Text

License Amendment Request: Containment Fan Cooler Unit (Cfcu) Allowed Outage Time (AOT) Extension
	ML17065A241
Person / Time
Site:	Salem
Issue date:	03/06/2017
From:	Mcfeaters C; Public Service Enterprise Group
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	LAR S16-04, LR-N16-0173
	Download: ML17065A241 (150)
	v • d • e

PSEG Nuclear LLC P.O. Box 236, Hancocks Bridge, NJ 08038-0236 10 CFR 50.90 LR-N16-0173 LAR S16-04 MAR 0 6 2017 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D.C. 20555-0001 Salem Nuclear Generating Station Units 1 and 2 Renewed Facility Operating License Nos. DPR-70 and DPR-75 NRC Docket Nos. 50-272 and 50-311

Subject:

License Amendment Request: Salem Containment Fan Cooler Unit (CFCU) Allowed Outage Time (AOT) Extension In accordance with 10 CFR 50.90, PSEG Nuclear LLC (PSEG) hereby requests an amendment to Renewed Facility Operating License Nos. DPR-70 and DPR-75 for Salem Nuclear Generating Station Units 1 and 2. In accordance with 10 CFR 50.91(b)(1), a copy of this request for amendment has been sent to the State of New Jersey.

This license amendment request proposes changes to Technical Specification (TS) 3.6.2.3, "Containment Cooling System." The proposed change would increase the containment fan coil unit (CFCU) allowed outage time (AOT) from 7 days to 14 days for one or two inoperable CFCUs. The proposed extended AOT is based on application of the Salem Generating Station (SGS) Probabilistic Risk Assessment (PRA) in support of a risk-informed extension, and on additional considerations and compensatory actions. The risk evaluation and deterministic engineering analysis supporting the proposed change have been developed in accordance with the guidelines established in NRC Regulatory Guide 1.177, "An Approach for Plant-Specific Risk-Informed Decisionmaking: Technical Specifications," and NRC Regulatory Guide 1.174, "An Approach for using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant Specific Changes to the Licensing Basis."

The proposed change will allow increased flexibility in the scheduling and performance of corrective and preventive maintenance, improve CFCU reliability, allow better control and allocation of resources and avert unplanned plant shutdowns.

MAR 0 6 2017 10 CFR 50.90 Page 2 LR-N16-0173 PSEG's technical and regulatory evaluation of this LAR and the TS changes are provided in Attachments 1 and 2 respectively. Enclosure 1 provides the supporting risk-informed evaluation of the proposed change, including an evaluation of the technical adequacy of the PRA in accordance with Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk Informed Activities."

The proposed change has been evaluated in accordance with 10 CFR 50.91(a)(1), using the criteria in 10 CFR 50.92(c), and it has been determined that this request involves no significant hazards considerations.

There are no regulatory commitments contained in this letter.

These proposed changes have been reviewed by the Plant Operations Review Committee.

PSEG requests NRC approval of the proposed License Amendment within one year of submittal to be implemented within 60 days of issuance.

If you have any questions or require additional information, please contact Mr. Lee Marabella at (856) 339-1208.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on ----3,_*-' ..L../-=-C ---'/--'-I__f_? __ _

(Date)

Respectfully

/'

1. ---- -*-

[/r Charles V. McFeaters Site Vice President Salem Generating Station Attachments:

1. Request for Changes to Technical Specifications

2. Technical Specification Pages with Proposed Changes

Enclosure:

1. Salem PRA Analysis for CFCU AOT Extension

MAR 0 2017 10 CFR 50.90 Page 3 LR-N16-0173 C. Administrator, Region I, NRC Project Manager, NRC NRC Senior Resident Inspector, Salem Mr. P. Mulligan, Chief, NJBNE Mr. L. Marabella, Corporate Commitment Tracking Coordinator Mr. T. Cachaza, Salem Commitment Tracking Coordinator

LR-N16-0173 Attachment 1 Request for Changes to Technical Specifications

LR-N16-0173 LAR S16-04 SALEM NUCLEAR GENERATING STATION RENEWED FACILITY OPERATING LICENSE NOS. DPR-70 AND DPR-75 DOCKET NO. 50-272 AND 50-311 License Amendment Request : Salem Containment Fan Cooling Unit (CFCU) Allowed Outage Time (AOT) Extension Table of Contents

1.0 DESCRIPTION

.2

2.0 PROPOSED CHANGE

2

3.0 BACKGROUND

....2

4.0 TECHNICAL ANALYSIS

.....7

5.0 REGULATORY ANALYSIS

...14 5.1 No Significant Hazards Consideration.....14 5.2 Applicable Regulatory Requirements and Criteria............16

6.0 ENVIRONMENTAL CONSIDERATION

17

7.0 REFERENCES

.17 Page 1

LR-N16-0173 LAR S16-04

1.0 DESCRIPTION

This license amendment request proposes a change which would revise Salem Units 1 and 2 Technical Specification (Reference 1) (TS) ACTION 3.6.2.3.a and ACTION 3.6.2.3.b concerning one or two inoperable containment cooling fans. The proposed change would increase the Containment Fan Cooling Unit (CFCU) allowed outage time (AOT) from 7 days to 14 days for one or two inoperable CFCUs. The proposed change is based on application of the Salem Generating Station (SGS) Probabilistic Risk Assessment (PRA) in support of a risk-informed extension, and on additional considerations and compensatory actions.

In addition, a minor typographical error is being corrected in TS ACTION 3.6.2.3.b changing the undefined word WITHIN to lower case within.

2.0 PROPOSED CHANGE

The proposed TS changes (Unit 1 and 2 changes are identical) are described below and are indicated on the marked up TS pages provided in Attachment 2 of this submittal.

1. TS 3.6.2.3 ACTION a is being revised as shown below:

With one or two of the above required containment cooling fans inoperable, restore the inoperable fan(s) to OPERABLE status within 7 14 days or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

2. TS 3.6.2.3 ACTION b is being revised as shown below:

With three or more of the above required containment cooling fans inoperable, restore at least three cooling fans to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or be in at least HOT STANDBY WITHIN within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

Restore the remaining inoperable cooling fans to OPERABLE status within 7 14 days of initial loss or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

3.0 BACKGROUND

3.1 Containment Fan Cooling System Containment cooling is an engineered safeguard system. CFCUs, along with Containment Spray, provide the design containment cooling function and depressurization during design basis loss of coolant accident (LOCA) and main steam line break (MSLB) conditions.

Furthermore, the CFCUs provide mixing of the containment atmosphere, which supports the iodine removal function of the containment spray system. During a LOCA (slow speed operation), the CFCUs draw the containment atmosphere through the moisture separators, HEPA filters, cooling coil, fan and ductwork.

Page 2

LR-N16-0173 LAR S16-04 The containment fan cooling system is designed to remove heat from the containment during normal operation, and remove heat and reduce pressure in the containment following a Loss of Coolant Accident (LOCA). The system consists of five air handling units, each including motor, fan, motor heat exchanger, cooling coils, roughing filters, dampers, duct distribution system, instrumentation, and controls. The CFCUs are powered from three separate vital buses as follows: one CFCU is powered from the A vital bus and two CFCUs are powered from each of the B and C vital buses. This ensures that, in the event of a single failure of a vital bus, the minimum number of three CFCUs required to maintain containment integrity would remain available during a design basis event.

Each fan is designed to supply a nominal 110,000 cubic feet per minute (cfm) during normal (high speed) operation and 40,000 cfm during accident (low speed) operation. The fans are direct driven, centrifugal type, and the coils are plate fin and tube type. Each fan-cooler unit is capable, taking into consideration tube fouling, of removing at least 44 x 106 Btu/hr or a cumulative heat transfer rate of 132 x 106 Btu/hr. for three fan-cooler units from the containment atmosphere under accident conditions. This heat transfer rate exceeds the analyzed value assumed in the analysis of containment pressure response to a spectrum of Reactor Coolant System (RCS) and steam line breaks described in the Salem Updated Final Safety Analysis Report. A minimum of 1,300 gpm of service (cooling) water is supplied to each unit during accident conditions. The design maximum river water inlet temperature is 90°F.

The containment fan cooling system is designed to maintain the containment atmosphere at less than or equal to 120°F during normal operation. In the event of a LOCA the system is designed to ensure that the containment pressure will not exceed its design value of 47 psig at 271°F (100-percent relative humidity). Although the water in the core after a LOCA is quickly subcooled by the Emergency Core Cooling System (ECCS), the containment fan cooling system is designed on the conservative assumption that the core residual heat is released to the containment as steam. The system is actuated (in the post-accident mode) by a safety injection signal. The fan cooler units continue to remove heat after the LOCA and reduce the containment pressure close to atmospheric within the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Duct work distributes the cooled air to the various containment compartments and areas.

During normal operation, the flow sequence through each air handling unit is as follows: inlet dampers, roughing filters, cooling coils, fan, discharge header. During post-accident operation, air is drawn through a moisture separator, a post-accident high-efficiency particulate air (HEPA) filter section and cooling coils and is discharged to the duct header.

3.2 Service Water System Cooling to the CFCUs is provided by the service water (SW) system. The SW system consists of six vertical turbine-type pumps, two per each of the three vital buses. In the event of a Loss of Offsite Power (LOOP), the SW pumps stop, and are sequenced back on via the Safeguards Equipment Controller (SEC) logic. Two 15,000 gallon pressurized accumulators (10,000 gallon normal water volume) are connected to the CFCU supply headers. These normally-isolated tanks are designed to be rapidly placed in service through fast opening isolation valves in order to keep the CFCU SW piping solid following a LOCA or MSLB concurrent with a LOOP event prior to the restart of the SW pumps.

Emergency diesel generators (EDGs) are provided to power one pump per bus (three pumps total) during a failure of normal power supply. A single failure of an EDG or vital bus results in Page 3

LR-N16-0173 LAR S16-04 two operating SW pumps, which is the minimum safeguards requirement. The CFCUs are supplied by individual lines from the containment SW header. Each inlet and discharge line penetrating the containment wall is provided with a remotely-operated isolation valve. This provision allows each fan cooler to be isolated on an individual basis from outside the containment area.

The following table provides a summary the main components described above with a brief description of how each component functions during normal operation and during the design basis accident.

Component Normal Normal Accident Accident Operating Operating Function Arrangement Function Arrangement (Minimum Safeguards)

CFCUs (5) Circulate and Up to four fan Circulate, Three fan units in cool containment units in service depressurize and service atmosphere cool containment atmosphere SW Pumps (6) Supply river Two to four Supply river Two pumps in water to CFCUs pumps in service water to CFCUs service depending on river temperature Seasonal CFCU and SW Systems normal operating configurations typically range between four CFCUs and four SW pumps in service during summer months and three CFCUs and two SW pumps during winter months. During environmental conditions (peak summer heat) when three CFCUs could be insufficient to maintain containment temperature less than 120 degrees F, CFCU maintenance is not normally scheduled to ensure TS 3.6.1.5 containment temperature limits for continued operation will be maintained. This applies for both the existing TS AOT of 7 days and the proposed AOT of 14 days.

The following table shows the normal power supplies for both the SW Pumps and the CFCUs:

Vital Bus Power Component Supply Component Vital Bus Power Supply 11 SW Pump 1C 11 CFCU 1A 12 SW Pump 1C 12 CFCU 1B 13 SW Pump 1B 13 CFCU 1C 14 SW Pump 1B 14 CFCU 1B 15 SW Pump 1A 15 CFCU 1C 16 SW Pump 1A 21 CFCU 2A 21 SW Pump 2A 22 CFCU 2B 22 SW Pump 2A 23 SW Pump 2B 23 CFCU 2C 24 SW Pump 2B 24 CFCU 2B 25 SW Pump 2C 25 CFCU 2C 26 SW Pump 2C Page 4

LR-N16-0173 LAR S16-04 3.3 Maintenance Rule Program The Maintenance Rule (MR) requires that an evaluation be performed when equipment covered by the MR does not meet its performance criteria. The reliability and availability of the CFCUs are monitored under the MR program. If the pre-established reliability or availability performance criteria are not achieved for the CFCUs, they are considered for 10 CFR 50.65(a)(1) actions. These actions would require increased management attention and goal setting in order to restore their performance to an acceptable level. The actual out of service time for the CFCUs is minimized to ensure that the reliability and availability performance criteria are met.

The current Salem MR status is green (minimal risk - no actions required) for all ten Unit 1 and Unit 2 CFCUs, with the 18-month rolling average unavailability as of 09/21/2016 for each CFCU as shown below. The demarcation limit between green and yellow (medium risk - consider/take appropriate compensatory actions) status is 850 unavailability hours (18-month rolling average).

CFCU Unavailability (hours) 11 159.41 12 185.41 13 264.00 14 120.87 15 86.93 21 174.56 22 249.70 23 96.02 24 241.84 25 250.85 The CFCU MR status is not expected to be adversely impacted by the proposed amendment.

3.4 Configuration Risk Management Program (CRMP)

Risk associated with unavailable plant equipment such as CFCUs is assessed at Salem as required by 10 CFR 50.65(a)(4). The PSEG work management administrative procedure governs on-line risk assessments. The on-line risk assessment is a blended approach using qualitative or defense-in-depth considerations and quantifiable PRA risk insights when available to complement the qualitative assessment. Salem communicates on-line plant risk using three risk tiers (GREEN, YELLOW, and RED). The criteria for these tiers are as follows:

Page 5

LR-N16-0173 LAR S16-04 Configuration Risk Management Criteria Color Risk Threshold(5) Required Action (1)

ICDP <1E-6 for 7 day duration No specific actions are required.

AND Green No LOOP High Risk Evolution (HRE)

AND (2)

ILERP <1E-7 for 7 day duration (1) Limit the unavailability time by establishing a ICDP >1E-6 AND <1E-5 for 7 day duration continuous work schedule or provide justification.

OR Protect SSCs which would cause an unplanned Yellow LOOP High Risk Evolution (HRE) entry into a Red risk condition if lost concurrent with OR other SSCs being unavailable for maintenance.

(2)

ILERP >1E-7 AND <1E-6 for 7 day duration It is unacceptable to voluntarily enter this condition.

(1)

ICDP >1E-5 for 7 day duration IF an emergent condition causes, or degradation Red OR may cause an unplanned entry into this condition, (2) immediate actions shall be taken to restore and/or ILERP >1E-6 for 7 day duration protect SSCs relied upon to mitigate events, and to contact the station duty manager for direction and support.

(1)

Incremental Core Damage Probability (2)

Incremental Large Early Release Probability The on-line risk level for both Salem units will remain GREEN when two CFCUs are unavailable. At this level, risk is considered close to baseline, and compliance with technical specification requirements may be considered adequate risk management. Nevertheless, the station protected equipment program requires protection of the remaining CFCUs and one of the two containment spray (CS) pumps. The program also requires protection of emergency diesel generators (EDGs) that supply emergency power to the remaining CFCUs. Protecting equipment requires posting of signs and robust barriers to alert personnel not to approach the protected equipment. Work on protected equipment is generally disallowed. Minor exceptions exist for activities such as inspections, security patrols, or emergency operations. Other exceptions may be authorized by the station shift manager in writing. If additional unplanned equipment unavailability occurs, station procedures direct that the risk be re-evaluated, and if found to be unacceptable, compensatory actions are taken until such a time that the risk is reduced to an acceptable level.

Page 6

LR-N16-0173 LAR S16-04 3.5 Current TS Requirements and Limitations The LIMITING CONDITION FOR OPERATION (LCO) for TS 3.6.2.3 requires five containment cooling fans to be OPERABLE to ensure that adequate heat removal capacity is available when operated in conjunction with the containment spray systems during post LOCA and MSLB conditions. As described in Salem UFSAR (Reference 2) section 6.2.2, "Containment Heat Removal Systems," a minimum of three containment fan coil units in operation with a single containment spray train is capable of maintaining post-accident containment temperature and pressure below their design basis values, assuming a worst-case single active failure.

The TS ACTION statement a currently requires restoration of one or two containment cooling fans found to be inoperable within 7 days or the plant to be in HOT STANDBY (MODE 3) within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN (MODE 5) within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

The TS ACTION statement b applies when 3 or more containment cooling fans are inoperable and requires the restoration of at least three cooling fans to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or the plant to be in at least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . It also currently requires restoration of all remaining inoperable containment cooling fans to OPERABLE status within 7 days of initial loss or the plant to be in HOT STANDBY (MODE 3) within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . Extension of the AOT from 7 to 14 days will allow more time to perform maintenance to avoid shutdown.

3.6 Operating Experience There have been nine emergent corrective maintenance orders over the time interval of September 2014 through January 2016 that were required to be completed which invoked TS Action Statement (TSAS) 3.6.2.3. One such order involved the 14 CFCU which was declared inoperable in March 2015 and resulted in a plant shutdown following the 7 day AOT period.

Two of the orders, involving a 24 CFCU motor cooler leak and a SW valve associated with the 25 CFCU failed stroke time, resulted in being in the TSAS for approximately 5 days. There is minimal work scope on the SW side of the CFCUs that is considered planned maintenance that invokes the entry into this TSAS. PSEG does not normally schedule any planned maintenance that would exceed 50% of the LCO AOT window. Some of the emergent work that invokes entry into this TSAS includes emergent work orders on the containment isolation air operated valves, CFCU motor cooler inspections following gasket leaks, and issues with the fast acting air operated valves for the SW accumulators. Due to the short LCO window, these emergent issues result in a major challenge to the work week process and require critical resources to be re-aligned to correct the emergent issue and clear the short duration LCO.

4.0 TECHNICAL ANALYSIS

This section provides the technical analysis of the proposed changes with regard to the principles that adequate defense-in-depth is maintained, sufficient safety margins are maintained, and the calculated increases in core damage frequency (CDF) and large early release frequency (LERF) are small and consistent with the guidance of RG 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Bases," dated May 2011 and RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," dated May 2011.

Page 7

LR-N16-0173 LAR S16-04 4.1 Current Licensing Basis for Containment Cooling Fans Allowed Outage Time Under the current TS, if one or two containment cooling fans are inoperable in MODES 1, 2, 3 or 4, action is taken to restore the inoperable cooling fans to operable status within 7 days. In this Condition, the three remaining operable cooling fans are adequate to provide the minimum containment cooling as assumed by the containment response analysis for a design-basis LOCA or MSLB event.

4.2 Proposed TS 3.6.2.3 Change and Benefits The proposed change will allow, for one or two CFCUs, an AOT of 14 days for maintenance activities. This will permit an additional 7 days beyond the current TS allowed AOT of 7 days and avoid or minimize TS required plant shutdowns due to CFCU maintenance or testing.

Implementation of this proposed AOT extension will provide the following benefits:

Allow increased flexibility in the scheduling and performance of preventive maintenance.

Allow better control and allocation of resources.

Avert unplanned plant shutdowns. Risks incurred by unexpected plant shutdowns can be comparable to and often exceed those associated with continued power operation.

The proposed Allowed Outage Time of 14 days supports maintenance that would involve the simultaneous unavailability of up to two CFCUs. While PSEG would normally take one CFCU at a time out of service, the TS allowance for two CFCUs out of service provides needed operational flexibility. One such example would be if a major maintenance activity were to be scheduled for a CFCU and a leak was discovered during an inspection of another CFCU.

Another example would be if one of the two SW accumulators were to be isolated for maintenance, which would make two CFCUs inoperable (either the 11(21) and 12(22) pair, or the 14(24) and 15(25) pair, depending on the SW accumulator removed from service).

A historical review of CFCU preventative and corrective maintenance shows that the longest duration maintenance outages are due to SW control valves and CFCU motor replacements.

Durations for scheduled preventative maintenance typically result in a CFCU unavailability window of approximately 10 to 50 hours5.787037e-4 days 0.0139 hours 8.267196e-5 weeks 1.9025e-5 months . With regard to emergent corrective maintenance, the CFCU unavailability has ranged from approximately 50 to 200 hours0.00231 days 0.0556 hours 3.306878e-4 weeks 7.61e-5 months in duration.

This change will allow some maintenance activities to be performed on-line which would otherwise require performance during a refueling outage, such as replacement of SW system valves associated with the CFCUs. On-line preventive maintenance and scheduled major repairs or replacements provide the flexibility to focus more quality resources on any corrective or elective CFCU maintenance. For example, during refueling outages, resources are required to support many system outages; while, during on-line maintenance, plant resources are focused on the CFCU repair.

4.3 Deterministic Assessment of Proposed CFCU AOT Extension The proposed change would allow continued power operation up to an additional 7 days while CFCU maintenance or testing is performed. The CFCU arrangement of five fan units, of which Page 8

LR-N16-0173 LAR S16-04 only three are required, provides adequate cooling capacity during design basis events (LOCA/MLSB) to maintain containment pressure and temperature below design basis limits.

The assumptions and the results of the containment pressure response analyses are not changed by an extension of the AOT. In addition, the effectiveness of maintenance on the CFCUs and support systems is monitored pursuant to the Maintenance Rule. Conservatisms include:

Actual CFCU heat removal capacity at the peak containment temperature of 265.9 degrees F (44 MBtu/hr) (Reference 6) exceeds the assumed containment analysis heat removal (36.44 MBtu/hr.)

Actual SW flow during accident conditions (1630 gpm in limiting SW accident alignment) is greater than the assumed value of 1300 gpm Assumed SW temperature in the Containment Response Analysis (93 degrees F for determining CFCU heat removal capacity; 95 degrees F as input to the Component Cooling Heat Exchangers) is greater than the design value of 90 degrees F.

Based on the above discussion, extending the AOT for one or two inoperable CFCUs from 7 days to 14 days is acceptable because the proposed change will not impact the plant design basis. The impact of extended plant operation with less than the installed equipment redundancy is evaluated in a probabilistic framework in the discussions that follow.

To ensure that the single failure design criterion is met, Limiting Conditions for Operation (LCOs) are specified in the plant TS requiring all 5 CFCUs to be operable. In the event that one or two CFCUs are inoperable in operating Modes 1, 2, 3 and 4 existing TS 3.6.2.3 ACTION a and ACTION b require the inoperable cooling fan(s) to be restored to OPERABLE status. When the required operability is not maintained, action is required within a specified time period to initiate a plant shutdown and place the plant in a safe condition. The AOT provides a limited time to restore equipment to operable status and represents a balance between the risk associated with continued plant operation with less than the required system or component redundancy and the risk associated with initiating a plant transient while transitioning the unit.

Thus, while the AOTs provided in the plant TS are designed to permit limited operation with temporary relaxation of the single failure criterion, the acceptability of the maximum length of the AOT interval relative to the potential occurrences of design basis events needs to be considered. Since extending the AOT for one or two inoperable CFCUs does not change the design basis of the Containment Cooling System to recirculate and cool the containment atmosphere in the event of a LOCA/MSLB and thereby ensures that the containment pressure will not exceed its design value of 47 psig at 271 degrees F, the risk impact of CFCU unavailability during the extended AOT interval (days 8 through 14 of the proposed 14 day AOT) must be evaluated quantitatively using a probabilistic approach.

If this LAR is not granted, a condition where one or two CFCUs are inoperable would require a plant shutdown following 7 days in current TS 3.6.2.3 ACTION a and ACTION b. Shutdown of the plant involves many plant operator activities and plant evolutions. These activities and evolutions provide challenges to plant equipment, opportunities for operator errors and increase the possibility of a plant trip. By granting this LAR and allowing continued steady state operation, additional operator activities and plant operations evolutions associated with plant shutdown would be avoided. The increased possibility for plant trip may also be avoided. This LAR proposes an additional 7 days as a reasonable time for AOT extension.

Page 9

LR-N16-0173 LAR S16-04 4.4 Risk Assessment Plant configuration changes for required maintenance of the CFCUs as well as the maintenance of any equipment having risk significance are managed by the Configuration Risk Management Program (CRMP). The CRMP helps ensure that these maintenance activities are carried out with no significant increase in the risk of a severe accident.

The proposed changes are evaluated to determine that current regulations and applicable requirements continue to be met, that adequate defense-in-depth and sufficient safety margins are maintained, and that any increase in core damage frequency (CDF) and large early release frequency (LERF) is small and consistent with the NRC Safety Goal Policy Statement, USNRC, "Use of Probabilistic Risk Assessment Methods in Nuclear Activities: Final Policy Statement,"

Federal Register, Volume 60, p.42622, August 16, 1995. In addition, even though the Salem PRA model is a single unit model based on Unit 1, there are no relevant differences between Unit 1 and Unit 2 that would affect this CFCU AOT extension.

The justification for extending the AOT of one or two CFCU from 7 to 14 days is based upon risk informed and deterministic evaluations consisting of three main elements:

Tier 1: Assessment of the impact of the proposed TS change using a valid and appropriate PRA model and compare with appropriate acceptance guidelines.

o The proposed changes associated with the extended CFCU AOT are evaluated using the Salem PRA Model of Record (MOR) to determine that current regulations and applicable requirements continue to be met, that adequate defense-in-depth and sufficient safety margins are maintained, and that any increase in core damage frequency (CDF) and large early release frequency (LERF) is small and consistent with the acceptance guidelines in Enclosure 1.

Tier 2: Evaluate equipment relative to the contribution to risk while two CFCUs are in the extended AOT.

o Out of service combinations can be evaluated for their risk significance to determine if additional measures may be required.

Tier 3: Implementation of the Configuration Risk Management Program (CRMP) while one or two CFCUs are in an extended AOT.

o The CRMP is used for all work and helps ensure that there is no significant increase in the risk due to a severe accident while CFCU maintenance is performed. These elements provide adequate justification for approval of the requested Technical Specification change by providing a high degree of assurance that any increase in risk is acceptable during the CFCU extended AOT for all Design Basis Accidents (DBAs) and 10 CFR 50 Appendix R fire requirements during the CFCU AOT.

The Tier 1 and Tier 2 evaluations, which include discussion of internal and external hazards, are provided in Enclosure 1. Tier 3 is discussed in Sections 3.3 and 3.4 of this Attachment. also includes documentation demonstrating that the Salem internal events PRA is a Page 10

LR-N16-0173 LAR S16-04 thorough and detailed PRA model that is robust and capable of supporting the risk-informed decision to increase the AOT for one or two inoperable CFCUs from 7 days to 14 days.

4.4.1 Compensatory Measures PSEG maintenance practices involve protecting other equipment coincident with maintenance being performed on CFCUs. If two CFCUs are unavailable, PSEG procedures require the other CFCUs and one Containment Spray pump to be protected to prevent concurrent unavailability.

The PRA Model Of Record (MOR) directly accounts for this maintenance practice and is reflected in the quantitative analysis.

In addition, procedures direct the plant personnel to routinely monitor various maintenance configurations and protect equipment that could lead to an elevated risk condition (e.g., red risk condition) if it were to become unavailable due to unplanned or emergent conditions. This is normally accomplished using a predictive PRA software tool based on the PRA MOR, i.e.,

EOOS Configuration Risk Monitor program from the Electric Power Research Institute (EPRI).

Based on the very small risk increase involving the configuration analyzed in this LAR, there is no further need for additional compensatory measures or quantification other than the existing programs stated above.

4.4.2 Other Considerations The CRMP will ensure that the plant state is monitored to minimize the risk impact of the change.

4.4.3 Discussion of Risk Due to External Events Salem does not have separate probabilistic risk assessments (PRA) for Fire, External Flood or Seismic events. An internal Fire PRA (FPRA) is currently under development. The FPRA was developed as part of the station license renewal project. However, the FPRA did not undergo an industry peer review as required by NRC Regulatory Guide 1.200 for use in risk informed regulatory applications. The current version, which follows the methodology of NUREG/CR-6850 with some incorporation of more recent data and methods, can be used to provide valuable insights, but not quantitative information. Seismic events are not currently included in the MOR.

Like most nuclear power stations, Salem completed an Individual Plant Examination of External Events (IPEEE) in 1996. A report summarizing the major findings states that fire and seismic events were the only important contributors to external events core damage. The fire related CDF was 2.3E-05 per year. The seismic related CDF was 9.5E-06 per year using a more conservative hazard curve (Lawrence Livermore National Laboratory) and 4.7E-06 per year using a curve described as more realistic (EPRI). Section 1.4.3 of the IPEEE explains how the risk of High Winds, External Flood and other external events were screened out as insignificant.

The risk due to fire and seismic events is discussed in Enclosure 1, Sections 3.4.7 and 3.4.8 respectively.

Page 11

LR-N16-0173 LAR S16-04 4.4.4 Uncertainties In addition to the assessment of the mean risk metrics which are specified in RG 1.177 and 1.174 for comparison with the acceptance guidelines, it is also prudent to examine whether modeling uncertainties may distort these comparisons.

Therefore, an extensive review of potential modeling uncertainties that may impact the risk metrics was performed. To this end, NUREG-1855 and the companion EPRI guideline on the treatment of uncertainties were used. Section 5 of Enclosure 1 provides perspectives on the identification and disposition of various uncertainties.

4.4.5 PRA Quality Revision 0 of the analysis in Enclosure 1 utilized PRA Model SA112A. Subsequent to the completion of the analysis, an updated PRA MOR (SA115A) was finalized in December 2016.

This PRA model incorporated the newly installed fourth Auxiliary Feed Water (AFW) pump and use of FLEX equipment to help mitigate extended SBO scenarios. Therefore, it was deemed appropriate to revise the original CFCU AOT extension analysis to include a sensitivity analysis to review the results that would be obtained using the PRA MOR. The results of the study, presented in Table 5-7 of Enclosure 1, showed that the incremental risk was actually smaller than that calculated using the PRA Model SA112A.

The Salem PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, and common cause events. The PRA model quantification process used for the Salem PRA is based on the event tree and linked fault tree methodology, which is a well-known methodology in the industry.

PSEG employs a multi-faceted approach to establishing and maintaining the technical adequacy and plant fidelity of the PRA models for all PSEG nuclear generation. This approach includes a proceduralized PRA maintenance and update process, which includes consideration of peer review Facts and Observations (F&Os) and their subsequent resolution. PRA quality is assured for the Salem PRA model and documentation through a combination of the following:

Confirmation of the fidelity of the model with the as-built, as-operated plant Use of methods and approaches consistent with the ASME PRA Standard Use of an Updating Requirement Evaluation (URE) database to track PRA model issues and potential enhancements Use of a PRA Peer Review to identify areas for enhancement Use of highly qualified PRA practitioners qualified under the PSEG PRA Risk Management Program Use of internal reviews and interviews with system engineers and operating crew members Page 12

LR-N16-0173 LAR S16-04 4.4.6 Conclusion The quantitative results of the evaluation are shown in the table below:

RESULTS OF RISK EVALUATION FOR SALEM RISK MEETS RISK METRIC RISK METRIC SIGNIFICANCE ACCEPTANCE RESULTS GUIDELINE GUIDELINE (1)

CDF(/yr) 5.61E-08 RG 1.174 Yes (1)

LERF(/yr) 2.15E-10 RG 1.174 Yes ICCDPCFCU 2.80E-08 < 1.0E-06 Yes ICLERPCFCU 1.08E-10 < 1.0E-07 Yes Table Note:

(1) - Region III of RG 1.174 - very small risk

where, CDF(/yr) = Difference between CDF with current technical specifications and the CDF for an average 18 month cycle with three instances of concurrent unavailability of two CFCUs extended to 14 days.

LERF(/yr) = Difference between LERF with current technical specifications and the CDF for an average 18 month cycle with three instances of concurrent unavailability of two CFCUs extended to 14 days.

ICCDPCFCU = Incremental conditional core damage probability with two CFCUs out-of-service for an interval of time equal to the proposed new Allowed Outage Time (14 days).

ICLERPCFCU = Incremental conditional large early release probability with two CFCUs out-of-service for an interval of time equal to the proposed new Allowed Outage Time (14 days).

The proposed modification to the Technical Specifications is acceptable based on the risk change calculated with the Salem PRA for the proposed CFCU AOT extension for any two simultaneously unavailable CFCUs.

The ICCDP and ICLERP for an unavailable pair of CFCUs are sufficiently below the Reg. Guide 1.177 guidelines of <1.0E-06 and <1.0E-07, respectively, to be able to call the risk change small. Hence, the guidelines for the increased CFCU Allowed Outage Time have been met.

Page 13

LR-N16-0173 LAR S16-04 Furthermore, the calculation of changes in CDF and LERF due to the extended CFCU AOT has been shown to meet the risk significance criteria of Regulatory Guide 1.174, i.e., Region III which represents very small risk changes.

These calculations support the increase in the extended AOT up to a period of 14 days for any one or two CFCUs that are unavailable from a quantitative risk-informed perspective, so long as the plant operational and maintenance practices are in reasonable agreement with the assumptions made in this evaluation.

5.0 REGULATORY ANALYSIS

This license amendment request proposes changes to the Salem Generating Station Unit 1 and Unit 2 (Salem) Technical Specifications (TS) concerning one or two containment fan cooling units (CFCUs). The proposed change would extend the Allowed Outage Time (AOT) for one or two inoperable CFCUs from 7 days to 14 days. The proposed new allowed outage time (AOT) is based on application of the Salem Probabilistic Risk Assessment (PRA) in support of a risk-informed extension, and on additional considerations and compensatory actions. The risk evaluation and deterministic engineering analysis supporting the proposed change were developed in accordance with the guidelines established in Regulatory Guide 1.177, "An Approach for Plant-Specific Risk-informed Decisionmaking: Technical Specifications," and Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis."

5.1 No Significant Hazards Consideration PSEG has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, Issuance of amendment, as discussed below:

1. Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The containment fan cooling units (CFCUs) are safety related components which provide the minimum containment cooling as assumed by the containment response analysis for a design-basis loss of coolant accident (LOCA) or main steam line break (MSLB) event. The CFCUs are not accident initiators; the CFCUs are designed to mitigate the consequences of previously evaluated accidents including a design basis LOCA or MSLB event. Extending the AOT for one or two inoperable CFCUs would not affect the previously evaluated accidents since the remaining three CFCUs supplying cooling to containment would continue to be available to perform the accident mitigation functions. Thus allowing one or two CFCUs to be inoperable for an additional 7 days for performance of maintenance or testing does not increase the probability of a previously evaluated accident.

Deterministic and probabilistic risk assessments evaluated the effect of the proposed Technical Specification change on the acceptability of operating with one or two CFCUs inoperable for up to 14 days. These assessments concluded that the proposed Page 14

LR-N16-0173 LAR S16-04 Technical Specification change does not involve a significant increase in the risk from CFCU unavailability.

The calculated impact on risk associated with continued operation for an additional 7 days with one or two CFCUs inoperable is very small and is consistent with the acceptance guidelines contained in Regulatory Guides 1.174 and 1.177. This risk is judged to be reasonably consistent with the risk associated with operations for 7 days with one or two CFCUs inoperable as allowed by the current Technical Specifications.

The remaining 3 operable CFCUs, in conjunction with the Containment Spray System, are adequate to supply cooling to remove sufficient heat from the reactor containment, following the initial LOCA/MSLB containment pressure transient, to keep the containment pressure from exceeding the design pressure.

