flow .............

C16 C.5.8 Mitigation of Inadequate Reactor Core Flow ............

C17 C.5.9 Training Related to the Proposed Change ..............

C19 C.6 Barriers for Release of Radioactivity

.......................

C19 C.6.1 Fuel Cladding .................................

C20 C.6.2 RCS Pressure Boundary ........ .....................

C20 C.6.3 Containment Integrity

............................

C21 C.6.4 Emergency Plan Actions ..........................

C23 References C24 iii List of Tables 1 Mean LBLOCA conditional failure probabilities for five plant operating states. Failure probabilities shown are for strainer blockage, core fiber load exceeding flow blockage criteria, and sunip differential pressure exceeding Ppbuckle.

Each case refers to a plant operating state.....

...26 2 Distribution of total conditional failures for LLOCA under Case 43 (one train operating)

........ ............................

28 3 All cold-leg split fractions conditioned on LOCA categories small, medium, and large for Case 43. The fraction going to the hot leg is simply the complement of the cold leg fraction ..................

29 4 Sample attributes of break cases leading to failure for Case 43. In the table: Weld is a text string defined in the inservice inspection program;Break Size is the size of the break in inches; RCS Leg denotes break location (CLB or HLB); and Break Location denotes regions in the containment building related to debris transport fractions

..........

30 5 Checklist for Regulatory Guide 1.174 ...... ..................

Al 6 Comparison of NEI 04-07 recommended engineering models with the models implemented in the STPNOC Pilot Project .... ..........

BI iv List of Figures 1 Reproduction of "Figure 1, Relationship of Regulatory Guide 1.174 to other risk-informed guidance" [10, Figure 1, Page 6] showing the elements used in the Option 2b analysis ....................................

xvi 2 Illustration of the engineering model input to the PRA used in the Option 2b GSI-191 resolution

.........

............................

xvii 3 Conceptual illustration of the uncertainty quantification process used to add detail (basic events) to the STPNOC PRA analysis in the LOCA initiating event sequences for the Option 2b analysis ......................

xviii 4 Illustration of the major elements of the STPNOC quality assurance plan for risk-informed closure of GSI-191 ..................... .xx 5 Illustration of a hypothetical spherical break (double-ended guillotine) dam-age zone truncated by a wall with the nomenclature of the damage charac-teristics; see eq. (2) ........ ..............................

7 6 Illustration of the processes local to the ECCS screen that contribute to direct pressure drop on the screen that lead to decreased NPSHA and downstream effects such as fiber penetration contributing to m.f.r and bubble formation during the recirculation phase ...................

8 7 Illustration of the flow paths in the reactor vessel used to establish accumulation and fiber bypass during the recirculation phase of ECCS op-eration in a medium or large cold leg break scenario .................

8 8 Illustration of the sump pool, screen, and pump annotated with the head losses to the SI pump suction. Also shown are the failure criteria associated with the pressure losses to the pump ..........................

9 9 Illustration of the processes local to the ECCS screen that contribute to direct pressure drop on the screen that lead to decreased NPSHA and downstream effects such as fiber penetration contributing to mcor and bubble formation during the recirculation phase ..............

10 10 Linear-linear interpolation of bounded Johnson extrema (solid) with nonuniform stratified random break-size profiles (dashed) ..........

26 11 Empirical distribution of total failure probability for Case 43 (one train operating) based on fifteen discrete samples of the NUREG-1829 break-frequency uncertainty envelope.

Weighted mean = 1.93x 10-02 marked as bold dot .....................................

29 12 Reproduction of Figure 4 from Regulatory Guide 1.174, "Acceptance guidelines for core damage frequency", the ACDF, CDF phase plane. 31 13 Reproduction of Figure 5 from Regulatory Guide 1.174, "Acceptance guidelines for large-early-release frequency", the ALERF, LERF phase plane .........

.................................

31 v Revision 1 Change Summary As a consequence of the condition discussed in Reference 5 of the cover letter, some changes were made to the engineering analysis supporting the PRA quantification.

Revision 1 of Volume 1 reflects the updated information.

Location Change Comments LOCA Acronyms Changed the acronyms for small and medium loss of coolant acci-dent in several places to be consistent with Vol-ume 3 In several places where Volume 3 sections, tables, and equations were referenced, up-dated the references to reflect changes made in November submittal revision.Page xiii Acknowledgments sec-tion updated to reflect changes to employments Figure 8, Page 9 Revised figure to in-clude containment pres-sure. Also added units (ft) to the P, and VP terms.Page 11 100% coatings failure Removed text: "For was assumed in the the STP risk-informed analysis.

evaluation, the failure fraction for each type of unqualified coating was determined by sampling the failure fraction probability distributions for each of the thousands of scenarios evaluated." continued next page ...vi

• .. continued[Location 1Change Comments Page 11 Added clarifying foot- Footnote: "Steam gen-note. erator compartment transport fractions were used for all breaks." Page 12 Removed misleading Removed text: "It was text. assumed that unqual-ified coatings in up-per containment would wash down to the pool immediately after fail-ure if sprays are still on at the time of failure.This is a conservative assumption since it ac-celerates the time that debris would reach the strainer." Page 12 Changed third bullet to Changed text as fol-more accurately reflect lows: "It was assumed eroded debris, that fiberglass debris erosion caused by flow in the pool or by con-tainment sprays would occur prior to the start of recirculation.

This is a conservative assumip-tion since it accelerates the time that erosion fines would reach the strainers" Page 15 Typo (one instance of"set to") corrected.

continued next page ...vii

... continued Location Change [Comments Page 16 Edited steps in the weld Changed step 1 text break frequency pro- as follows: "Calculate cedure to consolidate the relative weight of steps 1 & 5. breaks for specific weld categories based on pipe size, weld type, applicable degradation mechanisms, and so forth, and distribute total LOCA frequency to each weld loca-tion based on relative weight between weld cases." Page 16 Deleted reference to step 4 (unnecessary)

Page 16 Changed "pump" to"sump" to more ac-curately describe the strainers.

Page 24 Changed description of Changed to: AP >the failure threshold for Margin to NPSHR AP to be a more accu-rate description Page 25 Updated discussion on LOCA failure results from Table 1 in the text, Section 2.3.5, Page 26 Reflect updated sam- Sampling increased pling count in the from 3 by 5 to 15 by supporting engineering 20 in two places on analysis Page 26 Table 1, Page 26 Updated results for the conditional failure prob-abilities supplied to the PRA due to changes in the supporting engi-neering analysis continued next page ...viii

..continued Location _Change Comments Section 2.3.5, Page 27 Reflect updated sam- Second instance of pling count in the increased sampling supporting engineering Page 27 analysis Section 2.3.5, Page 28 Reflect updated sam-pling count in the supporting engineering analysis Table 2, Page 28 Updated epistemic un- The Johnson proba-certainties based on in- bility weights are used creased sampling fre- when sampling the quency in Revision 1 epistemic envelope Table 3, Page 29 Change to split frac- Note: Additionally a tions in updated typo in Revision 0 supporting engineering left the leading "4" in analysis the medium and large break columns Figure 11, Page 29 Figure revised to reflect changes (increased sam-pling frequency) in the supporting engineering analysis Page 29 Deleted discussion on We didn't establish ex-DEGB contribution act count of contribu-tion from LOCA size.Table 4, Page 30 Reflect updated failure attributions in the supporting engineering analysis Part VIII Page 41 Oversight section changed to include 2013 activities and to add reference to most recent oversight report (5 th oversight report).continued next page ...ix

... continued Location Change IComments Table 6 Page B2 Deleted concrete floor reference because we didn't take credit for hold up on concrete floors Table 6 Page B3 Changed test to reflect use of the average value of erosion instead of a distribution to be con-sistent with Volume 3 description.

Table 6 Page B3 Deleted erosion from the list of variables in-cluded in the time-dependent treatment to be consistent with Vol-ume 3 description Table 6 Page B5 Changed wording to more accurately reflect treatment of downstream effects of transportable debris Appendix C.4.2 Added the following Page C8 text: "STPNOC is requesting exemption to GDC 35 as described in Enclosure 2 to this submittal.

The request for exemption describes its basis and justifies that safety margin is I preserved." continued next page ...x

... continued Location Change Comments Appendix C.4.3 Added the following Page C9 text: "STPNOC is requesting exemption to GDC 38 as described in Enclosure 2 to this submittal.

The request for exemption describes its basis and justifies that safety margin is preserved." Appendix C.4.4 Added the following Page C9 text: "STPNOC is requesting exemption to GDC 41 as described in Enclosure 2 to this submittal.

The request for exemption describes its basis and justifies that safety margin is preserved." xi Abstract The PRA analyses that provide the technical background in the project to close Generic Safety Issue 191 at the South Texas Project using a risk-informed ap-proach are summarized.

The overall methodology used in the PRA analyses is summarized.

The elements of Regulatory Guide 1.174 required for a Risk-Informed license submittal are documented.

Qualitative and quantitative results of the PRA analyses are presented.

The results of the Independent Technical Oversight activ-ities are summarized.

The basic calculation flow of the engineering analysis sup-porting the PRA is summarized.

The methodology used to sample and propagate uncertainties is described.

xii Acknowledgements The Risk-Informed GSI-191 Closure Pilot Program is piloted by the STP Nuclear Operating Company and jointly funded with several other licensees.

It is a collaboration of experts from industry, academia, and a national laboratory.

In general, all products are developed jointly and reviewed in regularly scheduled (monthly)

Technical Team Meetings and weekly teleconferences as well as in specific review cycles by Independent Oversight (technical evaluation of all materials), STP Nuclear Operating Company project management, and STP Nuclear Operating Company quality management.

The business entities, the main areas of investigation, and the principal investigators of the Pilot Program are summarized below.STP Nuclear Operating Company Project Management, Licensing, Quality Assurance Steve Blossom; Rick Grantom (ret.); Ernie Kee; Wayne Harrison (ret.) Wes Schulz Alion Science & Technology Containment Accident Stochastic Analysis (CASA) Grande & GSI-191 Analysis L4 Methodology Implementation (GAMI)Bruce Letellier, Ph.D 1 , Janet Leavitt, Ph.D 2 Tim Sande; Gil Zigler; Austin Glover, Clint Shaffer, Joe Tezak 3 The University of New Mexico Corrosion/Head Loss Experiments (CHLE)Kerry Howe, Ph.D.University of Illinois at Urbana-Champaign Independent Oversight Zahra Mohaghegh 4 , Ph.D.; Seyed Reihani 5 , Ph.D.Texas A&M University Thermal Hydraulics (TH)Yassin Hassan, Ph.D.; Rodolfo Vaghetto; Saya Lee The University of Texas at Austin Uncertainty Quantification (UQ), Jet Formation mira Popova, Ph.D. (1962-2012);

David Morton, Ph.D.; Alex Galenko, Ph.D.; Jeren Tejada, Ph.D.; Erich Schneider, Ph.D.ABS Consulting Probabilistic Risk Assessment (PRA)David Johnson, Sc.D.; Don Wakefield; Tom Mikschl KNF Consulting Services, LLC Location-Specific Failure Damage Mechanism (DM)Karl Fleming; Bengt Lydell (ScandPower)

El ny'Previous to 2013, Los Alamos National Laboratory 2 Previously, UNM 3 From January 2013, Sande, Glover, Zigler, and Tezak, ENERCON 4 Previous to 2013, Soteria Consultants, LLC 5 Previous to 2013, Soteria Consultants, LLC Xiil Executive Summary The main objective of the STPNOC Risk-Informed GSI-191 Closure Pilot Project [1, 2] is,"Through a risk-informed approach, establish a technical basis that would demonstrate that the STP as-built, as-operated plant design is sufficient to gain NRC approval to close the issues raised in GSI-191 by the end of 2013." In 2012, the STP approach has been referred to as Option 2b in the industry.The results presented in this summary are the joint work of STPNOC Risk Management, Los Alamos National Laboratory, The University of Texas at Austin, Texas A&M University, Alion Science and Technology, ABS Consulting, The University of New Mexico, Soteria Consulting, and KNF Consulting, LLC. STPNOC has also collaborated with the PWROG and NEI in development of the Pilot Project.In the risk-informed approach, STPNOC will seek NRC approval for closure of GSI-191 based on the associated risk, the defense-in-depth measures in place, and adequate safety margin. STP is committed to investigating plant modifications including insulation removal and other measures (such as selective insulation reinforcement or debris transport mitigation) to preserve sufficient margins for nuclear safety if the analysis shows excessive risk, inadequate defense-in-depth or safety margin.The project is based on a two-phase approach that addresses all the concerns related to GSI-191. For the initial phase, in 2011, a quantification was performed to determine if a risk-informed approach would be feasible [3]. Since it was shown to be feasible, the project proceeded to a licensing action in 2012 and 2013.In both the initial risk analysis in 2011 and the 2012 final quantification, the risk was analyzed to be very small with adequate defense-in-depth and safety margin. That is, the change in risk was shown to be less than 1 X 10-6 in core damage frequency and less than 1 x 10-7 for large-early release frequency.

Although previous realistic testing [4] had shown that chemicals were unlikely to affect the head loss in STP debris beds (sump strainers and fuel assemblies), conservative head loss estimates due to the presence of chemical products were assumed for the initial phase. In 2012, experimental data, specific to the STP units, continued to demonstrate chemical effects are not likely to cause large increases in head loss in STP prototypical post-LOCA environments.

Nevertheless, conservative estimates of chemical effects were included in the 2012 quantification.

Both defense-in-depth and safety margin were evaluated to provide assurance of low risk.The methodologies and results from the first phase were presented in the following doc-uments: analysis of results from the physical process solver: uncertainty quantification and RELAP5 thermal-hydraulic analyses [5]; LOCA Frequency analysis [6]; uncertainty quan-tification methodologies and examples [7]; jet formation research [8]; and chemical effects research and experimental design [9].For the second phase, the results of the 2012 quantification are documented in this report (Project Summary) and the references.

This information is provided as the technical basis for the NRC review of the Pilot Project.xiv Introduction

& Background The purpose of this document is to summarize the PRA 6 quantification supporting the STPNOC7 license submittal to resolve concerns raised in GSI-191 8 "Assessment of Debris Accumulation on PWR 9 Sump Performance" at the STP 1 0 plants. GSI-191 describes the NRC concerns with potential blockage of the ECCS 1 1.Over several years of study, the scope of concern has come to include the possibility of effects in the RCS 1 2 including core blockage from debris and in 2012, linkage to boric acid precipitation in the core. All GSI-191 concerns are related to the LOCA 1 3 in high energy (Class 1) piping that would result in the release of fibrous material and other potential debris to the ECCS Emergency Sump.The purpose of the PRA quantification is to understand the risk and uncertainty in the as-built, as-operated plant associated with having fibrous insulation and latent debris in the STP containment buildings.

In particular, the PRA quantification forms the basis for what has come to be referred to as Option 2b, "Mitigative Measures and Alternative Methods Approach" identified as a GSI-191 closure path by the NRC Staff in 2012 [2]. The basic elements of the Option 2b submittal are shown in Figure 1, reproduced from RG1.174 1 4 [10].The PRA licensing elements addressed in the analysis are highlighted in Figure 1.STPNOC operates two identical four-loop Westinghouse-designed NSSS1 5.Each NSSS op-erated by STPNOC is licensed for 3853 MWth. The NSSS is contained in, and protected by, a large dry containment building with approximately 3,410,000 ft 3 of free volume. The primary elements of the ECCS are the HHSI 1 6 , LHSI 1 7 , CSS 1 8 , and RCFC 1 9.The three trains mentioned in the descriptions for the HHSI, LHSI, CSS, and RCFC systems are completely independent and piped into a single RCS loop. In addition, the HHSI and LHSI can be independently directed to their respective hot leg at their full (run out) flow rate.Early in 2011, STPNOC began a project to develop risk-informed closure strategies that would meet the intent of the NRC memorandum promulgated by Vietti-Cook in late 2010, while preparing a site-specific licensing submittal.

Several public meetings were conducted to inform the NRC staff of the modeling approach and to solicit feedback on the applicability and use of the approach for resolving GSI-191. These meetings included supporting material so that members of the public, and especially other plants, could be informed as well: [12],[13], [14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29].In the meetings referred to above, STPNOC described the additional physical models and necessary experimental studies required to support enhancement of the PRA to include 6 Probabilistic Risk Assessment 7 The STP Nuclear Operating Company 8Generic Safety Issue 191 9 Pressurized Water Reactor'°South Texas Project Electric Generating Station"Emergency Core Cooling System 1 2 Reactor Coolant System" 3 Loss of Coolant Accident 1 4 Regulatory Guide 1.174" 5 Nuclear Steam Supply System 1 6 High Head Safety Injection 1 7 Low Head Safety Injection 1 8 Contaimnent Spray System'9 The Reactor Containment Fan Coolers Xv I I I.- : -..--....--....--

--- --- -- .. .. .--:- ---: ~ 50AS4C) 10CFR Pat 52 F Protsctm NtOW Ucens AppFieation RpoAm ofmmed C"Re torys, nde tnhodaton Stpdtod Approasn for adopted WcaS NuiteaP Power Plmmn--ctoi -s ----- --ofFiur 2. heeaiceventoy prbblitgiestare estimatedy in a epuatrat moue(tas Modue 2of igueI2 bymoulA7inth Iunderlying1 phyidal ph0 IGenma of20 thI iceet Gek~ Supportkn v1 u Guidanc Num PA CoIw Figure 1: Repigrodu Actonceptuaioutlie 1, Rltinhenetip t ofReulniiatoyGide 1.14roesue nModuher risk-ingurem silutaed gudne"[0 Figure 1, Page detaishow aring the eeet unertaint qtheiction 2b anablysis the phenoena assoiatedentstha cocrns reaised in the1 relTiohae oveal appoach tand wshw adopthed caused minima compact from the PnieRA n M odels of Recor e 2[reso0e]otsd The metho of anucralyist qussanitificative aproaheworexplicitllustrovide faoilurte tproaicl-proess forafe uneraityLC baiqu nt fte T Cpant-spto i hw iu ecii PRA Assowthat ircs, Modul-eos Figuribtin 2).eTesoed baiceventerobabilitiexs surh estimateina sepasraemodul (thatysisan Module 2 figurhae 2)bymodcaedsmling thandunerlyingtpysia pheomenation, thae basicavoided adby propaigatingependencertaitieen parisingersmwher physicale modes The analysing fae-pii Thendiinldedpascevennces phrobbltes apresowniaste.otdlie on ro oue2t Figure 1casesgue Reduction s ofuFigurte 1, Relatiornsip ofaRegulatorny Gude 1.174dto iMothler risk-Finform silutaed gudne"[0 Figure 1, Page 6]til show ring the eeet usedtaint qatheiOption 2be anaiablysis.

olme3 The phdenoen bassciaveted wtha conern reaised totercruainn p1hae overll apprac thatwas adopted caused miniscmalimpac trom the PeAgModein mofdecor [30].e2 rsledotsd Thoemethod onceAyints quseantintienatis hApow A tn gre xpiils povid the fpiess probi-iels fontaribewtpnst basic events ofnthex sT ch ant-specfi PRa (nthatis, M du ofer Fidguren2).

Theshe bsic evnroaiitkiesfarmed mestimatdogy inuatseariate mdulet(thatios, Module 2mfigurhae 2)bymolctdesmling thandunerlyingnpysia pheomenatiof, thae beeicaevents adby propaigatingetheduncerbtaiente parisingerom ther physicalmoelsh analysenorisg fae-pii Theaddditboasi devedetces phrobbltes apresowniastheotdlie.on ro oue2t Modulme 1cineFigure 2.stAbuconneptadotied fof the uRncolertantlqantifictio proce dssriusedn iCnanmMduen 2Aofciguen 2Stillustrate inalFigur 3.SA Modrendetal regerding the uTnOcrtainty esdisribtosdvlpdiyifrn contexssuhasdtammermetnnlsitn xvi MODULE 1 STPNOC PRA with added features to capture details of concerns associated with GSI-191 Sump failure with added possibility

.to violate NPSHR and mechanical integrity I nlllatrng EWa.t I Syn-t 1-m , Iprto -.rao A n EnI tt Rnornuhlatoo Co-n Bockage Boron tn-oplnorion failure due to air ingestion* S * *MODULE 2 Engineering models of physical phenomena provide added input to the STPNOC PRA for concerns associated with GSI-191 Major Inputs to engineering analysis: Containment CAD Model LOCA Frequency Data Thermohydraulic Data Debris Transport Data Chemical Effects Data Debris Transport Data Strainer and Core Geometry I Design Performance Data 7 Li *

• aooirrbon

-L .Oe~ri, DebrA IDnyo enrtinLAfttqeny Acronyms ECCA. -rEt ergeny Cor Cooin Syttt MLOCA Medl.. nWCA FA OP -foel Asenmbly mifenenral1Pnesure RCP -Reaotm Coolam Pump UOCA -Large LOCA RHR -Residual Heat RenOnal LOCA -Los of Coolant Acldent SLOCA -Small LOCA LTC -LoogTer m Cooling Figure 2: Illustration of the engineering model input to the PRA used in the Option 2b GSI-191 resolution.

which need to be carefully sampled so that the "tails" are properly accounted for. In general, NLHS 2 1 strategies have been developed to properly represent distributions with long tails, especially in LOCA frequencies.

A quality assurance plan was developed to include standard STPNOC practice for PRA assessments.

Over the nearly two-year project duration, (nominally weekly) technical review teleconferences were conducted and supplemented at critical product development steps with on-site reviews. In addition, monthly face-to-face technical team meetings were held in 2012.In general, the STP PRA analyst (STP technical team Lead) is responsible for review and verification of the PRA inputs developed.

The STP PRA analyst review is supplemented by independent critical peer review intended to help disclose any overlooked technical gaps that would compromise results and, although the analysis is developed for the industrial setting, also help ensure that the overall product is academically defensible.

Independent 2 1 Nonuniform Latin Hypercube Sampling xvii I-U C U -O~m ofr thme dwfti~utdue Flow of WensudmIen

-Ex""B" _6 todaft-u-n Ca- dOdawinmpla pini ~ dwEs wirntkso-nrui- tvlvad swe-dA.MN Figure 3: Conceptual illustration of the uncertainty quantification process used to add detail (basic events) to the STPNOC PRA analysis in the LOCA initiating event sequences for the Option 2b analysis.technical oversight also helped to further focus the analysis efforts.The overall quality assurance plan is illustrated in Figure 4 as a flow chart. Due to the diverse areas of investigation in the GSI-191 scope, the PRA inputs are developed by several experts. The CASA Grande integrating framework uses the inputs to generate the two main inputs to the PRA: the sump demand failure likelihood and the in-vessel cooling failure likelihood (for each category of LOCA and all possible equipment configurations).

These elements are documented by the vendor and the normal STP vendor document review process is followed to ensure that those elements are suitable for input to the PRA. The overall STPNOC Pilot Project 2 2 quality assurance plan is expected to be similar to most utilities' processes for PRA applications and is consistent with industry PRA standards, practices and procedures

[see 31].The technical and RG1.174 documentation that establishes a technical basis to close GSI-191 in an Option 2b approach consists of several volumes: " Volume 1, Summary (this volume);" Volume 2, The PRA analysis and quantification;" Volume 3, The engineering analysis supporting the added basic events and top events needed by the PRA to address the concerns raised in GSI-191;2 2 STPNOC Risk-Informed GSI-191 Closure Pilot Project xviii

" Volume 4, Quality assurance documentation, approach, and summary;" Volume 5 , Oversight (five volumes: 5.1, 5.2, 5.3, 5.4, and 5.5); and" Volume 6, Comment and Request for Additional Information Resolution.

Additional documentation (for example the PRA Model Revision 7 and support calculations) are also available through reference.

The remainder of this document is developed to reflect the RG1.174 outline. That is, starting with Part I (Proposed Change), through Part VI (Documentation), the section numbering and the names of its major parts are intended to correspond to the outline of RG1.174. A summary of the STPNOC Pilot Project Oversight activity is given in Part VIII Independent Technical Oversight.

Many acronyms are used throughout the text. Each is expanded in a footnote when first used. In addition, Part IX provides both the complete name and a short description for most of the acronyms.As mentioned earlier, the first Part I through Part VI, correspond to the RG1.174 outline.A checklist (Reg. Guide 1.174 Checklist) is provided as an additional resource for cross referencing RG1.174 items with the text in this document.

Appendix B is provided to give an overview of the models implemented in the STPNOC Pilot Project and how they correspond to those recommended in NEI 04-07 [32]. Finally, Appendix C is a detailed summary of the STPNOC DID 2 3 measures that address the concerns raised in GSI-191.2 3 Defense-in-Depth xix Responsibility:.

Contracted service organization Process: Local quality program STPProcedure:

OPGPO3-ZT-01 38 Contractor/Staff Augmentation Volunteer Training and Qualification Program~0-P-. Input Development C 0 e-I.A r ICASA Framework I I I I I Responsibility-.

Alion Science &Technology Process: Local Quality Program, Alion Science Verification/Validation Program 0%J 3.cc ft CL t-0-Input to PRA Responsibility, STP Contract Technical Coordinator, Project Technical Lead Process: STP Technical Document Review Process Procedure OPGPO4-ZA-0328"Engineering Document Processing' Internal review supplemented and supported by Independent Oversight, (UIUC)Inputs to PRA Verified/Reviewed I, PRA Quantification/Output IRes PRA Application Pro Pro Res License Amendment Pro Responsibility:.

ABS Consulting Process: RISKMAN- quantification, STPNOC PRA current plant model STP PRA Analyses/Assessment Procedure Procedure OPGPOS-ZE-QOOO"PRA Analyses/Assessments' ponsibility.

STP Contract Technical Coordinator, Project TechnicalLeadS1 cess: STP PRA Assessment Process cedure OPGPO4-ZA-0604

'Probabilistic Risk Assessment Program.ponslbnllty.

STP Licensing Engineer cess: STP License Amendment Process cedure OPGPOS-ZN-0004'Changes to Licensing Basis Documents and endments to the Operating License" Proi Am Figure 4: Illustration of the major elements of the STPNOC quality assurance plan for risk-informed closure of GSI-191.

Part I Proposed Change Part of the STPNOC plant licensing ba-sis change considers long-term core cooling as identified in 10 CFR §50.46 following a LOCA. Long-term cooling is supported by the ECCS which system includes the safety-related CSS, the HHSI, LHSI, and the RHR 2 4 system. The STPNOC licensing basis requires these particular systems to operate with high probability following a LOCA. in addition, the licensing basis requires evaluation of un-certainty associated with proper operation.

In this licensing basis change, STPNOC uses the guidance provided in RGl.174 to ex-plicitly quantify the probability and uncer-tainty associated with the operation of the ECCS following a LOCA while verifying that DID measures are in place to prevent or miti-gate any postulated GSI-191 events such that long-term core cooling is ensured with ade-quate safety margin. In the current license basis, neither the probability nor the un-certainty that long-term cooling will oper-ate properly following LOCA is quantified.

Therefore, the licensing basis change is to incorporate the probability and uncertainty associated with long-term cooling success of the as-built, as-operated plant (as required in the license basis change). This requires NRC approval where the cumulative risk is shown to be very small [10, Figures 4 and 5, page 16].History of Defense in Depth and Safety Margin Activities Since the inception of the GSI-191 issue, STP has made significant improvements to pro-cesses, programs, design, and operation that, in the unlikely event of a LBLOCA 2 5 , would mitigate potential consequences.

These im-provements include design modifications to the plant hardware, operator training, and procedures.

Appendix C is provided to help review the current status and show what is in place to address those concerns raised in GSI-191 before the the STPNOC Pilot Project started. In the following section, the primary activities from that history that were already in place are summarized.

Procedures and Activi-ties in the Licensing Ba-sis Before the STPNOC Pilot Project started, STPNOC had already taken steps in STP design and operation to help eliminate, or greatly reduce, effects from the concerns raised in GSI-191 on long-term cooling at STP. Some of the steps taken include: " installing very large, uniform-loading ECCS strainers having strainer flow area approximately 10 times that of the strainers originally installed;" modifying the STP Emergency Oper-ating Procedures to terminate contain-ment spray early as a conditional action step to conserve RWST 2 6 inventory;" removing effectively all Marinite (cal-cium silicate) insulation from the con-25Large Break Loss of Coolant Accident 26Refueling Water Storage Tank 2 4 Residual Heat Removal System 1 tainment building;" reworking or replacing PWSCC 2'-susceptible welds in the steam gener-ators and the pressurizer safe ends;and" performing a comprehensive post-maintenance containment cleanup and inspection following refueling outages to help ensure the removal of material that would cause strainer blockage.The following primary procedures and ac-tivities are implemented that directly or indi-rectly bear on mitigating or eliminating the concerns raised in GSI-191:* "Condition Reporting Process," STPNOC plant procedure, 0PGP03-ZX-0002: The STPNOC process used to identify plant management, operations, and work control of any deficiencies or issues that may arise. This process requires identification and evaluation of the severity and required actions, to be taken as necessary for safe operation." "PRA Analyses/Assessments," STPNOC plant procedure, 0PGP05-ZE-0001: the STPNOC process used in PRA as the basis for applications and risk-based decision making." "Design Change Package," STPNOC plant procedure, 0PGP04-ZE-0309:

the STPNOC engineering design change pro-cess governing all design changes. Sec-tion 4 of the design change checklist and the supporting descriptions specif-ically address maintaining the assump-tions used for the engineering models in the STPNOC Pilot Project containment analysis.* "Inspection of Containment Emergency Sumps and Strainers Unit #1 -A, 1-B, 2 7 Primary Water Stress Corrosion Cracking 1-C Unit #2 2-A, 2-B, 2-C," STPNOC plant procedure, OPSP04-XC-0001:

the procedure satisfying Technical Specifi-cations for ECCS sump operability.

The specific procedure purpose is to provide instructions for cleanliness and struc-tural inspection of containment emer-gency sumps and strainers 1-A, 1-B, 1-C or 2-A, 2-B, 2-C required by Technical Specifications 4.5.2.d and 4.5.3.1.1.

• "Initial Containment Inspection to Es-tablish Integrity," STPNOC plant pro-cedure, OPSP03-XC-0002:

the STPNOC process that ensures no loose debris which could be transported to the con-tainment sump and cause restriction of pumps' suctions during LOCA con-ditions is present and is the proce-dure that satisfies Technical Specifica-tions 4.5.2.c.1, 4.6.1.7.1, 4.6.1.7.4, and 3.6.1.7.b." JISI28,,, STPNOC plant procedure, 0PSPll-RC-0015:

This procedure ensures that the following requirements of Technical Specifications 4.0.5 /4.4.10 have been satisfied:

completion of the ISI examinations of STP piping and component welds in accordance with the schedule requirements of the ASME Boiler and Pressure Vessel Code,Section XI (2004 Edition No Addenda);ISI of STP piping and equipment; com-ponent supports (excluding snubber assemblies

[pin-to-pin])

in accordance with the schedule requirements of the Code; completion of the Inservice Service Inspections of the STP contain-ment metal liner in accordance with the schedule requirements of the ASME Boiler and Pressure Vessel Code; and completion of the examinations of the STP reactor coolant pump flywheels in accordance with the requirements of 2 8 ASME Section XI Inservice Inspection 2

1 METHOD OF ANALYSIS Regulatory Guide 1.14.* "'Transient Cycle Counting Limits," STPNOC plant procedure, OPEP02-ZE-0001: The STPNOC process that pro-vides for the monitoring of the num-ber of primary and secondary plant op-erations that are explicitly considered as design transients for the NSSS pri-mary system and components.

This pro-cedure includes the transients listed un-der the normal, upset, and test con-ditions in UFSAR Section 3.9, except for particular transients discussed in Step 1.2 of the procedure.

This proce-dure is based on the recommendations of WCAP-12276.

• "Shielding," STPNOC plant procedure OPRP07-ZR-0004:

the STPNOC process for a consistent method of determining the need for, requesting, evaluating, in-stalling, modifying, accounting for and removing shielding at STP. In partic-ular, OPRP07-ZR-0004 requires inspec-tion for signs of wear such as crack-ing of the blanket material, damaged or corroded grommets, or other signs of physical damage. The inspection is per-formed prior to each removal and stor-age and thereby minimizes the possibil-ity that transient lead can be introduced in the post-LOCA sump chemistry.

1 Method of Analysis The method of analysis uses a RG1.174 ap-proach to explicitly provide the probabili-ties for a few post-LOCA basic events of the STPNOC plant-specific PRA. This has been done by modeling the underlying physical phenomena of the basic events and by prop-agating uncertainties in the physical models.In particular, the simplistic demand recircu-lation failure probability is replaced with the following basic events: " Air ingestion through the sump screen;" Pressure drop due to buildup of de-bris on the sump screens with chemical effects, resulting in NPSHA 2 9 dropping below NPSHR 3 0 for the ECCS pumps;* Boron precipitation;

• Core blockage with chemical effects; and" Strainer mechanical collapse.In order to assess the potential risk to long-term core cooling due to the issues raised in GSI-191. a theoretical "perfect plant" is hypothesized so its performance re-garding the concerns raised in GSI-191 can be compared to the as-built, as-operated plant. Such a plant would not be subject to the postulated failure mechanisms that mo-tivated GSI-191 and neither the as-built, as-operated plant nor the theoretically perfect plant would have any changes in commit-ments to current long-term cooling require-ments or performance of the ECCS.By adopting a RG1.174 approach that ex-plicitly assesses the potential risk of the is-sues raised in GSI-191 to be very small but also ensuring DID and safety margin for any unlikely, but potentially severe scenar-ios, STPNOC would avoid significant cost and worker radiation exposure that would be in-curred if using a so-called "bounding deter-ministic approach".

Cost estimates for the two STPNOC units has been estimated at$50,000,000 to $60,000,000, consistent with other cost estimates in the industry.

Com-pared to retaining the current design, radi-ation exposure to workers is also very high: 100REM to 200REM.2 9 Net Positive Suction Head Available 3 0 Net Positive Suction Head Required 3 Part II Engineering Analysis Title 10 "Energy" of the Code of Fed-eral Regulations (CFR) applies to all do-mestic commercial nuclear power stations.One of the several legal requirements de-fined in 10 CFR§50.46, "Acceptance crite-ria for ECCS for light-water nuclear power reactors," is that events leading to a loss of long-term core cooling must be mitigated with high probability.

The main purpose of the ECCS is to mitigate hypothesized LOCA events by supplying cooling water to the reactor. LOCA events can be triggered by a valve failure or a structural failure and the ECCS is designed to mitigate the "worst case" of these failures with high probability.

Since 2001, GSI-191 has eluded resolution despite significant efforts by industry and the NRC. Although recent thought has been given to risk quantification

[33, for exam-ple], and early recognition of the need for risk evaluation was identified

[34, for exam-ple], serious investigation into risk quantifi-cation had not been undertaken.

Instead, res-olution had followed a classical deterministic approach.

STPNOC's view, following an ini-tial quantification

[3], is that a risk-informed resolution path should be pursued in pref-erence to a deterministic approach, thereby quantifying the safety margins and identify-ing any scenarios that pose significant risk in GSI-191.The STPNOC PWR. RCS operates at tem-peratures higher than 650'F. As a conse-quence, high efficiency insulation is used to prevent exceeding local and general environ-mental temperatures in the enclosed space of the reactor containment building.

NUKON fiberglass insulation is specified for most high-temperature Class I piping and compo-nents in the STP containment buildings.

The Reactor Vessel and Reactor Vessel Head are notable exceptions insulated with RM1 3 1.In addition to the containment building application, insulation similar to NUKON is installed in high temperature steam cycle ap-plications, piping, heaters, valves, etc. Be-cause fiberglass insulation is in general us-age, STPNOC has a great deal of experience in installing and removing it. Processes and procedures have been in place for many years and, as a result, the plant staff has significant experience with fiberglass insulation leading to maintenance efficiencies.

During the recirculation phase of a hy-pothesized LOCA, various materials (e.g., fi-brous insulation ablated from piping and components insulated with NUKON, paint chips dislodged from painted surfaces, latent debris from inefficient containment building housekeeping, ablated concrete, and chemi-cal precipitants) may cause high differential pressure on the ECCS strainers or reactor core fuel assemblies if the materials are trans-ported to the containment emergency sump and then to the ECCS filter screens. If the conditions assumed in some of the more ex-tremely pessimistic hypothesized cases were realized, the resulting ECCS filter screen dif-ferential pressure could be sufficient to cause core damage due to the loss of one or more trains of the ECCS. Filter inefficiency may lead to blockage of all the fuel assemblies which also may result in core damage. In ad-dition to the concerns associated with dif-ferential pressures, boron precipitation could cause reduced heat transfer in the core.The GSI-191 PRA shows the risk to core damage or large early release due to the con-cerns raised in GSI-191 in the as-built, as-operated design to be very small. In the anal-ysis, the risk of core damage and/or large early release is quantified for a hypotheti-cal plant designed and operated in the same 3'Reflective Metal Insulation 4

1 ANALYSIS IN MODULE 2 manner as the STP plants except that it is not subject to the concerns raised in GSI-191.The STPNOC PRA meets the ASME/ANS PRA Standard as Capability Category II and has successfully provided the technical ba-sis for several risk-informed applications at STPNOC, for example RMTS 3 2 [35, 36]. PRA is relied upon in this analysis to quantify the risk associated with the concerns raised in GSI-191.The engineering analysis and experimen-tal support for the proposed license basis change are both detailed and broad in scope, commensurate with the perceived complex-ity of the issues raised in GSI-191. The inher-ent uncertainty of the analysis is addressed through the sampling methodology in the uncertainty quantification and by adopting maximum or reasonably high bounds where the analyses or experimental data are incom-plete. For example, NLHS is used in the un-certainty propagation methodology to em-phasize random samples from the extreme tails of many uncertain parameters.

In par-ticular. when defining random-break scenar-ios, the methodology ensures that DEGB 3 3 conditions are included for every weld in the containment within the spectrum of random break sizes that are chosen. NLHS permits a more precise quantification of variability near the extreme conditions for the same number of random scenarios without bias-ing the propagation of uncertainty.

Tradi-tional engineering limits are used for equip-ment performance assessment.

Examples in-clude NPSHR for ECCS pumps, air entrain-ment in the ECCS supply lines, and cooling flow that is required to remove decay heat.The findings of this analysis indicate that the risk associated with the issues raised in GSI-191 is very small and well within the Commission's safety goal. There are several reasons, that include adopting realistic un-3 2 Risk Managed Technical Specifications 3 3 Double-Ended Guillotine Break certainty analysis and accounting for the evo-lution of processes over time, that contribute to a minimal risk result. However, one of the most important contributors to the risk's be-ing small is that along the timeline of the is-sues motivating GSI-191, STPNOC took sev-eral steps in the design of the ECCS, con-tainmient maintenance, operation of the CSS, and insulation design that significantly in-creased the safety margin against the issues that were raised in GSI-191. The most signif-icant change in design was the introduction of very large ECCS sump strainers that, un-der realistic assumptions of LOCA behavior, would prevent NPSHA from dropping below NPSHR for the ECCS pumps.Some insulation types have shown in-creased head loss in fiber debris beds.STPNOC took steps to remove, or to pre-clude the installation of, insulation (such as Microtherm and calcium silicate) that could be responsible.

To prevent introduction of a direct debris path due to strainer dam-age, the exposed strainer modules have an added protective fence. Taking these steps after the concerns were originally raised in GSI-191 and within the context of continu-ous performance improvement, has greatly improved the safety margin and assurance of DID in the as-built, as-operated STP plants.1 Analysis in Module 2 The following description of information flow is intended to provide a summary of the CASA Grande analysis process which is closely aligned with the engineering intuition used to formulate the basic events supplied to the PRA. Introduced in the Introduction

&Background discussion earlier, the notional setting for the engineering analysis is cap-tured as Module 2 in Figure 2 showing cer-tain basic events provided to the PRA using the uncertainty quantification process sum-marized in Figure 3. Reviewers familiar with 5 1 ANALYSIS IN MODULE 2 1.1 Structured Information Process Flow deterministic analyses of the post-LOCA ac-cident progression often carry a mental list of information that is needed to fully calculate the outcome from a single complete accident scenario.

This summary traces a single ac-cident from start to finish and enumerates both the random variables that are sampled during the analysis and the primary perfor-mance metrics that are calculated from the outcome of the scenario.It is often easier to understand statisti-cal sampling strategies after a firm under-standing of the basic event is established.

In this case, the basic event consists of a sin-gle accident progression that is initiated by a broken pipe and continues for 30 days. The most basic statistical sampling approach con-sists of "brute force" repetition of this event under many, many random conditions that are introduced in proper proportion.

This summary is not intended to provide a literal implementation guide for the CASA Grande framework because of the complexities inher-ent in the analysis implemented to achieve both numerical and statistical efficiency.

Sta-tistical sampling strategies are discussed be-low and further in Section 1.3.This summary provides a structured con-text for conveniently referencing additional detail provided in Volumes 2-6. Volume 3 contains detailed descriptions of most physi-cal models that are referenced here. The fol-lowing outline focuses on principal physics equations that support quantification of time-dependent quantities like debris mass inventory, and differential pressure, but the high-level description of accident progres-sion also provides a basis for understanding where specific topical concerns fit into the integrated analysis, and illustrates how prior dependencies in the accident conditions can affect the relevance of each concern.By comparison to predictive physics models like RELAP that enumerate field equations and constitutive relationships, CASA Grande embodies only mass conserva-tion in the form of a, first-order rate equa-tion to track debris fractions in the con-tainment pool. Energy balance is addressed in principle by external calculations of pool temperature.

In this respect, CASA Grande is primarily an uncertainty propagation tool, but the timeline of the accident progres-sion is determined by tracking debris through the system circulation history. The time-line supports externally calculated parame-ters such as decay heat, pool temperature, operational configurations (EOP 3 4 response), chemical product formation, coatings degra-dation, and provides a basis for comparison to time-dependent performance metrics like NPSHA, and core debris loading relative to boron dilution strategies like switching to ECCS hot leg injection.

1.1 Structured

Information Process Flow 1. Set plant failure state (number of trains, and specific pumps available).

Failure state determines available flow rates through each train and guides operator action via EOPs.2. Randomly select a weld type/case based on relative frequency of break occur-rence. Relative frequencies reflect sus-ceptibility to degradation (failure).

3. Randomly select a specific weld from this type/case

[6] (equal probability among all welds of same type/case)

[37].Weld location defines P(x, y, z), and HLB 3 5 or CLB 3 6 condition.

Each weld location has a pre-calculated list of insulation targets that can be "seen" in every direction.

Concrete walls are the only feature that can shield insula-tion from potential damage. We assume 3 4 Emergency Operating Procedure 3 5Hot Leg Break 3 6 Cold Leg Break 6 1 ANALYSIS IN MODULE 2 1.1 Structured Information Process Flow pipes and large equipment to have no effect on a Z01 3 7.4. Conditional upon having a break for this specific weld type/case, sample a break diameter that is consistent with NUREG-1829

[38]: scaled to the maximum damage radius for insulation

k. Figure 5 is an illus-tration that shows the nomenclature of damage for a hypothetical break that has its damage radii truncated by a wall.Dbreak -~ FDb-k Iweld case .(1)Record break contribution to SBLOCA 3 8 , MBLOCA 3 9 , or LBLOCA category.

The designation of SBLOCA, MBLOCA, or LBLOCA becomes an explicit correlation for many following physical variables, both user-specified input (like typical times for operator action, chemical head-loss increase, containment pool volume, etc.) and externally computed trends (like temperature histories).

5. Randomly select a complete tempera-ture history T(t) from appropriate cor-relations of thermal-hydraulic trends for SBLOCA, MBLOCA, or LBLOCA events. The temperature history drives water properties, assumed arrival of chemical products, and NPSHmargin.

6. Calculate radii Ri,j,k of the three dam-age zones indexed by i = 1, 2, 3, debris sizes (fines, small pieces, large pieces, or intact blankets) indexed by j -1,2,3,4, and target type indexed k, where k c IC indexes insulation prod-ucts in containment.

We distinguish three sets indexed by k: IK denotes insu-lation products, F denotes fiber-based insulation, and L denotes all types of debris, including insulation and other debris such as unqualified coatings and crude particulate; so, F C IC c &.The R,,j,k damage zones for Nukon are 3 7 Zone of Influence 3"Small Break Loss of Coolant Accident 3 9 Medium Break Loss of Coolant Accident Figure 5: Illustration of a hy-pothetical spherical break (double-ended guillotine) damage zone trun-cated by a wall with the nomencla-ture of the damage characteristics; see eq. (2).7. If Dbreak < Dpipe then choose random direction perpendicular to pipe accord-ing to 0 -U(O, 27r). Else, 0 is assigned a flag that indicates a spherical ZOI.8. Calculate intersection of damage zones with insulation targets and clip by con-crete walls to obtain amount of debris in each damage radius and debris size (i,j, k), and convert volume to mass: Mijk = Pk I (Vd -age Vk n insulation)

\ Wconeretel (2)Here, the "Woncrete" designates exclu-sion of those insulation targets not dam-aged due to structural concrete blocking the break blast.7 I ANALYSIS IN MODULE 2 1.1 Structured Information Process Flow mass of debris is initially resident on each strainer, in addition to all other de-bris constituents that arrive over time: rnfjk(0) = F' P 2, fill Mijk(o)-(4)12. At each time t, assume homogeneous mixing in the pool: CP P ij, k M = mij, k(tVVP(0 (5)While this form is never used explicitly, it is helpful to think about debris mix-ing, transport and accumulation as con-centration.

Figure 6: Illustration of the pro-cesses local to the ECCS screen that contribute to direct pressure drop on the screen that lead to decreased NPSHA and downstream effects such as fiber penetration contribut-ing to m"ie and bubble formation during the recirculation phase.9. Apply transport logic diagram to ob-tain all ZOI-generated debris mass ar-riving at the pool. Complex transport logic is represented here via the opera-tor Ftransport:

mP(0) = Ftransport 9 M.(3)The transport logic captures, e.g., ero-sion of fibers from large pieces to fines, in transforming the vector M of Mi,j,k to the vector mP(t) of m Pk(t) t = 0.10. Introduce fixed quantities of non-ZOI debris types (those in £ but not K and not addressed above) like crude particu-late, latent debris, and unqualified coat-ings debris.11. Apply fill up transport fraction, FIfi, to train V's strainer sump cavity. This Figure 7: Illustration of the flow paths in the reactor vessel used to establish m"er accumulation and fiber bypass during the recircula-tion phase of ECCS operation in a medium or large cold leg break sce-nario.13. Solve coupled differential equations for mass in pool, mass on strainer and mass on core (see Figures 6 to 7 for the 8 I ANALYSIS IN MODULE 2 1.1 Structured Information Process Flow nomenclature setting): d d d ,(t dMkp(t) = Sk(t) > k tt A,BmC d- core (t) ke d-M,(t)=dtk , Vk c C (6a)f (1:M1k(t)) (Q'(0/VP(WMkP(0 kEL-?IV 711't), Vk C £dt k An ' >3f ~mý(0, Vk E T, (6b)where sources Sk(t) of debris type k can be time dependent, flow split A is the fraction of ECCS injection that passes through the fuel, and flow split -y is the fraction of total strainer flow that is in-jected. The complement (1 --y) is the fraction of total strainer flow passed to containment spray, and the complement (1 -A) is the fraction of ECCS injection that bypasses the core. For CLB A is de-termined based on the time-dependent boil-off rate. For HLB A = 1. For sim-plicity in writing the equations here, we suppress additional subscripts and just index the masses by debris type k C L.That said, these other indices matter in implementation.

For example, the last term in Equation 6a is only present when the k index indicates fiber, but it is also only present when the size index indicates fines. Constraint Equation 6c is only written for fiber, but is also only present when the size index is fines.14. Given histories of fiber and partic-ulate debris thickness, 6(t), on the strainer, compute time-dependent head loss across each strainer according to: AP'(t) =H(m'(t), Q'(t))N(5, 1)4),h(t)

(7)Figure 8: Illustration of the sump pool, screen, and pump annotated with the head losses to the SI pump suction. Also shown are the failure criteria associated with the pressure losses to the pump.where, the function H is given by NUREG/CR-6224

[39, Appendix B]with arguments given by the vector me(t) of m (t) for all k C £ and ve-locity via the flow rate Qe(t) and where N(5, 1) is a truncated normal random variable with a mean of 5 and unit vari-ance and where 1, 6(t) < 16 or T(t) > N(140,5)£,h otherwise.

Here, 4 Dch takes value 1 if the thick-ness is below 1/16-th of an inch or the temperature exceeds the specified normal random variable, centered on 140'F. Otherwise, 4)h takes the value of a shifted, and truncated, exponential random variable, which we denote by S.15. Compare time-dependent head loss to time-dependent NPSH and record the scenario as a failure if: max [APe(t) -NPSHmargin(t)]

>0, (8)t't 9 1 ANALYSIS IN MODULE 2 1.1 Structured Information Process Flow i.e., we record a failure for this scenario if anywhere along the 30-day time his-tory the head loss exceeds the NPSH margin for any strainer f = A, B, C.16. Compare time-dependent head loss to fixed mechanical collapse criterion and record the scenario as a failure if: K ECCS ScreenHole ri (2 Phs)P-d 6'tI max AP'(t) > APnecih, t,e (9)where APmech is the design strainer me-chanical strength inferred by the pres-sure drop across the strainer.17. Given time-dependent head loss, calcu-late time-dependent gas evolution and record the scenario as a failure if: max Fvod(APt(t))

> 2% (10)t'e 18. For CLB, compare the time-dependent fiber accumulation on the core against the assumed 7.5gm/FA thresh-old. Record a scenario failure if maxt mrIc..e(t)

> 7.5gm/FA.19. Given timec-dependent fiber on the core, record scenario success for all HLB.20. If any performance threshold is ex-ceeded for the scenario then record a failure.Figure 9 is an illustration of the various pro-cesses listed above that need to be evaluated in GSI-191 for ECCS performance during the recirculation phase of operation.

Again, as we indicate above, these steps sketch the nature of what would be calcu-lated within CASA Grande, if it were de-signed to run for a single scenario.

That spe-cific scenario includes numerous random re-alizations including:

the selection of the spe-cific weld location where the break occurs, the effective size of the break, the tempera-ture profile, the direction of the break on the pipe, and more. Further, while not always I Figure 9: Illustration of the pro-cesses local to the ECCS screen that contribute to direct pressure drop on the screen that lead to decreased NPSHA and downstream effects such as fiber penetration contribut-ing to m"°br and bubble formation during the recirculation phase.made explicit in the above description, many of the steps outlined depend on the specifics of this scenario.

To construct a Monte Carlo estimator of the failure probability, these steps would be replicated many times. How-ever, we do not simply construct a so-called naive Monte Carlo estimator.

Rather, we use techniques to reduce the variability of the estimator of the failure probability, and techniques to propagate uncertainties-such as the epistemic uncertainty in the initiat-ing frequency-to the PRA, where these fail-ure probabilities become branch fractions at the top event. Among our variance reduc-tion techniques, we enumerate breaks at each weld location, and we employ a NLHS estima-tor, which ensures we sample low-probability large-break events. Both the stratification across weld locations and the NLHS estima-tor require us to use proper probabilistic weights associated with the specific scenario when constructing the estimator.

10 I ANALYSIS IN MODULE 2 1.2 Method Comparisons with Prior Practice 1.2 Method Comparisons with Prior Practice Although the STPNOC Pilot Project adopted many of the commonly used engineering models developed for GSI-191, some of the engineering analyses differ from practices adopted for deterministic evaluations.

The practices that differ were adopted to fa-cilitate a risk-informed approach to evalu-ate the concerns raised in GSI-191. In this section, the differences between the risk-informed practice and previously-adopted (deterministic evaluations) practice are sum-marized or the risk-informed practice is sum-marized where describing differences breaks down. As mentioned previously, a summary table of the differences is also provided in Appendix B.1.2.1 Unqualified Coatings In a typical deterministic GSI-191 evaluation, 100% of the unqualified coatings are assumed to fail, and the time-dependence is not con-sidered (i.e. the unqualified coatings are nor-mally assumed to fail at the beginning of the event). The unqualified coatings are often as-sumed to fail as 10 micron particulate, al-though some plants have credited a range of chip sizes for unqualified epoxy coatings.The location, failure timing, and debris characteristics are important for several rea-sons: " Unqualified coatings in upper contain-ment that fail after containment sprays are secured would not be transported to the containment pool;" Unqualified coatings in lower contain-ment were assumed to fall directly in the pool and be available for transport.

However, delays in the failure timing re-sult. in delayed arrival at the strainer and a delayed impact on head loss;" Unqualified coatings in the reactor cav-ity would only be available for transport to the strainers if the break is in the re-actor cavity; and" Although essentially all the unquali-fied coatings fines would transport to the strainer, the transport for the chips would be significantly reduced.1.2.2 Blowdown Debris Capture The STPNOC Pilot Project methodology used for debris capture during the blowdown phase is based on refined deterministic de-bris transport methods that have been pre-viously accepted by the NRC [40]. The pri-mary difference in the risk-informed evalua-tion is that several additional break locations are considered, and the retention fractions on grating and other structures is based on the range of values provided in DDTS 4 0 [41]rather than a simple bounding value.The full range of break scenarios were grouped into the following break categories: " Breaks in thesteam generator compart-ments;" Breaks in the reactor cavity;" Breaks inside secondary shield wall be-neath steam generator compartments;

• Breaks in the pressurizer compartment;" Breaks outside secondary shield wall in the pressurizer surge line;" Breaks outside secondary shield wall in the RHR compartments; and* Breaks outside secondary shield wall in the annulus.4 1 4°Drywell Debris Transport Study 41Steam generator compartment transport fractions were used for all breaks.11 I ANALYSIS IN MODULE 2 1.2 Method Comparisons with Prior Practice 1.2.3 Washdown Transport The methodology used for the washdown transport analysis is similar to refined deter-ministic debris transport methods that have been used in the past. The retention fraction for the first level of grating is based on the DDTS results, and the retention fraction for each additional level of grating is based on engineering judgment (i.e., if a piece of debris passes through one level of grating, it is more likely to pass through a second level of grat-ing, but still has a non-zero probability of being captured).

Note that neglecting the re-tention of small pieces on the concrete floors is a significant conservatism since the analy-sis documented in an appendix to the risk-informed debris transport calculation shows that the flow velocity would generally not be high enough to transport the debris[42].

The washdown transport fractions do not depend on the location of the break, but only whether sprays are initiated.

Since un-qualified coatings debris may fail later in the event, this debris would only be washed down to the pool if the sprays are initiated and the coatings fail before the sprays are secured.1.2.4 Debris Distribution at the Start of Recirculation The methodology used for determining the initial debris distribution is very similar to the refined deterministic debris transport methods that have been previously approved by the NBC [43]. The primary difference is that a more realistic distribution was used for pieces of debris blown to lower contain-ment rather than automatically assuming that these pieces would be preferentially dis-tributed toward the sump strainers.

1.2.5 Time-Dependent Transport Although some investigators have used time-dependent transport in their analysis, most deterministic analyses assume that debris transports instantaneously to the sump strainers at the start of recirculation.

In the STPNOC Pilot Project analysis, different as-sumptions as listed below were adopted." It was assumed that debris washed down from upper containment reaches the pool after the inactive and sump cavities are filled, but before recircu-lation is initiated.

This is a conserva-tive assumption since it neglects trans-port of any washdown debris to inactive cavities during pool fill, but accelerates the time that debris would reach the strainer during the recirculation phase." It was assumed that the fine debris that is initially in the pool at the start of re-circulation as well as the fine debris that transports to the pool during recircula-tion would be uniformly distributed in the pool. This is a reasonable assump-tion since the fine debris in lower con-tainment prior to the start of recircula-tion would be well mixed in the pool as it fills, and the fine debris washed down from upper containment during recircu-lation would be well mixed due to the dispersed locations where containment sprays enter the pool." It was assumed that fiberglass debris erosion caused by flow in the pool or by containment sprays would occur prior to the start of recirculation.

This is a con-servative assumption since it accelerates the time that erosion fines would reach the strainers.

• It was assumed that all debris that pen-etrates the strainer and bypasses the core (either through the containment sprays or directly out the break) would immediately be transported back to the containment pool. This is a conservative assumption since it neglects the poten-tial hold-up of debris in various loca-tions and neglects the time that it would 12 I ANALYSIS IN MODULE 2 1.2 Method Comparisons with Prior Practice take for debris to transport through the systems and wash back to the pool.1.2.6 Chemical Release and Pre-cipitation Model Several scenarios were investigated using the WCAP-16530 formula for chemical release.The scenarios used different combinations of liquid temperature, pH, water volume, and fiber quantity for several different break sizes up to DEGB. Results of the investigation indicate that little or no precipitates are formed for the majority of break sizes and conditions.

However, for some extreme sce-narios (when maximum temperature, and/or maximum fiber quantities are assumed), sig-nificant chemical precipitation is predicted to occur using the deterministically-based cal-culation (WCAP 16530).1.2.7 Conventional Head Loss Model The head loss model adopted in the STPNOC Pilot Project is nominally based on the NUREG/CR-6224 head loss correlation developed by the NRC in support of evalua-tion of the strainer clogging issue in BWRs.NUREG/CR.-6224 has been extensively val-idated for a variety of flow conditions, water temperatures, experimental facilities, types and quantities of fibrous insulation debris, and types and quantities of particulate mat-ter debris. The types of fibrous insulation material tested include Nukon, Temp-Mat, and mineral wool. The particulate matter debris tested includes iron oxide particles from 1 to 300 yim in characteristic size, inorganic zinc, and paint chips. In all of the tests conducted in support of develop-ment, the NUREG/CR-6224 head loss cor-relation has bounded the experimental re-sults. Limited testing was conducted in the STPNOC Pilot Project to ensure that the cor-relation provided a reasonable prediction of head loss under STP-specific conditions

[44].Nevertheless, based on historic experience with concerns raised by the NRC staff and the ACRS, head losses computed in the STPNOC Pilot Project were increased by a factor of 5 to help account for any uncer-tainties.1.2.8 Chemical Effects Head Loss Model As discussed in Section 1.2.6, using a deterministically-based model, there are a relatively limited number of scenarios where significant chemical effects would be ob-served. Because the deterministically-based model indicated that only a few extreme sce-narios could be consequential, a simplistic chemical effects model was adopted. In the simplistic model, the magnitude of total head loss is no less than a factor of 1 greater than the conventional head loss, but could be as much as a factor of 24 times the conven-tional head loss discussed in Section 1.2.7.The model is implemented according to the description below: The minimum factor (1 times the conven-tional head loss) is applied if the fiber quan-tity on a given strainer is less than 1/16 of an inch.The minimum factor (1 times the con-ventional head loss) is applied if the sump temperature is above 140'F. Based on the sump temperature profiles implemented in the STPNOC Pilot Project, the increase in head loss would occur approximately 5 hr af-ter the start of the event for large breaks, and approximately 16 hr after the start of the event for small and medium breaks.The probability distributions used in the simplistic chemical effects model were devel-oped with a mean of approximately 2 for small breaks, 3 for medium breaks, and 3 for large breaks. The distribution extreme val-ues are approximately 15 for small breaks, 18 for medium breaks, and 24 for large breaks.13 1 ANALYSIS IN MODULE 2 1.2 Method Comparisons ivith Prior Practice 1 ANALYSIS IN iVIODULE 2 1.2 Method Comparisons with Prior Practice That is to say, at 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after the start of a LBLOCA, the maximum value for head loss would be approximately 24 times the con-ventional head loss. Recall that the conven-tional head loss has a fixed increase of 5 times the NUREG/CR-6224 value giving a total of approximately 120 times the NUREG/CR-6224 value.1.2.9 Fiber Penetration The STPNOC Pilot Project has adopted two terms that relate to different bypass phenom-ena, penetration and bypass. Penetration is used with ECCS strainer performance and bypass is reserved for the in-vessel flow paths around the core.Common practice for assessing debris pen-etration has been to weigh the total quan-tity of debris collected downstream of the strainer after several pool turnovers (af-ter all penetration is completed).

In the STPNOC Pilot Project, a time-dependent de-bris penetration model is adopted. The STPNOC Pilot Project model accounts for two mechanisms operative for penetration.

The first mechanism is direct passage of de-bris as it arrives on the strainer.

A portion of the debris that initially arrives at the strainer will pass through, and the remainder of the debris will be captured by the strainers.

The direct passage penetration is inversely pro-portional to the combined filtration efficiency of the strainer and the initial debris bed that forms. The second mechanism is shed-ding, which is the process of debris working its way through an existing bed and pass-ing through the strainer.

By definition, the fraction of debris that passes through the strainer by direct penetration will go to zero after the strainer has been fully covered with a fiberglass debris bed. Shedding, however, is a longer term phenomenon since particu-late and small fiber debris may continue to work its way through the debris bed for the duration of the event.Debris that penetrates the strainer can cause both ex-vessel and in-vessel problems.The most significant downstream effects con-cern is related to the quantity of fiberglass debris that accumulates in the core. This is a highly time-dependent process due to the following time-dependent parameters: " Initiation of recirculation with cold leg injection" Switchover to hot leg recirculation" Arrival of debris at the strainer* Accumulation of debris on the strainer" Direct passage" Debris shedding* Flow changes when pumps are secured" Decay heat boil-off In order to implement the STPNOC Pilot Project strainer penetration model, specialized full-scale module tests were performed.

Unlike common practice for debris penetration, the STPNOC Pilot Project debris was collected at many intervals dur-ing the test such that the time-dependent behavior could be empirically modeled.1.2.10 Boric Acid Precipitation The STPNOC Pilot Project used a simplis-tic approach to model boron precipitation.

Previous deterministic analyses have shown that if hot leg switchover occurs within 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> following a CLB, boron would not precipitate.

However, debris blockage could invalidate these analyses.

Therefore, the STPNOC Pilot Project used a small amount of debris collection on the core (7.5 g/FA) as a threshold for failure.14 1 ANALYSIS IN MODULE 2 1.3 Uncertainty Quantification 1.2.11 In-Vessel Fiber Limits The acceptance criteria for debris loads on the core were defined based on the break location, injection flow path, and fiberglass debris loads that could po-tentially cause issues for debris block-age. Based on the STPNOC Pilot Project, thermal-hydraulic modeling that showed full blockage at the bottom of the core and core bypass would not result in core damage for any HLB, the acceptance criterion was set to essentially an infinite fiber quantity.

An ac-ceptance criterion of 15 g/FA was used for CLBs based on the conservative results of testing by the PWROG [45]. Note, however, that the core blockage acceptance criteria are bounded by the boron precipitation accep-tance criteria.

As discussed in Section 1.2.10, boron precipitation was not considered to be an issue for HLBs. For medium and large CL3s, the acceptance criterion for boron pre-cipitation was assumed to be 7.5 g/FA of fiber debris on the core.1.3.1 LOCA Frequency We use a probability distribution to model the LOCA frequency for breaks of different sizes at different locations within the plant.This probability distribution is specified in Section 2.2.3 of [46]. The assumptions we make in order to determine this distribution are given in Section 3 of [46] in Assump-tions 3.a-3.f. The analysis that we use to de-velop the probability distribution, and the way in which the probability distribution is employed in the analysis using CASA Grande, is described in Section 5.3 of [46] with further details in [47]. Here we briefly summarize our approach.Forming probability distributions for the frequencies of LOCA pipe breaks, particu-larly larger breaks, presents challenges be-cause we have limited data from operating experience, due to the very low probabilities of these breaks occurring.

The probability distribution for LOCA frequency that we con-struct is informed by two sources. First, we use NUREG-1829

[38]., which, among other scenarios, documents an expert elicitation of the percentiles (5th, 50th, and 95th) for breaks of six effective sizes for PWR plants without inclusion of contributions due to steam generator tube ruptures; namely, we use NUREG-1829, Table 7.19 for the current-day fleet (25 year average fleet operation).

Second, we use an STP-specific study [48], which allows us to distribute an overall fre-quency associated with a particular break size across different weld locations in the plant, using a total of 45 categories of welds.This allows us to form a joint distribution across break size and weld location that dis-tinguishes different weld types of the same size based on degradation mechanisms, while maintaining consistency with NUREG-1829 for the fleet-wide quantiles.

