Text

License Amendment Request: Containment Fan Cooler Unit (Cfcu) Allowed Outage Time (AOT) Extension
	ML17065A241
Person / Time
Site:	Salem
Issue date:	03/06/2017
From:	Mcfeaters C; Public Service Enterprise Group
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	LAR S16-04, LR-N16-0173
	Download: ML17065A241 (150)
	v • d • e

LR-N16-0173 LAR S16-04 MAR 0 6 2017 PSEG Nuclear LLC P.O.

Box 236, Hancocks Bridge, NJ 08038-0236 10 CFR 50.90 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D.C. 20555-0001

Subject:

Salem Nuclear Generating Station Units 1 and 2 Renewed Facility Operating License Nos. DPR-70 and DPR-75 NRC Docket Nos. 50-272 and 50-311 License Amendment Request: Salem Containment Fan Cooler Unit (CFCU) Allowed Outage Time (AOT) Extension In accordance with 10 CFR 50.90, PSEG Nuclear LLC (PSEG) hereby requests an amendment to Renewed Facility Operating License Nos. DPR-70 and DPR-75 for Salem Nuclear Generating Station Units 1 and 2. In accordance with 10 CFR 50.91(b)(1), a copy of this request for amendment has been sent to the State of New Jersey.

This license amendment request proposes changes to Technical Specification (TS) 3.6.2.3, "Containment Cooling System." The proposed change would increase the containment fan coil unit (CFCU) allowed outage time (AOT) from 7 days to 14 days for one or two inoperable CFCUs. The proposed extended AOT is based on application of the Salem Generating Station (SGS) Probabilistic Risk Assessment (PRA) in support of a risk-informed extension, and on additional considerations and compensatory actions. The risk evaluation and deterministic engineering analysis supporting the proposed change have been developed in accordance with the guidelines established in NRC Regulatory Guide 1.177, "An Approach for Plant-Specific Risk-Informed Decisionmaking: Technical Specifications," and NRC Regulatory Guide 1.174, "An Approach for using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant Specific Changes to the Licensing Basis."

The proposed change will allow increased flexibility in the scheduling and performance of corrective and preventive maintenance, improve CFCU reliability, allow better control and allocation of resources and avert unplanned plant shutdowns.

MAR 0 6 2017 Page 2 LR-N16-0173 10 CFR 50.90 PSEG's technical and regulatory evaluation of this LAR and the TS changes are provided in Attachments 1 and 2 respectively. Enclosure 1 provides the supporting risk-informed evaluation of the proposed change, including an evaluation of the technical adequacy of the PRA in accordance with Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk Informed Activities."

The proposed change has been evaluated in accordance with 10 CFR 50.91 (a)(1 ), using the criteria in 10 CFR 50.92(c), and it has been determined that this request involves no significant hazards considerations.

There are no regulatory commitments contained in this letter.

These proposed changes have been reviewed by the Plant Operations Review Committee.

PSEG requests NRC approval of the proposed License Amendment within one year of submittal to be implemented within 60 days of issuance.

If you have any questions or require additional information, please contact Mr. Lee Marabella at (856) 339-1208.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on ----'3,_*..L../-=-C---'/--'-I__f_?

(Date)

Respectfully/' 1 --------

[/r

Charles V. McFeaters Site Vice President Salem Generating Station Attachments:

1.

Request for Changes to Technical Specifications

2.

Technical Specification Pages with Proposed Changes

Enclosure:

1.

Salem PRA Analysis for CFCU AOT Extension

MAR 0 2017 Page 3 LR-N16-0173 C.

Administrator, Region I, NRC Project Manager, NRC NRC Senior Resident Inspector, Salem Mr. P. Mulligan, Chief, NJBNE Mr. L. Marabella, Corporate Commitment Tracking Coordinator Mr. T. Cachaza, Salem Commitment Tracking Coordinator 10 CFR 50.90

LR-N16-0173 Request for Changes to Technical Specifications

LR-N16-0173 LAR S16-04 Page 1 SALEM NUCLEAR GENERATING STATION RENEWED FACILITY OPERATING LICENSE NOS. DPR-70 AND DPR-75 DOCKET NO. 50-272 AND 50-311 License Amendment Request : Salem Containment Fan Cooling Unit (CFCU) Allowed Outage Time (AOT) Extension Table of Contents

1.0 DESCRIPTION

.2

2.0 PROPOSED CHANGE

2

3.0 BACKGROUND

....2

4.0 TECHNICAL ANALYSIS

.....7

5.0 REGULATORY ANALYSIS

...14 5.1 No Significant Hazards Consideration.....14 5.2 Applicable Regulatory Requirements and Criteria............16

6.0 ENVIRONMENTAL CONSIDERATION

17

7.0 REFERENCES

.17

LR-N16-0173 LAR S16-04 Page 2

1.0 DESCRIPTION

This license amendment request proposes a change which would revise Salem Units 1 and 2 Technical Specification (Reference 1) (TS) ACTION 3.6.2.3.a and ACTION 3.6.2.3.b concerning one or two inoperable containment cooling fans. The proposed change would increase the Containment Fan Cooling Unit (CFCU) allowed outage time (AOT) from 7 days to 14 days for one or two inoperable CFCUs. The proposed change is based on application of the Salem Generating Station (SGS) Probabilistic Risk Assessment (PRA) in support of a risk-informed extension, and on additional considerations and compensatory actions.

In addition, a minor typographical error is being corrected in TS ACTION 3.6.2.3.b changing the undefined word WITHIN to lower case within.

2.0 PROPOSED CHANGE

The proposed TS changes (Unit 1 and 2 changes are identical) are described below and are indicated on the marked up TS pages provided in Attachment 2 of this submittal.

1. TS 3.6.2.3 ACTION a is being revised as shown below:

With one or two of the above required containment cooling fans inoperable, restore the inoperable fan(s) to OPERABLE status within 7 14 days or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

2. TS 3.6.2.3 ACTION b is being revised as shown below:

With three or more of the above required containment cooling fans inoperable, restore at least three cooling fans to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or be in at least HOT STANDBY WITHIN within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

Restore the remaining inoperable cooling fans to OPERABLE status within 7 14 days of initial loss or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

3.0 BACKGROUND

3.1 Containment Fan Cooling System Containment cooling is an engineered safeguard system. CFCUs, along with Containment Spray, provide the design containment cooling function and depressurization during design basis loss of coolant accident (LOCA) and main steam line break (MSLB) conditions.

Furthermore, the CFCUs provide mixing of the containment atmosphere, which supports the iodine removal function of the containment spray system. During a LOCA (slow speed operation), the CFCUs draw the containment atmosphere through the moisture separators, HEPA filters, cooling coil, fan and ductwork.

LR-N16-0173 LAR S16-04 Page 3 The containment fan cooling system is designed to remove heat from the containment during normal operation, and remove heat and reduce pressure in the containment following a Loss of Coolant Accident (LOCA). The system consists of five air handling units, each including motor, fan, motor heat exchanger, cooling coils, roughing filters, dampers, duct distribution system, instrumentation, and controls. The CFCUs are powered from three separate vital buses as follows: one CFCU is powered from the A vital bus and two CFCUs are powered from each of the B and C vital buses. This ensures that, in the event of a single failure of a vital bus, the minimum number of three CFCUs required to maintain containment integrity would remain available during a design basis event.

Each fan is designed to supply a nominal 110,000 cubic feet per minute (cfm) during normal (high speed) operation and 40,000 cfm during accident (low speed) operation. The fans are direct driven, centrifugal type, and the coils are plate fin and tube type. Each fan-cooler unit is capable, taking into consideration tube fouling, of removing at least 44 x 106 Btu/hr or a cumulative heat transfer rate of 132 x 106 Btu/hr. for three fan-cooler units from the containment atmosphere under accident conditions. This heat transfer rate exceeds the analyzed value assumed in the analysis of containment pressure response to a spectrum of Reactor Coolant System (RCS) and steam line breaks described in the Salem Updated Final Safety Analysis Report. A minimum of 1,300 gpm of service (cooling) water is supplied to each unit during accident conditions. The design maximum river water inlet temperature is 90°F.

The containment fan cooling system is designed to maintain the containment atmosphere at less than or equal to 120°F during normal operation. In the event of a LOCA the system is designed to ensure that the containment pressure will not exceed its design value of 47 psig at 271°F (100-percent relative humidity). Although the water in the core after a LOCA is quickly subcooled by the Emergency Core Cooling System (ECCS), the containment fan cooling system is designed on the conservative assumption that the core residual heat is released to the containment as steam. The system is actuated (in the post-accident mode) by a safety injection signal. The fan cooler units continue to remove heat after the LOCA and reduce the containment pressure close to atmospheric within the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Duct work distributes the cooled air to the various containment compartments and areas.

During normal operation, the flow sequence through each air handling unit is as follows: inlet dampers, roughing filters, cooling coils, fan, discharge header. During post-accident operation, air is drawn through a moisture separator, a post-accident high-efficiency particulate air (HEPA) filter section and cooling coils and is discharged to the duct header.

3.2 Service Water System Cooling to the CFCUs is provided by the service water (SW) system. The SW system consists of six vertical turbine-type pumps, two per each of the three vital buses. In the event of a Loss of Offsite Power (LOOP), the SW pumps stop, and are sequenced back on via the Safeguards Equipment Controller (SEC) logic. Two 15,000 gallon pressurized accumulators (10,000 gallon normal water volume) are connected to the CFCU supply headers. These normally-isolated tanks are designed to be rapidly placed in service through fast opening isolation valves in order to keep the CFCU SW piping solid following a LOCA or MSLB concurrent with a LOOP event prior to the restart of the SW pumps.

Emergency diesel generators (EDGs) are provided to power one pump per bus (three pumps total) during a failure of normal power supply. A single failure of an EDG or vital bus results in

LR-N16-0173 LAR S16-04 Page 4 two operating SW pumps, which is the minimum safeguards requirement. The CFCUs are supplied by individual lines from the containment SW header. Each inlet and discharge line penetrating the containment wall is provided with a remotely-operated isolation valve. This provision allows each fan cooler to be isolated on an individual basis from outside the containment area.

The following table provides a summary the main components described above with a brief description of how each component functions during normal operation and during the design basis accident.

Component Normal Operating Function Normal Operating Arrangement Accident Function Accident Arrangement (Minimum Safeguards)

CFCUs (5)

Circulate and cool containment atmosphere Up to four fan units in service Circulate, depressurize and cool containment atmosphere Three fan units in service SW Pumps (6)

Supply river water to CFCUs Two to four pumps in service depending on river temperature Supply river water to CFCUs Two pumps in service Seasonal CFCU and SW Systems normal operating configurations typically range between four CFCUs and four SW pumps in service during summer months and three CFCUs and two SW pumps during winter months. During environmental conditions (peak summer heat) when three CFCUs could be insufficient to maintain containment temperature less than 120 degrees F, CFCU maintenance is not normally scheduled to ensure TS 3.6.1.5 containment temperature limits for continued operation will be maintained. This applies for both the existing TS AOT of 7 days and the proposed AOT of 14 days.

The following table shows the normal power supplies for both the SW Pumps and the CFCUs:

Component Vital Bus Power Supply 11 SW Pump 1C 12 SW Pump 1C 13 SW Pump 1B 14 SW Pump 1B 15 SW Pump 1A 16 SW Pump 1A 21 SW Pump 2A 22 SW Pump 2A 23 SW Pump 2B 24 SW Pump 2B 25 SW Pump 2C 26 SW Pump 2C Component Vital Bus Power Supply 11 CFCU 1A 12 CFCU 1B 13 CFCU 1C 14 CFCU 1B 15 CFCU 1C 21 CFCU 2A 22 CFCU 2B 23 CFCU 2C 24 CFCU 2B 25 CFCU 2C

LR-N16-0173 LAR S16-04 Page 5 3.3 Maintenance Rule Program The Maintenance Rule (MR) requires that an evaluation be performed when equipment covered by the MR does not meet its performance criteria. The reliability and availability of the CFCUs are monitored under the MR program. If the pre-established reliability or availability performance criteria are not achieved for the CFCUs, they are considered for 10 CFR 50.65(a)(1) actions. These actions would require increased management attention and goal setting in order to restore their performance to an acceptable level. The actual out of service time for the CFCUs is minimized to ensure that the reliability and availability performance criteria are met.

The current Salem MR status is green (minimal risk - no actions required) for all ten Unit 1 and Unit 2 CFCUs, with the 18-month rolling average unavailability as of 09/21/2016 for each CFCU as shown below. The demarcation limit between green and yellow (medium risk - consider/take appropriate compensatory actions) status is 850 unavailability hours (18-month rolling average).

CFCU Unavailability (hours) 11 159.41 12 185.41 13 264.00 14 120.87 15 86.93 21 174.56 22 249.70 23 96.02 24 241.84 25 250.85 The CFCU MR status is not expected to be adversely impacted by the proposed amendment.

3.4 Configuration Risk Management Program (CRMP)

Risk associated with unavailable plant equipment such as CFCUs is assessed at Salem as required by 10 CFR 50.65(a)(4). The PSEG work management administrative procedure governs on-line risk assessments. The on-line risk assessment is a blended approach using qualitative or defense-in-depth considerations and quantifiable PRA risk insights when available to complement the qualitative assessment. Salem communicates on-line plant risk using three risk tiers (GREEN, YELLOW, and RED). The criteria for these tiers are as follows:

LR-N16-0173 LAR S16-04 Page 6 Configuration Risk Management Criteria Color Risk Threshold(5)

Required Action Green ICDP(1) <1E-6 for 7 day duration AND No LOOP High Risk Evolution (HRE)

AND ILERP(2) <1E-7 for 7 day duration No specific actions are required.

Yellow ICDP(1) >1E-6 AND <1E-5 for 7 day duration OR LOOP High Risk Evolution (HRE)

OR ILERP(2) >1E-7 AND <1E-6 for 7 day duration Limit the unavailability time by establishing a continuous work schedule or provide justification.

Protect SSCs which would cause an unplanned entry into a Red risk condition if lost concurrent with other SSCs being unavailable for maintenance.

Red ICDP(1) >1E-5 for 7 day duration OR ILERP(2) >1E-6 for 7 day duration It is unacceptable to voluntarily enter this condition.

IF an emergent condition causes, or degradation may cause an unplanned entry into this condition, immediate actions shall be taken to restore and/or protect SSCs relied upon to mitigate events, and to contact the station duty manager for direction and support.

(1) Incremental Core Damage Probability (2) Incremental Large Early Release Probability The on-line risk level for both Salem units will remain GREEN when two CFCUs are unavailable. At this level, risk is considered close to baseline, and compliance with technical specification requirements may be considered adequate risk management. Nevertheless, the station protected equipment program requires protection of the remaining CFCUs and one of the two containment spray (CS) pumps. The program also requires protection of emergency diesel generators (EDGs) that supply emergency power to the remaining CFCUs. Protecting equipment requires posting of signs and robust barriers to alert personnel not to approach the protected equipment. Work on protected equipment is generally disallowed. Minor exceptions exist for activities such as inspections, security patrols, or emergency operations. Other exceptions may be authorized by the station shift manager in writing. If additional unplanned equipment unavailability occurs, station procedures direct that the risk be re-evaluated, and if found to be unacceptable, compensatory actions are taken until such a time that the risk is reduced to an acceptable level.

LR-N16-0173 LAR S16-04 Page 7 3.5 Current TS Requirements and Limitations The LIMITING CONDITION FOR OPERATION (LCO) for TS 3.6.2.3 requires five containment cooling fans to be OPERABLE to ensure that adequate heat removal capacity is available when operated in conjunction with the containment spray systems during post LOCA and MSLB conditions. As described in Salem UFSAR (Reference 2) section 6.2.2, "Containment Heat Removal Systems," a minimum of three containment fan coil units in operation with a single containment spray train is capable of maintaining post-accident containment temperature and pressure below their design basis values, assuming a worst-case single active failure.

The TS ACTION statement a currently requires restoration of one or two containment cooling fans found to be inoperable within 7 days or the plant to be in HOT STANDBY (MODE 3) within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN (MODE 5) within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

The TS ACTION statement b applies when 3 or more containment cooling fans are inoperable and requires the restoration of at least three cooling fans to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or the plant to be in at least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . It also currently requires restoration of all remaining inoperable containment cooling fans to OPERABLE status within 7 days of initial loss or the plant to be in HOT STANDBY (MODE 3) within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . Extension of the AOT from 7 to 14 days will allow more time to perform maintenance to avoid shutdown.

3.6 Operating Experience There have been nine emergent corrective maintenance orders over the time interval of September 2014 through January 2016 that were required to be completed which invoked TS Action Statement (TSAS) 3.6.2.3. One such order involved the 14 CFCU which was declared inoperable in March 2015 and resulted in a plant shutdown following the 7 day AOT period.

Two of the orders, involving a 24 CFCU motor cooler leak and a SW valve associated with the 25 CFCU failed stroke time, resulted in being in the TSAS for approximately 5 days. There is minimal work scope on the SW side of the CFCUs that is considered planned maintenance that invokes the entry into this TSAS. PSEG does not normally schedule any planned maintenance that would exceed 50% of the LCO AOT window. Some of the emergent work that invokes entry into this TSAS includes emergent work orders on the containment isolation air operated valves, CFCU motor cooler inspections following gasket leaks, and issues with the fast acting air operated valves for the SW accumulators. Due to the short LCO window, these emergent issues result in a major challenge to the work week process and require critical resources to be re-aligned to correct the emergent issue and clear the short duration LCO.

4.0 TECHNICAL ANALYSIS

This section provides the technical analysis of the proposed changes with regard to the principles that adequate defense-in-depth is maintained, sufficient safety margins are maintained, and the calculated increases in core damage frequency (CDF) and large early release frequency (LERF) are small and consistent with the guidance of RG 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Bases," dated May 2011 and RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," dated May 2011.

LR-N16-0173 LAR S16-04 Page 8 4.1 Current Licensing Basis for Containment Cooling Fans Allowed Outage Time Under the current TS, if one or two containment cooling fans are inoperable in MODES 1, 2, 3 or 4, action is taken to restore the inoperable cooling fans to operable status within 7 days. In this Condition, the three remaining operable cooling fans are adequate to provide the minimum containment cooling as assumed by the containment response analysis for a design-basis LOCA or MSLB event.

4.2 Proposed TS 3.6.2.3 Change and Benefits The proposed change will allow, for one or two CFCUs, an AOT of 14 days for maintenance activities. This will permit an additional 7 days beyond the current TS allowed AOT of 7 days and avoid or minimize TS required plant shutdowns due to CFCU maintenance or testing.

Implementation of this proposed AOT extension will provide the following benefits:

Allow increased flexibility in the scheduling and performance of preventive maintenance.

Allow better control and allocation of resources.

Avert unplanned plant shutdowns. Risks incurred by unexpected plant shutdowns can be comparable to and often exceed those associated with continued power operation.

The proposed Allowed Outage Time of 14 days supports maintenance that would involve the simultaneous unavailability of up to two CFCUs. While PSEG would normally take one CFCU at a time out of service, the TS allowance for two CFCUs out of service provides needed operational flexibility. One such example would be if a major maintenance activity were to be scheduled for a CFCU and a leak was discovered during an inspection of another CFCU.

Another example would be if one of the two SW accumulators were to be isolated for maintenance, which would make two CFCUs inoperable (either the 11(21) and 12(22) pair, or the 14(24) and 15(25) pair, depending on the SW accumulator removed from service).

A historical review of CFCU preventative and corrective maintenance shows that the longest duration maintenance outages are due to SW control valves and CFCU motor replacements.

Durations for scheduled preventative maintenance typically result in a CFCU unavailability window of approximately 10 to 50 hours5.787037e-4 days 0.0139 hours 8.267196e-5 weeks 1.9025e-5 months . With regard to emergent corrective maintenance, the CFCU unavailability has ranged from approximately 50 to 200 hours0.00231 days 0.0556 hours 3.306878e-4 weeks 7.61e-5 months in duration.

This change will allow some maintenance activities to be performed on-line which would otherwise require performance during a refueling outage, such as replacement of SW system valves associated with the CFCUs. On-line preventive maintenance and scheduled major repairs or replacements provide the flexibility to focus more quality resources on any corrective or elective CFCU maintenance. For example, during refueling outages, resources are required to support many system outages; while, during on-line maintenance, plant resources are focused on the CFCU repair.

4.3 Deterministic Assessment of Proposed CFCU AOT Extension The proposed change would allow continued power operation up to an additional 7 days while CFCU maintenance or testing is performed. The CFCU arrangement of five fan units, of which

LR-N16-0173 LAR S16-04 Page 9 only three are required, provides adequate cooling capacity during design basis events (LOCA/MLSB) to maintain containment pressure and temperature below design basis limits.

The assumptions and the results of the containment pressure response analyses are not changed by an extension of the AOT. In addition, the effectiveness of maintenance on the CFCUs and support systems is monitored pursuant to the Maintenance Rule. Conservatisms include:

Actual CFCU heat removal capacity at the peak containment temperature of 265.9 degrees F (44 MBtu/hr) (Reference 6) exceeds the assumed containment analysis heat removal (36.44 MBtu/hr.)

Actual SW flow during accident conditions (1630 gpm in limiting SW accident alignment) is greater than the assumed value of 1300 gpm Assumed SW temperature in the Containment Response Analysis (93 degrees F for determining CFCU heat removal capacity; 95 degrees F as input to the Component Cooling Heat Exchangers) is greater than the design value of 90 degrees F.

Based on the above discussion, extending the AOT for one or two inoperable CFCUs from 7 days to 14 days is acceptable because the proposed change will not impact the plant design basis. The impact of extended plant operation with less than the installed equipment redundancy is evaluated in a probabilistic framework in the discussions that follow.

To ensure that the single failure design criterion is met, Limiting Conditions for Operation (LCOs) are specified in the plant TS requiring all 5 CFCUs to be operable. In the event that one or two CFCUs are inoperable in operating Modes 1, 2, 3 and 4 existing TS 3.6.2.3 ACTION a and ACTION b require the inoperable cooling fan(s) to be restored to OPERABLE status. When the required operability is not maintained, action is required within a specified time period to initiate a plant shutdown and place the plant in a safe condition. The AOT provides a limited time to restore equipment to operable status and represents a balance between the risk associated with continued plant operation with less than the required system or component redundancy and the risk associated with initiating a plant transient while transitioning the unit.

Thus, while the AOTs provided in the plant TS are designed to permit limited operation with temporary relaxation of the single failure criterion, the acceptability of the maximum length of the AOT interval relative to the potential occurrences of design basis events needs to be considered. Since extending the AOT for one or two inoperable CFCUs does not change the design basis of the Containment Cooling System to recirculate and cool the containment atmosphere in the event of a LOCA/MSLB and thereby ensures that the containment pressure will not exceed its design value of 47 psig at 271 degrees F, the risk impact of CFCU unavailability during the extended AOT interval (days 8 through 14 of the proposed 14 day AOT) must be evaluated quantitatively using a probabilistic approach.

If this LAR is not granted, a condition where one or two CFCUs are inoperable would require a plant shutdown following 7 days in current TS 3.6.2.3 ACTION a and ACTION b. Shutdown of the plant involves many plant operator activities and plant evolutions. These activities and evolutions provide challenges to plant equipment, opportunities for operator errors and increase the possibility of a plant trip. By granting this LAR and allowing continued steady state operation, additional operator activities and plant operations evolutions associated with plant shutdown would be avoided. The increased possibility for plant trip may also be avoided. This LAR proposes an additional 7 days as a reasonable time for AOT extension.

LR-N16-0173 LAR S16-04 Page 10 4.4 Risk Assessment Plant configuration changes for required maintenance of the CFCUs as well as the maintenance of any equipment having risk significance are managed by the Configuration Risk Management Program (CRMP). The CRMP helps ensure that these maintenance activities are carried out with no significant increase in the risk of a severe accident.

The proposed changes are evaluated to determine that current regulations and applicable requirements continue to be met, that adequate defense-in-depth and sufficient safety margins are maintained, and that any increase in core damage frequency (CDF) and large early release frequency (LERF) is small and consistent with the NRC Safety Goal Policy Statement, USNRC, "Use of Probabilistic Risk Assessment Methods in Nuclear Activities: Final Policy Statement,"

Federal Register, Volume 60, p.42622, August 16, 1995. In addition, even though the Salem PRA model is a single unit model based on Unit 1, there are no relevant differences between Unit 1 and Unit 2 that would affect this CFCU AOT extension.

The justification for extending the AOT of one or two CFCU from 7 to 14 days is based upon risk informed and deterministic evaluations consisting of three main elements:

Tier 1: Assessment of the impact of the proposed TS change using a valid and appropriate PRA model and compare with appropriate acceptance guidelines.

o The proposed changes associated with the extended CFCU AOT are evaluated using the Salem PRA Model of Record (MOR) to determine that current regulations and applicable requirements continue to be met, that adequate defense-in-depth and sufficient safety margins are maintained, and that any increase in core damage frequency (CDF) and large early release frequency (LERF) is small and consistent with the acceptance guidelines in Enclosure 1.

Tier 2: Evaluate equipment relative to the contribution to risk while two CFCUs are in the extended AOT.

o Out of service combinations can be evaluated for their risk significance to determine if additional measures may be required.

Tier 3: Implementation of the Configuration Risk Management Program (CRMP) while one or two CFCUs are in an extended AOT.

o The CRMP is used for all work and helps ensure that there is no significant increase in the risk due to a severe accident while CFCU maintenance is performed. These elements provide adequate justification for approval of the requested Technical Specification change by providing a high degree of assurance that any increase in risk is acceptable during the CFCU extended AOT for all Design Basis Accidents (DBAs) and 10 CFR 50 Appendix R fire requirements during the CFCU AOT.

The Tier 1 and Tier 2 evaluations, which include discussion of internal and external hazards, are provided in Enclosure 1. Tier 3 is discussed in Sections 3.3 and 3.4 of this Attachment. also includes documentation demonstrating that the Salem internal events PRA is a

LR-N16-0173 LAR S16-04 Page 11 thorough and detailed PRA model that is robust and capable of supporting the risk-informed decision to increase the AOT for one or two inoperable CFCUs from 7 days to 14 days.

4.4.1 Compensatory Measures PSEG maintenance practices involve protecting other equipment coincident with maintenance being performed on CFCUs. If two CFCUs are unavailable, PSEG procedures require the other CFCUs and one Containment Spray pump to be protected to prevent concurrent unavailability.

The PRA Model Of Record (MOR) directly accounts for this maintenance practice and is reflected in the quantitative analysis.

In addition, procedures direct the plant personnel to routinely monitor various maintenance configurations and protect equipment that could lead to an elevated risk condition (e.g., red risk condition) if it were to become unavailable due to unplanned or emergent conditions. This is normally accomplished using a predictive PRA software tool based on the PRA MOR, i.e.,

EOOS Configuration Risk Monitor program from the Electric Power Research Institute (EPRI).

Based on the very small risk increase involving the configuration analyzed in this LAR, there is no further need for additional compensatory measures or quantification other than the existing programs stated above.

4.4.2 Other Considerations The CRMP will ensure that the plant state is monitored to minimize the risk impact of the change.

4.4.3 Discussion of Risk Due to External Events Salem does not have separate probabilistic risk assessments (PRA) for Fire, External Flood or Seismic events. An internal Fire PRA (FPRA) is currently under development. The FPRA was developed as part of the station license renewal project. However, the FPRA did not undergo an industry peer review as required by NRC Regulatory Guide 1.200 for use in risk informed regulatory applications. The current version, which follows the methodology of NUREG/CR-6850 with some incorporation of more recent data and methods, can be used to provide valuable insights, but not quantitative information. Seismic events are not currently included in the MOR.

Like most nuclear power stations, Salem completed an Individual Plant Examination of External Events (IPEEE) in 1996. A report summarizing the major findings states that fire and seismic events were the only important contributors to external events core damage. The fire related CDF was 2.3E-05 per year. The seismic related CDF was 9.5E-06 per year using a more conservative hazard curve (Lawrence Livermore National Laboratory) and 4.7E-06 per year using a curve described as more realistic (EPRI). Section 1.4.3 of the IPEEE explains how the risk of High Winds, External Flood and other external events were screened out as insignificant.

The risk due to fire and seismic events is discussed in Enclosure 1, Sections 3.4.7 and 3.4.8 respectively.

LR-N16-0173 LAR S16-04 Page 12 4.4.4 Uncertainties In addition to the assessment of the mean risk metrics which are specified in RG 1.177 and 1.174 for comparison with the acceptance guidelines, it is also prudent to examine whether modeling uncertainties may distort these comparisons.

Therefore, an extensive review of potential modeling uncertainties that may impact the risk metrics was performed. To this end, NUREG-1855 and the companion EPRI guideline on the treatment of uncertainties were used. Section 5 of Enclosure 1 provides perspectives on the identification and disposition of various uncertainties.

4.4.5 PRA Quality Revision 0 of the analysis in Enclosure 1 utilized PRA Model SA112A. Subsequent to the completion of the analysis, an updated PRA MOR (SA115A) was finalized in December 2016.

This PRA model incorporated the newly installed fourth Auxiliary Feed Water (AFW) pump and use of FLEX equipment to help mitigate extended SBO scenarios. Therefore, it was deemed appropriate to revise the original CFCU AOT extension analysis to include a sensitivity analysis to review the results that would be obtained using the PRA MOR. The results of the study, presented in Table 5-7 of Enclosure 1, showed that the incremental risk was actually smaller than that calculated using the PRA Model SA112A.

The Salem PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, and common cause events. The PRA model quantification process used for the Salem PRA is based on the event tree and linked fault tree methodology, which is a well-known methodology in the industry.

PSEG employs a multi-faceted approach to establishing and maintaining the technical adequacy and plant fidelity of the PRA models for all PSEG nuclear generation. This approach includes a proceduralized PRA maintenance and update process, which includes consideration of peer review Facts and Observations (F&Os) and their subsequent resolution. PRA quality is assured for the Salem PRA model and documentation through a combination of the following:

Confirmation of the fidelity of the model with the as-built, as-operated plant Use of methods and approaches consistent with the ASME PRA Standard Use of an Updating Requirement Evaluation (URE) database to track PRA model issues and potential enhancements Use of a PRA Peer Review to identify areas for enhancement Use of highly qualified PRA practitioners qualified under the PSEG PRA Risk Management Program Use of internal reviews and interviews with system engineers and operating crew members

LR-N16-0173 LAR S16-04 Page 13 4.4.6 Conclusion The quantitative results of the evaluation are shown in the table below:

RESULTS OF RISK EVALUATION FOR SALEM RISK METRIC RISK METRIC RESULTS RISK SIGNIFICANCE GUIDELINE MEETS ACCEPTANCE GUIDELINE CDF(/yr) 5.61E-08 RG 1.174 Yes(1)

LERF(/yr) 2.15E-10 RG 1.174 Yes(1)

ICCDPCFCU 2.80E-08

< 1.0E-06 Yes ICLERPCFCU 1.08E-10

< 1.0E-07 Yes Table Note:

(1) - Region III of RG 1.174 - very small risk

where, CDF(/yr)

= Difference between CDF with current technical specifications and the CDF for an average 18 month cycle with three instances of concurrent unavailability of two CFCUs extended to 14 days.

LERF(/yr) = Difference between LERF with current technical specifications and the CDF for an average 18 month cycle with three instances of concurrent unavailability of two CFCUs extended to 14 days.

ICCDPCFCU

= Incremental conditional core damage probability with two CFCUs out-of-service for an interval of time equal to the proposed new Allowed Outage Time (14 days).

ICLERPCFCU = Incremental conditional large early release probability with two CFCUs out-of-service for an interval of time equal to the proposed new Allowed Outage Time (14 days).

The proposed modification to the Technical Specifications is acceptable based on the risk change calculated with the Salem PRA for the proposed CFCU AOT extension for any two simultaneously unavailable CFCUs.

The ICCDP and ICLERP for an unavailable pair of CFCUs are sufficiently below the Reg. Guide 1.177 guidelines of <1.0E-06 and <1.0E-07, respectively, to be able to call the risk change small. Hence, the guidelines for the increased CFCU Allowed Outage Time have been met.

LR-N16-0173 LAR S16-04 Page 14 Furthermore, the calculation of changes in CDF and LERF due to the extended CFCU AOT has been shown to meet the risk significance criteria of Regulatory Guide 1.174, i.e., Region III which represents very small risk changes.

These calculations support the increase in the extended AOT up to a period of 14 days for any one or two CFCUs that are unavailable from a quantitative risk-informed perspective, so long as the plant operational and maintenance practices are in reasonable agreement with the assumptions made in this evaluation.

5.0 REGULATORY ANALYSIS

This license amendment request proposes changes to the Salem Generating Station Unit 1 and Unit 2 (Salem) Technical Specifications (TS) concerning one or two containment fan cooling units (CFCUs). The proposed change would extend the Allowed Outage Time (AOT) for one or two inoperable CFCUs from 7 days to 14 days. The proposed new allowed outage time (AOT) is based on application of the Salem Probabilistic Risk Assessment (PRA) in support of a risk-informed extension, and on additional considerations and compensatory actions. The risk evaluation and deterministic engineering analysis supporting the proposed change were developed in accordance with the guidelines established in Regulatory Guide 1.177, "An Approach for Plant-Specific Risk-informed Decisionmaking: Technical Specifications," and Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis."

5.1 No Significant Hazards Consideration PSEG has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, Issuance of amendment, as discussed below:

1.

Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The containment fan cooling units (CFCUs) are safety related components which provide the minimum containment cooling as assumed by the containment response analysis for a design-basis loss of coolant accident (LOCA) or main steam line break (MSLB) event. The CFCUs are not accident initiators; the CFCUs are designed to mitigate the consequences of previously evaluated accidents including a design basis LOCA or MSLB event. Extending the AOT for one or two inoperable CFCUs would not affect the previously evaluated accidents since the remaining three CFCUs supplying cooling to containment would continue to be available to perform the accident mitigation functions. Thus allowing one or two CFCUs to be inoperable for an additional 7 days for performance of maintenance or testing does not increase the probability of a previously evaluated accident.

Deterministic and probabilistic risk assessments evaluated the effect of the proposed Technical Specification change on the acceptability of operating with one or two CFCUs inoperable for up to 14 days. These assessments concluded that the proposed

LR-N16-0173 LAR S16-04 Page 15 Technical Specification change does not involve a significant increase in the risk from CFCU unavailability.

The calculated impact on risk associated with continued operation for an additional 7 days with one or two CFCUs inoperable is very small and is consistent with the acceptance guidelines contained in Regulatory Guides 1.174 and 1.177. This risk is judged to be reasonably consistent with the risk associated with operations for 7 days with one or two CFCUs inoperable as allowed by the current Technical Specifications.