The consequences of previously evaluated accidents will remain the same during the proposed 14 day AOT as during the current 7 day AOT. The ability of the remaining 3 TS required CFCUs to maintain containment pressure and temperature within limits following a postulated design basis LOCA or MSLB event will not be affected.

There will be no impact on the source term or pathways assumed in accidents previously evaluated. No analysis assumptions will be changed and there will be no adverse effects on onsite or offsite doses as the result of an accident.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed Technical Specification change does not involve a change in the plant design, system operation, or procedures involved with the CFCUs. The proposed changes allow one or two CFCUs to be inoperable for additional time. There are no new failure modes or mechanisms created due to plant operation for an extended period to perform CFCU maintenance or testing. Extended operation with one or two inoperable CFCUs does not involve any modification in the operational limits or physical design of plant systems. There are no new accident precursors generated due to the extended AOT.

Therefore, the proposed changes do not create the possibility of a new or different kind of accident from any previously evaluated.

3. Does the proposed amendment involve a significant reduction in a margin of safety?

Response: No.

Margin of safety is related to the confidence in the ability of the fission product barriers to perform their design functions during and following an accident. These barriers include the fuel cladding, the reactor coolant system, and the containment system. The Page 15

LR-N16-0173 LAR S16-04 proposed change, which would increase the AOT from 7 days to 14 days for one or two inoperable CFCUs, does not exceed or alter a setpoint, design basis or safety limit.

Therefore, the proposed amendment does not involve a significant reduction in a margin of safety.

Based upon the above, PSEG Nuclear concludes that the proposed amendment presents no significant hazards consideration under the standards set forth in 10 CFR 50.92 (c), and, accordingly, a finding of no significant hazards consideration is justified.

5.2 Applicable Regulatory Requirements and Criteria 10 CFR 50.36 Technical Specifications 10 CFR 50.36, Technical Specifications, identifies the requirements for the Technical Specification categories for operating power plants: (1) Safety limits, limiting safety system settings, and limiting control settings, (2) Limiting conditions for operation, (3) Surveillance requirements, (4) Design features, (5) Administrative controls, (6) Decommissioning and (7)

Initial notification, and (8) Written Reports. For Limiting conditions for operation, 10 CFR 50.36 states: Limiting conditions for operation are the lowest functional capability or performance levels of equipment required for safe operation of the facility. When a limiting condition for operation of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the technical specifications until the condition can be met.

10 CFR 50 Appendix A General Design Criteria (GDC)

Salem Generating Station was designed using the Atomic Industrial Forum (AIF) general design criteria as published in a letter to the Atomic Energy Commission (AEC) from E. A. Wiggin, Atomic Industrial Forum, dated October 2, 1967. In addition to the AIF General Design Criteria, the Salem Generating Station (SGS) was designed to comply with Public Service Electric & Gas (PSE&G's) understanding of the intent of the AEC's proposed General Design Criteria, as published for comment by the AEC in July, 1967. The proposed GDCs applicable to this proposed change are 49 - Containment Design Basis and 52 - Containment Heat Removal Systems. A comparison of the Salem plant design with 10 CFR 50, Appendix A, (General Design Criteria for Nuclear Power Plants dated July 7, 1971) was performed and documented in Salem UFSAR Section 3.1.3. The Salem Plant design conforms to the intent of "General Design Criteria for Nuclear Power Plants," (10 CFR 50, Appendix A) dated July 7, 1971 with exceptions noted in the UFSAR.

The proposed change increases the allowed outage time (AOT) for CFCUs based on a risk informed analysis and does not affect the intent of any TS requirements. The proposed change does not alter conformance with the 10 CFR 50, Appendix A, general design criteria 38, containment heat removal, or the AEC proposed General Design Criteria as listed in the Salem UFSAR Section 3.1.2.

In conclusion, based on the considerations discussed above, (1) there is a reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the NRCs regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

Page 16

LR-N16-0173 LAR S16-04

6.0 ENVIRONMENTAL CONSIDERATION

A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluent that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure.

Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

7.0 REFERENCES

1. Salem Unit 1 and Unit 2 Technical Specifications

2. Salem Updated Final Safety Analysis Report

3. WCAP-16503 Rev. 3, Containment Response to LOCA and MSLB for Containment Fan Cooler Unit Margin Recovery Project, February 2007 Page 17

LR-N16-0173 Attachment 2 Technical Specification Pages with Proposed Changes Page 1

LR-N16-0173 TECHNICAL SPECIFICATION PAGES WITH PROPOSED CHANGES The following Technical Specifications for Renewed Facility Operating License DPR-70 are affected by this change request:

Technical Specification Page 3.6.2.3 3/4 6-11 The following Technical Specifications for Renewed Facility Operating License DPR-75 are affected by this change request:

Technical Specification Page 3.6.2.3 3/4 6-12 Page 2

LR-N16-0173 CONTAINMENT SYSTEMS CONTAINMENT COOLING SYSTEM LIMITING CONDITION FOR OPERATION 3.6.2.3 Five containment cooling fans shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3 and 4.

ACTION:

a. With one or two of the above required containment cooling fans inoperable, restore the inoperable cooling fan(s) to OPERABLE status within 7 14 days or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

b. With three or more of the above required containment cooling fans inoperable, restore at least three cooling fans to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or be in at least HOT STANDBY WITHIN the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . Restore the remaining inoperable cooling fans to OPERABLE status within 714 days of initial loss or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

SURVEILLANCE REQUIREMENTS 4.6.2.3 Each containment cooling fan shall be demonstrated OPERABLE:

SALEM - UNIT 1 3/4 6-11 Amendment No. 315 Page 3

LR-N16-0173 CONTAINMENT SYSTEMS CONTAINMENT COOLING SYSTEM LIMITING CONDITION FOR OPERATION 3.6.2.3 Five containment cooling fans shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3 and 4.

ACTION:

a. With one or two of the above required containment cooling fans inoperable, restore the inoperable cooling fan(s) to OPERABLE status within 7 14 days or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

b. With three or more of the above required containment cooling fans inoperable, restore at least three cooling fans to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or be in at least HOT STANDBY WITHIN the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . Restore the remaining inoperable cooling fans to OPERABLE status within 714 days of initial loss or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

SURVEILLANCE REQUIREMENTS 4.6.2.3 Each containment cooling fan shall be demonstrated OPERABLE:

SALEM - UNIT 2 3/4 6-12 Amendment No. 296 Page 4

LR-N16-0173 Enclosure 1 Salem PRA Analysis for CFCU AOT Extension Page 1

Salem Generating Station CFCU AOT Extension RM DOCUMENT NO: SA-LAR-007 REV: 1 STATION: Salem Generating Station UNIT S AFFECTED: Units 1 & 2 TITLE: Salem PRA Analysis for CFCU AOT Extension

SUMMARY

This analysis provides the basis for extending the Technical Specifications Allowed Outage Time (AOT) for Containment Fan Cooler Units (CFCUs) during extended maintenance activities. This analysis supports extending the AOT for the maintenance configuration in which one or two CFCUs are simultaneously out of service for up to 14 days.

Revision 1 adds an additional sensitivity analysis that uses the recently updated PRA model of Record SA 115A, which was finalized after completion of the original CFCU AOT extension analysis.

Internal RM Documentation Electronic Calculation Data Files:

\\Njnbufp1 9\PSEG Power\System Engineering\Salem\PRA\Applications\LAR\SA-LAR-007 CFCU LAR Prepared by:

Method of Review: [X] Detailed [ ] Alternate Approved by:

Date External RM Documentation Prepared by: ________ N/A---- ---------------------

Print Sign Date Approved by: ___ N/

_ 1

'"__ ______ .-:.1_____

Print Sign Date Do any ASSUMPTIONS I ENGINEERING JUDGMENTS require later verification?

[ ] Yes [X] No Tracked By: AT#, URE# etc.)

SA-LAR-007

Salem Generating Station CFCU AOT Extension TABLE OF CONTENTS Section Page EXECUTIVE

SUMMARY

................................................................................................ V

1.0 INTRODUCTION

............................................................................................... 141 1.1 Purpose .................................................................................................. 1 1 1.2 Background............................................................................................. 1 2 1.3 Technical Specifications ......................................................................... 1 3 1.4 Regulatory Guides .................................................................................. 1 3 1.5 Scope...................................................................................................... 1 4 1.6 Salem PRA Model and its Attributes ....................................................... 1 7 2.0 ANALYSIS ROADMAP AND REPORT ORGANIZATION ................................ 241 3.0 TIER 1 RISK ASSESSMENT ............................................................................ 343 3.1 Tier 1 Evaluation Approach..................................................................... 3 3 3.2 Assumptions ........................................................................................... 3 4 3.3 Compensatory Measures ........................................................................ 3 5 3.4 Calculational Approach ........................................................................... 3 5 3.5 Parametric Uncertainty Evaluation ........................................................ 3 16 4.0 TECHNICAL ADEQUACY OF THE PRA MODEL ............................................ 441 4.1 PRA Quality ............................................................................................ 4 1 4.2 Technical Adequacy Conclusion ........................................................... 4 51 4.3 External Events Considerations ............................................................ 4 51 4.4 Summary .............................................................................................. 4 56 5.0 DISCUSSION OF RISK CONTRIBUTORS AND UNCERTAINTY.................... 541 5.1 Step 3: Initial Comparison to Acceptance Guidelines ............................ 5 3 5.2 Consideration of Significant Contributors ................................................ 5 4 5.3 Step 4: Adequacy of the Scope of the Salem PRA ................................ 5 9 5.4 Step 5: Uncertainty Analysis .................................................................. 5 9 5.5 Sensitivity Analysis ............................................................................... 5 16 5.6 Sensitivity Analysis Conclusions ........................................................... 5 19 6.0

SUMMARY

AND CONCLUSIONS .................................................................... 641 6.1 Regulatory Guidelines............................................................................. 6 1 6.2 PRA Model.............................................................................................. 6 2 6.3 Quantitative PRA Results: Regulatory Guide 1.177 and 1.174 .............. 6 3 6.4 External hazards Considerations ............................................................ 6 3 ii SA LAR 007

Salem Generating Station CFCU AOT Extension 6.5 Uncertainties ........................................................................................... 6 4 6.6 Conclusion .............................................................................................. 6 4

7.0 REFERENCES

.................................................................................................. 741 LIST OF FIGURES Figure 1 Acceptance Guidelines for Core Damage Frequency (CDF) ............................ ix Figure 2 Acceptance Guidelines for Large Early Release Frequency (LERF)................. ix Figure 1 1 Acceptance Guidelines for Core Damage Frequency (CDF) ...................... 1 6 Figure 1 2 Acceptance Guidelines for Large Early Release Frequency (LERF) .......... 1 6 Figure 3 1 Parametric Uncertainty Distribution for Salem Base Model CDF (SA112B) for the CFCU AOT Extension Application Model ............................................. 3 17 Figure 3 2 Parametric Uncertainty Distribution for Salem CDF Representing the CFCU AOT Extension ..................................................................................... 3 18 Figure 3 3 Parametric Uncertainty Distribution for Salem Base Model LERF (SA112B) for the CFCU AOT Extension Application Model............................. 3 19 Figure 3 4 Parametric Uncertainty Distribution for Salem LERF Representing the CFCU AOT Extension ..................................................................................... 3 20 Figure 5 1 Overview of process for pra analysis to support a risk informed decision ... 5 2 Figure 6 1 Acceptance Guidelines for Core Damage Frequency (CDF) ...................... 6 6 Figure 6 2 Acceptance Guidelines for Large Early Release Frequency (LERF) .......... 6 6 LIST OF TABLES Table 1 1 History of Salem Generating Station PRA Model Updates ........................... 1 7 Table 2 1 RG 1.200 Analysis Actions Roadmap to Demonstrate PRA Technical Adequacy .......................................................................................................... 2 2 Table 3 1 Quantitative Results of the Risk Metrics for Concurrent Unavailability of Two CFCUS .................................................................................................... 3 11 Table 3 2 Dominant Risk Contributors Attributed to Extended CFCU AOT ................ 3 15 Table 4 1 Assessment of Supporting Requirement Capability Categories for Initiating Events Analysis ................................................................................................. 4 6 Table 4 2 Assessment of Supporting Requirement Capability Categories for Accident Sequence Analysis ........................................................................... 4 11 Table 4 3 Assessment of Supporting Requirement Capability Categories for Success Criteria ............................................................................................................. 4 15 Table 4 4 Assessment of Supporting Requirement Capability Categories for Systems Analysis ............................................................................................ 4 17 Table 4 5 Assessment Of Supporting Requirement Capability Categories For Human Reliability Analysis .............................................................................. 4 23 Table 4 6 Assessment Of Supporting Requirement Capability Categories For Data Analysis ........................................................................................................... 4 27 Table 4 7 Assessment of Supporting Requirement Capability Categories for iii SA LAR 007

Salem Generating Station CFCU AOT Extension Quantification................................................................................................... 4 34 Table 4 8 Assessment of Supporting Requirement Capability Categories for Internal Flood ............................................................................................................... 4 40 Table 4 9 Assessment of Supporting Requirement Capability Categories for Configuration Control....................................................................................... 4 46 Table 4 10 Assessment of Supporting Requirement Capability Categories with Consideration of Revised Supporting Requirements ....................................... 4 47 Table 4 11 Assessment of Supporting Requirement Capability Categories with Consideration of Qualifications from Reg Guide 1.200 (Appendix A) .............. 4 48 iv SA LAR 007

Salem Generating Station CFCU AOT Extension EXECUTIVE

SUMMARY

Tec h nical Eval uation of Extending Containment Fan Cooler Unit Allowed Outage Time Using Probabilistic Risk Assessment for Salem PURPOSE Consistent with the NRC's approach to risk-informed regulation, PSEG has identified a particular Technical Specification requirement that is restrictive in its nature and, if relaxed, has a minimal impact on the safety of the plant. This Technical Specification requires that the Containment Fan Cooler Unit (CFCU) Allowed Outage Time (AOT) be restricted to one or two CFCUs being inoperable for up to 7 days. The proposed change is to increase the CFCU AOT from the currently specified 7 days to 14 days for one or two CFCUs (out of five for each unit) being inoperable.

RISK INFORMED REGULATORY ENVIRONMENT Since the mid-1980s, the NRC has been reviewing and granting improvements to TS that are based, at least in part, on probabilistic risk assessment (PRA) insights. In its final policy statement on TS improvements of July 22, 1993, the NRC stated that it . . .

. . . expects that licensees, in preparing their Technical Specification related submittals, will utilize any plant-specific PSA [probabilistic safety assessment] or risk survey and any available literature on risk insights and PRAs.... Similarly, the NRC staff will also employ risk insights and PRAs in evaluating Technical Specifications related submittals. Further, as a part of the Commission's ongoing program of improving Technical Specifications, it will continue to consider methods to make better use of risk and reliability information for defining future generic Technical Specification requirements.

The NRC has specified, in Regulatory Guides, the risk metrics that should be calculated to provide input into the decision making process. The risk metrics chosen by the NRC in their Regulatory Guides include the following:

The change in Core Damage Frequency (CDF) (Reg. Guide 1.174)

The change in Large Early Release Frequency (LERF) (Reg. Guide 1.174)

The Incremental Conditional Core Damage Probability (ICCDP) (Reg. Guide 1.177)

The Incremental Conditional Large Early Release Probability (ICLERP) (Reg.

Guide 1.177) v SA-LAR-007

Salem Generating Station CFCU AOT Extension These risk metrics are all calculated with the Salem PRA model that includes internal events hazards, including internal floods.

Quantitative guidelines are defined by the NRC in RG 1 . 174 and 1.177 for what is an acceptably small change in risk.

The Salem calculated ICCDP and ICLERP for the CFCU AOT extension are sufficiently below the guidelines of <1.0E-06 and <1 . 0E-07, respectively, to be able to call the risk change small. Hence, the guidelines of Reg. Guide 1.177 for the increased CFCU Allowed Outage Time have been met.

The guidelines from Regulatory Guide 1.174 are provided to assure that the changes in CDF and LERF when the extended AOT is implemented remain acceptable. These guidelines specify acceptably small changes as a function of the absolute values of the CDF and LERF.

These calculations support the increase in the CFCU Allowed Outage Time (AOT) for a period of up to 14 days for any one or two CFCUs based on a quantitative risk-informed perspective.

QUANTITATIVE RESULTS The quantitative results of the evaluation are shown in the below table. Even though the risk increase was very similar for all 10 combination pairs of CFCUs being unavailable, two of the pairs presented the same maximum value, which is considered the "worst-case" combination for any two CFCUs that would be unavailable. To simplify the analysis, only one of the two pairs exhibiting the maximum risk increase (CFCUs #1 and #3) was chosen to represent the configuration for all quantitative calculations. Also, for the purpose of this analysis, three instances of a pair of CFCUs being unavailable for 14 days (42 days total) for a given fuel cycle were assumed. While this is unlikely, it could be based on multiple repetitive CFCU maintenance activities, such as maintenance on each of the two Service Water accumulators that would cause the unavailability of two CFCUs, with an additional maintenance activity whereby any two CFCUs could simultaneously be rendered unavailable.

vi SA-LAR-007

Salem Generating Station CFCU ACT Extension RESULTS OF RISK EVALUATION FOR SALEM RISK M ETRIC RISK M ETRIC RESULTS ilCDF(/yr) 5.61 E-08 l'lLERF(/yr) 2.1 5E-1 0 ICCDP cFcu 2.80E-08 ICLERP cFcu 1 .08E-1 0 Table Note:

1. Region Ill of RG 1.174-- very small risk changes.

In addition, the comparisons of the CDF and LERF risk metrics with the Reg. Guide 1.17 4 guidelines are shown in Figures 1 and 2, respectively. These comparisons show that the incremental risk is very low.

OTHER CONSIDERATIONS Any Shutdown Risk reductions associated with not having to perform maintenance on CFCUs during refueling outages have not been quantified as part of this evaluation.

The Configuration Risk Management Program (CRMP) will ensure that the plant state is monitored to minimize the risk impact of the change.

UNCERTAINTIES In addition to the assessment of the mean risk metrics which are specified in RG 1.177 and 1.174 for comparison with the acceptance guidelines, it is also prudent to examine whether modeling uncertainties may distort these comparisons.

Therefore, an extensive review of potential modeling uncertainties that may impact the risk metrics was performed. To this end, NUREG-1855 and the companion EPRI guideline on the treatment of uncertainties were used. Section 5 provides various perspectives on the identification and disposition of various uncertainties.

vii SA-LAR-007

Salem Generating Station CFCU AOT Extension CONCLUSION The proposed modification to the Technical Specifications is acceptable based on the risk change calculated with the Salem PRA for the proposed CFCU AOT extension for any two simultaneously unavailable CFCUs.

The ICCDP and ICLERP for an unavailable pair of CFCUs are sufficiently below the Reg. Guide 1.177 guidelines of <1.0E 06 and <1.0E 07, respectively, to be able to call the risk change small. Hence, the guidelines for the increased CFCU Allowed Outage Time have been met.

Furthermore, the calculation of changes in CDF and LERF due to the extended CFCU AOT have been shown to meet the risk significance criteria of Regulatory Guide 1.174, i.e., Region III which represents very small risk changes.

These calculations support the increase in the extended AOT up to a period of 14 days for any one or two CFCUs that are unavailable from a quantitative risk informed perspective, so long as the plant operational and maintenance practices are in reasonable agreement with the assumptions made in this evaluation.

viii SA LAR 007

Salem Generating Station CFCU AOT Extension t

(J 10"5 CDF ..,

FIGU RE 1 ACCEPTANCE GUIDELINES FOR CORE DAMAGE FREQU ENCY (CDF) 10'"5 LEAF * * ,_.,

FIGU RE 2 ACCEPTANCE GUIDELINES FOR LARGE EARLY RELEASE FREQU ENCY (LERF) ix SA-LAR-007

Salem Generating Station CFCU AOT Extension 1 .0 INTRODUCTION 1 .1 PU RPOSE Consistent with the NRC's approach to risk-informed regulation, PSEG has identified a particular Technical Specification requirement that is restrictive in its nature and, if relaxed, has a minimal impact on the safety of the plant. This Technical Specification is the requirement for the Containment Fan Cooler Unit (CFCU) Allowed Outage Time (AOT) to be restricted to 7 days for either one or two CFCUs being inoperable. The proposed change is to increase the AOT for any one or two inoperable CFCUs to a total of 1 4 days.

The proposed changes to Technical Specifications will extend the allowable Allowed Outage Times for the Required Actions associated with restoration of two inoperable CFCUs. The changes are being proposed to support any on-line maintenance that may be required that would render two CFCUs simultaneously unavailable.

1 .1 . 1 Benefits Implementation of this proposed Allowed Outage Time extension will provide the following benefits:

Allow increased flexibility in the scheduling and performance of preventive maintenance.

Improve containment fan cooler reliability.

Allow better control and allocation of resources.

Avert unplanned plant shutdowns. Risks incurred by unexpected plant shutdowns can be comparable to and often exceed those associated with continued power operation.

Permit scheduling of maintenance activities for CFCUs within the requested 1 4 day period.

The proposed Allowed Outage Time of 1 4 days is adequate to perform maintenance that would involve the simultaneous unavailability of two CFCUs. One such example would be if a major maintenance activity were to be scheduled for a CFCU and a leak was discovered during an inspection of another CFCU. Another example would be if any of the two Service Water accumulators were to be isolated for maintenance, which 1 -1 SA-LAR-007

Salem Generating Station CFCU AOT Extension would make two CFCUs inoperable (either the 11(21) and 12(22) pair, or the 14(24) and 15(25) pair, depending on the accumulator removed from service).

1.2 BACKGROUND

Since the mid 1980s, the NRC has been reviewing and granting improvements to TS that are based, at least in part, on probabilistic risk assessment (PRA) insights. In its final policy statement on TS improvements of July 22, 1993, the NRC stated that it . . .

. . . expects that licensees, in preparing their Technical Specification related submittals, will utilize any plant specific PSA [probabilistic safety assessment]1 or risk survey and any available literature on risk insights and PSAs. . . . Similarly, the NRC staff will also employ risk insights and PSAs in evaluating Technical Specifications related submittals. Further, as a part of the Commissions ongoing program of improving Technical Specifications, it will continue to consider methods to make better use of risk and reliability information for defining future generic Technical Specification requirements.

The NRC reiterated this point when it issued the revision to 10 CFR 50.36, Technical Specifications, in July 1995. In August 1995, the NRC adopted a final policy statement on the use of PRA methods in nuclear regulatory activities that encouraged greater use of PRA to improve safety decision making and regulatory efficiency. The PRA policy statement included the following points:

1. The use of PRA technology should be increased in all regulatory matters to the extent supported by the state of the art in PRA methods and data and in a manner that complements the NRCs deterministic approach and supports the NRCs traditional defense in depth philosophy.

2. PRA and associated analyses (e.g., sensitivity studies, uncertainty analyses, and importance measures) should be used in regulatory matters, where practical within the bounds of the state of the art, to reduce unnecessary conservatism associated with current regulatory requirements.

3. PRA evaluations in support of regulatory decisions should be as realistic as practicable and appropriate supporting data should be publicly available for review.

The movement of the NRC to more risk informed regulation has led to the NRC identifying Regulatory Guides and associated processes by which licensees can submit 1

PSA and PRA are used interchangeably herein.

12 SA LAR 007

Salem Generating Station CFCU AOT Extension changes to the plant design basis, including Technical Specifications. As examples, Regulatory Guides 1.17 4 [1] and 1.177 [2], both provide mechanisms to demonstrate valuable PRA input for Technical Specification modification.

1 .3 TECHNICAL SPECIFICATIONS As with all Technical Specifications, there is no rule to limit the number of times per year that an extended AOT would be invoked. However, there are a number of programs (e.g., MSP I, Maintenance Rule) that are monitoring programs that provide operational and risk controls on extended outages of key equipment. However, to provide a somewhat realistic assessment for this extended AOT involving concurrent unavailability of two CFCUs, an assumption was made that there would be at most three instances of dual CFCU unavailability per fuel cycle, with each period of unavailability being a full 1 4 days. The reasoning for this assumption involving three separate periods of dual CFCU unavailability was based on the fact that there are two Service Water accumulators, and each one was assumed to undergo online maintenance during a fuel cycle, with the third period of unavailability based on a random occurrence of any two CFCUs that might be made unavailable during at-power operations.

1 .4 REGULATORY GUIDES The license amendment request for an extension in the CFCU Allowed Outage Time (AOT) is made consistent with the NRC risk-informed process. The internal events PRA is developed and peer reviewed consistent with the ASME PRA Standard [11] as endorsed by Regulatory Guide (RG) 1.200 [3]. The risk-informed application is developed consistent with the general guidance in RG 1.174 [1] and the specific guidance for changes in AOTs contained in RG 1.177 [2].

1 .4.1 Acceptance Guidelines** R.G. 1 . 1 74 R. G. 1.174 specifies the acceptance guidelines in terms of the change in CDF and LERF as a function of the base model CDF and LERF, respectively. Figure 1-1 identifies the acceptance guidelines for R. G. 1.174 for the t1CDF risk metric and Figure 1-2 identifies the acceptance guidelines for R.G. 1.174 for the t1LERF risk metric.

1 -3 SA-LAR-007

Salem Generating Station CFCU AOT Extension Further, R. G. 1.174 in Section 2.5.5 [1] identifies the following regarding the PRA calculation to be used in comparison with the acceptance guidelines:

Because of the way the acceptance guidelines were developed, the appropriate numerical measures to use in the initial comparison of the PRA results to the acceptance guidelines are mean values.

1 .4.2 Acceptance Guidelines-- R.G. 1 . 1 77 Regulatory Guide 1.177 specifies acceptance guidelines in terms of two parameters that have been developed by the NRC as follows:

ICCDP - Incremental Conditional Core Damage Probability

[(conditional CDF with the subject equipment out of service) - (baseline CDF with nominal expected equipment unavailabilities)] x duration of single AOT under consideration)

ICLERP - Incremental Conditional Large Early Release Probability

[(conditional LERF with the subject equipment out of service) - (baseline LERF with nominal expected equipment unavailabilities)] x (duration of single AOT under consideration)

Further, the NRC has developed acceptance guidelines which the NRC states "should not be interpreted as overly prescriptive".

I RISK M ETRIC PARAM ETER I ACC E PTANC E GUI DELINE I I I I ICCDP 1 .0E-06 ICLERP 1 .0E-07 1 .5 SCOPE This analysis is to address the adequacy of the proposed Allowed Outage Time (AOT) extension for one or two Containment Fan Cooler Units (CFCUs) from the current 7 days to 14 days using the Salem Probabilistic Risk Assessment (PRA) model.

The following scope of the at-power PRA models is included:

Internal Events: Model developed in accordance with the ASME/ANS PRA Standard and Peer Reviewed

Internal Floods: Model developed in accordance with the ASME/ANS PRA Standard and Peer Reviewed 1 -4

Salem Generating Station CFCU AOT Extension

Seismic Events: Model based on Seismic Evaluation from IPEEE included in the model quantification

Internal Fires: Model based on Fire Evaluation from IPEEE with insights provided from the Work-in-Progress Fire PRA model

Other External Event Hazards: Non-contributors based on an independent review of IPEEE results which quantitatively or qualitatively screened these from further analysis.

The NRC has specified in Regulatory Guides the risk measures that should be calculated to provide input into the decision making process. The risk measures chosen by the NRC in their Regulatory Guides include the following:

The change in Core Damage Frequency (CDF) (Reg. Guide 1.174)

The change in Large Early Release Frequency (LERF) (Reg. Guide 1.174)

The Incremental Conditional Core Damage P robability (ICCDP) (Reg.

Guide 1. 177)

The Incremental Conditional Large Early Release Probability (ICLERP) (Reg. Guide 1.177) 1 -5 SA-LAR-007

Salem Generating Station CFCU AOT Extension t

Lt.

0 (J

<:]

10"5 104 CDF .......,

FIGURE 1-1 ACCEPTANCE GUIDELINES FOR CORE DAMAGE FREQUENCY (CDF) 10 .. 5 LEAF* ,_

FIGURE 1-2 ACCEPTANCE GUIDELINES FOR LARGE EARLY RELEASE FREQUENCY (LERF) 1 -6 SA-LAR-007

Salem Generating Station CFCU AOT Extension 1.6 SALEM PRA MODEL AND ITS ATTRIBUTES The Salem Generating Station (SGS) PRA internal events at power model and documentation has been maintained current with the as built, as operated plant and is routinely updated to reflect the current plant configuration and to reflect the accumulation of additional plant operating history and component failure data. The Level 1 and Level 2 Salem analyses were originally developed and submitted to the NRC as the Salem Generating Station Individual Plant Examination (IPE) Submittal [8]

in response to NRC Generic Letter 88 20 [9]. The Salem PRA has been updated many times since the original IPE. A summary of the Salem PRA history is in Table 1 1.

TABLE 141 HISTORY OF SALEM GENERATING STATION PRA MODEL UPDATES INTERNAL INTERNAL MODEL MODEL EVENTS EVENTS TRUNCATION REVISION COMMENTS NAME CDF LERF LIMIT DATE (1/YR) (1/YR)

July 93 IPE 6.40E 05 5.23E 06 NR Truncation limit not reported August 96 Model 1.0 5.13E 05 4.75E 06 NR Truncation limit not reported August 98 Model 2.0 5.23E 05 4.75E 06 1.00E 10 June 02 Model 3.0 5.20E 05 5.74E 06 1.00E 10 July 03 Model 3.1 4.10E 05 3.97E 06 1.00E 09 March 05 Model 3.2 2.48E 05 1.01E 06 1.00E 11 March 06 Model 3.2A 6.21E 05 7.61E 06 1.00E 11 No internal flood contribution No internal flood contribution; March 08 Model 4.0 4.54E 05 NR 1.00E 11 LERF results not reported September 08 Model 4.1 4.77E 05 5.06E 06 1.00E 11 March 09 Model 4.2 4.74E 05 5.06E 06 1.00E 11 December 09 Model 4.3 2.55E 05 1.18E 06 1.00E 11 Model 1.0E 11 (CDF)

September 14 1.55E 05 7.29E 07 SA112A 1.0E 12 (LERF)

The SA115A model was Model 1.0E 11 (CDF) finalized after the original December 16 8.38E 06 4.65E 07 SA115A 3.0E 13 (LERF) CFCU analysis was completed.

17 SA LAR 007

Salem Generating Station CFCU AOT Extension 1.6.1 Peer Review In November 2008, PSEG participated in a PRA Peer Review Certification of the Salem PRA administered under the auspices of the Westinghouse Electric Company LLC [7].

The purpose of the PRA peer review process was to establish a method of assessing the technical quality of the PRA for the spectrum of its potential applications.

1.6.2 Current Version of PRA Model The PRA version known as SA11 2A, satisfied the PSEG internal requirement for a periodic PRA Update, and also served to address peer review Findings and Observations (F&Os), open Updating Requirement Evaluations (UREs), and updated plant-specific data.

Model updates labeled as Rev. 4.2, 4.3, and SA112A have been performed since the peer review. While the model and documentation have been significantly improved, no methodology changes that would be considered a PRA upgrade per Regulatory Guide 1.200 were introduced.

This SA112A PRA Update included a data update, updated HRA analysis for a more detailed treatment of dependent operator actions and pre-initiator actions, and the closure of over 200 Updating Requirement Evaluations (URE).

Major fault tree logic changes included the following:

Due to transfers being made from the loss of CCW event tree to the small LOCA event tree, numerous gates were no longer necessary and removed from the PRA model logic.

The offsite power recovery logic was modified to ensure that all loss of offsite power (LOOP)-initiated cutsets contained a non-recovery probability for failure to restore offsite power given the type of initiating event involved, e.g., Weather, Grid, and Plant-Centered and Station.

Annualized terms and basic events that support fault tree logic used to estimate the occurrence of support system initiating events were verified to contain the mission time of 8760 hours0.101 days 2.433 hours 0.0145 weeks 0.00333 months to reflect the exposure time of one year.

1 -8 SA-LAR-007

Salem Generating Station CFCU AOT Extension

Additional credit was taken in the logic model for recovery of Control Area Ventilation due to insights gathered from procedure reviews and during operator interviews.

Further details regarding the SA112A PRA model may be found in Reference [6].

In addition, even though the Salem PRA model is a single unit model based on Unit 1, there are no major differences between Unit 1 and Unit 2 that would affect this CFCU AOT extension.

The following list provides a summary of some of the major differences noted between the two Salem units:

The Service Water (SW) air-operated valves (AOVs) that service the #12A and #12B Component Cooling Water (CCW) heat exchangers for Unit 1 require a control air dependency for successful operation whereas the #22 SW AOVs in Unit 2 do not.

The power dependencies for the SW pumps and associated MOVs are not symmetric between the two units. For example, the 4kV AC vital bus A on Unit 1 powers the 15 and 16 SW pumps, while the A vital bus on Unit 2 powers the 21 and 22 SW pumps.

The Unit 2 CVCS pumps do not require CCW cooling for their mechanical seals while the Unit 1 CVCS pumps do during normal operation.

However, this particular CCW dependency is not modeled in the PRA since it is not required for successful operation of the eves pumps during the injection phase of an accident condition since water from the RWST is relatively cool.

Operations personnel are trained such that no differences would exist with the Human Reliability Analysis (HRA) between the two units.

The Station Air Compressors (SACs) and Instrument Air system are shared between the two units, with SACs #1 and #3 powered from Unit 1 Group buses and SAC 2 powered from a Unit 2 Group bus. All three SACs are physically located in the Unit 1 Turbine Building on the 100' el.

The Demineralized Water (OM) pumps are also physically located in the Unit 1 Turbine Building on the 100' el. and provide OM water for both Unit 1 and Unit 2. The power supplies are such that the #1 and #3 pumps are powered from a Unit 1 Group bus while the #2 pump is powered from a Unit 2 Group bus. The Auxiliary OM pump is powered from a Unit 1 vital bus.

The Station Blackout (SBO) Air Compressor is located in the yard in close proximity to the Unit 2 Turbine Building and services the Control Air 1-9 SA-LAR-007

Salem Generating Station CFCU AOT Extension system for both units when required via a connection on the discharge side of the Unit 2 Emergency Control Air Compressor.

Although the Salem SA112A PRA model was used for this risk analysis, the Salem SA115A PRA Model of Record (MOR) was finalized following completion of the original analysis for this CFCU AOT extension. SA115 was utilized in an additional sensitivity analysis to further reinforce the original conclusion in support of the proposed CFCU AOT extension.

The major changes included as part of the SA115A PRA model update involved the incorporation of a fourth AFW pump that includes a dedicated diesel generator as its power supply. The use of FLEX equipment was also incorporated for those Station Blackout scenarios that lead to an extended loss of AC power in which offsite power is not expected to be restored within four hours. Failure probabilities were updated and incremental model improvements were incorporated that were identified as part of the Maintenance and Updating requirements per procedure ER AA 600 1015 [26].

