ML17284A179

Proposed License Amendment Request to Revise Integrated Leak Rate Test (Type a) and Type C Test Intervals

ML17284A179
Person / Time
Site:	Millstone
Issue date:	10/04/2017
From:	Mark D. Sartain Dominion Nuclear Connecticut
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
17-359
Download: ML17284A179 (134)

Text

Dominion Nuclear Connecticut, Inc.

5000 Dominion Boulevard, Glen Allen, VA 23060 Web Address: www.dom.com October 4, 2017 U.S. Nuclear Regulatory Commission Attention: Document Control Desk Washington, DC 20555 DOMINION NUCLEAR CONNECTICUT, INC.

MILLSTONE POWER STATION UNIT 2 Serial No.

NSSL/MLC Docket No.

License No.17-359 RO 50-336 DPR-65 PROPOSED LICENSE AMENDMENT REQUEST TO REVISE INTEGRATED LEAK RATE TEST (TYPE Al AND TYPE C TEST INTERVALS Pursuant to 10 CFR 50.90, Dominion Nuclear Connecticut, Inc. (DNC) requests a license amendment in the form of changes to the Millstone Power Station Unit 2 (MPS2) Technical Specifications (TSs) for facility Operating License DPR-65.

The proposed amendment revises MPS2 TS 6.19, "Containment Leakage Rate Testing Program," by replacing the reference to Regulatory Guide (RG) 1.163 (September 1995) with a reference to Nuclear Energy Institute (NEI) topical report NEI 94-01, Revision 3-A and the limitations and conditions specified in NEI 94-01, Revision 2-A, as the implementing documents used to develop the MPS2 performance-based leakage testing program in accordance with 10 CFR 50, Appendix J, Option B. This amendment would allow DNC to extend the Type A primary containment integrated leak rate test interval (ILRT) for MPS2 to 15 years and the Type C local leak rate test interval to 75 months, and incorporates the regulatory positions stated in RG 1.163. provides a discussion of the proposed change, including a summary of the supporting probabilistic risk assessment (PRA). A markup of the proposed change is provided in Attachment 2. Discussion of the supporting risk assessment and documentation of the technical adequacy of the PRA model are provided in Attachments 3 and 4.

DNC has evaluated the proposed amendment and has determined that it does not involve a significant hazards consideration as defined in 10 CFR 50.92. The basis for that determination. is included in Attachment 1.

DNC has also determined that operation with the proposed change will not result in any significant increase in the amount of effluents that may be released offsite nr any significant increase in individual or cumulative occupational radiation exposure.

Therefore, the proposed amendment is eligible for categorical exclusion from an environmental assessment as set forth in 10 CFR 51.22(c)(9). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment is needed in connection with approval of the proposed change. The proposed TS change has been reviewed and approved by the Facility Safety Review Committee.

Serial No: 17-359 Docket No. 50-336 Page 2 of 3 The next ILRT is currently due no later than November 10, 2019. Based on the current outage schedule, the current ten-year frequency would require the next MPS2 ILRT to be performed during the fall 2018 refueling outage. Therefore, DNC requests approval of the proposed change by September 4, 2018.

In accordance with 10 CFR 50.91 (b), a copy of this license amendment request is being provided to the State of Connecticut.

Should you have any questions in regard to this submittal, please contact Wanda Craft at (804) 273-4687.

Sincerely, Mark D. Sartain Vice President - Nuclear Engineering and Fleet Support Dominion Energy Nuclear Connecticut, Inc.

COMMONWEAL TH OF VIRGINIA COUNTY OF HENRICO The foregoing document was acknowledged before me, in and for the County and Commonwealth aforesaid, today by Mark D. Sartain, who is Vice President - Nuclear Engineering and Fleet Support of Dominion Energy Nuclear Connecticut, Inc. He has affirmed before me that he is duly authorized to execute and file the foregoing document in behalf of that company, and that the statements in the document are true to the best of his knowledge and belief.

Acknowledged before me this /7Jlday of t2c!/Jbtr, 2017.

My Commission Expires: 5-3/-/f. ~

• ~

Notary Public

.....,,~

Attachments:

1.

Discussion of Proposed Change

2.

Marked-up Technical Specification Page

3.

Documentation of Probabilistic Risk Assessment

4.

Probabilistic Risk Assessment Technical Adequacy Commitments made in this letter: None cc:

U.S. Nuclear Regulatory Commission Region I 2100 Renaissance Blvd, Suite 100 King of Prussia, PA 19406-2713 R. V. Guzman Senior Project Manager - Millstone Power Station U.S. Nuclear Regulatory Commission One White Flint North 11555 Rockville Pike Mail Stop 08 C2 Rockville, MD 20852-2738 NRC Senior Resident Inspector Millstone Power Station Director, Radiation Division Department of Energy and Environmental Protection 79 Elm Street Hartford, CT 06106-5127 Serial No: 17-359 Docket No. 50-336 Page 3 of 3

ATTACHMENT 1 Discussion of Proposed Change DOMINION NUCLEAR CONNECTICUT, INC.

MILLSTONE POWER STATION UNIT 2 Serial No.17-359 Docket No. 50-336

ATTACHMENT 1 TABLE OF CONTENTS Serial No.17-359 Docket No. 50-336, Page 1 of 26

1.0 DESCRIPTION

..................................................................................................... 2

2.0 PROPOSED CHANGE

........................................................................................ 2

3.0 BACKGROUND

................................................................................................... 3 3.1 1 O CFR 50, Appendix J, Option B Requirements.......................................... 3 3.2 Reason for Proposed Amendment................................................................ 5

4.0 TECHNICAL ANALYSIS

...................................................................................... 5 4.1 Description of Containment........................................................................... 8 4.2 Type A (ILRT) Test History.......................................................................... 10 4.3 Type Band C Testing................................................................................ 11 4.4 Supplemental Inspection Requirements...................................................... 13 4.4.1 IWE Examination........................................................................................ 14 4.4.2 IWL Examinations........................................................................................ 15 4.5 Deficiencies Identified.................................................................................. 18 4.6 Plant-Specific Confirmatory Analysis........................................................... 18 4.6.1 Methodology................................................................................................ 18 4.6.2 PRA Quality................................................................................................. 19 4.6.3 Summary of Plant-Specific Risk Assessment Results................................. 20 4.7 Conclusion................................................................................................... 21 5.0 REGULATORY ASSESSMENT.......................................................................... 22 5.1 Applicable Regulatory Requirements/Criteria.............................................. 22 5.2 No Significant Hazards Consideration......................................................... 23 5.3 Environmental Considerations..................................................................... 25 6.0 PRECEDENCE................................................................................................... 26

DISCUSSION OF PROPOSED CHANGE

1.0 DESCRIPTION

Serial No.17-359 Docket No. 50-336, Page 2 of 26 The proposed amendment revises Millstone Power Station Unit 2 (MPS2) Technical Specification (TS) 6.19, "Containment Leakage Rate Testing Program," by replacing the reference to Regulatory Guide (RG) 1.163 with a reference to Nuclear Energy Institute (NEI) topical report NEI 94-01, Revision 3-A and the limitations and conditions specified in NEI 94-01, Revision 2-A, as the implementing documents used by Dominion Nuclear Connecticut, Inc. (DNC) to develop the MPS2 performance-based leakage testing program in accordance with Option B of 10 CFR 50, Appendix J, "Primary Reactor Containment Leakage Testing for Water-Cooled Power Reactors". This amendment would allow DNC to extend the primary containment integrated leak rate test (ILRT) interval for MPS2 to 15 years and Type C local leak rate test (LLRT) interval to 75 months, and incorporates the regulatory positions stated in RG 1.163.

In the safety evaluations (SE) issued by NRG letter dated June 25, 2008 (NEI 94-01, Revision 2-A) and June 8, 2012 (NEI 94-01, Revision 3-A), the NRC concluded that these documents describe an acceptable approach for implementing the optional performance-based requirements of Option B of 10 CFR 50, Appendix J, and found that NEI 94-01, Revisions 2 and 3 are acceptable for referencing by licensees proposing to amend their TS in regards to containment leakage rate testing, subject to the limitations and conditions noted in Section 4.0 of the two SEs.

In accordance with the guidance in NEI 94-01, Revision 3-A, DNC proposes to extend the interval for the primary containment ILRT, which is currently required to be performed at ten year intervals, to no longer than 15 years from the last ILRT for MPS2.

The last ILRT for MPS2 was performe9 on November 11, 2009; therefore, the next ILRT for MPS2 is due no later than November 10, 2019. This would require the test be performed during the fall 2018 refueling outage. The proposed amendment would allow the next ILRT for MPS2 to be extended 5 years so that the next ILRT would be due no later than November 10, 2024. The performance of fewer ILRTs will result in significant savings in radiation exposure to personnel, cost, critical path time during future refueling outages, and reduction in industrial safety risk.

2.0 PROPOSED CHANGE

TS 6.19, "Containment Leakage Rate Testing Program," currently states:

"A program shall be established to implement the leakage rate testing of the primary containment as required by 10 CFR 50.54(0) and 10 CFR 50, Appendix J, Option B as modified by approved exemptions.

This program shall be in accordance with the guidelines contained in Regulatory Guide 1.163, "Performance-Based Containment Leak-Test Program, dated September 1995, as modified by the following exception. to NEI 94-01, Rev. 0, "Industry

Serial No.17-359 Docket No. 50-336, Page 3 of 26 Performance-Based Option of 10 CFR Part 50, Appendix J": The first Type A test performed after the June 10, 1995 Type A test shall be performed no later than June 10, 201 O."

The proposed change would revise this portion of TS 6.19 by replacing the reference to RG 1.163 with a reference to NEI 94-01, Revision 3-A as follows:

(

"A program shall be established to implement the leakage rate testing of the primary containment as required by 10 CFR 50.54(0) and 10 CFR 50, Appendix J, Option B as modified by approved exemptions.

This program shall be in accordance with the guidelines contained in NEI 94-01, Revision 3-A, "Industry Guideline for Implementing Performance-Based Option of 10 CFR Part 50, Appendix J," dated July 2012 and the limitations and conditions specified in NEI 94-01, Revision 2-A, dated October 2008."

A markup of the proposed change is provided in Attachment 2.

3.0 BACKGROUND

3.1 10 CFR 50, Appendix J, Option B Requirements The regulations in 10 CFR 50.54(0) require that the primary containments for water cooled power reactors shall be subject to the requirements set forth in 10 CFR 50, Appendix J. The testing requirements of 10 CFR 50, Appendix J, provide assurance that leakage from the containment, including systems and components that penetrate the containment, does not exceed the allowable leakage values specified in the TS, and that periodic surveillance of containment penetrations and isolation valves is performed

• so that proper maintenance and repairs are made during the service life of the containment and the systems and components penetrating containment. The limitation on containment leakage provides assurance that the containment would perform its design function following an accident, up to and including, the plant design basis accident. Appendix J identifies three types of required tests: (1) Type A tests, intended to measure the containment overall integrated leakage rate; (2) Type B tests, intended to detect local leaks and to measure leakage across pressure-containing or leakage limiting boundaries (other than valves) for containment penetrations; and (3) Type C tests, intended to measure containment isolation valve leakage. Type B and C tests identify the vast majority of potential containment leakage paths. Type A tests identify the overall (integrated) containment leakage rate and serve to ensure continued leakage integrity of the containment structure by evaluating those structural parts of the containment not covered by Type B and Type C testing.

In 1995, 10 CFR 50, Appendix J was amended to provide a performance-based Option B for the containment leakage testing requirements.

Option B requires that test intervals for Type A, Type B, and Type C testing be determined by using a performance-based approach.

Performance-based test intervals are based on consideration of the operating history of the component and resulting risk from its

Serial No.17-359 Docket No. 50-336, Page 4 of 26 failure. The term "performance-based" in 10 CFR 50, Appendix J, refers to both the performance history necessary to extend test intervals and the criteria necessary to meet the requirements of Option 8. Also in 1995, RG 1.163 was issued. The RG endorsed NEI 94-01, Revision 0, "Industry Guideline for Implementing Performance-8ased Option of 10 CFR 50, Appendix J," with certain modifications and additions.

Option 8, in concert with RG 1.163 and NEI 94-01, Revision 0, allows licensees with a satisfactory ILRT performance history (i.e., two consecutive, successful Type A tests) to reduce the test frequency for the containment Type A (ILRT) test from three tests in ten years to one test in ten years. This relaxation was based on an NRC risk program and Electric Power Research Institute (EPRI) TR-104285, "Risk Impact Assessment of Revised Containment Leak Rate Testing Intervals," both of which illustrated that the risk increase associated with extending the ILRT surveillance interval was very small.

NEI 94-01, Revision 2, describes an approach for implementing the optional performance-based requirements of Option 8 described in 10 CFR 50, Appendix J, which includes provisions for extending Type A intervals up to 15 years and incorporates the regulatory positions stated in RG 1.163. It delineates a performance-based approach for determining Type A, Type 8, and Type C containment leakage rate surveillance testing frequencies. This method uses industry performance data, plant-specific performance data, and risk insights in determining the appropriate testing frequency.

NEI 94-01, Revision 2, also addresses the performance factors that licensees must consider in determining test intervals. However, it does not address how to perform the tests because these details are included in existing documents (e.g.,

American National Standards Institute I American Nuclear Society [ANSl/ANS]-56.8-2002). The NRC final SE issued by letter dated June 25, 2008, documents the NRC's evaluation and acceptance of NEI 94-01, Revision 2, subject to the specific limitations and conditions listed in Section 4.1 of the SE. The accepted version of NEI 94-01 was subsequently issued as Revision 2-A, dated October 2008.

Electric Power Research Institute (EPRI) report TR-104285, "Risk Impact Assessment of Revised Containment Leak Rate Testing Intervals," Revision 2, provides a risk impact assessment for optimized ILRT intervals of up to 15 years, using current industry performance data and risk-informed guidance, primarily Revision 1 of RG 1.174, "An Approach for using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Bases." The NRC's final SE, issued by letter dated June 25, 2008, documents the NRC's evaluation and acceptance of TR-104285, Revision 2, subject to the specific limitations and conditions listed in Section 4.2 of the SE. An accepted version of EPRI TR-1009325 was subsequently issued as Revision 2-A (also identified as TR-1018243), dated October 2008.

NEI 94-01, Revision 3, describes an approach for implementing the optional performance-based requirements of Option 8 described in 10 CFR 50, Appendix J, which includes provisions for extending Type A and Type C intervals up to 15 years and 75 months, respectively, and incorporates the regulatory positions stated in RG 1.163.

It delineates a performance-based approach for determining Type A, Type B, and Type C containment leakage rate surveillance testing frequencies. This method uses industry performance data, plant-specific performance data, and risk insights in determining the

Serial No.17-359 Docket No. 50-336, Page 5 of 26 appropriate testing frequency. NEI 94-01, Revision 3, also addresses the performance factors that licensees must consider in determining test intervals. However, it does not address how to perform the tests because these details are included in existing documents (e.g., American National Standards Institute/American Nuclear Society (ANSl/ANS-56.8-2002).

The NRG final SE, issued by letter dated June 8, 2012, documents the NRC's evaluation and acceptance of NEI 94-01, Revision 3, subject to the specific limitations and conditions listed in Section 4.0 of the SE. The accepted version of NEI 94-01 was subsequently issued as Revision 3-A, dated July 2012.

EPRI TR-1009325, Revision 2, provides a validation of the risk impact assessment of EPRI TR-104285, dated August 1994. The assessment validates increasing allowable extended LLRT intervals to 120 months as specified in NEI 94-01, Revision 0.

However, the industry requested that the allowable extended interval for Type C local leak rate testing (LLRT) be increased only to 75 months, to be conservative, with a permissible extension (for non-routine emergent conditions) of nine months (84 months total). The NRC final SE, issued by letter dated June 8, 2012, documents the NRC's evaluation and acceptance of EPRI TR-1009325 as a validation of EPRI TR-104285, Revision 2 bases to extend Type C LLRT to 120 months, subject to the specific limitations and conditions listed in Section.4.0 of the SE.

3.2 Reason for Proposed Amendment With approval of this proposed license amendment, MPS2 will transition to a performance-based test frequency for the ILRT (Type A test) and LLRT (Type B and C tests) consistent with NEI 94-01, Revision 3-A, dated July 2012 and the limitations and conditions specified in NEI 94-01, Revision 2-A, dated October 2008."

4.0 TECHNICAL ANALYSIS

As required by 10 CFR 50.54(0), the MPS2 containment is subject to the requirements set forth in 10 CFR 50, Appendix J. Option B of Appendix J requires that test intervals for Type A, Type B, and Type C testing be determined by using a performance-based approach. Currently, the MPS2 10 CFR 50 Appendix J testing program is based on RG 1.163, which endorses NEI 94-01, Revision 0.

This license amendment request proposes to revise the MPS2 10 CFR 50, Appendix J testing program by implementing the guidance in NEI 94-01, Revision 3-A and the limitations and conditions specified in NEI 94-01, Revision 2-A.

In the NRC SEs dated June 25, 2008 and June 8 2012, the NRC concluded that NEI 94-01, Revisions 2 and 3, as modified by the limitations and conditions in Section 4.1, are acceptable for referencing by licensees proposing to amend their TS in regard to containment leakage rate testing for the optional performance-based requirements of Option B of 10 CFR 50, Appendix J.

The following addresses the limitations and conditions of the 2008 and 2012 SEs.

.........,..,.,,..,..,**********1qn~Z~o~~!~~ed~.(rom/ * ****** 4.~o:t tte\\f:2~Ar <

tie)J14:1!e>ts~l.<JatedJ... ~~;~oo$)i f *<

1. For calculating the Type A leakage rate, the licensee should use the definition in the NEI TR 94-01, Revision 2, in lieu of that in ANSI/ ANS-56.8-2002).

2. The licensee submits a schedule of containment inspections to be performed prior to and between Type A tests.

3. The licensee addresses the areas of the containment structure potentially subjected to degradation.

4. The licensee addresses any test and inspections performed following major modifications to the containment structure, as applicable.

Serial No.17-359 Docket No. 50-336, Page 6 of 26 Following the NRC approval of this license amendment request, DNC will use the definition in Section 5.0 of NEI 94-01, Revision 3-A (and Revision 2-A), for calculating the Type A leakage rate when future MPS2 Type A tests are performed.

A schedule of containment inspections is provided in Section 4.4.2 below.

General visual examination of accessible interior and exterior surfaces of the containment system for structural problems is typically conducted in accordance with the Millstone IWE/IWL Containment lnservice Inspection Plans which implement the requirements of the ASME,Section XI, Subsections IWE and IWL, as required by 10 CFR 50.55a(g).

Previously, the Millstone IWE Program had inspected the accessible leak chase channels and plugs or caps during the general visual examination as a liner boundary. In response to NRC Information Notice 2014-07, "Degradation of Leak Chase Channel System for Floor Welds of Metal Containment Shell and Containment Metallic Liner,"

the examination was expanded to include the inspection as an E-A Containment Surfaces, Item No.

E130 -

Moisture Barriers.

This examination identified no deficiencies. At this time there are no primary containment surface areas that require augmented examinations in accordance with ASME Section XI, IWE-1240.

Within the Millstone IWL Program, no repairs were required and the containment structure was found in good material condition. No significant defects or concerns were observed on the exterior concrete and the observed indications were due to original construction.

Taken together or individually, the indications do not represent a significant structural concern. The containment structure continues to retain its ability to perform, as designed.

No major modifications to the MPS2 containment structure have been performed. Steam generator and reactor vessel head replacements were performed without requiring any modification to the containment structure.

5. The normal Type A test interval should be less than 15 years. If a licensee has to utilize the provisions of Section 9.1 of NEI TR 94-01, Revision 2, related to extending the ILRT interval beyond 15 years, the licensee must demonstrate to the NRC staff that it is an unforeseen emergent condition.

6. For plants licensed under 10 CFR Part 52, applications requesting a permanent extension of the ILRT surveillance interval to 15 years should be deferred until after the construction and testing of containments for that design have been completed and applicants have confirmed the applicability of NEI TR 94-01, Revision 2 and EPRI Report No. 1009325, Revision 2, including the use of past containment ILRT data.

Serial No.17-359 Docket No. 50-336, Page 7 of 26 DNC acknowledges and accepts this NRC staff position, as communicated to the nuclear industry in Regulatory Issue Summary (RIS) 2008-27 dated December 8, 2008.

Not applicable. MPS2 is not licensed under 10 CFR Part 52.

1. The staff is allowing the extended interval for Type C LLRTs be increased to 75 months with the requirement that, a licensee's post-outage report include the margin between the Type B and Type C leakage rate summation and its regulatory limit.

In addition, a corrective action plan shall be developed to restore the margin to an acceptable level. The staff is also allowing the non-routine emergent extension out to 84-months as applied to Type C valves at a site, with some exceptions that must be detailed in NEI 94-01, Revision 3. At no time shall an extension be allowed for Type C valves that are restricted categorically (e.g. BWR MSIVs), and those valves with a history of leakage, or any valves held to either a less than maximum interval or to the base refueling cycle interval.

Only non-routine emergent conditions allow an extension to 84 months.

2. When routinely scheduling any LLRT valve interval beyond 60-months and up to 75-months, the primary containment leakage rate testing program trending or monitoring must include an estimate of the amount of understatement in the Type B & C total, and must be included in a licensee's post-outage report. The report must include the 'reasoning and determination of the acceptability of the extension, demonstrating that the LLRT totals calculated represent the actual leakage potential of the penetrations.

4.1 Description of Containment Serial No.17-359 Docket No. 50-336, Page 8 of 26 Following approval of this amendment and consistent with the guidance of NEI 94-01, Rev. 3-A, DNC will assess and monitor margin between the Type B and C leakage rate summation and the regulatory limit and include this margin in a post outage report. This will include corrective actions to restore margin to an acceptable level, if required.

Following approval of this amendment and consistent with the guidance of Section 11.3.2 of NEI 94-01, Rev. 3-A, DNC will estimate the amount of understatement in the Type B & C total and include determination of the acceptability in a post outage report.

The containment structure at MPS2 consists of a pre-stressed, reinforced concrete cylinder and dome connected to and supported by a massive reinforced concrete foundation slab. The cylindrical portion is pre-stressed by a post-tensioning system composed of horizontal and vertical tendons, with the horizontal tendons placed in three 240 degree systems using three buttresses as supports for the anchorages. The dome has a three-way post-tensioning system. The concrete foundation slab is conventionally reinforced with high strength reinforcing steel. A continuous access gallery is provided beneath the base slab for installation of vertical tendons.

Serial No.17-359 Docket No. 50-336, Page 9 *of 26 The containment structure has an inside diameter of 130 feet and has an interior vertical height of 175 feet. The cylindrical wall thickness is 3. 75 feet, the dome is 3.25 feet thick, and the foundation slab is 8.5 feet thick. A 0.25-inch thick welded steel liner is attached to the inside surface of the concrete shell to ensure a high degree of leak-tightness. The floor liner is installed on top of the structural slab and is then covered with concrete. A waterproofing membrane that was installed during construction of the containment is a continuous plain sheet of polyvinyl chloride applied to the concrete surface with an adhesive. The membrane was applied after the forms were stripped.

The membrane is composed of an elastomeric material having thickness of 40 mils (minimum).

The joints are lapped and the adhesive is applied continuously to the contact surface.

The containment structure completely encloses the reactor, reactor coolant system, and portions of the auxiliary and engineered safety features systems. It ensures that an acceptable upper limit for leakage of radioactive materials to the environment will not be exceeded even if gross failure of the reactor coolant system occurs.

An equipment hatch, 19 ft. in diameter, is provided to permit the transfer of equipment up to and including the size of the reactor vessel head, into and out of the containment.

A personnel lock, 10 ft. 8 in. in diameter, is also provided for access into and out of the containment. Other smaller containment structure penetrations include main steam and feedwater piping, the fuel transfer tube, and electrical conductors.

The containment is designed for all credible loads and load combinations. These load combinations consist of loads under normal operation, loads during a loss of coolant accident (LOCA), test loads, and loads due to adverse environmental conditions.

The containment steel liner plate and penetration sleeves are designed to serve as the primary leakage barrier for the containment. The design considered the composite action of the liner and the concrete structure and includes the transient effects of the liner due to temperature changes during construction, normal operation, and the LOCA.

The changes in strain to be experienced by the liner due to these effects, as well as those at the pressure testing of the containment, are considered.

The stability of the liner is achieved by anchoring it to the concrete structure. At all penetration sleeves, the liner is thickened to reduce stress concentrations, based on the 1968 ASME Code, Section Ill, for Class B vessels. The thickened portions of the liner are then anchored to the concrete. All weldments associated with the penetration sleeves are designed to resist the full applied loads.

All components of the liner which must resist the full design pressure, such as penetration sleeves, personnel lock, and equipment hatch, are designed to meet the requirements of paragraph N-1211, of Section Ill, Nuclear Vessels, 1968 Edition through the summer 1969 addenda of the ASME Code, except the external bolting attachments to the equipment hatch which were designed to meet the requirements of Section Ill, Subsection NE, 1986 Edition.

10 CFR 50, Appendix J, Option B, defines Pa as:

Serial No.17-359 Docket No. 50-336, Page 10 of 26 Pa (p.s.i.g.) means the calculated peak containment internal pressure related to the design basis loss-of-coolant accident as specified in the Technical Specifications.

For MPS2, the peak calculated containment pressure for the LOCA is 52.5 psig.

Therefore, in TS 6.19, Pa is defined as 53 psig (52.5 psig rounded up to the next integer value). However, since the peak calculated containment pressure for the Main Steam Line Break (MSLB) accident is more limiting (i.e., 53.8 psig), containment leakage rate testing is performed at the containment design pressure of 54 psig or higher.

TS 3.6.1.2 maximum allowable primary containment leakage rate, La (0.50% of the primary containment air weight per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />), is used in the MPS2 Final Safety Analysis Report (FSAR), Chapter 14, for the radiological dose calculations of both the LOCA and the MSLB. Therefore, performing the containment leak rate testing at the containment design pressure of 54 psig or higher, ensures that the maximum allowable primary containment leakage rate, La, used in both the LOCA and MSLB FSAR radiological dose calculations, is conservative.

4.2 Type A (ILRT) Test History Test results from the last three Type A ILRTs performed at MPS2 are shown below.

For MPS2, the maximum allowable containment leakage rate is 0.5% of containment air weight per day (%wt/day). Based on the last test performed in 2009, the containment leak rate was less than 43% (.2148/.5) of the TS limit.

Calculated Leakage Rate (Lca1c) 0.1365

%wt/day 0.1365

%wt/day 0.1365

%wt/day Upper Confidence Leakage 0.1793

%wt/day 0.1793

%wt/day 0.1793

%wt/day Rate (L95)

Line Up Penalties 0.03589

%wt/day 0.03589

%wt/day 0.03589

%wt/day Volume Change Correction

-0.0004

%wt/day

-0.0004

%wt/day

-0.0004

%wt/day Leakage Savings 0.000035

%wt/day Corrected Results 0.214835

%wt/day

Calculated Leakage Rate (Lca1c) 0.1135 Upper Confidence Leakage 0.2361 Rate (L95)

Line Up Penalties 0.00156 Volume Change Correction 0

Leakage Savings 0.01826 Corrected Results 0.25592 Calculated Leakage Rate (Lca1c) 0.1969 Upper Confidence Leakage 0.2565 Rate (L95 )

Line Up Penalties 0.0009 Volume Change Correction 0.0003 Leakage Savings 0.0232 Corrected Results 0.2809 4.3 Type 8 and Type C Testing

%wt/day 0.1135

%wt/day 0.2361

%wt/day 0.00156

%wt/day 0

%wt/day

%wt/day

%wt/day 0.1969

%wt/day 0.2565

%wt/day 0.0009

%wt/day 0.0003

%wt/day

%wt/day Serial No.17-359 Docket No. 50-336, Page 11 of 26

%wt/day 0.1135

%wt/day

%wt/day 0.2361

%wt/day

%wt/day 0.00156

%wt/day

%wt/day 0

%wt/day

%wt/day 0.1969

%wt/day

%wt/day 0.2565

%wt/day

%wt/day 0.0009

%wt/day

%wt/day 0.0003

%wt/day The MPS2 Appendix J, Type B and Type C leakage rate testing requires testing of electrical penetrations, airlocks, hatches, flanges, and valves within the scope of the program as required by 10 CFR 50, Appendix J, Option B and TS 6.19. The Type B and Type C testing program consists of local leak rate testing of penetrations with a resilient seal, expansion bellows, double-gasketed manways, hatches and flanges, and

' Serial No.17-359 Docket No. 50-336, Page 12 of 26 containment isolation valves that serve as a barrier to the release of the post-accident containment atmosphere.

A review of the most recent Type B and Type C test results and their comparison with the allowable leakage rate was performed. For MPS2, the combined Type B and Type C leakage acceptance criterion is 0.60 La or 511, 717 standard cubic centimeters per minute (seem). The maximum and minimum pathway leak rate summary totals for the last three refueling outages are shown below.

2R24 - April 2017 As-found Minimum Pathway Leakage Rate As-left Minimum Pathway Leakage Rate As-left Maximum Pathway Leakage Rate 2R23 - October 2015 As-found Minimum Pathway Leakage Rate As-left Minimum Pathway Leakage Rate As-left Maximum Pathway Leakage Rate 2R22 -April 2014 As-found Minimum Pathway Leakage Rate As-left Minimum Pathway Leakage Rate As-left Maximum Pathway Leakage Rate 19,309 seem 20,131 seem 36,989 seem 16,249 seem 16,448 seem 31,313 seem 21,903 seem 21,584 seem 42,198 seem

3. 778 % of 0.6La 3.939 % of 0.6La 7.238 % of 0.6La 3.179 % of 0.6La 3.218 % of 0.6La 6.127 % of 0.6La 4.286 % of 0.6La 4.224 % of 0.6La 8.258 % of 0.6La There were no Type B or Type C penetration test failures during 2R22, 2R23, or 2R24 refueling outages. During 2R22 and 2R23, containment penetration 38 (i.e., station air inside check valve 2-SA-22) was restored to a 60-month test frequency due to debris on the valve seat which required maintenance. Containment penetration 51 (i.e., waste gas header - inside and outside air operated containment isolation valves 2-GR-11.1 and 2-GR-11.2) was returned to a 60-month test frequency due to identification of debris on the valve internals from the piping system which required seat trim replacement.

Following satisfactory performance of two consecutive LLRTs, each penetration was returned to a 60-month test performance interval.

As discussed in NUREG-1493, Type B and Type C tests can identify the vast majority

(> 95%) of all potential containment leakage paths. This amendment request adopts the guidance in NEI 94-01, Revision 3-A, in place of NEI 94-01, Revision 0 for the Type C test interval, but otherwise does not affect the scope or performance of Type B or Type C tests. Type B and Type C testing will continue to provide a high degree of assurance that containment integrity is maintained.

At MPS2, a total of 54 Type B components are tested. Of the 48 electrical penetrations, 44 (or> 83%) are tested on the extended 120-month performance-based test interval.

Due to the historical performance of the original reactor coolant pump (RCP) electrical penetrations, DNC elected to increase the test frequency for these penetrations. To

Serial No.17-359 Docket No. 50-336, Page 13 of 26 date, eight of the 12 RCP electrical penetrations have been replaced.

The four

• remaining electrical penetrations are tested at an increased frequency.

The air lock, fuel transfer tube, and containment equipment hatch are tested every refueling outage.

Additionally, the air lock door gaskets are tested after each containment entry during power operation.

DNC has also modified three spare penetrations which are used for containment access for mechanical and electrical services during refueling outages. These penetrations may be disassembled and reassembled for each refueling outage and are Type 8 tested in the as-left condition.

A total of 59 Type C components are tested at MPS2.

With the exception of the containment purge and exhaust penetrations, which are required to be tested each refueling, the Type C valves at MPS2 are tested on a 60-month performance-based test interval due to their satisfactory performance.

4.4 Supplemental Inspection Requirements Prior to initiating a Type A test, a general visual examination of accessible interior and exterior surfaces of the containment system for structural problems that may affect either the containment structure leakage integrity or the performance of the Type A test is performed. This inspection is typically conducted in accordance with the Millstone Containment lnservice Inspection (ISi) Plan, which implements the requirements of ASME,Section XI, Subsection IWE/IWL. The current applicable code edition and addenda for the second 10-year IWE/IWL program interval is the 2001 Edition with the 2003 Addenda.

The examination performed in accordance with the IWE/IWL program satisfies the general visual examination requirements specified in 10 CFR 50, Appendix J, Option 8.

Identification and evaluation of inaccessible areas are addressed in accordance with the requirements of 10 CFR 50.55a(b)(2)(ix)(A) and (E). Examination of pressure-retaining bolted connections and evaluation of containment bolting flaws or degradation are performed in accordance with the requirements of 10 CFR 50.55a(b)(ix)(G) and 10 CFR 50.55a(b)(ix)(H). Each ten-year ISi interval is divided into three inspection periods of 3, 4 and 3 year durations for IWE. A minimum of one inspection during each inspection period of the ISi interval is required by the IWE program. Each ten-year ISi interval is divided into two five-year inspection periods for IWL. A minimum of one inspection during each inspection period of the ISi interval is required by the IWL program.

As noted in the table below, the required IWE and IWL inspections satisfy the requirement of Section 9.2.3.2 of NEI 94-01, Revision 3-A, to perform the general visual examinations at least three other times before the next Type A test, if the Type A test interval is to be extended to 15 years.

The examinations performed in accordance with the MPS2, American Society of Mechanical Engineers (ASME) Code,Section XI, Subsection IWE/IWL program satisfy

Serial No.17-359 Docket No. 50-336, Page 14 of 26 the general visual examination requirements specified in 10 CFR 50, Appendix J, Option 8. ASME Code,Section XI, Subsection IWE assures that at least three general visual examinations of metallic components will be conducted before the next Type A test if the Type A test interval is extended to 15 years. This meets the requirements of Section 9.2.3.2 of NEI 94-01, Revision 3-A and Condition 2 in Section 4.1 of the NRC safety evaluation for NEI 94-01, Revision 2.

Visual examinations of accessible concrete containment components in accordance with ASME Code,Section XI, Subsection IWL are performed every five years, resulting in at least three IWL examinations being performed during a 15-year Type A test interval.

Together, these examinations assure that at least three general visual examinations of the accessible containment surfaces (exterior and interior) and one visual examination immediately prior to a Type A test will be conducted before the next Type A test, if the Type A test interval is extended to 15 years, thereby meeting the requirements of Section 9.2.3.2 of NEI 94-01, Revision 3-A and Condition 2 in Section 4.1 of the NRC safety evaluation for NEI 94-01, Revision 2.

4.4.1 IWE Examinations A review was conducted for MPS2 per IWE-1241, Examination Surface Areas (1992 Edition with 1992 Addenda of ASME XI) for the initial 10-year Category E-C examination requirements.

No areas were deemed susceptible to accelerated degradation and aging; therefore, augmented examinations per Category E-C were not required.

MPS2 has completed the examination requirements of Interval 2, Period 3 of the containment IWE ISi program. Examinations were performed to the requirements of the I

2001 Edition through 2003 Addenda of ASME XI as modified by the 10 CFR 50.55a(b) limitations. At this time, no augmented Category E-C examinations are planned for MPS2.

In accordance with the containment ISi program, qualified station personnel perform an IWE - General Visual examination of accessible surface area associated with the containment liner.

The only significant repair has been replacement of the MPS2 containment structure moisture barrier.

One hundred percent of the moisture barrier was replaced (50% in 2000 and 50% in 2003). Visual inspection of the liner behind the moisture barrier identified some pitting and degradation resulting from leakage into the moisture barrier. Ultrasonic thickness examinations (five locations in 2000 and four locations in 2003) of the metal liner behind the moisture barrier material were performed to confirm that the containment liner thickness (minimum thickness 0.198 inches) significantly exceeded the minimum required wall thickness (0.0625 inches). The corrosion was minimal and repairs, other than replacing the moisture barrier, were not required. Replacement of the moisture barrier prevents any further intrusion of moisture and eliminates the potential for

Serial No.17-359 Docket No. 50-336, Page 15 of 26 continued loss of base material and further degradation. Subsequent inspections since replacement have verified that the moisture barrier remains in good condition and intact.

In accordance with ASME IWE, a complete inspection of all accessible containment liner surface areas is performed each period.

In addition, each refueling outage, a trained coating inspector specifically examines the containment liner coating, independent of the IWE examination. Recent coating degradation has been primarily the result of mechanical damage. However, the MPS2 liner coating has historically experienced coating failures due to original coating selection and application. During the initial plant construction, blistering or top coat delamination was identified. In all instances, the liner beneath the blisters has not shown signs of degradation or accelerated corrosion.

The original liner plate coating consisted of Carboline Carbozinc 11 primer covered with Carboline Phenoline 305 finish. This coating combination resulted in a high tensile strength finish (Phenoline 305) being used over a lower tensile strength primer (Carbozinc 11 ). Formation of blisters first occurred after the initial Structural Integrity Test (SIT) of containment in June 1975 and has continued at a decreasing formation rate.

The linear blisters identified on the liner plate appear to be the result of the Carboline Phenoline 305 stress relieving itself.

The epoxy topcoat has a modulus that is considerably higher than the organic zinc. Topcoat expansion (due to temperature and pressure changes or stressing of the liner plate) is believed to have caused the topcoat-to-zinc adhesion to fail. When the topcoat was stressed (e.g. compressed), a wrinkle developed in the finish coating that was seen as a long narrow blister (1/2 to 1 inch wide and up to 3 feet long). This wrinkle is the separation of the coating material from the zinc. As a result of the coating blisters, MPS2 has implemented a coating program to inspect the liner plate coating each outage.

Since the exterior containment concrete is fully enclosed and in a dry environment, no wicking potential from outside to the backside of the liner exists.

No evidence of degradation or accelerated corrosion has been found on the surface of the liner beneath the blisters. There are no primary containment surface areas that require augmented examination in accordance with ASME Section XI, IWE-1240. However, each period 100 percent of the accessible primary containment surface area is inspected. If any significant changes or potential concerns are identified, a detailed inspection would be performed at that time.

4.4.2 IWL Examinations The MPS2 containment is unique in that it is not an externally exposed structure. The above-grade containment concrete is fully enclosed and protected from the outside environment by the enclosure building or auxiliary building penetration area. The steel frame enclosure building, which is leak tested as part of the Enclosure Building Filtration System (EBFS) boundary, houses the containment structure dome and vertical sections of concrete.

Serial No.17-359 Docket No. 50-336, Page 16 of 26 The environment to which the containment concrete is subjected is essentially the same at all locations, due to the ventilation system.

The ventilation paths ensure the containment concrete experiences a dry, relatively constant environment. Procedural requirements state the "Enclosure Building should be ventilated prior to the Enclosure Building Ambient Temperature reaching 115°F". The containment concrete does not experience excessive heat, rain, sleet, snow, or freezing temperatures. The enclosure building eliminates the major degradation mechanism (i.e., freeze/thaw cycling) that is experienced by outdoor containments. Further, since the enclosure building maintains a dry environment, no wicking potential exists to damage the containment liner.

A 1996 activity identified four enclosure building structural steel members that appeared to be pulling away from containment.

A vendor was contracted to investigate and perform testing to determine the cause of the gaps. The vendor determined the gaps were the result of grout shrinkage, poorly mixed batches of grout, or inadequate preparation of the surfaces. The fact that the anchor bolts were not loose discounted the possibility that associated building structure movement had caused the plates to pull away from the wall. Their conclusion was that the condition of the anchor plates did not appear to indicate deterioration of the containment concrete or associated building structure. Subsequent IWL inspections have noted no change in the condition to date.

The second 10-year interval of concrete containment examinations (IWL) have been performed for MPS2. General and detailed visual examinations were completed by the required March 8, 2016 due date in accordance with Category L-A of the 2001 Edition with 2003 Addenda of ASME Section XI. The third 10-year interval will have similar

~xaminations (100% of accessible areas) performed by March 8, 2020 and 2025 (plus or minus 1 year) in accordance with Category L-A of the code.

The 2016 examinations of the concrete exterior were conducted by a Quality Control inspector and the responsible engineer, using the approved Code visual methods.

During the examinations, indications noted were minor spalls, efflorescence, pop-outs,

cracks, stains, nails or metal trapped within the concrete and abandoned anchors/anchor holes. Due to the controlled environment within the enclosure building, there have been no changes in the indications. All indications/conditions identified were minor in nature and did not require excavation or repair.

In general, the indications requiring additional inspection involved cracks and embedded metal. The designation of a Code versus a cosmetic repair is detailed in ACl-349.3R, "Evaluation of Existing Nuclear Safety-Related Concrete Structures." No repairs were required.

In summary, no significant defects or concerns were observed on the exterior concrete and for the most part, the observed defects were due to original construction flaws.

Based on these inspections, DNC concludes that the MPS2 containment structure is in good material condition.

The following provides an approximate. schedule for the MPS2 containment surface examinations, assuming the Type A test frequency is extended to 15 years. In addition

Serial No.17-359 Docket No. 50-336, Page 17 of 26 to the required IWE/IWL inspections, additional visual inspections of the normally accessible portions of the interior and external surface of containment are performed.

1992 12/24 3/18 1993 1994 1995 6/10 5/9 (Pre-ILRT) 5/9 (Pre-ILRT) 1996 4/30 12/19 (Baseline) 1997 1998 1999 3/8 (Liner) 2000 First Required 5/19 IWE Exam. (5/22}

2001 First Required 10/3 IWL Exam. (8/30) 2002 2003 11/12 11/1 2004 2005 2006 11/11 9/28 11/6 11/2 11/8 2007 2008 4/23 2009 11/10 10/29 (Pre-ILRT) 10/29 (Pre-ILRT) 10/28 10/31 2010 12/20 12/30 2011 4/5 4/22 2012 11/13 11/2 2013 2014 Note 1 (5/8) 5/10 4/25 2015 5/11 10/26 10/9 2016 3/8 2017 4/19 2018 (Fall)

(Fall)

(Fall) 2019 2020 (February)

(February)

(Spring) 2021 (Fall)

(Fall) 2022 2023 (15-Year)

(Pre-ILRT)

(Pre-ILRT)

(Spring)

(Spring) 2024 (Fall) 2025 (February)

(February) 2026 (Spring)

(Spring)

4.5 Deficiencies Identified Serial No.17-359 Docket No. 50-336, Page 1 8 of 26 Consistent with the guidance provided in NEI 94-01, Revision 3, Section 9.2.3.3, abnormal degradation of the primary containment structure identified during the conduct of IWE/IWL program examinations, or at other times, is entered into the corrective action program for evaluation to determine the cause of the degradation and to initiate appropriate corrective actions.

4.6 Plant-Specific Confirmatory Analysis 4.6.1 Methodology An evaluation has been performed to assess the risk impact of extending the MPS2 ILRT interval from the current 10 years to 15 years. This plant-specific risk assessment followed the guidance in NEI 94-01, Revision 2-A, the methodology described in EPRI TR-1009325, Revision 2-A, and the NRC regulatory guidance outlined in RG 1.174 on the use of Probabilistic Risk Assessment (PRA) findings and risk insights in support of a request to change the licensing basis of the plant. In addition, the methodology used for Calvert Cliffs Nuclear Power Plant to estimate the likelihood and risk implication of corrosion-induced leakage of steel containment liners going undetected during the extended ILRT interval was also used for sensitivity analysis. The current MPS2 Level 1 and Large Early Release Frequency (LERF) internal events PRA model was used to perform the plant-specific risk assessment. This PRA model has been updated to meet Capability Category II of ASME PRA Standard RA-Sa-2009 and RG 1.200, Revision 2, with the exception of several minor issues that have been determined to have no impact on the conclusions of the risk impact assessment. The analyses include evaluation for the dominant external events (fire and seismic) using conservative expert judgment with the information from the MPS2 Individual Plant Examination of External Events (IPEEE),

the MPS2 fire mitigation strategies, and the risk assessment of Generic Issue 199.

Though the IPEEE seismic and fire event models have not been updated since the original IPEEE, the insights and information from these sources have been used to estimate the effect on total LERF of including these external events in the ILRT interval extension risk assessment.

In the SE issued by NRC letter dated June 25, 2008, the NRC concluded that the methodology in EPRI TR-1009325, Revision 2, is acceptable for referencing by licensees proposing to amend their TS to extend the ILRT surveillance interval to 15 years, subject to the limitations and conditions noted in Section 4.0 of the SE. The following table addresses each of the four limitations and conditions for the use of EPRI TR-1009325, Revision 2.

1.

The licensee submits documentation indicating that the technical adequacy of their PRA is consistent with the requirements of RG 1.200 relevant to the ILRT extension application.

2.

The licensee submits documentation indicating that the estimated risk increase associated with permanently extending the ILRT surveillance interval to 15 years is small, and consistent with the clarification provided in Section 3.2.4.5 of the SE. Specifically, a small increase in population dose should be defined as an increase in population dose of less than or equal to either 1.0 person-rem per year or 1 percent of the total population dose; whichever is restrictive. In addition, a small increase in CCFP should be defined as a value marginally greater than that accepted in a previous onetime ILRT extension requests.

This would require that the increase in CCFP be less than or equal to 1.5 percentage point.

3.

The methodology in EPRI Report No.

1009325, Revision 2, is acceptable except for the calculation of the increase in expected population dose (per year of reactor operation).

In order to make the methodology acceptable, the average leak rate accident case (accident case 3b) used by the licensees shall be 100 La instead of 35 La.

4.

A LAR is required in instances where containment over-pressure is relied upon for emergency core cooling system (ECCS) performance.

4.6.2 PRA Quality Serial No.17-359 Docket No. 50-336, Page 19 of 26 MPS2 PRA quality is addressed in Section 4.6.2 below.

EPRI Report No.

1009325, Revision 2-A, incorporates these population dose and Conditional Containment Failure Probability (CCFP) acceptance guidelines, which were used for the MPS2 plant-specific assessment.

EPRI Report No. 1009325, Revision 2-A, incorporated the use of 100 La as the average leak rate for the preexisting containment large leakage rate accident case (accident case 3b), and this value was used in the MPS2 plant-specific risk assessment.

MPS2 does not rely on containment over-pressure for ECCS perfo~mance.

The Level 1 and LERF PRA model that is used for MPS2 is characteristic of an as-built, as-operated plant. The current internal events model (MPS2-R05e) is a linked fault tree model. Accident progression sequences have been developed from the internal events

Serial No.17-359 Docket No. 50-336, Page 20 of 26 CDF sequences. The sequences have been mapped to the radiological release end states (i.e. source term release to environment).

The MPS2 PRA is based on a detailed model of the plant developed from the Individual Plant Examination which underwent NRC review.

Review comments, current plant design, current procedures, plant operating data, current industry PRA techniques, and general improvements identified by the NRC have been incorporated into the current PRA model. The model is maintained in accordance with Dominion PRA procedures.

Two industry peer reviews and a self-assessment of the PRA model have been performed.

The first peer review was performed by the Combustion Engineering Owners Group in 2000 using the NEI 00-02 PRA Peer Review Process Guidance, and the A-and B-significance Facts and Observations (F&Os) have been resolved. A full-scope self-assessment of the PRA model was performed in 2007 using ASME/ANS PRA Standard RA-Sb-2005 and updated in 2011 using ASME/ANS PRA Standard RA-Sa-2009, and specific recommendations were provided for each Supporting Requirement (SR) which was assessed as not meeting Capability Category II by the PRA model and documentation. A focused-scope peer review was performed in 2012 using the ASME/ANS PRA Standard RA-Sa-2009, with focus on the items that were considered upgrades in accordance with the Capability Category II requirements of the 2009 ASME/ANS PRA Standard and Regulatory Guide (RG) 1.200. The MPS2 PRA model was updated to resolve most of the gaps identified by the peer review and self-assessment, and the unresolved gaps were evaluated for impact on the application. As such, the updated MPS2 PRA model is considered acceptable for use in assessing the risk impact of extending the MPS2 containment ILRT surveillance interval to 15 years.

4.6.3 Summary of Plant-Specific Risk Assessment Results Based on the risk assessment results and the sensitivity calculations detailed in, the following conclusions regarding the assessment of the plant risk are associated with extending the Type A ILRT test frequency to 15 years.

Reg. Guide 1.174 provides guidance for determining the risk impact of plant-specific changes to the licensing basis. Reg. Guide 1.17 4 defines very small changes in risk as resulting in increases of CDF below 1.OE-06/yr and increases in LERF below 1.0E-07/yr and small changes in risk as increases in LERF below 1.0E-06/yr. Since the ILRT extension was demonstrated to have no impact on CDF for MPS2, the relevant criterion is LERF. The increase in internal events LERF, which includes corrosion, resulting from a change in the Type A ILRT test frequency from three-per-ten years to one-per-fifteen years is conservatively estimated as 1.99E-07/yr (see Table 5.6-1 of Attachment 3) using the EPRI guidance as written. As such, the estimated change in internal events LERF is determined to be "small" using the acceptance guidelines of Reg. Guide 1.174.

The increase in LERF including both internal and external events is estimated as 5.72E-07/yr (see Table 5.7-2 of Attachment 3), which is considered a "small" change in LERF using the acceptance guidelines of Reg. Guide 1.174.

Serial No.17-359 Docket No. 50-336, Page 21 of 26 Reg. Guide 1.174 also states that when the calculated increase in LERF is in the range of 1.0E-06 per reactor year to 1.0E-07 per reactor year, applications will be considered only if it can be reasonably shown that the total LERF is less than 1.0E-05 per reactor year. Although the total increase in LERF for internal and external events is greater than 1.0E-7 per reactor year, the total LERF can be demonstrated to be well below 1.0E-5 per reactor year. The total base LERF for internal and external events is approximately 3.61 E-06/yr based on Table 5.7-2 of Attachment 3.

Given that the increase in LERF for the fifteen-year ILRT interval is 5.72E-07/yr for internal and external everits from Table 5.7-2 of, the total LERF for the fifteen-year interval can be estimated as 4.18E-06/yr. This is well below the RG 1.174 acceptance criteria for total LERF of 1.0E-05/yr.

The change in dose risk for changing the Type A test frequency from three-per-ten years to one-per-fifteen years, measured as an increase to the total integrated dose risk for all accident sequences, is 6.29E-04 person-rem/yr or 0.0084% of the total population dose using the EPRI guidance with the base case corrosion case from Table 5.6-1 of Attachment 3. EPRfTR-1018243 states that a very small population dose is defined as an increase of :::; 1.0 person-rem per year or:::; 1 % of the total population dose, whichever is less restrictive for the risk impact assessment of the extended ILRT intervals.

Moreover, the risk impact when compared to other severe accident risks is negligible.

The increase in the conditional containment failure frequency from the three-per-ten year frequency to one-per-fifteen year frequency is 0.025% using the base case corrosion case in Table 5.6-1 of Attachment 3.

EPRI TR-1018243 (Reference 18 of Attachment 3) states that increase in CCFP of :::; 1.5 percentage points are very small. Therefore this increase is judged to be very small.

Therefore, increasing the ILRT interval to 15 years is considered to be insignificant since it represents a small change to the MPS2 risk profile. Details of the MPS2 risk assessment are contained in Attachment 3.

4.7 Conclusion NEI 94-01, Revision 3-A, and the limitations and conditions specified in NEI 94-01, Rev.

2-A, describe an NRG-accepted approach for implementing the performance-based requirements of 10 CFR 50, Appendix J, Option B.

It incorporates the regulatory positions stated in RG 1.163 and includes provisions for extending Type A and Type C intervals to 15 years and 75 months, respectively. NEI 94-01, Revision 3-A delineates a performance-based approach for determining Type A, Type B, and Type C containment leakage rate surveillance test frequencies. DNC is adopting the guidance of NEI 94-01, Revision 3-A, and the limitations and conditions specified in NEI 94-01, Rev. 2-A, for use in the MPS2 10 CFR 50, Appendix J testing program.

Based on the previous ILRT tests conducted at MPS2, DNC concludes that extension of the containment ILRT interval from 10 to 15 years represents minimal risk to increased

I I.,

Serial No.17-359 Docket No. 50-336, Page 22 of 26 leakage. The risk is minimized by continued Type 8 and Type C testing performed in accordance with Option 8 of 10 CFR 50, Appendix J and inspection activities performed as part of the MPS2 IWE/IWL ISi program.

This conclusion is supplemented by the risk analysis provided in Attachment 3 and the PRA technical adequacy provided in Attachment 4.

The findings of the MPS2 risk assessment confirm, on a plant-specific basis, that extending the ILRT interval from 10 to 15 years results in a small change to the MPS2 risk profile.

5.0 REGULATORY ANALYSIS

5.1 Applicable Regulatory Requirements/Criteria The proposed change has been evaluated to determine whether applicable regulations and requirements continue to be met.

1 O CFR 50.54(0) requires primary reactor containments for water-cooled power reactors to be subject to the requirements of Appendix J to 10 CFR 50, "Leakage Rate Testing of Containment of Water Cooled Nuclear Power Plants."

Appendix J specifies containment leakage testing requirements, including the types required to ensure the leak-tight integrity of the primary reactor containment and systems and components which penetrate the containment.

In addition, Appendix J discusses leakage rate acceptance criteria, test methodology, frequency of testing and reporting requirements for each type of test.

RG 1.163 was developed to endorse NEI 94-01 with certain modifications and additions.

The adoption of Option 8 performance-based containment leakage rate testing for Type A testing did not alter the basic method by which Appendix J leakage rate te?ting is performed; however, it did alter the frequency at which Type A, Type 8, and Type C containment leakage tests must be performed. Under the performance-based option of 10 CFR 50, Appendix J, the test frequency is based on evaluation of "as-found" leakage history to determine the frequency for leakage testing which provides assurance that leakage limits will be maintained. The change to the Type A test frequency did not directly result in an increase in containment leakage. Similarly, the proposed change to the Type A test frequency will not directly result in an increase in containment leakage.

NEI 94-01, Revision 3-A, and the limitations and conditions specified in NEI 94-01, Rev.

2-A, describe an approach for implementing the performance-based requirements of 10 CFR 50, Appendix J, Option 8. The document incorporates the regulatory positions stated in RG 1.163 and includes provisions for extending Type A and Type C intervals to 15 years and 75 months, respectively.

NEI 94-01, Revision 3-A, delineates a performance-based approach for determining Type A, Type 8, and Type C containment leakage rate test frequencies. In the SEs issued by NRC letters dated June 25, 2008 and June 8, 2012, the NRC concluded that NEI 94-01, Revisions 2 and 3, describe an acceptable approach for implementing the optional performance-based requirements of 10 CFR 50, Appendix J, and is acceptable for referencing by licensees proposing to

Serial No.17-359 Docket No. 50-336, Page 23 of 26 amend their TS in regards to containment leakage rate testing, subject to the limitations and conditions, noted in Section 4.0 of the SEs.

EPRI TR-1009325, Revision 2, provides a risk impact assessment for optimized Integrated Leak Rate Test (ILRT) intervals up to 15 years, utilizing current industry performance data and risk informed guidance. NEI 94-01, Revision 3, states that a plant-specific risk impact assessment should be performed using the approach and methodology described in TR-1009325, Revision 2, for a proposed extension of the ILRT interval to 15 years. In the safety evaluation (SE) issued by NRC letter June 25, 2008, the NRC concluded that the methodology in EPRI TR-1009325, Revision 2, is acceptable for referencing by licensees proposing to amend their TS to extend the ILRT surveillance interval to 15 years, subject to the limitations and conditions noted in Section 4.2 of that SE.

Based on the considerations above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will continue to be conducted in accordance with the site licensing basis, and (3) the approval of the proposed change will not be inimical to the common defense and security or to the health and safety of the public.

In conclusion, DNC has determined that the proposed change does not require any exemptions or relief from regulatory requirements, other than the TS, and does not affect conformance with any regulatory requirements/criteria.

5.2 No Significant Hazards Consideration A change is proposed to the Millstone Power Station Unit 2 (MPS2), Technical Specification 6.19, "Containment Leakage Rate Testing Program."

The proposed amendment would replace the reference to Regulatory Guide (RG) 1.163 with a reference to Nuclear Energy Institute (NEI) topical report NEI 94-01, Revision 3-A, and the limitations and conditions specified in NEI 94-01, Rev. 2-A. as the implementing documents used by Dominion Nuclear Connecticut, Inc. (DNC) to develop the MPS2 performance-based leakage testing program in accordance with Option B of 10 CFR 50, Appendix J. The proposed amendment would also extend the interval for the primary containment integrated leak rate test (ILRT), which is required to be performed by 10 CFR 50, Appendix J, from 10 years to no longer than 15 years from the last ILRT and permit Type C testing to be performed at an interval not to exceed 75 months.

DNC has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth on 10 CFR 50.92, "Issuance of amendment," as discussed below" 1. Does the proposed change involve a significant increase

• in the probability or consequences of an accident previously evaluated?

Response: No.

Serial No.17-359 Docket No. 50-336, Page 24 of 26 The proposed amendment involves changes to the MPS2 Containment Leakage Rate Testing Program. The proposed amendment does not involve a physical change to the plant or a change in the manner in which the plant is operated or controlled. The primary containment function is to provide an 'essentially leak tight barrier against the uncontrolled release of radioactivity to the environment for postulated accidents. As such, the containment and the testing requirements to periodically demonstrate the integrity of the containment exist to ensure the plant's ability to mitigate the consequences of an accident, and do not involve any accident precursors or initiators.

Therefore, the probability of occurrence of an accident previously evaluated is not significantly increased by the proposed amendment.

The proposed amendment adopts the NRG-accepted guidelines of NEI 94-01, Revision 3-A, and the limitations and conditions specified in NEI 94-01, Rev. 2-A, for development of the MPS2 performance-based leakage testing program.

Implementation of these guidelines continues to provide adequate assurance that during design basis accidents, the primary containment and its components will limit leakage rates to less than the values assumed iri the plant safety analyses.

The potential consequences of extending the ILRT interval to 15 years have been evaluated by analyzing the resulting changes in risk. The increase in risk in terms of person-rem per year within 50 miles resulting from design basis accidents was estimated to be acceptably small and determined to be within the guidelines published in RG 1.17 4.

Additionally, the proposed change maintains defense-in-depth by preserving a reasonable balance among prevention of core damage, prevention of containment failure, and consequence mitigation.

DNC has determined that the increase in Conditional Containment Failure Probability due to the proposed change is very small.

Therefore, it is concluded that the proposed amendment does not significantly increase the consequences of an accident previously evaluated.

Based on the above discussion, it is concluded that the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2.

Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed amendment adopts the NRG-accepted guidelines of NEI 94-01, Revision 3-A, and the limitations and conditions specified in NEI 94-01, Rev. 2-A, for development of the MPS2 performance-based leakage testing program, and establishes a 15-year interval for Type A testing and an interval not to exceed 75 months for Type C testing. The containment and the testing requirements to periodically demonstrate the integrity of the containment exist to ensure the plant's ability to mitigate the consequences of an accident; do not involve any accident precursors or initiators. The

Serial No.17-359 Docket No. 50-336, Page 25 of 26 proposed change does not involve a physical change to the plant (i.e., no new or different type of equipment will be installed) or a change to the manner in which the plant is operated or controlled.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any previously evaluated.

3.

Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

The proposed amendment adopts the NRG-accepted guidelines of NEI 94-01, Revision 3-A, and the limitations and conditions specified in NEI 94-01, Rev. 2-A, for the development of the MPS2 performance-based leakage testing program, and establishes a 15-year interval for Type A testing and an interval not to exceed 75 months for Type C testing. This amendment does not alter the manner in which safety limits, limiting safety system setpoints, or limiting conditions for operation are determined.

The specific requirements and conditions of the Containment Leakage Rate Testing Program, as defined in the TS, ensure that the degree of primary containment structural integrity and leak-tightness that is considered in the plant's safety analysis is maintained. The overall containment leakage rate limit specified by the TS is maintained, and the Type A, Type B, and Type C containment leakage tests will be performed at the frequencies established in accordance with the NRG-accepted guidelines of NEI 94-01, Revision 3-A, and the limitations and conditions specified in NEI 94-01, Rev. 2-A.

Containment inspections performed in accordance with other plant programs serve to provide a high degree of assurance that the containment will not degrade in a manner that is not detectable by an ILRT. A risk assessment using the current MPS2 PRA model concluded that extending the ILRT test interval from 1 O years to 15 years results in a small change to the MPS2 risk profile.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, DNC concludes that the proposed amendment presents no significant hazards consideration under the standards set forth in 10 CFR 50. 92(c) and, accordingly, a finding of "no significant hazards consideration" is justified.

5.3 Environmental Consideration The proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluent that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure.

Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

6.0 PRECEDENCE Serial No.17-359 Docket No. 50-336, Page 26 of 26 This request is similar in nature to the license amendments authorized by the NRG on July 3, 2014, for Surry Power Station Units 1 and 2 (ADAMS Accession Number ML14148A235) and on June 16, 2015, for North Anna Power Station Units 1 and 2 (ADAMS Accession Number ML15133A381).

ATTACHMENT 2 Marked-Up Technical Specification Page DOMINION NUCLEAR CONNECTICUT, INC.

MILLSTONE POWER STATION UNIT 2 Serial No.17-359 Docket No. 50-336

Serial No.17-359 Docket No. 50-336, Page 1 of 1 Al)MINISTRATIVE CONTROLS NEI 94-01, Revision 3-A, "Industry Guideline. for

==========================t1mplementing Performance-Based Option or10 CFR 6.19 CONTAINMENT LEAKAGE RATE 1ESTING PROGRAM Part. 50, APpendix J, d.ated Juiy* 2.012 and the limitations aniJ con.ditions sp<;ocifieo in NE.I 9.4-0.1, The peak calculated primary Containment internal pressure for the design basis loss of coolant accident is Pa, Pa is 53 psig. ContairunentJeakage rate testing will be performed at the contairtment design pressure of 54 psig or higher.

The maximum allowable primary containment leakage rate, La, at P 8, iS 0. 5% of primary containment air weight per day.

Leakage rate acceptance criteria are:

a.

Primary containment overall leakage rate acceptance criterion is.< 1.0 L8

• During the first unitstarti.lp folfowingteJiting in accordance with this program, the leakage rate accepta,nc;e criteria are< 0.60 La fotthe combined Type.Band 'fype C tests, and< 0.75 La for Type A tests;

b.

Air lock testing acceptance criteria are:

1. Overall air lock leakage rate is s 0.05 La when tested at :2: Pa*

2. For each door, leakage rate is$: 0.01 La when pressurized to :2: 25 psig.

The provisions of SR 4.0.2 do :not apply for fest frequencies specified in the Primary Containment Leakage Rate Testing Program.

The provisions of SR 4.0.3. are applicable to the Primary Containment Leakage Rate Testing Program.

6.20 RADIOACTIVE EFFLUENTCONTROLS PROGRAM This program conforms to 10 CFR 50.36aforthe control of radioactive effluents and for maintaining the doses to members. of the public from radioactive effluents as low as reasonably achievable. The program shall be contained in the REMO DCM, shall be implemented by procedures, and shall include remedial actions to be taken whenever 1he program limits are exceeded. The program shall include the following elements:

a.

Limitatioris on the functional capability of radioactive liquid and gaseous monitoring instrumentation.including surveillance tests and setpointdetermination in accordance with the methodology in the R:EMODCM;

b.

Limitations on the concentrations of radioactive material releasedin liquid effluents to UNRESTRICTED AREAS, confonning to tcil times the concentration values in Appendix B, Table 2~ Column 2 to 10CFR 20.1001"20.2402; 6-26 MILLSTONE-UNIT.2 Amendment No.~.~. :;;+6, ;;;&§.,

~.*~

ATTACHMENT 3 Documentation of Probabilistic Risk Assessment DOMINION NUCLEAR CONNECTICUT, INC.

MILLSTONE POWER STATION UNIT 2 Serial No.17-359 Docket No. 50-336

ATTACHMENT 3 TABLE OF CONTENTS Serial No.17-359 Docket No. 50-336, Page 1 of 41 1.0 PURPOSE OF ANALYSIS...................................................................................................... 2 1.1 Purpose......................................................................................................................... 2 1.2 Background.......................................................................................,............................ 2 1.3 Criteria........................................................................................................................... 3 2.0 METHODOLOGY..................................................................................................................... 4 3.0 GROUND RULES.................................................................................................................... 5 4.0 INPUTS..........................................................................................................'........................... 6 4.1 General Resources Available.............................................................................................. 6 4.2 Plant-Specific Inputs............................................................................................................. 1 O 4.3 Impact of Extension on Detection of Component Failures That Lead to Leakage............. 13 4.4 Impact of Extension on Detection of Steel Liner Corrosion That Lead to Leakage............ 14 5.0 RESULTS............................................................................................................................... 17 5.1 Step 1 - Quantify the Base-Line Risk in Terms of Frequency Per Reactor Year................ 19 5.2 Step 2 - Develop Plant-Specific Person-Rem Dose (Population Dose)/Reactor Year........ 21 5.3 Step 3 - Evaluate Risk Impact of Extending Type A Test Interval From 1 Oto 15 Years...... 24 5.4 Step 4 - Determine the Change in Risk in Terms of Large Early Release Frequency....... 28 5.5 Step 5 - Determine the Impact on the Conditional Containment Failure Probability........... 29 5.6 Summary of Results.............................................................................................................. 31 5.7 External Events Contribution................................................................................................ 33 6.0 SENSITIVITIES....................................................................................................................... 36 6.1 Sensitivity to Corrosion Impact Assumptions........................................................................ 36

7.0 CONCLUSION

S..................................................................................................................... 37

8.0 REFERENCES

........................................................................................................................ 38

Serial No.17-359 Docket No. 50-336, Page 2 of 41 DOCUMENTATION OF PROBABILISTIC RISK ASSESSMENT 1.0 PURPOSE OF ANALYSIS 1.1 Purpose The purpose of this analysis is to provide an assessment of the risk associated with permanently extending the Type A integrated leak rate test (ILRT) interval from ten years to fifteen years for Millstone Power Station Unit 2 (MPS2). The risk assessment follows the guidelines from NEI 94-01, Revision 2-A [1], the methodology used in EPRI TR-104285 [2], the EPRI Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals [18], the NRC regulatory guidance on the use of Probabilistic Risk Assessment (PRA) findings and risk insights in support of a request for a plant's licensing basis as outlined in Regulatory Guide (RG) 1.174 [3], and the methodology used for Calvert Cliffs to estimate the likelihood and risk implications of corrosion-induced leakage of steel liners going undetected during the extended test interval [4].

The format of this document is consistent with the intent of the Risk Impact Assessment Template for evaluating extended integrated leak rate testing intervals provided in the October 2008 EPRI final report [18].

1.2 Background

Revisions to 1 OCFR50, Appendix J (Option 8) allow individual plants to extend the Integrated Leak Rate Test (ILRT) Type A surveillance testing frequency requirement from three-per-ten years to at least one-per-ten years. The revised Type A frequency is based on an acceptable performance history defined as two consecutive periodic Type A tests at least 24 months apart in which the calculated performance leakage rate was less than limiting containment leakage rate of 1 La.

The basis for the current 10-year test interval is provided in Section 11.0 of NEI 94-01, Revision 0, and was established in 1995 during development of the performance-based Option 8 to Appendix J.

Section 11.0 of NEI 94-01 states that NUREG-1493 [5],

"Performance-Based Containment Leak Test Program," provides the technical basis to support rulemaking to revise leakage rate testing requirements contained in Option 8 to Appendix J. The basis consisted of qualitative and quantitative assessments of the risk impact (in terms of increased public dose) associated with a range of extended leakage rate test intervals. To supplement the NRC's rulemaking basis, NEI undertook a similar study. The results of that study are documented in Electric Power Research Institute (EPRI) Research Project Report TR-104285 [2], "Risk Impact Assessment of Revised Containment Leak Rate Testing Intervals."

The NRC report on performance-based leak testing, NUREG-1493 [5], analyzed the effects of containment leakage on the health and safety of the public and the benefits realized from the containment leak rate testing. In that analysis, it was determined that for a representative PWR plant (i.e., Surry) containment isolation failures contribute less

Serial No.17-359 Docket No. 50-336, Page 3 of 41 than 0.1 percent to the latent risks from reactor accidents. Consequently, it is desirable to confirm that extending the ILRT interval will not lead to a substantial increase in risk from containment isolation failures for MPS2.

Earlier ILRT frequency extension submittals have used the EPRI TR-104285 [2]

methodology to perform the risk assessment. In October 2008, EPRI TR-1018243 [18]

was issued to develop a generic methodology for the risk impact assessment for ILRT interval extensions to fifteen years using current performance data and risk informed guidance, primarily NRC Regulatory Guide 1.17 4 [3]. This more recent EPRI document considers the change in population dose, large early release frequency (LERF), and containment conditional failure probability (CCFP), whereas TR-104285 considered only the change in risk based on the change in population dose.

This ILRT interval extension risk assessment for MPS2 employs the EPRI TR-1018243 methodology, with the affected System, Structure, or Component (SSC) being the primary containment boundary.

1.3 Criteria The acceptance guidelines in RG 1.17 4 [3] are used to assess the acceptability of this permanent extension of the Type A test interval beyond that established during the Option B rulemaking of Appendix J. RG 1.174 defines very small changes in the risk-acceptance guidelines as increases in core damage frequency (CDF) less than 1.0E-06 per reactor year and increases in large early release frequency (LERF) less than 1.0E-07 per reactor year. An evaluation of the CDF impact in Section 5 confirms that the change in risk is bounded by the LERF impact, so the relevant criterion is the change in LERF. RG 1.174 also defines small changes in LERF as below 1.0E-06 per reactor year. RG 1.17 4 discusses defense-in-depth and encourages the use of risk analysis techniques to help ensure and show that key principles, such as the defense-in-depth philosophy, are met.

Therefore, the increase in the conditional containment failure probability (CCFP) is also calculated to help ensure that the defense-in-depth philosophy is maintained.

Regarding CCFP, changes of up to 1.1 % have been accepted by the N RC for the one-time requests for extension of ILRT intervals. Given this perspective and based on the guidance in EPRI TR-1018243 [18], a change in the CCFP of up to 1.5% (percentage point) is assumed to be small.

In addition, the total annual risk (person rem/yr population dose) is examined to demonstrate the relative change in this parameter. While no acceptance guidelines for these additional figures of merit are published, examinations of NUREG-1493 and Safety Evaluation Reports (SER) for one-time interval extension (summarized in Appendix G of EPRI TR-1018243 [18]) indicate a range of incremental increases in population dose that have been accepted by the NRC.

The range of incremental population dose increases is from :5.0.01 to 0.2 person-rem/yr and/or 0.002 to 0.46% of the total accident dose. The total doses for the spectrum of all accidents (NUREG-1493

[5], Figure 7-2) result in health effects that are at least two orders of magnitude less

Serial No.17-359 Docket No. 50-336, Page 4 of 41 than the NRC Safety Goal Risk.

Given these perspectives, a very small population dose is defined as an increase from the baseline interval (3 tests per 10 years) dose of

51.0 person-rem per year, or 1 % of the total baseline dose, whichever is less restrictive for the risk impact assessment of the proposed extended ILRT interval. It is noted that the methodology used in the one-time ILRT interval extension requests assumed a large leak magnitude (EPRI class 3b) of 35La, whereas the methodology in EPRI TR-1018243 uses 1 OOLa. The dose rates are impacted by this change and will be larger than those in previous submittals.

2.0 METHODOLOGY A simplified bounding analysis approach consistent with the EPRI approach is used for evaluating the change in risk associated with increasing the test interval to fifteen years

[18]. The analysis uses results from a Level 2 analysis of core damage scenarios from the current MPS2 PRA analysis and subsequent containment responses resulting in various fission product release categories.

The six general steps of this assessment are as follows:

1. Quantify the baseline risk in terms of the frequency of events (per reactor year) for each of the eight containment release scenario types identified in the EPRI report.

2. Develop plant-specific person-rem (population dose) per reactor year for each of the eight containment release scenario types from plant specific consequence analyses.

3. Evaluate the risk impact (i.e., the change in containment release scenario type frequency and population dose) of extending the ILRT interval to fifteen years.

4. Determine the change in risk in terms of Large Early Release Frequency (LERF) in accordance with RG 1.174 [3] and compare with the acceptance guidelines of RG 1.174.

5. Determine the impact on the Conditional Containment Failure Probability (CCFP)

6. Evaluate the sensitivity of the results to assumptions in the liner corrosion analysis, external events, and to the fractional contribution of increased large isolation failures (due to liner breach) to LERF.

Furthermore, Consistent with the other industry containment leak risk assessments, the MPS2 assessment uses LERF and delta LERF in accordance with the risk acceptance guidance of RG 1.17 4. Changes in population dose and conditional containment

Serial No.17-359 Docket No. 50-336, Page 5 of 41 failure probability are also considered to show that defense-in-depth and the balance of prevention and mitigation is preserved.

Containment overpressure is not credited in the ECCS NPSH calculations for MPS2 [31 ]. As a result, an extension of the ILRT interval does not result in an increase in CDF, and LERF is the only metric evaluated against RG 1.174.

This evaluation for MPS2 uses ground rules and methods to calculate changes in risk metrics that are similar to those used in EPRI TR-1018243 [18], Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals.

3.0 GROUND RULES The following ground rules are used in the analysis:

The MPS2 Level 1 and Level 2 internal events PRA models provide representative results.

It is appropriate to use the MPS2 internal events PRA model as a gauge to effectively describe the risk change attributable to the ILRT extension.

It is reasonable to assume that the impact from the ILRT extension (with respect to percent increases in population dose) will not substantially differ if fire and seismic events were to be included in the calculations. However, external events have been accounted for in the analysis based on the available information from the MPS2 IPEEE as described in Section 5.7.

Dose results for the containment failures modeled in the PRA are contained in MPS2 calculation PRA02NQA-0310782 (referred to as the dose results from the MPS2 SAMA analysis) [22].

Accident classes describing radionuclide release end states are defined consistent with EPRI methodology [18] and are summarized in Section 4.2.

The representative containment leakage for EPRI Accident Class 1 sequences is 1 La. EPRI Accident Class 3 sequences account for increased leakage due to Type A inspection failures.

The representative containment leakage for EPRI Accident Class 3a sequences is 1 Ola based on the previously approved methodology performed for Indian Point Unit 3 [6, 7].

The representative containment leakage for EPRI Accident Class 3b sequences is 1 OOLa b.ased on the guidance provided in EPRI TR-1018243 [18].

Serial No.17-359 Docket No. 50-336, Page 6 of 41 The EPRI Accident Class 3b sequences can be conservatively categorized as LERF based on the previously approved methodology [6, 7].

The impact on population doses from containment bypass scenarios is not altered by the proposed ILRT extension, but is accounted for in the EPRI methodology as a separate entry for comparison purposes.

Since the containment bypass contribution to population dose is fixed, no changes on the conclusions from this analysis will result from this separate categorization.

The reduction in ILRT frequency does not impact the reliability of containment isolation valves to close in response to a containment isolation signal.

All of the calculations for this analysis were performed electronically using Microsoft Excel, which eliminates rounding error. As a result, hand calculations using the values in each table may yield slightly different results.

4.0 INPUTS This section summarizes the general resources available as input (Section 4.1) and the plant-specific resources required (Section 4.2).

4.1 General Resources Available Various industry studies on containment leakage risk assessment are briefly summarized here:

1. NUREG/CR-3539 [8]

2. NUREG/CR-4220 [9]

3. NUREG-1273 [10]

4. NUREG/CR-4330 [11]

5. EPRI TR-105189 [12]

6. NUREG-1493 [5]

7. EPRI TR-104285 [2]

8. Calvert Cliffs liner corrosion analysis [4]

9. EPRI TR-1018243 [18]

The first study is applicable because it provides one basis for the threshold that could be used in the Level 2 PRA for the size of containment leakage that is considered significant and is to be included in the model. The second study is applicable because it provides a basis of the probability for significant pre-existing containment leakage at the time of a core damage accident.

The third study is applicable because it is a subsequent study to NUREG/CR-4220 that undertook a more extensive evaluation of the same database. The fourth study provides an assessment of the impact of different containment leakage rates on plant risk. The fifth study provides an assessment of the impact on shutdown risk from ILRT test interval extension. The sixth study is the NRC's

Serial No.17-359 Docket No. 50-336, Page 7 of 41 cost-benefit analysis of various alternative approaches regarding extending the test intervals and increasing the allowable leakage rates for containment integrated and local leak rate tests. The seventh study is an EPRI study of the impact of extending ILRT and local leak rate test (LLRT) intervals on at-power public risk. The eighth study addresses the impact of age-related degradation of the containment liners on ILRT evaluations.

Finally, the ninth study builds on the previous work and includes a recommended methodology and template for evaluating the risk associated with a permanent 15-year extension of the ILRT interval.

NUREG/CR-3539 [8]

Oak Ridge National Laboratory (ORNL) documented a study of the impact of containment leak rates on public risk in NUREG/CR-3539. This study uses information from WASH-1400 [14] as the basis for its risk sensitivity calculations. ORNL concluded that the impact of leakage rates on light water reactor (LWR) accident risks is relatively small.

NUREG/CR-4220 [9]

NUREG/CR-4220 is a study performed by Pacific Northwest Laboratories for the NRC in 1985. The study reviewed over two thousand licensee event reports (LER), ILRT reports and other related records to calculate the unavailability of containment due to leakage.

NUREG-1273 [10]

A subsequent NRC study, NUREG-1273, performed a more extensive evaluation of the NUREG/CR-4220 database.

This assessment noted that about one-third of the reported events were leakages that were immediately detected and corrected.

In addition, this study noted that local leak rate tests can detect "essentially all potential degradations" of the containment isolation system.

NUREG/CR-4330 [11]

NUREG/CR-4330 is a study that examined the risk impacts associated with increasing the allowable containment leakage rates.

The details of this report have no direct impact on the modeling approach of the ILRT test interval extension, as NUREG/CR-4330 focuses on leakage rate and the ILRT test interval extension study focuses on the frequency of testing intervals. However, the general conclusions of NUREG/CR-4330 are consistent with NUREG/CR-3539 and other similar containment leakage risk studies:

"... the effect of containment leakage on overall accident risk is small since risk is dominated by accident sequences that result in failure or bypass of containment."

EPRI TR-105189 [12]

The EPRI study TR-105189 is useful to the ILRT test interval extension risk assessment because it provides insight regarding the impact of containment testing on shutdown risk. This study contains a quantitative evaluation (using the EPRI ORAM software) for two reference plants (a BWR-4 and a PWR) of the impact of extending ILRT and LLRT

Serial No.17-359 Docket No. 50-336, Page 8 of 41 test intervals on shutdown risk.

The conclusion from the study is that a small but measurable safety benefit is realized from extending the test intervals.

NUREG-1493 [51 NUREG-1493 is the NRC's cost-benefit analysis for proposed alternatives to reduce containment leakage testing intervals and/or relax allowable leakage rates. The NRC conclusions are consistent with other similar containment leakage risk studies:

Reduction in ILRT frequency from 3 per 10 years to 1 per 20 years results in an "imperceptible" increase in risk.

Given the insensitivity of risk to the containment leak rate and the small fraction of leak paths detected solely by Type A testing, increasing the interval between integrated leak rate tests is possible with minimal impact on public risk.

EPRI TR-104285 [21 Extending the risk assessment impact beyond shutdown (the earlier EPRI TR-105189 study), the EPRI TR-104285 study is a quantitative evaluation of the impact of extending ILRT and LLRT test intervals on at-power public risk. This study combined IPE Level 2 models with NUREG-1150 Level 3 population dose models to perform the analysis. The study also used the approach of NUREG-1493 in calculating the increase in pre-existing leakage probability due to extending the ILRT and LLRT test intervals.

EPRI TR-104285 uses a simplified Containment Event Tree to subdivide representative core damage frequencies into eight classes of containment response to a core damage accident:

1. Containment intact and isolated

2. Containment isolation failures dependent upon the core damage accident

3. Type A (ILRT) related containment isolation failures

4. Type 8 (LLRT) related containment isolation failures

5. Type C (LLRT) related containment isolation failures

6. Other penetration related containment isolation failures

7. Containment failures due to core damage accident phenomena

8. Containment bypass Consistent with the other containment leakage risk assessment studies, this study concluded:

"... the proposed CLRT [containment leak rate tests] frequency changes would have a minimal safety impact. The change in risk determined by the analyses is small in both absolute and relative terms. For example, for the PWR analyzed, the change is about 0.04 person-rem per year... "

Serial No.17-359 Docket No. 50-336, Page 9 of 41 Release Category Definitions Table 4.1-1 defines the accident classes used in the ILRT extension evaluation, which is consistent with the EPRI methodology [18]. These containment failure classifications are used in this analysis to determine the risk impact of extending the Containment Type A test interval as described in Section 5 of this report.

Table 4.1-1 EPRl/NEI Containment Failure Classifications

} EPRL(:l~$~

I:: *.i<

+.** /. > :

.. ****EP!U.Cla!i!i b~scripti(:)tj >

/<.;

\\}ii:* *.***

Containment remains intact including accident sequences that do not lead to 1

containment failure in the long term. The release of fission products (and attendant consequences) is determined by the maximum allowable leakage rate values La, under Appendix J for that plant 2

Containment isolation failures (as reported in the IPEs) include those accidents in which there is a failure to isolate the containment.

Independent (or random) isolation failures include those accidents in which the pre-3 existing isolation failure to seal (i.e., provide a leak-tight containment) is not dependent on the sequence in progress.

Independent (or random) isolation failures include those accidents in which the pre-existing isolation failure to seal is not dependent on the sequence in progress. This class 4

is similar to Class 3 isolation failures, but is applicable to sequences involving Type B tests and their potential failures. These are the Type B-tested components that have isolated but exhibit excessive leakage.

Independent (or random) isolation failures include those accidents in which the pre-5 existing isolation failure to seal is not dependent on the sequence in progress. This class is similar to Class 4 isolation failures, but is applicable to sequences involving Type C tests and their potential failures.

Containment isolation failures include those leak paths covered in the plant test and 6

maintenance requirements or verified per in service inspection and testing (151/IST) program.

7 Accidents involving containment failure induced by severe accident phenomena.

Changes in Appendix J testing requirements do not impact these accidents.

Accidents in which the containment is bypassed (either as an initial condition or induced 8

by phenomena) are included in Class 8. Changes in Appendix J testing requirements do not impact these accidents.

Serial No.17-359 Docket No. 50-336, Page 1 O of 41 Calvert Cliffs Response to Request for Additional Information Concerning the License Amendment for a One-Time Integrated Leakage Rate Test Extension [4]

This submittal to the NRC describes a method for determining the change in likelihood, due to extending the ILRT, of detecting liner corrosion, and the corresponding change in risk. The methodology was developed for Calvert Cliffs in response to a request for additional information regarding how the potential leakage due to age-related degradation mechanisms was factored into the risk assessment for the ILRT one-time extension. The Calvert Cliffs analysis was performed for a concrete cylinder and dome and a concrete basemat, each with a steel liner.

MPS2 has a similar type of containment, and the same methodology will be used in this risk impact assessment.

EPRI Report No.

1009325. Revision 2-A. Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals [181 This report provides a risk impact assessment for the permanent extension of ILRT test intervals to fifteen years. This document provides guidance for performing plant-specific supplemental risk impact assessments and builds on the previous EPRI risk impact assessment methodology [2] and the NRC performance-based containment leakage test program [5], and considers approaches utilized in various submittals, including Indian Point 3 (and associated NRC SER) and Crystal River.

The approach included in this guidance document is used in the MPS2 risk impact assessment to determine the estimated increase in risk associated with the ILRT extension. This document includes the bases for the values assigned in determining the probability of leakage for the EPRI Class 3a and 3b scenarios in this analysis as described in Section 5.

4.2 Plant-Specific Inputs The plant-specific information used to perform the MPS2 ILRT Extension Risk Assessment includes the following:

Internal events PRA model results [19]

Source term category definitions and frequencies used in the Level 2 Model [19, 21]

Source term category population dose within a 50-mile radius [22]

External events PRA model results [25, 26]

MPS2 Internal Events PRA Model The Level 1 and Level 2 PRA model that is used for MPS2 is characteristic of the as-built plant. The current internal events model (MPS2-R05e) is a linked fault tree model.

Using the average maintenance model, the model was quantified with the total Core Damage Frequency (CDF) = 2.14E-05/yr and Large Early Release Frequency (LEAF) =

1.24E-06/yr [19].

MPS2 Source Term Category Frequencies Serial No.17-359 Docket No. 50-336, Page 11 of 41 The current Level 2 release category definitions were developed in notebook MPS2-LE.1 R5 [21]. The current source term category (STC) frequencies were developed from the plant damage state frequencies (PDS) calculated from the Level 1 and Level 2 PRA model [19] and the relative contributions to CDF for the analyzed containment failure modes documented in MPS2-LE.1 [21 ]. Each of the source term categories is associated with a corresponding EPRI class, and the EPRI class frequencies are calculated by summing the associated source term category frequencies.

MPS2 Source Term Category Population Dose A plant-specific population dose was developed using MACCS2 for twelve source term categories (STC) in calculation PRA02NQA-03107S2 [22] for the SAMA analysis. The STC diagram has been revised since the IPE. The latest STC Diagram is documented in MPS2-LE.1 [21], and the number of STCs is eleven.

The dose results from PRA02NQA-03107S2 were correlated to the current STCs by associating end states in the current STC diagram with the release categories from the dose calculations. Note that the plant damage states resulting in STC 5 (Melthru) were split into STC 5A (Melthru with Spray) and STC 58 (Melthru without Spray) due to the significant

,difference in dose results based on the availability of containment spray.

Release Category Definitions Table 4.2-1 below defines the MPS2 release categories and associates them with the EPRI accident classes used in the ILRT extension evaluation.

These containment failure classifications are used in this analysis to determine the risk impact of extending the Containment Type A test interval as described in Section 5 of this report.

MPS2 Release Category 1

2 3

4 SA SB 6

7 8

9 10 11 CDF LERF Table 4.2-1 Serial No.17-359 Docket No. 50-336, Page 12 of 41 MPS2 Release Category Definitions, Frequency, and Population Dose Frequency Person-Rem2 EPRI per year 1

(50 miles)

Class Description 1.14E-08 2.27E+01 1

No CF O.OOE+OO 9.34E+OO 7

Late CF, Cont Spray O.OOE+OO 7.62E+04 7

Late CF, Early Spray 8.S2E-06 7.62E+04 7

Late CF, No Spray 6.09E-06 1.S6E+01 7

Meltthru, Spray 4.47E-06 1.02E+06 7

Meltthru, No Spray 6.S3E-09 1.32E+OS 2

Large Cl Fail 2.89E-07 2.27E+01 1

No CF O.OOE+OO 1.32E+OS 2

Large Cl Fail 4.96E-08 3.90E+06 8

EventV 1.94E-06 1.06E+06 8

SGTR O.OOE+OO 1.06E+OS3 8

SGTR (non-LERF) 2.14E-OS 1.24E-06

1. STC frequencies were calculated using the MPS2 Level 1 and Level 2 PRA and the MPS2-LE.1 Revision 5 notebook.

2. The population dose for each STC is based on the correlation of the current STCs to the population dose results from calculation PRA02NQA-0310752 for the SAMA analysis.

3. The dose for STC 11 is assumed to be one-tenth of STC 10 since it is a non-LERF SGTR.

Using the data in Table 4.2-1, the frequency and dose for the EPRI accident classes as they apply to Millstone 2 can be calculated. The frequency of each EPRI class is the sum of the associated STC frequencies, and the doses for classes 2, 7, and 8 are frequency weighted.

Table 4.2-2 Summary of Release Frequency and Population Dose Organized by EPRI Release Category EPRI Class frequency (/yr)

Dose (person-rem) 1 3.00E-07 2.27E+01 2

6.S3E-09 1.32E+OS 7

1.91E-OS 2.73E+OS 8

1.99E-06 1.13E+06

Serial No.17-359 Docket No. 50-336, Page 13 of 41 4.3 Impact of Extension on Detection of Component Failures That Lead to Leakage The ILRT can detect a number of component failures such as liner breach, failure of certain bellows arrangements and failure of some sealing surfaces, which can lead to leakage.

The proposed ILRT test interval extension may influence the conditional probability of detecting these types of failures. To ensure that this effect is properly accounted for, the EPRI Class 3 containment failure classification, as defined in Table 4.1-1, is divided into two sub-classes, Class 3a and Class 3b, representing small and large leakage failures, respectively.

The probability of the EPRI Class 3a and 3b failures is determined consistent with the EPRI guidance [18]. For Class 3a, the probability is based on the maximum likelihood estimate of failure (arithmetic average) from the available data (i.e., 2 "small" failures in 217 tests leads to 2/217=0.0092).

For Class 3b, Jeffrey's non-informative prior distribution is assumed for no "large" failures in 217 tests (i.e., 0.5/(217+ 1) = 0.0023).

The EPRI methodology [18] contains information concerning the potential that the calculated delta LERF values for several plants may fall above the "very small change" guidelines of the NRC regulatory guide 1.174 [3]. This information includes a discussion of conservatisms in the quantitative guidance for delta LERF.

The EPRI report [18]

describes ways to demonstrate that, using plant-specific calculations, the delta LERF is smaller than that calculated by the simplified method.

The supplemental information states:

The methodology employed for determining LERF (Class 3b frequency) involves conservatively multiplying the GDF by the failure probability for this class (3b) of accident.

This was done for simplicity and to maintain conservatism.

However, some plant-specific accident classes leading to core damage are likely to include individual sequences that either may already (independently) cause a LERF or could never cause a LERF, and are thus not associated with a postulated large Type A containment leakage path (LERF).

These contributors can be removed from Class 3b in the evaluation of LERF by multiplying the Class 3b probability by only that portion of GDF that may be impacted by type A leakage.

The application of this additional guidance to the analysis for MPS2 would result in a reduction of the CDF applied to the Class 3a and Class 3b CDFs. However, the MPS2 risk assessment will conservatively forgo the application of this guidance and will apply the total CDF in the calculation of the Class 3a and 3b frequencies.

Consistent with the EPRI methodology [18], the change in the leak detection probability can be estimated by comparing the average time that a leak could exist without detection.

For example, the average time that a leak could go undetected with a three-year test

Serial No.17-359 Docket No. 50-336, Page 14 of 41 interval is 1.5 years (3 yr I 2), and the average time that a leak could exist without detection for a ten-year interval is 5 years (1 O yr I 2). This change would lead to a non"'

detection probability that is a factor of 3.33 (5.0/1.5) higher for the probability of a leak that is detectable only by ILRT testing. Correspondingly, an extension of the ILRT interval to fifteen years can be estimated to lead to about a factor of 5.0 (7.5/1.5) increase in the non-detection probability of a leak.

It should be noted that using the methodology discussed above is very conservative compared to previous submittals (e.g., the Indian Point Unit 3 request for a one-time ILRT extension that was approved by the NRC [7]) because it does not factor in the possibility that the failures could be detected by other tests (e.g., the Type B local leak rate tests that will still occur.) Eliminating this possibility conservatively over-estimates the (factor increases attributable to the ILRT extension.

4.4 Impact of Extension on Detection of Steel Liner Corrosion That Lead to Leakage An estimate of the likelihood and risk implications of corrosion-induced leakage of the steel liners occurring and going undetected during the extended test interval is evaluated using the methodology from the Calvert Cliffs liner corrosion analysis [4]. The Calvert Cliffs analysis was performed for a concrete cylinder and dome and a concrete basemat, each with a steel liner. MPS2 has a similar type of containment.

The following approach is used to determine the change in likelihood, due to extending the ILRT, of detecting corrosion of the containment steel liner. This likelihood is then used to determine the resulting change in risk. Consistent with the Calvert Cliffs analysis, the following issues are addressed:

Differences between the containment basemat, containment cylinder, and dome The historical steel liner flaw likelihood due to concealed corrosion The impact of aging The corrosion leakage dependency on containment pressure The likelihood that visual inspections will be effective at detecting a flaw Assumptions Consistent with the Calvert Cliffs analysis, a half failure is assumed for basemat concealed liner corrosion due to the lack of identified failures.

The two corrosion events used to estimate the liner flaw probability in the Calvert Cliffs analysis are assumed to be applicable to the MPS2 containment analysis.

These events, one at North Anna Unit 2 and one at Brunswick Unit 2, were initiated from the non-visible (backside) portion of the containment liner. It is noted that four additional events have occurred in recent years (based on a data search covering approximately 9 years documented in Reference [28] and covering approximately

Serial No.17-359 Docket No. 50-336, Page 15 of 41 5 years in Reference [30]). In November 2006, the Turkey Point 4 containment building liner developed a hole when a sump pump support plate was moved. In May 2009, a hole approximately 3/8" by 1" in size was identified in the Beaver Valley 1 containment liner. In October 2010, an area 4" by 32" was found to be significantly degraded, including through-wall damage, in the Turkey Point 3 containment liner.

In October 2013, a 0.40" by 0.28" through-wall hole was identified in the Beaver Valley 1 containment liner. For risk evaluation purposes, these four more recent events occurring over a 14-year period are judged tb be adequately represented by the two events in the 5.5-year period of the Calvert Cliffs analysis incorporated in the EPRI guidance. (See Table 4.4-1, Step 1.)

Consistent with the Calvert Cliffs analysis, the estimated historical flaw probability is also limited to 70 steel-lined containments and 5.5 years to reflect the years since September 1996 when 10 CFR 50.55a started requiring visual inspection to the time the Calvert Cliffs liner corrosion analysis was performed.

Additional success data was not used to limit the aging impact of this corrosion issue, even though inspections were being performed prior to this date (and have been performed since the time frame of the Calvert Cliffs analysis), and there is no evidence that additional corrosion issues were identified.(See Table 4.4-1, Step 1.)

Consistent with the Calvert Cliffs analysis, the steel liner flaw likelihood is assumed to double every five years. This is based solely on judgment and is included in this analysis to address the increased likelihood of corrosion as the steel liner ages.

(See Table 4.4-1, Steps 2 and 3.) Sensitivity studies are included that address doubling this rate every ten years and every two years.

In the Calvert Cliffs analysis, the likelihood of the containment atmosphere reaching the outside atmosphere given that a liner flaw exists was estimated as 1.1 % for the cylinder and dome and 0.11 % (10% of the cylinder failure probability) for the basemat.

These values were determined from an assessment of the probability versus containment pressure, and the selected values are consistent with a pressure that corresponds to the ILRT target pressure of 37 psig.

For MPS2, the containment failure probabilities are less than these values at 54 psig

[29]. Conservative probabilities of 1 % for the cylinder and dome and 0.1 % for the basemat are used in this analysis, and sensitivity studies are included that increase and decrease the probabilities by an order of magnitude. (See Table 4.4-1, Step 4.)

Consistent with the Calvert Cliffs analysis, the likelihood of leakage escape (due to crack formation) in the basemat region is considered to be less likely than the containment cylinder and dome region. (See Table 4.4-1, Step 4.)

Consistent with the Calvert Cliffs analysis, a 5% visual inspection detection failure likelihood given the flaw is visible and a total detection failure likelihood of 10% is used.

To date, all liner corrosion events have been detected through visual

Serial No.17-359 Docket No. 50-336, Page 16 of 41 inspection.

(See Table 4.4-1, Step 5.) Sensitivity studies are included that evaluate total detection failure likelihood of 5% and 15%, respectively.

Consistent with the Calvert Cliffs analysis, all non-detectable containment failures are assumed to result in early releases. This approach avoids a detailed analysis of containment failure timing and operator recovery actions.

1 Historical Steel Liner Flaw Likelihood 2

Age-Adjusted Steel Liner Flaw Likelihood 3

Flaw Likelihood at 3, 10, and 15 years 4

Likelihood of Breach in Containment Given Steel Liner Flaw 5

6 Visual Inspection Detection Failure Likelihood Likelihood of Non-Detected Containment Leakage Table 4.4-1 Steel Liner Corrosion Base Case Events: 2 2/(70

• 5.5) = 5.2E-3 Year Failure Rate 1

2.05E-03 2

2.36E-03 3

2.71E-03 4

3.llE-03 5

3.57E-03 6

4.lOE-03 7

4.71E-03 8

5.41E-03 9

6.22E-03 10 7.14E-03 11 8.21E-03 12 9.43E-03 13 1.08E-02 14 1.24E-02 15 1.43E-02 1to3 years 0.71%

1to10 years 4.14%

1to15 years 9.66%

Pressure (psia)

Likelihood 2.00E+Ol 0.1%

6.47E+01 1.1%

1.00E+02 7.0%

1.20E+02 20.3%

1.50E+02 100.0%

10%

3 years 0.00077%

0.71%

• 1.1%

• 10%

10 years 0.00445%

4.14%

• 1.1%

• 10%

15 years 0.01039%

9.66%

• 1.1%

• 10%

Events: 0 (assume 0.5 failures) 0.5/(70

• 5.5) = 1.3E-3 Year Failure Rate 1

5.13E-04 2

5.89E-04 3

6.77E-04 4

7.77E-04 5

8.93E-04 6

1.03E-03 7

1.18E-03 8

1.35E-03 9

1.55E-03 10 1.79E-03 11 2.05E-03 12 2.36E-03 13 2.71E-03 14 3.llE-03 15 3.57E-03 1to3 years 0.18%

1to10 years 1.03%

1to15 years 2.41%

Pressure (psia)

Likelihood 2.00E+Ol 0.01%

6.47E+01 0.11%

1.00E+02 0.70%

1.20E+02 2.03%

1.50E+02 10.00%

100%

3 years 0.00019%

0.18%

• 0.11%

• 100%

10 years 0.00111%

1.03%

• 0.11%

• 100%

15 years 0.00260%

2.41%

• 0.11%

• 100%

Serial No.17-359 Docket No. 50-336, Page 17 of 41 The total likelihood of the corrosion-induced, non-detected containment leakage is the sum of Step 6 for the containment cylinder and dome and the containment basemat as summarized below for MPS2.

Total Likelihood of Non-Detected Containment Leakage Due To Corrosion for MPS2:

At 3 years

0.00077% + 0.00019% = 0.00096%

At 1 O years : 0.00445% + 0.00111 % = 0.00556%

At 15 years : 0.01039% + 0.00260% = 0.01298%

The above factors are applied to the non-LERF containment overpressure GDF scenarios, and the result is added to the Class 3b frequency in the corrosion sensitivity studies.

The non-LERF containment overpressure CDF is calculated by subtracting the Class 3b and Class 8 CDFs from the total GDF so that only Classes 1, 2, 3a, and 7 are included in the GDF calculation.

5.0 RESULTS The application of the approach based on the EPRI guidance [18] has led to the following results. The results are displayed according to the eight accident classes defined in the EPRI report. Table 5.0-1 lists these accident classes.

The analysis performed examined MPS2-specific accident sequences in which the containment remains intact or the containment is impaired.

Specifically, the categorization of the severe accidents contributing to risk was considered in the following manner:

Core damage sequences in which the containment remains intact initially and in the long term (EPRI TR-104285 Class 1 sequences).

Core damage sequences in which containment integrity is impaired due to random isolation failures of plant components other than those associated with Type B or Type C test components. For example, liner breach or bellows leakage. (EPRI Class 3 sequences).

Core damage sequences in which containment integrity is impaired due to containment isolation failures of pathways left "opened" following a plant post-maintenance test (e.g., a valve failing to close following a valve stroke test). (EPRI Class 6 sequences).

Consistent with the EPRI guidance, this class is not specifically examined since it will not significantly influence the results of this analysis.

Accident sequences involving containment bypassed (EPRI Class 8 sequences),

large containment isolation failures (EPRI Class 2 sequences), and small containment isolation "failure-to-seal" events (EPRI Class 4 and 5 sequences) are

Serial No.17-359 Docket No. 50-336, Page 18 of 41 accounted for in this evaluation as part of the baseline risk profile. However, they are not affected by the ILRT frequency change.

Class 4 and 5 sequences are impacted by changes in Type B and C test intervals; therefore, changes in the Type A test interval do not impact these sequences.

EPRI A(Cittent

T i,CI~~~

1 2

3a 3b 4

5 6

7 8

CDF Table 5.0-1 EPRI Accident Classes No Containment Failure Large Isolation Failures (Failure to Close)

Small Isolation Failures (liner breach)

Large Isolation Failures (liner breach)

Small Isolation Failures (Failure to seal-Type B)

Small Isolation Failures (Failure to seal-Type C)

Other Isolation Failures (e.g., dependent failures)

Failures Induced by Phenomena (Early and Late)

Bypass (Interfacing System LOCA and Steam Generator Tube Rupture)

Sum of all accident class frequencies (including very low and no release)

The steps taken to perform this risk assessment evaluation are as follows:

Step 1 Quantify the base-line risk in terms of frequency per reactor year for each of the eight accident classes presented in Table 5.0-1.

Step 2 Develop plant-specific person-rem dose (population dose) per reactor year for each of the eight accident classes.

Step 3 Evaluate the risk impact of extending Type A test interval from three to fifteen and ten to fifteen years.

Step 4 Determine the change in risk in terms of Large Early Release Frequency (LERF) in accordance with RG 1.174.

Step 5 Determine the impact on the Conditional Containment Failure Probability (CCFP).

Serial No.17-359 Docket No. 50-336, Page 19 of 41 5.1 Step 1 - Quantify the Base-Line Risk in Terms of Frequency Per Reactor Vear As previously described, the extension of the Type A interval does not influence those accident progressions that involve large containment isolation failures, Type B or Type C testing, or containment failure induced by severe accident phenomena.

For the assessment of ILRT impacts on the risk profile, the potential for pre-existing leaks is included in the model. These events are represented by the Class 3 sequences in EPRI TR-104285. Two failure modes were considered for the Class 3 sequences.

These are Class 3a (small breach) and Class 3b (large breach).

The frequencies for the severe accident classes defined in Table 5.0-1 were developed for MPS2 by first determining the frequencies for Classes 1, 2, 7 and 8 using the categorized sequences and the identified correlations shown in Table 4.2-2, determining the frequencies for Classes 3a and 3b, and then determining the remaining frequency for Class 1.

Furthermore, adjustments were made to the Class 3b and hence Class 1 frequencies to account for the impact of undetected corrosion of the steel liner per the methodology described in Section 4.4.

Class 1 Sequences This group consists of all core damage accident progression bins for which the containment remains intact (modeled as Technical Specification Leakage).

The frequency per year is initially determined from the Level 2 Release Categories 1 and 7 listed in Table 4.2-1, which was 3.00E-07/yr. With the inclusion of the EPRI 3a and 3b classes, the EPRI Class 1 frequency will be reduced by the EPRI Class 3a and 3b frequencies.

Class 2 Sequences This group consists of all core damage accident progression bins for which a failure to isolate the containment occurs. The frequency per year for these sequences is obtained from the Release Categories 6 and 8 listed in Table 4.2-1, which was 6.53E-09/yr.

Class 3 Sequences This group consists of all core damage accident progression bins for which a pre-existing leakage in the containment structure (e.g., containment liner) exists. The containment leakage for these sequences can be either small (in excess of design allowable but

<1 Ola) or large (> 1 OOLa).

The respective frequencies per year are determined as follows:

PROBc1ass_sa = probability of small pre-existing containment liner leakage

= 0.0092 [see Section 4.3]

PROBc1ass_sb = probability of large pre-existing containment liner leakage

= 0.0023 [see Section 4.3]

Serial No.17-359 Docket No. 50-336, Page 20 of 41 As described in Section 4.3, the total GDF will be conservatively applied to these failure probabilities in the calculation of the Class 3 frequencies.

Class 3a Class 3b

= 0.0092

• GDF

= 0.0092

• 2.14E-05/yr

= 1.97E-07/yr

= 0.0023

• GDF

= 0.0023

• 2.14E-05/yr

= 4.90E-08/yr For this analysis, the associated containment leakage for Class 3A is 1 Ola and for Class 3B is 1 OOLa. These assignments are consistent with the guidance provided in EPRI TR-1018243.

Class 4 Sequences This group consists of all core damage accident progression bins for which containment isolation failure-to-seal of Type B test components occurs. Because these failures are detected by Type B tests which are unaffected by the Type A ILRT, this group is not evaluated any further in the analysis.

Class 5 Sequences This group consists of all core damage accident progression bins for which a containment isolation failure-to-seal of Type C test components. Because the failures are detected by Type C tests which are unaffected by the Type A ILRT, this group is not evaluated any further in this analysis.

Class 6 Sequences This group is similar to Class 2. These are sequences that involve core damage accident progression bins for which a failure-to-seal containment leakage due to failure to isolate the containment occurs.

These sequences are dominated by misalignment of containment isolation valves following a test/maintenance evolution.

Consistent with guidance provided in EPRI TR-1018243, this accident class is not explicitly considered since it has a negligible impact on the results.

Class 7 Sequences This group consists of all core damage accident progression bins in which containment failure induced by severe accident phenomena occurs (e.g., overpressure).

For this analysis, the frequency is determined from Release Categories 2 through 5 from the MPS2 Level 2 results in Table 4.2-1, and the result is 1.91 E-05/yr.

Class 8 Sequences This group consists of all core damage accident progression bins in which containment bypass occurs. For this analysis, the frequency is determined from Release Categories 9 through 11 from the MPS2 Level 2 results in Table 4.2-1, and the result is 1.99E-06/yr.

Serial No.17-359 Docket No. 50-336, Page 21 of 41 Summary of Accident Class Frequencies In summary, the accident sequence frequencies that can lead to radionuclide release to the public have been derived consistent with the definitions of accident classes defined in EPRI TR-1018243.

Table 5.1-1 summarizes these accident frequencies by accident class for MPS2.

1 2

3a 3b 4

5 6

7 8

CDF Table 5.1-1 Accident Class Frequencies No Containment Failure Large Containment Isolation Failures (Failure to close)

Small Isolation Failures (Type A test)

Large Isolation Failures (Type A test)

Small Isolation Failure (Type B test)

Small Isolation Failure (Type C test)

Containment Isolation Failures (personnel errors)

Severe Accident Phenomena Induced Failure Containment Bypassed All CET End States (including intact case) 5.40E-08 6.53E-09 1.97E-07 4.90E-08 N/A N/A N/A 1.91E-05 1.99E-06 2.14E-05 5.2 Step 2 - Develop Plant-Specific Person-Rem Dose (Population Dose) Per Reactor Vear Plant-specific release analyses were performed to estimate the person-rem doses to the population within a 50-mile radius from the plant. The releases are based on information contained in calculation PRA02NQA-03107S2 [22] for the MPS2 SAMA analysis, the MPS2-LE.1 RS notebook [21 ], and the MPS2 one-time ILRT extension [23]. Calculation PRA02NQA-03107S2 contains the dose results in Sieverts for the release categories that were evaluated in the SAMA analysis. The LE.1 notebook [21] is used to associate the STCs from the current STC diagram with the release categories used during the SAMA analysis.

The results of applying these releases to the EPRI containment failure classification are as follows:

Class 1 Class 2 Class 3a Class 3b Class 4 Class 5 Class 6 Class 7

= 2.27E+01 person-rem (at 1.0la) (1)

= 1.32E+05 person-rem (2)

= 2.27E+01 person-rem x 1 Ola = 2.27E+02 person-rem (3)

= 2.27E+01 person-rem x 1 OOLa = 2.27E+03 person-rem (3)

= Not analyzed

= Not analyzed

= Not analyzed

= 2.73E+05 person-rem (4)

Class 8

= 1.13E+06 person-rem (5)

Serial No.17-359 Docket No. 50-336, Page 22 of 41 (1) The Class 1 dose is assigned from the frequency weighted dose for release categories resulting in no containment failure.

(2) The Class 2 dose is assigned from the frequency weighted dose for release categories resulting in containment isolation failure.

(3) The Class 3a and 3b dose are related to the leakage rate as shown.

This is consistent with the guidance provided in EPRI TR-1018243.

(4) The Class 7 dose is assigned from frequency weighted dose for release categories resulting in containment failure.

(5) Class 8 sequences involve containment bypass failures; as a result, the person-rem dose is not based on normal containment leakage.

The dose for this class is assigned from the frequency weighted dose for release categories resulting in containment bypass.

In summary, the population dose estimates derived for use in the risk evaluation per the EPRI methodology [18] containment failure classifications are provided in Table 5.2-1.

Table 5.2-1 Accident Class Population Dose I ? Acci~ent~las~i

• • • .****.*******,:e:* **.**************** >** *******************************.*.**.* ************ O~strip~i~ri*************** *********

• • • • • • • • • • • /**FF >******!h:x*** :..*.*.** )...

.... (

.:.r1>~~~ijri:Rem.. *:**** y*

1 No Containment Failure 2.27E+01 2

Large Containment Isolation Failures (Failure to close) 1.32E+OS 3a Small Isolation Failures (Type A test) 2.27E+02 3b Large Isolation Failures (Type A test) 2.27E+03 4

Small Isolation Failure (Type B test)

N/A 5

Small Isolation Failure (Type C test)

N/A 6

Containment Isolation Failures (personnel errors)

N/A 7

Severe Accident Phenomena Induced Failure 2.73E+OS 8

Containment Bypassed 1.13E+06 The above dose estimates, when combined with the results presented in Table 5.1-1, yield the MPS2 baseline mean consequence measures for each accident class. These results are presented in Table 5.2-2.

1 2

3a 3b 4

5 6

7 8

Total Table 5.2-2 Serial No.17-359 Docket No. 50-336, Page 23 of 41 Accident Class Frequency and Dose Risk for 3-per-10 Year ILRT Frequency No Containment Failure 2.27E+01 5.40E-08 1.23E-06 5.38E-08 1.22E-06

-4.20E-09 Large Isolation Failures (Failure 1.32E+05 6.53E-09 8.62E-04 6.53E-09 8.62E-04 O.OOE+OO to Close)

Small Isolation Failures (liner 2.27E+02 1.97E-07 4.47E-05 1.97E-07 4.47E-05 O.OOE+OO breach)

Large Isolation Failures (liner 2.27E+03 4.90E-08 1.11E-04 4.92E-08 1.12E-04 4.20E-07 breach)

Small Isolation Failures (Failure N/A N/A N/A N/A N/A to seal -Type B)

Small Isolation Failures (Failure N/A N/A N/A N/A N/A to seal-Type C)

Other Isolation Failures (e.g.,

N/A N/A N/A N/A N/A dependent failures)

Failures Induced by Phenomena 2.73E+05 1.91E-05 5.21E+OO 1.91E-05 5.21E+OO O.OOE+OO (Early and Late)

Containment 1.13E+06 1.99E-06 2.25E+OO 1.99E-06 2.25E+OO O.OOE+OO Bypass Sum of All 7.459063 7.459063 Accident Class 2.14E-05 2.14E-05 4.16E-07 Results E+OO E+OO

Serial No.17-359 Docket No. 50-336

. Attachment 3, Page 24 of 41 Table 5.2-3 shows how the new Class 3b frequency was calculated to account for a corrosion-induced containment leak for the 3 per 10 years ILRT frequency.

Table 5.2-3 Corrosion Impact on Class 3b Frequency for 3-per-10 year ILRT Frequency ILRT Frequency 3 per 10 Years Likelihood of Corrosion-Induced Leak (Section 4.4) 0.00096%

Non-LERF Containment Overpressure CDF (Classes 2, 3a, and 7) 1.93E-05/yr Increase in LERF (0.00096%

• 1.93E-05/yr) 1.SSE-10/yr Class 3B Frequency (Without Corrosion) 4.90E-08/yr Class 3B Frequency (With Corrosion) (4.90E-08/yr + 1.SSE-10/yr) 4.92E-08/yr 5.3 Step 3 - Evaluate Risk Impact of Extending Type A Test Interval From 10 to 15 Years The next step is to evaluate the risk impact of extending the test interval from its current ten-year value to fifteen years. To do this, an evaluation must first be made of the risk associated with the ten-year interval since the base case applies to a three-year interval (i.e., a simplified representation of a three-per-ten interval).

Risk Impact Due to 10-year Test Interval As previously stated, Type A tests impact only Class 3 sequences.

For Class 3 sequences, the release magnitude is not impacted by the change in test interval (a small or large breach remains the same, even though the probability of not detecting the breach increases). Thus, only the frequency of Class 3a and 3b sequences is impacted. The risk contribution is changed based on the NEI guidance as described in Section 4.3 by a factor of 3.33 compared to the base case values. The results of the calculation for a 10-year interval are presented in Table 5.3-1.

Serial No.17-359 Docket No. 50-336, Page 25 of 41 Table 5.3-1 Accident Class Frequency and Dose Risk for 1-per-10 Year ILRT Frequency io;x~.ar1iltei'Va1* <illerltfyea~~>

/ **

Without Corrosion Class Reill No Containment 1

Failure 2.27E+Ol 0.00E+00 1

O.OOE+OO 0.00E+001 0.00E+OO O.OOE+OO Large Isolation 2

Failures (Failure to l.32E+OS 6.53E-09 8.62E-04 6.53E-09 8.62E-04 O.OOE+OO Close)

Small Isolation 3a Failures (liner breach) 2.27E+02 6.56E-07 l.49E-04 6.56E-07 l.49E-04 O.OOE+OO 3b Large Isolation Failures (liner breach) 2.27E+03 l.63E-07 3.71E-04 l.64E-07 3.73E-04 2.49E-06 Small Isolation 4

Failures (Failure to N/A N/A N/A N/A N/A seal -Type B)

Small Isolation 5

Failures (Failure to N/A N/A N/A N/A N/A seal-Type C)

Other Isolation 6

Failures (e.g.,

N/A N/A N/A N/A N/A dependent failures)

Failures Induced by 7

Phenomena (Early and 2.73E+OS l.91E-05 5.21E+OO l.91E-05 5.21E+OO O.OOE+OO Late) 8 Containment Bypass l.13E+06 l.99E-06 2.25E+OO 1.99E-06 2.25E+OO O.OOE+OO Sum of All Accident 2.19E-052 7.459425 2.19E-052 7.459427 Total Class Results 2.49E-06 E+OO E+OO

1. The EPRI TR-1018243 [18] guidance conservatively subtracts the Class 3a and Class 3b frequencies from the Class 1 frequency to balance the CDF. However, the sum of the Class 3a and Class3b frequencies for this interval exceed the original Class 1 frequency from Table 4.2-2. Allowing the Class 1 frequency to become negative would result in subtraction of dose rate from the total. The Class 1 frequency has been limited to 0, which is conservative since the total dose for this internal now reflects an artificial increase in CDF.

2. The CDF calculated for this interval is artificially higher than the base CDF as a result of limiting the Class 1 frequency to 0 and not subtracting the Class 3a and Class 3b frequencies from any other EPRI Classes. This treatment is conservative, and the actual CDF remains 2.14E-05/yr.

Serial No.17-359 Docket No. 50-336, Page 26 of 41 Table 5.3-2 shows how the new Class 3b frequency was calculated to account for a corrosion-induced containment leak for the one-per-ten years ILRT frequency.

Table 5.3-2 Corrosion Impact on Class 3b Frequency for 1-per-10 year ILRT Frequency ILRT Frequency 1 per 10 Years Likelihood of Corrosion-Induced Leak (Section 4.4) 0.00556%

Non-LERF Containment Overpressure CDF (Classes 2, 3a, and 7) l.97E-05/yr Increase in LERF (0.00556%

• l.97E-05/yr) l.lOE-09/yr Class 3B Frequency (Without Corrosion) l.63E-07 /yr Class 3B Frequency (With Corrosion) (1.63E-07 /yr+ l.lOE-09/yr) l.64E-07 /yr Risk Impact Due to 15-Year Test Interval The risk contribution for a 15-year interval is calculated in a manner similar to the 10-year interval. The difference is in the increase in probability of leakage in Classes 3a and 3b.

For this case, the value used in the analysis is a factor of 5.0 compared to the 3-year interval value, as described in Section 4.3. The results for this calculation are presented in Table 5.3-3.

Table 5.3-3 Serial No.17-359 Docket No. 50-336, Page 27 of 41 Accident Class Frequency and Dose Risk for 1-per-15 Year ILRT Frequency 1 +

• .*.**I

. t:..

..... *... ( *****.. *.**c

~s~ Year.tntenlai (f per.*1s*yeaf~1*** ******************i*******.*.x >.*.i },!i : <.******************

.. *** r*<**********.**.*., ******..

.:._*::.:X::.. :::*:***.

Without Corrosion With Corrosion EPRI Person-Change in Description Frequency Person-Frequency Person-Class Rem Person-(1/YR)

Rem/YR (1/YR)

Rem/YR Rem/YR No Containment O.OOE+001 1

2.27E+01 Failure O.OOE+OO O.OOE+001 O.OOE+OO O.OOE+OO Large Isolation 2

Failures (Failure to 1.32E+05 6.53E-09 8.62E-04 6.53E-09 8.62E-04 O.OOE+OO Close}

Small Isolation 3a Failures (liner 2.27E+02 9.85E-07 2.24E-04 9.85E-07 2.24E-04 0.00E+OO breach}

Large Isolation 3b Failures (liner 2.27E+03 2.45E-07 5.56E-04 2.48E-07 5.62E-04 5.91E-06 breach}

Small Isolation 4

Failures (Failure to N/A N/A N/A N/A N/A seal -Type B}

Small Isolation 5

Failures (Failure to N/A N/A N/A N/A N/A seal-Type C}

Other Isolation 6

Failures (e.g.,

N/A N/A N/A N/A N/A dependent failures)

Failures Induced by 7

Phenomena (Early 2.73E+OS 1.91E-05 5.21E+OO 1.91E-05 5.21E+OO 0.00E+OO and Late) 8 Containment Bypass 1.13E+06 1.99E-06 2.25E+OO 1.99E-06 2.25E+OO 0.00E+OO Sum of All Accident 2.23E-052 7.459686 2.23E-052 7.459691 Total 5.91E-06 Class Results E+OO E+OO

1. The EPRI TR-1018243 (18] guidance conservatively subtracts the Class 3a and Class 3b frequencies from the Class 1 frequency to balance the CDF. However, the sum of the Class 3a and Class3b frequencies for this interval exceed the original Class 1 frequency from Table 4.2-2. Allowing the Class 1 frequency to become negative would result in subtraction of dose rate from the total. The Class 1 frequency has been limited to 0, which is conservative since the total dose for this internal now reflects an artificial increase in CDF.

2. The CDF calculated for this interval is artificially higher than the base CDF as a result of limiting the Class 1 frequency to 0 and not subtracting the Class 3a and Class 3b frequencies from any other EPRI Classes. This treatment is conservative, and the actual CDF remains 2.14E-05/yr.

Serial No.17-359 Docket No. 50-336, Page 28 of 41 Table 5.3-4 shows how the new Class 3b frequency was calculated to account for a corrosion-induced containment leak for the 1-per-15 years ILRT frequency.

Table 5.3-4 Corrosion Impact on Class 3b Frequency for 1-per-15 year ILRT Frequency ILRT Frequency 1 per 15 Years Likelihood of Corrosion-Induced Leak (Section 4.4) 0.01298%

Non-LERF Containment Overpressure CDF (Classes 2, 3a, and 7) 2.0lE-05/yr Increase in LERF (0.01298%* 2.0lE-05/yr) 2.61E-09/yr Class 3B Frequency (Without Corrosion) 2.45E-07 /yr Class 3B Frequency (With Corrosion) (2.45E-07/yr + 2.61E-09/yr) 2.48E-07 /yr 5.4 Step 4 - Determine the Change in Risk in Terms of Large Early Release Frequency (LERF)

The risk increase associated with extending the ILRT interval involves the potential that a core damage event that normally would result in only a small radioactive release from an intact containment could in fact result in a larger release due to the increase in probability of failure to detect a pre-existing leak. With strict adherence to the EPRI guidance, 100%

of the Class 3b contribution would be considered LERF.

Regulatory Guide 1.174 provides guidance for determining the risk impact of plant-specific changes to the licensing basis. RG 1.174 defines very small changes in risk as resulting in increases of core damage frequency (CDF) below 1.OE-06/yr and increases in LERF below 1.0E-07/yr, and small changes in LERF as below 1.0E-06/yr. Because the ILRT does not impact CDF, the relevant metric is LERF.

For MPS2, 100% of the frequency of Class 3b sequences can be used as a very conservative first-order estimate to approximate the potential increase in LERF from the ILRT interval extension (consistent with the EPRI guidance methodology). Based on the original three-per-ten year test interval from Table 5.2-2, the Class 3b frequency is 4.90E-08/yr. Based on a ten-year test interval from Table 5.3-1, the Class 3b frequency is 1.63E-07/yr, and based on a fifteen-year test interval from Table 5.3-3, it is 2.45E-07/yr.

Thus, the increase in the overall probability of* LERF due to Class 3b sequences that is due to increasing the ILRT test interval from three to fifteen years is 1.96E-07/yr.

Similarly, the increase due to increasing the interval from ten to fifteen years is 8.19E-08/yr. As can be seen, even with the conservatisms included in the evaluation (per the EPRI methodology), the estimated change in LERF is below the threshold criteria for a very small change when comparing the fifteen-year results to the current ten-year

Serial No.17-359 Docket No. 50-336, Page 29 of 41 requirement and a small change when comparing the fifteen-year results to the original three-year requirement.

If the effects due to liner corrosion are included in the fifteen-year interval results, the Class 3b frequency becomes 2.48E-07/yr as shown in Table 5.3-3.

Conservatively neglecting the impact of steel liner corrosion on the Class 3b frequency for the three-year and ten-year intervals, the change in LERF associated with the fifteen-year interval including the effects of steel liner corrosion is 1.99E-07/yr compared to the three-year interval and 8.45E-08/yr compared to the ten-year interval. This is an increase in LERF of 2.61 E-09/yr from the fifteen-year interval results without corrosion. These results indicate that the impact due to steel liner corrosion is very small, and the estimated change in LERF is below the threshold criteria for a very small change when comparing the fifteen-year results to the current ten-year requirement and a small change when comparing the fifteen-year results to the original three-year requirement.

5.5 Step 5 -

Determine the Impact on the Conditional Containment Failure Probability (CCFP)

Another parameter that the NRC guidance in RG 1.174 states can provide input into the decision-making process is the change in the conditional containment failure probability (CCFP). The change in CCFP is indicative of the effect of the ILRT on all radionuclide releases, not just LERF. The CCFP can be calculated from the results of this analysis.

One of the difficult aspects of this calculation is providing a definition of the "failed containment." In this assessment, the CCFP is defined such that containment failure includes all radionuclide release end states other than the intact state. The conditional part of the definition is conditional given a severe accident (i.e., core damage).

The change in CCFP can be calculated by using the method specified in the EPRI TR-1018243. The NRC has previously accepted similar calculations [7] as the basis for showing that the proposed change is consistent with the defense-in-depth philosophy.

CCFP = [1 - (Class 1 frequency + Class 3a frequency) I CDF]

• 100%

The results in Table 5.2-2, Table 5.3-1, and Table 5.3-3 provide the Class 1 and Class 3a frequencies for each interval.

However, direct application of the EPRI TR-1018243 guidance results in a reduction in CCFP since the Class 1 frequency was limited to 0 and the Class 3a frequency for the 1-per-10 and 1-per-15 year intervals exceeds the original Class 1 frequency from Table 4.2-2.

In order to avoid calculating a negative CCFP, EPRI Class 1 and Class 3a can be updated to more accurately reflect the intact containment fraction of their frequencies for each test interval. Based on the EPRI TR-1018243 guidance, the Class 3a and Class 3b probabilities are multiplied by the entire CDF to determine their respective frequencies (as discussed in Section 5.1 ). However, only the contribution to the Class 3a and Class 3b frequencies from Class 1 actually result in an increase in CCFP.

The remaining

Serial No.17-359 Docket No. 50-336, Page 30 of 41 contribution to the Class 3a and Class 3b frequencies from Classes 2, 7, and 8 does not impact the CCFP since these classes already result in containment failure.

Table 5.5-1 is used to calculate the contribution to the Class 3a and Class 3b frequencies from the Class 1 frequency for the 3-per-10 year ILRT interval. The Class 1 frequency from Table 4.2-2, which is 3.0E-07/yr, is multiplied by the Class 3a probability, 0.0092, and the Class 3b probability, 0.0023, to calculate the Class 1 contribution to the Class 3 frequencies. The Class 3a and Class 3b frequencies are calculated for the 1-per-10 year ILRT interval and 1-per-15 year ILRT interval by increasing them by a factor 3.33 and 5, respectively, as discussed in Section 5.3. The Class 1 frequency can then be adjusted for each interval by subtracting the Class 3a and Class 3b frequencies from the original Class 1 frequency. The calculation of CCFP from EPRI TR-1018243 can then be applied based on the updated frequencies.

CCFP = {1 - [(Class-1 frequency)Adjusted + (Class 3a frequency)c1ass 1 contribution] I CDF}

• 100%

In order to evaluate the impact of the steel liner corrosion analysis on the CCFP, the Class 3b frequency for each interval is also increased in Table 5.5-1by the "Increase in LERF" value for the respective interval from Table 5.2-3, Table 5.3-2, and Table 5.3-4.

Table 5.5-1 Calculation of Increase in Conditional Containment Failure Probability 1 (Nominal from Table 4.2-2) (1/yr) 3a (Class 1 Contribution) (1/yr) 2.76E-09 9.21E-09 l.38E-08 3b (Class 1 Contribution) (1/yr) 6.88E-10 2.29E-09 3.44E-09 1 (Adjusted) 2.97E-07 2.88E-07 2.83E-07 CCFP 98.600%

98.607%

98.613%

Delta CCFP 0.008%

0.013%

3b (Class 1 Contribution+ Corrosion) (1/yr) 8.73E-10 3.39E-09 6.0SE-09 1 (Adjusted with Class 3b Corrosion) (1/yr) 2.96E-07 2.87E-07 2.80E-07 CCFP 98.601%

98.612%

98.625%

Delta CCFP 0.013%

0.025%

The change in CCFP can be calculated by using the method specified in the EPRI TR-1018243 and the adjusted frequencies from Table 5.5-1.

CCFP3 = 98.600%

CCFP10 = 98.607%

CCFP1s = 98.613%

~CCFP3-To-1s = CCFP15 - CCFP3 = 0.013%

Serial No.17-359 Docket No. 50-336, Page 31 of 41

~CCFP10-To-1s = CCFP1s - CCFP10 = 0.005%

The CCFP is also calculated for the fifteen-year interval to evaluate the impact of the steel liner corrosion impact on the ILRT extension. The steel liner corrosion effects will be conservatively neglected for the three-year and ten-year intervals, which will result in a greater change in CCFP.

CCFP15+Corrosion = 98.625%

~CCFPs-To-15+Corrosion = CCFP1s+Corrosion - CCFPs = 0.025%

8CCFP10-To-1s+corrosion = CCFP1s+corrosion - CCFP10 = 0.018%

The change in CCFP of approximately 0.025% by extending the test interval to fifteen years from the original three-per-ten year requirement is judged to be insignificant.

5.6 Summary of Results The results from this ILRT extension risk assessment for MPS2 are summarized in Table 5.6-1.

7 8

Total Delta Dose 1

CCFP Delta CCFP 2

Class 3b LERF 3

Table 5.6-1 Summary of Results for ILRT Frequency Extensions 1.97E-07 4.47E-05 1.97E-07 4.47E-05 4.90E-08 1.llE-04 4.92E-08 1.12E-04 1.91E-05 5.21E+OO 1.91E-05 5.21E+OO 0.00E+OO 1.99E-06 2.25E+OO 1.99E-06 2.25E+OO O.OOE+OO 2.14E-05 7.459063 2.14E-05 7.459063 4.16E-07 N/A N/A 98.600%

98.601%

N/A N/A 4.92E-08 4.90E-08 1.85E-10 Delta LERF From Base Case (3 per 10 years) 3 Delta LERF From 1 per 10 years 3

1.49E-04 3.71E-04 1.91E-05 5.21E+OO 1.99E-06 2.25E+OO 2.19E-05 7.459425 3.62E-04 0.0049%

98.607%

0.008%

1.63E-07 1.14E-07 6.56E-07 1.64E-07 1.91E-05 1.99E-06 2.19E-05 N/A 1.49E-04 O.OOE+OO 3.73E-04 2.49E-06 5.21E+OO O.OOE+OO 2.25E+OO O.OOE+OO 7.459427 2.49E-06 3.65E-04 0.0049%

98.612%

0.013%

1.64E-07 (1.lOE-09) 1.15E-07 (1.lOE-09)

Serial No.17-359 Docket No. 50-336, Page 32 of 41 9.85E-07 2.24E-04 2.45E-07 5.56E-04 1.91E-05 5.21E+OO 1.99E-06 2.25E+OO 2.23E-05 7.459686 6.23E-04 0.0083%

98.613%

0.013%

2.45E-07 1.96E-07 8.19E-08 1.91E-05 5.21E+OO O.OOE+OO 1.99E-06 2.25E+OO O.OOE+OO 2.23E-05 7.459691 5.91E-06 6.29E-04 0.0084%

98.625%

0.025%

2.48E-07 (2.61E-09) 1.99E-07 (2.61E-09) 8.45E-08 (2.61E-09)

1. The delta dose is expressed as both charige in dose rate (person-rem/year) from base dose rate and as% of base total dose rate.

2. The delta CCFP is calculated with respect to the base case CCFP.

3. The delta between the results with and without corrosion for each interval is shown in parentheses below the results with corrosion.

5. 7 External Events Contribution Serial No.17-359 Docket No. 50-336, Page 33 of 41 Since the risk acceptance guidelines in RG 1.174 are intended for comparison with a full-scope assessment of risk including internal and external events, an analysis of the potential impact from external events is presented here. In the Millstone 2 Individual Plant Examination of External Events (IPEEE) [25], the dominant risk contributor from external events is fire. Other external hazards, such as seismic and high winds, were found to be within acceptable limits.

The plant was designed to withstand a safe shutdown earthquake (SSE) with peak horizontal ground acceleration of 0.17g and vertical ground acceleration of 0.11 g. A seismic margins analysis (SMA) was used to evaluate the vulnerability of the station to seismic hazards using a review level earthquake (RLE) with 0.3g peak ground acceleration [25]. The IPEEE concluded that MPS2 is well designed from a seismic standpoint and that a seismic PRA has minimal benefit. In addition, the post-Fukushima review of the station's seismic design [24] concluded that the IPEEE has already demonstrated the capability of the plant to safely shut down with redundant success paths with plant seismic capacity above the updated ground motion response spectrum (GMRS). In the review of the North Anna ILRT extension request, the NRC considered the results from Generic Issue 199 to evaluate the seismic impact on the application

[33]. Similarly, the seismic GDF estimation from Appendix D of Generic Issue 199 [32]

can be used as an order-of-magnitude estimate of the seismic risk for Millstone 2 since use of the SMA precluded the calculation of a seismic GDF in the IPEEE. The seismic GDF based on the 2008 USGS seismic hazard curve from [32] for Millstone 2 is 1.1 E-05/yr, which will be used to assess the impact on the ILRT interval extension from seismic events.

The IPEEE quantified the fire risk for Millstone 2 using a combination of the Fire Induced Vulnerability Evaluation (FIVE) methodology and Fire PRA.

FIVE data and methods are used to calculate area fire ignition frequencies, qualitatively and quantitatively screen areas, and provide hazards analysis for the resulting identified critical areas. Fire PRA is used for the quantification of the core damage frequencies.

The fire analysis is dominated by sequences resulting in station blackout, loss of DC power, and loss of the turbine building, which includes the AFW pumps. The high-risk fire areas included those associated with the main control room, auxiliary building, the cable vault, and the turbine building.

The fire procedures for Millstone 2 have been updated since the IPEEE analysis was performed. A review of the IPEEE and the Millstone 2 fire mitigation strategies in PRA notebook MPS2-RA.023 [26] concluded that most of the fire scenarios evaluated in the IPEEE adequately reflect the as-operated plant. However, three Appendix R fire areas were identified in which a review of the fire mitigation strategies provided additional insights. The main control room, which is located in fire area R-1, was the only room evaluated for control room abandonment in the IPEEE. However, there are other areas within R-1 outside the control room that may also require abandonment per the fire mitigation strategies as a result of damage to safe shutdown equipment. The R-14 fire

Serial No.17-359 Docket No. 50-336, Page 34 of 41 area, which includes the Facility 1 Lower 4.16kV Switchgear Room and the East Cable Vault, and the R-2 fire area, which includes the West Penetration Area, the MCC 861 Enclosure, the Facility 2 Upper 4.16kV Switchgear Room, and the West Cable Vault, were quantitatively screened out in the IPEEE. However, the fire mitigation strategies for R-2 and R-14 have been updated to remove offsite power, which was credited for these scenarios in the IPEEE. A supplemental assessment was performed in PRA notebook MPS2-RA.023 [26] to provide an order-of-magnitude estimate of the fire GDF given these additional insights.

By updating the frequency of R-1 fires resulting in control room abandonment and removing credit for offsite power for R-2 and R-14, an order-of-magnitude GDF is conservatively estimated by a frequency of 3.0E-05/yr. This risk estimate is conservative. Additional fire CDF reduction or refinement for the purposes of assessing the ILRT interval extension is not considered necessary given the acceptability of the results for this application using this estimate.

The method chosen to account for external events contributions is similar to the approach used to calculate the change in LERF for the internal events using the guidance in EPRI TR-1018243 [18]. The Class 3b frequency for the internal events analysis was calculated by multiplying the total CDF by the probability of a Class 3b release. The same approach will be used for external events using the CDF for internal fires. The Millstone 2 IPEEE [25] did not evaluate LERF. However, it is likely that the ratio between LERF and GDF for external events is much lower than the ratio for internal events given that some LERF events that contribute directly to LERF, such as Interfacing System Loss of Coolant Accidents (ISLOCA) and Steam Generator Tube Ruptures (SGTR), are not initiated or generally result from external events. As a result, the same ratio between LERF and GDF for internal events will be used to.calculate the LERF for external events in Table 5.7-1.

Table 5.7-1 External Events Base CDF and LERF Seismic 1.lOE-05 5.78E-02 Internal Fire 3.00E-05 1.74E-06 5.78E-02 Total 4.lOE-05

• 2.37E-06 Table 5.7-2 shows the calculation of the base Class 3b frequency for internal and external events, the increased Class 3b frequency as a result of the ILRT interval extension, and the total change in LERF.

Internal Events External Events Total Table 5.7-2 Serial No.17-359 Docket No. 50-336, Page 35 of 41 Total LERF Increase for 15-year ILRT Interval Including Internal and External Events

• • • 1~s$~b*E~gqygijGy'(Yvrfi1lil!

1 1H;li;i1'.***

-~~~~~t~+>... :e:;;L~~; <:*:e:t~LW1L 2.14E-05 1.24E-06 0.0023 4.90E-08 1.63E-07 2.45E-07 1.96E-07 4.10E-05 2.37E-06 0.0023 9.40E-08 3.13E-07 4.70E-07 3.76E-07 6.24E-OS 3.61E-06 1.43E-07

4. 77E-07 7.15E-07 5.72E-07 As with the internal events analysis, 100% of the frequency of Class 3b sequences can be used as a very conservative first-order estimate to approximate the potential increase in LERF from the ILRT interval extension (consistent with the EPRI guidance methodology). Based on the total three-per-ten year test interval from Table 5.7-2, the Class 3b frequency is 1.43E-07/yr. Based on a ten-year test interval, it is 4.77E-07/yr, and based on a fifteen-year test interval, it is 7.15E-07/yr. Thus, the increase in the overall probability of LERF due to Class 3b sequences that is due to increasing the ILRT test interval from three to fifteen years is 5.72E-07/yr and from ten to fifteen years is 2.38E-07/yr. As can be seen, even with the conservatisms included in the evaluation (per the EPRI methodology), the estimated change in LERF is small according to RG 1.174 since it falls between 1.0E-07/yr and 1.0E-06/yr when comparing the fifteen-year result to both the current ten-year requirement and the original three-year requirement.

In addition, the total LERF remains well below the Regulatory Guide 1.174 acceptance guideline of 1 E-05 per year.

6.0 SENSITIVITIES 6.1 Sensitivity to Corrosion Impact Assumptions Serial No.17-359 Docket No. 50-336, Page 36 of 41 The results in Tables 5.2-2, 5.3-1 and 5.3-3 show that including corrosion effects calculated using the assumptions described in Section 4.4 does not significantly affect the results of the ILRT extension risk assessment.

Sensitivity cases were developed to gain an understanding of the sensitivity of the results to the key parameters in the corrosion risk analysis.

The time for the flaw likelihood to double was adjusted from every five years to every two and every ten years.

The failure probabilities for the cylinder and dome and the basemat were increased and decreased by an order of magnitude.

The total detection failure likelihood was adjusted from 10% to 15% and 5%. The results are presented in Table 6.1-1. In every case the impact from including the corrosion effects is minimal. Even the upper bound estimates with conservative assumptions for all of the key parameters yield increases in LERF due to corrosion of only 3.49E-07 /yr. The results indicate that even with conservative assumptions, the conclusions from the base analysis would not change.

Table 6.1-1 Steel Liner Corrosion Sensitivity Cases to Corr:osion Base Case Base Case Base Case Base Case Base Case Double/5 Years 1.1/0.11 10%

100%

2.61E-09 l.99E-07 Double/2 Years Base Base Base 2.41E-08 2.20E-07 Double/10 Years Base Base Base l.41E-09 l.97E-07 Base Base Point lOx Lower Base Base 5.75E-10 l.97E-07 Base Base Point 10x Higher Base Base 1.18E-08 2.08E-07 Base Base 5%

Base l.56E-09 l.98E-07 Base Base 15%

Base 3.65E-09 2.00E-07 Lower Bound Double/10 Years Base Point 10x Lower 5%

10%

l.87E-11 l.96E-07 Upper Bound Double/2 Years Base Point 10x Higher 15%

100%

l.53E-07 3.49E-07

7.0 CONCLUSION

S Serial No.17-359 Docket No. 50-336, Page 37 of 41 Based on the results from Section 5 and the sensitivity calculations presented in Section 6, the following conclusions regarding the assessment of the plant risk are associated with extending the Type A ILRT test frequency to fifteen years.

Reg. Guide 1.17 4 [3] provides guidance for determining the risk impact of plant-specific changes to the licensing basis. Reg. Guide 1.17 4 defines very small changes in risk as resulting in increases of CDF below 1.0E-06/yr and increases in LERF below 1.0E-07/yr and small changes in risk as increases in LERF below 1.0E-06/yr. Since the ILRT extension was demonstrated to have no impact on CDF for MPS2, the relevant criterion is LERF. The increase in internal events LERF, which includes corrosion, resulting from a change in the Type A ILRT test frequency from three-per-ten years to one-per-fifteen years is conservatively estimated as 1.99E-07/yr (see Table 5.6-1) using the EPRI guidance as written.

As such, the estimated change in internal events LERF is determined to be "small" using the acceptance guidelines of Reg. Guide 1.17 4. The increase in LERF including both internal and external events is estimated as 5.72E-07/yr (see Table 5.7-2), which is considered a "small" change in LERF using the acceptance guidelines of Reg. Guide 1.174.

Reg. Guide 1.174 [3] also states that when the calculated increase in LERF is in the range of 1.0E-06 per reactor year to 1.0E-07 per reactor year, applications will be considered only if it can be reasonably shown that the total LERF is less than 1.0E-05 per reactor year. Although the total increase in LERF for internal and external events is greater than 1.0E-7 per reactor year, the total LERF can be demonstrated to be well below 1.0E-5 per reactor year. The total base LERF for internal and external events is approximately 3.61 E-06/yr based on Table 5.7-

2. Given that the increase in LERF for the fifteen-year ILRT interval is 5.72E-07/yr for internal and external events from Table 5.7-2, the total LERF for the fifteen-year interval can be estimated as 4.18E-06/yr. This is well below the RG 1.174 acceptance criteria for total LERF of 1.0E-05/yr.

e The change in dose risk for changing the Type A test frequency from three-per-ten years to one-per-fifteen years, measured as an increase to the total integrated dose risk for all accident sequences, is 6.29E-04 person-rem/yr or 0.0084% of the total population dose using the EPRI guidance with the base case corrosion case from Table 5.6-1. EPRI TR-1018243 [18] states that a very small population dose is defined as an increase of ::;; 1.0 person-rem per year or ::;;

1 % of the total population dose, whichever is less restrictive for the risk impact assessment of the extended ILRT intervals.

Moreover, the risk impact when compared to other severe accident risks is negligible.

The increase in the conditional containment failure frequency from the three-per-ten year frequency to one-per-fifteen year frequency is 0.025% using the base case corrosion case in Table 5.6-1. EPRI TR-1018243 [18] states that increases

Serial No.17-359 Docket No. 50-336, Page 38 of 41 in CCFP of s 1.5 percentage points are very small.

Therefore this increase judged to be very small.

Therefore, increasing the ILRT interval to fifteen years is considered to be insignificant since it represents a small change to the MPS2 risk profile.

Previous Assessments The NRC in NUREG-1493 [5] has previously concluded that:

Reducing the frequency of Type A tests (ILRTs) from three per 1 O years to one per 20 years was found to lead to an imperceptible increase in risk.

The estimated increase in risk is very small because ILRTs identify only a few potential containment leakage paths that cannot be identified by Type B and C testing, and the leaks that have been found by Type A tests have been only marginally above existing requirements.

Given the insensitivity of risk to containment leakage rate and the small fraction of leakage paths detected solely by Type A testing, increasing the interval between integrated leakage rate tests is possible with minimal impact on public risk. The impact of relaxing the ILRT frequency beyond one in 20 years has not been evaluated. Beyond testing the performance of containment penetrations, ILRTs also test the integrity of the containment structure.

The findings for MPS2 confirm these general findings on a plant specific basis considering the severe accidents evaluated for MPS2, the MPS2 containment failure modes, and the local population surrounding MPS2 within 50 miles.

8.0 REFERENCES

[1]

Industry Guideline for Implementing Performance-Based Option of 1 O CFR Part 50, Appendix J, NEI 94-01 Revision 2-A, October 2008.

[2]

Risk Impact Assessment of Revised Containment Leak Rate Testing Intervals, EPRI, Palo Alto, CA EPRI TR-104285, August 1994.

[3]

An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Regulatory Guide 1.174 Revision 1, November 2002.

[4]

Response to Request for Additional Information Concerning the License Amendment Request for a One-Time Integrated Leakage Rate Test Extension, Letter from Mr.

C.

H.

Cruse (Calvert Cliffs Nuclear Power Plant) to NRC Document Control Desk, Docket No. 50-317, March 27, 2002.

[5]

[6]

[7]

[8]

[9]

[1 O]

[11]

[12]

[13]

[14]

[15]

[16]

Serial No.17-359 Docket No. 50-336, Page 39 of 41 Performance-Based Containment Leak-Test Program, NUREG-1493, September 1995.

Letter from R. J. Barrett (Entergy) to U.S.. Nuclear Regulatory Commission, IPN-01-007, January 18, 2001.

United States Nuclear Regulatory Commission, Indian Point Nuclear Generating Unit No.

3 - Issuance of Amendment Re: Frequency of Performance-Based Leakage Rate Testing (TAC No. MB0178), April 17, 2001.

Impact of Containment Building Leakage on L WR Accident Risk, Oak Ridge National Laboratory, NUREG/CR-3539, ORNL/TM-8964, April 1984.

Reliability Analysis of Containment Isolation Systems, Pacific Northwest Laboratory, NUREG/CR-4220, PNL-5432, June 1985.

Technical Findings and Regulatory Analysis for Generic Safety Issue 11.E.4.3

'Containment Integrity Check', NUREG-1273, April 1988.

Review of Light Water Reactor Regulatory Requirements, Pacific Northwest Laboratory, NUREG/CR-4330, PNL-5809, Vol. 2, June 1986.

Shutdown Risk Impact Assessment for Extended Containment Leakage Testing Intervals Utilizing ORAM', EPRI, Palo Alto, CA TR-105189, Final Report, May 1995.

Severe Accident Risks: An Assessment for Five U.S.

Nuclear Power Plants, NUREG-1150, December 1990.

United States Nuclear Regulatory Commission, Reactor Safety Study, WASH-1400, October 1975.

Letter from J.A.

Hutton (Exelon, Peach Bottom) to U.S. Nuclear Regulatory Commission, Docket No. 50-278, License No. DPR-56, LAR-01-00430, dated May 30, 2001.

Risk Assessment for Joseph M. Farley Nuclear Plant Regarding ILRT (Type A)

Extension Request, prepared for Southern Nuclear Operating Co. by ERIN Engineering and Research, P0293010002-1929-030602, March 2002.

[17]

Letter from D. E. Young (Florida Power, Crystal River) to U.S.

Nuclear Regulatory Commission, 3F0401-11, dated April 25, 2001.

[18]

Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals, TR-1018243, Revision 2-A of 1009325, EPRI, Palo Alto, CA: 2008.

Serial No.17-359 Docket No. 50-336, Page 40 of 41

[19]

PRA Model Notebook MPS2-MC.1 Revision 1, MPS2-R05e Interim Model Development, Dominion Energy, Inc., Millstone Power Station, September 2017.

[20]

NF-AA-PRA-101, Revision 7, Probabilistic Risk Assessment Procedures and Methods: Purpose, Organization, and Use, Dominion Energy, Inc., July 2015.

[21]

PRA Model Notebook MPS2-LE.1 Revision 5, Level 2 Analysis, Dominion Energy, Inc., Millstone Power Station, August 2017.

[22]

Calculation Number PRA02NQA-03107S2, MACCS2 Model for Millstone Unit 2 Level 3 Application, Dominion Resources Services, Inc., Millstone Power Station, February 2004.

[23]

Calculation Number PRA03NQA-04057S2, Risk Impact Assessment of Extending Containment Type A Test Interval at Millstone 2, Dominion Resources Services, Inc., Millstone Power Station, December 2004.

[24]

Letter from D. A. Heacock (Dominion) to U.S. Nuclear Regulatory Commission, Millstone Power Station Units 2 and 3 Response to March 12 2012 Information Request: Supplemental Information Related to the Seismic Hazard and Screening Report for Recommendation 2. 1, Docket Nos. 50-336/423, License Nos. DPR-65/NPF-49, dated July 21, 2014.

[25]

Individual Plant Examination of External Events, Millstone Power Station Unit 2, Northeast Utilities Service Company, December 1995.

[26]

PRA Risk Analysis Notebook MPS2-RA.023, Revision 0, Fire Risk Input for ILRT, Dominion Energy, Inc., Millstone Power Station, September 2017.

[27]

Millstone 2 IPE, Millstone Nuclear Power Station, Unit No. 2, Response to Generic Letter 88-20, Individual Plant Examination for Severe Accident Vulnerabilities, Northeast Utilities Service Company, December 1993.

[28]

Letter from P. B. Cowan (Exelon Generation Company, LLC) to U.S. Nuclear Regulatory Commission, "Response to Request for Additional Information -

License Amendment Request for Type Test Extension", NRC Docket No. 50-277, May 2010.

[29]

Administrative Controls 5.5.15, "Containment Leakage Rate Testing Program",

Technical Specifications and 'Bases, North Anna Power Station Units 1 and 2, Dominion Resources Services, Inc., North Anna Power Station, January 2014.

[30]

ML15034A353, Virginia Electric and Power Company North Anna Power Station Units 1 and 2 Response to Request for Additional Information Proposed License Amendment Request Permanent Fifteen-Year Type A Test Interval, Letter from

Serial No.17-359 Docket No. 50-336, Page 41 of 41 Virginia Electric Power Company to U.S. Nuclear Regulatory Commission, January 28, 2015

[31]

Calculation Number 07077-US(B)-003, Revision 4, MP2 Minimum Sump Water Level Following a Loss of Coolant Accident (LOCA), Dominion Nuclear Connecticut, Millstone Power Station, December 2012.

[32]

ML100270756, Results of Safety/Risk Assessment of Generic Issue 199, "Implications of Updated Probabilistic Seismic Hazard Estimates in Central and Eastern United States on Existing Plants," Appendix D, Seismic Core Damage Frequencies, U. S. Nuclear Regulatory Commission, August 2010.

[33]

ML15133A381, North Anna Power Station, Unit Nos. 1 and 2, Issuance of Amendments to Extend Type A Test Frequency to 15 Years, Letter from U. S.

Nuclear Regulatory Commission to Virginia Electric Power Company, June 2015.

[34]

CE NPSD-1182-P, Probabilistic Safety Assessment Peer Review Report, Combustion Engineering Owners Group, CEOG PRA Peer Review, January 2000.

[35]

PRA Model Notebook MPS2-Appendix A.1 Revision 3, Internal Events Model Independent Assessment, Dominion Resources Services, Inc., Millstone Power Station, October 2012.

[36]

L TR-RAM-12-08, Focused Scope RG 1.200 PRA Peer Review Against the ASME PRA Standard Requirements For The Millstone Power Station Unit 2 Probabilistic Risk Assessment, Westinghouse Electric Company LLC, 2011 Westinghouse PRA Peer Review, September 2102.

[37]

ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, 2009

[38]

US Nuclear Regulatory Commission, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Regulatory Guide 1.200, Revision 2, March 2009

[39]

ASME/ANS RA-Sb-2005, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, 2005

ATTACHMENT 4 Probabilistic Risk Assessment Technical Adequacy DOMINION NUCLEAR CONNECTICUT, INC.

MILLSTONE POWER STATION UNIT 2 Serial No.17-359 Docket No. 50-336

ATTACHMENT 4 TABLE OF CONTENTS Serial No.17-359 Docket No. 50-336, Page 1 of 59

1.

SCOPE OF RISK CONTRIBUTORS ADDRESSED BY THE MILLSTONE 2 PRA..........

2

2.

LEVEL OF DETAIL OF THE MILLSTONE 2 PRA MODEL....................................... 2

3.

PORTIONS OF THE MILLSTONE 2 PRA USED TO SUPPORT THE APPLICATION...

2

4.

PRA MAINTENANCE AND DATA UPDATES.......................................................

2

5.

SUMMARY

OF THE MPS2 PRA HISTORY............................................................ 3

6.

TECHNICAL ADEQUACY OF THE MILLSTONE 2 PRA........................................... 4

7.

PRA TECHNICAL ADEQUACY REVIEW............................................................... 7

8.

REFERENCES................................................................................................ 72

PROBABILISTIC RISK ASSESSMENT TECHNICAL ADEQUACY Serial No.17-359 Docket No. 50-336, Page 2 of 59 The Probabilistic Risk Assessment (PRA) model used to analyze the risk of this application is the CAFTA accident sequence model referred to as MPS2-R05e [19]. The effective date of this model is September 2017. Millstone 2 PRA Model Notebook MC.1, Rev. 1 [19] documents the quantification of the PRA model. This is the most recent evaluation of the MPS2 internal events at-power risk profile.

The PRA model and associated documentation has been maintained as a living program, and the PRA data is updated approximately every 3 to 5 years to reflect the as-built, as-operated plant. This includes updating the PRA to reflect the current plant configuration and to reflect the accumulation of additional plant operating history and component failure data. The MPS2-R05e PRA model is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, and common cause events.

The PRA model quantification process used for the MPS2 PRA is based on the event tree I fault tree methodology, which is a well-known methodology in the industry.

1.

Scope of Risk Contributors Addressed by the Millstone 2 PRA The scope of the current MPS2 PRA model includes internal events and internal floods.

External hazards such as internal fires, seismic, and others were evaluated in the IPEEE [25].

2.

Level of Detail of the Millstone 2 PRA Model The MPS2 PRA model has been developed with an appropriate level of detail to effectively characterize risk in order to support regulatory applications.

System modeling and dependencies have been reviewed to ensure they conform to industry standards.

3.

Portions of the Millstone 2 PRA Used to Support the Application All portions of the PRA model were used to support the risk assessment for this application since the methodology depends on the total CDF. In addition, the LERF is used to ensure the RG 1.174 acceptance guideline of 1 E-05 per year for total LERF is met.

4.

PRA Maintenance and Data Updates There are several procedures and GARDs (Guidance and Reference Documentation) that govern Dominion's PRA program. Procedure NF-AA-PRA-101 [20] controls the maintenance and use of the PRA documentation and the associated NF-AA-PRA Procedures and GARDs.

These documents define the process to delineate the types of calculations to be performed, the computer codes and models used, and the process (or technique) by which each calculation is performed.

The NF-AA-PRA series of GARDs and Procedures provides a detailed description of the methodology necessary to:

Perform probabilistic risk assessments for the Dominion Nuclear Fleet, including

Millstone, North Anna and Surry Power Stations Serial No.17-359 Docket No. 50-336, Page 3 of 59 Create and maintain products to support licensing and plant operation concerns for the Dominion Nuclear Fleet Provide PRA model configuration control Create and maintain configuration risk evaluation tools for the Dominion Nuclear Fleet The purpose of the NF-AA-PRA GARDs and Procedures is to provide information and guidelines for performing probabilistic risk assessments.

An administratively controlled process is used to maintain configuration control of the MPS2 PRA models, data, and software. In addition to model control, administrative mechanisms are in place to assure that plant modifications, procedure changes, system operation changes and industry operating experiences (OEs) are appropriately screened, dispositioned and scheduled for incorporation into the model in a timely manner. These processes help assure that the MPS2 PRA reflects the as-built, as-operated plant within the limitations of the PRA methodology.

The process for performing a probabilistic risk assessment involves a periodic review and update cycle to model any changes in the plant design or operation. Plan_t hardware and procedure changes are reviewed on an approximate quarterly basis or more frequently to determine if they might impact the PRA and if PRA modeling and/or documentation changes might be warranted. These reviews are documented, and ifany PRA changes are potentially needed, they are added to the PRA Configuration Control (PRACC) database for PRA evaluation and implementation tracking.

The MPS2 PRACC database gets reviewed to identify any open (i.e., not yet formally resolved and incorporated into the PRA) PRACC items. The open PRACC items contain potential PRA changes to address plant modifications (as discussed above) as well as possible changes to correct errors or to enhance the model.

The Level 1 and Level 2 MPS2 PRA analyses were origir1ally developed and submitted to the NRC in 1993 as the Individual Plant Examination (IPE) Summary Report [27]. In response to Supplement 4 of Generic Letter 88-20, the IPE External Events (IPEEE) Summary Report was submitted to the NRC in 1995 [25]. The MPS2 PRA has been updated many times since the original IPE.

5.

Summary of the MPS2 PRA History Since 1995, updates have been made to incorporate newer generic and plant-specific reliability and unavailability data, add plant and procedure changes, improve the fidelity of the model, incorporate Combustion Engineering Owners Group (GEOG) Peer Review comments and support other applications, such as On-line Maintenance, Risk-Informed In-Service Inspection

Serial No.17-359 Docket No. 50-336, Page 4 of 59 (RI-ISi), Maintenance. Rule Risk Significance, and Mitigating System Performance Index (MSPI).

The enhancements to the MPS2 PRA model include a major internal flooding update and a number of updates to the Level 2 PRA model to allow a more realistic assessment of the Large Early Release Frequency. A summary of the MPS2 PRA history is as follows:

Date Model Change 12/93 IPE submitted 05/94 Supplement regarding a potential vulnerability identified in the IPE submittal 09/95 Responses to the RAls on the IPE submittal provided 12/95 IPEEE submitted 05/96 IPE approved by NRC 01/00 GEOG peer review report completed 01/00 PRA model updated - Plant-specific data incorporated 06/00 PRA model updated - Addressed significant peer review comments 01/01 IPEEE approved by NRC 04/01 PRA model updated - Incorporated design change to electrically separate from Unit 1 and connect to Unit 3 12/05 PRA model updated - Plant-specific data incorporated 10/07 Initial PRA self-assessment performed 01/11 PRA model updated - Addressed not met ASME/ANS supporting requirements 02/11 Updated PRA self-assessment based on latest PRA model and regulatory requirements 09/12 Updated the internal flooding risk analysis changes to the internal events model 09/12 Westinghouse focused scope peer review report completed 03/17 PRA model updated - Incorporated model changes primarily for AS and EP 09/17 PRA model updated - Resolved modeling issues related to open F&Os The MPS2 PRA model has benefited from the following comprehensive technical PRA peer reviews.

In addition, the self-identified model issues tracked in the PRA configuration control program and model uncertainties were evaluated and do not have any impact on the results of the application.

6.

Technical Adequacy of the Millstone 2 PRA The MPS2 PRA model has been evaluated to ensure the technical adequacy is sufficient to support regulatory applications. The Millstone 2 PRA model has been reviewed against ASME/ANS PRA Standard requirements [37] and the additional clarifications provided in RG 1.200 [38]. In cases where the PRA model was peer reviewed against previous versions of the PRA standard, a gap assessment was performed to the current standard requirements.

Serial No.17-359 Docket No. 50-336, Page 5 of 59 The documentation of supporting requirements met by the Millstone 2 PRA model is documented in Table 7-1.

A review of all open F&Os and their resolutions and their impact on the application is documented in Table 7-2.

Table 6-1 that follows is provided for clarification as to which versions of the PRA standard and RG 1.200 the Millstone 2 PRA model has been reviewed against. As an example, the table shows that the 2007 self-assessment was performed by reviewing the Millstone 2 internal events PRA model files and documentation against the requirements in PRA standard RA-Sb-2005 and RG 1.200 Rev. 1. Dominion PRA engineers reviewed the model against each SR and identified gaps wherever it was judged the PRA model did not meet Capability Category II. The 2012 (Westinghouse) focused (partial) scope peer review was reviewed against PRA Standard RA-Sa-2009 and RG 1.200 Rev. 2 by industry peers.

Table 6-1: Millstone 2 Peer Review History CEOG Peer Review 2000 Full NEl-00-02 N/A Self-Assessment I Gap Assessment*

2007 Full RA-Sb-2005 1

Westinghouse Peer Review 2012 Partial RA-Sa-2009 2

• An update to the self-assessment has been performed to re-evaluate the SRs to RG 1.200 Rev. 2 in accordance with NEI 05-04 Rev. 3 The MPS2 PRA currently has one upgrade which has not been peer reviewed shown in Table 6-2 below:

Serial No.17-359 Docket No. 50-336, Page 6 of 59 Table 6-2: Open Model Upgrades 2017 I MPS2-ROSE Door calculations have been performed to develop a better estimate of door failures due to flood height for dominant flood scenarios. (PRACC 16595)

This upgrade has no impact on the application.

Using generic door failure heights based on guidance from EPRI TR-1019194 has a small impact on flooding HEPs. A sensitivity study evaluated the impact on CDF and LERF due to the reduction in HEP timing, and the increase in risk does not impact the conclusions of the application.

Combustion Engineering Owners Group (GEOG) PRA Peer Review The MPS2 internal events PRA received a formal industry PRA Peer Review in 2000 [34].

The MPS2 review team used the NEl-00-02 "PRA Peer Review Process Guidance" as the basis for the review.

The general scope of the implementation of the 2000 PRA Peer Review included review of eleven main technical elements, using checklist tables (to cover the elements and sub-elements), for an at-power PRA including internal events and containment performance (with focus on LERF). All A-and B-significance F&Os have been addressed.

2007 RG 1.200 Self-Assessment Reference [35] documents the results of a self-assessment review of the Millstone Unit 2 Power Station (MPS2) PRA model, data and documentation in accordance with the Capability Category II requirements of the ASME Standard for PRA [37] and Regulatory Guide (RG) 1.200 [38]. The review was conducted by a team of experts with experience in performing NEI PRA Certifications and ASME PRA Standard Reviews. The assessment included a review of the Dominion PRA procedures, current documentation notebooks, and other documentation.

All technical areas described in Section 4 of the ASME Standard and RG 1.200 were reviewed, with the exception of the PRA Configuration Control Program.

Specific recommendations were provided for each Supporting Requirement (SR) which was assessed as not meeting CC-II by the current PRA model and documentation.

These recommendations were entered into the PRA Configuration Control database and were used to guide PRA enhancement activities, which have included resolution of most issues identified by the self-assessment. The PRACC database is used to track each SR that was assessed as not meeting CC-II as a corresponding database item.

Serial No.17-359 Docket No. 50-336, Page 7 of 59 The self-assessment was originally performed against the previous ASME standard [39]. In 2011 the self-assessr:nent was updated to the 2009 ASME/ANS PRA Standard [37].

2012 Focused Westinghouse PRA Peer Review The intent of the focused peer review [36] of the PRA model for the modeling, data, and documentation, is the items that were considered upgrades that have been incorporated in accordance with the Capability Category II requirements of the 2009 ASME/ANS PRA Standard [37] and Regulatory Guide (RG) 1.200 [38]. The review was conducted by a team of experts with experience in performing NEI PRA Certifications and ASME/ANS PRA Standard Reviews [36]. The peer review also included reviewing some of the Dominion PRA procedures, current documentation notebooks, and other documentation:

Table 6-3 shows the high level requirements and supporting requirements reviewed.

Table 6 Scope of MPS2 Focused Peer Review Technical High Level Requirements (HLRs)

Element Supporting Requirements (SRs) Covered IE HLR IE-C IE-ClO, IE-C11 AS HLR AS-A AS-A2, AS-A3 and AS-A6 SY HLR SY-A SY-All HLR SY-8 SY-83,SY-86,SY-87 HR HLR HR-C All HLR HR-D All HLR HR-G All DA HLR DA-D DA-DS LE All All IF All All QU HLR QU-A QU-AS This focused-scope peer review covered a total of 132 supporting requirements. Seven of the SRs were determined to be not applicable to the MPS2 PRA. Of the 125 remaining SRs, 104 SRs, or 83%, were rated as SR Met, Capability Category 1/11, or greater. Five SRs were rated as Category I and sixteen (16) SRs were considered not met.

7.

PRA Technical Adequacy Review Table 7-1 documents how the MPS2 PRA model was assessed against Addendum A to the 2009 ASME/ANS PRA Standard and Reg. Guide 1.200 Revision 2 to determine whether each SR meets Capability Category II.

Serial No.17-359 Docket No. 50-336, Page 8 of 59 Table 7-2 documents all of the open F&Os that have been identified. These include A-and B-significance F&Os from the 2000 GEOG peer review, unresolved gaps from the 2007 self-assessment for SRs which did not meet CC-II, and Finding F&Os from the 2012 Westinghouse peer review. Unresolved items are shown first in the table, and no open model issues were identified. Resolved items are also listed with a description of the issue resolution.

AS-Al AS-AlO AS-All AS-A2 AS-A3 AS-A4 AS-AS AS-A6 AS-A?

AS-A8 AS-A9 AS-Bl AS-B2 AS-B3 AS-B4 AS-BS AS-B6 AS-B7 AS-Cl AS-C2 AS-C3 DA-Al DA-A2 DA-A3 DA-A4 DA-Bl DA-B2 DA-Cl DA-ClO DA-Cll DA-C12 DA-C13 DA-C14 DA-ClS DA-C16 DA-C2 Serial No.17-359 Docket No. 50-336, Page 9 of 59 Table 7-1 Millstone 2 PRA Standard Supporting Requirements Category Met 2000 Full Scope None

• Note 1 Not Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Not Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2012 Focused Scope 2

None Required Not Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 N/A 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Not Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Not Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 2 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Not Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1

DA-C3 DA-C4 DA-CS DA-CG DA-C7 DA-CS DA-C9 DA-01 DA-02 DA-03 DA-04 DA-OS DA-06 DA-07 DA-08 DA-09 DA-El DA-E2 DA-E3 HR-Al HR-A2 HR-A3 HR-Bl HR-B2 HR-Cl HR-C2 HR-C3 HR-01 HR-02 HR-03 HR-04 HR-OS HR-06 HR-07 HR-El Serial No.17-359 Docket No. 50-336, Page 10 of 59 Table 7-1 Millstone 2 PRA Standard Supporting Requirements Category Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2012 Focused Scope 2

None Required Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 2 This SR was added in RG Met None N/A 1.200 Rev. 2 and has not been peer reviewed.

Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2000 Full Scope None

• Note 1

HR-E2 HR-E3 HR-E4 HR-Fl HR-F2 HR-Gl HR-G2 HR-G3 HR-G4 HR-GS HR-G6 HR-G7 HR-G8 HR-Hl HR-H2 HR-H3 HR-11 HR-12 HR-13 IE-Al IE-AlO IE-A2 IE-A3 IE-A4 IE-AS IE-A6 IE-A7 IE-A8 IE-A9 IE-Bl IE-B2 IE-B3 IE-B4 IE-BS IE-Cl IE-ClO Serial No.17-359 Docket No. 50-336, Page 11 of 59 Table 7-1 Millstone 2 PRA Standard Supporting Requirements Category Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Not Met 2012 Focused Scope 2

None Required Not Met 2012 Focused Scope 2

None Required Not Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Not Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2012 Focused Scope 2

None Required

IE-C11 IE-C12 IE-C13 IE-C14 IE-C15 IE-C2 IE-C3 IE-C4 IE-CS IE-C6 IE-C7 IE-CS IE-C9 IE-01 IE-02 IE-03 IFEV-A1 IFEV-A2 IFEV-A3 IFEV-A4 IFEV-AS IFEV-A6 IFEV-A7 IFEV-A8 IF EV-Bl IFEV-B2 IFEV-B3 IFPP-A1 IFPP-A2 IFPP-A3 IFPP-A4 IFPP-AS IFPP-B1 IFPP-B2 IFPP-B3 IFQU-A1 Serial No.17-359 Docket No. 50-336, Page 12 of 59 Table 7-1 Millstone 2 PRA Standard Supporting Requirements Category Met 2012 Focused Scope 2

None Required Met 2000 Full Scope None

• Note 2 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2012 Focused Scope 2

None Required Not Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required N/A 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Not Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required N/A 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required N/A 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required

IFQU-A10 IFQU-A11 IFQU-A2 IFQU-A3 IFQU-A4 IFQU-AS IFQU-A6 IFQU-A7 IFQU-A8 IFQU-A9 IFQU-81 IFQU-82 IFQU-83 IFSN-A1 IFSN-A10 IFSN-A11 IFSN-A12 IFSN-A13 IFSN-A14 IFSN-A15 IFSN-A16 IFSN-A17 IFSN-A2 IFSN-A3 IFSN-A4 IFSN-AS IFSN-A6 IFSN-A7 IFSN-A8 IFSN-A9 IFSN-81 IFSN-82 IFSN-83 IFSO-A1 IFSO-A2 IFSO-A3 Serial No.17-359 Docket No. 50-336, Page 13 of 59 Table 7-1 Millstone 2 PRA Standard Supporting Requirements Category Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required N/A 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required N/A 2012 Focused Scope 2

None Required Not Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Not Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Not Met 2012 Focused Scope 2

None Required Not Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Not Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Not Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required

Serial No.17-359 Docket No. 50-336, Page 14 of 59 Table 7-1 Millstone 2 PRA Standard Supporting Requirements Category ii'~~"'ij,i~~,**~,~~~,,'~~~sur 'Pef ;~g[r,%,;~~~!U!~~'; G':~~~~f~~~~~~ij IFSO-A4 Met 2012 Focused Scope 2

None Required IFSO-AS Met 2012 Focused Scope 2

None Required IFSO-A6 Not Met 2012 Focused Scope 2

None Required IFSO-Bl Met 2012 Focused Scope 2

None Required IFSO-B2 Met 2012 Focused Scope 2

None Required IFSO-B3 Not Met 2012 Focused Scope 2

None Required LE-Al Met 2012 Focused Scope 2

None Required LE-A2 Met 2012 Focused Scope 2

None Required LE-A3 Met 2012 Focused Scope 2

None Required LE-A4 Met 2012 Focused Scope 2

None Required LE-AS Met 2012 Focused Scope 2

None Required LE-Bl Met 2012 Focused Scope 2

None Required LE-B2 Met 2012 Focused Scope 2

None Required LE-B3 Met 2012 Focused Scope 2

None Required LE-Cl Met 2012 Focused Scope 2

None Required LE-C10 Met 2012 Focused Scope 2

None Required LE-C11 Met 2012 Focused Scope 2

None Required LE-C12 Not Met 2012 Focused Scope 2

None Required LE-C13 Met 2012 Focused Scope 2

None Required LE-C2 Not Met 2012 Focused Scope 2

None Required LE-C3 Not Met 2012 Focused Scope 2

None Required LE-C4 Met 2012 Focused Scope 2

None Required LE-CS Met 2012 Focused Scope 2

None Required LE-C6 Met 2012 Focused Scope 2

None Required LE-C7 Not Met 2012 Focused Scope 2

None Required LE-C8 Met 2012 Focused Scope 2

None Required LE-C9 Met 2012 Focused Scope 2

None Required LE-Dl Met 2012 Focused Scope 2

None Required LE-D2 N/A 2012 Focused Scope 2

None Required LE-D3 N/A 2012 Focused Scope 2

None Required LE-D4 Met 2012 Focused Scope 2

None Required LE-DS Met 2012 Focused Scope 2

None Required LE-D6 Met 2012 Focused Scope 2

None Required LE-D7 Met 2012 Focused Scope 2

None Required LE-El Met 2012 Focused Scope 2

None Required LE-E2 Met 2012 Focused Scope 2

None Required

LE-E3 LE-E4 LE-Fl LE-F2 LE-F3 LE-G1 LE-G2 LE-G3 LE-G4 LE-GS LE-G6 QU-A1 QU-A2 QU-A3

• QU-A4 QU-AS QU-B1 QU-B10 QU-B2 QU-B3 QU-B4 QU-BS QU-B6 QU-B7 QU-B8 QU-B9 QU-C1 QU-C2 QU-C3 QU-01 QU-02 QU-03 QU-04 QU-05 QU-06 QU-07 Serial No.17-359 Docket No. 50-336, Page 15 of 59 Table 7-1 Millstone 2 PRA Standard Supporting Requirements Category Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Not Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Not Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Not Met 2012 Focused Scope 2

None Required Met 2012 Focused Scope 2

None Required Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 2 Met 2000 Full Scope None

• Note 2 Met 2000 Full Scope None

• Note 1 Met 2012 Focused Scope 2

None Required Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1

.Met 2000 Full Scope None

• Note 1 Not Met 2000 Full Scope None

• Note 2 Met 2000 Full Scope None

• Note 2 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1

QU-El QU-E2 QU-E3 QU-E4 QU-Fl QU-F2 QU-F3 QU-F4 QU-FS QU-F6 SC-Al SC-A2 SC-A3 SC-A4 SC-AS SC-A6 SC-81 SC-82 SC-83 SC-84 SC-BS SC-Cl SC-C2 SC-C3 SY-Al SY-A10 SY-All SY-A12 SY-A13 SY-A14 SY-AlS SY-A16 SY-A17 SY-A18 SY-A19

'$Y-A2 Serial No.17-359 Docket No. 50-336, Page 16 of 59 Table 7-1 Millstone 2 PRA Standard Supporting Requirements Category Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 2 Met 2000 Full Scope None

• Note 2 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 2 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1

• Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1' Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2012 Focused Scope 2

None Required Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note.1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1 Met 2000 Full Scope None

• Note 1

Serial No.17-359 Docket No. 50-336, Page 17 of 59 Table 7-1 Millstone 2 PRA Standard Supporting Requirements Category SY-A20 Met 2000 Full Scope None

• Note 1 SY-A21 Not Met 2000 Full Scope None

• Note 1 SY-A22 Not Met 2000 Full Scope None

• Note 1 SY-A23 Met 2000 Full Scope None

• Note 1 SY-A24 Met 2000 Full Scope None

• Note 1 SY-A3 Met 2000 Full Scope None

• Note 1 SY-A4 Not Met 2000 Full Scope None

• Note 1 SY-AS Met 2000 Full Scope None

• Note 1 SY-A6 Met 2000 Full Scope None

• Note 1 SY-A?

Met 2000 Full Scope None

• Note 1 SY-AS Met 2000 Full Scope None

• Note 1 SY-A9 Met 2000 Full Scope None

• Note 1 SY-Bl Met 2000 Full Scope None

• Note 1 SY-BlO Met 2000 Full Scope None

• Note 1 SY-Bll Not Met 2000 Full Scope None

• Note 1 SY-B12 Met 2000 Full Scope None

• Note 1 SY-B13 Met 2000 Full Scope None

• Note 1 SY-B14 Met 2000 Full Scope None

• Note 1 SY-BlS Met 2000 Full Scope None

• Note 1 SY-B2 Met 2012 Focused Scope 2

None Required SY-B3 Met 2000 Full Scope None

• Note 1 SY-B4 Met 2000 Full Scope None

• Note 1 SY-BS Met 2000 Full Scope None

• Note 1 SY-B6 Met 2012 Focused Scope 2

None Required SY-B7 Met 2012 Focused Scope 2

None Required SY-BS Met 2000 Full Scope None

• Note 1 SY-B9 Met 2000 Full Scope None

• Note 1 SY-Cl Met 2000 Full Scope None

• Note 1 SY-C2 Not Met 2000 Full Scope None

• Note 1 SY-C3 Met 2000 Full Scope None

• Note 1

• Note 1 - The 2009 Self-Assessment was performed to assess potential gaps to RA-Sb-2005 I RG 1.200 Rev. 1 requirements. Per NEI 05-04 Rev. 3, no re-evaluation against RA-Sa-2009 I RG 1.200 Rev. 2 is required for this SR.

• Note 2 - The 2009 Self-Assessment was performed to assess potential gaps to RA-Sb-2005 I RG 1.200 Rev. 1 requirements. Per NEI 05-04 Rev. 3 requirements, re-evaluation using a gap assessment to RA-Sa-2009 I RG 1.200 Rev.

2 has been performed. No opens gaps have been identified.

Self-Assessment AS-A4 Self-Assessment AS-82 Self-Assessment AS-C2 Self-Assessment DA-ClS Self-Assessment DA-C3 AS-A4 AS-82 AS-C2 AS-C2 DA-C16 DA-C3 Serial No.17-359 Docket No. 50-336, Page 18 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application CAT-II NOT MET CAT-II MET CAT-II NOT MET CAT-II NOT MET

(*Note 2)

CAT-II NOT MET

(*Note 2)

CAT-II MET

(*Note 2)

In general, no summary or descriptions are provided for operator actions in either Success Criteria or Accident Sequence documentation.

Identify, describe and list all operator actions required for each key safety function modeled.

The dependence of modeled mitigating systems is not consistently identified in the accident sequence analysis. In general, no discussion is pro_vided for the dependence of systems or operator actions on the accident progression.

A one-to-one correlation between each initiating event and the associated event tree is not clearly provided. The system success criteria and associated basis is not clearly provided.

OSP Recovery is calculated in DOM HR.3, but is not discussed (only presented in a spreadsheet). No specific assessment of the applicability of the events considered to the Millstone site is provided.

The data being used in notebook DA.2 is for four years from 2000 through 2004 for reliability data and three years from 2002 through 2004 for availability data in DA.6. There is no discussion of the rationale for excluding data from prior periods. As a minimum, data from all of the years for which Maintenance Rule data is available should be considered.

Unresolved.

There is no impact on the application. No model changes are pending for this issue. This was identified in the self-assessment as a documentation enhancement.

Unresolved.

There is no impact on the application. No model changes are pending for this issue. This was identified in the self-assessment as a documentation enhancement.

Unresolved.

There is no impact on the application. No model changes are pending. This was identified in the self-assessment as a documentation enhancement.

Unresolved There is no impact on the application. No model changes are pending for this issue. This was identified in the self-assessment as a documentation enhancement.

Unresolved.

There is no impact on the application. The model and data have been updated to address the comments from the self-assessment. Further documentation is pending.

Self-IFSO-AS Assessment IF-B3 Self-Assessment LE-C9b LE-C12 Sel~

LE-Fl Assessment LE-Fla Self-QU-BS Assessment QU-BS Serial No.17-359 Docket No. 50-336, Page 19 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application CAT-II NOT MET

(*Note 2)

CAT-II NOT MET

(*Note 2)

For internal flooding, the documentation does not discuss the pressures and temperatures of the sources.

Review the significant accident progression sequences for post-containment failure operation.

Unresolved.

There is no impact on the application. No model changes are pending for this issue. This was identified in the self-assessment as a documentation enhancement.

Unresolved.

There is no impact on the application. Since there are no LERF sequences with containment failure, this search makes no difference. This issue will remain open until the PRA documentation is updated with this conclusion.

CAT-II NOT MET The PDS quantification has not been documented for Unresolved.

(*Note 2) the current results. Document the PDS contributors to CAT-II NOT MET

(*Note 2)

LERF. Define "significant" LERF contributors and document the relative contribution of each to LERF.

Develop documentation on the applicable logic gates and approach used for breaking circular logic in the MPS2 model.

There is no impact on the application. The PDS logic has been developed in the LERF model and documented, but the PDS contributors to LERF have not been documented.

Unresolved.

There is no impact on the application. No model changes are pending. Dominion fleet PRA guidance has been developed on breaking circular logic. This issue will remain open until a list of the circular logic breaks is added to the PRA documentation.

Self-SC-BS Assessment SC-BS Self-SY-A4 Assessment SY-A4 Self-SY-Bll Assessment SY-B12 Self-SY-C2 Assessment SY-C2 Focused IFSO-A3 Scope 2012 IFSO-A3-01 Serial No.17-359 Docket No. 50-336, Page 20 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application CAT-II NOT MET Enhance documentation to include a specific Unresolved.

(*Note 2) comparison of MP2 success criteria to other similar plants and note/explain any significant differences.

There is no impact on the application. This is a documentation enhancement, and no model changes are pending. A comparison of the MPS2 success criteria with Calvert Cliffs and ANO has been documented. However, a comparison of the thermal hydraulic results still is not documented.

CAT-II NOT MET While the IPE documentation and conversations with Unresolved.

(*Note 2) the PRA engineers indicate that these tasks were performed, no documentation exists (walkdown There is no impact on the application. No model sheets, system engineer interviews) to support this changes are pending. This was identified in the supposition.

self-assessment as a documentation enhancement.

CAT-II NOT MET The system models for CC and IA do not appear to Unresolved.

(*Note 2) take credit for insufficient inventories. However, documentation of that appears insufficient.

There is no impact on the application. No model changes are pending.. This was identified in the self-assessment as a documentation enhancement.

CAT-II NOT MET No walkdown information, documentation of Unresolved.

(*Note 2) operating history, or room heatup calculations exists.

There is no impact on the application. This is a documentation enhancement, and no model changes are pending. The PRA documentation has been updated to contain the appropriate level of information for operating history and room heatup calculations. Documentation of the walkdown information is still pending.

Met 30 inches was used as the flood failure height for non-Partially Resolved.

water tight doors, independent of the door positions and independent of if the non-guarantee failure There is no impact on the application. No model probabilities of the doors as a function of elevation.

changes are pending, and the SR is met.

Focused Scope 2012 LE-Fl-01 LE-Fl Serial No.17-359.

Docket No. 50-336, Page 21 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application CC-11/111 Operator actions for flood isolation were assumed successful beyond 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. Flood propagation through openings above 30 inches was not considered. Such assumptions could lead to potential non-conservative assumptions.

Drains in the room are currently not credited, which results in earlier failures and could update risk insights.

No identification of the contributors to LERF by plant damage states is provided in the LERF documentation.

Flood propagation was updated based on door swing direction using EPRI TR-1019194. Door calculations were developed to estimate the door failure heights for the dominant flood scenarios.

Scenarios with equipment damage occurring beyond 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> were evaluated by developing HEPs and using a sensitivity study to assess the risk significance of the scenarios. One scenario was added to the model, and the remainder were found to be not risk significant. Flood propagation through openings above 30 inches was considered and modeled where applicable. Timing for floods was updated based on drains in the room, and flood isolation HEPs were updated accordingly.

The open issue includes performing sensitivity studies based on door failure heights for non risk-significant areas. This is primarily a documentation issue as no impact on the model is expected.

Partially Resolved.

There is no impact on the application. The SR meets CC-I or greater. Plant damage state (PDS) logic was developed in the LERF model, but PDS contributions to LERF have not been clearly documented.

Focused HR-G3 Scope 2012 HR-G3-01 Focused HR-G4 Scope 2012 HR-G4-01 Focused HR-GS Scope 2012 HR-GS-01 Focused HR-G6 Scope 2012 HR-GG-01 Serial No.17-359 Docket No. 50-336, Page 22 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application CC-11/111 In "cognitive recovered" section of CBDTM method in Resolved.

HRA Calculator worksheets, dependency factor column OF is not properly filled out. In the The HRA Calculator worksheets were updated to "cognitive" section of HCR/ORE method in HRA ensure the dependency factor and sigma values are Calculator worksheets, sigma is not properly filled out properly filled out for each HFE.

for many of the worksheets.

Not Met It is recommended that the location of the source of Resolved.

time available to complete actions be accurately identified and clearly documented in a manner that is A detailed review of HFEs and the sequences they easily retrievable. It is recommended that for HEPs are modeled in was performed to ensure timing for where time available varies depending on the event each HFE is within the time available for the sequence, provide a justification if the shorter time is scenarios in which they are credited. In some not used. A specific example was provided in which scenarios, credit for an HFE was removed based on the model is non-conservative as a result of using an inadequate time available. The HRA Calculator HEP based on a longer time window than the time worksheets and the PRA model have been revised available for the scenario.

to reflect these changes.

CC-I Timing information for an HEP could not be located in Resolved.

the HRA documentation.

The operator survey information used for Tdelay and Tm for the HEP is now included in the PRA documentation.

Not Met No documentation of how the HFEs and their final Resolved.

HEPs were reviewed relative to each other to check for consistency and reasonableness.

The PRA documentation was revised to include additional information on how the consistency check was performed.

i~~~M: I.::*'**

urj'ib~r*** **

Focused Scope 2012 IFEV-A2-01 Focused Scope 2012 IFEV-AS-01 Focused Scope 2012 IFEV-A6-01 Focused Scope 2012 IFEV-B2-01 IFEV-A2 IFEV-AS IFEV-A6 IFEV-B2 Serial No.17-359 Docket No. 50-336, Page 23 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application Not Met Met CC-I Met The PRA documentation states that "some flood zone scenarios have been combined and were considered part of floods in adjacent flood zones" without describing how the item (a) or (b) ofthis SR is met.

Documented assessment is needed to ensure that use of the 2006 pipe rupture frequency data instead of the 2010 data still complies with the applicable requirements of Section 2-2.1.

Only generic pipe rupture frequencies were used. To meet CC II, use a combination of generic and other data sources as specified by the SR.

As with F&O IFSO-B2-01, information required to meet the SR is documented in an EXCEL file, which is inconsistent with Dominion guidance that states the same information should be described in a WORD document.

Resolved.

A basis for flood zone groupings was already provided. However, the descriptions were updated to clarify where item (a) or (b) of the SR is met for each grouping.

Resolved.

The pipe rupture frequencies have been updated to reflect the 2013 data found in EPRI TR-3002000079.

Resolved.

Performed and documented plant-specific internal flood events search.

Resolved The Dominion fleet strategy for PRA model documentation includes both WORD documents and supporting EXCEL files. EXCEL files are used in cases where a spreadsheet format is most appropriate to efficiently and clearly present the information. The F&O did not identify any missing information required to meet SR IFEV-B2, and the SR does not prescribe a method of documentation.

The Dominion guidance was found to be more prescriptive than necessary, so it was updated to remove the discrepancy between the guidance for flood scenario development and the documentation.

Focused IFPP-A4 Scope 2012 IFSO-A3 IFPP-A4-01 Focused IFSN-A14 Scope 2012 IFSN-A14-01 Focused IFSN-A3 Scope 2012 IFSN-A3-01 Focused IFSN-A4 Scope 2012 IFSN-A4-01 Serial No.17-359 Docket No. 50-336, Page 24 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application Met 30 inches and 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> criteria were used for non-Resolved.

Met water tight doors, independent of the door positions.

This is not representative of the as-operated plant Performed a more thorough evaluation of door configuration for this SR and could lead to non-failures based on the directionality of the way the conservative assumptions. Also see F&O IFSO-A3-02.

flood pushes doors either into or away from the jamb, and in some instances did specific door height failure calculations.

Not Met A 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> isolation criteria for plant mitigative actions Resolved.

assumed qualitatively that sufficient time is available to perform the isolation within two hours. To meet PRA documentation was updated to include an CCI or CCII, it needs to be shown that all three evaluation of scenarios that assumed flood relevant items specified by the SR are satisfied.

isolation within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. The evaluation documented all three items required by the SR (indication is available in the control room, the flood source is isolable, and the mitigative action can be performed with high reliability) and it ensured these scenarios are not risk significant.

Not Met For each flood area and for each source, no evidence Resolved.

was found that the applicable and relevant auto and/or operator responses were identified and Documentation was added that clearly identifies whether it has the probability to terminate or contain whether an automatic and/or operator response is a flood propagation credited to terminate the flood.

• Not Met No drain capacity and sumps, berms, dikes and curbs Resolved.

related estimate was performed and corresponding SSC impacts (positive or negative) was not performed.

The capacity of curbs had already been calculated and included in scenarios. The estimated capacity of drains and sumps has been added to the PRA documentation.

Focused IFSN-A8 Scope 2012 IFSN-A8-01 Focused IFSN-82 Scope 2012 IFSN-82-01 Serial No.17-359 Docket No. 50-336, Page 25 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application

1.**. :.c~p~bnitv******

• . t:..

£~-~~~9r)'.{C()

Not Met Met No documentation of propagation paths.

Resolved.

More thorough drain information has been added to the PRA documentation to discuss inter-area propagation drain information and documentation was enhanced to include the information by elevation.

As with F&O IFS0-82-01, information required to meet Resolved the SR is documented in an EXCEL file, which is inconsistent with Dominion guidance that states the same information should be described in a WORD document.

The Dominion fleet strategy for PRA model documentation includes both WORD documents and supporting EXCEL files. EXCEL files are used in cases where a spreadsheet format is most appropriate to efficiently and clearly present the information. The F&O did not identify any missing information required to meet SR IFSN-82, and the SR does not prescribe a method of documentation.

The Dominion guidance was found to be more prescriptive than necessary, so it was updated to remove the discrepancy between the guidance for flood scenario development and the documentation.

Serial No.17-359 Docket No. 50-336, Page 26 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application

• Finding**<*.

**supporting'*>.

• ***"*.****.**.**.*..

• c.*:.*.*.. a

.. *.*.*.. P*.*****.*.*.*****:a**

... **.*:**.. b

.... il.it:.*v*.*. :

... **.*.*.. *.*.+

l'Jtl~beri'I* * ;~~quir~~~l)t($)'

• • • Cat~gqr,t (cc)

Focused Scope 2012 IFSO-B2-01 Focused Scope 2012 IFSO-B3-01 Focused Scope 2012 LE-AS-01 IFSO-B2 IFSO-B3 LE-AS LE-E2 Met Not Met Met The Dominion guidance for flood scenario development states that EXCEL spreadsheets should be created to summarize the flood scenarios for each of the non-screened flood zone, and it also states that the scenarios should be described in detail in a WORD document with the same information. Currently, the WORD documents and EXCEL files do not contain the same information. The WORD document does not quite match what the Dominion guidance specified and is not quite descriptive enough to meet the requirements of the SR.

Inconsistencies were identified between different Dominion internal guidance for flood scenario development and analysis. For flood sources related uncertainties, no epistemic uncertainty was discussed.

The Plant Damage State Diagram is difficult to use and is lacking in documentation.

Resolved The Dominion fleet strategy for PRA model documentation includes both WORD documents and supporting EXCEL files. EXCEL files are used in cases where a spreadsheet format is most appropriate to efficiently and clearly present the information. The F&O did not identify any missing information required to meet SR IFSO-B2, and the SR does not prescribe a method of documentation.

The Dominion guidance was found to be more prescriptive than necessary, so it was updated to remove the discrepancy between the guidance for flood scenario development and the documentation.

Resolved.

Sources of internal flooding uncertainties are discussed in the internal flood PRA documentation and an uncertainty analysis is presented in the quantification PRA documentation.

Resolved.

A legible copy of the Plant Damage State Diagram was included and additional descriptions for the top events were added.

,.t~ig~~tj¢*****;1/

Nl!mberj Focused Scope 2012 LE-Cl-02 Focused Scope 2012 LE-C12-01

,~MPPQ~~jpg.....

~gQit~~~~~(~

LE-Cl LE-C12 Serial No.17-359 Docket No. 50-336, Page 27 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application CC-II CC-I The endpoints in the MPS2 Level 2 analyses are the Source Term Categories (STCs). However, there is no information with respect to the definition of each source term category nor are any of the source terms defined in terms of isotopic contents and split fractions There is no evidence that MPS2 performed a review of accident progression accident sequences to determine if it was possible for continued operation of equipment or personnel that would reduce LERF.

Resolved.

A copy of the Source Term Category (STC) binning diagram is now included. Additional discussion was added to the documentation.

Resolved.

Significant accident progression sequences have now been reviewed to determine if continued equipment operation or operator actions after containment failure can help reduce LERF. The review is documented in PRA Notebooks.

However, no credit is taken for additional equipment or operator actions because the significant LERF contributors are bypass scenarios, not failure of containment isolation.

Focused Scope 2012 LE-C2-01 LE-C2 Focused LE-C3 Scope 2012 LE-C3-01 Serial No.17-359 Docket No. 50-336, Page 28 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application Not Met CC-I Two potential SAMG actions were identified in the Level 2 analysis. However, one of them was set to 1.0 based on timing concerns, and the second was determined to be feasible but cannot be located in the model or documentation. Also, there are implied operator actions in the containment isolation failure analysis. These actions do not appear to have been delineated or evaluated.

MPS2 did not review significant accident progression sequences resulting in a large early release to determine if repair of equipment can be credited.

Resolved.

Both SAMG actions were reviewed. The first for RCS de pressurization was found to not be feasible based on timing. The second for re-flooding the steam generators following late core damage for tube rupture scenarios was developed and added to the model.

The containment isolation failure probability was recalculated with no credit taken for implied operator actions.

Level 2 documentation was updated to reflect these changes.

Resolved.

Significant accident progression sequences have now been reviewed to determine if repair can help reduce LERF. The review is documented in PRA Notebooks. However, no credit for repair is taken.

Serial No.17-359 Docket No. 50-336, Page 29 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application

't*:.*.**,*.. *,s.*. upp,'

..,,,*.o,.*

..,**. r.,**.t

...*,*.*.**.i*n.',*'.*

.. g capability,

r,,**..,

.. c*'*'.,*.*.,.*a'**.***t'

.. *.'*.'e,,

..,,,'g***.*,*o*.*.***rv'..*,(,c*

..,,c*.*,**,*

... )'.[.*

• <RE!quirE!ITIE!nt(s)., **

• Focused LE-02 Not Applicable Scope 2012 LE-02-01 Focused LE-F2 Not Met Scope 2012 LE-F2-01 Almost all LERF sequences are either bypass or isolation failure sequences because EQE analysis was not accounted for. There is no documentation that containment temperatures remain below the failure temperatures for the Level 2 accident sequences.

There is no evidence that MPS2 reviewed the LERF contributors for reasonableness.

Resolved.

The EQE report was obtained after the peer review.

Its focus is more on structural elements of the containment including pipe penetrations and does not specifically address analysis of thermal attack of electrical penetrations. The analysis for electrical penetrations is contained within the IPE report and is based on a review of industry tests and analysis of the containment at another plant.

The conclusion ofthe analysis is not sensitive to small variations of calculated temperatures in the containment for a severe accident and is still valid.

Resolved.

The LERF contributors have now been reviewed for reasonableness. PRA documentation includes review and explanation of significant accident progression sequences.

Focused LE-Gl Scope 2012 LE-Gl-01 Focused LE-GS Scope 2012 LE-GS-01 Full Scope IE-Bl, AS-Al, AS-CEOG 2000 A6, AS-A7, AS-A10, AS-Bl, QU-AS-01 Al Serial No.17-359 Docket No. 50-336, Page 30 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application Not Met The current Level 2 analysis documentation is Resolved.

disjointed and incomplete in several important details.

Some specific areas of difficulty include:

Readable versions of the Plant Damage State (PDS),

A) PDSs logic diagram is unreadable Containment Event Tree {CET), Decomposition B) CETs are not presented in the report Trees, and Source Term Category (STC) Diagrams C) No definitions are provided for STCs are now included in the PRA documentation along D) MPS2 did review their SAMGs to identify post-core with improved discussions. Treatment of the two damage operator actions. Of the 2 such actions SAMG actions has been addressed. The identified, one appears to have been ignored after introduction section of the LERF analysis PRA being identified.

documentation describes how this information is E) MPS2 has a LERF one-top model, but there is no used in the CAFTA LERF Fault Tree.

discussion of how it used and how it is tied to PDSs and CETs.

Not Met MPS2 has not reviewed their Level 2 analysis to Resolved.

identify any limitations that may have the potential to impact applications.

PRA documentation has been updated to include documentation of LERF limitations.

Marginal (*Note The initiating event of loss of condenser vacuum is Resolved.

1) included as one of the GPT initiating events.

Therefore for the Event Tree Node "SGC", Steam In the current MPS2 PRA Model, a loss of Generator Cooling, Main Feedwater would need to be condenser vacuum initiator fails the condensate set to failure to make the event tree bounding or the and MFW systems, which in turn causes a loss of loss of condenser vacuum needs to be addressed with MFW and contributes to failure of steam generator a separate event tree.

cooling (SGC).

Full Scope CEOG 2000 AS-02 Full Scope CEOG 2000 AS-03 IE-Bl, AS-A1,AS-A2, AS-A3, AS-AG, AS-A7, AS-AlO, AS-All, AS-Bl, AS-B4, SC-A3, QU-Al & QU-BG AS-A2, AS-A3, AS-AS, AS-A7, AS-A9, AS-A10, AS-Bl, SC-A3, SC-AG, SC-Bl, SC-B3, SC-B4, SC-Cl, SC-C2, SY-AlO, SY-A21, SY-B7 & QU-Al Serial No.17-359 Docket No. 50-336, Page 31 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application Inadequate

(*Note 1)

Inadequate

(*Note 1)

For the event tree used to address RCP Seal LOCA, the initiating event is the failure of SW or RBCCW including all support system failures. This does not treat the response to the challenges in a bounding manner since failures of these support systems are not explicitly evaluated for impacts on mitigating systems. In addition, impact of the loss of condenser vacuum appears to be included in the loss of feedwater but not bounded, and the impact of loss of DC power of the diverse scram system or loss of shunt coils on the RTBs.

The documentation section on General Plant Transient does not appear to address secondary system steam removal. It states that the Event Tree Node SGC addresses steam generator cooling. It identifies MFW and AFW as systems used to achieve this function. It does not include steam removal of the ADVs, TBVs or Main Steam relief valves.

Resolved.

RCP seal LOCAs are currently calculated for all initiating events using a transfer to a separate Loss of Seal Cooling event tree. The support system failures of SW and RBCCW are appropriately reflected for mitigating systems.

The loss of condenser vacuum is modeled in the GPT initiator, and failures of systems due to a loss of condenser vacuum are modeled.

The impact of loss of DC power on the diverse scram system will not be modeled because the diverse scram system is not explicitly modeled in the analysis. The failure to trip the reactor is modeled as a 'black box', which is consistent with other models Resolved.

If the atmospheric dump valves do not open, the pressure in the steam generators increases to the pressure of the first main steam safety valve.

Based on the safety functional requirements manual and an existing analysis, the nominal flow from the AFW pumps to the steam generators at the maximum MSSV pressure is sufficient to maintain steam generator cooling, and the ADVs are not required. Significant redundancy is available for steam relief through the ADVs, the MSSVs, and the condenser steam dumps.

Full Scope CEOG 2000 AS-04 Full Scope CEOG 2000 AS-OS AS-A2, AS-A3, AS-AS, AS-A7, AS-A9, AS-A10, AS-Bl, SC-A3, SC-A6, SC-Bl, SC-B3, SC-B4, SC-Cl, SC-C2, SY-AlO, SY-A21, SY-B7 & QU-Al AS-AS, AS-A9,AS-All, AS-Bl, AS-B2, AS-B3, AS-B4, AS-BS, AS-B6, SC-A3, SC-A6, SC-Bl, SC-B3, SC-B4, SC-Cl, SC-C2, SY-A10, SY-A21, SY-B7 & QU-Al Serial No.17-359 Docket No. 50-336, Page 32 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application aiJ~~'lit\\f 7,,*

}~~qry(~C)'

Inadequate

(*Note 1)

Inadequate

(*Note 1)

Loss of a vital DC bus with no credit of the non-vital Turbine battery results in loss of two inverters. Loss of two inverters would result in all ESAS signals with the exception of LNP and SRAS.

Although a spurious actuation of ESAS that results in a LNP or a simultaneous SIAS and SRAS will not occur on loss of single battery, a simultaneous loss of SIAS and SRAS will occur if two inverters are loss that are powered from different batteries. Combinations of failures of inverters may cause SIAS, SRAS, or LNP, and the PORV open logic may not be satisfied. These dependencies should be added to the model.

The impact of the AFW instrument air accumulators 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> capacities and the loss of the batteries following battery depletion after 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> needs to be considered as to its impact on AFW flow control.

Resolved.

The impact of combinations of vital AC bus failures was reviewed in detail. The additional dependency would have a very low likelihood since the issue centers on failure of two highly reliable power supplies. Since the impact on CDF was determined to be negligible, no model changes are required.

Resolved.

The impact of a loss of instrument air on AFW flow control was analyzed. Analysis of this scenario determined that procedural guidance is available to control AFW with backup air or local manual control following depletion of the accumulators for the AFW regulating valves, and the consequence of not controlling AFW is failure of the TDAFW pump.

Since the incremental probability of failure of the TDAFW pump would be very low, it was concluded that this failure scenario would not result in additional likelihood of a core damage event.

The effect of battery depletion is already included implicitly in the PRA Model for station blackout as a failure of the turbine-driven AFW pump.

Full Scope AS-A2, AS-A3, AS-CEOG 2000 A7, AS-AlO, AS-81, SC-A3 & QU-AS-06 Al Full Scope AS-A2, AS-A7, AS-CEOG 2000 AlO, AS-81, AS-84, QU-Al & QU-AS-07 86 Full Scope CEOG 2000 AS-08 Full Scope AS-AS, AS-A9, SC-CEOG 2000 A3, SC-A6, SC-81, SC-83, SC-84, SC-AS-09 Cl, SC-C2, SY-A10, SY-A21, SY-87 Serial No.17-359 Docket No. 50-336, Page 33 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application Inadequate Small-Small and Small LOCA, 8&F isn't credited for Resolved.

(*Note 1) heat removal if AFW fails. The TH calc states:

... Therefore, small breaks (as well as small-small In the current PRA Model, small-small LOCA events breaks) require decay heat removal via main or are combined with the small LOCA events. In the auxiliary feedwater. For small break LOCA, opening a current small LOCA event tree, once-through-PORV would also be adequate.

cooling (bleed and feed) is considered if steam generator cooling is lost.

Meets The success criteria for containment cooling with Resolved.

(*Note 1) respect to containment spray and containment air recirculation (CAR) fans does not appear to be The plant damage state in question has been properly reflected in the Small LOCA event tree for the corrected in the current MPS2 PRA Model.

plant damage state with successful CAR fans.

Inadequate The reference used for RCP failure probability given a Resolved.

(*Note 1) loss of seal injection is known to be optimistic since the reference for the value used in the model is stated The RCP seal failure methodology in the model has as "CE NPSD-755, Reactor Coolant Pump Seal Failure been modified. It is now based on the CEOG report Probability Given a Loss of Seal Injection."

CE NPSD-1199-P.

Inadequate It is apparent that an undocumented assumption is Resolved.

(*Note 1) made that AFW will succeed without reliance on ADVs, possibly due to the fact that AFW can feed An analysis was performed to show that since AFW against the MSSV lift setpoints. If this assumption is can provide sufficient flow to steam generators not valid, then loss of ADVs must be included in the while feeding against the MSSV lift setpoint, the failure mechanisms for AFW and SGC nodes in various ADVs are not modeled.

event trees. The same assumption is made for MFW pumps also.

Full Scope CEOG 2000 AS-10 Full Scope CEOG 2000 AS-11 Full Scope CEOG 2000 AS-12 Full Scope CEOG 2000 DA-01

• s.~~~~~t!hg *ti i**

<[t~q~i~erfr~Q~(s)

• i AS-AS, AS-A9, SC-A3, SC-A6, SC-Bl, SC-B3, SC-B4, SC-Cl, SC-C2, SY-AlO, SY-A21, SY-B7 AS-AS, AS-A9, SC-A3, SC-A6, SC-Bl, SC-B3, SC-B4, SC-Cl, SC-C2, SY-AlO, SY-A21, SY-B7 AS-AS, AS-A9, SC-A3, SC-A6, SC-Bl, SC-B3, SC-B4, SC-Cl, SC-C2, SY-AlO, SY-A21, SY-B7 SY-A14, DA-Al, DA-A4, DA-Cl, DA-C2, DA-C3, DA-C9 & LE-E2 Serial No.17-359 Docket No. 50-336, Page 34 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application Inadequate

(*Note 1)

Inadequate

(*Note 1)

Inadequate

(*Note 1)

Marginal (*Note

1)

MFW Success Criteria does not require makeup to the condenser when steam dump valves fail. No documentation of the verification that adequate volume exists in the condenser for successful cooldown. No modeling of makeup to the condenser was identified.

Per the CEOG best estimate ATWS success criteria evaluation, a limit of 3700 psia is recommended to be used. To use 4300 psia as success, RV upper head lift issues must be considered in the analysis. If a lower pressure is used, confirm the impact on the assumption of 1-of-2 PO RVs instead of 2-of-2 PO RVs as recommended by the CEOG best estimate evaluation.

Boron precipitation control is assumed required for small and medium LOCAs. This assumption for small LOCAs is probably overly conservative. Some additional evaluation could likely justify that this requirement is conservative for medium LOCAs.

Provide justification for PSA Guideline #12 section S.3 method to screen inadequate plant data to perform updates.

Resolved.

It was conservatively assumed that total failure of the Steam Dumps would lead to a failure of the Main Feedwater System. It was conservatively assumed that a loss of one Steam Dump would lead to a partial loss of Main Feedwater.

Resolved.

The current PRA Model assumes a peak pressure limit of 3700 psia, as defined in the CEOG guidance document, CE NPSD-S91-P. The higher peak pressure limit of 4300 psia is no longer credited.

The current success criteria for primary pressure relief during an ATWS event is 2 of 2 pressurizer safety valves open AND 2 of 2 pressurizer PO RVs (and associated block valves) open AND all of the valves reclose.

Resolved.

Boron precipitation control has been removed from the small LOCA event tree, but conservatively remains in the medium LOCA event tree.

Resolved.

All of the data was updated for the 200S Model update. The PSA guidelines are no longer used.

The current failure rate data uses both plant-specific and generic data.

Full Scope SY-A14, DA-Al, CEOG 2000 DA-A4, DA-Cl, DA-C2, DA-C3, DA-02 DA-C9, LE-E2 Full Scope HR-82, DA-Al, CEOG 2000 DA-A4, DA-81, DA-82, DA-C2 &

OA-03 DA-C3 Full Scope SY-A24, DA-Al, CEOG 2000 DA-C2, DA-C15 &

DA-C16 DA-05 Full Scope SY-A24, DA-Al, CEOG 2000 DA-C2, DA-C15 &

DA-C16 DA-06 Serial No.17-359 Docket No. 50-336, Page 35 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application Marginal (*Note The MS2 data analysis assumed a value of 0.33 when Resolved.

1) no failures have been experienced, which is unusual.

There are several processes for dealing with the "zero For the 2005 Model update, the Jeffery's prior has failure" condition, such as use of the equation E(n,t) =

been used in the calculation of IE frequencies for (2n+l)/2t.

rare IE in which the plant specific data could yield zero (O) failures. The value of 0.33 is no longer used.

Meets Credit was taken for the MPl DG. The failure rates for Resolved.

(*Note 1) these are different than used for the unit 2 'A' AND '8' DGs. The bases for the unit 1 DG failure rates do not The Millstone Unit 1 diesel generator is no longer appear to be docul'!lented in the data calculation.

used as a back-up power supply. The current PRA Model credits the Unit 3 S80 diesel generator and/or the Unit 3 RSST, and the failure rates of these components were calculated using both plant-specific and generic data.

Marginal (*Note Electrical Power fault tree does not appear to include Resolved.

1) an event to account for a Loss of Offsite Power (LNP) induces by grid instability caused by the plant trip.

The LNP frequency in the model has been modified One plant trip induced LNP has occurred in the to distinguish among the grid-related, weather-industry. Thus, loss of normal power needs to be related and plant-centered initiating events. LNP considered AFTER the initiator has occurred, typically events that are caused by grid instability that is requiring a second load shed and re-sequencing of induced by the plant reactor trip are accounted for equipment. Generally this is not included as part of in either plant-centered or grid-related LNP events the LNP initiator since it causes separate actions.

in the generic data. In addition, the current model has added the potential for a consequential LNP to occur following reactor trip.

Marginal (*Note The LNP initiating event frequency is given as 3.7E-02 Resolved.

1) in MP2 data Analysis. However, the quantification uses a lower LNP value of 2.4E-02. The 3.7E-02 is For the 2011 Model update, the LNP frequencies closer to the industry value.

were calculated using the latest accepted methods and using both plant-specific and generic data.

Full Scope CEOG 2000 DA-08 Full Scope CEOG 2000 DE-02 SY-A24, DA-Al, DA-C2, DA-C15 &

DA-C16 Serial No.17-359 Docket No. 50-336 ; Page-36 of 59 --

Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application Marginal (*Note

1)

Inadequate

(*Note 1)

PORV UNAVAILABILITY: A statement from the plant PSA staff indicated that one reason for using a 1-of-2 instead of 2-of-2 PORV success for ATWS pressure relief was due to high PORV unavailability. The data calculation states that there was no unavailability for the 3 yrs of MR data used and thus a lE-04 value was used. It should be confirmed that this low value is appropriate.

FOR FEED AND BLEED: The model indicates that PORV unavailability would be recoverable. If the PORV is determined to be inoperable, the block valve would likely be closed with its breaker open and thus the PORV would not be recoverable.

PORV UNAVAILABILITY BASIC EVENTS: There are different PORV unavailability basic events used in the fault tree. This could be an issue for use for on-line maintenance reviews since it must be ensured that all applicable PORV unavailability events are failed.

Expand the guidance in NU PSA Guide 4 Section 4.9.10 to require that references be linked directly to the identified dependencies.

Resolved.

The ATWS success criteria require 2 of 2 pressurizer PORVs. The PORV unavailability has been updated and is now based on plant-specific maintenance data. The only portion of the PORV unavailability that is ANDed with the block valve is related to recoverable scenarios where the PORV is isolated due to seal leakage. In the current model, the same unavailability of the PO RVs is used for both failure of automatic pressure relief and failure of feed and bleed.

Resolved.

The current system dependency analysis is documented. The dependency table is developed in accordance with the Systems Analysis (SY) element of the ASME PRA Standard.

Full Scope AS-81, AS-82, AS-CEOG 2000 BS, AS-86, SC-A3, SC-A4, SY-BS DE-05 Full Scope HR-A3; HR-DS, CEOG 2000 HR-G7 DE-06 Full Scope AS-83, SY-A4, SY-CEOG 2000 A21,SY-B8 DE-08 Serial No.17-359 Docket No. 50-336, Page 37 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application Inadequate Support system dependencies on Initiating Event are Resolved.

(*Note 1) not fully identified. LOSSDC top logic is not identified in the Flag file to document the system dependencies.

Since the time of the certification, the MPS2 Model was revised to eliminate the use of flag files. The current model correctly reflects the Loss of DC bus initiators, including dependencies between systems affected by these events.

Documentation has been enhanced to include dependency matrices and to describe the process for identifying and grouping initiating events.

Inadequate HRA calculation identifies specific HRA dependencies Resolved.

(*Note 1) that are not addressed by the recovery rules to preclude dependent recoveries, or make appropriate The dependency analysis has been revised and all adjustments.

~

operator actions were recalculated using the EPRI HRA calculator. The level of dependency between each group of operator actions occurring within the same cutset was checked. For all sets of actions in which there is at least a low level of dependence, the actions are replaced with a new basic event reflecting the dependence of the HFEs. All identified dependent recoveries are applied by the recovery rules.

Marginal (*Note There is no current flood evaluation. The old flooding Resolved.

1) evaluation is largely a qualitative screening approach.

Revised Internal Flooding analysis performed. A complete Internal Flooding (IF) model was developed.

Full Scope CEOG 2000 DE-09 Full Scope CEOG 2000 HR-01 Full Scope CEOG 2000 HR-02 HR-Cl, HR-C2, HR-C3, HR-DS,HR-El, HR-E2, HR-E3, HR-F2, HR-Gl, HR-G2, HR-G3, HR-G6, HR-Hl, HR-H2, SY-A17, QU-Cl SV-A16, HR-Al, HR-A2, HR-A3, HR-Bl, HR-B2, HR-C2, HR-C3 Serial No.17-359 Docket No. 50-336, Page 38 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application Marginal {*Note

1)

Inadequate

{*Note 1)

Meets

{*Note 1)

Directly link references to dependencies, and provide a summary for the scope of the dependency evaluation for each system.

The HRA guidance with respect to screening values appears to be inconsistent with good PRA practices.

The use of screening values, especially when they are vary from 1 to lE-2, may result in very conservative or non-conservative values. Therefore, achieving a best estimate analysis would be difficult. Good practice would be to use screening values only in the initial PSA quantification process. The term "screening value" as used by the Millstone 2 PSA appears to be more a rough estimate than a bounding value. The values need to be replaced with best estimate values.

There is no operator error for miscalibration of RWST level sensors leading to an early SRAS.

Resolved.

The system dependency analysis has been documented in the SV.1 notebook, and it was developed in accordance with the {SY) element of the AMSE PRA Standard.

Resolved.

All of the operator actions were recalculated using the latest methodology in the EPRI HRA Calculator.

The new operator actions contain no screening values.

Resolved.

This was addressed in a legacy MPS2 LPSI fault tree analysis, which stated that a gross miscalibration of 2 of 4 RWST level transmitters would have to occur. This was not considered a credible event.

Full Scope CEOG 2000 HR-03 Full Scope CEOG 2000 HR-OS Full Scope CEOG 2000 HR-07

_Full Scope CEOG 2000 HR-08 SY-A17, HR-Bl, HR-B2, HR-Dl, HR-D2, HR-D4,HR-El, HR-E2, HR-E3,HR-E4,HR-Gl, LE-E2 SY-A17, HR-El, HR-E2, HR-E3, HR-G6 HR-Cl, HR-C2, HR-C3, HR-DS,HR-El, HR-E2, HR-E4, HR-Fl, HR-F2, HR-Gl, HR-GS, HR-Hl, QU-Cl, LE-E2 HR-El, HR-E4, HR-Fl, HR-F2, HR-Gl, HR-G3, HR-G4 & HR-GS Serial No.17-359 Docket No. 50-336, Page 39 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application Inadequate

(*Note 1)

Inadequate

(*Note 1)

Inadequate

(*Note 1)

Inadequate

(*Note 1)

There does not exist any documented evidence in the Human Reliability Analysis on the use of operator input for the calculation of human error probabilities.

In addition, the Millstone PRA staff has stated that operator input was not used for the current HEP values.

The write-up for the description of human action OARDCl is blank. The same issue was identified for OASWALIGN.

MP2 Human Reliability Analysis includes a simplified event tree for determining the HEP for recovery actions. This simplified process has some obvious weaknesses including lack of timing input and lack of training input.

The time available to perform a human action, the time required to perform the action and the bases for both are not always provided for the applicable actions.

Resolved.

For all operator actions in which the cognitive failure probability is determined with the Human Cognitive Reliability Model, input for the diagnosis times and manipulation times have been provided by Operations personnel. All of the operator actions have been recalculated using the revised inputs using the latest methodology.

Resolved.

All of the operator actions were recalculated using the latest methodology. The human actions listed in the observation are no longer modeled in the current model.

Resolved.

All of the operator actions have been recalculated using the latest methodology in the EPRI HRA calculator. The diagnosis and manipulation times have been updated based on input from Control Room personnel. The training frequency for HEPs is also recorded in the HRA calculator.

Resolved.

All of the operator actions have been recalculated using the latest methodology in the EPRI HRA calculator. The time available and time required for each action are included in the calculator and based on a combination of input from control room personnel and thermal hydraulic calculations.

Full Scope CEOG 2000 HR-09 Full Scope CEOG 2000 HR-10 Full Scope CEOG 2000 HR-11 HR-F2, HR-Gl, HR-G3 HR-F2, HR-Gl, HR-G3 AS-AlO HR-E2 HR-Hl HR-H2 Serial No.17-359 Docket No. 50-336, Page 40 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application Inadequate

(*Note 1)

Inadequate

(*Note 1)

Not Reviewed

(*Note 1)

The HRA analysis in some cases discusses total time to take the action after the initiating event for the action but does not account for diagnosis time and time required to take the action.

Use of the simplified recovery action estimator seems overly simplistic. The assumption for available time (e.g., short) is subjective, it is not clear whether available time is total time or time available after diagnosis, and this method does not account for potential differences between in-CR and ex-CR actions There is a discrepancy between the failure probability in the HRA calculation and the failure probability in the cutset for failure to align power from Unit 1. The probability in the cutset must be justified or set to 1.0.

Resolved.

All of the operator actions have been recalculated using the latest methodology in the EPRI HRA calculator. The diagnosis time and time required are included in the calculation for each HFE.

Resolved.

All of the operator actions have been recalculated using the latest methodology in the EPRI HRA calculator. The available time is considered explicitly, timing information is clearly presented, and implications of actions outside the control room (timing, accessibility, environmental effects, etc.) are taken into consideration.

Resolved.

Unit 1 is decommissioned and is no longer the back-up power source to Unit 2. The new operator actions modeled are the alignment of the Unit 3 SBO diesel generator and Unit 3 RSST to supply power to Unit 2 during station blackout. The bases for the failure probabilities for these events are clearly documented in the HRA calculator file.

Full Scope HR-B2, HR-DS, CEOG 2000 HR-E2, HR-G7, HR-H3 & QU-Cl HR-12 Full Scope HR-Cl, HR-C2, CEOG 2000 HR-C3, HR-DS, HR-E2, QU-Cl HR-13 Full Scope HR-E2 CEOG 2000 HR-14 Full Scope HR-Cl, HR-C2, CEOG 2000 HR-C3, HR-DS, QU-Cl HR-15 Serial No.17-359 Docket No. 50-336, Page 41 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application Inadequate The factor of 10 increase in failure probability for Resolved.

(*Note 1) dependent actions which is used for several dependent actions, which may have complete The dependency analysis has been revised and all dependence, has no identified basis.

operator actions were recalculated using the EPRI HRA calculator. The level of dependency between each group of operator actions occurring within the same cutset was checked. For all sets of actions in which there is at least a low level of dependence, the actions are replaced with a new basic event reflecting the dependence of the HFEs.

Inadequate Dependencies between some actions listed in rule file Resolved.,

(*Note 1) are not discussed in the HRA calculation.

The dependency analysis has been revised and all operator actions were recalculated using the EPRI HRA calculator. The basis for the dependency between combinations of events is clearly identified.

Inadequate The actions in the recovery rule file that are Resolved.

(*Note 1) considered to be dependent are replaced with a new action with a higher probability. It should be During quantification of the PRA Model, a confirmed that potentially important cutsets were not truncation sensitivity was performed to ensure that truncated due to quantification with the two proper truncation is used. In addition, failure dependent actions "ANDed".

probabilities of HFEs are increased in the dependency analysis to ensure important combinations are not truncated.

Marginal (*Note This bleed and feed action is in the model with a 0.1 Resolved.

1) probability. This action is not do,cumented in the HRA calculation The operator action to initiate once-through-cooling (bleed and feed) has been recalculated and documented

Full Scope CEOG 2000 HR-16 Full Scope CEOG 2000 HR-17 Full Scope CEOG 2000 IE-01 Full Scope CEOG 2000 IE-02 Serial No.17-359 Docket No. 50-336, Page 42 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application

• C /~~'pp~rtip!*'****'.***\\**** i' ?*f~~pab~lity:*.:***:***:

Req4irern~ni(s).',, H >(:~~~gocy((:~)' '

IE-Bl, IE-B2, IE-B3, IE-B4, AS-Bl IE-Bl, IE-B2, IE-B3, IE-B4, AS-Bl Inadequate

(*Note 1)

Inadequate

(*Note 1)

Marginal (*Note

1)

Marginal (*Note

1)

References to EOPs and AOPs used to support various Resolved.

human action are weak and when stated do not include the revision number. This makes configuration control difficult.

The description of operator should clearly identify the bounding conditions for which the HEP was calculated.

SGTR frequency is based on the current version of the CEOG standard. Revised values were provided by email in 1998, but the report has not been updated yet. Report will be updated in 2000.

Spurious opening of PSVs or PO RVs do not appear to be treated as small LOCA initiators. There is no IE frequency calculation and the event tree analyses do not address this. Consequential failure of the PSVs and PO RVs are addressed.

The operator actions that are credited in the current PRA Model have been recalculated and documented. All procedures that are used to perform the action and provide the cue to perform the action are listed in the documentation.

Resolved.

Timing and other bounding information was added to the basic event description of human actions as appropriate. The descriptions of the operator actions were also clarified in many instances.

Resolved.

The SGTR frequency has been updated and is reflected in the model and documentation.

Resolved.

Spurious opening of a pressurizer safety valve or PORV is not considered a credible random initiating event, but the PORVs are considered for spurious operation during fire events.

Full Scope CEOG 2000 IE-03 Full Scope CEOG 2000 IE-04 IE-Bl, IE-B2, IE-B3, IE-B4, AS-Bl IE-Al, IE-A2,IE-A3, IE-A4, IE-AS, IE-A6, IE-A7,IE-B2, IE-Cl, IE-C2, IE-C3, IE-C8, IE-Dl, IE-D2 Serial No.17-359 Docket No. 50-336, Page 43 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application Marginal (*Note

1)

Marginal (*Note

1)

The ISLOCA report was reviewed, and the dominant event was failure of the RCP thermal barrier. Barrier CDF was estimated based on three parameters (PV IEF, Failure of Relief valve to Open and Operator action), and this failure dominated the ISLOCA.

Additional documentation is required to show that the information used in the analysis was applicable to MP2 design.

Operator actions for ISLOCA are treated with screening values. Error rate seems high and should be conservative (0.01).

Include statement with reference that opening of the relief has been judged to be sufficient to avoid downstream piping failure.

Many initiators are subsumed into the General Plant Transient (GPT) category and the Loss of Main Feedwater. There is no evidence that the progression of initiators, such as loss of condenser vacuum, were evaluated to ensure that they were consistent with the progression models for GPT or LMFW as appropriate. Note that for general transients, NU used only plant specific data and did show exactly where each trip was mapped.

Resolved.

Screening values are no longer used for any of the human failure events. Specifically for ISLOCA events, since it was not clear what indications would be available for breaks in charging and shutdown cooling lines, and what actions could be taken to isolate a break if it was found, these actions are assumed to fail (the HEP is set to 1.0).

Feasible actions have been recalculated based on updated scenario timing. The RCP thermal barrier portion of the accident sequence notebook was revised to address the concerns of this F&O.

Resolved.

In the current MPS2 PRA Model, the event contributes to the GPT initiator. A loss of condenser vacuum initiator fails the condensate and MFW systems, which in turn causes a loss of MFW, which contributes to failure of steam generator cooling (SGC). Similarly, failure of the instrument air system fails all of the components that are supported by instrument air. Thus equipment failures in the mitigation of these events may differ, but the contributions are summed for the GPT initiator.

Full Scope IE-Al, IE-A2, IE-CEOG 2000 AS, IE-A6, IE-B2 IE-OS Full Scope IE-Bl, IE-B2, IE-CEOG 2000 B3, IE-B4, IE-01, IE-02 & AS-Bl IE-06 Full Scope IE-01, IE-02 CEOG 2000 IE-08 Full Scope LE-Al, LE-A2, LE-CEOG 2000 A3, LE-A4, LE-AS, LE-C6, LE-CS &

L2-02 LE-C13 Full Scope LE-A2, LE-A3, LE-CEOG 2000 A4, LE-AS, LE-Bl, LE-Cl, LE-C2, LE-L2-04 C3, LE-C4, LE-C13 Serial No.17-359 Docket No. 50-336, Page 44 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application Marginal (*Note When sufficient plant-experience exists, purely plant-Resolved.

1) specific treatments were used for transient IEF calculations (GPT)." However, unless there is a basis The initiating event frequencies have been for not including plant in population of similar plants, recalculated using generic data Bayesian updated IE's should not be based on plant specific data alone.

with plant-specific data in subsequent model updates after the peer review. Also, all of the initiating event frequencies were recalculated for the 2011 Model update, and documented.*

Marginal (*Note The total frequency for LNP at Millstone is given as Resolved.

1) 0.024. This is about 1/2 of the latest generic frequency for LNP. There is limited documentation on The LNP frequency in the model has been modified the basis for excluding specific events. The process to distinguish among the grid-related, weather-did assume that all events that occurred when a plant related and plant-centered initiating events. The was shut down should be excluded. This is not LNP frequencies were calculated using both plant-necessarily a valid assumption.

specific and generic data for the 2011 Model update, and documented.

Marginal (*Note All of the documents associated with the Millstone 2 Resolved.

1)

PSA have a signoff block for independent review and independent review is required. None of the All documents related to the current PRA Model documents were signed, but this is because NU is in have been independently reviewed and approved.

the process of finalizing the latest update of the PSA.

Marginal (*Note There was no concise table mapping the values used Resolved.

1) for the CET fault tree basic events for each of the POSs.

The LERF notebooks that document this element of the PRA model were revised and enhanced the documentation of POSs.

Meets T-1 SGTR are sequences based on SO% degraded SG Resolved.

(*Note 1)

Tubes and WOG 1/7 scale results. This assumption may under-estimate SG releases that may be included The reference calculation has been superseded in in early releases.

the current model by EPRI TR-107623-Vl, so the issue is no longer a concern.

Full Scope CEOG 2000 L2-05 Full Scope CEOG 2000 MU-01 Full Scope CEOG 2000 MU-02 Full Scope CEOG 2000 QU-01

• • • • • • • • • • .i.. ~u**p~9*rt!p~ : : ***. *.**:

• .*. R~ql!irern~nt(st**

DA-C2, DA-C3 Serial No.17-359 Docket No. 50-336, Page 45 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application Meets

(*Note 1)

Inadequate

(*Note 1)

Inadequate

(*Note 1)

Inadequate

(*Note 1)

NU does not have a LERF analysis for the latest PRA update. The Millstone level 2 methodology has all of the key elements required in the NUREG-CR-6451 simplified LERF procedure, but does not have an explicit procedure for determining LERF.

It is recommended that NU consider developing a procedure to estimate LERF consistent with the new NRC LERF Procedure in NUREG-CR-6451.

Weaknesses are noted with the process to review for, document, track, and ensure timely completion of PRA changes.

During the initial presentations several pending changes or open items were identified. These and potentially other open items are not being formally captured.

The process described in the quantification report is difficult to follow. No basis was provided for the process of developing the delete term logic and the recovery patterns Resolved.

A LERF model is included in the current PRA Model.

Resolved.

The Dominion PRA group has implemented a PRA configuration control database, which captures and prioritizes all proposed PRA changes. The Dominion PRA group also has a process for performing PRA Model updates and upgrades, including the creation of all PRA products.

Resolved.

The Dominion PRA group has implemented a PRA configuration control database, which captures all proposed PRA changes.

Resolved.

Discussion of the quantification process has been updated and is described in the quantification documentation.

Full Scope DA-D3, QU-El, CEOG 2000 QU-E2, QU-E3, QU-E4 QU-02 Full Scope IE-D3, AS-BS, AS-CEOG 2000 B6, AS-C3, SC-C3, SY-C3, HR-13, DA-QU-03 E3, QU-B2, QU-B3, QU-B6,QU-B7, QU-B8,QU-Cl, QU-C2, QU-Dl, QU-D2, QU-D3, QU-DS, QU-El, QU-E2, QU-E3, QU-E4, QU-Fl, QU-F2, QU-F4, LE-G4 Full Scope QU-A4, QU-B4, CEOG 2000 QU-B6 & QU-F2 QU-04 Serial No.17-359 Docket No. 50-336, Page 46 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application Inadequate The quantification report does not describe the actual Resolved.

(*Note 1) process undertaken to perform the quantification, including the development of the sequence failure Discussion of the quantification process has been and success cutsets, mutually exclusive and recovery updated and is described in the quantification files, and delete term for the purpose of performing documentation.

the validation of the event trees prior to the conversion of the master fault tree.

Inadequate The PRA had been quantified with the top 500 cutsets Resolved.

(*Note 1) provided, but final documentation of the results, analysis of the dominant cutsets, evaluation of the Documentation for the analysis of quantification initiating event contributions, etc., were not complete results from the MPS2 PRA Model has been at the time of the review.

completed.

Marginal (*Note Millstone does not have a formal software control Resolved.

1) process in place to ensure that the PRA software versions being used are producing consistent and There is now a formal software control process in correct results.

place for the FTREX quantification engine to ensure consistent and correct results.

Full Scope QU-A2, QU-A4, CEOG 2000 QU-Dl, QU-D2, QU-D3, QU-D4, QU-05 QU-D6, LE-Fl Full Scope QU-A2, QU-A4, CEOG 2000 QU-Dl, QU-D2, QU-D3, QU-D4, QU-06 QU-D6, LE-Fl Full Scope QU-A2, QU-A4, CEOG 2000 QU-Dl, QU-D2, QU-D3, QU-D4, QU-07 QU-D6, LE-Fl Serial No.17-359 Docket No. 50-336, Page 47 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application Inadequate Many of the dominant sequences are a result of the Resolved.

(*Note 1) loss of 125 VDC. Apparently, on January 1, 1981 the supply breaker (DO 103) to the 125V DC load center The current modeling of partial and total loss of DC 201A was open during ground checks resulting in a power initiators is corrected. Recovery of DC reactor trip.

power is not credited in the current PRA Model.

NE personnel feel that this is readily recoverable. As a Loss of DC power causes the reactor to trip, but is result, a recovery factor of 10% (OARDCl) is used for tracked as a separate initiator, since other 125 VDC I Es %LDCA and %LDCB. The appropriateness equipment also fails, so the consequences are of this factor is not documented in the HR report. All worse than a typical general plant transient.

of the description fields are blank. Further, even if DC power is recovered this should cause a plant trip.

A loss of a single DC bus is a contributor to the loss Therefore, the plant trip frequency should be of an emergency AC bus (LACBUS) initiator.

increased.

Additional failures to other equipment dependent on DC power are still considered. Also, total loss of DC power (LOSSDC) remains a separate initiator.

Inadequate In general, operators or someone knowledgeable in Resolved.

(*Note 1) recovery possibilities should review the Millstone sequences. Many of the top sequences appear For model upgrades, top sequences are now being recoverable.

routinely reviewed for recoveries before the new model is released. Dominion believes that appropriate expertise exists among its PRA personnel to provide the meaningful review of the results. Also, in some instances, Operators have been used to review selected fault trees.

Inadequate It is overly conservative to always assume a 24 hr Resolved.

(*Note 1) mission for the EDGs.

The 24-hour EDG mission time assumption has been deleted and replaced with the probability of recovering AC power as a function of time.

Full Scope CEOG 2000 QU-08 Full Scope CEOG 2000 QU-09 Full Scope CEOG 2000 QU-11 Serial No.17-359 Docket No. 50-336, Page 48 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application

>

• supporting

• .*.... *.*.**.**.*.. *.*.. *.*.:.:.*.c

... *.*.*.*.a

.*. *. pa.*.. *.b.**.*.*... !

... i.t.. v.*.*.~*.*.. **.*......

i i ).... ** *: *)*/**** L Reql.iirewent(s) * "* +r C:~!~gofy (CC)

QU-A2, QU-A4, QU-01, QU-02, QU-03, QU-04, QU-06, LE-Fl QU-A2, QU-A4, QU-01, QU-02, QU-03, QU-04, QU-06, LE-Fl IE-03, AS-C3, SC-C3, SY-AS, SY-C3, HR-13, OA-E3, QU-A4, QU-B2, QU-B3, QU-01, QU-02, QU-03, QU-El, QU-E2, QU-E4, QU-F2, QU-F4, LE-G4 Inadequate

(*Note 1}

Inadequate

(*Note 1}

Inadequate

(*Note 1}

In Cutset 12, the OAROC recovery is being used to recover from a hardware failure, OCBK00103NF.

The MFW recovery factor, RECMFW, is being used to recover from LOCV and LMFW initiating events. The basis for this factor is not well documented.

The quantification report does not address (or appear to intend to address):

• asymmetric modeling or evaluate the validity of cutset results due to asymmetric modeling or actual plant asymmetries

• truncation limit validation

• sensitivity analyses

• uncertainty analysis

• dominant component importance analysis Resolved.

Recovery action OAROC is no longer modeled, so this F&O is no longer applicable.

Resolved.

The current PRA Model does not credit recovery of LMFW and loss of condenser vacuum events (note that loss of condenser vacuum events is now part of general plant transients). Note that the LMFW initiating event frequency is calculated assuming that the event in not recovered. The events in which a MFW pump trips but is quickly recovered are grouped with general transients.

Resolved.

The current PRA Model cutsets have been reviewed and all asymmetries can be explained. A truncation study is also performed is documented in the quantification notebook. Uncertainty analysis and sensitivity calculations have been performed as part of the quantification of the model. Review of the dominant component importances are performed prior to each model release.

Full Scope CEOG 2000 QU-13 Full Scope CEOG 2000 QU-16 Full Scope CEOG 2000 ST-03

. ~HPe(,rtlng

• .~c;r@ir~'!J~nt(s)

SY-A24, DA-C16, QU-AS, QU-Fl, QU-F2 QU-F4 IE-03, AS-BS, AS-86, AS-C3, SC-C3, SY-C3, HR-13, DA-E3, QU-86, QU-87, QU-88, QU-El, QU-E2, QU-E4, QU-F2, QU-F4, LE-G4 Serial No.17-359 Docket No. 50-336, Page 49 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application

.,:*************~~P!'l~i!i~y*********.******.**

. (:~~ggofy (C:(;:) ***

Inadequate

(*Note 1)

Inadequate

(*Note 1)

Marginal (*Note

1)

The quantification report and HRA report do not address the development of all the recovery actions.

Millstone did not perform any uncertainty analyses for this quantification, document any sensitivity studies on the impact of key assumptions, or populate the database with the error factors.

In the old MP2 flood analysis, NU apparently assumes that all flood barrier/flood doors will maintain their integrity under all conditions. There is no documentation of the flood door design bases that would support this implied assumption.

Resolved.

All of the operator actions were recalculated using the latest methodology with the EPRI HRA Calculator. The calculator file and the supporting HRA documentation address the development of all recovery actions.

Notebook HR.2 contains the revised calculations of the operator actions.

Resolved.

Uncertainty analysis and sensitivity calculations have been performed. Notebook QU.2 contains several sensitivities performed, and Notebook QU.3 documents the uncertainty analysis and additional sensitivity analyses.

Resolved.

A complete Internal Flooding (IF) model was developed, which includes failure offload barriers/flood doors to maintain their integrity based on the configuration of the door and the height of the flood.

Full Scope CEOG 2000 SY-02 Full Scope CEOG 2000 SY-03 Full Scope CEOG 2000 SY-04 SC-A2, SY-Al SC-A2, SY-Al SC-A2, SY-Al Serial No.17-359 Docket No. 50-336, Page 50 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application Marginal (*Note

1)

Marginal (*Note

1)

Marginal (*Note

1)

It appears that the AFW Motor and Turbine driven pumps are both Ingersoll Rand. The pumps appear similar enough to warrant common cause consideration of the pump itself.

The AFW turbine driven pump room is warm on entry and appears ventilated. There is no basis in the AFW system analysis noted for excluding this dependency.

Following a trip, the operators take control of AFW.

Without this, the steam generators could overfill. This is not modeled or documented in the AFW system analysis.

Resolved.

A common cause failure event representing the mechanical (pump) portion of the 3 auxiliary feedwater pumps to start was added. Similarly, a common cause failure event representing the mechanical portion of the 3 auxiliary feedwater pumps to run was added.

Resolved.

The equipment in the AFW pump rooms, which are located in the Turbine Building, is qualified to operate even during a HELB event in the Turbine Building. Therefore, ventilation is not required in the PRA Model, and no compensatory measures are needed.

Resolved.

If operators fail to control the SG level, the SGs may over-fill, which may cause the Terry Turbine to fail.

This is modeled in the current MPS2 PRA Model, and the action is included in the AFW system notebook.

Full Scope CEOG 2000 SY-05 Full Scope CEOG 2000 SY-08 SC-A2, SY-Al SC-A2, SY-Al Serial No.17-359 Docket No. 50-336, Page 51 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application Marginal (*Note

1)

Marginal (*Note

1)

The failure likelihood of a component should be related to the surveillance interval. In the system analysis document, this is addressed through the use of FEFs. Currently the intent of the FEFs as laid out in the system analysis guideline is not being implemented. This means that a component with a surveillance interval of once every refueling outage has the same failure rate as a same type of component monitored monthly.

In the ESAS Fault Tree analysis, the failures of isolators and power supplies are not considered.

Resolved.

All FEFs were removed from the MPS2 model, and the time dependent failure modes will account for infrequently tested components when demanded.

Resolved.

The failure of isolators and power supplies falls within the logic of the circuitry and is now within the component boundary of the associated SSC.

Full Scope SY-A3, SY-A6, SY-CEOG 2000 A7, SY-A8, SY-All, SY-A12, SY-SY-09 Cl, SY-C2, DA-Al Full Scope SY-A3, SY-A6, SY-CEOG 2000 A7, SY-A8, SY-All, SY-A12, SY-SY-10 Cl, SY-C2, DA-Al Full Scope SC-A2, SY-A6, SY-CEOG 2000 A7, SY-All, SY-A12 SY-11 Serial No.17-359 Docket No. 50-336, Page 52 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application Inadequate PSA Guideline #4 "System Modeling", section 4.8.2, Resolved.

(*Note 1) application of modeling assumption to neglect passive components may be too general. The basis for Within the Millstone Unit 2 model, important screening the passive components is that the failure passive component contributors have been likelihood of the passive component is two decades modeled. Examples of these include: CST, RWST, less than the next most dominant modeled RBCCW and TBCCW heat exchangers, SI check contributor. In certain cases, this is not met.

valves gross leakage/rupture, condenser, rupture of LPSI piping, SITs and numerous breakers ir:i Electrical Power system failing to remain closed.

Within the system analyses, flow diversion paths in which valves failing to remain closed were evaluated and placed in the model if determined to be of importance.

In other cases, passive failures were not modeled since their contribution would be orders of magnitude lower than other system failures and not a significant contributor. These were addressed within the system analyses.

Inadequate PSA Guideline #4 "System Modeling" 4.8.2 assumption Resolved.

(*Note 1) to neglect modeling passive components may hide their importance when performing analyses with Within the Millstone Unit 2 model, important equipment OOS. Given an application of the model in passive component contributors have been which the component is configured as running, but modeled. In other cases, passive failures were not must continue operation, then this modeling modeled since their contribution would be orders technique could indicate that essential will not fail, of magnitude lower than other system failures and since passive failures are neglected and fail to not a significant contributor. These were start/transfer would be falsed.

addressed within the system analyses.

Meets The ESAS Fault Tree Analysis considers common cause Resolved.

(*Note 1) failure of each group of input sensors. This appears to be appropriate. However, common cause failure of Common cause failure of the sequencers has been the sequencers is not considered.

explicitly modeled.

Full Scope AS-B3, SY-AS, SY-CEOG 2000 A18, SY-A21, SY-A22, SY-B14 SY-13 Full Scope CEOG 2000 SY-16 Full Scope AS-A9, SC-A6, SC-CEOG 2000 Bl, SC-B2, SC-B3, SC-B4 TH-05 Full Scope SC-A6, SC-Bl, SC-CEOG 2000 B3, SC-B4 TH-07 Serial No.17-359 Docket No. 50-336, Page 53 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application Meets

{*Note 1)

Meets

{*Note 1)

Meets

(*Note 1)

Marginal (*Note

1)

It is assumed that containment sump screens will not become plugged during recirculation. This is not a standard assumption and would need strong justification. It is recommended that this failure mode be included in the model.

There is a mismatch for AFW between the common cause factors documented and the basic event factors documented.

Hot-side/cold-side (HS/CS) injection is conservatively applied to small LOCAs. HS/CS for small LOCAs is not necessary for small LOCAs even with DB assumptions.

A more realistic treatment of the issue should reduce risk contribution, and simplify modeling.

ATWS does not reference the CEOG standard and uses head lift failure criteria. The general approach used appears conservative since it relies on early generation CESEC calculations in early CE documents.

Modified calculations show reduced ATWS pressure threat. This is offset by a more aggressive approach to utilize the 4300 psia failure limit. Using this approach will require consideration of failure to reseat issues

{hot side LOCA)

Resolved.

Since a single sump screen protects both recirculation inlets, a new basic event, representing plugging of the screen, was added to the model.

Resolved.

The common cause failure events for the PRA Model were recalculated.

Resolved.

Boron precipitation control has been removed from the small LOCA event tree.

Resolved.

The current PRA Model assumes a peak pressure limit of 3700 psia as defined in the CEOG guidance document, CE NPSD-591-P. The higher peak pressure limit of 4300 psia is no longer credited.

Fifid' l\\JUm Full Scope CEOG 2000 TH-08 Full Scope CEOG 2000 TH-10 Full Scope CEOG 2000 TH-11 sMep~f~irig*****************

• • • • ~.~9~ire~*~9t@.*.*t SC-A6, SC-Bl, SC-B3, SC-B4 SC-A6, SC-Bl, SC-B3, SC-B4 SC-A6, SC-Bl, SC-B3, SC-B4 Serial No.17-359 Docket No. 50-336, Page 54 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application

• • • • c~p~~it.i~v*********./

~.*.ate.**goi'Y (cc. ).*.*.*. ****

Marginal (*Note

1)

Marginal (*Note

1)

Marginal (*Note

1)

Plant specific analyses used for many scenarios.

Generally this is a strength. However, some calculations used for event timings were referenced to CY. Unclear how this information is used in MP2 PSA.

RELAP 5-Mod 2 used for F&B (strength) however many analyses use early plant conditions and less sophisticated codes. Timings for these analyses will be distorted. For RELAP calculations, this issue appears to be met.

The Feed and Bleed methodology reflects the new steam generator design (lower inventory at SG low level). No success is credited under any circumstances without ADVs. In addition, the criteria are not modified for longer term Feed and Bleed scenarios.

The available time documented is confusing and in some cases based on early generation analyses, and it should be redone.

Sump recirculation time calculation does not include consideration of Containment Spray injection. This may cause underestimation of the operator time available for initiating sump recirculation.

Resolved.

The thermal/hydraulic analyses have been updated using the MAAP4 and RELAPS computer codes.

The references to CY event timings are no longer in any of the documentation. The success criteria were updated based on the new analysis.

Resolved.

New success criteria for once-through-cooling (bleed and feed) have been established based on MAAP4 analyses. The results show that it is possible to perform successful OTC without ADVs.

Confirmation of the MAAP4 results was made for a loss of normal power scenario using RELAPS.

Resolved.

An operator action to manually initiate sump recirculation, given failure of automatic actuation, is included in the current MPS2 PRA Model with updated timing.

Full Scope CEOG 2000 TH-12 Full Scope CEOG 2000 TH-14 Serial No.17-359 Docket No. 50-336, Page 55 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application

• .*******Su P~.~r~.!h&' !!<!****

• 1* ** ********** Eal?~ ~ilJty.***.

Requir~m~r1t(s).***** **

c~tE!~o..Y (C:C)

• SC-A6, SC-Bl, SC-B3, SC-B4 SC-A6, SC-Bl, SC-B3, SC-B4 Marginal (*Note

1)

Marginal (*Note

1)

Do not use IREP for Calvert Cliffs, as Calvert Cliffs doesn't support its general conclusions.

Timing results for actions following LOCAs appear conservative. CY results may not be applicable to MP2 Resolved.

The reference to IREP for Calvert Cliffs is believed to refer to the upper boundary of the medium LOCA breaks. The primary reference for these break size classification is the Combustion Engineering report CEN-114-P. The Calvert Cliffs IREP is mentioned only as a secondary reference.

No changes are made to the documentation.

Resolved.

All of the operator actions were recalculated using the updated methodology in the EPRI HRA calculator. The timing for manually initiating sump recirculation for LOCA events was determined using MAAP4 calculations. The timing for switchover to hot-side/cold-side injection for boron precipitation control and subsequent actions for valve alignments is not important since the actions occur 8-10 hours after the event. The success criteria for bleed and feed have been established based on MAAP4 analyses for various scenarios and mitigating equipment alignments.

Full Scope CEOG 2000 TH-15

• • • x**~~*~~§r~.i.~~****.

      • fi;

iR~qµi.refo~nt(s)*;

......, *=*~*.,.::*..

SC-Bl, SC-B3, SC-B4, SC-BS & SY-B7 Serial No.17-359 Docket No. 50-336, Page 56 of 59 Table 7-2 Impact of Open Peer Review Findings and Self-Assessment Items on Application Marginal {*Note

1)

Detailed room heatup calculations performed for many areas. When not performed, qualitative assessments were made. The AFW rooms were not assessed. Control Room assessed via analogy with Calvert Cliffs. Calvert Cliffs doesn't agree with assessment. Other unanalyzed rooms conservatively assumed to require ventilation.

Resolved.

The scenarios that could lead to core damage due to loss of control room ventilation have been evaluated, and they have been excluded from the model based on low contribution to CDF. Where available, detailed room heatup calculations are used to justify whether ventilation should be included in the model or not. For areas where ventilation is required or a calculation has not yet been developed, a dependency on ventilation is modeled for equipment in the room.

• Note 1 -The 2000 CEOG peer review assessed the model against the requirements of NEI 00-02. For sub-elements of the NEI standard that were reviewed and applicable, the compliance level is listed as Inadequate, Marginal, or Meets.

In cases where a finding applied to multiple sub-elements, the most limiting compliance level was selected. No correlation is available between the compliance levels from the CEOG peer review and the RG 1.200 Rev. 2 capability categories.

8.

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[1 O]

[11]

[12]

[13]

[14]

[15]

REFERENCES Serial No.17-359 Docket No. 50-336, Page 57 of 59 Industry Guideline for Implementing Performance-Based Option of 10 CFR Part 50, Appendix J, NEI 94-01 Revision 2-A, October 2008.

Risk Impact Assessment of Revised Containment Leak Rate Testing Intervals, EPRI, Palo Alto, CA EPRI TR-104285, August 1994.

An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Regulatory Guide 1.17 4 Revision 1,

November 2002.

Response to Request for Additional Information Concerning the License Amendment Request for a One-Time Integrated Leakage Rate Test Extension, Letter from Mr. C. H.

Cruse (Calvert Cliffs Nuclear Power Plant) to NRC Document Control Desk, Docket No.

50-317, March 27, 2002.

Performance-Based Containment Leak-Test Program, NUREG-1493, September 1995.

Letter from R. J. Barrett (Entergy) to U.S. Nuclear Regulatory Commission, IPN-01-007, January 18, 2001.

United States Nuclear Regulatory Commission, Indian Point *Nuclear Generating Unit No. 3 - Issuance of Amendment Re: Frequency of Performance-Based Leakage Rate Testing (TAC No. MB0178), April 17, 2001.

Impact of Containment Building Leakage on LWR Accident Risk, Oak Ridge National Laboratory, NUREG/CR-3539, ORNL/TM-8964, April 1984.

Reliability Analysis of Containment Isolation Systems, Pacific Northwest Laboratory, NUREG/CR-4220, PNL-5432, June 1985.

Technical Findings and Regulatory Analysis for Generic Safety* Issue 11.E.4.3 Containment Integrity Check, NUREG-1273, April 1988.

Review of Light Water Reactor Regulatory Requirements, Pacific Northwest Laboratory, NUREG/CR-4330, PNL-5809, Vol. 2, June 1986.

Shutdown Risk Impact Assessment for Extended Containment Leakage Testing Intervals Utilizing ORAM', EPRI, Palo Alto, CA TR-105189, Final Report, May 1995.

Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants, NUREG-1150, December 1990.

United States Nuclear Regulatory Commission, Reactor Safety Study, WASH-1400, October 1975.

Letter from J. A. Hutton (Exelon, Peach Bottom) to U.S. Nuclear Regulatory Commission, Docket No. 50-278, License No. DPR-56, LAR-01-00430, dated May 30, 2001.

Serial No.17-359 Docket No. 50-336, Page 58 of 59

[16]

Risk Assessment for Joseph M. Farley Nuclear Plant Regarding ILRT (Type A)

• Extension Request, prepared for Southern Nuclear Operating Co. by ERIN Engineering and Research, P0293010002-1929-030602, March 2002.

[17]

Letter from D.E. Young (Florida Power, Crystal River) to U.S. Nuclear Regulatory Commission, 3F0401-11, dated April 25, 2001.

[18]

Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals, TR-1018243, Revision 2-A of 1009325, EPRI, Palo Alto, CA: 2008.

[19]

PAA Model Notebook MPS2-MC.1 Revision 1,

MPS2-R05e Interim Model Development, Dominion Energy, Inc., Millstone Power Station, September 2017.

[20]

NF-AA-PRA-101, Revision 7, Probabilistic Risk Assessment Procedures and Methods:

Purpose, Organization, and Use, Dominion Energy, Inc., July 2015.

[21]

PAA Model Notebook MPS2-LE.1 Revision 5, Level 2 Analysis, Dominion Energy, Inc.,

Millstone Power Station, August 2017.

[22]

Calculation Number PRA02NQA-03107S2, MACCS2 Model for Millstone Unit 2 Level 3 Application, Dominion Resources Services, Inc., Millstone Power Station, February 2004.

[23]

Calculation Number PRA03NQA-04057S2, Risk Impact Assessment of Extending Containment Type A Test Interval at Millstone 2, Dominion Resources Services, Inc.,

Millstone Power Station, December 2004.

[24]

Letter from D. A. Heacock (Dominion) to U.S. Nuclear Regulatory Commission, Millstone Power Station Units 2 and 3 Response to March 12 2012 Information Request: Supplemental Information Related to the Seismic Hazard and Screening Report for Recommendation 2.1, Docket Nos. 50-336/423, License Nos. DPR-65/NPF-49, dated July 21, 2014.

[25]

Individual Plant Examination of External Events, Millstone Power Station Unit 2, Northeast Utilities Service Company, December 1995.

[26]

PAA Risk Analysis Notebook MPS2-RA.023, Revision 0, Fire Risk Input for ILRT, Dominion Energy, Inc., Millstone Power Station, September 2017.

[27]

Millstone 2 IPE, Millstone Nuclear Power Station, Unit No. 2, Response to Generic Letter 88-20, Individual Plant Examination for Severe Accident Vulnerabilities, Northeast Utilities Service Company, December 1993.

[28]

Letter from P. B. Cowan (Exelon Generation Company, LLC) to U.S. Nuclear Regulatory Commission, "Response to Request for Additional Information - License Amendment Request for Type Test Extension", NRC Docket No. 50-277, May 2010.

[29]

Administrative Controls 5.5.15, "Containment Leakage Rate Testing Program",

Technical Specifications and Bases, North Anna Power Station Units 1and2, Dominion Resources Services, Inc., North Anna Power Station, January 2014.

Serial No.17-359 Docket No. 50-336, Page 59 of 59

[30]

ML15034A353, Virginia Electric and Power Company North Anna Power Station Units 1 and 2 Response to Request for Additional Information Proposed License Amendment Request Permanent Fifteen-Year Type A Test Interval, Letter from Virginia Electric Power Company to U.S. Nuclear Regulatory Commission, January 28, 2015

[31]

Calculation Number 07077-US(B)-003, Revision 4, MP2 Minimum Sump Water Level Following a Loss of Coolant Accident (LOCA), Dominion Nuclear Connecticut, Millstone Power Station, December 2012.

[32]

ML100270756, Results of Safety/Risk Assessment of Generic Issue 199, "Implications of Updated Probabilistic Seismic Hazard Estimates in Central and Eastern United States on Existing Plants," Appendix D, Seismic Core Damage Frequencies, U. S.

Nuclear Regulatory Commission, August 2010.

[33]

ML15133A381, North Anna Power Station, Unit Nos. 1 and 2, Issuance of Amendments to Extend Type A Test Frequency to 15 Years, Letter from U. S. Nuclear Regulatory Commission to Virginia Electric Power Company, June 2015.

[34]

CE NPSD-1182-P, Probabilistic Safety Assessment Peer Review Report, Combustion Engineering Owners Group, CEOG PRA Peer Review, January 2000.

[35]

PRA Model Notebook MPS2-Appendix A.1 Revision 3, Internal Events Model Independent Assessment, Dominion Resources Services, Inc., Millstone Power _Station, October 2012.

[36]

L TR-RAM-12-08, Focused Scope RG 1.200 PRA Peer Review Against the ASME PRA Standard Requirements For The Millstone Power Station Unit 2 Probabilistic Risk Assessment, Westinghouse Electric Company LLC, 2011 Westinghouse PRA Peer Review, September 2102.

[37]

ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, 2009

[38]

US Nuclear Regulatory Commission, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Regulatory Guide 1.200, Revision 2, March 2009

[39]

ASME/ANS RA-Sb-2005, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, 2005