While NUREG-1829 uses six effective break sizes, we model a continuum of break sizes, using a linear interpolation between the 1.3 Uncertainty tion Quantifica-CASA Grande uses numerous variables as de-tailed in Volume 3; see Figure 1.1 of Section 1 in [46] for an overview.

Some of these input parameters are treated as deterministic pa-rameters, while others are treated as random variables with specified probability distribu-tions. The manner in which these probabil-ity distributions were determined depends on the nature of the information available re-garding the specific parameter in question.To give an idea of the range of methods we use, we discuss how we determined proba-bility distributions for LOCA frequency and fiberglass penetration.

We provide a further discussion of modeling the joint distribu-tion of multiple random parameters as im-plemented in CASA Grande.15 1 ANALYSIS IN MODULE 2 1.3 Uncertwn(y Quantification 1 ANALYSIS IN MODULE 2 1.3 UncertainLy Quantification neighboring break sizes for the NUREG-1829 quantiles.

This is equivalent to assuming a uniform distribution and governs the break size between, for example, the NUREG-1829 sizes of a 7-inch and a 14-inch break. The steps used in determining the probability dis-tribution and sampling that distribution in the CASA Grande implementation are sum-marized as follows [46, Section 5.3]: 1. Calculate the relative weight of breaks for specific weld categories based on pipe size, weld type, applicable degra-dation mechanisms, and so forth, and distribute total LOCA frequency to each weld location based on relative weight between weld cases.2. Identify applicable weld category and spatial coordinates for each weld loca-tion.3. Statistically fit the NUREG-1829 fre-quencies (5th, 50th, and 95th) using a bounded Johnson distribution for each size category.

These fits represent the epistemic uncertainty associated with LOCA frequencies.

4. Sample the epistemic uncertainty (e.g., the 62nd percentile) and determine the corresponding total frequency curve based on the bounded Johnson fits, as-suming linear interpolation between size categories.

5. Sample break sizes at each weld loca-tion and proceed with the GSI-191 anal-ysis carrying the appropriate initiating event frequencies.

Step 1 amounts to forming conditional prob-abilities using the STP-specific study [48].These give the probabilities that the break comes from each relevant weld category given that we have observed a break of a specific size. In step 3, we choose the parameters from the class of bounded Johnson distributions to minimize the sum of the squared deviations of the fit distributions from the NUREG-1829 percentiles.

To ensure that the tails of the break-size distribution are adequately sampled, we use a NLHS procedure

[49] in the CASA Grande implementation.

1.3.2 Fiberglass

Debris Penetra-tion We use a probabilistic model of the filtration function of the ECCS pump strainers, and the parameters of that probabilistic model are given in Section 2.2.29 of [46]. The assump-tions regarding fiberglass penetration of the strainer are detailed in Section 3 of [46], As-sumptions 9.a-9.d. The analysis that we use to develop the probabilistic model is based on a mass-transport theory described in Sec-tion 5.8 of [46] with the statistical fitting pro-cedure detailed in [50]. Here we briefly sum-marize our approach.Following a break in RCS piping, some of the fiberglass insulation debris from nearby piping and equipment would be transported to the ECCS sumps, where it would accumu-late on the sump strainers.In addition, some of the fine debris would pass through, or pen-etrate, the strainer.

Debris can pass through the strainer directly or via shedding from the accumulated fiber bed on the strainer.

The filtration efficiency of a strainer increases towards one as mass accumulates on the strainer.

Test data from prototype strainer module experiments performed at Alden Re-search Laboratory (ARL) in October 2012 provide measurements of mass that passed through the strainer with specified time res-olution. A combination of 100% capture filter bags and isokinetic grab samples were used to gather data regarding the change in pen-etration as a function of time. We model the filtration efficiency of the strainer, as a func-tion of the mass on the strainer, using the empirical filtration function in equation 7 in Section 2.2.29 of [46]. We estimate the pa-16 I ANALYSIS IN MODULE 2 1.3 UncertaintY Quantificatioll 1 ANALYSIS IN MOD ULE 2 1.3 Uncertainty Quaii tification rameters of this function using data from the ARL experiments.

We further use the exper-imental data to estimate the shedding pa-rameters of the mass-transport theory equa-tions described in Section 5.8 of [46]. Here, we focus on the probabilistic model for the filtration efficiency function.Rather than simply developing point es-timates of the parameters of the filtration efficiency function (equation 9 [46, Section 2.2.29]) and using the resulting point esti-mate of the filtration function, we instead use the experimental data to form an em-pirical envelope for the filtration efficiency.

Then, when executing a computer simula-tion in CASA Grande, using a uniform ran-dom variable, we repeatedly sample realiza-tions of the filtration efficiency function from the empirical envelope, maintaining the same functional form of equation 9.To construct the empirical envelope for the filtration function we carried out the follow-ing three steps: 1. We use data from each experiment at ARL to fit the parameters of the equa-tions of the mass-transport theory de-scribed in Section 5.8 of [46]. These equations predict, as a function of time, the mass accumulated on the strainer, the mass that has passed through the strainer, and the mass remaining in the pool given the rate of flow, the flow fraction captured by the filters, and the masses of debris and the timing of their introduction.

We find parameters of the mass-transport theory equations that most closely match the data, using a, constrained weighted least-squares pro-cedure detailed in [50].2. We use the parameters obtained in step 1 to construct both filtration as a function of time and the mass-on-the-strainer as a function of time at dis-cretized time steps. Then, we "eliminate time" to obtain what we will label a data series for each experiment, speci-fying filtration efficiency as a function of mass on the strainer.3. Steps 1 and 2 are repeated for each of the experiments, and the results yield multiple data series indicating the variability seen across the experiments.

Taking these data, we form an empiri-cal envelope for filtration as a function of mass on the strainer by finding three functions:

First, we use a least-squares fit to find a central fit to the multiple data series from step 2, optimizing the parameters of equation 9 [46, Section 2.2.29]. This yields the parameters in the "Center" row of Table 2.2.28 in [46].The second function is also of the form of equation 9 but majorizes the data while having minimum area. under the function.

The third function is again of the form of equation 9 but minorizes the data and has maximum area under the function.

These latter two functions cor-respond to the parameters in the "Up-per" and "Lower" rows of Table 2.2.28 in [46].To transform the parameters found for the experiments at ARL to parameters for plant conditions, the parameters must be appropri-ately scaled, as described in Section 2.2.29 in[46].1.3.3 Modeling Dependencies Multiple parameters are random in our anal-ysis, and hence a joint distribution governs the associated random vector. This means we should describe the corresponding depen-dence structure.

We have two main strategies for dealing with the challenge of handling multivariate uncertainties for CASA Grande input parameters, and these strategies in-volve: (i) appropriate dimension reduction by modeling "perfect correlations" and (ii) ap-17 2 ENGINEERING ANALYSIS propriate modeling of conditional indepen-dence.As an example of dimension reduction, consider the uncertainty associated with LOCA exceedance frequencies for a 2-inch break and for a 6-inch break. Let A 2 de-note the exceedance frequency for a 2-inch break with (cumulative) distribution func-tion F 2 , and let A 6 and F 6 denote the anal-ogous quantities for a 6-inch break. Here, F 2 and F6 are fit as we describe in Section 1.3.1 and describe in more detail in Section 5.3 of[46] and in [47].We do not model the random variables A 2 and A 6 as being independent. (If one were to do so then it would be possible, in simu-lating observations from these distributions, that the 6-inch exceedance frequency would be greater than the 2-inch frequency.)

In-stead, we model dependence using dimen-sion reduction as follows: Let U -U(0, 1) be a uniform random variable on the interval (0, 1). Then using the standard simulation technique called inversion, A 2 = F.-1 (U) has distribution F 2 and A 6 = F6 1 (U) has distri-bution F 6.We reduce the dimension by as-suming a perfect correlation via the bivari-ate random vector (F1-l(U), F-J1 (U)), where we use the same uniform random variable in both expressions.

In this way, if the 2-inch frequency, A 2 , is at the 62nd percentile (via U = 0.62) of the distribution F2 then A 6 is at the 62nd percentile of F 6.This type of di-mension reduction is employed for modeling break sizes in CASA Grande.Appropriate modeling of conditional in-dependence is our second main strategy for handling multivariate uncertainty, and this approach is used pervasively in our analysis.As a first example, the timing of key plant re-sponse actions are, strictly speaking, random variables.

However, these are determined in a conditional manner as described in Sec-tion 2.2.1 of [46]. So for a break smaller than 2-inches, the accumulators would not inject, and the sprays would not be initiated.

Simi-larly, the timing for switchover to recircula-tion depends on the volume of water in the RWST, the total ECCS and CSS flow rate, and the break size. Operating procedures are further conditioned on the number of oper-ating CSS pumps. (Again, see Section 2.2.1 of [46].) The pool water level is discussed in Section 2.2.5 of [46] and this depends on the size of the break and on the elevation of the break. The pool temperature profiles depend on the size of the break, as described in Sec-tion 2.2.6 of [46].2 Engineering Analysis 2.1 Defense-in-Depth and Safety Margin No changes are proposed to DID or safety margin by this licensing basis change. In-stead, the risk associated with the traditional design basis accident analysis is assessed and quantified.

In keeping with the Commission's goal to increase the use of risk analysis in regulation, this analysis quantifies the risk and uncertainty incorporating the impact of steps taken to preserve high levels of nuclear safety against perceived risks, while balanc-ing regulatory cost and the need for signif-icant worker exposure to mitigate concerns where the risk to nuclear safety is significant.

A detailed discussion of the DID in place at STP is provided in Appendix C.2.1.1 Defense-in-Depth The risk to reliable operation of the as-built, as-operated plant DID systems is analyzed to be very small. STP has three trains of safety injection and three trains of containment fan coolers. The containment fan coolers do not rely on the recirculation mode for cooling the sump water. Decay heat can also be removed by the steam generators using the auxiliary feed water system and the steam generator 18 2 ENGINEERING ANALYSIS 2.1 Defense-in-Deptli and Safety Margin 2 ENGINEERING ANALYSIS 2.1 Defense-in-Depth and Safety Margin power operated relief valves.The normal charging system is an al-ternate flow path that can be aligned to the RWST if the ECCS pumps become un-available for any reason. The design pro-vides for an entire volume of the RWST (ap-proximately 500,000 gallons) to be refilled and injected into the containment.

Normally, STP can refill the RWST in approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. When indicated by the EOP, the reactor coolant pumps can be operated to cool the core and prevent core damage.The risk associated with the concerns raised in GSI-191 regarding the likelihood of radiation release from the as-built, as-operated plant, as evaluated by LERF 4 2 , is ef-fectively zero. The concerns raised in GSI-191 have no bearing on containment integrity or on the release of radiation.

2.1.1.1 General Design Criteria.Because the analysis evaluates the risk of the as-built, as-operated plant, the traditional engineering analysis that forms the basis for the design remains intact and is inherent in the analysis.

That is, the design criteria ul-timately result in certain performance stan-dards for the ECCS, such as required flow rates, support system availability, and equip-ment failure combinations.

Although all com-mitmnents to design criteria remain intact, they cannot guarantee that core damage or LERF are prevented for every postulated sce-nario. Therefore, as previously mentioned, the LB 4 3 change evaluates the significance of the (non-zero) risk associated with the as-built, as-operated plant. Because the design criteria are robust and because changes to the design have been made to address specific GSI-191 concerns, the risk produced by the analysis is very small. The analysis incorpo-rates extreme effects of chemical phenomena on debris bed differential pressures as well as 4 2 Large Early Release Frequency 4 3 Licensing Basis boron precipitation.

Even with these extreme assumptions, the probability for core damage is found to be very small with no expectation for increased probability for LERF.2.1.1.2 Defense-in-Depth Princi-ple. The analysis shows that DID is main-tained with high probability.

The availability and reliability of the systems that support DID continue to be assured with high proba-bility with consideration of uncertainty.

The analysis shows that there is practically no risk to containment integrity associated with the concerns raised in GSI-191 and therefore, the license basis change would indicate that as-built, as-operated containment design re-mains adequate to prevent a significant re-lease into the environment.

In quantification of the risk, additional operator actions or programatic activities beyond the existing as-built, as-operated plant have not been in-cluded.2.1.1.3 Uncertainties of Chemical Effects. As part of the analysis, exper-iments have been developed to investigate the significance of the concerns raised in GSI-191 for post-LOCA environments spe-cific to the STP plants. These experiments examined conditions under which specific forms of chemical precipitates, particularly A1OOH, can be formed: in-situ over short time frames (on the order of hours or days)by, for example, direct injection of aluminum salts; and ex-situ (as in surrogate prepara-tions developed elsewhere in the industry).

The experiments also examined chemicals formed by actual corrosion sources (such as aluminum, zinc, or concrete) in prototypical post-LOCA environments.

Experiments have shown that using ex-situ methods of precipitate formation pro-duced precipitate forms that are much more likely to result in head loss impacts in debris beds than those formed in-situ. Finally, and consistent with previous observations

[4], the 19 2 ENGINEERING ANALYSIS 2.1 Defense-in-Depth and Safety Alai-gin 2 ENGINEERING ANALYSIS 2.1 Defense-in-Depth and Safety Margin more recent experimental work performed for this analysis provides evidence that the chemical corrosion process that would take place in an actual post-LOCA environment is significantly more benign to debris bed head loss than would be suggested by any of the surrogate (in-situ or ex-situ) methods. The results of the chemical effects experimental program that are most similar to the actual post-LOCA sump conditions give confidence that experiments performed with surrogate preparations represent an upper bound for chemical effects on debris bed head loss.2.1.1.4 Uncertainties of Head Loss.The head loss associated with debris beds call be shown to be dependent not only on chemicals, but on the presence of particulates transported to the sump area. Such particu-lates have been hypothesized to result from failure of coatings unqualified for high radi-ation and post-LOCA fluid chemistry.

The transport and failure extent of such particu-lates have been conservatively estimated in the STPNOC Pilot Project analysis so as to preserve their effect on the result. The fail-ure extent and rate of failure used in the STPNOC Pilot Project are supported by ex-perimental evidence.Experiments have been conducted in a high-temperature vertical loop using ex-pected post-LOCA fluid conditions (pH, boron and buffer chemical concentrations.

and temperature) to examine the uncertainty of coefficients derived in correlations com-monly used in the analysis of head loss con-cerns raised in GSI-191, for example, the NUREG/CR-6224 correlation.

The experi-ments investigated a wide range of particu-late size distribution and types (for example, different forms of silicon carbide and iron ox-ide) and showed that the NUREG/CR-6224 correlation bounds actual head loss in beds with post-LOCA fluid flow, chemistry, par-ticulate, and bed formation prototypical of the STP plants. The experiments help in un-derstanding the uncertainty and margin in the analysis of head loss from many hypoth-esized break sizes and locations with different debris loads.Because current testing of STP conditions has only verified a few possible bed compo-sitions, a multiplier has been applied to all debris-bed head loss calculations to compen-sate for residual uncertainties.

2.1.2 Safety

Margin In each scenario, the tails of extreme distri-butions are sampled and propagated through to the PRA. Where appropriate, the un-certainty distributions envelope attributes of both aleatory uncertainty and epistemic uncertainty.

As will be explained later in this report, the only component of epistemic uncertainty that is explicitly preserved in the present analysis is the component at-tributable to the break-frequency size distri-butions taken from NUREG-1829.

All other sources of variability have been integrated into the estimates of failure probability re-ported for the composite failure modes used in the PRA. Composite failure modes ap-plied in the PRA include (1) strainer fail-ure by excessive differential pressure, exces-sive deaeration, and mechanical buckling; (2)core blockage; and (3) boron precipitation.

Also, experimental results for chemical ef-fects were obtained with existing amounts of aluminum exposed to post-LOCA fluids for 30 days, and they indicated very little to no precipitate formation in the bulk fluid.Although such an extreme scenario would never be expected based on a realistic analy-sis of the LOCA response, thermal-hydraulic engineering evaluations of core flow block-age scenarios were conducted to understand safety margin in these scenarios.

These eval-uations [51] include assessments of extreme conditions of core blockage.

It was shown that with complete blockage of the core in-let and all bypass paths, only a medium or 20 2 ENGINEERING ANALYSIS 2.2 Evaluation of Risk- Impact 2 ENGINEERING ANALYSIS 2.2 Evaluation of Risk Impact large break cold leg LOCA would result in core damage. In addition, detailed modeling of the core and reactor vessel showed that only one fuel assembly flow passage needs to remain clear to prevent fuel overheating.

The analyses included locating the open fuel as-sembly either at the core center or at an ex-treme periphery location.

Multi-dimensional vessel and core simulations at the time of re-circulation show that the core inflow is highly asymmetric indicating that it would be likely that several fuel assemblies would not be blocked by debris that might penetrate the ECCS sump screens.Chemical effects testing conducted in the STPNOC Pilot Project has shown that signif-icant amounts of chemical precipitation that would be expected to produce large head losses in typical debris beds are not present in solution in the STP post-LOCA environment.

Where precipitation occurs, the test results suggest that the precipitates that actually form in solution have different morphology from the surrogate precipitates and are likely to have less impact on total head loss. Un-der extreme scenarios, chemical effects might be more significant than those observed in the STPNOC Pilot Project tests. To address this possibility, a chemical effects bump-up factor probability distribution with a tail in-cluding 15x, 18x, and 24x increases for small, medium, and large breaks, respectively, was included in the CASA Grande evaluation.

The purpose of the extreme tail was to preserve a 10-5 probability of meeting or exceeding the stated limits, while preserving expecta-tion values between 2 and 3 (factors of 2x to 3x) for each LOCA category.

In addition, the contributions of chemical effects from bound-ing experiments with ex-situ prepared pre-cipitates

[52] are assumed in the core flow blockage success criteria, which success crite-ria was developed as a bounding value for all PWRs. Several other conservative assump-tions leading to safety margin in the as-built, as-operated plant are detailed by NEI [53].All STP large-bore piping PWSCC-susceptible welds (nozzle welds) have been replaced or otherwise mitigated, with the ex-ception of the reactor vessel nozzle welds.The reactor vessel nozzle welds are less of a concern in the GSI-191 analysis than are other break locations because the reactor vessel is covered with RMI, and the pri-mary shield wall would protect the majority of fiberglass insulation in the steam genera-tor compartments.

STPNOC is in compliance with ASME Section XI weld inspections.

The insulation, paint, and concrete dam-age choice of the ZOI used in the STPNOC en-gineering calculation is expanded to account for pipe whip. The calculations assumes piping constraints (especially on large-bore pipes) that would reduce the ZOI based on pipe whip restraint are not present. Finally, Ballew et al. [54] have shown that the ZOIs used in the GSI-191 risk analysis are signifi-cantly overestimated

[32, Section 3.4.2].2.2 Evaluation of Risk Im-pact The risk assessment shows that any increases in CDF 4 4 and risk are very small and con-sistent with the intent of the NRC's Safety Goal Policy Statement.

The expected change in CDF and LERF is very small in the analy-sis, which includes internal and external haz-ards in an at-power model that bounds risk contribution.

An in-depth and comprehen-sive risk assessment using the STPNOC PRA was used to derive the quantified estimate of the total impact of the proposed change as opposed to a qualitative assessment using, for example, performance measures.Because pressures and temperatures are greatly reduced in plant operating Modes 4, 5, and 6, the concerns raised in GSI-191 can not be realized in these shutdown modes of operation.

For Mode 3, the at-power model" 4 Core Damage Frequency 21 2 ENGINEERING ANALYSIS 2.3 PRA Adequacj, is bounding and can be used as a surrogate for Mode 3 operation.

The quantitative risk metrics evaluated in the analysis are CDF and LERF. There may be risk metrics that are not reflected (or are inadequately reflected) by changes to CDF and LERF. Other risk metrics were considered, especially effects on containment integrity.

However, no concerns related to GSI-191 that have a, bearing on containment integrity following a LOCA have been iden-tified in the analysis.

Therefore, there is no effect on LERF, and therefore no impacts to offsite consequences.

The STPNOC PRA has been reviewed on multiple occasions by the NRC. The last independent peer review was for STPNOC PRA Revision 5 and assessed it as adequate for use in STPNOC PRA applications.

Since Revision 5, there have not been any major changes to the PRA that require additional peer review. The PRA is currently at Revi-sion 7, released late in 2012. The concerns raised in GSI-191 are isolated to long-term cooling in LOCAs. Other initiating events in-eluded in the PRA are therefore less impor-tant than the LOCA event trees. The STP baseline CDF and LERF are substantially be-low the Commission Safety Goal when the as-built, as-operated plant risk is evaluated with the concerns raised in GSI-191 included.Therefore, the concerns raised in GSI-191 would contribute negligible risk relative to the analyzed average plant risk.2.3 Technical Adequacy of the PRA Analysis The STPNOC PRA is a full-scope integrated Level I and Level II PRA. Further details concerning the technical adequacy of the STPNOC PRA are found in Volume 4. How-ever, the GSI-191 concerns pertain to LOCAs and in particular, the recirculation phase of a LOCA. The main concerns are with MBLOCAs and LBLOCAs. As mentioned in Section 2.1.2, thermnal-hydraulic response analysis shows that long-term core cooling is not challenged in SBLOCA scenarios.

The STPNOC PRA, like similar PRAs, included a very simplistic demand failure probability for recirculation failure. The GSI-191 risk analy-sis required a much better understanding of the failure probability and concomitant un-certainty for recirculation failure. In order to support a more informed basis for recircu-lation failure, the basic event likelihood and uncertainty needed engineering analysis sup-port. A detailed uncertainty quantification was performed to solve the required engineer-ing models and propagate their uncertainty to obtain a. recirculation failure probability.

Similarly, the basic event failure likelihood and uncertainty for ECCS pump performance included only mechanical and electrical fail-ures. However, the concerns raised in GSI-191 required an assessment of the likelihood for air ingestion and inadequate NPSHA when debris beds are hypothesized to form on the ECCS sump strainers.

These added failure mechanisms were included in the PRA, with their failure probability and uncertainty de-termined through uncertainty propagation of appropriate physical models as described in detail in Volume 3. The failure thresholds for these kinds of events are from a stan-dard engineering analysis of allowable air and NPSHA for the pumps during a worst case LOCA scenario.Finally, downstream effects of core block-age and boron precipitation were included with the possibility of recirculation failure.Again, the added failure mechanisms were included in the PRA with their failure prob-ability and uncertainty determined through uncertainty propagation of appropriate phys-ical models.2.3.1 Scope of the PRA The scope of the STPNOC PRA is Level I and Level II, including external and inter-22 2 ENGINEERING ANALYSIS 2.3 PRA Adequacy 2 ENGINEERING ANALYSIS 2.3 PRA Adequacy nal hazards such as internal floods, seismic events, internal fires, high winds, and exter-nal flooding.

This level of detail is actually not required because none of the LOCAs are evaluated in external events, which means that GSI-191 issues do not appear. The con-cerns raised in GSI-191 are related to LOCAs, and the at-power LBLOCA- and MBLOCA-initiating events are the most important of the concerns.

Being that the STPNOC PRA is an at-power PRA, no shutdown LOCA events are considered.

The at-power scenar-ios bound the low power and shutdown LOCA events, not only because the decay heat load is significantly reduced, but because the en-ergy available for debris generation is much less. Therefore, the STPNOC PRA overall scope is sufficient to address the concerns as-sociated with GSI-191.The STPNOC PRA Revision 7 initiating event frequency for LOCAs is taken from the most recent database used in PRA anal-yses [55]. Eide et al. refer to NUREG-1829 [38] as the basis for LOCA initiating event frequencies.

The frequencies used in the STPNOC PRA LOCA initiating event trees are preserved in the engineering anal-ysis used to develop failure probabilities at locations throughout the Class 1 piping in the STP containment buildings.

Also, the LOCA epistemic uncertainties used in the en-gineering analysis are taken from the same NUREG-1829 table used by Eide et al.2.3.2 Level of Detail As previously mentioned, the PRA is not significantly changed to specifically address the concerns raised in GSI-191. Instead, a detailed engineering analysis is performed in an uncertainty quantification framework that evaluates the required failure modes of ECCS and core cooling (in-vessel effects).Significant detail is included in the engi-neering analysis used to develop the new basic events and top events required.

De-tails include physical models and mecha-nisms known to lead to failure, and the anal-yses include experimental evidence used to support particular areas of concern.2.3.3 Technical Adequacy The safety issues associated with GSI-191 are within the scope of current PRAs that meet Regulatory Guide 1.200 [56, 57], Revision 1 or Revision 2. LOCAs are internal event ini-tiators included in all versions of Regulatory Guide 1.200. The STPNOC PRA has been peer reviewed relative to internal events (in-cluding LOCA initiators).

Since STPNOC's PRA is compliant with RG 1.200, Revision 1 for internal events, it is compliant with Reg-ulatory Guide 1.200, Revision 2 for assessing the risk associated with GSI-191.The PRA analysis is technically robust.The assumptions and/or actual modeling of the concerns raised in GSI-191 are bounded either in other work by experimental evi-dence or analysis, or by analysis and ex-perimentation specifically performed for the STPNOC PRA evaluation.

The STPNOC PRA is used in risk-informed applications exten-sively at STP.The methodologies, applications, and re-sults derived from the STPNOC PRA are re-viewed by peers in benchmarking and other activities and are also regularly published in the open literature and symposia.

Exam-ples include [58, 59, 60, 61, 62, 36, 63, 64, 65, 66, 67, 68, 69, 70, 71]. In some cases, STPNOC has been the industry leader in PRA applications and application develop-ment, and in setting standards and prac-tices. In the GSI-191 risk-informed resolu-tion, STPNOC has followed the practices and methods known to be acceptable and consis-tent with industry PRA practices and stan-dards.23 2 ENGINEERING ANALYSIS 2.3 PRA Adequac.y 2 ENGINEERING ANALYSIS 2.3 PR.A Adequacy 2.3.4 Plant Representation The STPNOC PRA and the engineering anal-ysis supporting the GSI-191 analysis are representative of the as-built, as-operated plant. The STPNOC PRA is reviewed for compliance/adherence with the plant design and plant data every 36 months as an UF-SAR Chapter 13.7 commitment required for PRA applications.

Section 2.3.5 is a summary of the engineering analysis supporting the PRA analysis in the STPNOC Pilot Project.The STPNOC PRA configuration control is in accordance with STPNOC plant processes[72].2.3.5 Model of the LOCA Pro-cesses, CASA Grande One of the primary functions served by CASA Grande in the STPNOC Pilot Project is quantifying conditional failure probabilities related to GSI-191 phenomena for various plant modes and ECCS operating states. Fail-ure probabilities are passed to the PRA to de-termine the decision metrics for acceptance.

Three new top events are added to the PRA to accommodate composite GSI-191 failure processes: " failure at the sump strainer;" boron precipitation in the core; and" blockage of the core.These three composite failure probabilities are calculated by testing the outcome of ev-ery postulated break scenario against seven performance thresholds:

• (1) strainer AP > Margin to NPSHR;e (2) strainer AP Pbuckle 4 5;* (3) strainer F,,oid 4 6 > 0.02;4 5 Strainer structural design limit 4 6 Void Fraction* (4) core fiber load > CLB fiber limit for boron precipitation;

• (5) core fiber load > HLB fiber limit for boron precipitation;

• (6) core fiber load > CLB fiber limit for flow blockage; and* (7) core fiber load > HLB fiber limit for flow blockage.(1) through (3) above are counted as fail-ures if any single operable strainer exceeds the performance thresholds at any time dur-ing the 36-hour calculation.

(4) and (5) are assessed against the accumulated fiber pen-etration from all operable strainers and are counted as failures only if the performance threshold is exceeded before the time of hot-leg injection.

The thresholds for (5) were set infinitely high so that only exceedance of the CLB boron precipitation loading (4) was recorded as failure. This approach is reason-able because the threshold for failure in (4) is substantially lower than for (5) through (7), and because (4) through (7) all depend on (1)through (3), and all the performance thresh-olds depend on the same internal flow distri-bution and fiber accumulation processes.

Violation of any of the seven performance thresholds is counted as an independent fail-ure. Thus, it is possible that a single scenario can contribute to both a strainer-related fail-ure tally and a core-fiber-load failure tally.After a suite of scenarios is performed, the sum of probability weights for failed scenar-ios within each LOCA category is divided by the sum of probability weights for all scenar-ios within each LOCA category to generate the conditional failure probabilities needed for the PRA. Table 1 reports the mean con-ditional failure probability associated with each composite failure mode for each of five plant operating states (cases). No failures were recorded for small- or medium-break events, and it transpired that only the higher range of large-break events contributed to 24 2 ENGINEERING ANALYSIS 2.3 PRA Adequacly failure. In addition to the composite PRA failure modes, total failure probability con-ditioned on the LOCA category is provided.TheTable 1 results indicate the following.

Design-basis accident response with three trains operable (Case 1) is estimated to in-cur a total failure probability of 0.47% given that an LBLOCA occurs (that is, about 5 fail-ures in every 1,000 large-break events). If only one train is operable (Case 43), this es-timate increases to 1.93%. The primary con-tributor to the increase is the additional head loss incurred at the single strainer by col-lecting all of the debris that was designed to flow in proportion across three strainers un-der Case 1. Conversely, failures incurred by exceeding the boron fiber load are reduced (compare first and last columns) because less cumulative fiber is penetrating the sin-gle, highly loaded strainer.

Blockage failure is reported as zero probability because the thresholds were set very high, partly to avoid double counting blockage failures for events that first exceed the bounding low value for fiber-load thresholds related to boron pre-cipitation in the core.Conditional failure probabilities reported in Table 1 are described as "mean" or "ex-pected" values because fifteen point esti-mates associated with independent samples of the NUREG-1829 break frequency enve-lope have been averaged for use in the PRA.The following discussion explains the origin and the mechanics of this averaging process.The NUREG-1829 tables [38] assign con-fidence levels to estimates of annual occur-rence frequency as a, function of break size.This assignment of confidence level defines an envelope of epistemic uncertainty that was fit using bounded Johnson probability density functions at each discrete break size for which percentiles of confidence were tab-ulated. The purpose of these fits was to en-able interpolation of the confidence bands at any intermediate break size of interest.The relationship defined by NUREG-1829 between annual occurrence frequency (events per year) and break size is presented in terms of a ccdf 4 7.This format implies that the un-derlying pdf'8 has been integrated, and it is important to consider the form of the pdfs before selecting an interpolation scheme that will be applied to the ccdfs. Conversely, any presumption about interpolation of the ccdf would constrain the implied form of the pdf.A pdf defined for break size must define the probability per unit size that a break oc-curs within the interval between the discrete sizes tabulated in NUREG-1829.

Without knowing the details of how fracture mechan-ics processes were treated during compila-tion of the NUREG-1829 table, it is difficult to defend any assumption other than uni-form probability density between the tabu-lated discrete sizes. Uniform probability den-sity means that any break size within the in-terval is equally likely. Uniform (constant) break-size probability between two ccdf val-ues is easily calculated as the positive dif-ference between the complementary cumula-tive annual frequencies divided by the posi-tive range of size across the interval divided by the total annual exceedance frequency for the smallest break size. The integral of a con-stant pdf, which is needed to form a ccdf, is a straight line, and this implies that linear-linear interpolation of the NUREG-1829 ta-ble is the treatment most consistent with the assumption of constant underlying probabil-ity density.Figure 10 uses log-log axes for plotting a linear-linear interpolation of the NUREG-1829 table values, which causes the linear ccdf to appear as a periodically looping curve.NLHS of break-frequency profiles from the Johnson pdf envelope are performed in ex-actly the same manner as for all other ran-dom variables.

The nonuniform probability bins are predefined based on the desired 4 7 Comnplementary Cumulative Distribution Function 4 8 A probability density function 25 2 ENGINEERING ANALYSIS 2.3 PRA Adequacy Table 1: Mean LBLOCA conditional failure probabilities for five plant operating states. Failure probabilities shown are for strainer blockage, core fiber load exceed-ing flow blockage criteria, and sump differential pressure exceeding Ppbu.ckle.

Each case refers to a plant operating state.Case 1 Case 9 Case 22 Case 26 Case 43 Blockage 0 0 0 0 0 Boron 1.25x10-03 2.85x10-° 2.54x10-04 3.07xi 0 4 1.04x i0-5 Fiber Load Sump 3.41x10-0 3 7.23x10-0 3 6.19x10-0 3 1.02x10-0 2 1.93x10-0 2 Failure Total 4.66x 10-0 3 1.01 x 10-1 2 6.44x 10-0 3 1.05x 10-0 2 1.93x 10-0 2 2 number of samples and on the direction of presumed conservatism.

Then, random per-centiles are chosen from within each bin to represent, or "carry," the associated proba-bility weights. For the STPNOC Pilot Project, fifteen independent random samples were ex-tracted from the Johnson envelope for each plant operating state, with an emphasis on upper percentiles of the break frequency un-certainty envelope.

Given a sample of fif-teen percentiles, the Johnson fits are then inverted to find the corresponding annual frequencies.

All Johnson fits are perfectly correlated by using the same fixed values of the sampled percentiles.

Finally, the set of annual frequencies from each Johnson fit is linearly interpolated to create the break-frequency profiles shown as the dashed lines in Figure 10.Each break frequency profile is fully an-alyzed in CASA Grande using a set of 20 batch replicates containing approximately 2,250 break scenarios each to obtain a point estimate of failure probability for the com-posite modes. Residual sampling imprecision of roughly 5% among the twenty replicates is typical of this scenario sampling size. Proba-bility weights from stratified sampling of the beek size (m)Figure 10: Linear-linear interpo-lation of bounded Johnson extrema (solid) with nonuniform stratified random break-size profiles (dashed).26 2 ENGINEERING ANALYSIS 2.3 PRA Adequacy Johnson envelope are then used to form the weighted conditional means reported in Ta-ble 1.The resolution used in the STPNOC Pilot Project is 2,250 breaks for batch size, 20 replicates, and 15 break-frequency samplesTable 2 summarizes the fifteen point estimates and their associated probability weights generated for the total failure probability under plant operating state Case 43 (one train operable).

The weighted mean is formed simply by multi-plying each point estimate by its probability weight and adding the products.

Similar distributions

..were formed for all composite failure modes and for all plant operability states, but only the weighted means are presented in Table 1.The cumulative distribution defined for total failure probability under Case 43 in Table 2 is plotted in Figure 11 to illus-trate how epistemic quantiles could be pre-served from the GSI-191 engineering analysis CASA Grande. This distribution reflects only the uncertainty inherent to the estimation of annual break frequency.

All other random variability, including ranges on physical phe-nomena and decision criteria, has been inte-grated into each point estimate.

As shown in Table 2 and Figure 11, typical variation in failure probability estimates spans a factor of 2 to 4 between the minimum and maxi-mum values. This variation is caused solely by the shape of the randomly selected break-frequency profiles, which dictate the relative proportion of break frequency by size.It is important to reemphasize that CASA Grande never directly uses the an-nual break frequency as a time-rate quan-tity. All analyses proceed conditioned on the assumption that a break has already occurred.

Sample profiles taken from the break-frequency envelope then describe how to partition the relative occurrence of breaks by size. CASA Grande further redistributes the relative size probability across weld types in order to map the cumulative probability of a break as a function of size to discrete loca-tions in the plant [37].The PRA samples directly from the NUREG-1829 Johnson pdf fits in each cat-egory to preserve the epistemic uncertainty in LOCA frequency.

It is important for CASA Grande to use exactly the same repre-sentation of the epistemic uncertainty.

The Johnson fits are evaluated analytically in CASA Grande to generate a table of em-pirical pdfs that are manually passed to the PRA (RISKMANTM model) for repeated sampling in the risk quantification.

Although the PRA generates thousands of samples from the Johnson pdf during quantification, CASA Grande sampling is relatively sparse here. CASA Grande uses one quantification loop to generate point estimates of failure probability that are based on parameter vari-ations and model uncertainties like chem-ical effects bump up, and an outer loop to preserve the epistemic quantiles of the break-frequency envelope (see Section 2.5.1).Sparse sampling of the epistemic envelope is a consequence of emphasizing aleatory uncer-tainties (inner loop) that drive the outcome of each break scenario and epistemic sam-pling relies on NLHS for generating unbiased estimates of the mean failure probability.

Failure distributions similar to those shown in Figure 11 could alternatively be sampled by the PRA to generate distributions of in-cremental risk attributable to GSI-191 phe-nomena. A sampling scheme would necessar-ily preserve epistemic correlation in the dis-tribution of failure probability that is gener-ated by CASA Grande (Figure 11) and shared by the RISKMANTM model.Another key piece of information passed from CASA Grande to the PRA through the basic events supported is the conditional split fraction for cold leg breaks in each LOCA category.

The total break size prob-ability for a single NUREG-1829 profile is distributed across all welds in containment 27 2 ENGINEERING ANALYSIS 2.3 PRA Adequacy-Table 2: Distribution of total conditional failures for LLOCA under Case 43 (one train operating).

Point Failure Johnson Probability Cumulative Probability Weight Probability 1.20x 10-02 2.80x10-01 0.OOx 10-00 1.25xx10-02 2.02x10-°1 4.82x10-o' 2.01x10--2 1.45x10-0 1 6.27x10-M 2.05x10-0 2 5.41x10-0 2 6.81x10-1 2.44 x10-0 2 1.04x 10-0' 7.86x 10-0 1 2.49x10-0 2 7.52x10-0 2 8.61x10-1 2.53 x10-0 2 3.89 x10-0 2 9.00x10-0 1 3.36 x10-0 2 2.80 x10-0 2 9.28x 10 -1 3.78 x10-02 2.02 x10-0 2 9.48x 10-F 3.84x 10-02 1.04 x10-0 2 9.59x 10-0'3.98x 10-02 1.45x10-0 2 9.73x10-0 1 4.28x10-0 2 5.41x10-0 3 9.79x 10-0'4.37x10-1 2 3.89x10-0 3 9.82x10-°1 5.07x 10-0 2 7.52 x10-0 3 9.90 10-°1 5.14x10 0 1.00 X10-0 2 1.00X10-1.93x 10-02 weighted mean using the hybrid weighting scheme [37] to ac-count for the contributions of small breaks on large pipes to the small and medium LOCA categories.

Each break scenario sam-pled from this process carries a specific size and location and a fractional weight of the total break-size probability.

Before any other physical parameters are considered, the dis-tribution of probability weight can be par-titioned into HLB and CLB events and by LOCA size.Table 3 itemizes all cold-leg split frac-tions obtained for the fifteen batches as-sociated with Case 43. These values were obtained by dividing the sum of probabil-ity weights for CLBs in each LOCA cate-gory by the sum of probability weights for all breaks in the LOCA category.

HLB split fractions are simply the complement of any single entry in the table. Twenty replicates of 2,250 scenarios are evaluated for each of fifteen break-frequency profiles for a to-tal of 20x2250x 15 = 675,000 scenarios per plant operating state. CLB split fractions are mildly dependent on the break-frequency profile shape, but they are independent of the plant operating state. It is interesting to note that proportion of large CLBs is substantially smaller than the 50% proportion assumed in the 2011 [3] quantification.

Table 4 lists a sample of the specific welds, break sizes; and general containment zones that are associated with one or more failure modes in Case 43. This list includes only the first few of many failed scenarios that were tallied during the analysis.The fact that no SBLOCA or MBLOCA events have been recorded as failure for any 28 2 ENGINEERING ANALYSIS 2.4 Acceptance Guidelines Table 3: All cold-leg split fractions conditioned on LOCA categories small, medium, and large for Case 43. The complement of the cold leg fraction.fraction going to the hot leg is simply the Total Small Medium Large 4.1991892 x 10-0 1 4.2914777x 10-0 1 3.8133571 x 10-0 1 2.3039538 x 10-0 1 4.1984919 x 10-' 4.2909177x 10-"' 3.8133594x 10-' 2.3036310x 10-1 4.1991698 x 10-" 4.2914621 x 10-u 3.8133600x 10"1 2.3037358x 10-01 4.1996107x 10"1 4.2918159x 10-0 3.8133597 x 10-1 2.3038587x 10-01 4.2038478 x 10-U 4.2952020x 10`1 3.8133543 x 10-" 2.3052148x 10-0 4.2072589 x 10`1 4.2979108x 101- 3.8133489 x 10"1 2.3063934x 10-0 4.2095267x 10-1 4.2997033x 10-u1 3.8133451 x 10-01 2.3072009x 10-" 4.2177772x 10-01 4.3061685x 10-1 3.8133295x 10-" 2.3102566x 10'1 4.2309456 x 10'1 4.3163091 x 10-0' 3.8133003 x 10-' 2.3154444x 10-`4.2451989 x 10"1 4.3270453x 10-0' 3.8132616 x 10"' 2.3214710x 10-1 4.2651032 x 10-1 4.3416369x 10-01 3.8131885 x 10-" 2.3307565x 10-01 4.2701284x 10-01 4.3452493x 10-11 3.8131647x 10-01 2.3333097x 10-1 4.2919587x 10-01 4.3606210x 10`" 3.8130162 x 10-01 2.3458976 x 10" 4.3216441 x 10-' 4.3807278x 10-0 3.8125583 x 10-01 2.3704386 x10" 4.3899528x 10"-" 4.4239285x 10-01 3.8052362x 10- ' 2.5859755x 10-Cm-Dtd Tobd Fad- PWobkty (C... 43 0I 0*10 50.0.scenario evaluated in this quantification is a strong indication that there is a minimum size break below which insufficient debris can be formed to challenge the safety systems.2.4 Acceptance Guidelines Regions are established on the phase planes defined by ACDF, CDF and ALERF, LERF, as illustrated in Figure 12 and Fig-ure 13. Acceptance guidelines are established for each region as discussed below. The fig-ures show shading as the values increase on either axis. The shading indicates that greater scrutiny and support would be re-quired for values that approach the region boundaries.

Also illustrated, in the figures, is the desired trajectory for changes. That tra-jectory can be realized by using resources on projects that have the maximum risk benefit, a concept that is consistent with the Com-mission's direction to use risk insight to best achieve safety goals.018 0015 0 02 002M 003 0035 004 0040 005 0055 bk" -obk Figure 11: Empirical distribu-tion of total failure probability for Case 43 (one train operating) based on fifteen discrete samples of the NUREG-1829 break-frequency un-certainty envelope.

Weighted mean= 1.93x 10-0 2 marked as bold dot.29 2 ENGINEERING ANALYSIS 2.4 Acceptance Guidelines Table 4: Sample attributes of break cases leading to failure for Case 43. In the table: Weld is a text string defined in the inservice inspection program; Break Size is the size of the break in inches; RCS Leg denotes break location (CLB or HLB);and Break Location denotes regions in the containment transport fractions.

building related to debris Weld 31-RC-1302-NSS-1.1 31-RC-1402-NSS-9 31-RC-1302-NSS-1.1 3I-RC-1202-NSS-RSG-1B-ON-SE 31-RC-1202-NSS-1.1 31-RC-1102-NSS-2 31-RC-1302-NSS-RSG-1C-ON-SE 31-RC- 1302-NSS-8 31-RC-1202-NSS-4 29-RC- 1401-NSS-RPVI-N1DSE 29-RC-1301-NSS-4 31-RC-1402-NSS-1.1 29-RC-1401-NSS-3 29-RC-1401-NSS-3 31-RC-1102-NSS-1.1 3 1-RC- 1402-NSS-RSG-1D-ON-SE 29-RC-1301-NSS-5.1 29-RC- 1201-RSG-lB-IN-SE 31-RC-1102-NSS-8 31-RC-1302-NSS-3 29-R.C-1201-NSS-5.1 29-RC- 1201-RPV1-NIBSE 31-RC-1402-NSS-3 29-R.C-1201-NSS-5.1 29-RC-1401-NSS-4.1 29-RC- 1201-RSG-lB-IN-SE 31-RC- 1202-NSS-RSG-lB-ON-SE 31-RC-1102-NSS-3 31-RC-1402-NSS-2 31-RC-1302-NSS-3 31-RC-1302-NSS-9 29-RC-1401-NSS-4.1 31-RC-1402-NSS-RSG-1D-ON-SE 29-RC-1101-NSS-4 27.5-RC-1303-NSS-1 31-RC-1102-NSS-1.1 31-RC-1102-NSS-RSG-1A-ON-SE 31-RC-1402-NSS-1.1 Break Size 20.9 29.5 28.9 12.0 28.5 13.3 13.0 30.9 11.8 22.7 22.0 14.0 24.7 25.5 13.6 30.1 11.1 24.6 21.5 12.1 22.7 23.8 13.8 14.0 24.6 11.4 28.7 30.9 22.8 28.1 29.4 13.9 30.3 28.8 23.1 28.7 29.6 30.2 RCS Leg Cold Cold Cold Cold Cold Cold Cold Cold Cold Hot Hot Cold Hot Hot Cold Cold Hot Hot Cold Cold Hot Hot Cold Hot Hot Hot Cold Cold Cold Cold Cold Hot Cold Hot Cold Cold Cold Cold Break Location SG Cmpmnt SG Cmpmnt SG Cmnpmnt SG Cmrpmnt SG Cinpmnt SG Cmpnut SG Cmpmnt SG Cmpmnt SG Cmpmnt RX Cavity SG Cmpnmnt SG Cmpmnt SG Cmpmnt SC Cmpamnt SG Cmpmrnt SG Cmpmnt SG Cmpnnt SG Cmpmnt SG Cmpmnt SG Cmpnmnt SG Cmpnmt RX Cavity SG Cnipnmnt SG Cmpmnt SG Cmpmnt SG Cmpmnt SG Cmpmnt SG Cmpmnt SG Cmpmnt SG Cmpnnt SG Cmpmnt SG Cmpmnt SG Cmpmnnt SG Cmpmnt SG Cmpmnt SG Cmpmnt SG Cmpmnt SG Cmpmnnt 30 2 ENGINEERING ANALYSIS 2.5 Comparison with Guidelines The comparison in the STPNOC GSI-191 analysis uses the full-scope (including in-ternal and external hazards, at-power, low power, and shutdown) assessment of the change in risk metric and the baseline value of the risk metric (CDF and LERF). As noted above, the shutdown PRA analysis is bounded by the at-power model. In the STPNOC GSI-191 analysis, the maximum ac-ceptable increase in CDF is 10-06 and the maximum acceptable increase in LERF is 10-07.it 10'10**10I'10' 10' 1o CM Figure 12: Reproduction of Figure 4 from Regulatory Guide 1.174, "Ac-ceptance guidelines for core damage frequency", the ACDF, CDF phase plane.2.5 Comparison of PRA Re-sults with Acceptance Guidelines The STPNOC Pilot Project PRA quantifica-tion is detailed in Volume 2. As mentioned previously, the quantification shows that the risk associated with the concerns raised in GSI-191 are very small when compared to the acceptance criteria of RG1.174.The PRA used in the GSI-191 licensing basis change does not rely solely on nu-10,7 o0' 1o" LERF Figure 13: Reproduction of Figure 5 from Regulatory Guide 1.174, "Ac-ceptance guidelines for large-early-release frequency", the ALERF, LERF phase plane.merical results for change in risk. Instead, the choice of models, solution methodology and incorporation of uncertainties provides a high level of confidence that the uncertainties in models' parameters has been properly ac-counted for in the results. The safety margin described in Section 2.1.2 associated with use of the methodology reflected in the license basis change analysis provides assurance that safe operation can be expected without re-liance on numerical results alone.As mentioned in Section 2.3.3, the STPNOC PRA is an integrated Level 1 model that includes all internal and external events, Level 1 and Level 2 analysis, the focus of the GSI-191 concerns are related to LOCA.The analysis of LOCA initiating event fre-quencies and local pipe failure probabili-ties included in development of the basic events for the scenarios that address the con-cerns raised in GSI-191 include the full range of the epistemic uncertainty at each break size. Qualitative conservatisms that increase safety margin (as previously mentioned in Section 2.1.2) are included along with the quantifiable uncertainties to increase confi-31 2 ENGINEERING ANALYSIS 2.5 Comparison with Guidelines dence in the adequacy of the results.The STPNOC PRA analysis includes un-certainties that have been postulated in de-terministic analyses for the concerns related to GSI-191:* ZOI;" Chemical effects: " Debris transport;

• Head loss;" Boric acid precipitation; and" Air ingestion to ECCS pumps.In some cases, the uncertainties have been addressed through well-known conservative approximations.

In other cases, specific ex-perimentation has been performed to analyze the impact of the phenomena on plant per-formance in response to LOCA.2.5.1 Types of Uncertainties and Methods of Analysis Both aleatory and epistemic uncertainties have been included in the STPNOC PRA.As mentioned in the previous section (Sec-tion 2.5), uncertainties have also been addressed using conservative assumptions where appropriate or where large uncertain-ties are seen. For example, assuming a larger ZOI will result in scenarios that are conser-vative.2.5.1.1 Comments on Uncertainty Types In the PRA community, the con-cept of "separate" types of probabilities or uncertainties is discussed frequently.

In other communities, probability is simply probabil-ity and following quantification there is no distinction as to the source. (See Chapter 3 of [73] on PHSA 4 9 for a discussion including, 4 9 Probabilistic Seismic Hazard Analysis"The panel concludes that, unless one ac-cepts that all uncertainty is fundamentally epistemic, the classification of PHSA uncer-tainty as aleatory or epistemic is ambigu-ous.") So in an uncertainty quantification framework in which the goal is to obtain as output a point estimate or a probability dis-tribution on a key performance measure by propagating the probability distributions as-sociated with multiple sources of input un-certainty, there is typically no attempt to sort out the contribution due to each source of input uncertainty.

That said, it is com-mon practice to carry out a parametric anal-ysis in which we effectively remove the prob-ability distribution associated with an input parameter and simply vary the input param-eter over a range of plausible values in or-der to assess the effect on the output for the key performance measure. Applying this idea amounts to analyzing the output in a conditional manner, conditioned on the value of the corresponding input parameter.

Such parametric analyses are usually done for one source of uncertainty at a time, as opposed to trying to simultaneously vary multiple input parameters.

Now, reconsider the probability distribu-tion on the input parameter of focus. Output results for the key performance measure can be reported conditioned on the value of the input parameter, in turn, set to be specific quantiles from the input parameter's proba-bility distribution.

In this sense we can pre-serve the quantiles associated with a key in-put parameter when analyzing distributional output. The engineering analysis used to de-velop the basic event failure probabilities for the PRA uses an approach, likely new to PRA practitioners, that optionally inte-grates all uncertainty or preserves the quan-tiles of selected input distributions (which some may wish to label as being epistemic uncertainty).

The LOCA frequency, for ex-ample, has a large uncertainty envelope that has been preserved in this manner. Another 32 2 ENGINEERING ANALYSIS S2.5 Comparison with Guidelines large uncertainty envelope that could be pre-served in this way is the ECCS strainer dif-ferential pressure.

By preserving the uncer-tainty quantiles for selected sources, their ef-fect can be explicitly observed in the resul-tant basic event distributions.

In the STPNOC Pilot Project quantifica-tion, the LOCA epistemic uncertainty on fail-ure probability is quantified separately for each of the five ECCS pump combinations considered in the STPNOC Pilot Project anal-ysis. As a result, the failure probabilities re-sulting from GSI-191 phenomena for the five pump combination cases are correlated with the correct initiating event frequency associ-ated with the combination.

The RISKMAN software used for the STPNOC Pilot Project quantification is specifically designed to appropriately corre-late elements from a group to which the same parameter value applies. This is accom-plished using the "Big Loop Monte Carlo" option selected for the STPNOC Pilot Project quantification.

Each trial of the "Big Loop Monte Carlo" option, a random set of val-ues is selected from all input variables in the PRA model. These sample values are then used to reevaluate all PRA model elements;that is, basic event probabilities, split frac-tion failure probabilities, initiator frequen-cies, and sequence frequencies that are then summed to give the CDF and LERF. Impor-tantly, the option is also selected for the un-certainty quantification of the difference in the PRA metrics of ACDF and ALERF so that the uncertainty in the difference is cal-culated correctly.

The one exception to this correlation of input parameters among PRA model ele-ments are those considered in CASA Grande.By necessity, the PRA is quantified using failure probability distributions developed in the CASA Grande analysis which are them-selves functions of many data variables.

In the STPNOC Pilot Project quantification, the GSI-191 failure probabilities are quan-tified separately for each of the five ECCS pump state combinations considered in the STPNOC Pilot Project analysis.

In this way, the key parameter of the PRA sequence models (that is sump flow rates) is effec-tively correlated in RISKMANT M with the CASA Grande analysis.In the CASA Grande analysis, failure prob-abilities associated with engineering models of LOCA phenomena are also evaluated sep-arately for fifteen percentiles of the LOCA frequency uncertainty analysis.

These fifteen sets of results are the basis for the fifteen-bin uncertainty distributions on each of the GSI-191 phenomena failure probabilities.

The sparse sample of fifteen bins on the distribution of failure probability is not an inherent limitation of the CASA Grande methodology, but was chosen only for the sake of current practicality.

A more com-plete interrogation of the break-frequency uncertainty distribution can be made de-pending on the needs of the PRA. The ini-tial presumption was that higher percentiles of the break-frequency distribution would lead to more conservative estimates of CDF and LERF, so more sampling resolution was placed in the upper tails of the envelope (Fig-ure 10). The shape of each break-frequency profile defines the relative LOCA frequencies as a function of break size, as reflected in the variation between the fifteen point estimates of failure probability.

RISKMANT M samples from the full uncertainty distribution, us-ing 100 percentiles, for the absolute LOCA frequency and correlates each sample when evaluating the MBLOCA and LBLOCA initi-ating event frequencies.

The correlation be-tween the uncertainties in the relative break sizes used in the CASA Grande analysis and the absolute LOCA frequencies used in the PRA sequences models is not believed to be significant and therefore not modeled.33 2 ENGINEERING ANALYSIS 2.5 Comparison with Guidelines

2.5.2 Parameter

Uncertainty Parameter uncertainties are addressed per-vasively in the STPNOC PRA analysis.

For the physical models addressing the concerns of GSI-191, input parameters were derived from both historical data and physical lim-its (for example, total contained volume in a tank). The uncertainty associated with all important parameters has been included and sampling of the parameter distributions was done in LHS 5 0 schemes to accurately preserve the distribution.

Human error probabilities are included in the STPNOC PRA however, for the most severe accident scenarios (that is LBLOCA), there is very little opportunity for human actions to cause increases in the failure likelihood.

In these cases, automatic actuation of the ECCS will occur prior to op-erator intervention.

2.5.3 Model

Uncertainty As described on Page xv, the STPNOC PRA is supplied with failure probabilities result-ing from GSI-191 phenomena developed from engineering models of the phenomena asso-ciated with the concerns raised in GSI-191.That is, in the PRA, the models are devel-oped to be accurate representations of the plant including parameter uncertainties.

Over many years of study, the phenom-ena associated with the concerns raised in GSI-191 have been well characterized.

How-ever, the approach taken by most investiga-tors in GSI-191 studies has been to demon-strate margin to performance limits by bi-asing inputs, not by studying uncertainty or actual performance in the as-built, as-operated plant. In the STPNOC PRA, inves-tigators matched the phenomena to the per-formance of the as-built, as-operated plant.In all cases, the difference between re-sults of previous studies and results of the STPNOC GSI-191 studies can be explained 5°Latin Hypercube Sampling by well-established analytical methods. The extensive body of work related to the is-sues raised in GSI-191 helps provide assur-ance that adequate models and methods are available to exploit.Based on the STPNOC Pilot Project anal-ysis performed, the most important con-tribution to CDF is the model of chem-ical effects, both on the strainer and in the core. Although (as mentioned previously in Section 2.1.2) chemical effects in STP post-LOCA fluid conditions are benign com-pared to the conditions assumed for the experiments performed in WCAP 16793-NP, the STPNOC Pilot Project assumes that adverse chemical effects can occur, both at the strainer and in the core. The STPNOC Pilot Project also uses bounding val-ues for strainer differential pressure, that is, higher differential pressures than observed in experiments representative of STP condi-tions. The model is less sensitive to strainer differential pressure than core failure load-ing which is chosen at one half the 15gm/FA limit found in WCAP 16793-NP as a thresh-old for the potential of boron precipitation.

In a classical interpretation, "model un-certainty" often refers to the degree of credi-bility held by one prediction of physical phe-nomena compared to that held by alterna-tive predictions of the same phenomena.

For-mal methods have been developed to com-pare competing models that have been ini-tialized with as near identical input as possi-ble. Discrepancies between numerical predic-tions can then be used to quantify residual uncertainty in the prediction.

These meth-ods can even accommodate subjective mea-sures of confidence that particular models (or none of the models) are more accurate than the others. Often, the primary difference be-tween models lies in the degree of spatial res-olution or physical fidelity, but sometimes, fully mature alternative methods are com-pared.In the STPNOC Pilot Project, several new 34 2 ENGINEERING ANALYSIS 2.5 Conipai-ison with Guidelines predictive models are being applied for the first time. These include the debris penetra-tion/filtration model that was benchmarked to test data, and the time-dependent debris circulation model that addresses coolant by-pass around the reactor core. Relatively sim-ple, first-order models are extremely useful for identifying trends, describing trade-offs between competing mechanisms, and priori-tizing risk contributors; however, additional conservatism is warranted to explicitly ac-knowledge the uncertainty associated with the predictions of first-order models. For this reason, additional conservatism was incorpo-rated in the treatment of both conventional and chemical-induced differential head-loss estimation.

The practice of applying an over-all inflation factor that is distributed in mag-nitude according to the best interpretation of available data represents the extent of model uncertainty that has been addressed in the STPNOC Pilot Project.2.5.4 Completeness Uncertainty Although prior investigations in GSI-191 have focused primarily on "test for success", they have nevertheless resulted in greater understanding and characterization of the post-LOCA behavior related to the concerns raised in GSI-191. In some cases, greater un-derstanding has led to adoption of models that bound the experimental evidence sim-ply because the space adopted is too large to fully explore experimentally.

As a con-sequence, simplistic conservative approaches have been adopted where uncertainty is diffi-cult to quantify [see 53]. On the other hand, STPNOC GSI-191 analysis has helped to ex-tend the completeness of uncertainties asso-ciated with the concerns raised in GSI-191 by including phenomena expected to occur in the recirculation mode of ECCS operation where traditional analyses end. The STPNOC GSI-191 analysis uses realistic or prototypical conditions to model anticipated post-LOCA phenomena during all LOCA phases. Finally, where possible, uncertainties are quantified based on distributions that encompass plant conditions and equipment operating states that, although important to long-term cool-ing, are not considered in traditional (UF-SAR Chapter 15) analyses.The confidence in completeness of the modeling scope for the concerns raised in GSI-191 is increased due to the number of years of study and work of independent in-vestigators.

In the STPNOC Pilot Project, all known physical models have been adopted and evaluated in the engineering analysis supporting the PRA.As mentioned in Section 2.5.1, epistemic uncertainty has been considered in the STPNOC GSI-191 analysis.

Examples of com-pleteness uncertainties that have been con-sidered and excluded from the current anal-ysis are listed below: o Multiple simultaneous RCS pipe breaks would result in reduced damage due to the very rapid depressurizaton of the RCS. Although more damage zones would be involved, less damage would be possible at each location.o Physical security events that cause a LOCA. Such events would contribute equally to both the "ideal" plant and the as-built, as-operated plant. The STPNOC security force undergoes con-tinuous evaluation and improvements are made in processes and procedures that would help preclude such events.o Events occurring during shutdown modes of operation (includes lifting and transport of Heavy Loads). Heavy loads are not being moved during Mode 3.During the time heavy loads are be-ing moved, the plant is cooled down and depressurized.

The STPNOC pro-cess for control of heavy loads [74] com-plies with Generic Letter 81-07, "Con-trol of Heavy Loads," ANSI N14.6-1978 35 2 ENGINEERING ANALYSIS 2.5 Comparison witli Guidelines 2 ENGINEERING ANALYSIS 2.5 Comparison with Guidelines and NUREG 0612, and the TRM, Sec-tion 3/4.9.7.* Structural failures (containment build-ing, interior containment walls or parti-tions, that could be postulated to in-duce a LOCA). These beyond design basis events would contribute equally to both the "ideal plant" and the as-built, as-designed plant. In both cases, it would be assumed that core damage and large early release (in the case of containment failure leading to LOCA)would occur." Organizational decision making and safety culture, for example see Mo-haghegh [75]. STPNOC has a safety cul-ture evaluation program that undergoes continuous improvement and examina-tion.With regard to plant operating states, some can be eliminated from further evaluation.

These are under De-fueled conditions (No Mode), Refueling (Mode 6), and Cold Shut-down (Mode 5). The basis for this is that op-erating pressures and temperatures are suf-ficiently low so that piping failure mecha-nisms typically associated with LOCA events cannot reasonably be expected to occur.Modes 1, 2, 3 and 4 are bounded by the at-power model.The uncertainty quantification in the STPNOC GSI-191 PRA analysis is a sig-nificant improvement in the understanding of RCS -and containment building behav-ior under LOCA conditions.

Uncertainties, not explicitly quantified, are either bounded by other uncertainties associated with more dominant contributors or are sources of un-certainty outside the scope and boundary of GSI-191 safety issues.2.5.5 Comparisons with tance Guidelines Accep-As mentioned in Part II, the STPNOC GSI-191 analysis shows that the risk associ-ated with the concerns raised in GSI-191 is very small. Also, as defined byNuclear Regu-latory Commission

[10, Figures 4 and 5, Page 16] and previously mentioned in Part I, the STP average CDF and LERF are also very small. The estimates of ACDF and ALERF from the STPNOC GSI-191 analysis are far less than the Region III acceptance guide-lines.In the STPNOC GSI-191 PRA analysis, the mean values used to evaluate the accep-tance criteria are probability distributions that come from the propagation of the un-certainties of the input parameters and those model uncertainties explicitly represented in the model. The STPNOC GSI-191 PRA anal-ysis uses a formal propagation of the uncer-tainty to account for any state-of-knowledge uncertainties that arise from the use of the same parameter values for several basic event probability models.Where epistemic uncertainties have been identified in the STPNOC GSI-191 analysis, they have been either reduced through ex-perimental evidence or bounded through as-sumption as previously mentioned in Sec-tion 2.1.2. The STPNOC PRA margin to the acceptance criteria guidelines is significant, providing confidence that, any contributor to risk that may have been missed or other-wise not modeled would not make a signif-icant change to the risk determined in the STPNOC GSI-191 analysis.In the STPNOC Pilot Project analysis re-liance on importance measures is not neces-sary nor used. The focus of the analysis is to understand the risk associated with the con-cerns raised in GSI-191 and importance mea-sures, while useful in evaluations concerned with other applications, are not useful in the STPNOC Pilot Project.36 As discussed in Section 2.3, the STPNOC PRA is an integrated-level model that in-cludes all internal and external events (refer-ring to Level I and Level II analysis) related to the GSI-191 post-LOCA concerns.

Care has been taken in the STPNOC GSI-191 PRA to ensure that all concerns associated with GSI-191 have been addressed in the analysis.2.6 Integrated Making Decision As discussed extensively in Section 2.1, there are many qualitative insights that form the basis for the conclusion in the STPNOC GSI-191 PRA analysis that there is a very small risk for the concerns associated with GSI-191. A significant effort has been ex-pended to experimentally and analytically investigate the risk and uncertainties asso-ciated with the concerns raised in GSI-191.Traditional engineering analysis, which generally ignores uncertainty, has been en-hanced in the STPNOC GSI-191 PRA analysis by including parameter uncertainties.

In as much of the analysis as possible, uncertain-ties of input parameters in the traditional engineering models are propagated through the uncertainty quantification of basic events and aggregated (with uncertainty distribu-tions) for use in PRA basic events or top events. By integrating qualitative insights, bounding uncertainties, and quantifying the uncertainties inherent in engineering mod-els, the STPNOC GSI-191 PRA analysis is a robust, integrated analysis that can be re-lied on to accurately evaluate the risk asso-ciated with the concerns raised in GSI-191.Although the STPNOC GSI-191 PRA analy-sis relies on a full scope PRA, the analysis is specifically focused on the concerns raised in GSI-191. In particular, only the LOCA initi-ating events are of concern and the physical models are directed at long-term cooling.Part III Implementation and Monitoring As stated in Part V, no changes are proposed to any programs, processes, or design with regard to the current as-built, as-operated plant that would result in a significant reduc-tion to safety margin or DID. In particular, no changes are proposed to any ASME Sec-tion XI inspection programs [76, 77] or miti-gation strategies that have been shown effec-tive in early detection and mitigation of weld and material degradation in PWR Class I piping applications.

STPNOC has adopted other programs that help provide early de-tection and mitigation of leakage in other ap-plications

[78]. Additionally, no changes are proposed to design modifications, processes, or programs that have resulted from address-ing the concerns related to GSI-191 such as those mentioned in Section 2.1. In particular, design mnodifications that could affect any of these measures are specifically checked for in any design change [79, Checklist, Page 38].Part IV Submittal of Proposed Change Proposed changes to the STP UF-SAR, based on NRC approval of the STPNOC Pilot Project and LB change to resolve GSI-191, are submitted in the at-tachments to letter NOC-AE-13002954[80].

37 2 ARCHIVAL DOCUMENTATION Part V Quality Assurance No design, operational, or performance changes are proposed to existing safety re-lated systems, components, or structures in this analysis.

Existing procedures and pro-grams are unchanged by this license basis change. The STPNOC PRA analysis support-ing the licensing basis change is performed using STPNOC PRA procedure as required for PRA analyses and assessments

[31]. This is the STPNOC approved methodology for application evaluations using the PRA.The support provided for the STPNOC PRA is performed by personnel qualified in their fields of expertise.

All work performed in the licensing basis analysis is done follow-ing STPNOC procedures for contract person-nel. An oversight program, Part VIII, is in effect for the duration of the entire project.All records and documentation are controlled under the STPNOC Document Control and Records Management systems. A detailed description of the Quality Assurance pro-gram supporting the STPNOC Pilot Project is provided in Volume 4.Part VI Documentation 1 Introduction The total technical documentation consists of several volumes, Volume 1, Summary, Volume 2 PRA, Volume 3, the support-ing engineering analysis, CASA Grande, Vol-ume 4, Quality Assurance, and Volumes 5.1 through 5.4, Oversight.

Additional documen-tation such as the PRA Model Revision 7 and support calculations are also made available through reference.

In any case, all documen-tation is available in the STPNOC Records Management program.2 Archival Documenta-tion Volumes 2 and 3 of the STPNOC GSI-191 li-cense basis change submittal are detailed de-scriptions of the PRA and supporting engi-neering analyses conducted and results ob-tained. The analyses are primarily based on traditional engineering analyses that include experimental data obtained to specifically support the engineering models and analy-ses conducted as part of the licensing basis change. The full set of documentation cre-ated for this analysis are maintained as qual-ity documents for the life of plant in the RMS 5 1 and can be retrieved using the fol-lowing search fields and keywords:* FSUG: D07090703," TYPE: VENDREC, and" SUBTYPE: GSI191.The STPNOC PRA model of record is also maintained in the RMS according to the nor-mal PRA maintenance process and can be re-trieved using the following search fields and keywords: " FSUG: D6412," TYPE: DATA, and" DOCUMENT NUMBER: OPGPO1ZA0305.

STPNOC PRA analyses are maintained in the STPNOC RMS. The PRA analysis performed for this work can be retrieved using the fol-lowing search fields and keywords: 5 1 Records Management System 38

" FSUG: D64," TYPE: ANLYS, and" DOCUMENT NUMBER: PRA13001.Part VII Submittal Documentation The STPNOC proposed license basis change is consistent with the key principles of risk-informed regulation and NRC staff expecta-tions based on the following points: " The requirements for Long-Term Core Cooling summarized in 10 CFR§50.46 require the supporting systems to op-erate with a high level of probabil-ity including considerations of uncer-tainty. The licensing basis change re-quested quantifies the probability and uncertainty associated with long-term core cooling following the requirements as described in RG1.174. Based on the evaluation documented in the change request showing that the probability is very high that long-term core cooling will be satisfied, the impact to the li-censing basis is insignificant." The proposed change has no impact on existing equipment performance re-quirements or performance assessment (equipment surveillance) requirements.

For certain extremely low probability scenarios, when the extreme extent of the associated uncertainty is taken into account, the analysis shows that core damage could occur." No change to offsite dose or worker radi-ation dose is evaluated to occur. By im-plementing the proposed licensing basis change, a large worker radiation dose that would be incurred to mitigate a hypothesized event having insignificant likelihood is avoided.* No change to existing DID is proposed.All equipment, as designed, is expected to be available and to continue to func-tion with high probability." The proposed change is documented in the UFSAR, Chapter 6. No changes are proposed to any high-risk equipment.

In addition to the items listed above, the fol-lowing also support consistency with the key principles of risk-informed regulation and NRC staff expectations: " The integrity of the Class 1 welds, pip-ing, and components are maintained at a high level of reliability through the ASME Section XI inspection program;" The materials stored in Containment, especially any transient lead, should be stored as required by Wire [81]. In ad-dition, plant transients are monitored in the Transient Cycle Counting Limits Program [82];" The structural integrity and cleanli-ness of the Containment Sump Strain-ers is monitored prior to leaving the containment

[83, 84]. In particular, any condition noted that would result in direct passage of debris is evaluated through the Station Corrective Action Program [85] and repaired as neces-sary prior to Containment closeout.

The PRA is maintained to reflect the as-built, as-operated plant as described in the STPNOC UFSAR, Section 13.7.2.3 to reflect the current plant design not to exceed every 36 months and to re-flect the equipment performance (com-prehensive data update) not to exceed 60 months. Unless major modifications 39 are made to the containment design or insulation design, no changes should be required to the PRA analysis docu-mented in this licensing submittal;

• Information to be provided as part of the plant LB (e.g., FSAR, technical specifications licensing condition);" The GSI-191 PRA analysis is not used to enhance or modify safety-related functions of SSCs. The STPNOC GSI-191 PRA analysis is controlled un-der the existing STPNOC PRA appli-cation analysis and assessment pro-cess [31]; and* There are no other changes to the exist-ing requirements to any systems, struc-tures or components as a consequence of this licensing basis change.The program used to develop the results of the license basis change included an inde-pendent critical peer review oversight process requiring quarterly reporting and critical re-view question resolution.

A summary of In-dependent Oversight activities and observa-tions is addressed in Part VIII of this docu-ment. More details including Oversight com-ments and follow-up resolutions are available upon request (Independent Technical Over-sight, Quarterly Reports [86, 87, 88, 89]).As discussed on Page xv, minimal changes were made to the STPNOC PRA such that a new peer review would not be required.Although detailed models of post-LOCA be-havior are included in the risk analysis, the models are not embedded in the PRA. In-stead, detailed models of post-LOCA behav-ior are solved in an uncertainty quantifica-tion framework outside of the PRA and the results are supplied to the PRA as discrete probability distributions.

In this way, contri-butions of specific issues raised in GSI-191 are encapsulated in familiar models and are therefore more easily scrutinized and under-stood, especially by investigators more famil-iar with the engineering models of behavior.Since much of the previous investigation into the issues raised in GSI-191 was not based on risk methodologies, the STPNOC GSI-191 analysis method is expected to be familiar to the majority of previous GSI-191 investi-gators.STPNOC's PRA complies with Regulatory Guide 1.200, Revision 1, however; it does not comply with Regulatory Guide 1.200, Revi-sion 2 with respect to Fire PRA and Seismic PRA requirements.

Even though STPNOC's PRA contains both Fire and Seismic PRAs, they do not meet all the standards require-ments in the current ASME/ANS RA-S-2009 PRA Standard, as endorsed by RG 1.200, Rev. 2, at a Capability Category II level. PRA model changes since the peer re-view are detailed in Volume 4, but are min-imal. The Findings and Observations from the peer review are also reviewed in Vol-ume 4.STPNOC's PRA remains technically ade-quate to evaluate and quantify the risk asso-ciated with the concerns raised in GSI-191.GSI-191 is concerned with LOCA events and these events are explicitly modeled in the STPNOC PRA. STPNOC's PRA does meet Regulatory Guide 1.200, Revision 2 at Ca-pability Category II for LOCA events. For the risk-informed GSI-191 methodology de-scribed in this study, the technical rigor pro-vided to the PRA exceeds that performed in PRAs used today and is technically more than adequate to perform a risk-informed application meeting RG1.174 guidance.40 Part VIII Independent Technical Oversight A team from the University of Illinois at Urbana-Champaign (UIUC) has been pro-viding independent technical oversight for the STPNOC Pilot Project project. Two key members of this team were affiliated with Soteria Consultants, LLC (Soteria) in 2012;therefore, the oversight function was carried out under Soteria that year. In January 2013, the two key members joined the faculty of the Nuclear Engineering Department at UIUC and, from that time, the independent over-sight of the STPNOC Pilot Project was per-formed under a contract between STPNOC and UIUC.STPNOC commissioned the independent oversight team to help ensure the quality and validity of the research and development undertaken.

The main objective of indepen-dent technical oversight has been to perform an independent and in-depth scientific re-view of the phenomenological models and ex-periments developed and conducted for the Risk- Informed GSI-191 project. The over-sight teams scope of work covered critical review of all the documents related to the technical areas of the project such as Hybrid modeling for LOCA frequency, Jet formation physics, Debris generation, Debris transport, Strainer conventional head loss, Penetration, Reactor thermo-hydraulic, Boron precipita-tion, Chemical effects, Coating, Uncertainty propagation and sampling, and Probabilis-tic Risk Analysis.

In addition to reviewing the various working documents and analy-ses, the UIUC team reviewed Volumes 1, 2, 3, and 4 of the submittals and their support-ing documents.

Uncertainty propagation and sampling methodology were reviewed by the oversight team. However implementation in the engineering framework (Module 2 of Fig-ure 2) is a proprietary MATLAB application which was unavailable to the oversight team.The independent oversight team is specif-ically qualified to peer review the method-ologies, experiments, and calculations of the STPNOC Pilot Project. The oversight team members have academic and industry expe-rience in both probabilistic and determinis-tic domains, and are capable of (1) analyzing probabilistic methods (for example, PRA and uncertainty analysis), (2) analyzing physical and chemical phenomena (e.g., containment corrosion tests, strainer performance tests, and chemical effects tests, thermo-hydraulic modeling)

(3) providing scientific and practi-cal feedback, and (4) producing technically-sound and clear peer review documentation.

UIUCs approach included both active and passive oversight.

Two members of UIUC interacted and collaborated with the anal-ysis teams to provide feedback and to of-fer active oversight services.

Because of the multidisciplinary and integrative nature of the project, members of the oversight group were required to participate in meetings and then follow up on the discussions and issues with the other group members involved in the STPNOC Pilot Project. Specific areas of concern and review were also discussed with UIUCs passive oversight members (both se-nior and junior experts in the related fields).The UJUC team was involved in both "infor-mal" and "formal" oversight activities for the STPNOC Pilot Project. Examples of informal activities were: " Reviewing pre-meeting technical re-ports and documents related to NRC public meetings and providing com-ments," Providing technical support in develop-ing ACRS presentations.

41

• Participating in brainstorming sessions on diverse technical topical areas with the required follow-up on the proposed ideas.Some of the formal oversight activities in-cluded:* Participating in weekly technical team teleconferences and providing feedback.* Participating in monthly technical meetings and providing comments.* Critical review of the technical reports and documents and developing written comments and resolutions.

The UIUC independent oversight team provided the analysis team (that is, PRA GSI191 Analysis & Methodology Implemen-tation; GAMI, Corrosion/Head Loss Ex-periments; CHLE, CASA Grande, Thermal Hydraulics; TH, Uncertainty Quantification; UQ, and Jet Formation; JF) with written comments and, all of the comments and follow-up resolutions are documented and available in the oversight reports [86, 87, 88, 89, 90]. In order to make the review process more thorough and to enhance the effects and efficiency of having an oversight func-tion for the STPNOC project, UIUC team asked the other technical team members to provide responses regarding each of UIUC's specific comments.

The main objectives of[86, 87, 88, 89, 90] were to: Analyze the responses that UJUC had received from other technical teams re-garding oversight comments.

The tech-nical teams responses were documented along with UIUCs responses, resolu-tions, and feedback on the unresolved issues." Provide an up-to-date report of UIUC's activities during the quarter.* Communicate additional comments based on the review of recent reports and participation in the technical meetings and teleconferences." Facilitate the interaction and collabora-tion of the oversight team with members of the other technical teams.The oversight reports contributed to the progress of the project by addressing critical peer review of the documents and by high-lighting an up-to-date elaboration of areas of concern that required further investigation from the technical teams.In conclusion, the independent over-sight has performed concurrent peer reviews of documents, communicated review com-ments, has followed up with review comment resolutions, and has analyzed industry lim-itations and regulatory concerns to temper comments.

That is, the oversight team has provided reasonable comments directed to-ward ensuring academically defensible work results. Based on the UIUC teams review, the STPNOC Pilot Project is an outstanding blend of advanced and conventional methods that not only contributes towards the closure of the GSI-191 issues, but also makes a sig-nificant contribution to the formal incorpo-ration of underlying physical failure mecha-nisms of certain post-LOCA events into PRA.UIUC oversight activities confidently con-cluded that the STPNOC Pilot Project, hav-ing a well-designed combination of proba-bilistic and deterministic methodologies, has made important contributions to the closure of GSI-191 issues. Some of the UIUC com-ments (for example, related to vertical head-loss tests) have been considered but not im-plemented.

The detailed technical results of UIUCs critical reviews are available in the oversight reports [86, 87, 88, 89, 90].42 Part IX Acronyms & Notations BAT Boric Acid Tank either one of two highly concentrated boric acid supply tanks that provide the ability to increase boron concentration in the RCS and connected systems.CAD Computer Aided Design a computer aided design model STPNOC is using to rep-resent the containment buildings that includes piping welds and insulation details in order to help accurately assess ablated materials following an hypothesized LOCA.CASA Grande Containment Accident Stochastic Analysis (CASA) and Grande refers to the STPNOC large, dry containment is the framework used to perform the computer-ized uncertainty quantification (sampling of distributions, propagating uncertainties) to develop basic events that address the issues raised in GSI-191.ccdf Complementary Cumulative Distribution Function:

P(x) = 1- J.I'x f(t)dt, where f(-)is the pdf.CCW Component Cooling Water System is a part of the STP Engineered Safety Systems and consists of three trains (Trains A, B, and C). CCW is cooled by the ECW.CDF Core Damage Frequency is calculated at STPNOC using the STPNOC PRA.cdf Cumulative Distribution Function:

F(x) = f. f(t)dt, where f(.) is the pdf.CET Core Exit Thermocouple refers to one of the array of thermocouples arranged at the exit of the fuel assemblies in the STP core. The thermocouple data, is used to help identify adverse trends in functions (for example, core cooling) and decision points in the CSFSTs to direct response actions.CHRS Containment Heat Removal System is comprised includes the CSS and RCFCs.These systems mitigate the potential consequences of a LOCA or main steam line break.CLB Cold Leg Break is a failure in the RCS piping between the steam generator cold leg nozzle and the reactor vessel cold leg nozzle.CSFST Critical Safety Function Status Tree is one of several decision trees linked specific critical measurements used in the EOPs as necessary to direct decisions to restore required functions (for example, core cooling) in an event.CSS Containment Spray System is a part of the STP Engineered Safety Systems and consists of three trains (Trains A, B, and C). Only two Containment Spray trains are required to meet the system's spray flow requirements.

The STPNOC containment spray flow does not pass through the RHR heat exchanger.

CVCS Chemical Volume and Control System is the system that maintains the pressurizer level, RCS chemistry (chemical addition, ion control, filtering), and seal water flow during normal operation.

43 Dbr7eak the scenario-dependent break diameter.

The break diameter is limited to the pipe diameter at the scenario-dependent break location.

Any break diameter larger than the pipe diameter is assumed to be a double-ended guillotine break.Dpipe the diameter of the pipe where a scenario-dependent break occurs.DDTS Drywell Debris Transport Study is the NRC-sponsored Boiling Water Reactor study of the blowdown and washdown of debris to the suppression pool during LOCA.DEGB Double-Ended Guillotine Break is a hypothetical condition that can be realized mathematically whereby a pipe instantaneously shears around its circumference and in the same instantaneous time, completely offsets such that the jets from each end of the shear plane can't interfere with each other.DID Defense-in-Depth is the design concept that includes redundant and/or multiple bar-riers to a particular consequence.

ECCS Emergency Core Cooling System part of the STPNOC engineered safety features.ECW Essential Cooling Water System a part of the STP Engineered Safety Systems and consists of three trains (Trains A, B, and C). The ECW takes and returns water through the Ultimate Heat Sink, a hardened cooling pond.EOF Emergency Operations Facility is the support facility for the management of overall licensee emergency response (including coordination with Federal, State, and local offi-cials), coordination of radiological and environmental assessments,.and determination of recommended public protective actions. The EOF also has technical data, displays and plant records to assist in the diagnosis of plant conditions.

EOP Emergency Operating Procedure one of several plant procedures entered following reactor trip or SI that, in conjunction with other plant operating procedures, direct actions to avoid or mitigate any degraded plant state and help ensure the plant will arrive in a safe shut down condition following the trip or SI.77 is an empirically-derived constant related to the rate of fiber release through the strainer based on flow rate through the strainer.£ is a shifted exponential random variable used in computing the chemical bump-up factor, 4),h .f(.) is the empirically-derived ECCS strainer filter efficiency as a function of the mass on the strainer.Ft.ra.nsport is an operator that applies transport logic to obtain the mass of all ZOI-generated debris arriving at the pool.F' is the fill up transport fraction to train e's strainer sump cavity.FHB is the fuel handling building, containing the high head safety injection system, low head safety injection system, and containment spray pumps.T is an index set for all types of fiber-based insulation products in containment.

44 F,,.d Void Fraction is a function that computes the liquid vapor fraction just downstream of the ECCS strainer.FDbre oI weld case is the conditional distribution governing the random break diameter, Dbreak, given that a break occurs at a specified weld type/case.

0 is the scenario-dependent azimuthal angle of the break around the pipe.(tnh(') is the time- and scenario-dependent chemical bump-up factor used in computing head loss across ECCS sump strainer.ye Fraction of total time-dependent ECCS flow (QC(t)) that passes through train f's ECCS strainer and arrives in the RCS. The index f = A, B, C refers to the associated train.GL 2004-02 NRC Generic Letter 2004-02 was issued in response to the concerns raised in GSI-191 for PWRs.GSI-191 Generic Safety Issue 191 the NRC Generic Safety Issue number 191.H(.) Function based on NUREG-6224 used in computing head loss across ECCS sump strainer.HHSI High Head Safety Injection a part of the ECCS. The STPNOC plants have three HHSI trains (Trains A, B, and C) that can provide ECCS flow at pressures up to around 1600 psi. The STPNOC HHSI flow does not pass through the BRR heat exchanger.

HLB Hot Leg Break is a failure in the RCS piping between the steam generator hot leg nozzle and the reactor vessel hot leg nozzle including the Pressurizer (D Loop).ISI ASME Section XI Inservice Inspection is an ASME Section XI program that, among other things, verifies the weld integrity in critical piping.i when used as a subscript refers to one of three damage zones in the ZOI i = 1, 2, 3.j when used as a subscript refers to the size of debris generated within a damage zone (fines, small pieces, large pieces, and intact blankets) associated with the three assumed damaged radii for a scenario-dependent break.k when used as a subscript refers to debris type which can come from k. (all types of insulation products in containment), F (fiber-based insulation products), or £ (all types of debris), where F- CK C CL.KC is an index set for all types of insulation products in containment.

£ is an index set for all types of debris in containment including insulation, crude particu-late, unqualified coatings, and latent debris.f when used as a super- or subscript refers to ECCS sump strainers for train C for f =A,B,C.A the fraction of the total ECCS flow arriving in the vessel.45 LB Licensing Basis is the collection of commitments and requirements that licensee makes to the regulatory authority (in this case, the NRC) over the course of time.LBB Leak before break is a proposed licensing approach that relies on the observation that prior to a, catastrophic failure in large bore piping, a small, detectable flow initiates.

LERF Large Early Release Frequency STPNOC calculates large early release frequency using the STPNOC PRA.LHS Latin Hypercube Sampling is a simulation-based procedure that generalizes the notion of stratified sampling to multiple dimensions and yields an unbiased point estimate, while attempting to reduce variance of the estimator over naive Monte Carlo sampling.LHSI Low Head Safety Injection part of the ECCS. The STPNOC plants have three LHSI trains (Trains A, B, and C) that can provide ECCS flow at pressures up to around 400 psi. The LHSI train is the only ECCS train that uses the RHR heat exchangers for decay heat removal.LBLOCA Large Break Loss of Coolant Accident a hypothetical instantaneous pressure boundary failure that is defined for STPNOC as greater than 6 inch equivalent diam-eter.LOCA Loss of Coolant Accident a hypothetical instantaneous pressure boundary failure.Mij,k is the scenario-dependent mass of debris type k of size j originating from damage zone i.mJk(.) is the scenario-and time-dependent mass of debris type k of size j originating from damage zone i at train e's ECCS sump strainer.'1it,k() is the scenario-and time-dependent mass of debris of type k of size j originating from damage zone i, in the containment sump pool.is the scenario-and time-dependent mass accumulation of debris on the core (fuel assemblies).

All debris that arrives at the core is assumed to deposit on the core. The subscript k is restricted to k c F7, indicating that only fiber is transported to the vessel.MBLOCA Medium Break Loss of Coolant Accident a hypothetical instantaneous pressure boundary failure that is defined for STPNOC as greater than 2 inch equivalent diameter but less than 6 inch equivalent diameter.v is an empirically-fit parameter that expresses the fraction of all transportable debris that is mobile enough to be released via shedding from a strainer's accumulated bed of debris.NLHS Nonuniform Latin Hypercube Sampling is a variant of the LHS scheme that allows the support of each marginal distribution to be partitioned into cells with non-equal probabilities.

46 NPSHA Net Positive Suction Head Available is the total pressure at the eye of the pump impeller.

As long as the net positive suction head available is higher then the net positive suction required, the pump will have sufficient pressure at the impeller inlet to operate without cavitation.

NPSHR Net Positive Suction Head Required is the total pressure at the eye of the pump impeller required for the pump to operate properly, without excessive cavitation.

NPSHn....gi,,()

is the time-dependent NPSH margin; i.e., the difference between the NPSH available and the NPSH required.NSSS Nuclear Steam Supply System the nuclear reactor, piping, pumps, steam genera-tors, pressurizer, and auxiliary equipment associated with operation and control of the reactor system.STPNOC Pilot Project STPNOC Risk-Informed GSI-191 Closure Pilot Project. The NRC works with licensees as they develop methods to address new regulatory ap-proaches.

STPNOC requested and was granted Pilot Project status for the methodol-ogy for closing GSI-191 using Option 2b Pbuckle Strainer structural design limit is the differential pressure across the ECCS strainers at which they are analyzed to be within code design allowable stresses.

The limit is approximately 9.35 ftWC.pdf A probability density function specifies the relative likelihood that a continuous random variable takes on a specific value. When integrated over a region, representing an event, the pdf yields the probability mass associated with the event, as in the probability of observing a break diameter between 2-inches and 5-inches.PHSA Probabilistic Seismic Hazard Analysis is the probabilistic study of seismic events on systems, structures, and components to obtain failure likelihoods.

PRA Probabilistic Risk Assessment the STPNOC PRA is the platform for all quantitative risk assessment licensing activities at STPNOC. The current model (Model of Record)is Revision 7.PWR Pressurized Water Reactor uses steam generators to isolate the Rankine steam cy-cle from the reactor coolant system. The STPNOC site consists of two, four loop, approximately 3850 MWth, Westinghouse Nuclear Steam Supply System reactors.PWSCC Primary Water Stress Corrosion Cracking is a degradation mechanism for certain types of weld materials, especially Alloy 600.APe(.) time- and scenario-dependent head loss across train e's strainer.AP mech fixed mechanical collapse criterion.

Qe(.) time-dependent ECCS flow through strainer, where e = A, B, C refers to the train.QDPS Qualified Display Processing System is the STP computer system that displays criti-cal information and controls certain critical functions in an event including information needed for CSFST monitoring.

47 Pk is the density of the kth insulation material.Ri.j,k the scenario-dependent radius for the damage zone at the break location.

The sub-scripts i, j, k refer to the damage zone, debris size, and insulation type.RCB Reactor Containment Building is an additional barrier to release to the environment should both the fuel clad and RCS fail to contain radioactive fission products.RCFC The Reactor Containment Fan Coolers a part of the STP Engineered Safety Systems and consist of three trains (Trains A, B, and C).RCS Reactor Coolant System. The STPNOC reactor coolant system is a four loop West-inghouse design.RG1.174 Regulatory Guide 1.174 is a regulatory guidance document that describes the overall methodology to quantify risk using the PRA together with deterministically-based criteria to evaluate the acceptability of a particular change. The quantitative risk measures are CDF and LERF. The risk is deemed to be "very small" when the change increases CDF less than 10-6 and the LERF less than 10-7.RHR Residual Heat Removal System a shutdown cooling system consisting of three inde-pendent trains. The RHR heat exchangers are shared with the LHSI train. If the LHSI train is using the heat exchanger for that train, the R.HR train must be secured and vice versa.RMI Reflective Metal Insulation is a fitted, rigid insulation that uses metal radiation heat shields and dead air space to reduce heat loss.RMS Records Management System is the STPNOC document storage and retrieval system meeting the requirements of Regulatory Guide 1.33, Revision 2, Quality Assurance Program Requirements (Operation).

RMTS Risk Managed Technical Specifications changes the allowed outage time for risk significant equipment as derived from the configuration risk during the outage time.RVWL Reactor Vessel Water Level is the STP (two trains) level measuring instruments in the reactor vessel that use heated junction thermocouples to detect the presence of liquid.RWST Refueling Water Storage Tank the STPNOC reactor water storage tank holds ap-proximately 500,000 gallons of water borated to the all rods out, xenon free boron concentration, approximately 2800 ppm.Sk(.) time-dependent rate at which debris mass is added from each source, k, to the con-tainment pool.SI Safety Injection System is comprised of the valves, piping, pumps, and accumulators designed to deliver water the RCS following an actuation signal. The actuation signal for LOCA would be 2 out of 4 Pressurizer pressure signal (at the SI actuation set point).48 SBLOCA Small Break Loss of Coolant Accident is a hypothetical instantaneous pressure boundary failure that is defined for STPNOC as less than 2 inch equivalent diameter and greater than 1/2 inch equivalent diameter.STP South Texas Project Electric Generating Station is the two commercial nuclear electric generating units located near Wadsworth, TX.STPNOC The STP Nuclear Operating Company is the organization responsible for the safe and efficient operation of the South Texas Project electric generating station.T(t) is the scenario-and time-dependent temperature history correlated to thermal-hydraulic trends for SBLOCA, MBLOCA, or LBLOCA events.TSC Technical Support Center is the onsite facility located in the STP power block (two identical facilities provided for each STP Unit) control room that provide plant man-agement and technical support to the control room personnel located during emergency conditions.

VCT Volume Control Tank is a large surge volume provided in the CVCS to accommo-date changes in water volume requirements in the RCS and connected systems while maintaining constant pressurizer level (for example).VP(.) is the scenario-and time-dependent volume of water in the containment pool.V ...9e() is the scenario-dependent enclosed space of the damage zone indexed by i gen-erating insulation debris size j. The argument 0 refers to the angle associated with the hemispherical ZOI for non-guillotine breaks.insulation is the space of insulation of type k E K within containment.

,1'co,.rete is the space that the concrete walls clip at the scenario-dependent break location.ZOI Zone of Influence refers to the enclosed volume where damage to materials is hypoth-esized or assumed to occur. The damage assumed is from the energetic jet associated with the hypothesized instantaneous failure of Class 1 piping in the containment build-ing.49 REFERENCES References

[1] J. E. Dyer. Pilot Project Request, ST-AE-11002079, STI 32860124.

Letter from J. E.Dyer to A. W. Harrison, April 2011.[2] Nuclear Regulatory Commission.

CLOSURE OPTIONS FOR, GENERIC SAFETY ISSUE -191, ASSESSMENT OF DEBRIS ACCUMULATION ON PRESSURIZED-WATER REACTOR SUMP PERFORMANCE.

Letter (SECY) 12-0093, Nuclear Reg-ulatory Commission, Washington, DC, July 2012.[3] John W. Crenshaw.

Summary of GSI-191 Risk-Informed Closure Pilot Project 2011: Initial Quantification.

Letter from J.W. Crenshaw, Vice President Special Projects to USNRC Document Control Desk, January 2012.[4] J. Dallnan, B. Letellier, J. Garcia, J. Madrid, W. Roeschy, D. Chen, K. Howe, L. Archuleta, F. Sciacca, and B. P. Jain. Integrated Chemical Effects Test Project: Consolidated Data Report. NUREG/CR 6914, Los Alamos National Laboratory, Los Alamos, NM, December 2006.[5] Bruce Letellier.

Risk-Informed Resolution of GSI-191 at South Texas Project. Technical Report Revision 0, South Texas Project, Wadsworth, TX, 2011.[6] Karl N. Fleming, Bengt O.Y. Lydell, and Danielle Chrun. Development of LOCA Initiating Event Frequencies for South Texas Project GSI-191. Technical report, KnF Consulting Services, LLC, Spokane, WA, October 2011.[7] Elmira Popova and Alexander Galenko. Uncertainty Quantification (UQ) Methods, Strategies, and Illustrative Examples Used for Resolving the GSI-191 Problem at South Texas Project. Technical Report Revision 0, The University of Texas at Austin, Austin, TX, December 2011.[8] Erich Schneider, Julia Day, and William Gurecky. Simulation Modeling of Jet Forma-tion Progress Report, August -December 2011. Internal Report Revision 0, University of Texas at Austin, Austin, TX, December 2011.[9] Tim Sande, Keryy Howe, and Janet Leavitt. Expected Impact of Chemical Effects on GSI-191 Risk-Informed Evaluation for South Texas Project. White Paper ALION-REP-STPEGS-8221-02, Revision 0, Jointly, Alion Science and Technology and Uni-viersity of New Mexico, Albuquerque, NM, October 2011.[10] Nuclear Regulatory Commission.

REGULATORY GUIDE 1.174 An Approach for Using Probabilistic Risk Assessment In Risk-Informed Decisions On Plant-Specific Changes to the Licensing Basis, Revision 2. Regulatory Guide 1.174, Nuclear Reg-ulatory Commission, Washington, DC, May 2011.[11] Annette L. Vietti-Cook.

STAFF REQUIREMENTS

-SECY-10-0113

-CLOSURE OPTIONS FOR GENERIC SAFETY ISSUE-191, ASSESSMENT OF DEBRIS AC-CUMULATION ON PRESSURIZED WATER REACTOR SUMP PERFORMANCE.

Letter from Annette L. Vietti-Cook to R. W. Borchardt, December 2010.50 REFERENCES

[12] Stecey Rosenburg.

PUBLIC MEETING WITH THE NUCLEAR ENERGY INSTI-TUTE ON STATUS AND PATH FORWARD TO RESOLVE GSI-191. Memorandum, January 2011.[13] Mohan Thadani. FORTHCOMING MEETING WITH STP NUCLEAR OPERATING COMPANY (TAC NOS. ME5358 and ME5359). Memorandum, February 2011.[14] Balwant K. Singal. FORTHCOMING MEETING WITH STP NUCLEAR OPERAT-ING COMPANY (TAC NOS. ME5358 and ME5359). Memorandum, May 2011.[15] Balwant K. Singal. FORTHCOMING CONFERENCE CALL WITH STP NUCLEAR OPERATING COMPANY (TAC NOS. ME5358 and ME5359). Memorandum, June 2011.[16] Balwant K. Singal. FORTHCOMING CONFERENCE CALL WITH STP NUCLEAR OPERATING COMPANY (TAC NOS. ME5358 and ME5359). Memorandum, July 2011.[17] Balwant K. Singal. FORTHCOMING MEETING WITH STP NUCLEAR OPERAT-ING COMPANY (TAC NOS. ME5358 and ME5359). Memorandum, August 2011.[18] Balwant K. Singal. FORTHCOMING PUBLIC MEETING VIA CONFERENCE CALL WITH STP NUCLEAR OPERATING COMPANY (TAC NOS. ME5358 and ME5359). Memorandum, October 2011.[19] Balwant K. Singal. FORTHCOMING PUBLIC MEETING VIA CONFERENCE CALL WITH STP NUCLEAR OPERATING COMPANY (TAC NOS. ME5358 and ME5359). Memorandum, September 2011.[20] Balwant K. Singal. FORTHCOMING PUBLIC MEETING VIA CONFERENCE CALL WITH STP NUCLEAR OPERATING COMPANY (TAC NOS. ME5358 and ME5359). Memorandum, November 2011.[21] Balwant K. Singal. FORTHCOMING PUBLIC MEETING VIA CONFERENCE CALL WITH STP NUCLEAR OPERATING COMPANY (TAC NOS. ME7735 and ME7736). Memorandum, January 2012.[22] Balwant K. Singal. FORTHCOMING PUBLIC MEETING VIA CONFERENCE CALL WITH STP NUCLEAR OPERATING COMPANY (TAC NOS. ME7735 and ME7736). Memorandum, February 2 2012.[23] Balwant K. Singal. FORTHCOMING PUBLIC MEETING VIA CONFERENCE CALL WITH STP NUCLEAR OPERATING COMPANY (TAC NOS. ME7735 and ME7736). Memorandum, February 3 2012.[24] Balwant K. Singal. FORTHCOMING PUBLIC MEETING VIA CONFERENCE CALL WITH STP NUCLEAR OPERATING COMPANY (TAC NOS. ME7735 and ME7736). Memorandum, March 29 2012.51 REFERENCES

[25] Balwant K. Singal. FORTHCOMING PUBLIC MEETING VIA CONFERENCE CALL WITH STP NUCLEAR OPERATING COMPANY (TAC NOS. ME7735 and ME7736). Memorandum, May 31 2012.[26] Balwant K. Singal. FORTHCOMING PUBLIC MEETING VIA CONFERENCE CALL WITH STP NUCLEAR OPERATING COMPANY (TAC NOS. ME7735 and ME7736). Memorandum, August 23 2012.[27] Balwant K. Singal. FORTHCOMING PUBLIC MEETING VIA CONFERENCE CALL WITH STP NUCLEAR OPERATING COMPANY (TAC NOS. ME7735 and ME7736). Memorandum, September 21 2012.[28] Antonio Diaz. Federal Register Notice Regarding the Meeting of'the ACRS Sub-committee on Thermal Hydraulic Phenomena, May 8-9, 2012, Rockville, Maryland.Memorandum, April 17 2012.[29] Balwant K. Singal. FORTHCOMING PUBLIC MEETING VIA CONFERENCE CALL WITH STP NUCLEAR OPERATING COMPANY (TAC NOS. ME5358 and ME5359). Memorandum, November 27 2012.[30] Shawn S. Rodgers and Roland F. Dunn. PRA Reference Model Update From STP Rev. 6 to STP Rev. 7. Procedure OPGP01-ZA-0305, Rev. 9 STI 33590701, STPNOC Risk Management, STPNOC, PO Box 289, Wadsworth, TX 77414, August 30 2012.[31] Mary Anne Billings.

PRA Analyses/Assessments.

South Texas Project Plant Proce-dure, 0PGP05-ZE-0001, August 2010.[32] NEI. Pressurized Water Reactor Sump Performance Evaluation Methodology.

Tech-nical Report 04-07, Nuclear Energy Institute, 1776 I Street, Washington, DC, May 2004.[33] David Teolis, Robert Lutz, and Heather Detar. PRA Modeling of Debris-Induced Failure of Long Term Cooling via Recirculation Sumps. WCAP 16882, Westinghouse Electric Company, LLC, Pittsburgh, PA, 2009.[34] John Darby, D. V. Rao, and Bruce Letellier.

GSI-191 STUDY: TECHNICAL AP-PROACH FOR RISK ASSESSMENT OF PWR SUMP-SCREEN BLOCKAGE.

Tech-nical Letter Report LA-UR-00-5186, Los Alamos National Laboratory, Los Alamos, NM, 2000.[35] Fatma Yilmaz, Ernie Kee, and Drew Richards.

STP Risk Managed Technical Specifi-cation Software Design and Implementation.

In Proceedings of the 17th International Conference on Nuclear Engineering, number 17-75043 in ICONE, July 2009.[36] EPRI. Risk-Managed Technical Specifications

-Lessons Learned from Initial Applica-tion at South Texas Project. TR 101672, Electric Power Research Institute, Palo Alto, CA, 2008.52 REFERENCES

[37] Elmira Popova and David Morton. Uncertainty modeling of LOCA frequencies and break size distributions for the STP GSI-191 resolution.

Technical report, The Univer-sity of Texas at Austin, Austin, TX, May 2012.[38] Robert Tregoning, Lawrence Abramson, and Paul Scott. Estimating Loss-of-Coolant Accident (LOCA) Frequencies Through the Elicitation Process. NUREG 1829, Nuclear Regulatory Commission, Washngton, DC, April 2008.[39] G. Zigler, J. Brideau, D. V. Rao, C. Shaffer, F Souto, and W. Thomas. Parametric Study of the Potential for BWR ECCS Strainer Blockage Due to LOCA Generated Debris. NUREG/CR 6224, Science and Engineering Associates, Inc., Albuquerque, NM, October 1995.[40] John Boska. Indian Point Nuclear Generating Unit Nos. 2 and 3 Report on Results of Staff Audit of Corrective Actions to Address Generic Letter 200402 (TAC Nos. MC4689 and MC4690). Letter from John Boska (NRC) to Entergy Nuclear Operations, Inc., July 29 2008..[41] D.V. Rao, Clint Shaffer, and E. Haskin. Drywell Debris Transport Study. NUREG/CR 6369, USNRC, Washington, DC, February 1998.[42] Alion. Risk-Informed GSI-191 Debris Transport Calculation.

Revision 2. Technical Report ALION-CAL-STP-8511-08, Alion Science and Technology, Albuquerque, NM, January 21 2013.[43] Thomas Hiltz. San Onofre Nuclear Generating Station, Units 2 and 3 Report on Results of Staff Audit of Corrective Actions to Address Generic Letter 200402 (TAC Nos. MC4714 and MC4715). Letter from Thomas Hiltz (NRC) to Richard Rosenblum (Southern California Edison Company), May 16 2007.[44] Graham Wallis. The NUREG 6224 Head Loss Correlation.

Memorandum, September 2004.[45] Westinghouse.

Evaluation of LongTerm Cooling Considering Particulate, Fibrous and Chemical Debris in the Recirculating Fluid". WCAP 16793, Westinghouse Electric Company, Pittsburgh, PA, October 2011.[46] Bruce Letellier and Tim Sande. South Texas Project Risk-Informed GSI-191 Evalu-ation, Volume 3, CASA Grande Analysis.

Technical Report STP-RIGSI191-V03, Los Alamos National Laboratory, Los Alamos, NM, January 30 2013.[47] David Morton. Modeling and Sampling LOCA Frequency and Break Size for STP GSI-191 Resolution.

Technical Report STP-RIGSI191-V03.02, The University of Texas at Austin, Austin, TX, January 23 2013.[48] Karl Fleming. Development of LOCA Initiating Event Frequencies for South Texas Project GSI-191. Final Report for 2011 Work Scope. Technical report, KNF Consulting Services LLC, and Scandpower Risk Management, Inc., September 2011.53 REFERENCES

[49] David Morton. A Framework for Uncertainty Quantification:

Methods, Strategies, and an Illustrative Example. Technical Report STP-RIGSI191-V03.08, The University of Texas at Austin, Austin, TX, January 23 2013.[50] David Morton. Filtration as a Function of Debris Mass on the Strainer:

Fitting a Para-metric Physics-Based Model. Technical Report STP-RJGSI191-V03.06, The University of Texas at Austin, Austin, TX, January 24 2013.[51] Rodolfo Vaghetto.

Core Blockage Thermal-Hydraulic Analysis.

South Texas Project Risk-Informed GSI-191 Evaluation, Texas A&M University, College Station, Texas, January 2013.[52] Anne E. Lane, Timothy Andreychek, William A. Byers, Richard J. Jacko, Edward J.Lahoda, and Richard D. Reid and. Evaluation of Post-Accident Chemical Effects in Containment Sump Fluids to Support GSI-191. WCAP 16350, Westinghouse Electric Company, Pittsburgh, PA, February 2011.[53] NEI. ECCS Recirculation Performance Following Postulated LOCA Event: GSI-191 Expected Behavior.

White Paper, 2009.[54] Davis Ballew, William Gurecky, and Erich Schneider.

Flashing Free Jet Analysis.Internal Report Revision 0, The University of Texas at Austin, Austin, TX, November 2012.[55] S.A. Eide, T.E. Wierman, C.D. Gentillon, D.M. Rasmuson, and C.L. Atwood. Industry-Average Performance for Components and Initiating Events at U.S. Commercial Nu-clear Power Plants. Technical Report NUREG/CR 6928, NRC, Washington, DC 20555-0001, February 2007.[56] Nuclear Regulatory Commission.

AN APPROACH FOR DETERMINING THE TECHNICAL ADEQUACY OF PROBABILISTIC RISK ASSESSMENT RESULTS FOR RISK-INFORMED ACTIVITIES.

Regulatory Guide 1.200, Nuclear Regulatory Commission, Washington, DC, January 2007.[57] Nuclear Regulatory Commission.

AN APPROACH FOR DETERMINING THE TECHNICAL ADEQUACY OF PROBABILISTIC RISK ASSESSMENT RESULTS FOR. RISK-INFORMED ACTIVITIES.

Regulatory Guide 1.200, Nuclear Regulatory Commission, Washington, DC, March 2009;[58] Jim Liming and Ernie Kee. Integrated Risk-Informed Asset Management for Commer-cial Nuclear Power Stations.

In Proceedings of the 10th International Conference on Nuclear Engineering, number 10-22033 in ICONE, April 2002.[59] James K. Liming, Ernest J. Kee, and Garry G. Young. Practical application of decision support metrics for power plant risk-informed asset management.

In Proceedings of the 11th International Conference on Nuclear Engineering, April 20-23, Tokyo, JAPAN, April 2003.54 REFERENCES

[60] Vera (Erguina)

Moiseytseva and Ernest Kee. Using RIAM for Optimizing Reactor Vessel Head Leak Failure Mode Maintenance Strategies.

In Proceedings of the 12th International Conference on Nuclear Engineering, number 12-49376 in ICONE, April 2004.[61] Ernest Kee, Alice Sun, Andrew Richards, James Liming, James Salter, and Rick Grantom. Using risk-informed asset management for feedwater system preventative maintenance optimization.

Journal of NUCLEAR SCIENCE and TECHNOLOGY, 41 (3):347-353, March 2004.[62] Alexander Galenko, David Morton, Elmira Popova, Ernie Kee, Drew Richards, and Alice Sun. Operational Models and Methods for Risk Informed Nuclear Asset Manage-ment. In Proceedings of the 2005 ANS International Topical Meeting on Probabilistic Safety Analysis, PSA05, September 2005.[63] Shuwen Wang, Ernie Kee, and Fatma Yilmaz. Quantification of Conditional Probability for Triggering Events using Fault Tree Approach.

In Proceedings of the Probabilistic Safety Assessment Meeting 2010, number 10-164 in PSAM, June 2010.[64] Ernie Kee and Fatma Yilmaz. Estimating and Presenting Transient Risk for On-Line Maintenance Using the STP Balance of Plant Model. In Probabilistic Safety Assess-ment Meeting 2010, Seattle, WA, June 7-11, PSAM10. Probabilistic Safety Assessment Meeting, PSAM, June 2010.[65] Ernie Kee and Elmira Popova. Risk Applications in Commercial Nuclear Power, chap-ter 2, pages 26-61. INFORMS TutORials in Operations Research.

Risk and Optimiza-tion in an Uncertain World, Hanover, MD, November 2010.[66] Fatma Yilmaz, Ernie Kee, and Rick Grantom. Development of Risk Communication Sheet for Daily Operational Focus Meetings at STP. In ANS PSA 2011 International Topical Meeting on Probabilistic Safety Assessment and Analysis, Wilmington, NC March 13-17, March 2011. American Nuclear Society.[67] Fatma Yilmaz and Ernie Kee. Methodology to Rank BOP Components at STP. In ANS PSA 2011 International Topical Meeting on Probabilistic Safety Assessment and Analysis, Wilmington, NC March 13-17, March 2011. American Nuclear Society.[68] Shawn S. Rodgers, Coral D. Betancourt, Ernie Kee, Fatma Yilmaz, and Paul Nelson.Integrated Power Recovery Using Markov Modeling.

ASME Journal of Engineering for Gas Turbines and Power, Volume 133, 2011.[69] Ernie Kee, Shawn Rodgers, Fatma Yilmaz, Paul Nelson, Paul Rodi, Vera Moiseytseva, and Chase Gilmore. Probability of Critical Station Blackout via Computational Eval-uation of Nonrecovery Integrals.

In Proceedings of the 20th International Conference on Nuclear Engineering (in print), number 2012-54569 in ICONE, July 2012.[70] Fatma Yilmaz and Ernie Kee. Return-to-Service Priority determination in RAsCal.Number 21-15356 in ICONE, Chendu, China, July 29 -August 2 2012. ANS/ASME.55 REFERENCES

[71] Fatma Yilmaz and Ernie Kee. Tier 1 Nuclear Safety Performance Index at STP: Risk Index. Number 21-15355 in ICONE, Chendu, China, July 29 -August 2 2012.ANS/ASME.[72] Mary Anne Billings.

South Texas Project Plant Procedure, OPGPO1-ZA-0305, Septem-ber 23 2010. STP Procedure 0PGP01-ZA-0305, PRA Model Maintenance and Update.[73] National Research Council. Review of Recommendations for Probabilistic Seismic Haz-ard Analysis:Guidance on Uncertainty and Use of Experts. Panel on Seismic Hazard Evaluation, Committee on Seismology, Commission on Geosciences, Environment, and Resources, National Research Council. The National Academies Press, Washington, DC, 1997. ISBN 9780309056328.

URL http://www.

nap. edu/openbook.

php?record_

id=5487.[74] Jason 'Trbovich.

Control of heavy loads. South Texas Project Plant Procedure, OPGP03-ZA-0069, November 15 2010.[75] Zahra Mohaghegh.

Socio- Technical Risk Analysis.

VDM Verlag, March 2009.[76] Jim Heil. Boric Acid Corrosion Control Program. South Texas Project Plant Procedure, OPGP03-ZE-0133, March 23 2011.[77] Lyle Spiess. ASME Section XI Inservice Inspection.

South Texas Project Plant Pro-cedure, OPSP11-RC-0015, 2012.[78] Jim Heil. RCS Pressure Boundary Inspection for Boric Acid Leaks. South Texas Project Plant Procedure, 0PGP03-ZE-0033, October 20 2012.[79] C. Kelly Howard. Design Change Package. South Texas Project Plant Procedure, OPGP04-ZE-0309, February 21 2012.[80] John W. Crenshaw.

STP Pilot Submittal and Request for Partial Exemption for a Risk-Informed Approach to Resolve Generic Safety Issue (GSI)-191 (TAC Nos. MF0440 and MF0441). Letter dated January 31, 2013, John Crenshaw, STPNOC, to NRC Document Control Desk, January 31 2013.[81] Christopher Wire. Shielding.

South Texas Project Plant Procedure, OPRP07-ZR-0004, 2012.[82] Safar Shojaei. Transient Cycle Counting Limits. South Texas Project Plant Procedure, OPEP02-ZE-0001, 2010.[83] Mark Page. Initial Containment Inspection to Establish Integrity.

South Texas Project Plant Procedure, OPSP03-XC-0002, 2010.[84] Courtney Flynn. Inspection of Containment Emergency Sumps and Strainers Unit #1 1-A, 1-B, 1-C Unit #2 2-A, 2-B, 2-C. South Texas Project Plant Procedure, OPSP04-XC-0001, 2011.56 REFERENCES

[85] Dewayne Billings.

Condition Reporting Process. South Texas Project Plant Procedure, OPGP03-ZX-0002, 2012.[86] Zahra Mohaghegh and Seyed A. Reihani. 1 st Oversight Quarterly Report for STP Risk-Informed Approach to NRC Generic Safety Issue 191 (GSI-191).

Quarterly Oversight Report 1, SOTERIA Consultants, LLC, Boston, MA, April 14 2012.[87] Zahra Mohaghegh and Seyed A. Reihani. 2 nd Oversight Quarterly Report for STP Risk-Informed Approach to NRC Generic Safety Issue 191 (GSI-191).

Quarterly Oversight Report 2, SOTERIA Consultants, LLC, Boston, MA, July 11 2012.[88] Zahra Mohaghegh and Seyed A. Reihani. 3 rd Oversight Quarterly Report for STP Risk-Informed Approach to NRC Generic Safety Issue 191 (GSI-191).

Quarterly Oversight Report 3, SOTERIA Consultants, LLC, Boston, MA, October 14 2012.[89] Zahra Mohaghegh and Seyed A. Reihani. 4 th Oversight Quarterly Report for STP Risk-Informed Approach to NRC Generic Safety Issue 191 (GSI-191).

Quarterly Oversight Report 4, SOTERIA Consultants, LLC, Boston, MA, January 24 2013.[90] Zahra Mohaghegh, Seyed A. Reihani, Tatsuya Sakurahara, and Marzieh Abolhelm.

5 th Oversight Report for STP Risk-Informed Approach to NRC Generic Safety Issue 191 (GSI-191).

Quarterly Oversight Report, University of Illinois at Urbana-Champaign, Champaign, IL. October 14, 2013.57 Appendices Appendix A is a table with three columns, "Section", "Paragraph Summary", and "Where Addressed" developed to help ensure the requirements of RG1.174 have been addressed in the STPNOC Pilot Project. The first column, "Section", highlights the four elements identi-fled in RG1.174. In an attempt to identify all sub-elements, items that clearly bear on the information needed were pulled out of the text and entered in the column "Paragraph Sum-mary". The "Where Addressed" column primarily refers to the Section in this document (Volume 1) where the requirement is addressed.

As mentioned in the Volume 1 Introduc-tion k Background, the numbered sections of Volume 1 correspond to the numbered sections in RG1.174 which should also help in this regard.Appendix B is a table with four columns, "Topical Area", "NRC-Approved Determinis-tic Methods", "STPNOC Pilot Project Methods for 2012 Quantification," and "Comments." The table is intended to help understand how the engineering analysis supporting the PRA used in the STPNOC Pilot Project relates to the NEI 04-07 recommended models. In par-ticular, the collection of engineering models used in the CASA Grande analysis are itemized against the recommendations.

NEI 04-07. "Topical Area" is the GSI-191 engineering model subject area. "NRC-Approved Deterministic Methods" is the methodology approved by the NRC for the particular topical area (not all topical areas had approved models at the time the STPNOC Pilot Project was completed). "STPNOC Pilot ProjectMethods for 2012 Quan-tification" is a quick description of the engineering model used in the STPNOC Pilot Project."Comments" provides information about whether the model is the same (that is, "no dif-ference")

or a summary description of how the model adopted differs or in some cases is closely related to the NRC's model choice.Appendix C is a detailed description of the DID and Safety Margin measures in place at STP as well as the measures STPNOC has taken in response to the GSI-191 issue.58 A Checklist for Regulatory Guide 1.174 Inputs Table 5: Checklist for Regulatory Guide 1.174 I Section I Paragraph Summary I Where addressed I Element 1: Define the Proposed Change Identify those aspects of the plants LB that may be affected by the proposed change, including but not limited to rules and regulations, FSAR, technical specifications, licensing conditions, and licensing commitments.

Part I, Page 1.Identify all structures, systems, and components (SSCs), procedures, and ac- Part I, Page 1.tivities that are covered by the LB change being evaluated and should consider the original reasons for including each program requirement Identify all structures, systems, and components (SSCs), procedures, and ac- Prior changes and tivities that are covered by the LB change being evaluated and should consider primary STPNOC the original reasons for including each program requirement processes bearing on this LB change are summarized in Part I, Page 1 Identify regulatory requirements or commitments in its LB that it believes are GSI-191 and Generic overly restrictive or unnecessary to ensure safety at the plant. Letter 2004-02 overly restrictive based on ac-tual plant analysis.Identify design and operational aspects of the plant that should be enhanced consistent with an improved understanding of their safety significance.

Such enhancements should be embodied in appropriate LB changes that reflect these enhancements.

No additional changes to the plant are rec-ommended beyond the those already implemented.

Part III continued next page ...

• .. continued Section Paragraph Summary Where addressed Identify available engineering studies, methods, codes, applicable plant-specific Overview on Page xv, and industry data and operational experience, PRA findings, and research and Figure 2. Further de-analysis results relevant to the proposed LB change. With particular regard to tails provided in Vol-the plant-specific PRA, the licensee should assess the capability to use. refine, ume 3. The PRA ca-augment, and update system models as needed to support a risk assessment pability is described in of the proposed LB change. Part II, Section 2.3 and further details are provided in Volumes 2 and 4.Describe the LB change and outline the method of analysis.

The licensee should Part 1I, Page 3 describe the proposed change and how it meets the objectives of the NR.Cs PRA Policy Statement (Ref. 1), including enhanced decision making, more efficient use of resources, and reduction of unnecessary burden.Combined Change Re- Licensees may include several individual changes to the LB that have been This section is not quests evaluated and will be implemented in an integrated fashion. applicable to the STPNOC Pilot Project.Guidelines for Develop- The changes that make up a CCR should be related to one another. This section is not ing Combined Change applicable to the Requests STPNOC Pilot Project.Element 2: Perform The scope, level of detail, and technical adequacy of the engineering analyses Part II. Defense-in-Engineering Analysis conducted to justify any proposed LB change should be appropriate for the Depth is detailed in nature and scope of the proposed change. Appendix C. Detailed description is provided in Volume 3.Some proposed LB changes can be characterized as involving the categorization Not applicable to this of SSCs according to safety significance.

LB change.continued next page ...

... continued Section I Paragraph Summary Where addressed I Evaluation of Defense-in-Depth Attributes and Safety Margins Evaluate the proposed LB change with regard to the principles of maintaining adequate defense-in-depth, maintaining sufficient safety margins, and ensuring that proposed increases in CDF and risk are small and are consistent with the intent of the Commissions Safety Goal Policy Statement.

Part II, Section 2.1 summarizes Defense in Depth and Safety Margin. The risk is very small, (Part II, Page 5)and well within the Commissioners' safety goal.Show that the fundamental safety principles on which the plant design was No changes are pro-based are not compromised by the proposed change. posed to plant design principles beyond those taken in response to the concerns raised in GSI-191. Part II, Para-graph 2.1.1.1.Evaluate whether the impact of the proposed LB change (individually and Part II, Para-cumulatively) is consistent with the defense-in-depth philosophy, graph 2.1.1.2, Ap-pendix C, Pages C1 to C3 The evaluation should consider the intent of the general design criteria Part II, Para-graph 2.1.1.1. Ap-pendix C, Pages C7 to C9 has detailed descriptions of the affected GDC.continued next page ...

... continued Section j Paragraph Summary Where addressed Assess whether the proposed LB change meets the defense-in-depth principle.

Paragraph 2.1.1.2 is a summary. Appendix C provides a detailed dis-cussion of the defense-in-depth at regarding the concerns raised in GSI-191.Evaluation of Risk Im-pact, Including Treat-ment of Uncertainties Technical Adequacy of Probabilistic Risk As-sessmrent Analysis Acceptance Guidelines Assess whether the impact of the proposed LB change is consistent with the Section 2.1.2 principle that sufficient safety margins are maintained.

Risk assessment may be used to address the principle that proposed increases Part II, Section 2.2.in CDF and risk are small and are consistent with the intent of the NRCs Safety Goal Policy Statement Impacts of the proposed change on aspects of risk not captured (or inade- Part II, Section 2.2.quately captured) by changes in CDF and LERF should be addressed.

For example, changes affecting long-term containment performance would impact radionuclide releases from containment occurring after evacuation and could result in substantial changes to off- site consequences such as latent cancer fatalities.

The scope, level of detail, and technical adequacy of the PRA are to be com- Part II, Section 2.3 and mensurate with the application for which it is intended and the role the PRA Section 2.3.1.results play in the integrated decision process.Both aleatory and epistemic uncertainty should be evaluated.

An understand-Section 2.5.3.ing of the important contributors in the model should be developed.

Regions are established in the two planes generated by a measure of the base-line risk metric (CDF or LERF) along the x-axis, and the change in those met-rics (CDF or LERF) along the y-axis (Figures 4 and 5). Acceptance guidelines are established for each region.Part II, Section 2.4.continued next page ...

... continued Section I Paragraph Summary I Where addressed It is recognized that many PRAs are not full scope and PRA information of less than full scope may be acceptable.

The scope and tech-nical adequacy of the STPNOC PRA is also de-scribed in Part II, Sec-tion 2.3.3 There are two sets of acceptance guidelines, one for CDF and one for LERF, The STPNOC PRA and both sets should be used. evaluates both CDF and LERF. Both of these metrics are included in the STPNOC Pilot Project acceptance criteria (Part II, Section 2.2).In the context of integrated decision making, the acceptance guidelines should Part II, Section 2.5.not be interpreted as being overly prescriptive.

They are intended to provide an indication, in numerical terms, of what is considered acceptable.

Cr Comparison of PRA results with acceptance guidelines The assumptions made in response to these sources of model uncertainty and any conservatism introduced by the analysis approach can bias the results.This is of particular concern for the assessment of importance measures with respect to the combined risk assessment and the relative contributions of the hazard groups to the various risk metrics.Importance measures are not relied on in the STPNOC Pilot Project (Page 36)continued next page ...

... continued Section Paragraph Summary Where addressed Comparison of the PRA results with the acceptance guidelines must be based on an understanding of the contributors to the PRA results and on the ro-bustness of the assessment of those contributors and the impacts of the uncer-tainties, both those that are explicitly accounted for in the results and those that are not.Section 2.5. Other con-tributors are captured in epistemic uncertainty as well as adoption of extreme thresholds for failure, especially in consideration of Boron Precipitation, ECCS strainer differen-tial pressure and core blockage.

Table 6. See Page 33.The analysis must be done to correlate the sample values for different PRA elements from a group to which the same parameter value applies.Part II, Section 2.5.1, a description of uncer-tainty quantification is given in Part II, Sec-tion 1.3 and the mod-eling of dependencies in the engineering analysis is described in Part II, Section 1.3.3 continued next page ...

... continued I Section I Paragraph Summary I Where addressed It is important to develop an understanding of the impact of a specific as-sumption or choice of model on the predictions of the PRA. This is true even when the model uncertainty is treated probabilistically, since the probabili-ties, or weights, given to different models would be subjective.

The impact of using alternative assumptions or models may be addressed by performing appropriate sensitivity studies or by using qualitative arguments, based on an understanding of the contributors to the results and how they are impacted by the change in assumptions or models.The impact of making specific modeling approximations may be explored in a similar manner.Part II, Section 2.3.5 provides an example il-lustration of how the analysis provides under-standing of engineering model impacts on the results.Appendix B compares models used com-pared with industry de facto models. Part II, Section 2.5.1 and Sec-tion 2.3 also address model appropriateness.

In many cases, the appropriateness of the models adopted is not questioned and these models have become, de facto, the consensus models to use.Completeness Uncer-tainty Comparisons with Ac-ceptance Guidelines Integrated decision making The issue of completeness of scope of a PRA can be addressed for those scope Part II, Section 2.5.4 items for which methods are in principle available, and therefore some un-derstanding of the contribution to risk exists, by supplementing the analysis with additional analysis to enlarge the scope,using more restrictive acceptance guidelines,or by providing arguments that, for the application of concern, the out-of-scope contributors are not significant.

Comparison with acceptance guidelines.

Part II, Section 2.5.5 In making a regulatory decision, risk insights are integrated with considera-tions of defense-in-depth and safety margins.Part II, Section 2.6 continued next page ...

... continued Section Paragraph Summary Where addressed Element 3: Define Im-plementation and Mon-itoring Program Element 4: Submit Proposed Change Documentation Careful consideration should be given to implementation of the proposed change and the associated performance-monitoring strategies.

The primary goal of Element 3 is to ensure that no unexpected adverse safety degradation occurs due to the change(s) to the LB.Part III Requests for proposed changes to the plants LB typically take the form of Part IV requests for license amendments (including changes to or removal of license conditions), technical specification changes, changes to or withdrawals of or-ders, and changes to programs under 10 CFR 50.54, "Conditions of Licenses" (e.g., quality assurance program changes under 10 CFR 50.54(a)).

To facilitate the NRC staffs review to ensure that the analyses conducted were Part VI sufficient to conclude that the key principles of risk-informed regulation have been mnet, documentation of the evaluation process and findings are to be maintained.

As part of evaluation of risk, licensees should understand the effects of the current application in light of past applications.

The STPNOC PRA is maintained current with the plant including application impacts as described in Part VII.

I, B NEI 04-07 Comparison Table 6: Comparison of NEI 04-07 recommended engineering models with the models implemented in the STPNOC Pilot Project Topical Area NRC-Approved Determinis-STPNOC Pilot Project Comments tic Methods Methods for 2012 Quantifi-cation Debris Generation Use spherical or hemispherical Use spherical or hemispherical No difference.

ZOI ZOI 17D ZOI for Nukon and 17D ZOI for Nukon and No difference.

Thermal-Wrap Thermal-Wrap 28.6D ZOI for Microtherm 28.6D ZOI for Microtherm No difference.

4D ZOI for qualified coatings 4D ZOI for qualified coatings No difference.

Truncate ZOI at walls Truncate ZOI at walls No difference.

4-category size distribution for Alion proprietary 4-category size Alion 4 category size distribution fiberglass debris including fines, distribution methodology (con- methodology previously accepted small pieces, large pieces, and in- sistent with guidance in SER ap- by NRC for deterministic evalu-tact blankets pendices) ations.100% fines for Microtherm debris 100% fines for Microtherm debris No difference.

100% fines (10fl) for qualified 100% fines (10p) for qualified No difference.

coatings debris coatings debris 100% failure for all unqualified Time-dependent failure of un- New methodology documented coatings debris qualified coatings based on avail- in Volume 3.able data.Unqualified coatings fail as 10lp Unqualified coatings fail in a Similar methods previously ac-particles if the strainer is fully size distribution based on coat- cepted by NRC for deterministic covered or as chips if a fiber bed ing type and available data. evaluations.

would not be formed.continued next page ...

... continued I Topical Area NRC-Approved Determinis-STPNOC Pilot Project Meth- Co1 ments tic Methods ods for 2012 Quanitification Plant-specific walkdowns re- STP-specific walkdown used to No difference.

quired to determine latent debris determine latent debris quantity quantity Latent debris consists of 85% Latent debris consists of 85% No difference.

dirt/dust and 15% fiber dirt/dust and 15% fiber Debris Transport Logic tree approach to analyz- Logic tree approach to analyz- No difference.

ing transport phases: blowdown, ing transport phases: blowdown, washdown, pool fill, recircula-washdown, pool fill, recircula-tion, and erosion tion, and erosion All large pieces and a portion of Fines transport proportional to Similar methods previously ac-small pieces are captured when containment flow, grating and cepted by NRC for deterministic blowdown flow passes through miscellaneous obstructions cap- evaluations.

grating. ture some small and large pieces.100% washdown of fines, limited 100% washdown of fines. -0% Includes some new methodology credit for hold-up of small pieces, washdown of large pieces through documented in Volume 3.and 0% washdown of large pieces grating.through grating Pool fill transport to inactive Pool fill transport to inac- Similar methods previously ac-cavities must be limited to 15% tive cavities is less than 15%. cepted by NRC for deterministic unless sufficient justification can Methodology is based on expo- evaluations.

be made nential equation with uniform mixing of fines.continued next page ...

• .. continued[Topical Area [NRC-Approved Determinis-STPNOC Pilot Project Meth- Comments tic Methods Iods for 2012 Quantification

_ __________1 CFD refinements are appropriate Recirculation transport based on Methodology for CFD modeling for recirculation transport, but a conservative CFD simulations and recirculation transport anal-blanket assumption that all de- developed for the deterministic ysis previously accepted by NRC bris is uniformly distributed is STP debris transport calcula- for deterministic evaluations.

not appropriate.

tion. All debris was not assumed to be uniformly distributed.

90% erosion should be used for An average erosion fraction less Value is relatively close to the non-transporting pieces of un- than 10% based on Alion testing. experimentally determined 10%jacketed fiberglass in the recircu- erosion value previously accepted lation pool unless additional test- by the NRC for deterministic ing is performed to justify a lower evaluations.

fraction.1% erosion of small or large 1% erosion of small or large No difference.

pieces of fiberglass held up in up- pieces of fiberglass held up in up-per containment, per containment.

Minimal previous analysis on Time-dependent transport eval- Several aspects of the time-time-dependent transport.

uated for pool fill, washdown, dependent transport are new en-and recirculation.

gineering models documented in Volume 3.Chemical Effects Corrosion and dissolution of met- WCAP 16530 NP model used to Overall chemical effects evalua-als and insulation in contain- calculate corrosion for wide range tion is a new approach as doc-ment is a function of tempera- of scenarios, and inform engi- umented in Volume 3 CASA ture, pH, and water volume. Ac- neering judgment for chemical ef- Grande Analysis.cepted model is WCAP-16530-fects bump-up factors.NP.continued next page ...

• .. continued Topical Area NRC-Approved Determinis-STPNOC Pilot Project Meth- Comments tic Methods a ds for 2012 Quantification I______________

100% of material in solution will Some material in solution may Overall chemical effects evalua-precipitate.

not precipitate depending on the tion is a new approach as in Vol-temperature-dependent solubil- ume 3 CASA Grande Analysis.ity limit of the precipitate.

Precipitates can be simulated us- Chemical products generally ap- Overall chemical effects evalua-ing the surrogate recipe provided pear to be more benign than tion is a new approach as doc-in WCAP-16530-NP.

WCAP surrogate.

umented in Volume 3 CASA Grande Analysis.Strainer Head Loss Perform plant-specific head Use the NUREG/CR-6224 cor- Approach documented in Volume loss testing of the bounding relation so that head loss can be 3 CASA Grande Analysis.scenario(s) with a prototype evaluated at the full range of sce-strainer module. narios.Address chemical effects head Address chemical effects head Overall chemical effects evalua-loss using WCAP-16530-NP sur- loss with bump-up factor condi- tion is a new approach as doc-rogates in prototype strainer tional probability distributions.

umented in Volume 3 CASA testing. Grande Analysis.Minimum fiber quantity equiva- Minimum fiber quantity equiva- No difference.

lent to 1/16 inch debris bed on lent to 1/16 inch debris bed on the strainers is required to form the strainers is required to form a thin bed. a thin bed.Bounding strainer head loss com- Time-dependent strainer Similar engineering model as pared to bounding NPSH margin head loss compared to time- documented in Volume 3.and bounding structural margin dependent NPSH margin and to determine whether the pumps bounding structural margin to or strainer would fail. determine whether the pumps or strainer would fail.continued next page ...

... continued Topical Area NRC-Approved Determinis-STPNOC Pilot Project Meth- Comments tic Methods ods for 2012 Quantification Air Intrusion Debris Penetration Release of air bubbles at the strainer calculated based on the water temperature, submer-gence, strainer head loss, and flow rate.NPSH margin adjusted based on the void fraction at the pump in-let Release of air bubbles at the strainer calculated based on the water temperature, submer-gence, strainer head loss, and flow rate.NPSH margin adjusted based on the void fraction at the pump in-let No difference.

No difference.

W1 Void fraction at pumps compared Void fraction at pumps compared No difference.

to a steady-state void fraction to a steady-state void fraction of 2% to determine whether the of 2% to determine whether the pumps would fail. pumps would fail.Perform plant-specific fiber pen- Develop a fiber penetration cor- New engineering model Docu-etration testing of the bound- relation as a function of strainer mented in Volume 3.ing scenario(s) with a prototype flow rate and fiber accumulation strainer module. based on a series of penetration tests.100% penetration of trans-portable particulate and chemi-cal precipitates.

Downstream effects acceptance criteria based on 100% penetra-tion of transportable particulate and chemical precipitates.

No difference.

Ex-Vessel Downstream Evaluate ex-vessel wear and Evaluate ex-vessel wear and No difference.

Effects clogging based on the methodol-clogging based on the methodol-ogy in WCAP-16406-P ogy in WCAP-16406-P continued next page ...

... continued Topical Area NRC-Approved Determinis-

] STPNOC Pilot Project Meth- Comments tic Methodsj ods for 2012 Quantification In-Vessel Downstream Compare fiber quantity on core Use RELAP5 simulations to New approach documented in Effects to bounding 15 g/FA limit based show that cold leg small break Volume 3 CASA Grande Analy-on WCAP-16793-NP.

LOCAs and all hot leg LOCAs sis.would not go to core damage with full blockage at the base of the core. For medium and large cold leg breaks, use WCAP-16793-P for fiber limit on the core.Evaluate reduced heat transfer Evaluate reduced heat transfer No difference.

due to deposition on fuel rods us- due to deposition on fuel rods us-ing LOCADM software.

ing LOCADM software.Boron Precipitation No currently accepted methodol-Evaluate fiber accumulation on New approach documented in ogy. the core for cold leg breaks dur- Volume 3 CASA Grande Analy-ing cold leg injection.

Assume sis.that 7.5 g/FA of fiber is sufficient to form a debris bed that would prevent natural mixing between the core and lower plenum. As-sume failure due to boron pre-cipitation if this quantity arrives prior to hot leg switchover.

C Defense-in-Depth and Safety Margin C.1 Introduction DID 1 for STP 2 Units 1 and 2 is based on the plant design, operating procedures, and administrative controls.

The proposed change to the Updated Final Safety Analysis Report (UFSAR) reconstitutes the current licensing basis for acceptable containment emergency sump strainer design and performance in support of the recirculation modes for ECCS 3 and CSS 4 following postulated LOCAs 5 , using a risk-informed approach to address GSI-191 6 [1].GSI-191 addresses concerns that debris generated during a LOCA could clog the RCB7 sump strainers in PWRs 8 and result in NPSHA 9 falling below NPSHR 1 0 for the ECCS pumps and CSS pumps. The NRC issued Bulletin 2003-01 [2] to address the potential for sump blockage.

The NRC later issued Generic Letter (GL) 2004-02 [3], requesting that licensees address the issues raised by GSI-191 and focused on demonstrating compliance with 10 CFR 50.46.In responses to Bulletin 2003-01 and GL 2004-02, STP described modifications to plant hardware (most notably new advanced design sump strainers), and operating procedures and administrative controls that were implemented to address GSI-191 concerns [4, 5, 6, 7, 8].STP operating procedures have actions which prevent and mitigate strainer blockage and in-vessel core blockage based on indications available to operators such as instrumentation to monitor core water levels and temperatures.

Actions include initiation of combined cold leg and hot leg injection, which provides an alternate flow path that bypasses core inlet blockage, and delaying the initiation of recirculation mode by delaying depletion of the RWST 1' including actions to refill the RWST. STP surveillance procedures implement Tech-nical Specification requirements for cleanliness in accessible areas of the RCB to verify no loose debris (rags, trash, clothing, etc.) is present which could be transported to the RCB sump and cause restriction of the pump suctions during LOCA conditions, and for visual inspections of the RCB sumps to verify suction inlets are not restricted by debris and that the sump components show no evidence of structural distress or abnormal corrosion.

The new strainer design satisfies the current licensing basis for debris loading as described in the STP UFSAR.. The new strainer design satisfies the current licensing basis for compli-ance with 10 CFR 50.46 and the regulatory requirements contained in GL 2004-02 including General Design Criteria (GDC) 35, 38, and 41, for the current licensing basis assumptions for analyzing the effects of post-accident debris blockage.

This evaluation is documented as part of a previously approved license amendment request [9, 10, 11].The current licensing basis for the new sump strainers installed to address GSI-191 con-1 Defeinse-in-Depth 2 South Texas Project Electric Generating Station 3 Emergency Core Cooling System 4 Containment Spray System 5 Loss of Coolant Accidents 6 Generic Safety Issue 191 7 Reactor Containment Building'Pressurized Water Reactors 9 Net Positive Suction Head Available 1"Net Positive Suction Head Required"Refueling Water Storage Tank C1 sists of the current assumptions, initial conditions and conclusions of CL 2004-02 related evaluations, including the current evaluations of design basis accident debris generation and transport, sump strainer performance, impact of chemical effects and downstream effects of debris. Substantial plant-specific testing that supports assumptions and corresponding conclusions contained in the GL 2004-02 evaluations for STP has been performed.

This in-formation supporting the previous deterministic methodology for demonstrating compliance is documented in supplemental information provided in response to CL 2004-02 [12]. How-ever, the NRC has not fully accepted the evaluations to demonstrate complete resolution of GSI-191 for the as-built and as-operated plant design using the deterministic methodology.

The risk-informed analyses associated with the proposed exemptions and license amend-ment along with the design, procedure and administrative controls already incorporated demonstrate that the RCB emergency sump strainers will perform their required functions.

To resolve GSI-191, STP has developed a risk-informed approach consistent with the guid-ance in RG1.174 1 2 to reconstitute the licensing basis for the strainer design for compliance with the regulatory requirements.

The STP risk-informed approach follows RG1.174 [13], verifying DID and Safety Margin are maintained through design modifications, ongoing design modification controls, maintenance procedures including the IS11 3 program. The ap-proach is comprehensive in nature, analyzing a full spectrum of LOCAs including DEGB14 for all piping sizes up to and including the largest pipe in the RCS 1 5.By requiring that mit-igative capability be maintained in a realistic and risk-informed evaluation of GSI-191 for a full spectrum of LOCAs, the approach ensures that DID is maintained.

The risk-informed method meets the key principles of RG1.174 and demonstrates that the residual risk as-sociated with GSI-191 concerns is far less than the threshold for Region III, "Very Small Changes," as defined by RG1.174 and therefore meets the Commissions Safety Goal.The proposed change to the licensing basis is to use the methodology of a RG1.174 risk-informed approach to evaluate containment emergency sump strainer performance in sup-port of ECCS and CSS recirculation modes following postulated LOCAs.The proposed change to the licensing basis is consistent with maintaining DID in that the following aspects of the facility design and operation are maintained:

• Functional requirements and design configurations of systems* Existing plant barriers to the release of fission products" Design provisions for redundancy, diversity and independence" Plant response to transients and other initiating events" Preventative and mitigative capability of plant design features.Based on the results of the risk-informed method and the hardware, operating procedures and administrative controls already implemented to address GSI-191 concerns, STP has high confidence that plant systems and operators would respond as required to mitigate postulated LOCAs. This confidence is bolstered by the DID features for STP described below.'2 Regulatory Guide 1.174 1 3 ASME Section XI Inservice Inspection"Double-Ended Guillotine Break" 5 Reactor Coolant System C2 C.2 Effectiveness of Defense-In-Depth Actions The effectiveness of the DID actions is shown to be acceptable when considering the follow-ing: " STP EOPs 1 6 are based on the approved industry standard Emergency Response Guide-lines (ERGs). These symptom-based EOPs have generic or site-specific analyses that support them." STP Severe Accident Mitigation Guidelines (SAMGs) are based on approved industry standard guidance." The procedures are trained upon and evaluated as part of the classroom training." The DID actions are trained upon using the simulator to demonstrate effectiveness." The procedures that make the framework for the DID actions are evaluated during the STP station review and approval process.C.3 Evaluations STP DID measures that are associated with the concerns of GSI-191 are evaluated by ap-plying regulatory guidance and industry guidance.C.3.1 Guidance in RG1.174 STPNOC 1 7 proposes a licensing basis change to use a risk informed approach to address the concerns of GSI-191 with respect to maintaining long term cooling post-LOCA on the basis that the change meets the principles and acceptance guidelines of RG1.174. The DID elements given in Section 2.1.1 of RG1.174 discussed below have been evaluated to show that the proposed change is consistent with DID for STP Units 1 and 2. DID for STP is based on the hardware, operating procedures, and administrative controls and design modifications that have been implemented to address the concerns of GSI-191 and GL 2004-02. The proposed licensing basis change does not propose any additional DID measures.A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

STP Units 1 and 2 each have three trains of ECCS equipment for the prevention of core damage. Each train includes a SJ18 accumulator, HHS1 1 9 pump, LHS1 2 0 pump that has its discharge routed through the RHR 2 1 heat exchanger for cooling by CCW 2 2.There are three independent trains of equipment for containment heat removal to prevent containment failure. The heat removal equipment for each 1 6 Emergency Operating Procedures 17The STP Nuclear Operating Company 1 8 Safety Injection System 1 9 High Head Safety Injection 2 0 Low Head Safety Injection 21Residual Heat Removal System 2 2 Component Cooling Water System C3 train includes a CSS pump and two RCFC 2 3 units per train that are cooled by safety-related CCW. Consequence mitigation is achieved using active equipment of the ECCS and CSS and by maintaining the containment building as an effective barrier to radioactive release.The proposed change does not involve any equipment or design changes beyond the modifications that have been made in response to the concerns raised in GSI-191 nor does it involve any changes to the EOPs beyond the changes in place to address the concerns raised in GSI-191. As discussed further below, the proposed change does not significantly affect the containment integrity or the capability of the independent and safety-related RCFCs to remove post-LOCA decay heat from containment.

There is no change to the strategies for the prevention of core damage, for prevention of containment failure, or for consequence mitigation.

Thus the existing balance among these is preserved.

Over-reliance on programmatic activities as compensatory measures associated with the change in the licensing basis is avoided.Programmatic activities associated with the proposed change include the ISI pro-gram, plant personnel training, RCS leak detection program, and containment cleanliness inspection activities.

The ISI program requires non-destructive examinations of the RCS components and piping. The inservice testing (IST) program requires testing of active compo-nents such as pumps and valves in the RCS, SI, and CSS systems. The proposed change does not rely heavily on programmatic activities as compensatory mea-sures nor propose any new programmatic activities that could be heavily relied upon. The risk-informed approach does consider pipe break frequencies.

STP has previously implemented a risk-informed ISI program that was approved by the NRC [14]. The ISI program is an effective element of DID that performs an im-portant role in the prevention of pipe breaks. It is important to note that the risk-informed GSI-191 program and the risk-informed ISI program are comple-mentary in that the risk insights from the stations plant specific PRA 2 4 are used in conjunction with deterministic information to improve the safety and effective-ness of the ISI program.The leak detection program at STP is capable of early identification of RCS leakage to provide time for appropriate operator action before a flaw causing a leak would propagate to a break. This program is an important contributor to preventive DID.Containment cleanliness inspection activities are performed prior to reactor startup following outages, as required by the Technical Specifications.

The risk-informed approach uses an input for the assumed amount of latent debris in-side containment after the cleanup activity is complete.

However, this is the same amount as that given in the NEI 04-07 guidance for a deterministic ap-proach [15, 16]. Thus, there is no over-reliance on STP programmatic activities to 2 3 The Reactor Containment Fan Coolers 2 4 Probabilistic Risk Assessment C4 quantify or manage latent debris as compensatory measures for the risk-informed approach.System redundancy, independence, and diversity are preserved com-mensurate with the expected frequency, consequences of challenges to the system, and uncertainties (for example, no risk outliers).

STP has three independent trains of ECCS equipment for the prevention of core damage. Each train includes a SI accumulator, HHSI pump, LHSI pump that has the discharge routed through the RHR heat exchanger for cooling by CCW. There are three independent trains of equipment for containment heat removal to prevent containment failure. The heat removal equipment for each train includes a CSS pump and two RCFC units that are cooled by CCW. Each train has an independent containment emergency sump with strainer to provide suction flow during the recirculation mode to the respective train's pumps (HHSI, LHSI, and CSS).The proposed change does not require any design change to these systems. Thus system redundancy, independence, and diversity are preserved.

The proposed li-censing basis change also does not call for any changes to the system operating procedures.

These systems have been fully analyzed relative to their contribu-tion to nuclear safety through STPs plant-specific PRA. The STP PRA includes the risk contributions for the full spectrum of LOCA events and meets industry PRA standards for risk-informed applications.

The treatment of uncertainties in the risk-informed model ensures results are obtained for realistic assessments, as discussed in detail in the supporting engineering analysis provided in Enclosure 4-3 (Volume 3). The uncertainties using the risk-informed approach methodology have been examined in the PRA and there are no risk outliers.Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mech-anisms is assessed.The proposed change does not change any defenses against common-cause fail-ures. A potential common cause failure would be all of the sump strainers be-coming clogged so that there would not be adequate flow to any of the SI and CSS pumps. The defenses that apply to potential strainer clogging (for example change in flow rate, conserving RWST inventory, use of alternate injection sources, and stopping/starting of pumps) are not changed by the use of the risk-informed methodology since there are no design changes to the equipment or changes to the EOPs.The potential for new common-cause failure mechanisms has been assessed for the GSI-191 issue. The primary failure mechanisms of concern are recirculation sump strainer clogging and core clogging (that is, in-vessel effect). A new aspect of clogging is the consideration of chemical effects in addition to the fibrous partic-ulate debris. However the defenses against chemically-induced clogging in either the ECCS sump strainers or in-vessel fuel blockage (which are discussed more in the next section) are effective, reasonable and acceptable operational measures to mitigate or ameliorate adverse strainer and core cooling performance.

Addition-ally, these defenses do not change due to the proposed licensing basis change to C5 use the RG1.174 risk-informed approach.

Since the risk-informed approach does not involve any design changes to the equipment or changes to the operating pro-cedures beyond those already taken in response to the concerns raised in GSI-191, it does not introduce any new common-cause failures or reduce the current plant defenses against common-cause failures Independence of barriers is not degraded.The three barriers to a radioactive release are the fuel cladding, the RCS piping and components, and the RCB. For the evaluation of a LOCA, the RCS barrier is pos-tulated to be breached.

The proposed licensing basis change does not involve any change to the design and analysis requirements for the fuel. Thus the fuel barrier independence is not degraded.

Consequently, the risk-informed GSI-191 analysis approach focuses primarily on addressing the integrity of the fuel cladding by assuring the ECCS cooling function is maintained.

STPs risk-informed evaluation includes both the ECCS cooling function and the containment function.In the recirculation mode of accident mitigation, the post-LOCA fluid that collects on the containment floor is pumped by the HHSI, LHSI, and CSS pumps that are located in the Fuel Handling Building (FHB). Thus the recirculated fluid goes from the RCB to the FHB and back to the RCB. The barrier to release from the FHB is the SI and CSS piping and components in the recirculation flow path. The FHB HVAC system has filters to handle gaseous leakage that would come from any recirculating sump water leakage in the FHB. The proposed licensing basis change does not involve any change to the design and operating requirements for this equipment.

Thus there is no change to the containment bypass path. The containment barrier is maintained.

The RCB is fully analyzed for not only design basis considerations but also from a Level 2 PRA perspective.

Detailed analyses for severe accident phenomena, includ-ing LOCAs, have been evaluated for impact to containment building integrity; and these events do not challenge the overall capability of the containment to remain intact. Also, it should be noted that additional DID capability is available through the use of the RCFCs. The RCFCs have enough cooling capability to remove decay heat from the containment pool through containment atmosphere cooling dur-ing the ECCS recirculation phase thereby further reducing containment integrity challenges.

The proposed change does not involve any design change to these barriers (fuel, piping, building, HVAC filters).

Thus the independence of the barriers is main-tained and not degraded.Defenses against human errors are preserved.

The proposed change does not involve any design change to the current equipment or for any change to operating procedures.

Operator actions during the initial accident mitigation stage are focused on monitoring of the automatic mitigation actions including automatic ECCS and CSS responses to the event. Operators will secure one CSS train if all three trains are running at the initiation of the event to conserve RWST volume. Prior to depletion of the RXVST, there is an automatic switchover of the ECCS and CSS pumps from taking suction from the C6 RWST to taking suction from the containment emergency sumps. Operator action is needed at the end of the switchover sequence to close the RWST outlet valves.If RCS pressure is greater than the pumps shutoff head pressure, the operators are required to secure the ECCS pumps to prevent pump damage. After 5.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, the switchover from cold leg injection to combined cold leg and hot leg injection is a manual action performed by the operator.

The use of the methodology for the risk-informed approach does not change any of the EOPs that would be used or impose any additional operator actions or complexity.

Thus the defenses that are already in place with respect to human errors are not impacted by the proposed licensing basis change.The intent of the plants design criteria is maintained.

The proposed change does not involve any change to the design or design re-quirements of the current plant equipment associated with GSI-191. Based on the results of the proposed change showing that the risk-informed approach meets RG1.174 acceptance criteria, the proposed change reconstitutes the licensing basis for acceptable containment emergency sump strainer design and performance in support of ECCS and CSS operation in recirculation mode following postulated LOCAs. Therefore the intent of the plants design criteria is maintained.

The design and licensing basis descriptions of accidents requiring ECCS and CSS operation, including analysis methods, assumptions, and results provided in UF-SAR Chapters 6 and 15 remain unchanged.

The proposed change to the licensing basis continues to meet the intent of the GDC that apply to functions addressed by GSI-191. This conclusion is based on the results of the risk-informed approach that demonstrate that the calculated risk associated with GSI-191 concerns for STP Units 1 and 2 is very small and far less than the Region III acceptance guide-lines defined by RG1.174. The functionality of the ECCS and CSS during design basis accidents is confirmed.

The performance evaluations for accidents requiring ECCS operation described in Chapters 6 and 15 are based on the STP Units 1 and 2 Appendix K Large-Break Loss-of-Coolant Accident (LBLOCA 2 5) analysis.

These evaluations demonstrate that for breaks up to and including the double-ended guillotine break of a reactor coolant pipe, the ECCS will limit the clad temperature to below the limit specified in 10 CFR 50.46, thus assuring that the core will remain in place and substantially intact with its essential heat transfer geometry preserved.

The proposed change does not involve a change to the ECCS acceptance criteria specified in 10 CFR 50.46.C.4 General Design Criteria GDC that apply to GSI-191 concerns are evaluated as follows.2 5 Large Break Loss of Coolant Accident C7 C.4.1 Criterion 16-Containment Design Containment and associated systems shall be provided to establish an essentially leak tight barrier against the uncontrolled release of radioactivity to the environment and to assure that the containment design conditions important to safety are not exceeded for as long as postulated accident conditions require.For STP, the containment isolation system will limit leakage to small percentages by providing an essentially leak-tight barrier against radioactivity which may be released to the containment atmosphere in the unlikely event of an accident.

Additional systems provided to prevent the uncontrolled release of radioactivity from the containment to the environment are the ECCS and CHRS 2 6 which includes the CSS and RCFCs. These systems mitigate the potential consequences of a LOCA or main steam line break. The containment and these associated engineered safety systems are designed to operate under all internal and external environmental conditions that may be postulated to occur during the life of the plant, including both short-and long-term effects following a LOCA.C.4.2 Criterion 35-Emergency Core Cooling A system to provide abundant emergency core cooling shall be provided.

The system safety function shall be to transfer heat from the reactor core following any loss of reactor coolant at a rate such that: (1) fuel and clad damage that could interfere with continued effective core cooling is prevented; and (2) clad metal/water reaction is limited to negligible amounts.For STP, the ECCS is provided to cope with any LOCA up to and including the plant design basis DEGB of the RCS. Abundant cooling water is available in an emergency to transfer heat from the core at a rate sufficient to maintain the core in a coolable geometry for any postulated LOCA and to assure that clad metal/water reaction is limited to less than 1 percent. Adequate design provisions are made to assure performance of the required safety functions even with a single failure. Additionally, the station's plant-specific PRA fully evaluates the risk of LOCAs and extends the analysis to beyond design basis events.Thus, additional DID considerations have been evaluated through the station's PRA to account for events such as multiple equipment failures, human errors, and external events including seismic events.STPNOC is requesting exemption to GDC 35 as described in Enclosure 2 to this sub-mittal. The request for exemption describes its basis and justifies that safety margin is preserved.

C.4.3 Criterion 38-Containment Heat Removal A system to remove heat from the containment shall be provided.

The system safety func-tion shall be to reduce rapidly, consistent with the functioning of other associated systems, the containment pressure and temperature following any LOCA and maintain them at ac-ceptably low levels.For STP, the CHRS consists of the CSS and the RCFC subsystem, and is assisted by the RHR heat exchangers acting in conjunction with the SI system to remove heat from containment.

The CHRS is designed to accomplish the following functions in the unlikely event of a LOCA: 2 6 Containment Heat Removal System C8 e Rapidly condense the steam within containment in order to prevent over-pressurization during blowdown of the RCS; and e Provide long-term continuous heat removal from containment.

Initially, the CSS and the HHSI and LHSI pumps take suction from the RWST. During the recirculation phase, the CSS and the HHSI and LHSI pumps take suction from the containment emergency sumps. The RCFC subsystem is also available as part of the CHRS to remove containment atmospheric heat and in so doing reduce containment temperature and pressure.STPNOC is requesting exemption to GDC 38 as described in Enclosure 2 to this sub-mittal. The request for exemption describes its basis and justifies that safety margin is preserved.

C.4.4 Criterion 41-Containment Atmosphere Cleanup Systems to control fission products, hydrogen, oxygen, and other substances which may be released into containment shall be provided as necessary to reduce, consistent with the functioning of other associated systems, the concentration and quantity of fission products released to the environment following postulated accidents, and to control the concentration of hydrogen or oxygen and other substances in containment atmosphere following postulated accidents to assure that containment integrity is maintained.

Each system shall have suitable redundancy in components and features, and suitable interconnections, leak detection, isolation, and containment capabilities to assure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available), its safety function can be accomplished, assuming a single failure.For STP, the CSS is provided to reduce the concentration and quantity of fission products in containment atmosphere following a LOCA. The equilibrium sump pH is maintained by trisodium phosphate (TSP) contained in baskets on the containment floor. The initial CSS water and spilled RCS water dissolves the TSP into the containment sump allowing recirculation of the fluid. Each unit is equipped with three 50 percent spray trains from a design basis perspective taking suction from the containment sump.STPNOC is requesting exemption to GDC 41 as described in Enclosure 2 to this sub-mittal. The request for exemption describes its basis and justifies that safety margin is preserved.

C.4.5 Criterion 50-Containment Design Bases The reactor containment structure, including access openings, penetrations and the CHRS, shall be designed so that the containment structure and its internal compartments can accommodate, without exceeding the design leakage rate with sufficient margin, the cal-culated pressure and temperature conditions resulting from any LOCA. This margin shall reflect consideration of: (1) the effects of potential energy sources which have not been included in the determination of the peak conditions, such as energy in steam generators (SGs) and energy from metal/water and other chemical reactions that may result from degraded emergency core-cooling functioning; (2) the limited experience and experimental C9 data available for defining accident phenomena and containment responses; and (3) the conservatism of the calculation model and input parameters.

For STP, the containment design basis is relevant to the risk-informed approach for that small fraction of events (typically involving beyond design basis failures) for which there is core damage that rely on containment for DID. The maximum temperature and pres-sure reached in the RCB during the worst-case design basis accident are well below the design temperature and pressure of this structure and there is substantial margin in the containment design to accommodate beyond design basis events. The proposed licensing basis change for the RG1.174 risk approach for GSI-191 does not change any of the design and testing requirements for the containment.

The section below titled "Barriers for Release of Radioactivity" provides additional discussion.

C.5 NEI Guidance for Defense-in-Depth Measures in Sup-port of GSI-191 Resolution For the purposes of GSI-191 resolution, the primary regulatory objective is specified in 10 CFR 50.46(b)(5) as long-term cooling. A method for ensuring adequate DID is to maintain the capability for operators to detect and mitigate inadequate flow through recirculation strainers and inadequate flow through the reactor core due to the potential impacts of debris blockage.

The following evaluation of the STP DID measures that support the STP applica-tion for a risk-informed approach to resolving GSI-191 is based on Nuclear Energy Institute (NEI) guidance [17] which includes additional justification for the measures discussed.

The STP Units 1 and 2 EOP framework has guidance for monitoring for the loss of emergency sump recirculation capabilities and actions to be taken if this condition occurs.These actions are as described in responses to Bulletin 2003-01 and GL 2004-02 [4, 5, 6, 7, 8], and remain in effect.In summary, these actions include (1) reducing flow through the strainer(s) by stopping pumps, (2) monitoring for for proper pump operation, core exit thermocouples, and reactor water level indication, (3) refilling the RWST for injection flow, (4) using injection flow from alternate sources, and (5) transferring to combined hot leg/cold leg injection flow paths.STP EOPs that implement these actions include: OPOP05-EO-EOOO "Reactor Trip or Safety Injection" OPOP05-EO-EO10 "Loss of Reactor or Secondary Coolant" OPOP05-EO-EC11 "Loss of Emergency Coolant Recirculation" OPOP05-EO-ES13 "Transfer to Cold Leg Recirculation" OPOP05-EO-ES14 "Transfer to Hot Leg Recirculation" OPOP05-EO-FO02 "Core Cooling Critical Safety Function Status Tree" OPOP05-EO-FRC1 "Response to Inadequate Core Cooling" OPOP05-EO-FRC2 "Response to Degraded Core Cooling" OPOP05-EO-FRZ3 "Response to High Containment Radiation Level" C.5.1 Strainer Blockage Inadequate recirculation strainer flow refers to the condition where the head loss across the ECCS sump strainers develops to the condition where the NPSHA is less than the CIO NPSHR of the HHSI, LHSI and CSS pumps taking suction on the strainers.

This condition could result from the formation of chemical precipitates in the containment sump pool and their deposition on a debris bed on the sump strainers.

The onset of inadequate sump strainer flow would not be expected to present itself as a problem until several hours into an event (following cooldown and the potential formation of chemical precipitates).

This has been shown previously through generic and highly conservative (i.e., bounding) testing to significantly increase the strainer head loss above that which develops solely as a result of non-chemical debris. For STP, more recent testing for the realistic post-LOCA conditions has shown that impacts due to chemical effects are not deleterious to pump performance.

In fact, the plant specific, prototypical (i.e., realistic) tests and experiments have shown that there has been an extremely small amount of precipitates formed in STP post-LOCA sump environments over a thirty day time period. However, the STP DID does include sump strainer contingencies due to debris-induced strainer clogging, as discussed above.C.5.2 Prevention of Strainer Blockage The primary means to delay or prevent this condition is to reduce the flow through the sump strainers by the following.

e STP has a continuous action step in the EOPs to remove the third CSS pump from service after conditions have been verified suitable.

Upon the initiation of an event that would cause a CSS actuation, the STP EOPs secure one CSS pump if three CSS pumps are in service. The operator performs this at the onset of the event to conserve RWST volume. This will also reduce the flow demands on the associated emergency sump during emergency recirculation phase.* The following additional pumps are removed as conditions allow: CSS pumps (with TSC 2 7 concurrence when containment pressure is less than 6.5 psig) and LHSI pumps (if RCS pressure is greater than 415 psig).* For small to medium LOCAs, guidance to delay depletion of the 1RWST exists in proce-dure OPOP05-EO-ES12, "Post LOCA Cooldown and Depressurization".

This procedure provides actions to cooldown and to depressurize the RCS to reduce the break flow, thereby reducing the injection flow necessary to maintain RCS subcooling and inven-tory. The operating HHSI pumps are sequentially stopped to reduce injection flow, based on pre-established criteria that maintain core cooling, resulting in less outflow from the RWST. If the break is not large enough to drop RCS pressure below 415 psig, then the three LHSI pumps would not be injecting into the RCS but would be on pump recirculation flow back to the RWST. This would greatly reduce the depletion of RWST volume since these are high volume pumps. The procedure would secure these pumps as long as RCS pressure is maintained above 415 psig.* For smaller LOCAs, it is possible to cooldown and depressurize the RCS to cold shut-down conditions before the RWST is drained to the switchover level. Therefore cold leg recirculation is not required to be established for these breaks; and sump blockage is not an issue.2 7 Technical Support Center Cll Additional considerations for prevention of sump strainer blockage: e For the Technical Specification Surveillance Requirement (TS SR) 4.5.2.c, STP has im-plemented procedures OPSP03-XC-0002 "Initial Containment Inspection To Establish Integrity" and OPSP03-XC-0002A "Partial Containment Inspection (Containment In-tegrity Established)," to visually inspect all accessible areas of the containment when Containment Integrity is established and maintained.

The inspections ensure no loose debris (rags, trash, clothing, etc.) is present in the containment which could be trans-ported to the containment sump. Walk-downs are performed by station management and Operations personnel and a final acceptance walk-down is performed by Opera-tions to assure the containment building is free of loose debris prior to entering Mode 4 (Hot Shutdown).

For subsequent entries, inspections of the travel path and work locations are required to assure the areas free of loose debris.* For TS SR 4.5.2.d, STP has implemented procedures to verify by visual inspection that the suction inlets are not restricted by debris and that the sump components show no evidence of structural distress or abnormal corrosion.

This TS SR is required every refueling outage.e The RWVST level is normally maintained at a nominal level from 490,000 to 500,000 gallons to ensure standby capacity is maintained above the Technical Specification minimum required volume of 458,000 gallons and the low level alarm setting of 473,000 gallons.e Training has been provided to engineering personnel to raise their awareness of the more aggressive containment cleanliness requirements, the potential for sump blockage, and actions being taken to address sump blockage concerns.C.5.3 Detection of Strainer Blockage In a LOCA scenario, debris would be generated and could be transported to the emergency sump strainers.

Following initiation of flow through the sump strainers in the recirculation mode, fiber and particulate debris could accumulate on the strainers resulting in increased head loss across the strainers.

If an excessive head loss condition were to develop, it would result in a condition of inadequate recirculation flow from the strainers to the pumps. This, in turn, could result in a condition where insufficient cooling is provided to cool the reactor core or insufficient flow is available for containment pressure control.If a condition of inadequate recirculation strainer flow were to develop, it is important for the plant operators to be able to detect this condition in a timely manner. The primary methods for detection of this condition are: Pump distress indications STP has flow indication in the control room for all SI pumps (LHSI and HHSI) and for all CSS pumps. Instrumentation is available to provide the operator with indications of potential sump blockage.

Indications of pump cavitation or pump suction pressure below NPSHR. such as erratic flow or low discharge pressure can indicate a degradation in suction supply that could be caused by containment recirculation sump strainer C12 clogging.

Indications are provided for SI and CSS pump flows and SI pump discharge pressures that can be monitored for signs of degraded pump conditions, such as could be caused by containment sump clogging following establishment of recirculation flow.Core cooling degrading STP has core exit thermocouple (CET) indication and reactor vessel water level (RVWL) indication in the Control Room both on computer screens for the Integrated Computer System (ICS) and Qualified Display Parameter System (QDPS) to allow monitoring for any potential reduction in core cooling flow due to sump blockage.

This indication is also displayed on the computer systems as part of the critical safety sys-tem status trees indicators.

The Reactor Operators and the Shift Technical Advisor monitor these status tree indications.

The status tree indicators provide change based on status tree logic to further enhance operator recognition of a distress condition developing.

C.5.4 Mitigation of Strainer Blockage Multiple methods are available to mitigate an inadequate recirculation flow condition caused by the accumulation of debris on the sump strainer, including:

Reduction in flow demand on the emergency sump strainer EOPs contain steps to reduce flow through the system up to and including stopping all pumps taking suction from the affected emergency sump strainer.

In strainer head loss testing it has been observed that stopping all flow through a debris laden strainer has resulted in separation of portions of the debris bed from the strainer.

The primary driver for this separation is gravity since the force that held the debris bed in place was the differential force (pressure) developed as a result of flow and head loss through the bed. Another contributor to the collapse of the debris bed is the reverse pressure wave that develops as a result of stopping the pumps and the consequential closure of discharge check valves. STP procedure OPOP05-EO-EC11 "Loss of Emergency Coolant Recirculation" minimizes the pumps required depending on plant conditions and di-rects shutting down all pumps as applicable.

The following actions would address degraded ECCS recirculation flow that may be caused by containment recirculation sump strainer clogging:* stopping CSS pumps not needed for containment pressure control with adequate RCFCs used for containment heat removal, to conserve RWST.* securing SI pumps to the RWST.* aligning CCP to the VCT 2 8 and injecting into the RCS.Alternation of Recirculation Trains STP has a design configuration that allows independent operation of recirculation strainer trains. This enables the capability to operate the recirculation system in a sacrificial strainer arrangement.

With two recirculation strainers put in service and the third strainer in standby, the vast majority of the debris will collect on the first 2 SVolume Control Tank C13 two strainers.

This provides for a relatively clean, low head loss strainer that can be placed in service later if determined necessary due to blockage on the first two strainers.

The STP design has three independent trains each consisting of one HHSI pump, one LHSI pump, one CSS pump, one RHR heat exchanger, and one emergency sump strainer.The design does have the capability for operating only two trains at a time which would allow the third train to have relatively debris free strainer operation if called upon to be in service later in the accident mitigation scenario.Emergency Sump Strainer Backwash The STP plant design configuration can provide a gravity drain of water from the nor-mal injection supply from the RWST backwards through the emergency sump strainer.This backfiow from the RWST to the sump could occur only if the containment pres-sure is sufficiently low (below the RWST gravity head). The bottom of the RWST is at elevation

(+) 10 feet and the sump strainers are at elevation

(-) 11 feet. Gravity backwash removes accumulated debris blockage at the sump strainer.

The TSC, using guidance provided in the SAMGs, would be expected to advise performance of this action, considering the plant conditions and available indications.

RWST Refill and Realignment for Injection Flow The EOPs for STP contain steps to initiate makeup to the RWST following transfer to the recirculation mode of core cooling. In the event of strainer blockage, realignment to the direct injection flow path from the RWST would provide necessary cooling for an extended period of time. If aligned to the RWST, the operators would establish the minimum flow required for core decay heat removal depending on sub-cooling conditions.

STP transfers from cold leg recirculation to hot leg recirculation at 5.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after event initiation.

Per the hot leg recirculation procedure requirements, Operators will transfer two trains to hot leg recirculation while maintaining one train in cold leg recirculation.

STP has the design capability to refill the RWST and to realign the SI pumps to use this injection water source in case the recirculation flow path was blocked by clogged sump strainers.

STP has guidance in the SAMGs to inject more than one RWST volume, and the additional RWST volume to be added would be coordinated with the TSC.Injection Flow from Alternate Sources STP has the capability to use other sources of water to provide for core cooling. The STP plant design configuration can provide CVCS 2 9 Recycle holdup tanks as a water source to make up to the VCT allowing use of a charging pump to provide injection flow. STP has the capability to align the BAT 3 0 using the boric acid transfer pump to inject into the RCS.C.5.5 Inadequate Reactor Core Flow Inadequate reactor core flow refers to the condition where the normal core cooling flow path has become impeded (blocked) and is not allowing sufficient cooling water flow to 2 Volume and Control System 3 0 Boric Acid Tank C14 reach the core. This condition could result from the formation of a flow limiting or blocking debris bed at the entrance to the core region from the lower plenum of the reactor vessel.The fiber bed that is developed is the result of fibers bypassing (flowing through) the emergency sump strainers and becoming trapped in the debris limiting openings at or near the bottom of the fuel assemblies.

Tests have shown that the limiting conditions for fuel blockage require the combination of fibrous debris, particulates and chemical precipitates.

Significantly higher fiber debris loads can be accommodated without flow reductions with the absence of or significant reduction in chemical precipitates or in a significantly increased particulate contribution.

Similarly, with a significant reduction in fibrous debris, particulates and chemical precipitates can be accommodated without problems.In a LOCA scenario, debris would be generated and deposited inside containment.

Fol-lowing initiation of flow through the emergency sump strainers during the recirculation mode, fibrous and particulate debris would be transported to the strainers.

Some of the debris transported would pass through the strainers and enter the suction of the ECCS pumps (LHSI and HHSI) and be injected into the reactor. The ECCS recirculation flow will be directed initially to the cold legs of the RCS and flow through the reactor vessel to the lower plenum region and then up into the fuel assemblies.

Depending on the break size and location, a portion of this flow can bypass the reactor core and flow out of the break loca-tion. Any fibrous debris that goes through the strainers and makes it to the reactor vessel will tend to collect on the bottom of the fuel to form a debris bed that would also capture particulate debris. As temperature in the containment pool reduces below the value asso-ciated with the development of chemical precipitates, these precipitates will interact with the debris bed formed at the fuel assemblies resulting in a further increase in head loss.The STP plant design has combined hot leg and cold leg injection once the RWST is de-pleted and the pumps have been aligned during the recirculation mode. Initially the pumps are aligned for cold leg injection.

At 5.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after the initiating event, the switchover to combined hot/cold leg injection is made. Since core cooling flow in this configuration is directed from below and above the core, this design is less susceptible to the development of blockage conditions that would result in an inadequate reactor core flow condition for flow in only one direction.

C.5.6 Prevention of Inadequate Reactor Core Flow Controlling (Reducing)

Core Flow The set of actions identified above for reducing or controlling flow through the emer-gency sump strainers during the recirculation mode can have a similar positive impact on reducing the potential for fuel blockage.

Controlling flow to the reactor vessel to maintain fuel coverage and match decay heat has benefits through reduced head loss and delayed onset of any chemical precipitates.

Transfer to Combined Hot Leg / Cold Leg Injection Flow Paths This step normally is performed at 5.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> following the design basis pipe break event. There are some factors to consider that establish the mininmm time for normal transition to this mode of core cooling. These factors are the decay heat load versus the hot leg injection capability and the potential for steam binding of flow out of the core for certain hot leg break scenarios.

For STP which has multiple hot leg injection flow paths, the safety injection flow rate is significantly greater than the core boil off rate.C15 This ensures adequate flow to the core. Because debris beds observed in testing appear to be very unstable, transferring to hot leg injection also has the potential to disturb any debris collected onl the bottom of the fuel. The STP EOPs call for switchover of two trains to hot leg injection while maintaining cold leg injection with the third train.C.5.7 Detection of Inadequate Reactor Core Flow Multiple methods exist for detection of a core blockage condition as manifested by an inadequate reactor coolant system (RCS) inventory or RCS and core heat removal condition.

The primary methods include core exit thermocouples (CET) temperature indication and the RVWL monitoring system.Monitoring is initiated early in the event in the EOPs through Critical Safety Function Status Trees (CSFST). The CSFSTs are performed continuously after completion of diagno-sis of the event directed by the EOPs. The QDPS and ICS screens display the Critical Safety Function status at the bottom of the screen to allow the operating crew easy monitoring capability.

In addition, the Shift Technical Advisor is responsible to provide an independent monitoring of the CSFST during an event and update the operating crew of any changes.Emergency Response Personnel in the TSC or EOF 3 1 will also maintain oversight of plant status through review of information available in the TSC and EOF. An additional method for detection of a core blockage condition includes monitoring of containment radiation levels by the TSC or EOF staff and/or if an alarm setpoint is reached resulting in an alarm in the control room. Subcooling and containment radiation are monitored during an event by the operating crew and/or the Emergency Response Personnel and will be used to help determine if the event is escalating in severity and if one of the fission product barriers may be impacted.Increasing core exit thermocouple (CET) temperature indication CETs are monitored during EOP usage as well as for status tree functional restoration entries and the safety parameter display system (SPDS). As part of operator training, the operating crew must demonstrate the ability to detect increases in CET tempera-ture indication and transition to the appropriate EOP for dealing with this condition.

Core exit temperature behavior is the primary indicator of adequate core cooling. If cold leg recirculation has been established with flow maintained into the RCS, core exit temperature should be stable or slowly lowering during the recovery.

Increasing core exit temperatures while injection flow is maintained, regardless of reactor vessel water level behavior, is an unexpected condition that should be evaluated well before any CSFST temperature limits are approached.

In this regard, when a core cooling concern is identified, STP's functional restoration procedure would attempt to establish injection flow. If unable to establish SI flow, then centrifugal charging pump (CCP)flow is established to allow maximum injection into the RCS utilizing the two CCPs.Decreasing reactor water level indication Reactor vessel water level is monitored throughout the EOPs. Through continuing training, operators demonstrate the ability to monitor and understand the implications a"Emergency Operations Facility C16 of a decreasing reactor vessel water level and appropriately transition within the EOP framework to mitigate this condition.

STP uses a RVWL indicating system design consisting of heated and unheated junc-tion thermocouple pairs which would indicate a lowering water level with lower core region flow blockage.

The STP design uses eight pairs of heated and unheated junction thermocouples enclosed in a vertical shroud from the top of the core to the top of the reactor vessel head which provides discrete level indication (void/no void) at the elevation of each pair. This RVWL design does not rely on differential pressure sensors for indication.

Increasing containment or auxiliary building radiation levels Increasing radiation levels would be indicated by alarms in the control room with specific procedural steps in both alarm response procedures and EOPs for addressing the condition.

Radiation monitor indication in the auxiliary building may be indication of a LOCA outside containment or provide initial entry conditions into an Emergency plan (E-plan) due to increasing radiation levels. Abnormal containment radiation could require an escalation of the E-plan due to this being indication of fission product barrier degradation which is monitored by the control room. Abnormal containment radiation level is also one of the symptoms used to identify a LOCA inside containment in the EOPs. Due to the sensitivity of the monitors and the low alarm set points, identification of degrading core conditions is expected to be indicated well before a significant release of radioactivity to containment occurs.C.5.8 Mitigation of Inadequate Reactor Core Flow Multiple methods are available to mitigate an identified inadequate reactor core flow con-dition.Upon identification of an inadequate RCS inventory or an inadequate core heat removal condition, the EOPs direct the operators to take actions to restore cooling flow to the RCS including:

• Increase SI flow to refill the reactor vessel by depressurizing the RCS.* Depressurize the RCS to inject the accumulators.

• Attempt to start any available SI pumps not running." Secure SI pumps to prevent pump damage, as necessary." As necessary, secure SI flow to prevent pump damage." Refill the RWST." Provide injection flow from the VCT using the charging pumps on a loss of emergency recirculation." Provide injection flow using the positive displacement pump, if needed.* Provide core cooling by steaming through the steam generators.

C17 e Transfer to R.HR if determined acceptable by the TSC.* Transfer to hot leg recirculation.

The operators will also inform the TSC of indications of inadequate reactor core cooling.The TSC will evaluate the condition and recommend the following actions, as necessary, to the operators to restore core heat removal using SAMGs or mitigation procedure guidance." Throttle RCS injection flow rate to'ensure long term minimum decay heat removal is met." Use the hot leg injection flow path.* Gravity drain the RWST to backwash the containment emergency sumps." Establish alternate injection paths that include the VCT and BAT." Refill of the RWST from the CVCS or fire water system" Restart Reactor Coolant Pumps (RCPs).* Flood containment using the fire water system" Transfer to combined hot leg / cold leg injection flow paths At the time for switchover to hot leg injection, the containment sump inventory typically has been recirculated through the ECCS and RCS several times. Particulate and fibrous debris generated by the initial break and carried in the recirculating coolant is depleted by either capture on the sump strainer, fuel assemblies, or by settling out in the containment sump or in low flow locations of the ECCS reactor vessel flow path such as the reactor vessel lower plenum. Thus, the amount of particulates and fibrous debris in the recirculating flow at the time of initiation of hot leg recirculation is expected to be small. When considering chemical effects for STP, the results of tests using sump chemistry representative of post-LOCA conditions for STP indicate that significant impacts to strainer 'and fuel head loss due to chemical effects would not be expected.STP's multiple hot leg injection flow paths provide a safety injection flow rate that is significantly greater than the core boil off rate. This ensures adequate flow to the core.Transferring to hot leg injection also has the potential to disturb any debris collected on the bottom of the fuel. The STP EOPs call for switchover of two trains to hot leg injection while maintaining cold leg injection with the third train.Establishment of Alternate Flow Paths If CET temperature indication reaches the established threshold, then alternate flow paths could be established to provide for core cooling. Some of the alternative flow paths considered are returning to the injection mode of core cooling through use of alternate water supplies.

If unable to establish SI flow, then CCP flow is established to allow maximum injection into the RCS utilizing two CCPs. This alternate flow suction source can be aligned to either the RWST or VCT. As discussed previously, hot leg recirculation for STP using combined hot leg and cold leg injection flow paths has the potential to disturb the developed debris bed allowing for adequate core cooling.C18 Start a Reactor Coolant Pump If GET temperature indication reaches the established threshold, then the operators could start an RCP. This action is expected to remove the material blocking the core and allow the normal recirculation injection flow paths to become effective at main-taining adequate core cooling.Implementation of SAMGs or EDMGs SAMG and Extensive Damage Mitigation Guidelines (EDMG) provide additional guid-ance and actions for addressing inadequate core flow conditions.

Typically, SAMGs will be entered when directed by the EOPs and with the concurrence of the TSC. The SAMGs are used by the technical support staff in the TSC or EOF to evaluate alter-native courses of action for a degrading condition.

The SAMGs or the EDMGs will provide guidance for flooding containment above the reactor vessel hot and cold leg nozzles thus covering the break location to provide for convective circulation cooling of the reactor vessel.C.5.9 Training Related to the Proposed Change The proposed change does not result in changes to the symptom-based response procedures and guidelines beyond those already implemented in response to Bulletin 2003-01 and GL 2004-02. Initial training on sump blockage issues was completed as described in [4, 5, 6, 7, 8].Licensed operator classroom and simulator training on indications of, and responses to, degraded pump flow indications which may be caused by containment sump clogging is provided during initial and requalification training.Training has been conducted for Emergency Response Organization decision makers and evaluators in the TSC on indications of sump blockage and compensatory actions.C.6 Barriers for Release of Radioactivity The following evaluation demonstrates that the proposed change maintains sufficient safety margin for the current barriers for release of radioactivity which are the fuel cladding, the RCS boundary, the RCB, and the emergency plan (EP) actions. The evaluation concludes that the proposed licensing basis change: " Does not affect or remove any of these levels of protection.

• Does not result in a significant increase in the existing challenges to the integrity of the barriers.* Does not significantly change the failure probability of any individual barrier." Does not introduce new or additional failure dependencies among barriers that signif-icantly increase the likelihood of failure when compared to the existing conditions." Does not change the overall redundancy and diversity features among the barriers that are sufficient to ensure compatibility with the risk acceptance guidelines.

C19 C.6.1 Fuel Cladding The fuel cladding barrier is maintained by the ECCS following a LOCA. After the initial phase of the accident mitigation, long term cooling is also maintained post-LOCA by the ECCS. The proposed licensing basis change for the change in methodology to use a RG1.174 risk-informed approach for GSI-191 does not make any change to the previous analyses and testing programs that demonstrate the acceptability of the ECCS for the initial phase of providing core cooling. The proposed licensing basis change shows that long term cooling is met for the additional accident mitigation and recovery phase. The proposed licensing basis change does not call for any equipment changes or design changes or for any changes to the plant operating and testing procedures beyond those already implemented in response to the concerns raised in GSI-191. There is no change to the design and analysis requirements for the fuel.Emergency Core Cooling To comply with GDC 35, "Emergency core cooling," STP has a system to provide abundant emergency core cooling. The system safety function is to transfer heat from the reactor core following any loss of reactor coolant at a rate such that: (1) fuel and clad damage that could interfere with continued effective core cooling is prevented and;(2) clad metal-water reaction is limited to negligible amounts. Suitable redundancy in components and features, and suitable interconnections, leak detection, isolation, and containment capabilities are provided to assure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available) the sygtem safety function can be accomplished, assuming a single failure.Long Term Cooling To comply with 10 CFR 50.46(b)(5), "Long-term cooling," the STP RG1.174 risk-informed approach for post-LOCA sump performance shows that after the successful initial operation of the ECCS, the core temperature is maintained at an acceptable low value and decay heat is removed for the extended period of time required by the long-lived radioactivity remaining in the core.C.6.2 Reactor Coolant System Pressure Boundary The integrity of the RCS pressure boundary is postulated to be broken for the GSI-191 sump performance evaluation which is concerned with post-LOCA debris effects. However, the proposed change does not make any change to the previous analyses and testing programs that demonstrate the integrity of the RCS. Since the proposed licensing basis change does not impact any design or programmatic requirements for the reactor coolant pressure boundary, the likelihood of a LOCA is not affected.Inservice Inspection Program The IST program performs an important role in the prevention of pipe breaks. The in-tegrity of the Class 1 welds, piping, and components are maintained at a high level of reliability through the ASME Section XI inspection program. STP procedure, OPSP11-RC-0015, for ASME Section XI Inservice Inspection, ensures that the following require-ments of Technical Specifications 4.0.5 and 4.4.10 have been satisfied:

C20

" Completion of the ISI program examinations of STP piping and component welds in accordance with the schedule requirements of the ASME Boiler and Pressure Vessel Code,Section XI (2004 Edition No Addenda)." Completion of ISI of piping and equipment, and component supports (excluding snubber assemblies) in accordance with the schedule requirements of the Code." Completion of ISI containment metal liner in accordance with the schedule re-quirements of the ASME Boiler and Pressure Vessel Code." Completion of the examinations of the RCP flywheels in accordance with the requirements of RGl.174.Reactor Vessel Nozzle Welds All STP large bore piping welds (nozzle welds) susceptible to pressurized water stress corrosion cracking (PWSCC) have been replaced or otherwise mitigated with the ex-ception of the Reactor Vessel nozzle welds. The reactor vessel nozzle welds are less of a concern in the GSI-191 analysis than other break locations because the reactor vessel is covered with reflective metal insulation (RMI), and the primary shield wall would protect the majority of fiberglass insulation in the steam generator compartments.

RCS leakage detection The leak detection program at STP is capable of early identification of RCS leakage to provide time for appropriate operator action before a flaw causing a leak would propagate to a, break. The effectiveness of this program is not reduced by the proposed licensing basis change to the risk-informed approach for GSI-191.C.6.3 Containment Integrity The evaluation of sump performance using a risk-informed approach is not a component of the analyses that demonstrate containment integrity.

Previous analyses show that the containment structure can withstand the peak pressures calculated without loss of integrity.

The containment remains a low leakage barrier against the release of fission products for the duration of the postulated LOCAs.Containment Design Basis The safety design basis for the containment is identified in GDC 50. The reactor containment structure, including access openings, penetrations, and containment heat removal systems, shall be designed so that the containment structure and its internal compartments can accommodate, without exceeding the design leakage rate and with sufficient margin, the calculated pressure and temperature conditions resulting from any loss of coolant accident.Containment Heat Removal The proposed change to the licensing basis does not involve any equipment changes beyond those modifications already made in response to the concerns raised in GSI-191.Thus there is no change to any of the containment heat removal components needed to maintain containment integrity.

Therefore the proposed change does not significantly impact the structural capability and integrity of the RCB as an effective fission product barrier post-LOCA.

The STP large, dry containments with safety-grade RCFCs are C21 likely to survive a significant core d(lnlage event, eveni with a loss of the colitaimnent emergency sump RCFCs are designed to operate independently in the post-LOCA environment and are not directly affected by the loss of the sump or containment sprays. This additional and independent capability to reject decay heat from containment ensures that the containment would not fail because of overpressure or overheating.

Although core melt could be postulated, containment integrity would be maintained by operation of the RCFCs and the RCB would continue to be maintained as an effective fission product barrier [18].Energy released to the containment atmosphere from the postulated accidents is re-moved by the CSS and RCFCs. STP has three groups of RCFCs with two fans and two heat exchangers in each group (total of six fans and heat exchangers).

The RCFCs are designed to remove heat from the containment during both normal operation and accident conditions.

In the event of an accident, all RCFCs are automatically placed into operation on receipt of a safety injection signal. During normal operation, cooling water flow to the RCFCs is supplied by the non-safety grade chilled water system. Following an accident, cooling water flow to the fan coolers is supplied by the safety-grade CCW.The RCFCs remove thermal energy from inside the containment to reduce the contain-ment atmosphere pressure and temperature following loss of offsite power (LOOP) or a DBA. The operation of four of six RCFC units (two of three trains), or three of six RCFC units and two of three CSS trains are required to reduce the peak pressure and temperature of the RCB following a DBA.Containment analyses consider operation of either two or three trains at the time of accident initiation.

LOCAs for a DEGB pump suction break consider both maximum and minimum SI to assure coverage of all failure modes for the DBA. Minimum SI is based on single-failure of a standby diesel generator (SDG). This represents the most substantial loss of engineered safety features (ESF) equipment.

ESF equipment lost with the SDG includes one train of SI, one train of CSS, one train of CCW to a RHR heat exchanger, and one train of RCFCs (two RCFC units).The STP design calls for two trains of SI, two trains of CSS, and two trains of RCFCs to be used for accident mitigation to yield acceptable containment peak pressure results that are less than the containment design pressure of 56.5 psig. Analysis indicates that RCB failure takes place at more than 140 psig.A study case has been performed to show that two LHSI pumps in the injection phase and one HHSI and one LHSI in the recirculation phase with zero CSS pumps and three RCFC trains gives acceptable results of containment pressure reaching 38.6 psig.Another case study shows that one LHSI pump in the injection phase and one HHSI and one LHSI in the recirculation phase with zero SI pumps and one RCFC train results in a peak containment pressure of 62.0 psig.Based on these study results, it is concluded that two trains of RCFCs are sufficient for containment heat removal if zero containment spray pumps are operating.

Thus containment integrity is maintained if all the CSS pumps are secured.C22 Other industry studies have indicated the ability of the containment systems to survive challenges of 2.5 to 3 times the design levels. The Zion Probabilistic Safety Study showed that the containment ultimate capacity was 2.55 to 2.86 times the design capacity.

Industry standard for large, dry containments is 2.5 to 3.0 times the design pressure limit [19].Containment Testing Technical Specification 6.8.3.j requires a Containment Leakage Rate Testing Program to be established to implement leakage rate testing of the containment as required by 10 CFR. 50.54(o) and 10 CFR 50, Appendix ., Option B, as modified by approved exemp-tions. This program is in accordance with the guidelines contained in RG 1.163 [20].The proposed change does not impact the requirements for structural integrity and leak-tightness of the containment and does not involve any changes to the containment leakage testing requirements for demonstrating the effectiveness of the containment as a low leakage barrier is maintained.

Testing requirements include RCB Integrated Leakage Rate Test (Type A), Containment Penetration Leakage Rate Test (Type B), and Containment Isolation Valve Leakage Rate Test (Type C) for compliance with Appendix A and Appendix J to 10 CFR Part 50.C.6.4 Emergency Plan Actions The proposed change to the licensing basis to use the methodology of a risk-informed ap-proach does not involve any changes to the Emergency Plans. There is no change to the strategies for prevention of core damage, for prevention of containment failure, or for con-sequence mitigation.

The use of the risk-informed approach does not impose any additional operator actions or complexity.

Implementation of the proposed change would not result in any changes to the response requirements for Emergency Response Personnel during an accident.

The STP DID approach includes the ability to detect, prevent, and mitigate post-LOCA strainer debris blockage and in-vessel debris blockage.C23 References

[1] NRC. Assessment of Debris Accumulation on Pressurized-Water Reactor Sump Per-formance.

Generic Safety Issue 191/ACRSR-2203, Nuclear Regulatory Commission, Washington, DC, August 1 2006.[2] NRC. Potential Impact of Debris Blockage on Emergency Sump Recirculation at Pressurized-Water Reactors.

Bulletin 2003-01, Nuclear Regulatory Commission, Washington, DC, June 9 2003.[3] NRC. Potential Impact of Debris Blockage on Emergency Recirculation During De-sign Basis Accidents at Pressurized-Water Reactors.

Generic Letter 2004-02, Nuclear Regulatory Commission, Washington, DC, September 13 2004.[4] Tom Jordan. Request for Additional Information Bulletin 2003-01. STPNOC Letter to NRC Document Control Desk NOC-AE-04001793 (ML043230288), Wadsworth, TX, November 11 2004.[5] Tom Jordan. 60 Day Response to Bulletin 2003-01. STPNOC Letter to NRC Document Control Desk NOC-AE-03001569 (ML032270462), STPNOC, Wadsworth, TX, August 7 2003.[6] Tom Jordan. Response to a Request for Additional Information Regarding the 60 Day Response to Bulletin 2003-01: Potential Impact of Debris Blockage on Emergency Sump Recirculation at Pressurized-Water Reactors (TAC Nos. MB9615 and MB9616).STPNOC Letter to NRC Document Control Desk NOC-AE-05001883 (ML052000279), Wadsworth, TX, July 13 2005.[7] Tom Jordan. 90-Day Response to Generic Letter 2004-02: Potential Impact of Debris Blockage on Emergency Recirculation during Design Basis Accidents at Pressurized-Water Reactors.

STPNOC Letter to NRC Document Control Desk NOC-AE-05001862 (ML050770105), Wadsworth, TX, March 8 2005.[8] Tom Jordan. Supplement 1 to the Response to Generic Letter 2004-02 (TAC Nos.MC4719 and MC4720). STPNOC Letter to NRC Document Control Desk NOC-AE-05001922 (ML052500311), Wadsworth, TX, 2005.[9] David W. Rencurrel.

Proposed Change to Surveillance Requirement 4.5.2.d. STPNOC Letter to NRC Document Control Desk NOC-AE-07002156 (ML0715605), Wadsworth, TX, May 21 2007.[10] David W. Rencurrel.

Response to NRC Request for Additional Information on Pro-posed Change to Surveillance Requirement 4.5.2.d (TAC Nos. MD5705, MD5706).STPNOC Letter to NRC Document Control Desk NOC-AE-07002225 (ML073380340), Wadsworth, TX, November 26 2007.[11] NRC. Safety Evaluation by the Office of Nuclear Reactor Regulation Related to Amendment Nos. 183 and 170 to Facility Operating License Nos. NPF-76 and NPF-80 STP Nuclear Operating Company, et al., South Texas Project, Units 1 and 2, Docket C24 Nos. 50-498 and 50-499. Technical Report ML080360321, Nuclear Regulatory Com-mission, Washington, DC, March 25 2008.[12] David W. Rencurrel.

Supplement 4 to the Response to Generic Letter 2004-02 (TAC Nos. MC4719 and MC4720). STPNOC Letter to NRC Document Control Desk NOC-AE-08002372 (ML083520326), Wadsworth, TX, December 11 2008.[13] Nuclear Regulatory Commission.

AN APPROACH FOR USING PROBABILISTIC RISK ASSESSMENT IN RISK-INFORMED DECISIONS ON PLANT-SPECIFIC CHANGES TO THE LICENSING BASIS. Regulatory Guide 1.174 (Revision 2), Nu-clear Regulatory Commission, Washington, DC, 2011.[14] NRC. Safety Evaluation by the Office of Nuclear Reactor Regulation Related to Safety Evaluation by the Office of Nuclear Reactor Regulation for Request for Relief No.RR-ENG-3-04.

SER, September 10 2012.[15] NEI. "Pressurized Water Reactor Sump Performance Evaluation Methodology," Vol-ume 1 "Pressurized Water Reactor Sump Performance Evaluation Methodology," Revi-sion 0. Technical Report 04-07, ML050550138, Nuclear Energy Institute, Washington, DC, December 2004.[16] NEI. Pressurized Water Reactor Sump Performance Evaluation Methodology, Vol-ume 2 "Safety Evaluation by the Office of Nuclear Reactor Regulation Related to NRC Generic Letter 2004-02, Revision 0, December 6, 2004. Technical Report 04-07, ML050550156, Nucelar Energy Institute, Washington, DC, December 2004.[17] John C. Butler. Defense-In-Depth Measures in Support of GSI-191 Resolution Op-tions. NEI Letter to to Stewart N. Bailey NRC ML 120730661, Nucelar Energy Institute, Washington, DC, March 5 2012.[18] NRC. Regulatory Analysis for USI A-43, "Containment Emergency Sump Perfor-mance". Technical Report NUREG-0869, Revision 1, Nuclear Regulatory Commission, Washington, DC, December 5 1985.[19] NRC. Containment Performance Working Group Report. Technical Report NUREG-1037 (DRAFT, unpublished), Nuclear Regulatory Commission, Washington, DC, May 1985.[20] NRC. Performance-Based Containment Leak-Test Program. Regulatory Guide 1.163, Nuclear Regulatory Commission, Washington, DC, September 1995.C25