1.6.3 IPEEE The Salem IPEEE evaluation [10] was used as a basis to gain insight into what impact the CFCU AOT extension might have on the risk associated with fire and seismic events, as well as any other related external events risk.

Although Salem does not currently possess any peer reviewed seismic and fire PRA models, the use of IPEEE results and any insights gleaned from the Work in Progress (WIP) Fire PRA model are deemed adequate in analyzing any perceived increase in risk due to seismic and fire events associated with extending the CFCU AOT.

1 10 SA LAR 007

Salem Generating Station CFCU AOT Extension 2.0 ANALYSIS ROADMAP AND REPORT ORGANIZATION The method of compliance to demonstrate the technical adequacy of the PRA used to support the EDG AOT Extension is provided in RG 1.200, Revision 1. The guidance in RG 1.200, Revision 1 indicates that the following steps should be followed to perform this study of the technical adequacy of the PRA:

1. Per Section 3 of RG 1.200, identify the parts of the PRA used to support the application

a. Describe the SSCs, operator actions, and operational characteristics affected by the application and how these are implemented in the PRA model.

b. Provide a definition of the acceptance guidelines used for the application.

2. Per Section 3.1 of RG 1.200, identify the scope of risk contributors addressed by the PRA model

a. If not full scope (i.e., internal and external), identify appropriate compensatory measures or provide bounding arguments to address the risk contributors not addressed by the model.

3. Per Section 3.2 and 4.2 of RG 1.200, demonstrate the Technical Adequacy of the PRA

a. Identify plant changes (design or operational practices) that have been incorporated at the site, but are not yet in the PRA model and justify why the change does not impact the PRA results used to support the application.

b. Document that the parts of the PRA used in the decision are consistent with applicable standards endorsed by the Regulatory Guide (currently, in RG 1.200, Revision 1 this is just the internal events PRA standard). Provide justification to show that where specific requirements in the standard are not met, it will not unduly impact the results.

c. Document peer review findings and observations that are applicable to the parts of the PRA required for the application, and for those that have not yet been addressed justify why the significant contributors would not be impacted.

d. Identify key assumptions and approximations relevant to the results used in the decision making process.

4. Per Section 4.2 of RG 1.200, summarize the risk assessment methodology used to assess the risk of the application

a. Include how the PRA model was modified to appropriately model the risk impact of the change request.

Table 2 1 summarizes the RG 1.200 identified actions and the corresponding location of that analysis or information in this report.

21 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 241 RG 1.200 ANALYSIS ACTIONS ROADMAP TO DEMONSTRATE PRA TECHNICAL ADEQUACY RG 1.200 ACTIONS REPORT SECTION

1. Identify the parts of the PRA used to support the application Section 1.5 and Section 3 1a. Describe the SSCs, operator actions, and operational characteristics Section 1.1, 1.3, affected by the application and how these are implemented in the PRA and Section 3 model.

1b. Provide a definition of the acceptance guidelines used for the Section 1.4 application.

2. Identify the scope of risk contributors addressed by the PRA model. If Section 3 and 5 not full scope (i.e., internal and external events), identify appropriate compensatory measures or provide bounding arguments to address the risk contributors not addressed by the model.

3. Demonstrate the Technical Adequacy of the PRA. Section 4 3a. Identify plant changes (design or operational practices) that have been Section 4.1.1, 4.1.2 incorporated at the site, but are not yet in the PRA model and justify why the change does not impact the PRA results used to support the application.

3b. Document that the parts of the PRA used in the decision are consistent Section 4.1.3 with applicable standards endorsed by the RG (currently, in RG 1.200 Rev. 1. RG 1.200 Rev. 1 addresses the internal events ASME PRA Standard). Provide justification to show that where specific requirements in the standard are not met, it will not unduly impact the results.

3c. Document PRA peer review findings and observations that are Section 4.1.3, applicable to the parts of the PRA required for the application, and for Tables 4 1 to 4 11 those that have not yet been addressed justify why the significant contributors would not be impacted.

3d. Identify key assumptions and approximations relevant to the results used Section 3.2 and in the decision making process. Section 5

4. Summarize the risk assessment methodology used to assess the risk of Section 3 the application. Include how the PRA model was modified to appropriately model the risk impact of the change request.

4a. Include how the PRA model was modified to appropriately model the risk Section 3.4.3 impact of the change request.

22 SA LAR 007

Salem Generating Station CFCU AOT Extension 3.0 TIER 1 RISK ASSESSMENT The justification for the use of a Containment Fan Cooler Unit (CFCU) extended Allowed Outage Time (AOT) is based upon risk informed and deterministic evaluations consisting of three main elements:

1. Tier 1: Assessment of the impact of the proposed TS change using a valid and appropriate PRA model and compare with appropriate acceptance guidelines.

2. Tier 2: Evaluate equipment relative to the contribution to risk while two CFCUs are in the extended AOT.

a. Examination of out of service combinations can be evaluated for their risk significance to determine if additional measures may be required.

3. Tier 3: Implementation of the Configuration Risk Management Program (CRMP) while two CFCUs are in an extended AOT. The CRMP is used for all work and helps ensure that there is no significant increase in the risk due to a severe accident while CFCU maintenance is performed. These elements provide adequate justification for approval of the requested Technical Specification change by providing a high degree of assurance that any increase in risk is acceptable during the CFCU extended AOT for all Design Basis Accidents (DBAs) and 10 CFR 50 Appendix R fire requirements during the CFCU AOT.

This section addresses the risk assessment for the proposed extension of the CFCU AOT. Plant configuration changes for planned and unplanned maintenance of the CFCUs as well as the maintenance of equipment having risk significance is managed by the Configuration Risk Management Program (CRMP). The CRMP helps ensure that these maintenance activities are carried out with no significant increase in the risk of a severe accident.

3.1 TIER 1 EVALUATION APPROACH The proposed changes associated with the extended CFCU AOT are evaluated using the Salem PRA Model of Record (MOR) to determine that current regulations and applicable requirements continue to be met, that adequate defense in depth and sufficient safety margins are maintained, and that any increase in core damage frequency (CDF) and large early release frequency (LERF) is small and consistent with the acceptance guidelines in Reference [2].

33 SA LAR 007

Salem Generating Station CFCU AOT Extension The modeling approach is consistent with the NRC guidance for the calculation of the requested risk measures using the Salem PRA MOR:

Regulatory Guide 1.177 [2] is followed to calculate the change in risk measures:

ICCDP ICLERP These conditional probabilities are performed to calculate the risk change during the proposed CFCU AOT.

An integrated assessment of the impact of the AOT extension is calculated assigning the "worst case" dual unavailability of CFCUs up to a period of 14 days. This calculation can then be used to calculate the change in CDF and LERF in comparison with the criteria set in Regulatory Guide 1.174 [1].

Regulatory Guide 1 .174 has acceptance guidelines that act as "trigger points" to address concerns as to whether the proposed change provides reasonable assurance of adequate protection.

The Salem internal events PRA is a thorough and detailed PRA model that is robust and capable of supporting the risk-informed decision to increase the CFCU Allowed Outage Time from 7 days to 14 days. See Section 4 for a discussion of the PRA technical adequacy.

3 .2 ASSUMPTIONS The PRA quantitative evaluation of the extended CFCU AOT has a number of assumptions. This subsection lists some of the important assumptions.

An extended CFCU outage will occur for two CFCUs three (3) times during a refueling cycle (18 months).

The external event analysis is based on a qualitative analysis using insights from the IPEEE study [10] and any insights gleaned from the WIP Fire PRA model.

There is not a shutdown PRA maintained for Salem, and therefore, the risk decrease associated with removing CFCU maintenance from the outage is not quantified. The change in the Technical Specification AOT for the CFCUs would result in removing this shutdown risk increment. This unquantified risk reduction would reduce the calculated risk metrics of CDF, LERF, ICCDP, and ICLERP calculated in this report. However, the quantitative effect of risk changes during shutdown are not explicitly included in the quantification. The shutdown risk change will result in increased safety because the CFCU work window will be removed from the outage. By not including the risk benefit associated with the 3-4 SA-LAR-007

Salem Generating Station CFCU AOT Extension outage safety improvement, the at-power results provided in the enclosed analysis will be conservative.

The base risk model has not increased the CFCU maintenance unavailabilities to account for future potential increases in the average unavailabilities. If this were to be included in the base risk model, it would result in improving the calculated risk metrics and showing an increase in the margin from the calculated risk metrics to their acceptance guidelines.

Corrective and preventative maintenance outages have been combined to calculate a total maintenance unavailability. This is consistent with the ASME PRA Standard [11].

Common cause failure events are treated using the INL common cause data base developed under the auspices of the NRC. The conditional probability of failure of additional CFCUs has been adjusted to account for the hypothetical case that two out of five CFCUs have suffered a failure. This is bounding; other more likely scenarios would lead to lower conditional probabilities and risk increases.

3 .3 COMPENSATORY MEASURES PSEG maintenance practices involve protecting other equipment coincident with maintenance being performed on CFCUs per OP-AA-1 08-116, PROTECTED EQUIPMENT PROGRAM [21]. This procedure specifically states that if two CFCUs are unavailable, the other CFCUs and one Containment Spray pump are protected to prevent concurrent unavailability. The PRA MOR directly accounts for this maintenance practice and is reflected in the quantitative analysis.

In addition, OP-AA-1 08-116 directs the Operations and Work Management personnel to routinely monitor various maintenance configurations and protect equipment that could lead to an elevated risk condition (e.g., "red" risk condition) if it were to become unavailable due to unplanned or emergent conditions. This is normally accomplished using a predictive PRA software tool based on the PRA MOR, i.e., EOOS Configuration Risk Monitor program from the Electric Power Research Institute (EPRI).

3 .4 CALCULATIONAL APPROACH 3 . 4.1 Overview With two CFCUs unavailable up to a period of 14 days, the Salem PRA MOR yielded the following results:

3-5 SA-LAR-007

Salem Generating Station CFCU AOT Extension FREQUENCY SU RROGATE SAFETY RISK M ETRIC (PER RX-YR) GOAL (PER RX-YR)

CDF (1) 1 E-4 1 .62E-05 LERF 7.32E-07<2> 1 E-5 Table Notes:

(l) At truncation of 1 E-11/yr using the single top PRA model.

(Z) At truncation of 1 E-12/yr using the single top PRA model.

The CDF risk metric meets the NRC surrogate safety goal with margin.

3 .4.2 Risk Metric Calculational Approac h To determine the effect of the proposed 14 day Allowed Outage Time for unavailability of two CFCUs, the guidance provided in Regulatory Guides 1.17 4 and 1.177 is used.

Thus, the following risk metrics are used to evaluate the risk impacts of extending the CFCU AOT from 7 days to 14 days:

Regulatory Guide 1.174 iJCOFAvE = change in the annual average CDF due to the increase in on-line maintenance unavailability for any two CFCUs based on the increased Allowed Outage Time. This risk metric is used to compare against the criteria of Regulatory Guide 1. 174 to determine whether a change in COF is regarded as risk significant. These criteria are a function of the baseline annual average core damage frequency, CDFaASE*

LJLERFAvE =change in the annual average LERF due to the increase in on-line maintenance unavailability for any two CFCUs based on the increased Allowed Outage Time. Regulatory Guide 1.174 criteria were also applied to judge the significance of changes in this risk metric.

Regulatory Guide 1.177 ICCOPcFcu = incremental conditional core damage probability with two CFCUs out of-service for an interval of time equal to the proposed new Allowed Outage Time (14 days). This risk metric is used as suggested in Regulatory Guide 1. 177 to determine whether a proposed increase in Allowed Outage Time has an acceptable risk impact.

3-6 SA-LAR-007

Salem Generating Station CFCU AOT Extension JCLERPcFcu = incremental conditional large early release probability with two CFCUs out-of-service for an interval of time equal to the proposed new Allowed Outage Time (14 days). Regulatory Guide 1.177 criteria were a/so applied to judge the significance of changes in this risk metric.

The evaluation of the above risk metrics is performed as follows.

The change in the annual average CDF due to the extension of the CFCU Allowed Outage Time for three instances of dual CFCU unavailability, CDFAVE, is evaluated by computing the following:

CDFNEW =(3xTCYCLETcFcuJcDFCFCU ( 3xTcFcuJcDFBASE

+ 1-where:

TCYCLE CDFNEW =

Average CDF over a "typical" 18 month refueling cycle.

CDFsAsE = baseline annual average CDF with average unavailability of CFCUs consistent with the current CFCU Allowed Outage Time.

CDFc Fcu = CDF evaluated from the PRA model with concurrent unavailability of two CFCUs out-of-service and compensatory measures that include prohibiting concurrent maintenance on the remaining CFCUs and one Containment Spray pump.

TcFcu = Total time per 18 month refueling cycle (TcYCLE) that two CFCUs are out-of-service for the extended Allowed Outage Time -- assumed to be 14 days.

Tcycle = 18 months of operation (1.5 x 365 days= 547.5 days).

= CDFCFCU X 42days 547.5days

+ CDFBASE X 505.5 days 547.5days

where, iJ.CDF CDFNEW - CDFBASE

=

CDF = Difference between CDF with current technical specifications and the CDF for an average 18 month cycle with three instances of concurrent unavailability of two CFCUs extended to 14 days.

A similar approach was used to evaluate the change in the average LERF due to the requested Allowed Outage Time, LERF:

3-7 SA-LAR-007

Salem Generating Station CFCU AOT Extension LERFNEW

=

( 3 X TCFCU TCYCLE J LERFCFCU +(1- 3 X TCFCU TCYCLE JLERFBASE ifLERF = LERFNEW -LERFsAsE where:

LERFNEw = Average LERF over a "typical" 18 month refueling cycle.

LERFsAsE = baseline annual average LERF with average unavailability of CFCUs consistent with the current CFCU Allowed Outage Time.

LERFcFcu = LERF evaluated from the PRA model with concurrent unavailability of two CFCUs out-of-service and compensatory measures that include prohibiting concurrent maintenance on the remaining CFCUs and one Containment Spray pump.

LERF = Difference between LERF with current technical specifications and the CDF for an average 18 month cycle with three instances of concurrent unavailability of two CFCUs extended to 14 days.

The evaluation was performed based on the assumption that the extended Allowed Outage Time would be applied to three instances of two CFCUs being unavailable simultaneously per 18 month refueling cycle, hence TcFcu = 42 days. The refueling cycle is based on an 18 month schedule (TC YCLE= 547.5 days).

The incremental conditional core damage probability (ICCDP) and incremental conditional large early release probability (ICLERP) are computed using the definitions from Regulatory Guide 1.177. In terms of the above defined parameters, the definition of ICCDP for the dual unavailability of two CFCUs is as follows:

ICCDPcFcu= (CDFcFcu- CDFsAsE)TcFcu ICCDPCFcu= (CDFcFcu- CDFBAsE) * (14 days)* (365 days/yearF1 ICCDPcFcu= (CDFcpcu- CDFBASE)

3.84 x 10-2 year Note that in the above formula 365 days/year is merely a conversion factor to provide the Allowed Outage Time units consistent with the CDF frequency units. The ICCDP values are dimensionless probabilities to evaluate the incremental probability of a core damage event over a period of time equal to the extended Allowed Outage Time. This 3-8 SA-LAR-007

Salem Generating Station CFCU AOT Extension should not be confused with the evaluation of CDFAVE in which the CDF is averaged over an 18 month refueling cycle.

Similarly, ICLERP is calculated using the methodology described above:

ICLERPcFcu = (LERFcFcu - LERFBASE)

3.84 x 10-2 year 3 .4.3 CFCU AOT Extension PRA Analysis The Base PRA model of record (MOR) has been reviewed for applicability to the Salem CFCU AOT extension and the following changes were included as part of the analysis used for this risk application:

A change to the common cause term for multiple failure of three of more CFCUs was made to account for the identified failure of two CFCUs. The common cause basic event VCS-FNR-FR-DF01 in the MOR was changed from its nominal failure probability of 6.48E-06 to 8.22E-01 using the "RaspCCF" calculational methodology for staggered testing employed in the SAPHIRE PRA software program [22] given that two out of five components have initially failed. This condition produced the largest conditional failure probability for failure of the remaining fans.

A change was made to eliminate certain accident sequences from the cutset results that would not necessarily lead to core damage due to being long-term and slowly developing scenarios that would not require containment cooling, either by the Containment Spray (CS) System or Containment Fan Cooler Units (CFCUs). A MAAP 4.0.6 sensitivity analysis showed that this type of accident sequence did not require successful containment cooling either via CS or CFCUs in order to avert core damage.

The first model change was incorporated into this analysis via a flag file, which was used to adjust the failure probabilities to simulate the unavailability of the #1 and #3 CFCU basic event maintenance terms, since this particular combination of CFCUs shared the maximum change in CDF to a value of 7 significant figures with one other combination (#1 and #4). The other CFCU maintenance terms were set to zero to simulate current maintenance practices and Technical Specification requirements in which the remaining fan coolers are being protected. Additionally, the mutually exclusive logic in the PRA MOR also prohibits cutsets that would involve three or more CFCUs in maintenance with simultaneous maintenance of any one train of Containment Spray. The common cause term was also adjusted based on the RaspCCF 3-9 SA-LAR-007

Salem Generating Station CFCU AOT Extension calculational methodology described above. The flag file employed for this analysis is presented below, which was used to calculate the CDFcFcu and LERFcFcu terms defined above:

VCS-FNR-TM-VHE15 EQU .T.

VCS-FNR-TM-VHE17 EQU .T.

VCS-FNR-TM-VHE16 prob 0.0 VCS-FNR-TM-VHE18 prob 0.0 VCS-FNR-TM-VHE19 prob 0.0 VCS-FNR-FR-DFOl prob 8.2223E-01 The second change listed above necessitated the creation of an application specific model, known as the SA112B PRA model, which is documented in risk application SA MISC-016, "Application Specific Model for CFCU LAR." This application specific model eliminates some cutsets that included late failure of the AFW system and containment cooling failures. Containment cooling was shown to not be necessary for these scenarios based on a thermal hydraulic sensitivity analysis using the MAAP computer code.

The model calculations were performed using the SA1128 PRA model to develop the increase in risk associated with those configurations involving concurrent unavailability of two CFCUs for an extended AOT, assuming three separate occurrences within a given fuel cycle. These calculations were used to develop the risk metrics for comparison with RG 1.174 and RG 1.177 acceptance guidelines.

3 .4.4 Com pensatory Measures There were no compensatory measures implemented other than standard maintenance practice that has already been identified in OP-AA-1 08-116 [21], which involves protecting the other available CFCUs and one Containment Spray pump when two CFCUs are made available for maintenance.

3 .4 .5 Calculated Risk Metrics Table 3-1 summarizes the calculated values for the NRC specified risk metrics (CDF, LERF, ICCDP, and ICLERP) for the proposed change to the AOT involving the concurrent unavailability of two CFCUs for a period of 14 days, with the premise that 3-1 0 SA-LAR-007

Salem Generating Station CFCU AOT Extension this occurs on three separate occasions throughout a given refueling cycle (18 months).

The process used to calculate the risk metrics complies with NRC Regulatory Guides 1.174 and 1.177.

TABLE 3 -1 QUANTITATIVE RESULTS OF THE RISK METRICS FOR CONCURRENT UNAVAILABILITY OF TWO CFCUS PARAM ETER VALU E COMMENTS T cvcLE 547.5 days Based on 1 8 month refueling cycle T cFcu 1 4 days Number of days that two CFCUs are unavailable CDF based on application of flag file for two CDFcFc u 1 .62E-05 unavailable CFCUs and adjusted CCF term LERF based on application of flag file for two LERF c Fcu 7.32E-07 unavailable CFCUs and adjusted CCF term CDF sASE 1 .55 E-05 CDF for PRA MOR LERF sAs E 7.29E-07 LERF for PRA MOR Average CDF over one 1 8 month refueling cycle CDFAVE 1 .55E-05 for three instances of dual CFCU unavailability for 14 days at a time Average LERF over one 1 8 month refueling cycle LERFAVE 7.29E-07 for three instances of dual CFCU unavailability for 1 4 days at a time Difference between CDF with current technical specifications and the CDF for an average 1 8 CDF 5.61 E-08 month cycle with three instances of concurrent unavailability of two CFCUs extended to 1 4 days This value is below Region I l l of RG 1 .1 74 Difference between LERF with cu rrent technical specifications and the LERF for an average 1 8 LERF 2.1 5 E-1 0 month cycle with three instances of concurrent unavailability of two CFCUs extended to 1 4 days This value is well below Region I l l of RG 1 .1 74 ICCDPcFcu 2.80E-08 Below 1 E-06 Acceptance Guideline of RG 1 . 1 77 I CLERP cFcu 1 .08E-1 0 Below 1 E-07 Acceptance Guideline of RG 1 .1 77 3 . 4.6 Discussion of Risk Due to External Events Salem does not have separate probabilistic risk assessments (PRA) for Fire, External Flood or Seismic events. An internal Fire PRA (FPRA) is currently under development.

The FPRA was developed as part of the station license renewal project. However, the 3-1 1 SA-LAR-007

Salem Generating Station CFCU AOT Extension FPRA did not undergo an industry peer review as required by NRC Regulatory Guide 1.200 for use in risk informed regulatory applications. PSEG is working to complete the FPRA. The current version, which follows the methodology of NUREG/CR-6850 with some incorporation of more recent data and methods can be used to provide valuable insights, but not quantitative information. The project is expected to culminate with an industry peer review. Seismic events are not currently included in the MOR. The Seismic PRA development for both Salem and Hope Creek is being considered as part of a PSEG Nuclear long-term planning strategy, which will determine the need for such an analysis using PRA methods. External Flood, Low Power/Shutdown, as well as other external events are also being considered as part of a long-term risk management program strategic plan.

Like most nuclear power stations, Salem completed an Individual Plant Examination of External Events in 1996. The summary of that work can be found in the Document Control and Records Management System (DCRMS) as VTD 320758 [10]. Section 1.4 summarizes the major findings and states that fire and seismic events were the only important contributors to external events core damage. The fire related CDF was 2.3E-05 per year. The seismic related CDF was 9.5E-06 per year using a more conservative hazard curve (LLNL) and 4.7E-06 per year using a curve described as more realistic (EPRI).

Section 1.4.3 of the IPEEE explains how the risk of High Winds, External Flood and other external events were screened out as insignificant. The risk due to fire and seismic events is discussed in the following sections.

3 .4.7 Discussion of Fire Risk Section 1.4.2 of Salem's IPEEE discusses the station fire risk. The total CDF from fire events was calculated to be 2.3E-05 per year. The top four scenarios are described as follows:

24% of the total CDF (5.5E-06 per year) caused by a fire in the relay room that damages more than one cabinet and requires control room abandonment. Core cooling by alternate shutdown methods is unsuccessful, leading to core damage.

3-1 2 SA-LAR-007

Salem Generating Station CFCU AOT Extension

9.1% of the total CDF (2.1E-06 per year) caused by a fire in the control room which damages consoles 1, 2, or 3 and requires control room abandonment.

Core cooling by alternate shutdown methods is unsuccessful, leading to core damage.

7.4% of the total CDF (1.7E-06 per year) caused by a relay room fire with damage limited to one electrical cabinet. Control room functions remain available but degraded. Core cooling is unsuccessful, leading to core damage.

4.6% of the total CDF (1.1E-06 per year) caused by a control room fire with damage limited to control console 3. Equipment damage requires control room abandonment. Core cooling by alternate shutdown methods is unsuccessful, leading to core damage.

Another perspective of fire risk is the relative importance for a fire in each area. The top four areas are the relay room (31%), control room (30%), the 460VAC switchgear room (7%), and the 4kVAC switchgear room (7%). Core damage following a relay or control room fire arise primarily from failure to implement alternate shutdown methods following control room abandonment. The switchgear room fires cause loss of one vital bus.

Additional equipment becomes unavailable if the fire is not suppressed. Random failures of equipment unaffected by fire lead to core damage for these scenarios.

The Work-in-Progress (WIP) Fire PRA was used to gain insights into the risk impact that would be expected given the concurrent unavailability of two CFCUs. The results showed that although the power and control cables are routed through the rooms identified above (and others), the WIP Fire PRA has a high dependence on offsite power. In particular, the simultaneous unavailability of two CFCUs yielded a minimal increase in risk of about two orders of magnitude below the base level Fire CDF. The risk increase was dominated by loss of offsite power (LOOP) scenarios in which the operator fails to isolate the excess letdown line from the RCS, followed by subsequent operator failure to align the RHR system to deliver water to the containment spray system. Although the failure to isolate the excess letdown flowpath is postulated to result in a LOCA, the excess letdown line is not normally in service, except for transition periods such as during startup operations. Because the letdown line is not normally in service during full power operation, the perceived risk increase for fire hazards would most likely be negligible.

3-1 3 SA-LAR-007

Salem Generating Station CFCU AOT Extension 3 .4.8 Discussion of Seismic Risk Section 1.4.1 of Salem's IPEEE reports four significant contributors to seismic related CDF, all associated with station blackout (SBO). These four scenarios represent 78%

of the total seismic related CDF based on the more conservative LLNL hazard curve:

31% of the total CDF (2.9E-06 per year) is caused by seismic damage to the switchyard ceramic insulators that leads to a loss of offsite power (LOOP). This is coupled with non-seismic failures of the emergency diesel generators (EDGs) or EDG support systems.

14% of the total CDF (1.3E-06 per year) is caused by seismic damage that causes both a LOOP and loss of service water (LOSW). Service water is required to support the EDGs. Therefore, the LOSW leads to a loss of EDGs.

21% of the total CDF (2.0E-06 per year) is caused by seismic damage that causes both a LOOP and a loss of battery trains 'A' and 'B'. DC power from the batteries is required to start the EDGs. Therefore, the 'A' and 'B' EDGs fail to start. The station has two diesel fuel oil transfer pumps (DFOTPs) powered from the A and 'B' vital buses. The 'C' EDG eventually fails when the associated fuel oil day tank is depleted.

12% of the total CDF (1.2E-06 per year) is caused by seismic damage that causes both a LOOP and failures of main control room instrumentation and control (I&C) caused by ceiling grid collapse.

Relay chatter was not considered significant to safe shutdown, and no vulnerability to containment failure or containment bypass leading to early failure was identified.

The review of the dominant cutsets related to extending the AOT for CFCUs did appear to have contributions stemming from LOOP scenarios, but it was the lack of adequate containment heat removal due to loss of CFCUs that prevented successful sump recirculation, which would be subsumed by SBO scenarios due to the fact that a loss of all AC power would prevent operation of the Emergency Core Cooling System (ECCS) pumps, i.e., RHR pumps. As such, it can qualitatively be inferred that there would be no significant impact on seismic risk due to extending the AOT for two CFCUs up to a period of 14 days.

3 .4.9 Summ ary of Results In looking at the increase in risk due extending the AOT for CFCUs, the dominant failure mechanism is the loss of sump recirculation following either feed and bleed operation or 3-1 4 SA-LAR-007

Salem Generating Station CFCU AOT Extension injection to mitigate LOCA events. Internal flood scenarios in the Mechanical Penetration room on the 78 elevation that damage AOVs affecting the flow of Service Water to the CFCUs inside containment combined with random failures of the Containment Spray system are responsible for loss of containment heat removal, which then can lead to loss of the Net Positive Suction Head (NPSH) for the Residual Heat Removal (RHR) pumps that transfer water from the containment sump to the injection pumps for recirculation back into the Reactor Coolant System (RCS). Heat removal from the RCS would be accomplished via the Component Cooling Water (CCW) system.

Table 3 2 shows the relative risk increase with regard to CDF for the dominant initiating events when comparing the nominal base level cutsets with those cutsets for the extended CFCU AOT using the delete term method of comparison between the two cutset files.

TABLE 342 DOMINANT RISK CONTRIBUTORS ATTRIBUTED TO EXTENDED CFCU AOT PERCENT INITIATOR TYPE DIFFERENCE Small and Medium LOCAs 37.60%

Loss of Offsite Power Events (LOOPs) 25.40%

Flooding in Flood Zone MP 078 21.1%

Transients with Loss of Feedwater 7.50%

Other Internal Events 8.40%

Although the change in LERF was relatively insignificant for this analysis, the change in risk was dominated mostly by LOOP and transient scenarios. These accident sequences involved random failures of the remaining CFCUs and containment spray failure in combination with a pre existing containment leakage pathway to the environment.

Based on the results discussed above in Section 3.4.7 for fire hazards, it was deemed that any perceived risk increase would be negligible. For seismic hazards, Section 3.4.8 discussed that the impact would be minimal since the dominant sequences for 3 15 SA LAR 007

Salem Generating Station CFCU AOT Extension seismic events do not involve scenarios where containment sump recirculation is required, which would only be required following depletion of the Refueling Water Storage Tank (RWST) during feed and bleed operation or mitigation of LOCA events.

The results presented in Table 3-1 are well below the regulatory guidelines for a license amendment request:

The L'lCDF and L'lLERF risk metrics are well below the RG 1 .174 acceptance guidelines for Region Ill, i.e., very small risk change.

The ICCDP for the CFCU AOT is well below the RG 1.177 acceptance guideline.

The ICLERP for the CFCU AOT is well below the RG 1 .177 acceptance guideline.

3 .5 PARAMETRIC UNCERTAINTY EVALUATION The evaluation of the CDF for the CFCU extended AOT assessment has been supported by a detailed qualitative and quantitative uncertainty evaluation. The parametric uncertainty quantification is performed using the CAFTA utility, UNCERT, to identify the effect of the parametric correlation. The base model (SA112B) uncertainty distribution for CDF of the application specific model is presented in Figure 3-1. The uncertainty distribution for CDF due to the condition in which two CFCUs (#1 and #3) are unavailable for a period of 14 days is shown in Figure 3-2. Likewise, for LERF, the base model uncertainty distribution is presented in Figure 3-3, with the AOT extension uncertainty distribution for LERF shown in Figure 3-4.

In addition, a set of practical sensitivity evaluations have been performed to demonstrate the influence of some of the key assumptions in the assessment. These sensitivities are discussed in Section 5.

3-1 6 SA-LAR-007

Salem Generating Station CFCU AOT Extension I

I (l4 l v

.J -

lEo!l!

CONFIDENCE PARAMETER ESTIMATE RANGE Point Est 1 .55E-05 Samples 20000 Mean 1 . 59E-05 [ 1 .6E-05 , 1 .6E-05]

5th percentile 7.49E-06 [7.4E-06, 7.6E-06]

Median 1 . 39E-05 [1 .4E-05 , 1 .4E-05]

95th percentile 3 . 02 E-05 [3. OE-05 , 3.1 E-05]

StdDev 1 . 01 E-05 Skewness 2 1 .96886 Sampling Method Montecarlo Sample Size 20000 Cutset File(s) CDF E-1 1 .CUT Selected Target(s) CDF E-1 1 Database SA 1 1 2B.rr FIGURE 3-1 PARAMETRIC UNCERTAINTY DISTRIBUTION FOR SALEM BASE MODEL CDF (SA112B) FOR THE CFCU AOT EXTENSION APPLICATION MODEL 3-1 7 SA-LAR-007

Salem Generating Station CFCU AOT Extension

- I I

!14 l 1/

"" /

lE-&1 lA.

\

f \

l \

) .... .. ..

CONFIDENCE PARAM ETER ESTI MATE RANGE Point Est 1 .62E-05 Samples 20000 Mean 1 .65E-05 [ 1 .6 E-05 1 .7E-05]

I 5th percentile 7. 82E-06 [7.8E-06 7.9E-06]

I Median 1 .44E-05 [1 .4E-05 1 .4E-05]

I 95th percentile 3.1 6E-05 [3. 1 E-05 3.2E-05]

I StdDev 9.74E-06 Skewness 1 1 .57679 Sampling Method Montecarlo Sample Size 20000 Cutset File(s) CDF_1 1 -1 3.CUT Selected Target(s) CDF_1 1 - 1 3 Database SA1 1 2B.rr FIGURE 3-2 PARAMETRIC UNCERTAINTY DISTRIBUTION FOR SALEM CDF REPRESENTING THE CFCU AOT EXTENSION 3-1 8 SA-LAR-007

Salem Generating Station CFCU AOT Extension

/'

n; I

- /

/

/ -

/\

t

. \

l IE.JB 1E*lll I I I I CONFIDENCE PARAM ETER ESTIMATE RANGE Point Est 7.29E-07 Samples 20000 Mean 7.44E-07 [7.3E-07 , 7.5E-07]

5th percentile 2 . 1 OE-07 [2. 1 E-07 , 2.1 E-07]

Median 5.50E-07 [5.4E-07 , 5.6E-07]

95th percentile 1 .84E-06 [1.8E-06 , 1 .9E-06]

StdDev 7.69E-07 Skewness 9. 089499 Sampling Method Montecarlo Sample Size 20000 Cutset File(s) LERF E-1 2.CUT Selected Target(s) LERF_E-1 2 Database SA1 1 2B.rr FIGURE 3- 3 PARAMETRIC UNCERTAINTY DISTRIBUTION FOR SALEM BASE MODEL LERF (SA1 1 2B) FOR THE CFCU AOT EXTENSION APPLICATION MODEL 3-1 9 SA-LAR-007

Salem Generating Station CFCU AOT Extension v

I OA I --

/

iL " . .

A

\

l

\,

IJ--D..

1&111 CONFIDEN C E PARAIVIElTE R ESTI MATE RANGE Point Est 7.32E-07 Samples 20000 Mean 7.43E-07 [7.3E-07 , 7.5E-07]

5th percentile 2.10E-07 [2.1 E-07 , 2.1 E-07]

Median 5.50E-07 [5.4E-07 , 5.6E-07]

95th percentiles 1 .81 E-06 [1.8E-06 , 1.9E-06]

StdDev 8.32E-07 Skewness 16.96292 Sampling Met:ho*d Montecarlo Sample Size 20000 Cutset File(s) LERF_12-13.CUT Selected T ar9!Jel(s) LERF 1 2-13 Database SA112B.rr FIGURE 3- 4 PARAMETRIC UNICIERTAINTY DISTRIBUTION FOR SALEM LERF REPRESENTING THE CFCU AOT EXTENSION 3-20 SA-LAR-007

Salem Generating Station CFCU AOT Extension 4.0 TECHNICAL ADEQUACY OF THE PRA MODEL This section summarizes the following with respect to the Salem PRA and its technical adequacy:

PRA Quality

Technical Adequacy Conclusion

External Events Considerations 4.1 PRA QUALITY The SA112A version of the Salem PRA model is the most recent evaluation of the risk profile at Salem for internal event challenges. The Salem PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, and common cause events. The PRA model quantification process used for the Salem PRA is based on the event tree and linked fault tree methodology, which is a well-known methodology in the industry.

However, in the performance of this analysis, it was discovered during a review of the initial results using the SA 112A model that some cutsets were found to include late failures of the AFW system along with containment cooling failures. Containment cooling was shown to not be necessary for these scenarios based on a thermal hydraulic sensitivity analysis using the MAAP computer code. Because of this, an application specific model known as the SA1128 PRA model was created to accommodate this change (see Section 3.4.3). The SA1128 PRA model is documented in risk application SA-MISC-016, "Application Specific Model for CFCU LAR."

PSEG employs a multi-faceted approach to establishing and maintaining the technical adequacy and plant fidelity of the PRA models for all PSEG nuclear generation. This approach includes a proceduralized PRA maintenance and update process, which includes consideration of peer review Facts and Observations (F&Os) and their subsequent resolution.

PRA quality is assured for the Salem PRA model and documentation through a combination of the following:

4-1 SA-LAR-007

Salem Generating Station CFCU AOT Extension

Confirmation of the fidelity of the model with the as-built, as-operated plant (see Section 4.1.1)

Use of methods and approaches consistent with the ASME PRA Standard

Use of an Updating Requirement Evaluation (URE) database to track PRA model issues and potential enhancements (See Section 4.1.2)

Use of a PRA Peer Review (see Section 4.1.3) to identify areas for enhancement

Use of highly qualified PRA practitioners qualified under the PSEG PRA Risk Management Program

Use of internal reviews and interviews with system engineers and operating crew members 4.1 . 1 PRA Maintenance and Update The PSEG risk management process ensures that the applicable PRA model remains an accurate reflection of the as-built and as-operated plants. This process is defined in the PSEG Risk Management program, which consists of a governing procedure (ER-AA-600, "Risk Management") and subordinate implementation procedures. PSEG procedure ER-AA-600-1 015, "FPIE PRA Model Update" delineates the responsibilities and guidelines for updating the full power internal events PRA models at PSEG nuclear generation sites. The overall PSEG Risk Management program, including ER-AA-600-1015, defines the process for implementing regularly scheduled and interim PRA model updates, for tracking issues identified as potentially affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, industry operating experience), and for controlling the model and associated computer files. To ensure that the current PRA model remains an accurate reflection of the as-built, as-operated plant, the Site Risk Management Engineer (SRME) reviews plant design modifications and any changes to plant procedures or calculations referenced in the PRA that could affect the risk profile and identifies any that need to be evaluated for consideration in future PRA updates per ER-AA-600-1015. Plant modifications and 4th procedure revisions to associated with the AFW pump and the changes associated with the Extended Loss of AC Power (ELAP) Fukushima-driven modifications led to the recent PRA update known as SA1115A. The effect on the outcome of this PRA analysis for the CFCU AOT extension was shown to be small in a sensitivity analysis.

4-2 SA-LAR-007

Salem Generating Station CFCU AOT Extension Because of this, the entire analysis was not re-performed following completion of the PRA update.

In addition to these activities, PSEG risk management procedures provide the guidance for particular risk management and PRA quality and maintenance activities. This guidance includes:

Documentation of the PRA model, PRA products, and bases documents

The approach for controlling electronic storage of Risk Management (RM) products including PRA update information, PRA models, and PRA applications

Guidelines for updating the full power, internal events PRA models

Guidance in the use of quantitative and qualitative risk assessments in support of the on-line work control process for risk evaluations of maintenance tasks (corrective maintenance, preventive maintenance, minor maintenance, surveillance tests and modifications) on systems, structures, and components (SSCs) within the scope of the Maintenance Rule (10CFR50.65 (a)(4))

In accordance with this guidance, regularly scheduled PRA model updates occur approximately every three years, with longer intervals being justified if it can be shown that the PRA continues to adequately represent the as-built, as-operated plant. PSEG completed the SA112A PRA model in September 2014, which was the result of a regularly scheduled update of the PRA model. Although a recently updated PRA MOR was finalized in December 2016, it was not available by the time that the PRA analysis for the CFCU AOT extension was completed. However, the PRA quality discussion is also applicable to the SA115A PRA model since it also contains the earlier resolution of facts and observations (F&Os) that were incorporated in the SA1 12A PRA model. An additional sensitivity analysis was performed using the SA115A PRA model (see Section 5.5.3).

4.1 .2 Pending Changes Identified Against the PRA Model A PRA tracking database record is created for all issues that are identified that could impact the PRA model. This database, the Updating Requirement Evaluation (URE) database includes the identification of those plant changes that could impact the PRA model.

4-3 SA-LAR-007

Salem Generating Station CFCU AOT Extension The plant modifications, procedure changes, and other PRA model issues identified in the URE database have been reviewed as part of the preparation of the risk assessment for the CFCU AOT extension request. None have been identified that would significantly affect the SA112A PRA model or its quantification.

4.1.3 Applicability of Peer Review Findings and Observations A PRA Peer Review of the Salem Rev. 4.1 PRA model was performed during November 2008. The peer review was performed against the ASME PRA Standard [4]

using the process defined in Nuclear Energy Institute (NEI) 05 04 [27]. The PRA Peer Review resulted in a number of F&Os that indicated that there were a number of supporting requirements (SRs) that were categorized as Not Met for Capability Category II. Since then, a subsequent model revision (SA112A) was performed to address all of these F&Os.

A summary of the disposition of the 2008 Industry PRA Peer Review F&Os for the Salem PRA model was documented as part of the PRA Technical Adequacy for MSPI in the Salem MSPI Basis Document [5]. Additionally, many of the F&Os not related to MSPI were also addressed as part of the PRA model update that resulted in the SA112A PRA model, which is documented in Appendix G of the PRA model Quantification Notebook [6].

Tables 4 1 through 4 9 summarize each of the F&Os identified during the peer review that was performed in November 2008 and reported in Reference [7] with a brief summary of the resolution for each. A listing of those Supporting Requirements (SRs) that were revised between the 2005 [4] and the 2009 [11] versions of the ASME PRA Standard with a description of the change and associated comments is provided in Table 4 10. In addition, a gap assessment was also performed against the NRC clarifications in Appendix A of RG 1.200 [3] with regard to the ASME Standard [11] and comments tabulated in Table 4 11.

Subsequent to the November 2008 peer review [7], the SA112A PRA model [6]

addressed and resolved those SRs not meeting Capability Category II. Based on the PRA Peer Review process and the updated PRA model (SA112A), the Salem PRA model is deemed satisfactory for use in PRA applications.

44 SA LAR 007

Salem Generating Station CFCU AOT Extension 45 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 441 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INITIATING EVENTS ANALYSIS RA4Sa4 RA4Sb4 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 2005 SR # Category F&Os SR #

The plant specific search only addresses supporting systems. The listing is not encompassing of possible plant specific initiators found Table 2 2 in the IE notebook (SA PRA 001), which was revised IE A1 IE A1 IE A1 01 at other plants such as a loss of charging (impact on RCP seal during the 2012 PRA model update, lists the basis for this event not cooling). Loss of charging would lead to a reactor trip and would being a unique plant trip initiator. No further action required.

decrease redundancy for RCP seal cooling.

Consideration of some initiating events may be required based on IE A2 IE A2 SR Met N/A shutdown requirement.

The plant specific history indicates that on 12/31/01 an event SR IE A3 001, Spurious SI was added to the SA112A model as initiating event Tsi.

IE A3 IE A3 occurred resulting in SI. The categorization of initiating events does Not Met IE A3 002 No further action required.

not account for this or the case of ESFAS actuation.

Section 2.1 of the initiating events notebook indicates that comparisons were made to industry data and to other plants.

The available documentation lists that past PRAs are examined.

SR Additional information was added to the IE notebook (SA PRA 001, IE A4 IE A3a IE A3 001 However, there appears to be no documentation of this evaluation Not Met rev. 1) at the end of Section 2 to compare initiators from Watts Bar, with consideration of plants of similar design.

South Texas Project, Surry, and Byron/Braidwood. No further action required.

The observation associated with IE A4 says, The analysis only addresses support systems and does not address the impact of other operating systems (such as charging) with regard to events resulting in a plant upset and subsequent trip signal. IE A4 asks for The analysis only addresses support systems and does not address SR Met: a systematic review of plant systems to identify potential initiating IE A5 IE A4 IE A4 001 the impact of other operating systems (such as charging) with regard (CC I) events. A systematic review was performed in the IE notebook and to events resulting in a plant upset and subsequent trip signal.

documented in Table 2 2. Loss of charging was not included as a separate initiator based on screening criterion identified in the initiating events notebook. Also, see the response for SR IE A1. No further action required.

SR See supporting requirement IE A4. Not all potential systems were IE A6 IE A4a IE A4 001 N/A Not Met addressed.

Appropriate evidence exists that LERs were reviewed for other than "at power" conditions to determine whether or not a new initiator should be added that was not already incorporated into the PRA SA PRA Initiating Events Notebook, SA PRA 001, Revision 0, model SR Section 2.1.2 describes the review of Salem Generating Station IE A7 IE A5 IE A5 01 (\\erinpa21\Customers\PSEG_Salem\brad_turnover\peer_review_rel Not Met Experience and Trip Review. No mention is made of consideration ated\support_for_model_development\s1r41\ie\Initiating Events\plant of events that occurred at conditions other than at power operation.

data\salem_lers\). The LERs reviewed are documented in the initiating evetns notebook (SA PRA 001 revision 1). No further action required.

46 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 441 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INITIATING EVENTS ANALYSIS RA4Sa4 RA4Sb4 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 2005 SR # Category F&Os SR #

SA PRA Initiating Events Notebook, SA PRA 001, Revision 0, Maintenance Rule Expert Panel meeting was held on 10/5/2012 to Section 2.1.2 does not indicate that plant operations, maintenance, review the updated Initiating Events Notebook and comments were SR Met:

IE A8 IE A6 IA A6 01 engineering, and safety analysis personnel were interviewed or incorporated. See Section 2 of the IE notebook (SA PRA 001, (CC I) included in the review process for the initiating events notebook to revision 1) for discussion of this review by plant personnel. No determine if potential initiating events have been overlooked. further actions required.

A list of LERs was previously reviewed for the existence of any initiating event precursors and document in the aforementioned spreadsheet located in the following LAN location:

SA PRA Initiating Events Notebook, SA PRA 001, Revision 0, \\Njnbufp19\PSEG Power\System Engineering\Salem\PRA\SA112A SR Met: Section 2.1.2 does not indicate that a review of plant specific or Files and Documents\Supporting Documents\Initiating Events. A IE A9 IE A7 IE A7 01 (CC I) industry operating experience was performed for the purpose of statement was added to the IE notebook documenting that this identifying initiating event precursors. review was previously performed. Since industry information was also reviewed in addition to plant specific information, this SR could actually be considered as being met at Capability Category III. No further action required.

IE A8 IE A8 This SR was deleted in RA Sb 2005. N/A IE A9 IE A9 This SR was deleted in RA Sb 2005. N/A SA PRA Initiating Events Notebook, SA PRA 001, Revision 0, Section 2.1.3 describes the consideration of multi unit site initiating IE A10 IE A10 SR Met events. Based on that analysis, dual unit initiating events for loss of N/A service water, loss of control air, and loss of offsite power were included.

IE B1 IE B1 SR Met N/A A structured process was followed in the grouping of the initiating IE B2 IE B2 SR Met N/A events.

Initiating events may be grouped reasonably in accordance with SR IE B3 as long as the impacts are comparable to existing initiators The potential for SI actuation is placed in the general transient and the grouping does not impact significant accident sequences.

category with events such as reactor trip and considered to be no SR Spurious SI will generally be recovered (by resetting SI) and the IE B3 IE B3 IE B3 001 worse than the reactor trip. However, unmitigated SI events can Not Met event will be a transient. If SI is not reset prior to PORV operation, a challenge a PORV resulting in a consequential LOCA. These two logic change was added to the SA112A PRA model to transfer to the events should not be grouped.

small LOCA event tree. See the Initiating Events Notebook for further details (SA PRA 001). No further action required.

IE B4 IE B4 SR Met Grouping of initiating events was performed. N/A 47 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 441 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INITIATING EVENTS ANALYSIS RA4Sa4 RA4Sb4 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 2005 SR # Category F&Os SR #

SA PRA Initiating Events Notebook, SA PRA 001, Revision 0, Section 2.1.3 describes the consideration of multi unit site initiating events. Based on that analysis, dual unit initiating events for loss of IE B5 IE B5 SR Met N/A service water, loss of control air, and loss of offsite power were included. There is no indication that these events were subsumed into other events.

Based on a review of Sections 3.0 of Salem SA PRA 001, Revision 0, "Initiating Events", initiating event frequencies have been calculated using relevant generic and plant specific data. Generic As part of updating initiating event frequencies, use of newer loss of data is from NUREG/CR 5750 Rates of Initiating Events at U.S. offsite power (LOOP) data was incorporated into the CAFTA model Nuclear Power Plants: 1987 1995. More recent industry sources of database as part of the 2012 PRA update, including dual unit LOOP IE C1 IE C1 SR Met IE C1 01 initiating event data such as from NUREG/CR 6928, "Industry events. See the Initiating Events Notebook for further details (SA Average Performance for Components and Initiating Events at U.S. PRA 001). The normal PRA update process (ER AA 600 1015)

Commercial Nuclear Power Plants," should be used. For initiators ensures that this activity is routinely performed. No further action when plant specific data is available, the initiating event frequency is required.

calculation by Bayesian updating the industry prior with the plant specific data.

The most recent applicable plant specific data has been used to quantify the initiating event frequencies, based on a review of IE C2 IE C1a SR Met N/A Section 3.1 of Salem SA PRA 001, Revision. 0, "Initiating Events" the plant specific data is from 10/1/2000 to 12/31/2006.

Section 3.3 of the Salem SA PRA 001, Revision 0 notebook has a brief discussion of the special initiators developed using fault trees.

It references the applicable system model notebooks along with the basic event for the initiator in the fault tree. For the loss of SW Support system initiators that were developed using fault trees were initiator, notebook SA PRA 005.13, Revision 0 was reviewed for the identified in the Initiating Events Notebook (SA PRA 001 revision 1)

IE C3 IE C1b SR Met IE C1b 01 modeling of the initiator. There was no description of the how the with reference made to the applicable system notebook for model loss of SW initiator is modeled as an initiator. Also, there did not development and details. No further action required.

appear to be documentation of the recoveries credited in the initiator fault trees and whether the actions are justified for preventing the initiator. This SR is considered met but SR IE D2 will be considered not met for documentation.

Based on a review of Section 3.2 of the Salem SA PRA 001, IE C4 IE C2 SR Met Revision 0 notebook, Bayesian updating has been performed N/A appropriately and complies with this SR.

The initiators that are fault trees, loss of SW, loss of Capability This was implemented in the CAFTA PRA model SA112A.CAF with SR Category, loss of control area ventilation, and others, do not appear the event AVAIL FACTOR set to the value of 0.925 as determined in IE C5 IE C3 IE C3 01 Not Met to be based on reactor year. For example, under gate IE TSW, the Initiating Events Notebook (SA PRA 001). No further action basic event SWS PIP RP TBHDR has a mission time of 8760 hours0.101 days 2.433 hours 0.0145 weeks 0.00333 months . required.

48 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 441 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INITIATING EVENTS ANALYSIS RA4Sa4 RA4Sb4 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 2005 SR # Category F&Os SR #

Quantitative screening does not appear to be performed, based on a review of the Salem SA PRA 001, Revision 0 notebook. Therefore, subsection a) and b) of this SR are considered met. However, SR IE C6 IE C4 IE A1 01 subsection c) of this SR does not appear to be met as noted in the e See above response for SR IE A1.

Not Met review for SR IE A1, some events that require the plant to be shut down due to technical specifications were screened (e.g., loss of a 4KV bus).

IE C7 IE C5 SR N/A Time trend analysis is not required for a Capability Category II rating. N/A Section 3.3 of the Salem SA PRA 001 Revision 0 notebook provides some limited description of the initiators that are fault trees. Details of the modeling of the system fault tree are provided in the applicable system notebooks. Applicable systems analysis requirements for fault tree modeling appear to have been used. The IE C8 IE C6 SR Met IE C1b 01 N/A initiating event modeling is performed to the same level of detail as the fault trees used for the modeling of post initiator operation of mitigating systems and appears to be appropriate. The documentation of the development of the initiator fault trees could be enhanced.

Initiating events that rely upon fault tree modeling correctly produce IE C9 IE C7 SR Met N/A failure frequencies rather than top event probabilities.

The logic under gates IE TSW and IE TCC were reviewed in fault tree SIR4.Caf. The fault tree models used to calculate initiating event frequencies appear to model all relevant combinations of IE C10 IE C8 SR Met N/A events involving the annual frequency of one component failure combined with the unavailability (or failure during the repair time of the first component) of other components.

The logic under gates IE TSW and IE TCC were reviewed in fault tree SIR4.Caf. A human reliability analysis was used to calculate the IE C11 IE C9 SR Met probability of failure of the operator actions credited under these N/A gates as documented in Salem model notebook SA PRA 004, Revision 0.

Tables 3 6 and 3 7 contain a comparison of the initiator frequencies used in the Salem model as compared with NUREG/CR 5750.

However, there is no comparison with other sources. Since many of the frequencies used in the Salem model use the same frequencies This was performed and documented in the IE notebook (SA PRA IE C12 IE C10 SR Met IE C10 01 used in the Salem model as compared with NUREG/CR 5750. 001, Revision 1) as part of the 2012 PRA update. No further action However, there is no comparison with other sources. Since many of required.

the frequencies used in the Salem model use the same frequencies from NUREG/CR 5750, such as the LOCAs, the tables should be updated with a comparison with other similar plants.

49 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 441 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INITIATING EVENTS ANALYSIS RA4Sa4 RA4Sb4 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 2005 SR # Category F&Os SR #

SR Met (CC Initiating event frequencies for rare events and extremely rare events IE C13 IE C11 N/A I/II) are based on generic data.

Section 3.5 of the Salem SA PRA 001, Revision 0 notebook provides some description of the ISLOCA screening, quantification of SR Met (CC the initiator frequency and the event tree development. The details IE C14 IE C12 N/A I/II) of the ISLOCA analysis are contained in PLG Report Number PLG 0826, Containment Bypass Analysis. The analysis considers the requirements in this SR as appropriate.

Mean values and error factors are developed for the initiating event IE C15 IE C13 SR Met frequencies modeled as documented in Sections 3.2, 3.3 and 3.4 of N/A the Salem SA PRA 001, Revision 0.

The initiating event analysis documentation is a logical format consistent with the major high level requirements for initiating event IE D1 IE D1 SR Met N/A analysis. Improvements can be made to the notebook as noted by the F&Os in the other SRs.

The Salem initiating event notebook SA PRA 001, Revision 0 provides good documentation of the identification, grouping, and evaluation of plant specific data, screening and quantification of the IE D2 IE D2 SR Met N/A frequencies. However, as noted in a number of the F&Os for HLR IE A, B and C, the notebook lacks sufficient documentation for verifying the requirements of some SRs.

While assumptions are documented to some degree in the Salem This issue of uncertainty and key assumptions has been addressed SR SC C3 01, SA PRA 001, Revision 0 notebook, a systematic review/listing of with the creation of the PRA Uncertainty Notebook (SA PRA 018)

IE D3 IE D3 Not Met SC C3 02 assumptions and sources of uncertainty as defined by the Standard during the PRA model update that resulted in the PRA Model of is not documented or referenced in the initiating events notebooks. Record SA112A. No further action required.

4 10 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 442 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR ACCIDENT SEQUENCE ANALYSIS RA4Sa4 RA4Sb4 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 SR 2005 SR Category F&Os Accident Sequences and Event Tree Development Notebook, SA PRA 002, Revision 0 describes the method used for development of the Event tree figures were included in the Accident Sequence Event accident sequences and event trees covering all three required aspects.

AS A1 AS A1 SR Met AS A1 01 Tree (SA PRA 002, revision 1) notebook as Appendix A. No further The graphical representation of the event trees is not included in the action required.

notebook, but is available through reference to the appropriate CAFTA event tree files.

Accident Sequences and Event Tree Development Notebook, SA PRA 002, Revision 0 describes the method used for development of the AS A2 AS A2 SR Met accident sequences and event trees. Section 2.0 describes the key N/A safety functions necessary to reach a safe, stable state and prevent core damage.

Accident Sequences and Event Tree Development Notebook, SA PRA 002, Revision 0 describes the method used for development of the AS A3 AS A3 SR Met N/A accident sequences and event trees. Sections 3 through 9 define systems that can be used to mitigate each modeled initiating event class.

Accident Sequences and Event Tree Development Notebook, SA PRA 002, Revision 0 describes the method used for development of the AS A4 AS A4 SR Met accident sequences and event trees. Sections 3 through 9 describes the N/A achievement of key safety functions for each initiating event. Operator actions are described in general terms.

Initiating events may be grouped reasonably in accordance with SR IE B3 as long as the impacts are comparable to existing initiators and the grouping does not impact significant accident sequences.

Spurious SI is subsumed into the Turbine Trip initiating event and, Spurious SI will generally be recovered (by resetting SI) and the event AS A5 AS A5 SR Met IE B3 01 therefore, into the General Transient event tree. However, the path will be a transient. If SI is not reset prior to PORV operation, a logic through the EOPs would be different for the two events.

change was added to the SA112A PRA model to transfer to the small LOCA event tree. See the Initiating Events Notebook for further details (SA PRA 001). No further action required.

Accident Sequences and Event Tree Development Notebook, SA PRA AS A6 AS A6 SR Met 002, Revision 0 describes the accident sequences in accordance with the N/A timing of the event to the extent practical.

4 11 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 442 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR ACCIDENT SEQUENCE ANALYSIS RA4Sa4 RA4Sb4 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 SR 2005 SR Category F&Os Accident Sequences and Event Tree Development Notebook, SA PRA 002, Revision 0 delineates the possible accident sequences for each modeled initiating event. However, some sequences are not explicitly modeled in the single top fault tree (e.g., TT sequences S04 and S05 are Sequence endstates that exhibit identical core damage characteristics combined into a single fault tree gate). No documentation was found to were combined. The only reason that there are two different describe the basis of these combinations. In addition, SA PRA 002, endstates identified is to distinguish between an isolated and non Revision 0, Section 3.3.4.5 states that the Te3 and Te4 event trees have SR Met AS A7 01, isolated containment. A revision was made to the Accident Sequence AS A7 AS A7 sequences that were not modeled because they have "very low (CC I/II) AS A7 02 Notebook (SA PRA 002) to state that sequences were combined that frequencies." No basis for this assessment was documented. The VS exhibit identical core damage characteristics under a single gate in the ISLOCA sequence with no piping failure is assumed to be terminated with fault tree logic for Level 1 sequences in order to conserve core operator isolation of the suction path using the pump suction isolation damage numerical results. No further action required.

MOVs. However, isolation cannot be accomplished until primary pressure is reduced. The potential for flooding of adjacent areas by water lost through the RHR pump seals and/or RHR heat exchangers prior to isolation does not appear to have been evaluated.

There is no "double counting" of offsite power recovery being applied in the SA112A PRA model. The concept of a diesel mission run time of 6.2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months that was developed in Section 5.0 of the Data notebook was meant to estimate a "time averaged" value for which the EDG would be required to run and supply AC power prior to recovery of an Accident Sequences and Event Tree Development Notebook, SA PRA offsite power source. The RBU terms that are employed in the PRA 002, Revision 0 and the associated CAFTA event trees define the end model are not recovery terms but flags that are meant to delineate a state of each sequence as success or core damage. However, the SBO particular set of circumstances during a particular accident sequence sequences S08, S11, S14 and S17 are assumed to be successful based to allow the appropriate "recovery before uncovery" probability to be on offsite power recovery. Operator action to restore mitigating systems applied to the cutset in question. This is separate from the run time after power recovery is not addressed. In addition, given the fact that that was calculated in determining how long, on average, the EDG power recovery is only credible out to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , 20 hours2.314815e-4 days 0.00556 hours 3.306878e-5 weeks 7.61e-6 months of mitigating would be expected to run prior to recovery of offsite power, which was system operation and the potential failures of that equipment over a based on the worst set of conditions, i.e., weather related causes.

AS A8 AS A8 SR Met AS A8 01 significant portion of the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission time is not being addressed. This approach is also consistent with other Westinghouse PWR PRA This failure to address recovery of mitigating systems following power models. For the issue of mitigating systems that would be required to recovery does not ensure a safe, stable end state has been reached for function following the possible recovery of offsite power, they are not some SBO sequences. There is also concern that the application of explicitly modeled as being subject to "restart" failures due to the fact offsite power recovery is included twice in the modeling of the SBO event. that system start failures are on the order of 1E 3. However, a Recovery is credited in the application of a diesel mission time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months sensitivity analysis was performed that estimated the frequency of and again through the application of offsite power recovery top event LOOP events that result in successful recovery of offsite power, which RBU. was added to the initiating event frequency for transient events without PCS (%TP). The resultant CDF calculated with this adjusted %TP frequency resulted in a 0.5% increase in CDF and a 0.4% increase in LERF. Because of these small changes in CDF and LERF, there is no expected impact on MSPI results and the requisite change to PRA model logic for these additional sequences can be deferred until a 4 12 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 442 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR ACCIDENT SEQUENCE ANALYSIS RA4Sa4 RA4Sb4 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 SR 2005 SR Category F&Os future PRA update (see URE # 2015 028). For this URE, there is no further action required.

Accident Sequences and Event Tree Development Notebook, SA PRA SR Met:

AS A9 AS A9 002, Revision 0 Section 2.0 indicates that success criteria was based on N/A (CC II) combination of generic, similar plant, and plant specific sources.

Systems and operator actions required to meet each key safety function are discussed in general terms in the Accident Sequences and Event Tree Development Notebook, SA PRA 002, Revision 0 Sections 3 A weighted average analysis of the size of a RCP seal LOCA with through 9. Operator actions and diverse systems to satisfy top events are various configurations of successful means of heat removal mitigation included in the fault tree but are grouped under common top events in the AS AS SR Met: with offsite power non recovery probabilities was performed and is AS A10 01 accident sequence model (e.g., core decay heat removal includes AFS, A10 A10 (CC I) consistent with other Westinghouse PWR models. This is described in operator action to depressurize, and condensate under a common top Appendix D of SA PRA 002 Revision 1. There is no further action event). However, the modeling of offsite power recovery in the SBO required.

event tree does not explicitly model the differences in recovery times or plant response associated with different RCP seal leakage rates. Instead, a single lumped recovery event is modeled.

Transfers between event trees are described in the Accident Sequences Transfer of certain sequences to other event trees is discussed for AS AS SR Met AS A11 01 and Event Tree Development Notebook, SA PRA 002, Revision 0 each event tree in the event tress construction section of the Accident A11 A11 Sections 3 through 9. Sequence Event Tree notebook. No further action required.

This requirement is met by Sections 3 and 9 of the Accident Sequence notebook. These sections identify the mitigating systems and how the AS B1 AS B1 SR Met N/A accident progresses depending the equipment availability. The single top fault tree model explicitly models initiator impacts on mitigating systems.

This requirement is met by Sections 3 and 9 of the Accident Sequence AS B2 AS B2 SR Met notebook. These sections identify the mitigating systems and how the N/A accident progresses depending the equipment availability.

The environmental conditions are considered (Section 3.6) for AS B3 AS B3 SR Met recirculation. The clogging of the sumps is addressed in the system N/A notebook.

AS B4 AS B4 SR N/A This model does not use the split fraction method. N/A This SR is geared towards other methodologies than CAFTA. The event trees and the fault trees are of sufficient detail to address intersystem AS B5 AS B5 SR Met N/A dependencies and train level interfaces. In CAFTA these two requirements are done at the fault tree level.

AS This requirement is addressed in the system models. Therefore it will be AS B6 SR N/A N/A B5a address in the review of the System Notebook.

4 13 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 442 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR ACCIDENT SEQUENCE ANALYSIS RA4Sa4 RA4Sb4 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 SR 2005 SR Category F&Os The SBO/LOOP, battery depletion, and room cooling are all addressed in See above response for SR AS A8. In addition, SBO scenarios are SR the Accident Sequence notebook. However, the lumped treatment of AS B7 AS B6 AS A8 01 relatively insignificant risk contributors within the context of this risk Not Met offsite power recovery into both the diesel mission time calculation and evaluation that supports the proposed CFCU AOT extension.

the RBU recovery factor could overestimate the potential for recovery.

The accident sequences are analyzed in a manner that allows application, AS C1 AS C1 SR Met N/A upgrades, and peer review to be accomplished in a timely.

The HRA and Level 2 notebooks now adequately address procedural guidance and important operator actions in sufficient detail to allow traceability of references used and description of how HEPs are being applied to their appropriate accident sequences. Since the Level 2 SR The operator actions are not part of the event tree as required by this AS C2 AS C2 AS C2 01 logic is explained in detail in Appendices A, B, and C of the Level 2 Not Met Supporting Requirement. The requirements of c, d and e are not met.

Notebook, it was not necessary to expand any of the event trees. The operator actions referred to in the above description are discussed in the Level 2 Notebook. At any event, there is no further action required.

In Notice of Clarification to Revision 1 of Regulatory Guide 1.200, FRN July 27, 2007, Accession number: ML071170054, the NRC provided their clarification related to assumptions and sources of uncertainty. The NRC stated that Key assumptions and sources have meaning only within the scope of an application. For a base PRA, the plant needs to identify and This issue of uncertainty and key assumptions has been addressed SR characterize assumptions and sources of uncertainty. Characterization with the creation of the PRA Uncertainty Notebook (SA PRA 018)

AS C3 AS C3 SC C3 02 Not Met can be qualitative. ANO2 has documented the assumptions that they during the PRA model update that resulted in the PRA Model of used for the accident sequence analyses. The uncertainty notebook is in Record SA112A. No further action required.

draft form and therefore is not reviewable. The uncertainty portion of this requirement is not met. The assumption were in the notebook so this part of the requirement is met. A suggestion is that an assumption section be added to the notebook.

4 14 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 443 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SUCCESS CRITERIA RA4Sa4 RA4Sb4 Capability Associated

SUMMARY

OF RESOLUTION 2009 SR 2005 SR Category F&Os The ASME standard defines core damage as "uncovery and heatup of the reactor core to the point at which prolonged oxidation and severe fuel damage involving a large section of the core is The definition of core damage has been clarified as part of the 2012 SR anticipated." In the Salem PRA Success Criteria Notebook, SA PRA PRA update and properly reflected in both the Success Criteria and SC A1 SC A1 SC A1 01 Not Met 003, a "big picture" definition as described in the ASME PRA standard Accident Sequence Event Tree notebooks. No further action appears to missing. In the Salem PRA, core damage is defined as required.

maintaining core temperature below 1200 degrees F which deals with heatup but not uncovery.

In the Salem PRA, core cooling was defined as successful if core exit temperatures do not exceed 1200 degrees F. This represents the This was a documentation issue that has since been resolved by temperature below which no core damage is expected to occur and revising the Level 1 Success Criteria Notebook (SA PRA 003) to the core exit thermocouple temperature at which the operators definitively state in Section 2.4 that core cooling is successful if the SR transfer to severe accident guidelines. The 1200 degrees F core mass averaged temperature of the hottest core node does not exceed SC A2 SC A2 SC A2 01 Not Met temperature success criteria were interpreted to be the core hottest 1800 deg. F. This is also consistent with the definition of core node temperature (TCRHOT) in MAAP. However, in the TH notebook damage stated in Section 2.2.1 of the Thermal Hydraulic MAAP PRA a peak cladding temperature of 1800 degrees F was referenced. The Notebook (SA PRA 007) that references this same value of 1800 deg.

MAAP code used 1800 degrees as TCRHOT. Also, there is no F. No further action required.

mention of core collapsed liquid level.

N/A SC A3 This SR was deleted in RA Sb 2005. N/A The success criteria for each of the key safety functions is specified in SC A3 SC A4 SR Met N/A the success criteria notebook.

The only system that is shared is the VCA system. This system is SC SC A4 SR Met identified as being shared and the common initiating event is N/A A4a discussed.

Accident sequences are terminated at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , except under two conditions:

SR Met: 1. The plant is brought to a condition where return to power operation SC A5 SC A5 N/A (CC II/III) is possible in less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , or

2. Core damage or containment failure is predicted to occur within a few hours after the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months limitation.

Success criteria are based on plant specific features, procedures and SC A6 SC A6 SR Met N/A operation.

SR Met: Plant specific MAAP analyses have been performed to determine SC B1 SC B1 N/A (CC II) success criteria SC B2 SC B2 SR N/A Expert judgment is not used in the success criteria development. N/A T/H analyses are consistent with the initiating event groups and SC B3 SC B3 SR Met N/A accident sequences.

The MAAP Thermal Hydraulic Calculations Notebook (SA PRA 007, The Success Criteria Notebook (SA PRA 003) has been updated to SR Revision 1), Sections 1.2 and 1.3 provide a discussion of the codes SC B4 SC B4 SC B4 01 properly address this as part of the 2012 PRA update. No further Not Met available and the advantages associated with using MAAP, action required.

respectively. However, MAAP is used in establishing large LOCA 4 15 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 443 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SUCCESS CRITERIA RA4Sa4 RA4Sb4 Capability Associated

SUMMARY

OF RESOLUTION 2009 SR 2005 SR Category F&Os success criteria, although the code is not suitable for analysis of this plant upset. A discussion of code limitations is not provided.

A comparison of general success criteria with that of other SR A check of the reasonableness and acceptability of the success SC B5 SC B5 SC B5 01 Westinghouse plants was provided in Table 2 2 of the Success Not Met criteria results is not documented.

Criteria Notebook (SA PRA 003). No further action required.

The Level 1 Success Criteria Notebook (SA PRA 003, Revision 0),

MAAP4 Parameter File Notebook (SA PRA 009, Revision 1), and This issue has no impact on the quality of the PRA and was only MAAP Thermal Hydraulic Calculations Notebook (SA PRA 007, meant to aid reviewers in identifying where each of the elements of SC C1 SC C1 SR Met SC C1 01 Revision 1) document the success criteria analyses. However, it the PRA Standard are being addressed. As such, this is only a would be helpful to provide a cross reference to the PRA Standard documentation issue and may remain open for now. No further action requirements to facilitate PRA applications, upgrades, and peer required.

reviews.

SC C2 SC C2 SR Met The success criteria development process has been documented. N/A This issue has no impact on the quality of the PRA and is only meant to aid reviewers in identifying what assumptions were made during development of the Success Criteria Notebook (SA PRA 003). Each Assumptions are embedded in the documentation rather than PRA System Notebook (SA PRA 005.####) now has a section that captured in a specific section. Sources of uncertainty are addressed lists assumptions that were made as part of the systems analysis.

SR SC C3 01, SC C3 SC C3 in a draft evaluation using guidance from draft EPRI report, Also, the Uncertainty Notebook (SA PRA 018) was officially issued Not Met SC C3 02 "Treatment of Parameter and Model Uncertainty for Probabilistic Risk and includes a section on model uncertainty and references both Assessments." EPRI 1026511, which addresses the use of PRA and the treatment of uncertainty, and EPRI 1016737, which addresses the treatment of parameter and model uncertainty. As such, there is no further action required.

4 16 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 444 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA4Sa4 RA4Sb4 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 SR # 2005 SR # Category F&Os The system models are consistent with similar PWR PRAs and SY A1 SY A1 SR Met address system responses found in the accident sequence N/A response.

The system model documentation includes references to SY A2 SY A2 SR Met drawings, control logic, procedures and technical specifications. N/A Training drawings are included in the documentation.

Based on documentation for the system notebooks information SY A3 SY A3 SR Met N/A was reviewed.

The system notebooks do not provide any walkdown Plant walkdowns for the systems modeled in the PRA were documented in SR SY A4 SY A4 SY A4 01 information. A walkdown document was made available to the Appendix C of each of the Salem PRA System Notebooks (SA PRA Not Met peer review but has not been reviewed and formally released. 005.#### series). No further action required.

Modeling addresses plant configurations necessary to support SY A5 SY A5 SR Met N/A success criteria.

The system notebooks do not provide definitive explanation of System model boundary diagrams were provided in Section 2.3 of the Salem SR SY A6 SY A6 SY A6 01 boundary information and do not provide illustration of modeled PRA System Notebooks (SA PRA 005.#### series). No further action Not Met components. required.

SR Met:

SY A7 SY A7 N/A (CC III)

Boundary definitions for plant systems were better defined in the PRA System Notebooks (SA PRA 005.#### series) during the 2012 PRA Update by incorporating drawings with highlighted boundaries in order to help the reader better visualize the modeled system boundaries. However, the Data Notebook (SA PRA 010) will need to be revised in order to explain how SR SY A8 SY A8 SY A8 01 Boundaries not defined. component boundaries were defined. In particular, Section 5.1 of Not Met NUREG/CR 6928 contains the definition used for component boundaries that were used for generic industry data. Since this is only a documentation issue, there is no impact on either CDF or LERF, because the appropriate component boundaries for component data were used. As such, this issue has no impact on the results for this license amendment request.

N/A SY A9 This SR was deleted in RA Sb 2005. N/A 4 17 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 444 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA4Sa4 RA4Sb4 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 SR # 2005 SR # Category F&Os Since the Emergency Diesel Generator (EDG) Day Tanks are modeled as being part of the component boundary for the EDGs, the failure probabilities used for the EDG events used in the SA112A PRA model inherently include the failure of Day Tanks to perform their function, e.g., rupture, plugged lines, etc. However, a failure mode that could cause failure of the fuel oil transfer pumps involves miscalibration of the day tank level instrumentation, which was included in the SA112A PRA model. However, the Vital AC SR System Notebook (SA PRA 005.0020) should have a discussion about the SY A9 SY A10 SY A10 01 Diesel generator modeling.

Not Met EDG Day Tanks being part of the component boundary definition used for the EDGs. From a generic standpoint, a list of general assumptions was added to each System Notebook (SA PRA 005.#### series) to describe definition of component boundaries and certain failure modes that could be excluded. Since this is only a documentation issue, there is no impact on either CDF or LERF due to the fact that the appropriate failure modes were considered in the PRA model. As such, this issue has no impact on the results for this license amendment request.

SY A10 SY A11 SR Met N/A Although the Emergency Diesel Generator (EDG) Day Tanks were considered to be within the component boundary of the EDGs (see response to SY A9), the fuel oil transfer system was not, and as such, was explicitly modeled in the SA112A PRA model. Also, there are Human Error Probability (HEP) events included in the SA112A PRA model that model SR Some components listed in the standard supporting requirement SY A11 SY A12 SY A12 01 failure to realign ventilation dampers, e.g., see event RD3 XHE MM Not Met are absent from some system models.

(OPERATORS FAIL TO ALIGN CAV FOR MAINT MODE) in the HRA Notebook (SA PRA 004). This and other HEPs that make use of AB.CAV procedures have been appropriately analyzed in the HRA notebook and included in the SA112A PRA model where appropriate. No further action required.

SY A12 SY A12a SR Met N/A SY A13 SY A12b SR Met Modeling guidance included consideration of divergence paths. N/A 4 18 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 444 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA4Sa4 RA4Sb4 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 SR # 2005 SR # Category F&Os The probability of manual valves transferring shut was not generally modeled as the failure probability is exceedingly low and can be excluded via the use of the criteria found in ASME Supporting Requirement (SR) SY A15: One or more failure modes for a component may be excluded from the systems model if the contribution of them to the total failure rate or probability is less than 1% of the total failure rate or probability for that component when the SR Review of models identified several exclusions of failure modes SY4A14 SY4A13 SY4A13401 effects on system operation are the same. However, SR SY A15 should be Not Met on a global basis without justification.

referred to in Section 3.1 (Generic Assumptions) of each PRA System Notebook to support the decision to exclude low probability events. Since this is only a documentation issue, there is no impact on either CDF or LERF due to the fact that the exclusion of manual valves spuriously changing state was appropriately addressed in the PRA model. As such, this issue has no impact on the results for this license amendment request.

SY A15 SY A14 SR N/A No assessment performed. N/A SR Met:

SY A16 SY A15 N/A (CC III)

SY A17 SY A16 SR Met N/A SY A18 SY A17 SR Met N/A SY A19 SY A18 SR Met N/A SY A20 SY A18a SR Met N/A In general, system components were not modeled to perform beyond their design operating conditions, but if required to do so, this information would be specifically documented in the PRA System Notebooks (SA PRA 005.#### series). Additionally, support systems were also not expected to function successfully under adverse operating conditions beyond their design requirements. In order to clarify that this was a general practice SR followed as part of system modeling, an additional assumption should be SY A21 SY A19 SY A19 01 No documentation of assessment.

Not Met added to the existing list of generic assumptions in Section 3.1 of each PRA System Notebook. However, because this issue involves a documentation issue and is not a deficiency of any technical element, this issue will be resolved pending a future revision to the PRA System Notebooks. The Updating Requirement Evaluation (URE) database entry (URE # SA2015 025) has been recorded to track this issue. As such, this issue has no impact on the results for this license amendment request.

SR Met:

SY A22 SY A20 SY A20 01 No analyses provided. N/A (CC I) 4 19 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 444 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA4Sa4 RA4Sb4 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 SR # 2005 SR # Category F&Os The state of knowledge correlation was addressed as part of the 2012 PRA SR Multiple type code descriptions are used for the same data such SY A23 SY A21 SY A21 01 update. See the Salem PRA Data Notebook (SA PRA 010) for further Not Met that the second part of the SR is not met.

details. No further action required.

SY A24 SY A22 SR Met N/A SR Met:

SY B1 SY B1 N/A (CC II/III)

SR Met:

SY B2 SY B2 N/A (CC I/II)

Due to the small probabilities and uncertainty that is involved with interim CCF combinations involving a population size of 6, it was deemed adequate in modeling the 2 of 6 (loss of one division), 4 of 6 (loss of two divisions), and 6 of 6 event combinations (loss of all three divisions) in estimating the total SR For some cases the selection of CCF combinations are not SY B3 SY B3 SY B3 01 risk associated with DC battery charger common cause failures. The Not Met complete and those selected are not the most limiting.

common cause modeling was limited to only those combinations that are consequential and important to risk. Refer to Appendix D of the Data Notebook (SA PRA 010) for further details. As such, no further action is required.

SR Some combinations are absent which when using MGL can SY B4 SY B4 SY B3 01 See above response for SR SY B3.

Not Met underestimate the CCF contribution.

Since the heated water system was not required as an immediate support system for system success, it was not explicitly modeled due to the fact that freezing of water lines is a slowly developing event with ample time for Documentation for several system notebooks (AFW, CVCS and SR procedural direction and any necessary repair. It was also explicitly stated in SY B5 SY B5 SY B5 01 RWST) indicated that the heated water circulating system was Not Met the system modeling documentation that the heating water system was not required to prevent freezing, but was not modeled.

required during the PRA mission time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , e.g., see Section 2.5.4 of the AFS and MFWS System Notebook (SA PRA 005.0001). As such, no further action is required.

As part of the 2012 PRA Update, all System Notebooks were revised to follow a more consistent outline with information better organized to allow a SR SY B6 SY B6 SY B6 01 No analysis documented more effective review and understanding of the documentation including Not Met sections on shared/ required systems. As such, there is no further action required.

4 20 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 444 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA4Sa4 RA4Sb4 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 SR # 2005 SR # Category F&Os It was apparent that the peer reviewer failed to identify the basis for certain success criteria for ventilation requirements. As part of the 2012 PRA Update, this information has been clarified and references provided for success criteria in the System Notebooks using a more consistent approach that will now make it much easier for the reviewer to identify such information. Also, fault tree modeling and operator actions were updated SR Met: The support system modeling is mostly based on conservative SY B7 SY B7 SY B7 01 during the 2012 PRA update using the latest design calculations for the (CC I) criteria.

control room envelope. The results of the SA112A PRA model showed that loss of Control Area Ventilation (CAV) scenarios are now about a factor of ten less than what previously existed in the peer reviewed PRA model (PRA Model, Rev. 4.1). Therefore, any conservatism that may exist in the design basis calculations for CAV is not important to the PRA results. As such, there is no further action required.

SY B8 SY B8 SR Met SY A4 01 Walkdowns are not formally complete N/A N/A SY B9 This SR was deleted in RA Sb 2005. N/A SR The need for heating of the RWST is not modeled although the SY B9 SY B10 SY B5 01 See above response for SR SY B5.

Not Met system notebook indicates the need for heating.

This issue was addressed as part of the 2012 PRA Update. In particular, the AFW system and SI actuation logic and automatic initiation signals were SR Some AFW signals (SI, LOSP) are not defined and no reviewed and revisions made and additional logic added to the PRA model SY B10 SY B11 SY B11 01 Not Met justification for exclusion is provided. where appropriate. See the Salem PRA System Notebooks (SA PRA 005.#### series) for the changes that were made to the SA112A PRA model for such systems as AFW and SSPS. No further action required.

An average value for the expected run time of the Emergency Diesel Generators (EDGs) and their supporting components, such as the fuel oil transfer pumps, was derived based on a convolution involving non recovery of offsite power data and EDG run time failure probabilities. This analysis is documented in Section 10.0 of the Salem PRA Data Notebook (SA PRA SR SY B11 SY B12 SY B12 01 Some identified mission times are less than required. 010), which was performed during the PRA update that resulted in the Not Met SA112A model. This exercise resulted in an average run time of 6.2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for the EDGs, which was also used for the EDG fuel oil transfer pumps.

However, the mission time for the AFW turbine driven pump was assigned a mission time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months in the SA112A PRA model. No further action required.

SY B12 SY B13 SR Met N/A SY B13 SY B14 SR Met N/A SR No documentation of an evaluation for potential adverse SY B14 SY B15 See above response for SR SY A21.

Not Met environments.

4 21 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 444 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA4Sa4 RA4Sb4 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 SR # 2005 SR # Category F&Os The issue of instrument miscalibration was modeled using Human Error Probability (HEP) pre initiator events that were included in the appropriate SR Operator starts for standby equipment not defined. No SY B15 SY B16 HR C3 01 sections of the Salem SA112A PRA model to capture the unavailability of Not Met miscalibration of under voltage relays.

instruments due to miscalibration errors. These HEPs are documented in the Salem HRA Notebook (SA PRA 004). No further action required.

SY C1 SY C1 SR Met N/A The Salem PRA System Notebooks were revised and enhanced as part of the PRA model update that resulted in the SA112A PRA model, which SR System documentation does not provide some required SY C2 SY C2 SY C2 01 occurred after the peer review was performed in 2008. Since this issue was Not Met documentation.

a documentation issue, there would be no impact on the results for this license amendment request.

The Salem PRA System Notebooks were revised and enhanced as part of the PRA model update that resulted in the SA112A PRA model, which occurred after the peer review was performed in 2008. In particular, Section SR SY C3 SY C3 SC C3 02 Assumptions are not present 3 of the System Notebooks (SA PRA 005.#### series) now lists both generic Not Met and system specific PRA modeling assumptions. Since this issue was a documentation issue, there would be no impact on the results for this license amendment request.

4 22 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 445 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR HUMAN RELIABILITY ANALYSIS RA4 RA4Sb4 Sa4 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2005 2009 Category F&Os SR #

SR #

This requirement is met by the process outlined in Section 2.2 HR A1 HR A1 SR Met N/A of the HRA Notebook.

This requirement is met by the process outlined in Section 2.2 HR A2 HR A2 SR Met N/A of the HRA Notebook.

This requirement is met by the process outlined in Section HR A3 HR A3 SR Met N/A 2.3.4 of the HRA Notebook.

SR Met: This requirement is met by the process outlined in Section HR B1 HR B1 N/A (CC II/III) 4.3.3.1 of the HRA Notebook.

This requirement is directly in violation of the first sentence of The HRA notebook (SA PRA 004) was revised to address this issue SR Section 4.3.3.1 which allows screening of actions that could in order to clarify that screening of this nature was not performed.

HR B2 HR B2 HR B2 01 Not Met simultaneously have an impact on multiple trains of a Therefore, this SR is now met and there is no further action redundant system or diverse systems. required.

This requirement is met by including the description of the HR C1 HR C1 SR Met HFE with each HFE analysis (see Tables 5.1.1, 5.1.2 and N/A 5.1.3)

The HRA notebooks specified that the LARs were reviewed SR Met:

HR C2 HR C2 and the descriptions indicate modes of unavailability have N/A (CC II/III) been included.

The issue of instrument miscalibration was modeled using Human There is no documentation showing that miscalibration as a Error Probability (HEP) pre initiator events that were included in the SR Not mode of failure of initiation of standby systems was appropriate sections of the Salem SA112A PRA model to capture HR C3 HR C3 HR C3 01 Met considered. An example of this is that there is no HFE for the unavailability of instruments due to miscalibration errors. These miscalibration of bus under voltage bus, RPS relays, etc. HEPs are documented in the Salem HRA Notebook (SA PRA 004).

No further action required.

Since the EPRI HRA Calculator was used this requirement is HR D1 HR D1 SR Met N/A met.

SR Met: This meets Capability Category II since there was one HR D2 HR D2 N/A (CC II) screening value used for pre initiators.

This requirement is met due to the fact that the EPRI HRA SR Met:

HR D3 HR D3 Calculator is used. The Calculator requires human shaping N/A (CC II/III) factors which includes these requirements.

This requirement is met due to the fact that the EPRI HRA HR D4 HR D4 SR Met Calculator is used. The Calculator requires human shaping N/A factors which includes these requirements.

HR D5 HR D5 SR Met This requirement is met in Section 5.2.2. N/A The uncertainty analysis has not been done. The mean The Salem PRA Uncertainty Notebook (SA PRA 018) was officially SR Not HR D6 HR D6 SC C3 02 values were used since the HRA Calculator was used for this issued as part of the SA112A PRA model update and includes Met analysis. sources of uncertainties associated with Human Reliability Analysis 4 23 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 445 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR HUMAN RELIABILITY ANALYSIS RA4 RA4Sb4 Sa4 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2005 2009 Category F&Os SR #

SR #

(HRA). This document makes use of both EPRI 1026511, which addresses the use of PRA and the treatment of uncertainty, and EPRI 1016737, which addresses the treatment of parameter and model uncertainty. As such, there is no further action required.

SR Met: There was no requirement to check reasonableness of HEPs HR D7 HR D7 N/A (CC I/II) in light of the plants experience.

This requirement is met by the methodology section of the HR E1 HR E1 SR Met N/A HRA Notebook.

HR E2 HR E2 SR Met This requirement is met by Section 2.1 of the HRA Notebook. N/A SR Met:

HR E3 HR E3 This requirement is met in Section 2.6 of the HRA Notebook. N/A (CC II/III)

SR Met:

HR E4 HR E4 This requirement is met in Section 2.6 of the HRA Notebook. N/A (CC II/III)

This requirement is met at the Capability Category I/II level SR Met:

HR F1 HR F1 because several HFEs included several responses which are N/A (CC I/II) grouped into one HFE.

The accident sequence specific timing of time window for successful completion for CCS XHE FO ISOLT is based on a calculation that does not address leakage. The calculation S CC MDC 2111 is for loss of Service Water and does not address leakage of the Component Cooling Water System.

The HRA Notebook (SA PRA 004) has been revised as part of the The time window should account for leakage that would drain 2012 PRA update that resulted in the SA112A PRA model. The SR Not HR F2 01, the CCW system and make it inoperable. This is the limiting HR F2 HR F2 notebook now describes the available system windows for operator Met HR F2 02 time since the CCW system will continue to cool with the leak intervention and use of cues for all the important and risk significant until the surge tank is drained. Other examples of problems Human Error Probability (HEP) events. No further action required.

with timing are the lack of documentation for the timing used.

This is noted in HRAs: CIS XHE FC XLCNT, AND MSS XHE FO MS10. It should be noted that only a sampling was performed and that this may involve many more HRA analysis.

The notebook does document which HEP's are risk While industry consensus has not been achieved in adopting a significant and the ones that are not use screening values. consistent methodology to appropriately analyze the many actions The reason this does not meet Capability Category I is that associated with remote shutdown activities, a detailed HEP SR Met:

HR G1 HR G1 HR G1 01 the human action from the shutdown panel, RRS XHE FO calculation is no longer required for RRS XHE FO SDRSP as it is (CC I)

SDRSP, is risk significant but still uses a screening value. not risk significant in the SA112A model. Per Category II of HR G1, This requirement must have a detailed analysis for significant screening values may be assigned to HEPs for non significant HFEs. human failure basic events. No further action required.

4 24 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 445 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR HUMAN RELIABILITY ANALYSIS RA4 RA4Sb4 Sa4 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2005 2009 Category F&Os SR #

SR #

This requirement was met since the EPRI HRA Calculator HR G2 HR G2 SR Met N/A was used for the analysis.

SR Met: This requirement was met since the EPRI HRA Calculator HR G3 HR G3 N/A (CC II/III) was used for the analysis.

The accident sequence specific timing of time window for successful completion for CCS XHE FO ISOLT is based on a calculation that does not address leakage. The calculation S CC MDC 2111 is for loss of Service Water and does not address leakage of the Component Cooling Water System.

The time window should account for leakage that would drain SR Not HR F2 01, the CCW system and make it inoperable. This is the limiting HR G4 HR G4 See above response for SR HR F2.

Met HR F2 02 time since the CCW system will continue to cool with the leak until the surge tank is drained. Other examples of problems with timing are the lack of documentation for the timing used.

This is noted in HRAs: CIS XHE FC XLCNT, and MSS XHE FO MS10. It should be noted that only a sampling was performed and that this may involve many more HRA analysis.

SR Met:

HR G5 HR G5 This requirement was met by Section 2.6 during plant visits. N/A (CC II/III)

This requirement was met by Section 2.6 during plant visits HR G6 HR G6 SR Met N/A and operator interviews.

This requirement is met by Section 5.2 of the HRA Notebook, HR G7 HR G7 SR Met N/A Dependent Operator Actions.

N/A HR G8 This SR was deleted in RA Sb 2005. N/A The Salem PRA Uncertainty Notebook (SA PRA 018) was officially issued as part of the SA112A PRA model update and includes sources of uncertainties associated with Human Reliability Analysis SR Not HR G8 HR G9 SC C3 02 This requirement is not met. (HRA). This document makes use of both EPRI 1026511, which Met addresses the use of PRA and the treatment of uncertainty, and EPRI 1016737, which addresses the treatment of parameter and model uncertainty. As such, there is no further action required.

SR Met: This requirement was met because the EPRI HRA Calculator HR H1 HR H1 N/A (CC II/III) was used and this includes operator recovery actions.

This requirement was met because the EPRI HRA Calculator HR H2 HR H2 SR Met N/A was used and this includes operator recovery actions.

This requirement is met by Section 5.2 of the HRA Notebook, HR H3 HR H3 SR Met N/A Dependent Operator Actions.

4 25 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 445 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR HUMAN RELIABILITY ANALYSIS RA4 RA4Sb4 Sa4 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2005 2009 Category F&Os SR #

SR #

The use of the EPRI HRA Calculator and the documentation HR I1 HR I1 SR Met N/A in the HRA Notebook meets this requirement.

The use of the EPRI HRA Calculator and the documentation HR I2 HR I2 SR Met N/A in the HRA Notebook meets this requirement.

SR Not HR I3 HR I3 SC C3 02 This requirement is not met. See above response for SR HR G8.

Met 4 26 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 446 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra4Sa4 Ra4Sb4 Capability Associated 2009 2005 SR # Category F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SR #

Need to develop Salem specific site procedures. The PSEG ER AA 600 series of procedures exist to address Salem specific site procedures should be developed for this issue. Specifically ER AA 600 1015 addresses SR Met:

DA A1 DA A1 DA A1 01 maintenance of site specific PRAs. maintenance and update of the internal events PRA model.

(CC II/III)

Recommendation is to develop Salem specific site They may be found and retrieved using the site's database procedures. known as DCRMS. There is no further action required.

No discussion of component boundary definition is provided Boundary definitions for plant systems were better defined in in either the data or systems analysis. Boundaries for the System Notebooks during the 2012 PRA Update by unavailability events are not established. Boundary incorporating drawings with highlighted boundaries in order definitions help assure that failures are attributed to the to help the reader better visualize the modeled system correct component and that calculated failure rates and boundaries. However, the Data Notebook (SA PRA 010) will unavailability values are appropriate. Some component need to be revised in order to explain how component SR Not boundaries are discussed in the notes to Appendix A, boundaries were defined. In particular, Section 5.1 of DA A2 DA A1a DA A1a 01 Met "Generic (Industry) Failure Data" of the Data Notebook. NUREG/CR 6928 contains the definition used for component Note 32 states to "Assume that CCW/RHR HX failure rates boundaries that were used for generic industry data. Also, apply to TDAFW Pump Bearing and governor jacket the TDAFW jacket coolers were removed from the SA112A coolers", however unless the Salem TDAFW pump has PRA model since they are considered within the boundary of unique features that require this to be modeled separately, the TDAFW pump. Based on this being a documentation cooling to the TDAFW pump is included in the component issue, there is no impact on the results for this license boundary to the pump in NUREG 6928. amendment request.

The PRA update for the Rev. 4.3 PRA model included adding uncertainty parameters to the type code database, Mean values for failure rates appear in the model, however SR Not and as part of the 2012 PRA model update, the CAFTA DA A3 DA A2 DA A2 01 no uncertainty distributions could be found in the basic Met Access database file (SA112A.rr) was updated to include events checked.

uncertainty parameters for all type codes and basic events used in the SA112A PRA model. No further action required.

The data parameters used in the model appear to be appropriately identified. The units for Motor Operated Valves DA A4 DA A3 SR Met Fails to Close are demands. The units identified for Motor N/A Operated Valves Fails to Remain Open or Closed are hours.

Reference Data Analysis Notebook Section 2.1.1.

The type codes used and listed in the Data Notebook (SA PRA 010) do identify the different systems and type codes Components were grouped according to type such as motor used as well as the basis for their failure probabilities. Type operated valve to meet Category 1 of the standard.

code failure rates now distinguish between clean and dirty Components were grouped according to mission type, (e.g.,

SR Met: water systems, e.g., pumps in the CCS and SWS PRA DA B1 DA B1 DA B1 01 standby and operating) fails to meet Category II, however as (CC I) modeled systems, in the SA112A PRA model. Also, the stated in the Data Analysis Notebook Section 2.1.1.6, "there internal flood evaluation makes use of pipe rupture rates is no differentiation between systems (e.g., clean water vs.

categorized by the type and quality of water contained within raw water". Therefore, a full Category II could not be met.

the various water pipes that were analyzed. No further action required.

4 27 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 446 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra4Sa4 Ra4Sb4 Capability Associated 2009 2005 SR # Category F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SR #

There did not appear to be any outliers in the data reviewed.

DA B2 DA B2 SR Met Reference Data Analysis Notebook, Section 2.2 and N/A Appendix A and Appendix C.

Since some of the maintenance unavailability terms in the SA112A PRA model used older data from the Salem Rev.

3.2 PRA model as noted in Appendix C of SA PRA 010, a sensitivity analysis was performed to obtain a more accurate assessment of the maintenance philosophy of the plant using Maintenance Rule historical data from the period of 1/1/2007 to 7/1/2012. If it was found that there were unavailability hours logged for a specific component, then the unavailability was calculated by dividing the number of unavailable hours by the critical hours during this time period. If there were no hours that were recorded during this time period of 5.5 years, then a Bayesian update was performed using the Salem Rev. 3.2 data as the prior distribution (lognormal with EF=3) with 0 hours0 days 0 hours 0 weeks 0 months of unavailability over the time period of interest. The resulting unavailabilities were then substituted for the current Generic parameter estimates are obtained from recognized maintenance terms in the SA112A PRA model and new CDF sources (principally NUREG/CR 6928). However, no importance measures generated to determine the impact on discussion of component boundary definition is provided SR DA A1a 01, PRA results. This sensitivity analysis also included an DA C1 DA C1 other than a draft document. In addition, generic Not Met DA C1 01 update to the failure rates for certain type codes that unavailability data is used for some SSCs without satisfied the category of being risk significant per Step demonstrating that the data is consistent with the test and 4.5.4.1 of ER AA 600 1015 (see URE # SA2010 054). As a maintenance philosophies for the subject plant.

chosen figure of merit, the comparison of Birnbaum importance measures revealed that no MSPI monitored component changed by a value that exceeded 40% (the threshold is 300%). As such, there is only a minimal impact on the PRA results based on comparing Birnbaum importance measures, which were chosen to characterize this impact since the present Salem MSPI Basis Document was based on the SA112A PRA model results. Based on the relatively small changes in importance measures, the SA112A PRA model is deemed acceptable for use in risk informed applications. With regard to use of generic data, only the boric acid transfer pumps (CVS BAP TM 11BAT and CVS BAP TM 12BAT) make use of generic data, which comes from Table 6 1 of NUREG/CR 6928, and represents the combined data for all motor driven pumps (MDP). This is considered acceptable for the SA112A PRA model since the 4 28 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 446 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra4Sa4 Ra4Sb4 Capability Associated 2009 2005 SR # Category F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SR #

RAW value is only 1.01 and the Fussell Vesely is 9.9E 05 for this piece of equipment. Based on this discussion, this issue of generic unavailability is deemed to have only a minimal impact on the results for this license amendment request.

A review was made of the basic event importance measures from the SA112A PRA model and events tied to four (4) separate type codes were found to satisfy the risk significant criteria found in Step 4.5.4.1 of ER AA 600 1015. A review of reliability data for the associated plant systems was performed using Maintenance Rule historical data from the time period of 1/1/2007 to 7/1/2012. Using plant specific data for the type codes of interest (AC4BKROO, CASEACFR, RHSMOVCC, and VASACXFS) a Bayesian update was performed using the generic data as the prior distribution to derive new failure rates. The resulting failure Plant specific data is only collected for MSPI components.

SR rates for these type codes were then substituted for the DA C2 DA C2 DA C2 01 The draft data procedure provided requires that plant specific Not Met generic values being used in the SA112A PRA model and data be supplied for SSCs with RAWs > 2 and F V's > 0.005.

new CDF importance measures generated to determine the impact on PRA results. This sensitivity analysis also included an update to the maintenance unavailability terms that were using legacy values from the Rev. 3.2 PRA model (see response to SR DA C1). As a chosen figure of merit, the comparison of Birnbaum importance measures revealed that no MSPI monitored component changed by a value that exceeded 40% (the threshold is 300%). Based on this discussion, this issue of plant specific data for risk significant components is deemed to have only a minimal impact on the results for this license amendment request.

Plant specific data is collected consistent with design, DA C3 DA C3 SR Met N/A operation and experience.

Documentation describing the process of evaluating Formal procedures now currently exist that describe the PRA maintenance records was identified in a draft procedure. All update process, including what data collection is required.

failures must be reviewed for applicability to the PRA model Actual plant specific failure and unavailability data were SR DA C4 DA C4 DA C4 01 and this process should be documented. All plant specific obtained from the Salem Maintenance Rule and MSPI Not Met data came from MSPI or the Maintenance Rule, however programs. See the Data Notebook (SA PRA 010) for further there was no documentation provided that these failures details. Since this is a documentation issue, there is no were reviewed as PRA failures. impact on the results for this license amendment request.

4 29 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 446 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra4Sa4 Ra4Sb4 Capability Associated 2009 2005 SR # Category F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SR #

Failure and unavailability data were obtained from the Salem Maintenance Rule and MSPI programs. The counting of component failures, such as was done for MSPI components, was consistent with industry practice. Failures were obtained from the MSPI reporting process and were handled appropriately during the revision of the Data Documentation describing the process of evaluating failure Notebook (SA PRA 010) as part of the 2012 PRA model SR records other than applying MSPI data directly could not be DA C5 DA C5 DA C5 01 update. URE database record SA2015 026 was created to Not Met identified. All failures must be reviewed for applicability to enhance the description of the failure evaluation process so the PRA model.

as to document that repetitive failures occuring within a short duration, if they were to occur, would be appropriately handled so as not to skew the importance of any one SSC.

With regard to this issue, there is no impact on the results for this license amendment request since this was a documentation issue.

Plant specific reliability data for MSPI monitored components was obtained from the Salem MSPI reporting process and provided in the Appendix B tables of the Data Notebook (SA PRA 010) in order to facilitate the Bayesian updating Documentation describing the process of evaluating the process during the 2012 PRA Update. This process was number of plant specific demands for standby components documented in Section 7.2 of SA PRA 010. A sensitivity could not be identified. Standby components were identified analysis was performed using additional plant specific data in Table 1 of the Data Analysis Notebook and plant specific to address issues related to SRs DA C1 and DA C2. In all demands for some of these components were listed in cases with regard to the SA112A PRA model, failure rates SR Appendix B, however the basis for this number of demands DA C6 DA C6 DA C6 01 and probabilities fall into one of two categories, i.e., they Not Met was not provided. The draft data procedure states that plant were either a part of the plant specific data update that used specific data should be estimated by actual counts of hours MSPI data, which included plant specific demands and run or demands from logs or counters, use of surveillance hours from the MSPI Derivation reports, or they made use of procedures to estimate the frequency of demands and run generic data from sources such as NUREG/CR 6928. For times, or estimates based upon input from the System future updates, plant specific data and Bayesian updating Engineer.

will be extended to include risk signifcant components per ER AA 600 1015. Since this is mainly a documentation issue, there is no impact on the results for this license amendment request.

Documentation describing the process of collecting the Existing performance monitoring programs, such as the number of surveillance tests and planned maintenance Maintenance Rule, already document testing and activities on plant requirements could not be identified. In maintenance unavailability information for each of the more SR DA C7 DA C7 DA C7 01 Appendix C for example CCS MOVs in test and Maintenance risk significant systems modeled in the PRA. The testing Not Met were described. The source of the data was listed as Salem and maintenance unavailability information used in the 3.2 PRA, however no specific breakdown of the surveillance Salem PRA is a combined value, i.e., represented by a tests included was provided. The draft data procedure single basic event. As such, there is no further action 4 30 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 446 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra4Sa4 Ra4Sb4 Capability Associated 2009 2005 SR # Category F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SR #

identifies surveillance tests as a source of data. required.

The table cited in the summary description is now labelled as Table A 1 in the Salem PRA Data Notebook (SA PRA 010),

which identifies the failure rates/probabilities to be used for various SSCs modeled in the PRA. The notes to this table An estimate of times that some components were configured help identify which components are considered either in their standby status is identified in Table 1 and its notes, normally running or in a standby condition, and also what SR Met:

DA C8 DA C8 DA C8 01 however no documentation of how these estimates were fraction of the time a component may be considered in either (CC I) derived was provided. No operational records were provided a running or standby condition, e.g., Note 25 for station air in order to meet Capability Category II. compressors. In addition, standby flags are employed in the SA112A PRA model to denote which components are configured in a standby condition so that the appropriate failure mode can be applied in the fault tree logic. As such, there is no further action required.

Documentation describing the process of estimating the operational time of standby components from testing was Further clarification was provided in the Salem Data identified in draft procedure. Standby components were Notebook (SA PRA 010) during the 2012 PRA model update SR Not DA C9 DA C9 DA C9 01 identified in Table 1 of the Data Analysis Notebook and (SA112A) to help better explain how estimates for standby Met operational times for some of these components were listed time were derived. As such, there is no further action in the Data Analysis Notebook, however the source of the required.

data was not provided.

Documentation describing the process of reviewing test Initiating event category tables were provided in the revised procedures to determine surveillance test data could not be Initiating Events Notebook (SA PRA 001) to provide a identified. No specific surveillance tests were discussed in SR Not benchmark comparison to ensure that Salem initiating event DA C10 DA C10 DA C10 01 the Data Analysis Notebook. The Systems Analysis Met categories were adequate in capturing the necessary PRA Notebooks for specific systems described various initiating events. The plants compared were South Texas, surveillance testing, but did not reference surveillance tests Surry, and Watts Bar. No further action required.

by name.

Consistent with industry practice, the failure and Documentation describing the process of using maintenance unavailability data were obtained from the Salem and testing durations to determine plant specific durations Maintenance Rule and MSPI programs. The Maintenance SR Not DA C11 DA C11 DA C11 01 was identified in a draft document. No specific surveillance Rule data and MSPI data are traceable to individual Met tests were discussed in the Data Analysis Notebook but occurrences. Therefore, the documentation does exist and it MSPI/Maintenance Rule sources were identified. was not necessary to repeat the information in the Data Notebook (SA PRA 010). No further action required.

4 31 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 446 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra4Sa4 Ra4Sb4 Capability Associated 2009 2005 SR # Category F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SR #

As part of the enhancements made during the 2012 PRA Documentation describing the process of how to count update, the process used for counting maintenance maintenance unavailability was not identified. Plant Specific unavailabilities was more clearly described in the Salem unavailability was only documented for MSPI components PRA Data Notebook (SA PRA 010). Also, existing Salem SR Not DA C11a DA C12 DA C11a which identifies the unavailability for support and frontline performance monitoring programs, such as MSPI and Met 01 systems separately, however it could not be determined that Maintenance Rule, formed the basis for derivation of this was the case throughout the model without a specific maintenance unavailabilities over the data collection period.

guidance document. This approach is consistent with industry practice. As such, there is no further action required.

While a table of critical hours was provided and the Maintenance unavailabilities for shared systems between the Maintenance Unavailability Table provided in Appendix C SR Not two units has been updated in Sections 3.0 and 8.1 of the DA C13 DA C12 DA C12 01 appears to address these hours there was no specific Met Salem Data Notebook (SA PRA 010) as part of the 2012 documentation or guidance document provided that Salem PRA model update. No further action required.

discusses how maintenance was treated for shared systems.

Coincident unavailability for service water pumps was A paragraph was added to section 8.2 of the Data Notebook modeled as shown in Appendix C of the Data Analysis (SA PRA 010) to document the concurrent unavailability for SR Not DA C14 DA C13 DA C13 01 Notebook, however, no overall guidance document could be SW. Also, Note 12 was added at the bottom of Table C 1 in Met found to ensure all systems were reviewed for coincident Appendix C of SA PRA 010 to denote the unavailabilities unavailability. used. No further action required.

SR Not DA C15 DA C14 SSC repair is not modeled. N/A Applicable SR Not DA C16 DA C15 System recovery is not modeled. N/A Applicable Plant specific evidence was provided for significant basic SR Met:

DA D1 DA D1 events. A Bayesian update of generic prior was performed N/A (CC II) as shown in Appendix B of the Data Analysis Notebook.

Use of Monte Carlo simulation techniques using the @RISK Excel add in was used to derive failure distributions for the Evaluation of diesel driven compressor provides example of diesel driven air compressor with documentation provided in DA D2 DA D2 SR Met DA D2 01 evaluating plant specific consideration using similar Section 6.3 of the Salem PRA Data Notebook (SA PRA 010) components. See Data Analysis notebook Section 2.1.3.

during the 2012 PRA model update. No further action required.

All parameters identified in Table A 1 of SA PRA 010 now SR Met: Observations of SA PRA 010, Table A 1. Mean values were DA D3 DA D3 DA D3 01 have a reference provided to show traceability of information.

(CC I) provided along with error factors for most distributions.

No further action required.

A paragraph was added to Section 7.2 of the Salem PRA Data Notebook (SA PRA 010) to document the comparison SR Met: No documentation is present that substantiates that the DA D4 DA D4 DA D4 01 of updated results with the generic data during the Salem (CC I) analysis was performed. This is sufficient for Category I.

2012 PRA model update. Because no abnormalities were identified, no further action is required.

4 32 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 446 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra4Sa4 Ra4Sb4 Capability Associated 2009 2005 SR # Category F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SR #

SR Met: Values provided for Alpha and MGL methods for significant DA D5 DA D5 N/A (CC II) events in the Data Analysis Notebook.

During the Salem 2012 PRA model update, a paragraph was added to Section 6.1 of the Data Notebook (SA PRA 010) to document a comparison of the NUREG/CR 6928 values with SR Met: No apparent comparison of common cause failures to plant DA D6 DA D6 DA D6 01 other generic data sources, such as NUCLARR and EPRI.

(CC I) experience was provided in the Data Analysis Notebook.

No large discrepancies were identified. As such, NUREG/CR 6928 was deemed acceptable for use. No further action required.

SR Not DA D7 DA D6a No generic data was screened. N/A Applicable SR Not DA D8 DA D7 No modifications are known that would impact data. N/A Applicable The analysis is documented in a manner that could facilitate This URE is a suggestion that has no impact on the quality of applications, upgrades, and PEER reviews. The notebook the PRA and was only meant to aid reviewers in the DA E1 DA E1 SR Met DA E1 01 could be improved by providing direct references to actual traceability of data sources. As such, there is no further failure numbers in EPIX or CDE numbers in Appendix A.

action required.

See suggestion.

NUREG/CR 6928, which was used in gathering the generic data for updating the Salem Data Notebook (SA PRA 010),

provides a definition of the component boundaries for the A draft document was provided that documented how to modeled components of interest. No formal procedure SR Not establish component boundaries, how to establish failure DA E2 DA E2 DA E2 01 needs to be developed when the data source used for the Met probabilities, sources of generic data, etc. This procedure SA112A PRA model already defines the component needs to be formalized.

boundaries of modeled components. Because this is a documentation issue, there is no impact on the results for this license amendment request.

Assumptions are appropriately documented throughout the Data Analysis Notebook (SA PRA 010) where appropriate in order to be consistent with the context of each section. In general, most assumptions may be found within footnotes to Assumptions were noted in various sections of the Data the data tables in order to explain the basis for derivation of SR Not Analysis Notebook. These need to be gathered into an the data. Additionally, the Uncertainty Notebook (SA PRA DA E3 DA E3 SC C3 02 Met assumptions section in the notebook. Sources of uncertainty 018) was officially issued and includes a section on model were not discussed in the analysis. uncertainty and references both EPRI 1026511, which addresses the use of PRA and the treatment of uncertainty, and EPRI 1016737, which addresses the treatment of parameter and model uncertainty. As such, there is no further action required.

4 33 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 447 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA4 RA4Sb4 Capability Associated Sa4 2005 Category F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 SR #

SR #

The single top fault tree (S1R4.CAF) integrates the model in a manner QU A1 QU A1 SR Met N/A that supports quantification and treatment of dependencies.

QU QU A2 SR Met Fault tree linking is used in constructing the S1R4.CAF model. N/A A2a The parametric uncertainty analysis was performed and documented in the newly issued Salem PRA Uncertainty Notebook (SA PRA 018). The Parametric uncertainty is not performed on the quantification results. In QU SR Met: uncertainty analysis also correctly accounted for the QU A3 QU A2b 01 addition, it is not clear that the same type code is used for multiple A2b (CC I) "state of knowledge" correlation by making the events based upon the same underlying data.

necessary adjustments to the type codes in the CAFTA database file (SA112A.rr). No further action required.

The model is quantified using CAFTA software which is capable of QU A4 QU A3 SR Met reporting contributors to CDF by initiating event, or at the individual N/A sequence level if desired.

Recovery events that have no basis or discussion of applicability were removed from the recovery model Recovery events NRAC 12H, NRAC OSP, and NREDG 4H are included logic during the 2012 PRA model update (SA112A).

in the S1R4REC.CAF file, but their application is not discussed in the The recovery files are discussed in the Quantification QU A5 QU A4 SR Met QU A4 01 Accident Sequences and Event Tree notebook or in the AC Power notebook (SA PRA 014). The offiste power non System Notebook. recoveries are discussed in Appendix D of the Accident Sequence Notebook (SA PRA 002). As such, there is no further action required.

The CAFTA software suite and the Forte quantification engine are used QU B1 QU B1 SR Met in the quantification. These are standard software products which have N/A been shown to produce appropriate results in industry usage.

Salem Quantification Notebook SA PRA 2008 01 Attachment E QU B2 QU B2 SR Met documents the convergence analysis performed to set an appropriate N/A truncation value.

Attachment E of the Salem Quantification Notebook (SA PRA 014) for the SA112A PRA model documents the process used to ensure that Salem Quantification Notebook SA PRA 2008 01 Attachment E convergence was achieved for quantification of CDF documents the convergence analysis performed to set an appropriate and LERF cutsets. There was less than a 5%

truncation value. The truncation level for both CDF and LERF was set QU B3 QU B3 SR Met QU B3 01 change in CDF in going from a truncation limit of 1E at 1.0E 11. The percentage change between 1.0E 10 and 1.0E 11 was 11 to 1E 12, and less than a 5% change in LERF 2.2% for CDF, but 6.1% for LERF. Therefore, this SR was not satisfied when going from a truncation of 1E 12 to 1E 13.

for LERF.

Therefore, the official truncation limits used were 1E 11 for CDF and 1E 12 for LERF. No further action required.

4 34 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 447 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA4 RA4Sb4 Capability Associated Sa4 2005 Category F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 SR #

SR #

Forte uses the minimal cutset upper bound quantification method to QU B4 QU B4 SR Met N/A produce the mean value.

A new vital AC power PRA system notebook (SA PRA 005.0020) was created during the 2012 PRA model update. Section 6.8 of this notebook contains an explanation of how circular logic loops were Creation of different fault tree tops to break circular logic is discussed in broken for the diesel generator support SR Not the system notebooks; however the documentation is not sufficient to QU B5 QU B5 QU B5 01 dependencies, and also lists the affected gates with Met determine whether the logic was broken at the appropriate level to a description of the modification. The documented ensure unnecessary conservatisms or non conservatisms.

review of this PRA system notebook provides evidence that the logic was broken at the appropriate level to avoid any unnecessary conservatisms or non conservatisms. No further action required.

Complementary logic is used where needed to account for system QU B6 QU B6 SR Met N/A successes in transfers to the LERF model from the Level 1 model.

Mutually exclusive logic is included in the linked fault tree under gate QU QU B7 SR Met DAM GDAM100 and combined with the core damage or LERF logic in N/A B7a an "A and not B" gate.

Mutually exclusive logic is included in the linked fault tree under gate QU DAM GDAM100 and combined with the core damage or LERF logic in QU B8 SR Met N/A B7b an "A and not B" gate to remove mutually exclusive combinations during quantification.

Flag file S1R4IFL.CAF contains the flag settings as TRUE or FALSE.

QU B9 QU B8 SR Met The quantification process using PRAQUANT merges the flag file with N/A the PRA model prior to quantification.

Split fractions such as the ones mentioned in the Split fractions and undeveloped events are included in the model.

summary description (MFI UNAVAILABLE and Examples include main Feedwater availability for ATWS (MFI G2SW22) are listed in Table A 2 of the PRA Data QU SR Not UNAVAILABLE) and some Unit 2 systems credited for recovery of Unit 1 QU B9 QU B9 01 Notebook (SA PRA 010) that was revised during the B10 Met CAV failure (G2SW22). The derivation of the values for these events is 2012 PRA model update (SA112A) along with not documented to allow determination that consideration has been references to document their derivation. No further given to the impact of shared events.

action required.

The dependency analysis for multiple HFEs is described in the HRA Notebook. The process included a requantification of the model with QU C1 QU C1 SR Met HEPs set to 0.1 to capture combinations which could be below normal N/A truncation levels. The final application of dependency correction factors is done through post processing of the cutsets.

The dependency analysis for multiple HFEs is described in the HRA QU C2 QU C2 SR Met N/A Notebook.

4 35 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 447 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA4 RA4Sb4 Capability Associated Sa4 2005 Category F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 SR #

SR #

QU C3 QU C3 SR N/A The linked event tree methodology is not used for the Salem model. N/A The current system window for the RRS XHE FO SDRSP action (FAILURE OF REMOTE SHUTDOWN UPON LOSS OF CAV) is 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months as OP AB.CAV 0001 reports that the electrical equipment room temperature will exceed 145F in 4.2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months if no operator action is taken. Use of a joint human error probability (HEP) floor value (1E 6 for the SGS HRA) is the current industry expectation as discussed in NUREG 1792, Good Practices for Section 6 of the quantification notebook SA PRA 2008 01, Revision 4.1 Implementing HRA. The system window length has QU includes a discussion of the top cutsets. The discussion provides good no impact on the application of the joint HEP floor QU D1 SR Met QU D1a 01 D1a detail of the core damage scenarios. Some of the cutsets appear to be value. It is acknowledged that the time reported for conservative, which are discussed more in the F&O. MFW XHE FO COND did reflect that actions base case (LOFW at time zero) rather than a loss of feedwater upon depletion of the AFWST, which is more representative of the combination. The Salem Dependency Analysis for the 2012 PRA model update was completely revised using the HRA Calculator, which allows the manipulation of timing within a combination. Still, there are no joint HEPs in the Salem HRA with values less than 1E 6 due to the floor value requirement. No further action required.

Section 6 of the Quantification Notebook (SA PRA 014) for the 2012 PRA model update discusses the There is no discussion in the quantification notebook that indicates a top 25 cutsets that lead to core damage and also QU SR Not review of the results was performed for the purpose of assessing QU D2 QU D1b 01 addresses the fact that a cutset review was D1b Met modeling and operational consistency. Also, since the sequences were conducted with PSEG personnel in March 2014 to not quantified, it is difficult to perform this verification.

ensure modeling and operational consistency. No further action required.

QU SR Not There is no discussion in the quantification notebook SA PRA 2008 01, QU D3 QU A4 01 See response for SR QU A4.

D1c Met Revision 4.1 that indicates this review was completed.

N/A QU D2 This SR was deleted in RA Sb 2005 N/A Based on comments from the PWROG Chairman, the PWROG PRA Comparison Database is out of This is a Capability Category I since there is no documentation to date by at least 6 years and was not used. A high SR Met:

QU D4 QU D3 QU D3 01 indicate that the Salem results were compared to the results of a similar level comparison was made to other similar PWRs.

(CC I) plant. Also, see response for SR IE A4 for additional industry comparison. Since this is a documentation issue, there is no impact on the results for this 4 36 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 447 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA4 RA4Sb4 Capability Associated Sa4 2005 Category F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 SR #

SR #

license amendment request.

A sampling of non significant accident cutsets that lead to core damage near the truncation threshold of 1E 11 were inspected to determine the presence of There is no documentation indicating that a sampling of non significant any illogical cutsets. This review was documented in SR Not QU D5 QU D4 QU D4 01 accident cutsets or sequences were reviewed to determine they are Section 6 of the Quantification Notebook (SA PRA Met reasonable and have physical meaning. 014) for the 2012 PRA model update (SA112A). The review determined that the cutsets did appear to be reasonable and had physical meaning. No further action required.

This requirement was not met because the importance of components QU SR Not and basic events was not performed. There is no definition of significant QU D6 QU F2 01 See response for SR QU F2.

D5a Met contributors to CDF. No documentation of an analysis for significant contributors to CDF.

QU SR Not This requirement was not met because the importance of components QU D7 QU F2 01 See response for SR QU F2.

D5b Met and basic events was not performed.

SR Not QU E1 QU E1 SC C3 02 The uncertainty notebook was produced but is not finalized. See response for SR QU F4.

Met The quantification assumption is that the model been correct analyzed.

QU E2 QU E2 SR Met So that the assumptions are in the other notebooks and will be N/A documented in the SR for those areas.

SR Not QU E3 QU E3 SC C3 02 The uncertainty notebook was produced but is not finalized. See response for SR QU F4.

Met SR Not QU E4 QU E4 SC C3 02 The uncertainty notebook was produced but is not finalized. See response for SR QU F4.

Met QU F1 QU F1 SR Met This requirement is met by the Quantification Notebook. N/A 4 37 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 447 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA4 RA4Sb4 Capability Associated Sa4 2005 Category F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 SR #

SR #

The following discussion addresses only those sub parts that were considered "not met": c) the method This requirement was only partially met as described below:

of applying recovery events and adjustment for joint (a) This requirement is met by the system and HRA notebooks.

HEPs is now described in Section 5 of the (b) There is a cutset review process description.

Quantification Notebook (SA PRA 014); (f)

(c) There is no description of how the success systems are accounted descripton of top 25 cutsets and dominant for. Since a one top tree is used the software already accounts for this.

sequences were discussed in the Quantification A statement stating would be satisfactory. The truncation values and Notebook (see Section 6 of SA PRA 014); (g) how they were determined were documented. The method for applying Human Error Probabilities (HEPs) that were recovery and how post initiator HFE's are applied was not described.

identified as being "time sensitive" are now (d) This requirement was met.

discussed in the HRA Notebook (SA PRA 004); (h)

(e) This requirement was met.

sensitivity calculations were documented and (f) This requirement was not met since the cutsets per accident discussed in the Uncertainty Notebook (SA PRA sequence were not discussed.

018); (i) the Uncertainty Notebook (SA PRA 018)

(g) This requirement was not met since equipment or human actions that was prepared and issued as part of the work scope are the key factors in causing the accidents sequences to be non involved with the Salem 2012 PRA Update Project SR Not QU B3 01, dominant are not discussed.

QU F2 QU F2 (SA112A); (j) importance measures are utilized as a Met QU F2 01 (h) This requirement was not met since sensitivities were not part of the process used to document Maintenance documented.

Rule products per the ER AA 310 series of (i) This requirement was not met since the uncertainty notebook was procedures. Also, the risk poster, which is produced not finalized.

as part of the rollout process (Risk Application: SA (j) This requirement is not met since there is no discussion of MISC 002), will also satisfy this requirement; (k) a importance.

discussion of how mutually exclusive events were (k) This requirement is not met because there is not list of mutually treated was provided in Section 5 of the exclusive events and there justification.

Quantification Notebook (SA PRA 014); (l) model (l) This requirement is not met because there is no discussion of asymmetries were mainly limited to the fact that the asymmetries in quantitative modeling to provide application users the SA112A PRA model is a Unit 1 model that relies on necessary understanding regarding why such asymmetries are present Unit 2 equipment for certain support functions, e.g.,

in the model.

Demineralized Water and Main Control Room (m) This requirement is met since CAFTA and Forte are being used.

ventilation, which are not developed to the full level Both of these pieces of software are industry standards and therefore no of detail as would be required if a dual unit PRA further testing is required.

model was adopted. Based on the above discussion, there is no further action required.

The reason this is a Capability Category I is that there is not SR Met: documentation of significant contributors such as accident sequences QU F3 QU F3 QU F2 01 See response for SR QU F2.

(CC I) and basic events being reviewed. Also there is no definition of significant contributors.

4 38 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 447 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA4 RA4Sb4 Capability Associated Sa4 2005 Category F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 SR #

SR #

the Uncertainty Notebook (SA PRA 018) was officially issued and includes a section on model uncertainty and references both EPRI 1026511, SR Not QU F4 QU F4 SC C3 02 The uncertainty notebook has not been approved. which addresses the use of PRA and the treatment Met of uncertainty, and EPRI 1016737, which addresses the treatment of parameter and model uncertainty.

As such, there is no further action required.

This requirement is met by the statement about caution when using FV QU F5 QU F5 SR Met N/A values of less than 0.1% and RAW values of less than 1E 04.

SR Not This requirement was not met since there is no definition for significant QU F6 QU F6 QU F2 01 See response for SR QU F2.

Met basic event, significant cutset, significant accident sequence.

4 39 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 448 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA4 RA4Sa42009 Sb4 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SR # 2005 Category F&Os SR #

Salem internal flooding notebook SA PRA 012, Revision 0 IFPP A1 IF A1 SR Met N/A Appendix B contains a description of the flood areas.

Section 4.0 of the Internal Flood Walkdown Notebook contains a list of plant drawings that define the rooms and Salem internal flooding notebook SA PRA 012, Revision 0 areas within the plant, while Appendix D of the Internal Flood Appendices B and D contain a description of the flood Summary Notebook provides a listing of those rooms and areas. The flood areas were generally aligned with the fire areas that form the scenario boundary. It is unnecessary to SR Met: areas as discussed in Section B.3. Even though the IFPP A2 IF A1a IF A1a 01 outline the flood area boundaries on a separate set of (CC II/III) documentation that shows the flood areas/zones could be drawings when the information that was used to define the more descriptive, this SR is considered to be met. The flood boundaries already exists for other programs, e.g., Fire F&O is for improving the documentation of the flood areas Hazards Analysis. Since this is a documentation issue, there and zones.

is no impact on the results for this license amendment request.

The buildings and areas that share equipment (e.g.,

IFPP A3 IF A1b SR Met Auxiliary and Turbine buildings) are included in the flood N/A area identifications.

N/A IF A2 This SR was deleted in RA Sb 2005. N/A The drawings used in the identification and definition of the flood areas appear to be current. Changes to the drawings IFPP A4 IF A3 SR Met N/A used should be captured as part of the inputs monitoring in the model update program.

Salem internal flooding notebook SA PRA 012, Revision 0 Appendix A contains a summary of the walkdowns that The raw handwritten notes from the plant walkdowns were were performed. The summary includes some of the scanned to PDF files (Salem PRA Events.pdf and Salem IFPP A5 IF A4 SR Not Met IF A4 01 important flood features. But walkdown sheets containing Water Sources.pdf) and are now included with the rest of the the details of the walkdowns (spatial information, mitigating electronic documentation and associated files. No further equipment such as drains, sumps, doors, wall penetrations, action required.

etc.) were not available.

Flood sources are documented in the summary of walkdowns in Appendix A of the Salem internal flooding notebook SA PRA 012, Revision 0, and also in the detailed IFSO A1 IF B1 SR Met analysis of the risk significant flood scenarios in Appendix N/A E. Section 2.2.11 documents the assessment of in leakage from other flood areas (e.g., back flow through drains).

4 40 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 448 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA4 RA4Sa42009 Sb4 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SR # 2005 Category F&Os SR #

The assessment performed in Section 3.0 of Risk Application The buildings and areas that share equipment (e.g.,

SA MISC 005 (Resolution of Internal Flood Peer Review Auxiliary and Turbine buildings) are included in the flood IF B1a 01, Comments) showed that there were no new multi unit IFSO A2 IF B1a SR Not Met area identifications. However, there was no indication in IF C4a 01 scenarios that require consideration due to the fact that they the documentation that flood sources from Unit 2 can were either already postulated or were subsumed by existing impact Unit 1 and vice versa.

scenarios. No further action required.

Flooding areas were selected based on the presence of one or more potential flooding sources. Hence, plant areas IFSO A3 IF B1b SR Met not subject to flooding were screened as described in N/A Appendix B of the Salem internal flooding notebook SA PRA 012, Revision 0.

Three categories of flooding initiating events were evaluated for the potential flood sources identified: major floods (2000+ gpm), general floods (100 to 2000 gpm) and spray type floods (<100 gpm). The frequency calculation method used (Reference EPRI technical report TR 1013141) for these flood scenarios includes failure modes IFSO A4 IF B2 SR Met of components. Section 2.2.9.1.1 of SA PRA 012, N/A Revision 0 documents the assessment of human induced flood mechanisms. This section concludes that human induced flood mechanism have a low enough frequency that they can be subsumed with the pipe failure frequencies. Considering the basis documented, this conclusion appears to be reasonable.

Three categories of flooding initiating events were evaluated for the potential flood sources identified: major IFSO A5 IF B3 SR Met N/A floods (2000+ gpm), general floods (100 to 2000 gpm) and spray type floods.

Salem internal flooding notebook SA PRA 012, Revision 0 Appendix A contains a summary of the walkdowns that IFSO A6 IF B3a SR Not Met IF A4 01 were performed. The summary includes some of the See response for IFPP A5.

important flood features. But walkdown sheets containing the details of the walkdowns were not available.

N/A IF B4 Relocated to IF C2 N/A This finding is adequately addressed via the analysis Propagation paths for areas are defined for highly risk contained in Section 3.0 of Risk Application SA MISC 005 IFSN A1 IF C1 SR Not Met IF C1 01 significant cases only. (Resolution of Internal Flood Peer Review Comments). No further action required.

4 41 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 448 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA4 RA4Sa42009 Sb4 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SR # 2005 Category F&Os SR #

For those quantified scenarios, a conservative approach was initially used that considered all PRA modeled SSCs to be damaged due to a flood originating or propagating into a particular flood area and a conditional core damage probability (CCDP) computed. This CCDP was then multiplied by the flood initiating frequency to estimate the core damage frequency (CDF). If the CDF for a given flood scenario was sufficiently low, e.g., less than about 0.1% of the nominal internal events CDF, then no further refinement was deemed necessary. However, if first estimates of the core damage frequencies for that compartment proved too Plant design features that have the ability to terminate or pessimistic, the affected area of the plant was analyzed in IFSN A2 IF C2 SR Not Met IF C2 01 contain the flood propagation are not documented for all greater detail to take into account spatial effects, specific defined flood areas. flooding flow rates, operator actions, drainage pathways, etc.

Hence, the justification for more detailed modeling of certain internal flood scenarios was aimed at removing some of the conservatism of the methodology, while at the same time providing a realistic basis for not assuming complete failure of all scenario specific equipment due to a credible flooding event.

The PRA model was updated in 2012 (SA112A) following the peer review to include all modeled internal flood scenarios and does not numerically screen any on a numerical basis.

No further action required.

In general, operator action for internal flood mitigation was only credited where needed to reduce the risk where failure of all PRA equipment was deemed too conservative. Also, IFSN A3 IF C2a SR Not Met IF C2a 01 This is only addressed for the most risk significant areas.

automatic isolation and operation of sump pumps or other dewatering equipment were not credited, which was a conservative approach. No further action required.

No discussion of required information is provided for the IFSN A4 IF C2b SR Not Met IF C2b 01 See response for SR IFSN A2.

majority of areas.

The documentation does not discuss spatial orientation for IFSN A5 IF C2c SR Not Met IF C2c 01 See response for SR IFSN A2.

components in those areas not screened.

SR Met: Component susceptibility to flood induced failure is IFSN A6 IF C3 N/A (CC I/II) considered.

4 42 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 448 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA4 RA4Sa42009 Sb4 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SR # 2005 Category F&Os SR #

Appendix D of the PRA Internal Flood Evaluation states The robustness of AOVs and MOVs with regard to spray that "For spray scenarios, however, walkdown observations scenarios was an informed judgment based on empirical revealed that Air Operated Valves (AOVs) and Motor observation. This observation is also reinforced by a paper Operated Valves (MOVs) were of a robust design that presented at the PSA 2008 ANS conference by J. Lin would exclude them from being susceptible to water (Insights from the Updates of Internal Flooding PRAs). Water IFSN A7 IF C3a SR Not Met IF C3a 01 damage. Hence, these components were not automatically spray does not generally prevent AOVs and MOVs from failed (PRA event equal to TRUE) for quantification of the operating, and although it may remotely be possible, the most CCDP." This is not an adequate basis for determining the likely result is that it will not. Therefore, the basis for this susceptibility of these components to flood induced failure assumption is deemed adequate and there is no further action mechanisms per this SR. required.

This finding is adequately addressed via the analysis SR Met: contained in Section 3.0 of Risk Application SA MISC 005 IFSN A8 IF C3b IF C3b 01 Identification is not present in documentation.

(CC I) (Resolution of Internal Flood Peer Review Comments). No further action required.

IFSN A9 IF C3c SR Met However, only for most important sequences. N/A In general, internal flood scenarios that were calculated using a conservative methodology that were found to contribute less than 0.1% to CDF were not subjected to any further scrutiny or refinement, since further refinement was deemed The defined flooding scenarios were screened without unnecessary for the purposes of the full power internal events development of flood rate, source, operator actions. (FPIE) PRA model. It is unlikely that this particular issue IFSN A10 IF C4 SR Not Met IF C4 01 Detailed assessments were only provided for selected high involving internal floods with a relatively small contribution to frequency floods. CDF would have a measurable impact on the results for this license amendment request. The PRA model was updated in 2012 (SA112A) following the peer review to include all modeled internal flood scenarios and does not numerically screen any on a numerical basis. No further action required.

Multi unit scenarios were considered and analyzed, e.g.,

scenarios involving AB 084B found in Appendix E of the IF C4a 01, Documentation of multi unit scenarios could not be Internal Flood Summary Notebook. The assessment in IFSN A11 IF C4a SR Not Met IF B1a 01 identified. Section 3.0 of Risk Application SA MISC 005 (Resolution of Internal Flood Peer Review Comments) did not identify any new potential multi unit scenarios. No further action required.

IFSN A12 IF C5 SR N/A No flood areas were screened out. N/A IFSN A13 IF C5a SR N/A No flood areas were screened out. N/A SR N/A No floods were screened out based on human mitigative IFSN A14 IF C6 N/A actions.

4 43 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 448 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA4 RA4Sa42009 Sb4 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SR # 2005 Category F&Os SR #

SR N/A Screening was not performed based on the criteria defined IFSN A15 IF C7 N/A in this requirement.

SR N/A No flood sources were screened out based on human IFSN A16 IF C8 N/A mitigative actions.

Walkdowns were performed. However, walkdown sheets IFSN A17 IF C9 SR Met IF A4 01 See response for SR IFPP A5.

with the required information were not available for review.

This requirement has been met by Appendices C & D of IFEV A1 IF D1 SR Met N/A the Flood Analysis Notebook.

N/A IF D2 This SR was deleted in RA Sb 2005. N/A IFEV A2 IF D3 SR Not Met IF C4 01 This is an extension of F&O IF C4 01. See response for SR IFSN A10.

There was no grouping or subsuming of flood initiating IFEV A3 IF D3a SR N/A N/A scenarios with other plant initiating event group.

There is no evidence that flooding in Unit 2 was considered IFEV A4 IF D4 SR Not Met IF C4a 01 See response for SR IFSN A11.

for its effects on Unit 1.

This requirement is met in Appendix D of the Flooding IFEV A5 IF D5 SR Met N/A Notebook.

SR Met: This requirement is met in Appendix D of the Flooding IFEV A6 IF D5a N/A (CC II/III) Notebook.

Human induced floods during maintenance were SR Met:

IFEV A7 IF D6 considered in Section 2.2.9.1.1 of the Internal Flood N/A (CC I/II)

Evaluation.

IFEV A8 IF D7 SR N/A Flood scenarios were not screened out using these criteria. N/A The CCDPs for each of the scenarios were calculated by setting all initiating events in the PRA model to zero, with IFQU A1 IF E1 SR Met either the turbine trip event with PCS available (%TT) or N/A PCS unavailable (%TP) set to a value of 1.0, depending on the nature of the components failed.

N/A IF E2 Moved to IF C3c N/A All of the components modeled in the PRA that were assigned to the various scenario IDs based on their location in the plant and their susceptibility to water damage from the various modes of flooding, i.e., spray, IFQU A2 IF E3 SR Met N/A general flooding, and major flooding. These components were utilized in flag files to set the appropriate basic events to TRUE, representing failure due to water damage, for the quantification of CCDPs for the analyzed scenarios.

4 44 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 448 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA4 RA4Sa42009 Sb4 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SR # 2005 Category F&Os SR #

Areas were screened if the product of the sum of the SR MET:

IFQU A3 IF E3a frequencies of the flood scenarios for the area and the N/A (CC II/III) bounding CCDP were less than 1E 9/reactor year.

No additional analysis of SSC data was performed to IFQU A4 IF E4 SR N/A N/A support quantification of flood scenarios IFQU A5 IF E5 SR Met Scenario specific impacts on PSFs are included. N/A IFQU A6 IF E5a SR Met Scenario specific impacts on PSFs are included. N/A Internal flood sequences are quantified in accordance with IFQU A7 IF E6 SR Met N/A the QU SRs.

The combined effects of failures caused by flooding and IFQU A8 IF E6a SR Met N/A due to causes independent of the flooding are included.

Both direct and indirect effects are included in the IFQU A9 IF E6b SR Met N/A quantification.

Flood sequences are represented appropriately in the IFQU A10 IF E7 SR Met N/A LERF analysis.

Walkdown documentation does not capture this information IFQU A11 IF E8 SR Not Met IF A4 01 See response for SR IFPP A5.

for all flood areas.

IFPP B1, IFSO B1, The internal flooding analysis documentation can support IFSN B1, IF F1 SR Met N/A PRA applications, upgrades, and peer review.

IFEV B1, IFQU B1 IFPP B2, The Internal Flood documentation (SA PRA 012) was revised IFSO B2, to include missing information and provide clarification where See all IF Some documentation elements are missing, as noted in the IFSN B2, IF F2 SR Not Met necessary during the Salem 2012 PRA model update. Since F&Os Internal Flood F&Os.

IFEV B2, this is a documentation issue, there is no impact on the IFQU B2 results for this license amendment request.

IFPP B3, Sources of modeling uncertainty (systemic) associated with IFSO B3, Assumptions are documented in the Flooding Notebook. internal flooding is now addressed in the Salem PRA IFSN B3, IF F3 SR Not Met IF F3 01 Parametric uncertainty analysis was done but systemic Uncertainty Notebook (SA PRA 018), which was created IFEV B3, uncertainty is not addressed. during the Salem 2012 PRA model update. No further action IFQU B3 required.

4 45 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 449 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR CONFIGURATION CONTROL RA4 RA4Sb4 Capability Associated Sa4 2005 Category F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 SR #

SR #

Salem specific site procedures should be developed for The Salem Generating Station has since developed site specific MU Maintenance of site specific PRAs. Develop Salem specific site procedures for maintenance and use of PRA models. They are MU A1 SR Met MU A1 01 A1 procedures. officially controlled and accessed via DCRMS. No further action is required.

MU This requirement is met in Section 4.1.2 of procedure ER AA N/A MU A2 SR Met 600 1015, "FPIE PRA Model Update," Revision 6.

A2 This requirement is met in Sections 4.1.3 and 4.2.2 of N/A procedure ER AA 600 1015, "FPIE PRA Model Update,"

MU Revision 6. Section 4.1.3 addresses how Updating MU B1 SR Met B1 Requirements (URE) puts are processed. Section 4.2.2 addresses review of UREs not dispositional into the next model update.

This requirement is met in Sections 4.1.3, and 4.2.1 of N/A procedure ER AA 600 1015, "FPIE PRA Model Update,"

MU MU B2 SR Met Revision 6. This requirement is met for periodic updates in the B2 project planning phase in Section 4.2.1 of the subject procedure and Section 4.1.3 for unscheduled updates.

MU Since the other Supporting Requirements are met this SR is N/A MU B3 SR Met B3 met by default.

There is no reference to the requirement for a PRA peer review Step 4.5.5.4.A of ER AA 600 1015 addresses this concern MU MU B4 SR Not Met MU B4 01 for upgrades. regarding PRA upgrades and the possibility for needing a limited B4 peer review against the ASME PRA Standard.

There is no reference to a review of the cumulative impact of Step 4.3.1.3 of ER AA 600 1015 addresses this concern MU pending changes. regarding cumulative impact of pending PRA model changes.

MU C1 SR Not Met MU C1 01 C1 No further action is required.

MU This requirement is met in Section 4.2.7 of procedure ER AA N/A MU D1 SR Met D1 600 1015, "FPIE PRA Model Update," Revision 6.

This requirement is met in Sections 4.1 and 4.2 of procedure N/A MU MU E1 SR Met ER AA 600 1014, "Risk Management Configuration Control,"

E1 Revision 5.

MU All items are met except for item (f), the review of the cumulative N/A MU F1 SR Met F1 impact of pending changes. See F & O MU C1 01.

4 46 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 4410 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF REVISED SUPPORTING REQUIREMENTS RA4Sa42009 RA4Sb42005 DESCRIPTION OF CHANGE COMMENTS SR # SR #

Coincident unavailability due to maintenance for redundant The SA112A PRA Model of Record (MOR) makes use of dual Service Water equipment is now being based on the activity being the result pump maintenance terms based on previous maintenance activities, which of a planned, repetitive activity that is based on plant may not have been considered as being routine or repetitive evolutions. As experience. This implies that maintenance terms used in the such, the more recent version of this Supporting Requirement implies that PRA model that represent multiple SSCs being unavailable these maintenance terms can be removed from the PRA model if the DA C14 DA C13 should not be used unless the activity is a routine planned maintenance activity is not considered a planned and repetitive activity. The evolution. net effect is that this may result in a slight decrease in CDF and LERF if the SW pump dual maintenance terms are removed from the PRA model. An Updating Requirement Evaluation (URE) record has been recorded (SA2016 005) to capture this as part of the maintenance and update of the Salem PRA model.

The newer version of the Supporting Requirement (SR) states This has no impact on the Salem PRA MOR as the resolution of circular logic that when resolving circular logic to NOT introduce any was more clearly documented during the 2012 PRA model update in the PRA unnecessary conservatisms or non conservatisms, whereas System Notebook for vital AC power (SA PRA 005.0020). A review of this QU B5 QU B5 the previous version of the Standard used the work AVOID. document in Section 6.8 provides evidence that unnecessary conservatisms or non conservatisms were NOT introduced as a result of resolving circular logic issues.

The newer version of this Supporting Requirement redefines During the 2012 PRA model update, the Uncertainty Notebook (SA PRA 018) the treatment of model uncertainty and related assumptions was officially issued and includes a comprehensive treatment on model with the intent of IDENTIFYING how the PRA model is uncertainty and assumptions for both CDF and LERF, using references that affected, whereas the older version was focused more on an include EPRI 1026511, which addresses the use of PRA and the treatment of QU E4 QU E4 EVALUATION of sensitivity studies as it related to model uncertainty, and EPRI 1016737, which addresses the treatment of parameter uncertainty and assumptions. and model uncertainty. As such, the PRA model documentation is in compliance with the 2009 version of the ASME PRA Standard with regard to this Supporting Requirement.

The newer version of this SR redefines the treatment of model See response for SR QU E4.

uncertainty and related assumptions by referring to QU E4, whereas the earlier requirement referenced an example listing QU F4 QU F4 of "key assumptions" and "key sources of uncertainty", such as success criteria, reliability data, modeling uncertainties, completeness of initiating events, spatical dependencies, etc.

The change for this SR involves the same change involving the See response for SR QU E4.

LE F3 LE F3 treatment of uncertainty and assumptions as for CDF, except that the focus is on LERF.

4 47 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 4411 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF QUALIFICATIONS FROM REG GUIDE 1.200 (APPENDIX A)

RA4Sa4 RA4Sb4 DESCRIPTION OF RG 1.200, REV. 2, COMMENTS 2009 SR # 2005 SR # QUALIFICATION STATEMENT This SR provides a justification for crediting equipment repair (SYA24).

As written, it could be interpreted as allowing plant specific data to be discounted in favor of industry data. In reality, for such components as pumps, plant specific data is likely to be insufficient and a broader base is This Supporting Requirement (SR) is not applicable for the Salem PRA DA C15 DA C14 necessary. model since no credit is being taken for repair of equipment following initial failure.

IDENTIFY instances of plant specific experience or and, when that is insufficient to estimate failure to repair consistent with DA4D9, applicable industry experience and for each repair, COLLECTZ.

New requirement needed, DA C15 was incomplete, only provided for data collection, not quantification of repair. (See SY A24.)

DA D9 N/A For each SSC for which repair is to be modeled, ESTIMATE, based See response for SR DA C15.

on the data collected in DA4C15, the probability of failure to repair the SSC in time to prevent core damage as a function of the accident sequence in which the SSC failure appears.

4 48 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 4411 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF QUALIFICATIONS FROM REG GUIDE 1.200 (APPENDIX A)

IFSN A6 IF C3 For Cat II, it is not acceptable to just note that a flood induced failure Component susceptibility to flood damage due to either submergence or mechanism is not included in the scope of the internal flooding analysis.

spray effects was identified for various types of SSCs in section 2.2.5 of the Some level of assessment is required.

Internal Flood PRA Notebook (SA PRA 012). Damage to SSCs due to jet impingement, pipe whip, elevated temperature, humidity, and excessive Cat I:

condensation are attributed to High Energy Line Break type of scenarios For the SSCs identified in IFSN A5, IDENTIFY the susceptibility of each which are modeled using feedwater and steam line break initiating events SSC in a flood area to flood induced failure mechanisms. INCLUDE that are already a part of the full power internal events (FPIE) PRA model.

failure by submergence and spray in the identification process.

Also, these high energy line break (HELB) scenarios are covered under the Design and Licensing process where Equipment Qualification of safety EITHER:

related SSCs is required as part of the Design and Licensing basis.

(a) ASSESSZ by using conservative assumptions; OR (b) NOTE that these mechanisms are not included in the scope of the In addition, most high energy system piping is located in an outside evaluation.

environment at Salem since the Salem turbine deck is open to the atmosphere. Within the Auxiliary Building, high energy steam piping that Cat II:

supplies the motive force for the turbine driven Auxiliary Feedwater (AFW)

For the SSCs identified in IFSN4A5, IDENTIFY the susceptibility of pump is contained within an enclosure designed for HELB scenarios.

each SSC in a flood area to flood4induced failure mechanisms.

INCLUDE failure by submergence and spray in the identification The water systems associated with internal flood hazards are typically process.

below 200 deg. F and less than 275 psig, which are incapable of producing the flood induced mechanisms associated with HELB scenarios. As such, ASSESS qualitatively the impact of flood4induced mechanisms that the damage mechanisms associated with HELB scenarios (i.e.,

are not formally addressed (e.g., using the mechanisms listed under mechanisms listed under Capability Category III) are not applicable to the Capability Category III of this requirement), by using conservative modeled internal flood scenarios in the Salem FPIE PRA model.

assumptions.

4 49 SA LAR 007

Salem Generating Station CFCU AOT Extension 4.1.4 URE Status The URE database is a resource and working tool used by the Risk Management Team to ensure that the as built, as operated Salem plant configuration is reflected in the PRA. In addition, enhancements to the PRA quality are also identified, tracked, and resolved. The observations are recorded in the URE database. These observations identify potential areas of investigation for future model enhancement. Based on a review of this database, there are no outstanding UREs that would invalidate the use of the SA112A PRA model for quantifying the risk implications involved with the proposed CFCU AOT extension.

The major plant safety upgrade that led to the PRA update in accordance with PSEG procedural guidance was the diesel electric 4th AFW pump that will be capable of cooling all steam generators at both Salem Units 1 and 2. The diesel is located in a dedicated building and the pump is in the Unit 1 Turbine Building. The pump discharges to the MFW system, making it completely independent from the Auxiliary Feedwater (AFW) system and the Auxiliary Building. This plant modification increases the defense in depth for secondary side heat removal, thus making the use of feed and bleed operation, and subsequent containment sump recirculation, less likely for removal of decay heat.

4.1.5 Review of PRA Model Specific to Application As a result of reviewing the cutsets for the configuration in which two CFCUs are concurrently unavailable, it was seen that various cutsets that were previously below the truncation threshold were now above the threshold. A review of some of these cutsets revealed that the accident sequences would not necessarily lead to core damage due to being long term and slowly developing scenarios that would not require containment cooling, either by the Containment Spray (CS) System or CFCUs. For example, many of these sequences involved a transient event followed by successful operation of the AFW System for approximately 11 hours1.273148e-4 days 0.00306 hours 1.818783e-5 weeks 4.1855e-6 months , but due inability to refill the AFW storage tank, operation of feed and bleed was implemented via injection from the Refueling Water Storage Tank (RWST). A MAAP 4.0.6 sensitivity analysis showed that this type of 4 50 SA LAR 007

Salem Generating Station CFCU AOT Extension accident sequence did not require successful containment cooling either via CS or CFCUs. As such, an application specific model was developed to exclude these cutsets in order to attain a more accurate analysis of the risk increase. PSEG risk application SA MISC 016, Application Specific Model for CFCU LAR, provides the details of the SA112B application specific PRA model that will be utilized for this extended AOT analysis.

4.2 TECHNICAL ADEQUACY CONCLUSION The combination of the internal events and internal flood PRA development process, associated PRA peer review, resolution of F&Os, and subsequent PRA update resulted in the current Model of Record (MOR) known as the SA112A model. Because of the specific configuration involving concurrent unavailability of two CFCUs, an application specific model was created to more accurately estimate the risk increase for this CFCU AOT extension (see Section 4.1.6).

In general, based on the information presented in the previous sections, the SA112A PRA MOR is deemed acceptable for use in evaluating the impact on risk due to the proposed CFCU AOT extension.

4.3 EXTERNAL EVENTS CONSIDERATIONS 4.3.1 Overview External hazards were evaluated in the Salem Individual Plant Examination for External Events (IPEEE) submittal in response to the NRC IPEEE Program (Generic Letter 88 20, Supplement 4) [12]. The IPEEE Program was a one time review of external hazard risk and was limited in its purpose to the identification of potential plant vulnerabilities and the understanding of associated severe accident risks.

The results of the Salem IPEEE study are documented in the Salem IPEEE [10]. Each of the Salem external event evaluations were reviewed as part of the Submittal by the NRC and compared to the requirements of NUREG 1407 [13].

4 51 SA LAR 007

Salem Generating Station CFCU AOT Extension Consistent with Generic Letter 88-20, the Salem IPEEE Submittal does not screen out seismic or fire hazards, but provides quantitative analyses. The following sections provide a brief summary of the seismic and fire hazards probabilistic analysis.

4.3 . 2 Seismic PRA The seismic risk analysis provided in the Salem Individual Plant Examination for External Events is based on a detailed Seismic Probabilistic Risk Assessment. A Seismic Probabilistic Risk Assessment analysis approach was taken to identify any potential seismic vulnerabilities at Salem. The Seismic PRA method was deemed an acceptable methodology identified in NUREG-1407. This PRA technique included consideration of the following elements:

Seismic hazard analysis

Seismic fragility assessment

Seismic systems analysis

Quantification of the seismically induced core damage frequency The Salem Seismic PRA study is a detailed analysis that, like the internal fire analysis, uses quantification and model elements (e.g., system fault trees, event tree structures, random failure rates, common cause failures, etc.) consistent with those employed in the internal events portion of the Salem PRA.

Some of the highlights of the Salem Seismic PRA methodology include the following:

Seismic hazard curve is based on the EPRI site specific seismic hazard study. In addition, revised Lawrence Livermore National Laboratory (LLNL) seismic hazard estimates are used as input as a sensitivity case.

A seismic event is not always assumed to result in a Loss of Offsite Power (LOOP). Seismic failure of offsite power is evaluated on a probabilistic basis according to component fragilities.

The Salem IPEEE stated that no plant unique or new vulnerabilities associated with the Seismic Analysis were identified. The Seismic PRA for Salem, with its original IPEEE hazard curves and identified dependencies and fragilities, can be used to provide general quantitative and qualitative insights.

4-52 SA-LAR-007

Salem Generating Station CFCU AOT Extension 4.3.3 Fire PRA The analysis of the impact of internal fires consisted of a screening of fire areas based on EPRI Fire Induced Vulnerability Evaluation (FIVE) methodology [14]. As prescribed by the FIVE methodology, detailed area by area equipment and cable inventories were developed from the Appendix R analysis, the Safe Shutdown Analysis (SSA) [15], and the Fire Hazards Analysis (FHA) [16]. The fire evaluation was performed on the basis of fire areas, which are plant locations completely enclosed by rated fire barriers. The fire area boundaries were assumed to be effective in preventing a fire from spreading from the originating area to another area based on the implementation of a satisfactory fire barrier surveillance and maintenance program, and observation during the walkdown. The fire area boundaries recognized in this study are defined in Sections 3 through 5 of the Salem Generating Station FHA [16] and in the SSA [15]. Qualitatively, an area was screened out if the area neither contained safe shutdown equipment nor called for a manual or automatic plant trip, given the condition that all equipment in the area is damaged. Quantitatively, an area was screened out if the CDF could be shown to be less than 1E 06 per year, assuming a reactor trip and all equipment in the area failed and was unrecoverable.

In theory, the contribution to core damage frequency from fires anywhere in the plant may be assessed in detail. However this was impractical due to the large number of possible scenarios and also unnecessary, since fires in many plant areas are incapable of causing significant damage regardless of how severe they become. Consequently, the first stage in performing a fire analysis was to perform a systematic screening of all fire areas in accordance with the FIVE methodology. Areas not screened quantitatively or qualitatively were retained for a further detailed PRA evaluation.

The purpose of the qualitative screening was to identify the boundaries of the plant fire areas, together with the location of equipment and cables which, if damaged by fire, would cause a plant shutdown or degradation of shutdown paths identified in the plant's SSA or IPE. This information was then used to qualitatively screen fire areas from further consideration using the criteria developed in the FIVE methodology. The steps involved in qualitative screening included the following:

4 53 SA LAR 007

Salem Generating Station CFCU AOT Extension

Step 1 - Identification of Fire Areas

Step 2 - Identification of Plant Safe Shutdown Systems

Step 3 - Identification of Safe Shutdown Equipment in Each Fire Area

Step 4 - Perform Fire Area Safe Shutdown Function Evaluation For the quantitative screening analysis, the FIVE methodology provided a method of screening based on a conservative estimation of the contribution to CDF. The equipment contained within an area was assumed to fail due to a fire. Using an event tree representative of the most significant failure, the contribution to CDF was then calculated. If this contribution was less than 1E-06 per year using the fault tree and event tree models from the IPE, the area or compartment was able to be screened out.

As part of the IPEEE internal fire analysis, one potential plant vulnerability was identified, and a plant enhancement has been implemented as a result [17]. There are two sets of cables supplying offsite power to the 4kV vital buses and these are routed through one elevation of the turbine and service buildings before entering the auxiliary building. The two sets provide a redundant source of power to the vital 4kV buses.

Thus, if one set is damaged by fire, the second set could provide power to all three buses. In the turbine and service buildings, the two redundant sets of cables are separated by less than 10 feet for a portion of the area. No significant fixed combustible sources are located within 30 feet of the cables and are therefore not considered to be risk significant. However, as a result of the fire IPEEE, transient combustible controls similar to those in place for the auxiliary building, penetration areas and service water intake structure have been put into effect for this area of the turbine and service buildings. As a result of the enhancement, daily walkdowns will be performed for the elevation on which the cables are routed, trays containing the cables will be marked to identify them as safety-related, fire watches will be posted if any normally active suppression systems are disabled, and transient combustibles entering the area of the cables will be require administrative approval. Procedures are now being revised to ensure these activities are accomplished through periodic monitoring. The internal fire PRA model was credited with this enhancement and was reflected in the IPEEE results.

4-54 SA-LAR-007

Salem Generating Station CFCU AOT Extension 4.3.4 Other External Hazards In addition to internal fires and seismic events, the Salem IPEEE analysis of high winds or tornados, external floods, transportation accidents, nearby facility accidents, release of onsite chemicals, detritus and other external hazards was accomplished by reviewing the plant environs against regulatory requirements regarding these hazards. The screening assessment took advantage of the fact that the site is co located with the Hope Creek Generating Station (HCGS), which is a plant that meets the 1975 Standard Review Plan (SRP) criteria [18]. To the extent that the event assessment is based on location of the site, as opposed to plant specific features, information from Sections 2 and 3 of the latest revision of the HCGS Updated FSAR (UFSAR) [19] was used to supplement information from the Salem UFSAR [20].

The class of external events termed "other external events" were screened out either by compliance with the 1975 SRP criteria [18] or by bounding probabilistic analyses that demonstrated a core damage frequency of less than the IPEEE screening criterion.

The external flood assessment provided input to the now completed PSE&G Penetration Improvement Program by recommending that a high priority be placed on penetrations through the Auxiliary Building/Service Building walls. The IPEEE provided confidence that no plant unique external event is known that poses a significant threat of severe accidents and that the Salem units are not vulnerable to other external events.

More recently, in response to NRC Order EA 12 049 [28], which was issued following the tsunami and plant consequences experienced at Fukushima Daichi in March 2011, PSEG developed an Overall Integrated Plan (OIP) [29] to enhance the defense in depth countermeasures aimed at mitigating extreme external hazards. The OIP employed the use of Diverse and Flexible Coping Strategies (FLEX) in accordance with the guidance given in NEI 12 06 [30]. This resulted in the deployment of portable FLEX equipment that could be put into service when necessary to mitigate extreme external hazards.

Although FLEX is not explicitly modeled in the SA112B PRA model used for this CFCU AOT extension, qualitative insights suggest that the risk due to these other external hazards, as well as other beyond design basis events pursuant to Reference [30], would 4 55 SA LAR 007

Salem Generating Station CFCU AOT Extension be even less than what was characterized by any historic evaluations performed in support of the IPEEE.

4.3.5 External Hazard PRA Summary Due to the fact that Salem does not have a current external events PRA model, the use of IPEEE results was deemed acceptable for use in providing insights into the risk contribution associated with the CFCU AOT extension.

4.4

SUMMARY

The Salem PRA model, maintenance and update process, and technical capability discussion described above provide a robust basis for concluding that the PRA is suitable for use in risk informed processes. However, given the discussion in Section 4.1.6, and because the specific configuration of interest involves the concurrent unavailability of two CFCUs, which is the basis for this analysis, an application specific PRA model (SA112B) was developed in order to remove non core damage cutsets to more accurately assess the risk increase for this CFCU AOT extension. Since this was the only change made to the current Salem PRA MOR (SA112A), the technical adequacy of the SA112A MOR also extends to this application specific PRA model (SA112B).

4 56 SA LAR 007

Salem Generating Station CFCU AOT Extension 5.0 DISCUSSION OF RISK CONTRIBUTORS AND UNCERTAINTY This section evaluates epistemic uncertainties that could impact the CFCU AOT extension assessment. Section 5.1 provides a breakdown of the contributors to the CDF risk increase associated with this LAR to provide a framework for performing the uncertainty analysis. Note that the focus is on CDF since there is substantial margin to the acceptance guidelines for the LERF figure of merit. Section 5.2 then elaborates on the three types of epistemic uncertainty: parameter, model, and completeness uncertainties. Section 5.3 provides results of sensitivity studies that were performed based on the model uncertainty evaluation (including issues identified from peer review findings). Section 5.4 then summarizes the insights obtained from the uncertainty assessment.

Overall, this LAR contains all the elements of risk informed decision making process described in NUREG 1855. The structure used to present this information is shown in Figure 5 1, which is taken from the companion document to NUREG 1855 entitled EPRI 1026511, Practical Guidance on the Use of Probabilistic Risk Assessment in Risk Informed Applications with a Focus on the Treatment of Uncertainty [25]. Table 5 1 provides a roadmap identifying the relevant sections of the uncertainty analysis.

TABLE 541 ROADMAP TO THE UNCERTAINTY ANALYSIS Step Step Summary Document Section 1 Define the risk analysis application to be Performed in Section 1.

used to address RG 1.177 2 Assess the adequacy of the existing PRA Performed in Section 4. Technical Adequacy of models to support the analysis the PRA Model.

3 Perform the initial comparison with the Initial comparison is shown in the Executive acceptance guidelines. Identify significant Summary; significant contributors are identified contributors and role of affected function. in Section 5.2.

4 Assess the adequacy of the scope of the Assessed in Section 4.

PRA models 5 Perform final comparison with acceptance Analyzed in Section 5.5; parametric analysis guidelines - assessment of significance of shown in Section 3.5.

parameter and model uncertainty 6 Prepare input for the integrated decision Section 6.

making process 51 SA LAR 007

Salem Generating Station CFCU AOT Extens i on

'i$w FIGURE 5- 1 OVERVIEW OF PROCESS FOR PRA ANALYSIS TO S U PPORT A RIS K INFORMED DECISION 5-2 SA-LAR-007

Salem Generating Station CFCU AOT Extension 5.1 STEP 3 : INITIAL COMPARISON T O ACCEPTANCE GUIDELINES Table 5-2 summarizes the calculated values for the NRC specified risk metrics (!lCDF, L'lLERF, ICCDP, and ICLERP) for the proposed change to the AOT involving the concurrent unavailability of two CFCUs for a period of 14 days, with the premise that this occurs on three separate occasions throughout a given refueling cycle (18 months).

The process used to calculate the risk metrics complies with NRC Regulatory Guides 1.174 and 1.177, as described in Section 3.

TABLE 5-2 QUANTITATIVE RESULTS OF THE RISK METRICS FOR CONCURRENT UNAVAILABILITY OF TWO CFCUS Parameter Value Comments TcvcLE 547.5 days Based on 1 8 month refuelin_g cycle T cFcu 14 days Number of days that two C FCUs are unavailable CDF based on application of flag file for two CD F cFc u 1 .62E-05 unavailable CFCUs and adj usted C C F term LERF based on application of flag file for two LERFcFcu 7.32E-07 unavailable CFCUs and adjusted C C F term CDF sASE 1.55E-05 CDF for PRA MOR LERF sAs E 7.29E-07 LERF for PRA MOR Average CDF over one 1 8 month refueling cycle CDFAVE 1.55E-05 for three instances of dual CFCU unavailability for 1 4 days at a time Average LERF over one 18 month refueling cycle LERFAvE 7.29E-07 for three instances of dual CFCU unavailability for 1 4 days at a time Difference between CDF with current technical specifications and the CDF for an average 1 8 month cycle with three instances of concurrent 1'\CDF 5.61E-08 unavailability of two C FCUs extended to 14 days This value is below Region Ill of RG 1 . 1 74 Difference between LERF with current technical specifications and the LERF for an average 1 8 month cycle with three instances of concurrent 1'\LERF 2.15E- 1 0 unavailability of two C FCUs extended to 1 4 days This value is well below Region Ill of RG 1.174 ICCDP cFc u 2.80E-08 Below 1 E-06 Acceptance Guideline of RG 1.1 77 ICLERPcFcu 1 .08E-1 0 Below 1 E-07 Acceptance Guideline of RG 1 .177 5-3 SA-LAR-007

Salem Generating Station CFCU AOT Extension Note that all risk values are much more than one order of magnitude below the Acceptance Guidelines of RG 1.177. The calculations of delta CDF are and delta LERF are very small, as defined in RG 1.174 (less than 1E 6 and 1E 7 respectively). Salems CDF and LERF are clearly in Region III of Figure 5 in RG 1.174. Therefore, the focus of the uncertainty analysis will be to search for model uncertainties that could approach or exceed the acceptance guidelines.

5.2 CONSIDERATION OF SIGNIFICANT CONTRIBUTORS To determine the relative importance of the individual contributors for this LAR, the focus needs to be on the results of the CDF assessments for two CFCUs out of service.

Note that the results are very similar when a single CFCU is out of service in the internal events and internal floods models such that a detailed presentation of those results is not warranted.

To obtain insights regarding the changes to the base case results when two CFCU are out of service, the first step is to take the out of service case results and remove the base case cutsets (e.g. using the CAFTA delete term process). This leads to a cutset file that can be used to provide information regarding the significant accident sequences or cutsets that are driving the delta CDF assessment.

For the internal events and internal floods assessment, the results are presented by initiator in Table 5 3. Since the delta CDF is quantitatively more limiting than delta LERF analysis, the initiating event and component importance analysis is done on the delta CDF calculations. The delta LERF files were reviewed and a more detailed analysis would provide no additional information. The reason delta LERF is less limiting is well understood - the risk increase is predominantly from slowly developing core damage scenarios with late recirculation failure.

The change in CDF comes from approximately equal contributions from intermediate LOCA, LOOP and internal flood initiators. In addition, the dominant cutsets for each case were reviewed to assist with understanding the important contributors and identifying potential sources of model uncertainty.

54 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 5-3 MAJOR INITIATING EVENTS CONTRIBUTING TO THE RISK INCREASE Fig u re of Merit I nternal Events & I nternal Floods CDFcFcu 1 .62E-05 CDF BASE 1 . 55 E-05 CDF = C D Fx - CDF aAsE 5.6 1 E-08 I NTERMEDIATE LOCA 32%

LOSS OF OFFSITE POWER 25%

I NTERNAL FLOODS 21%

TRANSI E NTS 7%

SMALL LOCA 3%

LARGE LOCA 3%

OTHER 8%

Intermediate LOCA cutsets are characterized by an additional dependent failure of a CFCU, which fails the system, and failure of the containment spray system (CSS),

which leads to failure of containment sump recirculation. The most important CSS failure is the operator failing to align the RHR pump discharge to the containment spray system headers for long-term containment spray.

The next most important family of scenarios are LOOPs and transients that lead to a LOOP or LOOP-like conditions because of a consequential LOOP. The LOOP cutsets are not related to station blackout; instead, they are characterized as cutsets that affect the ability to cool the steam generators. As with most PRAs, the Salem PRA model does not credit the use of any secondary cooling functions (e.g. , condensate or main feedwater) in LOOP scenarios. From the internal events analysis, the dominant cutsets typically involve multiple operator actions, such as dependent human failure events that result in loss of decay heat removal.

The flooding cutsets involve flooding from the AFW system on the 78' elevation of the Auxiliary Building. In addition to the AFW system, the flooding cutsets characteristically 5-5 SA-LAR-007

Salem Generating Station CFCU AOT Extension fail at least one additional CFCU and the containment spray function. The cutsets also require an additional failure which renders non safety related steam generator cooling (condensate and main feedwater) unavailable. Consequential loss of offsite power and a variety of human failures lead to unavailability of the condensate and feedwater systems. In these cutsets, bleed and feed cooling is successful, but recirculation fails due to the inability to cool containment.

The review of the top level contributors in Table 5 4 and top cutsets provides a general understanding of the nature of the most important CDF contributors associated with the CFCU outages. A more detailed and comprehensive view of the contributors is gained through a review of the important individual basic event contributors. The results of the internal events and internal flood assessment at the basic event level are provided in Table 5 4. In both cases, the basic events sorted by Fussell Vesely importance (i.e.,

percent contribution) are provided for all Fussell Vesely values greater than 0.005.

Note that specific initiating event contributors have been purposely excluded from this list since they have already been assessed in Table 5 3. Flag events that add no pertinent information for the analyst were also excluded.

Starting at the top of Table 5 4, the review of important basic events begins with VCS FNR FR DF01, which is the common cause failure of 3 or more fans. This event is quite important because it is quantified using the conditional probability that additional fans will fail given that two other fans have initially failed. It appears in LOCA, LOOP and many other cutsets.

The second most important event, CSS XHE FO CSREC, represents the operator failing to align the discharge of the RHR system to the containment spray system during recirculation of water from the containment sump. This operator action is required after depletion of the Reactor Water Storage Tank (RWST). This event appears along with VCS FNR FR DF01 (discussed above) in LOCA, LOOP and many other cutsets.

The next most important event, MFW XHE FO CONDE, represents failure of the operator to use secondary plant systems to cool the steam generator following loss of AFW. AFW is rendered unavailable in Auxiliary Building internal flood scenarios.

56 SA LAR 007

Salem Generating Station CFCU AOT Extension The fourth most important event of substantially high importance is CIS XHE FC XLCNT, which represents the operator failing to isolate the Reactor Coolant System (RCS) letdown flowpath. This subsequently leads to a LOCA that will eventually require the capability to perform containment sump recirculation.

Table 5 4 presents those basic events that were found to be important to the relative increase in plant risk:

TABLE 544 BASIC EVENTS IMPORTANT TO THE RISK INCREASE Event Probability Fussell4 Achiev. Description Vesely Worth VCS FNR FR DF01 8.22E 01 0.6716 1 DEP FAILURE TO RUN OF 3 OR MORE FANS CSS XHE FO CSREC 1.90E 03 0.5146 271 OPER FAILS TO ALIGN RHR DISCHARGE TO CSS SPRAY MFW XHE FO CONDE 1.80E 02 0.1746 11 OPERATOR FAILS TO ESTABLISH FW TO SGs (EXEC ONLY EARLY CASE)

CIS XHE FC XLCNT 2.60E 03 0.1316 51 OPERATOR FAILS TO TERMINATE EXCESS LD LOCA THRU CNTMT AC5 OFFSITE PWR 5.30E 03 0.0561 12 POWER UNAVAILABLE TO 500 KV SWITCHYARD AFS XHE FO EARLY 3.70E 03 0.0358 11 OPERATOR FAILS TO DIAGNOSE LOSS OF SECONDARY HEAT REMOVAL RHS LSW FT 1RH1 1.00E 04 0.0327 328 VALVE 1RH1 CLOSED LIMIT SWITCH FAILS RHS LSW FT 1RH2 1.00E 04 0.0327 328 VALVE 1RH2 CLOSED LIMIT SWITCH FAILS CCS MOV CC DF10 3.03E 05 0.0247 814 DEP FAILURE TO OPEN OF 2 MOV'S (11, 12CC16)

JHE XHE CSREC AFL1 1.00E 06 0.0225 22318 JOINT HUMAN ERROR FAILING CONT. SPRAY AND AFW LATE JHE XHE AFE CSREC 1.00E 06 0.0220 21829 JOINT HUMAN ERROR FAILING CONT. SPRAY AND AFL1 AFW JHE XHE CSREC AFL12 1.00E 06 0.0220 21829 JOINT HUMAN ERROR FAILING CONT. SPRAY AND AFW LATE AFS XHE FO LATE1 3.00E 04 0.0204 69 COGNITIVE FAILURE ASSOC WITH H2OLT AND REFILL LATE RHS XHE FO RECIR 2.00E 03 0.0171 10 OPER FAILS TO REALIGN FOR RECIRC LONG TIME (SLOCA)

IFB XHE 4.40E 03 0.0159 5 FAILURE TO ISOLATE SG AFTER FEEDLINE BREAK CCS MOV CC 11C16 1.58E 03 0.0139 10 VALVE 11CC16 FAILS TO OPEN CCS MOV CC 12C16 1.58E 03 0.0132 9 VALVE 12CC16 FAILS TO OPEN RCS XHE FO LDEP 8.40E 03 0.0090 2 OPER FAILS TO DEPRESSUR RCS LATE AFTER SGTR SJS XHE FC TRMSI 2.50E 03 0.0077 4 OPERATOR FAILS TO TERMINATE SI ACP XHE FO GTG 6.70E 02 0.0054 1 GTG UNAVAILABLE DUE TO OP FAILURE CSS MOV CC 1CS36 1.07E 03 0.0052 6 MOV 11CS36 FAILS TO OPEN AC5 GTS TM GTG 6.37E 02 0.0051 1 GAS TURBINE GEN UNAVAIL DUE TO TM RHR XHE FO SHDCL 4.80E 03 0.0051 2 OPER FAILS TO ALIGN SHUTDOWN COOLING AFTER DEPRESS 57 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 5-4 BASIC EVENTS IMPORTANT TO THE RISK INCREASE Event Probability Fussell- Achiev. Description Vesely Worth SWS-AOV-CC-12223 2.06E-03 0.0050 3 AOV 1 2SW223 FAILS TO OPEN SWS-AOV-CC-14223 2.06E-03 0.0050 3 AOV 1 4 SW223 FAILS TO OPEN SWS-AOV-CC-1 5223 2.06E-03 0.0050 3 AOV 1 5SW223 FAILS TO OPEN AFS-MDP-FS-DF04 1 . 1 OE-05 0.0048 442 DEPENDENT FAILURE OF ALL 3 AFW PUMPS CSS-MOV-CC-2CS36 1 .07E-03 0.0048 5 MOV 1 2CS36 FAILS TO OPEN A review of the importance measure reports presented in Tables 5-3 and 5-4 confirm the importance of some of the contributors identified previously and provide some additional insights. These additional insights are listed below:

From the internal events assessment, intermediate LOCAs will eventually require recirculation. Unavailability of CFCUs increases the likelihood that containment conditions will not support continued successful sump recirculation.

From the internal events assessment, internal flood risk is dominated by flooding on the 78' elevation of the Auxiliary Building, which fails the air-operated SW outlet valves (SW-223) for each CFCU. These valves fail open on loss of air and closed on loss of DC power. Random valve failures are also important following other non-internal flood initiating events.

From the internal events and internal flood assessment, operator actions associated with loss of decay heat removal (LODHR) scenarios were identified as important (i.e., aligning containment spray, initiating and operating steam generator cooling), and associated actions that are important in feed and bleed cooling. They are important as both individual human failure events as well as dependent failures involving multiple operator actions.

From the internal events and internal flood assessment, maintenance on containment spray and emergency diesel generators (EDGs) also contribute to the risk increase in some manner.

From the perspective of fire PRA scenarios, the WIP Fire PRA model showed a high dependence on offsite power. Due to this high dependence, the dependence on the CFCUs for this particular configuration analyzed in this CFCU AOT extension was minimal.

From the internal events assessment, failure of one additional CFCU is important, either due to failure of an additional fan or associated damper failures.

From the internal events assessment, no additional common cause events significantly affected the outcome other than those associated with the conditional probability for failure of additional CFCUs.

5-8 SA-LAR-007

Salem Generating Station CFCU AOT Extension

From the internal events assessment, LOOP initiators and consequential LOOPs (AC5-0FFSITE-PWR) are important since they result in failure of all non-safety related methods of steam generator cooling. EDG importance is not as high due to a failure of any one EDG only affecting one of the three safety buses at Salem.

One unique feature of the Salem electrical distribution system is the fact the plant has 3 EDGs and vital buses, but only 2 fuel oil transfer pumps. This configuration affects station blackout scenarios, but has a negligible impact on this CFCU AOT extension analysis.

Based on these insights, none of the noted contributors represent an inordinately large fraction of the risk contribution to either the internal events or fire hazard results.

5.3 STEP 4: ADEQUACY OF THE SCOPE OF THE SALEM PRA Based on the very small risk increase involving the configuration analyzed in this LAR (see Section 3.4.5), there is no further need for additional compensatory measures or quantification. Based on fire PRA insights from the WIP Fire PRA model, it was found that there was no appreciable increase in fire risk as a result of this CFCU AOT extension. Because of this, quantitative fire PRA results were not deemed necessary.

5.4 STEP 5: UNCERTAINTY ANALYSIS As discussed earlier, epistemic uncertainty is generally categorized into three types -

parameter, model, and completeness uncertainty. These are each discussed in the sections that follow.

5.4.1 Parameter Uncertainty The cutset results for the different CDF assessments were reviewed to determine if the epistemic correlation could influence the mean value determination. From the review of the cutsets, it was determined that the dominant contributors do not involve basic events with epistemic correlations (i.e., the probabilities of multiple basic events within the same cutset for the dominant contributors are not determined from a common parameter value). Per Guideline 2b of EPRI 101673, it is acceptable to use the point estimate directly in the risk assessment.

To verify that the use of the point estimate is acceptable in these cases, a detailed Monte Carlo calculation using EPRI R&R workstation UNCERT software was performed 5-9 SA-LAR-007

Salem Generating Station CFCU AOT Extension to compare the mean value determined from the Monte Carlo simulation as compared to the point estimate. The results of those assessments for the calculated change in core damage frequency (CDF) are provided in Figures 3 1 and 3 2. Although the change in risk determined from the propagated mean is typically slightly higher, the change in risk was less than 5% in all cases. Therefore, based on the small difference in the comparison of the mean value with the point estimate values provided, the use of the point estimate for this assessment is deemed acceptable.

Note that a similar assessment was performed for the LERF figure of merit and exhibited a similar trend. That is, the parametric mean values were very close to the point estimate mean values. The results of those assessments are provided in Figures 3 3 and 3 4. For these LERF cases, the percent difference between the two means from the base case and CFCU AOT extension was essentially zero. Therefore, since LERF is not a significant contributor for this assessment, the use of the point estimate is also deemed acceptable.

Reviewing the results shown in Figures 3 1 to 3 4 shows that the uncertainty distributions for CDF and LERF are similar in the base and AOT extension models. It should be noted that even the upper bounds of the distributions will not approach the acceptance guidelines.

Additionally, in reviewing the top 35 cutsets as a result of the risk increase described in Section 5.2 for identical or similar components for which the data may come from a common source, there were no such cutsets found exhibiting this condition. This is because the cutsets generally consisted of human failures and common cause events.

Therefore, the state of knowledge correlation (SOKC) does not have a significant quantitative effect on the results.

5.4.2 Model Uncertainty The assessment of model uncertainty utilizes the guidance provided in EPRI 1016737

[23] and in NUREG 1855 [24] and considers the following:

1. Characterize the manner in which the PRA model is used in the application.

5 10 SA LAR 007

Salem Generating Station CFCU AOT Extension

2. Characterize modifications to the PRA model.

3 . Identify application-specific contributors.

4. Assess sources of model uncertainty in the context of important contributors.

a. Also consider other sources of model uncertainty from the base PRA model assessment for the identification of candidate key sources of uncertainty.

b. Screen based on relevance to parts of PRA needed or based on relevance to the results.

5. Identify sources of model uncertainty and related assumptions relevant to the application.

a. This involves the formulation of sensitivity studies for those sources of uncertainty that may challenge the acceptance guidelines and an interpretation of the results.

5.4.2.1 Characterize the Manner in which the PRA Model is Used in the Application The manner in which the PRA model is used in this application is fully described in Section 3 and does not need to be reproduced here.

5. 4. 2. 2 Characterize Modifications to the PRA Model Other than the one change made to the PRA model of record (MOR) described in Section 3.4.3, there were no other changes made to the model that would introduce any application-specific sources of model uncertainty for this analysis.

5.4. 2. 3 Characterize the Manner in which the PRA Model is Used in the Application The following items are identified as the important contributors to the change compared to the base case results.

Operator actions associated with initiating or operating CSS, MFW, AFW and RHR.

LOCA and internal flood initiating event frequency

LOOP frequency and consequential LOOP probability

Failure rates of the components for the systems above

Common cause failure probabilities of the CFCU 5-1 1 SA-LAR-007

Salem Generating Station CFCU AOT Extension 5.4.2.4 Assess Sources of Model Uncertainty in Context of Important Contributors A review of the identified sources of model uncertainty from the base model assessment as identified by implementing the process outlined in EPRI 1 016737 for Salem was then performed to determine which of those items are potentially applicable for this assessment even though they did not appear as a dominant contributor in the base assessment for the application. Based on this review, some of the items were already identified and many do not warrant further analysis, but the following items were added for investigation since they were judged to be potentially applicable for this application.

The CCF of 3 or more CFCUs

Equipment in Test & Maintenance Based on the identified important contributors as summarized in Section 5.2 and the addition of applicable base PRA model sources of uncertainty identified above, the next step is to perform a qualitative assessment or semi-quantitative screening assessment to determine if sources of uncertainty have been addressed in the PRA that affect the important contributors for the application.

The semi-quantitative screening assessment is based on exceeding the ICCDP limit of

1. 0E-6 currently specified for permanent technical specification changes in RG 1.177.

Recall that the ICCDP is obtained as indicated below.

ICCDPcFcu = (CDFcFcu - CDFaA sE) x A O TNEW One can substitute in the known values to solve for the maximum CDFcFcu that would result in an ICCDP of 1.0E-6.

Including the base CDF from the internal events and internal floods assessment as well as the internal fires assessment, this would equate to:

COFMAX = 1. OE-6 I 3. 84E-2 + 1. 55E-5 = 4. 15E-5 Correspondingly, the minimum Risk Achievement Worth (RAW) value that could lead to exceeding the ICCDP acceptance guideline is shown below.

5-1 2 SA-LAR-007

Salem Generating Station CFCU AOT Extension RAWMIN = CDFMAX / CDFCFCU For the internal events and internal floods assessment, this would equate to:

RAWMIN = 4.15E 5 / 1.62E 5 = 2.5 Based on those events found to be relatively significant contributors to the change in risk (see Table 5 4) using a Risk Achievement Worth (RAW) of 2.5, a qualitative assessment is provided in Table 5 5 to discuss potential sources of uncertainty that might possibly challenge the acceptance guidelines from any single basic event. The results of this assessment are shown in Table 5 5.

TABLE 545 IDENTIFICATION OF POTENTIAL KEY SOURCES UNCERTAINTY Source of Source of Application Source of Model Uncertainty Potential Uncertainty Model Important Assessment Key Source Uncertainty Contributor of for Base Uncertainty Model Operator action Yes Yes The credited actions are procedurally No to diagnose loss directed with the calculated HEP of secondary values derived from an accepted heat removal methodology. Although variations to the HEP values may lead to changes Operator action in the risk assessment results, only to line up very bounding assumptions containment regarding the appropriate HEP spray values for these individual actions Operator would lead to exceeding the risk actions to refill metric acceptance guidelines for AFW storage voluntary actions requiring risk tank management actions.

Operator action to initiate feed and bleed Operator fails to terminate excess letdown 5 13 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 545 IDENTIFICATION OF POTENTIAL KEY SOURCES UNCERTAINTY Source of Source of Application Source of Model Uncertainty Potential Uncertainty Model Important Assessment Key Source Uncertainty Contributor of for Base Uncertainty Model Likelihood that Yes Yes This represents the likelihood of No loss of offsite LOOPs and initial diagnosis failures power leads to that are not recovered via permanent loss condensate cooling. Recovery of of condensate secondary side heat removal via the cooling of SGs condensate system following a LOOP is not modeled.

Maintenance No Yes Although these events by themselves Yes -

configurations do not represent a true source of sensitivity involving CSS, model uncertainty, the relative case #2 was RHR, AFW and importance of the maintenance terms performed to GTGs for these systems indicates that address avoiding maintenance on these removal of systems during the extended AOT GTG from could be a potentially important service action that could be taken to reduce the risk associated with the extended AOT. All TM terms have RAWs less than or equal to 1.005. Concurrent maintenance activities are addressed via existing work control practices.

Failure rates of No Yes The failure rates and probabilities Yes -

components for associated with these systems are sensitivity the above derived based on a Bayesian update case #1 was systems of plant specific data. These failure performed to rates and probabilities represent a address this best estimate of the expected concern response for the site. Given this, reasonable variations to these events have been partially captured in the parametric uncertainty evaluation.

Common cause Yes Yes As indicated previously, the common No, because failure cause failure probabilities of the of the probabilities of CFCUs contribute to the internal conservative CFCUs events assessment, but are not as probability significant for the internal fires estimate; the assessment. RAW is 1.1 5 14 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 5-5 IDENTIFICATION OF POTENTIAL KEY SOURCES UNCERTAINTY Source of Source of App lication Source of Model U ncertainty Potential U ncertai nty Model I mportant Assessment Key Source U ncertainty Contributor of for Base U ncertainty Model Common cause Yes Yes Common cause failures of M OVs in No failure the CCS system and pumps in the probabilities of AFW system contribute to the internal other PRA events assessment. Increasing the components basic event values by greater than 1 0 times their cu rrent values would be req uired in order to exceed the risk metric acceptance guidelines. Since the CCF conditional probabilities are based on accepted methodologies and data, an increase of 1 0 times their cu rrent values is deemed unreasonable and as such, this model uncertainty is screened as a potential sou rce of uncertainty.

5.4.2.5 Identify Sources of Model Uncertainty and Related Assumptions Relevant to the Application Based on the evaluation of important contributors shown in Table 5-5, the following items were identified as potential key sources of uncertainty for this application.

Maintenance configurations involving CSS, RHR, AFW and GTG

Failure rates for equipment associated with CSS, RHR, AFW and GTG The first item was addressed as part of a sensitivity analysis presented in Section 5.5.2 that investigates unavailability of the Gas Turbine Generator (GTG, also known as Salem Unit 3). Other maintenance activities had a much lower impact than for the Salem Unit 3 case and can be addressed with compensatory measures using existing work control practices e.g., OP-AA-1 08-1 16, PROTECTED EQUIPMENT PROGRAM

[21].

The second item was addressed as part of a sensitivity analysis presented in Section 5.5.1 that adjusts the failure probabilities for those components that had both a high 5- 1 5 SA-LAR-007

Salem Generating Station CFCU AOT Extension Risk Achievement Worth (RAW >2) and lack of plant specific data as required by PSEG procedure ER AA 600 1015, FPIE PRA MODEL UPDATE [26]. This also addresses the peer review finding of Not Met for Supporting Requirement DA C2 (see Table 4 6).

5.4.3 Completeness Uncertainty As discussed in Section 3.4, external hazards from fire and seismic events were qualitatively addressed as not having a significant contribution to any risk increases associated with this CFCU AOT extension. Other external hazards, as discussed in the IPEEE [10], were screened out as being insignificant. Therefore, only two hazard groups were explicitly considered for this risk assessment. Internal events and internal floods are explicitly included in the quantitative evaluations described in Section 3.2.

Although a Salem peer reviewed Fire PRA model does not currently exist, additional insight regarding fire hazards were investigated using a Work in Progress (WIP) Fire PRA model that did not reveal any significant risk impacts with respect to the configuration modeled for this CFCU AOT extension.

Therefore, there is no major form of completeness uncertainty that would impact the results of this assessment.

5.5 SENSITIVITY ANALYSIS This section describes the results of various sensitivity analyses that were performed to address peer review findings and other identified sources of uncertainty, e.g., Table 5 5.

5.5.1 Sensitivity Case #1 This sensitivity case presents the potential effect of not using plant specific data for important components. Table 4 6 points out a peer review finding of Not Met for Supporting Requirement DA C2. The data procedure used by PSEG requires the use of plant specific data for components with a Risk Achievement Worth (RAW) greater than 2 and Fussell Vesely importances greater than 0.005. The following components listed in Table 5 6 met these importance measures for the risk increase associated with this CFCU AOT extension.

5 16 SA LAR 007

Salem Generating Station CFCU AOT Extension TABLE 546 COMPONENTS IMPORTANT TO THE RISK INCREASE Event Probability Fussell4 Achiev. Description Vesely Worth RHS LSW FT 1RH1 1.00E 04 0.0327 328 VALVE 1RH1 CLOSED LIMIT SWITCH FAILS RHS LSW FT 1RH2 1.00E 04 0.0327 328 VALVE 1RH2 CLOSED LIMIT SWITCH FAILS CCS MOV CC 11C16 1.58E 03 0.0139 10 VALVE 11CC16 FAILS TO OPEN CCS MOV CC 12C16 1.58E 03 0.0132 9 VALVE 12CC16 FAILS TO OPEN CSS MOV CC 1CS36 1.07E 03 0.0052 6 MOV 11CS36 FAILS TO OPEN SWS AOV CC 12223 2.06E 03 0.0050 3 AOV 12SW223 FAILS TO OPEN SWS AOV CC 14223 2.06E 03 0.0050 3 AOV 14SW223 FAILS TO OPEN SWS AOV CC 15223 2.06E 03 0.0050 3 AOV 15SW223 FAILS TO OPEN CSS MOV CC 2CS36 1.07E 03 0.0048 5 MOV 12CS36 FAILS TO OPEN Of these components, the SWS MOVs are MSPI components and their failure data has been represented with Bayesian updated data. The HRS limit switches (LSW) are a component not normally quantified with plant specific data. The associated RHS and CCS MOVs are quantified using Bayesian updated data. Therefore, the two valves of concern are the containment spray system (CSS) MOVs. A review of Maintenance Rule records indicated that no CSS MOV failures have been experienced in the last 3 years. However, for the purposes of a sensitivity analysis, one could assume that the failure probability for these valves could be doubled, with a resulting value of 2.14E 03.

Another check was performed during this sensitivity analysis. Basic events RHS LSW FT 1RH1 and RHS LSW FT 1RH2, CCS MOV CC 11C16 and CCS MOV CC 12C16, CSS MOV CC 1CS36 and CSS MOV CC 2CS36, and multiple SWS AOVs from the table above do not appear together in cutsets. This further proves the aforementioned conclusion that the SOKC is not of significant importance with regard to this LAR. The results of this sensitivity case is presented in Table 5 7.

5.5.2 Sensitivity Case #2 Salems offsite power is backed up by an on site gas turbine generator known as Salem Unit 3. Salem has experienced equipment reliability problems in the past with Salem Unit 3, and may consider in the future retiring this piece of equipment. Therefore, it was deemed prudent to perform a sensitivity case for this LAR in which Salem Unit 3 was 5 17 SA LAR 007

Salem Generating Station CFCU AOT Extension assumed to be unavailable. The results of this sensitivity case is presented in Table 5-7.

5.5.3 Sensitivity Case #3 After the completion of Revision 0 of this analysis (SA-LAR-007), an updated PRA model was finalized in December 2016. This PRA model was known as the SA115A PRA model, which incorporated the newly installed fourth AFW pump and use of FLEX equipment to help mitigate extended SBO scenarios. Therefore, it was deemed appropriate to revise the original CFCU AOT extension analysis in order to accommodate a sensitivity analysis to review the results that would be experienced using the SA115A PRA model. The same flag file that was documented in Section 3.4.3 was used for this sensitivity case.

5.5.4 Sensitivity Case Res u l ts The quantitative results for the three sensitivity cases discussed above are presented in Table 5-7, which show that the results remain well below the regulatory risk acceptance guidelines presented in Section 1.4.

TABLE 5-7 QUANTITATIVE RESULTS - SENSITIVITY CASES BASE SENSITIVITY CASE 1 : S E NSITIVITY CASE 2 : S ENSITIVITY CAS E 3 :

PARAM ETER CASE BASIC EVENT DATA SALEM 3 I N SA1 1 5A PRA MODEL VALU ES ADJ USTM ENT MAINTENANCE T CYCLE 547.5 days 547.5 days 547 . 5 days 547.5 days TcFcu 1 4 days 14 days 1 4 days 1 4 days CDF cFcu 1 .62E-05 1.62E-05 1 .83E-05 8.82E-06 CDF sASE 1.55E-05 1 .55E-05 1 .55 E-05 8. 38E-06 CDFAvE 1.55E-05 1 .55 E-05 1 . 57 E-05 8.41 E-06

!1CDF 5.61 E-08 5.72E-08 2.21 E-07 3.38E-08 ICCDP cFcu 2.80E-08 2.86E-08 1. 1 0E-07 1.69E-08 5.5.5 Sensitivity Cases Considered but Not Quantified The major conservatisms that can be observed from the cutset review are as follows:

5-1 8 SA-LAR-00'7

Salem Generating Station CFCU AOT Extension

The C C F event (VCS-F NR-FR-D F0 1 ) which models the loss of add itional fan coolers is q u antified very conservatively. The q uantification approach models the emerg ing fa ilu re to ru n of both fan coolers. The u nderlying assu mptions are those that are used in event and cond ition assessment in that no credit can be g iven for PSEG extent of condition activities and no credit g iven for observation of ru n n i ng fan coolers. In a realistic situation, PSEG would assess the possibility that the failure is th reaten ing other fan coolers. Since the CFCUs a re not standby equ ipment, the operato rs cou ld and would observe the ru n n ing of the remaining 3 fan coolers, wh ich would be req u i red for normal co ntainment cooling.

If an add itional fan cooler should fail, the plant would be in a 6-h r shutdown LCO.

Operators would be immed iately aware of any CFCU or support system failure th rough mon itoring of control room ind ications.

Recovery from LOOP i n itiati ng events and consequential LOOPs are modeled in the PRA for station blackout scenarios, but not for LOOP scenarios. The containment cooling fu nction is generally not needed u ntil late in accident sce narios, so additional modeling of power recovery options could reduce the risk increase.

Salem installed a 4th AFW pump that is d iesel-electric d riven and capable of feed ing all steam generators for both u n its. The d iesel is outdoors and the rest of the system is located in the Turbine Bu ild i n g . As expected , the PRA impact was that the pump red u ced the failure likelihood of steam generator cooling by p rovid ing add itional d efense in depth . As previously stated , the new P RA model (SA1 1 5A) i ncludes the 4th AFW pum p and the new E LAP proced u res associated with the Fu kush ima response. Based on a review of the cutsets for th is LAR, the 4th AFW pump red u ces the risk associated with flood ing in the Auxiliary Bu ilding and ELAP had little effect on the C F C U risk. Therefore, a sensitivity analysis specifically focused on the ELAP proced u re changes is not necessary.

Sensitivity cases were not quantified to address these issues because the issues can not increase the risk or red uce the margin to acceptance g uidelines. S i nce all risk measures calculated in support of this LAR (see Section 3.4.5) are s ignificantly below the acceptance g u idelines, no q uantification was deemed necessary for these other identified issues .

5.6 SENSITIVITY ANALYSIS CONCLUSIONS As previously ind icated , the u ncertainty analysis add resses the three generally accepted forms of u ncertai nty: parameter, model, and completeness u ncertainty. The conclusions from these assessments are as fo llows .

5- 1 9

Salem Generating Station C FCU AOT Extension 5.6.1 Parameter Uncertainty The parameter u ncertainty assessment ind icated that the use of the point estimate resu lts d irectly for this assessment is acceptable. The SOKC does not have a sign ificant effect on the quantitative resu lts or insig hts from the risk calculations.

5.6.2 Model Uncertainty The model uncertainty assessment high lig hted the following sou rces of u n certainty as being important to address with add itional sensitivity stud ies or potential compensatory measures:

Maintenance config u rations i nvolving GSS , RHR, AFW and Salem 3.

A sensitivity study (Case #2) was performed to look at the potential risk increase as a res u lt of Salem 3 maintenance. Other mainten ance activities had a much lower impact than for the Salem 3 case a n d can be addressed with compensatory measures using existi ng work control p ractices e . g . , OP-AA-1 08-1 1 6 , P ROTECTED EQUI PMENT P RO G RAM [2 1 ] .

5.6.3 Completeness Uncertainty The uncertainty associated with model completeness h ighlig hted the following sou rce of u n certainty as being important enough to address with an add itional sensitivity study:

Possible impact of using plant specific data for certai n events.

A sensitivity study (Case #1 ) was performed to look at the potential risk in crease for expanding the use of plant-specific data. I n add itio n , a peer review finding against the ASM E P RA Standard [1 ] Su pporting Req uirement DA-C2 was also add ressed regard ing the issue of p lant-specific data for risk sign ificant components (see Table 4-6). The evaluation of completeness u ncertainty indicated that there was no sig n ificant impact fou n d that wou ld i nfluence the resu lts for this LAR assessment.

5-20 SA-LAR-007

Salem Generating Station CFCU AOT Extension 5.6.4 Sensitivity Study Results The results of these sensitivity studies indicated that although changes to the calculated CDF can be postulated, the results from the sensitivity cases were otherwise determined to be similar to the results found from using the Salem SA112B PRA model (see Section 3.4.5). Specifically, most of the change to CDF was caused by scenarios that involved a failure of containment sump recirculation following depletion of the RWST. None of the calculated risk metric results from the sensitivity cases would lead to exceeding the acceptance guidelines presented in Section 1.4, e.g., Regulatory Guide 1.177 limit of 1.0E 06 for ICCDP and 1.0E 07 for ICLERP for permanent changes.

Also, the results found in using the recently completed SA115A PRA MOR further corroborated the very small risk that would be experienced in implementing the proposed CFCU AOT extension.

5 21 SA LAR 007

Salem Generating Station CFCU AOT Extension 6.0

SUMMARY

AND CONCLUSIONS Con siste nt with the N RC's approach to risk-informed reg ulation, PSEG has identified a particular Tech n ical Specification req uirement that is u n d uly restrictive in its natu re and ,

if relaxed , has a min imal impact o n the safety of the plant. This Tech n ical Specification is the req u irement for the Containment Fan Cooler U n it (CFCU) Allowed O utage Time (AOT) to be restricted to 7 d ays for either one or two C FC U s being inoperable . The p roposed change was to i ncrease the AOT for any one or two i noperable C FC U s to a total of 1 4 days.

This section s u mmarizes the risk metrics requested by the N RC Reg ulatory Gu ides ,

p rovides the calcu lated resu lts using the SA 1 1 2 8 Salem PRA model, and the conclusion of this assessment for the extended C F C U AOT analysis.

6.1 REGULATORY GUIDELINES As described earlier, the p ro babilistic risk assessment i np ut to the decision making p rocess h as been defined i n detail by the N RC in two Regu latory G u ides, Regulatory G u ides 1 . 1 74 and 1 . 1 77 .

T h e NRC has specified i n Reg ulatory Guides t h e risk metrics that should b e calcu lated to p rovide input into the decision making process. The risk metrics chosen by the N RC i n their Reg u latory G u ides include the following:

The change in Core Damage F requency (CDF) (Reg . G u ide 1 . 1 74)

The change in Large Ea rly Release Frequency (LERF) (Reg . Gu ide 1 . 1 74)

The Incremental Cond itional Core Damage P robability (ICCDP) (Reg . G u ide 1 . 1 77)

The Incremental Conditional Large Ea rly Release P robability (ICLERP) (Reg .

Guide 1 . 1 77)

These risk metrics were all calcu lated using the SA 1 1 2 8 P RA model (see Section 4 . 1 .5), wh ich was developed as an application specific model to more accurately assess the in cremental increase in risk for this extended AOT analysis by eliminating some cutsets that were found to n ot lead to core damage d ue to being long-term and slowly developing scenarios that wou ld not req u i re containment cooling, either by the 6-1 SA-LAR-007

Salem Generating Station CFCU AOT Extension Contai nment S p ray (CS) System or C FC U s . A MAAP 4.0.6 sensitivity a nalysis was performed to confirm that this type of accident seq uence d id not req u ire su ccessfu l conta in men t cooling e ither via C S o r C FC U s .

Quantitative g u idelines are defined b y t h e N RC in R G 1 . 1 74 [1 ] and 1 . 1 77 [2] for what is an acceptably small change in risk:

The Salem calculated I C C D P and I C LE RP for the CFCU AOT extension are sufficiently below the g u idelines of < 1 .0E-06 and < 1 .0E-07, respectively, to be able to call the risk change small. Hence, the g u idelines of Reg . Gu ide 1 . 1 77 for the increased CFCU AOT Time have been met. See Table 3-1 for the q u antitative results.

F u rthermore, the evaluation of changes in C D F and LERF due to the C FCU AOT extension h ave been shown to be an order of magn itude below the d isplayed area for Reg ion I l l as depicted in Reg ulatory Guide 1 . 1 74. See the Executive Su mmary for g raphical depiction and Table 3-1 for nu merical results .

These calcu lations su pport the increase in the CFCU AOT from a quantitative risk informed perspective .

6.2 PRA MODEL The q u a ntitative evaluation of the risk metrics for this applicatio n was perfo rmed using the SA 1 1 2B Salem PRA Application S pecific Model (see Sections 3.4.3 and 4 . 1 .5).

This i nclu ded the following ch anges to the SA 1 1 2A PRA Model of Record :

A change to the common cause term for m ultiple failure of th ree of more CFCUs was made to account for the identified fa ilure of two CFCUs. The common cause basic event VCS-F N R-FR-DF01 in the M O R was changed from its nominal fai l u re p robability of 6.48E-06 to 8.22E-01 using the "RaspC C F" calculational methodology for staggered testing employed in the SAP H I RE P RA software p rogram [22] .

A change was made to eliminate certain accident seq uences from the cutset res u lts that wou ld not necessarily lead to core d amage. Specifically, these cutsets i nvolved long-term and slowly developing scenarios that would not req u ire containment cooling, either by the Containment Spray (CS) System or C o ntain ment Fan Cooler U n its (CFC Us) . A MAAP 4.0.6 sensitivity analysis s h owed that this type of accident seq uence did not requ i re successful containment cooling e ithe r via CS or C FC U s in order to avert core damage.

In addition , the recent u pdate in December 201 6 of the PRA MOR, wh ich is known as the SA 1 1 5A P RA model, was used to perform an add itional sensitivity an alysis that 6-2 SA-LAR-007

Salem Generating Station CFCU AOT Extension showed that the incremental risk was actually smaller than that calculated using the SA112B PRA model (see Section 5.5.4).

6.3 QUANTITATIVE PRA RESULTS: REGULATORY GUIDE 1.177 AND 1.174 This subsection includes the quantitative PRA results using the SA112B Salem PRA model as described in risk application SA MISC 016, Application Specific Model for CFCU LAR.

The calculated results using the SA112B PRA model are shown in Table 6 1. The results in Table 6 1 are compared with the acceptance guidelines that are specified by the NRC in Regulatory Guide 1.174 [1] and Regulatory Guide 1.177 [2]. The comparison of the CDF and LERF risk metrics with Regulatory Guide 1.174 guidelines are graphically depicted in Figures 6 1 and 6 2, respectively.

These results provide a good indication that the risk associated with this proposed extension of the CFCU AOT is very small. These results are also reinforced by the Tier 2 and Tier 3 assessments. The Tier 2 assessment was addressed as part of the sensitivity cases investigated in Section 5.5, in which other equipment other than the CFCUs is investigated for relative importance. The Tier 3 assessment, which involves adherence to existing work control practices as part of the Salem Configuration Risk Management Program (CRMP), was addressed in Section 3.3.

6.4 EXTERNAL HAZARDS CONSIDERATIONS The evaluation of risk due to fire and seismic events was based on insights gleaned from the IPEEE. Within this analysis, Section 3.4.7 addresses fire risk and Section 3.4.8 discusses seismic risk. For this particular CFCU AOT extension, there was no perceived increase in risk due to either of these external hazards.

With regard to fire hazards, since the CFCUs and their support systems do not show a high dependence on the results of the fire model, it was qualitatively inferred in Section 3.4.7 that the risk increase would be negligible due to extending the AOT for two CFCUs up to a period of 14 days. This qualitative insight was based on the fact that the unavailability of CFCUs does not have a high impact on the ability to mitigate any of the 63 SA LAR 007

Salem Generating Station CFCU AOT Extension dominant fire risk contributors. As such, the Work in Progress Fire PRA model did not reveal any perceived risk increase for this CFCU AOT extension.

With regard to seismic hazards, a review of the dominant cutsets related to extending the AOT for CFCUs did appear to have contributions stemming from LOOP scenarios, but it was the lack of adequate containment heat removal due to loss of CFCUs that prevented successful sump recirculation, which would be subsumed by Station Blackout (SBO) scenarios due to the fact that a loss of all AC power would prevent operation of the Emergency Core Cooling System (ECCS) pumps, i.e., RHR pumps. As such, it can qualitatively be inferred that there would be no significant impact on seismic risk due to extending the AOT for two CFCUs up to a period of 14 days.

Other external hazards were screened as being insignificant, as documented in Section 1.4.3 of the Salem IPEEE [10], and as such, were not deemed applicable to this analysis for the CFCU AOT extension.

6.5 UNCERTAINTIES In addition to the assessment of the mean risk metrics which are specified in Regulatory Guides 1.174 and 1.177 for comparison with the acceptance guidelines, it is also prudent to examine whether modeling uncertainties may distort these comparisons.

Therefore, an extensive review of various uncertainties that may impact the risk metrics was performed. To this end, NUREG 1855 and the companion EPRI guideline (EPRI 1026511) were utilized for the treatment of uncertainties pertaining to parametric, modeling, and completeness issues.

Section 5 provides an analysis and discussion of the results, which concluded that there are no outstanding uncertainty issues that would tend to challenge the numerical results calculated using the SA112B PRA model.

6.6 CONCLUSION

The risk change calculated with the SA112B Salem PRA model for the proposed CFCU AOT extension is considered to be very small.

64 SA LAR 007

Salem Generating Station CFCU AOT Extension The I C C D P and I C LERP for d ual C F C U u navailability a re sufficiently below the g u idelines of < 1 .0 E-06 and < 1 . 0E-07, respectively, to be able to call the risk change small. He nce, the g u idelines of Reg. G u ide 1 . 1 77 for the i ncreased EDG Allowed O utage Time have been met.

F u rthermore , the calcu lated of changes in CD F and L E R F d u e to the CFCU AOT extension have been shown to meet the risk sign ificance criteria of Regu latory Guide 1 . 1 74 with su bstantial marg i n , i.e . , Reg ion I l l which rep resents "very small risk changes." Table 6-1 provides a listing of the numerical results , with Figures 6-1 and 6-2 showing a g raph ical depiction of the L1CD F and L1LERF res u lts.

These ca lcu lations support the increase in the CFCU AOT extension from a quantitative risk-informed perspective , wh ich includes following established PSEG maintenance p ractices as d iscussed in Section 3 . 3 .

TABLE 6-1 RESULTS OF RISK EVALUATION FOR SALEM RISK M ETRIC RISK METRIC RESU LTS 11C D F(/yr) 5.61 E-08 11LERF(/yr) 2 . 1 5 E-1 0 ICCDPcFcu 2. 80E-08 ICLERP cFc u 1 . 08E-1 0 Table Note:

1. Region Ill of RG 1 . 1 74 -- very small risk changes.

6-5 SA-LAR-007

Salem Generating Station CFCU AOT Extension t

LL.

0 (J

1 0"'6 CDF

FIGURE 6-1 ACCEPTANCE GUIDELINES FOR CORE DAMAGE FREQUENCY (CDF)

LEA F FIGURE 6- 2 ACCEPTANCE G UIDELINES FOR LARGE EARLY RELEASE FREQUENCY (LERF) 6-6 SA-LAR-007

Salem Generating Station CFCU AOT Extension

7.0 REFERENCES

[1] Regulatory Guide 1.174: An Approach for Using Probabilistic Risk Assessment in Risk Informed Decisions on Plant Specific Changes to the Licensing Basis, USNRC, Revision 2, May 2011.

[2] Regulatory Guide 1.177: An Approach for Plant Specific, Risk Informed Decision Making: Technical Specifications, USNRC, Revision 1, May 2011.

[3] Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk Informed Activities, Revision 2, March 2009.

[4] American Society of Mechanical Engineers, Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, (ASME RA S 2002), Addenda RA Sb 2005, December 2005.

[5] Salem Generating Station, Mitigating System Performance Index Basis Document, SC MSPI 001, Revision 11, January 2016.

[6] Salem Generating Station, Quantification Notebook, SA PRA 014, Revision 0, September 2014.

[7] Westinghouse, RG 1.200 PRA Peer Review Against the ASME PRA Standard Requirements for the Salem Generating Station, Units 1 and 2 PRA, LTR RAM II 09 001, June 2009.

[8] PSEG, Salem Generating Station Individual Plant Examination, July 1993.

[9] Individual Plant Examination for Severe Accident Vulnerabilities 10 CFR 50.54(f), Generic Letter 88 20, November 23, 1988.

[10] PSEG, Salem Generating Station Individual Plant Examination of External Events, January 1996.

[11] American Society of Mechanical Engineers, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addenda to ASME/ANS RA S 2008 (ASME/ANS RA Sa 2009),

February 2009.

[12] NRC Generic Letter 88 20, Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities 10 CFR 50.54(f), Supplement 4, June 28, 1991.

[13] NUREG 1407, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities, June 1991.

[14] Professional Loss Control, Inc., Fire Induced Vulnerability Evaluation (FIVE)

Methodology Plant Screening Guide, EPRI TR 100370, Electric Power Research Institute, April 1992.

[15] Public Service Electric and Gas, Salem Fire Protection Report - Safe Shutdown Analysis, DE PS.ZZ 0001(Q), Rev. 1, 1991.

[16] Public Service Electric and Gas, Salem Fire Protection Report - Fire Hazards Analysis, DE PS.ZZ 001(Q) A2 FHA, Rev. 4, 1993.

71 SA LAR 007

Salem Generating Station CFCU AOT Extension

[17] Public Service Electric and Gas, Action Request for Reducing Potential Risk to Cables Routed Through the Turbine and Service Buildings Which Supply Offsite Power to the 4kV Vital Buses, 1995.

[18] U.S. Nuclear Regulatory Commission, Standard Review Plan for Review of Safety Analysis Report for Nuclear Power Plants, NUREG 75/187, December 1975.

[19] Public Service Electric and Gas, Hope Creek Generating Station Updated Safety Analysis Report, Sections 2 and 3, Latest Revision.

[20] Public Service Electric and Gas, Salem Generating Station Updated Safety Analysis Report, Sections 2 and 3, Latest Revision.

[21] Public Service Electric and Gas, Protected Equipment Program, OP AA 108 116, Revision 12.

[22] U.S. Nuclear Regulatory Commission, SAPHIRE, Version 8.1.4, 2010 Update to the Parameter Estimation Component Reliability Data Sheets, Section 9.4, Build Date: 05/14/2012.

[23] Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, EPRI Report 1016737, Palo Alto, CA, December 2008.

[24] U.S. Nuclear Regulatory Commission, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk Informed Decisionmaking, NUREG 1855, Revision 1, (Version to be issued) ML15026A512.

[25] Practical Guidance on the Use of Probabilistic Risk Assessment in Risk Informed Applications with a Focus on the Treatment of Uncertainty, EPRI Report 1026511, Palo Alto, CA December 2012.

[26] Public Service Electric and Gas, FPIE PRA Model Update, ER AA 600 1015, Revision 8.

[27] NEI 05 04, Revision 1 (Draft), Process for Performing Follow On PRA Peer Reviews Using the ASME PRA Standard (Internal Events), Nuclear Energy Institute, November 2007.

[28] NRC Order Number EA 12 049, Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond Design Basis External Events, March 12, 2012.

[29] PSEG Nuclear, PSEG Nuclear LLCs Overall Integrated Plan for the Salem Generating Station in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond Design Basis External Events (Order Number EA 12 049), LR N13 0034, February 28, 2013.

[30] Nuclear Energy Institute (NEI) 12 06, Diverse and Flexible Coping Strategies (FLEX) Implementation Guide, Rev. 0, August 2012.

72 SA LAR 007

v t e Letter Sequence Request
CAC:MF9364, (Approved, Closed)
Initiation Request Acceptance, Acceptance Supplement Administration Questions 31 July 2017 Answers 14 September 2017 Results Approval Other:
MONTHYEAR2017-05-04 [Table View]

LR-N16-0173, License Amendment Request: Containment Fan Cooler Unit (Cfcu) Allowed Outage Time (AOT) Extension

Text

Subject:

Enclosure:

1.0 DESCRIPTION

2.0 PROPOSED CHANGE

3.0 BACKGROUND

4.0 TECHNICAL ANALYSIS

5.0 REGULATORY ANALYSIS

6.0 ENVIRONMENTAL CONSIDERATION

7.0 REFERENCES

1.0 DESCRIPTION

2.0 PROPOSED CHANGE

3.0 BACKGROUND

4.0 TECHNICAL ANALYSIS

5.0 REGULATORY ANALYSIS

6.0 ENVIRONMENTAL CONSIDERATION

7.0 REFERENCES

SUMMARY

SUMMARY

1.0 INTRODUCTION

SUMMARY

7.0 REFERENCES

SUMMARY

1.2 BACKGROUND

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY