ML18136A866

License Amendment Request: Vital Instrument Bus Inverter Allowed Outage Time (AOT) Extension

ML18136A866
Person / Time
Site:	Salem
Issue date:	05/16/2018
From:	Mcfeaters C Public Service Enterprise Group
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
LAR S18-02, LR -N18-0033
Download: ML18136A866 (156)

Text

{{#Wiki_filter:PSEG Nuclear LLC P.O. Box 236, Hancocks Bridge, New Jersey 08038-0236 PSEG Nuclear LLC LR -N 18-0033 LAR S18-02 MAY l6 '2018 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D.C. 20555-0001 Sale Generating Station, Units 1 and 2 10 CFR 50.90 Renewed Facility Operating License Nos. DPR-70 and DPR-75 NRC)Docket Nos. 50-272 and 50-311

Subject:

License Amendment Request: Vital Instrument Bus Inverter Allowed Outage Time (AOT) Extension In accordance with 10 CFR 50.90, PSEG Nuclear LLC (PSEG) hereby requests an amendment to Renewed Facility Operating License No. DPR-70 and DPR-75 for Salem Generating Station (Salem) Units 1 and 2. This license amendment request proposes changes to Technical Specification (TS) 3.8.2.1, "A. C. Distribution - Operating." The proposed change would increase the Vital Instrument Bus (VI B) Inverters allowed outage time (AOT) from 24 hours for the A, B and C inverters to 7 days and from 72 hours for the D inverter to 7 days. The proposed extended AOT is based on application of the Salem Probabilistic Risk Assessment (PRA), and on additional considerations and compensatory actions. The risk evaluation and deterministic engineering analysis supporting the proposed change have been developed in accordance with thm guidelines established in NRC Regulatory Guide 1.177, "An Approach for Plant-specific Risk-Informed Decisionmaking: Technical Specifications," and NRC Regulatory Guide 1.174, "An Approach for using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis." The proposed change will allow increased flexibility in the scheduling and performance of corrective maintenance, allow better control and allocation of resources, and reduce the potential for unplanned plant shutdowns. 95-2168 REV. 7/99

\\ MAY 16.2018 Page 2 LR-N18-0033 10 CFR 50.90 PSEG's technical and regulatory evaluation of this LAR and the TS change are provided in an enclosure to this letter which includes the supporting risk-informed evaluation of the proposed change. The proposed change has been evaluated in accordance with 10 CFR 50.91 (a)(1 }, using the criteria in 10 CFR 50.92(c}, and it has been determined that this request involves no significant hazards considerations. There are no regulatory commitments contained in this letter. PSEG requests NRC approval of the proposed License Amendment within one year of submittal acceptance to be implemented within 60 days of issuance. In accordance with 10 CFR 50.91 (b)(1 ), a copy of this request for amendment has been sent to the State of New Jersey. If you have any questions or require additional information, please contact Mr. Lee Marabella at (856) 339-1208. I declare under penalty of perjury that the foregoing is true*and correct. Executed on _ __;;.s-_/J_l 6_1._1-=1 ___ (Date) Charles V. McFeaters Site Vice President Salem Generating Station

Enclosure:

Request for Changes to Technical Specifications C. Administrator, Region I, NRC Project Manager, NRC NRC Senior Resident Inspector, Salem Mr. P. Mulligan, Chief, NJBNE Mr. L. Marabella, Corporate Commitment Tracking Coordinator Mr. T. Cachaza, Salem Commitment Tracking Coordinator

LR-N18-0033 LAR S18-02 Enclosure Request for Changes to Technical Specifications

LR-N18-0033 LAR S18-02 Enclosure SALEM GENERATING STATION UNITS 1 AND 2 RENEWED FACILITY OPERATING LICENSE NOs. DPR-70 AND DPR-75 NRC DOCKET NOs. 50-272 AND 50-311 License Amendment Request: Inverter Allowed Outage Time (AOT) Extension Table of Contents 1.0

SUMMARY

DESCRIPTION....................................................................................... 2 2.0 DETAILED DESCRIPTION....................................................................................... 2 2.1 System Design and Operation........................................................................... 2 2.2 Current Technical Specifications Requirement.................................................. 7 2.3 Reason for the Proposed Change..................................................................... 7 2.4 Description of the Proposed Change............................................................... 10

3.0 TECHNICAL EVALUATION

.................................................................................... 10 3.1 Deterministic Assessment............................................................................... 10 3.1.1 Defense in Depth.................................................................................. 10 3.1.2 Safety Margin........................................................................................ 13 3.2 Risk Assessment............................................................................................. 13 3.2.1 PRA Quality and Technical Adequacy................................................... 14 3.2.2 Probabilistic Risk Assessment Results.................................................. 25 3.2.3 External Event Considerations.............................................................. 32 3.2.4 Uncertainty Evaluations........................................................................ 45 3.2.5 Tier 2 - Avoidance of Risk - Significant Plant Configurations............... 55 3.2.6 Tier 3 - Risk-informed Configuration Management............................... 55 3.2.7 Risk Summary and Conclusion............................................................. 57

4.0 REGULATORY EVALUATION

............................................................................... 61 4.1 Applicable Regulatory Requirements/Criteria................................................... 61 4.2 Precedent........................................................................................................ 62 4.2.1 License Amendments......................................................................... 62 4.2.2 Notices Of Enforcement Discretion.................................................... 63 4.3 No Significant Hazards Consideration Analysis............................................... 63 4.4 Conclusion...................................................................................................... 65

5.0 ENVIRONMENTAL CONSIDERATION

.................................................................. 65

6.0 REFERENCES

....................................................................................................... 66 ATTACHMENTS:

1. Technical Specification Page Markups

2. PRA Standard Supporting Requirements

3. Simplified Drawing of Typical Inverter

LR-N18-0033 LAR S18-02 Enclosure 1.0

SUMMARY

DESCRIPTION This license amendment request proposes a change which would revise Salem Technical Specification (TS) ACTION 3.8.2.1.b concerning inoperable Vital Instrument Bus (VIB) Inverters. The proposed change would increase the VIB Inverters allowed outage time (AOT) from 24 hours to 7 days for the A, B and C inverters and from 72 hours to 7 days for the D inverter. The proposed change is based on application of the Salem Generating Station (Salem) Probabilistic Risk Assessment (PRA) in support of a risk-informed extension, and on additional considerations and compensatory actions. 2.0 DETAILED DESCRIPTION 2.1 System Design and Operation The safety related 115V A.C. instrument and control power system is divided into four independent power supply channels (A, B, C, and D) for each unit, designed to provide reliable uninterrupted source of power for reactor control instrumentation, reactor protection instrumentation and safety-related equipment. Each channel supplies its associated safety related electrical load group. Vital instrument bus loads are assigned to load groups such that a loss of any one vital instrument bus will not will prevent the operation of the required safety systems during a postulated design basis event. Each of the four 12kVA 115V A.C. vital instrument buses in each unit receives power from its own individual Uninterruptible Power Supply (UPS). Each UPS consists of a rectifier which converts normal source A.C. power from the vital 230V A.C. bus to 125V D.C., and a static inverter which then converts power from D.C. to A.C. In the event of a 230V A.C. power loss or a UPS rectifier malfunction, the corresponding 125V D.C. vital station battery will automatically supply power to the UPS Inverter via the UPS auctioneering circuit, to maintain uninterruptible A.C. output power. Each UPS also contains a 12kVA A.C. Line Regulator and Static Switch that receives Alternate Power Source, vital 230V A.C. power, from the same normal source vital 230V A.C. bus. In the event of a UPS Inverter malfunction, the Static Switch senses a loss of Inverter output voltage and automatically fast transfers the associated vital instrument bus loads to the A.C. Line Regulator 115V A.C. output. When the UPS Inverter voltage returns to normal, the Static Switch will automatically return the associated vital instrument bus loads to the Inverter output. The following table depicts channel designations for each vital instrument bus power feed. A simplified drawing of a typical inverter is provided in Attachment 3. Battery Feed to Power Supply 230V A.C. Normal Power Source 230V A.C. Alternate Power Source No. 1A Vital Bus A A A No. 1B Vital Bus B B B No. 1C Vital Bus C C C No. 1D Vital Bus B B B

LR-N18-0033 LAR S18-02 Enclosure Loss of Vital Instrument Bus With a VIB UPS inverter inoperable, the 115V A.C. vital instrument bus is energized from the vital 230V A.C. bus via the A.C. line regulator. In the event of a loss of offsite power (LOP), the affected vital instrument bus will experience a loss of power. Safety function would not be lost as redundant equipment would be available with only one VIB de-energized. The associated EDG can be manually started and loaded in accordance with existing operating procedures if required to restore power. TS 3.8.2.1 Action b requires the vital instrument bus to be energized within 8 hours or to be in at least HOT STANDBY within the next 6 hours. A detailed description of the actions which the operators are directed to perform for the loss of each vital A.C. instrument bus is provided below. Abnormal operating procedures S1(2).OP-AB.115-0001(0002)(0003)(0004), Loss of 1(2)A(B)(C)(D) Vital Instrument Bus are the primary governing procedures for addressing this abnormal condition. Operator actions would focus on mitigating the transient effects, entering the applicable TS Action Statements and coordinating with Maintenance personnel on the restoration of the inverter. Attachments to these procedures provide a description of the effects on the loss of that inverter and the significant effects are summarized below. Unit 1 component designations are used. The principal loss of vital instrument bus effects are listed in the table below: Components/Functions Affected by Loss of Vital Instrument Bus A B C D Associated Solid State Protection System (SSPS) Trains A & B Input Relays X X X X Associated Safeguards Equipment Controller (SEC) Power Supply X X X Associated Source Range (SR), Intermediate Range (IR) Nuclear Instrumentation (NI) X X Associated Power Range (PR) NI X X X X Emergency Diesel Generator (EDG) Volt, Amp, Watt, and Frequency X X X SSPS Train A Power Supply X X SSPS Train B Power Supply X X SSPS Train A Output Relays X SSPS Train B Output Relays X Steam Dump Train A X Steam Dump Train B X Control rods automatic insertion X Auto/manual rod withdrawal blocked X X X Auto/manual rod motion not available X Loss of CFCU instrumentation X X X Auxiliary Feedwater (AFW) Steam Generator inlet valves fail closed X X X Loss of 13 AFW Pump speed control and indication X Letdown Heat Exchanger CCW outlet control valve closes in automatic X Pressurizer level control (conditional) X X X X Control Area Ventilation (CAV) accident pressurized mode initiation X X Residual Heat Removal (RHR) Heat Exchanger (HX) Outlet Flow Control Valve fails open X X Pressurizer spray valves fail closed X

LR-N18-0033 LAR S18-02 Enclosure Loss of 1A 115V Vital Instrument Bus Effects of loss of power to the 1A 115V vital instrument bus are summarized below. Channel I Turbine Steamline Inlet Pressure transmitter (PT-505) fails to the no-load value. Control Rods will step in at the maximum rate due to the resulting Tavg/Tref mismatch. An immediate action in the associated abnormal operating procedure directs the Rod Bank Selector Switch to be placed in manual to stop undesirable Control Rod motion. The Steam Dump System is aligned in Main Steam Pressure Control mode due to the demand signal generated in Tavg mode. Pressurizer heaters will de-energize and letdown will isolate if Channel I is selected for pressure and level control. The associated abnormal operating procedure directs Pressurizer control channels to be transferred to unaffected channels to remove erroneous input from protection and control processors. The Letdown Heat Exchanger CCW outlet control valve closes in automatic. The associated abnormal operating procedure provides direction to operate the control valve in manual and restore letdown if flow was isolated. The Chemical and Volume Control System auto makeup initiates. The Boric Acid Flow Control Valve 1CV172 fails open and Primary Water Flow Control to Blender Valve 1CV179 fails closed. The associated abnormal operating procedure directs Charging Pump suction to be aligned to the refueling water storage tank (RWST) if Volume Control Tank level cannot be maintained. Primary Water Flow Control to Blender Valve 1CV179 fails closed and CVCS Makeup system auto makeup initiates. The associated abnormal operating procedure directs Charging Pump suction to be aligned to the refueling water storage tank (RWST) if VCT level cannot be maintained. Source and intermediate range nuclear instrumentation trip logic is one out of two for each range. Reactor trip would occur on source range if power was below Reactor Trip System interlock P-6 and on intermediate range if power was below 10% rated thermal power. Channel I bistables for the 1N41 Power Range Nuclear Instrumentation (NI) trip. The associated abnormal operating procedure directs 1N41 to be placed in a tripped condition to adjust control rods in manual and maintain RCS Tavg within the program range. The AFW steam generator level control valves 13AF21 and 14AF21 fail closed. The associated abnormal operating procedure directs operators to locally control 13 and 14AF21 valves if the 11 Auxiliary Feed Pump is required to maintain steam generator levels. Failure of 11 Component Cooling (CC) system header pressure instrumentation generates start signals to all CC pumps. The associated abnormal operating procedure directs operators to stop any CC pumps not required to support current plant operation.

LR-N18-0033 LAR S18-02 Enclosure CFCU 11 outlet water temperature and flow indication and leak detection instrumentation will be lost. The associated abnormal operating procedure directs operators to stop 11 CFCU as a precautionary measure due to loss of temperature, Service Water flow and leak detection indications. The remaining CFCUs may be placed in service to provide containment cooling capabilities. The Unit 1 Control Area Ventilation (CAV) system initiates in accident pressurized mode due to loss of CRIX relay Train "A". The associated abnormal operating procedure provides direction to place the CAV system in the single train operating mode with Unit 2 supplying. CAV is a shared system between Unit 1 and Unit 2 with each unit providing a single train of the two train system. 11 RHR HX Outlet Flow Control Valve 11RH18 will fail open. The associated abnormal operating procedure directs the unaffected 12 RHR loop to be placed in service if required. Loss of 1B 115V Vital Instrument Bus Effects of loss of power to the 1B 115V vital instrument bus are summarized below. Source and intermediate range nuclear instrumentation trip logic is one out of two for each range. Reactor trip would occur on source range if power was below Reactor Trip System interlock P-6 and on intermediate range if power was below 10% rated thermal power. Channel II bistables for the 1N42 Power Range NI trip. The associated abnormal operating procedure directs operators to evaluate placing 1N42 Power Range NI in the tripped condition. The AFW steam generator level control valves 11AF21 and 12AF21 fail closed. The associated abnormal operating procedure directs operators to locally control 11 and 12AF21 valves if the 12 Auxiliary Feed Pump is required to maintain steam generator levels. Failure of 12 Component Cooling (CC) system header pressure instrumentation generates start signals to all CC pumps. The associated abnormal operating procedure directs operators to stop any CC pumps not required to support current plant operation. 12 and 14 CFCU indicating instrumentation will be lost. The associated abnormal operating procedure directs operators to stop 12 and 14 CFCUs as a precautionary measure due to loss of temperature, Service Water flow and leak detection indications. The remaining CFCUs may be placed in service to provide containment cooling capabilities. The Unit 1 Control Area Ventilation (CAV) system initiates in accident pressurized mode due to loss of CRIX relay Train "B". The associated abnormal operating procedure provides direction to place the CAV system in the single train operating mode with Unit 2 supplying.

LR-N18-0033 LAR S18-02 Enclosure Temperature and differential pressure (DP) control instrumentation for Auxiliary Building Ventilation will be lost. The alarm response and system operating procedures provide direction to maintain minimum negative pressure within the Auxiliary Building boundary. 12 RHR HX Outlet Flow Control Valve 12RH18 will fail open. The associated abnormal operating procedure directs the unaffected 11 RHR loop to be placed in service if required. Channel II Turbine Steamline Inlet Pressure transmitter (PT-506) fails to the no-load value. The associated abnormal operating procedure directs the Steam Dump System to be aligned in Main Steam Pressure Control mode due to the demand signal generated in Tavg mode. Loss of power to pressurizer level comparator 1LC460D-C results in Letdown isolation and loss of all pressurizer heaters. The associated abnormal operating procedure provides direction to supply temporary power to re-energize 1LC460D-C to restore letdown. Loss of 1C 115V Vital Instrument Bus Effects of loss of power to the 1C 115V vital instrument bus are summarized below. Letdown will isolate if Channel III is selected for pressure and level control. The associated abnormal operating procedure directs Pressurizer control channels to be transferred to unaffected channels. This will allow Letdown to be restored. Pressurizer spray valves fail closed. The associated abnormal operating procedure directs the Pressurizer Pressure Control System to be operated in manual The AFW steam generator level control valves 11-14AF21 fail as-is. A redundant flow path and local manual valve control are available. Channel III bistables for the 1N43 Power Range Nuclear Instrumentation (NI) trip. The associated abnormal operating procedure directs operators to evaluate placing 1N43 Power Range NI in the tripped condition. 13 and 15 CFCU indicating instrumentation will be lost. The associated abnormal operating procedure directs operators to stop 13 and 15 CFCUs as a precautionary measure due to loss of temperature, Service Water flow and leak detection indications. The remaining CFCUs may be placed in service to provide containment cooling capabilities. Loss of 1D 115V Vital Instrument Bus Effects of loss of power to the 1D 115V vital instrument bus are summarized below. Charging Line Seal Pressure Control Valve 1CV71 fails closed and Charging Flow Control Valve 1CV55 fails open. The associated abnormal operating procedure directs local valve operation.

LR-N18-0033 LAR S18-02 Enclosure Loss of power to pressurizer level comparator 1LC459C results in Letdown isolation and loss of all pressurizer heaters. The associated abnormal operating procedure provides direction to supply temporary power to re-energize 1LC459C to restore letdown. RHR HX Bypass Valve 1RH20 will fail open. The associated abnormal operating procedure directs operators to component cooling to the in-service RHR HX, as required to control RCS temperature. Channel IV bistables for the 1N44 Power NI trip. The associated abnormal operating procedure directs operators to evaluate placing 1N44 Power Range NI in the tripped condition. Control rods remain trippable. Manual and automatic rod movement is lost. The associated abnormal operating procedure provides direction to adjust Tavg adjusting turbine load, if the turbine is operating, or by operation of the Atmospheric Relief Valves. 2.2 Current Technical Specification Requirements For the sake of simplicity, Unit 1 component designations are used. The current TS 3.8.2.1, Onsite Power Distribution Systems, A.C. Distribution - Operating, Limiting Condition for Operability (LCO) provides a list of A.C. electrical buses which shall be OPERABLE and energized from sources of power other than diesel generators in MODES 1, 2, 3 and 4. This list includes the following: 115 volt Vital Instrument Bus # 1A and Inverter 115 volt Vital Instrument Bus # 1B and Inverter 115 volt Vital Instrument Bus # 1C and Inverter 115 volt Vital Instrument Bus # 1D and Inverter TS 3.8.2.1 ACTION b states, With one inverter inoperable, energize the associated A.C. Vital Bus within 8 hours; restore the inoperable 1A, 1B, or 1C inverter to OPERABLE and energized status within 24 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours; restore the inoperable 1D inverter to OPERABLE and energized status within 72 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours. The current 72 hour AOT for the D VIB inverter is based upon allowing increased operating flexibility because it does not affect the operation of any Safeguards Equipment Controller. The OPERABILITY of the A.C. and D.C. power sources and associated distribution systems during operation ensures that sufficient power will be available to supply the safety related equipment required for (1) the safe shutdown of the facility and (2) the mitigation and control of accident conditions within the facility. The minimum specified independent and redundant A.C. and D.C. power sources and distribution systems satisfy the requirements of General Design Criteria 17 of Appendix A to 10 CFR 50. 2.3 Reason for the Proposed Change Consistent with the objectives of the Nuclear Regulatory Commission's (NRC's) policy entitled "Use of Probabilistic Risk Assessment Methods in Nuclear Activities: Final Policy Statement,"

LR-N18-0033 LAR S18-02 Enclosure (Probabilistic Risk Assessment [PRA] Policy Statement, the amendment proposed herein provides (1) safety decision-making enhanced by the use of PRA insights, (2) more efficient use of resources, and (3) a reduction in unnecessary burden. The proposed inverter Allowed Outage Time (AOT) extension would provide these benefits by supporting the ability to complete on-line corrective or planned maintenance of an inoperable vital A.C. inverter. These benefits are described in the following table: Anticipated Benefits of Proposed Inverter AOT Extension NRC PRA Policy Statement Objective Enhanced Decision-making Efficient Use Of Resources Reduction In Unnecessary Burden Reduce the potential for unplanned unit shutdowns and minimize the potential need for NOED; X X X Increase the time to perform troubleshooting, repair, and testing following inverter equipment problems, which will enhance the safety and reliability of equipment and personnel; X X Allow time to perform routine maintenance activities on the inverters in MODES 1 through 4, enhancing the ability to focus quality resources on the activity and the availability of the inverters during refueling outage periods. X X X TS 3.8.2.1 Action b currently allows only 24 hours for an inoperable 115V A.C. VIB inverter A, B or C, and 72 hours for inverter D, to troubleshoot and repair, perform post-maintenance testing, and return the inoperable inverter to service. The current AOTs are based on engineering judgment, taking into consideration the time required to repair an inverter and the additional risk to which the unit is exposed because of the inverter inoperability. The 72 hour AOT for the D VIB inverter is based upon allowing increased operating flexibility because it does not affect the operation of any Safeguards Equipment Controller. Mitigating strategies have been implemented to address emergent issues within the current AOTs. These include prepared safety tagouts for inverter troubleshooting and repair, and maintaining stocks of capacitors and burned-in replacement circuit cards. However, as discussed below, the current AOTs can be insufficient in certain instances to support on-line troubleshooting, corrective maintenance, and post-maintenance testing in response to emergent issues. Salem performs preventative maintenance on the VIB inverters during refueling outages. There are no current plans to perform routine preventive maintenance on a scheduled basis at power. Should the need for such maintenance be identified as a result of component performance, the necessary preventive maintenance would be planned and scheduled in accordance with PSEG procedures for on-line work management. If an inverter becomes inoperable due to an emergent issue, the inverter troubleshooting and repair process requires proper electrical safety tagging to be established. A sequence of non-intrusive checks are performed prior to the inverter being de-energized for troubleshooting, including visual inspection for blown fuses, alarm conditions and breaker positions; and measurement of source and output voltages. Upon completion of repairs, and depending on which circuit cards have been removed and replaced, adjustments are performed. Post maintenance testing is required before returning the

LR-N18-0033 LAR S18-02 Enclosure UPS to service. Depending on the corrective maintenance, an inverter functional test may also be required. Experience both at Salem and at other nuclear power plants has shown that the current AOTs for restoration of an inoperable VIB inverter are insufficient in certain instances to support on-line troubleshooting, corrective maintenance, and post-maintenance testing while the unit is at power. Specifically, Salem has entered TS 3.8.2.1 LCO due to an inoperable inverter 5 times since 2009. The actual times in the LCO were 9 hours 28 minutes in 2009, 16 hours 39 minutes in 2014, 23 hours 33 minutes in 2016, 16 hours 47 minutes in 2017 and 32 hours 50 minutes in 2018 (for the D inverter): however in these instances, the cause of the failures was readily evident. This allowed the troubleshooting process to be minimized thereby allowing for a quick repair and subsequent testing. In each of the above instances, the inoperable inverter was returned to OPERABLE status within the allowed outage time. The emergent issues were quickly identified, replacement parts were readily available and extensive post-maintenance testing (PMT) and component tuning were not required. However, if the emergent issue had required complex troubleshooting or more extensive post-maintenance testing, or if backup, burnt-in replacement components were not available on site, or if qualified personnel were not immediately available, the process of returning the inverter to OPERABLE status could have taken more than the current AOTs. The recommended burn-in period for replacement circuit cards is 50 hours to properly ensure the integrity of the card. A review of 10 CFR 50.72 event notifications identified 3 instances since 2003 in which plant shutdowns were initiated as required by Technical Specifications when the time to complete inverter troubleshooting and repair exceeded the 24-hour allowed outage time. Other nuclear power plants have had similar instances of inverter failures prompting requests for enforcement discretion (NOED) and for License Amendments for inverter TS Completion Time extensions from 24 hours to 7 days. Callaway was granted enforcement discretion in 2012 for an additional period of 36 hours to restore an inverter to OPERABLE status. FPL Energy Seabrook, LLC received NRC approval of enforcement discretion for an 18-hour extension to the Seabrook Station AOT for an inoperable (i.e., failed) distribution panel inverter. The Nine Mile Point and Watts Bar nuclear stations also received enforcement discretion in 2003 and 2001, respectively, to extend the Completion Time for an inoperable distribution panel inverter. The NRC approvals of the above NOEDs and LARs for the Clinton, North Anna, Braidwood, Byron and Palo Verde Stations are detailed in Section 4.2 of this evaluation. These approved amendments demonstrate that the current Allowed Outage Times for restoration of an inoperable inverter can, in some cases, be insufficient to support on-line troubleshooting, corrective maintenance, and post-maintenance testing which could lead to unplanned unit shutdowns or to requests for enforcement discretion. The proposed AOT increase does not significantly increase the potential for a loss of required instrumentation. While operator actions are required in response to the inoperability of one inverter, the proposed change will reduce the immediate demands on the operations staff preparing for a potential plant shutdown. Once approved, this LAR will better focus the operators on risk significant actions, as compared to actions that are based upon qualitative completion times.

LR-N18-0033 LAR S18-02 Enclosure 2.4 Description of the Proposed Change The proposed TS changes (Unit 1 and 2 changes are identical) are described below for Unit 1. Both units changes are indicated on the marked up TS pages provided in Attachment 1 of this submittal. TS 3.8.2.1 ACTION b is being revised as shown below: With one inverter inoperable, energize the associated A.C. Vital Bus within 8 hours; restore the inoperable 1A, 1B or 1C inverter to OPERABLE and energized status within 24 hours7 days or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours; restore the inoperable 1 D inverter to OPERABLE and energized status within 72 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours.

3.0 TECHNICAL EVALUATION

3.1 Deterministic Assessment 3.1.1 Defense-In-Depth

1) Preservation of a reasonable balance among the layers of defense The proposed licensing basis change does not significantly reduce the effectiveness of a layer of defense that exists in the plant design before the implementation of the proposed licensing basis change.

The defense in depth approach to designing and operating Salem is used in order to prevent and mitigate accidents that could release radiation or hazardous materials. This approach provides for multiple independent and redundant layers of defense to compensate for potential human and mechanical failures which ensures that no single layer, no matter how robust, is exclusively relied upon. Defense in depth includes the use of access controls, physical barriers, redundancy, diverse key safety functions, and emergency response measures. The robust plant design to survive hazards and minimize challenges that could result in the occurrence of an event is not affected by the proposed change. The proposed extended AOT does not increase the likelihood of initiating events or create new significant initiating events. It simply provides a risk-informed basis for the completion time. There are a number of actions that are competed by the operations staff as required for the automatic response of the plant when there is a loss of a 115V A.C. vital instrument bus. This LAR has the effect of balancing some of the demands on the operations staff. Once approved, the LAR will permit more focused operator and maintenance technician attention upon risk significant actions, as compared to actions that are based upon qualitative AOTs. The availability and reliability of Systems, Structures or Components (SSCs) providing the safety functions that prevent plant challenges from progressing to core damage are not significantly impacted. The remaining OPERABLE 115 V A.C. inverters are capable of supplying the required loads to safely shutdown the plant.

LR-N18-0033 LAR S18-02 Enclosure The proposed extension of the AOT for one inverter to 7 days does not significantly reduce the effectiveness of the emergency preparedness program, including the ability to detect and measure releases of radioactivity, notify offsite agencies and the public, and shelter or evacuate the public as necessary.

2) Preservation of adequate capability of design features without an overreliance on programmatic activities as compensatory measures The proposed licensing basis change does not substitute programmatic activities for design features to an extent that significantly reduces the reliability and availability of design features to perform their safety functions without overreliance on programmatic activities.

No programmatic activities are required as compensatory measures to preserve adequate capability of design features during the extended AOT. Three inverter channels are sufficient to supply the safety related equipment required for (1) the safe shutdown of the facility and (2) the mitigation and control of accident conditions within the facility. Therefore, one inverter being inoperable does not impact the ability of the system to perform its required function. Salem uses abnormal operating procedures which provide direction for operator actions in response to a loss of a VIB inverter. Restoration of power to the associated 115V A.C. vital instrument bus and restoration of affected plant components to normal lineup are also controlled by plant procedures as referenced by the abnormal operating procedure. While timely actions are required when there is a loss of VIB inverter, this LAR will reduce the immediate demands on the operations staff preparing for a potential plant shutdown. Administrative controls consistent with other licensees that have received similar extensions of the inverter allowed outage time, as described in Section 4.2 of this Enclosure will be implemented. The administrative controls are qualitative, prudent actions. Entry into the extended inverter AOT will not be planned concurrent with EDG maintenance, and entry into the extended inverter AOT will not be planned concurrent with planned maintenance on another reactor trip system or ESF actuation system instrumentation channel that could result in that channel being in a tripped condition. These actions are taken because it is recognized that with an inverter inoperable and the vital instrument bus being powered by the backup A.C. distribution system, continued instrument power for that train is dependent on power from the associated EDG following a loss of power event.

3) Preservation of system redundancy, independence, and diversity commensurate with the expected frequency and consequences of challenges to the system, including consideration of uncertainty The proposed licensing basis change does not significantly reduce the redundancy, independence, or diversity of systems.

The proposed extended AOT makes no changes to the system operation or design and therefore has no effect on the expected frequency of challenges or result in a decrease in redundancy, independence, or diversity of the 115 V A.C. power system. Also, redundant power supplies and operator actions are not impacted by these changes. If a redundant

LR-N18-0033 LAR S18-02 Enclosure channel should fail or be taken out of service during the extended AOT, Salem would be in TS 3.0.3, requiring a plant shutdown. This requirement is unchanged by this LAR. The proposed extended AOT is consistent with the assumptions in the plants safety analysis, and does not result in a significant increase in risk.

4) Preservation of adequate defense against potential Common Cause Failures (CCFs)

The proposed licensing basis change does not significantly reduce defenses against CCFs that could defeat the redundancy, independence, or diversity of the layers of defense; fission product barriers; and the design, operational, or maintenance aspects of the plant. The extension requested does not reduce defenses against CCF. In fact, these extensions allow more deliberate and thorough troubleshooting following an emerging failure, which improves the causal evaluations performed for equipment issues. Better understanding of any emergent failure causes could lead to investigations or actions to improve the reliability of the unaffected inverters. In addition, the operating environment for these components remains unchanged and there are no changes to the design or operation of the inverters associated with the proposed change, so new common cause failure modes are not introduced. There are no changes to the common environment, inverter or support system design, therefore there are no changes to existing coupling factors. The extent of condition performed as a part of any failure of a safety-related piece of equipment will address these issues as required by plant administrative procedures. Therefore, the defense against potential CCFs remains adequate.

5) Maintain multiple fission product barriers The proposed licensing basis change does not significantly reduce the effectiveness of the multiple fission product barriers.

The fission product barriers (fuel cladding, reactor coolant system, and containment) and their effectiveness are maintained. The proposed changes do not affect the integrity of fission product barriers to limit leakage to the environment. Extending the AOT of the VIB inverters does not result in a significant increase in the frequency of existing challenges to the integrity of the barriers, significantly increase the failure probability of any individual barrier, or introduce new or additional failure dependencies among barriers.

6) Preserve sufficient defense against human errors The proposed licensing basis change does not significantly increase the potential for or create new human errors that might adversely impact one or more layers of defense.

The proposed extended AOT does not require any new operator actions for the existing plant equipment or introduce the potential for new human errors. OP-AA-108-116, Protected Equipment Program [19] incorporates compensatory measures which control what equipment or systems will not be allowed to be taken out of service concurrent with an inverter out of service for planned or unplanned maintenance. There is no change to the Configuration Risk Management Program and therefore there is no increase in the potential

LR-N18-0033 LAR S18-02 Enclosure for, or creation of new human errors that might adversely impact one or more layers of defense. No new operating, maintenance, or test procedures are required due to these changes, and no new at-power tests or maintenance activities are expected to occur as a result of these changes. The plant will continue to be operated and maintained as before.

7) Continue to meet the intent of the plants design criteria The proposed licensing basis change does not affect the plants ability to meet the intent of the design criteria referenced in the licensing basis.

The intent of the Salem design criteria is maintained. The plant will continue to be operated and maintained as before. The proposed changes do not involve any physical changes to the design or operation of the 115V A.C. distribution system. The ability of the remaining TS required inverters to perform their required functions is maintained during the extended AOT.

8) Integrated Evaluation of the Defense-in-Depth Considerations There are no changes to the current plant design. The intent of each defense-in-depth consideration addressed above would still be met following implementation of the proposed extended AOT. Therefore, the proposed licensing basis change maintains consistency with the defense-in-depth philosophy.

3.1.2 Safety Margin The impact of the proposed change is consistent with the principle that sufficient safety margins are maintained. Codes and Standards or alternatives approved for use by the NRC are met. The design and operation of the 115V A.C. distribution system is not changed by proposed increase of the AOT. The proposed change does not affect conformance with applicable codes and standards. Safety analysis acceptance criteria in the UFSAR are met. The safety analysis acceptance criteria, as stated in the Salem UFSAR, are not impacted by these changes. Redundant channels will be maintained. Diversity, with regard to ensuring that sufficient power will be available to supply the safety related equipment required for (1) the safe shutdown of the facility and (2) the mitigation and control of accident conditions within the facility will be maintained. The minimum specified independent and redundant A.C. and D.C. power sources and distribution systems will continue to satisfy the requirements of General Design Criteria 17 of Appendix "A" to 10 CFR 50. The proposed changes will not allow plant operation in a configuration outside the design basis. 3.2 Risk Assessment This risk assessment evaluates the proposed extension of the inverter Allowed Outage Times (AOT) from the current 24 or 72 hours to 7 days using the Salem Full-Power Internal Events (FPIE) PRA Model of Record - SA115A. The justification for the use of extended Allowed Outage Times (AOTs) for 115V A.C. inverters is based upon risk-informed and deterministic evaluations consisting of three main elements as cited in RG 1.177:

LR-N18-0033 LAR S18-02 Enclosure

1) Tier 1: Assessment of the impact of the proposed TS change using a valid and appropriate PRA model as compared with appropriate acceptance guidelines.

2) Tier 2: Evaluation of equipment relevant to plant risk while the inverter(s) are in the extended AOT. Combinations of out-of-service equipment can be evaluated for their risk significance to determine if additional compensatory measures may be required.

3) Tier 3: Implementation of the Configuration Risk Management Program (CRMP) while the inverter(s) is/are in the extended Allowed Outage Time. The CRMP is used for all work and helps ensure that there is no avoidable increase in plant risk while any inverter maintenance is performed. These programmatic measures provide additional assurance that critical plant safety functions are preserved during the extended inverter AOT.

This section addresses the Tier 1 risk assessment for the proposed extension of the inverter AOT. Tier 2 evaluations are supported by the examination of results, such as in Section 3.2.5, to determine if any specific failures dominate the results, and the modeled mitigation strategies discussed in Section 3.2.2.3. Plant configuration changes for planned and unplanned maintenance of the components as well as the maintenance of equipment having risk significance is managed by the Configuration Risk Management Program (CRMP). The CRMP helps ensure that these maintenance activities are carried out with no significant increase in the risk of a severe accident (Tier 3). 3.2.1 PRA Quality and Technical Adequacy The SA115A version of the Salem PRA model is the most recent evaluation of the risk profile at Salem for internal event challenges. The Salem PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, and common cause events. The PRA model quantification process used for the Salem PRA is based on the event tree and linked fault tree methodology, which is a well-known methodology in the industry. PSEG employs a multi-faceted approach to establishing and maintaining the technical adequacy and plant fidelity of the PRA models for all PSEG nuclear generation. This approach includes a proceduralized PRA maintenance and update process, which includes consideration of peer review Findings and Observations (F&Os) and their subsequent resolution. PRA quality is assured for the Salem PRA model and documentation through a combination of the following: Confirmation of the fidelity of the model with the as-built, as-operated plant (see Section 3.2.1.1) Use of methods and approaches consistent with the ASME PRA Standard Use of an Updating Requirement Evaluation (URE) database to track PRA model issues and potential enhancements (See Section 3.2.1.4) Use of a PRA Peer Review (see Section 3.2.1.3) to identify areas for enhancement Use of highly qualified PRA practitioners qualified under the PSEG PRA Risk Management Program Use of internal reviews and interviews with system engineers and operating crew members

LR-N18-0033 LAR S18-02 Enclosure 3.2.1.1 PRA Maintenance and Update The PSEG risk management process ensures that the applicable PRA model remains an accurate reflection of the as-built and as-operated plants. This process is defined in the PSEG Risk Management program, which consists of a governing procedure (ER-AA-600, "Risk Management") and subordinate implementation procedures. PSEG procedure ER-AA-600-1015 [10], "FPIE PRA Model Update" delineates the responsibilities and guidelines for updating the full power internal events PRA models at PSEG nuclear generation sites. The overall PSEG Risk Management program, including ER-AA-600-1015, defines the process for implementing regularly scheduled and interim PRA model updates, for tracking issues identified as potentially affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, industry operating experience), and for controlling the model and associated computer files. In a recent Safety Evaluation [48], the NRC stated that two changes incorporated into SA115A constitute a PRA upgrade. Incorporation of a plant modification that installed a fourth motor driven auxiliary feedwater pump that is independently powered by a separate diesel generator. Refinement of the station blackout event tree sequences to take into account use of FLEX equipment and update of loss of offsite power non-recovery data from Idaho National Laboratory. The impacts of these modifications on this LAR are assessed in a sensitivity analysis in Section 3.2.4.2.4 and actions are tracked in the URE database described in Section 3.2.1.4. To ensure that the current PRA model remains an accurate reflection of the as-built, as-operated plant, the Site Risk Management Engineer (SRME) reviews plant design modifications and any changes to plant procedures or calculations referenced in the PRA that could affect the risk profile and identifies any that need to be evaluated for consideration in future PRA updates. No new plant modifications or revision to plant procedures and calculations referenced in the PRA have been identified since the creation of the SA115A PRA model that would warrant an interim PRA update or that would affect the outcome of this PRA analysis for the inverter AOT extension. In addition to these activities, PSEG risk management procedures provide the guidance for particular risk management and PRA quality and maintenance activities. This guidance includes: Documentation of the PRA model, PRA products, and bases documents The approach for controlling electronic storage of Risk Management (RM) products including PRA update information, PRA models, and PRA applications Guidelines for updating the full power, internal events PRA models Guidance in the use of quantitative and qualitative risk assessments in support of the on-line work control process for risk evaluations of maintenance tasks (corrective maintenance, preventive maintenance, minor maintenance, surveillance tests and modifications) on systems, structures, and components (SSCs) within the scope of the Maintenance Rule (10CFR50.65 (a)(4))

LR-N18-0033 LAR S18-02 Enclosure In accordance with this guidance, regularly scheduled PRA model updates occur approximately every three years, with longer intervals being justified if it can be shown that the PRA continues to adequately represent the as-built, as-operated plant. PSEG completed the SA115A PRA model in December 2016, which was the result of a regularly scheduled update of the PRA model. 3.2.1.2 Pending Changes Identified Against the PRA Model A PRA tracking database record is created for all issues that are identified that could impact the PRA model. This database, the Updating Requirement Evaluation (URE) database includes the identification of those plant changes that could impact the PRA model. The plant modifications, procedure changes, and other PRA model issues identified in the URE database have been reviewed as part of the preparation of the risk assessment for the inverter AOT extension request. Only a few have been identified that could significantly affect the SA115A PRA model or its quantification. See Section 3.2.1.4 for more information regarding the URE database review. 3.2.1.3 Applicability of Peer Review Findings and Observations A PRA Peer Review of the Salem Rev. 4.1 PRA model was performed during November 2008. The peer review was performed against the ASME PRA Standard [4] using the process defined in Nuclear Energy Institute (NEI) 05-04 [11]. The PRA Peer Review resulted in a number of Findings and Observations (F&Os) that indicated that there were a number of supporting requirements (SRs) that were categorized as Not Met for Capability Category II. Since then, several subsequent model revisions (See Table below) were performed to address these F&Os. HISTORY OF SALEM GENERATING STATION PRA MODEL UPDATES MODEL REVISION DATE MODEL NAME INTERNAL EVENTS CDF (1/YR) INTERNAL EVENTS LERF (1/YR) TRUNCATION LIMIT COMMENTS July-93 IPE 6.40E-05 5.23E-06 NR Truncation limit not reported August-96 Model 1.0 5.13E-05 4.75E-06 NR Truncation limit not reported August-98 Model 2.0 5.23E-05 4.75E-06 1.00E-10 June-02 Model 3.0 5.20E-05 5.74E-06 1.00E-10 July-03 Model 3.1 4.10E-05 3.97E-06 1.00E-09 March-05 Model 3.2 2.48E-05 1.01E-06 1.00E-11 March-06 Model 3.2A 6.21E-05 7.61E-06 1.00E-11 No internal flood contribution March-08 Model 4.0 4.54E-05 NR 1.00E-11 No internal flood contribution; LERF results not reported September-08 Model 4.1 4.77E-05 5.06E-06 1.00E-11 March-09 Model 4.2 4.74E-05 5.06E-06 1.00E-11

LR-N18-0033 LAR S18-02 Enclosure HISTORY OF SALEM GENERATING STATION PRA MODEL UPDATES MODEL REVISION DATE MODEL NAME INTERNAL EVENTS CDF (1/YR) INTERNAL EVENTS LERF (1/YR) TRUNCATION LIMIT COMMENTS December-09 Model 4.3 2.55E-05 1.18E-06 1.00E-11 September-14 Model SA112A 1.55E-05 7.29E-07 1.00E-11 December-16 Model SA115A 8.38E-06 4.65E-07 1.00E-11 Table A-1 through Table A-10 in Attachment 2 summarize each of the F&Os identified during the peer review that was performed in November 2008 and reported in the peer review report [8] with a brief summary of the resolution for each. All changes made during the SA112A model update have been carried through to the SA115A model unless modified by later required changes. A listing of those Supporting Requirements (SRs) that were revised between the 2005 and the 2009 [14] versions of the ASME PRA Standard (as endorsed by RG 1.200) with a description of the change and associated comments is provided in Table A-11. In addition, a gap assessment was also performed against the NRC clarifications and qualifications in Appendix A of RG 1.200 Rev. 2 [5] with regard to the ASME Standard and the comments are tabulated in Table A-12. This assessment evaluates changes in the clarifications and comments between Rev. 1 and Rev. 2 of RG 1.200. Since the peer review already includes the RG 1.200 Rev. 1 clarifications and qualifications when assessing the technical adequacy of the model, no additional tabulation is needed for those. Subsequent to the November 2008 peer review, the SA115A PRA model addressed and resolved those SRs not meeting Capability Category II. Based on the PRA Peer Review process and the updated PRA model (SA115A), the Salem PRA model is deemed satisfactory for use in PRA applications. 3.2.1.4 URE Status The URE (Update Requirement Evaluation) database is a resource and working tool used by the Risk Management Team to ensure that the as-built, as-operated Salem plant configuration is reflected in the PRA. In addition, enhancements to the PRA quality are also identified, tracked, and resolved. The observations are recorded in the URE database. These observations identify potential areas of investigation for future model enhancement. This database was reviewed and potential impacts for open UREs are recorded below in Table 3-1. There are three UREs identified in Table 3-1 as a potential impact, SA2017-018 and SA2017-035 and SA2018-001. SA2017-018 identifies the need for 115V A.C. vital bus support dependency logic for SEC trains B and C, which includes inverter logic. SA2017-035 describes the need for an unavailability term to represent the testing and maintenance of the inverters. Both logic changes described in SA2017-018 and SA2017-035 have been incorporated into

LR-N18-0033 LAR S18-02 Enclosure SA115C, the application specific model. See Section 3.2.1.5 for more information on the application specific model. SA2018-001 identifies two plant changes that were incorporated into the PRA, and may require evaluation as possible PRA upgrades. Sensitivity calculations that remove these two changes from the PRA are provided in Section 3.2.4.2.4. Table 3 1 Open URE Review URE Number Comments Date Initiated Potential to affect the LAR? SA2005-019 Unit 2 model needs to be developed 1/12/2006 No SA2010-027 Suggestion to provide cross reference between PRA Standard and where in the document it is addressed N/A No SA2012-002 Modification of CVCS pumps; now have mechanical seals that do not require CCW cooling 1/30/2012 No SA2013-001 Butterfly valves added to SW return lines 7/19/2013 No SA2013-002 Chiller recirculation pump modeling needs to be refined 10/23/2013 No SA2014-001 Advanced digital feedwater control system replaced-needs to be updated in model 12/12/2013 No SA2014-005 Review FPRA impact from fire loading associated with new cables associated with FLEX strategies 3/5/2014 No SA2014-006 Revise manipulation times applied in cold leg recirculation actions 4/21/2014 No SA2014-010 Add in missing pre-initiators in HRA documentation 5/27/2014 No SA2014-012 NSAL-14-1 produced preliminary results which warranted a change in RCP seal LOCA leakage. Once more guidance is released, the model may need to be updated again 6/6/2014 No SA2014-017 RCP seal flow rate following loss of all AC power is underestimated in model 7/10/2014 No SA2014-018 Incorporation of SA-STI-004 (surveillance test interval extension) analysis that was performed on the vital bus undervoltage relays 7/21/2014 No SA2014-021 System notebook maintenance 9/9/2014 No SA2015-007 Development of AFW alternate suction sources 3/24/2015 No SA2015-016 EOOS asymmetry with ECACS between Unit 1 and Unit 2 6/2/2015 No SA2015-017 Potential CCW dependency enhancement 6/10/2015 No SA2015-024 Installation of SW return valves 9/18/2015 No SA2015-028 New RCP seals 10/22/2015 No SA2015-032 Modeling enhancement for EDG failure to load event 12/18/2015 No SA2015-033 Recovery of Offsite power during first hour of event 12/18/2015 No

LR-N18-0033 LAR S18-02 Enclosure Table 3 1 Open URE Review URE Number Comments Date Initiated Potential to affect the LAR? SA2016-005 Concurrent maintenance times 4/20/2016 No SA2016-007 Chilled water inter-unit cross-tie 6/27/2016 No SA2016-011 Risk significant actions without details HEP calculations 12/13/2016 No SA2017-001 Basic Event AC5-BAC-ST-I-1153 needs to be renamed 1/3/2017 No SA2017-002 Elimination of cutsets with both ELAP event and non-ELAP event flags 1/21/2017 No SA2017-003 Revised JHEP analysis 2/2/2017 No SA2017-004 SW AOVs for DG cooling support 2/9/2017 No SA2017-005 Improved operator response in procedure for ISLOCA 2/24/2017 No SA2017-006 Spray scenario refinement 3/28/2017 No SA2017-007 Merging of EOOS model logic with MOR 3/28/2017 No SA2017-008 Internal flooding mitigation in SW bays 3/28/2017 No SA2017-009 Add CC3 valves to EOOS red pump list 3/29/2017 No SA2017-010 Internal floods in electrical penetration area 4/18/2017 No SA2017-011 Internal floods in SWIS bays 4/18/2017 No SA2017-012 SA-PRA-003 footnote error regarding CFCUs 4/26/2017 No SA2017-013 Non-generic values needed for 3 HEPs recently found to be risk significant 5/24/2017 No SA2017-014 Logic modifications needed for 28 VDC chargers 6/5/2017 No SA2017-015 SEC actuation for SW20 and SW26 valves 6/8/2017 No SA2017-016 28 VDC battery modeling-output breakers not installed 6/9/2017 No SA2017-017 Conditional LOOPs treated as grid-related LOOPs (possible under conservative probabilities being used) 6/9/2017 No SA2017-018 SEC and 115 VAC vital instrument bus support dependencies 6/9/2017 Yes SA2017-019 Basic Event CM reduced from 1.2E-06 to 1.2E-08 6/21/2017 No SA2017-020 Correction of fault tree logic for ATWS scenarios with LOOP initiators 6/21/2017 No SA2017-021 Review modeling of the ability of the opposite unit to provide seal injection using only the centrifugal charging pump (CCP) 7/14/2017 No SA2017-022 Improvement to include Fire Protection (FP) or Service Water (SW) as an alternate AFW suction source 7/27/2017 No

LR-N18-0033 LAR S18-02 Enclosure Table 3 1 Open URE Review URE Number Comments Date Initiated Potential to affect the LAR? SA2017-023 Review requirements of NEI 99-02 and SC-MSPI-001 need to be reviewed to determine if there are any changes to MSPI UA tracking for CCW based on the TS change and update model to allow two outages simultaneously 8/11/2017 No SA2017-024 Review possibility of spray damage for AOV DR6 8/28/2017 No SA2017-025 Documentation of evaluation of MOV and AOV resistance to sprays 9/9/2017 No SA2017-026 Review LERF model for opportunities to credit repair of failed equipment 9/9/2017 No SA2017-027 Update JHEP values for JHE-XHE-84M-RCN-116 and JHE-XHE-84F-RCN-116 to include the floor drain unavailability factor of 0.001 9/12/2017 No SA2017-028 Include house events to reflect swap to other charger when a charger is out of service for maintenance 9/21/2017 No SA2017-029 Failure mechanisms for manual valves 1DM427 and 1DM216 should be included in the PRA logic for the suction flowpath from the Demineralized Water Storage Tanks to the safety related AFW pumps 9/21/2017 No SA2017-030 Delete basic events for DC breakers failing to remain shut that were found to be redundant to other basic events in the PRA model 9/21/2017 No SA2017-031 As per SA-16-003 (70192022), surveillances for Engineered Safety Feature Containment Isolation Phase A and Phase B testing have been approved to extend from 18 month intervals to 54 month intervals; refer to SA-STI-010, Rev. 0 for required PRA model changes 10/31/2017 No SA2017-032 As per SA-16-004 (70190253), surveillances for rod control movement have been approved to extend from monthly intervals to quarterly intervals; refer to SA-STI-009, Rev. 0 for required PRA model changes 10/31/2017 No SA2017-033 Add testing and maintenance(T+M) events for 21/22 chillers and 21/23 CAACS fans 11/16/2017 No SA2017-034 Review modeling of ventilation for the 2C EDG Control Room 12/19/2017 No SA2017-035 The Salem PRA model does not currently model maintenance unavailability for any of its inverters 12/22/2017 Yes SA2018-001 Tracking two changes that require evaluation as possible PRA Upgrades (4th AFW pump and use FLEX equipment) 4/10/2018 Yes 3.2.1.5 Review of PRA Model Specific to Application Sufficient modeling exists in the PRA to generally represent the components of interest. However, a few changes were needed in order to add details to fully support the analysis of the inverters. The changes have been incorporated to create a new application specific model, SA115C. (Model SA115B was an application-specific model for a different application and has no impact on SA115C.)

LR-N18-0033 LAR S18-02 Enclosure Basic events have been added to the model which represent the unavailability of the 115V A.C. Inverters due to testing and maintenance. The new testing and maintenance basic events were placed in all locations which contained inverter failure basic events (see Table 3-2). The unavailability value used for these basic events was taken from the Idaho National Lab (INL) unavailability data [16]. Additionally, while the inverters are in testing/maintenance, A.C. power is aligned from the backup power supply (via a 12kVA AC Line Regulator and Static Switch), and the failure of the automatic bus transfer switch event (AC1-ABT-OO-1A(B/C/D)115) would not apply. This has been incorporated into the model by replacing the automatic switch failure event with an A AND NOT B (AANB) gate, with the A input being the automatic switch failure event and the B input being the new maintenance term. This logic was replicated for all four inverter trains. See Table 3-2 for more information on the new basic events. See Figure 3-1and Figure 3-2 for the Train A example of the transfer switch logic change. These two changes address URE SA2017-035. TABLE 3-2 ASM BASIC EVENTS New Basic Event Value Parent Gate AC1-INV-TM-1A115 2.00E-04 G18X110 G1AB110 G1XV110 AC1-ABT-OO-1A AC1-INV-TM-1B115 2.00E-04 GXB1110 G37X110 G1BB110 AC1-ABT-OO-1B AC1-INV-TM-1C115 2.00E-04 G1CB110 GXC1110 GXC1110X AC1-ABT-OO-1C AC1-INV-TM-1D115 2.00E-04 G1DB110 AC1-ABT-OO-1D

LR-N18-0033 Enclosure LAR 818-02 UN.AVAILABILITY OF ALTERIIIATE SOURCE 230 VAC VITAL BUS tA jGtXV102j oQ TRANSFORMER LOSS FAILURE OF OF POWER FO.R ALTERN.ATE 230 VAC ALTERN.ATE TRAINA... TRAINAPOWER SUPP... IAC1-TFM-LP-1AREGI IG1XV'!03I 8 2.27E-05 a(:.:) FAILURE OF LOOP INITIATING AUTOMATIC BU.S EVEliiT TRANSFER SWITCH F... IAC1-ABT-OO-tAt15j "'n 81.E-03 ** FIGURE 3-1 PREVIOUS AUTOMATIC BUS TRANSFER SWITCH FAILURE LOGIC FOR TRAIN A UNAVAILABIUTY OF ALTERNATE SOURCE 230 VACVITAL BUS 1A TRANSFORMER LOSS OF FAILURE OF AUTOMATIC FAILURE OF ALTERNATE POWER FOR ALTERNATE BUS TRANSFER SWITCH 230 VAC TRAIN A POWER TRAIN A SOURCE j\\ (AC 1-TFM -LP-1AREG( 8 2.27E-05 F AlLURE OF AU TOM A TIC BUS TRANSFER SWITCH FOR TRAIN A FOR TRAIN A IAcJ.AeT-oo.1AI 0 115 VAC INVERTER 1A NOT IN TESTING/ MAINTENANCE 115 V AC INVERTER 1A UNAVAILABUEDUE TO TESTING/ MAINTENANCE FIGURE 3-2 SUPPLY I G1031 D LOOP INITIATING EVENT li!§ D SA115C AUTOMATIC BUS TRANSFER SWITCH FAILURE LOGIC FOR TRAIN A LR-N18-0033 LAR S18-02 Enclosure To address URE SA2017-018, the EDG electrical support dependencies are more accurately modeled by adding the 1B 115V A.C. vital bus dependency (gate GXB1100) as an input to OR gate G46X100, and similarly for train C, adding gate GXC1100X under OR gate G47X100. This is equivalent to how train A is being modeled in the SA115A PRA model of record. Additionally, the gate IE-TE (LOOP INITIATING EVENT) was added as an input to gates G1XV102 (UNAVAILABILITY OF ALTERNATE SOURCE 230V A.C. VITAL BUS 1A), G37X102X (UNAVAILABILITY OF ALTERNATE SOURCE 230V A.C. VITAL BUS 1B), and GXCB102X (UNAVAILABILITY OF ALTERNATE SOURCE 230V A.C. VITAL BUS 1C) in order to account for the fact that the alternate power source for 230V A.C. would be rendered unavailable during a LOOP event. The inverter logic is a part of the 115V A.C. vital bus dependency logic. Therefore, the above changes were included in this ASM in order to more accurately represent the change in risk due to an extension of inverter Allowed Outage Time. As concurrent maintenance is not allowed for the 115V A.C. inverters, the following lines of text were added to the mutually exclusive file: CONCURRENT MAINTENANCE NOT ALLOWED FOR INVERTERS AC1-INV-TM-1A115 AC1-INV-TM-1B115 AC1-INV-TM-1A115 AC1-INV-TM-1C115 AC1-INV-TM-1A115 AC1-INV-TM-1D115 AC1-INV-TM-1B115 AC1-INV-TM-1C115 AC1-INV-TM-1B115 AC1-INV-TM-1D115 AC1-INV-TM-1C115 AC1-INV-TM-1D115 New events were added to the PRA model to represent concurrent failures of inverters failing to operate due to common cause failures. The new inverter common cause terms are determined using the alpha factor model. The alpha factors were taken from the Salem SPAR model [17]. The alpha factor ( ) is used in combination with the existing inverter independent failure rate (), where k is the number of components being considered and m is the total number of components, in order to determine the common cause failure term ( ). The equation used is shown below and was taken from the INEL Common Cause Failure Data Collection and Analysis System [18].

= ()! (1)! (1)!

LR-N18-0033 LAR S18-02 Enclosure Table 3-3 and Table 3-4 below show the type code and basic event information added to the corresponding tables in the SA115C RR database file. TABLE 3-3 INVERTER COMMON CAUSE TERM TYPE CODES TYPE RATE UNITS DESC SOURCE EQUATION _AC1_INV_FR44 7.05E-03 H ALPHA FACTOR 4/4 115V A.C. INVERTERS SPAR MODEL _AC1_INV_FR34 1.03E-02 H ALPHA FACTOR 3/4 115V A.C. INVERTERS SPAR MODEL _AC1_INV_FR24 1.56E-02 H ALPHA FACTOR 2/4 115V A.C. INVERTERS SPAR MODEL AC1_INV_FR44 3.95E-08 H SPAR MODEL AC1INVFR*_AC1_INV_FR44/1 AC1_INV_FR34 1.92E-08 H SPAR MODEL AC1INVFR*_AC1_INV_FR34/3 AC1_INV_FR24 2.91E-08 H SPAR MODEL AC1INVFR*_AC1_INV_FR24/3 AC1INVFR _INV_FR H INVERTER FAILS TO CONTINUE OPERATING NUREG/CR-6928 2010 _INV_FR 5.60E-06 H INVERTER FAILS TO CONTINUE OPERATING NUREG/CR-6928 2010 TABLE 3-4 INVERTER COMMON CAUSE TERM BASIC EVENTS NAME C FACTOR UNITS DESC TYPE CODE PROBABILITY AC1-INV-CC-1ABCD 1 24 H CCF OF 115V A.C. INVERTERS 1A/B/C/D AC1_INV_FR44 9.475E-07 AC1-INV-CC-1ABC 1 24 H CCF OF 115V A.C. INVERTERS 1A/B/C AC1_INV_FR34 4.614E-07 AC1-INV-CC-1ABD 1 24 H CCF OF 115V A.C. INVERTERS 1A/B/D AC1_INV_FR34 4.614E-07 AC1-INV-CC-1ACD 1 24 H CCF OF 115V A.C. INVERTERS 1A/C/D AC1_INV_FR34 4.614E-07 AC1-INV-CC-1BCD 1 24 H CCF OF 115V A.C. INVERTERS 1B/C/D AC1_INV_FR34 4.614E-07 AC1-INV-CC-1AB 1 24 H CCF OF 115V A.C. INVERTERS 1A/B AC1_INV_FR24 6.989E-07 AC1-INV-CC-1AC 1 24 H CCF OF 115V A.C. INVERTERS 1A/C AC1_INV_FR24 6.989E-07 AC1-INV-CC-1AD 1 24 H CCF OF 115V A.C. INVERTERS 1A/D AC1_INV_FR24 6.989E-07 AC1-INV-CC-1BC 1 24 H CCF OF 115V A.C. INVERTERS 1B/C AC1_INV_FR24 6.989E-07 AC1-INV-CC-1BD 1 24 H CCF OF 115V A.C. INVERTERS 1B/D AC1_INV_FR24 6.989E-07 AC1-INV-CC-1CD 1 24 H CCF OF 115V A.C. INVERTERS 1C/D AC1_INV_FR24 6.989E-07

LR-N18-0033 LAR S18-02 Enclosure 3.2.1.6 Technical Adequacy Summary The Salem PRA model, maintenance and update process, and technical capability discussion described above provide a robust basis for concluding that the PRA is suitable for use in risk-informed processes. However, an application specific PRA model (SA115C) was developed in order to more accurately assess the risk increase for this inverter AOT extension. Since this was the only change made to the current Salem PRA MOR (SA115A), the technical adequacy of the SA115A MOR also extends to the application specific PRA model (SA115C). 3.2.2 Probabilistic Risk Assessment Results 3.2.2.1 Tier 1 Evaluation Approach The proposed changes associated with the extended inverter AOT are evaluated using a PRA model closely based on the Salem PRA Model of Record (MOR) to determine that current regulations and applicable requirements continue to be met, that adequate defense-in-depth and sufficient safety margins are maintained, and that any increase in core damage frequency (CDF) and large early release frequency (LERF) is small and consistent with the acceptance guidelines in Regulatory Guide 1.177. The modeling approach is consistent with the NRC guidance for the calculation of the requested risk measures. Regulatory Guide 1.177 is followed to calculate the change in risk measures Incremental Conditional Core Damage Probability (ICCDP) and Incremental Conditional Large Early Release Probability (ICLERP). These conditional probabilities are performed to calculate the risk change during the proposed inverter AOT by setting the appropriate components as failed. In addition, an assessment of the impact of the AOT extension on overall average risk is calculated by assigning an increased testing/maintenance probability to the 115V A.C. inverters. This increased probability is based on the factor of change of the AOT, thereby conservatively assuming that all existing unavailability will be increased by that same factor. Regulatory Guide 1.174 has acceptance guidelines that act as trigger points to address concerns as to whether the proposed change provides reasonable assurance of adequate protection. The Salem internal events PRA is a thorough and detailed PRA model that is robust and capable of supporting the risk-informed decision to increase the inverter AOT. See Section 3.2.1 for a discussion of the PRA technical adequacy. 3.2.2.2 Assumptions The PRA quantitative evaluation of the extended inverter AOT has a number of assumptions. This subsection lists some of the important assumptions. The external event analysis is based on hazard-specific stand-alone calculations of potential risk impacts based on the RG 1.200 peer-reviewed FPIE PRA, supported by qualitative analysis insights from the IPEEE study. As sensitivity cases, common cause failure events are treated using the INL common cause data base developed under the auspices of the NRC. The conditional probability of failure of additional components has been adjusted to account for the hypothetical case that a specified inverter has suffered a failure that is fully susceptible to common cause. This is bounding; not all failure modes would be

LR-N18-0033 LAR S18-02 Enclosure susceptible to common cause, and consideration of such would lead to lower conditional probabilities and risk increases. 3.2.2.3 Modeled Maintenance Activities PSEG maintenance practices involve protecting other equipment coincident with maintenance being performed on inverters per OP-AA-108-116, Protected Equipment Program [19]. This procedure requires that if a 115V A.C. Vital Instrument Bus (VIB) is unavailable then the remaining VIBs shall be protected. The PRA MOR directly accounts for this maintenance practice and is reflected in the quantitative analysis. In addition, OP-AA-108-116 directs the Operations and Work Management personnel to routinely monitor various maintenance configurations and protect equipment that could lead to an elevated risk condition (e.g., red risk condition) if it were to become unavailable due to unplanned or emergent conditions. This is normally accomplished using a predictive PRA software tool based on the PRA MOR, i.e., EOOS Configuration Risk Monitor program from the Electric Power Research Institute (EPRI). Specific compensatory measures are discussed in the Tier 2 evaluation, Section 3.2.5. 3.2.2.4 Calculational Approach To determine the effect of the proposed Allowed Outage Time for unavailability of the inverters, the guidance provided in Regulatory Guides 1.174 [1] and 1.177 is used. Thus, the following risk metrics are used to evaluate the risk impacts of extending the inverter AOT: Regulatory Guide 1.174 CDFAVE = change in the annual average CDF due to the increase in on-line maintenance unavailability for the 115V A.C. inverters based on the increased Allowed Outage Time. This risk metric is used to compare against the criteria of Regulatory Guide 1.174 to determine whether a change in CDF is regarded as risk significant. These criteria are a function of the baseline annual average core damage frequency, CDFBASE. LERFAVE = change in the annual average LERF due to the increase in on-line maintenance unavailability for the 115V A.C. inverters based on the increased Allowed Outage Time. Regulatory Guide 1.174 criteria were also applied to judge the significance of changes in this risk metric. Regulatory Guide 1.177 ICCDPINV = incremental conditional core damage probability with the 115V A.C. inverters out-of-service for an interval of time equal to the proposed new Allowed Outage Time (7 days). This risk metric is used as suggested in NUMARC 93-01 [35] to determine whether a proposed increase in Allowed Outage Time has an acceptable risk impact.

LR-N18-0033 LAR S18-02 Enclosure ICLERPINV = incremental conditional large early release probability with the 115V A.C. inverters out-of-service for an interval of time equal to the proposed new Allowed Outage Time (7 days). NUMARC 93-01 criteria were also applied to judge the significance of changes in this risk metric. The change in the annual average CDF due to the extension of the 115V A.C. inverters Allowed Outage Time for the specified unavailability, CDFAVE, is evaluated by computing the following: Base CYCLE A OOS INV CYCLE A AVE CDF T T CDF T T CDF

1 CDFAVE = CDFAVE - CDFBASE where: CDFBASE = baseline annual average CDF with average unavailability of inverters consistent with the current Allowed Outage Time. CDFINV-OOS = CDF evaluated from the PRA model with the inverter(s) out-of-service and appropriate compensatory measures implemented. CDFAVE= Average CDF based on an increased 7 day inverter AOT TA = Total outage time proposed for the AOT required for the maintenance action and testing of the inverter(s) (i.e., 7 days). TCycle= For this AOT extension, the cycle is assumed to be a calendar year, 12 months of operation (365 days) A similar approach was used to evaluate the change in the average LERF due to the requested Allowed Outage Time, LERFAVE: Base CYCLE A OOS INV CYCLE A AVE LERF T T LERF T T LERF

1 = where: LERFBASE = baseline annual average LERF with average unavailability of inverters consistent with the current Allowed Outage Time. LERFAVE= Average LERF based on an increased 7 day inverter OOS LERFINV-OOS =LERF evaluated from the PRA model with the inverter(s) out-of-service and appropriate compensatory measures implemented. TA = Total outage time proposed for the AOT required for the maintenance action and testing of the inverter(s) (i.e., 7 days). TCycle= For this AOT extension, the cycle is assumed to be a calendar year, 12 months of operation (365 days)

LR-N18-0033 LAR S18-02 Enclosure In order to calculate CDFINV-OOS and LERFINV-OOS, the testing and maintenance inverter terms are set to true using four individual flag files which are listed in Table 3-5. It is assumed a maximum of one inverter would enter the extended outage in any given year. TABLE 3-5 INVERTER OOS FLAG FILES Case Flag File Inverter A OOS AC1-INV-TM-1A115 EQU .T Inverter B OOS AC1-INV-TM-1B115 EQU .T Inverter C OOS AC1-INV-TM-1C115 EQU .T Inverter D OOS AC1-INV-TM-1D115 EQU .T The incremental conditional core damage probability (ICCDP) and incremental conditional large early release probability (ICLERP) are computed using the definitions from Regulatory Guide 1.177. In terms of the above defined parameters, the definition of ICCDP for the unavailability of the inverters is as follows: ICCDPINV = (CDFINV-OOS - CDFBASE)

The ICCDP values are dimensionless probabilities to evaluate the incremental probability of a core damage event over a period of time equal to the extended Allowed Outage Time. Similarly, ICLERP is calculated using the methodology described above: ICLERPINV = (LERFINV-OOS - LERFBASE )

Note that because the time variables are set to 7 days per year for both sets of calculations, CDF/LERF will equal ICCDP/ICLERP for this evaluation. Table 3-6 summarizes the results using the SA115C PRA model for the NRC specified risk metrics (CDF, LERF, ICCDP, and ICLERP) for the proposed change to the AOT of the inverters. The process used to calculate the risk metrics complies with NRC Regulatory Guides 1.174 and 1.177.

LR-N18-0033 LAR S18-02 Enclosure Table 3-6 Quantitative Results for the Unavailability of 115V A.C. Inverters Case Event Trunc CDF/LERF INV-OOS CDF/LERF AVE CDF/LERF ICCDP/ICLERP RG 1.177 Guideline Inv A CDF 1.00E-11 8.42E-06 8.38E-06 7.85E-10 < 1E-06 LERF 1.00E-12 4.53E-07 4.47E-07 1.10E-10 < 1E-07 Inv B CDF 1.00E-11 8.52E-06 8.38E-06 2.56E-09 < 1E-06 LERF 1.00E-12 4.56E-07 4.47E-07 1.70E-10 < 1E-07 Inv C CDF 1.00E-11 8.77E-06 8.39E-06 7.49E-09 < 1E-06 LERF 1.00E-12 4.83E-07 4.48E-07 6.90E-10 < 1E-07 Inv D CDF 1.00E-11 8.38E-06 8.38E-06 0.00E+00 < 1E-06 LERF 1.00E-12 4.47E-07 4.47E-07 0.00E+00 < 1E-07 Note that all risk values are significantly below the Acceptance Guidelines of RG 1.177. The calculations of CDF are and LERF are very small, as defined in RG 1.174 (less than 1E-6 and 1E-7 respectively). Salems CDF and LERF are clearly in Region III of Figure 5 in RG 1.174. Therefore, the focus of the uncertainty analysis will be to search for model uncertainties that could approach or exceed the acceptance guidelines. 3.2.2.5 Distribution of Risk Contributors The distribution of initiating event and accident class contributors for the results generated by the Salem Application-Specific Model (ASM) have been reviewed. As the risk metrics depend on the difference between each case and the base case, the importance measures of interest are those of the delterm cutsets, i.e. the difference in the two cutset files. Table 3-7 and Table 3-8 present the initiating events importance measures for delterm FPIE CDF and LERF from the cases for Inverter C, which shows the largest increases.

LR-N18-0033 LAR S18-02 Enclosure TABLE 3-7 INITIATING EVENT IMPORTANCE MEASURES FOR CDF Initiator Description Inverter C CDF %TT TRANSIENT WITH PCS AVAILABLE INITIATOR 2.47E-06 29% %TES1 LOOP INITIATOR FOR PLANT/SWITCHYARD - UNIT 1 ONLY 1.87E-06 22% %TEW LOOP initiator - weather 1.09E-06 13% %TEG LOOP initiator - Grid 9.06E-07 11% %TES12 DUAL UNIT LOOP INITIATOR FOR PLANT/SWITCHYARD 5.74E-07 7% %TP TRANSIENT WITH PCS UNAVAILABLE INITIATOR 4.96E-07 6% %TSBO MAIN STEAM LINE BREAK OUTSIDE CONTAINMENT INITIATOR 1.74E-07 2% %FLD-SWS-SW-100-B-FLD GENERAL FLOOD IN SW-100-B CAUSED BY FAILURE OF SWS PIPING 1.14E-07 1% %FLD-SWS-SW-100-A-FLD GENERAL FLOOD IN SW-100-A CAUSED BY FAILURE OF SWS PIPING 1.14E-07 1% %FLD-OTH-DG-084-FLD GENERAL FLOOD WATER SOURCES NOT MODELED IN PRA IN DG-084 6.18E-08 1% %FLD-SWS-DG-084 FLD GENERAL FLOOD IN AB-084 CAUSED BY FAILURE OF SWS PIPING (#1 SW HEADER) 5.80E-08 1% %FLD-SWS-DG-084 FLD GENERAL FLOOD IN AB-084 CAUSED BY FAILURE OF SWS PIPING (#2 SW HEADER) 5.80E-08 1% %FLD-SW-100-A-SPR LOCAL SPR FLOOD IN FLOOD AREA SW-100 5.28E-08 1% %FLD-SW-100-B-SPR LOCAL SPR FLOOD IN FLOOD AREA SW-100 5.28E-08 1% %FLD-OTH-TB-088-A-FLD GENERAL FLOOD WATER SOURCES NOT MODELED IN PRA IN TB-088-A 4.27E-08 1% %FLD-OTH-TB-088-B-FLD GENERAL FLOOD WATER SOURCES NOT MODELED IN PRA IN TB-088-B 4.27E-08 1% Other 1.99E-07 2% Total 8.38E-06 100%

LR-N18-0033 LAR S18-02 Enclosure TABLE 3-8 INITIATING EVENT IMPORTANCE MEASURES FOR LERF Initiator Description Inverter C LERF %TT TRANSIENT WITH PCS AVAILABLE INITIATOR 1.35E-07 30% %TES1 LOOP INITIATOR FOR PLANT/SWITCHYARD - UNIT 1 ONLY 9.96E-08 22% %TEW LOOP initiator - weather 5.66E-08 13% %TEG LOOP initiator - Grid 4.12E-08 9% %TES12 DUAL UNIT LOOP INITIATOR FOR PLANT/SWITCHYARD 2.85E-08 6% %TP TRANSIENT WITH PCS UNAVAILABLE INITIATOR 2.48E-08 6% %TSBO MAIN STEAM LINE BREAK OUTSIDE CONTAINMENT INITIATOR 8.54E-09 2% %FLD-SWS-SW-100-A-FLD GENERAL FLOOD IN SW-100-A CAUSED BY FAILURE OF SWS PIPING 6.56E-09 1% %FLD-SWS-SW-100-B-FLD GENERAL FLOOD IN SW-100-B CAUSED BY FAILURE OF SWS PIPING 6.56E-09 1% %S4-A STEAM GENERATOR 11 TUBE RUPTURE INITIATOR 3.84E-09 1% %S4-B STEAM GENERATOR 12 TUBE RUPTURE INITIATOR 3.84E-09 1% %S4-C STEAM GENERATOR 13 TUBE RUPTURE INITIATOR 3.75E-09 1% %S4-D STEAM GENERATOR 14 TUBE RUPTURE INITIATOR 3.75E-09 1% %FLD-OTH-DG-084-FLD GENERAL FLOOD WATER SOURCES NOT MODELED IN PRA IN DG-084 3.42E-09 1% %FLD-SWS-DG-084 FLD GENERAL FLOOD IN AB-084 CAUSED BY FAILURE OF SWS PIPING (#1 SW HEADER) 3.16E-09 1% %FLD-SWS-DG-084 FLD GENERAL FLOOD IN AB-084 CAUSED BY FAILURE OF SWS PIPING (#2 SW HEADER) 3.16E-09 1% %FLD-SW-100-A-SPR LOCAL SPR FLOOD IN FLOOD AREA SW-100 2.83E-09 1% %FLD-SW-100-B-SPR LOCAL SPR FLOOD IN FLOOD AREA SW-100 2.83E-09 1% Other 9.46E-09 2% Total 4.47E-07 100% First, a loss of offsite power (LOOP) is overwhelmingly significant to the change in plant risk metrics due to the considered AOT change. The PCS transient initiator (%TT) and LOOP initiators (initiators that begin with %TE) appear in the cutsets via station blackout sequences. The transient initiator reaches that state via a coincident loss of power to the 500kV switchyard. These account for over 80% of CDF and LERF. Such a high importance comports with the inverters sole, vital function as part of A.C. power distribution to Class 1E equipment - any change in plant risk due to their maintenance must naturally proceed from a challenge to A.C. power. The other initiators contribute negligible amounts of risk.

LR-N18-0033 LAR S18-02 Enclosure Further review of the delterm cutsets revealed the top actions and equipment contributing to the increase in risk. The top operator actions include failure to locally close the service water turbine header valve, failure to align the FLEX DG, failure to start and align the non-safety related Auxiliary Feedwater System pump, and failure to manually start the emergency diesel generator upon failure of auto start. The top equipment failures leading to an increase in risk include failure of any of the diesel generator and the gas turbine generator. These are as expected because in the event of a loss of offsite power, the top priority is aligning/ starting emergency diesel generators and keeping the core covered. Results from cases for Inverters A and B are slightly different due to differences in loads served. They are both less than the Inverter C cases, with lower contributions due to the turbine trip with a coincident loss of power. Different cutsets appear for these inverters following a steam generator tube rupture due to the need to manually close AFW discharge valves to isolate the ruptured steam generator after random faults of associated buses or transformers, while the power failures also prevent valves from opening for shutdown cooling. However, the overall contributions of these differences are still quite low and less than the Inverter C case. Results from the Inverter D case show zero result at the normal truncation levels. A review of the functions of Inverter D support that result, as its primary loads that impact the PRA are the power to the Auxiliary Spray and AMSAC. Examining cutsets for transients run under conservative conditions to cause more cutsets to be produced, the most likely cutsets would be a combination of a loss of power to an Auxiliary Spray valve with a random PORV failure that would prevent the plant from mitigating a SGTR. On a LOOP, the ATWS Mitigation System Actuation Circuitry failures would be coupled with other instrumentation failures to fail the trip of the main turbine during an ATWS. However, all of these cases are well below normal truncation limits and much less than the other inverter cases. 3.2.2.6 Summary of Results for Internal Events The results presented in Table 3-6 are well below the regulatory guidelines for a license amendment request: The CDF and LERF risk metrics are well below the RG 1.174 acceptance guidelines for Region III, i.e., very small risk change. The ICCDP for the inverter AOT is well below the RG 1.177 acceptance guideline. The ICLERP for the inverter AOT is well below the RG 1.177 acceptance guideline. 3.2.3 External Events Considerations 3.2.3.1 Overview Salem does not have separate probabilistic risk assessments (PRA) for Fire, External Flood, or Seismic events. An internal Fire PRA (FPRA) is currently under development. The FPRA was developed as part of the station license renewal project. However, the FPRA did not yet undergo an industry peer review as required by NRC Regulatory Guide 1.200 for use in risk informed regulatory applications. PSEG is working to complete the FPRA. The current version, which follows the methodology of NUREG/CR-6850 with some incorporation of more recent data and methods can be used to provide valuable insights, but not quantitative information.

LR-N18-0033 LAR S18-02 Enclosure Salem completed an Individual Plant Examination of External Events in 1996 [9]. Each of the Salem external event evaluations were reviewed as part of the submittal by the NRC and compared to the requirements of NUREG-1407 [21]. Section 1.4 of the IPEEE summarizes the major findings and states that fire and seismic events were the only important contributors to external events core damage. The fire related CDF was 2.3E-05 per year. The seismic related CDF was 9.5E-06 per year using a more conservative hazard curve (LLNL) and 4.7E-06 per year using a curve described as more realistic (EPRI). Section 1.4.3 of the IPEEE explains how the risk of High Winds, External Flood and other external events were screened out as insignificant. The risk increases related to the plant changes in this application due to fire, seismic, and external flood events are discussed in the following sections. 3.2.3.2 Fire PRA The IPEEE analysis of the impact of internal fires consisted of a screening of fire areas based on EPRI Fire Induced Vulnerability Evaluation (FIVE) methodology [22]. As prescribed by the FIVE methodology, detailed area-by-area equipment and cable inventories were developed from the Appendix R Safe Shutdown Analysis (SSA) [23], and the Fire Hazards Analysis (FHA) [24]. The fire evaluation was performed on the basis of fire areas, which are plant locations completely enclosed by rated fire barriers. The fire area boundaries were assumed to be effective in preventing a fire from spreading from the originating area to another area based on the implementation of a satisfactory fire barrier surveillance and maintenance program, and observation during the walkdown. The fire area boundaries recognized in this study are defined in Sections 3 through 5 of the Salem Generating Station FHA and in the SSA. Qualitatively, an area was screened out if the area neither contained safe shutdown equipment nor called for a manual or automatic plant trip, given the condition that all equipment in the area is damaged. Quantitatively, an area was screened out if the CDF could be shown to be less than 1E-06 per year, assuming a reactor trip and all equipment in the area failed and was unrecoverable. In theory, the contribution to core damage frequency from fires anywhere in the plant may be assessed in detail. However this was impractical due to the large number of possible scenarios and also unnecessary, since fires in many plant areas are incapable of causing significant damage regardless of how severe they become. Consequently, the first stage in performing a fire analysis was to perform a systematic screening of all fire areas in accordance with the FIVE methodology. Areas not screened quantitatively or qualitatively were retained for a further detailed PRA evaluation. The purpose of the qualitative screening was to identify the boundaries of the plant fire areas, together with the location of equipment and cables which, if damaged by fire, would cause a plant shutdown or degradation of shutdown paths identified in the plant's SSA or IPE. This information was then used to qualitatively screen fire areas from further consideration using the criteria developed in the FIVE methodology. The steps involved in qualitative screening included the following: Step 1 - Identification of Fire Areas Step 2 - Identification of Plant Safe Shutdown Systems Step 3 - Identification of Safe Shutdown Equipment in Each Fire Area Step 4 - Perform Fire Area Safe Shutdown Function Evaluation

LR-N18-0033 LAR S18-02 Enclosure For the quantitative screening analysis, the FIVE methodology provided a method of screening based on a conservative estimation of the contribution to CDF. The equipment contained within an area was assumed to fail due to a fire. Using an event tree representative of the most significant failure, the contribution to CDF was then calculated. If this contribution was less than 1E-06 per year using the fault tree and event tree models from the IPE, the area or compartment was able to be screened out. Additionally, Section 1.4.2 of Salems IPEEE discusses the station fire risk. As part of this internal fire analysis one potential plant vulnerability was identified, and a plant enhancement has been implemented as a result [25]. There are two sets of cables supplying offsite power to the 4kV vital buses and these are routed through one elevation of the turbine and service buildings before entering the auxiliary building. The two sets provide a redundant source of power to the vital 4kV buses. Thus, if one set is damaged by fire, the second set could provide power to all three buses. In the turbine and service buildings, the two redundant sets of cables are separated by less than 10 feet for a portion of the area. No significant fixed combustible sources are located within 30 feet of the cables and are therefore not considered to be risk significant. However, as a result of the fire IPEEE, transient combustible controls similar to those in place for the auxiliary building, penetration areas and service water intake structure have been put into effect for this area of the turbine and service buildings. The internal fire PRA model was credited with this enhancement and was reflected in the IPEEE results. The total CDF from fire events in the IPEEE was calculated to be 2.3E-05 per year. The top four scenarios are described as follows: 24% of the total CDF (5.5E-06 per year) caused by a fire in the relay room that damages more than one cabinet and requires control room abandonment. Core cooling by alternate shutdown methods is unsuccessful, leading to core damage. 9.1% of the total CDF (2.1E-06 per year) caused by a fire in the control room which damages consoles 1, 2, or 3 and requires control room abandonment. Core cooling by alternate shutdown methods is unsuccessful, leading to core damage. 7.4% of the total CDF (1.7E-06 per year) caused by a relay room fire with damage limited to one electrical cabinet. Control room functions remain available but degraded. Core cooling is unsuccessful, leading to core damage. 4.6% of the total CDF (1.1E-06 per year) caused by a control room fire with damage limited to control console 3. Equipment damage requires control room abandonment. Core cooling by alternate shutdown methods is unsuccessful, leading to core damage. Another perspective of fire risk is the relative importance for a fire in each area. The top four areas are the relay room (31%), control room (30%), the 460V A.C. switchgear room (7%), and the 4kV A.C. switchgear room (7%). Core damage following a relay or control room fire arise primarily from failure to implement alternate shutdown methods following control room abandonment. Such fire scenarios may damage multiple trains of equipment, so the status of a particular component being out-of-service would have a negligible impact since it would have been damaged anyway. The switchgear room fires cause loss of one vital bus. Additional equipment becomes unavailable if the fire is not suppressed. Random failures of equipment unaffected by fire then lead to core damage for these scenarios.

LR-N18-0033 LAR S18-02 Enclosure As an additional set of stand-alone calculations, the potential impact of fire events on the risk assessment is considered using inputs from the full-power internal events which has been shown to be technically adequate per peer review in accordance with RG 1.200. The steps to determine the potential impact of fire events for proposed extensions are: Determine fire initiating event frequencies Determine the power sources required for event mitigation Determine the change in inverter unavailability Determine the impact on risk metrics The fire ignition frequencies used for this calculation are from the current work-in-progress fire PRA. The plant-specific internal fire boundaries have been identified and the physical analysis units have been defined in accordance with NUREG/CR-6850. The fire ignition frequencies have been calculated from Supplement 1 of NUREG/CR-6850 (FAQ 08-0048) and NUREG-2169. The frequencies for all of the ignition sources are summed, accounting for severity factors and non-suppression probabilities. Each fire scenario is assumed to impact all but one inverter. This is a conservative assumption, since for any cases that impact all inverter trains, there would be no change in risk due to additional unavailability since they would all be failed by the fire. The extended AOT of the 115V A.C. inverters will have the greatest impact during a loss of offsite power event. Each of the three 4160V A.C. vital buses can be connected to an auto starting Emergency Diesel Generator, which provides emergency power for safe shutdown in the event the offsite power source is lost. The 115V A.C. power system supplies multiple sources, including the safeguards equipment control (SEC) and backup to the three 4160V A.C. vital buses in the event of a loss of all A.C. power event. In the event that a single 115V A.C. inverter is out of service, there is an alternate 230V A.C. power source (via a 12kVA AC Line Regulator and Static Switch) which can provide back-up for that specific bus. In the event that a fire impacts the 230V A.C. power source, the extended outage time of the inverters would be irrelevant. The failure probability of the alternate 230V A.C. source is calculated while an inverter is out of service by solving the 230V A.C. gate in the PRA model. Additionally, a flag file is used to set the inverter testing and maintenance events to true, and set all initiating events to false. There are multiple versions of the alternate 230V A.C. power supply failure gate in the PRA model. Some versions of those gates include diesel generator failure logic which leads to failure of the SEC. In the loss of power conditions being analyzed, the power to the main 1E 4kV buses would be provided by the diesel generator, and therefore a diesel generator failure is irrelevant for the delta-risk calculation since failure of the diesel would leave the actual equipment without power as well. The gates chosen to represent alternate 230V A.C. power therefore only include dependencies between the 4 kV bus and the 120V A.C. panel being powered by the 230V A.C. alternate power. The gates selected are listed in Table 3-10. To determine the change in unavailability for the inverter, the probability of the old inverter testing/maintenance basic event is subtracted from the new increased basic event probability. This was conservatively calculated for all 4 inverters. See Table 3-9 for more details on this calculation.

LR-N18-0033 LAR S18-02 Enclosure Table 3-9 Change in Inverter Unavailability Description Basic Event Old UA New UA UAINV 115V A.C. Inverter 1A AC1-INV-TM-1A115 2.00E-04 1.40E-03 1.20E-03 115V A.C. Inverter 1B AC1-INV-TM-1B115 2.00E-04 1.40E-03 1.20E-03 115V A.C. Inverter 1C AC1-INV-TM-1C115 2.00E-04 1.40E-03 1.20E-03 115V A.C. Inverter 1D AC1-INV-TM-1D115 2.00E-04 4.67E-04 2.67E-04 Based on this expected sequence of events, the risk impact related to the change in inverter unavailability can be conservatively estimated as: CDF = FIE-F x UAINV x PBU where: FIE-F = Fire initiating event frequency (based on NRC guidance as discussed above) UAINV = Change in inverter unavailability PBU

=

Probability of failure of back up 230V power supply The values used for each case are: Table 3-10 Delta CDF Calculation for Fire Events Inverter A B C D FIE = 4.62E-01 4.62E-01 4.62E-01 4.62E-01 UAINV = 1.20E-03 1.20E-03 1.20E-03 2.67E-04 PBU Gate G18X102 G37X102 GXCB102X G1DB102 PBU = 1.53E-04 1.19E-04 1.53E-04 2.83E-04 CDF = 8.48E-08 6.60E-08 8.48E-08 3.49E-08 Following the most conservative case, CDFtotal = 8.48E-08 /yr Since the change in CDF is negligible, the LERF impact will also be negligible and the CDF and LERF changes meet the acceptance criteria in RG 1.174. 3.2.3.3 Seismic PRA The seismic risk analysis provided in the Salem Individual Plant Examination for External Events is based on a detailed Seismic Probabilistic Risk Assessment. A Seismic Probabilistic

LR-N18-0033 LAR S18-02 Enclosure Risk Assessment analysis approach was taken to identify any potential seismic vulnerabilities at Salem. The Seismic PRA method was deemed an acceptable methodology identified in NUREG-1407. This PRA technique included consideration of the following elements: Seismic hazard analysis Seismic fragility assessment Seismic systems analysis Quantification of the seismically induced core damage frequency The IPEEE assessment incorporates quantification and model elements (such as system fault trees, event trees, random failure rates, common-cause failures, etc.) consistent with state of the practice in the 1990s. Since the methodology for seismic PRA has evolved significantly, the IPEEE assessment cannot be used for quantitative insights. Therefore, PSEG has neither incorporated the latest seismic hazard information into the IPEEE model nor reviewed the IPEEE assessment to determine the effect of any procedural or equipment changes. Instead, the assessment of extension of inverter AOTs will be based on more recent seismic hazard evaluations and walkdowns and on the up-to-date Salem internal events PRA model. Because damage to equipment during seismic events is often correlated across trains, extension of AOTs for most components will have a negligible impact on seismic risk estimates. If a component is failed during a particular seismic event, its corresponding opposite train component is also likely to fail; therefore, whether it was out-of-service or not is irrelevant. If a component is not failed during a particular seismic event, it will then only contribute to seismic risk when its corresponding opposite train component is out-of-service due to random failures, which are very low and bounded by the internal events analysis. As such, it can qualitatively be inferred that there would be no significant impact on seismic risk due to extending the AOT for these components. As an additional set of stand-alone calculations, the potential impact of seismic events on the risk assessment is considered using inputs from the full-power internal events which has been shown to be technically adequate per peer review in accordance RG 1.200. The steps to determine the potential impact of seismic events for proposed extensions are: Determine the accidents that can result from a seismic event Determine the systems of interest Determine how the system of interest is used to mitigate the seismically induced event Determine the impact on risk metrics The primary seismic event of interest for this assessment is a LOOP. The largest seismic events are expected to cause LOCAs and additional failures, making small changes in the availability of 115V A.C. inverters a negligible impact as discussed above. For a seismically-induced LOOP event, emergency diesel generators (EDGs) are required to start and run, AFW is required to provide secondary side heat removal, and RCP seal cooling (injection or thermal barrier cooling) must continue to prevent an RCP seal LOCA. This neglects the impact of any new RCP seals that may be installed currently or in the future. The only functions that may be impacted by the AOT changes are the power systems required to safely shutdown. The 115V A.C. power system supplies multiple sources, including the

LR-N18-0033 LAR S18-02 Enclosure safeguards equipment control (SEC) and backup to the three 4160V A.C. vital buses in the event of a loss of all A.C. power event. The change in risk for seismic events is computed as an incremental conditional core damage probability similar to Section 3.2.2.4. Over a one-year time frame, this is generally equivalent to a change in CDF. The general equation is as follows: ICCDPINV = (CDFINV - CDFBASE)TINV For the case of specific initiating events, each CDF can be calculated as the frequency of the initiating event times the conditional core damage probability (CCDP) given that initiating event, or: ICCDPINV = f(Seismic LOOP)*(CCDPINV - CCDPBASE)*TINV The seismically induced LOOP frequency is calculated by summing all of the seismically-induced LOOPs from all categories of seismic events in LR-N14-0051[26] 1. The calculation of the CCDP values is quantified conservatively assuming that LOOP recovery is not possible. The calculation of ICLERP is similar. Applying these assumptions and calculations, with the TINV set to 7 days per year (1.92E-2) yields the estimates of seismic ICCDP and ICLERP in Table 3-11. Table 3-11 Risk Calculation for Seismic Events Inverter CCDP(INV) CCDP(BASE) CLERP(INV) CLERP(BASE) ICCDP ICLERP A 6.28E-04 6.15E-04 7.11E-05 6.62E-05 5.39E-12 2.06E-12 B 6.89E-04 6.15E-04 7.44E-05 6.62E-05 3.10E-11 3.44E-12 C 6.49E-04 6.15E-04 6.96E-05 6.62E-05 1.39E-11 1.43E-12 D 6.15E-04 6.15E-04 6.62E-05 6.62E-05 0.00E+00 0.00E+00 In summary, for scenarios that would damage multiple trains of equipment, the status of a particular component being out-of-service would have a negligible impact since it would have been damaged anyway. Where a seismic scenario only damages one component, the impact would be seen with the opposite train component out-of-service, and those impacts are estimated to be very low based on these stand-alone calculations. 3.2.3.4 External Flooding PRA 3.2.3.4.1 Background Information Regarding External Flooding The following provides a brief discussion of relevant Salem Flood Protection Features and the highlights of the IPEEE Screening and Re-evaluated Flood Hazard. A later sub-section then summarizes the main results from the risk calculations for the LAR. 1 Frequency based on calculation using values from PSEG's Response to 10 CFR 50.54(f) Recommendation 2.1 of the Near-Term Task Force Review of the Fukushima Accident - Salem Generating Station, LR-N14-0051, March 2014.

LR-N18-0033 LAR S18-02 Enclosure Flood Protection Features Salem relies on both passive and active incorporated flood protection features to establish its design basis flood protection. Doors and penetrations in exterior walls of the containment, service water intake, auxiliary and penetration areas are protected against water inflow up to elevation 120.4 ft. Public Service Datum (PSD). Penetrations in exterior walls and slabs of the Station Service Water System intake structure are protected against water inflow up to elevation 126 ft. PSD with wave run up protection to 128.0 ft. PSD. These flood protection features include the buildings themselves, penetration seals, waterproofing, and watertight doors. The Salem flood protection features are part of the design and licensing basis of the plant and have clearly defined hydraulic capability characteristics. During Salem's Response to Recommendation 2.3: Flooding Walkdown of the Near-Term Task Force Review of Insights from the Fukushima Dai-ichi Accident [36, 37, 38], Salem's flood protection features were reviewed and show adequate margin above design basis flood elevations. The flooding walkdown report provides additional information on the flood protection features credited in the Salem licensing basis. Performance of the walkdowns provided confirmation that flood protection features are in place, are in good condition and will perform as credited in the current licensing basis. Minor issues were entered in the PSEG Corrective Action Program (CAP). No operability concerns were identified. As shown in Table 2.1-3 of PSEG Letter LR-N14-0042 [39], watertight door thresholds at Salem are at elevation 10.2 ft. North American Vertical Datum of 1988 (NAVD88) (100.2 ft. PSD). The plant's design basis flood protection features are established to mitigate the effects of a hurricane storm surge event, with the flood protection elevations at 120.4 ft. PSD or higher. Salem flood protection features do not include any temporary features that require implementation of a procedure for performance of manual/operator actions in order for the feature to perform its intended flood protection function. The watertight doors are the only active flood protection features at Salem. The balance of the flood protection features are passive and continually maintain their full hydraulic capability. IPEEE Screening All "other external events" identified in NUREG/CR-2300 have been screened out by bounding probabilistic analyses that demonstrate a core damage frequency of less than the IPEEE screening criterion of 1E-6/yr or by compliance with the 1975 Standard Review Plan (SRP) criteria. For external floods, Salem did a Bounding Analysis as defined in Section 5.2.5 of NUREG-1407. The IPEEE reports that hurricane-induced flooding dominates all other sources of flooding. The walkdown and semi-quantitative analysis of the IPEEE identified 3 potentially significant water ingress paths: 1) penetrations in the 88 level of the Service Building that lead to the Auxiliary Building, 2) flood doors mistakenly left open, and 3) the fabric that seals the gap between the Auxiliary Building penetrations rooms and the containment. Path 1) was judged to be important, and PSEG completed installation of a retrofit penetration seal material in the 1990s that eliminated paths 1) and 3). The current Adverse Environmental Condition procedure, described in the next section, ensures that flood doors are kept closed. Re-evaluated Flood Hazard As discussed in the Flood Hazard Reevaluation Report (FHRR Section 3 of LR-N14-0042), Salem is susceptible to flooding above plant grade from Local Intense Precipitation (LIP) and Storm Surge based flooding events. Probable Maximum Flood events that address the effects of upstream riverine flooding only produce flood levels above plant grade when combined with

LR-N18-0033 LAR S18-02 Enclosure storm surge events. Other NUREG/CR-7046 postulated flooding mechanisms do not produce sufficient water surface elevations in the Delaware River and Bay to cause flooding in excess of plant grade. The FHRR (Section 1.3) notes there have been no changes to the flood protection features themselves since initial licensing. Procedural actions have been enhanced to respond to potential flood threats. 3.2.3.4.2 Qualitative Discussion of External Flooding This subsection is structured to show that the margins below the NRC acceptance criteria still apply based on current knowledge of external flooding risk at Salem. PSEG is providing a detailed qualitative assessment based on recent analyses and current procedures that shows that the external flooding risk is still very low. Frequency of External Flooding Mechanisms LIP and Storm Surge based flooding events that produce water levels that challenge the plant's design basis flood protection features are events with annual exceedance probabilities of 1E-6 or smaller, as discussed in Section 2.4 of LR-N14-0042. The annual exceedance probability of flood levels that could exceed the watertight door thresholds did not need to be calculated for the FHRR; however, PSEG did assess these levels during the development of the FHRR and subsequent activities [40]. Based on a representative analysis performed by EPRI [41], the rainfall rate used in Section 2.1 of the FHRR to evaluate the LIP event is estimated to have an annual exceedance probability between 1E-7 to 1E-9. To support development of a trigger to implement watertight door closure for a LIP event, PSEG assessed the rate of rainfall required to exceed watertight door thresholds. Based on the same conservative modeling approaches described in the FHRR (LR-N14-0042, Section 2.1), approximately 6 inches of rain in 6 hours could challenge the threshold. OP-AA-108-111-1001, Severe Weather and Natural Disaster Guidelines, provides a guide for response to impending severe weather conditions by members of Salem/Hope Creek in order to assure personnel and assets are adequately protected. Additionally, it provides programmatic guidance to nuclear personnel for reaction to severe weather conditions [42]. Conservatively, SC.OP-AB.ZZ-0001, Adverse Environmental Conditions, which contains a trigger of a predicted 6 inches of rain in the next 24 hours is now used to implement watertight door closure in advance of a heavy rainfall event [43]. The US Army Corps of Engineers (USACE) completed a Storm Surge Study for Federal Emergency Management Agency (FEMA) Region Ill, which encompasses the Delaware River and Bay areas in 2013 [44]. This study estimated still water surface elevations of 10.7 ft. NAVD and 12.1 ft. NAVD for recurrence intervals of 500 and 1000 years, respectively. These elevations equate to approximately site grade and the watertight door threshold, respectively. Impact of External Flooding Mechanisms on Plant Operation and Structures Including the Ability to Cope with Upset Conditions As discussed in LR-N14-0042, the reevaluated flooding events could produce flood levels that are above the watertight door thresholds, but below the plant's minimum flood-protected elevation of 120.4 ft. PSD. The plant's design basis flood protection features are established to mitigate the effects of a hurricane storm surge event. Protection of safety related systems, structures, and components (SSCs) is ensured by implementing severe weather guidance

LR-N18-0033 LAR S18-02 Enclosure document OP-AA-108-111-1001, "Severe Weather and Natural Disaster Guidelines" and abnormal operating procedure SC.OP-AB.ZZ-0001, "Adverse Environmental Conditions". Performance of the walkdowns provided confirmation that flood protection features are in place, are in good condition and will perform as credited in the current licensing basis (CLB). Minor issues were identified and entered in the PSEG CAP. No operability concerns were identified. The overall strategy for protecting the Salem from a flooding event requires simple and straightforward actions. Response to a flood event begins with the Control Room Supervisor monitoring the National Weather Service for storm warnings. Plant safety is then ensured by implementing severe weather guidance and an abnormal operating procedure, which instruct operators to close watertight doors. LR-N14-0042 provides additional discussion of the temporal characteristics of these hypothetical events in Sections 2.10.6. As described later in this document, PSEG operators should execute these procedures with no particular challenge. Operating Experience Associated with Reliability of Flood Protection Measures Evaluation of the overall effectiveness of the Salem flood protection features was performed and documented in the Salem Response to Recommendation 2.3: Flooding Walkdown of the Near-Term Task Force Review of Insights from the Fukushima Daiichi Accident. The review of the flood protection features design and licensing documentation, and subsequent field inspection of the applicable physical flood protection features was implemented per the guidance provided within NEI 12-07 [45]. PSEG has implemented ER-AA-310-101 Condition Monitoring of Maintenance Rule structures [46] for structures such as flood control features: concrete walls and slabs, water-control structure elements, penetration seals, etc. Salem safe shutdown SSCs are currently protected by means of permanent/passive measures and permanent active features, i.e., watertight doors. Watertight door closure can be performed within the warning time provided by proceduralized triggers, as shown by Salem operating experience (e.g., the flooding walkdown report in LR-N12-0370 documents actual closure can be performed within the required period of time following exceedance of a high river water level trigger). Therefore, the manual actions required to implement the flood response strategy (i.e., watertight door closure) are feasible and the overall implementation of the strategy is adequate. Performance of the walkdowns provided confirmation that flood protection features are in place, are in good condition and will perform as credited in the CLB. Minor issues were identified and entered in the PSEG CAP. No operability concerns were identified. Reliability of Operator Actions Operator actions required for flood protection actions are contained in SC.OP-AB.ZZ-0001, Adverse Environmental Conditions. This procedure would be entered for conditions that could result in onsite flooding, including: Extreme High River Levels. Severe weather observed or expected, as reported by the National Weather Service for Salem County, in the form of high winds (greater than 40 mph sustained or greater than 58 mph gusts from any direction) and/or excessive precipitation (Hurricane, Tropical Storm, Tornado, or Severe Thunderstorm Warning). Wind Speeds of greater than 30 mph (sustained) from sector between 140 degrees (SE) to 240 degrees (WSW)predicted to occur within the next 8 hours.

LR-N18-0033 LAR S18-02 Enclosure The National Weather Service Probabilistic Quantitative Precipitation Forecast (PQPF) predicts Local Intense Precipitation (LIP) to exceed 6 inches over the next 24 hours. The abnormal procedure directs operators to increase monitoring of river levels and perform closure of water tight doors onsite. Operators have indications available in the control room that are used to monitor river level conditions and the actions to close water tight doors are within the capability of the minimum shift complement to complete. The entry into the abnormal operating procedure under the conditions described above provides sufficient time for the operators to complete required actions such that they can be relied upon to be completed prior to water levels on site approaching the 102 ft. PSD where flooding could impact system operations. Periodic testing of the watertight doors ensures their continued flood protection capability and demonstrates operator proficiency at performing this task. 3.2.3.4.3 Semi-Quantitative Treatment of External Flooding The potential impact of external flooding events on this risk assessment is considered using inputs from the full-power internal events which has been shown to be technically adequate per peer review in accordance RG 1.200. The steps to determine the potential impact of external flooding events for the proposed extensions are: Determine the surrogate initiating event that can be used to simulate an external flood Determine the system response to the initiating event Determine how the system of interest is used to mitigate the flood induced event Determine the impact on risk metrics An upper bound estimate of external flooding hazards was established by comparing external flooding events to a loss of offsite power (LOOP). The NRC Initiating Event data does not include any external-flood induced initiating events, though it does include other external events that have occurred (e.g., fires, seismic events). Weather-induced LOOPs have occurred, and are therefore more frequent than external-flood events. Therefore, it can be assumed that the frequency of an external flooding event is bounded by weather-induced LOOP (frequency of 4.09E-03 per year in the Salem PRA). Furthermore, while an external flooding event may not cause a LOOP, any increased risk due to extended inverter outages will only occur due to a LOOP-type event, so an external-flood-induced LOOP will be assumed. In the internal events PRA, weather-induced LOOP is modeled with a statistically determined recovery curve. While recoverable weather induced LOOPs have been observed with some frequency, unrecoverable events are rare. Thus, use of weather-induced initiating event frequency to bound the non-recovered external event frequency is considered appropriate. However, due to uncertainties regarding recovery of offsite power during an external-flood-induced LOOP, no credit for offsite power recovery will be credited in this calculation. Any external flooding analysis has to address beyond design basis floods and penetration seal failures. A full external flood PRA would be required to quantify the absolute risk of these scenarios, but the analysis in the section only addresses the incremental risk of these floods associated with increasing inverter unavailability. Though the most extreme beyond design basis floods are likely to cause additional failures that would make the status of the inverters inconsequential, for this calculation all external floods are assumed to be at a level where a LOOP is created but the inverters are still important.

LR-N18-0033 LAR S18-02 Enclosure Penetration seals could fail at flood levels below the plants design basis level. Salem takes steps to minimize this probability. Additionally, Salem has procedures that will mitigate any accident scenarios associated with penetration seal failures. These potential failures will increase the absolute risk associated with external floods, but will have little effect on the incremental risk associated with inverter unavailability. By using a very conservative initiating event frequency and non-recovery probability for offsite power, the incremental risk is accounted for in the following calculations. The change in risk for an external flood event is computed as an incremental conditional core damage probability similar to Section 3.2.2.4. Over a one-year time frame, this is generally equivalent to a change in CDF. The general equation is as follows: ICCDPINV = (CDFINV - CDFBASE)TINV For the case of specific initiating events, each CDF can be calculated as the frequency of the initiating event times the conditional core damage probability (CCDP) given that initiating event, or: ICCDPINV = f(External Flood LOOP)*(CCDPINV - CCDPBASE)*TINV The calculation of the CCDP values is quantified conservatively assuming that LOOP recovery is not possible. The calculation of ICLERP is similar. Applying these assumptions and calculations, with the TINV set to 7 days per year (1.92E-2 yr) yields the estimates of flood ICCDP and ICLERP in Table 3-12. Table 3-12 Risk Calculation for External Flood Events Inverter CCDP(INV) CCDP(BASE) CLERP(INV) CLERP(BASE) ICCDP ICLERP A 6.28E-04 6.15E-04 7.11E-05 6.62E-05 1.01E-09 3.84E-10 B 6.89E-04 6.15E-04 7.44E-05 6.62E-05 5.79E-09 6.43E-10 C 6.49E-04 6.15E-04 6.96E-05 6.62E-05 2.60E-09 2.67E-10 D 6.15E-04 6.15E-04 6.62E-05 6.62E-05 0.00E+00 0.00E+00 This bounding calculation indicates that total risk is small enough that changes to extend Allowed Outage AOTs for inverters do not have a significant effect on overall risk. The unavailability does not significantly affect this bounding calculation and could not affect a more realistic calculation. The risk increases are several orders of magnitude below the RG 1.177 decision criteria of ICCDP<1.0E-6 and ICLERP<1.0E-7. Thus, changes to risk associated with external floods cannot change the conclusion of the LAR. 3.2.3.5 Other External Hazards In addition to internal fires and seismic events, the Salem IPEEE analysis of high winds or tornados, external floods, transportation accidents, nearby facility accidents, release of onsite chemicals, detritus and other external hazards was accomplished by reviewing the plant environs against regulatory requirements regarding these hazards. The screening assessment took advantage of the fact that the site is co-located with the Hope Creek Generating Station (HCGS), which is a plant that meets the 1975 Standard Review Plan (SRP) criteria [27]. To the

LR-N18-0033 LAR S18-02 Enclosure extent that the event assessment is based on location of the site, as opposed to plant specific features, information from Sections 2 and 3 of the latest revision of the HCGS Updated FSAR (UFSAR) [28] was used to supplement information from the Salem UFSAR [29]. The class of external events termed "other external events" were screened out either by compliance with the 1975 SRP criteria or by bounding probabilistic analyses that demonstrated a core damage frequency of less than the IPEEE screening criterion. The external flood assessment provided input to the now completed PSEG Penetration Improvement Program by recommending that a high priority be placed on penetrations through the Auxiliary Building/Service Building walls. The IPEEE provided confidence that no plant-unique external event is known that poses a significant threat of severe accidents and that the Salem units are not vulnerable to other external events. More recently, in response to NRC Order EA-12-049 [30], which was issued following the tsunami and plant consequences experienced at Fukushima-Daichi in March 2011, PSEG developed an Overall Integrated Plan (OIP) [31] to enhance the defense-in-depth countermeasures aimed at mitigating extreme external hazards. The OIP employed the use of Diverse and Flexible Coping Strategies (FLEX) in accordance with the guidance given in NEI 12-06 [32]. This resulted in the deployment of portable FLEX equipment that could be put into service when necessary to mitigate extreme external hazards. Although FLEX is not explicitly modeled in the current PRA model, qualitative insights suggest that the risk due to these other external hazards, as well as other beyond design basis events pursuant to NEI 12-06, would be even less than what was characterized by any historic evaluations performed in support of the IPEEE. 3.2.3.6 External Hazard PRA Summary Due to the fact that Salem does not have a current external events PRA model, the use of stand-alone calculations based on the RG 1.200 peer-reviewed FPIE PRA and insights from IPEEE results was deemed acceptable for use in providing insights into the risk contribution associated with the AOT extension. In summary, the status of a particular inverter being out-of-service would have a negligible impact from an external events perspective. The external event CDFs and LERFs are clearly bounded by the PSEG risk calculations shown in this LAR. In addition, any risk increase would only occur for events that fail all but one (and only one) train of inverters since events that fail all trains or no trains would not be impacted by an extended AOT. Events that failed all but two or three inverters would require multiple random failures, which would be even lower probability than the calculations used. This conclusion is consistent with and supported by the FPIE risk insights. 3.2.4 Discussion of Uncertainty This section evaluates uncertainties that could impact the inverter AOT extension assessment. Overall, this analysis contains all the elements of risk-informed decision-making process described in NUREG-1855 [3]. The structure used to present this information is shown in Figure 3-3, which is taken from the companion document to NUREG-1855 entitled EPRI-1026511, Practical Guidance on the Use of Probabilistic Risk Assessment in Risk-Informed Applications with a Focus on the Treatment of Uncertainty [33]. Table 3-13 provides a roadmap identifying the relevant sections of the uncertainty analysis.

LR-N18-0033 LAR S18-02 Enclosure Table 3-13 ROADMAP TO THE UNCERTAINTY ANALYSIS Step Step Summary Document Section 1 Define the risk analysis application to be used to address RG 1.177 Performed in Section 1. 2 Assess the adequacy of the existing PRA models to support the analysis Performed in Section 3.2.1. Technical Adequacy of the PRA Model. 3 Perform the initial comparison with the acceptance guidelines. Identify significant contributors and role of affected function. Initial comparison is shown in the Executive Summary and Table 3-7; significant contributors (if any) are identified in Section 3.2.2. 4 Assess the adequacy of the scope of the PRA models Assessed in Section 3.2.3. 5 Perform final comparison with acceptance guidelines - assessment of significance of parameter and model uncertainty Analyzed in Section 3.2.7. 6 Prepare input for the integrated decision-making process Presented in Section 3.2.7.

LR-N18-0033 Enclosure Yes Step.3! Perform initial rompart son withactaft<e.gines. ldentif)l9gnilkllltcontribut<n> I and *e o( alferu!d function(s) Figure 3-3 LAR 818-02 Yes Yes Overview of Process for PRA Analysis to Support a Risk Informed Decision 3.2.4.1 Parametric Uncertainty Evaluation The evaluation of the CDF for the inverter AOT extension assessment has been supported by a detailed qualitative and quantitative uncertainty evaluation. The parametric uncertainty quantification is performed using the CAFTA utility, UNCERT, to identify the effect of the parametric correlation. The base model (SA 115C) uncertainty distribution for CDF of the application specific model is presented in Figure 3-4. The uncertainty distribution for CDF due to the condition in which an inverter is out of service is shown in Figure 3-5. To be conservative, Inverter C was chosen because it results it the greatest change in risk. Likewise, for LERF, the base model uncertainty distribution is presented in Figure 3-6, with the distribution for LERF while Inverter C is out of service is shown in Figure 3-7. The mean results for each case show similar differences from the point estimates. In addition, the cutset results for the dCDF/LERF assessments were reviewed to determine if an epistemic correlation could influence the mean value determination. From the review of the cutsets, it was determined that the dominant contributors do not involve basic events with epistemic correlations (i.e., the probabilities of multiple basic events within the same cutset for the dominant contributors are not determined from a common parameter value). Per Guideline 2b of EPRI 1016737 [34] it is acceptable to use the point estimate directly in the risk assessment. Therefore, the parameter uncertainty assessment indicates that the use of the point estimate results directly for this assessment is acceptable. LR-N18-0033 Enclosure 0.8 0.6 0.2 0 1E-D6 0.8 0.6 0.4 0.2 0 1E-D6 I/ J I I _/ 1E-GS A 1\\ I \\ I J \\. lE-<JS Parameter Point Est Samples Mean 5% Median 95% StdDev Skewness Parameter Sampling Method Sample Size Importance Measures Scope Cutset File(s) Selected Target(s) Database LAR S18-02 1E-ll4 1E-ll3 1E-G2 1E-G1 1E+OO 1E-ll4 1E-ll3 1H2 1H1 1E+OO Estimate Confidence Range 8.38E-06 50000 8.52E-06 [8.5E-06 I 8.6E-06] 3.65E-06 [3.6E-06 I 3.7E-06] 7.07E-06 [7.0E-06 I 7.1 E-06] 1.76E-05 [1.7E-05 I 1.8E-05] 6.53E-06 10.23874 Value Montecarlo 50000 FALSE All CDF 1 E-11.CUT CDF SA115C.rr FIGURE 3-4 PARAMETRIC UNCERTAINTY DISTRIBUTION FOR SALEM BASE MODEL CDF (SA115C) FOR THE INVERTER AOT EXTENSION APPLICATION MODEL LR-N 18-0033 Enclosure LAR S18-02 0.8 0.6 0.4 0.2 0 18l6 08 0.6 0.4 02 0 1E-o6 / I I I J 1E-ll5 /!\\. I\\ I ' I \\ J 1E-o5 Parameter Point Est Samples Mean 5% Median 95% StdDev Skewness Parameter Sampling Method Sample Size Importance Measures Scope Cutset File(s) Selected Target(s) Database 1E*04 1E-<J3 1E*02 1E-ll1 1E-04 1E-ll3 1E-o2 1E-G1 Estimate Confidence Range 8.77E-06 50000 8.95E-06 [8.9E-06, 9.0E-06] 3.89E-06 [3.9E-06, 3.9E-06] 7.47E-06 [7.4E-06, 7.5E-06] 1.80E-05 [1.8E-05, 1.8E-05] 7.02E-06 16.27634 Value Montecarlo 50000 FALSE All CDF _1E-11 DELTA C.CUT CDF SA115C.rr FIGURE 3-5 PARAMETRIC UNCERTAINTY DISTRIBUTION FOR SALEM CDF REPRESENTING THE INVERTER AOT EXTENSION 1E.OO 1E+OO

LR-N 18-0033 Enclosure 0.8 0.6 0.4 0.2 0 lE-08 OS 0.6 0.4 02 0 1E-Q8

5""

I I I /_ 1E-ll7 lE-{)6 G\\. /\\ I \\ II \\ j \\ 1E-ll7 1E<l6 Parameter Point Est-Samples Mean 5% Median 95% StdDev Skewness Parameter Sampling Method Sample Size Importance Measures Scope Cutset File(s) Selected Target(s) Database LAR S18-02 1815 1E41 lE-03 lE-02 1E-01 1E+OO 1E-o5 1E-ll4 1E-03 1EP 1E-ll1 1E+OD Estimate Confidence Range 4.47E-07 50000 4.50E-07 [4.5E-07 I 4.5E-07] 1.52E-07 [1.5E-07 I 1.5E-07] 3.57E-07 [3.5E-07 I 3.6E-07] 1.01E-06 [1.0E-06 I 1.0E-06] 4.39E-07 21.42005 Value Montecarlo 50000 FALSE All LERF 1E-12.CUT LERF SA115C.rr FIGURE 3-6 PARAMETRIC UNCERTAINTY DISTRIBUTION FOR SALEM BASE MODEL LERF (SA115C) FOR THE INVERTER AOT EXTENSION APPLICATION MODEL LR-N18-0033 Enclosure LAR S18-02 0.8 08 0.6 0.4 02 0 1E-Q8 I I I I / lE-07 lE-06 I\\ l \\ I \\ IJI \\ 1E.07 1E..il6 Parameter Point Est Samples Mean 5% Median 95% StdDev Skewness Parameter Sampling Method Sample Size Importance Measures Scope Cutset File(s) Selected Target(s) Database lE-{15 1E-<l4 1E<l3 1E<l2 1E.01 1E.o5 1E-<l4 1E-<J3 1E<l2 1E.01 Estimate Confidence Range 4.83E-07 50000 4.90E-07 [4.9E-07, 4.9E-07] 1.64E-07 [1.6E-07, 1. 7E-07] 3.85E-07 [3.8E-07, 3.9E-07] 1.10E-06 [1.1 E-06, 1.1 E-06] 4.76E-07 15.74544 Value Montecarlo 50000 FALSE All LERF _1E-12 DELTA C.CUT LERF SA115C.rr FIGURE 3-7 PARAMETRIC UNCERTAINTY DISTRIBUTION FOR SALEM LERF REPRESENTING THE INVERTER AOT EXTENSION lE+OO 1e.... oo

LR-N18-0033 LAR S18-02 Enclosure 3.2.4.2 Model Uncertainty The assessment of model uncertainty utilizes the guidance provided in EPRI 1016737 and in NUREG-1855 and considers the following: Characterize the manner in which the PRA model is used in the application. Characterize modifications to the PRA model. Identify application-specific contributors. Assess sources of model uncertainty in the context of important contributors. o Also consider other sources of model uncertainty from the base PRA model assessment for the identification of candidate key sources of uncertainty. o Screen based on relevance to parts of PRA needed or based on relevance to the results. Identify sources of model uncertainty and related assumptions relevant to the application. o This involves the formulation of sensitivity studies for those sources of uncertainty that may challenge the acceptance guidelines and an interpretation of the results. 3.2.4.2.1 Characterize the Manner in which the PRA Model is used in the Application The manner in which the PRA model is used in this application is fully described in Section 3.2 and is not reproduced here. 3.2.4.2.2 Characterize Modifications to the PRA Model The minor changes made to the PRA model of record (MOR) are described in Section 3.2.1.5. These changes made to the model do not introduce any application-specific sources of model uncertainty for this analysis. 3.2.4.2.3 Identify Application-Specific Contributors Application-specific contributors are fully discussed in Section 3.2.2.5 via examination of resulting cutsets and delete-term cutsets. The important contributors to the delta-risk metrics were identified as increases due to a few specific initiating events that are more impacted by the potentially increased unavailabilities. These initiating events are based on industry and plant-specific data and calculated using accepted realistic methods. Therefore, these application-specific contributors do not introduce any new sources of model uncertainty. 3.2.4.2.4 Assess Sources of Model Uncertainty in Context of Important Contributors to the Base Model A review of the identified sources of model uncertainty from the base model assessment as identified by implementing the process outlined in EPRI 1016737 for Salem was performed to determine which of those items are potentially applicable for this assessment even though they did not appear as a dominant contributor in the base assessment for the application. Based on this review, some of the items were already identified and many do not warrant further analysis, but the following items were added for investigation since they were judged to be potentially applicable for this application. Method of Calculating CDF/LERF Treatment of CCFs when one component is failed

LR-N18-0033 LAR S18-02 Enclosure Testing and maintenance events Significant fault tree modifications made to PRA model SA115A o Implementation of Mitigating Systems Performance Index (MSPI) pump (4th Auxiliary Feedwater (AFW) pump) o Station Blackout (SBO) event tree enhancements that make use of FLEX equipment for extended loss of A.C. power (ELAP) scenarios Method of Calculating CDF/LERF Another method of calculating CDF and LERF was considered which calculates CDFAVE and LERFAVE by adjusting the inverter testing and maintenance terms by a factor proportional to the change in allowed outage time. The changes are shown in Table 3-14. Table 3-14 New Inverter Unavailability for Sensitivity Description Basic Event Old UA New UA Factor of Change 115V A.C. Inverter 1A AC1-INV-TM-1A115 2.00E-04 1.40E-03 7 115V A.C. Inverter 1B AC1-INV-TM-1B115 2.00E-04 1.40E-03 7 115V A.C. Inverter 1C AC1-INV-TM-1C115 2.00E-04 1.40E-03 7 115V A.C. Inverter 1D AC1-INV-TM-1D115 2.00E-04 4.67E-04 2.33 Examining of resulting internal events cutsets and delete-term cutsets, there is zero change in the average CDF and LERF. At the truncations used for the model of record, the inverter testing and maintenance (T&M) terms do not appear in either the CDF or LERF cutsets. After the unavailability of these terms is increased as described in this sensitivity, any cutsets containing the T&M terms still fall below truncation and do not appear in the cutsets. Common Cause Failure Event Sensitivity Based on the identified important contributors and the addition of applicable base PRA model sources of uncertainty identified above, the next step is to perform an assessment to determine if sources of uncertainty have been addressed in the PRA that affect the important contributors for the application. For the ICCDP/ICLERP calculations where selected components are set to unavailable, a sensitivity study was performed which conservatively adjusts the CCF failure probabilities and uses the corresponding failure events instead of the testing and maintenance terms. This is done by setting the independent failure probability to 1 when solving the common cause failure equations. This is considered conservative since not all failures would be subject to common cause failure modes. In addition, using the failure terms instead of the test and maintenance terms introduces another conservatism by assuming that the backup power supply is not already aligned. The results of this sensitivity study are shown in Table 3-15, and show that the

LR-N18-0033 LAR S18-02 Enclosure calculated risk changes are still well below the acceptance criteria. Therefore, this is not identified as a model uncertainty that could impact the decision. Table 3-15 Sensitivity Results for Common Cause Failure Modes Case Trunc Result ICCDP/ICLERPSENS RG 1.177 Limit Inv. A CDF 1.00E-11 1.31E-05 9.09E-08 1.00E-06 Inv. A LERF 1.00E-12 8.30E-07 7.35E-09 1.00E-07 Inv. B CDF 1.00E-11 1.33E-05 9.44E-08 1.00E-06 Inv. B LERF 1.00E-12 8.42E-07 7.57E-09 1.00E-07 Inv. C CDF 1.00E-11 1.23E-05 7.44E-08 1.00E-06 Inv. C LERF 1.00E-12 8.25E-07 7.26E-09 1.00E-07 Inv. D CDF 1.00E-11 1.16E-05 6.20E-08 1.00E-06 Inv. D LERF 1.00E-12 7.25E-07 5.34E-09 1.00E-07 Testing and Maintenance Event Sensitivity The test and maintenance events in the model for the inverters are set based on plant data or on historical values that are considered conservative. In these risk evaluations, these unavailability terms are conservatively increased, and the results are still well below the acceptance criteria. Therefore, there is no unique model uncertainty related to these event probabilities that would impact the model to the extent to impact the decision. Recent SA115A Model Change Sensitivity During the SA115A PRA update the Mitigating Systems Performance Index (MSPI) pump (4th Auxiliary Feedwater pump) was incorporated in the PRA model. Additionally, enhancements were made to the Station Blackout (SBO) event tree that make use of FLEX equipment for extended loss of A.C. power (ELAP) scenarios. In order to determine the model sensitivity to these two changes, both the MSPI pump and FLEX diesel generator were failed in the model and the CDF/LERF for the AOT extension was recalculated. The results meet the RG 1.174 guidelines and are listed in Table 3-16.

LR-N18-0033 LAR S18-02 Enclosure Table 3-16 AOT Extension Sensitivity to Model Changes Case Failure Event Trunc Cutsets Result CDF/LERFAVE Delta CDF/LERF Base (no MSPI Pump or FLEX DG) CDF 1.00E-11 46615 1.74E-05 Base (no MSPI Pump or FLEX DG) LERF 1.00E-12 52509 8.36E-07 Inverter A OOS CDF 1.00E-11 51175 1.80E-05 1.75E-05 1.03E-08(1) Inverter A OOS LERF 1.00E-12 60498 8.73E-07 8.37E-07 7.11E-10(1) Inverter B OOS CDF 1.00E-11 52685 1.83E-05 1.75E-05 1.55E-08(1) Inverter B OOS LERF 1.00E-12 59531 8.90E-07 8.37E-07 1.03E-09(1) Inverter C OOS CDF 1.00E-11 55004 2.63E-05 1.76E-05 1.70E-07(1) Inverter C OOS LERF 1.00E-12 62316 1.71E-06 8.53E-07 1.68E-08(1) Inverter D OOS CDF 1.00E-11 46615 1.74E-05 1.74E-05 0.00E+00(1) Inverter D OOS LERF 1.00E-12 52509 8.36E-07 8.36E-07 0.00E+00(1) Table Note:

1.

Region III of RG 1.174 -- very small risk changes. 3.2.4.2.5 Identify Sources of Model Uncertainty and Related Assumptions Relevant to the Application Based on the evaluation of important contributors above, no items were identified as key sources of uncertainty that would impact the risk results to an extent to affect the decision. 3.2.4.3 Completeness Uncertainty As discussed in Section 3.2.3, external hazards from fire, seismic, and external flooding events were addressed using conservative quantitative and qualitative analyses as not having a significant contribution to any risk increases associated with these AOT extensions. Other external hazards, as discussed in the IPEEE, were screened out as being insignificant. Therefore, only two hazard groups (internal events and internal floods) were explicitly calculated for this risk assessment. There is no major form of completeness uncertainty that would impact the results of this assessment. The risk analysis in this LAR shows the risk increases associated with on-line inverter maintenance. The need for inverter maintenance could emerge while in Mode 3. The plant spends less time in Mode 3 than it does on-line, thus the likelihood of needing maintenance is lower. The risk increases associated with on-line maintenance bound the risk increases associated with Mode 3 maintenance. Thus, the risk associated with shutdown maintenance is also bounded and does not need to be quantified in this LAR. Therefore, there is no major form of completeness uncertainty that would impact the results of this assessment.

LR-N18-0033 LAR S18-02 Enclosure 3.2.5 Tier 2. Avoidance of Risk Significant Plant Configurations The risk metrics calculated in Section 3.2.2 demonstrate that Salem is well within the acceptance criteria for the proposed inverter AOT extension in its current configuration. The risk insights discussed in Section 3.2.2.5 did not identify any equipment outage or plant configuration with extremely high risk contributions while an inverter is out of service. Therefore, no plant configuration or equipment outage would require enhancements to Technical Specifications or plant procedures. Nevertheless, PSEG has identified a set of Compensatory Measures that would improve the plants defense-in-depth with one inverter in maintenance and further increase the available margin to the acceptance guidelines, should it be judged necessary. These measures are presented below. The following are a list of identified compensatory measures to be used during planned inverter outages that are qualitative, prudent actions, consistent with other licensees that have received similar extensions of the inverter allowed out-of-service time.

1. Entry into the extended inverter AOT will not be planned concurrent with EDG maintenance.

2. Entry into the extended inverter AOT will not be planned concurrent with planned maintenance on another reactor trip system or ESF actuation system instrumentation channel that could result in that channel being in a tripped condition.

The practical implementation of these compensatory measures in the PRA model has taken the following approach: Compensatory Measure 1 is not directly credited, though Salem does credit an existing manual action to start EDGs if the automatic signal fails. This compensatory action is taken because it is recognized that with an inverter inoperable and the instrument bus being powered by the back-up transformer, instrument power for that train is dependent on power from the associated DG following a loss of offsite power event. Compensatory Measure 2 is not directly credited in the risk metric calculations. This is a conservative assumption. 3.2.6 Tier 3. Risk-Informed Configuration Management Implementation of the Salem Configuration Risk Management Program, which meets the requirements in Regulatory Guide 1.177 Section 2.3.7.2, helps to ensure there is no significant risk increase while maintenance is being performed. This tier is important because all possible risk-significant configurations under Tier 2 cannot be predicted. Salem implements the applicable portions of the Maintenance Rule by using the endorsed guidance of Section 11.0 of NUMARC 93-01. Salem uses the Equipment Out of Service (EOOS) Configuration Risk Monitor program from the Electric Power Research Institute (EPRI) to implement 10 CFR 50.65(a)(4). EOOS uses the same fault trees and database as the internal events PRA model, so it is fully capable of evaluating CDF and LERF for internal events. The loading and use of EOOS is procedurally controlled by the PSEG PRA procedures.

LR-N18-0033 Enclosure LAR S18-02 Salem procedures recognize there are limitations in EOOS and specifically direct consideration of external events and site activities that can result in significant plant events. Some conditions are evaluated in EOOS through multiplication factors; others procedurally lead to other meditative actions including plant color changes. Fire risk management actions, which are governed by the same set of procedures and implemented by the same staff, are determined from the deterministic fire safe shutdown procedures from 1 0 CFR 50 Appendix R. When maintenance or testing is scheduled, the Operations, Work Week Management and Site Risk Management staff perform and review weekly risk analyses using the EOOS program. For unplanned or emerging equipment failures, control room personnel will enter the configuration into the EOOS. In either case, the configuration will be evaluated to assess and manage the risk. Risk associated with unavailable plant equipment is assessed at Salem as required by 1 0 CFR 50.65(a)(4). The PSEG work management administrative procedure governs on-line risk assessments. The on-line risk assessment is a blended approach using qualitative or defense in-depth considerations and quantifiable PRA risk insights when available to complement the qualitative assessment. Salem communicates on-line plant risk using three risk tiers (GREEN, YELLOW, and RED). The criteria for these tiers are as follows: Configuration Risk Management Criteria Color Risk Th reshold I CD P1' l < 1 6-6 for 7 day duration .AND Green No LOOP High Risk Evolution (HRE) .AND I LER pi:Z:O < 1 6-7 for 7 day duration I C DP1' l > 1 6-6 Brill < 1 6-5 for 7 day duration OR Yellow LOOP High Risk Evolution (HRE) OR I LER pi:Z:O > 1 6-7.AND < 1 6-6 for 7 day duration ICDP1'l >1 6-5 tlr 7 dayduralion Red OR ILEFIPI:Z:O >-1E-6 tlr7 daydl raiJI (1l Incremental Core Damage Probability Required Action No speci1c actions are required. Umit the unavailabilitytime byestablishing a continuous worio: schedule or pro\\lide justi1icali on. Protect SS Cs which would cause an unplanned entry into a Red risk condilion it lost concurrent with other SSCs being unavailable tlr mairtenance. It is unacceJtable to volun1aril y enter this condition. !E an emergent condilion causes. or degradation may cause an unplanned entry into this condition. immediate actions shall be 1aken to restore and/or protect SSCs relied u pon 1Xl miligate events, and to contact the stalion duty manager for direction and support. (2l Incremental Large Early Release Probability The on-line risk level for both Salem units will remain GREEN for an outage of any single component seeped into this proposed change. At this level, risk is considered close to baseline, and compliance with technical specification requirements would be considered adequate risk management. Nevertheless, PSEG maintenance practices involve protecting other inverters coincident with maintenance being performed on a single inverter per OP-AA-1 08-116, Protected Equipment Program. This procedure states that if an inverter train is unavailable as LR-N18-0033 LAR S18-02 Enclosure permitted by technical specifications, the remaining operable trains shall be protected. The PRA MOR directly accounts for this maintenance practice and is reflected in the quantitative analysis. Protecting equipment requires posting of signs and robust barriers to alert personnel not to approach the protected equipment. Work on protected equipment is generally disallowed. Minor exceptions exist for activities such as inspections, security patrols, or emergency operations. Other exceptions may be authorized by the station shift manager in writing. If additional unplanned equipment unavailability occurs, station procedures direct that the risk be re-evaluated, and if found to be unacceptable, compensatory actions are taken until such a time that the risk is reduced to an acceptable level. In addition, OP-AA-108-116 directs the Operations and Work Management personnel to routinely monitor various maintenance configurations and protect equipment that could lead to an elevated risk condition (e.g., red risk condition) if it were to become unavailable due to unplanned or emergent conditions. This is normally accomplished using the EOOS PRA software tool, supplemented by operations and work management procedures. 3.2.7 Risk Summary and Conclusion Consistent with the NRCs approach to risk-informed regulation, PSEG has identified particular Technical Specification (TS) requirements that are restrictive in nature and, if relaxed, have a minimal impact on the safety of the plant. These Technical Specifications require that the 115V A.C. inverter Allowed Outage Times (AOT) (also referred to as Completion Times) be restricted to 24 hours for trains A, B, and C, and 72 hours for train D. The proposed change is to increase the AOTs for all trains from the currently specified time to 7 days. This section summarizes the risk metrics requested by the NRC Regulatory Guides, provides the calculated results using the SA115C Salem PRA models, and presents the conclusion of this assessment for the extended inverter AOT analysis. 3.2.7.1 Regulatory Guidelines As described earlier, the probabilistic risk assessment input to the decision making process has been defined in detail by the NRC in two Regulatory Guides, Regulatory Guides 1.174 and 1.177. The NRC has specified in Regulatory Guides the risk metrics that should be calculated to provide input into the decision making process. The risk metrics chosen by the NRC in their Regulatory Guides include the following: The change in Core Damage Frequency (CDF) (Reg. Guide 1.174) The change in Large Early Release Frequency (LERF) (Reg. Guide 1.174) The Incremental Conditional Core Damage Probability (ICCDP) (Reg. Guide 1.177) The Incremental Conditional Large Early Release Probability (ICLERP) (Reg. Guide 1.177) These risk metrics were all calculated using the SA115C PRA models (see Section 3.2.1.5), which were developed as application specific models to more accurately assess the incremental

LR-N18-0033 LAR S18-02 Enclosure increase in risk for these extended AOT analyses by adding inverter and common cause failure terms. Quantitative guidelines are defined by the NRC in RG 1.174 and 1.177 for what is an acceptably small change in risk: The Salem calculated ICCDP and ICLERP for the inverter AOT extensions are sufficiently below the guidelines of <1.0E-06 and <1.0E-07, respectively, to be able to call the risk change small. Hence, the guidelines of Reg. Guide 1.177 for the increased inverter AOTs have been met. See the Executive Summary and Table 3-6 for the quantitative results. Furthermore, the evaluation of changes in CDF and LERF due to the AOT extensions have been shown to be an order of magnitude below the displayed area for Region III as depicted in RG1.174. See Table 3-6 for numerical results. These calculations support the increase in the inverter AOTs from a quantitative risk-informed perspective. 3.2.7.2 PRA Model The quantitative evaluation of the risk metrics for this application was performed using the SA115C Salem PRA Application Specific Model. This included the following changes to the SA115A PRA Model of Record: Addition of inverter maintenance terms Addition of inverter common cause failure terms Addition of logic which models the automatic bus transfer switch EDG electrical support dependencies are more accurately modeled Mutually exclusive file has been edited to exclude concurrent maintenance of inverters 3.2.7.3 Quantitative PRA Results: Regulatory Guide 1.177 and 1.174 This subsection includes the quantitative PRA results using the SA115C Salem PRA model. The calculated results using the application specific PRA model are shown in Table 3-17. The results are compared with the acceptance guidelines that are specified by the NRC in Regulatory Guide 1.174 and Regulatory Guide 1.177. The comparison of the CDF and LERF risk metrics with Regulatory Guide 1.174 guidelines are graphically depicted in Figure 3-8 and Figure 3-9, respectively. These results provide a good indication that the risk associated with this proposed extension of the inverter AOTs is very small. These results are also reinforced by the Tier 2 and Tier 3 assessments. 3.2.7.4 External Hazards Considerations The evaluation of risk due to fire, seismic, and external flooding events was based on conservative quantitative and qualitative analyses, along with insights gleaned from the IPEEE. Within this analysis, Section 3.2.3.2 addresses fire risk, Section 3.2.3.3 addresses seismic risk,

LR-N18-0033 LAR S18-02 Enclosure and Section 3.2.3.4 addresses external flooding risk. For this particular AOT extension, there are no significant increases in risk expected due to any of these external hazards. With regard to fire hazards, since the specified inverters and their support systems do not show a high dependence on the results of the fire model, it was concluded in Section 3.2.3.2 that the risk increase would be negligible due to extending the AOTs. This insight was based on the fact that the unavailability of the 115V A.C. inverters does not have a high impact on the ability to mitigate any of the dominant fire risk contributors. With regard to seismic hazards, because damage to equipment during seismic events is often correlated across trains, extension of AOTs for 115V A.C. inverters will have a negligible impact on Seismic risk estimates. A stand-alone conservative calculation also shows a negligible impact on Seismic risk. As such, it is concluded that there would be no significant impact on seismic risk due to extending the AOT for these inverters. A similar calculation for external floods also shows a negligible risk increase due to extending the AOT for the 115V A.C. inverters. Other external hazards were screened as being insignificant, as documented in Section 1.4.3 of the Salem IPEEE, and as such, were not deemed applicable to this analysis for the AOT extension. 3.2.7.5 Conclusion The risk change calculated with the SA115C Salem PRA model for the proposed 115V A.C. inverter AOT extension is considered to be very small. The ICCDP and ICLERP for the inverter unavailability is sufficiently below the guidelines of <1.0E-06 and <1.0E-07, respectively, to be able to call the risk change small. Hence, the guidelines of RG1.177 for the increased Allowed Outage Times have been met. Furthermore, the calculated changes in CDF and LERF due to the inverter AOT extension have been shown to meet the risk significance criteria of Regulatory Guide 1.174 with substantial margin, i.e., Region III which represents very small risk changes. Table 3-17 provides a listing of the numerical results, with Figure 3-8 and Figure 3-9 showing a graphical depiction of the CDF and LERF results. These calculations support the increase in the inverter AOT extension from a quantitative risk-informed perspective, which includes following established PSEG maintenance practices as discussed in Section 3.2.2.3. TABLE 3-17 RESULTS OF RISK EVALUATION FOR SALEM Case Event CDF/LERF ICCDP/ICLERP RG 1.177 Guideline RG 1.174Evaluation Inv A CDF 7.85E-10 < 1E-06 Region III - very small LERF 1.10E-10 < 1E-07 Region III - very small Inv B CDF 2.56E-09 < 1E-06 Region III - very small

LR-N18-0033 LAR S18-02 Enclosure Case Event CDF/LERF ICCDP/ICLERP RG 1.177 Guideline RG 1.174Evaluation LERF 1.70E-10 < 1E-07 Region III - very small Inv C CDF 7.49E-09 < 1E-06 Region III - very small LERF 6.90E-10 < 1E-07 Region III - very small Inv D CDF 0.00E+00 < 1E-06 Region III - very small LERF 0.00E+00 < 1E-07 Region III - very small

LR-N 18-0033 Enclosure 1o** FIGURE 3-8 LAR S18-02 CDF ACCEPTANCE GUIDELINES FOR CORE DAMAGE FREQUENCY (CDF) t u.. a: 4 ..( 10... 10*8 10*5 LERF Jlt FIGURE 3-9 ACCEPTANCE GUIDELINES FOR LARGE EARLY RELEASE FREQUENCY (LERF)

4.0 REGULATORY EVALUATION

LR-N18-0033 LAR S18-02 Enclosure 4.1 Applicable Regulatory Requirements and Criteria 10 CFR 50.36 Technical Specifications 10 CFR 50.36, Technical Specifications, identifies the requirements for the Technical Specification categories for operating power plants: (1) Safety limits, limiting safety system settings, and limiting control settings, (2) Limiting conditions for operation, (3) Surveillance requirements, (4) Design features, (5) Administrative controls, (6) Decommissioning and (7) Initial notification, and (8) Written Reports. For Limiting conditions for operation, 10 CFR 50.36 states: Limiting conditions for operation are the lowest functional capability or performance levels of equipment required for safe operation of the facility. When a limiting condition for operation of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the technical specifications until the condition can be met. The OPERABILITY of the inverters is consistent with the initial assumptions of the accident analyses and is based on meeting the design basis of the unit. The inverters are a part of the distribution system and, as such, satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 10 CFR 50 Appendix A General Design Criteria (GDC) Salem Generating Station was designed using the Atomic Industrial Forum (AIF) general design criteria as published in a letter to the Atomic Energy Commission (AEC) from E. A. Wiggin, Atomic Industrial Forum, dated October 2, 1967. In addition to the AIF General Design Criteria, the Salem Generating Station (SGS) was designed to comply with Public Service Electric & Gas (PSE&G's) understanding of the intent of the AEC's proposed General Design Criteria, as published for comment by the AEC in July, 1967. The proposed GDCs applicable to this proposed change are 24 - Emergency Power for Protection Systems," 25 - Demonstration of Functional Operability of Protective Systems and 39 - Emergency Power for Engineered Safety Features. A comparison of the Salem plant design with 10 CFR 50, Appendix A, (General Design Criteria for Nuclear Power Plants dated July 7, 1971) was performed and documented in Salem UFSAR Section 3.1.3. The Salem Plant design conforms to the intent of "General Design Criteria for Nuclear Power Plants," (10 CFR 50, Appendix A) dated July 7, 1971 with exceptions noted in the UFSAR. 10 CFR 50.65, "Requirements for monitoring the effectiveness of maintenance at nuclear power plants," requires that preventive maintenance activities must be sufficient to provide reasonable assurance that SSCs are capable of fulfilling their intended functions. As it relates to the proposed inverter Allowed Outage Time extension, 10 CFR 50.65(a)(4) requires the assessment and management of the increase in risk that may result from proposed maintenance activities. As discussed previously, the Salem Maintenance Rule program monitors the reliability and availability of the A.C. inverters and ensures that appropriate management attention and goal setting are applied based on pre-established performance criteria. The A.C. inverters are all currently in the 10 CFR 50.65(a)(2) Maintenance Rule category (i.e., the A.C. inverters are meeting established performance criteria). The Salem CRMP is consistent with 10 CFR 50.65(a)(4), and is managed to ensure that risk-significant plant configurations will not be entered for planned maintenance activities, and that appropriate actions will be taken should unforeseen events place the plant in a risk significant configuration during the proposed extended A.C. inverter Allowed Outage Time. Therefore, the proposed extension of the A.C. inverter Allowed Outage Time from 24/72 hours to 7 days are not anticipated to result in exceeding the current established Maintenance Rule criteria for the A.C. inverters.

LR-N18-0033 LAR S18-02 Enclosure 10 CFR 50.63, "Loss of all alternating current power," requires that nuclear power plants must be able to withstand a loss of all A.C. power for an established period of time and recover from a station blackout. The proposed extension of the A.C. inverter Completion Time from 24/72 hours to 7 days has no significant effect on the ability to withstand a loss of all A.C. power and recover from a station blackout. 4.2 Precedent 4.2.1 License Amendments The changes proposed herein to the Allowed Outage Time for restoration of an inoperable A.C. inverter are similar to those previously approved by the NRC for the Clinton Power Station, North Anna Power Station, Byron and Braidwood Stations, and Palo Verde Station. These previous approvals are discussed below. Palo Verde Nuclear Generating Station By Arizona Public Service (APS) letter dated September 29, 2009 (ADAMS accession ML092810227), as supplemented by APS letters dated June 24, 2010 (ML101880263), September 03, 2010 (ML102571398), and September 24, 2010 (ML102720481), APS requested NRC approval of a Palo Verde Nuclear Generating Station TS change to extend the inverter Allowed Outage Time. The NRC approved the change in License Amendment Nos. 180 for Palo Verde, Units 1, 2 and 3, issued September 29, 2010 (ML102670352). The amendment issued for the Palo Verde Nuclear Generating Station was substantively equivalent to the amendment requested herein for Salem, in that it revised TS 3.8.7, "Inverters - Operating," to change the Allowed Outage Time for restoration of an inoperable inverter from 24 hours to 7 days. Clinton Power Station By AmerGen Energy Company, LLC (AmerGen) letter dated April 26, 2004 (ADAMS Accession ML041210913), as supplemented by AmerGen letters dated April 18, 2005 (ML051080395), October 11, 2005 (ML052910184), and May 19, 2006 (ML061500124), AmerGen requested NRC approval of a Clinton Power Station TS change to extend the Completion Time for Nuclear System Protection System Inverters. The NRC approved the change in License Amendment No. 174 for the Clinton Power Station, Unit 1, issued May 26, 2006 (ML061160181). The amendment issued for the Clinton Power Station was substantively equivalent to the amendment requested herein for Salem, in that it revised TS 3.8.7, "Inverters - Operating," to change the Completion Time for restoration of an inoperable inverter from 24 hours to 7 days. North Anna Power Station By Virginia Electric and Power Company (VEPC) letter dated December 13, 2002 (ADAMS accession ML023600217), as supplemented by VEPC letters dated May 8, 2003 (ML031400019), December 17, 2003 (ML033580639), February 12, 2004 (ML040550548), and March 9, 2004 (ML040700512), VEPC requested NRC approval of a North Anna Power Station TS change to extend the inverter Allowed Outage Time. The NRC approved the change in License Amendment Nos. 235 and 217 for the North Anna Power Station, Units 1 and 2, respectively, issued May 12, 2004 (ML041380438). The amendment issued for the North Anna Power Station was substantively equivalent to the amendment requested herein for Salem, in

LR-N18-0033 LAR S18-02 Enclosure that it revised TS 3.8.7, "Inverters - Operating," to change the Allowed Outage Time for restoration of an inoperable inverter from 24 hours to 7 days. Byron and Braidwood Power Stations By Exelon Generation Co., LLC (Exelon) letter dated October 16, 2002 (ADAMS accession ML023020061), as supplemented by Exelon letters dated June 20, 2003, October 14, 2003 (ML032900989), and November 7, 2003 (ML033160196), Exelon requested NRC approval of TS changes to extend the inverter Completion Time for the Byron and Braidwood Stations. The NRC approved the changes in License Amendment Nos. 135 for the Byron Station, Units 1 and 2, and Amendment Nos. 129 for the Braidwood Station, Units 1 and 2, issued November 19, 2003 (ML032830455). The amendments issued for the Byron and Braidwood Stations were substantively equivalent to the amendment requested herein for Salem, in that they revised TS.3.8.7, "Inverters - Operating," to change the Completion Time for restoration of an inoperable inverter from 24 hours to 7 days. 4.2.2 Notice of Enforcement Discretion (NOED) Nuclear power plants with instances of inverter failures prompting requests for NOEDs to extend the Completion Time for an inoperable distribution panel inverter.

1) NRC Letter to Union Electric Company, "Notice of Enforcement Discretion for Union Electric Company Regarding Callaway Plant Unit 1 [TAC NO. ME9277, NOED No.

12-4-002]," dated August 23, 2012 (ADAMS Accession No. ML12237A010). This NOED granted enforcement discretion for an additional 36 hours.

2) NRC Letter to FPL Energy Seabrook, LLC, "Notice of Enforcement Discretion for FPL Energy Seabrook, LLC, Regarding Seabrook Station, NOED No. 2005-01-01,"

dated December 5, 2005 (ADAMS Accession No. ML053400372). This NOED granted an AOT extension of 18 hours.

3) NRC Letter to Nine Mile Point Nuclear Station, LLC, "Notice of Enforcement Discretion Regarding Nine Mile Point Unit 2, NOED No. 2003-03-01-002," dated August 18, 2003 (ADAMS Accession No. ML032310080). This NOED granted an AOT extension of 18 hours.

4) NRC Letter to Tennessee Valley Authority, "Notice of Enforcement Discretion for Tennessee Valley Authority Regarding Watts Bar Nuclear Plant Unit 1, NOED No.

2001-2-001," dated March 8, 2001 (ADAMS Accession No. ML010680211). This NOED granted an AOT extension of 24 hours. 4.3 No Significant Hazards Consideration PSEG Nuclear LLC (PSEG) requests approval of a change to the Salem Generating Station (Salem) Technical Specifications (TS) concerning Alternating Current (AC) Inverters. The proposed change would extend the Allowed Outage Time (AOT) for an inoperable inverter from 24 hours for the A, B and C inverters to 7 days and from 72 hours for the D inverter to 7 days. The proposed new allowed outage time (AOT) is based on application of the Salem Probabilistic Risk Assessment (PRA) in support of a risk-informed extension, and on additional considerations and compensatory actions. The risk evaluation and deterministic engineering analysis supporting the proposed change were developed in accordance with the guidelines established in Regulatory Guide (RG) 1.177, "An Approach for Plant-Specific Risk-informed Decision-making: Technical Specifications," and Regulatory Guide 1.174, "An Approach for

LR-N18-0033 LAR S18-02 Enclosure Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis." PSEG Nuclear (PSEG) has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, Issuance of amendment, as discussed below:

1.

Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated? Response: No. The proposed TS amendment does not affect the design of the vital A.C. inverters, the operational characteristics or function of the inverters, the interfaces between the inverters and other plant systems, or the reliability of the inverters. An inoperable vital A.C. inverter is not considered an initiator of an analyzed event. In addition, TS Actions and the associated Allowed Outage Times are not initiators of previously evaluated accidents. Extending the Allowed Outage Time for an inoperable vital A.C. inverter would not have a significant impact on the frequency of occurrence of an accident previously evaluated. The proposed amendment will not result in modifications to plant activities associated with inverter maintenance, but rather, provides operational flexibility by allowing additional time to perform inverter troubleshooting, corrective maintenance, and post-maintenance testing on-line. The proposed extension of the Allowed Outage Time for an inoperable vital A.C. inverter will not significantly affect the capability of the inverters to perform their safety function, which is to ensure an uninterruptible supply of 115-volt A.C. electrical power to the associated power distribution subsystems. An evaluation, using PRA methods, confirmed that the increase in plant risk associated with implementation of the proposed Allowed Outage Time extension is consistent with the NRC's Safety Goal Policy Statement, as further described in RG 1.174 and RG 1.177. In addition, a deterministic evaluation concluded that plant defense-in-depth philosophy will be maintained with the proposed Allowed Outage Time extension. There will be no impact on the source term or pathways assumed in accidents previously evaluated. No analysis assumptions will be changed and there will be no adverse effects on onsite or offsite doses as the result of an accident. Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2.

Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated? Response: No. The proposed amendment does not involve physical alteration of the Salem Generating Station. No new equipment is being introduced, and installed equipment is not being operated in a new or different manner. There is no change being made to the parameters within which Salem is operated. There are no setpoints at which protective or mitigating actions are initiated that are affected by this proposed action. The use of

LR-N18-0033 LAR S18-02 Enclosure the alternate Class 1E power source for the vital A.C. instrument bus is consistent with the Salem plant design. The change does not alter assumptions made in the safety analysis. This proposed action will not alter the manner in which equipment operation is initiated, nor will the functional demands on credited equipment be changed. No alteration is proposed to the procedures that ensure Salem remains within analyzed limits, and no change is being made to procedures relied upon to respond to an off-normal event. As such, no new failure modes are being introduced. Therefore, the proposed changes do not create the possibility of a new or different kind of accident from any previously evaluated.

3.

Does the proposed amendment involve a significant reduction in a margin of safety? Response: No. Margin of safety is related to the confidence in the ability of the fission product barriers to perform their design functions during and following an accident. These barriers include the fuel cladding, the reactor coolant system, and the containment system. The proposed change, which would increase the AOT from 24/72 hours to 7 days for one inoperable inverter, does not exceed or alter a setpoint, design basis or safety limit. Therefore, the proposed amendment does not involve a significant reduction in a margin of safety. 4.4 Conclusion In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5.0 ENVIRONMENTAL CONSIDERATION

A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluent that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

LR-N18-0033 LAR S18-02 Enclosure

6.0 REFERENCES

1. Regulatory Guide 1.174: An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, USNRC, Revision 2, May 2011.

2. Regulatory Guide 1.177: An Approach for Plant-Specific, Risk-Informed Decision-Making: Technical Specifications, USNRC, Revision 1, May 2011.

3. U.S. Nuclear Regulatory Commission, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision-making, NUREG-1855, Revision 1, ML15026A512.

4. American Society of Mechanical Engineers, Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, (ASME RA-S-2002), Addenda RA-Sb-2005, December 2005.

5. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk Informed Activities, Revision 2, March 2009.

6. PSEG, Salem Generating Station Individual Plant Examination, July 1993.

7. NRC Generic Letter 88-20, Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10 CFR 50.54(f), Supplement 4, June 28, 1991.

8. Westinghouse, RG 1.200 PRA Peer Review Against the ASME PRA Standard Requirements for the Salem Generating Station, Units 1 and 2 PRA, LTR-RAM-II 001, June 2009.

9. PSEG, Salem Generating Station Individual Plant Examination of External Events, January 1996.

10. PSEG, FPIE PRA Model Update, ER-AA-600-1015, Revision 8.

11. NEI 05-04, Revision 1 (Draft), Process for Performing Follow-On PRA Peer Reviews Using the ASME PRA Standard (Internal Events), Nuclear Energy Institute, November 2007.

12. Salem Generating Station, Mitigating System Performance Index Basis Document, SC-MSPI-001, Revision 12, December 2016.

13. Salem Generating Station, Quantification Notebook, SA-PRA-014, Revision 1, December 2016.

14. American Society of Mechanical Engineers, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addenda to ASME/ANS RA-S-2008 (ASME/ANS RA-Sa-2009), February 2009.

15. Salem Full Power Internal Events PRA Model, SA115A. August 2016.

16. INEL SPAR Basic Event Unavailability Data and Results, 2015 Parameter Estimation Update 2015.

17. Salem NRC SPAR Model, version 8.50.

18. INEL-94/0066 Common-Cause Failure Data Collection and Analysis System Volume 2

- Definition and Classification of Common-Cause Failure Events," Idaho National Engineering Laboratory. December 1995.

19. PSEG, Protected Equipment Program, OP-AA-108-116, Revision 12.

20. Individual Plant Examination for Severe Accident Vulnerabilities-10 CFR 50.54(f),

Generic Letter 88-20, November 23, 1988.

21. NUREG-1407, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities, June 1991.

22. Professional Loss Control, Inc., Fire-Induced Vulnerability Evaluation (FIVE)

Methodology Plant Screening Guide, EPRI TR-100370, Electric Power Research Institute, April 1992.

LR-N18-0033 LAR S18-02 Enclosure

23. PSEG, Salem Fire Protection Report - Safe Shutdown Analysis, DE-PS.ZZ-0001(Q),

Rev. 1, 1991.

24. PSEG, Salem Fire Protection Report - Fire Hazards Analysis, DE-PS.ZZ-001(Q)-A2-FHA, Rev. 4, 1993.

25. PSEG, Action Request for Reducing Potential Risk to Cables Routed Through the Turbine and Service Buildings Which Supply Offsite Power to the 4kV Vital Buses, 1995.

26. U.S. NRC's Response to 10 CFR 50.54(f) Recommendation 2.1 of the Near-Term Task Force Review of the Fukushima Accident - Salem Generating Station, LR-N14-0051, March 2014.

27. U.S. Nuclear Regulatory Commission, Standard Review Plan for Review of Safety Analysis Report for Nuclear Power Plants, NUREG-75/187, December 1975.

28. PSEG, Hope Creek Generating Station Updated Safety Analysis Report, Sections 2 and 3, Latest Revision.

29. PSEG, Salem Generating Station Updated Safety Analysis Report, Sections 2 and 3, Latest Revision.

30. NRC Order Number EA-12-049, Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events, March 12, 2012.

31. PSEG Nuclear, PSEG Nuclear LLCs Overall Integrated Plan for the Salem Generating Station in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events (Order Number EA-12-049), LR-N13-0034, February 28, 2013.

32. Nuclear Energy Institute (NEI) 12-06, Diverse and Flexible Coping Strategies (FLEX)

Implementation Guide, Rev. 0, August 2012.

33. Practical Guidance on the Use of Probabilistic Risk Assessment in Risk-Informed Applications with a Focus on the Treatment of Uncertainty, EPRI Report 1026511, Palo Alto, CA December 2012.

34. Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, EPRI Report 1016737, Palo Alto, CA, December 2008.

35. USNRC, "Industry Guidelines for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, NUMARC 93-01, Revision 4D," June 2015.

36. PSEG Letter LR-N12-0370, Salem Generating Station Response to Recommendation 2.3: Flooding Walkdown of the Near-Term Task Force Review of Insights from the Fukushima Dai-chi Accident, Nov. 26, 2012, ML123340583.

37. NRC, Nuclear Regulatory Commission Report for the Audit Of PSEG Nuclear LLC's Flood Hazard Reevaluation Report Submittals Relating to the Near-Term Task Force Recommendation 2.1-Flooding for Salem Nuclear Generating Station, Units 1 and 2, January 8, 2016, ML15364A073.

38. NRC, Salem Generating Station Units 1 And 2-Staff Assessment of Flooding Walkdown Report Supporting Implementation of Near-Term Task Force Recommendation 2.3 Related to the Fukushima Dai-Ichi Nuclear Power Plant Accident, June 16, 2014, ML14140A307.

39. PSEG Letter LR-N14-0042, PSEG Nuclear LLC's Response to Request for Information Regarding Flooding Aspects of Recommendation 2.1 of the Near-Term Task Force Review of Insights from the Fukushima Dai-chi Accident-Salem Generating Station Flood Hazard Reevaluation, March 11, 2014, ML14071A401.

40. PSEG Letter LR-N16-0161, Salem Generating Station's Flood Hazards Mitigating Strategies Assessment (MSA) Report Submittal, Dec. 30, 2016, ML16365A151.

41. EPRI Report 3002004400, "Local Precipitation-Frequency Studies, Development of 1-Hour/1-Square Mile Precipitation-Frequency Relationships for Two Example Nuclear Power Plant Sites," 2014.

LR-N18-0033 LAR S18-02 Enclosure

42. PSEG, OP-AA-108-111-1001, Severe Weather and Natural Disaster Guidelines.

43. PSEG, SC.OP-AB.ZZ-0001, Adverse Environmental Conditions.

44. USACE Report ERDC/CHL TR-11-1, Report 5, "Coastal Storm Surge Analysis: Storm Surge Results," November 2013.

45. NEI 12-07, "Guidelines for Performing Verification Walkdowns of Plant Flood Protection Features," Revision 0-A dated May 2012 (ML12173A215).

46. PSEG Document ER-AA-310-101, "Condition Monitoring of Structures," Revision 0.

47. NRC Policy Statement, "Use of Probabilistic Risk Assessment Methods in Nuclear Activities: Final Policy Statement," Federal Register, Vol. 60, p. 42622 (60 FR 42622),

August 16, 1995.

48. NRC, Salem Nuclear Generating Station, Unit Nos. 1 and 2-Issuance of Amendments Re: Containment Fan Coil Unit Allowed Outage Time Extension (CAC Nos. MF9364 and MF9365; EPID L-2017-LLA-0212)

LR-N18-0033 LAR S18-02 Technical Specification Pages with Proposed Changes

LR-N18-0033 LAR S18-02 TECHNICAL SPECIFICATION PAGES WITH PROPOSED CHANGES The following Technical Specifications for Renewed Facility Operating License DPR-70 are affected by this change request: Technical Specification Page 3.8.2.1 3/4 8-6 TECHNICAL SPECIFICATION PAGES WITH PROPOSED CHANGES The following Technical Specifications for Renewed Facility Operating License DPR-75 are affected by this change request: Technical Specification Page 3.8.2.1 3/4 8-8

LR-N18-0033 LAR S18-02 PRA Standard Supporting Requirements

LR-N18-0033 LAR S18-02 TABLE A-1 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INITIATING EVENTS ANALYSIS RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IE-A1 IE-A1 SR Not Met IE-A1-01 The plant-specific search only addresses supporting systems. The listing is not encompassing of possible plant-specific initiators found at other plants such as a loss of charging (impact on RCP seal cooling). Loss of charging would lead to a reactor trip and would decrease redundancy for RCP seal cooling. Table 2-2 in the IE notebook (SA-PRA-001), which was revised during the 2012 PRA model update, lists the basis for this event not being a unique plant trip initiator. For the case in which the charging system is lost, this leads to a slowly developing transient that can be easily accommodated with high reliability using plant response procedures to avoid an unnecessary plant transient event. Based on reviews of potential missing initiating events, it was concluded that no initiating events were missing and therefore the intent of this SR is met. IE-A2 IE-A2 SR Met Consideration of some initiating events may be required based on shutdown requirement. N/A IE-A3 IE-A3 SR Not Met IE-A3-001, IE-A3-002 The plant-specific history indicates that on 12/31/01 an event occurred resulting in SI. The categorization of initiating events does not account for this or the case of ESFAS actuation. Spurious SI was added to the SA112A model as initiating event Tsi. No further action required. IE-A4 IE-A3a SR Not Met IE-A3-001 The available documentation lists that past PRAs are examined. However, there appears to be no documentation of this evaluation with consideration of plants of similar design. Section 2.1 of the initiating events notebook indicates that comparisons were made to industry data and to other plants. Additional information was added to the IE notebook (SA-PRA-001, rev. 3) at the end of Section 2 to compare initiators from Watts Bar, South Texas Project, Surry, and Byron/Braidwood. No further action required. IE-A5 IE-A4 SR Met: (CC I) IE-A4-001 The analysis only addresses support systems and does not address the impact of other operating systems (such as charging) with regard to events resulting in a plant upset and subsequent trip signal. The observation associated with IE-A4 says, The analysis only addresses support systems and does not address the impact of other operating systems (such as charging) with regard to events resulting in a plant upset and subsequent trip signal. IE-A4 asks for a systematic review of plant systems to identify potential initiating events. A systematic review was performed in the IE notebook and documented in Table 2-2. Loss of charging was not included as a separate initiator based on screening criterion identified in the initiating events notebook. Also, see the response for SR IE-A1. No further action required. IE-A6 IE-A4a SR Not Met IE-A4-001 See supporting requirement IE-A4. Not all potential systems were addressed. N/A

LR-N18-0033 LAR S18-02 TABLE A-1 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INITIATING EVENTS ANALYSIS RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IE-A7 IE-A5 SR Not Met IE-A5-01 SA PRA Initiating Events Notebook, SA-PRA-001, Revision 0, Section 2.2.1 and 2.2.2 describe the review of Salem Generating Station Experience and Trip Review. No mention is made of consideration of events that occurred at conditions other than at-power operation. Appropriate evidence exists that LERs were reviewed for other than "at-power" conditions to determine whether or not a new initiator should be added that was not already incorporated into the PRA model. The LERs reviewed are documented in the initiating events notebook (SA-PRA-001 revision 2). No further action required. IE-A8 IE-A6 SR Met: (CC I) IA-A6-01 SA PRA Initiating Events Notebook, SA-PRA-001, Revision 0, Section 2.1.2 does not indicate that plant operations, maintenance, engineering, and safety analysis personnel were interviewed or included in the review process for the initiating events notebook to determine if potential initiating events have been overlooked. A Maintenance Rule Expert Panel meeting was held on 10/5/2012 to review the updated Initiating Events Notebook with plant personnel representing plant operations, maintenance, engineering and safety analysis in order to determine if potential initiating events had been overlooked. Some of the items discussed during the interview included:

• Grassing events were appropriately binned as %Tp initiators
• Loss of non-vital bus G needed to be added as a %Tt initiator
• The plant shutdown in July 2011 that was related to the SJ10 cracked weld needed to be identified
• The appropriateness of binning spurious SI trips with an existing initiator
• Loss of a 4kV vital bus does not directly lead to a plant trip
• Manual shutdowns should not be credited in the transient initiating event category Based on this review, it was concluded that no initiating events were missing and therefore the intent of this SR is met.

LR-N18-0033 LAR S18-02 TABLE A-1 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INITIATING EVENTS ANALYSIS RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IE-A9 IE-A7 SR Met: (CC I) IE-A7-01 SA PRA Initiating Events Notebook, SA-PRA-001, Revision 0, Section 2.1.2 does not indicate that a review of plant-specific or industry operating experience was performed for the purpose of identifying initiating event precursors. A list of LERs was previously reviewed for the existence of any initiating event precursors. A statement was added to the IE notebook documenting that this review was previously performed. Since industry information was also reviewed in addition to plant-specific information, this SR could actually be considered as being met at Capability Category III. No further action required. IE-A8 This SR was deleted in RA-Sb-2005. N/A IE-A9 This SR was deleted in RA-Sb-2005. N/A IE-A10 IE-A10 SR Met SA PRA Initiating Events Notebook, SA-PRA-001, Revision 0, Section 2.1.3 describes the consideration of multi-unit site initiating events. Based on that analysis, dual unit initiating events for loss of service water, loss of control air, and loss of offsite power were included. N/A IE-B1 IE-B1 SR Met N/A IE-B2 IE-B2 SR Met A structured process was followed in the grouping of the initiating events. N/A IE-B3 IE-B3 SR Not Met IE-B3-001 The potential for SI actuation is placed in the general transient category with events such as reactor trip and considered to be no worse than the reactor trip. However, unmitigated SI events can challenge a PORV resulting in a consequential LOCA. These two events should not be grouped. Initiating events may be grouped reasonably in accordance with SR IE-B3 as long as the impacts are comparable to existing initiators and the grouping does not impact significant accident sequences. Spurious SI will generally be recovered (by resetting SI) and the event will be a transient. If SI is not reset prior to PORV operation, a logic change was added to the SA112A PRA model to transfer to the small LOCA event tree. See the Initiating Events Notebook for further details (SA-PRA-001). No further action required. IE-B4 IE-B4 SR Met Grouping of initiating events was performed. N/A

LR-N18-0033 LAR S18-02 TABLE A-1 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INITIATING EVENTS ANALYSIS RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IE-B5 IE-B5 SR Met SA PRA Initiating Events Notebook, SA-PRA-001, Revision 0, Section 2.1.3 describes the consideration of multi-unit site initiating events. Based on that analysis, dual unit initiating events for loss of service water, loss of control air, and loss of offsite power were included. There is no indication that these events were subsumed into other events. N/A IE-C1 IE-C1 SR Met IE-C1-01 Based on a review of Sections 3.0 of Salem SA-PRA-001, Revision 0, "Initiating Events," initiating event frequencies have been calculated using relevant generic and plant-specific data. Generic data is from NUREG/CR-5750, Rates of Initiating Events at U.S. Nuclear Power Plants: 1987-1995. More recent industry sources of initiating event data such as from NUREG/CR-6928, "Industry-Average Performance for Components and Initiating Events at U.S. Commercial Nuclear Power Plants," should be used. For initiators when plant-specific data is available, the initiating event frequency is calculation by Bayesian updating the industry prior with the plant-specific data. As part of updating initiating event frequencies, use of newer loss of offsite power (LOOP) data was incorporated into the CAFTA model database as part of the 2012 PRA update, including dual-unit LOOP events. See the Initiating Events Notebook for further details (SA-PRA-003). The normal PRA update process (ER-AA-600-1015) ensures that this activity is routinely performed. No further action required. IE-C2 IE-C1a SR Met The most recent applicable plant specific data has been used to quantify the initiating event frequencies, based on a review of Section 3.1 of Salem SA-PRA-001, Revision. 0, "Initiating Events." The plant-specific data is from 10/1/2000 to 12/31/2006. N/A IE-C3 IE-C1b SR Met IE-C1b-01 Section 3.3 of the Salem SA-PRA-001, Revision 0 notebook has a brief discussion of the special initiators developed using fault trees. It references the applicable system model notebooks along with the basic event for the initiator in the fault tree. For the loss of SW initiator, notebook SA-PRA-005.13, Revision 0 was reviewed for the modeling of the initiator. There was no description of the how the loss of SW initiator is modeled as an initiator. Also, there did not appear to be documentation of the recoveries credited in the initiator fault trees and whether the actions are justified for preventing the initiator. This SR is considered met but SR IE-D2 will be considered not met for documentation. Support system initiators that were developed using fault trees were identified in the Initiating Events Notebook (SA-PRA-001 revision 2 Section 3.5) with reference made to the applicable system notebook for model development and details. No further action required. IE-C4 IE-C2 SR Met Based on a review of Section 3.2 of the Salem SA-PRA-001, Revision 0 notebook, Bayesian updating has been performed appropriately and complies with this SR. N/A

LR-N18-0033 LAR S18-02 TABLE A-1 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INITIATING EVENTS ANALYSIS RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IE-C5 IE-C3 SR Not Met IE-C3-01 The initiators that are fault trees, loss of SW, loss of Capability Category, loss of control area ventilation, and others, do not appear to be based on reactor year. For example, under gate IE-TSW, basic event SWS-PIP-RP-TBHDR has a mission time of 8760 hours. This was implemented in the CAFTA PRA model SA112A.CAF with the event AVAIL-FACTOR set to the value of 0.925 as determined in the Initiating Events Notebook (SA-PRA-001). No further action required. IE-C6 IE-C4 SR Not Met IE-A1-01 Quantitative screening does not appear to be performed, based on a review of the Salem SA-PRA-001, Revision 0 notebook. Therefore, subsection a) and b) of this SR are considered met. However, subsection c) of this SR does not appear to be met as noted in the review for SR IE-A1, some events that require the plant to be shut down due to technical specifications were screened (e.g., loss of a 4KV bus). Based on discussions with plant personnel (see response to IE-A6-01), it was determined that loss of 4kV non-vital buses affect the balance of plant operations and lead to an eventual turbine trip, which is accounted for in the event frequency for turbine trip (%Tt). Loss of a 4kV vital bus can lead to unavailability of standby ECCS equipment, but it does not lead to an automatic plant trip. As such, this was not considered a possible transient event. This was documented in Table 2-2 of the Initiating Events Notebook (SA-PRA-001). Based on this review, it was concluded that no initiating events were missing and therefore the intent of this SR is met. IE-C7 IE-C5 SR N/A Time trend analysis is not required for a Capability Category II rating. N/A IE-C8 IE-C6 SR Met IE-C1b-01 Section 3.3 of the Salem SA-PRA-001 Revision 0 notebook provides some limited description of the initiators that are fault trees. Details of the modeling of the system fault tree are provided in the applicable system notebooks. Applicable systems-analysis requirements for fault-tree modeling appear to have been used. The initiating event modeling is performed to the same level of detail as the fault trees used for the modeling of post-initiator operation of mitigating systems and appears to be appropriate. The documentation of the development of the initiator fault trees could be enhanced. N/A IE-C9 IE-C7 SR Met Initiating events that rely upon fault tree modeling correctly produce failure frequencies rather than top event probabilities. N/A

LR-N18-0033 LAR S18-02 TABLE A-1 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INITIATING EVENTS ANALYSIS RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IE-C10 IE-C8 SR Met The logic under gates IE-TSW and IE-TCC were reviewed in fault tree SIR4.Caf. The fault tree models used to calculate initiating event frequencies appear to model all relevant combinations of events involving the annual frequency of one component failure combined with the unavailability (or failure during the repair time of the first component) of other components. N/A IE-C11 IE-C9 SR Met The logic under gates IE-TSW and IE-TCC were reviewed in fault tree SIR4.Caf. A human reliability analysis was used to calculate the probability of failure of the operator actions credited under these gates as documented in Salem model notebook SA-PRA-004, Revision 0. N/A IE-C12 IE-C10 SR Met IE-C10-01 Tables 3-6 and 3-7 contain a comparison of the initiator frequencies used in the Salem model as compared with NUREG/CR-5750. However, there is no comparison with other sources.. Since many of the frequencies used in the Salem model use the same frequencies from NUREG/CR-5750, such as the LOCAs, the tables should be updated with a comparison with other similar plants. Tables 2-5, 2-6 and 2-7 in the Initiating Events Notebook (SA-PRA-001) provide event types, along with their descriptions, for the South Texas Project, Watts Bar Project and Surry Project, respectively. This data is given in order to provide the reader with other categorization schemes for similar plants to which the Salem plant may be compared. It was shown that these categorization schemes for initiating events are consistent with the Salem PRA model. Based on this updated comparison to other plants, it was concluded that the intent of this SR is met. F&O IE-C10-01 is a suggestion-level F&O. IE-C13 IE-C11 SR Met (CC I/II) Initiating event frequencies for rare events and extremely rare events are based on generic data. N/A IE-C14 IE-C12 SR Met (CC I/II) Section 3.5 of the Salem SA-PRA-001, Revision 0 notebook provides some description of the ISLOCA screening, quantification of the initiator frequency and the event tree development. The details of the ISLOCA analysis are contained in PLG Report Number PLG-0826, Containment Bypass Analysis. The analysis considers the requirements in this SR as appropriate. N/A IE-C15 IE-C13 SR Met Mean values and error factors are developed for the initiating event frequencies modeled as documented in Sections 3.2, 3.3 and 3.4 of the Salem SA-PRA-001, Revision 0. N/A

LR-N18-0033 LAR S18-02 TABLE A-1 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INITIATING EVENTS ANALYSIS RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IE-D1 IE-D1 SR Met The initiating event analysis documentation is a logical format consistent with the major high level requirements for initiating event analysis. Improvements can be made to the notebook as noted by the F&Os in the other SRs. N/A IE-D2 IE-D2 SR Met The Salem initiating event notebook SA-PRA-001, Revision 0 provides good documentation of the identification, grouping, and evaluation of plant-specific data, screening and quantification of the frequencies. However, as noted in a number of the F&Os for HLR IE-A, B and C, the notebook lacks sufficient documentation for verifying the requirements of some SRs. N/A IE-D3 IE-D3 SR Not Met SC-C3-01, SC-C3-02 While assumptions are documented to some degree in the Salem SA-PRA-001, Revision 0 notebook, a systematic review/listing of assumptions and sources of uncertainty as defined by the Standard is not documented or referenced in the initiating events notebooks. This issue of uncertainty and key assumptions has been addressed with the creation of the PRA Uncertainty Notebook (SA-PRA-018) during the PRA model update that resulted in the PRA Model of Record SA112A. No further action required. TABLE A-2 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR ACCIDENT SEQUENCE ANALYSIS RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION AS-A1 AS-A1 SR Met AS-A1-01 Accident Sequences and Event Tree Development Notebook, SA-PRA-002, Revision 0 describes the method used for development of the accident sequences and event trees covering all three required aspects. The graphical representation of the event trees is not included in the notebook, but is available through reference to the appropriate CAFTA event tree files. Event tree figures were included in the Accident Sequence - Event Tree (SA-PRA-002, revision 1) notebook as Appendix A. No further action required.

LR-N18-0033 LAR S18-02 TABLE A-2 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR ACCIDENT SEQUENCE ANALYSIS RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION AS-A2 AS-A2 SR Met Accident Sequences and Event Tree Development Notebook, SA-PRA-002, Revision 0 describes the method used for development of the accident sequences and event trees. Section 2.0 describes the key safety functions necessary to reach a safe, stable state and prevent core damage. N/A AS-A3 AS-A3 SR Met Accident Sequences and Event Tree Development Notebook, SA-PRA-002, Revision 0 describes the method used for development of the accident sequences and event trees. Sections 3 through 9 define systems that can be used to mitigate each modeled initiating event class. N/A AS-A4 AS-A4 SR Met Accident Sequences and Event Tree Development Notebook, SA-PRA-002, Revision 0 describes the method used for development of the accident sequences and event trees. Sections 3 through 9 describes the achievement of key safety functions for each initiating event. Operator actions are described in general terms. N/A AS-A5 AS-A5 SR Met IE-B3-01 Spurious SI is subsumed into the Turbine Trip initiating event and, therefore, into the General Transient event tree. However, the path through the EOPs would be different for the two events. Initiating events may be grouped reasonably in accordance with SR IE-B3 as long as the impacts are comparable to existing initiators and the grouping does not impact significant accident sequences. Spurious SI will generally be recovered (by resetting SI) and the event will be a transient. If SI is not reset prior to PORV operation, a logic change was added to the SA112A PRA model to transfer to the small LOCA event tree. See the Initiating Events Notebook for further details (SA-PRA-001). No further action required. AS-A6 AS-A6 SR Met Accident Sequences and Event Tree Development Notebook, SA-PRA-002, Revision 0 describes the accident sequences in accordance with the timing of the event to the extent practical. N/A

LR-N18-0033 LAR S18-02 TABLE A-2 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR ACCIDENT SEQUENCE ANALYSIS RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION AS-A7 AS-A7 SR Met (CC I/II) AS-A7-01, AS-A7-02 Accident Sequences and Event Tree Development Notebook, SA-PRA-002, Revision 0 delineates the possible accident sequences for each modeled initiating event. However, some sequences are not explicitly modeled in the single-top fault tree (e.g., TT sequences S04 and S05 are combined into a single fault tree gate). No documentation was found to describe the basis of these combinations. In addition, SA-PRA-002, Revision 0, Section 3.3.4.5 states that the Te3 and Te4 event trees have sequences that were not modeled because they have "very low frequencies." No basis for this assessment was documented. The VS ISLOCA sequence with no piping failure is assumed to be terminated with operator isolation of the suction path using the pump suction isolation MOVs. However, isolation cannot be accomplished until primary pressure is reduced. The potential for flooding of adjacent areas by water lost through the RHR pump seals and/or RHR heat exchangers prior to isolation does not appear to have been evaluated. Sequence endstates that exhibit identical core damage characteristics were combined. The only reason that there are two different endstates identified is to distinguish between an isolated and non-isolated containment. A revision was made to the Accident Sequence Notebook (SA-PRA-002) to state that sequences were combined that exhibit identical core damage characteristics under a single gate in the fault tree logic for Level 1 sequences in order to conserve core damage numerical results. No further action required.

LR-N18-0033 LAR S18-02 TABLE A-2 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR ACCIDENT SEQUENCE ANALYSIS RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION AS-A8 AS-A8 SR Met AS-A8-01 Accident Sequences and Event Tree Development Notebook, SA-PRA-002, Revision 0 and the associated CAFTA event trees define the end state of each sequence as success or core damage. However, the SBO sequences S08, S11, S14 and S17 are assumed to be successful based on offsite power recovery. Operator action to restore mitigating systems after power recovery is not addressed. In addition, given the fact that power recovery is only credible out to 4 hours, 20 hours of mitigating system operation and the potential failures of that equipment over a significant portion of the 24 hour mission time is not being addressed. This failure to address recovery of mitigating systems following power recovery does not ensure a safe, stable end state has been reached for some SBO sequences. There is also concern that the application of offsite power recovery is included twice in the modeling of the SBO event. Recovery is credited in the application of a diesel mission time of 6 hours and again through the application of offsite power recovery top event RBU. There is no "double-counting" of offsite power recovery being applied in the SA115A PRA model. The concept of a diesel-mission run time of 6.2 hours that was developed in Section 10.0 of the Data notebook was meant to estimate a "time-averaged" value for which the EDG would be required to run and supply AC power prior to recovery of an offsite power source. The RBU terms that are employed in the PRA model are not recovery terms but flags that are meant to delineate a particular set of circumstances during a particular accident sequence to allow the appropriate "recovery before uncovery" probability to be applied to the cutset in question. This is separate from the run time that was calculated in determining how long, on average, the EDG would be expected to run prior to recovery of offsite power, which was based on the worst set of conditions, i.e., weather-related causes. This approach is also consistent with other Westinghouse PWR PRA models. For the issue of mitigating systems that would be required to function following the possible recovery of offsite power, they are not explicitly modeled as being subject to "restart" failures due to the fact that system start failures are on the order of 1E-3. However, a sensitivity analysis was performed that estimated the frequency of LOOP events that result in successful recovery of offsite power, which was added to the initiating event frequency for transient events without PCS (%TP). The resultant CDF calculated with this adjusted %TP frequency resulted in a 0.5% increase in CDF and a 0.4% increase in LERF. Because of these small changes in CDF and LERF, there is no expected impact on MSPI results and the requisite change to PRA model logic for these additional sequences can be deferred until a future PRA update (see URE # 2015-028). For this URE, there is no further action required. AS-A9 AS-A9 SR Met: (CC II) Accident Sequences and Event Tree Development Notebook, SA-PRA-002, Revision 0 Section 2.0 indicates that success criteria was based on combination of generic, similar plant, and plant-specific sources. N/A

LR-N18-0033 LAR S18-02 TABLE A-2 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR ACCIDENT SEQUENCE ANALYSIS RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION AS-A10 AS-A10 SR Met: (CC I) AS-A10-01 Systems and operator actions required to meet each key safety function are discussed in general terms in the Accident Sequences and Event Tree Development Notebook, SA-PRA-002, Revision 0 Sections 3 through 9. Operator actions and diverse systems to satisfy top events are included in the fault tree but are grouped under common top events in the accident sequence model (e.g., core decay heat removal includes AFS, operator action to depressurize, and condensate under a common top event). However, the modeling of offsite power recovery in the SBO event tree does not explicitly model the differences in recovery times or plant response associated with different RCP seal leakage rates. Instead, a single lumped recovery event is modeled. A weighted average analysis of the size of a RCP seal LOCA with various configurations of successful means of heat removal mitigation with offsite power non-recovery probabilities was performed and is consistent with other Westinghouse PWR models. This is described in Appendix C of SA-PRA-002 Revision 3. There is no further action required. AS-A11 AS-A11 SR Met AS-A11-01 Transfers between event trees are described in the Accident Sequences and Event Tree Development Notebook, SA-PRA-002, Revision 0 Sections 3 through 9. Transfer of certain sequences to other event trees is discussed for each event tree in the event tress construction section of the Accident Sequence - Event Tree notebook. No further action required. AS-B1 AS-B1 SR Met This requirement is met by Sections 3 and 9 of the Accident Sequence notebook. These sections identify the mitigating systems and how the accident progresses depending the equipment availability. The single-top fault tree model explicitly models initiator impacts on mitigating systems. N/A AS-B2 AS-B2 SR Met This requirement is met by Sections 3 and 9 of the Accident Sequence notebook. These sections identify the mitigating systems and how the accident progresses depending the equipment availability. N/A AS-B3 AS-B3 SR Met The environmental conditions are considered (Section 3.6) for recirculation. The clogging of the sumps is addressed in the system notebook. N/A AS-B4 AS-B4 SR N/A This model does not use the split fraction method. N/A AS-B5 AS-B5 SR Met This SR is geared towards other methodologies than CAFTA. The event trees and the fault trees are of sufficient detail to address intersystem dependencies and train level interfaces. In CAFTA these two requirements are done at the fault tree level. N/A AS-B6 AS-B5a SR N/A This requirement is addressed in the system models. Therefore it will be address in the review of the System Notebook. N/A

LR-N18-0033 LAR S18-02 TABLE A-2 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR ACCIDENT SEQUENCE ANALYSIS RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION AS-B7 AS-B6 SR Not Met AS-A8-01 The SBO/LOOP, battery depletion, and room cooling are all addressed in the Accident Sequence notebook. However, the lumped treatment of offsite power recovery into both the diesel mission time calculation and the RBU recovery factor could overestimate the potential for recovery. See above response for SR AS-A8. AS-C1 AS-C1 SR Met The accident sequences are analyzed in a manner that allows application, upgrades, and peer review to be accomplished in a timely. N/A AS-C2 AS-C2 SR Not Met AS-C2-01 The operator actions are not part of the event tree as required by this Supporting Requirement. The requirements of c, d and e are not met. The HRA and Level 2 notebooks now adequately address procedural guidance and important operator actions in sufficient detail to allow traceability of references used and description of how HEPs are being applied to their appropriate accident sequences. Since the Level 2 logic is explained in detail in Appendices A, B, and C of the Level 2 Notebook, it was not necessary to expand any of the event trees. The operator actions referred to in the above description are discussed in the Level 2 Notebook. At any event, there is no further action required. AS-C3 AS-C3 SR Not Met SC-C3-02 In Notice of Clarification to Revision 1 of Regulatory Guide 1.200, FRN July 27, 2007, Accession number: ML071170054, the NRC provided their clarification related to assumptions and sources of uncertainty. The NRC stated that Key assumptions and sources have meaning only within the scope of an application. For a base PRA, the plant needs to identify and characterize assumptions and sources of uncertainty. Characterization can be qualitative. ANO2 has documented the assumptions that they used for the accident sequence analyses. The uncertainty notebook is in draft form and therefore is not reviewable. The uncertainty portion of this requirement is not met. The assumption were in the notebook so this part of the requirement is met. A suggestion is that an assumption section be added to the notebook. This issue of uncertainty and key assumptions has been addressed with the creation of the PRA Uncertainty Notebook (SA-PRA-018) during the PRA model update that resulted in the PRA Model of Record SA112A. No further action required.

LR-N18-0033 LAR S18-02 TABLE A-3 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SUCCESS CRITERIA RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF RESOLUTION SC-A1 SC-A1 SR Not Met SC-A1-01 The ASME standard defines core damage as "uncovery and heatup of the reactor core to the point at which prolonged oxidation and severe fuel damage involving a large section of the core is anticipated." In the Salem PRA Success Criteria Notebook, SA-PRA-003, a "big picture" definition as described in the ASME PRA standard appears to missing. In the Salem PRA, core damage is defined as maintaining core temperature below 1200 degrees F which deals with heatup but not uncovery. The definition of core damage has been clarified as part of the 2012 PRA update and properly reflected in both the Success Criteria and Accident Sequence - Event Tree notebooks. No further action required. SC-A2 SC-A2 SR Not Met SC-A2-01 In the Salem PRA, core cooling was defined as successful if core exit temperatures do not exceed 1200 degrees F. This represents the temperature below which no core damage is expected to occur and the core exit thermocouple temperature at which the operators transfer to severe accident guidelines. The 1200 degrees F core temperature success criteria were interpreted to be the core hottest node temperature (TCRHOT) in MAAP. However, in the TH notebook a peak cladding temperature of 1800 degrees F was referenced. The MAAP code used 1800 degrees as TCRHOT. Also, there is no mention of core collapsed liquid level. This was a documentation issue that has since been resolved by revising the Level 1 Success Criteria Notebook (SA-PRA-003) to definitively state in Section 2.4 that core cooling is successful if the mass-averaged temperature of the hottest core node does not exceed 1800 deg. F. This is also consistent with the definition of core damage stated in Section 2.2.1 of the Thermal-Hydraulic MAAP PRA Notebook (SA-PRA-007) that references this same value of 1800 deg. F. No further action required. N/A SC-A3 This SR was deleted in RA-Sb-2005. N/A SC-A3 SC-A4 SR Met The success criteria for each of the key safety functions is specified in the success criteria notebook. N/A SC-A4 SC-A4a SR Met The only system that is shared is the VCA system. This system is identified as being shared and the common initiating event is discussed. N/A SC-A5 SC-A5 SR Met: (CC II/III) Accident sequences are terminated at 24 hours, except under two conditions:

1. The plant is brought to a condition where return to power operation is possible in less than 24 hours, or

2. Core damage or containment failure is predicted to occur within a few hours after the 24 hour limitation.

N/A SC-A6 SC-A6 SR Met Success criteria are based on plant-specific features, procedures and operation. N/A

LR-N18-0033 LAR S18-02 TABLE A-3 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SUCCESS CRITERIA RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF RESOLUTION SC-B1 SC-B1 SR Met: (CC II) Plant-specific MAAP analyses have been performed to determine success criteria N/A SC-B2 SC-B2 SR N/A Expert judgment is not used in the success criteria development. N/A SC-B3 SC-B3 SR Met T/H analyses are consistent with the initiating event groups and accident sequences. N/A SC-B4 SC-B4 SR Not Met SC-B4-01 The MAAP Thermal-Hydraulic Calculations Notebook (SA-PRA-007, Revision 1), Sections 1.2 and 1.3 provide a discussion of the codes available and the advantages associated with using MAAP, respectively. However, MAAP is used in establishing large LOCA success criteria, although the code is not suitable for analysis of this plant upset. A discussion of code limitations is not provided. Section 1.3 of the Success Criteria Notebook (SA-PRA-003) now discusses the limitations of the MAAP computer code. Relative to the Salem Generating Station, this means that the minimum systems required to mitigate a large break LOCA should be based on a source other than MAAP. In this case, the success criteria was defined using analyses related to the plants licensing basis. Other code limitations were listed in Table 1-2 of this notebook. Since this issue has been addressed through the use of the plants licensing basis, the issue associated with this SR has been adequately addressed. SC-B5 SC-B5 SR Not Met SC-B5-01 A check of the reasonableness and acceptability of the success criteria results is not documented. Table 2-1 of SA-PRA-003 provides a summary of the overall success criteria for the Salem Generating Station for In-Vessel Core Cooling, RCS Integrity, and Containment Integrity. Table 2-2 of the notebook shows the general success criteria for the Byron and Braidwood nuclear stations, which reveals that Salems success criteria is consistent with other Westinghouse plants. These comparisons confirm the reasonableness of the success criteria results, and meet the intent of this SR. SC-C1 SC-C1 SR Met SC-C1-01 The Level 1 Success Criteria Notebook (SA-PRA-003, Revision 0), MAAP4 Parameter File Notebook (SA-PRA-009, Revision 1), and MAAP Thermal-Hydraulic Calculations Notebook (SA-PRA-007, Revision 1) document the success criteria analyses. However, it would be helpful to provide a cross reference to the PRA Standard requirements to facilitate PRA applications, upgrades, and peer reviews. This issue has no impact on the quality of the PRA and was only meant to aid reviewers in identifying where each of the elements of the PRA Standard are being addressed. As such, this is only a documentation issue and may remain open for now. No further action required. SC-C2 SC-C2 SR Met The success criteria development process has been documented. N/A

LR-N18-0033 LAR S18-02 TABLE A-3 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SUCCESS CRITERIA RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF RESOLUTION SC-C3 SC-C3 SR Not Met SC-C3-01, SC-C3-02 Assumptions are embedded in the documentation rather than captured in a specific section. Sources of uncertainty are addressed in a draft evaluation using guidance from draft EPRI report, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments." Each PRA System Notebook (SA-PRA-005.####) now has a section that lists assumptions that were made as part of the systems analysis. The Uncertainty Notebook (SA-PRA-018) was officially issued and includes a section on model uncertainty and references both EPRI 1026511, which addresses the use of PRA and the treatment of uncertainty, and EPRI 1016737, which addresses the treatment of parameter and model uncertainty. The results of the Salem Uncertainty analysis clarify the importance of assumptions that were made during development of the Success Criteria Notebook (SA-PRA-003). As such, there is no further action required.

LR-N18-0033 LAR S18-02 TABLE A-4 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SY-A1 SY-A1 SR Met The system models are consistent with similar PWR PRAs and address system responses found in the accident sequence response. N/A SY-A2 SY-A2 SR Met The system model documentation includes references to drawings, control logic, procedures and technical specifications. Training drawings are included in the documentation. N/A SY-A3 SY-A3 SR Met Based on documentation for the system notebooks information was reviewed. N/A SY-A4 SY-A4 SR Not Met SY-A4-01 The system notebooks do not provide any walkdown information. A walkdown document was made available to the peer review but has not been reviewed and formally released. Plant walkdowns for the systems modeled in the PRA were documented in Appendix C of each of the Salem PRA System Notebooks (SA-PRA-005.#### series). No further action required. SY-A5 SY-A5 SR Met Modeling addresses plant configurations necessary to support success criteria. N/A SY-A6 SY-A6 SR Not Met SY-A6-01 The system notebooks do not provide definitive explanation of boundary information and do not provide illustration of modeled components. The System Model Notebooks (SA-PRA-005.#### series) were revised to more clearly define system boundaries of modeled systems using one-line diagrams depicted in Section 2.3 of these notebooks. For example, for the Safety Injection (SI) system, the system boundary includes all of the components in the SI system whose failure could potentially prevent water from reaching the RCS, but the system boundaries do not branch into the other ECCS systems. Figure 2-1 in this system notebook shows a diagram of the SI system boundary, and various highlighted colors show the different modes of operation of SI. Not all of the components highlighted along the paths were modeled in the PRA. For example, many valves are not modeled because their failure does not prevent water from being injected into the core. Also see SY-A8. SY-A7 SY-A7 SR Met: (CC III) N/A

LR-N18-0033 LAR S18-02 TABLE A-4 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SY-A8 SY-A8 SR Not Met SY-A8-01 Boundaries not defined. Boundary definitions for plant systems were better defined in the PRA System Notebooks (SA-PRA-005.#### series) during the 2012 PRA Update by incorporating drawings with highlighted boundaries in order to help the reader better visualize the modeled system boundaries. The Data Notebook (SA-PRA-010, Rev. 2) has also been revised in order to explain how component boundaries were defined. N/A SY-A9 This SR was deleted in RA-Sb-2005. N/A SY-A9 SY-A10 SR Not Met SY-A10-01 Diesel generator modeling. Since the Emergency Diesel Generator (EDG) Day Tanks are modeled as being part of the component boundary for the EDGs, the failure probabilities used for the EDG events used in the SA115A PRA model inherently include the failure of Day Tanks to perform their function, e.g., rupture, plugged lines, etc. However, a failure mode that could cause failure of the fuel oil transfer pumps involves miscalibration of the day tank level instrumentation, which was included in the SA115A PRA model. The Vital AC system notebook now includes a discussion about the EDG day tanks being part of the component boundary definition used for the EDGs. SY-A10 SY-A11 SR Met N/A SY-A11 SY-A12 SR Not Met SY-A12-01 Some components listed in the standard supporting requirement are absent from some system models. Although the Emergency Diesel Generator (EDG) Day Tanks are considered to be within the component boundary of the EDGs (see response to SY-A9), the fuel oil transfer system was not, and as such, was explicitly modeled in the SA115A PRA model. Also, there are Human Error Probability (HEP) events included in the SA115A PRA model that model failure to realign ventilation dampers, e.g., see event RD3-XHE-MM (OPERATORS FAIL TO ALIGN CAV FOR MAINT MODE) in the HRA Notebook (SA-PRA-004). This and other HEPs that make use of AB.CAV procedures have been appropriately analyzed in the HRA notebook and included in the SA115A PRA model where appropriate. No further action required. SY-A12 SY-A12a SR Met N/A

LR-N18-0033 LAR S18-02 TABLE A-4 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SY-A13 SY-A12b SR Met Modeling guidance included consideration of divergence paths. N/A SY-A14 SY-A13 SR Not Met SY-A13-01 Review of models identified several exclusions of failure modes on a global basis without justification. The probability of manual valves transferring shut was not generally modeled as the failure probability is exceedingly low and can be excluded via the use of the criteria found in ASME Supporting Requirement (SR) SY-A15: One or more failure modes for a component may be excluded from the systems model if the contribution of them to the total failure rate or probability is less than 1% of the total failure rate or probability for that component when the effects on system operation are the same. However, SR SY-A15 should be referred to in Section 3.1 (Generic Assumptions) of each PRA System Notebook to support the decision to exclude low probability events. Since this is only a documentation issue, there is no impact on either CDF or LERF due to the fact that the exclusion of manual valves spuriously changing state was appropriately addressed in the PRA model. As such, this issue has no impact on the results for this license amendment request. SY-A15 SY-A14 SR N/A No assessment performed. N/A SY-A16 SY-A15 SR Met: (CC III) N/A SY-A17 SY-A16 SR Met N/A SY-A18 SY-A17 SR Met N/A SY-A19 SY-A18 SR Met N/A SY-A20 SY-A18a SR Met N/A SY-A21 SY-A19 SR Not Met SY-A19-01 No documentation of assessment. All PRA System notebooks were revised to add generic assumptions on components not performing beyond their design operating conditions unless otherwise specified. No further action is required. SY-A22 SY-A20 SR Met: (CC I) SY-A20-01 No analyses provided. N/A

LR-N18-0033 LAR S18-02 TABLE A-4 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SY-A23 SY-A21 SR Not Met SY-A21-01 Multiple type code descriptions are used for the same data such that the second part of the SR is not met. The state of knowledge correlation was addressed as part of the 2012 PRA update. See the Salem PRA Data Notebook (SA-PRA-010) for further details. No further action required. SY-A24 SY-A22 SR Met N/A SY-B1 SY-B1 SR Met: (CC II/III) N/A SY-B2 SY-B2 SR Met: (CC I/II) N/A SY-B3 SY-B3 SR Not Met SY-B3-01 For some cases the selection of CCF combinations are not complete and those selected are not the most limiting. Industry common cause failure data is collected from the NRC/INL Common Cause Database [CCF Parameter Estimations, 2012 Update]. Due to the relative rarity of common cause events, generic data is used for the Salem PRA model. The Alpha-Factor Methodology was used for common cause modeling in the Salem PRA. Mean values for the alpha factors were obtained and used to determine the Common Cause Factor, which is input into the CAFTA BE database Factor field. A few CCF events were determined using sources other than the NRC/INL data. In particular, to address the issue of completeness regarding various combination of failures, and due to the small probabilities and uncertainty that is involved with interim CCF combinations involving a population size of 6, it was deemed adequate in modeling the 2 of 6 (loss of one division), 4 of 6 (loss of two divisions), and 6 of 6 event combinations (loss of all three divisions) in estimating the total risk associated with DC battery charger common cause failures. The common cause modeling was limited to only those combinations that are consequential and important to risk. Refer to Appendix D of the Data Notebook (SA-PRA-010) for further details.

LR-N18-0033 LAR S18-02 TABLE A-4 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SY-B4 SY-B4 SR Not Met SY-B3-01 Some combinations are absent which when using MGL can underestimate the CCF contribution. The MGL parameter model was not used for common cause failure probabilities used in the Salem PRA model. Instead, the Alpha-Factor Methodology was used. As stated in the response for SY-B3-01, certain interim combinations for DC battery chargers involving a population size of 6 were omitted due to their small probabilities and inherent uncertainty, with only the important common cause combinations being retained, e.g., 2 of 6, 4 of 6, and 6 of 6. Since MGL is not used for these events, the missing combinations do not significantly underestimate the CCF contributions. SY-B5 SY-B5 SR Not Met SY-B5-01 Documentation for several system notebooks (AFW, CVCS and RWST) indicated that the heated water circulating system was required to prevent freezing, but was not modeled. Since the heated water system was not required as an immediate support system for system success, it was not explicitly modeled due to the fact that freezing of water lines is a slowly developing event with ample time for procedural direction and any necessary repair. It was also explicitly stated in the system modeling documentation that the heating water system was not required during the PRA mission time of 24 hours, e.g., see Section 2.5.4 of the AFS and MFWS System Notebook (SA-PRA-005.0001). As such, no further action is required. SY-B6 SY-B6 SR Not Met SY-B6-01 No analysis documented No documentation provided related to analysis of support system requirements. There appears to be no analysis of support system requirements concurrent with their definition in the system notebooks. Perform the required engineering analysis. As part of the 2012 PRA Update, all PRA System Notebooks were revised to follow a more consistent outline with information better organized to allow a more effective review and understanding of the documentation including sections on shared/required systems. In addressing this particular SR, section 4.4 in each PRA System Notebook (SA-PRA-005.#### series) documents the support system requirements and dependencies for all modeled system components in the PRA model.

LR-N18-0033 LAR S18-02 TABLE A-4 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SY-B7 SY-B7 SR Met: (CC I) SY-B7-01 The support system modeling is mostly based on conservative criteria. As part of the 2012 PRA Update, this information has been clarified and references provided for success criteria in the System Notebooks using a more consistent approach that will now make it much easier for the reviewer to identify such information. Also, fault tree modeling and operator actions were updated during the 2012 PRA update using the latest design calculations for the control room envelope. The results of the SA112A PRA model showed that loss of Control Area Ventilation (CAV) scenarios are now about a factor of ten less than what previously existed in the peer-reviewed PRA model (PRA Model, Rev. 4.1). Therefore, any conservatism that may exist in the design basis calculations for CAV is not important to the PRA results. As such, there is no further action required. SY-B8 SY-B8 SR Met SY-A4-01 Walkdowns are not formally complete N/A N/A SY-B9 This SR was deleted in RA-Sb-2005. N/A SY-B9 SY-B10 SR Not Met SY-B5-01 The need for heating of the RWST is not modeled although the system notebook indicates the need for heating. See above response for SR SY-B5. SY-B10 SY-B11 SR Not Met SY-B11-01 Some AFW signals (SI, LOSP) are not defined and no justification for exclusion is provided. This issue was addressed as part of the 2012 PRA Update. In particular, the AFW system and SI actuation logic and automatic initiation signals were reviewed and revisions made and additional logic added to the PRA model where appropriate. Specifically, Section 2.6 of the AFW PRA System Notebooks (SA-PRA-005.0001) documents the actuation signals that are modeled in the PRA for automatic system actuation. Necessary signals are now modeled, meeting the intent of this SR.

LR-N18-0033 LAR S18-02 TABLE A-4 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SY-B11 SY-B12 SR Not Met SY-B12-01 Some identified mission times are less than required. An average value for the expected run-time of the Emergency Diesel Generators (EDGs) and their supporting components, such as the fuel oil transfer pumps, was derived based on a convolution involving non-recovery of offsite power data and EDG run-time failure probabilities. This analysis is documented in Section 10.0 of the Salem PRA Data Notebook (SA-PRA-010), which was performed during the PRA update that resulted in the SA112A model. This exercise resulted in an average run time of 6.2 hours for the EDGs, which was also used for the EDG fuel oil transfer pumps. However, the AFW turbine-driven pump was assigned a mission time of 24 hours. No further action required. SY-B12 SY-B13 SR Met N/A SY-B13 SY-B14 SR Met N/A SY-B14 SY-B15 SR Not Met No documentation of an evaluation for potential adverse environments. See above response for SR SY-A21. SY-B15 SY-B16 SR Not Met HR-C3-01 Operator starts for standby equipment not defined. No miscalibration of under voltage relays. The issue of instrument miscalibration was modeled using Human Error Probability (HEP) pre-initiator events that were included in the appropriate sections of the Salem SA112A PRA model to capture the unavailability of instruments due to miscalibration errors. These HEPs are documented in the Salem HRA Notebook (SA-PRA-004). No further action required. SY-C1 SY-C1 SR Met N/A SY-C2 SY-C2 SR Not Met SY-C2-01 System documentation does not provide some required documentation. The Salem PRA System Notebooks were revised and enhanced as part of the PRA model update that resulted in the SA112A PRA model, which occurred after the peer review was performed in 2008. Since this issue was a documentation issue, there would be no impact on the results for this license amendment request.

LR-N18-0033 LAR S18-02 TABLE A-4 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION SY-C3 SY-C3 SR Not Met SC-C3-02 Assumptions are not present The Salem PRA System Notebooks were revised and enhanced as part of the PRA model update that resulted in the SA112A PRA model, which occurred after the peer review was performed in 2008. In particular, Section 3 of the System Notebooks (SA-PRA-005.#### series) now lists both generic and system-specific PRA modeling assumptions. Since this issue was a documentation issue, there would be no impact on the results for this license amendment request.

LR-N18-0033 LAR S18-02 TABLE A-5 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR HUMAN RELIABILITY ANALYSIS RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION HR-A1 HR-A1 SR Met This requirement is met by the process outlined in Section 2.2 of the HRA Notebook. N/A HR-A2 HR-A2 SR Met This requirement is met by the process outlined in Section 2.2 of the HRA Notebook. N/A HR-A3 HR-A3 SR Met This requirement is met by the process outlined in Section 2.3.4 of the HRA Notebook. N/A HR-B1 HR-B1 SR Met: (CC II/III) This requirement is met by the process outlined in Section 4.3.3.1 of the HRA Notebook. N/A HR-B2 HR-B2 SR Not Met HR-B2-01 This requirement is directly in violation of the first sentence of Section 4.3.3.1 which allows screening of actions that could simultaneously have an impact on multiple trains of a redundant system or diverse systems. The HRA notebook (SA-PRA-004) was revised to address this issue in order to clarify that screening of this nature was not performed. Therefore, this SR is now met and there is no further action required. HR-C1 HR-C1 SR Met This requirement is met by including the description of the HFE with each HFE analysis (see Tables 5.1.1, 5.1.2 and 5.1.3) N/A HR-C2 HR-C2 SR Met: (CC II/III) The HRA notebooks specified that the LARs were reviewed and the descriptions indicate modes of unavailability have been included. N/A HR-C3 HR-C3 SR Not Met HR-C3-01 There is no documentation showing that miscalibration as a mode of failure of initiation of standby systems was considered. An example of this is that there is no HFE for miscalibration of bus under voltage bus, RPS relays, etc. The issue of instrument miscalibration was modeled using Human Error Probability (HEP) pre-initiator events that were included in the appropriate sections of the Salem SA112A PRA model to capture the unavailability of instruments due to miscalibration errors. These HEPs are documented in the Salem HRA Notebook (SA-PRA-004). No further action required. HR-D1 HR-D1 SR Met Since the EPRI HRA Calculator was used this requirement is met. N/A HR-D2 HR-D2 SR Met: (CC II) This meets Capability Category II since there was one screening value used for pre-initiators. N/A HR-D3 HR-D3 SR Met: (CC II/III) This requirement is met due to the fact that the EPRI HRA Calculator is used. The Calculator requires human shaping factors which includes these requirements. N/A HR-D4 HR-D4 SR Met This requirement is met due to the fact that the EPRI HRA Calculator is used. The Calculator requires human shaping factors which includes these requirements. N/A HR-D5 HR-D5 SR Met This requirement is met in Section 5.2.2. N/A

LR-N18-0033 LAR S18-02 TABLE A-5 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR HUMAN RELIABILITY ANALYSIS RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION HR-D6 HR-D6 SR Not Met SC-C3-02 The uncertainty analysis has not been done. The mean values were used since the HRA Calculator was used for this analysis. The Salem PRA Uncertainty Notebook (SA-PRA-018) was officially issued as part of the SA112A PRA model update and includes sources of uncertainties associated with Human Reliability Analysis (HRA). This document makes use of both EPRI 1026511, which addresses the use of PRA and the treatment of uncertainty, and EPRI 1016737, which addresses the treatment of parameter and model uncertainty. As such, there is no further action required. HR-D7 HR-D7 SR Met: (CC I/II) There was no requirement to check reasonableness of HEPs in light of the plants experience. N/A HR-E1 HR-E1 SR Met This requirement is met by the methodology section of the HRA Notebook. N/A HR-E2 HR-E2 SR Met This requirement is met by Section 2.1 of the HRA Notebook. N/A HR-E3 HR-E3 SR Met: (CC II/III) This requirement is met in Section 2.6 of the HRA Notebook. N/A HR-E4 HR-E4 SR Met: (CC II/III) This requirement is met in Section 2.6 of the HRA Notebook. N/A HR-F1 HR-F1 SR Met: (CC I/II) This requirement is met at the Capability Category I/II level because several HFEs included several responses which are grouped into one HFE. N/A HR-F2 HR-F2 SR Not Met HR-F2-01, HR-F2-02 The accident sequence specific timing of time window for successful completion for CCS-XHE-FO-ISOLT is based on a calculation that does not address leakage. The calculation S-CC-MDC-2111 is for loss of Service Water and does not address leakage of the Component Cooling Water System. The time window should account for leakage that would drain the CCW system and make it inoperable. This is the limiting time since the CCW system will continue to cool with the leak until the surge tank is drained. Other examples of problems with timing are the lack of documentation for the timing used. This is noted in HRAs: CIS-XHE-FC-XLCNT, AND MSS-XHE-FO-MS10. It should be noted that only a sampling was performed and that this may involve many more HRA analysis. The HRA Notebook (SA-PRA-004) has been revised as part of the 2012 PRA update that resulted in the SA112A PRA model. The notebook now describes the available system windows for operator intervention and use of cues for all the important and risk-significant Human Error Probability (HEP) events. With regard to the specific comments made against this SR, event CCS-XHE-FO-ISOLT is no longer being used in the PRA model, as it was a legacy event that no longer applies to the current treatment of internal flood mitigation. Events CIS-XHE-FC-XLCNT and MSS-XHE-FO-MS10 were analyzed in detail with justification cited for the system time window that was used in developing the human error probability.

LR-N18-0033 LAR S18-02 TABLE A-5 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR HUMAN RELIABILITY ANALYSIS RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION HR-G1 HR-G1 SR Met: (CC I) HR-G1-01 The notebook does document which HEP's are risk significant and the ones that are not use screening values. The reason this does not meet Capability Category I is that the human action from the shutdown panel, RRS-XHE-FO-SDRSP, is risk significant but still uses a screening value. This requirement must have a detailed analysis for significant HFEs. While industry consensus has not been achieved in adopting a consistent methodology to appropriately analyze the many actions associated with remote shutdown activities, a detailed HEP calculation is no longer required for RRS-XHE-FO-SDRSP as it is not risk significant in the SA112A model. Per Category II of HR-G1, screening values may be assigned to HEPs for non-significant human failure basic events. No further action required. HR-G2 HR-G2 SR Met This requirement was met since the EPRI HRA Calculator was used for the analysis. N/A HR-G3 HR-G3 SR Met: (CC II/III) This requirement was met since the EPRI HRA Calculator was used for the analysis. N/A HR-G4 HR-G4 SR Not Met HR-F2-01, HR-F2-02 The accident sequence specific timing of time window for successful completion for CCS-XHE-FO-ISOLT is based on a calculation that does not address leakage. The calculation S-CC-MDC-2111 is for loss of Service Water and does not address leakage of the Component Cooling Water System. The time window should account for leakage that would drain the CCW system and make it inoperable. This is the limiting time since the CCW system will continue to cool with the leak until the surge tank is drained. Other examples of problems with timing are the lack of documentation for the timing used. This is noted in HRAs: CIS-XHE-FC-XLCNT, and MSS-XHE-FO-MS10. It should be noted that only a sampling was performed and that this may involve many more HRA analysis. See above response for SR HR-F2. HR-G5 HR-G5 SR Met: (CC II/III) This requirement was met by Section 2.6 during plant visits. N/A HR-G6 HR-G6 SR Met This requirement was met by Section 2.6 during plant visits and operator interviews. N/A HR-G7 HR-G7 SR Met This requirement is met by Section 5.2 of the HRA Notebook, Dependent Operator Actions. N/A N/A HR-G8 This SR was deleted in RA-Sb-2005. N/A

LR-N18-0033 LAR S18-02 TABLE A-5 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR HUMAN RELIABILITY ANALYSIS RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION HR-G8 HR-G9 SR Not Met SC-C3-02 This requirement is not met. The Salem PRA Uncertainty Notebook (SA-PRA-018) was officially issued as part of the SA112A PRA model update and includes sources of uncertainties associated with Human Reliability Analysis (HRA). This document makes use of both EPRI 1026511, which addresses the use of PRA and the treatment of uncertainty, and EPRI 1016737, which addresses the treatment of parameter and model uncertainty. As such, there is no further action required. HR-H1 HR-H1 SR Met: (CC II/III) This requirement was met because the EPRI HRA Calculator was used and this includes operator recovery actions. N/A HR-H2 HR-H2 SR Met This requirement was met because the EPRI HRA Calculator was used and this includes operator recovery actions. N/A HR-H3 HR-H3 SR Met This requirement is met by Section 5.2 of the HRA Notebook, Dependent Operator Actions. N/A HR-I1 HR-I1 SR Met The use of the EPRI HRA Calculator and the documentation in the HRA Notebook meets this requirement. N/A HR-I2 HR-I2 SR Met The use of the EPRI HRA Calculator and the documentation in the HRA Notebook meets this requirement. N/A HR-I3 HR-I3 SR Not Met SC-C3-02 This requirement is not met. See above response for SR HR-G8.

LR-N18-0033 LAR S18-02 TABLE A-6 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra-Sa-2009 SR # Ra-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION DA-A1 DA-A1 SR Met: (CC II/III) DA-A1-01 Need to develop Salem specific site procedures. Salem specific site procedures should be developed for maintenance of site specific PRAs. Recommendation is to develop Salem specific site procedures. The PSEG ER-AA-600 series of procedures exist to address this issue. Specifically ER-AA-600-1015 addresses maintenance and update of the internal events PRA model. They may be found and retrieved using the site's database known as DCRMS. There is no further action required. DA-A2 DA-A1a SR Not Met DA-A1a-01 No discussion of component boundary definition is provided in either the data or systems analysis. Boundaries for unavailability events are not established. Boundary definitions help assure that failures are attributed to the correct component and that calculated failure rates and unavailability values are appropriate. Some component boundaries are discussed in the notes to Appendix A, "Generic (Industry) Failure Data" of the Data Notebook. Note 32 states to "Assume that CCW/RHR HX failure rates apply to TDAFW Pump Bearing and governor jacket coolers," however unless the Salem TDAFW pump has unique features that require this to be modeled separately, cooling to the TDAFW pump is included in the component boundary to the pump in NUREG-6928. Boundary definitions for plant systems were better defined in the System Notebooks during the 2012 PRA Update by incorporating drawings with highlighted boundaries in order to help the reader better visualize the modeled system boundaries. The Data Notebook (SA-PRA-010) was also revised in order to explain how component boundaries were defined. This was done by referencing Section 5.1 of NUREG/CR-6928 which contains the definition used for component boundaries for generic industry data. Also, the TDAFW jacket coolers were removed from the SA112A PRA model since they are considered within the boundary of the TDAFW pump. No further action required. DA-A3 DA-A2 SR Not Met DA-A2-01 Mean values for failure rates appear in the model, however no uncertainty distributions could be found in the basic events checked. The PRA update for the Rev. 4.3 PRA model included adding uncertainty parameters to the type code database, and as part of the 2012 PRA model update, the CAFTA Access database file (SA112A.rr) was updated to include uncertainty parameters for all type codes and basic events used in the SA112A PRA model. No further action required. DA-A4 DA-A3 SR Met The data parameters used in the model appear to be appropriately identified. The units for Motor Operated Valves Fails to Close are demands. The units identified for Motor Operated Valves Fails to Remain Open or Closed are hours. Reference Data Analysis Notebook Section 2.1.1. N/A

LR-N18-0033 LAR S18-02 TABLE A-6 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra-Sa-2009 SR # Ra-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION DA-B1 DA-B1 SR Met: (CC I) DA-B1-01 Components were grouped according to type such as motor-operated valve to meet Category 1 of the standard. Components were grouped according to mission type, (e.g., standby and operating) fails to meet Category II, however as stated in the Data Analysis Notebook Section 2.1.1.6, "there is no differentiation between systems (e.g., clean water vs. raw water". Therefore, a full Category II could not be met. The type codes used and listed in the Data Notebook (SA-PRA-010) do identify the different systems and type codes used as well as the basis for their failure probabilities. Type code failure rates now distinguish between clean and dirty water systems, e.g., pumps in the CCS and SWS PRA modeled systems. Also, the internal flood evaluation makes use of pipe rupture rates categorized by the type and quality of water contained within the various water pipes that were analyzed. No further action required. DA-B2 DA-B2 SR Met There did not appear to be any outliers in the data reviewed. Reference Data Analysis Notebook, Section 2.2 and Appendix A and Appendix C. N/A DA-C1 DA-C1 SR Not Met DA-A1a-01, DA-C1-01 Generic parameter estimates are obtained from recognized sources (principally NUREG/CR-6928). However, no discussion of component boundary definition is provided other than a draft document. In addition, generic unavailability data is used for some SSCs without demonstrating that the data is consistent with the test and maintenance philosophies for the subject plant. As discussed in DA-A2, the Data Notebook (SA-PRA-010) was revised in order to explain how component boundaries were defined, which is consistent with NUREG/CR-6928, the source of the generic failure rate data. The most recent PRA update, SA115A, included plant-specific updates for all unavailability type codes using current or past plant specific maintenance rule data. No unavailability is based on generic sources. Past unavailability data from an older model revision is used only for components which show zero unavailability from maintenance rule data as noted in Appendix C of SA-PRA-010, so the impact on the model is slightly conservative and negligible. No further action required.

LR-N18-0033 LAR S18-02 TABLE A-6 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra-Sa-2009 SR # Ra-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION DA-C2 DA-C2 SR Not Met DA-C2-01 Plant-specific data is only collected for MSPI components. The draft data procedure provided requires that plant specific data be supplied for SSCs with RAWs > 2 and F-V's > 0.005. In accordance with ER-AA-600-1015, plant specific updating of data should be considered for those events that satisfy either a Fussell-Vesely (FV) value greater than 0.005 or a Risk Achievement Worth (RAW) greater than 2.0. An importance measures report was generated from a CDF cutset listing and a review made of those non-MSPI applicable basic events that exceeded this criteria. The associated type codes for these basic events were then identified and are listed in Table 7-1 of the data notebook (SA-PRA-010) to determine the type of plant components for which plant specific updating was considered. A search of Salems SAP database was performed to identify any functional failures that may have occurred within the time period from July 2012 to September 2016. Any applicable failures for the identified equipment types were then recorded in Table 7-1 of the Data Notebook to support a Bayesian update of the generic data. This data update that was incorporated in SA115A now addresses all components with the identified importance values, thereby meeting the intent of this SR. DA-C3 DA-C3 SR Met Plant-specific data is collected consistent with design, operation and experience. N/A

LR-N18-0033 LAR S18-02 TABLE A-6 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra-Sa-2009 SR # Ra-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION DA-C4 DA-C4 SR Not Met DA-C4-01 Documentation describing the process of evaluating maintenance records was identified in a draft procedure. All failures must be reviewed for applicability to the PRA model and this process should be documented. All plant specific data came from MSPI or the Maintenance Rule, however there was no documentation provided that these failures were reviewed as PRA failures. Formal procedures now currently exist that describe the PRA update process, including what data collection is required. Actual plant-specific failure and unavailability data were obtained from the Salem Maintenance Rule and MSPI programs. In accordance with ER-AA-600-1015, plant specific updating of data should be considered for those events that satisfy either a Fussell-Vesely (FV) value greater than 0.005 or a Risk Achievement Worth (RAW) greater than 2.0. As a matter of practice, all MSPI monitored components, whether risk-significant or not, use plant-specific data to inform the generic industry data (i.e., Bayesian analysis). For other components deemed risk significant, an importance measures report was generated from a CDF cutset listing and a review made of those non-MSPI applicable basic events that exceeded this criteria. The associated type codes for these basic events were then identified and were listed in Table 7-1 of the PRA Data Notebook (SA-PRA-010) to determine the type of plant components for which plant specific updating was considered. A search of Salems SAP database was performed to identify any functional failures that may have occurred within the time period from July 2012 to September 2016. Any applicable failures for the identified equipment types were then recorded in Table 7-1 of the Data Notebook to support a Bayesian update of the generic data. For failure rates that are time-dependent, e.g., standby failure rates, it was also necessary to record the critical operating hours for Salem Unit 1 and Unit 2, which are listed in Table 7-2 of the Data Notebook for the time period from July 2012 to September 2016. Further details may be found in the PRA Data Notebook (SA-PRA-010). This process, now documented, meets the intent of the SR.

LR-N18-0033 LAR S18-02 TABLE A-6 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra-Sa-2009 SR # Ra-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION DA-C5 DA-C5 SR Not Met DA-C5-01 Documentation describing the process of evaluating failure records other than applying MSPI data directly could not be identified. All failures must be reviewed for applicability to the PRA model. Failure and unavailability data were obtained from the Salem Maintenance Rule and MSPI programs. The counting of component failures, such as was done for MSPI components, was consistent with industry practice. Failures were obtained from the MSPI reporting process and were handled appropriately during the revision of the Data Notebook (SA-PRA-010) as part of the 2012 PRA model update. During the 2015 update, the Data notebook was updated to clarify failures occurring within a short time interval can be excluded so as not to skew the data for any one SSC modeled in the PRA. No further action required. DA-C6 DA-C6 SR Not Met DA-C6-01 Documentation describing the process of evaluating the number of plant specific demands for standby components could not be identified. Standby components were identified in Table 1 of the Data Analysis Notebook and plant specific demands for some of these components were listed in Appendix B, however the basis for this number of demands was not provided. The draft data procedure states that plant specific data should be estimated by actual counts of hours or demands from logs or counters, use of surveillance procedures to estimate the frequency of demands and run times, or estimates based upon input from the System Engineer. Plant-specific reliability data for MSPI monitored components was obtained from the Salem MSPI reporting process and provided in the Appendix B tables of the Data Notebook (SA-PRA-010) in order to facilitate the Bayesian updating process during the 2012 PRA Update. This process was documented in Section 7.2 of SA-PRA-010. A sensitivity analysis was performed using additional plant-specific data to address issues related to SRs DA-C1 and DA-C2. In all cases, failure rates and probabilities fall into one of two categories, i.e., they were either a part of the plant-specific data update that used MSPI data, which included plant-specific demands and run hours from the MSPI Derivation reports, or they made use of generic data from sources such as NUREG/CR-6928. For future updates, plant-specific data and Bayesian updating will be extended to include risk-significant components per ER-AA-600-1015. Since this is mainly a documentation issue, there is no impact on the results for this license amendment request.

LR-N18-0033 LAR S18-02 TABLE A-6 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra-Sa-2009 SR # Ra-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION DA-C7 DA-C7 SR Not Met DA-C7-01 Documentation describing the process of collecting the number of surveillance tests and planned maintenance activities on plant requirements could not be identified. In Appendix C for example CCS MOVs in test and Maintenance were described. The source of the data was listed as Salem 3.2 PRA, however no specific breakdown of the surveillance tests included was provided. The draft data procedure identifies surveillance tests as a source of data. Existing performance monitoring programs, such as the Maintenance Rule, already document testing and maintenance unavailability information for each of the more risk-significant systems modeled in the PRA. The testing and maintenance unavailability information used in the Salem PRA is a combined value, i.e., represented by a single basic event. As such, there is no further action required. DA-C8 DA-C8 SR Met: (CC I) DA-C8-01 An estimate of times that some components were configured in their standby status is identified in Table 1 and its notes, however no documentation of how these estimates were derived was provided. No operational records were provided in order to meet Capability Category II. The table cited in the summary description is now labelled as Table A-1 in the Salem PRA Data Notebook (SA-PRA-010), which identifies the failure rates/probabilities to be used for various SSCs modeled in the PRA. The notes to this table help identify which components are considered either normally running or in a standby condition, and also what fraction of the time a component may be considered in either a running or standby condition, e.g., Note 25 for station air compressors. In addition, standby flags were employed in the SA112A PRA model to denote which components are configured in a standby condition so that the appropriate failure mode can be applied in the fault tree logic. Two significant updates to the 2010 NUREG/CR-6928 component reliability data sheets includes providing both the Fails to Start data for standby equipment and the Fails to Run <1 HR data with beta distribution. This allowed the data to be easily combined to determine the new Fails to Start failure rate for standby equipment. Therefore, there was no need to identify a specific number standby hours for equipment normally in a standby status, since the standby failure rate model is not applicable to the Salem SA115A PRA model. As such, there is no further action required.

LR-N18-0033 LAR S18-02 TABLE A-6 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra-Sa-2009 SR # Ra-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION DA-C9 DA-C9 SR Not Met DA-C9-01 Documentation describing the process of estimating the operational time of standby components from testing was identified in draft procedure. Standby components were identified in Table 1 of the Data Analysis Notebook and operational times for some of these components were listed in the Data Analysis Notebook, however the source of the data was not provided. Further clarification was provided in the Salem Data Notebook (SA-PRA-010) during the 2012 PRA model update (SA112A) to help better explain how estimates for standby time were derived. As such, there is no further action required. DA-C10 DA-C10 SR Not Met DA-C10-01 Documentation describing the process of reviewing test procedures to determine surveillance test data could not be identified. No specific surveillance tests were discussed in the Data Analysis Notebook. The Systems Analysis Notebooks for specific systems described various surveillance testing, but did not reference surveillance tests by name. The use surveillance tests and their frequency was used to determine the number of demands for determining plant-specific operating experience for updating generic data that was used for risk significant components modeled in the PRA. For capability category II to be met for PRA Standard Supporting Requirement DA-D1, it requires that realistic parameter estimates be made for significant basic events based on relevant plant-specific evidence. It is the number of surveillance tests that is a part of this exercise in determining more realistic parameter estimates. Specifically, the response to APLA-RAI-2 shows that the number of demands were determined based on the number of functional tests for the component of interest (see Table RAI-2-3), which were determined based on configuration risk management schedules in support of 10 CFR 50.65(a)(4) planning and interviews with work control personnel at the Salem plant. This information was necessary for the Bayesian updating process in which the denominator of for the generic demand failure probability is updated with this plant-specific information. Therefore, this F&O has been addressed and Supporting Requirement DA-C10 is considered to be met at Capability Category II.

LR-N18-0033 LAR S18-02 TABLE A-6 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra-Sa-2009 SR # Ra-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION DA-C11 DA-C11 SR Not Met DA-C11-01 Documentation describing the process of using maintenance and testing durations to determine plant specific durations was identified in a draft document. No specific surveillance tests were discussed in the Data Analysis Notebook but MSPI/Maintenance Rule sources were identified. Consistent with industry practice, the failure and unavailability data were obtained from the Salem Maintenance Rule and MSPI programs. The Maintenance Rule data and MSPI data are traceable to individual occurrences. Therefore, the documentation does exist and it was not necessary to repeat the information in the Data Notebook (SA-PRA-010). No further action required. DA-C12 DA-C11a SR Not Met DA-C11a-01 Documentation describing the process of how to count maintenance unavailability was not identified. Plant Specific unavailability was only documented for MSPI components which identifies the unavailability for support and frontline systems separately, however it could not be determined that this was the case throughout the model without a specific guidance document. As part of the enhancements made during the 2012 PRA update, the process used for counting maintenance unavailabilities was more clearly described in the Salem PRA Data Notebook (SA-PRA-010). In particular, Section 8.0 of SA-PRA-010 states that unavailability due to test and maintenance was collected from plant records. Specifically, Maintenance Rule and MSPI unavailability data was used to determine train and component unavailability for use in the PRA. Generic industry unavailability data was only used when no other information was available. Salem MRule Manager software and MSPI Derivation Reports for Unavailability Index were used as the primary sources of plant specific component and/or train unavailability. Because maintenance practices change over time, the best representation of the current plant practices would be seen in the most current data. This being the case, unavailability data was only collected and analyzed from March 2012 through February 2015.

LR-N18-0033 LAR S18-02 TABLE A-6 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra-Sa-2009 SR # Ra-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION DA-C13 DA-C12 SR Not Met DA-C12-01 While a table of critical hours was provided and the Maintenance Unavailability Table provided in Appendix C appears to address these hours there was no specific documentation or guidance document provided that discusses how maintenance was treated for shared systems. Maintenance unavailabilities for shared systems between the two units is addressed in Section 8.1 of the Salem Data Notebook (SA-PRA-010). Specifically, since some of the Maintenance Rule data was for shared systems (e.g., ECAC, GTG), common critical hours were needed. Common critical hours (denoted as C Hours) were calculated by determining the time during which either unit was critical. With regard to outage durations, it was assumed that the C critical hours were the greater of the two units critical hours for any months during which both plants were not critical 100% of the time (e.g., April 2012). If both units were critical for the entire month, the C hours would be the number of hours in the month. DA-C14 DA-C13 SR Not Met DA-C13-01 Coincident unavailability for service water pumps was modeled as shown in Appendix C of the Data Analysis Notebook, however, no overall guidance document could be found to ensure all systems were reviewed for coincident unavailability. A paragraph was added to section 8.2 of the Data Notebook (SA-PRA-010) to document the treatment of concurrent unavailability for SW. Also, Note 12 was added at the bottom of Table C-1 in Appendix C of SA-PRA-010 to denote the actual unavailability values that were used. In general, for other plant systems, the plant records that were reviewed revealed that coincident unavailability amongst safety related trains was non-existent, but because of the number of SW pumps that exist at Salem (a total of six), it would be possible that a pair of SW pumps could be simultaneously taken out for maintenance. However, since the time period of interest did not show any such occurrence, legacy values used in previous versions of the PRA for dual maintenance unavailabilities amongst the SW pumps were maintained. Future versions to the ASME PRA Standard allude to the fact that dual maintenance terms can be excluded if supporting data exists. DA-C15 DA-C14 SR Not Applicable SSC repair is not modeled. N/A DA-C16 DA-C15 SR Not Applicable System recovery is not modeled. N/A

LR-N18-0033 LAR S18-02 TABLE A-6 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra-Sa-2009 SR # Ra-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION DA-D1 DA-D1 SR Met: (CC II) Plant specific evidence was provided for significant basic events. A Bayesian update of generic prior was performed as shown in Appendix B of the Data Analysis Notebook. N/A DA-D2 DA-D2 SR Met DA-D2-01 Evaluation of diesel-driven compressor provides example of evaluating plant-specific consideration using similar components. See Data Analysis notebook Section 2.1.3. Use of Monte Carlo simulation techniques using the @RISK Excel add-in was used to derive failure distributions for the diesel-driven air compressor with documentation provided in Section 6.3 of the Salem PRA Data Notebook (SA-PRA-010) during the 2012 PRA model update. No further action required. DA-D3 DA-D3 SR Met: (CC I) DA-D3-01 Observations of SA PRA-010, Table A-1. Mean values were provided along with error factors for most distributions. Several items listed in Table A-1 do not contain any reference information for either error factor or basic input parameters from which an error factor can be derived. All parameters identified in Table A-1 of SA-PRA-010 now have a reference provided to show traceability of information. Table A-1 is a listing of the generic failure rates and probabilities that were used in the Salem PRA model, and were obtained primarily from the 2010 update to NUREG/CR-6928. For those components where NUREG/CR-6928 could not be used, other appropriate sources were used, such as NUCLARR, NUREG/CR-2728, NUREG/CR-5500, and legacy values from earlier Salem PRA models. DA-D4 DA-D4 SR Met: (CC I) DA-D4-01 No documentation is present that substantiates that the analysis was performed. This is sufficient for Category I. A paragraph was added to Section 7.2 of the Salem PRA Data Notebook (SA-PRA-010) to document the comparison of updated results with the generic data during the Salem 2012 PRA model update. Because no abnormalities were identified, no further action is required. DA-D5 DA-D5 SR Met: (CC II) Values provided for Alpha and MGL methods for significant events in the Data Analysis Notebook. N/A

LR-N18-0033 LAR S18-02 TABLE A-6 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra-Sa-2009 SR # Ra-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION DA-D6 DA-D6 SR Met: (CC I) DA-D6-01 No apparent comparison of common cause failures to plant experience was provided in the Data Analysis Notebook. During the Salem 2012 PRA model update, a paragraph was added to Section 6.1 of the Data Notebook (SA-PRA-010) to document a comparison of the NUREG/CR-6928 values with other generic data sources, such as NUCLARR and EPRI. No large discrepancies were identified. As such, NUREG/CR-6928 was deemed acceptable for use. No further action required. DA-D7 DA-D6a SR Not Applicable No generic data was screened. N/A DA-D8 DA-D7 SR Not Applicable No modifications are known that would impact data. N/A DA-E1 DA-E1 SR Met DA-E1-01 The analysis is documented in a manner that could facilitate applications, upgrades, and PEER reviews. The notebook could be improved by providing direct references to actual failure numbers in EPIX or CDE numbers in Appendix A. See suggestion. This URE is a suggestion that has no impact on the quality of the PRA and was only meant to aid reviewers in the traceability of data sources. The current data notebook is now traceable to ISIS (replacement for EPIX) and/or CDE. As such, there is no further action required. DA-E2 DA-E2 SR Not Met DA-E2-01 A draft document was provided that documented how to establish component boundaries, how to establish failure probabilities, sources of generic data, etc. This procedure needs to be formalized. NUREG/CR-6928, which was used in gathering the generic data for updating the Salem Data Notebook (SA-PRA-010), provides a definition of the component boundaries for the modeled components of interest. No formal procedure needs to be developed when the data source used for the SA115A PRA model already defines the component boundaries of modeled components. Because this is a documentation issue, there is no impact on the results for this license amendment request.

LR-N18-0033 LAR S18-02 TABLE A-6 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra-Sa-2009 SR # Ra-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION DA-E3 DA-E3 SR Not Met SC-C3-02 Assumptions were noted in various sections of the Data Analysis Notebook. These need to be gathered into an assumptions section in the notebook. Sources of uncertainty were not discussed in the analysis. Assumptions are appropriately documented throughout the Data Analysis Notebook (SA-PRA-010) where appropriate in order to be consistent with the context of each section. In general, most assumptions may be found within footnotes to the data tables in order to explain the basis for derivation of the data. Additionally, the Uncertainty Notebook (SA-PRA-018) was officially issued and includes a section on model uncertainty and references both EPRI 1026511, which addresses the use of PRA and the treatment of uncertainty, and EPRI 1016737, which addresses the treatment of parameter and model uncertainty. As such, there is no further action required.

LR-N18-0033 LAR S18-02 TABLE A-7 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION QU-A1 QU-A1 SR Met The single-top fault tree (S1R4.CAF) integrates the model in a manner that supports quantification and treatment of dependencies. N/A QU-A2 QU-A2a SR Met Fault tree linking is used in constructing the S1R4.CAF model. N/A QU-A3 QU-A2b SR Met: (CC I) QU-A2b-01 Parametric uncertainty is not performed on the quantification results. In addition, it is not clear that the same type code is used for multiple events based upon the same underlying data. The parametric uncertainty analysis was performed and documented in the newly issued Salem PRA Uncertainty Notebook (SA-PRA-018). The uncertainty analysis also correctly accounted for the "state-of-knowledge" correlation by making the necessary adjustments to the type codes in the CAFTA database file (SA112A.rr). No further action required. QU-A4 QU-A3 SR Met The model is quantified using CAFTA software which is capable of reporting contributors to CDF by initiating event, or at the individual sequence level if desired. N/A QU-A5 QU-A4 SR Met QU-A4-01 Recovery events NRAC-12H, NRAC-OSP, and NREDG-4H are included in the S1R4REC.CAF file, but their application is not discussed in the Accident Sequences and Event Tree notebook or in the AC Power System Notebook. Recovery events that have no basis or discussion of applicability were removed from the recovery model logic during the 2012 PRA model update (SA112A). The recovery files are discussed in the Quantification notebook (SA-PRA-014). The offiste power non-recoveries are discussed in Appendix D of the Accident Sequence Notebook (SA-PRA-002). As such, there is no further action required. QU-B1 QU-B1 SR Met The CAFTA software suite and the Forte quantification engine are used in the quantification. These are standard software products which have been shown to produce appropriate results in industry usage. N/A QU-B2 QU-B2 SR Met Salem Quantification Notebook SA PRA-2008-01 Attachment E documents the convergence analysis performed to set an appropriate truncation value. N/A

LR-N18-0033 LAR S18-02 TABLE A-7 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION QU-B3 QU-B3 SR Met QU-B3-01 Salem Quantification Notebook SA PRA-2008-01 Attachment E documents the convergence analysis performed to set an appropriate truncation value. The truncation level for both CDF and LERF was set at 1.0E-11. The percentage change between 1.0E-10 and 1.0E-11 was 2.2% for CDF, but 6.1% for LERF. Therefore, this SR was not satisfied for LERF. Attachment E of the Salem Quantification Notebook (SA-PRA-014) for the SA115A PRA model documents the process used to ensure that convergence was achieved for quantification of CDF and LERF cutsets. There was less than a 5% change in CDF in going from a truncation limit of 1E-11 to 1E-12, and less than a 5% change in LERF when going from a truncation of 1E-12 to 1E-13. Therefore, the official truncation limits used were 1E-11 for CDF and 1E-12 for LERF. No further action required. QU-B4 QU-B4 SR Met Forte uses the minimal cutset upper bound quantification method to produce the mean value. N/A QU-B5 QU-B5 SR Not Met QU-B5-01 Creation of different fault tree tops to break circular logic is discussed in the system notebooks; however the documentation is not sufficient to determine whether the logic was broken at the appropriate level to ensure unnecessary conservatisms or non-conservatisms. A new vital AC power PRA system notebook (SA-PRA-005.0020) was created during the 2012 PRA model update. Section 6.8 of this notebook contains an explanation of how circular logic loops were broken for the diesel generator support dependencies, and also lists the affected gates with a description of the modification. The documented review of this PRA system notebook provides evidence that the logic was broken at the appropriate level to avoid any unnecessary conservatisms or non-conservatisms. No further action required. QU-B6 QU-B6 SR Met Complementary logic is used where needed to account for system successes in transfers to the LERF model from the Level 1 model. N/A QU-B7 QU-B7a SR Met Mutually exclusive logic is included in the linked fault tree under gate DAM-GDAM100 and combined with the core damage or LERF logic in an "A and not B" gate. N/A

LR-N18-0033 LAR S18-02 TABLE A-7 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION QU-B8 QU-B7b SR Met Mutually exclusive logic is included in the linked fault tree under gate DAM-GDAM100 and combined with the core damage or LERF logic in an "A and not B" gate to remove mutually exclusive combinations during quantification. N/A QU-B9 QU-B8 SR Met Flag file S1R4IFL.CAF contains the flag settings as TRUE or FALSE. The quantification process using PRAQUANT merges the flag file with the PRA model prior to quantification. N/A QU-B10 QU-B9 SR Not Met QU-B9-01 Split fractions and undeveloped events are included in the model. Examples include main Feedwater availability for ATWS (MFI-UNAVAILABLE) and some Unit 2 systems credited for recovery of Unit 1 CAV failure (G2SW22). The derivation of the values for these events is not documented to allow determination that consideration has been given to the impact of shared events. Split fractions such as the ones mentioned in the summary description (MFI-UNAVAILABLE and G2SW22) are listed in Table A-2 of the PRA Data Notebook (SA-PRA-010) that was revised during the 2012 PRA model update (SA112A) along with references to document the basis of their values. The split fraction for unavailability of feedwater during an ATWS event was obtained from WCAP-11992. The estimated value for event G2SW22, which represents insufficient flow from the opposite unit Service Water header, was obtained by quantifying a gate in the PRA model (G1CC324) that explicitly models unavailability of the 12 SW header. QU-C1 QU-C1 SR Met The dependency analysis for multiple HFEs is described in the HRA Notebook. The process included a requantification of the model with HEPs set to 0.1 to capture combinations which could be below normal truncation levels. The final application of dependency correction factors is done through post-processing of the cutsets. N/A QU-C2 QU-C2 SR Met The dependency analysis for multiple HFEs is described in the HRA Notebook. N/A QU-C3 QU-C3 SR N/A The linked event tree methodology is not used for the Salem model. N/A

LR-N18-0033 LAR S18-02 TABLE A-7 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION QU-D1 QU-D1a SR Met QU-D1a-01 Section 6 of the quantification notebook SA-PRA-2008-01, Revision 4.1 includes a discussion of the top cutsets. The discussion provides good detail of the core damage scenarios. Some of the cutsets appear to be conservative, which are discussed more in the F&O. The current system window for the RRS-XHE-FO-SDRSP action (FAILURE OF REMOTE SHUTDOWN UPON LOSS OF CAV) is 4 hours as OP-AB.CAV-0001 reports that the electrical equipment room temperature will exceed 145F in 4.2 hours if no operator action is taken. Use of a joint human error probability (HEP) floor value (1E-6 for the SGS HRA) is the current industry expectation as discussed in NUREG-1792, Good Practices for Implementing HRA. The system window length has no impact on the application of the joint HEP floor value. It is acknowledged that the time reported for MFW-XHE-FO-COND did reflect that actions base case (LOFW at time zero) rather than a loss of feedwater upon depletion of the AFWST, which is more representative of the combination. The Salem Dependency Analysis for the 2012 PRA model update was completely revised using the HRA Calculator, which allows the manipulation of timing within a combination. Still, there are no joint HEPs in the Salem HRA with values less than 1E-6 due to the floor value requirement. No further action required. QU-D2 QU-D1b SR Not Met QU-D1b-01 There is no discussion in the quantification notebook that indicates a review of the results was performed for the purpose of assessing modeling and operational consistency. Also, since the sequences were not quantified, it is difficult to perform this verification. Section 6 of the Quantification Notebook (SA-PRA-014) for the 2015 PRA model update discusses the top 25 cutsets that lead to core damage and also addresses the fact that a cutset review was conducted with PSEG personnel in November 2016 to ensure modeling and operational consistency. No further action required.

LR-N18-0033 LAR S18-02 TABLE A-7 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION QU-D3 QU-D1c SR Not Met QU-A4-01 There is no discussion in the quantification notebook SA-PRA-2008-01, Revision 4.1 that indicates this review was completed. Review the recovery file to ensure only those events intended to be applied are included. Provision of a listing of all recovery events and their intended application in the Quantification Notebook could facilitate this review for future model revisions. Recovery events that were no longer applicable were removed from the recovery model logic during the 2012 PRA model update (SA112A). The use of recovery files is discussed in Section 5.3 of the Quantification notebook (SA-PRA-014). The offsite power non-recoveries are discussed in Appendix D of the Accident Sequence Notebook (SA-PRA-002). N/A QU-D2 This SR was deleted in RA-Sb-2005 N/A QU-D4 QU-D3 SR Met: (CC I) QU-D3-01 This is a Capability Category I since there is no documentation to indicate that the Salem results were compared to the results of a similar plant. In Tables 2-5 to 2-7 of Section 2.3 of the Initiating Events notebook (SA-PRA-001) a comparison was made to the initiating events used for other PWR PRA models, i.e., South Texas Project, Watts Bar, and Surry to show that there were no applicable event categories that would have been omitted from the Salem PRA model. Also, the success criteria used for the Salem PRA model was benchmarked against the success criteria used for the Byron and Braidwood PRA models in Table 2-2 of the Success Criteria Notebook (SA-PRA-003). Since this is a documentation issue, there is no impact on the results for this license amendment request in extending the inverter AOT. QU-D5 QU-D4 SR Not Met QU-D4-01 There is no documentation indicating that a sampling of non-significant accident cutsets or sequences were reviewed to determine they are reasonable and have physical meaning. A sampling of non-significant accident cutsets that lead to core damage near the truncation threshold of 1E-11 were inspected to determine the presence of any illogical cutsets. This review was documented in Section 6 of the Quantification Notebook (SA-PRA-014) for the 2015 PRA model update (SA115A). The review determined that the cutsets did appear to be reasonable and had physical meaning. No further action required.

LR-N18-0033 LAR S18-02 TABLE A-7 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION QU-D6 QU-D5a SR Not Met QU-F2-01 This requirement was not met because the importance of components and basic events was not performed. There is no definition of significant contributors to CDF. No documentation of an analysis for significant contributors to CDF. A description of top 25 cutsets related to CDF are discussed in Section 6 of the Quantification Notebook (SA-PRA-014), which includes those SSCs and operator actions that contribute to event frequencies and mitigation. Also, Appendix D of SA-PRA-014 discusses the dominant CDF and LERF accident sequences, including a discussion of the type of initiating event and associated SSC failures and operator actions. Since this is a documentation issue, there is no impact on the results for this license amendment request in extending the inverter AOT. QU-D7 QU-D5b SR Not Met QU-F2-01 This requirement was not met because the importance of components and basic events was not performed. A listing of the importance measures for CDF is presented in Section 7 of the Quantification Notebook (SA-PRA-014), and an analysis of the baseline results for CDF and LERF for the SA115A PRA model are discussed in Appendix F of SA-PRA-014. Appendix H discusses the results for LERF as well as the other detailed Level 2 release categories. The review of these results showed that they make logical sense. Also, since this is a documentation issue, there is no impact on the results for this license amendment request in extending the inverter AOT. QU-E1 QU-E1 SR Not Met SC-C3-02 The uncertainty notebook was produced but is not finalized. See response for SR QU-F4. QU-E2 QU-E2 SR Met The quantification assumption is that the model been correct analyzed. So that the assumptions are in the other notebooks and will be documented in the SR for those areas. N/A QU-E3 QU-E3 SR Not Met SC-C3-02 The uncertainty notebook was produced but is not finalized. See response for SR QU-F4. QU-E4 QU-E4 SR Not Met SC-C3-02 The uncertainty notebook was produced but is not finalized. See response for SR QU-F4. QU-F1 QU-F1 SR Met This requirement is met by the Quantification Notebook. N/A

LR-N18-0033 LAR S18-02 TABLE A-7 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION QU-F2 QU-F2 SR Not Met QU-B3-01, QU-F2-01 This requirement was only partially met as described below: (a) This requirement is met by the system and HRA notebooks. (b) There is a cutset review process description. (c) There is no description of how the success systems are accounted for. Since a one top tree is used the software already accounts for this. A statement stating would be satisfactory. The truncation values and how they were determined were documented. The method for applying recovery and how post initiator HFE's are applied was not described. (d) This requirement was met. (e) This requirement was met. (f) This requirement was not met since the cutsets per accident sequence were not discussed. (g) This requirement was not met since equipment or human actions that are the key factors in causing the accidents sequences to be non-dominant are not discussed. (h) This requirement was not met since sensitivities were not documented. (i) This requirement was not met since the uncertainty notebook was not finalized. (j) This requirement is not met since there is no discussion of importance. (k) This requirement is not met because there is not list of mutually exclusive events and there justification. (l) This requirement is not met because there is no discussion of asymmetries in quantitative modeling to provide application users the necessary understanding regarding why such asymmetries are present in the model. (m) This requirement is met since CAFTA and Forte are being used. Both of these pieces of software are industry standards and therefore no further testing is required. The following discussion addresses only those sub-parts that were considered "not met": c) the method of applying recovery events and adjustment for joint HEPs is now described in Section 5 of the Quantification Notebook (SA-PRA-014); (f) descripton of top 25 cutsets and dominant sequences were discussed in the Quantification Notebook (see Section 6 of SA-PRA-014); (g) Human Error Probabilities (HEPs) that were identified as being "time sensitive" are now discussed in the HRA Notebook (SA-PRA-004); (h) sensitivity calculations were documented and discussed in the Uncertainty Notebook (SA-PRA-018); (i) the Uncertainty Notebook (SA-PRA-018) was prepared and issued as part of the work scope involved with the Salem 2012 PRA Update Project (SA112A); (j) importance measures are utilized as a part of the process used to document Maintenance Rule products per the ER-AA-310 series of procedures. Also, the risk poster, which is produced as part of the rollout process (Risk Application: SA-MISC-002), will also satisfy this requirement; (k) a discussion of how mutually exclusive events were treated was provided in Section 5 of the Quantification Notebook (SA-PRA-014); (l) model asymmetries were mainly limited to the fact that the SA115A PRA model is a Unit 1 model that relies on Unit 2 equipment for certain support functions, e.g., Demineralized Water and Main Control Room ventilation, which are not developed to the full level of detail as would be required if a dual-unit PRA model was adopted. Based on the above discussion, there is no further action required.

LR-N18-0033 LAR S18-02 TABLE A-7 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION QU-F3 QU-F3 SR Met: (CC I) QU-F2-01 The reason this is a Capability Category I is that there is not documentation of significant contributors such as accident sequences and basic events being reviewed. Also there is no definition of significant contributors. See response for SR QU-F2. QU-F4 QU-F4 SR Not Met SC-C3-02 The uncertainty notebook has not been approved. the Uncertainty Notebook (SA-PRA-018) was officially issued and includes a section on model uncertainty and references both EPRI 1026511, which addresses the use of PRA and the treatment of uncertainty, and EPRI 1016737, which addresses the treatment of parameter and model uncertainty. As such, there is no further action required. QU-F5 QU-F5 SR Met This requirement is met by the statement about caution when using FV values of less than 0.1% and RAW values of less than 1E-04. N/A QU-F6 QU-F6 SR Not Met QU-F2-01 This requirement was not met since there is no definition for significant basic event, significant cutset, significant accident sequence. See response for SR QU-F2.

LR-N18-0033 LAR S18-02 TABLE A-8 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IFPP-A1 IF-A1 SR Met Salem internal flooding notebook SA-PRA-012, Revision 0 Appendix B contains a description of the flood areas. N/A IFPP-A2 IF-A1a SR Met: (CC II/III) IF-A1a-01 Salem internal flooding notebook SA-PRA-012, Revision 0 Appendices B and D contain a description of the flood areas. The flood areas were generally aligned with the fire areas as discussed in Section B.3. Even though the documentation that shows the flood areas/zones could be more descriptive, this SR is considered to be met. The F&O is for improving the documentation of the flood areas and zones. Appendix D of the Internal Flood Walkdown Notebook contains a list of plant drawings that define the rooms and areas within the plant and how they form the scenario boundaries. Appendix I has the embedded PDF drawings listed in Appendix D. It is unnecessary to outline the flood area boundaries on a separate set of drawings when the information that was used to define the flood boundaries already exists for other programs, e.g., Fire Hazards Analysis. Since this is a documentation issue, there is no impact on the results for this license amendment request. IFPP-A3 IF-A1b SR Met The buildings and areas that share equipment (e.g., Auxiliary and Turbine buildings) are included in the flood area identifications. N/A N/A IF-A2 This SR was deleted in RA-Sb-2005. N/A IFPP-A4 IF-A3 SR Met The drawings used in the identification and definition of the flood areas appear to be current. Changes to the drawings used should be captured as part of the inputs monitoring in the model update program. N/A IFPP-A5 IF-A4 SR Not Met IF-A4-01 Salem internal flooding notebook SA-PRA-012, Revision 0 Appendix A contains a summary of the walkdowns that were performed. The summary includes some of the important flood features. But walkdown sheets containing the details of the walkdowns (spatial information, mitigating equipment such as drains, sumps, doors, wall penetrations, etc.) were not available. The raw handwritten notes from the plant walkdowns were scanned to PDF files (Salem PRA Events.pdf and Salem Water Sources.pdf) and are now included with the rest of the electronic documentation and associated files. No further action required.

LR-N18-0033 LAR S18-02 TABLE A-8 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IFSO-A1 IF-B1 SR Met Flood sources are documented in the summary of walkdowns in Appendix A of the Salem internal flooding notebook SA-PRA-012, Revision 0, and also in the detailed analysis of the risk significant flood scenarios in Appendix E. Section 2.2.11 documents the assessment of in-leakage from other flood areas (e.g., back flow through drains). N/A IFSO-A2 IF-B1a SR Not Met IF-B1a-01, IF-C4a-01 The buildings and areas that share equipment (e.g., Auxiliary and Turbine buildings) are included in the flood area identifications. However, there was no indication in the documentation that flood sources from Unit 2 can impact Unit 1 and vice versa. The assessment performed in Section 3.0 of Risk Application SA-MISC-005 (Resolution of Internal Flood Peer Review Comments) showed that there were no new multi-unit scenarios that require consideration due to the fact that they were either already postulated or were subsumed by existing scenarios. No further action required. IFSO-A3 IF-B1b SR Met Flooding areas were selected based on the presence of one or more potential flooding sources. Hence, plant areas not subject to flooding were screened as described in Appendix B of the Salem internal flooding notebook SA-PRA-012, Revision 0. N/A IFSO-A4 IF-B2 SR Met Three categories of flooding initiating events were evaluated for the potential flood sources identified: major floods (2000+ gpm), general floods (100 to 2000 gpm) and spray type floods (<100 gpm). The frequency calculation method used (Reference EPRI technical report TR-1013141) for these flood scenarios includes failure modes of components. Section 2.2.9.1.1 of SA-PRA-012, Revision 0 documents the assessment of human-induced flood mechanisms. This section concludes that human induced flood mechanism have a low enough frequency that they can be subsumed with the pipe failure frequencies. Considering the basis documented, this conclusion appears to be reasonable. N/A IFSO-A5 IF-B3 SR Met Three categories of flooding initiating events were evaluated for the potential flood sources identified: major floods (2000+ gpm), general floods (100 to 2000 gpm) and spray type floods. N/A

LR-N18-0033 LAR S18-02 TABLE A-8 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IFSO-A6 IF-B3a SR Not Met IF-A4-01 Salem internal flooding notebook SA-PRA-012, Revision 0 Appendix A contains a summary of the walkdowns that were performed. The summary includes some of the important flood features. But walkdown sheets containing the details of the walkdowns were not available. See response for IFPP-A5. N/A IF-B4 Relocated to IF-C2 N/A IFSN-A1 IF-C1 SR Not Met IF-C1-01 Propagation paths for areas are defined for highly risk-significant cases only. An independent assessment was performed to investigate the merit of this peer review finding that deals with propagation pathways and the possible existence of other scenarios that were not already considered or perhaps that were subsumed by other scenarios. The independent study revealed that there were no other postulated scenarios that were not already considered, or that were more severe than those currently being modeled in the internal flood PRA. The details and results of this analysis are documented in Risk Application SA-MISC-005 (Resolution of Internal Flood Peer Review Comments).

LR-N18-0033 LAR S18-02 TABLE A-8 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IFSN-A2 IF-C2 SR Not Met IF-C2-01 Plant design features that have the ability to terminate or contain the flood propagation are not documented for all defined flood areas. For those quantified scenarios, a conservative approach was initially used that considered all PRA-modeled SSCs to be damaged due to a flood originating or propagating into a particular flood area and a conditional core damage probability (CCDP) computed. This CCDP was then multiplied by the flood initiating frequency to estimate the core damage frequency (CDF). If the CDF for a given flood scenario was sufficiently low, e.g., less than about 0.1% of the nominal internal events CDF, then no further refinement was deemed necessary. However, if first estimates of the core damage frequencies for that compartment proved too pessimistic, the affected area of the plant was analyzed in greater detail to take into account spatial effects, specific flooding flow rates, operator actions, drainage pathways, etc. Hence, the justification for more detailed modeling of certain internal flood scenarios was aimed at removing some of the conservatism of the methodology, while at the same time providing a realistic basis for not assuming complete failure of all scenario-specific equipment due to a credible flooding event. The PRA model was updated in 2012 (SA112A) following the peer review to include all modeled internal flood scenarios and does not numerically screen any on a numerical basis. No further action required. IFSN-A3 IF-C2a SR Not Met IF-C2a-01 This is only addressed for the most risk-significant areas. In general, operator action for internal flood mitigation was only credited where needed to reduce the risk where failure of all PRA equipment was deemed too conservative. Also, automatic isolation and operation of sump pumps or other dewatering equipment were not credited, which was a conservative approach. No further action required.

LR-N18-0033 LAR S18-02 TABLE A-8 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IFSN-A4 IF-C2b SR Not Met IF-C2b-01 No discussion of required information is provided for the majority of areas. See response for SR IFSN-A2. IFSN-A5 IF-C2c SR Not Met IF-C2c-01 The documentation does not discuss spatial orientation for components in those areas not screened. See response for SR IFSN-A2. IFSN-A6 IF-C3 SR Met: (CC I/II) Component susceptibility to flood-induced failure is considered. N/A IFSN-A7 IF-C3a SR Not Met IF-C3a-01 Appendix D of the PRA Internal Flood Evaluation states that "For spray scenarios, however, walkdown observations revealed that Air-Operated Valves (AOVs) and Motor-Operated Valves (MOVs) were of a robust design that would exclude them from being susceptible to water damage. Hence, these components were not automatically failed (PRA event equal to TRUE) for quantification of the CCDP." This is not an adequate basis for determining the susceptibility of these components to flood-induced failure mechanisms per this SR. The robustness of AOVs and MOVs with regard to spray scenarios was an informed judgment based on empirical observation. Repeated walkdowns have confirmed these observations. This observation is also reinforced by a paper presented at the PSA 2008 ANS conference by J. Lin (Insights from the Updates of Internal Flooding PRAs), which has been added as a reference. Water spray does not generally prevent AOVs and MOVs from operating, and although it may remotely be possible, the most likely result is that it will not. Therefore, the basis for this assumption is deemed adequate and there is no further action required. A sensitivity evaluation assuming that all AOVs and MOVs are conservatively damaged in the risk-significant flood area of interest shows that the changes in risk metrics are very minor and would not impact the decision for this inverter AOT. IFSN-A8 IF-C3b SR Met: (CC I) IF-C3b-01 Identification of propagation paths for each flood area is not present in documentation. See response for SR IFSN-A1 (F&O IF-C1-01), since both F&Os are related to the same issue. IFSN-A9 IF-C3c SR Met However, only for most important sequences. N/A

LR-N18-0033 LAR S18-02 TABLE A-8 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IFSN-A10 IF-C4 SR Not Met IF-C4-01 The defined flooding scenarios were screened without development of flood rate, source, and operator actions. Detailed assessments were only provided for selected high frequency floods. In general, internal flood scenarios that were calculated using a conservative methodology that were found to contribute less than 0.1% to CDF were not subjected to any further scrutiny or refinement, since further refinement was deemed unnecessary for the purposes of the full-power internal events (FPIE) PRA model. It is unlikely that this particular issue involving internal floods with a relatively small contribution to CDF would have a measurable impact on the results for this license amendment request. The PRA model was updated in 2012 (SA112A) following the peer review to include all modeled internal flood scenarios and does not numerically screen any on a numerical basis. No further action required. IFSN-A11 IF-C4a SR Not Met IF-C4a-01, IF-B1a-01 Documentation of multi-unit scenarios could not be identified. Multi-unit scenarios were considered and analyzed, e.g., scenarios involving AB-084B found in Appendix E of the Internal Flood Summary Notebook. The assessment in Section 3.0 of Risk Application SA-MISC-005 (Resolution of Internal Flood Peer Review Comments) did not identify any new potential multi-unit scenarios. No further action required. IFSN-A12 IF-C5 SR N/A No flood areas were screened out. N/A IFSN-A13 IF-C5a SR N/A No flood areas were screened out. N/A IFSN-A14 IF-C6 SR N/A No floods were screened out based on human mitigative actions. N/A IFSN-A15 IF-C7 SR N/A Screening was not performed based on the criteria defined in this requirement. N/A IFSN-A16 IF-C8 SR N/A No flood sources were screened out based on human mitigative actions. N/A

LR-N18-0033 LAR S18-02 TABLE A-8 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IFSN-A17 IF-C9 SR Met IF-A4-01 Walkdowns were performed. However, walkdown sheets with the required information were not available for review. See response for SR IFPP-A5. IFEV-A1 IF-D1 SR Met This requirement has been met by Appendices C & D of the Flood Analysis Notebook. N/A N/A IF-D2 This SR was deleted in RA-Sb-2005. N/A IFEV-A2 IF-D3 SR Not Met IF-C4-01 This is an extension of F&O IF-C4-01. See response for SR IFSN-A10. IFEV-A3 IF-D3a SR N/A There was no grouping or subsuming of flood initiating scenarios with other plant initiating event group. N/A IFEV-A4 IF-D4 SR Not Met IF-C4a-01 There is no evidence that flooding in Unit 2 was considered for its effects on Unit 1. See response for SR IFSN-A11. IFEV-A5 IF-D5 SR Met This requirement is met in Appendix D of the Flooding Notebook. N/A IFEV-A6 IF-D5a SR Met: (CC II/III) This requirement is met in Appendix D of the Flooding Notebook. N/A IFEV-A7 IF-D6 SR Met: (CC I/II) Human-induced floods during maintenance were considered in Section 2.2.9.1.1 of the Internal Flood Evaluation. N/A IFEV-A8 IF-D7 SR N/A Flood scenarios were not screened out using these criteria. N/A IFQU-A1 IF-E1 SR Met The CCDPs for each of the scenarios were calculated by setting all initiating events in the PRA model to zero, with either the turbine trip event with PCS available (%TT) or PCS unavailable (%TP) set to a value of 1.0, depending on the nature of the components failed. N/A N/A IF-E2 Moved to IF-C3c N/A

LR-N18-0033 LAR S18-02 TABLE A-8 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IFQU-A2 IF-E3 SR Met All of the components modeled in the PRA that were assigned to the various scenario IDs based on their location in the plant and their susceptibility to water damage from the various modes of flooding, i.e., spray, general flooding, and major flooding. These components were utilized in flag files to set the appropriate basic events to TRUE, representing failure due to water damage, for the quantification of CCDPs for the analyzed scenarios. N/A IFQU-A3 IF-E3a SR Met: (CC II/III) Areas were screened if the product of the sum of the frequencies of the flood scenarios for the area and the bounding CCDP were less than 1E-9/reactor year. N/A IFQU-A4 IF-E4 SR N/A No additional analysis of SSC data was performed to support quantification of flood scenarios N/A IFQU-A5 IF-E5 SR Met Scenario-specific impacts on PSFs are included. N/A IFQU-A6 IF-E5a SR Met Scenario-specific impacts on PSFs are included. N/A IFQU-A7 IF-E6 SR Met Internal flood sequences are quantified in accordance with the QU SRs. N/A IFQU-A8 IF-E6a SR Met The combined effects of failures caused by flooding and due to causes independent of the flooding are included. N/A IFQU-A9 IF-E6b SR Met Both direct and indirect effects are included in the quantification. N/A IFQU-A10 IF-E7 SR Met Flood sequences are represented appropriately in the LERF analysis. N/A IFQU-A11 IF-E8 SR Not Met IF-A4-01 Walkdown documentation does not capture this information for all flood areas. See response for SR IFPP-A5.

LR-N18-0033 LAR S18-02 TABLE A-8 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION IFPP-B1, IFSO-B1, IFSN-B1, IFEV-B1, IFQU-B1 IF-F1 SR Met The internal flooding analysis documentation can support PRA applications, upgrades, and peer review. N/A IFPP-B2, IFSO-B2, IFSN-B2, IFEV-B2, IFQU-B2 IF-F2 SR Not Met See all IF F&Os Some documentation elements are missing, as noted in the Internal Flood F&Os. The Internal Flood documentation (SA-PRA-012) was revised to include missing information and provide clarification where necessary during the Salem 2012 PRA model update. Since this is a documentation issue, there is no impact on the results for this license amendment request. IFPP-B3, IFSO-B3, IFSN-B3, IFEV-B3, IFQU-B3 IF-F3 SR Not Met IF-F3-01 Assumptions are documented in the Flooding Notebook. Parametric uncertainty analysis was done but systemic uncertainty is not addressed. Sources of modeling uncertainty (systemic) associated with internal flooding is now addressed in the Salem PRA Uncertainty Notebook (SA-PRA-018), which was created during the Salem 2012 PRA model update. No further action required.

LR-N18-0033 LAR S18-02 TABLE A-9 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR CONFIGURATION CONTROL RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION MU-A1 MU-A1 SR Met MU-A1-01 Salem specific site procedures should be developed for Maintenance of site specific PRAs. Develop Salem specific site procedures. The Salem Generating Station has since developed site-specific procedures for maintenance and use of PRA models. They are officially controlled and accessed via DCRMS. No further action is required. MU-A2 MU-A2 SR Met This requirement is met in Section 4.1.2 of procedure ER-AA-600-1015, "FPIE PRA Model Update," Revision 6. N/A MU-B1 MU-B1 SR Met This requirement is met in Sections 4.1.3 and 4.2.2 of procedure ER-AA-600-1015, "FPIE PRA Model Update," Revision 6. Section 4.1.3 addresses how Updating Requirements (URE) puts are processed. Section 4.2.2 addresses review of UREs not dispositional into the next model update. N/A MU-B2 MU-B2 SR Met This requirement is met in Sections 4.1.3, and 4.2.1 of procedure ER-AA-600-1015, "FPIE PRA Model Update," Revision 6. This requirement is met for periodic updates in the project planning phase in Section 4.2.1 of the subject procedure and Section 4.1.3 for unscheduled updates. N/A MU-B3 MU-B3 SR Met Since the other Supporting Requirements are met this SR is met by default. N/A MU-B4 MU-B4 SR Not Met MU-B4-01 There is no reference to the requirement for a PRA peer review for upgrades. Step 4.5.5.3.A of ER-AA-600-1015 addresses this concern regarding PRA upgrades and the possibility for needing a limited peer review against the ASME PRA Standard. MU-C1 MU-C1 SR Not Met MU-C1-01 There is no reference to a review of the cumulative impact of pending changes. Step 4.3.1 of ER-AA-600-1015 addresses this concern regarding cumulative impact of pending PRA model changes. No further action is required. MU-D1 MU-D1 SR Met This requirement is met in Section 4.2.7 of procedure ER-AA-600-1015, "FPIE PRA Model Update," Revision 6. N/A MU-E1 MU-E1 SR Met This requirement is met in Sections 4.1 and 4.2 of procedure ER-AA-600-1014, "Risk Management Configuration Control," Revision 5. N/A MU-F1 MU-F1 SR Met All items are met except for item (f), the review of the cumulative impact of pending changes. See F & O MU-C1-01. N/A

LR-N18-0033 LAR S18-02 TABLE A-10 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR LERF RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os Summary of Assessment Summary of Resolution LE-A1 LE-A1 SR Met Level 2 Analysis notebook, SA-PRA-015, Section 2 addresses those physical characteristics at the time of core damage that can influence LERF. N/A LE-A2 LE-A2 SR Met Level 2 Analysis notebook, SA-PRA-015, Appendix A addresses accident sequence characteristics at the time of core damage that can influence LERF. N/A LE-A3 LE-A3 SR Met Level 2 Analysis notebook, SA-PRA-015, Appendix A addresses those adjustments needed between the Level 1 event trees and the containment event trees. N/A LE-A4 LE-A4 SR Met Level 2 Analysis notebook, SA-PRA-015, Appendix A addresses those adjustments needed between the Level 1 event trees and the containment event trees. N/A LE-A5 LE-A5 SR Met Level 2 Analysis notebook, SA-PRA-015, Appendix A defines the plant damage state groupings in Section 3. N/A LE-B1 LE-B1 SR Met: (CC II) Level 2 Analysis notebook, SA-PRA-015, Sections 1 and 2 discuss unique plant issues and LERF contributors. The issues identified in Table 4.5.9-3 are addressed with the exception of in-vessel recovery which is not credited. N/A

LR-N18-0033 LAR S18-02 TABLE A-10 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR LERF RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os Summary of Assessment Summary of Resolution LE-B2 LE-B2 SR Met: (CC I) LE-B2-01 Analysis does address challenges, but plant-specific analyses are treated in a conservative manner. Category II for LE-B2 says "using applicable generic or plant-specific analyses for significant containment challenges," while conservative analyses can be used for non-significant challenges. Conservative analyses were not used for significant challenges, though they were used for initial categorization. MAAP analyses and plant-specific analyses were used to support the final LERF contributors. Use of plant-specific parameters, such as containment fragility, are documented in the Level 2 Analysis Notebook (SA-PRA-015). Section 2.0 of SA-PRA-015 states that in order to assess the accident progression following a core damage event, the Level 2 analysis used a containment event tree shown in Figure 2-1 of SA-PRA-015 to determine the type of release, if any. Each node in the event tree is based on plant-specific Salem parameters, recent accident progression research, and other Salem-specific analyses. Where applicable, the documentation was updated to emphasize realistic, plant-specific analyses. LE-B3 LE-B3 SR Met: (CC II) MAAP analyses using plant-specific inputs performed, but utilized in a somewhat conservative manner. N/A

LR-N18-0033 LAR S18-02 TABLE A-10 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR LERF RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os Summary of Assessment Summary of Resolution LE-C1 LE-C1 SR Met: (CC I) LE-C1-01 Analysis of non-LERF or analysis of factors contributing to non-LERF was not addressed. A discussion of LERF and its definition were added to the Level 2 Notebook (SA-PRA-015) in order to explain how LERF and non-LERF designations were developed and assigned. Specifically, Section 5.0 of this notebook defines the major release categories that were evaluated: INTACT - Containment structure and function succeed and prevent a large or late release of fission products. LATE - Containment failure occurs, but is considered late because of a significant time delay between core damage and containment failure. LERF - Containment failure occurs early in the scenario. Early releases are defined as those releases that occur within a short time following core damage, such that adequate evacuation time is not available to protect the public from prompt health effects. SERF - Containment is bypassed, such as due to an initiating steam generator tube rupture, but successful filling of the steam generator scrubs the release to reduce it to a small magnitude.

LR-N18-0033 LAR S18-02 TABLE A-10 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR LERF RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os Summary of Assessment Summary of Resolution LE-C2 LE-C2a SR Met: (CC I) LE-C2a-01 Screening values appear to have been used for containment isolation actions. No operator actions are directly called out in the containment event tree. Of the human error probabilities (HEPs) that were associated with containment isolation actions, only SJS-XHE-FO-MANAC (Operator fails to open or close valves per EOPs) was found to exceed the criteria for risk significance, and the failure probability was evaluated in detail (not a screening value) in the SA115A PRA model. There were only two HEPs that were found to be risk-significant in the SA115A model, i.e., time-critical operator actions. They were AFS-XHE-FO-REC1 (Operator failure to close AFW discharge valves locally) and ISL-XHE-VD1 (Operator fails to isolate RHR to avoid ISLOCA). These HEPs are both documented in Appendix F of the HRA Notebook (SA-PRA-004) and will require a detailed evaluation as part of a future scheduled PRA update. LE-C3 LE-C2b SR Met: (CC I) LE-C2b-01 Repair of failed equipment is not addressed in the Level 2 Analysis notebook, SA-PRA-015. The Quantification Notebook (SA-PRA-014) discussed some of the dominant initiators that lead to LERF in Appendix H where pre-emptive actions could be taken to reduce the impact to LERF, e.g., installation of door sweeps to reduce the flow of water into the 230/460 VAC switchgear rooms due to internal floods, but no repair of failed equipment was directly credited or modeled in the SA115A model for mitigation of LERF sequences.

LR-N18-0033 LAR S18-02 TABLE A-10 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR LERF RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os Summary of Assessment Summary of Resolution LE-C4 LE-C3 SR Met: (CC I) LE-C3-01 Fission product scrubbing and mitigating actions by plant staff are not addressed. Since the time of the peer review, potential scrubbing of SGTR releases was added to the PRA model. In addition, text was added to the Level 2 Analysis Notebook (SA-PRA-015) to describe mitigating actions and beneficial failures that are modeled. Even without operator action, some scrubbing does occur in the thermal-hydraulic modeling of SGTRs, if applicable, such as in release category LERF-SGTR-AFW, which represents sequences caused by a steam generator tube rupture that have successful operation of auxiliary feedwater. LE-C5 LE-C4 SR Met: (CC II) Realistic generic success criteria appear to have been used. N/A LE-C6 LE-C5 SR Met N/A LE-C7 LE-C6 SR Met N/A LE-C8 LE-C7 SR Met One top model. N/A LE-C9 LE-C8a SR Not Met LE-C8a-01 No discussion provided in the documentation related to environment. Since there was no credit given in the SA115A PRA model for equipment survivability or human actions under adverse environments, there was no need to justify any type of credit. LE-C10 LE-C8b SR Met: (CC I) LE-C8a-01 No analysis provided. N/A LE-C11 LE-C9a SR Met: (CC I) LE-C8a-01 No credit taken. N/A

LR-N18-0033 LAR S18-02 TABLE A-10 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR LERF RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os Summary of Assessment Summary of Resolution LE-C12 LE-C9b SR Met: (CC I) LE-C8a-01 N/A LE-C13 LE-C10 SR Met: (CC I) LE-C3-01 Section 2 notes that credit is not taken for scrubbing of SGTR damage scenarios. N/A LE-D1 LE-D1a SR Met: (CC I) LE-D1a-01 Early containment loads are addressed using NUREG information. The Cat II SR requires "a realistic containment capacity analysis for the significant containment challenges" and "a conservative or a combination of conservative and realistic evaluation of containment capacity for nonsignificant containment challenges." In the Salem Level 2 analysis, early containment failure is not a significant contributor, therefore conservative or a combination of realistic and conservative evaluations are acceptable. The early containment failure probabilities from the NUREGs are based on plant-specific analysis or generic analysis that is adjusted to be applicable to Salem. Also, a Salem-specific containment structural evaluation and failure characterization that had been performed for a previous revision of the PRA was used in the SA115A Level 2 analysis due still being applicable. Therefore, no further work is necessary to comply with Category II of LE-D1. LE-D2 LE-D1b SR Not Met LE-D1b-01 No analysis for penetrations, hatches, seals Section 2.2 of the Success Criteria Notebook (SA-PRA-003) now references the evaluation of penetrations, hatches and seals for containment. LE-D3 LE-D2 SR Not Applicable N/A

LR-N18-0033 LAR S18-02 TABLE A-10 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR LERF RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os Summary of Assessment Summary of Resolution LE-D4 LE-D3 SR Met: (CC II) N/A LE-D5 LE-D4 SR Met: (CC II) N/A LE-D6 LE-D5 SR Met: (CC II) N/A LE-D7 LE-D6 SR Not Met LE-D6-01 The CI model (SA-PRA-005.07) does not provide sufficient information and does not address potential failures due to air locks or other locations. The Containment Isolation System Notebook (SA-PRA-005.0007) now provides a set of criteria to determine whether containment penetrations should be modeled for their safety significance in the PRA, such as size of line, number of valve isolations, etc. The Success Criteria Notebook (SA-PRA-003) in Section 2.2 states that containment penetrations, hatches and seals were also evaluated and found to have a higher pressure capacity than the meridional membrane capacity of the dome that proved to be the limiting failure location. The basis for this statement may be found in PSEG document S-C.ZZ-NEE-0686 (Probabilistic Engineering Evaluation of Salem Units 1 and 2 Containment Performance for Beyond Design Basis Conditions). LE-E1 LE-E1 SR Met Appropriate SSC and HFE values are utilized. N/A LE-E2 LE-E2 SR Met: (CC I) LE-D1a-01 The LERF analysis makes heavy use of the NUREG documents. See the F&O response for the 2009 SR LE-D1, since both F&Os are related to the same issue.

LR-N18-0033 LAR S18-02 TABLE A-10 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR LERF RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os Summary of Assessment Summary of Resolution LE-E3 LE-E3 SR Met: (CC I) LE-D1a-01 Early containment failures, bypass sequences, and isolation failures are designated as LERF contributors. The Level 2 Analysis Notebook (SA-PRA-015) explains in detail those accident sequences that satisfy the definition for LERF, and are listed in Table 7-1, which defines the type of accident sequence and initiating event that is involved. To satisfy this F&O, more detail was given in this section of SA-PRA-015 that better explains what accident progression sequences can lead to LERF. LE-E4 LE-E4 SR Met QU-B3-01 LERF is quantified consistent with the applicable requirements. A minor issue related to truncation limit is identified in QU-B3-01. N/A LE-F1 LE-F1a SR Met: (CC II/III) Table 8-2 of the Salem PRA Level 2 Analysis Notebook shows the calculated results for the detailed release categories. N/A LE-F2 LE-F1b SR Not Met LE-F1b-01 Other than verifying that the sum of the three end states (INTACT, LATE and LERF) is approximately equal to the core damage frequency, no checks on the reasonableness of the LERF contributors is documented. A summary of the Level 2 results is provided in Appendix H of the Quantification Notebook (SA-PRA-014). The comparison to the value for CDF was discussed, in which it was noted that the direct sum of the four major Level 2 endstates (INTACT, LERF, SERF, and LATE), which was 9.5E-06/yr, is a little more than the calculation of CDF at 8.4E-6/yr for the SA115A PRA model. This is due to summation of low probability sequences below the truncation threshold used for the quantification of CDF and the inclusion of non-minimal Level 1 sequences in the summation of the Level 2 release categories. N/A LE-F2 SR Met: (CC I) SC-C3-02 Bounding assumptions are identified in the documentation. Sources of uncertainty are addressed in a draft evaluation using guidance from draft EPRI report, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments." No documentation of sensitivity studies was found. See the F&O response for the 2009 SR LE-G4, since both F&Os are related to the same issue.

LR-N18-0033 LAR S18-02 TABLE A-10 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR LERF RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os Summary of Assessment Summary of Resolution LE-F3 LE-F3 SR Not Met LE-F3-01 LERF uncertainties are not characterized consistent with the requirements in Tables 4.5.8-2(d) and 4.5.8-2(e). The uncertainty associated with LERF was addressed in the Salem PRA Uncertainty Notebook (SA-PRA-018), with the results being presented in Section 5.1.2.1. LE-G1 LE-G1 SR Met The LERF analysis documentation appears to be adequate for supporting PRA applications, upgrades, and peer review. N/A LE-G2 LE-G2 SR Met The LERF notebook documents the process used to arrive at the LERF estimates. N/A LE-G3 LE-G3 SR Met: (CC II/III) Table 8-2 of the Salem PRA Level 2 Analysis Notebook shows the calculated results for the detailed release categories. N/A LE-G4 LE-G4 SR Not Met SC-C3-01, SC-C3-02 Assumptions are embedded in the documentation rather than captured in a specific section. Sources of uncertainty are addressed in a draft evaluation using guidance from draft EPRI report, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments." No documentation of sensitivity studies was found. This issue has no impact on the quality of the PRA and is only meant to aid reviewers in identifying what assumptions were made during development of the Success Criteria Notebook (SA-PRA-003). Each PRA System Notebook (SA-PRA-005.####) now has a section that lists assumptions that were made as part of the systems analysis. Also, the Uncertainty Notebook (SA-PRA-018) was officially issued and includes a section on model uncertainty and references both EPRI 1026511, which addresses the use of PRA and the treatment of uncertainty, and EPRI 1016737, which addresses the treatment of parameter and model uncertainty.

LR-N18-0033 LAR S18-02 TABLE A-10 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR LERF RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os Summary of Assessment Summary of Resolution LE-G5 LE-G5 SR Not Met LE-G5-01 Limitations in the LERF analysis that would impact applications are not documented. Appendix A of the Uncertainty Notebook (SA-PRA-018) discusses model uncertainty issues and plant-specific issue characterizations that can be extended to identification of impacts on various risk applications. For example, the treatment of core melt arrest in-vessel has been limited. However, recent NRC work has indicated that there may be more potential than previously credited. For this particular issue, Salem has taken the approach that no credit will be given for recovery of core cooling following core damage and prior to reactor vessel failures. In other words, all core damage sequences proceed to vessel failure. Although this issue could provide an impact to certain applications related to Level 2 release categories, this particular LAR dealing with extending the Technical Specification AOT for unavailability is relatively unimportant with regard to LERF.

LR-N18-0033 LAR S18-02 TABLE A-10 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR LERF RA-Sa-2009 SR # RA-Sb-2005 SR # Capability Category Associated F&Os Summary of Assessment Summary of Resolution LE-G6 LE-G6 SR Not Met LE-G6-01 A definition for significant accident progression sequence is not documented. A significant accident progression sequence is one of the set of accident sequences contributing to large early release frequency resulting from the analysis of a specific hazard group that, when rank-ordered by decreasing frequency, sum to a specified percentage of the large early release frequency, or that individually contribute more than a specified percentage of large early release frequency for that hazard group. Specifically, the summed percentage is 95% and the individual percentage is 1% of the applicable hazard group. The dominant accident sequences that contribute to LERF are listed and described in Section D of the Quantification Notebook (SA-PRA-014), and the relative contribution to LERF for each of the modeled initiating events is listed in Appendix F of SA-PRA-014. Since this is a documentation issue, it has no impact on the results for this LAR.

LR-N18-0033 LAR S18-02 TABLE A-11 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF REVISED SUPPORTING REQUIREMENTS RA-Sa-2009 SR # RA-Sb-2005 SR # DESCRIPTION OF CHANGE COMMENTS DA-C14 DA-C13 Coincident unavailability due to maintenance for redundant equipment is now being based on the activity being the result of a planned, repetitive activity that is based on plant experience. This implies that maintenance terms used in the PRA model that represent multiple SSCs being unavailable should not be used unless the activity is a routine planned evolution. The SA112A PRA Model of Record (MOR) makes use of dual Service Water pump maintenance terms based on previous maintenance activities, which may not have been considered as being routine or repetitive evolutions. As such, the more recent version of this Supporting Requirement implies that these maintenance terms can be removed from the PRA model if the maintenance activity is not considered a planned and repetitive activity. The net effect is that this may result in a slight decrease in CDF and LERF if the SW pump dual maintenance terms are removed from the PRA model. An Updating Requirement Evaluation (URE) record has been recorded (SA2016-005) to capture this as part of the maintenance and update of the Salem PRA model. QU-B5 QU-B5 The newer version of the Supporting Requirement (SR) states that when resolving circular logic to NOT introduce any unnecessary conservatisms or non-conservatisms, whereas the previous version of the Standard used the work AVOID. This has no impact on the Salem PRA MOR as the resolution of circular logic was more clearly documented during the 2012 PRA model update in the PRA System Notebook for vital AC power (SA-PRA-005.0020). A review of this document in Section 6.8 provides evidence that unnecessary conservatisms or non-conservatisms were NOT introduced as a result of resolving circular logic issues. QU-E4 QU-E4 The newer version of this Supporting Requirement redefines the treatment of model uncertainty and related assumptions with the intent of IDENTIFYING how the PRA model is affected, whereas the older version was focused more on an EVALUATION of sensitivity studies as it related to model uncertainty and assumptions. During the 2012 PRA model update, the Uncertainty Notebook (SA-PRA-018) was officially issued and includes a comprehensive treatment on model uncertainty and assumptions for both CDF and LERF, using references that include EPRI 1026511, which addresses the use of PRA and the treatment of uncertainty, and EPRI 1016737, which addresses the treatment of parameter and model uncertainty. As such, the PRA model documentation is in compliance with the 2009 version of the ASME PRA Standard with regard to this Supporting Requirement. QU-F4 QU-F4 The newer version of this SR redefines the treatment of model uncertainty and related assumptions by referring to QU-E4, whereas the earlier requirement referenced an example listing of "key assumptions" and "key sources of uncertainty," such as success criteria, reliability data, modeling uncertainties, completeness of initiating events, spatical dependencies, etc. See response for SR QU-E4. LE-F3 LE-F3 The change for this SR involves the same change involving the treatment of uncertainty and assumptions as for CDF, except that the focus is on LERF. See response for SR QU-E4.

LR-N18-0033 LAR S18-02 TABLE A-12 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF REGULATORY POSITION CHANGES FROM REG GUIDE 1.200 REV 1 TO REV 2 (APPENDIX A) RA-Sa-2009 SR # (RG 1.200 Rev 2) RA-Sb-2005 SR # (RG 1.200 Rev 1) DESCRIPTION OF RG 1.200, REV. 2, REGULATORY POSITION (CAT II) COMMENTS IE-A5 IE-A4 The search for initiators should go down to the subsystem/train level. Capability Category III should consider the use of other systematic processes. Cat I and II: PERFORM a systematic evaluation of each system and where necessary down to the subsystem or train level, including support systems. No change from RG 1.200 Rev 1 to Rev 2. IE-A6 IE-A4a Initiating events from common cause or from both routine and non-routine system alignments should be considered. Cat II: resulting from multiple failures, if the equipment failures result from a common cause, and or from routine system alignments resulting from preventive and corrective maintenance. Change from and to or in RG 1.200 Rev 2 does not change underlying purpose already addressed by Rev 1. IE-C12 IE-C10 Providing a list of generic data sources would be consistent with other SRs related to data. COMPARE results and EXPLAIN differences in the initiating event analysis with generic data sources to provide a reasonable check of the results. An example of an acceptable generic data sources is NUREG/CR-6928 [Note (1)]. Change to a different NUREG as an example does not change the evaluation already addressed by Rev 1.

LR-N18-0033 LAR S18-02 TABLE A-12 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF REGULATORY POSITION CHANGES FROM REG GUIDE 1.200 REV 1 TO REV 2 (APPENDIX A) RA-Sa-2009 SR # (RG 1.200 Rev 2) RA-Sb-2005 SR # (RG 1.200 Rev 1) DESCRIPTION OF RG 1.200, REV. 2, REGULATORY POSITION (CAT II) COMMENTS Footnote (1)(a) to Table 2-2.1-4(c) Footnote 3 to Table 4.5.1-2(c) The first example makes an assumption that the hourly failure rate is applicable for all operating conditions.

Thus, fbus at power = 1x10-7/hr

• 8760 hrs/yr
• 0.90 = 7.9x10-4/reactor year.

In the above example, it is assumed the bus failure rate is applicable for at-power conditions. It should be noted that initiating event frequencies may be variable from one operating state to another due to various factors. In such cases, the contribution from events occurring only during at-power conditions should be utilized. No change from RG 1.200 Rev 1 to Rev 2. 2-2.2.1 4.5.2.1 The HLR and associated SRs are written for CDF and not LERF; therefore, references to LERF are not appropriate. 2-2.2.1 Objectives. The objectives reflected in the assessment of CDF and LERF is such a way that. No change from RG 1.200 Rev 1 to Rev 2. AS-A9 AS-A9 The code requirements for acceptability need to be stated. Cat II and III: affect the operability of the mitigating systems. (See SC-B4.) No change from RG 1.200 Rev 1 to Rev 2. 2-2.3.1 4.5.3.1 The HLR and associated SRs are written for CDF and not LERF; therefore, references to LERF are not appropriate. (a) overall success criteria are defined (i.e., core damage and large early release) No change from RG 1.200 Rev 1 to Rev 2.

LR-N18-0033 LAR S18-02 TABLE A-12 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF REGULATORY POSITION CHANGES FROM REG GUIDE 1.200 REV 1 TO REV 2 (APPENDIX A) RA-Sa-2009 SR # (RG 1.200 Rev 2) RA-Sb-2005 SR # (RG 1.200 Rev 1) DESCRIPTION OF RG 1.200, REV. 2, REGULATORY POSITION (CAT II) COMMENTS SY-A24 SY-A22 There are no commonly used analysis methods for recovery in the sense of repair, other than use of actuarial data. is justified through an adequate analysis or examination of data collected in accordance with DA-C15 and estimated in accordance with DA-D9. (See DA-C15.) No change from RG 1.200 Rev 1 to Rev 2 (other than changing the numbering to DA-C15 and D9 from DA-C14 and D8 SY-B14 SY-B15 Containment vent and failure can cause more than NPSH problems (e.g., harsh environments). Examples of degraded environments include: (h) harsh environments induced by containment venting, failure of the containment venting ducts, or failure of the containment boundary that may occur prior to the onset of core damage Added detail about failure of the containment venting ducts, or failure of the containment boundary to the example does not significantly change the Salem response. See resolution in Table 3-4: All PRA System notebooks were revised to add generic assumptions on components not performing beyond their design operating conditions unless otherwise specified. HR-D3 HR-D3 Add examples for what is meant by quality in items (a) and (b) of Cat II, III. Cat II, III: (a) the quality (e.g., format, logical structure, ease of use, clarity, and comprehensiveness) of written procedures (for performing tasks) and the type of administrative controls that support independent review (e.g., configuration control process, technical review process, training processes, and management emphasis on adherence to procedures). of administrative controls (for independent review) (b) the quality of the human-machine interface (e.g., adherence to human factors guidelines [Note (3)] and results of any quantitative evaluations of performance per functional requirements), including both the equipment configuration, and instrumentation and control layout (3) NUREG-0700, Rev. 2, Human-System Interface Design Review Guidelines; J.M. OHara, W.S. Brown, P.M. Lewis, and J.J. Persensky, May 2002. This change from Rev 1 to Rev 2 is only meant to properly document the reference to Note 3. There is no impact on the conformance of the SA115A PRA model to RG 1.200, Rev. 2.

LR-N18-0033 LAR S18-02 TABLE A-12 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF REGULATORY POSITION CHANGES FROM REG GUIDE 1.200 REV 1 TO REV 2 (APPENDIX A) RA-Sa-2009 SR # (RG 1.200 Rev 2) RA-Sb-2005 SR # (RG 1.200 Rev 1) DESCRIPTION OF RG 1.200, REV. 2, REGULATORY POSITION (CAT II) COMMENTS HR-D6 HR-D6 This SR should be written similarly to HR-G9 PROVIDE an assessment of the uncertainty in the. point estimates of HEPs. CHARACTERIZE the uncertainty in the estimates of the HEPs consistent with the quantification approach, and PROVIDE mean values for use in the quantification of the PRA results. New clarification. The SA115A PRA model does report HEP values based on their mean point estimates as provided by the HRA Calculator software. As such, there is no impact on the conformance of the SA115A PRA model to RG 1.200, Rev. 2. HR-G3 HR-G3 In item (d) of CC II, III, clarify that clarity refers the meaning of the cues, etc. In item (a) of CC I and item (g) of CC II, III, clarify that complexity refers to both determining the need for and executing the required response. Cat II, and III: (d) degree of clarity of the cues/indications in supporting the detection, diagnosis, and decision-making give the plant-specific and scenario-specific context of the event. (g) complexity of detection, diagnosis and decision-making, and executing the required response. Rev 2 separates Cat I from Cat II/III, and adds more detail to item (d) for Cat II. This added detail already exists in item (g) of Rev 1. The use of the HRA Calculator supports this level of detail in the Salem HRA, as was documented in the review against Rev 1, so there is no impact on the conformance of the SA115A PRA model to Rev 2. HR-G4 HR-G4 Requirements concerning the use of thermal/hydraulic codes should be cross-referenced. Cat I, II, and III: BASE. (See SC-B4.) SPECIFY the point in time. No change from RG 1.200 Rev 1 to Rev 2. HR-G8 HR-G9 Action verb should be capitalized CHARACTERIZE Characterize the uncertainty.. This is a typographical correction only.

LR-N18-0033 LAR S18-02 TABLE A-12 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF REGULATORY POSITION CHANGES FROM REG GUIDE 1.200 REV 1 TO REV 2 (APPENDIX A) RA-Sa-2009 SR # (RG 1.200 Rev 2) RA-Sb-2005 SR # (RG 1.200 Rev 1) DESCRIPTION OF RG 1.200, REV. 2, REGULATORY POSITION (CAT II) COMMENTS DA-C15 DA-C14 This SR provides a justification for crediting equipment repair (SYA24). As written, it could be interpreted as allowing plant-specific data to be discounted in favor of industry data. In reality, for such components as pumps, plant-specific data is likely to be insufficient and a broader base is necessary. IDENTIFY instances of plant-specific experience or and, when that is insufficient to estimate failure to repair consistent with DA-D9, applicable industry experience and for each repair, COLLECT. This Supporting Requirement (SR) is not applicable for the Salem PRA model since no credit is being taken for repair of equipment following initial failure. DA-D1 DA-D1 Other approved statistical processes for combining plant-specific and generic data are not available. CC II and III: USE a Bayes update process or equivalent statistical process that assigns that assigns appropriate weight to the statistical significance of the generic and plant specific evidence and provides an appropriate characterization of the uncertainty. CHOOSE. No change from RG 1.200 Rev 1 to Rev 2. DA-D9 N/A New requirement needed, DA-C15 was incomplete, only provided for data collection, not quantification of repair. (See SY-A24.) Cat I, II, and III: For each SSC for which repair is to be modeled, ESTIMATE, based on the data collected in DA-C15, the probability of failure to repair the SSC in time to prevent core damage as a function of the accident sequence in which the SSC failure appears. See response for SR DA-C15.

LR-N18-0033 LAR S18-02 TABLE A-12 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF REGULATORY POSITION CHANGES FROM REG GUIDE 1.200 REV 1 TO REV 2 (APPENDIX A) RA-Sa-2009 SR # (RG 1.200 Rev 2) RA-Sb-2005 SR # (RG 1.200 Rev 1) DESCRIPTION OF RG 1.200, REV. 2, REGULATORY POSITION (CAT II) COMMENTS 2-2.7.1 4.5.8.1 SRs for LERF quantification reference the SRs in 2-2.8, and therefore, need to be acknowledged in 2-2.8. The objectives of the quantification element are to provide an estimate of CDF (and support the quantification of LERF) based upon the plant-specific (b) significant contributors to CDF (and LERF) are identified such as initiating events No change from RG 1.200 Rev 1 to Rev 2. Table 2-2.7-1 HLR-QU-D Table 4.5.8-1 HLR-QU-D SRs for LERF quantification reference the SRs in 2-2.8 and, therefore, need to be acknowledged in 2-2.8. significant contributors to CDF (and LERF), such as initiating events, accident sequences No change from RG 1.200 Rev 1 to Rev 2. QU-A2 QU-A2a Need to acknowledge LERF quantification consistent with the estimation of total CDF (and LERF) to identify significant accident The addition of LERF is covered by the assessment of the LE supporting requirements. QU-A3 QU-A2b The state-of-knowledge correlation should be accounted for all event probabilities. Left to the analyst to determine the extent of the events to be correlated. Need to also acknowledge LERF quantification Cat II: ESTIMATE the mean CDF (and LERF), accounting for the state-of-knowledge correlation between event probabilities when significant (see NOTE 1). The addition of LERF is covered by the assessment of the LE supporting requirements. The when significant deletion was unchanged from Rev 1 to Rev 2.

LR-N18-0033 LAR S18-02 TABLE A-12 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF REGULATORY POSITION CHANGES FROM REG GUIDE 1.200 REV 1 TO REV 2 (APPENDIX A) RA-Sa-2009 SR # (RG 1.200 Rev 2) RA-Sb-2005 SR # (RG 1.200 Rev 1) DESCRIPTION OF RG 1.200, REV. 2, REGULATORY POSITION (CAT II) COMMENTS QU-B6 QU-B6 Need to acknowledge LERF quantification ACCOUNT for realistic estimation of CDF or LERF. This accounting The addition of LERF is covered by the assessment of the LE supporting requirements. Table 2-2.7-5(d) Table 4.5.8-2(d) HLR-QU-D and Table 2-2.7-2(d) objective statement just before table need to agree; SRs for LERF quantification reference the SRs in 2-2.7 and, therefore, need to be acknowledged in 2-2.7. significant contributors to CDF (and LERF), such as initiating events, accident sequences No change from RG 1.200 Rev 1 to Rev 2. QU-E3 QU-E3 Need to acknowledge LERF quantification Cat I and II: ESTIMATE the uncertainty interval of the CDF (and LERF) results. The addition of LERF is covered by the assessment of the LE supporting requirements. QU-E4 QU-E4 The note has no relevance to the base model and could cause confusion; it should be deleted. For each source of model uncertainty introduction of a new initiating event) [Note (1)]. NOTE: For specific applications, And in logical combinations. Deletion of the note does not change the conformance of the SA115A PRA model to Rev 2. QU-F2 QU-F2 SR needs to use defined term significant instead of dominant. In addition, there is no requirement to perform sensitivity studies, and therefore, requirement is not needed for documentation. (g) equipment or human actions that are the key factors in causing the accidents sequences to be non-dominant nonsignificant. (h) the results of all sensitivity studies Changes to (g) are the same in Rev 1 and Rev 2. Deletion of (h) does not change the conformance of the SA115A PRA model to Rev 2.

LR-N18-0033 LAR S18-02 TABLE A-12 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF REGULATORY POSITION CHANGES FROM REG GUIDE 1.200 REV 1 TO REV 2 (APPENDIX A) RA-Sa-2009 SR # (RG 1.200 Rev 2) RA-Sb-2005 SR # (RG 1.200 Rev 1) DESCRIPTION OF RG 1.200, REV. 2, REGULATORY POSITION (CAT II) COMMENTS LE-G2 LE-G2 There is no requirement to perform sensitivity studies. (h) the model integration quantification including uncertainty and sensitivity analyses, as appropriate for the level of analysis Deletion of the requirement for sensitivity studies does not change the conformance of the SA115A PRA model to Rev 2. IFSO-A1 IF-B1 The list of fluid systems should be expanded to include fire protection systems. For each flood area... INCLUDE: (a) equipment (e.g., piping, valves, pumps) located in the area that are connected to fluid systems (e.g., circulating water system, service water system, and reactor coolant system, and fire protection system) No change from RG 1.200 Rev 1 to Rev 2. IFSO-A5 IF-B3 It is necessary to consider a range of flow rates for identified flooding sources, each having a unique frequency of occurrence. For example, small leaks that only cause spray are more likely than large leaks that may cause equipment submergence. (b) range of flow rates No change from RG 1.200 Rev 1 to Rev 2.

LR-N18-0033 LAR S18-02 TABLE A-12 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF REGULATORY POSITION CHANGES FROM REG GUIDE 1.200 REV 1 TO REV 2 (APPENDIX A) RA-Sa-2009 SR # (RG 1.200 Rev 2) RA-Sb-2005 SR # (RG 1.200 Rev 1) DESCRIPTION OF RG 1.200, REV. 2, REGULATORY POSITION (CAT II) COMMENTS IFSN-A6 IF-C3 For Cat II, it is not acceptable to just note that a flood-induced failure mechanism is not included in the scope of the internal flooding analysis. Some level of assessment is required. Cat II: For the SSCs identified in IFSN-A5, IDENTIFY the susceptibility of each SSC in a flood area to flood-induced failure mechanisms. INCLUDE failure by submergence and spray in the identification process. ASSESS qualitatively the impact of flood-induced mechanisms that are not formally addressed (e.g., using the mechanisms listed under Capability Category III of this requirement), by using conservative assumptions. Component susceptibility to flood damage due to either submergence or spray effects was identified for various types of SSCs in section 2.2.5 of the Internal Flood PRA Notebook (SA-PRA-012). Damage to SSCs due to jet impingement, pipe whip, elevated temperature, humidity, and excessive condensation are attributed to High Energy Line Break type of scenarios which are modeled using feedwater and steam line break initiating events that are already a part of the full power internal events (FPIE) PRA model. Also, these high energy line break (HELB) scenarios are covered under the Design and Licensing process where Equipment Qualification of safety related SSCs is required as part of the Design and Licensing basis. In addition, most high energy system piping is located in an outside environment at Salem since the Salem turbine deck is open to the atmosphere. Within the Auxiliary Building, high energy steam piping that supplies the motive force for the turbine-driven Auxiliary Feedwater (AFW) pump is contained within an enclosure designed for HELB scenarios. The water systems associated with internal flood hazards are typically below 200 deg. F and less than 275 psig, which are incapable of producing the flood-induced mechanisms associated with HELB scenarios. As such, the damage mechanisms associated with HELB scenarios (i.e., mechanisms listed under Capability Category III) are not applicable to the modeled internal flood scenarios in the Salem FPIE PRA model. IFQU-A8 IF-E6a The quantification also needs to include the effect of common-cause failure. INCLUDE, in the quantification, the combined effects of including equipment failures, unavailability due to maintenance, common-cause failures and other credible causes. Addition of common-cause failures was unchanged from Rev 1 to Rev 2.

LR-N18-0033 LAR S18-02 TABLE A-12 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF REGULATORY POSITION CHANGES FROM REG GUIDE 1.200 REV 1 TO REV 2 (APPENDIX A) RA-Sa-2009 SR # (RG 1.200 Rev 2) RA-Sb-2005 SR # (RG 1.200 Rev 1) DESCRIPTION OF RG 1.200, REV. 2, REGULATORY POSITION (CAT II) COMMENTS References (from both Table A-2 and A-3) Start of Table A-1 See global comment on references at start of Table A-1. Use of references: the various references, may be acceptable, in general; however, the staff has not reviewed the references, and there may be aspects that are not applicable or not acceptable. For every reference cited in the standard (except NEI 00-02): No staff position is provided on this reference. The staff neither approves nor disapproves of information contained in the referenced document. No change from RG 1.200 Rev 1 to Rev 2.

LR-N18-0033 LAR S18-02 Simplified Drawing of Typical Inverter

LR-N18-0033 Simplified Drawing of Typical Inverter 230Y,3til RECTIFIER 200A A IINVJA5YB AC/OC POWER SUPPLY FOR NO. lA VITAL INSTRUMENT INVERTER 200A lBKRlAqYC AUCTlONEER..._ __ _. CIRCUIT OAMAL: 120YAC SUPPLY 200A -400A STATIC REGULATOR l2KVA 12KVA 240ttJqv ) II' ALTERNATE 120VPC SUPPLY lHVERTER OUTPUT N <t 2- ':£! LAR S18-02}}