The remaining 3 operable CFCUs, in conjunction with the Containment Spray System, are adequate to supply cooling to remove sufficient heat from the reactor containment, following the initial LOCA/MSLB containment pressure transient, to keep the containment pressure from exceeding the design pressure.

The consequences of previously evaluated accidents will remain the same during the proposed 14 day AOT as during the current 7 day AOT. The ability of the remaining 3 TS required CFCUs to maintain containment pressure and temperature within limits following a postulated design basis LOCA or MSLB event will not be affected.

There will be no impact on the source term or pathways assumed in accidents previously evaluated. No analysis assumptions will be changed and there will be no adverse effects on onsite or offsite doses as the result of an accident.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2.

Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed Technical Specification change does not involve a change in the plant design, system operation, or procedures involved with the CFCUs. The proposed changes allow one or two CFCUs to be inoperable for additional time. There are no new failure modes or mechanisms created due to plant operation for an extended period to perform CFCU maintenance or testing. Extended operation with one or two inoperable CFCUs does not involve any modification in the operational limits or physical design of plant systems. There are no new accident precursors generated due to the extended AOT.

Therefore, the proposed changes do not create the possibility of a new or different kind of accident from any previously evaluated.

3.

Does the proposed amendment involve a significant reduction in a margin of safety?

Response: No.

Margin of safety is related to the confidence in the ability of the fission product barriers to perform their design functions during and following an accident. These barriers include the fuel cladding, the reactor coolant system, and the containment system. The

LR-N16-0173 LAR S16-04 Page 16 proposed change, which would increase the AOT from 7 days to 14 days for one or two inoperable CFCUs, does not exceed or alter a setpoint, design basis or safety limit.

Therefore, the proposed amendment does not involve a significant reduction in a margin of safety.

Based upon the above, PSEG Nuclear concludes that the proposed amendment presents no significant hazards consideration under the standards set forth in 10 CFR 50.92 (c), and, accordingly, a finding of no significant hazards consideration is justified.

5.2 Applicable Regulatory Requirements and Criteria 10 CFR 50.36 Technical Specifications 10 CFR 50.36, Technical Specifications, identifies the requirements for the Technical Specification categories for operating power plants: (1) Safety limits, limiting safety system settings, and limiting control settings, (2) Limiting conditions for operation, (3) Surveillance requirements, (4) Design features, (5) Administrative controls, (6) Decommissioning and (7)

Initial notification, and (8) Written Reports. For Limiting conditions for operation, 10 CFR 50.36 states: Limiting conditions for operation are the lowest functional capability or performance levels of equipment required for safe operation of the facility. When a limiting condition for operation of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the technical specifications until the condition can be met.

10 CFR 50 Appendix A General Design Criteria (GDC)

Salem Generating Station was designed using the Atomic Industrial Forum (AIF) general design criteria as published in a letter to the Atomic Energy Commission (AEC) from E. A. Wiggin, Atomic Industrial Forum, dated October 2, 1967. In addition to the AIF General Design Criteria, the Salem Generating Station (SGS) was designed to comply with Public Service Electric & Gas (PSE&G's) understanding of the intent of the AEC's proposed General Design Criteria, as published for comment by the AEC in July, 1967. The proposed GDCs applicable to this proposed change are 49 - Containment Design Basis and 52 - Containment Heat Removal Systems. A comparison of the Salem plant design with 10 CFR 50, Appendix A, (General Design Criteria for Nuclear Power Plants dated July 7, 1971) was performed and documented in Salem UFSAR Section 3.1.3. The Salem Plant design conforms to the intent of "General Design Criteria for Nuclear Power Plants," (10 CFR 50, Appendix A) dated July 7, 1971 with exceptions noted in the UFSAR.

The proposed change increases the allowed outage time (AOT) for CFCUs based on a risk informed analysis and does not affect the intent of any TS requirements. The proposed change does not alter conformance with the 10 CFR 50, Appendix A, general design criteria 38, containment heat removal, or the AEC proposed General Design Criteria as listed in the Salem UFSAR Section 3.1.2.

In conclusion, based on the considerations discussed above, (1) there is a reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the NRCs regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

LR-N16-0173 LAR S16-04 Page 17

6.0 ENVIRONMENTAL CONSIDERATION

A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluent that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure.

Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

7.0 REFERENCES

1. Salem Unit 1 and Unit 2 Technical Specifications

2. Salem Updated Final Safety Analysis Report

3. WCAP-16503 Rev. 3, Containment Response to LOCA and MSLB for Containment Fan Cooler Unit Margin Recovery Project, February 2007

LR-N16-0173 Page 1 Technical Specification Pages with Proposed Changes

LR-N16-0173 Page 2 TECHNICAL SPECIFICATION PAGES WITH PROPOSED CHANGES The following Technical Specifications for Renewed Facility Operating License DPR-70 are affected by this change request:

Technical Specification Page 3.6.2.3 3/4 6-11 The following Technical Specifications for Renewed Facility Operating License DPR-75 are affected by this change request:

Technical Specification Page 3.6.2.3 3/4 6-12

LR-N16-0173 Page 3 CONTAINMENT SYSTEMS CONTAINMENT COOLING SYSTEM LIMITING CONDITION FOR OPERATION 3.6.2.3 Five containment cooling fans shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3 and 4.

ACTION:

a.

With one or two of the above required containment cooling fans inoperable, restore the inoperable cooling fan(s) to OPERABLE status within 7 14 days or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

b.

With three or more of the above required containment cooling fans inoperable, restore at least three cooling fans to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or be in at least HOT STANDBY WITHIN the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . Restore the remaining inoperable cooling fans to OPERABLE status within 714 days of initial loss or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

SURVEILLANCE REQUIREMENTS 4.6.2.3 Each containment cooling fan shall be demonstrated OPERABLE:

SALEM - UNIT 1 3/4 6-11 Amendment No. 315

LR-N16-0173 Page 4 CONTAINMENT SYSTEMS CONTAINMENT COOLING SYSTEM LIMITING CONDITION FOR OPERATION 3.6.2.3 Five containment cooling fans shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3 and 4.

ACTION:

a.

With one or two of the above required containment cooling fans inoperable, restore the inoperable cooling fan(s) to OPERABLE status within 7 14 days or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

b.

With three or more of the above required containment cooling fans inoperable, restore at least three cooling fans to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or be in at least HOT STANDBY WITHIN the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . Restore the remaining inoperable cooling fans to OPERABLE status within 714 days of initial loss or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

SURVEILLANCE REQUIREMENTS 4.6.2.3 Each containment cooling fan shall be demonstrated OPERABLE:

SALEM - UNIT 2 3/4 6-12 Amendment No. 296

LR-N16-0173 Page 1 Salem PRA Analysis for CFCU AOT Extension

Salem Generating Station CFCU AOT Extension RM DOCUMENT NO:

STATION:

UNIT S AFFECTED:

TITLE:

SUMMARY

SA-LAR-007 Salem Generating Station Units 1 & 2 REV:

1 Salem PRA Analysis for CFCU AOT Extension This analysis provides the basis for extending the Technical Specifications Allowed Outage Time (AOT) for Containment Fan Cooler Units (CFCUs) during extended maintenance activities. This analysis supports extending the AOT for the maintenance configuration in which one or two CFCUs are simultaneously out of service for up to 14 days.

Revision 1 adds an additional sensitivity analysis that uses the recently updated PRA model of Record SA 115A, which was finalized after completion of the original CFCU AOT extension analysis.

Internal RM Documentation Electronic Calculation Data Files:

\\\\Njnbufp1 9\\PSEG Power\\System Engineering\\Salem\\PRA\\Applications\\LAR\\SA-LAR-007 CFCU LAR Prepared by:

Method of Review:

[X] Detailed

[ ] Alternate Approved by:

External RM Documentation Date Prepared by:

________ NQ/RAS----TU----VWX------YZ-----------

Print Sign Date Approved by: ___ _...:..;NQ/...__----'"1

________.-:.1 Print Sign Date Do any ASSUMPTIONS I ENGINEERING JUDGMENTS require later verification?

[

] Yes [X] No Tracked By: AT#, URE# etc.)

SA-LAR-007

Salem Generating Station CFCU AOT Extension ii SALAR007 TABLE OF CONTENTS Section Page EXECUTIVE

SUMMARY

................................................................................................ V

1.0 INTRODUCTION

............................................................................................... 141 1.1 Purpose.................................................................................................. 11 1.2 Background............................................................................................. 12 1.3 Technical Specifications......................................................................... 13 1.4 Regulatory Guides.................................................................................. 13 1.5 Scope...................................................................................................... 14 1.6 Salem PRA Model and its Attributes....................................................... 17 2.0 ANALYSIS ROADMAP AND REPORT ORGANIZATION................................ 241 3.0 TIER 1 RISK ASSESSMENT............................................................................ 343 3.1 Tier 1 Evaluation Approach..................................................................... 33 3.2 Assumptions........................................................................................... 34 3.3 Compensatory Measures........................................................................ 35 3.4 Calculational Approach........................................................................... 35 3.5 Parametric Uncertainty Evaluation........................................................ 316 4.0 TECHNICAL ADEQUACY OF THE PRA MODEL............................................ 441 4.1 PRA Quality............................................................................................ 41 4.2 Technical Adequacy Conclusion........................................................... 451 4.3 External Events Considerations............................................................ 451 4.4 Summary.............................................................................................. 456 5.0 DISCUSSION OF RISK CONTRIBUTORS AND UNCERTAINTY.................... 541 5.1 Step 3: Initial Comparison to Acceptance Guidelines............................ 53 5.2 Consideration of Significant Contributors................................................ 54 5.3 Step 4: Adequacy of the Scope of the Salem PRA................................ 59 5.4 Step 5: Uncertainty Analysis.................................................................. 59 5.5 Sensitivity Analysis............................................................................... 516 5.6 Sensitivity Analysis Conclusions........................................................... 519 6.0

SUMMARY

AND CONCLUSIONS.................................................................... 641 6.1 Regulatory Guidelines............................................................................. 61 6.2 PRA Model.............................................................................................. 62 6.3 Quantitative PRA Results: Regulatory Guide 1.177 and 1.174.............. 63 6.4 External hazards Considerations............................................................ 63

Salem Generating Station CFCU AOT Extension iii SALAR007 6.5 Uncertainties........................................................................................... 64 6.6 Conclusion.............................................................................................. 64

7.0 REFERENCES

.................................................................................................. 741 LIST OF FIGURES Figure 1 Acceptance Guidelines for Core Damage Frequency (CDF)............................ ix Figure 2 Acceptance Guidelines for Large Early Release Frequency (LERF)................. ix Figure 11 Acceptance Guidelines for Core Damage Frequency (CDF)...................... 16 Figure 12 Acceptance Guidelines for Large Early Release Frequency (LERF).......... 16 Figure 31 Parametric Uncertainty Distribution for Salem Base Model CDF (SA112B) for the CFCU AOT Extension Application Model............................................. 317 Figure 32 Parametric Uncertainty Distribution for Salem CDF Representing the CFCU AOT Extension..................................................................................... 318 Figure 33 Parametric Uncertainty Distribution for Salem Base Model LERF (SA112B) for the CFCU AOT Extension Application Model............................. 319 Figure 34 Parametric Uncertainty Distribution for Salem LERF Representing the CFCU AOT Extension..................................................................................... 320 Figure 51 Overview of process for pra analysis to support a risk informed decision... 52 Figure 61 Acceptance Guidelines for Core Damage Frequency (CDF)...................... 66 Figure 62 Acceptance Guidelines for Large Early Release Frequency (LERF).......... 66 LIST OF TABLES Table 11 History of Salem Generating Station PRA Model Updates........................... 17 Table 21 RG 1.200 Analysis Actions Roadmap to Demonstrate PRA Technical Adequacy.......................................................................................................... 22 Table 31 Quantitative Results of the Risk Metrics for Concurrent Unavailability of Two CFCUS.................................................................................................... 311 Table 32 Dominant Risk Contributors Attributed to Extended CFCU AOT................ 315 Table 41 Assessment of Supporting Requirement Capability Categories for Initiating Events Analysis................................................................................................. 46 Table 42 Assessment of Supporting Requirement Capability Categories for Accident Sequence Analysis........................................................................... 411 Table 43 Assessment of Supporting Requirement Capability Categories for Success Criteria............................................................................................................. 415 Table 44 Assessment of Supporting Requirement Capability Categories for Systems Analysis............................................................................................ 417 Table 45 Assessment Of Supporting Requirement Capability Categories For Human Reliability Analysis.............................................................................. 423 Table 46 Assessment Of Supporting Requirement Capability Categories For Data Analysis........................................................................................................... 427 Table 47 Assessment of Supporting Requirement Capability Categories for

Salem Generating Station CFCU AOT Extension iv SALAR007 Quantification................................................................................................... 434 Table 48 Assessment of Supporting Requirement Capability Categories for Internal Flood............................................................................................................... 440 Table 49 Assessment of Supporting Requirement Capability Categories for Configuration Control....................................................................................... 446 Table 410 Assessment of Supporting Requirement Capability Categories with Consideration of Revised Supporting Requirements....................................... 447 Table 411 Assessment of Supporting Requirement Capability Categories with Consideration of Qualifications from Reg Guide 1.200 (Appendix A).............. 448

EXECUTIVE

SUMMARY

Salem Generating Station CFCU AOT Extension Technical Evaluation of Extending Containment Fan Cooler Unit Allowed Outage Time Using Probabilistic Risk Assessment for Salem PURPOSE Consistent with the NRC's approach to risk-informed regulation, PSEG has identified a particular Technical Specification requirement that is restrictive in its nature and, if relaxed, has a minimal impact on the safety of the plant. This Technical Specification requires that the Containment Fan Cooler Unit (CFCU) Allowed Outage Time (AOT) be restricted to one or two CFCUs being inoperable for up to 7 days.

The proposed change is to increase the CFCU AOT from the currently specified 7 days to 14 days for one or two CFCUs (out of five for each unit) being inoperable.

RISK INFORMED REGULATORY ENVIRONMENT Since the mid-1980s, the NRC has been reviewing and granting improvements to TS that are based, at least in part, on probabilistic risk assessment (PRA) insights. In its final policy statement on TS improvements of July 22, 1993, the NRC stated that it...

... expects that licensees, in preparing their Technical Specification related submittals, will utilize any plant-specific PSA

[probabilistic safety assessment] or risk survey and any available literature on risk insights and PRAs.... Similarly, the NRC staff will also employ risk insights and PRAs in evaluating Technical Specifications related submittals. Further, as a part of the Commission's ongoing program of improving Technical Specifications, it will continue to consider methods to make better use of risk and reliability information for defining future generic Technical Specification requirements.

The NRC has specified, in Regulatory Guides, the risk metrics that should be calculated to provide input into the decision making process.

The risk metrics chosen by the NRC in their Regulatory Guides include the following:

The change in Core Damage Frequency (CDF) (Reg. Guide 1.174)

The change in Large Early Release Frequency (LERF) (Reg. Guide 1.174)

The Incremental Conditional Core Damage Probability (ICCDP) (Reg. Guide 1.177)

The Incremental Conditional Large Early Release Probability (ICLERP) (Reg.

Guide 1.177) v SA-LAR-007

Salem Generating Station CFCU AOT Extension These risk metrics are all calculated with the Salem PRA model that includes internal events hazards, including internal floods.

Quantitative guidelines are defined by the NRC in RG 1.174 and 1.177 for what is an acceptably small change in risk.

The Salem calculated ICCDP and ICLERP for the CFCU AOT extension are sufficiently below the guidelines of <1.0E-06 and <1.0E-07, respectively, to be able to call the risk change small. Hence, the guidelines of Reg. Guide 1.177 for the increased CFCU Allowed Outage Time have been met.

The guidelines from Regulatory Guide 1.174 are provided to assure that the changes in CDF and LERF when the extended AOT is implemented remain acceptable. These guidelines specify acceptably small changes as a function of the absolute values of the CDF and LERF.

These calculations support the increase in the CFCU Allowed Outage Time (AOT) for a period of up to 14 days for any one or two CFCUs based on a quantitative risk-informed perspective.

QUANTITATIVE RESULTS The quantitative results of the evaluation are shown in the below table. Even though the risk increase was very similar for all 10 combination pairs of CFCUs being unavailable, two of the pairs presented the same maximum value, which is considered the "worst-case" combination for any two CFCUs that would be unavailable. To simplify the analysis, only one of the two pairs exhibiting the maximum risk increase (CFCUs #1 and #3) was chosen to represent the configuration for all quantitative calculations. Also, for the purpose of this analysis, three instances of a pair of CFCUs being unavailable for 14 days (42 days total) for a given fuel cycle were assumed. While this is unlikely, it could be based on multiple repetitive CFCU maintenance activities, such as maintenance on each of the two Service Water accumulators that would cause the unavailability of two CFCUs, with an additional maintenance activity whereby any two CFCUs could simultaneously be rendered unavailable.

vi SA-LAR-007

Salem Generating Station CFCU ACT Extension RESULTS OF RISK EVALUATION FOR SALEM RISK M ETRIC RISK M ETRIC RESULTS ilCDF(/yr) 5.61 E-08 l'lLERF (/yr) 2.1 5E-1 0 ICCDPcFcu 2.80E-08 ICLERPcFcu 1.08E-1 0 Table Note:

1.

Region Ill of RG 1.174-- very small risk changes.

In addition, the comparisons of the CDF and LERF risk metrics with the Reg. Guide 1.17 4 guidelines are shown in Figures 1 and 2, respectively.

These comparisons show that the incremental risk is very low.

OTHER CONSIDERATIONS Any Shutdown Risk reductions associated with not having to perform maintenance on CFCUs during refueling outages have not been quantified as part of this evaluation.

The Configuration Risk Management Program (CRMP) will ensure that the plant state is monitored to minimize the risk impact of the change.

UNCERTAINTIES In addition to the assessment of the mean risk metrics which are specified in RG 1.177 and 1.174 for comparison with the acceptance guidelines, it is also prudent to examine whether modeling uncertainties may distort these comparisons.

Therefore, an extensive review of potential modeling uncertainties that may impact the risk metrics was performed.

To this end, NUREG-1855 and the companion EPRI guideline on the treatment of uncertainties were used.

Section 5 provides various perspectives on the identification and disposition of various uncertainties.

vii SA-LAR-007

Salem Generating Station CFCU AOT Extension viii SALAR007 CONCLUSION The proposed modification to the Technical Specifications is acceptable based on the risk change calculated with the Salem PRA for the proposed CFCU AOT extension for any two simultaneously unavailable CFCUs.

The ICCDP and ICLERP for an unavailable pair of CFCUs are sufficiently below the Reg. Guide 1.177 guidelines of <1.0E06 and <1.0E07, respectively, to be able to call the risk change small. Hence, the guidelines for the increased CFCU Allowed Outage Time have been met.

Furthermore, the calculation of changes in CDF and LERF due to the extended CFCU AOT have been shown to meet the risk significance criteria of Regulatory Guide 1.174, i.e., Region III which represents very small risk changes.

These calculations support the increase in the extended AOT up to a period of 14 days for any one or two CFCUs that are unavailable from a quantitative riskinformed perspective, so long as the plant operational and maintenance practices are in reasonable agreement with the assumptions made in this evaluation.

t (J

=

10"5 FIGURE 1 Salem Generating Station CFCU AOT Extension CDF ACCEPTANCE GUIDELINES FOR CORE DAMAGE FREQUENCY (CDF) 10'"5 LEAF "* #*,_.,

FIGU RE 2 ACCEPTANCE GUIDELINES FOR LARGE EARLY RELEASE FREQUENCY (LERF) ix SA-LAR-007

1.0 INTRODUCTION 1.1 PURPOSE Salem Generating Station CFCU AOT Extension Consistent with the NRC's approach to risk-informed regulation, PSEG has identified a particular Technical Specification requirement that is restrictive in its nature and, if relaxed, has a minimal impact on the safety of the plant. This Technical Specification is the requirement for the Containment Fan Cooler Unit (CFCU) Allowed Outage Time (AOT) to be restricted to 7 days for either one or two CFCUs being inoperable. The proposed change is to increase the AOT for any one or two inoperable CFCUs to a total of 1 4 days.

The proposed changes to Technical Specifications will extend the allowable Allowed Outage Times for the Required Actions associated with restoration of two inoperable CFCUs. The changes are being proposed to support any on-line maintenance that may be required that would render two CFCUs simultaneously unavailable.

1.1.1 Benefits Implementation of this proposed Allowed Outage Time extension will provide the following benefits:

Allow increased flexibility in the scheduling and performance of preventive maintenance.

Improve containment fan cooler reliability.

Allow better control and allocation of resources.

Avert unplanned plant shutdowns. Risks incurred by unexpected plant shutdowns can be comparable to and often exceed those associated with continued power operation.

Permit scheduling of maintenance activities for CFCUs within the requested 1 4 day period.

The proposed Allowed Outage Time of 1 4 days is adequate to perform maintenance that would involve the simultaneous unavailability of two CFCUs. One such example would be if a major maintenance activity were to be scheduled for a CFCU and a leak was discovered during an inspection of another CFCU. Another example would be if any of the two Service Water accumulators were to be isolated for maintenance, which 1 -1 SA-LAR-007

Salem Generating Station CFCU AOT Extension 12 SALAR007 would make two CFCUs inoperable (either the 11(21) and 12(22) pair, or the 14(24) and 15(25) pair, depending on the accumulator removed from service).

1.2 BACKGROUND

Since the mid1980s, the NRC has been reviewing and granting improvements to TS that are based, at least in part, on probabilistic risk assessment (PRA) insights. In its final policy statement on TS improvements of July 22, 1993, the NRC stated that it...

... expects that licensees, in preparing their Technical Specification related submittals, will utilize any plantspecific PSA [probabilistic safety assessment]1 or risk survey and any available literature on risk insights and PSAs.... Similarly, the NRC staff will also employ risk insights and PSAs in evaluating Technical Specifications related submittals. Further, as a part of the Commissions ongoing program of improving Technical Specifications, it will continue to consider methods to make better use of risk and reliability information for defining future generic Technical Specification requirements.

The NRC reiterated this point when it issued the revision to 10 CFR 50.36, Technical Specifications, in July 1995. In August 1995, the NRC adopted a final policy statement on the use of PRA methods in nuclear regulatory activities that encouraged greater use of PRA to improve safety decision making and regulatory efficiency. The PRA policy statement included the following points:

1.

The use of PRA technology should be increased in all regulatory matters to the extent supported by the state of the art in PRA methods and data and in a manner that complements the NRCs deterministic approach and supports the NRCs traditional defenseindepth philosophy.

2.

PRA and associated analyses (e.g., sensitivity studies, uncertainty analyses, and importance measures) should be used in regulatory matters, where practical within the bounds of the state of the art, to reduce unnecessary conservatism associated with current regulatory requirements.

3.

PRA evaluations in support of regulatory decisions should be as realistic as practicable and appropriate supporting data should be publicly available for review.

The movement of the NRC to more riskinformed regulation has led to the NRC identifying Regulatory Guides and associated processes by which licensees can submit 1 PSA and PRA are used interchangeably herein.

Salem Generating Station CFCU AOT Extension changes to the plant design basis, including Technical Specifications. As examples, Regulatory Guides 1.17 4 [1] and 1.177 [2], both provide mechanisms to demonstrate valuable PRA input for Technical Specification modification.

1.3 TECHNICAL SPECIFICATIONS As with all Technical Specifications, there is no rule to limit the number of times per year that an extended AOT would be invoked. However, there are a number of programs (e.g., MSPI, Maintenance Rule) that are monitoring programs that provide operational and risk controls on extended outages of key equipment.

However, to provide a somewhat realistic assessment for this extended AOT involving concurrent unavailability of two CFCUs, an assumption was made that there would be at most three instances of dual CFCU unavailability per fuel cycle, with each period of unavailability being a full 1 4 days. The reasoning for this assumption involving three separate periods of dual CFCU unavailability was based on the fact that there are two Service Water accumulators, and each one was assumed to undergo online maintenance during a fuel cycle, with the third period of unavailability based on a random occurrence of any two CFCUs that might be made unavailable during at-power operations.

1.4 REGULATORY GUIDES The license amendment request for an extension in the CFCU Allowed Outage Time (AOT) is made consistent with the NRC risk-informed process. The internal events PRA is developed and peer reviewed consistent with the ASME PRA Standard [11] as endorsed by Regulatory Guide (RG) 1.200 [3].

The risk-informed application is developed consistent with the general guidance in RG 1.174 [1] and the specific guidance for changes in AOTs contained in RG 1.177 [2].

1.4.1 Acceptance Guidelines** R.G. 1.1 74 R.G. 1.174 specifies the acceptance guidelines in terms of the change in CDF and LERF as a function of the base model CDF and LERF, respectively.

Figure 1-1 identifies the acceptance guidelines for R.G. 1.174 for the t1CDF risk metric and Figure 1-2 identifies the acceptance guidelines for R.G. 1.174 for the t1LERF risk metric.

1-3 SA-LAR-007

Salem Generating Station CFCU AOT Extension Further, R.G. 1.174 in Section 2.5.5 [1] identifies the following regarding the PRA calculation to be used in comparison with the acceptance guidelines:

Because of the way the acceptance guidelines were developed, the appropriate numerical measures to use in the initial comparison of the PRA results to the acceptance guidelines are mean values.

1.4.2 Acceptance Guidelines-- R.G. 1.1 77 Regulatory Guide 1.177 specifies acceptance guidelines in terms of two parameters that have been developed by the NRC as follows:

ICCDP - Incremental Conditional Core Damage Probability

[(conditional CDF with the subject equipment out of service) - (baseline CDF with nominal expected equipment unavailabilities)] x duration of single AOT under consideration)

ICLERP - Incremental Conditional Large Early Release Probability

[(conditional LERF with the subject equipment out of service) - (baseline LERF with nominal expected equipment unavailabilities)] x (duration of single AOT under consideration)

Further, the NRC has developed acceptance guidelines which the NRC states "should not be interpreted as overly prescriptive".

1.5 SCOPE I RISK METRIC PARAMETER I ACCEPTANCE GUIDELINE I I

ICCDP I

1.0E-06 I

ICLERP 1.0E-07 This analysis is to address the adequacy of the proposed Allowed Outage Time (AOT) extension for one or two Containment Fan Cooler Units (CFCUs) from the current 7 days to 14 days using the Salem Probabilistic Risk Assessment (PRA) model.

The following scope of the at-power PRA models is included:

Internal Events: Model developed in accordance with the ASME/ANS PRA Standard and Peer Reviewed Internal Floods: Model developed in accordance with the ASME/ANS PRA Standard and Peer Reviewed 1 -4

Salem Generating Station CFCU AOT Extension Seismic Events:

Model based on Seismic Evaluation from IPEEE included in the model quantification Internal Fires:

Model based on Fire Evaluation from IPEEE with insights provided from the Work-in-Progress Fire PRA model Other External Event Hazards:

Non-contributors based on an independent review of IPEEE results which quantitatively or qualitatively screened these from further analysis.

The NRC has specified in Regulatory Guides the risk measures that should be calculated to provide input into the decision making process. The risk measures chosen by the NRC in their Regulatory Guides include the following:

The change in Core Damage Frequency (CDF) (Reg. Guide 1.174)

The change in Large Early Release Frequency (LERF) (Reg. Guide 1.174)

The Incremental Conditional Core Damage Probability (ICCDP) (Reg.

Guide 1.177)

The Incremental Conditional Large Early Release Probability (ICLERP) (Reg. Guide 1.177) 1-5 SA-LAR-007

t Lt.

0 (J

<:]

10"5 10<4 FIGURE 1-1 Salem Generating Station CFCU AOT Extension CDF.......,

ACCEPTANCE GUIDELINES FOR CORE DAMAGE FREQUENCY (CDF) 10

.. 5 LEAF*

FIGURE 1-2 ACCEPTANCE GUIDELINES FOR LARGE EARLY RELEASE FREQUENCY (LERF) 1 -6 SA-LAR-007

Salem Generating Station CFCU AOT Extension 17 SALAR007 1.6 SALEM PRA MODEL AND ITS ATTRIBUTES The Salem Generating Station (SGS) PRA internal events atpower model and documentation has been maintained current with the asbuilt, asoperated plant and is routinely updated to reflect the current plant configuration and to reflect the accumulation of additional plant operating history and component failure data. The Level 1 and Level 2 Salem analyses were originally developed and submitted to the NRC as the Salem Generating Station Individual Plant Examination (IPE) Submittal [8]

in response to NRC Generic Letter 8820 [9]. The Salem PRA has been updated many times since the original IPE. A summary of the Salem PRA history is in Table 11.

TABLE 141 HISTORY OF SALEM GENERATING STATION PRA MODEL UPDATES MODEL REVISION DATE MODEL NAME INTERNAL EVENTS CDF (1/YR)

INTERNAL EVENTS LERF (1/YR)

TRUNCATION LIMIT COMMENTS July93 IPE 6.40E05 5.23E06 NR Truncation limit not reported August96 Model 1.0 5.13E05 4.75E06 NR Truncation limit not reported August98 Model 2.0 5.23E05 4.75E06 1.00E10 June02 Model 3.0 5.20E05 5.74E06 1.00E10 July03 Model 3.1 4.10E05 3.97E06 1.00E09 March05 Model 3.2 2.48E05 1.01E06 1.00E11 March06 Model 3.2A 6.21E05 7.61E06 1.00E11 No internal flood contribution March08 Model 4.0 4.54E05 NR 1.00E11 No internal flood contribution; LERF results not reported September08 Model 4.1 4.77E05 5.06E06 1.00E11 March09 Model 4.2 4.74E05 5.06E06 1.00E11 December09 Model 4.3 2.55E05 1.18E06 1.00E11 September14 Model SA112A 1.55E05 7.29E07 1.0E11 (CDF) 1.0E12 (LERF)

December 16 Model SA115A 8.38E06 4.65E07 1.0E11 (CDF) 3.0E13 (LERF)

The SA115A model was finalized after the original CFCU analysis was completed.

1.6.1 Peer Review Salem Generating Station CFCU AOT Extension In November 2008, PSEG participated in a PRA Peer Review Certification of the Salem PRA administered under the auspices of the Westinghouse Electric Company LLC [7].

The purpose of the PRA peer review process was to establish a method of assessing the technical quality of the PRA for the spectrum of its potential applications.

1.6.2 Current Version of PRA Model The PRA version known as SA 11 2A, satisfied the PSEG internal requirement for a periodic PRA Update, and also served to address peer review Findings and Observations (F&Os), open Updating Requirement Evaluations (UREs), and updated plant-specific data.

Model updates labeled as Rev. 4.2, 4.3, and SA 112A have been performed since the peer review. While the model and documentation have been significantly improved, no methodology changes that would be considered a PRA upgrade per Regulatory Guide 1.200 were introduced.

This SA112A PRA Update included a data update, updated HRA analysis for a more detailed treatment of dependent operator actions and pre-initiator actions, and the closure of over 200 Updating Requirement Evaluations (URE).

Major fault tree logic changes included the following:

Due to transfers being made from the loss of CCW event tree to the small LOCA event tree, numerous gates were no longer necessary and removed from the PRA model logic.

The offsite power recovery logic was modified to ensure that all loss of offsite power (LOOP)-initiated cutsets contained a non-recovery probability for failure to restore offsite power given the type of initiating event involved, e.g., Weather, Grid, and Plant-Centered and Station.

Annualized terms and basic events that support fault tree logic used to estimate the occurrence of support system initiating events were verified to contain the mission time of 8760 hours0.101 days 2.433 hours 0.0145 weeks 0.00333 months to reflect the exposure time of one year.

1-8 SA-LAR-007

Salem Generating Station CFCU AOT Extension Additional credit was taken in the logic model for recovery of Control Area Ventilation due to insights gathered from procedure reviews and during operator interviews.

Further details regarding the SA112A PRA model may be found in Reference [6].

In addition, even though the Salem PRA model is a single unit model based on Unit 1, there are no major differences between Unit 1 and Unit 2 that would affect this CFCU AOT extension.

The following list provides a summary of some of the major differences noted between the two Salem units:

The Service Water (SW) air-operated valves (AOVs) that service the #12A and #12B Component Cooling Water (CCW) heat exchangers for Unit 1 require a control air dependency for successful operation whereas the #22 SW AOVs in Unit 2 do not.

The power dependencies for the SW pumps and associated MOVs are not symmetric between the two units. For example, the 4kV AC vital bus A on Unit 1 powers the 15 and 16 SW pumps, while the A vital bus on Unit 2 powers the 21 and 22 SW pumps.

The Unit 2 CVCS pumps do not require CCW cooling for their mechanical seals while the Unit 1 CVCS pumps do during normal operation.

However, this particular CCW dependency is not modeled in the PRA since it is not required for successful operation of the eves pumps during the injection phase of an accident condition since water from the RWST is relatively cool.

Operations personnel are trained such that no differences would exist with the Human Reliability Analysis (HRA) between the two units.

The Station Air Compressors (SACs) and Instrument Air system are shared between the two units, with SACs #1 and #3 powered from Unit 1 Group buses and SAC 2 powered from a Unit 2 Group bus. All three SACs are physically located in the Unit 1 Turbine Building on the 1 00' el.

The Demineralized Water (OM) pumps are also physically located in the Unit 1 Turbine Building on the 1 00' el. and provide OM water for both Unit 1 and Unit 2. The power supplies are such that the #1 and #3 pumps are powered from a Unit 1 Group bus while the #2 pump is powered from a Unit 2 Group bus. The Auxiliary OM pump is powered from a Unit 1 vital bus.

The Station Blackout (SBO) Air Compressor is located in the yard in close proximity to the Unit 2 Turbine Building and services the Control Air 1-9 SA-LAR-007

Salem Generating Station CFCU AOT Extension 110 SALAR007 system for both units when required via a connection on the discharge side of the Unit 2 Emergency Control Air Compressor.

Although the Salem SA112A PRA model was used for this risk analysis, the Salem SA115A PRA Model of Record (MOR) was finalized following completion of the original analysis for this CFCU AOT extension. SA115 was utilized in an additional sensitivity analysis to further reinforce the original conclusion in support of the proposed CFCU AOT extension.

The major changes included as part of the SA115A PRA model update involved the incorporation of a fourth AFW pump that includes a dedicated diesel generator as its power supply. The use of FLEX equipment was also incorporated for those Station Blackout scenarios that lead to an extended loss of AC power in which offsite power is not expected to be restored within four hours. Failure probabilities were updated and incremental model improvements were incorporated that were identified as part of the Maintenance and Updating requirements per procedure ERAA6001015 [26].

1.6.3 IPEEE The Salem IPEEE evaluation [10] was used as a basis to gain insight into what impact the CFCU AOT extension might have on the risk associated with fire and seismic events, as well as any other related external events risk.

Although Salem does not currently possess any peerreviewed seismic and fire PRA models, the use of IPEEE results and any insights gleaned from the WorkinProgress (WIP) Fire PRA model are deemed adequate in analyzing any perceived increase in risk due to seismic and fire events associated with extending the CFCU AOT.

Salem Generating Station CFCU AOT Extension 21 SALAR007 2.0 ANALYSIS ROADMAP AND REPORT ORGANIZATION The method of compliance to demonstrate the technical adequacy of the PRA used to support the EDG AOT Extension is provided in RG 1.200, Revision 1. The guidance in RG 1.200, Revision 1 indicates that the following steps should be followed to perform this study of the technical adequacy of the PRA:

1.

Per Section 3 of RG 1.200, identify the parts of the PRA used to support the application

a. Describe the SSCs, operator actions, and operational characteristics affected by the application and how these are implemented in the PRA model.

b. Provide a definition of the acceptance guidelines used for the application.

2.

Per Section 3.1 of RG 1.200, identify the scope of risk contributors addressed by the PRA model

a. If not full scope (i.e., internal and external), identify appropriate compensatory measures or provide bounding arguments to address the risk contributors not addressed by the model.

3.

Per Section 3.2 and 4.2 of RG 1.200, demonstrate the Technical Adequacy of the PRA

a. Identify plant changes (design or operational practices) that have been incorporated at the site, but are not yet in the PRA model and justify why the change does not impact the PRA results used to support the application.

b. Document that the parts of the PRA used in the decision are consistent with applicable standards endorsed by the Regulatory Guide (currently, in RG 1.200, Revision 1 this is just the internal events PRA standard). Provide justification to show that where specific requirements in the standard are not met, it will not unduly impact the results.

c. Document peer review findings and observations that are applicable to the parts of the PRA required for the application, and for those that have not yet been addressed justify why the significant contributors would not be impacted.

d. Identify key assumptions and approximations relevant to the results used in the decision making process.

4.

Per Section 4.2 of RG 1.200, summarize the risk assessment methodology used to assess the risk of the application

a. Include how the PRA model was modified to appropriately model the risk impact of the change request.

Table 21 summarizes the RG 1.200 identified actions and the corresponding location of that analysis or information in this report.

Salem Generating Station CFCU AOT Extension 22 SALAR007 TABLE 241 RG 1.200 ANALYSIS ACTIONS ROADMAP TO DEMONSTRATE PRA TECHNICAL ADEQUACY RG 1.200 ACTIONS REPORT SECTION

1. Identify the parts of the PRA used to support the application Section 1.5 and Section 3 1a. Describe the SSCs, operator actions, and operational characteristics affected by the application and how these are implemented in the PRA model.

Section 1.1, 1.3, and Section 3 1b. Provide a definition of the acceptance guidelines used for the application.

Section 1.4

2. Identify the scope of risk contributors addressed by the PRA model. If not full scope (i.e., internal and external events), identify appropriate compensatory measures or provide bounding arguments to address the risk contributors not addressed by the model.

Section 3 and 5

3. Demonstrate the Technical Adequacy of the PRA.

Section 4 3a. Identify plant changes (design or operational practices) that have been incorporated at the site, but are not yet in the PRA model and justify why the change does not impact the PRA results used to support the application.

Section 4.1.1, 4.1.2 3b. Document that the parts of the PRA used in the decision are consistent with applicable standards endorsed by the RG (currently, in RG 1.200 Rev. 1. RG 1.200 Rev. 1 addresses the internal events ASME PRA Standard). Provide justification to show that where specific requirements in the standard are not met, it will not unduly impact the results.

Section 4.1.3 3c. Document PRA peer review findings and observations that are applicable to the parts of the PRA required for the application, and for those that have not yet been addressed justify why the significant contributors would not be impacted.

Section 4.1.3, Tables 41 to 411 3d. Identify key assumptions and approximations relevant to the results used in the decision making process.

Section 3.2 and Section 5

4. Summarize the risk assessment methodology used to assess the risk of the application. Include how the PRA model was modified to appropriately model the risk impact of the change request.

Section 3 4a. Include how the PRA model was modified to appropriately model the risk impact of the change request.

Section 3.4.3

Salem Generating Station CFCU AOT Extension 33 SALAR007 3.0 TIER 1 RISK ASSESSMENT The justification for the use of a Containment Fan Cooler Unit (CFCU) extended Allowed Outage Time (AOT) is based upon riskinformed and deterministic evaluations consisting of three main elements:

1. Tier 1: Assessment of the impact of the proposed TS change using a valid and appropriate PRA model and compare with appropriate acceptance guidelines.

2. Tier 2: Evaluate equipment relative to the contribution to risk while two CFCUs are in the extended AOT.

a. Examination of out of service combinations can be evaluated for their risk significance to determine if additional measures may be required.

3. Tier 3: Implementation of the Configuration Risk Management Program (CRMP) while two CFCUs are in an extended AOT. The CRMP is used for all work and helps ensure that there is no significant increase in the risk due to a severe accident while CFCU maintenance is performed. These elements provide adequate justification for approval of the requested Technical Specification change by providing a high degree of assurance that any increase in risk is acceptable during the CFCU extended AOT for all Design Basis Accidents (DBAs) and 10 CFR 50 Appendix R fire requirements during the CFCU AOT.

This section addresses the risk assessment for the proposed extension of the CFCU AOT. Plant configuration changes for planned and unplanned maintenance of the CFCUs as well as the maintenance of equipment having risk significance is managed by the Configuration Risk Management Program (CRMP). The CRMP helps ensure that these maintenance activities are carried out with no significant increase in the risk of a severe accident.

3.1 TIER 1 EVALUATION APPROACH The proposed changes associated with the extended CFCU AOT are evaluated using the Salem PRA Model of Record (MOR) to determine that current regulations and applicable requirements continue to be met, that adequate defenseindepth and sufficient safety margins are maintained, and that any increase in core damage frequency (CDF) and large early release frequency (LERF) is small and consistent with the acceptance guidelines in Reference [2].

Salem Generating Station CFCU AOT Extension The modeling approach is consistent with the NRC guidance for the calculation of the requested risk measures using the Salem PRA MOR:

Regulatory Guide 1.177 [2] is followed to calculate the change in risk measures:

ICCDP ICLERP These conditional probabilities are performed to calculate the risk change during the proposed CFCU AOT.

An integrated assessment of the impact of the AOT extension is calculated assigning the "worst case" dual unavailability of CFCUs up to a period of 14 days. This calculation can then be used to calculate the change in CDF and LERF in comparison with the criteria set in Regulatory Guide 1.174 [1].

Regulatory Guide 1.174 has acceptance guidelines that act as "trigger points" to address concerns as to whether the proposed change provides reasonable assurance of adequate protection.

The Salem internal events PRA is a thorough and detailed PRA model that is robust and capable of supporting the risk-informed decision to increase the CFCU Allowed Outage Time from 7 days to 14 days. See Section 4 for a discussion of the PRA technical adequacy.

3.2 ASSUMPTIONS The PRA quantitative evaluation of the extended CFCU AOT has a number of assumptions. This subsection lists some of the important assumptions.

An extended CFCU outage will occur for two CFCUs three (3) times during a refueling cycle (18 months).

The external event analysis is based on a qualitative analysis using insights from the IPEEE study [1 0] and any insights gleaned from the WIP Fire PRA model.

There is not a shutdown PRA maintained for Salem, and therefore, the risk decrease associated with removing CFCU maintenance from the outage is not quantified. The change in the Technical Specification AOT for the CFCUs would result in removing this shutdown risk increment. This unquantified risk reduction would reduce the calculated risk metrics of CDF, LERF, ICCDP, and ICLERP calculated in this report. However, the quantitative effect of risk changes during shutdown are not explicitly included in the quantification. The shutdown risk change will result in increased safety because the CFCU work window will be removed from the outage. By not including the risk benefit associated with the 3-4 SA-LAR-007

Salem Generating Station CFCU AOT Extension outage safety improvement, the at-power results provided in the enclosed analysis will be conservative.

The base risk model has not increased the CFCU maintenance unavailabilities to account for future potential increases in the average unavailabilities. If this were to be included in the base risk model, it would result in improving the calculated risk metrics and showing an increase in the margin from the calculated risk metrics to their acceptance guidelines.

Corrective and preventative maintenance outages have been combined to calculate a total maintenance unavailability. This is consistent with the ASME PRA Standard [11].

Common cause failure events are treated using the INL common cause data base developed under the auspices of the NRC. The conditional probability of failure of additional CFCUs has been adjusted to account for the hypothetical case that two out of five CFCUs have suffered a failure. This is bounding; other more likely scenarios would lead to lower conditional probabilities and risk increases.

3.3 COMPENSATORY MEASURES PSEG maintenance practices involve protecting other equipment coincident with maintenance being performed on CFCUs per OP-AA-1 08-116, PROTECTED EQUIPMENT PROGRAM [21]. This procedure specifically states that if two CFCUs are unavailable, the other CFCUs and one Containment Spray pump are protected to prevent concurrent unavailability. The PRA MOR directly accounts for this maintenance practice and is reflected in the quantitative analysis.

In addition, OP-AA-1 08-116 directs the Operations and Work Management personnel to routinely monitor various maintenance configurations and protect equipment that could lead to an elevated risk condition (e.g., "red" risk condition) if it were to become unavailable due to unplanned or emergent conditions. This is normally accomplished using a predictive PRA software tool based on the PRA MOR, i.e., EOOS Configuration Risk Monitor program from the Electric Power Research Institute (EPRI).

3.4 CALCULATIONAL APPROACH 3.4.1 Overview With two CFCUs unavailable up to a period of 14 days, the Salem PRA MOR yielded the following results:

3-5 SA-LAR-007

Salem Generating Station CFCU AOT Extension FREQUENCY SURROGATE SAFETY RISK METRIC (PER RX-YR)

GOAL (PER RX-YR)

CDF 1.62E-05(1) 1 E-4 LERF 7.32E-07<2>

1 E-5 Table Notes:

(l)

At truncation of 1 E-11/yr using the single top PRA model.

(Z)

At truncation of 1 E-12/yr using the single top PRA model.

The CDF risk metric meets the NRC surrogate safety goal with margin.

3.4.2 Risk Metric Calculational Approach To determine the effect of the proposed 14 day Allowed Outage Time for unavailability of two CFCUs, the guidance provided in Regulatory Guides 1.17 4 and 1.177 is used.

Thus, the following risk metrics are used to evaluate the risk impacts of extending the CFCU AOT from 7 days to 14 days:

Regulatory Guide 1.174 iJCOFAvE = change in the annual average CDF due to the increase in on-line maintenance unavailability for any two CFCUs based on the increased Allowed Outage Time.

This risk metric is used to compare against the criteria of Regulatory Guide 1. 174 to determine whether a change in COF is regarded as risk significant. These criteria are a function of the baseline annual average core damage frequency, CDFaASE*

LJLERFAvE =change in the annual average LERF due to the increase in on-line maintenance unavailability for any two CFCUs based on the increased Allowed Outage Time. Regulatory Guide 1.174 criteria were also applied to judge the significance of changes in this risk metric.

Regulatory Guide 1.177 ICCOPcFcu =

incremental conditional core damage probability with two CFCUs out of-service for an interval of time equal to the proposed new Allowed Outage Time (14 days).

This risk metric is used as suggested in Regulatory Guide 1. 177 to determine whether a proposed increase in Allowed Outage Time has an acceptable risk impact.

3-6 SA-LAR-007

Salem Generating Station CFCU AOT Extension JCLERPcFcu =

incremental conditional large early release probability with two CFCUs out-of-service for an interval of time equal to the proposed new Allowed Outage Time (14 days).

Regulatory Guide 1.177 criteria were a/so applied to judge the significance of changes in this risk metric.

The evaluation of the above risk metrics is performed as follows.

The change in the annual average CDF due to the extension of the CFCU Allowed Outage Time for three instances of dual CFCU unavailability, CDF AVE, is evaluated by computing the following:

where:

CDF =(3xTcFcuJcDF

+(1-3xTcFcuJcDF NEW T CFCU T

BASE CYCLE CYCLE CDFNEW

=

Average CDF over a "typical" 18 month refueling cycle.

CDFsAsE =

baseline annual average CDF with average unavailability of CFCUs consistent with the current CFCU Allowed Outage Time.

CDFcFcu

=

CDF evaluated from the PRA model with concurrent unavailability of two CFCUs out-of-service and compensatory measures that include prohibiting concurrent maintenance on the remaining CFCUs and one Containment Spray pump.

T cFcu

=

Total time per 18 month refueling cycle (T cYCLE) that two CFCUs are out-of-service for the extended Allowed Outage Time -- assumed to be 14 days.

Tcycle

=

18 months of operation (1.5 x 365 days= 547.5 days).

where, CDF 42days 505.5 days

= CDFCFCU X

+ CDFBASE X __ ____:__

547.5days 547.5days iJ.CDF = CDFNEW -CDFBASE

=

Difference between CDF with current technical specifications and the CDF for an average 18 month cycle with three instances of concurrent unavailability of two CFCUs extended to 14 days.

A similar approach was used to evaluate the change in the average LERF due to the requested Allowed Outage Time, LERF:

3-7 SA-LAR-007

where:

Salem Generating Station CFCU AOT Extension LERF

= (

3 X TCFCU J LERF +(1-3 X TCFCU JLERF NEW T

CFCU T

BASE CYCLE CYCLE ifLERF = LERFNEW -LERFsAsE LERFNEw

= Average LERF over a "typical" 18 month refueling cycle.

LERFsAsE

= baseline annual average LERF with average unavailability of CFCUs consistent with the current CFCU Allowed Outage Time.

LERFcFcu

= LERF evaluated from the PRA model with concurrent unavailability of two CFCUs out-of-service and compensatory measures that include prohibiting concurrent maintenance on the remaining CFCUs and one Containment Spray pump.

LERF

= Difference between LERF with current technical specifications and the CDF for an average 18 month cycle with three instances of concurrent unavailability of two CFCUs extended to 14 days.

The evaluation was performed based on the assumption that the extended Allowed Outage Time would be applied to three instances of two CFCUs being unavailable simultaneously per 18 month refueling cycle, hence T cFcu = 42 days. The refueling cycle is based on an 18 month schedule (T CYCLE= 547.5 days).

The incremental conditional core damage probability (ICCDP) and incremental conditional large early release probability (ICLERP) are computed using the definitions from Regulatory Guide 1.177. In terms of the above defined parameters, the definition of ICCDP for the dual unavailability of two CFCUs is as follows:

ICCDPcFcu= (CDFcFcu-CDFsAsE)TcFcu ICCDPCFcu= (CDFcFcu-CDFBAsE) * (14 days)* (365 days/yearF1 ICCDPcFcu= (CDFcpcu-CDFBASE)

3.84 x 10-2 year Note that in the above formula 365 days/year is merely a conversion factor to provide the Allowed Outage Time units consistent with the CDF frequency units. The ICCDP values are dimensionless probabilities to evaluate the incremental probability of a core damage event over a period of time equal to the extended Allowed Outage Time. This 3-8 SA-LAR-007

Salem Generating Station CFCU AOT Extension should not be confused with the evaluation of CDF AVE in which the CDF is averaged over an 18 month refueling cycle.

Similarly, ICLERP is calculated using the methodology described above:

ICLERPcFcu = (LERFcFcu - LERFBASE)

3.84 x 10-2 year 3.4.3 CFCU AOT Extension PRA Analysis The Base PRA model of record (MOR) has been reviewed for applicability to the Salem CFCU AOT extension and the following changes were included as part of the analysis used for this risk application:

A change to the common cause term for multiple failure of three of more CFCUs was made to account for the identified failure of two CFCUs. The common cause basic event VCS-FNR-FR-DF01 in the MOR was changed from its nominal failure probability of 6.48E-06 to 8.22E-01 using the "RaspCCF" calculational methodology for staggered testing employed in the SAPHIRE PRA software program [22] given that two out of five components have initially failed. This condition produced the largest conditional failure probability for failure of the remaining fans.

A change was made to eliminate certain accident sequences from the cutset results that would not necessarily lead to core damage due to being long-term and slowly developing scenarios that would not require containment cooling, either by the Containment Spray (CS) System or Containment Fan Cooler Units (CFCUs). A MAAP 4.0.6 sensitivity analysis showed that this type of accident sequence did not require successful containment cooling either via CS or CFCUs in order to avert core damage.

The first model change was incorporated into this analysis via a flag file, which was used to adjust the failure probabilities to simulate the unavailability of the #1 and #3 CFCU basic event maintenance terms, since this particular combination of CFCUs shared the maximum change in CDF to a value of 7 significant figures with one other combination (#1 and #4). The other CFCU maintenance terms were set to zero to simulate current maintenance practices and Technical Specification requirements in which the remaining fan coolers are being protected.

Additionally, the mutually exclusive logic in the PRA MOR also prohibits cutsets that would involve three or more CFCUs in maintenance with simultaneous maintenance of any one train of Containment Spray.

The common cause term was also adjusted based on the RaspCCF 3-9 SA-LAR-007

Salem Generating Station CFCU AOT Extension calculational methodology described above. The flag file employed for this analysis is presented below, which was used to calculate the CDFcFcu and LERFcFcu terms defined above:

VCS-FNR-TM-VHE15 EQU

.T.

VCS-FNR-TM-VHE17 EQU

.T.

VCS-FNR-TM-VHE16 prob 0.0 VCS-FNR-TM-VHE18 prob 0.0 VCS-FNR-TM-VHE19 prob 0.0 VCS-FNR-FR-DFOl prob 8.2223E-01 The second change listed above necessitated the creation of an application specific model, known as the SA112B PRA model, which is documented in risk application SA MISC-016, "Application Specific Model for CFCU LAR." This application specific model eliminates some cutsets that included late failure of the AFW system and containment cooling failures.

Containment cooling was shown to not be necessary for these scenarios based on a thermal hydraulic sensitivity analysis using the MAAP computer code.

The model calculations were performed using the SA 1128 PRA model to develop the increase in risk associated with those configurations involving concurrent unavailability of two CFCUs for an extended AOT, assuming three separate occurrences within a given fuel cycle.

These calculations were used to develop the risk metrics for comparison with RG 1.17 4 and RG 1.177 acceptance guidelines.

3.4.4 Compensatory Measures There were no compensatory measures implemented other than standard maintenance practice that has already been identified in OP-AA-1 08-116 [21 ], which involves protecting the other available CFCUs and one Containment Spray pump when two CFCUs are made available for maintenance.

3.4.5 Calculated Risk Metrics Table 3-1 summarizes the calculated values for the NRC specified risk metrics (CDF, LERF, ICCDP, and ICLERP) for the proposed change to the AOT involving the concurrent unavailability of two CFCUs for a period of 14 days, with the premise that 3-1 0 SA-LAR-007

Salem Generating Station CFCU AOT Extension this occurs on three separate occasions throughout a given refueling cycle (18 months).

The process used to calculate the risk metrics complies with NRC Regulatory Guides 1.174 and 1.177.

TABLE 3 -1 QUANTITATIVE RESULTS OF THE RISK METRICS FOR CONCURRENT UNAVAILABILITY OF TWO CFCUS PARAMETER VALUE COMMENTS TcvcLE 547.5 days Based on 1 8 month refueling cycle TcFcu 14 days Number of days that two CFCUs are unavailable CDFcFcu 1.62E-05 CDF based on application of flag file for two unavailable CFCUs and adjusted CCF term LERFcFcu 7.32E-07 LERF based on application of flag file for two unavailable CFCUs and adjusted CCF term CDFsASE 1.55E-05 CDF for PRA MOR LERFsAsE 7.29E-07 LERF for PRA MOR Average CDF over one 1 8 month refueling cycle CDFAVE 1.55E-05 for three instances of dual CFCU unavailability for 14 days at a time Average LERF over one 1 8 month refueling cycle LERFAVE 7.29E-07 for three instances of dual CFCU unavailability for 14 days at a time Difference between CDF with current technical specifications and the CDF for an average 18 CDF 5.61 E-08 month cycle with three instances of concurrent unavailability of two CFCUs extended to 14 days This value is below Region I l l of RG 1.1 74 Difference between LERF with current technical specifications and the LERF for an average 1 8 ELERF 2.1 5E-1 0 month cycle with three instances of concurrent unavailability of two CFCUs extended to 14 days This value is well below Region Ill of RG 1.17 4 ICCDPcFcu 2.80E-08 Below 1 E-06 Acceptance Guideline of RG 1.177 ICLERPcFcu 1.08E-1 0 Below 1 E-07 Acceptance Guideline of RG 1.177 3.4.6 Discussion of Risk Due to External Events Salem does not have separate probabilistic risk assessments (PRA) for Fire, External Flood or Seismic events. An internal Fire PRA (FPRA) is currently under development.

The FPRA was developed as part of the station license renewal project. However, the 3-1 1 SA-LAR-007

Salem Generating Station CFCU AOT Extension FPRA did not undergo an industry peer review as required by NRC Regulatory Guide 1.200 for use in risk informed regulatory applications. PSEG is working to complete the FPRA. The current version, which follows the methodology of NUREG/CR-6850 with some incorporation of more recent data and methods can be used to provide valuable insights, but not quantitative information. The project is expected to culminate with an industry peer review.

Seismic events are not currently included in the MOR.

The Seismic PRA development for both Salem and Hope Creek is being considered as part of a PSEG Nuclear long-term planning strategy, which will determine the need for such an analysis using PRA methods. External Flood, Low Power/Shutdown, as well as other external events are also being considered as part of a long-term risk management program strategic plan.

Like most nuclear power stations, Salem completed an Individual Plant Examination of External Events in 1996. The summary of that work can be found in the Document Control and Records Management System (DCRMS) as VTD 320758 [1 0]. Section 1.4 summarizes the major findings and states that fire and seismic events were the only important contributors to external events core damage.

The fire related CDF was 2.3E-05 per year.

The seismic related CDF was 9.5E-06 per year using a more conservative hazard curve (LLNL) and 4.7E-06 per year using a curve described as more realistic (EPRI).

Section 1.4.3 of the IPEEE explains how the risk of High Winds, External Flood and other external events were screened out as insignificant. The risk due to fire and seismic events is discussed in the following sections.

3.4.7 Discussion of Fire Risk Section 1.4.2 of Salem's IPEEE discusses the station fire risk. The total CDF from fire events was calculated to be 2.3E-05 per year. The top four scenarios are described as follows:

24% of the total CDF (5.5E-06 per year) caused by a fire in the relay room that damages more than one cabinet and requires control room abandonment. Core cooling by alternate shutdown methods is unsuccessful, leading to core damage.

3-1 2 SA-LAR-007

Salem Generating Station CFCU AOT Extension 9.1% of the total CDF (2. 1 E-06 per year) caused by a fire in the control room which damages consoles 1, 2, or 3 and requires control room abandonment.

Core cooling by alternate shutdown methods is unsuccessful, leading to core damage.

7.4% of the total CDF (1.7E-06 per year) caused by a relay room fire with damage limited to one electrical cabinet.

Control room functions remain available but degraded. Core cooling is unsuccessful, leading to core damage.

4.6% of the total CDF (1. 1 E-06 per year) caused by a control room fire with damage limited to control console 3. Equipment damage requires control room abandonment.

Core cooling by alternate shutdown methods is unsuccessful, leading to core damage.

Another perspective of fire risk is the relative importance for a fire in each area. The top four areas are the relay room (31 %), control room (30%), the 460VAC switchgear room (7%), and the 4kVAC switchgear room (7%). Core damage following a relay or control room fire arise primarily from failure to implement alternate shutdown methods following control room abandonment. The switchgear room fires cause loss of one vital bus.

Additional equipment becomes unavailable if the fire is not suppressed.

Random failures of equipment unaffected by fire lead to core damage for these scenarios.

The Work-in-Progress (WIP) Fire PRA was used to gain insights into the risk impact that would be expected given the concurrent unavailability of two CFCUs.

The results showed that although the power and control cables are routed through the rooms identified above (and others), the WIP Fire PRA has a high dependence on offsite power. In particular, the simultaneous unavailability of two CFCUs yielded a minimal increase in risk of about two orders of magnitude below the base level Fire CDF. The risk increase was dominated by loss of offsite power (LOOP) scenarios in which the operator fails to isolate the excess letdown line from the RCS, followed by subsequent operator failure to align the RHR system to deliver water to the containment spray system. Although the failure to isolate the excess letdown flowpath is postulated to result in a LOCA, the excess letdown line is not normally in service, except for transition periods such as during startup operations. Because the letdown line is not normally in service during full power operation, the perceived risk increase for fire hazards would most likely be negligible.

3-1 3 SA-LAR-007

3.4.8 Discussion of Seismic Risk Salem Generating Station CFCU AOT Extension Section 1.4.1 of Salem's IPEEE reports four significant contributors to seismic related CDF, all associated with station blackout (SBO). These four scenarios represent 78%

of the total seismic related CDF based on the more conservative LLNL hazard curve:

31% of the total CDF (2.9E-06 per year) is caused by seismic damage to the switchyard ceramic insulators that leads to a loss of offsite power (LOOP). This is coupled with non-seismic failures of the emergency diesel generators (EDGs) or EDG support systems.

14% of the total CDF (1.3E-06 per year) is caused by seismic damage that causes both a LOOP and loss of service water (LOSW).

Service water is required to support the EDGs. Therefore, the LOSW leads to a loss of EDGs.

21% of the total CDF (2.0E-06 per year) is caused by seismic damage that causes both a LOOP and a loss of battery trains 'A' and 'B'. DC power from the batteries is required to start the EDGs. Therefore, the 'A' and 'B' EDGs fail to start. The station has two diesel fuel oil transfer pumps (DFOTPs) powered from the 'A' and 'B' vital buses. The 'C' EDG eventually fails when the associated fuel oil day tank is depleted.

12% of the total CDF (1.2E-06 per year) is caused by seismic damage that causes both a LOOP and failures of main control room instrumentation and control (I&C) caused by ceiling grid collapse.

Relay chatter was not considered significant to safe shutdown, and no vulnerability to containment failure or containment bypass leading to early failure was identified.

The review of the dominant cutsets related to extending the AOT for CFCUs did appear to have contributions stemming from LOOP scenarios, but it was the lack of adequate containment heat removal due to loss of CFCUs that prevented successful sump recirculation, which would be subsumed by SBO scenarios due to the fact that a loss of all AC power would prevent operation of the Emergency Core Cooling System (ECCS) pumps, i.e., RHR pumps. As such, it can qualitatively be inferred that there would be no significant impact on seismic risk due to extending the AOT for two CFCUs up to a period of 14 days.

3.4.9 Summary of Results In looking at the increase in risk due extending the AOT for CFCUs, the dominant failure mechanism is the loss of sump recirculation following either feed and bleed operation or 3-1 4 SA-LAR-007

Salem Generating Station CFCU AOT Extension 315 SALAR007 injection to mitigate LOCA events. Internal flood scenarios in the Mechanical Penetration room on the 78 elevation that damage AOVs affecting the flow of Service Water to the CFCUs inside containment combined with random failures of the Containment Spray system are responsible for loss of containment heat removal, which then can lead to loss of the Net Positive Suction Head (NPSH) for the Residual Heat Removal (RHR) pumps that transfer water from the containment sump to the injection pumps for recirculation back into the Reactor Coolant System (RCS). Heat removal from the RCS would be accomplished via the Component Cooling Water (CCW) system.

Table 32 shows the relative risk increase with regard to CDF for the dominant initiating events when comparing the nominal base level cutsets with those cutsets for the extended CFCU AOT using the deleteterm method of comparison between the two cutset files.

TABLE 342 DOMINANT RISK CONTRIBUTORS ATTRIBUTED TO EXTENDED CFCU AOT INITIATOR TYPE PERCENT DIFFERENCE Small and Medium LOCAs 37.60%

Loss of Offsite Power Events (LOOPs) 25.40%

Flooding in Flood Zone MP078 21.1%

Transients with Loss of Feedwater 7.50%

Other Internal Events 8.40%

Although the change in LERF was relatively insignificant for this analysis, the change in risk was dominated mostly by LOOP and transient scenarios. These accident sequences involved random failures of the remaining CFCUs and containment spray failure in combination with a preexisting containment leakage pathway to the environment.

Based on the results discussed above in Section 3.4.7 for fire hazards, it was deemed that any perceived risk increase would be negligible. For seismic hazards, Section 3.4.8 discussed that the impact would be minimal since the dominant sequences for

Salem Generating Station CFCU AOT Extension seismic events do not involve scenarios where containment sump recirculation is required, which would only be required following depletion of the Refueling Water Storage Tank (RWST) during feed and bleed operation or mitigation of LOCA events.

The results presented in Table 3-1 are well below the regulatory guidelines for a license amendment request:

The L'lCDF and L'lLERF risk metrics are well below the RG 1.174 acceptance guidelines for Region Ill, i.e., very small risk change.

The ICCDP for the CFCU AOT is well below the RG 1.177 acceptance guideline.

The ICLERP for the CFCU AOT is well below the RG 1.177 acceptance guideline.

3.5 PARAMETRIC UNCERTAINTY EVALUATION The evaluation of the CDF for the CFCU extended AOT assessment has been supported by a detailed qualitative and quantitative uncertainty evaluation.

The parametric uncertainty quantification is performed using the CAFTA utility, UNCERT, to identify the effect of the parametric correlation. The base model (SA 112B) uncertainty distribution for CDF of the application specific model is presented in Figure 3-1. The uncertainty distribution for CDF due to the condition in which two CFCUs (#1 and #3) are unavailable for a period of 14 days is shown in Figure 3-2. Likewise, for LERF, the base model uncertainty distribution is presented in Figure 3-3, with the AOT extension uncertainty distribution for LERF shown in Figure 3-4.

In addition, a set of practical sensitivity evaluations have been performed to demonstrate the influence of some of the key assumptions in the assessment. These sensitivities are discussed in Section 5.

3-1 6 SA-LAR-007

I I

l v

(l4

.J PARAMETER Point Est Samples Mean 5th percentile Median 95th percentile StdDev Skewness Sampling Method Sample Size Cutset File(s)

Selected Target(s)

Database ESTIMATE 1.55E-05 20000 1. 59E-05 7.49E-06 1.39E-05 3.02E-05 1.01 E-05 21.96886 Montecarlo 20000 CDF E-1 1.CUT CDF E-1 1 SA 1 1 2B.rr FIGURE 3-1 Salem Generating Station CFCU AOT Extension lEo!l!

CONFIDENCE RANGE

[1.6E-05, 1.6E-05]

[7.4E-06, 7.6E-06]

[1.4E-05, 1.4E-05]

[3. OE-05, 3.1 E-05]

PARAMETRIC UNCERTAINTY DISTRIBUTION FOR SALEM BASE MODEL CDF (SA112B) FOR THE CFCU AOT EXTENSION APPLICATION MODEL 3-1 7 SA-LAR-007

I I

l 1/

!14

/

lA.

\\

f \\

l \\

).......... +,

PARAMETER Point Est Samples Mean 5th percentile Median 95th percentile StdDev Skewness Sampling Method Sample Size Cutset File(s)

Selected Target(s)

Database ESTIMATE 1.62E-05 20000 1.65E-05 7.82E-06 1.44E-05 3.1 6E-05 9.74E-06 1 1.57679 Montecarlo 20000 CDF _1 1 -1 3.CUT CDF _1 1 - 1 3 SA1 12B.rr FIGURE 3-2 Salem Generating Station CFCU AOT Extension lE-&1 CONFIDENCE RANGE

[1.6E-05 I 1.7E-05]

[7.8E-06 I 7.9E-06]

[1.4E-05 I 1.4E-05]

[3.1 E-05 I 3.2E-05]

PARAMETRIC UNCERTAINTY DISTRIBUTION FOR SALEM CDF REPRESENTING THE CFCU AOT EXTENSION 3-1 8 SA-LAR-007

/'

I

/

n;

/

/\\

\\

t l

I PARAMETER I Point Est Samples Mean 5th percentile Median 95th percentile StdDev Skewness Sampling Method Sample Size Cutset File(s)

Selected Target(s)

Database ESTIMATE 7.29E-07 20000 7.44E-07 2.1 OE-07 5.50E-07 1.84E-06 7.69E-07 9.089499 Montecarlo 20000 LERF E-1 2.CUT LERF _E-1 2 SA1 1 2B.rr FIGURE 3-3 I

Salem Generating Station CFCU AOT Extension IE.JB 1E*lll CONFIDENCE I RANGE

[7.3E-07, 7.5E-07]

[2. 1 E-07, 2.1 E-07]

[5.4E-07, 5.6E-07]

[1.8E-06, 1.9E-06]

PARAMETRIC UNCERTAINTY DISTRIBUTION FOR SALEM BASE MODEL LERF (SA1 1 2B) FOR THE CFCU AOT EXTENSION APPLICATION MODEL 3-19 SA-LAR-007

OA v

I I

/

iL A

\\ \\,

l IJ--D..

PARAIVIElTE R Point Est Samples Mean 5th percentile Median 95th percentiles StdDev Skewness Sampling Met:ho*d Sample Size Cutset File(s)

Selected T ar9!Jel( s)

Database ESTIMATE 7.32E-07 20000 7.43E-07 2.10E-07 5.50E-07 1.81 E-06 8.32E-07 16.96292 Montecarlo 20000 LERF _12-13.CUT LERF 12-13 SA112B.rr FIGURE 3-4 Salem Generating Station CFCU AOT Extension 1&111 CONFIDENCE RANGE

[7.3E-07, 7.5E-07]

[2.1 E-07, 2.1 E-07]

[5.4E-07, 5.6E-07]

[1.8E-06, 1.9E-06]

PARAMETRIC UNICIERTAINTY DISTRIBUTION FOR SALEM LERF REPRESENTING THE CFCU AOT EXTENSION 3-20 SA-LAR-007

4.0 TECHNICAL ADEQUACY OF THE PRA MODEL Salem Generating Station CFCU AOT Extension This section summarizes the following with respect to the Salem PRA and its technical adequacy:

PRA Quality Technical Adequacy Conclusion External Events Considerations 4.1 PRA QUALITY The SA 112A version of the Salem PRA model is the most recent evaluation of the risk profile at Salem for internal event challenges. The Salem PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, and common cause events. The PRA model quantification process used for the Salem PRA is based on the event tree and linked fault tree methodology, which is a well-known methodology in the industry.

However, in the performance of this analysis, it was discovered during a review of the initial results using the SA 112A model that some cutsets were found to include late failures of the AFW system along with containment cooling failures.

Containment cooling was shown to not be necessary for these scenarios based on a thermal hydraulic sensitivity analysis using the MAAP computer code.

Because of this, an application specific model known as the SA 1128 PRA model was created to accommodate this change (see Section 3.4.3). The SA 1128 PRA model is documented in risk application SA-MISC-016, "Application Specific Model for CFCU LAR."

PSEG employs a multi-faceted approach to establishing and maintaining the technical adequacy and plant fidelity of the PRA models for all PSEG nuclear generation. This approach includes a proceduralized PRA maintenance and update process, which includes consideration of peer review Facts and Observations (F&Os) and their subsequent resolution.

PRA quality is assured for the Salem PRA model and documentation through a combination of the following:

4-1 SA-LAR-007

Salem Generating Station CFCU AOT Extension Confirmation of the fidelity of the model with the as-built, as-operated plant (see Section 4.1.1)

Use of methods and approaches consistent with the ASME PRA Standard Use of an Updating Requirement Evaluation (URE) database to track PRA model issues and potential enhancements (See Section 4.1.2)

Use of a PRA Peer Review (see Section 4.1.3) to identify areas for enhancement Use of highly qualified PRA practitioners qualified under the PSEG PRA Risk Management Program Use of internal reviews and interviews with system engineers and operating crew members 4.1.1 PRA Maintenance and Update The PSEG risk management process ensures that the applicable PRA model remains an accurate reflection of the as-built and as-operated plants. This process is defined in the PSEG Risk Management program, which consists of a governing procedure (ER-AA-600, "Risk Management") and subordinate implementation procedures. PSEG procedure ER-AA-600-1 015, "FPIE PRA Model Update" delineates the responsibilities and guidelines for updating the full power internal events PRA models at PSEG nuclear generation sites.

The overall PSEG Risk Management

program, including ER-AA-600-1 015, defines the process for implementing regularly scheduled and interim PRA model updates, for tracking issues identified as potentially affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, industry operating experience), and for controlling the model and associated computer files. To ensure that the current PRA model remains an accurate reflection of the as-built, as-operated plant, the Site Risk Management Engineer (SRME) reviews plant design modifications and any changes to plant procedures or calculations referenced in the PRA that could affect the risk profile and identifies any that need to be evaluated for consideration in future PRA updates per ER-AA-600-1 015.

Plant modifications and procedure revisions to associated with the 4th AFW pump and the changes associated with the Extended Loss of AC Power (ELAP) Fukushima-driven modifications led to the recent PRA update known as SA 1115A.

The effect on the outcome of this PRA analysis for the CFCU AOT extension was shown to be small in a sensitivity analysis.

4-2 SA-LAR-007

Salem Generating Station CFCU AOT Extension Because of this, the entire analysis was not re-performed following completion of the PRA update.

In addition to these activities, PSEG risk management procedures provide the guidance for particular risk management and PRA quality and maintenance activities. This guidance includes:

Documentation of the PRA model, PRA products, and bases documents The approach for controlling electronic storage of Risk Management (RM) products including PRA update information, PRA models, and PRA applications Guidelines for updating the full power, internal events PRA models Guidance in the use of quantitative and qualitative risk assessments in support of the on-line work control process for risk evaluations of maintenance tasks (corrective maintenance, preventive maintenance, minor maintenance, surveillance tests and modifications) on systems, structures, and components (SSCs) within the scope of the Maintenance Rule (1 OCFR50.65 (a)(4))

In accordance with this guidance, regularly scheduled PRA model updates occur approximately every three years, with longer intervals being justified if it can be shown that the PRA continues to adequately represent the as-built, as-operated plant. PSEG completed the SA112A PRA model in September 2014, which was the result of a regularly scheduled update of the PRA model. Although a recently updated PRA MOR was finalized in December 2016, it was not available by the time that the PRA analysis for the CFCU AOT extension was completed. However, the PRA quality discussion is also applicable to the SA115A PRA model since it also contains the earlier resolution of facts and observations (F&Os) that were incorporated in the SA1 12A PRA model. An additional sensitivity analysis was performed using the SA 115A PRA model (see Section 5.5.3).

4.1.2 Pending Changes Identified Against the PRA Model A PRA tracking database record is created for all issues that are identified that could impact the PRA model. This database, the Updating Requirement Evaluation (URE) database includes the identification of those plant changes that could impact the PRA model.

4-3 SA-LAR-007

Salem Generating Station CFCU AOT Extension 44 SALAR007 The plant modifications, procedure changes, and other PRA model issues identified in the URE database have been reviewed as part of the preparation of the risk assessment for the CFCU AOT extension request. None have been identified that would significantly affect the SA112A PRA model or its quantification.

4.1.3 Applicability of Peer Review Findings and Observations A PRA Peer Review of the Salem Rev. 4.1 PRA model was performed during November 2008. The peer review was performed against the ASME PRA Standard [4]

using the process defined in Nuclear Energy Institute (NEI) 0504 [27]. The PRA Peer Review resulted in a number of F&Os that indicated that there were a number of supporting requirements (SRs) that were categorized as Not Met for Capability Category II. Since then, a subsequent model revision (SA112A) was performed to address all of these F&Os.

A summary of the disposition of the 2008 Industry PRA Peer Review F&Os for the Salem PRA model was documented as part of the PRA Technical Adequacy for MSPI in the Salem MSPI Basis Document [5]. Additionally, many of the F&Os not related to MSPI were also addressed as part of the PRA model update that resulted in the SA112A PRA model, which is documented in Appendix G of the PRA model Quantification Notebook [6].

Tables 41 through 49 summarize each of the F&Os identified during the peer review that was performed in November 2008 and reported in Reference [7] with a brief summary of the resolution for each. A listing of those Supporting Requirements (SRs) that were revised between the 2005 [4] and the 2009 [11] versions of the ASME PRA Standard with a description of the change and associated comments is provided in Table 410. In addition, a gap assessment was also performed against the NRC clarifications in Appendix A of RG 1.200 [3] with regard to the ASME Standard [11] and comments tabulated in Table 411.

Subsequent to the November 2008 peer review [7], the SA112A PRA model [6]

addressed and resolved those SRs not meeting Capability Category II. Based on the PRA Peer Review process and the updated PRA model (SA112A), the Salem PRA model is deemed satisfactory for use in PRA applications.

Salem Generating Station CFCU AOT Extension 45 SALAR007

Salem Generating Station CFCU AOT Extension 46 SALAR007 TABLE 441 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INITIATING EVENTS ANALYSIS RA4Sa4 2009 SR #

RA4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IEA1 IEA1 IEA101 The plantspecific search only addresses supporting systems. The listing is not encompassing of possible plantspecific initiators found at other plants such as a loss of charging (impact on RCP seal cooling). Loss of charging would lead to a reactor trip and would decrease redundancy for RCP seal cooling.

Table 22 in the IE notebook (SAPRA001), which was revised during the 2012 PRA model update, lists the basis for this event not being a unique plant trip initiator. No further action required.

IEA2 IEA2 SR Met Consideration of some initiating events may be required based on shutdown requirement.

N/A IEA3 IEA3 SR Not Met IEA3001, IEA3002 The plantspecific history indicates that on 12/31/01 an event occurred resulting in SI. The categorization of initiating events does not account for this or the case of ESFAS actuation.

Spurious SI was added to the SA112A model as initiating event Tsi.

No further action required.

IEA4 IEA3a SR Not Met IEA3001 The available documentation lists that past PRAs are examined.

However, there appears to be no documentation of this evaluation with consideration of plants of similar design.

Section 2.1 of the initiating events notebook indicates that comparisons were made to industry data and to other plants.

Additional information was added to the IE notebook (SAPRA001, rev. 1) at the end of Section 2 to compare initiators from Watts Bar, South Texas Project, Surry, and Byron/Braidwood. No further action required.

IEA5 IEA4 SR Met:

(CC I)

IEA4001 The analysis only addresses support systems and does not address the impact of other operating systems (such as charging) with regard to events resulting in a plant upset and subsequent trip signal.

The observation associated with IEA4 says, The analysis only addresses support systems and does not address the impact of other operating systems (such as charging) with regard to events resulting in a plant upset and subsequent trip signal. IEA4 asks for a systematic review of plant systems to identify potential initiating events. A systematic review was performed in the IE notebook and documented in Table 22. Loss of charging was not included as a separate initiator based on screening criterion identified in the initiating events notebook. Also, see the response for SR IEA1. No further action required.

IEA6 IEA4a SR Not Met IEA4001 See supporting requirement IEA4. Not all potential systems were addressed.

N/A IEA7 IEA5 SR Not Met IEA501 SA PRA Initiating Events Notebook, SAPRA001, Revision 0, Section 2.1.2 describes the review of Salem Generating Station Experience and Trip Review. No mention is made of consideration of events that occurred at conditions other than atpower operation.

Appropriate evidence exists that LERs were reviewed for other than "atpower" conditions to determine whether or not a new initiator should be added that was not already incorporated into the PRA model

(\\\\erinpa21\\Customers\\PSEG_Salem\\brad_turnover\\peer_review_rel ated\\support_for_model_development\\s1r41\\ie\\Initiating Events\\plant data\\salem_lers\\). The LERs reviewed are documented in the initiating evetns notebook (SAPRA001 revision 1). No further action required.

Salem Generating Station CFCU AOT Extension 47 SALAR007 TABLE 441 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INITIATING EVENTS ANALYSIS RA4Sa4 2009 SR #

RA4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IEA8 IEA6 SR Met:

(CC I)

IAA601 SA PRA Initiating Events Notebook, SAPRA001, Revision 0, Section 2.1.2 does not indicate that plant operations, maintenance, engineering, and safety analysis personnel were interviewed or included in the review process for the initiating events notebook to determine if potential initiating events have been overlooked.

Maintenance Rule Expert Panel meeting was held on 10/5/2012 to review the updated Initiating Events Notebook and comments were incorporated. See Section 2 of the IE notebook (SAPRA001, revision 1) for discussion of this review by plant personnel. No further actions required.

IEA9 IEA7 SR Met:

(CC I)

IEA701 SA PRA Initiating Events Notebook, SAPRA001, Revision 0, Section 2.1.2 does not indicate that a review of plantspecific or industry operating experience was performed for the purpose of identifying initiating event precursors.

A list of LERs was previously reviewed for the existence of any initiating event precursors and document in the aforementioned spreadsheet located in the following LAN location:

\\\\Njnbufp19\\PSEG Power\\System Engineering\\Salem\\PRA\\SA112A Files and Documents\\Supporting Documents\\Initiating Events. A statement was added to the IE notebook documenting that this review was previously performed. Since industry information was also reviewed in addition to plantspecific information, this SR could actually be considered as being met at Capability Category III. No further action required.

IEA8 IEA8 This SR was deleted in RASb2005.

N/A IEA9 IEA9 This SR was deleted in RASb2005.

N/A IEA10 IEA10 SR Met SA PRA Initiating Events Notebook, SAPRA001, Revision 0, Section 2.1.3 describes the consideration of multiunit site initiating events. Based on that analysis, dual unit initiating events for loss of service water, loss of control air, and loss of offsite power were included.

N/A IEB1 IEB1 SR Met N/A IEB2 IEB2 SR Met A structured process was followed in the grouping of the initiating events.

N/A IEB3 IEB3 SR Not Met IEB3001 The potential for SI actuation is placed in the general transient category with events such as reactor trip and considered to be no worse than the reactor trip. However, unmitigated SI events can challenge a PORV resulting in a consequential LOCA. These two events should not be grouped.

Initiating events may be grouped reasonably in accordance with SR IEB3 as long as the impacts are comparable to existing initiators and the grouping does not impact significant accident sequences.

Spurious SI will generally be recovered (by resetting SI) and the event will be a transient. If SI is not reset prior to PORV operation, a logic change was added to the SA112A PRA model to transfer to the small LOCA event tree. See the Initiating Events Notebook for further details (SAPRA001). No further action required.

IEB4 IEB4 SR Met Grouping of initiating events was performed.

N/A

Salem Generating Station CFCU AOT Extension 48 SALAR007 TABLE 441 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INITIATING EVENTS ANALYSIS RA4Sa4 2009 SR #

RA4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IEB5 IEB5 SR Met SA PRA Initiating Events Notebook, SAPRA001, Revision 0, Section 2.1.3 describes the consideration of multiunit site initiating events. Based on that analysis, dual unit initiating events for loss of service water, loss of control air, and loss of offsite power were included. There is no indication that these events were subsumed into other events.

N/A IEC1 IEC1 SR Met IEC101 Based on a review of Sections 3.0 of Salem SAPRA001, Revision 0, "Initiating Events", initiating event frequencies have been calculated using relevant generic and plantspecific data. Generic data is from NUREG/CR5750 Rates of Initiating Events at U.S.

Nuclear Power Plants: 19871995. More recent industry sources of initiating event data such as from NUREG/CR6928, "Industry

Average Performance for Components and Initiating Events at U.S.

Commercial Nuclear Power Plants," should be used. For initiators when plantspecific data is available, the initiating event frequency is calculation by Bayesian updating the industry prior with the plant

specific data.

As part of updating initiating event frequencies, use of newer loss of offsite power (LOOP) data was incorporated into the CAFTA model database as part of the 2012 PRA update, including dualunit LOOP events. See the Initiating Events Notebook for further details (SA

PRA001). The normal PRA update process (ERAA6001015) ensures that this activity is routinely performed. No further action required.

IEC2 IEC1a SR Met The most recent applicable plant specific data has been used to quantify the initiating event frequencies, based on a review of Section 3.1 of Salem SAPRA001, Revision. 0, "Initiating Events" the plantspecific data is from 10/1/2000 to 12/31/2006.

N/A IEC3 IEC1b SR Met IEC1b01 Section 3.3 of the Salem SAPRA001, Revision 0 notebook has a brief discussion of the special initiators developed using fault trees.

It references the applicable system model notebooks along with the basic event for the initiator in the fault tree. For the loss of SW initiator, notebook SAPRA005.13, Revision 0 was reviewed for the modeling of the initiator. There was no description of the how the loss of SW initiator is modeled as an initiator. Also, there did not appear to be documentation of the recoveries credited in the initiator fault trees and whether the actions are justified for preventing the initiator. This SR is considered met but SR IED2 will be considered not met for documentation.

Support system initiators that were developed using fault trees were identified in the Initiating Events Notebook (SAPRA001 revision 1) with reference made to the applicable system notebook for model development and details. No further action required.

IEC4 IEC2 SR Met Based on a review of Section 3.2 of the Salem SAPRA001, Revision 0 notebook, Bayesian updating has been performed appropriately and complies with this SR.

N/A IEC5 IEC3 SR Not Met IEC301 The initiators that are fault trees, loss of SW, loss of Capability Category, loss of control area ventilation, and others, do not appear to be based on reactor year. For example, under gate IETSW, basic event SWSPIPRPTBHDR has a mission time of 8760 hours0.101 days 2.433 hours 0.0145 weeks 0.00333 months .

This was implemented in the CAFTA PRA model SA112A.CAF with the event AVAILFACTOR set to the value of 0.925 as determined in the Initiating Events Notebook (SAPRA001). No further action required.

Salem Generating Station CFCU AOT Extension 49 SALAR007 TABLE 441 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INITIATING EVENTS ANALYSIS RA4Sa4 2009 SR #

RA4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IEC6 IEC4 SR Not Met IEA101 Quantitative screening does not appear to be performed, based on a review of the Salem SAPRA001, Revision 0 notebook. Therefore, subsection a) and b) of this SR are considered met. However, subsection c) of this SR does not appear to be met as noted in the e review for SR IEA1, some events that require the plant to be shut down due to technical specifications were screened (e.g., loss of a 4KV bus).

See above response for SR IEA1.

IEC7 IEC5 SR N/A Time trend analysis is not required for a Capability Category II rating.

N/A IEC8 IEC6 SR Met IEC1b01 Section 3.3 of the Salem SAPRA001 Revision 0 notebook provides some limited description of the initiators that are fault trees. Details of the modeling of the system fault tree are provided in the applicable system notebooks. Applicable systemsanalysis requirements for faulttree modeling appear to have been used. The initiating event modeling is performed to the same level of detail as the fault trees used for the modeling of postinitiator operation of mitigating systems and appears to be appropriate. The documentation of the development of the initiator fault trees could be enhanced.

N/A IEC9 IEC7 SR Met Initiating events that rely upon fault tree modeling correctly produce failure frequencies rather than top event probabilities.

N/A IEC10 IEC8 SR Met The logic under gates IETSW and IETCC were reviewed in fault tree SIR4.Caf. The fault tree models used to calculate initiating event frequencies appear to model all relevant combinations of events involving the annual frequency of one component failure combined with the unavailability (or failure during the repair time of the first component) of other components.

N/A IEC11 IEC9 SR Met The logic under gates IETSW and IETCC were reviewed in fault tree SIR4.Caf. A human reliability analysis was used to calculate the probability of failure of the operator actions credited under these gates as documented in Salem model notebook SAPRA004, Revision 0.

N/A IEC12 IEC10 SR Met IEC1001 Tables 36 and 37 contain a comparison of the initiator frequencies used in the Salem model as compared with NUREG/CR5750.

However, there is no comparison with other sources. Since many of the frequencies used in the Salem model use the same frequencies used in the Salem model as compared with NUREG/CR5750.

However, there is no comparison with other sources. Since many of the frequencies used in the Salem model use the same frequencies from NUREG/CR5750, such as the LOCAs, the tables should be updated with a comparison with other similar plants.

This was performed and documented in the IE notebook (SAPRA

001, Revision 1) as part of the 2012 PRA update. No further action required.

Salem Generating Station CFCU AOT Extension 410 SALAR007 TABLE 441 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INITIATING EVENTS ANALYSIS RA4Sa4 2009 SR #

RA4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IEC13 IEC11 SR Met (CC I/II)

Initiating event frequencies for rare events and extremely rare events are based on generic data.

N/A IEC14 IEC12 SR Met (CC I/II)

Section 3.5 of the Salem SAPRA001, Revision 0 notebook provides some description of the ISLOCA screening, quantification of the initiator frequency and the event tree development. The details of the ISLOCA analysis are contained in PLG Report Number PLG

0826, Containment Bypass Analysis. The analysis considers the requirements in this SR as appropriate.

N/A IEC15 IEC13 SR Met Mean values and error factors are developed for the initiating event frequencies modeled as documented in Sections 3.2, 3.3 and 3.4 of the Salem SAPRA001, Revision 0.

N/A IED1 IED1 SR Met The initiating event analysis documentation is a logical format consistent with the major high level requirements for initiating event analysis. Improvements can be made to the notebook as noted by the F&Os in the other SRs.

N/A IED2 IED2 SR Met The Salem initiating event notebook SAPRA001, Revision 0 provides good documentation of the identification, grouping, and evaluation of plantspecific data, screening and quantification of the frequencies. However, as noted in a number of the F&Os for HLR IEA, B and C, the notebook lacks sufficient documentation for verifying the requirements of some SRs.

N/A IED3 IED3 SR Not Met SCC301, SCC302 While assumptions are documented to some degree in the Salem SAPRA001, Revision 0 notebook, a systematic review/listing of assumptions and sources of uncertainty as defined by the Standard is not documented or referenced in the initiating events notebooks.

This issue of uncertainty and key assumptions has been addressed with the creation of the PRA Uncertainty Notebook (SAPRA018) during the PRA model update that resulted in the PRA Model of Record SA112A. No further action required.

Salem Generating Station CFCU AOT Extension 411 SALAR007 TABLE 442 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR ACCIDENT SEQUENCE ANALYSIS RA4Sa4 2009 SR RA4Sb4 2005 SR Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION ASA1 ASA1 SR Met ASA101 Accident Sequences and Event Tree Development Notebook, SAPRA

002, Revision 0 describes the method used for development of the accident sequences and event trees covering all three required aspects.

The graphical representation of the event trees is not included in the notebook, but is available through reference to the appropriate CAFTA event tree files.

Event tree figures were included in the Accident Sequence Event Tree (SAPRA002, revision 1) notebook as Appendix A. No further action required.

ASA2 ASA2 SR Met Accident Sequences and Event Tree Development Notebook, SAPRA

002, Revision 0 describes the method used for development of the accident sequences and event trees. Section 2.0 describes the key safety functions necessary to reach a safe, stable state and prevent core damage.

N/A ASA3 ASA3 SR Met Accident Sequences and Event Tree Development Notebook, SAPRA

002, Revision 0 describes the method used for development of the accident sequences and event trees. Sections 3 through 9 define systems that can be used to mitigate each modeled initiating event class.

N/A ASA4 ASA4 SR Met Accident Sequences and Event Tree Development Notebook, SAPRA

002, Revision 0 describes the method used for development of the accident sequences and event trees. Sections 3 through 9 describes the achievement of key safety functions for each initiating event. Operator actions are described in general terms.

N/A ASA5 ASA5 SR Met IEB301 Spurious SI is subsumed into the Turbine Trip initiating event and, therefore, into the General Transient event tree. However, the path through the EOPs would be different for the two events.

Initiating events may be grouped reasonably in accordance with SR IEB3 as long as the impacts are comparable to existing initiators and the grouping does not impact significant accident sequences.

Spurious SI will generally be recovered (by resetting SI) and the event will be a transient. If SI is not reset prior to PORV operation, a logic change was added to the SA112A PRA model to transfer to the small LOCA event tree. See the Initiating Events Notebook for further details (SAPRA001). No further action required.

ASA6 ASA6 SR Met Accident Sequences and Event Tree Development Notebook, SAPRA

002, Revision 0 describes the accident sequences in accordance with the timing of the event to the extent practical.

N/A

Salem Generating Station CFCU AOT Extension 412 SALAR007 TABLE 442 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR ACCIDENT SEQUENCE ANALYSIS RA4Sa4 2009 SR RA4Sb4 2005 SR Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION ASA7 ASA7 SR Met (CC I/II)

ASA701, ASA702 Accident Sequences and Event Tree Development Notebook, SAPRA

002, Revision 0 delineates the possible accident sequences for each modeled initiating event. However, some sequences are not explicitly modeled in the singletop fault tree (e.g., TT sequences S04 and S05 are combined into a single fault tree gate). No documentation was found to describe the basis of these combinations. In addition, SAPRA002, Revision 0, Section 3.3.4.5 states that the Te3 and Te4 event trees have sequences that were not modeled because they have "very low frequencies." No basis for this assessment was documented. The VS ISLOCA sequence with no piping failure is assumed to be terminated with operator isolation of the suction path using the pump suction isolation MOVs. However, isolation cannot be accomplished until primary pressure is reduced. The potential for flooding of adjacent areas by water lost through the RHR pump seals and/or RHR heat exchangers prior to isolation does not appear to have been evaluated.

Sequence endstates that exhibit identical core damage characteristics were combined. The only reason that there are two different endstates identified is to distinguish between an isolated and non

isolated containment. A revision was made to the Accident Sequence Notebook (SAPRA002) to state that sequences were combined that exhibit identical core damage characteristics under a single gate in the fault tree logic for Level 1 sequences in order to conserve core damage numerical results. No further action required.

ASA8 ASA8 SR Met ASA801 Accident Sequences and Event Tree Development Notebook, SAPRA

002, Revision 0 and the associated CAFTA event trees define the end state of each sequence as success or core damage. However, the SBO sequences S08, S11, S14 and S17 are assumed to be successful based on offsite power recovery. Operator action to restore mitigating systems after power recovery is not addressed. In addition, given the fact that power recovery is only credible out to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , 20 hours2.314815e-4 days 0.00556 hours 3.306878e-5 weeks 7.61e-6 months of mitigating system operation and the potential failures of that equipment over a significant portion of the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission time is not being addressed.

This failure to address recovery of mitigating systems following power recovery does not ensure a safe, stable end state has been reached for some SBO sequences. There is also concern that the application of offsite power recovery is included twice in the modeling of the SBO event.

Recovery is credited in the application of a diesel mission time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and again through the application of offsite power recovery top event RBU.

There is no "doublecounting" of offsite power recovery being applied in the SA112A PRA model. The concept of a dieselmission run time of 6.2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months that was developed in Section 5.0 of the Data notebook was meant to estimate a "timeaveraged" value for which the EDG would be required to run and supply AC power prior to recovery of an offsite power source. The RBU terms that are employed in the PRA model are not recovery terms but flags that are meant to delineate a particular set of circumstances during a particular accident sequence to allow the appropriate "recovery before uncovery" probability to be applied to the cutset in question. This is separate from the run time that was calculated in determining how long, on average, the EDG would be expected to run prior to recovery of offsite power, which was based on the worst set of conditions, i.e., weatherrelated causes.

This approach is also consistent with other Westinghouse PWR PRA models. For the issue of mitigating systems that would be required to function following the possible recovery of offsite power, they are not explicitly modeled as being subject to "restart" failures due to the fact that system start failures are on the order of 1E3. However, a sensitivity analysis was performed that estimated the frequency of LOOP events that result in successful recovery of offsite power, which was added to the initiating event frequency for transient events without PCS (%TP). The resultant CDF calculated with this adjusted %TP frequency resulted in a 0.5% increase in CDF and a 0.4% increase in LERF. Because of these small changes in CDF and LERF, there is no expected impact on MSPI results and the requisite change to PRA model logic for these additional sequences can be deferred until a

Salem Generating Station CFCU AOT Extension 413 SALAR007 TABLE 442 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR ACCIDENT SEQUENCE ANALYSIS RA4Sa4 2009 SR RA4Sb4 2005 SR Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION future PRA update (see URE # 2015028). For this URE, there is no further action required.

ASA9 ASA9 SR Met:

(CC II)

Accident Sequences and Event Tree Development Notebook, SAPRA

002, Revision 0 Section 2.0 indicates that success criteria was based on combination of generic, similar plant, and plantspecific sources.

N/A AS

A10 AS

A10 SR Met:

(CC I)

ASA1001 Systems and operator actions required to meet each key safety function are discussed in general terms in the Accident Sequences and Event Tree Development Notebook, SAPRA002, Revision 0 Sections 3 through 9. Operator actions and diverse systems to satisfy top events are included in the fault tree but are grouped under common top events in the accident sequence model (e.g., core decay heat removal includes AFS, operator action to depressurize, and condensate under a common top event). However, the modeling of offsite power recovery in the SBO event tree does not explicitly model the differences in recovery times or plant response associated with different RCP seal leakage rates. Instead, a single lumped recovery event is modeled.

A weighted average analysis of the size of a RCP seal LOCA with various configurations of successful means of heat removal mitigation with offsite power nonrecovery probabilities was performed and is consistent with other Westinghouse PWR models. This is described in Appendix D of SAPRA002 Revision 1. There is no further action required.

AS

A11 AS

A11 SR Met ASA1101 Transfers between event trees are described in the Accident Sequences and Event Tree Development Notebook, SAPRA002, Revision 0 Sections 3 through 9.

Transfer of certain sequences to other event trees is discussed for each event tree in the event tress construction section of the Accident Sequence Event Tree notebook. No further action required.

ASB1 ASB1 SR Met This requirement is met by Sections 3 and 9 of the Accident Sequence notebook. These sections identify the mitigating systems and how the accident progresses depending the equipment availability. The singletop fault tree model explicitly models initiator impacts on mitigating systems.

N/A ASB2 ASB2 SR Met This requirement is met by Sections 3 and 9 of the Accident Sequence notebook. These sections identify the mitigating systems and how the accident progresses depending the equipment availability.

N/A ASB3 ASB3 SR Met The environmental conditions are considered (Section 3.6) for recirculation. The clogging of the sumps is addressed in the system notebook.

N/A ASB4 ASB4 SR N/A This model does not use the split fraction method.

N/A ASB5 ASB5 SR Met This SR is geared towards other methodologies than CAFTA. The event trees and the fault trees are of sufficient detail to address intersystem dependencies and train level interfaces. In CAFTA these two requirements are done at the fault tree level.

N/A ASB6 AS

B5a SR N/A This requirement is addressed in the system models. Therefore it will be address in the review of the System Notebook.

N/A

Salem Generating Station CFCU AOT Extension 414 SALAR007 TABLE 442 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR ACCIDENT SEQUENCE ANALYSIS RA4Sa4 2009 SR RA4Sb4 2005 SR Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION ASB7 ASB6 SR Not Met ASA801 The SBO/LOOP, battery depletion, and room cooling are all addressed in the Accident Sequence notebook. However, the lumped treatment of offsite power recovery into both the diesel mission time calculation and the RBU recovery factor could overestimate the potential for recovery.

See above response for SR ASA8. In addition, SBO scenarios are relatively insignificant risk contributors within the context of this risk evaluation that supports the proposed CFCU AOT extension.

ASC1 ASC1 SR Met The accident sequences are analyzed in a manner that allows application, upgrades, and peer review to be accomplished in a timely.

N/A ASC2 ASC2 SR Not Met ASC201 The operator actions are not part of the event tree as required by this Supporting Requirement. The requirements of c, d and e are not met.

The HRA and Level 2 notebooks now adequately address procedural guidance and important operator actions in sufficient detail to allow traceability of references used and description of how HEPs are being applied to their appropriate accident sequences. Since the Level 2 logic is explained in detail in Appendices A, B, and C of the Level 2 Notebook, it was not necessary to expand any of the event trees. The operator actions referred to in the above description are discussed in the Level 2 Notebook. At any event, there is no further action required.

ASC3 ASC3 SR Not Met SCC302 In Notice of Clarification to Revision 1 of Regulatory Guide 1.200, FRN July 27, 2007, Accession number: ML071170054, the NRC provided their clarification related to assumptions and sources of uncertainty. The NRC stated that Key assumptions and sources have meaning only within the scope of an application. For a base PRA, the plant needs to identify and characterize assumptions and sources of uncertainty. Characterization can be qualitative. ANO2 has documented the assumptions that they used for the accident sequence analyses. The uncertainty notebook is in draft form and therefore is not reviewable. The uncertainty portion of this requirement is not met. The assumption were in the notebook so this part of the requirement is met. A suggestion is that an assumption section be added to the notebook.

This issue of uncertainty and key assumptions has been addressed with the creation of the PRA Uncertainty Notebook (SAPRA018) during the PRA model update that resulted in the PRA Model of Record SA112A. No further action required.

Salem Generating Station CFCU AOT Extension 415 SALAR007 TABLE 443 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SUCCESS CRITERIA RA4Sa4 2009 SR RA4Sb4 2005 SR Capability Category Associated F&Os

SUMMARY

OF RESOLUTION SCA1 SCA1 SR Not Met SCA101 The ASME standard defines core damage as "uncovery and heatup of the reactor core to the point at which prolonged oxidation and severe fuel damage involving a large section of the core is anticipated." In the Salem PRA Success Criteria Notebook, SAPRA

003, a "big picture" definition as described in the ASME PRA standard appears to missing. In the Salem PRA, core damage is defined as maintaining core temperature below 1200 degrees F which deals with heatup but not uncovery.

The definition of core damage has been clarified as part of the 2012 PRA update and properly reflected in both the Success Criteria and Accident Sequence Event Tree notebooks. No further action required.

SCA2 SCA2 SR Not Met SCA201 In the Salem PRA, core cooling was defined as successful if core exit temperatures do not exceed 1200 degrees F. This represents the temperature below which no core damage is expected to occur and the core exit thermocouple temperature at which the operators transfer to severe accident guidelines. The 1200 degrees F core temperature success criteria were interpreted to be the core hottest node temperature (TCRHOT) in MAAP. However, in the TH notebook a peak cladding temperature of 1800 degrees F was referenced. The MAAP code used 1800 degrees as TCRHOT. Also, there is no mention of core collapsed liquid level.

This was a documentation issue that has since been resolved by revising the Level 1 Success Criteria Notebook (SAPRA003) to definitively state in Section 2.4 that core cooling is successful if the massaveraged temperature of the hottest core node does not exceed 1800 deg. F. This is also consistent with the definition of core damage stated in Section 2.2.1 of the ThermalHydraulic MAAP PRA Notebook (SAPRA007) that references this same value of 1800 deg.

F. No further action required.

N/A SCA3 This SR was deleted in RASb2005.

N/A SCA3 SCA4 SR Met The success criteria for each of the key safety functions is specified in the success criteria notebook.

N/A SCA4 SC

A4a SR Met The only system that is shared is the VCA system. This system is identified as being shared and the common initiating event is discussed.

N/A SCA5 SCA5 SR Met:

(CC II/III)

Accident sequences are terminated at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , except under two conditions:

1. The plant is brought to a condition where return to power operation is possible in less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , or

2. Core damage or containment failure is predicted to occur within a few hours after the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months limitation.

N/A SCA6 SCA6 SR Met Success criteria are based on plantspecific features, procedures and operation.

N/A SCB1 SCB1 SR Met:

(CC II)

Plantspecific MAAP analyses have been performed to determine success criteria N/A SCB2 SCB2 SR N/A Expert judgment is not used in the success criteria development.

N/A SCB3 SCB3 SR Met T/H analyses are consistent with the initiating event groups and accident sequences.

N/A SCB4 SCB4 SR Not Met SCB401 The MAAP ThermalHydraulic Calculations Notebook (SAPRA007, Revision 1), Sections 1.2 and 1.3 provide a discussion of the codes available and the advantages associated with using MAAP, respectively. However, MAAP is used in establishing large LOCA The Success Criteria Notebook (SAPRA003) has been updated to properly address this as part of the 2012 PRA update. No further action required.

Salem Generating Station CFCU AOT Extension 416 SALAR007 TABLE 443 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SUCCESS CRITERIA RA4Sa4 2009 SR RA4Sb4 2005 SR Capability Category Associated F&Os

SUMMARY

OF RESOLUTION success criteria, although the code is not suitable for analysis of this plant upset. A discussion of code limitations is not provided.

SCB5 SCB5 SR Not Met SCB501 A check of the reasonableness and acceptability of the success criteria results is not documented.

A comparison of general success criteria with that of other Westinghouse plants was provided in Table 22 of the Success Criteria Notebook (SAPRA003). No further action required.

SCC1 SCC1 SR Met SCC101 The Level 1 Success Criteria Notebook (SAPRA003, Revision 0),

MAAP4 Parameter File Notebook (SAPRA009, Revision 1), and MAAP ThermalHydraulic Calculations Notebook (SAPRA007, Revision 1) document the success criteria analyses. However, it would be helpful to provide a cross reference to the PRA Standard requirements to facilitate PRA applications, upgrades, and peer reviews.

This issue has no impact on the quality of the PRA and was only meant to aid reviewers in identifying where each of the elements of the PRA Standard are being addressed. As such, this is only a documentation issue and may remain open for now. No further action required.

SCC2 SCC2 SR Met The success criteria development process has been documented.

N/A SCC3 SCC3 SR Not Met SCC301, SCC302 Assumptions are embedded in the documentation rather than captured in a specific section. Sources of uncertainty are addressed in a draft evaluation using guidance from draft EPRI report, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments."

This issue has no impact on the quality of the PRA and is only meant to aid reviewers in identifying what assumptions were made during development of the Success Criteria Notebook (SAPRA003). Each PRA System Notebook (SAPRA005.####) now has a section that lists assumptions that were made as part of the systems analysis.

Also, the Uncertainty Notebook (SAPRA018) was officially issued and includes a section on model uncertainty and references both EPRI 1026511, which addresses the use of PRA and the treatment of uncertainty, and EPRI 1016737, which addresses the treatment of parameter and model uncertainty. As such, there is no further action required.

Salem Generating Station CFCU AOT Extension 417 SALAR007 TABLE 444 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA4Sa4 2009 SR #

RA4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SYA1 SYA1 SR Met The system models are consistent with similar PWR PRAs and address system responses found in the accident sequence response.

N/A SYA2 SYA2 SR Met The system model documentation includes references to drawings, control logic, procedures and technical specifications.

Training drawings are included in the documentation.

N/A SYA3 SYA3 SR Met Based on documentation for the system notebooks information was reviewed.

N/A SYA4 SYA4 SR Not Met SYA401 The system notebooks do not provide any walkdown information. A walkdown document was made available to the peer review but has not been reviewed and formally released.

Plant walkdowns for the systems modeled in the PRA were documented in Appendix C of each of the Salem PRA System Notebooks (SAPRA

005.#### series). No further action required.

SYA5 SYA5 SR Met Modeling addresses plant configurations necessary to support success criteria.

N/A SYA6 SYA6 SR Not Met SYA601 The system notebooks do not provide definitive explanation of boundary information and do not provide illustration of modeled components.

System model boundary diagrams were provided in Section 2.3 of the Salem PRA System Notebooks (SAPRA005.#### series). No further action required.

SYA7 SYA7 SR Met:

(CC III)

N/A SYA8 SYA8 SR Not Met SYA801 Boundaries not defined.

Boundary definitions for plant systems were better defined in the PRA System Notebooks (SAPRA005.#### series) during the 2012 PRA Update by incorporating drawings with highlighted boundaries in order to help the reader better visualize the modeled system boundaries. However, the Data Notebook (SAPRA010) will need to be revised in order to explain how component boundaries were defined. In particular, Section 5.1 of NUREG/CR6928 contains the definition used for component boundaries that were used for generic industry data. Since this is only a documentation issue, there is no impact on either CDF or LERF, because the appropriate component boundaries for component data were used. As such, this issue has no impact on the results for this license amendment request.

N/A SYA9 This SR was deleted in RASb2005.

N/A

Salem Generating Station CFCU AOT Extension 418 SALAR007 TABLE 444 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA4Sa4 2009 SR #

RA4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SYA9 SYA10 SR Not Met SYA1001 Diesel generator modeling.

Since the Emergency Diesel Generator (EDG) Day Tanks are modeled as being part of the component boundary for the EDGs, the failure probabilities used for the EDG events used in the SA112A PRA model inherently include the failure of Day Tanks to perform their function, e.g., rupture, plugged lines, etc. However, a failure mode that could cause failure of the fuel oil transfer pumps involves miscalibration of the day tank level instrumentation, which was included in the SA112A PRA model. However, the Vital AC System Notebook (SAPRA005.0020) should have a discussion about the EDG Day Tanks being part of the component boundary definition used for the EDGs. From a generic standpoint, a list of general assumptions was added to each System Notebook (SAPRA005.#### series) to describe definition of component boundaries and certain failure modes that could be excluded. Since this is only a documentation issue, there is no impact on either CDF or LERF due to the fact that the appropriate failure modes were considered in the PRA model. As such, this issue has no impact on the results for this license amendment request.

SYA10 SYA11 SR Met N/A SYA11 SYA12 SR Not Met SYA1201 Some components listed in the standard supporting requirement are absent from some system models.

Although the Emergency Diesel Generator (EDG) Day Tanks were considered to be within the component boundary of the EDGs (see response to SYA9), the fuel oil transfer system was not, and as such, was explicitly modeled in the SA112A PRA model. Also, there are Human Error Probability (HEP) events included in the SA112A PRA model that model failure to realign ventilation dampers, e.g., see event RD3XHEMM (OPERATORS FAIL TO ALIGN CAV FOR MAINT MODE) in the HRA Notebook (SAPRA004). This and other HEPs that make use of AB.CAV procedures have been appropriately analyzed in the HRA notebook and included in the SA112A PRA model where appropriate. No further action required.

SYA12 SYA12a SR Met N/A SYA13 SYA12b SR Met Modeling guidance included consideration of divergence paths.

N/A

Salem Generating Station CFCU AOT Extension 419 SALAR007 TABLE 444 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA4Sa4 2009 SR #

RA4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SY4A14 SY4A13 SR Not Met SY4A13401 Review of models identified several exclusions of failure modes on a global basis without justification.

The probability of manual valves transferring shut was not generally modeled as the failure probability is exceedingly low and can be excluded via the use of the criteria found in ASME Supporting Requirement (SR) SYA15: One or more failure modes for a component may be excluded from the systems model if the contribution of them to the total failure rate or probability is less than 1% of the total failure rate or probability for that component when the effects on system operation are the same. However, SR SYA15 should be referred to in Section 3.1 (Generic Assumptions) of each PRA System Notebook to support the decision to exclude low probability events. Since this is only a documentation issue, there is no impact on either CDF or LERF due to the fact that the exclusion of manual valves spuriously changing state was appropriately addressed in the PRA model. As such, this issue has no impact on the results for this license amendment request.

SYA15 SYA14 SR N/A No assessment performed.

N/A SYA16 SYA15 SR Met:

(CC III)

N/A SYA17 SYA16 SR Met N/A SYA18 SYA17 SR Met N/A SYA19 SYA18 SR Met N/A SYA20 SYA18a SR Met N/A SYA21 SYA19 SR Not Met SYA1901 No documentation of assessment.

In general, system components were not modeled to perform beyond their design operating conditions, but if required to do so, this information would be specifically documented in the PRA System Notebooks (SAPRA

005.#### series). Additionally, support systems were also not expected to function successfully under adverse operating conditions beyond their design requirements. In order to clarify that this was a general practice followed as part of system modeling, an additional assumption should be added to the existing list of generic assumptions in Section 3.1 of each PRA System Notebook. However, because this issue involves a documentation issue and is not a deficiency of any technical element, this issue will be resolved pending a future revision to the PRA System Notebooks. The Updating Requirement Evaluation (URE) database entry (URE # SA2015

025) has been recorded to track this issue. As such, this issue has no impact on the results for this license amendment request.

SYA22 SYA20 SR Met:

(CC I)

SYA2001 No analyses provided.

N/A

Salem Generating Station CFCU AOT Extension 420 SALAR007 TABLE 444 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA4Sa4 2009 SR #

RA4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SYA23 SYA21 SR Not Met SYA2101 Multiple type code descriptions are used for the same data such that the second part of the SR is not met.

The state of knowledge correlation was addressed as part of the 2012 PRA update. See the Salem PRA Data Notebook (SAPRA010) for further details. No further action required.

SYA24 SYA22 SR Met N/A SYB1 SYB1 SR Met:

(CC II/III)

N/A SYB2 SYB2 SR Met:

(CC I/II)

N/A SYB3 SYB3 SR Not Met SYB301 For some cases the selection of CCF combinations are not complete and those selected are not the most limiting.

Due to the small probabilities and uncertainty that is involved with interim CCF combinations involving a population size of 6, it was deemed adequate in modeling the 2 of 6 (loss of one division), 4 of 6 (loss of two divisions), and 6 of 6 event combinations (loss of all three divisions) in estimating the total risk associated with DC battery charger common cause failures. The common cause modeling was limited to only those combinations that are consequential and important to risk. Refer to Appendix D of the Data Notebook (SAPRA010) for further details. As such, no further action is required.

SYB4 SYB4 SR Not Met SYB301 Some combinations are absent which when using MGL can underestimate the CCF contribution.

See above response for SR SYB3.

SYB5 SYB5 SR Not Met SYB501 Documentation for several system notebooks (AFW, CVCS and RWST) indicated that the heated water circulating system was required to prevent freezing, but was not modeled.

Since the heated water system was not required as an immediate support system for system success, it was not explicitly modeled due to the fact that freezing of water lines is a slowly developing event with ample time for procedural direction and any necessary repair. It was also explicitly stated in the system modeling documentation that the heating water system was not required during the PRA mission time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , e.g., see Section 2.5.4 of the AFS and MFWS System Notebook (SAPRA005.0001). As such, no further action is required.

SYB6 SYB6 SR Not Met SYB601 No analysis documented As part of the 2012 PRA Update, all System Notebooks were revised to follow a more consistent outline with information better organized to allow a more effective review and understanding of the documentation including sections on shared/ required systems. As such, there is no further action required.

Salem Generating Station CFCU AOT Extension 421 SALAR007 TABLE 444 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA4Sa4 2009 SR #

RA4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SYB7 SYB7 SR Met:

(CC I)

SYB701 The support system modeling is mostly based on conservative criteria.

It was apparent that the peer reviewer failed to identify the basis for certain success criteria for ventilation requirements. As part of the 2012 PRA Update, this information has been clarified and references provided for success criteria in the System Notebooks using a more consistent approach that will now make it much easier for the reviewer to identify such information. Also, fault tree modeling and operator actions were updated during the 2012 PRA update using the latest design calculations for the control room envelope. The results of the SA112A PRA model showed that loss of Control Area Ventilation (CAV) scenarios are now about a factor of ten less than what previously existed in the peerreviewed PRA model (PRA Model, Rev. 4.1). Therefore, any conservatism that may exist in the design basis calculations for CAV is not important to the PRA results. As such, there is no further action required.

SYB8 SYB8 SR Met SYA401 Walkdowns are not formally complete N/A N/A SYB9 This SR was deleted in RASb2005.

N/A SYB9 SYB10 SR Not Met SYB501 The need for heating of the RWST is not modeled although the system notebook indicates the need for heating.

See above response for SR SYB5.

SYB10 SYB11 SR Not Met SYB1101 Some AFW signals (SI, LOSP) are not defined and no justification for exclusion is provided.

This issue was addressed as part of the 2012 PRA Update. In particular, the AFW system and SI actuation logic and automatic initiation signals were reviewed and revisions made and additional logic added to the PRA model where appropriate. See the Salem PRA System Notebooks (SAPRA

005.#### series) for the changes that were made to the SA112A PRA model for such systems as AFW and SSPS. No further action required.

SYB11 SYB12 SR Not Met SYB1201 Some identified mission times are less than required.

An average value for the expected runtime of the Emergency Diesel Generators (EDGs) and their supporting components, such as the fuel oil transfer pumps, was derived based on a convolution involving nonrecovery of offsite power data and EDG runtime failure probabilities. This analysis is documented in Section 10.0 of the Salem PRA Data Notebook (SAPRA

010), which was performed during the PRA update that resulted in the SA112A model. This exercise resulted in an average run time of 6.2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for the EDGs, which was also used for the EDG fuel oil transfer pumps.

However, the mission time for the AFW turbinedriven pump was assigned a mission time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months in the SA112A PRA model. No further action required.

SYB12 SYB13 SR Met N/A SYB13 SYB14 SR Met N/A SYB14 SYB15 SR Not Met No documentation of an evaluation for potential adverse environments.

See above response for SR SYA21.

Salem Generating Station CFCU AOT Extension 422 SALAR007 TABLE 444 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA4Sa4 2009 SR #

RA4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SYB15 SYB16 SR Not Met HRC301 Operator starts for standby equipment not defined. No miscalibration of under voltage relays.

The issue of instrument miscalibration was modeled using Human Error Probability (HEP) preinitiator events that were included in the appropriate sections of the Salem SA112A PRA model to capture the unavailability of instruments due to miscalibration errors. These HEPs are documented in the Salem HRA Notebook (SAPRA004). No further action required.

SYC1 SYC1 SR Met N/A SYC2 SYC2 SR Not Met SYC201 System documentation does not provide some required documentation.

The Salem PRA System Notebooks were revised and enhanced as part of the PRA model update that resulted in the SA112A PRA model, which occurred after the peer review was performed in 2008. Since this issue was a documentation issue, there would be no impact on the results for this license amendment request.

SYC3 SYC3 SR Not Met SCC302 Assumptions are not present The Salem PRA System Notebooks were revised and enhanced as part of the PRA model update that resulted in the SA112A PRA model, which occurred after the peer review was performed in 2008. In particular, Section 3 of the System Notebooks (SAPRA005.#### series) now lists both generic and systemspecific PRA modeling assumptions. Since this issue was a documentation issue, there would be no impact on the results for this license amendment request.

Salem Generating Station CFCU AOT Extension 423 SALAR007 TABLE 445 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR HUMAN RELIABILITY ANALYSIS RA4 Sa4 2009 SR #

RA4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION HRA1 HRA1 SR Met This requirement is met by the process outlined in Section 2.2 of the HRA Notebook.

N/A HRA2 HRA2 SR Met This requirement is met by the process outlined in Section 2.2 of the HRA Notebook.

N/A HRA3 HRA3 SR Met This requirement is met by the process outlined in Section 2.3.4 of the HRA Notebook.

N/A HRB1 HRB1 SR Met:

(CC II/III)

This requirement is met by the process outlined in Section 4.3.3.1 of the HRA Notebook.

N/A HRB2 HRB2 SR Not Met HRB201 This requirement is directly in violation of the first sentence of Section 4.3.3.1 which allows screening of actions that could simultaneously have an impact on multiple trains of a redundant system or diverse systems.

The HRA notebook (SAPRA004) was revised to address this issue in order to clarify that screening of this nature was not performed.

Therefore, this SR is now met and there is no further action required.

HRC1 HRC1 SR Met This requirement is met by including the description of the HFE with each HFE analysis (see Tables 5.1.1, 5.1.2 and 5.1.3)

N/A HRC2 HRC2 SR Met:

(CC II/III)

The HRA notebooks specified that the LARs were reviewed and the descriptions indicate modes of unavailability have been included.

N/A HRC3 HRC3 SR Not Met HRC301 There is no documentation showing that miscalibration as a mode of failure of initiation of standby systems was considered. An example of this is that there is no HFE for miscalibration of bus under voltage bus, RPS relays, etc.

The issue of instrument miscalibration was modeled using Human Error Probability (HEP) preinitiator events that were included in the appropriate sections of the Salem SA112A PRA model to capture the unavailability of instruments due to miscalibration errors. These HEPs are documented in the Salem HRA Notebook (SAPRA004).

No further action required.

HRD1 HRD1 SR Met Since the EPRI HRA Calculator was used this requirement is met.

N/A HRD2 HRD2 SR Met:

(CC II)

This meets Capability Category II since there was one screening value used for preinitiators.

N/A HRD3 HRD3 SR Met:

(CC II/III)

This requirement is met due to the fact that the EPRI HRA Calculator is used. The Calculator requires human shaping factors which includes these requirements.

N/A HRD4 HRD4 SR Met This requirement is met due to the fact that the EPRI HRA Calculator is used. The Calculator requires human shaping factors which includes these requirements.

N/A HRD5 HRD5 SR Met This requirement is met in Section 5.2.2.

N/A HRD6 HRD6 SR Not Met SCC302 The uncertainty analysis has not been done. The mean values were used since the HRA Calculator was used for this analysis.

The Salem PRA Uncertainty Notebook (SAPRA018) was officially issued as part of the SA112A PRA model update and includes sources of uncertainties associated with Human Reliability Analysis

Salem Generating Station CFCU AOT Extension 424 SALAR007 TABLE 445 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR HUMAN RELIABILITY ANALYSIS RA4 Sa4 2009 SR #

RA4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION (HRA). This document makes use of both EPRI 1026511, which addresses the use of PRA and the treatment of uncertainty, and EPRI 1016737, which addresses the treatment of parameter and model uncertainty. As such, there is no further action required.

HRD7 HRD7 SR Met:

(CC I/II)

There was no requirement to check reasonableness of HEPs in light of the plants experience.

N/A HRE1 HRE1 SR Met This requirement is met by the methodology section of the HRA Notebook.

N/A HRE2 HRE2 SR Met This requirement is met by Section 2.1 of the HRA Notebook.

N/A HRE3 HRE3 SR Met:

(CC II/III)

This requirement is met in Section 2.6 of the HRA Notebook.

N/A HRE4 HRE4 SR Met:

(CC II/III)

This requirement is met in Section 2.6 of the HRA Notebook.

N/A HRF1 HRF1 SR Met:

(CC I/II)

This requirement is met at the Capability Category I/II level because several HFEs included several responses which are grouped into one HFE.

N/A HRF2 HRF2 SR Not Met HRF201, HRF202 The accident sequence specific timing of time window for successful completion for CCSXHEFOISOLT is based on a calculation that does not address leakage. The calculation S

CCMDC2111 is for loss of Service Water and does not address leakage of the Component Cooling Water System.

The time window should account for leakage that would drain the CCW system and make it inoperable. This is the limiting time since the CCW system will continue to cool with the leak until the surge tank is drained. Other examples of problems with timing are the lack of documentation for the timing used.

This is noted in HRAs: CISXHEFCXLCNT, AND MSSXHE

FOMS10. It should be noted that only a sampling was performed and that this may involve many more HRA analysis.

The HRA Notebook (SAPRA004) has been revised as part of the 2012 PRA update that resulted in the SA112A PRA model. The notebook now describes the available system windows for operator intervention and use of cues for all the important and risksignificant Human Error Probability (HEP) events. No further action required.

HRG1 HRG1 SR Met:

(CC I)

HRG101 The notebook does document which HEP's are risk significant and the ones that are not use screening values.

The reason this does not meet Capability Category I is that the human action from the shutdown panel, RRSXHEFO

SDRSP, is risk significant but still uses a screening value.

This requirement must have a detailed analysis for significant HFEs.

While industry consensus has not been achieved in adopting a consistent methodology to appropriately analyze the many actions associated with remote shutdown activities, a detailed HEP calculation is no longer required for RRSXHEFOSDRSP as it is not risk significant in the SA112A model. Per Category II of HRG1, screening values may be assigned to HEPs for nonsignificant human failure basic events. No further action required.

Salem Generating Station CFCU AOT Extension 425 SALAR007 TABLE 445 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR HUMAN RELIABILITY ANALYSIS RA4 Sa4 2009 SR #

RA4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION HRG2 HRG2 SR Met This requirement was met since the EPRI HRA Calculator was used for the analysis.

N/A HRG3 HRG3 SR Met:

(CC II/III)

This requirement was met since the EPRI HRA Calculator was used for the analysis.

N/A HRG4 HRG4 SR Not Met HRF201, HRF202 The accident sequence specific timing of time window for successful completion for CCSXHEFOISOLT is based on a calculation that does not address leakage. The calculation S

CCMDC2111 is for loss of Service Water and does not address leakage of the Component Cooling Water System.

The time window should account for leakage that would drain the CCW system and make it inoperable. This is the limiting time since the CCW system will continue to cool with the leak until the surge tank is drained. Other examples of problems with timing are the lack of documentation for the timing used.

This is noted in HRAs: CISXHEFCXLCNT, and MSSXHE

FOMS10. It should be noted that only a sampling was performed and that this may involve many more HRA analysis.

See above response for SR HRF2.

HRG5 HRG5 SR Met:

(CC II/III)

This requirement was met by Section 2.6 during plant visits.

N/A HRG6 HRG6 SR Met This requirement was met by Section 2.6 during plant visits and operator interviews.

N/A HRG7 HRG7 SR Met This requirement is met by Section 5.2 of the HRA Notebook, Dependent Operator Actions.

N/A N/A HRG8 This SR was deleted in RASb2005.

N/A HRG8 HRG9 SR Not Met SCC302 This requirement is not met.

The Salem PRA Uncertainty Notebook (SAPRA018) was officially issued as part of the SA112A PRA model update and includes sources of uncertainties associated with Human Reliability Analysis (HRA). This document makes use of both EPRI 1026511, which addresses the use of PRA and the treatment of uncertainty, and EPRI 1016737, which addresses the treatment of parameter and model uncertainty. As such, there is no further action required.

HRH1 HRH1 SR Met:

(CC II/III)

This requirement was met because the EPRI HRA Calculator was used and this includes operator recovery actions.

N/A HRH2 HRH2 SR Met This requirement was met because the EPRI HRA Calculator was used and this includes operator recovery actions.

N/A HRH3 HRH3 SR Met This requirement is met by Section 5.2 of the HRA Notebook, Dependent Operator Actions.

N/A

Salem Generating Station CFCU AOT Extension 426 SALAR007 TABLE 445 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR HUMAN RELIABILITY ANALYSIS RA4 Sa4 2009 SR #

RA4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION HRI1 HRI1 SR Met The use of the EPRI HRA Calculator and the documentation in the HRA Notebook meets this requirement.

N/A HRI2 HRI2 SR Met The use of the EPRI HRA Calculator and the documentation in the HRA Notebook meets this requirement.

N/A HRI3 HRI3 SR Not Met SCC302 This requirement is not met.

See above response for SR HRG8.

Salem Generating Station CFCU AOT Extension 427 SALAR007 TABLE 446 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra4Sa4 2009 SR #

Ra4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION DAA1 DAA1 SR Met:

(CC II/III)

DAA101 Need to develop Salem specific site procedures.

Salem specific site procedures should be developed for maintenance of site specific PRAs.

Recommendation is to develop Salem specific site procedures.

The PSEG ERAA600 series of procedures exist to address this issue. Specifically ERAA6001015 addresses maintenance and update of the internal events PRA model.

They may be found and retrieved using the site's database known as DCRMS. There is no further action required.

DAA2 DAA1a SR Not Met DAA1a01 No discussion of component boundary definition is provided in either the data or systems analysis. Boundaries for unavailability events are not established. Boundary definitions help assure that failures are attributed to the correct component and that calculated failure rates and unavailability values are appropriate. Some component boundaries are discussed in the notes to Appendix A, "Generic (Industry) Failure Data" of the Data Notebook.

Note 32 states to "Assume that CCW/RHR HX failure rates apply to TDAFW Pump Bearing and governor jacket coolers", however unless the Salem TDAFW pump has unique features that require this to be modeled separately, cooling to the TDAFW pump is included in the component boundary to the pump in NUREG6928.

Boundary definitions for plant systems were better defined in the System Notebooks during the 2012 PRA Update by incorporating drawings with highlighted boundaries in order to help the reader better visualize the modeled system boundaries. However, the Data Notebook (SAPRA010) will need to be revised in order to explain how component boundaries were defined. In particular, Section 5.1 of NUREG/CR6928 contains the definition used for component boundaries that were used for generic industry data. Also, the TDAFW jacket coolers were removed from the SA112A PRA model since they are considered within the boundary of the TDAFW pump. Based on this being a documentation issue, there is no impact on the results for this license amendment request.

DAA3 DAA2 SR Not Met DAA201 Mean values for failure rates appear in the model, however no uncertainty distributions could be found in the basic events checked.

The PRA update for the Rev. 4.3 PRA model included adding uncertainty parameters to the type code database, and as part of the 2012 PRA model update, the CAFTA Access database file (SA112A.rr) was updated to include uncertainty parameters for all type codes and basic events used in the SA112A PRA model. No further action required.

DAA4 DAA3 SR Met The data parameters used in the model appear to be appropriately identified. The units for Motor Operated Valves Fails to Close are demands. The units identified for Motor Operated Valves Fails to Remain Open or Closed are hours.

Reference Data Analysis Notebook Section 2.1.1.

N/A DAB1 DAB1 SR Met:

(CC I)

DAB101 Components were grouped according to type such as motor

operated valve to meet Category 1 of the standard.

Components were grouped according to mission type, (e.g.,

standby and operating) fails to meet Category II, however as stated in the Data Analysis Notebook Section 2.1.1.6, "there is no differentiation between systems (e.g., clean water vs.

raw water". Therefore, a full Category II could not be met.

The type codes used and listed in the Data Notebook (SA

PRA010) do identify the different systems and type codes used as well as the basis for their failure probabilities. Type code failure rates now distinguish between clean and dirty water systems, e.g., pumps in the CCS and SWS PRA modeled systems, in the SA112A PRA model. Also, the internal flood evaluation makes use of pipe rupture rates categorized by the type and quality of water contained within the various water pipes that were analyzed. No further action required.

Salem Generating Station CFCU AOT Extension 428 SALAR007 TABLE 446 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra4Sa4 2009 SR #

Ra4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION DAB2 DAB2 SR Met There did not appear to be any outliers in the data reviewed.

Reference Data Analysis Notebook, Section 2.2 and Appendix A and Appendix C.

N/A DAC1 DAC1 SR Not Met DAA1a01, DAC101 Generic parameter estimates are obtained from recognized sources (principally NUREG/CR6928). However, no discussion of component boundary definition is provided other than a draft document. In addition, generic unavailability data is used for some SSCs without demonstrating that the data is consistent with the test and maintenance philosophies for the subject plant.

Since some of the maintenance unavailability terms in the SA112A PRA model used older data from the Salem Rev.

3.2 PRA model as noted in Appendix C of SAPRA010, a sensitivity analysis was performed to obtain a more accurate assessment of the maintenance philosophy of the plant using Maintenance Rule historical data from the period of 1/1/2007 to 7/1/2012. If it was found that there were unavailability hours logged for a specific component, then the unavailability was calculated by dividing the number of unavailable hours by the critical hours during this time period. If there were no hours that were recorded during this time period of 5.5 years, then a Bayesian update was performed using the Salem Rev. 3.2 data as the prior distribution (lognormal with EF=3) with 0 hours0 days 0 hours 0 weeks 0 months of unavailability over the time period of interest. The resulting unavailabilities were then substituted for the current maintenance terms in the SA112A PRA model and new CDF importance measures generated to determine the impact on PRA results. This sensitivity analysis also included an update to the failure rates for certain type codes that satisfied the category of being risksignificant per Step 4.5.4.1 of ERAA6001015 (see URE # SA2010054). As a chosen figure of merit, the comparison of Birnbaum importance measures revealed that no MSPI monitored component changed by a value that exceeded 40% (the threshold is 300%). As such, there is only a minimal impact on the PRA results based on comparing Birnbaum importance measures, which were chosen to characterize this impact since the present Salem MSPI Basis Document was based on the SA112A PRA model results. Based on the relatively small changes in importance measures, the SA112A PRA model is deemed acceptable for use in risk

informed applications. With regard to use of generic data, only the boric acid transfer pumps (CVSBAPTM11BAT and CVSBAPTM12BAT) make use of generic data, which comes from Table 61 of NUREG/CR6928, and represents the combined data for all motordriven pumps (MDP). This is considered acceptable for the SA112A PRA model since the

Salem Generating Station CFCU AOT Extension 429 SALAR007 TABLE 446 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra4Sa4 2009 SR #

Ra4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION RAW value is only 1.01 and the FussellVesely is 9.9E05 for this piece of equipment. Based on this discussion, this issue of generic unavailability is deemed to have only a minimal impact on the results for this license amendment request.

DAC2 DAC2 SR Not Met DAC201 Plantspecific data is only collected for MSPI components.

The draft data procedure provided requires that plant specific data be supplied for SSCs with RAWs > 2 and FV's > 0.005.

A review was made of the basic event importance measures from the SA112A PRA model and events tied to four (4) separate type codes were found to satisfy the risksignificant criteria found in Step 4.5.4.1 of ERAA6001015. A review of reliability data for the associated plant systems was performed using Maintenance Rule historical data from the time period of 1/1/2007 to 7/1/2012. Using plantspecific data for the type codes of interest (AC4BKROO, CASEACFR, RHSMOVCC, and VASACXFS) a Bayesian update was performed using the generic data as the prior distribution to derive new failure rates. The resulting failure rates for these type codes were then substituted for the generic values being used in the SA112A PRA model and new CDF importance measures generated to determine the impact on PRA results. This sensitivity analysis also included an update to the maintenance unavailability terms that were using legacy values from the Rev. 3.2 PRA model (see response to SR DAC1). As a chosen figure of merit, the comparison of Birnbaum importance measures revealed that no MSPI monitored component changed by a value that exceeded 40% (the threshold is 300%). Based on this discussion, this issue of plantspecific data for risksignificant components is deemed to have only a minimal impact on the results for this license amendment request.

DAC3 DAC3 SR Met Plantspecific data is collected consistent with design, operation and experience.

N/A DAC4 DAC4 SR Not Met DAC401 Documentation describing the process of evaluating maintenance records was identified in a draft procedure. All failures must be reviewed for applicability to the PRA model and this process should be documented. All plant specific data came from MSPI or the Maintenance Rule, however there was no documentation provided that these failures were reviewed as PRA failures.

Formal procedures now currently exist that describe the PRA update process, including what data collection is required.

Actual plantspecific failure and unavailability data were obtained from the Salem Maintenance Rule and MSPI programs. See the Data Notebook (SAPRA010) for further details. Since this is a documentation issue, there is no impact on the results for this license amendment request.

Salem Generating Station CFCU AOT Extension 430 SALAR007 TABLE 446 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra4Sa4 2009 SR #

Ra4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION DAC5 DAC5 SR Not Met DAC501 Documentation describing the process of evaluating failure records other than applying MSPI data directly could not be identified. All failures must be reviewed for applicability to the PRA model.

Failure and unavailability data were obtained from the Salem Maintenance Rule and MSPI programs. The counting of component failures, such as was done for MSPI components, was consistent with industry practice. Failures were obtained from the MSPI reporting process and were handled appropriately during the revision of the Data Notebook (SAPRA010) as part of the 2012 PRA model update. URE database record SA2015026 was created to enhance the description of the failure evaluation process so as to document that repetitive failures occuring within a short duration, if they were to occur, would be appropriately handled so as not to skew the importance of any one SSC.

With regard to this issue, there is no impact on the results for this license amendment request since this was a documentation issue.

DAC6 DAC6 SR Not Met DAC601 Documentation describing the process of evaluating the number of plant specific demands for standby components could not be identified. Standby components were identified in Table 1 of the Data Analysis Notebook and plant specific demands for some of these components were listed in Appendix B, however the basis for this number of demands was not provided. The draft data procedure states that plant specific data should be estimated by actual counts of hours or demands from logs or counters, use of surveillance procedures to estimate the frequency of demands and run times, or estimates based upon input from the System Engineer.

Plantspecific reliability data for MSPI monitored components was obtained from the Salem MSPI reporting process and provided in the Appendix B tables of the Data Notebook (SA

PRA010) in order to facilitate the Bayesian updating process during the 2012 PRA Update. This process was documented in Section 7.2 of SAPRA010. A sensitivity analysis was performed using additional plantspecific data to address issues related to SRs DAC1 and DAC2. In all cases with regard to the SA112A PRA model, failure rates and probabilities fall into one of two categories, i.e., they were either a part of the plantspecific data update that used MSPI data, which included plantspecific demands and run hours from the MSPI Derivation reports, or they made use of generic data from sources such as NUREG/CR6928. For future updates, plantspecific data and Bayesian updating will be extended to include risksignifcant components per ERAA6001015. Since this is mainly a documentation issue, there is no impact on the results for this license amendment request.

DAC7 DAC7 SR Not Met DAC701 Documentation describing the process of collecting the number of surveillance tests and planned maintenance activities on plant requirements could not be identified. In Appendix C for example CCS MOVs in test and Maintenance were described. The source of the data was listed as Salem 3.2 PRA, however no specific breakdown of the surveillance tests included was provided. The draft data procedure Existing performance monitoring programs, such as the Maintenance Rule, already document testing and maintenance unavailability information for each of the more risksignificant systems modeled in the PRA. The testing and maintenance unavailability information used in the Salem PRA is a combined value, i.e., represented by a single basic event. As such, there is no further action

Salem Generating Station CFCU AOT Extension 431 SALAR007 TABLE 446 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra4Sa4 2009 SR #

Ra4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION identifies surveillance tests as a source of data.

required.

DAC8 DAC8 SR Met:

(CC I)

DAC801 An estimate of times that some components were configured in their standby status is identified in Table 1 and its notes, however no documentation of how these estimates were derived was provided. No operational records were provided in order to meet Capability Category II.

The table cited in the summary description is now labelled as Table A1 in the Salem PRA Data Notebook (SAPRA010),

which identifies the failure rates/probabilities to be used for various SSCs modeled in the PRA. The notes to this table help identify which components are considered either normally running or in a standby condition, and also what fraction of the time a component may be considered in either a running or standby condition, e.g., Note 25 for station air compressors. In addition, standby flags are employed in the SA112A PRA model to denote which components are configured in a standby condition so that the appropriate failure mode can be applied in the fault tree logic. As such, there is no further action required.

DAC9 DAC9 SR Not Met DAC901 Documentation describing the process of estimating the operational time of standby components from testing was identified in draft procedure. Standby components were identified in Table 1 of the Data Analysis Notebook and operational times for some of these components were listed in the Data Analysis Notebook, however the source of the data was not provided.

Further clarification was provided in the Salem Data Notebook (SAPRA010) during the 2012 PRA model update (SA112A) to help better explain how estimates for standby time were derived. As such, there is no further action required.

DAC10 DAC10 SR Not Met DAC1001 Documentation describing the process of reviewing test procedures to determine surveillance test data could not be identified. No specific surveillance tests were discussed in the Data Analysis Notebook. The Systems Analysis Notebooks for specific systems described various surveillance testing, but did not reference surveillance tests by name.

Initiating event category tables were provided in the revised Initiating Events Notebook (SAPRA001) to provide a benchmark comparison to ensure that Salem initiating event categories were adequate in capturing the necessary PRA initiating events. The plants compared were South Texas, Surry, and Watts Bar. No further action required.

DAC11 DAC11 SR Not Met DAC1101 Documentation describing the process of using maintenance and testing durations to determine plant specific durations was identified in a draft document. No specific surveillance tests were discussed in the Data Analysis Notebook but MSPI/Maintenance Rule sources were identified.

Consistent with industry practice, the failure and unavailability data were obtained from the Salem Maintenance Rule and MSPI programs. The Maintenance Rule data and MSPI data are traceable to individual occurrences. Therefore, the documentation does exist and it was not necessary to repeat the information in the Data Notebook (SAPRA010). No further action required.

Salem Generating Station CFCU AOT Extension 432 SALAR007 TABLE 446 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra4Sa4 2009 SR #

Ra4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION DAC12 DAC11a SR Not Met DAC11a

01 Documentation describing the process of how to count maintenance unavailability was not identified. Plant Specific unavailability was only documented for MSPI components which identifies the unavailability for support and frontline systems separately, however it could not be determined that this was the case throughout the model without a specific guidance document.

As part of the enhancements made during the 2012 PRA update, the process used for counting maintenance unavailabilities was more clearly described in the Salem PRA Data Notebook (SAPRA010). Also, existing Salem performance monitoring programs, such as MSPI and Maintenance Rule, formed the basis for derivation of maintenance unavailabilities over the data collection period.

This approach is consistent with industry practice. As such, there is no further action required.

DAC13 DAC12 SR Not Met DAC1201 While a table of critical hours was provided and the Maintenance Unavailability Table provided in Appendix C appears to address these hours there was no specific documentation or guidance document provided that discusses how maintenance was treated for shared systems.

Maintenance unavailabilities for shared systems between the two units has been updated in Sections 3.0 and 8.1 of the Salem Data Notebook (SAPRA010) as part of the 2012 Salem PRA model update. No further action required.

DAC14 DAC13 SR Not Met DAC1301 Coincident unavailability for service water pumps was modeled as shown in Appendix C of the Data Analysis Notebook, however, no overall guidance document could be found to ensure all systems were reviewed for coincident unavailability.

A paragraph was added to section 8.2 of the Data Notebook (SAPRA010) to document the concurrent unavailability for SW. Also, Note 12 was added at the bottom of Table C1 in Appendix C of SAPRA010 to denote the unavailabilities used. No further action required.

DAC15 DAC14 SR Not Applicable SSC repair is not modeled.

N/A DAC16 DAC15 SR Not Applicable System recovery is not modeled.

N/A DAD1 DAD1 SR Met:

(CC II)

Plant specific evidence was provided for significant basic events. A Bayesian update of generic prior was performed as shown in Appendix B of the Data Analysis Notebook.

N/A DAD2 DAD2 SR Met DAD201 Evaluation of dieseldriven compressor provides example of evaluating plantspecific consideration using similar components. See Data Analysis notebook Section 2.1.3.

Use of Monte Carlo simulation techniques using the @RISK Excel addin was used to derive failure distributions for the dieseldriven air compressor with documentation provided in Section 6.3 of the Salem PRA Data Notebook (SAPRA010) during the 2012 PRA model update. No further action required.

DAD3 DAD3 SR Met:

(CC I)

DAD301 Observations of SA PRA010, Table A1. Mean values were provided along with error factors for most distributions.

All parameters identified in Table A1 of SAPRA010 now have a reference provided to show traceability of information.

No further action required.

DAD4 DAD4 SR Met:

(CC I)

DAD401 No documentation is present that substantiates that the analysis was performed. This is sufficient for Category I.

A paragraph was added to Section 7.2 of the Salem PRA Data Notebook (SAPRA010) to document the comparison of updated results with the generic data during the Salem 2012 PRA model update. Because no abnormalities were identified, no further action is required.

Salem Generating Station CFCU AOT Extension 433 SALAR007 TABLE 446 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra4Sa4 2009 SR #

Ra4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION DAD5 DAD5 SR Met:

(CC II)

Values provided for Alpha and MGL methods for significant events in the Data Analysis Notebook.

N/A DAD6 DAD6 SR Met:

(CC I)

DAD601 No apparent comparison of common cause failures to plant experience was provided in the Data Analysis Notebook.

During the Salem 2012 PRA model update, a paragraph was added to Section 6.1 of the Data Notebook (SAPRA010) to document a comparison of the NUREG/CR6928 values with other generic data sources, such as NUCLARR and EPRI.

No large discrepancies were identified. As such, NUREG/CR6928 was deemed acceptable for use. No further action required.

DAD7 DAD6a SR Not Applicable No generic data was screened.

N/A DAD8 DAD7 SR Not Applicable No modifications are known that would impact data.

N/A DAE1 DAE1 SR Met DAE101 The analysis is documented in a manner that could facilitate applications, upgrades, and PEER reviews. The notebook could be improved by providing direct references to actual failure numbers in EPIX or CDE numbers in Appendix A.

See suggestion.

This URE is a suggestion that has no impact on the quality of the PRA and was only meant to aid reviewers in the traceability of data sources. As such, there is no further action required.

DAE2 DAE2 SR Not Met DAE201 A draft document was provided that documented how to establish component boundaries, how to establish failure probabilities, sources of generic data, etc. This procedure needs to be formalized.

NUREG/CR6928, which was used in gathering the generic data for updating the Salem Data Notebook (SAPRA010),

provides a definition of the component boundaries for the modeled components of interest. No formal procedure needs to be developed when the data source used for the SA112A PRA model already defines the component boundaries of modeled components. Because this is a documentation issue, there is no impact on the results for this license amendment request.

DAE3 DAE3 SR Not Met SCC302 Assumptions were noted in various sections of the Data Analysis Notebook. These need to be gathered into an assumptions section in the notebook. Sources of uncertainty were not discussed in the analysis.

Assumptions are appropriately documented throughout the Data Analysis Notebook (SAPRA010) where appropriate in order to be consistent with the context of each section. In general, most assumptions may be found within footnotes to the data tables in order to explain the basis for derivation of the data. Additionally, the Uncertainty Notebook (SAPRA

018) was officially issued and includes a section on model uncertainty and references both EPRI 1026511, which addresses the use of PRA and the treatment of uncertainty, and EPRI 1016737, which addresses the treatment of parameter and model uncertainty. As such, there is no further action required.

Salem Generating Station CFCU AOT Extension 434 SALAR007 TABLE 447 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA4 Sa4 2009 SR #

RA4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION QUA1 QUA1 SR Met The singletop fault tree (S1R4.CAF) integrates the model in a manner that supports quantification and treatment of dependencies.

N/A QUA2 QU

A2a SR Met Fault tree linking is used in constructing the S1R4.CAF model.

N/A QUA3 QU

A2b SR Met:

(CC I)

QUA2b01 Parametric uncertainty is not performed on the quantification results. In addition, it is not clear that the same type code is used for multiple events based upon the same underlying data.

The parametric uncertainty analysis was performed and documented in the newly issued Salem PRA Uncertainty Notebook (SAPRA018). The uncertainty analysis also correctly accounted for the "stateofknowledge" correlation by making the necessary adjustments to the type codes in the CAFTA database file (SA112A.rr). No further action required.

QUA4 QUA3 SR Met The model is quantified using CAFTA software which is capable of reporting contributors to CDF by initiating event, or at the individual sequence level if desired.

N/A QUA5 QUA4 SR Met QUA401 Recovery events NRAC12H, NRACOSP, and NREDG4H are included in the S1R4REC.CAF file, but their application is not discussed in the Accident Sequences and Event Tree notebook or in the AC Power System Notebook.

Recovery events that have no basis or discussion of applicability were removed from the recovery model logic during the 2012 PRA model update (SA112A).

The recovery files are discussed in the Quantification notebook (SAPRA014). The offiste power non

recoveries are discussed in Appendix D of the Accident Sequence Notebook (SAPRA002). As such, there is no further action required.

QUB1 QUB1 SR Met The CAFTA software suite and the Forte quantification engine are used in the quantification. These are standard software products which have been shown to produce appropriate results in industry usage.

N/A QUB2 QUB2 SR Met Salem Quantification Notebook SA PRA200801 Attachment E documents the convergence analysis performed to set an appropriate truncation value.

N/A QUB3 QUB3 SR Met QUB301 Salem Quantification Notebook SA PRA200801 Attachment E documents the convergence analysis performed to set an appropriate truncation value. The truncation level for both CDF and LERF was set at 1.0E11. The percentage change between 1.0E10 and 1.0E11 was 2.2% for CDF, but 6.1% for LERF. Therefore, this SR was not satisfied for LERF.

Attachment E of the Salem Quantification Notebook (SAPRA014) for the SA112A PRA model documents the process used to ensure that convergence was achieved for quantification of CDF and LERF cutsets. There was less than a 5%

change in CDF in going from a truncation limit of 1E

11 to 1E12, and less than a 5% change in LERF when going from a truncation of 1E12 to 1E13.

Therefore, the official truncation limits used were 1E

11 for CDF and 1E12 for LERF. No further action required.

Salem Generating Station CFCU AOT Extension 435 SALAR007 TABLE 447 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA4 Sa4 2009 SR #

RA4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION QUB4 QUB4 SR Met Forte uses the minimal cutset upper bound quantification method to produce the mean value.

N/A QUB5 QUB5 SR Not Met QUB501 Creation of different fault tree tops to break circular logic is discussed in the system notebooks; however the documentation is not sufficient to determine whether the logic was broken at the appropriate level to ensure unnecessary conservatisms or nonconservatisms.

A new vital AC power PRA system notebook (SA

PRA005.0020) was created during the 2012 PRA model update. Section 6.8 of this notebook contains an explanation of how circular logic loops were broken for the diesel generator support dependencies, and also lists the affected gates with a description of the modification. The documented review of this PRA system notebook provides evidence that the logic was broken at the appropriate level to avoid any unnecessary conservatisms or nonconservatisms. No further action required.

QUB6 QUB6 SR Met Complementary logic is used where needed to account for system successes in transfers to the LERF model from the Level 1 model.

N/A QUB7 QU

B7a SR Met Mutually exclusive logic is included in the linked fault tree under gate DAMGDAM100 and combined with the core damage or LERF logic in an "A and not B" gate.

N/A QUB8 QU

B7b SR Met Mutually exclusive logic is included in the linked fault tree under gate DAMGDAM100 and combined with the core damage or LERF logic in an "A and not B" gate to remove mutually exclusive combinations during quantification.

N/A QUB9 QUB8 SR Met Flag file S1R4IFL.CAF contains the flag settings as TRUE or FALSE.

The quantification process using PRAQUANT merges the flag file with the PRA model prior to quantification.

N/A QU

B10 QUB9 SR Not Met QUB901 Split fractions and undeveloped events are included in the model.

Examples include main Feedwater availability for ATWS (MFI

UNAVAILABLE) and some Unit 2 systems credited for recovery of Unit 1 CAV failure (G2SW22). The derivation of the values for these events is not documented to allow determination that consideration has been given to the impact of shared events.

Split fractions such as the ones mentioned in the summary description (MFIUNAVAILABLE and G2SW22) are listed in Table A2 of the PRA Data Notebook (SAPRA010) that was revised during the 2012 PRA model update (SA112A) along with references to document their derivation. No further action required.

QUC1 QUC1 SR Met The dependency analysis for multiple HFEs is described in the HRA Notebook. The process included a requantification of the model with HEPs set to 0.1 to capture combinations which could be below normal truncation levels. The final application of dependency correction factors is done through postprocessing of the cutsets.

N/A QUC2 QUC2 SR Met The dependency analysis for multiple HFEs is described in the HRA Notebook.

N/A

Salem Generating Station CFCU AOT Extension 436 SALAR007 TABLE 447 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA4 Sa4 2009 SR #

RA4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION QUC3 QUC3 SR N/A The linked event tree methodology is not used for the Salem model.

N/A QUD1 QU

D1a SR Met QUD1a01 Section 6 of the quantification notebook SAPRA200801, Revision 4.1 includes a discussion of the top cutsets. The discussion provides good detail of the core damage scenarios. Some of the cutsets appear to be conservative, which are discussed more in the F&O.

The current system window for the RRSXHEFO

SDRSP action (FAILURE OF REMOTE SHUTDOWN UPON LOSS OF CAV) is 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months as OPAB.CAV0001 reports that the electrical equipment room temperature will exceed 145F in 4.2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months if no operator action is taken. Use of a joint human error probability (HEP) floor value (1E6 for the SGS HRA) is the current industry expectation as discussed in NUREG1792, Good Practices for Implementing HRA. The system window length has no impact on the application of the joint HEP floor value. It is acknowledged that the time reported for MFWXHEFOCOND did reflect that actions base case (LOFW at time zero) rather than a loss of feedwater upon depletion of the AFWST, which is more representative of the combination. The Salem Dependency Analysis for the 2012 PRA model update was completely revised using the HRA Calculator, which allows the manipulation of timing within a combination. Still, there are no joint HEPs in the Salem HRA with values less than 1E6 due to the floor value requirement. No further action required.

QUD2 QU

D1b SR Not Met QUD1b01 There is no discussion in the quantification notebook that indicates a review of the results was performed for the purpose of assessing modeling and operational consistency. Also, since the sequences were not quantified, it is difficult to perform this verification.

Section 6 of the Quantification Notebook (SAPRA

014) for the 2012 PRA model update discusses the top 25 cutsets that lead to core damage and also addresses the fact that a cutset review was conducted with PSEG personnel in March 2014 to ensure modeling and operational consistency. No further action required.

QUD3 QU

D1c SR Not Met QUA401 There is no discussion in the quantification notebook SAPRA200801, Revision 4.1 that indicates this review was completed.

See response for SR QUA4.

N/A QUD2 This SR was deleted in RASb2005 N/A QUD4 QUD3 SR Met:

(CC I)

QUD301 This is a Capability Category I since there is no documentation to indicate that the Salem results were compared to the results of a similar plant.

Based on comments from the PWROG Chairman, the PWROG PRA Comparison Database is out of date by at least 6 years and was not used. A high level comparison was made to other similar PWRs.

Also, see response for SR IEA4 for additional industry comparison. Since this is a documentation issue, there is no impact on the results for this

Salem Generating Station CFCU AOT Extension 437 SALAR007 TABLE 447 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA4 Sa4 2009 SR #

RA4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION license amendment request.

QUD5 QUD4 SR Not Met QUD401 There is no documentation indicating that a sampling of nonsignificant accident cutsets or sequences were reviewed to determine they are reasonable and have physical meaning.

A sampling of nonsignificant accident cutsets that lead to core damage near the truncation threshold of 1E11 were inspected to determine the presence of any illogical cutsets. This review was documented in Section 6 of the Quantification Notebook (SAPRA

014) for the 2012 PRA model update (SA112A). The review determined that the cutsets did appear to be reasonable and had physical meaning. No further action required.

QUD6 QU

D5a SR Not Met QUF201 This requirement was not met because the importance of components and basic events was not performed. There is no definition of significant contributors to CDF. No documentation of an analysis for significant contributors to CDF.

See response for SR QUF2.

QUD7 QU

D5b SR Not Met QUF201 This requirement was not met because the importance of components and basic events was not performed.

See response for SR QUF2.

QUE1 QUE1 SR Not Met SCC302 The uncertainty notebook was produced but is not finalized.

See response for SR QUF4.

QUE2 QUE2 SR Met The quantification assumption is that the model been correct analyzed.

So that the assumptions are in the other notebooks and will be documented in the SR for those areas.

N/A QUE3 QUE3 SR Not Met SCC302 The uncertainty notebook was produced but is not finalized.

See response for SR QUF4.

QUE4 QUE4 SR Not Met SCC302 The uncertainty notebook was produced but is not finalized.

See response for SR QUF4.

QUF1 QUF1 SR Met This requirement is met by the Quantification Notebook.

N/A

Salem Generating Station CFCU AOT Extension 438 SALAR007 TABLE 447 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA4 Sa4 2009 SR #

RA4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION QUF2 QUF2 SR Not Met QUB301, QUF201 This requirement was only partially met as described below:

(a) This requirement is met by the system and HRA notebooks.

(b) There is a cutset review process description.

(c) There is no description of how the success systems are accounted for. Since a one top tree is used the software already accounts for this.

A statement stating would be satisfactory. The truncation values and how they were determined were documented. The method for applying recovery and how post initiator HFE's are applied was not described.

(d) This requirement was met.

(e) This requirement was met.

(f) This requirement was not met since the cutsets per accident sequence were not discussed.

(g) This requirement was not met since equipment or human actions that are the key factors in causing the accidents sequences to be non

dominant are not discussed.

(h) This requirement was not met since sensitivities were not documented.

(i) This requirement was not met since the uncertainty notebook was not finalized.

(j) This requirement is not met since there is no discussion of importance.

(k) This requirement is not met because there is not list of mutually exclusive events and there justification.

(l) This requirement is not met because there is no discussion of asymmetries in quantitative modeling to provide application users the necessary understanding regarding why such asymmetries are present in the model.

(m) This requirement is met since CAFTA and Forte are being used.

Both of these pieces of software are industry standards and therefore no further testing is required.

The following discussion addresses only those sub

parts that were considered "not met": c) the method of applying recovery events and adjustment for joint HEPs is now described in Section 5 of the Quantification Notebook (SAPRA014); (f) descripton of top 25 cutsets and dominant sequences were discussed in the Quantification Notebook (see Section 6 of SAPRA014); (g)

Human Error Probabilities (HEPs) that were identified as being "time sensitive" are now discussed in the HRA Notebook (SAPRA004); (h) sensitivity calculations were documented and discussed in the Uncertainty Notebook (SAPRA

018); (i) the Uncertainty Notebook (SAPRA018) was prepared and issued as part of the work scope involved with the Salem 2012 PRA Update Project (SA112A); (j) importance measures are utilized as a part of the process used to document Maintenance Rule products per the ERAA310 series of procedures. Also, the risk poster, which is produced as part of the rollout process (Risk Application: SA

MISC002), will also satisfy this requirement; (k) a discussion of how mutually exclusive events were treated was provided in Section 5 of the Quantification Notebook (SAPRA014); (l) model asymmetries were mainly limited to the fact that the SA112A PRA model is a Unit 1 model that relies on Unit 2 equipment for certain support functions, e.g.,

Demineralized Water and Main Control Room ventilation, which are not developed to the full level of detail as would be required if a dualunit PRA model was adopted. Based on the above discussion, there is no further action required.

QUF3 QUF3 SR Met:

(CC I)

QUF201 The reason this is a Capability Category I is that there is not documentation of significant contributors such as accident sequences and basic events being reviewed. Also there is no definition of significant contributors.

See response for SR QUF2.

Salem Generating Station CFCU AOT Extension 439 SALAR007 TABLE 447 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA4 Sa4 2009 SR #

RA4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION QUF4 QUF4 SR Not Met SCC302 The uncertainty notebook has not been approved.

the Uncertainty Notebook (SAPRA018) was officially issued and includes a section on model uncertainty and references both EPRI 1026511, which addresses the use of PRA and the treatment of uncertainty, and EPRI 1016737, which addresses the treatment of parameter and model uncertainty.

As such, there is no further action required.

QUF5 QUF5 SR Met This requirement is met by the statement about caution when using FV values of less than 0.1% and RAW values of less than 1E04.

N/A QUF6 QUF6 SR Not Met QUF201 This requirement was not met since there is no definition for significant basic event, significant cutset, significant accident sequence.

See response for SR QUF2.

Salem Generating Station CFCU AOT Extension 440 SALAR007 TABLE 448 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA4Sa42009 SR #

RA4 Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IFPPA1 IFA1 SR Met Salem internal flooding notebook SAPRA012, Revision 0 Appendix B contains a description of the flood areas.

N/A IFPPA2 IFA1a SR Met:

(CC II/III)

IFA1a01 Salem internal flooding notebook SAPRA012, Revision 0 Appendices B and D contain a description of the flood areas. The flood areas were generally aligned with the fire areas as discussed in Section B.3. Even though the documentation that shows the flood areas/zones could be more descriptive, this SR is considered to be met. The F&O is for improving the documentation of the flood areas and zones.

Section 4.0 of the Internal Flood Walkdown Notebook contains a list of plant drawings that define the rooms and areas within the plant, while Appendix D of the Internal Flood Summary Notebook provides a listing of those rooms and areas that form the scenario boundary. It is unnecessary to outline the flood area boundaries on a separate set of drawings when the information that was used to define the flood boundaries already exists for other programs, e.g., Fire Hazards Analysis. Since this is a documentation issue, there is no impact on the results for this license amendment request.

IFPPA3 IFA1b SR Met The buildings and areas that share equipment (e.g.,

Auxiliary and Turbine buildings) are included in the flood area identifications.

N/A N/A IFA2 This SR was deleted in RASb2005.

N/A IFPPA4 IFA3 SR Met The drawings used in the identification and definition of the flood areas appear to be current. Changes to the drawings used should be captured as part of the inputs monitoring in the model update program.

N/A IFPPA5 IFA4 SR Not Met IFA401 Salem internal flooding notebook SAPRA012, Revision 0 Appendix A contains a summary of the walkdowns that were performed. The summary includes some of the important flood features. But walkdown sheets containing the details of the walkdowns (spatial information, mitigating equipment such as drains, sumps, doors, wall penetrations, etc.) were not available.

The raw handwritten notes from the plant walkdowns were scanned to PDF files (Salem PRA Events.pdf and Salem Water Sources.pdf) and are now included with the rest of the electronic documentation and associated files. No further action required.

IFSOA1 IFB1 SR Met Flood sources are documented in the summary of walkdowns in Appendix A of the Salem internal flooding notebook SAPRA012, Revision 0, and also in the detailed analysis of the risk significant flood scenarios in Appendix E. Section 2.2.11 documents the assessment of in

leakage from other flood areas (e.g., back flow through drains).

N/A

Salem Generating Station CFCU AOT Extension 441 SALAR007 TABLE 448 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA4Sa42009 SR #

RA4 Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IFSOA2 IFB1a SR Not Met IFB1a01, IFC4a01 The buildings and areas that share equipment (e.g.,

Auxiliary and Turbine buildings) are included in the flood area identifications. However, there was no indication in the documentation that flood sources from Unit 2 can impact Unit 1 and vice versa.

The assessment performed in Section 3.0 of Risk Application SAMISC005 (Resolution of Internal Flood Peer Review Comments) showed that there were no new multiunit scenarios that require consideration due to the fact that they were either already postulated or were subsumed by existing scenarios. No further action required.

IFSOA3 IFB1b SR Met Flooding areas were selected based on the presence of one or more potential flooding sources. Hence, plant areas not subject to flooding were screened as described in Appendix B of the Salem internal flooding notebook SA

PRA012, Revision 0.

N/A IFSOA4 IFB2 SR Met Three categories of flooding initiating events were evaluated for the potential flood sources identified: major floods (2000+ gpm), general floods (100 to 2000 gpm) and spray type floods (<100 gpm). The frequency calculation method used (Reference EPRI technical report TR

1013141) for these flood scenarios includes failure modes of components. Section 2.2.9.1.1 of SAPRA012, Revision 0 documents the assessment of humaninduced flood mechanisms. This section concludes that human induced flood mechanism have a low enough frequency that they can be subsumed with the pipe failure frequencies. Considering the basis documented, this conclusion appears to be reasonable.

N/A IFSOA5 IFB3 SR Met Three categories of flooding initiating events were evaluated for the potential flood sources identified: major floods (2000+ gpm), general floods (100 to 2000 gpm) and spray type floods.

N/A IFSOA6 IFB3a SR Not Met IFA401 Salem internal flooding notebook SAPRA012, Revision 0 Appendix A contains a summary of the walkdowns that were performed. The summary includes some of the important flood features. But walkdown sheets containing the details of the walkdowns were not available.

See response for IFPPA5.

N/A IFB4 Relocated to IFC2 N/A IFSNA1 IFC1 SR Not Met IFC101 Propagation paths for areas are defined for highly risk

significant cases only.

This finding is adequately addressed via the analysis contained in Section 3.0 of Risk Application SAMISC005 (Resolution of Internal Flood Peer Review Comments). No further action required.

Salem Generating Station CFCU AOT Extension 442 SALAR007 TABLE 448 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA4Sa42009 SR #

RA4 Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IFSNA2 IFC2 SR Not Met IFC201 Plant design features that have the ability to terminate or contain the flood propagation are not documented for all defined flood areas.

For those quantified scenarios, a conservative approach was initially used that considered all PRAmodeled SSCs to be damaged due to a flood originating or propagating into a particular flood area and a conditional core damage probability (CCDP) computed. This CCDP was then multiplied by the flood initiating frequency to estimate the core damage frequency (CDF). If the CDF for a given flood scenario was sufficiently low, e.g., less than about 0.1% of the nominal internal events CDF, then no further refinement was deemed necessary. However, if first estimates of the core damage frequencies for that compartment proved too pessimistic, the affected area of the plant was analyzed in greater detail to take into account spatial effects, specific flooding flow rates, operator actions, drainage pathways, etc.

Hence, the justification for more detailed modeling of certain internal flood scenarios was aimed at removing some of the conservatism of the methodology, while at the same time providing a realistic basis for not assuming complete failure of all scenariospecific equipment due to a credible flooding event.

The PRA model was updated in 2012 (SA112A) following the peer review to include all modeled internal flood scenarios and does not numerically screen any on a numerical basis.

No further action required.

IFSNA3 IFC2a SR Not Met IFC2a01 This is only addressed for the most risksignificant areas.

In general, operator action for internal flood mitigation was only credited where needed to reduce the risk where failure of all PRA equipment was deemed too conservative. Also, automatic isolation and operation of sump pumps or other dewatering equipment were not credited, which was a conservative approach. No further action required.

IFSNA4 IFC2b SR Not Met IFC2b01 No discussion of required information is provided for the majority of areas.

See response for SR IFSNA2.

IFSNA5 IFC2c SR Not Met IFC2c01 The documentation does not discuss spatial orientation for components in those areas not screened.

See response for SR IFSNA2.

IFSNA6 IFC3 SR Met:

(CC I/II)

Component susceptibility to floodinduced failure is considered.

N/A

Salem Generating Station CFCU AOT Extension 443 SALAR007 TABLE 448 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA4Sa42009 SR #

RA4 Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IFSNA7 IFC3a SR Not Met IFC3a01 Appendix D of the PRA Internal Flood Evaluation states that "For spray scenarios, however, walkdown observations revealed that AirOperated Valves (AOVs) and Motor

Operated Valves (MOVs) were of a robust design that would exclude them from being susceptible to water damage. Hence, these components were not automatically failed (PRA event equal to TRUE) for quantification of the CCDP." This is not an adequate basis for determining the susceptibility of these components to floodinduced failure mechanisms per this SR.

The robustness of AOVs and MOVs with regard to spray scenarios was an informed judgment based on empirical observation. This observation is also reinforced by a paper presented at the PSA 2008 ANS conference by J. Lin (Insights from the Updates of Internal Flooding PRAs). Water spray does not generally prevent AOVs and MOVs from operating, and although it may remotely be possible, the most likely result is that it will not. Therefore, the basis for this assumption is deemed adequate and there is no further action required.

IFSNA8 IFC3b SR Met:

(CC I)

IFC3b01 Identification is not present in documentation.

This finding is adequately addressed via the analysis contained in Section 3.0 of Risk Application SAMISC005 (Resolution of Internal Flood Peer Review Comments). No further action required.

IFSNA9 IFC3c SR Met However, only for most important sequences.

N/A IFSNA10 IFC4 SR Not Met IFC401 The defined flooding scenarios were screened without development of flood rate, source, operator actions.

Detailed assessments were only provided for selected high frequency floods.

In general, internal flood scenarios that were calculated using a conservative methodology that were found to contribute less than 0.1% to CDF were not subjected to any further scrutiny or refinement, since further refinement was deemed unnecessary for the purposes of the fullpower internal events (FPIE) PRA model. It is unlikely that this particular issue involving internal floods with a relatively small contribution to CDF would have a measurable impact on the results for this license amendment request. The PRA model was updated in 2012 (SA112A) following the peer review to include all modeled internal flood scenarios and does not numerically screen any on a numerical basis. No further action required.

IFSNA11 IFC4a SR Not Met IFC4a01, IFB1a01 Documentation of multiunit scenarios could not be identified.

Multiunit scenarios were considered and analyzed, e.g.,

scenarios involving AB084B found in Appendix E of the Internal Flood Summary Notebook. The assessment in Section 3.0 of Risk Application SAMISC005 (Resolution of Internal Flood Peer Review Comments) did not identify any new potential multiunit scenarios. No further action required.

IFSNA12 IFC5 SR N/A No flood areas were screened out.

N/A IFSNA13 IFC5a SR N/A No flood areas were screened out.

N/A IFSNA14 IFC6 SR N/A No floods were screened out based on human mitigative actions.

N/A

Salem Generating Station CFCU AOT Extension 444 SALAR007 TABLE 448 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA4Sa42009 SR #

RA4 Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IFSNA15 IFC7 SR N/A Screening was not performed based on the criteria defined in this requirement.

N/A IFSNA16 IFC8 SR N/A No flood sources were screened out based on human mitigative actions.

N/A IFSNA17 IFC9 SR Met IFA401 Walkdowns were performed. However, walkdown sheets with the required information were not available for review.

See response for SR IFPPA5.

IFEVA1 IFD1 SR Met This requirement has been met by Appendices C & D of the Flood Analysis Notebook.

N/A N/A IFD2 This SR was deleted in RASb2005.

N/A IFEVA2 IFD3 SR Not Met IFC401 This is an extension of F&O IFC401.

See response for SR IFSNA10.

IFEVA3 IFD3a SR N/A There was no grouping or subsuming of flood initiating scenarios with other plant initiating event group.

N/A IFEVA4 IFD4 SR Not Met IFC4a01 There is no evidence that flooding in Unit 2 was considered for its effects on Unit 1.

See response for SR IFSNA11.

IFEVA5 IFD5 SR Met This requirement is met in Appendix D of the Flooding Notebook.

N/A IFEVA6 IFD5a SR Met:

(CC II/III)

This requirement is met in Appendix D of the Flooding Notebook.

N/A IFEVA7 IFD6 SR Met:

(CC I/II)

Humaninduced floods during maintenance were considered in Section 2.2.9.1.1 of the Internal Flood Evaluation.

N/A IFEVA8 IFD7 SR N/A Flood scenarios were not screened out using these criteria.

N/A IFQUA1 IFE1 SR Met The CCDPs for each of the scenarios were calculated by setting all initiating events in the PRA model to zero, with either the turbine trip event with PCS available (%TT) or PCS unavailable (%TP) set to a value of 1.0, depending on the nature of the components failed.

N/A N/A IFE2 Moved to IFC3c N/A IFQUA2 IFE3 SR Met All of the components modeled in the PRA that were assigned to the various scenario IDs based on their location in the plant and their susceptibility to water damage from the various modes of flooding, i.e., spray, general flooding, and major flooding. These components were utilized in flag files to set the appropriate basic events to TRUE, representing failure due to water damage, for the quantification of CCDPs for the analyzed scenarios.

N/A

Salem Generating Station CFCU AOT Extension 445 SALAR007 TABLE 448 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA4Sa42009 SR #

RA4 Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IFQUA3 IFE3a SR MET:

(CC II/III)

Areas were screened if the product of the sum of the frequencies of the flood scenarios for the area and the bounding CCDP were less than 1E9/reactor year.

N/A IFQUA4 IFE4 SR N/A No additional analysis of SSC data was performed to support quantification of flood scenarios N/A IFQUA5 IFE5 SR Met Scenariospecific impacts on PSFs are included.

N/A IFQUA6 IFE5a SR Met Scenariospecific impacts on PSFs are included.

N/A IFQUA7 IFE6 SR Met Internal flood sequences are quantified in accordance with the QU SRs.

N/A IFQUA8 IFE6a SR Met The combined effects of failures caused by flooding and due to causes independent of the flooding are included.

N/A IFQUA9 IFE6b SR Met Both direct and indirect effects are included in the quantification.

N/A IFQUA10 IFE7 SR Met Flood sequences are represented appropriately in the LERF analysis.

N/A IFQUA11 IFE8 SR Not Met IFA401 Walkdown documentation does not capture this information for all flood areas.

See response for SR IFPPA5.

IFPPB1, IFSOB1, IFSNB1, IFEVB1, IFQUB1 IFF1 SR Met The internal flooding analysis documentation can support PRA applications, upgrades, and peer review.

N/A IFPPB2, IFSOB2, IFSNB2, IFEVB2, IFQUB2 IFF2 SR Not Met See all IF F&Os Some documentation elements are missing, as noted in the Internal Flood F&Os.

The Internal Flood documentation (SAPRA012) was revised to include missing information and provide clarification where necessary during the Salem 2012 PRA model update. Since this is a documentation issue, there is no impact on the results for this license amendment request.

IFPPB3, IFSOB3, IFSNB3, IFEVB3, IFQUB3 IFF3 SR Not Met IFF301 Assumptions are documented in the Flooding Notebook.

Parametric uncertainty analysis was done but systemic uncertainty is not addressed.

Sources of modeling uncertainty (systemic) associated with internal flooding is now addressed in the Salem PRA Uncertainty Notebook (SAPRA018), which was created during the Salem 2012 PRA model update. No further action required.

Salem Generating Station CFCU AOT Extension 446 SALAR007 TABLE 449 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR CONFIGURATION CONTROL RA4 Sa4 2009 SR #

RA4Sb4 2005 SR #

Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION MU

A1 MUA1 SR Met MUA101 Salem specific site procedures should be developed for Maintenance of site specific PRAs. Develop Salem specific site procedures.

The Salem Generating Station has since developed sitespecific procedures for maintenance and use of PRA models. They are officially controlled and accessed via DCRMS. No further action is required.

MU

A2 MUA2 SR Met This requirement is met in Section 4.1.2 of procedure ERAA

6001015, "FPIE PRA Model Update," Revision 6.

N/A MU

B1 MUB1 SR Met This requirement is met in Sections 4.1.3 and 4.2.2 of procedure ERAA6001015, "FPIE PRA Model Update,"

Revision 6. Section 4.1.3 addresses how Updating Requirements (URE) puts are processed. Section 4.2.2 addresses review of UREs not dispositional into the next model update.

N/A MU

B2 MUB2 SR Met This requirement is met in Sections 4.1.3, and 4.2.1 of procedure ERAA6001015, "FPIE PRA Model Update,"

Revision 6. This requirement is met for periodic updates in the project planning phase in Section 4.2.1 of the subject procedure and Section 4.1.3 for unscheduled updates.

N/A MU

B3 MUB3 SR Met Since the other Supporting Requirements are met this SR is met by default.

N/A MU

B4 MUB4 SR Not Met MUB401 There is no reference to the requirement for a PRA peer review for upgrades.

Step 4.5.5.4.A of ERAA6001015 addresses this concern regarding PRA upgrades and the possibility for needing a limited peer review against the ASME PRA Standard.

MU

C1 MUC1 SR Not Met MUC101 There is no reference to a review of the cumulative impact of pending changes.

Step 4.3.1.3 of ERAA6001015 addresses this concern regarding cumulative impact of pending PRA model changes.

No further action is required.

MU

D1 MUD1 SR Met This requirement is met in Section 4.2.7 of procedure ERAA

6001015, "FPIE PRA Model Update," Revision 6.

N/A MU

E1 MUE1 SR Met This requirement is met in Sections 4.1 and 4.2 of procedure ERAA6001014, "Risk Management Configuration Control,"

Revision 5.

N/A MU

F1 MUF1 SR Met All items are met except for item (f), the review of the cumulative impact of pending changes. See F & O MUC101.

N/A

Salem Generating Station CFCU AOT Extension 447 SALAR007 TABLE 4410 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF REVISED SUPPORTING REQUIREMENTS RA4Sa42009 SR #

RA4Sb42005 SR #

DESCRIPTION OF CHANGE COMMENTS DAC14 DAC13 Coincident unavailability due to maintenance for redundant equipment is now being based on the activity being the result of a planned, repetitive activity that is based on plant experience. This implies that maintenance terms used in the PRA model that represent multiple SSCs being unavailable should not be used unless the activity is a routine planned evolution.

The SA112A PRA Model of Record (MOR) makes use of dual Service Water pump maintenance terms based on previous maintenance activities, which may not have been considered as being routine or repetitive evolutions. As such, the more recent version of this Supporting Requirement implies that these maintenance terms can be removed from the PRA model if the maintenance activity is not considered a planned and repetitive activity. The net effect is that this may result in a slight decrease in CDF and LERF if the SW pump dual maintenance terms are removed from the PRA model. An Updating Requirement Evaluation (URE) record has been recorded (SA2016

005) to capture this as part of the maintenance and update of the Salem PRA model.

QUB5 QUB5 The newer version of the Supporting Requirement (SR) states that when resolving circular logic to NOT introduce any unnecessary conservatisms or nonconservatisms, whereas the previous version of the Standard used the work AVOID.

This has no impact on the Salem PRA MOR as the resolution of circular logic was more clearly documented during the 2012 PRA model update in the PRA System Notebook for vital AC power (SAPRA005.0020). A review of this document in Section 6.8 provides evidence that unnecessary conservatisms or nonconservatisms were NOT introduced as a result of resolving circular logic issues.

QUE4 QUE4 The newer version of this Supporting Requirement redefines the treatment of model uncertainty and related assumptions with the intent of IDENTIFYING how the PRA model is affected, whereas the older version was focused more on an EVALUATION of sensitivity studies as it related to model uncertainty and assumptions.

During the 2012 PRA model update, the Uncertainty Notebook (SAPRA018) was officially issued and includes a comprehensive treatment on model uncertainty and assumptions for both CDF and LERF, using references that include EPRI 1026511, which addresses the use of PRA and the treatment of uncertainty, and EPRI 1016737, which addresses the treatment of parameter and model uncertainty. As such, the PRA model documentation is in compliance with the 2009 version of the ASME PRA Standard with regard to this Supporting Requirement.

QUF4 QUF4 The newer version of this SR redefines the treatment of model uncertainty and related assumptions by referring to QUE4, whereas the earlier requirement referenced an example listing of "key assumptions" and "key sources of uncertainty", such as success criteria, reliability data, modeling uncertainties, completeness of initiating events, spatical dependencies, etc.

See response for SR QUE4.

LEF3 LEF3 The change for this SR involves the same change involving the treatment of uncertainty and assumptions as for CDF, except that the focus is on LERF.

See response for SR QUE4.

Salem Generating Station CFCU AOT Extension 448 SALAR007 TABLE 4411 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF QUALIFICATIONS FROM REG GUIDE 1.200 (APPENDIX A)

RA4Sa4 2009 SR #

RA4Sb4 2005 SR #

DESCRIPTION OF RG 1.200, REV. 2, QUALIFICATION STATEMENT COMMENTS DAC15 DAC14 This SR provides a justification for crediting equipment repair (SYA24).

As written, it could be interpreted as allowing plantspecific data to be discounted in favor of industry data. In reality, for such components as pumps, plantspecific data is likely to be insufficient and a broader base is necessary.

IDENTIFY instances of plantspecific experience or and, when that is insufficient to estimate failure to repair consistent with DA4D9, applicable industry experience and for each repair, COLLECTZ.

This Supporting Requirement (SR) is not applicable for the Salem PRA model since no credit is being taken for repair of equipment following initial failure.

DAD9 N/A New requirement needed, DAC15 was incomplete, only provided for data collection, not quantification of repair. (See SYA24.)

For each SSC for which repair is to be modeled, ESTIMATE, based on the data collected in DA4C15, the probability of failure to repair the SSC in time to prevent core damage as a function of the accident sequence in which the SSC failure appears.

See response for SR DAC15.

Salem Generating Station CFCU AOT Extension 449 SALAR007 TABLE 4411 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF QUALIFICATIONS FROM REG GUIDE 1.200 (APPENDIX A)

IFSNA6 IFC3 For Cat II, it is not acceptable to just note that a floodinduced failure mechanism is not included in the scope of the internal flooding analysis.

Some level of assessment is required.

Cat I:

For the SSCs identified in IFSNA5, IDENTIFY the susceptibility of each SSC in a flood area to floodinduced failure mechanisms. INCLUDE failure by submergence and spray in the identification process.

EITHER:

(a) ASSESSZ by using conservative assumptions; OR (b) NOTE that these mechanisms are not included in the scope of the evaluation.

Cat II:

For the SSCs identified in IFSN4A5, IDENTIFY the susceptibility of each SSC in a flood area to flood4induced failure mechanisms.

INCLUDE failure by submergence and spray in the identification process.

ASSESS qualitatively the impact of flood4induced mechanisms that are not formally addressed (e.g., using the mechanisms listed under Capability Category III of this requirement), by using conservative assumptions.

Component susceptibility to flood damage due to either submergence or spray effects was identified for various types of SSCs in section 2.2.5 of the Internal Flood PRA Notebook (SAPRA012). Damage to SSCs due to jet impingement, pipe whip, elevated temperature, humidity, and excessive condensation are attributed to High Energy Line Break type of scenarios which are modeled using feedwater and steam line break initiating events that are already a part of the full power internal events (FPIE) PRA model.

Also, these high energy line break (HELB) scenarios are covered under the Design and Licensing process where Equipment Qualification of safety related SSCs is required as part of the Design and Licensing basis.

In addition, most high energy system piping is located in an outside environment at Salem since the Salem turbine deck is open to the atmosphere. Within the Auxiliary Building, high energy steam piping that supplies the motive force for the turbinedriven Auxiliary Feedwater (AFW) pump is contained within an enclosure designed for HELB scenarios.

The water systems associated with internal flood hazards are typically below 200 deg. F and less than 275 psig, which are incapable of producing the floodinduced mechanisms associated with HELB scenarios. As such, the damage mechanisms associated with HELB scenarios (i.e.,

mechanisms listed under Capability Category III) are not applicable to the modeled internal flood scenarios in the Salem FPIE PRA model.

Salem Generating Station CFCU AOT Extension 450 SALAR007 4.1.4 URE Status The URE database is a resource and working tool used by the Risk Management Team to ensure that the asbuilt, asoperated Salem plant configuration is reflected in the PRA. In addition, enhancements to the PRA quality are also identified, tracked, and resolved. The observations are recorded in the URE database. These observations identify potential areas of investigation for future model enhancement. Based on a review of this database, there are no outstanding UREs that would invalidate the use of the SA112A PRA model for quantifying the risk implications involved with the proposed CFCU AOT extension.

The major plant safety upgrade that led to the PRA update in accordance with PSEG procedural guidance was the dieselelectric 4th AFW pump that will be capable of cooling all steam generators at both Salem Units 1 and 2. The diesel is located in a dedicated building and the pump is in the Unit 1 Turbine Building. The pump discharges to the MFW system, making it completely independent from the Auxiliary Feedwater (AFW) system and the Auxiliary Building. This plant modification increases the defenseindepth for secondary side heat removal, thus making the use of feed and bleed operation, and subsequent containment sump recirculation, less likely for removal of decay heat.

4.1.5 Review of PRA Model Specific to Application As a result of reviewing the cutsets for the configuration in which two CFCUs are concurrently unavailable, it was seen that various cutsets that were previously below the truncation threshold were now above the threshold. A review of some of these cutsets revealed that the accident sequences would not necessarily lead to core damage due to being longterm and slowly developing scenarios that would not require containment cooling, either by the Containment Spray (CS) System or CFCUs. For example, many of these sequences involved a transient event followed by successful operation of the AFW System for approximately 11 hours1.273148e-4 days 0.00306 hours 1.818783e-5 weeks 4.1855e-6 months , but due inability to refill the AFW storage tank, operation of feed and bleed was implemented via injection from the Refueling Water Storage Tank (RWST). A MAAP 4.0.6 sensitivity analysis showed that this type of

Salem Generating Station CFCU AOT Extension 451 SALAR007 accident sequence did not require successful containment cooling either via CS or CFCUs. As such, an application specific model was developed to exclude these cutsets in order to attain a more accurate analysis of the risk increase. PSEG risk application SAMISC016, Application Specific Model for CFCU LAR, provides the details of the SA112B application specific PRA model that will be utilized for this extended AOT analysis.

4.2 TECHNICAL ADEQUACY CONCLUSION The combination of the internal events and internal flood PRA development process, associated PRA peer review, resolution of F&Os, and subsequent PRA update resulted in the current Model of Record (MOR) known as the SA112A model. Because of the specific configuration involving concurrent unavailability of two CFCUs, an application specific model was created to more accurately estimate the risk increase for this CFCU AOT extension (see Section 4.1.6).

In general, based on the information presented in the previous sections, the SA112A PRA MOR is deemed acceptable for use in evaluating the impact on risk due to the proposed CFCU AOT extension.

4.3 EXTERNAL EVENTS CONSIDERATIONS 4.3.1 Overview External hazards were evaluated in the Salem Individual Plant Examination for External Events (IPEEE) submittal in response to the NRC IPEEE Program (Generic Letter 88

20, Supplement 4) [12]. The IPEEE Program was a onetime review of external hazard risk and was limited in its purpose to the identification of potential plant vulnerabilities and the understanding of associated severe accident risks.

The results of the Salem IPEEE study are documented in the Salem IPEEE [10]. Each of the Salem external event evaluations were reviewed as part of the Submittal by the NRC and compared to the requirements of NUREG1407 [13].

Salem Generating Station CFCU AOT Extension Consistent with Generic Letter 88-20, the Salem IPEEE Submittal does not screen out seismic or fire hazards, but provides quantitative analyses. The following sections provide a brief summary of the seismic and fire hazards probabilistic analysis.

4.3.2 Seismic PRA The seismic risk analysis provided in the Salem Individual Plant Examination for External Events is based on a detailed Seismic Probabilistic Risk Assessment. A Seismic Probabilistic Risk Assessment analysis approach was taken to identify any potential seismic vulnerabilities at Salem. The Seismic PRA method was deemed an acceptable methodology identified in NUREG-1407.

This PRA technique included consideration of the following elements:

Seismic hazard analysis Seismic fragility assessment Seismic systems analysis Quantification of the seismically induced core damage frequency The Salem Seismic PRA study is a detailed analysis that, like the internal fire analysis, uses quantification and model elements (e.g., system fault trees, event tree structures, random failure rates, common cause failures, etc.) consistent with those employed in the internal events portion of the Salem PRA.

Some of the highlights of the Salem Seismic PRA methodology include the following:

Seismic hazard curve is based on the EPRI site specific seismic hazard study. In addition, revised Lawrence Livermore National Laboratory (LLNL) seismic hazard estimates are used as input as a sensitivity case.

A seismic event is not always assumed to result in a Loss of Offsite Power (LOOP). Seismic failure of offsite power is evaluated on a probabilistic basis according to component fragilities.

The Salem IPEEE stated that no plant unique or new vulnerabilities associated with the Seismic Analysis were identified. The Seismic PRA for Salem, with its original IPEEE hazard curves and identified dependencies and fragilities, can be used to provide general quantitative and qualitative insights.

4-52 SA-LAR-007

Salem Generating Station CFCU AOT Extension 453 SALAR007 4.3.3 Fire PRA The analysis of the impact of internal fires consisted of a screening of fire areas based on EPRI Fire Induced Vulnerability Evaluation (FIVE) methodology [14]. As prescribed by the FIVE methodology, detailed areabyarea equipment and cable inventories were developed from the Appendix R analysis, the Safe Shutdown Analysis (SSA) [15], and the Fire Hazards Analysis (FHA) [16]. The fire evaluation was performed on the basis of fire areas, which are plant locations completely enclosed by rated fire barriers. The fire area boundaries were assumed to be effective in preventing a fire from spreading from the originating area to another area based on the implementation of a satisfactory fire barrier surveillance and maintenance program, and observation during the walkdown. The fire area boundaries recognized in this study are defined in Sections 3 through 5 of the Salem Generating Station FHA [16] and in the SSA [15]. Qualitatively, an area was screened out if the area neither contained safe shutdown equipment nor called for a manual or automatic plant trip, given the condition that all equipment in the area is damaged. Quantitatively, an area was screened out if the CDF could be shown to be less than 1E06 per year, assuming a reactor trip and all equipment in the area failed and was unrecoverable.

In theory, the contribution to core damage frequency from fires anywhere in the plant may be assessed in detail. However this was impractical due to the large number of possible scenarios and also unnecessary, since fires in many plant areas are incapable of causing significant damage regardless of how severe they become. Consequently, the first stage in performing a fire analysis was to perform a systematic screening of all fire areas in accordance with the FIVE methodology. Areas not screened quantitatively or qualitatively were retained for a further detailed PRA evaluation.

The purpose of the qualitative screening was to identify the boundaries of the plant fire areas, together with the location of equipment and cables which, if damaged by fire, would cause a plant shutdown or degradation of shutdown paths identified in the plant's SSA or IPE. This information was then used to qualitatively screen fire areas from further consideration using the criteria developed in the FIVE methodology. The steps involved in qualitative screening included the following:

Salem Generating Station CFCU AOT Extension Step 1 - Identification of Fire Areas Step 2 - Identification of Plant Safe Shutdown Systems Step 3 - Identification of Safe Shutdown Equipment in Each Fire Area Step 4 - Perform Fire Area Safe Shutdown Function Evaluation For the quantitative screening analysis, the FIVE methodology provided a method of screening based on a conservative estimation of the contribution to CDF.

The equipment contained within an area was assumed to fail due to a fire. Using an event tree representative of the most significant failure, the contribution to CDF was then calculated. If this contribution was less than 1 E-06 per year using the fault tree and event tree models from the IPE, the area or compartment was able to be screened out.

As part of the IPEEE internal fire analysis, one potential plant vulnerability was identified, and a plant enhancement has been implemented as a result [17]. There are two sets of cables supplying offsite power to the 4kV vital buses and these are routed through one elevation of the turbine and service buildings before entering the auxiliary building. The two sets provide a redundant source of power to the vital 4kV buses.

Thus, if one set is damaged by fire, the second set could provide power to all three buses. In the turbine and service buildings, the two redundant sets of cables are separated by less than 10 feet for a portion of the area. No significant fixed combustible sources are located within 30 feet of the cables and are therefore not considered to be risk significant. However, as a result of the fire IPEEE, transient combustible controls similar to those in place for the auxiliary building, penetration areas and service water intake structure have been put into effect for this area of the turbine and service buildings. As a result of the enhancement, daily walkdowns will be performed for the elevation on which the cables are routed, trays containing the cables will be marked to identify them as safety-related, fire watches will be posted if any normally active suppression systems are disabled, and transient combustibles entering the area of the cables will be require administrative approval. Procedures are now being revised to ensure these activities are accomplished through periodic monitoring. The internal fire PRA model was credited with this enhancement and was reflected in the IPEEE results.

4-54 SA-LAR-007

Salem Generating Station CFCU AOT Extension 455 SALAR007 4.3.4 Other External Hazards In addition to internal fires and seismic events, the Salem IPEEE analysis of high winds or tornados, external floods, transportation accidents, nearby facility accidents, release of onsite chemicals, detritus and other external hazards was accomplished by reviewing the plant environs against regulatory requirements regarding these hazards. The screening assessment took advantage of the fact that the site is colocated with the Hope Creek Generating Station (HCGS), which is a plant that meets the 1975 Standard Review Plan (SRP) criteria [18]. To the extent that the event assessment is based on location of the site, as opposed to plant specific features, information from Sections 2 and 3 of the latest revision of the HCGS Updated FSAR (UFSAR) [19] was used to supplement information from the Salem UFSAR [20].

The class of external events termed "other external events" were screened out either by compliance with the 1975 SRP criteria [18] or by bounding probabilistic analyses that demonstrated a core damage frequency of less than the IPEEE screening criterion.

The external flood assessment provided input to the now completed PSE&G Penetration Improvement Program by recommending that a high priority be placed on penetrations through the Auxiliary Building/Service Building walls. The IPEEE provided confidence that no plantunique external event is known that poses a significant threat of severe accidents and that the Salem units are not vulnerable to other external events.

More recently, in response to NRC Order EA12049 [28], which was issued following the tsunami and plant consequences experienced at FukushimaDaichi in March 2011, PSEG developed an Overall Integrated Plan (OIP) [29] to enhance the defenseindepth countermeasures aimed at mitigating extreme external hazards. The OIP employed the use of Diverse and Flexible Coping Strategies (FLEX) in accordance with the guidance given in NEI 1206 [30]. This resulted in the deployment of portable FLEX equipment that could be put into service when necessary to mitigate extreme external hazards.

Although FLEX is not explicitly modeled in the SA112B PRA model used for this CFCU AOT extension, qualitative insights suggest that the risk due to these other external hazards, as well as other beyond design basis events pursuant to Reference [30], would

Salem Generating Station CFCU AOT Extension 456 SALAR007 be even less than what was characterized by any historic evaluations performed in support of the IPEEE.

4.3.5 External Hazard PRA Summary Due to the fact that Salem does not have a current external events PRA model, the use of IPEEE results was deemed acceptable for use in providing insights into the risk contribution associated with the CFCU AOT extension.

4.4

SUMMARY

The Salem PRA model, maintenance and update process, and technical capability discussion described above provide a robust basis for concluding that the PRA is suitable for use in riskinformed processes. However, given the discussion in Section 4.1.6, and because the specific configuration of interest involves the concurrent unavailability of two CFCUs, which is the basis for this analysis, an application specific PRA model (SA112B) was developed in order to remove noncore damage cutsets to more accurately assess the risk increase for this CFCU AOT extension. Since this was the only change made to the current Salem PRA MOR (SA112A), the technical adequacy of the SA112A MOR also extends to this application specific PRA model (SA112B).

Salem Generating Station CFCU AOT Extension 51 SALAR007 5.0 DISCUSSION OF RISK CONTRIBUTORS AND UNCERTAINTY This section evaluates epistemic uncertainties that could impact the CFCU AOT extension assessment. Section 5.1 provides a breakdown of the contributors to the CDF risk increase associated with this LAR to provide a framework for performing the uncertainty analysis. Note that the focus is on CDF since there is substantial margin to the acceptance guidelines for the LERF figure of merit. Section 5.2 then elaborates on the three types of epistemic uncertainty: parameter, model, and completeness uncertainties. Section 5.3 provides results of sensitivity studies that were performed based on the model uncertainty evaluation (including issues identified from peer review findings). Section 5.4 then summarizes the insights obtained from the uncertainty assessment.

Overall, this LAR contains all the elements of riskinformed decisionmaking process described in NUREG1855. The structure used to present this information is shown in Figure 51, which is taken from the companion document to NUREG1855 entitled EPRI1026511, Practical Guidance on the Use of Probabilistic Risk Assessment in RiskInformed Applications with a Focus on the Treatment of Uncertainty [25]. Table 51 provides a roadmap identifying the relevant sections of the uncertainty analysis.

TABLE 541 ROADMAP TO THE UNCERTAINTY ANALYSIS Step Step Summary Document Section 1

Define the risk analysis application to be used to address RG 1.177 Performed in Section 1.

2 Assess the adequacy of the existing PRA models to support the analysis Performed in Section 4. Technical Adequacy of the PRA Model.

3 Perform the initial comparison with the acceptance guidelines. Identify significant contributors and role of affected function.

Initial comparison is shown in the Executive Summary; significant contributors are identified in Section 5.2.

4 Assess the adequacy of the scope of the PRA models Assessed in Section 4.

5 Perform final comparison with acceptance guidelines - assessment of significance of parameter and model uncertainty Analyzed in Section 5.5; parametric analysis shown in Section 3.5.

6 Prepare input for the integrated decision

making process Section 6.

'i$w FIGURE 5-1 Salem Generating Station CFCU AOT Extension OVERVIEW OF PROCESS FOR PRA ANALYSIS TO SUPPORT A RISK INFORMED DECISION 5-2 SA-LAR-007

Salem Generating Station CFCU AOT Extension 5.1 STEP 3: INITIAL COMPARISON TO ACCEPTANCE GUIDELINES Table 5-2 summarizes the calculated values for the NRC specified risk metrics (!lCDF, L'lLERF, ICCDP, and ICLERP) for the proposed change to the AOT involving the concurrent unavailability of two CFCUs for a period of 14 days, with the premise that this occurs on three separate occasions throughout a given refueling cycle (18 months).

The process used to calculate the risk metrics complies with NRC Regulatory Guides 1.17 4 and 1.177, as described in Section 3.

TABLE 5-2 QUANTITATIVE RESULTS OF THE RISK METRICS FOR CONCURRENT UNAVAILABILITY OF TWO CFCUS Parameter Value Comments TcvcLE 547.5 days Based on 1 8 month refuelin_g cycle TcFcu 14 days Number of days that two CFCUs are unavailable CDFcFcu 1.62E-05 CDF based on application of flag file for two unavailable CFCUs and adjusted CCF term LERFcFcu 7.32E-07 LERF based on application of flag file for two unavailable CFCUs and adjusted CCF term CDFsASE 1.55E-05 CDF for PRA MOR LERFsAsE 7.29E-07 LERF for PRA MOR Average CDF over one 1 8 month refueling cycle CDFAVE 1.55E-05 for three instances of dual CFCU unavailability for 1 4 days at a time Average LERF over one 18 month refueling cycle LERFAvE 7.29E-07 for three instances of dual CFCU unavailability for 1 4 days at a time Difference between CDF with current technical specifications and the CDF for an average 1 8 1'\\CDF 5.61 E-08 month cycle with three instances of concurrent unavailability of two CFCUs extended to 14 days This value is below Region Ill of RG 1.1 74 Difference between LERF with current technical specifications and the LERF for an average 1 8 1'\\LERF 2.15E-1 0 month cycle with three instances of concurrent unavailability of two CFCUs extended to 1 4 days This value is well below Region Ill of RG 1.174 ICCDPcFcu 2.80E-08 Below 1 E-06 Acceptance Guideline of RG 1.1 77 ICLERPcFcu 1.08E-1 0 Below 1 E-07 Acceptance Guideline of RG 1.177 5-3 SA-LAR-007

Salem Generating Station CFCU AOT Extension 54 SALAR007 Note that all risk values are much more than one order of magnitude below the Acceptance Guidelines of RG 1.177. The calculations of deltaCDF are and deltaLERF are very small, as defined in RG 1.174 (less than 1E6 and 1E7 respectively). Salems CDF and LERF are clearly in Region III of Figure 5 in RG 1.174. Therefore, the focus of the uncertainty analysis will be to search for model uncertainties that could approach or exceed the acceptance guidelines.

5.2 CONSIDERATION OF SIGNIFICANT CONTRIBUTORS To determine the relative importance of the individual contributors for this LAR, the focus needs to be on the results of the CDF assessments for two CFCUs out of service.

Note that the results are very similar when a single CFCU is out of service in the internal events and internal floods models such that a detailed presentation of those results is not warranted.

To obtain insights regarding the changes to the base case results when two CFCU are out of service, the first step is to take the out of service case results and remove the base case cutsets (e.g. using the CAFTA delete term process). This leads to a cutset file that can be used to provide information regarding the significant accident sequences or cutsets that are driving the deltaCDF assessment.

For the internal events and internal floods assessment, the results are presented by initiator in Table 53. Since the deltaCDF is quantitatively more limiting than delta

LERF analysis, the initiating event and component importance analysis is done on the deltaCDF calculations. The deltaLERF files were reviewed and a more detailed analysis would provide no additional information. The reason deltaLERF is less limiting is well understood - the risk increase is predominantly from slowly developing core damage scenarios with late recirculation failure.

The change in CDF comes from approximately equal contributions from intermediate LOCA, LOOP and internal flood initiators. In addition, the dominant cutsets for each case were reviewed to assist with understanding the important contributors and identifying potential sources of model uncertainty.

Salem Generating Station CFCU AOT Extension TABLE 5-3 MAJOR INITIATING EVENTS CONTRIBUTING TO THE RISK INCREASE Fig ure of Merit I nternal Events & I nternal Floods CDFcFcu 1.62E-05 CDFBASE 1.55E-05 CDF = CDFx - CDFaAsE 5.61 E-08 INTERMEDIATE LOCA 32%

LOSS OF OFFSITE POWER 25%

INTERNAL FLOODS 21%

TRANSIENTS 7%

SMALL LOCA 3%

LARGE LOCA 3%

OTHER 8%

Intermediate LOCA cutsets are characterized by an additional dependent failure of a CFCU, which fails the system, and failure of the containment spray system (CSS),

which leads to failure of containment sump recirculation.

The most important CSS failure is the operator failing to align the RHR pump discharge to the containment spray system headers for long-term containment spray.

The next most important family of scenarios are LOOPs and transients that lead to a LOOP or LOOP-like conditions because of a consequential LOOP. The LOOP cutsets are not related to station blackout; instead, they are characterized as cutsets that affect the ability to cool the steam generators. As with most PRAs, the Salem PRA model does not credit the use of any secondary cooling functions (e.g., condensate or main feedwater) in LOOP scenarios. From the internal events analysis, the dominant cutsets typically involve multiple operator actions, such as dependent human failure events that result in loss of decay heat removal.

The flooding cutsets involve flooding from the AFW system on the 78' elevation of the Auxiliary Building. In addition to the AFW system, the flooding cutsets characteristically 5-5 SA-LAR-007

Salem Generating Station CFCU AOT Extension 56 SALAR007 fail at least one additional CFCU and the containment spray function. The cutsets also require an additional failure which renders nonsafety related steam generator cooling (condensate and main feedwater) unavailable. Consequential loss of offsite power and a variety of human failures lead to unavailability of the condensate and feedwater systems. In these cutsets, bleed and feed cooling is successful, but recirculation fails due to the inability to cool containment.

The review of the top level contributors in Table 54 and top cutsets provides a general understanding of the nature of the most important CDF contributors associated with the CFCU outages. A more detailed and comprehensive view of the contributors is gained through a review of the important individual basic event contributors. The results of the internal events and internal flood assessment at the basic event level are provided in Table 54. In both cases, the basic events sorted by FussellVesely importance (i.e.,

percent contribution) are provided for all FussellVesely values greater than 0.005.

Note that specific initiating event contributors have been purposely excluded from this list since they have already been assessed in Table 53. Flag events that add no pertinent information for the analyst were also excluded.

Starting at the top of Table 54, the review of important basic events begins with VCS

FNRFRDF01, which is the commoncause failure of 3 or more fans. This event is quite important because it is quantified using the conditional probability that additional fans will fail given that two other fans have initially failed. It appears in LOCA, LOOP and many other cutsets.

The second most important event, CSSXHEFOCSREC, represents the operator failing to align the discharge of the RHR system to the containment spray system during recirculation of water from the containment sump. This operator action is required after depletion of the Reactor Water Storage Tank (RWST). This event appears along with VCSFNRFRDF01 (discussed above) in LOCA, LOOP and many other cutsets.

The next most important event, MFWXHEFOCONDE, represents failure of the operator to use secondary plant systems to cool the steam generator following loss of AFW. AFW is rendered unavailable in Auxiliary Building internal flood scenarios.

Salem Generating Station CFCU AOT Extension 57 SALAR007 The fourth most important event of substantially high importance is CISXHEFC

XLCNT, which represents the operator failing to isolate the Reactor Coolant System (RCS) letdown flowpath. This subsequently leads to a LOCA that will eventually require the capability to perform containment sump recirculation.

Table 54 presents those basic events that were found to be important to the relative increase in plant risk:

TABLE 544 BASIC EVENTS IMPORTANT TO THE RISK INCREASE Event Probability Fussell4 Vesely Achiev.

Worth Description VCSFNRFRDF01 8.22E01 0.6716 1

DEP FAILURE TO RUN OF 3 OR MORE FANS CSSXHEFOCSREC 1.90E03 0.5146 271 OPER FAILS TO ALIGN RHR DISCHARGE TO CSS SPRAY MFWXHEFOCONDE 1.80E02 0.1746 11 OPERATOR FAILS TO ESTABLISH FW TO SGs (EXEC ONLY EARLY CASE)

CISXHEFCXLCNT 2.60E03 0.1316 51 OPERATOR FAILS TO TERMINATE EXCESS LD LOCA THRU CNTMT AC5OFFSITEPWR 5.30E03 0.0561 12 POWER UNAVAILABLE TO 500 KV SWITCHYARD AFSXHEFOEARLY 3.70E03 0.0358 11 OPERATOR FAILS TO DIAGNOSE LOSS OF SECONDARY HEAT REMOVAL RHSLSWFT1RH1 1.00E04 0.0327 328 VALVE 1RH1 CLOSED LIMIT SWITCH FAILS RHSLSWFT1RH2 1.00E04 0.0327 328 VALVE 1RH2 CLOSED LIMIT SWITCH FAILS CCSMOVCCDF10 3.03E05 0.0247 814 DEP FAILURE TO OPEN OF 2 MOV'S (11, 12CC16)

JHEXHECSRECAFL1 1.00E06 0.0225 22318 JOINT HUMAN ERROR FAILING CONT. SPRAY AND AFW LATE JHEXHEAFECSREC

AFL1 1.00E06 0.0220 21829 JOINT HUMAN ERROR FAILING CONT. SPRAY AND AFW JHEXHECSRECAFL12 1.00E06 0.0220 21829 JOINT HUMAN ERROR FAILING CONT. SPRAY AND AFW LATE AFSXHEFOLATE1 3.00E04 0.0204 69 COGNITIVE FAILURE ASSOC WITH H2OLT AND REFILL LATE RHSXHEFORECIR 2.00E03 0.0171 10 OPER FAILS TO REALIGN FOR RECIRC LONG TIME (SLOCA)

IFBXHE 4.40E03 0.0159 5

FAILURE TO ISOLATE SG AFTER FEEDLINE BREAK CCSMOVCC11C16 1.58E03 0.0139 10 VALVE11CC16 FAILS TO OPEN CCSMOVCC12C16 1.58E03 0.0132 9

VALVE12CC16 FAILS TO OPEN RCSXHEFOLDEP 8.40E03 0.0090 2

OPER FAILS TO DEPRESSUR RCS LATE AFTER SGTR SJSXHEFCTRMSI 2.50E03 0.0077 4

OPERATOR FAILS TO TERMINATE SI ACPXHEFOGTG 6.70E02 0.0054 1

GTG UNAVAILABLE DUE TO OP FAILURE CSSMOVCC1CS36 1.07E03 0.0052 6

MOV 11CS36 FAILS TO OPEN AC5GTSTMGTG 6.37E02 0.0051 1

GAS TURBINE GEN UNAVAIL DUE TO TM RHRXHEFOSHDCL 4.80E03 0.0051 2

OPER FAILS TO ALIGN SHUTDOWN COOLING AFTER DEPRESS

TABLE 5-4 Salem Generating Station CFCU AOT Extension BASIC EVENTS IMPORTANT TO THE RISK INCREASE Event Probability Fussell-Achiev.

Description Vesely Worth SWS-AOV-CC-12223 2.06E-03 0.0050 3

AOV 1 2SW223 FAILS TO OPEN SWS-AOV -CC-14223 2.06E-03 0.0050 3

AOV 14SW223 FAILS TO OPEN SWS-AOV-CC-1 5223 2.06E-03 0.0050 3

AOV 1 5SW223 FAILS TO OPEN AFS-MDP-FS-DF04 1. 1 OE-05 0.0048 442 DEPENDENT FAILURE OF ALL 3 AFW PUMPS CSS-MOV-CC-2CS36 1.07E-03 0.0048 5

MOV 1 2CS36 FAILS TO OPEN A review of the importance measure reports presented in Tables 5-3 and 5-4 confirm the importance of some of the contributors identified previously and provide some additional insights. These additional insights are listed below:

From the internal events assessment, intermediate LOCAs will eventually require recirculation. Unavailability of CFCUs increases the likelihood that containment conditions will not support continued successful sump recirculation.

From the internal events assessment, internal flood risk is dominated by flooding on the 78' elevation of the Auxiliary Building, which fails the air-operated SW outlet valves (SW-223) for each CFCU. These valves fail open on loss of air and closed on loss of DC power. Random valve failures are also important following other non-internal flood initiating events.

From the internal events and internal flood assessment, operator actions associated with loss of decay heat removal (LODHR) scenarios were identified as important (i.e., aligning containment spray, initiating and operating steam generator cooling), and associated actions that are important in feed and bleed cooling. They are important as both individual human failure events as well as dependent failures involving multiple operator actions.

From the internal events and internal flood assessment, maintenance on containment sp'ray and emergency diesel generators (EDGs) also contribute to the risk increase in some manner.

From the perspective of fire PRA scenarios, the WIP Fire PRA model showed a high dependence on offsite power.

Due to this high dependence, the dependence on the CFCUs for this particular configuration analyzed in this CFCU AOT extension was minimal.

From the internal events assessment, failure of one additional CFCU is important, either due to failure of an additional fan or associated damper failures.

From the internal events assessment, no additional common cause events significantly affected the outcome other than those associated with the conditional probability for failure of additional CFCUs.

5-8 SA-LAR-007

Salem Generating Station CFCU AOT Extension From the internal events assessment, LOOP initiators and consequential LOOPs (AC5-0FFSITE-PWR) are important since they result in failure of all non-safety related methods of steam generator cooling. EDG importance is not as high due to a failure of any one EDG only affecting one of the three safety buses at Salem.

One unique feature of the Salem electrical distribution system is the fact the plant has 3 EDGs and vital buses, but only 2 fuel oil transfer pumps.

This configuration affects station blackout scenarios, but has a negligible impact on this CFCU AOT extension analysis.

Based on these insights, none of the noted contributors represent an inordinately large fraction of the risk contribution to either the internal events or fire hazard results.

5.3 STEP 4: ADEQUACY OF THE SCOPE OF THE SALEM PRA Based on the very small risk increase involving the configuration analyzed in this LAR (see Section 3.4.5), there is no further need for additional compensatory measures or quantification. Based on fire PRA insights from the WIP Fire PRA model, it was found that there was no appreciable increase in fire risk as a result of this CFCU AOT extension. Because of this, quantitative fire PRA results were not deemed necessary.

5.4 STEP 5: UNCERTAINTY ANALYSIS As discussed earlier, epistemic uncertainty is generally categorized into three types -

parameter, model, and completeness uncertainty. These are each discussed in the sections that follow.

5.4.1 Parameter Uncertainty The cutset results for the different CDF assessments were reviewed to determine if the epistemic correlation could influence the mean value determination. From the review of the cutsets, it was determined that the dominant contributors do not involve basic events with epistemic correlations (i.e., the probabilities of multiple basic events within the same cutset for the dominant contributors are not determined from a common parameter value). Per Guideline 2b of EPRI 101673, it is acceptable to use the point estimate directly in the risk assessment.

To verify that the use of the point estimate is acceptable in these cases, a detailed Monte Carlo calculation using EPRI R&R workstation UNCERT software was performed 5-9 SA-LAR-007

Salem Generating Station CFCU AOT Extension 510 SALAR007 to compare the mean value determined from the Monte Carlo simulation as compared to the point estimate. The results of those assessments for the calculated change in core damage frequency (CDF) are provided in Figures 31 and 32. Although the change in risk determined from the propagated mean is typically slightly higher, the change in risk was less than 5% in all cases. Therefore, based on the small difference in the comparison of the mean value with the point estimate values provided, the use of the point estimate for this assessment is deemed acceptable.

Note that a similar assessment was performed for the LERF figure of merit and exhibited a similar trend. That is, the parametric mean values were very close to the point estimate mean values. The results of those assessments are provided in Figures 33 and 34. For these LERF cases, the percent difference between the two means from the base case and CFCU AOT extension was essentially zero. Therefore, since LERF is not a significant contributor for this assessment, the use of the point estimate is also deemed acceptable.

Reviewing the results shown in Figures 31 to 34 shows that the uncertainty distributions for CDF and LERF are similar in the base and AOT extension models. It should be noted that even the upper bounds of the distributions will not approach the acceptance guidelines.

Additionally, in reviewing the top 35 cutsets as a result of the risk increase described in Section 5.2 for identical or similar components for which the data may come from a common source, there were no such cutsets found exhibiting this condition. This is because the cutsets generally consisted of human failures and common cause events.

Therefore, the state of knowledge correlation (SOKC) does not have a significant quantitative effect on the results.

5.4.2 Model Uncertainty The assessment of model uncertainty utilizes the guidance provided in EPRI 1016737

[23] and in NUREG1855 [24] and considers the following:

1. Characterize the manner in which the PRA model is used in the application.

Salem Generating Station CFCU AOT Extension

2. Characterize modifications to the PRA model.

3. Identify application-specific contributors.

4. Assess sources of model uncertainty in the context of important contributors.

a. Also consider other sources of model uncertainty from the base PRA model assessment for the identification of candidate key sources of uncertainty.

b. Screen based on relevance to parts of PRA needed or based on relevance to the results.

5. Identify sources of model uncertainty and related assumptions relevant to the application.

a. This involves the formulation of sensitivity studies for those sources of uncertainty that may challenge the acceptance guidelines and an interpretation of the results.

5.4.2.1 Characterize the Manner in which the PRA Model is Used in the Application The manner in which the PRA model is used in this application is fully described in Section 3 and does not need to be reproduced here.

5.4.2.2 Characterize Modifications to the PRA Model Other than the one change made to the PRA model of record (MOR) described in Section 3.4.3, there were no other changes made to the model that would introduce any application-specific sources of model uncertainty for this analysis.

5.4.2.3 Characterize the Manner in which the PRA Model is Used in the Application The following items are identified as the important contributors to the change compared to the base case results.

Operator actions associated with initiating or operating CSS, MFW, AFW and RHR.

LOCA and internal flood initiating event frequency LOOP frequency and consequential LOOP probability Failure rates of the components for the systems above Common cause failure probabilities of the CFCU 5-1 1 SA-LAR-007

Salem Generating Station CFCU AOT Extension 5.4.2.4 Assess Sources of Model Uncertainty in Context of Important Contributors A review of the identified sources of model uncertainty from the base model assessment as identified by implementing the process outlined in EPRI 1 016737 for Salem was then performed to determine which of those items are potentially applicable for this assessment even though they did not appear as a dominant contributor in the base assessment for the application. Based on this review, some of the items were already identified and many do not warrant further analysis, but the following items were added for investigation since they were judged to be potentially applicable for this application.

The CCF of 3 or more CFCUs Equipment in Test & Maintenance Based on the identified important contributors as summarized in Section 5.2 and the addition of applicable base PRA model sources of uncertainty identified above, the next step is to perform a qualitative assessment or semi-quantitative screening assessment to determine if sources of uncertainty have been addressed in the PRA that affect the important contributors for the application.

The semi-quantitative screening assessment is based on exceeding the ICCDP limit of 1.0E-6 currently specified for permanent technical specification changes in RG 1.177.

Recall that the ICCDP is obtained as indicated below.

ICCDPcFcu = (CDFcFcu - CDFaAsE) x AOTNEW One can substitute in the known values to solve for the maximum CDFcFcu that would result in an ICCDP of 1.0E-6.

Including the base CDF from the internal events and internal floods assessment as well as the internal fires assessment, this would equate to:

COFMAX = 1. OE-6 I 3. 84E-2 + 1. 55E-5 = 4. 15E-5 Correspondingly, the minimum Risk Achievement Worth (RAW) value that could lead to exceeding the ICCDP acceptance guideline is shown below.

5-1 2 SA-LAR-007

Salem Generating Station CFCU AOT Extension 513 SALAR007 RAWMIN = CDFMAX / CDFCFCU For the internal events and internal floods assessment, this would equate to:

RAWMIN = 4.15E5 / 1.62E5 = 2.5 Based on those events found to be relatively significant contributors to the change in risk (see Table 54) using a Risk Achievement Worth (RAW) of 2.5, a qualitative assessment is provided in Table 55 to discuss potential sources of uncertainty that might possibly challenge the acceptance guidelines from any single basic event. The results of this assessment are shown in Table 55.

TABLE 545 IDENTIFICATION OF POTENTIAL KEY SOURCES UNCERTAINTY Source of Uncertainty Source of Model Uncertainty for Base Model Application Important Contributor Source of Model Uncertainty Assessment Potential Key Source of Uncertainty Operator action to diagnose loss of secondary heat removal Operator action to line up containment spray Operator actions to refill AFW storage tank Operator action to initiate feed and bleed Operator fails to terminate excess letdown Yes Yes The credited actions are procedurally directed with the calculated HEP values derived from an accepted methodology. Although variations to the HEP values may lead to changes in the risk assessment results, only very bounding assumptions regarding the appropriate HEP values for these individual actions would lead to exceeding the risk metric acceptance guidelines for voluntary actions requiring risk management actions.

No

Salem Generating Station CFCU AOT Extension 514 SALAR007 TABLE 545 IDENTIFICATION OF POTENTIAL KEY SOURCES UNCERTAINTY Source of Uncertainty Source of Model Uncertainty for Base Model Application Important Contributor Source of Model Uncertainty Assessment Potential Key Source of Uncertainty Likelihood that loss of offsite power leads to permanent loss of condensate cooling of SGs Yes Yes This represents the likelihood of LOOPs and initial diagnosis failures that are not recovered via condensate cooling. Recovery of secondary side heat removal via the condensate system following a LOOP is not modeled.

No Maintenance configurations involving CSS, RHR, AFW and GTGs No Yes Although these events by themselves do not represent a true source of model uncertainty, the relative importance of the maintenance terms for these systems indicates that avoiding maintenance on these systems during the extended AOT could be a potentially important action that could be taken to reduce the risk associated with the extended AOT. All TM terms have RAWs less than or equal to 1.005. Concurrent maintenance activities are addressed via existing work control practices.

Yes -

sensitivity case #2 was performed to address removal of GTG from service Failure rates of components for the above systems No Yes The failure rates and probabilities associated with these systems are derived based on a Bayesian update of plantspecific data. These failure rates and probabilities represent a best estimate of the expected response for the site. Given this, reasonable variations to these events have been partially captured in the parametric uncertainty evaluation.

Yes -

sensitivity case #1 was performed to address this concern Common cause failure probabilities of CFCUs Yes Yes As indicated previously, the common cause failure probabilities of the CFCUs contribute to the internal events assessment, but are not as significant for the internal fires assessment.

No, because of the conservative probability estimate; the RAW is 1.1

TABLE 5-5 Salem Generating Station CFCU AOT Extension IDENTIFICATION OF POTENTIAL KEY SOURCES UNCERTAINTY Source of Source of Application Source of Model Uncertainty Potential Uncertai nty Model Important Assessment Key Source Uncertainty Contributor of for Base Uncertainty Model Common cause Yes Yes Common cause failures of MOVs in No failure the CCS system and pumps in the probabilities of AFW system contribute to the internal other PRA events assessment. Increasing the components basic event values by greater than 1 0 times their current values would be required in order to exceed the risk metric acceptance guidelines. Since the CCF conditional probabilities are based on accepted methodologies and data, an increase of 1 0 times their current values is deemed unreasonable and as such, this model uncertainty is screened as a potential source of uncertainty.

5.4.2.5 Identify Sources of Model Uncertainty and Related Assumptions Relevant to the Application Based on the evaluation of important contributors shown in Table 5-5, the following items were identified as potential key sources of uncertainty for this application.

Maintenance configurations involving CSS, RHR, AFW and GTG Failure rates for equipment associated with CSS, RHR, AFW and GTG The first item was addressed as part of a sensitivity analysis presented in Section 5.5.2 that investigates unavailability of the Gas Turbine Generator (GTG, also known as Salem Unit 3). Other maintenance activities had a much lower impact than for the Salem Unit 3 case and can be addressed with compensatory measures using existing work control practices e.g., OP-AA-1 08-1 16, PROTECTED EQUIPMENT PROGRAM

[21 ].

The second item was addressed as part of a sensitivity analysis presented in Section 5.5.1 that adjusts the failure probabilities for those components that had both a high 5-1 5 SA-LAR-007

Salem Generating Station CFCU AOT Extension 516 SALAR007 Risk Achievement Worth (RAW >2) and lack of plantspecific data as required by PSEG procedure ERAA6001015, FPIE PRA MODEL UPDATE [26]. This also addresses the peer review finding of Not Met for Supporting Requirement DAC2 (see Table 46).

5.4.3 Completeness Uncertainty As discussed in Section 3.4, external hazards from fire and seismic events were qualitatively addressed as not having a significant contribution to any risk increases associated with this CFCU AOT extension. Other external hazards, as discussed in the IPEEE [10], were screened out as being insignificant. Therefore, only two hazard groups were explicitly considered for this risk assessment. Internal events and internal floods are explicitly included in the quantitative evaluations described in Section 3.2.

Although a Salem peerreviewed Fire PRA model does not currently exist, additional insight regarding fire hazards were investigated using a WorkinProgress (WIP) Fire PRA model that did not reveal any significant risk impacts with respect to the configuration modeled for this CFCU AOT extension.

Therefore, there is no major form of completeness uncertainty that would impact the results of this assessment.

5.5 SENSITIVITY ANALYSIS This section describes the results of various sensitivity analyses that were performed to address peer review findings and other identified sources of uncertainty, e.g., Table 55.

5.5.1 Sensitivity Case #1 This sensitivity case presents the potential effect of not using plant specific data for important components. Table 46 points out a peer review finding of Not Met for Supporting Requirement DAC2. The data procedure used by PSEG requires the use of plant specific data for components with a Risk Achievement Worth (RAW) greater than 2 and FussellVesely importances greater than 0.005. The following components listed in Table 56 met these importance measures for the risk increase associated with this CFCU AOT extension.

Salem Generating Station CFCU AOT Extension 517 SALAR007 TABLE 546 COMPONENTS IMPORTANT TO THE RISK INCREASE Event Probability Fussell4 Vesely Achiev.

Worth Description RHSLSWFT1RH1 1.00E04 0.0327 328 VALVE 1RH1 CLOSED LIMIT SWITCH FAILS RHSLSWFT1RH2 1.00E04 0.0327 328 VALVE 1RH2 CLOSED LIMIT SWITCH FAILS CCSMOVCC11C16 1.58E03 0.0139 10 VALVE11CC16 FAILS TO OPEN CCSMOVCC12C16 1.58E03 0.0132 9

VALVE12CC16 FAILS TO OPEN CSSMOVCC1CS36 1.07E03 0.0052 6

MOV 11CS36 FAILS TO OPEN SWSAOVCC12223 2.06E03 0.0050 3

AOV 12SW223 FAILS TO OPEN SWSAOVCC14223 2.06E03 0.0050 3

AOV 14SW223 FAILS TO OPEN SWSAOVCC15223 2.06E03 0.0050 3

AOV 15SW223 FAILS TO OPEN CSSMOVCC2CS36 1.07E03 0.0048 5

MOV 12CS36 FAILS TO OPEN Of these components, the SWS MOVs are MSPI components and their failure data has been represented with Bayesian updated data. The HRS limit switches (LSW) are a component not normally quantified with plant specific data. The associated RHS and CCS MOVs are quantified using Bayesian updated data. Therefore, the two valves of concern are the containment spray system (CSS) MOVs. A review of Maintenance Rule records indicated that no CSS MOV failures have been experienced in the last 3 years. However, for the purposes of a sensitivity analysis, one could assume that the failure probability for these valves could be doubled, with a resulting value of 2.14E03.

Another check was performed during this sensitivity analysis. Basic events RHSLSW

FT1RH1 and RHSLSWFT1RH2, CCSMOVCC11C16 and CCSMOVCC12C16, CSSMOVCC1CS36 and CSSMOVCC2CS36, and multiple SWS AOVs from the table above do not appear together in cutsets. This further proves the aforementioned conclusion that the SOKC is not of significant importance with regard to this LAR. The results of this sensitivity case is presented in Table 57.

5.5.2 Sensitivity Case #2 Salems offsite power is backed up by an onsite gas turbine generator known as Salem Unit 3. Salem has experienced equipment reliability problems in the past with Salem Unit 3, and may consider in the future retiring this piece of equipment. Therefore, it was deemed prudent to perform a sensitivity case for this LAR in which Salem Unit 3 was

Salem Generating Station CFCU AOT Extension assumed to be unavailable. The results of this sensitivity case is presented in Table 5-

7.

5.5.3 Sensitivity Case #3 After the completion of Revision 0 of this analysis (SA-LAR-007), an updated PRA model was finalized in December 2016. This PRA model was known as the SA 115A PRA model, which incorporated the newly installed fourth AFW pump and use of FLEX equipment to help mitigate extended SBO scenarios.

Therefore, it was deemed appropriate to revise the original CFCU AOT extension analysis in order to accommodate a sensitivity analysis to review the results that would be experienced using the SA 115A PRA model. The same flag file that was documented in Section 3.4.3 was used for this sensitivity case.

5.5.4 Sensitivity Case Results The quantitative results for the three sensitivity cases discussed above are presented in Table 5-7, which show that the results remain well below the regulatory risk acceptance guidelines presented in Section 1.4.

TABLE 5-7 QUANTITATIVE RESULTS - SENSITIVITY CASES BASE SENSITIVITY CASE 1 :

SENSITIVITY CASE 2:

PARAMETER CASE BASIC EVENT DATA SALEM 3 IN VALU ES ADJUSTM ENT MAINTENANCE T CYCLE 547.5 days 547.5 days 547.5 days TcFcu 1 4 days 14 days 1 4 days CDFcFcu 1.62E-05 1.62E-05 1.83E-05 CDFsASE 1.55E-05 1.55E-05 1.55E-05 CDFAvE 1.55E-05 1.55E-05 1.57E-05

!1CDF 5.61 E-08 5.72E-08 2.21 E-07 ICCDPcFcu 2.80E-08 2.86E-08 1.1 0E-07 5.5.5 Sensitivity Cases Considered but Not Quantified SENSITIVITY CASE 3:

SA1 1 5A PRA MODEL 547.5 days 1 4 days 8.82E-06 8.38E-06 8.41 E-06 3.38E-08 1.69E-08 The major conservatisms that can be observed from the cutset review are as follows:

5-1 8 SA-LAR-00'7

Salem Generating Station CFCU AOT Extension The CCF event (VCS-FNR-FR-DF01 ) which models the loss of additional fan coolers is quantified very conservatively. The quantification approach models the emerging failure to run of both fan coolers. The underlying assumptions are those that are used in event and condition assessment in that no credit can be given for PSEG extent of condition activities and no credit given for observation of running fan coolers. In a realistic situation, PSEG would assess the possibility that the failure is threatening other fan coolers.

Since the CFCUs are not standby equipment, the operators could and would observe the running of the remaining 3 fan coolers, which would be required for normal containment cooling.

If an additional fan cooler should fail, the plant would be in a 6-hr shutdown LCO.

Operators would be immediately aware of any CFCU or support system failure through monitoring of control room indications.

Recovery from LOOP initiating events and consequential LOOPs are modeled in the PRA for station blackout scenarios, but not for LOOP scenarios.

The containment cooling function is generally not needed until late in accident scenarios, so additional modeling of power recovery options could reduce the risk increase.

Salem installed a 4th AFW pump that is diesel-electric driven and capable of feeding all steam generators for both units. The diesel is outdoors and the rest of the system is located in the Turbine Building. As expected, the PRA impact was that the pump reduced the failure likelihood of steam generator cooling by providing additional defense in depth. As previously stated, the new PRA model (SA1 1 5A) includes the 4th AFW pump and the new ELAP procedures associated with the Fukushima response. Based on a review of the cutsets for this LAR, the 4th AFW pump reduces the risk associated with flooding in the Auxiliary Building and ELAP had little effect on the CFCU risk. Therefore, a sensitivity analysis specifically focused on the ELAP procedure changes is not necessary.

Sensitivity cases were not quantified to address these issues because the issues cannot increase the risk or reduce the margin to acceptance guidelines. Since all risk measures calculated in support of this LAR (see Section 3.4.5) are significantly below the acceptance guidelines, no quantification was deemed necessary for these other identified issues.

5.6 SENSITIVITY ANALYSIS CONCLUSIONS As previously indicated, the uncertainty analysis addresses the three generally accepted forms of uncertainty: parameter, model, and completeness uncertainty. The conclusions from these assessments are as follows.

5-1 9

Salem Generating Station CFCU AOT Extension 5.6.1 Parameter Uncertainty The parameter uncertainty assessment indicated that the use of the point estimate results directly for this assessment is acceptable.

The SOKC does not have a significant effect on the quantitative results or insights from the risk calculations.

5.6.2 Model Uncertainty The model uncertainty assessment highlighted the following sources of uncertainty as being important to address with additional sensitivity studies or potential compensatory measures:

Maintenance configurations involving GSS, RHR, AFW and Salem 3.

A sensitivity study (Case #2) was performed to look at the potential risk increase as a result of Salem 3 maintenance. Other maintenance activities had a much lower impact than for the Salem 3 case and can be addressed with compensatory measures using existing work control practices e.g., OP-AA-1 08-1 1 6, PROTECTED EQUIPMENT PROGRAM [21 ].

5.6.3 Completeness Uncertainty The uncertainty associated with model completeness highlighted the following source of uncertainty as being important enough to address with an additional sensitivity study:

Possible impact of using plant specific data for certain events.

A sensitivity study (Case #1 ) was performed to look at the potential risk increase for expanding the use of plant-specific data. In addition, a peer review finding against the ASM E PRA Standard [1 ] Supporting Requirement DA-C2 was also addressed regarding the issue of plant-specific data for risk significant components (see Table 4-6). The evaluation of completeness uncertainty indicated that there was no significant impact found that would influence the results for this LAR assessment.

5-20 SA-LAR-007

Salem Generating Station CFCU AOT Extension 521 SALAR007 5.6.4 Sensitivity Study Results The results of these sensitivity studies indicated that although changes to the calculated CDF can be postulated, the results from the sensitivity cases were otherwise determined to be similar to the results found from using the Salem SA112B PRA model (see Section 3.4.5). Specifically, most of the change to CDF was caused by scenarios that involved a failure of containment sump recirculation following depletion of the RWST. None of the calculated risk metric results from the sensitivity cases would lead to exceeding the acceptance guidelines presented in Section 1.4, e.g., Regulatory Guide 1.177 limit of 1.0E06 for ICCDP and 1.0E07 for ICLERP for permanent changes.

Also, the results found in using the recently completed SA115A PRA MOR further corroborated the very small risk that would be experienced in implementing the proposed CFCU AOT extension.

6.0

SUMMARY

AND CONCLUSIONS Salem Generating Station CFCU AOT Extension Consistent with the NRC's approach to risk-informed regulation, PSEG has identified a particular Technical Specification requirement that is unduly restrictive in its nature and, if relaxed, has a minimal impact on the safety of the plant. This Technical Specification is the requirement for the Containment Fan Cooler Unit (CFCU) Allowed Outage Time (AOT) to be restricted to 7 days for either one or two CFCUs being inoperable. The proposed change was to increase the AOT for any one or two inoperable CFCUs to a total of 1 4 days.

This section summarizes the risk metrics requested by the NRC Regulatory Guides, provides the calculated results using the SA 1 1 28 Salem PRA model, and the conclusion of this assessment for the extended CFCU AOT analysis.

6.1 REGULATORY GUIDELINES As described earlier, the probabilistic risk assessment input to the decision making process has been defined in detail by the NRC in two Regulatory Guides, Regulatory Guides 1. 1 74 and 1.1 77.

The NRC has specified in Regulatory Guides the risk metrics that should be calculated to provide input into the decision making process. The risk metrics chosen by the NRC in their Regulatory Guides include the following:

The change in Core Damage Frequency (CDF) (Reg. Guide 1.1 74)

The change in Large Early Release Frequency (LERF) (Reg. Guide 1. 1 74)

The Incremental Conditional Core Damage Probability (ICCDP) (Reg. Guide 1.1 77)

The Incremental Conditional Large Early Release Probability (ICLERP) (Reg.

Guide 1.1 77)

These risk metrics were all calculated using the SA 1 1 28 PRA model (see Section 4.1.5), which was developed as an application specific model to more accurately assess the incremental increase in risk for this extended AOT analysis by eliminating some cutsets that were found to not lead to core damage due to being long-term and slowly developing scenarios that would not require containment cooling, either by the 6-1 SA-LAR-007

Salem Generating Station CFCU AOT Extension Containment Spray (CS) System or C FCUs. A MAAP 4.0.6 sensitivity analysis was performed to confirm that this type of accident sequence did not require successful containment cooling either via CS or CFCUs.

Quantitative guidelines are defined by the NRC in RG 1. 1 74 [1 ] and 1. 1 77 [2] for what is an acceptably small change in risk:

The Salem calculated ICCDP and ICLERP for the CFCU AOT extension are sufficiently below the guidelines of <1.0E-06 and <1.0E-07, respectively, to be able to call the risk change small. Hence, the guidelines of Reg. Guide 1. 1 77 for the increased CFCU AOT Time have been met.

See Table 3-1 for the quantitative results.

Furthermore, the evaluation of changes in CDF and LERF due to the CFCU AOT extension have been shown to be an order of magnitude below the displayed area for Region Ill as depicted in Regulatory Guide 1.1 74. See the Executive Summary for graphical depiction and Table 3-1 for numerical results.

These calculations support the increase in the CFCU AOT from a quantitative risk informed perspective.

6.2 PRA MODEL The quantitative evaluation of the risk metrics for this application was performed using the SA 1 1 2B Salem PRA Application Specific Model (see Sections 3.4.3 and 4.1.5).

This included the following changes to the SA 1 1 2A PRA Model of Record :

A change to the common cause term for multiple failure of three of more CFCUs was made to account for the identified failure of two CFCUs. The common cause basic event VCS-FNR-FR-DF01 in the MOR was changed from its nominal failure probability of 6.48E-06 to 8.22E-01 using the "RaspCCF" calculational methodology for staggered testing employed in the SAPHIRE PRA software program [22].

A change was made to eliminate certain accident sequences from the cutset resu lts that would not necessarily lead to core damage.

Specifically, these cutsets involved long-term and slowly developing scenarios that would not require containment cooling, either by the Containment Spray (CS) System or Containment Fan Cooler Units (CFCUs).

A MAAP 4.0.6 sensitivity analysis showed that this type of accident sequence did not require successful containment cooling either via CS or CFCUs in order to avert core damage.

In addition, the recent update in December 201 6 of the PRA MOR, which is known as the SA 1 1 5A PRA model, was used to perform an additional sensitivity analysis that 6-2 SA-LAR-007

Salem Generating Station CFCU AOT Extension 63 SALAR007 showed that the incremental risk was actually smaller than that calculated using the SA112B PRA model (see Section 5.5.4).

6.3 QUANTITATIVE PRA RESULTS: REGULATORY GUIDE 1.177 AND 1.174 This subsection includes the quantitative PRA results using the SA112B Salem PRA model as described in risk application SAMISC016, Application Specific Model for CFCU LAR.

The calculated results using the SA112B PRA model are shown in Table 61. The results in Table 61 are compared with the acceptance guidelines that are specified by the NRC in Regulatory Guide 1.174 [1] and Regulatory Guide 1.177 [2]. The comparison of the CDF and LERF risk metrics with Regulatory Guide 1.174 guidelines are graphically depicted in Figures 61 and 62, respectively.

These results provide a good indication that the risk associated with this proposed extension of the CFCU AOT is very small. These results are also reinforced by the Tier 2 and Tier 3 assessments. The Tier 2 assessment was addressed as part of the sensitivity cases investigated in Section 5.5, in which other equipment other than the CFCUs is investigated for relative importance. The Tier 3 assessment, which involves adherence to existing work control practices as part of the Salem Configuration Risk Management Program (CRMP), was addressed in Section 3.3.

6.4 EXTERNAL HAZARDS CONSIDERATIONS The evaluation of risk due to fire and seismic events was based on insights gleaned from the IPEEE. Within this analysis, Section 3.4.7 addresses fire risk and Section 3.4.8 discusses seismic risk. For this particular CFCU AOT extension, there was no perceived increase in risk due to either of these external hazards.

With regard to fire hazards, since the CFCUs and their support systems do not show a high dependence on the results of the fire model, it was qualitatively inferred in Section 3.4.7 that the risk increase would be negligible due to extending the AOT for two CFCUs up to a period of 14 days. This qualitative insight was based on the fact that the unavailability of CFCUs does not have a high impact on the ability to mitigate any of the

Salem Generating Station CFCU AOT Extension 64 SALAR007 dominant fire risk contributors. As such, the WorkinProgress Fire PRA model did not reveal any perceived risk increase for this CFCU AOT extension.

With regard to seismic hazards, a review of the dominant cutsets related to extending the AOT for CFCUs did appear to have contributions stemming from LOOP scenarios, but it was the lack of adequate containment heat removal due to loss of CFCUs that prevented successful sump recirculation, which would be subsumed by Station Blackout (SBO) scenarios due to the fact that a loss of all AC power would prevent operation of the Emergency Core Cooling System (ECCS) pumps, i.e., RHR pumps. As such, it can qualitatively be inferred that there would be no significant impact on seismic risk due to extending the AOT for two CFCUs up to a period of 14 days.

Other external hazards were screened as being insignificant, as documented in Section 1.4.3 of the Salem IPEEE [10], and as such, were not deemed applicable to this analysis for the CFCU AOT extension.

6.5 UNCERTAINTIES In addition to the assessment of the mean risk metrics which are specified in Regulatory Guides 1.174 and 1.177 for comparison with the acceptance guidelines, it is also prudent to examine whether modeling uncertainties may distort these comparisons.

Therefore, an extensive review of various uncertainties that may impact the risk metrics was performed. To this end, NUREG1855 and the companion EPRI guideline (EPRI 1026511) were utilized for the treatment of uncertainties pertaining to parametric, modeling, and completeness issues.

Section 5 provides an analysis and discussion of the results, which concluded that there are no outstanding uncertainty issues that would tend to challenge the numerical results calculated using the SA112B PRA model.

6.6 CONCLUSION

The risk change calculated with the SA112B Salem PRA model for the proposed CFCU AOT extension is considered to be very small.

Salem Generating Station CFCU AOT Extension The ICCDP and ICLERP for dual CFCU unavailability are sufficiently below the guidelines of <1.0E-06 and <1.0E-07, respectively, to be able to call the risk change small.

Hence, the guidelines of Reg. Guide 1.1 77 for the increased EDG Allowed Outage Time have been met.

Furthermore, the calculated of changes in CDF and LERF due to the CFCU AOT extension have been shown to meet the risk significance criteria of Regulatory Guide 1.1 74 with substantial margin, i.e., Region Ill which represents "very small risk changes." Table 6-1 provides a listing of the numerical results, with Figures 6-1 and 6-2 showing a graphical depiction of the L1CDF and L1LERF results.

These calculations support the increase in the CFCU AOT extension from a quantitative risk-informed perspective, which includes following established PSEG maintenance practices as discussed in Section 3.3.

TABLE 6-1 RESULTS OF RISK EVALUATION FOR SALEM RISK METRIC RISK M ETRIC RESULTS 11CDF(/yr) 5.61 E-08 11LERF(/yr) 2.1 5E-1 0 ICCDPcFcu 2.80E-08 ICLERPcFcu 1.08E-1 0 Table Note:

1.

Region Ill of RG 1. 1 74 -- very small risk changes.

6-5 SA-LAR-007

t LL.

0 (J

10"'6 FIGURE 6-1 Salem Generating Station CFCU AOT Extension CDF ACCEPTANCE GUIDELINES FOR CORE DAMAGE FREQUENCY (CDF)

LEAF FIGURE 6-2 ACCEPTANCE GUIDELINES FOR LARGE EARLY RELEASE FREQUENCY (LERF) 6-6 SA-LAR-007

Salem Generating Station CFCU AOT Extension 71 SALAR007

7.0 REFERENCES

[1]

Regulatory Guide 1.174: An Approach for Using Probabilistic Risk Assessment in RiskInformed Decisions on PlantSpecific Changes to the Licensing Basis, USNRC, Revision 2, May 2011.

[2]

Regulatory Guide 1.177: An Approach for PlantSpecific, RiskInformed Decision

Making: Technical Specifications, USNRC, Revision 1, May 2011.

[3]

Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk Informed Activities, Revision 2, March 2009.

[4]

American Society of Mechanical Engineers, Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, (ASME RAS2002), Addenda RASb2005, December 2005.

[5]

Salem Generating Station, Mitigating System Performance Index Basis Document, SCMSPI001, Revision 11, January 2016.

[6]

Salem Generating Station, Quantification Notebook, SAPRA014, Revision 0, September 2014.

[7]

Westinghouse, RG 1.200 PRA Peer Review Against the ASME PRA Standard Requirements for the Salem Generating Station, Units 1 and 2 PRA, LTRRAM

II09001, June 2009.

[8]

PSEG, Salem Generating Station Individual Plant Examination, July 1993.

[9]

Individual Plant Examination for Severe Accident Vulnerabilities10 CFR 50.54(f), Generic Letter 8820, November 23, 1988.

[10] PSEG, Salem Generating Station Individual Plant Examination of External Events, January 1996.

[11]

American Society of Mechanical Engineers, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addenda to ASME/ANS RAS2008 (ASME/ANS RASa2009),

February 2009.

[12]

NRC Generic Letter 8820, Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities 10 CFR 50.54(f), Supplement 4, June 28, 1991.

[13]

NUREG1407, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities, June 1991.

[14]

Professional Loss Control, Inc., FireInduced Vulnerability Evaluation (FIVE)

Methodology Plant Screening Guide, EPRI TR100370, Electric Power Research Institute, April 1992.

[15]

Public Service Electric and Gas, Salem Fire Protection Report - Safe Shutdown Analysis, DEPS.ZZ0001(Q), Rev. 1, 1991.

[16]

Public Service Electric and Gas, Salem Fire Protection Report - Fire Hazards Analysis, DEPS.ZZ001(Q)A2FHA, Rev. 4, 1993.

Salem Generating Station CFCU AOT Extension 72 SALAR007

[17]

Public Service Electric and Gas, Action Request for Reducing Potential Risk to Cables Routed Through the Turbine and Service Buildings Which Supply Offsite Power to the 4kV Vital Buses, 1995.

[18]

U.S. Nuclear Regulatory Commission, Standard Review Plan for Review of Safety Analysis Report for Nuclear Power Plants, NUREG75/187, December 1975.

[19]

Public Service Electric and Gas, Hope Creek Generating Station Updated Safety Analysis Report, Sections 2 and 3, Latest Revision.

[20]

Public Service Electric and Gas, Salem Generating Station Updated Safety Analysis Report, Sections 2 and 3, Latest Revision.

[21]

Public Service Electric and Gas, Protected Equipment Program, OPAA108116, Revision 12.

[22]

U.S. Nuclear Regulatory Commission, SAPHIRE, Version 8.1.4, 2010 Update to the Parameter Estimation Component Reliability Data Sheets, Section 9.4, Build Date: 05/14/2012.

[23]

Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, EPRI Report 1016737, Palo Alto, CA, December 2008.

[24]

U.S. Nuclear Regulatory Commission, Guidance on the Treatment of Uncertainties Associated with PRAs in RiskInformed Decisionmaking, NUREG

1855, Revision 1, (Version to be issued) ML15026A512.

[25]

Practical Guidance on the Use of Probabilistic Risk Assessment in RiskInformed Applications with a Focus on the Treatment of Uncertainty, EPRI Report 1026511, Palo Alto, CA December 2012.

[26]

Public Service Electric and Gas, FPIE PRA Model Update, ERAA6001015, Revision 8.

[27]

NEI 0504, Revision 1 (Draft), Process for Performing FollowOn PRA Peer Reviews Using the ASME PRA Standard (Internal Events), Nuclear Energy Institute, November 2007.

[28]

NRC Order Number EA12049, Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for BeyondDesignBasis External Events, March 12, 2012.

[29]

PSEG Nuclear, PSEG Nuclear LLCs Overall Integrated Plan for the Salem Generating Station in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond

DesignBasis External Events (Order Number EA12049), LRN130034, February 28, 2013.

[30]

Nuclear Energy Institute (NEI) 1206, Diverse and Flexible Coping Strategies (FLEX) Implementation Guide, Rev. 0, August 2012.

v t e Letter Sequence Request
CAC:MF9364, (Approved, Closed)
Initiation Request Acceptance, Acceptance Supplement Administration Questions 31 July 2017 Answers 14 September 2017 Results Approval Other:
MONTHYEAR2017-05-04 [Table View]

LR-N16-0173, License Amendment Request: Containment Fan Cooler Unit (Cfcu) Allowed Outage Time (AOT) Extension

Text

Subject:

Enclosure:

1.0 DESCRIPTION

2.0 PROPOSED CHANGE

3.0 BACKGROUND

4.0 TECHNICAL ANALYSIS

5.0 REGULATORY ANALYSIS

6.0 ENVIRONMENTAL CONSIDERATION

7.0 REFERENCES

1.0 DESCRIPTION

2.0 PROPOSED CHANGE

3.0 BACKGROUND

4.0 TECHNICAL ANALYSIS

5.0 REGULATORY ANALYSIS

6.0 ENVIRONMENTAL CONSIDERATION

7.0 REFERENCES

SUMMARY

SUMMARY

1.0 INTRODUCTION

SUMMARY

7.0 REFERENCES

SUMMARY

1.2 BACKGROUND

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY