ML19217A208

Proposed License Amendment Request to Revise Integrated Leak Rate Test (Type a) and Type C Test Intervals

ML19217A208
Person / Time
Site:	Millstone
Issue date:	07/30/2019
From:	Mark D. Sartain Dominion Energy Nuclear Connecticut
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
19-211
Download: ML19217A208 (159)

Text

Dominion Energy Nuclear Connecticut, Inc.

5000 Dominion Boulevard. Glen Allen, VA 23060 Dominion Energy.com July 30, 2019 a.

~

Dominion Energy U. S. Nuclear Regulatory Commission Serial No.19-211 Attention: Document Control Desk NSSL/MLC RO Washington, DC 20555 Docket No. 50-423 License No. NPF-49 DOMINION ENERGY NUCLEAR CONNECTICUT, INC.

MILLSTONE POWER STATION UNIT 3 PROPOSED LICENSE AMENDMENT REQUEST TO REVISE INTEGRATED LEAK RATE TEST (TYPE A) AND TYPE C TEST INTERVALS Pursuant to 10 CFR 50.90, Dominion Energy Nuclear Connecticut, Inc. (DENC) requests a license amendment in the form of changes to the Millstone Power Station Unit 3 (MPS3) Technical Specifications (TSs) for facility Operating License NPF-49. The proposed amendment revises MPS3 TS 6.8.4.f, "Containment Leakage Rate Testing Program," by replacing the reference to Regulatory Guide (RG) 1.163 (September 1995) with a reference to Nuclear Energy* institute (NEI) topical report NEI 94-01, Revision 3-A and the limitations and conditions specified in NEI 94-01, Revision 2-A, as the implementing documents used to develop the MPS3 performance-based leakage testing program in accordance with 10 CFR 50, Appendix J, Option B. This amendment would allow DENC to extend the Type A primary containment integrated leak rate test interval (ILRT) for MPS3 from 10 years to 15 years and the Type C local leak rate test interval from 60 months to 75 months, and incorporates the regulatory positions stated in RG 1.163. provides a discussion of the proposed change, including a summary of the supporting probabilistic risk assessment (PRA). A markup of the proposed change is provided in Attachment 2. Discussion of the supporting risk assessment and documentation of the technical adequacy of the PRA model are provided in and its Enclosure.

DENC has evaluated the proposed amendment and has determined that it does not involve a significant hazards consideration as defined in 10 CFR 50.92. The basis for that determination is included in Attachment 1. DENC has also determined that operation with the proposed change will not result in any significant increase in the amount of effluents that may be released offsite or any significant increase in individual or cumulative occupational radiation exposure. Therefore, the proposed amendment is eligible for categorical exclusion from an environmental assessment as set forth in 10 CFR 51.22(c)(9). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment is needed in connection with approval of the proposed change. The proposed TS change has been reviewed and approved by the Facility Safety Review Committee.

Serial No: 19-211 Docket No. 50-423 Page 2 of 3 The next ILRT for MPS3 is currently due no later than November 8, 2021. Based on the current outage schedule, the current ten-year frequency would require the next MPS3 ILRT to be performed during the fall 2020 refueling outage. Therefore, DENG requests approval of the proposed amendment by August 3, 2020 with 60 days to implement.

In accordance with 10 CFR 50.91 (b), a copy of this license amendment request is being provided to the State of Connecticut.

Should you have any questions in regard to this submittal, please contact Mr.

Shayan Sinha at (804) 273-4687.

Sincerely, Mark D. Sartain Vice President - Nuclear Engineering and Fleet Support Dominion Energy Nuclear Connecticut, Inc.

COMMONWEAL TH OF VIRGINIA COUNTY OF HENRICO The foregoing document was acknowledged before me, in and for the County and Commonwealth aforesaid, today by Mark D. Sartain, who is Vice President - Nuclear Engineering and Fleet Support of Dominion Energy Nuclear Connecticut. Inc. He has affirmed before me that he is duly authorized to execute and file the foregoing document in behalf of that company, and that the statements in the document are true to the best of his knowledge and belief.

Acknowledged before me this 30'th day of --i ..)u :S ,2019.

My Commission Expires: Q\.lj\AA -t B \J 'l..O 19 .___,,.tC.:::.~~~~A!.~~~i'--"'-_,......

Attachments:

1. Discussion of Proposed Change

2. Marked-up Technical Specification Page

3. Confirmatory Risk Impact Assessment for Permanent ILRT Extension to 1 per 15 Years

- Enclosure A: Probabilistic Risk Assessment Acceptability Commitments made in this letter: None

Serial No: 19-211 Docket No. 50-423 Page 3 of 3 cc: U.S. Nuclear Regulatory Commission Region I 2100 Renaissance Blvd, Suite 100 King of Prussia, PA 19406-2713 R. V. Guzman Senior Project Manager - Millstone Power Station U.S. Nuclear Regulatory Commission One White Flint North 11555 Rockville Pike Mai! Stop 08 C2 Rockville, MD 20852-2738 NRC Senior Resident Inspector Millstone Power Station Director, Radiation Division Department of Energy and Environmental Protection 79 Elm Street Hartford, CT 06106-5127

Serial No.19-211 Docket No. 50-423 ATTACHMENT 1 Discussion of Proposed Change DOMINION ENERGY NUCLEAR CONNECTICUT, INC.

MILLSTONE POWER STATION UNIT 3

Serial No.19-211 Docket No. 50-423 .

Attachment 1, Page 1 of 26 ATTACHMENT 1 TABLE OF CONTENTS

1.0 DESCRIPTION

....................................................................................................... 2

2.0 PROPOSED CHANGE

........................................................................................... 2

3.0 BACKGROUND

..... .... .... .. .. .. .. .. ...... .. ......... ..... ... ....... ...... . ...... .... ... ... ...... ... .. .... ........ 3 3.1 10 CFR 50, Appendix J, Option B Requirements............................................ 3 3.2 Reason for Proposed Amendment ................................................................... 5

4.0 TECHNICAL ANALYSIS

........................................................................................ 5 4.1 Description of Containment.. ............................................................................ 8 4.2 Type A (ILRT) Test History .............................................................................. 11 4.3 Type B and C Testing ............................. *....................................................... 13 4.4 Supplemental Inspection Requirements .......................................................... 15 4.4.1 IWE Examination ............................................................................................ 16 4.4.2 lWL Examinations ........................................................................................... 16 4.5 Deficiencies Identified., .................................................................................... 19

_i 4.6 Plant-Specific Confirmatory Analysis ............................................................... 19 4.6.1 Methodology .............................. : ...................................................................... 19 4.6.2 PRA Quality ..................................................................................................... 20 4.6.3 Summary of Plant-Specific Risk Assessment Results ..................................... 21 4.7 Conclusion ...................................................................................................... 22 5.0 REGULATORY ASSESSMENT .............................................................................. 23 5.1 Applicable Regulatory Requirements/Criteria ................................................. 23 5.2 No Significant Hazards Consideration ............................................................ 24 5.3 Environmental Considerations ........................................................................ 26 6.0 PRECEDENCE ...................................................................................................... 26

Serial No.19-211 Docket No. 50-423 Attachment 1, Page 2 of 26 DISCUSSION OF PROPOSED CHANGE

1.0 DESCRIPTION

The proposed amendment revises Millstone Power Station Unit 3 (MPS3) Technical Specification (TS) 6.8.4.f, "Containment Leakage Rate Testing Program," by replacing the reference to Regulatory Guide (RG) 1.163 with a reference to Nuclear Energy Institute (NEI) topical report NEI 94-01, Revision 3-A and the limitations and conditions specified in NEI 94-01, Revision 2-A, as the implementing documents used by Dominion Energy Nuclear Connecticut, Inc. (DENG) to develop the MPS3 performance-based leakage testing program in accordance with Option B of 10 CFR 50, Appendix J, "Primary Reactor Containment Leakage Testing for Water-Cooled Power Reactors". This amendment would allow DENG to extend the primary containment integrated leak rate test (ILRT) interval for MPS3 from 10 years to 15 years and the Type C local leak rate test (LLRT) interval from 60 months to 75 months, and incorporates the regulatory positions stated in RG 1.163.

In the safety evaluations (SE) issued by NRG letter dated June 25, 2008 (NEI 94-01, Revision 2-A) and June 8, 2012 (NEI 94-01, Revision 3-A), the NRG concluded that these documents describe an acceptable approach for implementing the optional performance-based requirements of Option B of 10 CFR 50, Appendix J, and found that NEI 94-01, Revisions 2 and 3 are acceptable for referencing by licensees proposing to amend their TS in regards to containment leakage rate testing, subject to the limitations and conditions noted in Section 4.0 of the two SEs.

In accordance with the guidance in NEI 94-01, Revision 3-A, DENG proposes to extend the interval for the primary containment ILRT, which is currently required to be performed at ten year intervals, to no longer than 15 years from the last ILRT for MPS3. The last ILRT for MPS3 was performed on November 8, 2011; therefore, the next ILRT for MPS3 is due no later than November 8, 2021. This would require the test be performed during the fall 2020 refueling outage. The proposed amendment would allow the next ILRT for MPS3 to be extended 5 years so that the next ILRT would be due no later than November 8, 2026. The performance of fewer ILRTs will result in significant savings in radiation exposure to personnel, cost, critical path time during future refueling outages, and a reduction in industrial safety risk.

2.0 PROPOSED CHANGE

TS 6.8.4.f, "Containment Leakage Rate Testing Program," currently states:

"A program shall be established to implement the leakage rate testing of the containment as required by 10 CFR 50.54(0) and 10 CFR 50, Appendix J, Option B, as modified by approved exemptions*. This program shall be in accordance with the guidelines contained in Regulatory Guide 1.163, "Performance-Based Containment Leak-Test Program," dated September 1995, as modified by the following exception to NEI 94-01, Rev. 0, "Industry Performance Based Option of 10 CFR Part 50

Serial No.19-211 Docket No. 50-423 Attachment 1, Page 3 of 26 Appendix J": The first Type A test performed after the January 6, 1998 Type A test shall be performed no later than January 6, 2013."

The proposed change would revise this portion of TS 6.8.4.f by replacing the reference to RG 1.163 with a reference to NEI 94-01, Revision 3-A as follows:

"A program shall be established to implement the leakage rate testing of the containment as required by 10 CFR 50.54(0) and 10 CFR 50, Appendix J, Option B, as modified by approved exemptions*. This program shall be in accordance with the guidelines contained in NEI 94-01, Revision 3-A, "Industry Guideline for Implementing Performance-Based Option of 10 CFR Part 50, Appendix J," dated July 2012 and the limitations and conditions specified in NEI 94-01, Revision 2-A, dated October 2008."

A markup of the proposed change is provided in Attachment 2.

3.0 BACKGROUND

3.1 10 CFR 50, Appendix J, Option B Requirements The regulations in 10 CFR 50.54(0) require that the primary containments for water cooled power reactors shall be subject to the requirements set forth in 10 CFR 50, Appendix J.

The testing requirements of 10 CFR 50, Appendix J, provide assurance that leakage from the containment, including systems and components that penetrate the containment, does not exceed the allowable leakage values specified in the TS, and that periodic surveillance of containment penetrations and isolation valves is performed so that proper maintenance and repairs are made during the service life of the containment and the systems and components penetrating containment. The limitation on containment leakage provides assurance that the containment would perform its design function following an accident, up to and including the plant design basis accident. Appendix J identifies three types of required tests: (1) Type A tests, intended to measure the containment overall integrated leakage rate; {2) Type B tests, intended to detect local leaks and to measure leakage across pressure-containing or leakage limiting boundaries (other than valves) for containment penetrations; and (3) Type C tests, intended to measure containment isolation valve leakage. Type B and C tests identify the vast majority of potential containment leakage paths. Type A tests identify the overall {integrated) containment leakage rate and serve to ensure continued leakage integrity of the containment structure by evaluating those structural parts of the containment not covered by Type B and Type C testing.

In 1995, 10 CFR 50, Appendix J was amended to provide a performance-based Option B for the containment leakage testing requirements. Option B requires that test intervals for Type A, Type 8, and Type C testing be determined by using a performance-based approach. Performance-based test intervals are based on consideration of the operating history of the component and resulting risk from its failure. The term "performance-based" in 10 CFR 50, Appendix J, refers to both the performance history necessary to extend test intervals and the criteria necessary to meet the requirements of Option B. Also in 1995, RG 1.163 was issued. The RG endorsed NEI 94-01, Revision 0, "Industry Guideline for

Serial No.19-211 Docket No. 50-423 Attachment 1, Page 4 of 26 Implementing Performance-Based Option of 10 CFR 50, Appendix J," with certain modifications and additions. Option B, in concert with RG 1.163 and NEI 94-01, Revision 0, allows licensees with a satisfactory ILRT performance history (i.e., two consecutive, successful Type A tests) to reduce the test frequency for the containment Type A (ILRT) test from three tests in ten years to one test in ten years. This relaxation was based on an NRC risk program and Electric Power Research Institute (EPRI) TR-104285, "Risk Impact Assessment of Revised Containment Leak Rate Testing Intervals," both of which illustrated that the risk increase associated with extending the ILRT surveillance interval was very small.

NEl 94-01, Revision 2, describes an approach for implementing the optional performance-based requirements of Option B described in 10 CFR 50, Appendix J, which includes provisions for extending Type A intervals up to 15 years and incorporates the regulatory positions stated in RG 1.163. It delineates a performance-based approach for determining Type A, Type B, and Type C containment leakage rate surveillance testing frequencies.

This method uses industry performance data, plant-specific performance data, and risk insights in determining the appropriate testing frequency. NEI 94-01, Revision 2, also addresses the performance factors that licensees must consider in determining test intervals. However, it does not address how to perform the tests because these details are included in existing documents (e.g., American National Standards Institute / American Nuclear Society [ANSI/ANS)-56.8-2002). The NRG final SE issued by letter dated June 25, 2008, documents the NRC's evaluation and acceptance of NE! 94-01, Revision 2, subject to the specific limitations and conditions listed in Section 4.1 of the SE. The accepted version of NE! 94-01 was subsequently issued as Revision 2-A, dated October 2008.

Electric Power Research Institute (EPRl) report TR-104285, "Risk Impact Assessment of Revised Containment Leak Rate Testing Intervals," Revision 2, provides a risk impact assessment for optimized ILRT intervals of up to 15 years, using current industry performance data and risk-informed guidance, primarily Revision 1 of RG 1.174, "An Approach for using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Bases." The NRC's final SE, issued by letter dated June 25, 2008, documents the NRC's evaluation and acceptance of TR-104285, Revision 2, subject to the specific limitations and conditions listed in Section 4.2 of the SE. An accepted version of EPRI TR-1009325 was subsequently issued as Revision 2-A (also identified as TR-1018243), dated October 2008.

NEI 94-01, Revision 3, describes an approach for implementing the optional performance-based requirements of Option B described in 10 CFR 50, Appendix J, which includes provisions for extending Type A and Type C intervals up to 15 years and 75 months, respectively, and incorporates the regulatory positions stated in RG 1.163. It delineates a performance-based approach for determining Type A, Type B, and Type C containment leakage rate surveillance testing frequencies. This method uses industry performance data, plant-specific performance data, and risk insights in determining the appropriate testing frequency. NEI 94-01, Revision 3, also addresses the performance factors that licensees must consider in determining test intervals. However, it does not address how to perform the tests because these details are included in existing documents (e.g., American National Standards Institute/American Nuclear Society (ANSI/ANS-56.8-2002). The NRC final SE, issued by letter dated June 8, 2012, documents the NRC's evaluation and

Serial No.19-211 Docket No. 50-423 Attachment 1, Page 5 of 26 acceptance of NE! 94-01, Revision 3, subject to the specific limitations and conditions listed in Section 4.0 of the SE. The accepted version of NEI 94-01 was subsequently issued as Revision 3-A, dated July 2012.

EPRI TR-1009325, Revision 2, provides a validation of the risk impact assessment of EPRI TR-104285, dated August 1994. The assessment validates increasing allowable extended LLRT intervals to 120 months as specified in NEI 94-01, Revision 0. The NRC final SE, issued by letter dated June 8, 2012, documents the NRC's evaluation and acceptance of EPRI TR-1009325 as a validation of EPRI TR-104285, Revision 2 bases to extend Type C LLRT to 120 months, subject to the specific limitations and conditions listed in Section 4.0 of the SE. However, the industry requested that the allowable extended interval for Type C local leak rate testing (LLRT) be increased only to 75 months, to be conservative, with a permissible extension (for non-routine emergent conditions) of nine months (84 months total).

3.2 Reason for Proposed Amendment With approval of this MPS3 LAR, DENC will extend the Type A ILRT interval from 10 years to 15 years and the Type C LLRT interval from 60 months to 75 months.

4.0 TECHNICAL ANALYSIS

As required by 10 CFR 50.54(0), the MPS3 containment is subject to the requirements set forth in 10 CFR 50, Appendix J. Option B of Appendix J requires that test intervals for Type A, Type B, and Type C testing be determined by using a performance-based approach.

Currently, the MPS3 10 CFR 50, Appendix J testing program is based on RG 1.163, which endorses NEI 94-01, Revision 0. This license amendment request proposes to revise the MPS3 10 CFR 50, Appendix J testing program by implementing the guidance in NEI 94-01, Revision 3-A and the limitations and conditions specified in NEI 94-01, Revision 2-A.

In the NRC SEs dated June 25, 2008 and June 8 2012, the NRC concluded that NEI 94-01, Revisions 2 and 3, as modified by the limitations and conditions in Section 4.1, are acceptable for referencing by licensees proposing to amend their TS in regard to containment leakage rate testing for the optional performance-based requirements of Option B of 10 CFR 50, Appendix J. The following addresses the limitations and conditions of the 2008 and 2012 SEs.

Serial No.19-211 Docket No. 50-423 Attachment 1, Page 6 of 26 limitations/Conditions from NEI 94-01 Rev. 2-A MPS3 Response (Section 4.1 of SE dated June 25, 2008)

Following the NRC approval of this license

1. For calculating the Type A leakage rate, the amendment request, DENC will use the definition in licensee should use the definition in the NEl TR Section 5.0 of NEI 94-01, Revision 3-A (and Revision 94-01, Revision 2, in lieu of that in ANSI/ANS-56.8-2-A), for calculating the Type A leakage rate when 2002).

future MPS3 Type A tests are performed.

2. The licensee submits a schedule of containment A schedule of containment inspections is provided inspections to be performed prior to and between in Section 4.4.2 below.

Type A tests.

3. The licensee addresses the areas of the General visual examination of accessible interior containment structure potentially subjected to and exterior surfaces of the containment system for degradation. structural problems is typically conducted in accordance with the Millstone IWE/IWL Containment lnservice Inspection Plans which implement the requirements of the ASME,Section XI, Subsections IWE and IWL, as required by 10 CFR 50.SSa(g).

Previously, the Millstone IWE Program had inspected the accessible leak chase channels and plugs or caps during the general visual examination as a liner boundary. In response to NRC Information Notice 2014-07, "Degradation of Leak Chase Channel System for Floor Welds of Metal Containment Shell and Containment Metallic Liner,"

the examination was expanded to include an inspection under E-A Containment Surfaces, Item No. E130 *- Moisture Barriers. This examination identified no deficiencies. At this time there are no primary containment surface areas that require augmented examinations in accordance with ASME Section XI, IWE-1240.

Within the Millstone IWL Program no repairs were required. The internal and external inspections confirmed the containment structure is in good material condition. No significant defects or concerns were observed on the exterior concrete and the observed indications were due to original construction. Taken together or individually, the indications do not represent a significant structural concern. The containment structure continues to retain its ability to perform as designed.

4. The licensee addresses any test and inspections No major modifications to the MPS3 containment performed following major modifications to the structure have been performed.

containment structure, as applicable.

Serial No.19-211 Docket No. 50-423 Attachment 1, Page 7 of 26 Limitations/Conditions from NEI 94-01 Rev. 2-A MPS3 Response (Section 4.1 of SE dated June 25, 2008)

5. The normal Type A test interval should be !ess DENC acknowledg,es and accepts this NRC staff than 15. years. If a licensee has to utilize the I position, as communicated to the nuclear industry provisions of Scc~ion 9.1 of NE! TR 94-01, Revision in Regulatory !ssue Summ21y (RIS) 2008-27 dc1ted 2, related to extending the ILRT interval beyond ; December 8, 2008.

15 years, the licensee must demonstrate to the NRC staff that it is an unforeseen emergent condition.

6. For plants licensed under 10 CFR Part 52, Not applicable. MPS3 is not licensed under 10 CFR applications requesting a permanent extension of Part 52.

the ILRT surveillance interval to 15 years should be deferred until after the construction and testing of contaiwnents for that design have been .

completed and applicants have confirmed the !

applicability of 0JEI TR 94-01, Revision 2 and EPRI Report No. 1009325, Revision 2, of past containment ILRT data.

Serial No.19-211 Docket No. 50-423 Attachment 1, Page 8 of 26 Limitations/Conditions from NEI 94-01 Rev. 3-A MPS3 Response (Section 4.0 of"SE dated June 8, 2012)

1. The staff is allowing the extended interval for Following approval of this amendment and Type C LLRTs be increased to 75 months with the consistent with the guidance of NEI 94-01, Rev. 3-A, requirement that, a licensee's post-outage report DENC will assess and monitor margin between the include the margin between the Type B and Type Type B and C leakage rate summation and the C leakage rate summation and its regulatory limit. regulatory limit and include this margin in a post In addition, a corrective action plan shall be outage report. This will include corrective actions to developed to restore the margin to an acceptable restore margin to an acceptable level, if required.

level. The staff is also allowing the non-routine emergent extension out to 84-months as applied to Type C valves at a site, with some exceptions that must be detailed in NEI 94-01, Revision 3. At no time shall an extension be allowed for Type C valves that are restricted categorically (e.g. BWR MS!Vs), and those valves with a history of leakage, or any valves held to either a less than maximum interval or to the base refueling cycle interval.

Only non-routine emergent conditions allow an extension to 84 months.

2. When routinely scheduling any LLRT valve interval Following approval of this amendment and beyond 60-months and up to 75-months, the consistent with the guidance of Section 11.3.2 of primary containment leakage rate testing NE! 94-01, Rev. 3-A, DENC will estimate the amount program trending or monitoring must include an of understatement in the Type B & C total and estimate of the amount of understatement in the include determination of the acceptability in a post Type B & C total, and must be included in a outage report.

licensee's post-outage report. The report must include the 'reasoning and determination of the acceptability of the extension, demonstrating that the LLRT totals calculated represent the actual leakage potential of the penetrations.

4.1 Description of Containment The MPS3 containment structure is a steel-lined, conventionally reinforced concrete structure designed to operate under sub-atmospheric conditions. The structure has a vertical cylindrical wall and hemispherical dome supported on a flat base mat which is founded on bedrock.

The base mat or foundation slab is 10 ft. thick with a diameter of 158 ft. The floor liner plate is 0.25 in. thick. A reinforced concrete slab approximately 2 ft. thick was placed over and anchored through the mat liner to stiffen it against negative pressur:.es and to protect it from heat associated with a design basis accident. This slab also serves as anchorage and support for equipment located on the lowest level of the containment.

Serial No.19-211 Docket No. 50-423 Attachment 1, Page 9 of 26 The cylindrical wall is 4 ft. 6 in. thick with an inside diameter of 140 ft. and a height from mat to spring line of 131 ft. 3 in. The inside radius of the 2 ft. 6 in. thick dome is 70 ft. The internal height from base mat to the center of the dome is 201 ft. 3 in. The dome liner plate is 0.5 in. thick.

The liner plate is a continuously welded steel membrane supported by and anchored to the inside of the containment at sufficiently close intervals with anchor studs and deformed bars so that the overall deformation of the liner under the parameters derived from the design basis accident (OBA) and normal operation is essentially the same as that of the concrete containment structure.

The function of the liner is to act as a gas-tight membrane under conditions that can be encountered throughout the operating life of the plant. The liner is designed to resist all direct loads and accommodate deformation of the concrete containment structure without jeopardizing leak-tight integrity.

Penetrations are used for personnel and equipment access, process p1p1ng, electrical service, and a mechanical fuel transfer system through the containment wall. These penetrations are classified as follows:

Sleeved Piping Penetration These penetrations have a sleeve around the outside of forged piping with integral flued head. Sleeved penetrations are used for multiple small pipes passing through one penetration and for thermally hot piping systems.

Unsleeved Piping Penetrations These penetrations consist of piping installed through the containment wall that are thermally cold piping systems and only one pipe is passing through the penetration. The process pipe is welded directly to the reinforcement plate.

Electrical Penetrations Electrical penetrations are used to carry electrical cables and instrumentation leads through the containment wall. Each penetration contains either a 12 in. or an 18 in. diameter steel sleeve. The sleeves are welded to liner reinforcement plates. The electrical leads are installed in the penetration assemblies which are mounted to the pipe sleeve by a welded flange. Individual conductors can be replaced without cutting the containment liner or sleeve. Each installed penetration is periodically tested for leak tightness.

Fuel Transfer Tube (Mechanical Transfer System)

This penetration is provided for fuel transfer between the containment structure and the fuel building. The penetration consists of a stainless steel pipe installed inside a stainless steel enclosure with bellows expansion joints to compensate for differential movements of the buildings. The inner pipe acts as the transfer tube and connects the containment refueling canal with the spent fuel pool in the fuel building via the fuel transfer c~nal. The enclosure is welded to the containment liner. The bellows were selected to withstand thermal expansion differentials, seismic motions, and radial and axial differential movements of the fuel building and the containment structure. The enclosure has a tap which provides

Serial No.19-211 Docket No. 50-423 Attachment 1, Page 10 of 26 means for leak testing the system. A blind flange is provided on the inner tube of the containment side and a valve on the fuel building side.

Personnel Air Lock The personnel air lock is a double closure penetration with an inside diameter of 7 ft. Each closure head is hinged and double gasketed with a leakage test tap between the "O" rings.

The enclosed space between the "O" rings is pressurized to containment design pressure to test for leakage through the access door when it is locked in place. The personnel access lock can be independently pressurized up to containment design pressure for testing. Both doors are hydraulically latched and hydraulically swung. Both doors are interlocked so that in the event one door is opening the other cannot be actuated. Both doors are furnished with a pressure equalizing connection. The equalizing valves are manually and automatically operated by the person entering or leaving the personnel access lock.

Equipment Hatch The equipment hatch is a single closure penetration with an inside diameter of 15 ft. The equipment hatch cover is mounted inside the containment structure and is double gasketed with a leakage test tap between the "O" rings. The enclosed space between the "O" rings is pressurized to containment design pressure to test for leakage through the access door when it is bolted in place.

The maximum containment* structure design pressure is 45 psig. The minimum containment structure design pressure is 8.0 psia. This pressure is equivalent to the minimum operating pressure minus the pressure drop due to the maximum, hypothetical containment cooldown situation. During this condition, the containment atmosphere pressure is assumed to be decreased below normal operational pressure by the inadvertent operation of the quench spray system during normal unit operation. The resulting total pressure is above the minimum containment design pressure of 8.0 psia.

The limitations on containment leakage rates (La), as specified in the Containment Leakage Rate Testing Program, ensure that the total containment leakage volume will not exceed the value assumed in the safety analyses at the peak accident pressure, Pa. As an added conservatism, the measured overall integrated leakage rate is further limited to less than 0.75 La during performance of the periodic test to account for possible degradation of the containment leakage barriers between leakage tests.

The Limiting Condition for Operation (LCO) defines the limitations on containment leakage.

The leakage rates are verified by surveillance testing as specified in the Containment Leakage Rate Testing Program. Although the LCO specifies the leakage rates at accident pressure, Pa, it is not feasible to perform a test at such an exact value for pressure.

Consequently, the surveillance testing is performed at a pressure greater than or equal to Pa to account for test instrument uncertainties and stabilization changes. This conservative test pressure ensures that the measured leakage rates are representative of those which would occur at accident pressure while meeting the intent of the LCO.

The peak calculated containment internal pressure for the design basis loss of coolant accident, Pa, is 41.9 psig. The maximum allowable containment leakage rate La, at Pa,

Serial No.19-211 Docket No. 50-423 Attachment 1, Page 11 of 26 overall leakage rate acceptance criterion is s; 1.0 La. "

shall be 0.3 percent by weight of the containment air per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The containment 4.2 Type A (ILRT) Test History Test results from the last three Type A ILRTs performed at MPS3 are provided below.

Note that on June 29, 2007, the NRC approved License Amendment 239 to allow a one-time 5-year extension of Type A testing (ADAMS Accession ML071690523).

For MPS3, the maximum allowable containment leakage rate is 0.3% of containment air weight per day (%wt/day). Based on the last test performed in 2011, the containment leak rate was less than 17% (0.0506/0.3) of the TS limit.

MPS3 Containment Integrated Leakage Rate Test Results (3R14)

• * * * .November.7, 2011 * *

• * 'AsL~ft.< Perforrnance Calculated Leakage Rate (Laml 0.0435 %wt/day 0.0435 %wt/day 0.0435 %wt/day Upper Confidence Leakage 0.0462 %wt/day 0.0462 %wt/day 0.0462 %wt/day Rate (Lgs)

Line Up Penalties 0.0044 %wt/day 0.0044 %wt/day 0.0044 %wt/day Volume Change Correction 0.0000 %wt/day 0.0000 %wt/day 0.0000 %wt/day Leakage Sa'l(ings 0.0025 %wt/day Corrected Results 0.0531 %wt/day 0.0506 %wt/day 0.0506 Note: Mass Point leakage rate calculation per ANSI/ANS 56.8-1994.

Serial No.19-211 Docket No. 50-423 Attachment 1, Page 12 of 26 MPS3 Containment Integrated Leakage Rate Test Results October 28, 1998 As Found As Left Performance Calculated Leakage Rate (Lca1c) 0.0601 %wt/day 0.0601 %wt/day 0.0601 %wt/day Upper Confidence Leakage

>0.3 %wt/day 0.1097 %wt/day 0.1097 %wt/day Rate (L95)

Line Up Penalties 0.0061 %wt/day 0.0061 %wt/day %wt/day Volume Change Correction 0.0000 %wt/day 0.0000 %wt/day 0.0000 %wt/day Leakage Savings >0.3 %wt/day 1,if** P. .;l "'"...

• "I:'. <Y,f .** *,.* *i'f, *',;'f~s,:rG; .'.::It,:" *. "C Corrected Results >0.3 %wt/day 0.1158 %wt/day 0.1158 %wt/day Notes: Total Time leakage rate calculation per BN-TOP-01 Rl.

ILRT was performed in 1998 following an extended unit shutdown.

The "as-found" Type A test was considered a failure due to degraded valve (Type C) performance of Containment Purge Supply (penetration 86) identified in LER 96-012-00, B1S752 dated 6/14/1996.

MPS3 Containment Integrated Leakage Rate Test Results October 10, 1993 As Found As Left Performance Calculated Leakage Rate (Lca1cl "- 0.0942 %wt/day 0.0942 %wt/day 0.0942 %wt/day Upper Confidence Leakage 0.1311 %wt/day 0.1311 %wt/day 0.1311 %wt/day Rate (L95 )

Line Up Penalties 0.0002 %wt/day 0.0002 %wt/day 0.0002 %wt/day Volume Change Correction 0.0000 %wt/day 0.0000 %wt/day 0.0000 %wt/day Leakage Savings 0.0014 %wt/day Corrected Resu Its* 0.1339  % wt/day 0.1333 %wt/day 0.1333 %wt/day Note: Total Time leakage rate calculation per BN-TOP-01 Rl.

• The revised values provided resulted from a Configuration Management Plan review of penetrations that were not vented or drained, and may not have had appropriate penalties applied. Corrections applied to ILRT results for 1985, 1989 and 1993 (Northeast Utilities (NU) letter dated 6/19/1997, B16528).

Serial No.19-211 Docket No. 50-423 Attachment 1, Page 13 of 26 4.3 Type B and Type C Testing The MPS3 Appendix J, Type B and Type C program requires local leak rate testing of electrical penetrations, airlocks, hatches, flanges, and valves as required by 10 CFR 50, Appendix J, Option B and TS 6.8.4.f. The Type B and Type C program consists of local leak rate testing of penetrations with a resilient seal, expansion bellows, double-gasketed manways, hatches and flanges, and containment isolation valves that serve as a barrier to the release of the post-accident containment atmosphere.

The most recent Type Band Type C test results were compared with the allowable leakage rate. For MPS3, the combined Type B and Type C leakage rate acceptance criterion is 0.60La or 307,520 standard cubic centimeters per minute (seem). The. maximum and minimum pathway leak rate summary totals for the last three refueling outages are shown below:

3R19 - May 2019 As-found Minimum Pathway Leakage Rate 15,896 seem (5.169 % of 0.6La)

As-left Minimum Pathway Leakage Rate 12,299 seem (3.999 % of 0.6La)

As-left Maximum Pathway Leakage Rate 25,780 seem (8.383 % of 0.6La)

During 3R 19, the Chilled Water Return (penetration 72) inside containment isolation valve, 3CDS*CTV91 B, failed its LLRT due to an extruded T-ring seat seal. The valve was disassembled and repaired and the subsequent leakage rate was satisfactory. The redundant outside containment isolation valve, 3CDS*CTV38B, was tested and found leak tight, maintaining minimum pathway leakage criteria. Leakage rate testing is performed each refueling outage until compliance with leakage limits is restored.

3R18 - April 2017 As-found Minimum Pathway Leakage Rate 24,838 seem (8.076 % of 0.6La)

As-left Minimum Pathway Leakage Rate 24,131 seem (7.847 % of 0.6La)

As-left Maximum Pathway Leakage Rate 66,025 seem (21.470 % of 0.6La)

During 3R 18, the inside containment isolation check valve 3CHS*V58 failed its LLRT, requiring disassembly and inspection. Leakage rate testing was performed until compliance with leakage limits was restored.

3R17 -April 2016 As-found Minimum Pathway Leakage Rate Undetermined >0.60La As-left Minimum Pathway Leakage Rate 18,240 seem (5.931 % of 0.6La)

As-left Maximum Pathway Leakage Rate 56,436 seem (18.352 % of 0.6La)

During 3R17, containment penetration 38, Chilled Water Return, exhibited both inside valve (3CDS*CTV91A) and outside valve (3CDS*CTV38A) leakage rates in excess of 0.60La for the penetration. As a result, repairs were made and leakage rate testing was performed until compliance with leakage limits was restored.

Serial No.19-211 Docket No. 50-423 Attachment 1, Page 14 of 26 At MPS3, there are a total of 83 Type B tested components, including 80 electrical penetrations. All electrical penetrations are on the extended test interval and are tested within the 120-month performance-based test interval. The air lock and manway seals, fuel transfer tube, and containment equipment hatch and manway are tested every refueling outage. Air lock door gaskets are tested following containment entries during power operation.

The Type C tested components at MPS3 consist of 67 penetrations and 172 components.

Five valves are currently on a refueling frequency for testing, whereas 97% of all Type C tested components are on the extended interval. The containment purge and exhaust penetrations are not on the performance based extended interval and are therefore tested on a refueling frequency. Approximately 50% of the Type C penetrations are tested each refueling outage due to scheduled maintenance and train-specific alignments.

One containment penetration (penetration 116), Reactor Plant Chilled Water Supply (valve 3C0S*CTV40A) had experienced repeat failures and inconsistent leakage rate performance. Consequently, this valve was being monitored by the Maintenance Rule Program. However during 3R19, the second consecutive, as-found test was found to be acceptable, allowing the valve to be returned to an extended test interval.

In February 2019, DENG performed an evaluation of the MPS3 containment penetrations and valves in systems that are normally filled with water and operate under post-accident conditions. The design of the water-filled penetrations is such that they preclude leakage of containment atmosphere through these penetrations during a design basis accident (OBA).

The implementing industry guideline for the performance based Option B of 10 CFR 50, Appendix J identifies local leakage rate testing is not required for primary containment boundaries that do not constitute potential primary containment atmosphere pathways during and following a OBA. As such, the requirements of 10 CFR 50, Appendix J do not apply to the containment isolation valves in those systems. The evaluation identified 21 containment penetrations which include the reactor coolant pump seal water injection (penetrations 16, 17, 18 and 19), high pressure boron injection (penetration 51), residual heat removal system (penetrations 91, 92, 93, 94, and 95), high pressure and low pressure safety injection (penetrations 96, 97 and 98), and containment recirculation suction and discharge (penetrations 102, 103, 104, 105, 107, 108, 109 and 110). From the population of penetrations removed from 10 CFR 50, Appendix J leakage requirements, 56 valves are eliminated from the test requirements and will not be tested.

As discussed in NUREG-1493, Type B and Type C tests can identify the vast majority (>

95%) of all potential containment leakage paths. This amendment request adopts the guidance in NEI 94-01, Revision 3-A, in place of NEI 94-01, Revision O for the Type C test interval, but otherwise does not affect the scope or performance of Type B or Type C tests.

Type B and Type C testing will_ continue to provide a high degree of assurance that containment integrity is maintained.

Serial No.19-211 Docket No. 50-423 Attachment 1, Page 15 of 26 4.4 Supplemental Inspection Requirements Prior to initiating a Type A test, a general visual examination is performed of accessible interior and exterior surfaces of the containment system for structural problems that may affect either the containment structure leakage integrity or the performance of the Type A test. This examination is typically conducted in accordance with the Millstone Containment lnservice Inspection (ISi) Plan, which implements the requirements of ASME Section XI, Subsection IWE/IWL. The current applicable code edition and addenda for the second ten-year interval IWE/IWL program is the 2001 Edition with the 2003 Addenda.

The examination performed in accordance with the IWE/IWL program satisfies the general visual examination requirements specified in 10 CFR 50, Appendix J, Option B.

Identification and evaluation of inaccessible areas are addressed in accordance with the requirements of 10 CFR 50.55a(b)(2)(ix)(A) and (E). Examination of pressure-retaining bolted connections and evaluation of containment bolting flaws or degradation are performed in accordance with the requirements of 10 CFR 50.55a(b)(ix)(G) and 10 CFR 50.55a(b)(ix)(H). Each ten-year ISi interval is divided into three inspection periods of 3, 4 and 3 year durations for IWE. A minimum of one inspection during each inspection period of the ISi interval is required by the IWE program. Each ten-year ISi interval is divided into two five-year inspection periods for IWL. A minimum of one inspection during each inspection period of the ISi interval is required by the IWL program.

The examinations performed in accordance with the MPS3 Ar:nerican Society of Mechanical Engineers (ASME) Code,Section XI, Subsection IWE/IWL program satisfy the general visual examinations requirements specified in 10 CFR 50, Appendix J, Option B. ASME Code,Section XI, Subsection IWE assures that at least three general visual examinations of metallic components will be conducted before the next Type A test if the Type A test interval is extended to 15 years. As noted in the "MPS3 Containment Surface Examination Schedule" Table in Section 4.4.2, thes.e inspections meet the requirements of Section 9.2.3.2 of NEI 94-01, Revision 3-A and Condition 2 in Section 4.1 of the NRC safety evaluation for NEI 94-01, Revision 2.

Visual examinations of accessible concrete containment components in accordance with ASME Code,Section XI, Subsection IWL are performed every five years, resulting in at least three IWL examinations being performed during a 15-year Type A test interval.

Together, these examinations assure that at least three general visual examinations of the accessible containment surfaces (exterior and interior) and one visual examination immediately prior to a Type A test will be conducted before the next Type A test if the Type A test interval is extended to 15 years, thereby meeting the requirements of Section 9.2.3.2 of NEI 94-01, Revision 3-A and Condition 2 in Section 4.1 of the NRC safety evaluation for NEI 94-01, Revision 2.

4.4.1 IWE Examinations A review was conducted for MPS3 in accordance with IWE-1241, Examination Surface Areas (1992 Edition with 1992 Addenda of ASME XI) per the initial ten-year Category E-C

Serial No.19-211 Docket No. 50-423 Attachment 1, Page 16 of 26 examination requirements. No areas were deemed susceptible to accelerated degradation and aging; therefore, augmented examinations per Category E-C were not required.

MPS3 has completed the Interval 2, Period 3 examination requirements of the Containment IWE lnservice Inspection Program. Examinations were performed to the requirements of the 2001 Edition through 2003 Addenda of ASME XI, as modified by the 10 CFR 50.55a(b) limitations. At this time, no augmented Category E-C examinations are planned for MPS3.

In accordance with the Containment lnservice Inspection Testing Program, qualified personnel perform an !WE - General Visual examination of all accessible surface areas associated with the containment liner. The only significant repair was the replacement of localized areas of the moisture barrier in October of 2005, and May of 2016.

In accordance with ASME IWE, during each period a complete inspection of all. accessible containment liner surface areas is performed. There is no active degradation mechanism present. Coating degradation of the liner has been primarily the result of mechanical damage incurred during outages. To prevent further mechanical damage, bubble wrap is placed on the outer annulus walls near staged equipment and high traffic areas to prevent interaction with the liner.

Since the exterior containment concrete is fully enclosed and in a dry environment, no wicking potential exists from outside to the backside of the liner. There are no primary containment surface areas that require augmented examination in accordance with ASME Section XI, IWE-1240. However, during each period, 100 percent of the accessible primary containment surface area is inspected. Any significant changes or potential concerns receive a detailed inspection at that time.

4.4.2 IWL Examinations The MPS3, containment is not an externally exposed structure. All above grade containment concrete is fully enclosed and protected from the outside environment by the Enclosure Building, Auxiliary Building, Main Steam Valve Building, Hydrogen Recombiner Building, Spent Fuel Building, or Engineered Safeguards Features (ESF) Building.

Below grade, a waterproof membrane is installed below the containment structure mat and ESF Building. During construction, the membrane was installed on the walls to envelope the containment structure and ESF Building. Water that penetrates or circumvents the membrane drains to a layer of porous concrete directly below the mat and above the membrane. This porous concrete layer serves as a horizontal drain under the containment structure and ESF Building. Water drains through the porous layer and into the ESF Building for disposal.

The steel frame Enclosure Building, which is leak tested as part of the Supplementary Leak Collection and Release System (SLCRS) boundary, houses the containment structure dome and vertical sections of concrete. The environment to which the containment concrete is subjected is essentially the same at all locations due to the ventilation system.

The ventilation paths ensure the containment concrete is exposed to a dry, relatively

Serial No.19-211 Docket No. 50-423 Attachment 1, Page 17 of 26 constant environment. Since the Enclosure Building protects the containment concrete from excessive heat, rain, sleet, snow, or freezing temperatures, many of the major degradation mechanisms (i.e., freeze/thaw cycling) typical of outdoor containments, are precluded. Further, since the Enclosure Building maintains a dry environment, no wicking potential exits to damage the containment liner.

The second 10-year interval of concrete containment examinations (IWL) have been performed for MPS3. General and detailed visual examinations were completed by the required March 28, 2016 due date in accordance with Category L-A of the 2001 Edition with 2003 Addenda of ASME Section XI. The third 10-year interval will have similar examinations (100% of accessible areas) performed by March 28, 2020 and 2025 (plus or minus 1 year) in accordance with Category L-A of the Code.

The 2016 examinations of the concrete exterior were conducted by a Quality Contra.I inspector and the responsible engineer, using the approved ASME Code visual methods.

The examinations were performed from a Bosun's chair suspended from the enclosure building structural steel. During the examinations, indications noted were minor spalls, efflorescence, pop-outs, cracks, stains, nails or metal trapped within the concrete, and abandoned anchors/anchor holes. Due to the controlled environment within the enclosure building, there have been no changes in the indications. The indications identified were minor in nature and did not require excavation or repair. In general, the indications requiring additional inspection involved cracks and embedded metal. The designation of a Code versus a cosmetic repair is detailed in ACl-349.3R, "Evaluation of Existing Nuclear Safety-Related Concrete Structures."

In summary, no indications have been observed on the exterior concrete other than those due to original construction flaws. Based on these inspections, DENC concludes that the MPS3 containment structure is in good material condition.

The following table provides an approximate schedule for the MPS3 containment surface examinations, assuming the Type A test frequency is extended to 15 years. In addition to the required IWE/IWL inspections, additional visual inspections (shown in the table column headings) of the normally accessible portions of the interior and external surface of the containment are performed.

Serial No. *rn-211 Docket No. 50-423 Attachment 1, Page 18 of 26 MPS3 Containment Surface Examination Schedule General Visual Maintenance General Visual CTMT . Examination of Rule Structural ! Containment i Type A Examination of Calendar Basemat Accessible Inspection Enclosure Test Accessible Year Settlement Interior Liner CTMT& Roof (ILRT) Exterior Surfaces Inspection Surfaces Enclosure Inspection (IWL}

{IWE) Building 1998 1/17 10/3 (Pre-lLRT) 1/13 10/3 (Pre-lLRT) 12/18  ; i 1999 - - - + * * *

• ___5_/2_7_ -*----***-----+------------,- __ s/_3_1_ _I

-~---<----*** -*t---

2000 4/7 9/7 First Required IWL First Required 2001 2/21 Exam (8/21) IWE Exam (2/1) I 1 2002 11/7 9/25 I 6/18

• • • ------+-- I 2003 4/17 '/

2004 7/6 4/28 I 6/15 2005 10/6 10/6 6/15 2006 3/27 5/1 6/14 I 2007 6/19 5/31 6/17

---

~--- ****---- -*--- * - - - - * * * * * * * +-------,I ----~

2008 11/3 1 I 2009 4/23 6/10 2010 5/8 6/8 i 2011 11/6 l/ 3l lWL 6/30 I 11/4 (Pre-lLHT) J 11/3 6/8 I

---*-*******-- ___ 11/4 (Pre-II.PT) __ ---***- """ *-* * *******-f--

2012  ! 6/11 2013 5/13 8/1 5/6 2014 10/14 I 2015

,--- ***~--+---*-- ----- *-+---*-

2016 1/18 4/27 6/14 5/16 I 4/20 I 2017 10/31 10/17 2018 2019 (4/13) (6/1) (4/11) I

---+-----***

2020 (2/18) ( i 1 year) (10/4) 2021 {5/12) io22 2023 Spdng (6/i). (5/16) 2024 2025 (2/18)* ( +/- 1 year) Spring . (Fall) 2026 (15 Year) (Pre-lLRT) (Pre~ILRT)

• Note 1- The inspection frequency is each Refueling Outage. Inspections are rescheduled upon completion of the current inspection.

Seria!No.19-211 Docket No. 50-423 Attachment 1, Page 19 of 26 4.5 Deficiencies Identified Consistent with the guidance provided in NEI 94-01, Revision 3, Section 9.2.3.3, abnormal degradation of the primary containment structure identified during the conduct of IWE/IWL program examinations, or at other times, is entered into the corrective action program for evaluation to determine the cause of the degradation and to initiate appropriate corrective actions.

4.6 Plant-Specific Confirmatory Analysis 4.6.1 Methodology An evaluation has been performed to assess the risk impact of extending the MPS3 ILRT interval from the current 10 years to 15 years. This plant-specific risk assessment followed the guidance in NEI 94-01, Revision 2-A, the methodology described in EPRI TR-100932~.

Revision 2-A, and the NRC regulatory guidance outlined in RG 1.174 on the use of Probabilistic Risk Assessment (PRA) findings and risk insights in support of a request to change the licensing basis of the plant. In addition, the methodology used for Calvert Cliffs Nuclear Power Plant to estimate the likelihood and risk implication of corrosion-induced leakage of steel containment liners going undetected during the extended ILRT interval was also used for sensitivity analysis. The current MPS3 Level 1 and Large Early Release Frequency (LERF) internal events PRA model was used to perform the plant-specific risk assessment. All technical elements of the PRA model have been peer reviewed consistent with ASME/ANS RA-*sa-2009, as endorsed by RG.1.200, Revision 2. The analyses include 1

bounding evaluations for the dominant external events (fire and seismic) using the information from the MPS3 Individual Plant Examination of External Events (IPEEE).

Though the JPEEE seismic and fire event models have not been updated since the original IPEEE, the insights and information from these sources have been used to estimate the effect on total LERF of including these external events in the ILRT interval extension risk assessment.

In the SE issued by NRC letter dated June 25, 2008, the NRC concluded that the methodology in EPRI TR-1009325, Revision 2, is acceptable for referencing by licensees

• proposing to amend their TS to extend the ILRT surveillance interval to 15 years, subject to the limitations and conditions noted in Section 4.0 of the SE. The following table addresses each of the four limitations and conditions for the use of EPRI TR-1009325, Revision 2.

Serial No.19-211 Docket No. 50-423 Attachment 1, Page 20 of 26 Limi.tations/Conditions from NEI 94-01 Rev. 2-A MPS3 Response (Section 4.2 of SE dated June 25, 2008)

1. The licensee submits documentation indicating that MPS3 PRA acceptability is addressed in the technical adequacy of their PRA is consistent with Attachment 3, Enclosure A.

the requirements of RG 1.200 relevant to the ILRT extension application.

2. The licensee submits documentation indicating that EPRI Report No. 1009325, Revision 2-A, the estimated risk increase associated with incorporates these population dose and permanently extending the ILRT surveillance interval Conditional Containment Failure to 15 years is small, and consistent with the Probability (CCFP) acceptance clarification provided in Section 3.2.4.5 of the SE. guidelines, which were used for the Specifically, a small increase in population dose should MPS3 plant-specific assessment.

be defined as an increase in population dose of less than or equal to either 1.0 person-rem per year or 1 percent of the total population dose; whichever is restrictive. In addition, a small increase in CCFP should be defined as a value marginally greater than that accepted in a previous onetime ILRT extension requests. This would require that the increase in CCFP be less than or equal to 1.5 percentage point.

3. The methodology in EPRI Report No. 1009325, EPRI Report No. 1009325, Revision 2-A, Revision 2, is acceptable except for the calculation of incorporated the use of 100 La as the the increase in expected population dose (per year of average leak rate for the preexisting reactor operation). In order to make the methodology containment large leakage rate accident acceptable, the average leak rate accident case case (accident case 3b), and this value (accident case 3b) used by the licensees shall be 100 La was used in the MPS3 plant-specific risk instead of 35 La. assessment.

4. ALAR is required in instances where containment MPS3 does not rely on containment over-pressure is relied upon for emergency core over-pressure for ECCS performance.

cooling system (ECCS) performance.

4.6.2 PRA Quality The PRA model used to analyze the risk of this application is referred to as MPS3-R08.

The PRA model and associated documentation has been maintained as a living program, and the PRA data is 'updated approximately every 3 to 5 years to reflect the as-built, as-operated plant. This includes updating the PRA to reflect the current plant configuration and to reflect the accumulation of additional plant operating history and component failure data. The MPS3-R08 PRA model has a high level of detail, including a wide variety of initiating events, modeled systems, operator actions, and common cause failure events.

The PRA model quantification process for the MPS3 PRA uses a linked fault tree approach,

Serial No.19-211 Docket No. 50-423 Attachment 1, Page 21 of 26 which is a well-known methodology in the industry. The scope of the MPS3 PRA model includes internal events and internal flood hazards.

In the confirmatory risk analysis, accident progression sequences have been developed from the internal events CDF sequences. The sequences have been mapped to the radiological release end states (i.e. source term release to environment). The MPS3 PRA model has been developed with an appropriate level of detail to effectively characterize risk for this application. All technical elements of the PRA model have been peer reviewed consistent with ASME/ANS RA-Sa-2009, as endorsed by RG.1.200, Revision 2.

Unresolved Peer Review Findings/Unmet Supporting Requirements, Key PRA Model Assumptions and Uncertainties that could significantly impact the risk calculations, as well as pending changes to the PRA, were each assessed and dispositioned with respect to this application as discussed in Attachment 3, Enclosure A. Therefore, the MPS3 PRA model is considered acceptable for use to assess the risk impact of extending the MPS3 containment ILRT surveillance interval to 15 years.

4.6.3 Summary ~f Plant-Specific Risk Assessment Results Based on the risk assessment results and the sensitivity calculations detailed in Attachment 3, the following conclusions regarding the assessment of the plant risk are associated with extending the Type A ILRT test frequency to 15 years.

• Reg. Guide 1.174 provides guidance for determining the risk impact of plant-specific changes to the licensing basis. Reg. Guide 1.174 defines very small changes in risk as resulting in increases of CDF below 1.0E-06/yr and increases in LERF below 1.0E-07/yr and small changes in risk as increases in LERF below 1.0E-06/yr. Since the ILRT extension was demonstrated to have no impact on CDF for MPS3, the relevant criterion is LERF. The increase in internal events LERF, which includes corrosion, resulting from a change in the Type A ILRT test frequency from three-per-ten years to one-per-fifteen years is conservatively estimated as 2.59E-08/yr (see Table 5.6-1 of Attachment 3) using the EPRI guidance as written. As such, the estimated change in internal events LERF is determined to be "very small" using the acceptance guidelines of Reg. Guide 1.174. The increase in LERF including both internal and external events is estimated as 1.53E-07/yr (see Table 5.7-2 of Attachment 3), which is considered a "small" change in LERF using the acceptance guidelines of Reg. Guide 1.174.

• Reg. Guide 1.174 also states that when the calculated increase in LERF is in the range of 1.0E-06 per reactor year to 1.0E-07 per reactor year, applications will be considered only if it can be reasonably shown that the total LERF is less than 1.0E-05 per reactor year. Although the total increase in LERF for internal and external events is greater than 1.0E-7 per reactor year, the total LERF can be demonstrated to be well below 1 .OE-5 per reactor year. The total base LERF for internal and external events is approximately 8.21 E-07/yr based on Table 5.7-2 of Attachment 3.

Given that the increase in LERF for the fifteen-year ILRT interval is 1.53E-07/yr for internal and external events from Table 5. 7-2 of Attachment 3, the total LERF for the

Serial No.19-211 Docket No. 50-423 Attachment 1, Page 22 of 26 fifteen-year interval can be estimated as 9.74E-07/yr. This is well below the RG 1.174 acceptance criteria for total LERF of 1.0E-05/yr.

• The change in dose risk for changing the Type A test frequency from three-per-ten years to one-per-fifteen years, measured as an increase to the total integrated dose risk for all accident sequences, is 5.75E-2 person-rem/yr or 4.2% of the total population dose using the EPRI guidance with the base case corrosion case from Table 5.6-1 of Attachment 3. EPRI TR-1018243 states that a very small population dose is defined as an increase of ::; 1.0 person-rem per year or ::; 1 % of the total population dose, whichever is less restrictive for the risk impact assessment of the extended ILRT intervals. Moreover, the risk impact when compared to other severe accident risks is negligible.

• The increase in the conditional containment failure frequency from the three-per-ten year frequency to one-per-fifteen year frequency is 0.92% using the base case corrosion case in Table 5.6-1 of Attachment 3. EPRI TR-1018243 states that increases in CCFP of ::; 1.5 percentage points are very small. Therefore, this increase is judged to be very small.

Therefore, increasing the ILRT interval to 15 years is considered to be acceptable since it represents a small change to the MPS3 risk profile. Details of the MPS3 risk assessment are contained in Attachment 3.

4.7 Conclusion NEI 94-01, Revision 3-A, and the limitations and conditions specified in NEI 94-01, Rev. 2-A, describe an NRG-accepted approach for implementing the performance-based requirements of 10 CFR 50, Appendix J, Option B. It incorporates the regulatory positions stated in RG 1.163 and includes provisions for extending Type A and Type C intervals to 15 years and 75 months, respectively. NEI 94-01, Revision 3-A delineates a performance-based approach for determining Type A, Type B, and Type C containment leakage rate surveillance test frequencies. DENC is adopting the guidance of NEI 94-01, Revision 3-A, and the limitations and conditions specified in NEI 94-01, Rev. 2-A, for use in the MPS3 10 CFR 50, Appendix J testing program.

Based on the previous ILRT tests conducted at MPS3, DENC concludes that extension of the containment ILRT interval from 10 to 15 years represents minimal risk to increased leakage. The risk is minimized by continued Type B and Type C testing performed in accordance with Option B of 10 CFR 50, Appendix J and inspection activities performed as part of the MPS3 IWE/IWL ISi program.

This conclusion is supplemented by the risk analysis provided in Attachment 3 and the PRA technical adequacy provided in Attachment 3, Er)closure A. The findings of the MPS3 risk assessment confirm, on a plant-specific basis, that extending the ILRT interval from 10 to 15 years results in a small change to the MPS3 risk profile.

Serial. No.19-211 Docket No. 50-423 Attachment 1, Page 23 of 26

5.0 REGULATORY ANALYSIS

5.1 Applicable Regulatory Requirements/Criteria The proposed change has been evaluated to determine whether applicable regulations and requirements continue to be met.

10 CFR 50.54(0) requires primary reactor containments for water-cooled power reactors to be subject to the requirements of Appendix J to 10 CFR 50, "Leakage Rate Testing of Containment of Water Cooled Nuclear Power Plants." Appendix J specifies containment leakage testing requirements, including the types required to ensure the leak-tight integrity of the primary reactor containment and systems and components which penetrate the containment. In addition, Appendix J discusses leakage rate acceptance criteria, test methodology, frequency of testing and reporting requirements for each type of test. RG 1.163 was developed to endorse NEI 94-01 with certain modifications and additions.

The adoption of Option B performance-based containment leakage rate testing for Type A testing did not alter the basic method by which Appendix* J leakage rate testing is performed; however, it did alter the frequency at which Type A, Type B, and Type C containment leakage tests must be performed. Under the performance-based option of 10 CFR 50, Appendix J, the test frequency is based on evaluation of "as-found" leakage history to determine the frequency for leakage testing which provides assurance that leakage limits will be maintained. The change to the Type A test frequency did not directly result in an increase in containment leakage. Similarly, the proposed change to the Type A test frequency will not directly result in an increase in containment leakage.

NEI 94-01, Revision 3-A, and the limitations and conditions specified in NEI 94-01, Rev. 2-A, describe an approach for implementing the performance-based requirements of 10 CFR 50, Appendix J, Option B. The document incorporates the regulatory positions stated in RG 1.163 and includes provisions for extending Type A and Type C intervals to 15 years and 75 months, respectively. NEI 94-01, Revision 3-A, delineates a performance-based approach for determining Type A, Type B, and Type C containment leakage rate test frequencies. In the SEs issued by NRC letters dated June 25, 2008 and June 8, 2012, the NRC concluded that NEI 94-01, Revisions 2 and 3, describe an acceptable approach for implementing the optional performance-based requirements of 10 CFR 50, Appendix J, and is acceptable for referencing by licensees proposing to amend their TS in regards to containment leakage rate testing, subject to the limitations and conditions, noted in Section 4.0 of the SEs.

EPRI TR-1009325, Revision 2, provides a risk impact assessment for optimized Integrated Leak Rate Test (ILRT) intervals up to 15 years, utilizing current industry performance data and risk informed guidance. NEI 94-01, Revision 3, states that a plant-specific risk impact assessment should be performed using the approach and* methodology described in TR-1009325, Revision 2, for a proposed extension of the ILRT interval to 15 years. In the safety evaluation (SE) issued by NRC letter June 25, 2008, the NRC concluded that the methodology in EPRI TR-1009325, Revision 2, is acceptable for referencing by licensees proposing to amend their TS to extend the ILRT surveillance interval to 15 years, subject to the limitations and conditions noted in Section 4.2 of that SE.

Serial No.19-211 Docket No. 50-423 Attachment 1, Page 24 of 26 Based on the considerations above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will continue to be conducted in accordance with the site licensing basis, and (3) the approval of the proposed change will not be inimical to the common defense and security or to the health and safety of the public.

In conclusion, DENG has determined that the proposed change does not require any exemptions or relief from regulatory requirements, other than the TS, and does not affect conformance with any regulatory requirements/criteria.

5.2 No Significant Hazards Consideration A change is proposed to the Millstone Power Station Unit 3 (MPS3), Technical Specification 6.8.4.f, "Containment Leakage Rate Testing Program." The proposed amendment would replace the reference to Regulatory Guide (RG) 1.163 with a reference to Nuclear Energy Institute (NEI) topical report NEI 94-01, Revision 3-A, and the limitations and conditions specified in NEI 94-01, Rev. 2-A as the implementing documents used by Dominion Energy Nuclear Connecticut, Inc. (DENG) to develop the MPS3 performance-based leakage testing program in accordance with Option B of 10 CFR 50, Appendix J.

The proposed amendment would allow DENC to extend the interval for the primary containment integrated leak rate test (ILRT), required by 10 CFR 50, Appendix J, from 10 years to 15 years and permit Type C testing to be performed at an interval of 75 months.

DENC has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below.

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed amendment involves changes to the MPS3 Containment Leakage Rate Testing Program. The proposed amendment does not involve a physical change to the plant or a change in the manner in which the plant is operated or controlled. The primary containment function is to provide an essentially leak tight barrier against the uncontrolled release of radioactivity to the environment for postulated accidents. As such, the containment and the testing requirements to periodically demonstrate the integrity of the containment exist to ensure the plant's ability to mitigate the consequences of an accident, and do not involve any accident precursors or initiators.

Therefore, the probability of occurrence of an accident previously evaluated is not significantly increased by the proposed amendment.

The proposed amendment adopts the NRC-accepted guidelines of NEI 94-01, Revision 3-A, and the limitations and conditions specified in NEI 94-01, Rev. 2-A, for development of

Serial No.19-211 Docket No. 50-423 Attachment 1, Page 25 of 26 the MPS3 performance-based leakage testing program. Implementation of these guidelines continues to provide adequate assurance that during design basis accidents, the primary containment and its components will limit leakage rates to less than the values assumed in the plant safety analyses. The potential consequences of extending the ILRT interval to 15 years have been evaluated by analyzing the resulting changes in risk. The increase in risk in terms of person-rem per year within 50 miles resulting from design basis accidents was estimated to be acceptably small and determined to be within the guidelines published in RG 1.174. Additionally, the proposed change maintains defense-in-depth by preserving a reasonable balance among prevention of core damage, prevention of containment failure, and consequence mitigation. DENC has determined that the increase in Conditional Containment Failure Probability due to the proposed change is very small.

Therefore, it is concluded that the proposed amendment does not significantly increase the consequences of an accident previously evaluated.

Based on the above discussion, it is concluded that the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed amendment adopts the NRC-accepted guidelines of NEI 94-01, Revision 3-A, and the limitations and conditions specified in NEI 94-01, Rev. 2-A, for development of the MPS3 performance-based leakage testing program, and establishes a 15-year interval for Type A testing and an interval of 75 months for Type C testing. The containment and the testing requirements to periodically demonstrate the integrity of the containment exist to ensure the plant's ability to mitigate the consequences of an accident; and do not involve any accident precursors or initiators. The proposed change does not involve a physical change to the plant (i.e., no new or different type of equipment will be installed) or a change to the manner in which the plant is operated or controlled.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

The proposed amendment adopts the NRC-accepted guidelines of NEI 94-01, Revision 3-A, and the limitations and conditions specified in NEI 94-01, Rev. 2-A, for the development of the MPS3 performance-based leakage testing program, and establishes a 15-year interval for Type A testing and an interval of 75 months for Type C testing. This amendment does not alter the manner in which safety limits, limiting safety s1ystem setpoints, or limiting conditions for operation are determined. The specific requirements and conditions of the Containment Leakage Rate Testing Program, as defined in the TS,

Serial No.19-211 Docket No. 50-423 Attachment 1, Page 26 of 26 ensure that the degree of primary containment structural integrity and leak-tightness that is considered in the plant's safety analysis is maintained. The overall containment leakage rate limit specified by the TS is maintained, and the Type A, Type B, and Type C containment leakage tests will be performed at the frequencies established in accordance with the NRG-accepted guidelines of NEI 94-01, Revision 3-A, and the limitations and conditions specified in NEI 94-01, Rev. 2-A.

Containment inspections performed in accordance with other plant programs serve to provide a high degree of assurance that the containment will not degrade in a manner that is not detectable by an ILRT. A risk assessment using the current MPS3 PRA model concluded that extending the ILRT test interval from 10 years to 15 years results in a small change to the MPS3 risk profile.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, DENC concludes that the proposed amendment presents no significant hazards consideration under the standards set forth in 10 CFR 50. 92(c) and, accordingly, a finding of "no significant hazards consideration" is justified.

5.3 Environmental Consideration The proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluent that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

6.0 PRECEDENCE This request is similar in nature to the license amendments approved by the NRC on July 3, 2014, for Surry Power Station Units 1 and 2 (ADAMS Accession Number ML14148A235), on June 16, 2015, for North Anna Power Station Units 1 and 2 (ADAMS Accession Number ML15133A381 ), and on September 25, 2018, for Millstone Unit 2 (ADAMS Accession Number ML18246A007).

Serial No.19-211 Docket No. 50-423 ATTACHMENT 2

/

Marked-Up Technical Specification Page DOMINION ENERGY NUCLEAR CONNECTICUT, INC.

MILLSTONE POWER STATION UNIT 3

Serial No.19-211 Docket No. 50-423 Attachment 2, Page 1 of 1 ADMINISTRATIVE CONTROLS llEI 94-01. Re,iision 3-A, "lndust,y Guideline for

======================tlmp!ementing Perfonnance-Based Option of 10 CFR Perl 50. Appendix J," dated July 2012 and lhe limitations end ccn<flllons specifted in NEI 94-01.

PROCEDURES AND PROGRAMS (Continued)

Revision 2*A. daled October 2008.

2) Pre-planned operating procedures and backup instmmentation to be used if*

one or more monitoring instruments become inoperable, and

3) Administrative procedures for returning inoperable instruments lo OPERABLE status as soon as practicable.

f. Containment Leakage Rate *resting Program A program shall be established to implement the leakage rate testing of the containment as required by 10 CFR 50.54(o) and l OCFR 50, Appendix J, Opti 1 B, a~ modified by approved exemptions*. This program shall be in accordance with the guide! incs contained in Ile15ulttlm J' G1:1i!le 1.163, "Perfsrr,1anee Bm1et:I Cofllftitlffleat Leak Tust Pi*egmm, ., oote!I Septemh.>>- 1995, as mo!lifiea ay the

~ *

• r ., ~

• b  ! * ~

19 Grit Pttfl: 58 Apr,etu!L; J". The HI'S! 'l)pe .\ lest perEirnfletl. ttfl.er >>ie Jannet)' 6, 1998 Ty11e A test shttll lla perfeFH1e!l 11e later tl1a11 .J1Hu11uy 6, 3Ql3.

• 111c peak calculated containment internal pressure for the design basis loss of coolant accident, Pa, is 41. 9 psig. ,,f' 11le maxinium allowable containment leakage rate Ld, at P 8 , shall be 0.3 percent by weight of the containment air per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

Leakage rate acceptance criteria are:

I) Containment overall leakage rate acceptance criterion is S 1.0 L8

• During the .first unit startup following testing in accordance with this program, the leakage rate accept:mcc criteria arc< 0.60 l-a for the combined Type Band lype C tests, and$ 0.06 L,. for all penetrations that are Secondary Containment bypass leakage paths, ru1d < 0.75 L0 for Type A tests;

2) Air lock testing acceptance criteria are:

a. Overall air lock leakage rate is$ 0.05 La when tested at 2: Pa*

b. For each door, seal leakage rate is < 0.0 I 1-d when pressurized to.: I\.

1l1e provisions of Specification 4.0.2 do not apply to the test frequencies specified in the Containment Leakage Rate Testing Program.

The provisions of Specification 4.0.3 are applicable to the Containment Leakage Rate Testing Program.

• An exemption to Appendix J, Option A, paragraph IILD.2(b)(ii), of 10 CFR Part 50, as approved by the NRC on December 6, 1985.

MILLSTONE - UNIT 3 6-17 Amendment No. 69, +86, ~,--B-9,

~.~

Serial No.19-211 Docket No. 50-423 ATTACHMENT 3 Confirmatory Risk Impact Assessment for Permanent ILRT Extension to 1 Per 15 Years DOMINION ENERGY NUCLEAR CONNECTICUT, INC.

MILLSTONE POWER STATION UNIT 3

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 1 of 39 TABLE OF CONTENTS 1.0 PURPOSE OF ANALYSIS ................. ................... ,..... .'.......................................................... 2 1.1 Purpose .........................................................................................................................2 1.2 Background ...................................................................................................................2 1.3 Criteria ...........................................................................................................................3 2.0 METHODOLOGY .....................................................................................................................3 3.0 GROUND RULES ....................................................................................................................4 4.0 INPUTS ............................ :........................................................................................................5 4.1 General Resources Available ..............................................................................................5 4.2 Plant-Specific lnputs ..............................................................................................................9 4.3 Impact of Surveillance Extension on Failure Detection ................................................. 12 4.4 Impact of Surveillance Extension on Steel Liner Corrosion Detection .............................. 13 5.0 RESULTS ... ............................................................................................................................16 5.1 Step 1 - Quantify the Base-Line Risk in Terms of Frequency Per Reactor Year. ................. 18 5.2 Step 2 - Develop Plant-Specific Person-Rem Dose (Population Dose) ............................ 20 5.3 Step 3 - Evaluate Risk Impact of Surveillance Extension ............................................. 23 5.4 Step 4 - Determine the Change in Risk in Terms of Large Early Release Frequency ........ 27 5.5 Step 5 - Determine the Impact on the Conditional Containment Failure Probability ............ 28 5.6 Summary of Results ..............................................................................................................28 5.7 External Hazards Assessment .............................................................................................30 6.0 SENSITIVITIES ... ....................................................................................................................32 6.1 Sensitivity to Corrosion Impact Assumptions .......................................................................32 6.2 Sensitivity to PRA Model Uncertainties and Acceptability ............................................ 33

7.0 CONCLUSION

S .....................................................................................................................35

8.0 REFERENCES

........................................................................................................................36 ENCLOSURE A - PRA Acceptability

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 2 of 39 1.0 PURPOSE OF ANALYSIS 1.1 Purpose The purpose of this analysis is to provide an assessment of the risk associated with permanently extending the Type A integrated leak rate test (ILRT) interval from ten years to fifteen years for Millstone Power Station Unit 3 (MPS3). The risk assessment follows the guidelines from NEI 94-01, Revision 2-A [1], the methodology used in EPRI TR-104285 [2], the EPRI Risk Impact Assessment of Extended Integrated Leak Rate Testing

_Intervals [18], the NRC regulatory guidance on the use of Probabilistic Risk Assessment (PRA) findings and risk insights in support of a request for a plant's licensing basis as outlined in Regulatory Guide (RG) 1.174 [3], and the methodology used for Calvert Cliffs to estimate the likelihood and risk implications of corrosion-induced leakage of steel liners going undetected during the extended test interval [4]. The format of this document is consistent with the intent of the Risk Impact Assessment Template for evaluating extended integrated leak rate testing intervals provided in the October 2008 EPRI final report [18].

1.2 Background Revisions to 10CFR50, Appendix J (Option B) allow individual plants to extend the Integrated Leak Rate Test (ILRT) Type A surveillance testing frequency requirement from three-per-ten years to at least one-per-ten years. The revised Type A frequency is based on an acceptable performance history defined _as two consecutive periodic Type A tests at least 24 months apart in which the calculated performance leakage rate was less than limiting containment leakage rate of 1 La.

The basis for the current 10-year test interval is provided in Section 11.0 of NEI 94-01, Revision 0, and was established in 1995 during development of the performance-based Option B to Appendix J. Section 11.0 of NEI 94-01 states that NUREG-1493 [5],

"Performance-Based Containment Leak Test Program," provides the technical basis to.

support rulemaking to revise leakage rate testing requirements contained in Option B to Appendix J. The basis consisted of qualitative and quantitative assessments of the risk impact (in terms of increased public dose) associated with a range of extended leakage rate test intervals. To supplement the NRC's rulemaking basis, NEI undertook a similar study. The results of that study are documented in Electric Power Research Institute (EPRI) Research Project Report TR-104285 [2], "Risk Impact Assessment of Revised Containment Leak Rate Testing Intervals."

The NRC report on performance-based leak testing, NUREG-1493 [5], analyzed the effects of containment leakage on the health and safety of the public and the benefits realized from the containment leak rate testing. In that analysis, it was determined that for a representative PWR plant (i.e., Surry Power Station) containment isolation failures contribute less than 0.1 percent to the latent risks from reactor accidents. Consequently, it is desirable to confirm that extending the ILRT interval will not lead to a substantial increase in risk from containment isolation failures for MPS3.

Earlier ILRT frequency extension submittals have used the EPRI TR-104285 [2]

methodology to perform the risk assessment. In October 2008, EPRI TR-1018243 [18]

was issued to develop a generic methodology for the risk impact assessment for ILRT interval extensions to fifteen years using current performance data and risk informed

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 3 of 39 guidance, primarily NRC Regulatory Guide 1.174 [3]. This more recent EPRI document considers the change in population dose, large early release frequency (LERF), and containment conditional failure probability (CCFP), whereas TR-104285 considered only the change in risk based on the change in population dose. This ILRT interval extension risk assessment for MPS3 employs the EPRI TR-1018243 methodology, with the affected System, Structure, or Component (SSC) being the primary containment boundary.

1.3 Criteria The acceptance guidelines in RG 1.174 [3] are used to assess the acceptability of this permanent extension of the Type A test interval beyond that established during the Option B rulemaking of Appendix J. RG 1.174 defines very small changes in the risk-acceptance guidelines as increases in core damage frequency (CDF) less than 1.0E-06 per reactor year and increases in large early release frequency (LERF) less than 1.0E-07 per reactor year. An evaluation of the CDF impact in Section 5 confirms that the change in risk is bounded by the LERF impact, so the relevant criterion is the change in LERF. RG 1.174 also defines small changes in LERF as below 1.0E-06 per reactor year. RG 1.174 discusses defense-in-depth and encourages the use of risk analysis techniques to help ensure and show that key principles, such as the defense-in-depth philosophy, are met.

Therefore, the increase in the conditional containment failure probability (CCFP) is also calculated to help ensure that the defense-in-depth philosophy is maintained.

Regarding CCFP, changes of up to 1.1 % have been accepted by the NRC for requests for one-time extensions of ILRT intervals. Given this perspective and based on the guidance in EPRI TR-1018243 [18], a change in the CCFP of up to 1.5% (percentage point) is assumed to be "small".

In addition, the total annual risk (person rem/yr population dose) is examined to demonstrate the relative change in this parameter. While no acceptance guidelines for these additional figures of merit are published, examinations of NUREG-1493 and Safety Evaluation Reports (SER) for one-time interval extensions (summarized in Appendix G of EPRI TR-1018243 [18]) indicate a range of incremental increases in population dose that have been accepted -by the NRC. The range of incremental population dose increases is from :s;.0.01 to 0.2 person-rem/yr and/or 0.002 to 0.46% of the total accident dose. The total doses for the spectrum of all accidents (NUREG-1493 [5], Figure 7-2) result in health effects that are at least two orders of magnitude less than the NRC Safety Goal Risk.

Given these perspectives, a very small population dose is defined as an increase from the baseline interval (3 tests per 10 years) dose of :::;1.0 person-rem per year, or 1% of the total baseline dose, whichever is less restrictive for the risk impact assessment of the proposed extended ILRT interval. It is noted that the methodology used in the one-time ILRT interval extension requests assumed a large leak magnitude (EPRI class 3b) of 35La, whereas the methodology in EPRI TR-1018243 uses 100La. Therefore the dose rates assessed in this evaluation will be larger than those in previous submittals.

2.0 METHODOLOGY A simplified bounding analysis approach consistent with the EPRI approach is used for evaluating the change in risk associated with increasing the test interval to fifteen years

[18]. The analysis uses results from a Level 2 analysis of core damage scenarios from the

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 4 of 39 current MPS3 PRA analysis and subsequent containment responses resulting in various fission product release categories.

The six general steps of this assessment' are as follows:

1. Quantify the baseline risk in terms of the frequency of events (per reactor year) for each of the eight containment release scenario types identified in the EPRI report.

2. Develop plant-specific person-rem (population dose) per reactor year for each of the eight containment release scenario types from plant specific consequence analyses.

3. Evaluate the risk impact (i.e., the change in containment release scenario type ,

frequency and population dose) of extending the ILRT interval to one in fifteen years.

4. Determine the change in risk in terms of Large Early Release Frequency (LERF) in accordance with RG 1.174 [3] and compare with the acceptance guidelines of RG 1.174.

5. Determine the impact on the Conditional Containment Failure Probability (CCFP)

6. Evaluate the sensitivity of the results to assumptions in the liner corrosion analysis, external events, PRA Acceptability, and to the fractional contribution of increased large isolation failures (due to liner breach) to LERF.

Furthermore,

• Consistent with the other industry containment leak risk assessments, the MPS3 assessment uses LERF and delta LERF in accordance with the risk acceptance guidance of RG 1.174. Changes in population dose and conditional containment failure probability are also considered to show that defense-in-depth and the balance of prevention and mitigation is preserved.

• Containment overpressure is not credited in the ECCS NPSH calculations for MPS3

[31 ]. As a result, an extension of the ILRT interval does not result in an increase in CDF, and LERF is the only metric evaluated against RG 1.174 acceptance criteria.

• This evaluation for MPS3 uses ground rules and methods to calculate changes in risk metrics that are similar to those used in EPRI TR-1018243 [18], Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals.

3.0 GROUND RULES The following ground rules are used in the analysis:

• The MPS3 Level 1 and Level 2 internal events PRA models provide sufficiently representative results. This assumption has been verified in Section 6 by assessing and evaluating the cumulative impact of PRA technical adequacy gaps.

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 5 of 39

• It is appropriate to use the MPS3 internal events PRA model to describe the change in risk change attributable to the ILRT extension. It is reasonable to assume that the impact from the ILRT extension (with respect to percent increases in population dose) will not substantially differ if fire and seismic events were to be included in the calculations. This assumption has been verified by assessing and evaluating external hazards in Section 6.

• Dose results for the containment failures modeled in the PRA are contained in MPS3 calculation PRA02NQA-01895S3 (referred to as the dose results from the MPS3 SAMA analysis) [22].

• Accident classes describing radionuclide release end states are defined consistent with EPRI methodology [18] and are summarized in Section 4.2.

• The representative containment leakage for EPRI Accident Class 1 sequences is 1La. EPRI Accident Class 3 sequences account for increased leakage due to Type A inspection failures.

• The representative containment leakage for EPRI Accident Class 3a sequences is 1Ola based on the previously approved methodology performed for Indian Point Unit 3 [6, 7].

• The representative containment leakage for EPRI Accident Class 3b sequences is 1OOLa based on the guidance provided in EPRI TR-1018243 [18].

• The EPRI Accident Class 3b sequences can be conservatively categorized as LERF based on the previously approved methodology [6, 7].

• The impact on population doses from containment bypass scenarios is not altered by the proposed ILRT extension, but is accounted for in the EPRI methodology as a separate entry for comparison purposes. Since the containment bypass contribution to population dose is fixed, no changes on the conclusions from this analysis will result from this separate categorization.

• The reduction in ILRT frequency does not impact the reliability of containment isolation valves to close in response to a containment isolation signal.

• All of the calculations for this analysis were performed electronically using Microsoft Excel, which eliminates rounding error. As a result, hand calculations using the values in each table may yield slightly different results.

4.0 INPUTS This section summarizes the general resources available as input (Section 4.1) and the plant-specific resources required (Section 4.2).

4.1 General Resources Available Various industry studies on containment leakage risk assessment are briefly summarized in this section:

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 6 of 39

1. NUREG/CR-3539 [8]

2. NUREG/CR-4220 [9]

3. NUREG-1273 [1 O]

4. NUREG/CR-4330 [11]

5. EPRI TR-105189 [12]

6. NUREG-1493 [5]

7. EPRI TR-104285 [2]

8. Calvert Cliffs liner corrosion analysis [4]

9. EPRI TR-1018243 [18]

The first study is applicable because it provides one basis for the threshold that could be used in the Level 2 PRA for the size of containment leakage that is considered significant and is to be included in the model. The second study is applicable because it provides a basis of the probability for significant pre-existing containment leakage at the time of a core damage accident. The third study is applicable because it is a subsequent study to NUREG/CR-4220 that undertook a more extensive evaluation of the same database. The fourth study provides an assessment of the impact of different containment leakage rates on plant risk. The fifth study provides an assessment of the impact on shutdown risk from ILRT test interval extension. The sixth study is the NRC's cost-benefit analysis of various alternative approaches regarding extending the test intervals and increasing the allowable leakage rates for containment integrated and local leak rate tests. The seventh study is an EPRI study of the impact of extending ILRT and local leak rate test (LLRT) intervals on at-power public risk. The eighth study addresses the impact of age-related degradation of the containment liners on ILRT evaluations. Finally, the ninth study builds on the previous work and includes a recommended methodology and template for evaluating the risk associated with a permanent 15-year extension of the ILRT interval.

NUREG/CR-3539 [8]

Oak Ridge National Laboratory (ORNL) documented a study of the impact of containment leak rates on public risk in NUREG/CR-3539. This study uses information from WASH-1400 [14] as the basis for its risk sensitivity calculations. ORNL concluded that the impact of leakage rates on light water reactor (LWR) accident risks is relatively small.

NUREG/CR-4220 [9]

NUREG/CR-4220 is a study performed by Pacific Northwest Laboratories for the NRC in 1985. The study reviewed over two thousand licensee event reports (LER), ILRT reports and other related records to calculate the unavailability of containment due to leakage.

NUREG-1273 [10]

A subsequent NRC study, NUREG-1273, p~rformed a more extensive evaluation of the NUREG/CR-4220 database. This assessment noted that about one-third of the reported events were leakages that were immediately detected and corrected. In addition, this

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 7 of 39 study noted that local leak rate tests can detect "essentially all potential degradations" of the containment isolation system.

NUREG/CR-4330 [11 l NUREG/CR-4330 is a study that examined the risk impacts associated with increasing the allowable containment leakage rates. The details of this report have no direct impact on the modeling approach of the ILRT test interval extension, as NUREG/CR-4330 focuses on leakage rate and the ILRT test interval extension study focuses on the frequency of testing intervals. However, the general conclusions of NUREG/CR-4330 are consistent with NUREG/CR-3539 and other similar containment leakage risk studies:

" ... the effect of containment leakage on overall accident risk is small since risk is dominated by accident sequences that result in failure or bypass of containment."

EPRI TR-105189 [121 The EPRI study TR-105189 is useful to the ILRT test interval extension risk assessment because it provides insight regarding the impact of containment testing on shutdown risk.

This study contains a quantitative evaluation (using the EPRI ORAM software) for two reference plants (a BWR-4 and a PWR) of the impact of extending ILRT and LLRT test intervals on shutdown risk. The conclusion from the study is that a small but measurable safety benefit is realized from extending the test intervals.

NUREG-1493 [51 NUREG-1493 is the NRC's cost-benefit analysis for proposed alternatives to reduce containment leakage testing intervals and/or relax allowable leakage rates. The NRC conclusions are consistent with other similar containment leakage risk studies:

Reduction in ILRT frequency from 3 per 10 years to 1 per 20 years results in an "imperceptible" increase in risk Given the insensitivity of risk to the containment leak rate and the small fraction of leak paths detected solely by Type A testing, increasing the interval between integrated leak rate tests is possible with minimal impact on public risk.

EPRI TR-104285 [2]

Extending the risk assessment impact beyond shutdown (the earlier EPRI TR-105189 study), the EPRI TR-104285 study is a quantitative evaluation of the impact of extending ILRT and LLRT test intervals on at-power public risk. This study combined IPE Level 2 models with NUREG- 1150 Level 3 population dose models to perform the analysis. The study also used the approach of NUR_EG-1493 in calculating the increase in pre-existing leakage probability due to extending the ILRT and LLRT test intervals. EPRI TR-104285 uses a simplified Containment Event Tree to subdivide representative core damage frequencies into eight classes of containment response to a core damage accident:

1. Containment intact and isolated

2. Containment isolation failures dependent upon the core damage accident

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 8 of 39

3. Type A (lLRT) related containment isolation failures

4. Type B (LLRT) related containment isolation failures

5. Type C (LLRT) related containment isolation failures

6. Other penetration related containment isolation failures

7. Containment failures due to core damage accident phenomena

8. Containment bypass Consistent with the other containment leakage risk assessment studies, this study concluded:

" ... the proposed CLRT [containment leak rate tests] frequency changes would have a minimal safety impact. The change in risk determined by the analyses is small in both absolute and relative terms. For example, for the PWR analyzed, the change is about 0.04 person-rem per year ... "

Calvert Cliffs Response to Request for Additional Information Concerning the License Amendment for a One-Time Integrated Leakage Rate Test Extension [41 This submittal to the NRC describes a method for determining the change in likelihood, due to extending the ILRT, of detecting liner corrosion, and the corresponding change in risk. The methodology was developed for Calvert Cliffs i'n response to a request for additional information regarding how the potential leakage due to age-related degradation mechanisms was factored into the risk assessment for the ILRT one-time extension. The Calvert Cliffs analysis was performed for a concrete cylinder and dome and a concrete basemat, each with a steel liner. MPS3 has a similar type of containment, and the same methodology will be used in this risk impact assessment.

EPRl Report No. 1009325, Revision 2-A, Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals [18]

This report provides a risk impact assessment for the permanent extension of ILRT test intervals to fifteen years. This document provides guidance for performing plant-specific supplemental risk impact assessments and builds on the previous EPRI risk impact assessment methodology [2] and the NRC performance-based containment leakage test program [5], and considers approaches utilized in various submittals, including Indian Point 3 (and associated NRC SER) and Crystal River.

The approach included in this guidance document is used in the MPS3 risk impact assessment to determine the estimated increase in risk associated with the ILRT extension. This document includes the bases for the values assigned in determining the probability of leakage for the EPRI Class 3a and 3b scenarios in this analysis as described in Section 5.

Release Category Definitions Table 4.1-1 defines the accident classes used in the ILRT extension evaluation, which is consistent with the EPRI methodology [181. These containment failure classifications are

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 9 of 39 used in this analysis to determine the risk impact of extending the Containment Type A test interval as described in Section 5 of this report.

Table 4.1-1 EPRI/NEI Containment Failure Classifications EPRI Class EPRI Class Description Containment remains intact including accident sequences that do not lead to containment failure in the long term. The release of fission products (and 1

attendant consequences) is determined by the maximum allowable leakage rate values La, under Appendix J for that plant Containment isolation failures (as reported in the IPEs) include those accidents in 2

which there are a failure to isolate the containment.

Independent (or random) isolation failures include those accidents in, which the 3 pre-existing isolation failure to seal (i.e., provide a leak-tight containment) is not dependent on the sequence in progress.

Independent (or random) isolation failures include those accidents in which the pre-existing isolation failure to seal is not dependent on the sequence in 4 progress. This class is similar to Class 3 isolation failures, but is applicable to sequences involving Type B tests and their potential failures. These are the Type B-tested components that have isolated but exhibit excessive leakage.

Independent (or random) isolation failures include those accidents in which the 1 pre-existing isolation failure to seal is not dependent on the sequence in 5

progress. This class is similar to Class 4 isolation failures, but is applicable to sequences involving Type C tests and their potential failures.

Containment isolation failures include those leak paths covered in the plant test 6 and maintenance requirements or verified per in service inspection and testing (ISI/IST) program.

Accidents involving containment failure induced by severe accident phenomena.

7 Changes in Appendix J testing requirements do not impact these accidents.

Accidents in which the containment is bypassed (either as an initial condition or 8 induced by phenomena) are included in Class 8. Changes in Appendix J testing requirements do not impact these accidents.

4.2 Plant-Specific Inputs The plant-specific information used to perform the MPS3 ILRT Extension Risk Assessment includes the following:

• Internal events PRA model results [19]

• Source term category definitions and frequencies used in the Level 2 Model [19, 21]

• Source term category population dose within a 50-mile radius [22]

• External events PRA model results [25]

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 10 of 39 MPS3 Internal Events PRA Model The Level 1 and Level 2 PRA model that is used for MPS3 reflects the as-built, as-operated plant. The current internal events model (MPS3-R08) is a linked fault tree model. The model includes Internal Events and Internal Flood hazards. The model was quantified with the total Core Damage Frequency (CDF) of 2.78E-06/yr and Large Early Release Frequency (LERF) of 1.37E-07/yr [19].

MPS3 Source Term Category Frequencies The current Level 2 release category definitions were developed in notebook MPS3-LE.1 R4 [21]. The current source term category (STC) frequencies were developed from the plant damage state (PDS) frequencies calculated from the Level 1 and Level 2 PRA model

[19] and the relative contributions to CDF for the analyzed containment failure modes documented in MPS3-LE.1 [21]. Each of the source term categories is associated with a corresponding EPRI class, and the EPRI class frequencies are calculated by summing the associated source term category frequencies.

MPS3 Source Term Category Population Dose A plant-specific population dose was developed_ using MACCS2 for twelve source term categories (STC) in calculation PRA02NQA-01895S3 [22] for the SAMA analysis. The STC diagram has been revised since the IPE. The latest STC Diagram is documented in MPS3-LE.1 [21], and the number of STCs is 15. The dose results from PRA02NQA-01895S3 were correlated to the current STCs by associating end states in the current STC diagram with the release categories from the dose calculations.

• Release Category Definitions Table 4.2-1 below defines the MPS3 release categories and associates them with the EPRI accident classes used in the ILRT extension evaluation. These containment failure classifications are used in this analysis to determine the risk impact of extending the Containment Type A test interval as described in Section 5 of this report.

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 11 of 39 Table 4.2-1 MPS3 Release Category Definitions, Frequency, and Population Dose Source Person-.

Term Frequency (yr"1 ) 1 Rem 2 EPRI Class Description

• Category (SO mi) 1 7.06E-07 1.65E+04 1 No Containment Failure Containment Failure (Late),

2 O.OOE+OO 9.49E+05 7 Recirculation Spray Succeeds Containment Overpressure Failure 3 2.06E-09 6.52E+05 7 (Late), Recirculation Spray Failure (Late}

Containment Overpressure Failure 4 7.40E-07 6.52E+05 7 (Late), Total Spray Failure Containment Overpressure Failure 5 2.92E-07 6.52E+05 7 (Late) , Quench Spray Succeeds, Recirculation Spray Fails 6 3.48E-08 1.14E+04 7 Containment Melt-Through 7 3.73E-10 2.67E+06 2 Containment Isolation Failure (Small) 8 O.OOE+OO 2.67E+06 2 Containment Isolation Failure (Large)

In-Vessel Cooling Succeeds, 9 7.70E-07 l.65E+04 1 Containment Isolation Succeeds In-Vessel Cooling Succeeds, 10 O.OOE+OO 1.65E+04 2 Containment Isolation Failure (Large)

In-Vessel Cooling Succeeds, 11 O.OOE+OO 1.65E+04 2 Containment Isolation Failure (Small)

RHR ISLOCA (Offsite Dose Attenuated 12 6.54E-10 l.65E+04 8 by Flood in RHR room)

SI or Other ISLOCA (Dose Not 13 3.63E-10 l.01E+07 8 Attenuated) 14 2.30E-07 2.77E+06 8 SGTR (Large Release) 153 7.00E-09 2.77E+05 8 SGTR ("Not Large" Release)

CDF 2.78E-06 LERF l.37E-07

1. STC frequencies were calculated using the MPS3 Level 1 and Level 2 PRA and the MPS3-LE.1 Revision 5 notebook.

2. The population dose for each STC is based on the correlation of the current STCs to the population dose results from calculation PRA02NQA-01895S3 for the SAMA analysis.

3. The dose for STC 15 is assumed to be one-tenth of STC 14 since it is a non-LERF SGTR.

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 12 of 39 Using* the data in Table 4.2-1, the frequency and dose for the EPRI accident classes as they apply to Millstone 3 can be calculated. The frequency of each EPRI class is the sum of the associated STC frequencies, and the doses for classes 2, 7, and 8 are frequency weighted.

Table 4.2-2 Summary of Release Frequency and Population Dose Organized by EPRI Release Category Person-Rem EPRI Class Frequency (y(1) CDF Contribution (%)

(50 mi) 1 1 1.48E-06 l.65E+04 53.04%

2 3.73E-10 2.67E+06 0.01%

7 l.07E-06 6.31E+OS 38.42%

8 2.38E-07 2.70E+06 8.53%

1. Frequency weighted average across constituent Source Term Categories 4.3 Impact of Surveillance Extension on Failure Detection The ILRT can detect a number of component failures such as liner breach, failure of certain bellows arrangements and failure of some sealing surfaces, which can lead to leakage. The proposed ILRT test interval extension may influence the conditional probability of detecting these types of failures. To ensure that this effect is properly accounted for, the EPRI Class 3 containment failure classification, as defined in Table 4.1-1, is divided into two sub-classes: Class 3a and Class 3b, representing small and large leakage failures, respectively.

The probability of the EPRI Class 3a and 3b failures is determined consistent with the EPRI guidance [18]. For Class 3a, the probability is based on the maximum likelihood estimate of failure (arithmetic average) from the available data (i.e., 2 "small" failures in 217 tests leads to 2/217=0.0092). For Class 3b, Jeffrey's non-informative prior distribution is assumed for no "large" failures in 217 tests (i.e., 0.5/(217+1) = 0.0023).

The EPRI methodology [18] contains information concerning the potential that the calculated delta LERF values for several plants may fall above the "very small change" guidelines of the NRC regulatory guide 1.174 [3]. This information includes a discussion of conservatisms in the quantitative guidance for delta LERF. The EPRI report [18]

describes ways to demonstrate that, using plant-specific calculations, the delta LERF is smaller than that calculated by the simplified method.

The supplemental information states:

The methodology employed for determining LERF (Class 3b frequency) involves conservatively multiplying the CDF by the failure probability for this class (3b) of accident.

This was done for simplicity and to maintain conservatism. However, some plant-specific accident classes leading to core damage are likely to include individual sequences that

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 13 of 39 either may already (independently) cause a LE,RF or could never cause a LERF, and are thus not associated with a postulated large Type A containment leakage path (LERF).

These contributors can be removed from Class 3b in the evaluation of LERF by multiplying the Class 3b probability by only that portion of GDF that may be impacted by type A leakage.

The application of this additional guidance to the analysis for MPS3 would result in a reduction of the CDF applied to the Class 3a and Class 3b CDFs. However, the MPS3 risk assessment will conservatively forgo the application of this guidance and will apply the total CDF in the calculation of the Class 3a and 3b frequencies.

Consistent with the EPRI methodology [18], the change in the leak detection probability can be estimated by comparing the average time that a leak could exist without detection.

For example, the average time that a leak could go undetected with a three-year test interval is 1.5 years (3 yr / 2), and the average time that a leak could exist without detection for a ten-year interval is 5 years (10 yr/ 2). This change would lead to a non-detection probability that is a factor of 3.33 (5.0/1.5) higher for the probability of a leak that is detectable only by ILRT testing. Correspondingly, an extension of the ILRT interval to fifteen years can be estimated to lead to about a factor of 5.0 (7.5/1.5) increase in the non-detection probability of a leak.

It should be noted that using the methodology discussed above is very conservative compared to previous submittals (e.g., the Indian Point Unit 3 request for a one-time ILRT extension that was approved by the NRC [7]) because it does not factor in the possibility that the failures could be detected by other tests (e.g., the Type B local leak rate tests that will still occur.) Eliminating this possibility conservatively over-estimates the factor increases attributable to the ILRT extension.

4.4 Impact of Surveillance Extension on Steel Liner Corrosion Detection An estimate of the likelihood and risk implications of corrosion-induced leakage of the steel liners occurring and going undetected during the extended test interval is evaluated using the methodology from the Calvert Cliffs liner corrosion analysis [4]. The Calvert Cliffs analysis was performed for a concrete cylinder and dome and a concrete basemat, each with a steel liner. MPS3 has a similar type of containment.

The following approach is used to determine the change in likelihood, due to extending the ILRT, of detecting corrosion of the containment steel liner. This likelihood is then used to determine the resulting change in risk. Consistent with the Calvert Cliffs analysis, the following issues are addressed:

• Differences between the containment basemat and the containment cylinder and dome

• The historical steel liner flaw likelihood due to concealed corrosion

• The impact of aging

• The corrosion leakage dependency on containment pressure

• The likelihood that visual inspections will be effective at detecting a flaw

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 14 of 39 Assumptions

• Consistent with the Calvert Cliffs analysis, a half failure is assumed for basemat concealed liner corrosion due to the lack of identified failures.

• The two corrosion events used to estimate the liner flaw probability in the Calvert Cliffs analysis are assumed to be applicable to the MPS3 containment analysis.

These events, one at North Anna Unit 2 and one at Brunswick Unit 2, were initiated from the non-visible (backside) portion of the containment liner. It is noted that four additional events have occurred in recent years (based on a data search covering approximately 9 years documented in Reference [28] and covering approximately 5 years in Reference [30]). In November 2006, the Turkey Point 4 containment building liner developed a hole when a sump pump support plate was moved. In May 2009, a hole approximately 3/8" by 1" in size was identified in the Beaver Valley 1 containment liner. In October 2010, an area 4" by 32" was found to be significantly degraded, including through-wall damage, in the Turkey Point 3 containment liner. In October 2013, a 0.40" by 0.28" through-wall hole was identified in the Beaver Valley 1 containment liner. For risk evaluation purposes, these four more recent events occurring over a 14-year period are judged to be adequately represented by the two events in the 5.5-year period of the Calvert Cliffs analysis incorporated in the EPRI guidance. (See Table 4.4-1, Step 1.)

• Consistent with the Calvert Cliffs analysis, the estimated historical flaw probability is also limited to 70 steel-lined containments and 5.5 years to reflect the years since September 1996 when 10 CFR 50.55a started requiring visual inspection to the time the Calvert Cliffs liner corrosion analysis was performed. Additional success data was not used to limit the aging impact of this corrosion issue, even though inspections were being performed prior to this date (and have been performed since the time frame of the Calvert Cliffs analysis), and there is no evidence that additional corrosion issues were identified. (See Table 4.4-1, Step 1.)

• Consistent with the Calvert Cliffs analysis, the steel liner flaw likelihood is assumed to double every five years. This is based solely on judgment and is included in this analysis to address the increased likelihood of corrosion as the steel liner ages.

(See Table 4.4-1, Steps 2 and 3.) Sensitivity studies are included that address doubling this rate every ten years and every two years.

• In the Calvert Cliffs analysis, the likelihood of the containment atmosphere reaching the outside atmosphere given that a liner flaw exists was estimated as 1.1 % for the cylinder and dome and 0.11 % (10% of the cylinder failure probability) for the bas,emat. These values were determined from an assessment of the probability versus containment pressure, and the selected values are consistent with a pressure that corresponds to the ILRT target pressure of 64.7 psia. [4] For MPS3, the containment failure probabilities are less than these values at 64.7 psia.

Conservative probabilities of 1% for the cylinder and dome and 0.1 % for the basemat are used in this analysis, and sensitivity studies are included that increase and decrease the probabilities by an order of magnitude. (See Table 4.4-1, Step 4.)

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 15 of 39

• Consistent with the Calvert Cliffs analysis, the likelihood of leakage escape (due to crack formation) in the basemat region is considered to be less likely than the containment cylinder and dome region. (See Table 4.4-1, Step 4.)

• Consistent with the Calvert Cliffs analysis, a 5% visual inspection detection failure likelihood given the flaw is visible and a total detection failure likelihood of 10% is used. To date, all liner corrosion events have been detected through visual inspection. (See Table 4.4-1, Step 5.) Sensitivity studies are included that evaluate total detection failure likelihood of 5% and 15%, respectively.

• Consistent with the Calvert Cliffs analysis, all non-detectable containment failures are assumed to result in early releases. This approach avqids a detailed analysis of containment failure timing and operator recovery actions.

Table 4.4-1 Steel Liner Corrosion Base Case

. step ** Description Containme.nt Walls

• Contain'rri~nt Basemat'

I Events: 0 Historical Steel Liner Events: 2 1 (assume 0.5 failures)

Flaw Likelihood 2/(70

• 5.5) = 5.2E-3 0.5/(70

• 5.5) = l.3E-3 Ve.ar * '. Failure Rate Vear

• F~ilure .Rate 2 Age-Adjusted Steel 1 2.05E-03 1 5.13E-04 Liner Flaw Likelihood 2 . 2.36E-03 2 5.89E-04 3 2.71E-03 3 6.77E-04 4 3.llE-03 4 7.77E-04 5 3.57E-03 5 8.93E-04 6 4.lOE-03 6 1.03E-03 7 4.71E-03 7 l.18E-03 8 5.41E-03 8 1.35E-03 6.22E-03 9

- 9 1.55E-03 10 7.14E-03 10 1.79E-03 11 8.21E-03 11 2.05E-03 12 9.43E-03 12 2.36E 0 03 13 1.08E-02 13 2.71E-03 14 1.24E-02 14 3.llE-03 15 1.43E-02 15 3.57E-03 3 Flaw Likelihood at 3, 1 to 3 years 0.71% 1 to 3 years 0.18%

10, and 15 years 1 to 10 years 4.14% 1 to 10 years 1.0.3%

1 to 15 years 9.66% 1 to 15 years 2.41%

)

4 Likelihood of Breach in Containment Given 1.0% 0.10%

Steel Liner Flaw

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 16 of 39 5 Detection Failure 10% 100%

Likelihood I

6 Likelihood of Non- 3 years 0.00071% 3 years 0.00018%

Detected 0.71%

• 1.0%

• 10% 0.18%

• 0.1%

• 100%

Containment Leakage 10 years 0.00414% 10 years 0.00103%

4.14%

• 1.0%

• 10% 1.03%

• 0.1%

• 100%

15 years 0.00966% 15 years 0.00241%

9.66%

• 1.0%

• 10% 2.41%

• 0.1%

• 100%

The total likelihood of the corrosion-induced, non-detected containment leakage is the sum of Step 6 for the containment cylinder and dome and the containment basemat as summarized below for MPS3.

Total Likelihood of Non-Detected Containment Leakage Due To Corrosion for MPS3:

At 3 years: 0.00071 % + 0.00018% = 0.00089%

At 10 years: 0.00414% + 0.00103% = 0.00517%

At 15 years: 0.00966% + 0.00241 % = 0.01207%

The above factors are applied to CDF scenarios, and the result is added to the Class 3b frequency in the corrosion sensitivity studies.

5.0 RESULTS The application of the approach based on the EPRI guidance [18] has led to the following results. The results are displayed according to the eight accident classes defined in the EPRI report. Table 5.0-1 lists these accident classes.

The analysis performed examined MPS3-specific accident sequences in which the containment remains intact or the containment is impaired. Specifically, the categorization of the severe accidents contributing to risk was considered in the following manner:

• Core damage sequences in which the containment remains intact initially and in the long term (EPRI TR-104285 Class 1 sequences).

• Core damage sequences in which containment integrity is impaired due to random isolation failures of plant components other than those associated with Type B or Type C test components. For example, liner breach or bellows leakage. (EPRI Class 3 sequences).

• Core damage sequences in which containment integrity is impaired due to containment isolation failures of pathways left "opened" following a plant post-maintenance test (e.g., a valve failing to close following a valve stroke test). (EPRI Class 6 sequences). Consistent with the EPRI guidance, this class is not specifically examined since it will not significantly influence the results of this analysis.

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 17 of 39

• Accident sequences involving containment bypassed (EPRI Class 8 sequences),

large containment isolation failures (EPRI Class 2 sequences), and small containment isolation "failure-to-seal" events (EPRI Class 4 and 5 sequences) are accounted for in this evaluation as part of the baseline risk profile. However, they are not affected by the ILRT frequency change.

• Class 4 and 5 sequences are impacted by changes in Type B and C test intervals; therefore, changes in the Type A test interval do not impact these sequences.

Table 5.0-1 EPRI Accident Classes EPRI Accident Class Description 1 No Containment Failure 2 Large Isolation Failures (Failure to Close) 3a Small Isolation Failures (liner breach}

3b Large Isolation Failures (liner breach) 4 Small Isolation Failures (Failure to seal -Type B) 5 Small Isolation Failures (Failure to seal-Type C}

6 Other Isolation Failures (e.g., dependent failures) 7 Failures Induced by Phenomena (Early and Late) 8 Bypass (Interfacing System LOCA and Steam Generator Tube Rupture)

CDF Sum of all accident class frequencies (including very low and no release)

The steps taken to perform this risk assessment evaluation are as follows:

Step 1: Quantify the base-line risk in terms of frequency per reactor year for each of the eight accident classes presented in Table 5.0-1.

Step 2: Develop plant-specific person-rem dose (population dose) per reactor year for each of the eight accident classes.

Step 3: Evaluate the risk impact of extending Type A test interval from three to fifteen and ten to fifteen years.

Step 4: Determine the change in risk in terms of Large Early Release Frequency (LERF) in accordance with RG 1.174.

Step 5: Determine the impact on the Conditional Containment Failure Probability (CCFP).

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 18 of 39 5.1 Step 1 - Quantify the Base-Line Risk in Terms of Frequency Per Re~ctor Year As previously described, the extension of the Type A interval does not influence those accident progressions that involve large containment isolation failures, Type B or Type C testing, or containment failure induced by severe accident phenomena.

For the assessment of ILRT impacts on the risk profile, the potential for pre-existing leaks is included in the model. These events are represented by the Class 3 sequences in EPRI TR-104285. Two failure modes were considered for the Class 3 sequences. These are Class 3a (small breach) and Class 3b (large breach).

The frequencies for the severe accident classes defined in Table 5.0-1 were developed for MPS3 by first determining the frequencies for Classes 1, 2, 7 and 8 using the categorized sequences and the identified correlations shown in Table 4.2-2, determining the frequencies for Classes 3a and 3b, and then determining the remaining frequency for Class 1. Furthermore, adjustments were made to the Class 3b and hence Class 1 frequencies to account for the impact of undetected corrosion of the steel liner per the methodology described in Section 4.4.

Class 1 Sequences Tliis group consists of all core damage accident progression bins for which the containment remains intact (modeled as Technical Specification Leakage). The frequency per year is initially determined from the Level 2 Source Term Categories 1 and 9 listed in Table 4.2-1, which is 1.48E-06/yr. With the inclusion of the EPRI 3a and 3b classes, the EPRI Class 1 frequency will be reduced by the EPRI Class 3a and 3b frequencies.

Class 2 Sequences This group consists of all core damage accident progression bins for which a failure to isolate the containment occurs. The frequency per year for these sequences is obtained from the Level 2 Source Term Categories 7, 8, 10 and 11 listed in Table 4.2-1, which is 3.73E-10/yr.

Class 3 Sequences This group consists of all core damage accident progression bins for which a pre-existing leakage in the containment structure (e.g., containment liner) exists. The containment leakage for these sequences can be either small (in excess of design allowable but <1 Ola) or large (>100La).

• The respective frequencies per year are determined as follows:

PR0Bc1ass_3a = probability of small pre-existing containment liner leakage

= 0.0092 [see Section 4.3]

PROBc1ass_3b = probability of large pre-existing containment liner leakage

= 0.0023 [see Section 4.3J As described in Section 4.3, the total CDF will be conservatively applied to these failure probabilities in the calculation of the Class 3 frequencies.

Class 3a = 0.0092

• CDF

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 19 of 39

= 0.0092

• 2.78E-06/yr

= 2.57E-08/yr Class 3b = 0.0023

• CDF

= 0.0023

• 2.78E-06/yr

= 6.39E-09/yr For this analysis, the associated containment leakage for Class 3A is 1Ola and for Class 38 is 1OOLa. These assignments are consistent with the guidance provided in EPRI TR-1018243. .

Class 4 Sequences This group consists of all core damage accident progression bins for which containment isolation failure-to-seal of Type B test components occurs. Because these failures are detected by Type B tests which are unaffected by the Type A ILRT, this group is not evaluated any further in the analysis.

Class 5 Sequences This group consists of all core damage accident progression bins for which a containment isolation failure-to-seal of Type C test components. Because the failures are detected by Type C tests which are unaffected by the Type A ILRT, this group is not evaluated any further in this analysis.

Class 6 Sequences This group is similar to Class 2. These are sequences that involve core damage accident progression bins for which a failure-to-seal containment leakage due to failure to isolate the containment occurs. These sequences are dominated by misalignment of containment isolation valves following a test/maintenance evolution. Consistent with guidance provided in EPRI TR-1018243, this accident class is not explicitly considered since it has a negligible impact on the results.

Class 7 Sequences This group consists of all core damage accident progression bins in which containment failure induced by severe accident phenomena occurs (e.g., overpressure). For this analysis, the frequency is determined from Release Categories 2 through 6 from the Level 2 results in Table 4.2-1, and the result is 1.0?E-06/yr.

Class 8 Sequences This group consists of all core damage accident progression bins in which containment bypass occurs. For this analysis, the frequency is determined from Release Categories 12 through 15 from the Level 2 results in Table 4.2-1, and the result is 2.38E-07/yr.

Summary of Accident Class Frequencies In summary, the accident sequence frequencies that can lead to radionuclide release to the public have been derived consistent with the definitions of accident classes defined in EPRI TR-1018243. Table 5.1-1 summarizes these accident frequencies by accident class for MPS3.

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 20 of 39 Table 5.1-1 Accident Class Frequencies EPRI Frequency Description Class (y(l) 1 No Containment Failure 1.44E-06 2 Large Containment Isolation Failures (Failure to Close) 3.73E-10 3a Small Isolation Failures (Type A Test) 2.57E-08 3b Large Isolation Failures (Type A Test) 6.39E-09 4 Small Isolation Failure (Type B test) N/A 5 Small Isolation Failure (Type C test) N/A 6 Containment Isolation Failures (personnel errors) N/A 7 Severe Accident Phenomena Induced Failure 1.07E-06 8 Containment Bypassed 2.38E-07 CDF All CET End States (including intact case) 2.78E-06 5.2 Step 2 - Develop Plant-Specific Person-Rem Dose (Population Dose)

Plant-specific release analyses were performed to estimate the person-rem doses to the population within a 50-mile radius from the plant. The releases are based on information contained in calculation PRA02NQA-01895S3 [22] for the MPS3 SAMA analysis, the MPS3-LE.1 R4 notebook [21], and the MPS3 one-time ILRT extension [23]. Calculation PRA02NQA-01895S3 contains the dose results in Sieverts for the release categories that were evaluated in the SAMA analysis. The LE.1 notebook [21] is used to associate the STCs from the current STC diagram with the release categories used during the SAMA analysis. The results of applying these releases to the EPRI containment failure classification are as follows:

Class 1 = 1.65E+04 person-rem (at 1.0La)(1l Class 2 = 2.67E+06 person-rem(2l Class 3a = 1.65E+04 person-rem x 1Ola= 1.65E+05 person-rem(3)

Class 3b = 1.65E+04 person-rem x 1OOLa = 1.65E+06 person-rem( 3l Class 4 = Not analyzed Class 5 = Not analyzed Class 6 = Not analyzed Class 7 = 6.31 E+05 person-rem(4 )

Class 8 = 2.70E+06 person-rem( 5l

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 21 of 39 (1) The Class 1 dose is assigned from the frequency weighted dose for release categories resulting in no containment failure.

(2) The Class 2 dose is assigned from the frequency weighted dose for release categories resulting in containment isolation failure.

(3) The Class 3a and 3b dose are related to the leakage rate as shown. This is consistent with the guidance provided in EPRI TR-1018243.

(4) The Class 7 dose is assigned from frequency weighted dose for release categories resulting in containment failure.

(5) Class 8 sequences involve containment bypass failures; as a result, the person-rem dose is not based on normal containment leakage. The dose for this class is assigned from the frequency weighted dose for release categories resulting in containment bypass.

In summary, the population dose estimates derived for use in the risk evaluation per the EPRI methodology [18] containment failure classifications are provided in Table 5.2-1.

Table 5.2-1 Accident Class Population Dose EPRI Description Dose (Person-Rem)

Class 1 No Containment Failure 1.65E+04 2 Large Containment Isolation Failures (Failure to Close) 2.67E+06 3a Small Isolation Failures (Type A Test) 1.65E+05 3b Large Isolation Failures (Type A Test) 1.65E+06 4 Small Isolation Failure (Type B test) N/A 5 Small Isolation Failure (Type C test) N/A 6 Containment Isolation Failures (personnel errors) N/A 7 Severe Accident Phenomena Induced Failure 6.31E+05 8 Containment Bypassed 2.70E+06 The above dose estimates, when combined with the results presented in Table 5.1-1, yield the MPS3 baseline mean consequence measures for each accident class. These results are presented in Table 5.2-2.

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 22 of 39 Table 5.2-2 Accident Class Frequency and Dose Risk for 3-per-10 Year ILRT Frequency Base Case (3 per 10 years)

Without Corrosion With Corrosion Dose EPRI Class Description Frequency Person- Frequency Person- Change in (Person-Rem)

(y(l) Rem/yr (y(l) Rem/yr Person-Rem/yr 1 No Containment Failure 1.65E+04 1.44E-06 2.38E-02 1.44E-06 2.38E-02 -4.09E-07 Large Containment Isolation Failures 2 2.67E+06 3.73E-10 9.95E-04 3.73E-10 9.95E-04 O.OOE+OO (Failure to Close) 3a Small Isolation Failures (Type A Test) 1.65E+05 2.57E-08 4.23E-03 2.57E-08 4.23E-03 O.OOE+OO 3b Large Isolation Failures (Type A Test) 1.65E+06 6.39E-09 1.0SE-02 6.41E-09 1.06E-02 4.09E-05 Severe Accident Phenomena Induced 7 6.31E+05 1.07E-06 6.75E-01 1.07E-06 6.75E-01 O.OOE+OO Failure 8 Containment Bypass 2.70E+06 2.38E-07 6.41E-01 2.38E-07 6.41E-01 O.OOE+OO Total Sum of All Accident Class Results -- 2.78E-06 1.36E+OO 2.78E-06 1.36E+OO 4.0SE-05

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 23 of 39 Table 5.2-3 shows how the new Class 3b frequency was calculated to account for a corrosion-induced containment leak for the 3 per 10 years ILRT frequency.

Table 5.2-3 Corrosion Impact on Class 3b Frequency for 3-per-10 year ILRT Frequency Metric Result ILRT Frequency 3 per 10 Years Likelihood of Corrosion-Induced Leak (Section 4.4) 8.89E-06 Core Damage Frequency 2.78E-06/yr Increase in LERF (Leak Prob* CDF) 2.48E-11/yr Class 3B Frequency 6.39E-09/yr New Class 3B Frequency 6.41E-09/yr 5.3 Step 3 - Evaluate Risk Impact of Surveillance Extension The next step is to evaluate the risk impact of extending the test interval from its current ten-year value to fifteen years. To do this, an evaluation must first be made of the risk associated with the ten-year interval since the. base case applies to a three-year interval (i.e., a simplified representation of a three-per-ten interval).

Risk Impact Due to 10-year Test Interval As previously stated, Type A tests impact only Class 3 sequences. For Class 3 seq*uences, the release magnitude is not impacted by the change in test interval (a small or large breach remains the same, even though the probability of not detecting the breach increases). Thus, only the frequency of Class 3a and 3b sequences is impacted. The risk contribution is changed based on the EPRI guidance as described in Section 4.3 by a factor of 3.33 compared to the base case values. The results of the calculation for a 10-year interval are presented in Table 5.3-1.

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 24 of 39 Table 5.3-1 Accident Class Frequency and Dose Risk for 1-per-10 Year ILRT Frequency 10-Year Interval (1 per 10 years)

Without Corrosion With Corrosion Dose EPRI Class Description Frequency Person- Frequency Person- Change in (Person-Rem)

(y(l) Rem/yr (y(l) Rem/yr Person-Rem/yr

• 1 No Containment Failure l.65E+04 l.37E-06 2.26E-02 l.37E-06 2.26E-02 -2.38E-06 Large Containment Isolation Failures 2 2.67E+06 3.73E-10 9.95E-04 3.73E-10 9.95E-04 O.OOE+OO (Failure to Close) 3a Small Isolation Failures (Type A Test) l.65E+05 8.54E-08 l.41E-02 8.54E-08 l.41E-02 O.OOE+OO 3b Large Isolation Failures (Type A Test) l.65E+06 2.13E-08 3.SlE-02 2.14E-08 3.53E-02 2.38E-04 Severe Accident Phenomena Induced 7 6.31E+OS l.07E-06 6.75E-01 l.07E-06 6)SE-01 O.OOE+OO Failure 8 Containment Bypass 2.70E+06 2.38E-07 6.41E-01 2.38E-07 6.41E-01 O.OOE+OO Total Sum of All Accident Class Results -- 2.78E-06 1.39E+OO 2.78E-06 1.39E+OO 2.35E-04

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 25 of 39 Table 5.3-2 shows how the new Class 3b frequency was calculated to account for a corrosion-induced containment leak for the one-per-ten years ILRT frequency.

Table 5.3-2 Corrosion Impact on Class 3b Frequency for 1-per-10 year ILRT Frequency Metric Result ILRT Frequency 1 per 10 Years Likelihood of Corrosion-Induced Leak (Section 4.4) 5.17E-05 Core Damage Frequency 2.78E-06/yr Increase in LERF (Leak Prob* CDF) 1.44E-10/yr Class 3B Frequency 2.13E-08/yr New Class 3B Frequency 2.14E-08/yr Risk Impact Due to 15-Year Test Interval The risk contribution for a 15-year interval is calculated in a manner similar to the 10-year interval. The difference is in the increase in probability of leakage in Classes 3a and 3b.

For this case, the value used in the analysis is a factor of 5.0 compared to the 3-year interval value, as described in Section 4.3. The results for this calculation are presented in Table 5.3-3.

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 26 of 39 Table 5.3-3 Accident Class Frequency and Dose Risk for l-per-15 Year ILRT Frequency 15-Year Interval (1 per 15 years)

.. ** Dose Without Corrosion With Corrosion

.EP~I Cl~ss ?

J)escrip:tion_

. *""; . ~~. _,,.*

.(P~rson- Frequel')CY. Person- - Frequency Person-. Cha!'lge in ,

- Rem) (yf1) Rem/yr (yr*1 f Rem/yr Person-R~m/yr 1 No Containment Failure l.65E+04 l.32E-06 2.17E-02 l.32E-06 2.17E-02 -5.SSE-06 Large Containment Isolation Failures 2 2.67E+06 3.73E-10 9.95E-04 3.73E-10 9.95E-04 O.OOE+OO (Failure to Close) 3a Small Isolation Failures (Type A Test) l.GSE+OS l.28E-07 2.12E-02 l.28E-07 2.12E-02 O.OOE+OO 3b Large Isolation Failures (Type A Test) 1.65E+06 3.19E-08 5.27E-02 3.23E-08 5.32E-02 5.SSE-04

'Severe Accident Phenomena Induced -

7 6.31E+OS l.07E-06 6.75E-01 l.07E-06 6.75E-01 O.OOE+OO Failure 8 Containment Bypass_ 2.70E+06 2.38E-07 6.41E-01 2.38E-07 6.41E-01 O.OOE+OO Total Sum of All Accident Class Results -- 2.78E-06 l.41E+OO 2.78E-06 l.41E+OO 5.49E-04

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 27 of 39 Table 5.3-4 shows how the new Class 3b frequency was calculated to account for a corrosion-induced containment leak for the 1-per-15 years ILRT frequency.

Table 5.3-4 Corrosion Impact on Class 3b Frequency for 1-per-15 year ILRT Frequency Metric Result ILRT Frequency 1 per 15 Years Likelihood of Corrosion-Induced Leak (Section 4.4) 1.21E-04 Core Damage Frequency 2.78E-06/yr Increase in LERF (Leak Prob* CDF) 3.36E-10/yr Class 3B Frequency 3.19E-08/yr New Class 3B Frequency 3.23E-08/yr 5.4 Step 4 - Determine the Change in Risk in Terms of Large Early Release Frequency The risk increase associated with extending the ILRT interval involves the potential that a core damage event that normally would result in only a small radioactive release from an intact containment could in fact result in a larger release due to the increase in probability of failure to detect a pre-existing leak. With strict adherence to the EPRI guidance, 100%

of the Class 3b contribution would be considered LERF.

Regulatory Guide 1.174 provides guidance for determining the risk impact of plant-specific changes to the licensing basis. RG 1.174 defines very small changes in risk as resulting in increases of core damage frequency (CDF) below 1.0E-06/yr and increases in LERF below 1.0E-07/yr, and small changes in LERF as below 1.0E-06/yr. Because the ILRT does not impact CDF, the relevant metric is LERF.

For MPS3, 100% of the frequency of Class 3b sequences can be used as a very conservative first-order estimate to approximate the potential increase in LERF from the ILRT interval extension (consistent with the EPRI guidance methodology). Based on the original three-per-ten year test interval from Table 5.2-2, the Class 3b frequency is 6.39E-09/yr. Based on a ten-year test interval from Table 5.3-1, the Class 3b frequency is 2.13E-08/yr, and based on a fifteen-year test interval from Table 5.3-3, it is 3.19E-08/yr. Thus, the increase in the overall probability of LERF due to Class 3b sequences that is due to increasing the ILRT test interval from three per ten years to one per fifteen years is 2.55E-08/yr. Similarly, the increase due to increasing the interval from ten to fifteen years is 1.07E-08/yr. As can be seen, even with the conservatisms included in the evaluation (per the EPRI methodology), the estimated change in LERF is below the threshold criteria for a very small change in accordance with RG 1.174.

If the effects due to liner corrosion are included in the fifteen-year interval results, the Class 3b frequency becomes 3.23E-08/yr as shown in Table 5.3-3. Conservatively neglecting the impact of steel liner corrosion on the Class 3b frequency for the three per ten and ten-year intervals, the change in LERF associated with the fifteen-year interval

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 28 of 39 including the effects of steel liner corrosion is 2.59E-08/yr compared to the three per ten year interval and 1.1 OE-08/yr compared to the ten-year interval. This is an increase in LERF of 3.36E-10/yr from the fifteen-year interval results without corrosion. These results indicate that the impact due to steel liner corrosion is very small, and the estimated change in LERF is below the threshold criteria for a very small change in accordance with RG1.174.

5.5 Step 5 - Determine the Impact on the Conditional Containment Failure Probability Another parameter that the NRC guidance in RG 1.174 states can provide input into the decision-making process is the change in the conditional containment failure probability (CCFP). The change in CCFP is indicative of the effect of the ILRT on all radionuclide releases, not just LERF. The CCFP can be calculated from the results of this analysis.

One of the difficult aspects of this calculation is providing a definition of the "failed containment." In this assessment, the CCFP is defined such that containment failure includes all radionuclide release end states other than the intact state, given that core damage occurs.

The change in CCFP can be calculated by using the method specified in the EPRI TR-1018243. The NRC has previously accepted similar calculations [7] as the basis for showing that the proposed change is consi~tent with the defense-in-depth philosophy.

CCFP = [1 - (Class 1 frequency+ Class 3a frequency)/ CDF]

• 100%

CCFP 3 = 47.19%

CCFP10 = 47.73%

CCFP1 5 = 48.11 %

L\CCFP3-To-1s =CCFP15 - CCFP3 =0.92%

L\CCFP10-ro-1s = CCFP1s - CCFP10 = 0.38%

The CCFP is also calculated for the fifteen-year interval to evaluate the impact of the steel liner corrosion impact on the ILRT extension. The steel liner corrosion effects will be conservatively neglected for the three per ten year and ten-year intervals, which will result in a greater change in CCFP.

CCFP1s+Corrosion = 48.12%

L\CCFP3-To-15+Corrosion =CCFP1s+Corrosion - CCFP3 = 0.93%

L\CCFP10-To-15+Corrosion = CCFP1s+Corrosion - CCFP10 = 0.40%

The change in CCFP of approximately 0.93% by extending the test interval to fifteen years from the original three-per-ten year requirement is judged to be insignificant.

5.6 Summary of Results The results from this ILRT extension risk assessment for MPS3 are summarized in Table 5.6-1.

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 29 of 39 TableS.6-1 Summary of Results for ILRT Frequency Extensions Base Case (3 per 10 years) 1 per 10 years 1 per 15 years Without Corrosion With Corrosion Without Corrosion With Corrosion Without Corrosion With Corrosion EPRI Class Freq. Pers.- Freq. Pers.~ Delta Freq. Pers.- Freq. Pers.- Delta . Freq. Pers.- Freq. Pers.- Delta (yr"l) Rem/yr (yr"l) Rem/yr PR/Y (yr'l) Rem/yr (yr-1) Rem/yr PR/Y (yr"l) . Rem/yr (yr"lf Rem/yr PR/V 1 1.44E-06 2.38E-02 1.44E-06 2.38E-02 -4.09E-07 1.37E-06 2.26E-02 1.37E-06 2.26E-02 -2.38E-06 1.32E-06 2.17E-02 1.32E-06 2.17E-02 -5.SSE-06 2 3.73E-10 9.95E-04 3.73E-10 9.95E-04 O.OOE+OO 3.73E-10 9.95E-04 3.73E-10 9.95E-04 O.OOE+OO 3.73E-10 9.95E-04 3.73E-10 9.9SE-04 O.OOE+OO 3A 2.57E-08 4.23E-03 2.57E-08 4.23E-03 O.OOE+OO 8.54E-08 l.41E-02 8.54E-08 1.41E-02 O.OOE+OO l.28E-07 2.12E-02 1.28E-07 2.12E-02 O.OOE+OO 3B 6.39E-09 1.0SE-02 6.41E-09 1.06E-02 4.09E-05 2.13E-08 3.SlE-02 2.14E-08 3.53E-02 2.38E-04 3.19E-08 5.27E-02 3.23E-08 5.32E-02 5.SSE-04 7 1.07E-06 6.75E-01 1.07E-06 6.75E-01 O.OOE+OO 1.07E-06 6.75E-01 1.07E-06 6.7SE-01 O.OOE+OO 1.07E-06 6.75E-01 1.07E-06 6.75E-01 0.00E+OO 8 2.38E-07 6.41E-01 2.38E-07 6.41E-01 O.OOE+OO 2 E-01 2.38E-07 6.41E-01 O.OOE+OO 2.38E-07 6.41E-01 2.38E-07 6.41E-01 O.OOE+OO Total 2.78E-06 l.36E+OO 2.78E-06 1.36E+OO 4.0SE-05 2.78E-06 1.39E+OO 2.78E-06 1.39E+OO 2.35E-04 2.78E-06 1.41E+OO 2.78E-06 1.41E+OO 5.49E-04 Delta 3.32E-02 3.34E-02 5.70E-02 S.75E-02 N/A N/A Dose 2.4% 2.5% 4.2% 4.2%

CCFP 47.19% 47.19% 47.73% 47.73% 48.11% 48.12%

Delta N/A N/A 0.53% 0.54% 0.92% 0.93%

CCFP Class 6.41E-09 2.14E-08 3.23E-08 3B 6.39E-09 2.13E-08 3.19E-08 2.48E-11 1.44E-10 3.36E-10 LERF 1.SOE-08 2.59E-08 Delta LERF From Base Case (3 per 10 years) 1.49E-08 2.SSE-08 l.44E-10 3.36E-10 1.lOE-08 Delta LERF From 1 per 10 years N/A 1.07E-08 3.36E-10

l. The delta dose is expressed as both change in dose rate (person-rem/year) from base dose rate and as% of base total dose rate.

2. The delta CCFP is calculated with respect to the base case CCFP.

3. The delta between the results with and without corrosion for each interval is shown as underlined below the results with corrosion.

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 30 of 39 5.7 External Hazards Assessment Since the acceptance criteria in RG 1.174 are intended for comparison with a full-scope assessment of risk including internal and external hazards, an analysis of the potential impact from external events is presented here. The MPS-ROB PRA model includes internal events and internal floods. The most recent external hazards probabilistic risk assessment performed for Millstone 3 is the Individual Plant Examination of External Events (IPEEE)

[25]. Use of the IPEEE analysis to assess external hazards is considered bounding for the purpose of assessing change in risk associated with extending the ILRT interval because the IPEEE does not account for safety improvements made to the as-built as-operated plant (such as FLOWSERV Reactor Coolant Pump seals, FLEX strategies, etc) nor state-of-the-art PRA methods developed after the IPEEE was published. These changes, if applied to the IPEEE, would tend to decrease the calculated external hazards CDF and reduce uncertainty in the calculation.

The IPEEE seismic risk analysis quantified a CDF impact by combining the seismic hazard frequencies with the fragilities of critical structures and components and the safety function unavailabilities to obtain a CDF. The CDF due to seismic events is 9.1 E-06/yr, with the dominant risk being seismic events that result in a loss of offsite power and failure of the Emergency Diesel Generator enclosures, or collapse of the control building.

The IPEEE fire risk analysis quantified a CDF impact by combining the frequency of fires and the probability of detection/suppression failure with the remaining safety function unavailabilities. A systematic approach was used to identify critical fire areas where fires could fail safety functions and pose an increased risk of core damage if other safety functions are unavailable. The CDF calculated due to fire is 4.BE-06/yr, with the dominant risk being fire in the cable spreading room, switchgear rooms, control room, and Charging/Component Cooling pump zone.

The risk of other external events such as external floods, high winds, aircraft accidents, hazardous materials and turbine missiles was assessed in the MPS3 IPEEE. The IPEEE assessments concluded that the risk of these accidents is negligible primarily due to the very low associated event frequencies, and the plant features designed to withstand such conditions. For example, reinforced concrete structures that provide missile protection during high wind conditions protect all critical safety functions.

An estimate of the total of all external hazards LERF for Millstone 3 is required in order to make the comparison to RG 1.174 acceptance criteria. The Millstone 3 IPEEE [25] did not evaluate LERF. It is assumed in this analysis that the ratio between LERF and CDF for external events is much lower than the ratio for internal events given that some internal event sequences, such as Interfacing System Loss of Coolant Accidents (ISLOCA) and Steam Generator Tube Ruptures (SGTR), contribute directly to LERF via containment bypass mechanisms. These sequences are not initiated nor generally result from external events. As a result, the same ratio between LERF and CDF for internal events will be used to calculate the LERF for external events in Table 5.7-1.

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 31 of 39 Table 5.7-1 External Events Base CDF and LERF LERF/CDF Hazard Group CDF (yr"1 ) LERF (yr" 1 )

Ratio Seismic 9.lOE-06 4.48E-07 4.92E-02 Internal Fire 4.80E-06 2.36E-07 4.92E-02 Total External Events l.39E-05 6.84E-07 Internal Events (inc. Flood) 2.78E-06 l.37E-07 Total All-Hazards l.67E-05 8.21E-07 The method chosen to account for external events contributions is similar to the approach used to calculate the change in LERF for the internal events using the guidance in EPRI TR-1018243 [18]. The Class 3b frequency for the internal events analysis was calculated by multiplying the total CDF by the probability of a Class 3b release. The same approach will be used for external events using the total external events CDF.

Table 5.7-2 shows the calculation of the base Class 3b frequency for internal and external events, the increased Class 3b frequency as a result of the ILRT interval extension, and the total change in LERF.

Table 5.7-2 Total LERF Increase for 15-year ILRT Interval Including External Hazards Class Class 3b Frequency (yr"1 )

Hazard CDF LERF Change in 3b 3 per 10 1 per 10 1 per 15 Group (yr"1) (yr"1) LERF (yr" 1 )

Prob year ILRT year ILRT year ILRT Internal Events 2.78E-06 1.37E-07 0.0023 6.39E-09 2.13E-08 3.19E-08 2.SSE-08 External Events l.39E-05 6.84E-07 0.0023 3.19E-08 l.06E-07 l.59E-07 l.28E-07 Total l.67E-05 8.21E-07 - 3.83E-08 l.27E-07 1.91E-07 1.53E-07 As with the internal events analysis, 100% of the frequency of Class 3b sequences can be used as a very conservative first-order estimate to approximate the potential increase in LERF from the ILRT interval extension (consistent with the EPRI guidance methodology).

Based on the total three-per-ten year test interval from Table 5.7-2, the Class 3b frequency is 3.83E-08/yr. Based on a ten-year test interval, it is 1.27E-07/yr, and based on a fifteen-year test interval, it is 1.91 E-07/yr. Thus, the increase in the overall probability of LERF due to Class 3b sequences that is due to increasing the ILRT test interval from three per ten years to once per fifteen years is 1.53E-07/yr.

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 32 of 39 Even with the conservatisms included in the evaluation (per the EPRI methodology), the estimated change in LERF is small according to RG 1.174 since it falls between 1.0E-07/yr and 1.0E-06/yr. In addition, the total LERF remains well below the Regulatory Guide 1.174 threshold of 1E-05 per year, thus the small change to LERF proposed in this application would be considered by NRC to be in region II of RG 1.174 acceptance guidelines.

6.0 SENSITIVITIES 6.1 Sensitivity to Corrosion Impact Assumptions The results in Tables 5.2-2, 5.3-1 and 5.3-3 show that including corrosion effects calculated using the assumptions described in Section 4.4 does not significantly affect the results of the ILRT extension risk assessment.

Sensitivity cases were developed to gain an understanding of the sensitivity of the results to the key parameters in the corrosion risk analysis. The time for the flaw likelihood to double was adjusted from every five years to every two and every ten years. The failure probabilities for the cylinder and dome were increased and decreased by an order of magnitude. The total detection failure likelihood was adjusted from 10% to 15% and 5%.

The results are presented in Table 6.1-1. In every case the impact from including the corrosion effects is minimal. Even the upper bound estimates with conservative assumptions for all of the key parameters yield increases in LERF due to corrosion of only 4.43E-08 /yr. The results indicate that even with conservative assumptions, the conclusions from the base analysis would not change.

Table 6.1-1 Steel Liner Corrosion Sensitivity Cases I

Increase in Class 3b Corrosion- Flaw Non Frequency (LERF) for Containment Induced Failure Detection ILRT Extension from 3-Breach Probability Acceleration rate Probability per-10 to 1-per-15

' Years (yr"1 )

Base Case Double/5 Years 1%/0.1% 10% 2.59E-08 Case 1 Double/2 Years Base Base 2.69E-08 Case 2 Double/10 Years Base Base 2.58E-08 Case 3 Base 0.1%/0.01% Base 2.56E-08 Case 4 Base 10%/1% Base 2.87E-08 Case 5 Base Base 5% 2.57E-08 Case 6 Base Base 15% 2.60E-08 Lower Bound Double/10 Years 0.1%/0.01% 5% 2.56E-08 Upper Bound Double/2 Years 10%/1% 15% 4.43E-08

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 33 of 39 6.2 Sensitivity to PRA Model Uncertainti.es and Acceptability Assessment of the sensitivity of this analysis to PRA model results is performed in three steps.

Step 1 The change in risk calculation for the ILRT surveillance frequency was iterated as a function of CDF. This sensitivity showed that the CDF could increase by a factor of 18 before challenging the acceptance criteria for this analysis (note that the limiting acceptance criteria was: change in dose of 1 person-rem/yr). Given the conservatisms in the methodology used to calculate change in dose this is considered to be very low sensitivity to the PRA input to the EPRI methodology.

Table 6.2-1 CDF Sensitivity Cases

%CDF Delta Dose CDF (yr"1 ) Delta LERF (yr"1 ) Delta Dose (%) Delta CCFP Increase (Person-Rem/yr) 0% 2.78E-06 2.SSE-08 5.70E-02 4.20% 0.92%

5% 2.92E-06 2.68E-08 5.98E-02 4.41% 0.92%

20% 3.34E-06 3.06E-08 6.84E-02 5.04% 0.92%

45% 4.04E-06 3.70E-08 8.26E-02 6.09% 0.92%

80% 5.0lE-06 4.60E-08 l.03E-01 7.56% 0.92%

125% 6.26E-06 5.75E-08 1.28E-01 9.45% 0.92%

180% 7.80E-06 7.lSE-08 1.59E-01 11.76% 0.92%

245% 9.60E-06 8.81E-08 1.97E-01 14.49% 0.92%

320% l.17E-05 1.07E-07 2.39E-01 17.64% 0.92%

405% 1.41E-05 1.29E-07 2.88E-01 21.21% 0.92%

500% 1.67E-05 1.53E-07 3.42E-01 25.20% 0.92%

605% 1.96E-05 1.80E-07 4.02E-01 29.61% 0.92%

720% 2.28E-05 2.09E-07 4.67E-01 34.44% 0.92%

845% 2.63E-05 2.41E-07 S.38E-01 39.69% 0.92%

980% 3.0lE-05 2.76E-07 6.lSE-01 45.37% 0.92%

1125% 3.41E-05 3.13E-07 6.98E-01 51.46% 0.92%

1280% 3.84E-05 3.52E-07 7.86E-01 57.97% 0.92%

1445% 4.30E-05 3.95E-07 8.BOE-01 64.90% 0.92%

1620% 4.79E-05 4.39E-07 9.80E-Ol 72.25% 0.92%

1805% 5.30E-05 4.87E-07 1.09E+OO 80.02% 0.92%

Step 2 The acceptability of the MPS3 PRA was reviewed in accordance with RG 1.174 and RG 1.200 R2 guidance. The details of this review are described in Enclosure A to this attachment. This review identified a number of PRA model Peer Review findings and deficiencies that were screened quantitatively using a sensitivity study approach in step 3 below.

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 34 of 39 Step 3 A single sensitivity study was performed to conservatively estimate the potential cumulative increase in CDF if PRA peer review findings, pending PRA model changes and key PRA assumptions and uncertainties identified in step 2 were resolved in the model.

The changes applied to the model to perform the cumulative sensitivity study include:

• Fault Tree changes to resolve or conservatively estimate the impact of unresolved issues and uncertainties

• A factor of 3 increase applied to all Human Failure Event Probabilities (including Dependent combinations) and offsite power non-recovery probabilities

• A factor of 3 increase applied to all unreliability probability estimates in the model including:

o Equipment failures o Equipment common cause failures o Test & Maintenance unavailabilities

• A factor of 3 increase applied to a number of modeled initiating event frequencies including:

o Loss of Main Feedwater o Loss of Offsite Power o Explicitly modeled support system initiators o Internal Flood Frequencies A small number of modeled events in the PRA model were then excluded from the factor of 3 increase based on a detailed review and manual inspection of PRA model which determined that the existing treatment in the MPS3 PRA model for these specific events was adequate. These events include:

o Auxiliary Feed Water Pump and _Emergency Diesel Generator Failure probabilities and Test & Maintenance unavailabilities o Loss of Function of 4160V Emergency/Bus Initiating event frequencies The PRA model was then requantified after making all of these changes in order to determine the CDF, which was determined to be 4.19E-05/yr. This is considered to be an extremely conservative estimate of CDF for Millstone 3 because very limited effort is made to limit or address conservative bias in the cumulative sensitivity study or apply detailed resolutions for identified findings. The calculated 4.19E-05/yr CDF from the cumulative sensitivity would meet acceptance criteria for this application as determined in Step 1.

Therefore, the conclusion of the cumulative sensitivity study for PRA Model Uncertainties and Acceptability is that the MPS3 PRA model is adequate to support this application.

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 35 of 39 7 .0 CONCLUSIONS Based on the results from Section 5 and the sensitivity calculations presented in Section 6, the following conclusions regarding the assessment of the plant risk are associated with extending the Type A ILRT test frequency to fifteen years:

• Reg. Guide 1.174 [3] provides guidance for determining the risk impact of plant-specific changes to the licensing basis. Reg. Guide 1.174 defines very small changes in risk as resulting in increases of CDF below 1.0E-06/yr and increases in LERF below 1.0E-07/yr and small changes in risk as increases in LERF below 1.0E-06/yr. Since the ILRT extension was demonstrated to have no impact on CDF for MPS3, the relevant criterion is LERF. The increase in internal events LERF, which includes corrosion, resulting from a change in the Type A ILRT test frequency from three-per-ten years to one-per-fifteen years is conservatively estimated as 2.59E-08/yr (see Table 5.6-1) using the EPRI guidance as written. As such, the estimated change in internal events LERF is determined to be "very small" using the acceptance guidelines of Reg. Guide 1.174. The increase in LERF including both internal and external events is estimated as 1.53E-07/yr (see Table 5.7-2),

which is considered a "small" change in LERF using the acceptance guidelines of Reg. Guide 1.174.

• Reg. Guide 1.174 [3] also states that when the calculated increase in LERF is in the range of 1.0E-06 per reactor year to 1.0E-07 per reactor year, applications will be considered only if it can be reasonably shown that the total LERF is less than 1.0E-05 per reactor year. Although the total increase in LERF for internal and external events is greater than 1.0E-7 per reactor year, the total LERF can be demonstrated to be well below 1.0E-5 per reactor year. The total base LERF for internal and external events is approximately 8.21 E-07/yr based on Table 5.7-2. Given that the increase in LERF for the fifteen-year ILRT interval is 1.53E-07/yr for internal and external events from Table 5. 7-2, the total LERF for the fifteen-year interval can be estimated as 9.74E-07/yr. This is well below the RG 1.174 acceptance criteria for total LERF of 1.0E-05/yr.

• The change in dose risk for changing the Type A test frequency from three-per-ten years to one-per-fifteen years, measured as an increase to the total integrated dose risk for all accident sequences, is 5.75E-2 person-rem/yr or 4.2% of the total population dose using the EPRI guidance with the base case corrosion case from Table 5.6-1. EPRI TR-1018243 [18] states that a very small population dose is defined as an increase of s; 1.0 person-rem per year ors; 1 % of the total population dose, whichever is less restrictive for the risk impact assessment of the extended ILRT intervals. Moreover, the risk impact when compared to other severe accident risks is negligible.

• The increase in the conditional containment failure frequency from the three-per-ten year frequency to one-per-fifteen year frequency is 0.92% using the base case corrosion case in Table 5.6-1. EPRI TR-1018243 [18] states that increases in

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 36 of 39 CCFP of :5 1.5 percentage points are very small. Therefore this increase is judged to be very small.

Therefore, increasing the ILRT interval to fifteen years is considered to be acceptable since it represents a small change to the MPS3 risk profile.

Previous Assessments The NRC in NUREG-1493 [5] has previously concluded that:

• Reducing the frequency of Type A tests (ILRTs) from three per 10 years to one per 20 years was found to lead to an imperceptible increase in risk. The estimated increase in risk is very small because ILRTs identify only a few potential containment leakage paths that cannot be identified by Type B and C testing, and the leaks that have been found by Type A tests have been only marginally above existing requirements.

• Given the insensitivity of risk to containment leakage rate and the small fraction of leakage paths detected solely by Type A testing, increasing the interval between integrated leakage rate tests is possible with minimal impact on public risk. The impact of relaxing the ILRT frequency beyond one in 20 years has not been evaluated. Beyond testing the performance of containment penetrations, ILRTs also test the integrity of the containment structure.

The findings for MPS3 confirm these general findings on a plant specific basis considering the severe accidents evaluated for MPS3, the MPS3 containment failure modes, and the local population surrounding MPS3 within 50 miles.

8.0 REFERENCES

[1] Industry Guideline for Implementing Performance-Based Option of 10 CFR Part 50, Appendix J, NEI 94-01 Revision 2-A, October 2008.

[2] Risk Impact Assessment of Revised Containment Leak Rate Testing Intervals, EPRI, Palo Alto, CA EPRI TR-104285, August 1994.

[3] An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Regulatory Guide 1.174 Revision 3, January 2018.

[4] Response to Request for Additional Information Concerning the License Amendment Request for a One-Time Integrated Leakage Rate Test Extension, Letter from Mr. C. H. Cruse (Calvert Cliffs Nuclear Power Plant) to NRC Document Control Desk, Docket No. 50-317, March 27, 2002.

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 37 of 39

[5] Performance-Based Containment Leak-Test Program, NUREG-1493, September 1995.

[6] Letter from R. J. Barrett (Entergy) ,to U.S. Nuclear Regulatory Commission, IPN 007, January 18, 2001.

[7] United States Nuclear Regulatory Commission, Indian Point Nuclear Generating Unit No. 3 - Issuance of Amendment Re: Frequency of Performance-Based Leakage Rate Testing (TAC No. MB0178), April 17, 2001.

[8] Impact of Containment Building Leakage on LWR Accident Risk, Oak Ridge National Laboratory, NUREG/CR-3539, ORNL/TM-8964, April 1984.

[9] Reliability Analysis of Containment Isolation Systems, Pacific Northwest Laboratory, NUREG/CR-4220, PNL-5432, June 1985.

[10] Technical Findings and Regulatory Analysis for Generic Safety Issue 11.E.4.3

'Containment Integrity Check', NUREG-1273, April 1988.

[11] Review of Light Water Reactor Regulatory Requirements, Pacific Northwest Laboratory, NUREG/CR-4330, PNL-5809, Vol. 2, June 1986.

[12] Shutdown Risk Impact Assessment for Extended Containment Leakage Testing Intervals Utilizing ORAM', EPRI, Palo Alto, CA TR-105189, Final Report, May 1995.

[13] Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants, NUREG-1150, December 1990.

[14] United States Nuclear Regulatory Commission, Reactor Safety Study, WASH-1400, October 1975.

[15] Letter from J.A. Hutton (Exelon, Peach Bottom) to U.S. Nuclear Regulatory Commission, Docket No. 50-278, License No. DPR-56, LAR-01-00430, dated May 30, 2001.

[16] Risk Assessment for Joseph M. Farley Nuclear Plant Regarding ILRT (Type A)

Extension Request, prepared for Southern Nuclear Operating Co. by ERIN Engineering and Research, P0293010002-1929-030602, March 2002.

[17] Letter from D.E. Young (Florida Power, Crystal River) to U.S. Nuclear Regulatory Commission, 3F0401-11, dated April 25, 2001.

[18] Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals, TR-1018243, Revision 2-A of 1009325, EPRI, Palo Alto, CA: 2008.

[19] PRA Model Notebook MPS3-QU.2 Revision 7, Model Quantification Results, Dominion Energy, Inc., Millstone Power Station, November 2018.

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 38 of 39

[20] NF-AA-PRA-101, Revision 7, Probabilistic Risk Assessment Procedures and Methods: Purpose, Organization, and Use, Dominion Energy, Inc., July 2015.

[21] PRA Model Notebook MPS3-LE.1 Revision 4, Level 2 Analysis, Dominion Energy, Inc., Millstone Power Station, August 2012.

[22] Calculation Number PRA02NQA-01895S3 Revision 2, MACCS2 Model for Millstone Unit 3 Level 3 Application, Dominion Resources Services, Inc., Millstone Power Station, January 2007.

[23] Calculation Number PRA06NQA-04178S3 Revision 2, Risk Impact Assessment of Extending Containment Type A Test Interval at Millstone 3, Dominion Resources Services, Inc., Millstone Power Station, December 2004.

[24] Not Used

[25] Individual Plant Examination of External Events, Millstone Power Station Unit 3, Northeast Utilities Service Company, December 1991.

[26] Not used

[27] Millstone 3 IPE, Millstone Nuclear Power Station, Unit No. 3, Response to Generic Letter 88-20, Individual Plant Examination for Severe Accident Vulnerabilities, Northeast Utilities Service Company, August 1990.

[28] Letter from P. B. Cowan (Exelon Generation Company, LLC) to U.S. Nuclear Regulatory Commission, "Response to Request for Additional Information - License Amendment Request for Type Test Extension", NRC Docket No. 50-277, May 2010.

[29] Not Used

[30] ML15034A353, Virginia Electric and Power Company Norlh Anna Power Station Units 1 and 2 Response to Request for Additional Information Proposed License Amendment Request Permanent Fifteen-Year Type A Test Interval, Letter from Virginia Electric Power Company to U.S. Nuclear Regulatory Commission, January 28, 2015.

[31] MILLSTONE POWER STATION UNIT 3 FINAL SAFETY ANALYSIS REPORT Chapter 6: Engineered Safety Features, Section 6.2.2.3.

[32] Not Used

[33] Not Used

[34] Focused Scope RG 1.200 PRA Peer Review Against the ASME/ANS PRA Standard Requirements for the Millstone Power Station Unit 3 Probabilistic Risk Assessment Revision 0, Science Applications International Corporation (SAIC), July 2012.

Serial No.19-211 Docket No. 50-423 Attachment 3, Page 39 of 39

[35] MILLSTONE NUCLEAR POWER STATION UNIT 3 PROBABILISTIC RISK ASSESSMENT PEER REVIEW REPORT, September 1999.

[36] PWROG-18064-P Revision 0, Focused-Scope Peer Review of the Millstone 3 Probabilistic Risk Assessment, March 2019.

[37] ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, 2009

[38] US Nuclear Regulatory Commission, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Regulatory Guide 1.200, Revision 2, March 2009.

[39] PRA Model Notebook MPS3-RA-023 Revision 0, Battery and Charger STIE, March 2019.

[40] PRA Model Notebook MPS3-A.1 Revision 4, Internal Events Model Self-Assessment, September 2012.

[41] NRC Letter to Mr. David A. Heacock, "Millstone Power Station, Unit No. 3- Issuance of Amendment RE: Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee Controlled Program, (Adoption of TSTF-425, Revision 3)", (TAC NO. ME9733), Accession Number ML14023A748.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A ENCLOSURE A Probabilistic Risk Assessment Acceptability DOMINION ENERGY NUCLEAR CONNECTICUT, INC.

MILLSTONE POWER STATION UNIT 3

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 1 of 87 Probabilistic Risk Assessment Acceptability The following demonstrates the quality and level of detail of the PRA model is acceptable. All technical elements of the PRA model described below have been peer reviewed consistent with ASME/ANS RA-Sa-2009, as endorsed by RG.1.200, Revision 2. Previously the NRC had reviewed the PRA technical adequacy for adoption of TSTF-425, Revision 3, "Relocate Surveillance Frequencies to Licensee Control - RITSTF Initiative 5b" [41] with routine maintenance updates applied. The model has been updated and has undergone a focused scope peer review since that submittal.

The PRA model used to analyze the risk of this application is referred to as MPS3-R08 [19]. This model was issued in November 2018. Millstone 3 PRA Model Notebook QU.2, Rev. 7 [19]

documents the quantification of the PRA model. This is the most recent evaluation of the MPS3 internal events at-power risk profile. The PRA model and associated documentation has been maintained as a living program, and the PRA data is updated approximately every 3 to 5 years to reflect the as-built, as-operated plant. This includes updating .the PRA to reflect the current plant configuration and to reflect the accumulation of additional plant operating history and component failure data. The MPS3-R08 PRA model has a high level of detail, including a wide variety of initiating events, modeled systems, operator actions, and common cause failure events. The PRA model quantification process for the MPS3 PRA uses a linked fault tree approach, which is a well-known methodology in the industry.

A.1 Scope of Risk Contributors Addressed by the Millstone 3 PRA The scope of the current MPS3 PRA model includes internal events and internal floods. External hazards such as internal fires, seismic, and others have been evaluated in the IPEEE [25].

A.2 Level of Detail of the Millstone 3 PRA Model The MPS3 PRA model has been developed with an appropriate level of detail to effectively characterize risk for this application. This conclusion is b,ased on the following:

• Results from Industry Peer Reviews against the full scope of RG 1.200 R2 ASME/ANS RA-Sa-2009 Standard requirements for internal events and internal flooding hazards, as discussed further in section A.6

• Cumulative PRA Adequacy assessment. discussed in Section 6. This assessment evaluates potential impact on this application with respect to o Unresolved Peer Review Findings/Unmet Supporting Requirements of ASME/ANS

' RA-Sa-2009/RG 1.200 R2 o Key PRA Model Assumptions and Uncertainties that could significantly impact the risk calculations o Pending changes to the PRA identified in Dominion's Probabilistic' Risk Assessment Configuration Control (PRACC) program

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 2 of 87 A.3 Portions of the Millstone 3 PRA Used to Support the Application All portions of the PRA model were used to support the risk assessment for this application since the methodology depends on the total GDF and source term category frequencies developed in the Level 2 PRA analysis.

A.4 PRA Maintenance and Data Updates Dominion PRA utilizes a Probabilistic Risk Assessment Configuration Control (PRACC) program that is described in procedures applicable to the Dominion fleet. The PRA Configuration Control program includes the following attributes:

• A process for monitoring PRA inputs and collecting new information

• A process that maintains and upgrades the PRA to be consistent with the as-built, as operated plant

• A process that ensures that the cumulative impact of pending changes is considered when applying the PRA

• Guidance for documentation of the PRA Maintenance and Upgrade process In addition, all computer codes used to support the PRA Configuration Control Program and perform PRA model quantification are controlled.

This PRACC process has been peer reviewed and satisfies configuration control requirements specified in section 1-5 of the ASME/ANS PRA standard. In accordance with this process, open items in Dominion's PRA Configuration control database were reviewed in order to ensure that the cumulative impact of pending changes to the PRA is considered in this evaluation.

A.5 Summary of the MPS3 PRA History The Level 1 and Level 2 MPS3 internal events PRA was originally known as the Plant Safety Study (PSS), and was developed by Westinghouse in the 1980s before the plant was licensed.

Over time, updates have been made to incorporate newer generic and plant-specific reliability and unavailability data, incorporate facility and procedure changes, improve the fidelity of the model, address Peer Review comments and support applications of the PRA such as Risk Monitor, Risk-Informed In-Service Inspection (RI-ISi), Maintenance Rule, and Mitigating System Performance Index (MSPI).

A summary of the MPS3 PRA history is as follows:

)

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 3 of 87 Table A.5-1 MPS3 Model Change History Date Model Change 1/84 Transfer of PSS technology from Westinghouse, the PSS contractor, to the licensee.

8/85 Published Millstone 3 risk evaluation report (NUREG-1152) 8/90 Submittal of IPE NRC staff evaluation report concludes IPE meets the intent of Generic Letter 88-20. The 5/92 report contains recommendations to explicitly model total loss of service water initiating event, ventilation dependency, and DC power dependency Model converted from support state to linked fault tree methodology. Ventilation 12/95 dependency explicitly modeled. DC power dependency explicitly modeled. Total loss of service water initiator modeled.

2/96 LERF model developed using original PSS model 9/99 Westinghouse Owner's Group peer review completed MSPI Model Update completed:

• plant specific data

• reliability: 01/01/2000-12/31/2004 2005

• unavailability: January, 2002 to December, 2004

• initiating events: 1990 to 12/31/2004

• addressed remaining A and B level peer review F&Os M308A Model Reliability & Unavailability data Update and revisions to address issues identified during 2007 2008 PRA model Self-Assessment. The improvements made to the model involved documenting sources of uncertainty/assumptions, systematic process for establishing CCF groups, updating and improving T/H analysis and success criteria documentation.

M310A Model Large scope update to prepare the model to receive focused scope peer review. Broad changes 2012 made across all technical elements to align the model to ASME/ANS PRA standard requirements. Also updated reliability & unavailability data incorporating plant specific data from January 2008 to December 2010.

Focused scope Science Applications International Corporation (SAIC) PRA Peer Review 2012 This peer review was a focused scope peer review performed to review model upgrades incorporated since the 1999 WOG peer review.

M310Aa Model 2016 Update and corrections to resolve issues important with respect to MSPI risk evaluations, including changes to the as-built, as-operated facility.

MPS3-R08 Model 2018 Minor update and corrections to the model, including revised documentation related to previous model changes during the M310Aa update Westinghouse Focused Scope Peer Review.

The scope of this peer review was selected to ensure that the MPS3 internal events and 2018 internal floods PRA model has received a peer review against the requirements of ASME/ ANS RA-Sa-2009 (RG 1.200 Revision 2) for all Supporting Requirements of the standard

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 4 of 87 A.6 Peer Reviews The Millstone 3 internal events and internal floods PRA model has been reviewed against all ASME/ANS RA-Sa-2009 PRA Standard Supporting Requirements [37] and the additional clarifications provided in RG 1.200 R2 [38].

The following discussion summarizes MPS3 PRA model review history:

1999 WOG PRA Peer Review In 1999, the MPS3 internal events PRA received a formal industry PRA peer review. The purpose of the PRA peer review process was to provide a method for establishing the technical quality of a PRA for the spectrum of potential risk informed plant licensing applications for which the PRA may be used. The PRA peer review process used a team composed of industry PRA consultants and utility peers, each with significant expertise in both PRA development and PRA applications. This review team provided both an objective review of the PRA technical elements and a subjective assessment, based on their PRA experience, regarding the acceptability of the PRA elements. This review was performed using the WOG implementation of the industry PRA peer review methodology as defined in NEI 00-02, "PRA.

Peer Review Process Guidance." The review team reviewed over 200 attributes of 11 different elements of the PRA. Reviewer questions or comments that could not be answered during the review were documented in Fact & Observation (F&O) forms and were categorized by level of significance as follows:

A- Extremely important, technical adequacy may be impacted 8- Important, but may be deferred to next model update C- Less important, desirable to maintain model flexibility and consistency with the industry D- Editorial, minor technical item S- Strength / Superior Treatment (no follow-up required)

The peer review is documented in the Westinghouse PRA peer review report [35]. Subsequent to the peer review, the model had been updated several times and F&Os were addressed during each model update. All F&Os identified during the 1999 WOG Peer Review have been addressed.

2007 MPS3 PRA Self-Assessment A self-assessment review of the MPS3 PRA against the ASME PRA Standard was performed by Dominion with the support of a contracting company, MARACOR, in late 2007 using guidance provided in NRC Regulatory Guide RG 1.200, revision 1, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results from Risk-Informed Activities". This self-assessment was documented and used as a planning guide for the M308A model update. [40]

• Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 5 of 87 2012 Focused Scope SAIC Peer Review [34]

In June 2012, Science Applications International Corporation (SAIC) performed a focused PRA peer review of model upgrades incorporated since the 1999 WOG peer review. The purpose of the PRA peer review is to assess whether PRA upgrades, as defined by the ASME/ANS (American Nuclear Society) PRA standard, meet the intent of Category II SRs.ln the course of this review, thirty-five (35) new Facts and Observations (F&Os) were prepared, including twenty (20) suggestions, fourteen (14) findings, and one (1) best practice. A review of all open Findings and their resolutions and/or their impact on the application is documented in Table A.7-1. The scope of the peer review is provided in Table A.6-1 below.

Table A.6-1 SR Scope of 2012 Focused SAIC Peer Review

• . :Techl1icc3L... ' ; ' ' fligh: l~y~I ~~quirertients*.: *, ./* Siippqrfing.Ri,qufr:~rn~hts~(SRs); ' ,.**

. Element *:* ... , ' *,: : , :  ;** . '(:a(Rs). , -: * * . . . . Ct>verecl*: . ,... ;,* * :

IE-C8, IE-C9, IE-ClO,

• IE HLR IE-C IE-Cll, IE-C14 HLR AS-A All AS HLR AS-8 All HLR AS-C All SC HLR SC-8 All SY-A6, SY-A8, SY-All, HLR SY-A SY SY-A14, SY-A18 HLR SY-8 SY-BS,SY-86,SY-87,SY-89,SY-810 HLR HR-C All HR HLR HR-D All HLR HR-G All HLR DA-8 All DA HLR DA-D DA-DS, DA-D6 LE All All IFPP All All IFSO All All IFSN All All IFEV All All IFQU All All

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 6 of 87 2018 Westinghouse Focused Scope Peer Review In 2018, Dominion Energy, Inc. contracted with Westinghouse to perform a focused scope peer review of the MPS3 PRA to determine compliance with Addendum A of the ASME/ANS PRA Standard and RG 1.200, Revision 2. [36]

The scope of this review included all supporting requirements in the following technical elements of Part 2 (Internal Events) of the PRA Standard:

• Initiating Event Analysis (IE)

• Success Criteria (SC)

• Systems Analysis (SY)

• Human Reliability Analysis (HR)

• Data Analysis (DA)

• Quantification (QU)

Only elements AS (Accident Sequence Analysis) and LE (LERF Analysis) in Part 2 of the PRA Standard were not reviewed. This is because these elements were considered previously reviewed during the 2012 SAIC Peer Review. In the course of this review, a total of 114 new Facts and Observations (F&Os) were generated, including 92 findings and 22 suggestions. A review of all open Findings and their resolutions and/or their impact on the application is documented in Table A.7-1.

A. 7 PRA Acceptability Review Introduction In the NRC safety evaluation (SE) report for Electric Power Research Institute (EPRI)

Technical Report (TR) 1009325, Revision 2, the NRC staff, in part, stated the following with respect to PRA technical adequacy requirements:

"Capability category I of ASME RA-Sa-2003 shall be applied as the standard, since approximate values of GDF and LERF and their distribution among release categories are sufficient for use in the EPRI methodology. Any identified deficiencies in addressing this standard shall be assessed! further in order to determine any impacts on any proposed decreases to surveillance frequencies."

Subsequent to NRC issuance of the SE for TR-1009325 Rev 2, NRC has issued Regulatory Guide 1.200 R2 as part of a phased approach to stabilizing the PRA quality expectations and requirements to achieve an appropriate level of PRA quality for NRC's risk-informed regulatory decision-making policy. See also SECY-04-0118 (ML041530099).

In this section, a detailed review of deficiencies with respect to ASME/ANS RA-Sa-2009 capability category II is performed to determine if these deficiencies impact this application.

This is in excess of TR-1009325, Revision 2 requirements. This simplification is being made because the MPS3 PRA model has generally not been reviewed against the requirements of

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 7 of 87 ASME RA-Sa-2003 and because more recent risk informed applications of the PRA have capability category II applied as the standard. This simplification, in part, has resulted in a relatively large quantity of peer review findings considered for impact in this detailed review.

This detailed assessment of identified PRA model deficiencies and uncertainties places emphasis on the NRG conclusion that "approximate values of GDF and LERF and their distribution among release categories are sufficient for use in the EPRI methodology". The

, evaluation performed in section 6 confirmed this NRG conclusion for MPS3. Given the conservatisms in the EPRI methodology and the plant specific sensitivity analysis which demonstrates that this application has very low sensitivity to PRA model results, the conclusion of the detailed PRA Acceptability review is that the MPS3 PRA model is acceptable to support ILRT surveillance extension. This conclusion is supported by the Westinghouse 2018 Peer Review Report [36], which concluded that:

"Overall, the MPS3 PRA was found to substantially meet the ASMEIANS PRA Standard, RA-Sa-2009 at Capability Category II.

For a number of the technical elements reviewed, the documentation was incomplete or had issues that did not facilitate the peer review and would make future updates and uses of this information more difficult. The findings and suggestions primarily pertain to. modeling details and to the clarity and completeness of documentation."

• PRA Acceptability review Table A.7-1 lists all of the open Peer Review F&Os of Finding significance from the 2012 and 2018 peer reviews that are considered OPEN against the MPS3 PRA model. Each finding has been assessed for impact on this application. In some cases the issue has been resolved in the model and therefore its impact was already considered in the change in risk evaluation for this application. Other findings have been assessed qualitatively for impact on this application.

Still other findings have been assessed by incorporation into a PRA acceptability cumulative impact sensitivity study described in Section 6. Unreviewed PRA model upgrades, and pending PRA model changes have been reviewed in a similar manner and discussed in Tables A.7-2 and A.7-3, respectively. PRA model uncertainties and assumptions have been reviewed and Key uncertainties and assumptions for this application have been identified in Table A.7-4.

Serial No.19-211

. Docket No. 50-423 Attachment 3, Enclosure A, Page 8 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC}

AS-A9-01 AS-A9 CC II Notebook AS-2 is not complete. Supporting analysis for RESOLVED (2012) several of the items identified as to be addressed in this The associated documentation Notebook has not been incorporated.

has been revised and this issue is considered resolved.

Possible Resolution Note: This finding was No possible resolution was provided by the 2012 peer intentiona'lly omitted from the review team.

MPS3 TSTF-425 LAR because it was considered resolved at that time.

AS-B6-01 AS-B6 Met No dependencies among various systems due to plant RESOLVED (2012) configuration and maintenance practices have been The associated documentation identified. Include a discussion in the accident sequence has been revised and this issue is notebook AS.l to state that no such dependencies are considered resolved.

applicable.

Note: This finding was Possible Resolution intentionally omitted from the MPS3 TSTF-425 LAR because it No possible resolution was provided by the 2012 peer was considered resolved at that review team.

time.

Serial No. 19-2-11 Docket No. 50-423 Attachment 3, Enclosure A, Page 9 of 87 Table A. 7-1 Disposition of OPEN Peer Review Findings Finding . Supporting* Capability Number Requirement (s) Category (CC)

Descrrption -Disposition for ILRT Extem,ion

• 4-5 DA-ClO NOT MET While the guidance in NF-AA-PRA-101-2061 states that Assessment with Sensitivitv (2018) these procedures should be reviewed to ensure the This finding has identified that demands/number of demands are accurate (Section the count of demands many be 3.2.4.i), there is no documentation that such a review was inaccurate, which can result in conducted. For instance the example in the standard of not underestimation of component crediting each EDG test as a test of the sequen~er was ynreliability. This deficiency was reviewed and the conclusion was that the sequencer assessed with the PRA demands in the MSP3 PRA are indeed based on the number acceptability aggregate impact of demands on the EDG.

sensitivity study, which multiplied component (This F&O originated from SR DA-C10}

unreliability estimates by a factor of 3. The results of the Possible Resolution cumulative sensitivity study demonstrate that the MPS3-R08 Review cited surveillance procedures to determine that all model is adequate to support counts are accurate. Pay close attention on components this application. Therefore, this that reference another component as the basis for the issue does not impact this counts. Document this review in a manner that supports application.

independent review and future updates.

23-4 DA-C13 CCI Assumption 7 in Notebook DA.6 states that MR Qualitative Assessment (2018) unavailability during shutdown was included which is This deficiency with respect to inconsistent with the SR as well as the PRA procedures.

removing plant specific unavailability during shutdown (This F&O originated from SR D/\-(13) overestimates the unreliability of plant systems. Therefore, this Possible Resolution issue does not impact this application Review unavailability events and remove any data from i' periods of plant shutdown.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 10 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC) 23-7 DA-Cl3 CC I Plant staff has not been interviewed to confirm estimates Assessment with Sensitivity

{2018) of unavailability where data does not exist. The impact of the potential underestimation of System (This F&O originated from SR DA-C13) unreliability was assessed with the PRA acceptability aggregate Possible Resolution impact sensitivity study, which multiplied component Interview plant staff to confirm estimated unavailability for unreliability estimates by a components for which data is not available or justify that factor of 3. The results of the these events are not significant. cumulative sensitivity study demonstrate that the MPS3-R08 model is adequate to support this application. Therefore, this issue does not impact this application.

23-3 DA-01 cc Ill Table 1 of Notebook SY.2 (systems assumptions) indicates Assessment with Sensitivity (2018) that the conditional probability of a PORV being challenged The impact ofthe potential (3PR0B-RC-PORV-CHALLENGED) is 0.077 and references underestimation of 3PR0B-RC-NotebookDA.4 for the development of this plant-specific PORV-C_HALLENGED was value. No documentation of this calculation could be found assessed with the PRA in NotebookDA.4. acceptability aggregate impact sensitivity study, which (This F&O originated from SR DA-Dl} substituted a value of 0.1 for this event. The results of the Possible Resolution cumulative sensitivity study demonstrate that the MPS3-R08 Document a basis for this conditional probability. If model is adequate to support applicable, consider this as a source of model uncertainty this application. Therefore, this given the importance of this basic event. issue does not impact this application.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 11 of 87 Table A.7-1 Disposition of OPEN Peer Review FindJngs Finding Supporting* Capability Description. Disposition for ILRT Extension Number Requirement (s) Category (CC) 23-1 DA-El Met Clarifications were required to interpret the plant specific Qualitative Assessment (2018) failure screening assessment to support SR DA-C4 during This deficiency adversely impacts the peer review. It was not clear that a simple 'No' in the the readability of the PRA model.

data spreadsheet meant that the failure was not related to It does not adversely affect the a PRA component rather than it had been dispositioned as PRA Quantification results.

not a PRA failure. Sometimes this detail was included and Therefore, this issue does not other times it was not.

impact this application (This F&O originated from SR DA-El)

Possible Resolution Add a new column to the assessment that indicates that a component is not modeled in the PRA or include that conclusion in the description so that it is clear.

23-2 DA-El Met The unavailability data from the station logs was Qualitative Assessment (2018) determined to be "manually collected by trained staff" but This deficiency adversely impacts the site stated that manual data collection has not been the Justification of the PRA retained for review. Although the guidance in NF-AA-PRA-model results. It does not 101-2063 for reviewing data is considered sufficient, there adversely affect the PRA is no d9cumentatiorf of the review to confirm it was Quantification results.

_correctly followed.

Therefore, this issue does not

- impact this application (This F&O originated from SR DA-El)

Possible Resolution Document the application of the criteria for I inclusion/exclusion outlined in the Dominion guidance to all activities identified requiring manual assessment over the data period. Confirm that the collected data complies with the referenced Dominion guidance.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 12 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings

, *Finding . Sqpportlng* '.* ' *:*Capability:' i '  : ,

Descri~tion Number* Requirement,{s) 'eafeg~ry (CC} ' ...

23-6 DA-El Met MPS3-DA.2 does.not document that no instances of Qualitative Assessment (2018) repeated failures over a short time occurred to confirm This deficiency adversely impacts that this was indeed addressed at the site level instead of the Justification of the PRA being not applicable to Millstone.

model results. It does not adversely affect the PRA (This F&O originated from SR DA-El)

Quantification results.

Therefore, this issue does not Possible Resolution impact this application Add a statement in MPS3-DA.2 that the data was reviewed and that the count was zero.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 13 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding- Supporting Capability Description DispositionJor ILRT Extension.

Number Requirement (s} Categoryc(CC) 3-1 HR-Al NOT MET A comprehensive review of procedures and practices to Assessment with Sensitivity

{2018) identify realignment of PRA equipment outside its normal This deficiency identifies that the status was not performed. level of detail in the MPS3 pre-initiator event screening analysis is (This F&O originated from SR HR-Al) not sufficient to fully conform to the supporting requirements related to Possible Resolution High Level Requirement HLR-HR-A of ASME/ANS RA-Sa-2009. There is a Review procedures and practices that may cause qualitative reasoning for the current level of detail in the PRA model misalignment to PRA equipment. Document this review, "continuous control room which may then be further screened at a indication", which nonetheless is procedure/component individual level. deficient with respect to the standard. Note that pre-initiator Consider using EPRI 3002008094, "Data and Modeling of human failure events are NOT Pre-Initiator Human Failure Events in Probabilistic Risk typically important contributors to Assessment." system unreliability because of the very low probability of occurrence compared to other sources of System Unreliability. The impact of the potential under-estimation of System unreliability was assessed with the PRA acceptability aggregate impact sensitivity study, which multiplied component unreliability estimates {including

' pre-initiator events) in the model by a factor of 3. The results of the cumulative sensitivity study demonstrate that the MPS3-R08 model is adequate to support this application. Therefore, this issue does not impact this application.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 14 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extensi9n Number Requirement (s) Category (CC).

3-2 HR-A2 Met A systematic review of procedures and practices to identify Assessment with Sensitivit'i (2018) calibration activities that if performed incorrectly that can This deficiency identifies that the have an adverse impact on the automatic initiation of level of detail in the MPS3 pre-standby safety equipment is not performed. initiator event screening analysis is not sufficient to fully conform to the (This F&O originated from SR HR-A2) supporting requirements related to High Level Requirement HLR-HR-A Possible Resolution of ASME/ANS RA-Sa-2009. There is a qualitative reasoning in the model that Reg. Guide 1.97 Program Perform a systematic review of procedures and practices instruments are sufficient for that could introduce miscalibration of standby safety defining the scope of pre-initiator equipment. Document this review, which may then be calibration events, but this is further screened at a procedure/component individual deficient with respect to the level. Standard. Note that pre-initiator human failure events are NOT typically important contributors to system unreliability because of the very low probability of occurrence compared to other sources of System Unreliability. The impact of the potential underestimation of System unreliability was assessed with the PRA acceptability aggregate impact sensitivity study, which multiplied component unreliability estimates (including pre-initiator events) in the model by a factor of 3. The results of the cumulative sensitivity study demonstrate that the MPS3-R08 model is adequate to support this application. Therefore, this issue does not impact this application.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 15 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description. Disposition for ILRT Extension Number Requirement (s) Category (CC) 3-7 HR-A3 NOT MET Attachment 3 of Notebook HR.1 identifies some work Assessment with Sensitivitl{'.

(2018) practices that involve a mechanism simultaneously This deficiency identifies that the affecting equipment in different trains of a redundant level of detail in the MPS3 pre-system. However, this list may be incomplete due to the initiator event screening analysis is premature screening of components before procedures are not sufficient to fully conform to the reviewed. supporting requirements related to High Level Requirement HLR-HR-A (This F&O originated from SR HR-A3) of ASME/ANS RA-Sa-2009. There is a qualitative reasoning for the current level of detail in the PRA model Possible Resolution "continuous control room indication", which nonetheless is Perform the review of work practices affecting multiple deficient with respect to the trains on the list of procedures documented in order to Standard. Note that pre-initiator meet SRs HR-Al and HR-A2. human failure events are NOT typically important contributors to Ensure the criteria for screening in includes calibrations system unreliability because of the that are performed by the same crew on the same shift very low probability of occurrence using the same equipment. compared to other sources of System Unreliability. The impact of the potential underestimation of System unreliability was assessed with the PRA acceptability aggregate impact sensitivity study, which multiplied component I

unreliability estimates (including pre-initiator events) in the model by a factor of 3. The results of the cumulative sensitivity study demonstrate that the MPS3-R08 model is adequate to support this application. Therefore, this issue

- does not impact this application.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 16 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s} Category {CC)

Rules for screening were performed on classes of activities Assessment with Sensitivity and not individual activities.

3-3 HR-81 CC I This deficiency identifies that the (2018) (This F&O originated from SR HR-B1) level of detail in the MPS3 pre-initiator event screening analysis is not sufficient to fully conform to the Possible Resolution supporting requirements related to High Level Requirement HLR-HR-B Review individual procedures/activities that may cause of ASME/ANS RA-Sa-2009. There is a misalignment and miscalibration to PRA equipment. Apply qualitative reasoning for the current screening rules to these individual procedures/activities. level of detail in the PRA model

' "continuous control room indication", which nonetheless is deficient with respect to the Standard. Note that pre-initiator human failure events are NOT typically important contributors to system unreliability because of the very low probability of occurrence compared to other sources of System Unreliability. The impact of the potential underestimation of System unreliability was assessed with the PRA acceptability aggregate impact sensitivity study, which multiplied component unreliability estimates (including pre-initiator events) in the model by a factor of 3. The results of the cumulative sensitivity study demonstrate that the MPS3-R08 model is adequate to support this application. Therefore, this issue does not impact this application.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 17 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC}

' Assessment with Sensitivity 3-4 HR-B2 NOT MET Screening rules were applied first with no verification that (2018) these activities would not simultaneously have an impact This deficiency identifies that the on multiple trains of a redundant system or diverse level of detail in the MPS3 pre-systems. initiator event screening analysis is not sufficient to fully conform to the (This F&O originated from SR HR-B2) supporting requirements related to High Level Requirement HLR-HR-B of ASME/ANS RA-Sa-2009. There is a Possible Resolution qualitative reasoning for the current level of detail in the PRA model First review each activity/procedure for simultaneously "continuous control room having an impact on multiple trains of a redundant system _lndication", which nonetheless is or diverse systems. After this review is completed and deficient with respect to the documented, then a'ctivities/procedures may be screened Standard. Note that pre-initiator out that do not impact multiple trains of redundant human failure events are NOT systems. typically important contributors to

- system unreliability because of the very low probability of occurrence compared to other sources of System Unreliability. The impact of the potential underestimation of System unreliability was assessed with the PRA acceptability aggregate impact sensitivity study, which multiplied component unreliability estimates (including pre-initiator events) in the model by a factor of 3. The results of the

~

cumulative sensitivity study demonstrate that the MPS3-R08 model is adequate to support this application. Therefore, this issue does not impact this application.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 18 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC}

3-30 HR-D3 cc 11/111 Documentation of plant specific assumptions and sources Qualitative Assessment (2018) of uncertainty are missing from the notebooks.

PRA assumptions and Uncertainties have been (This F&O originated from SR IE-03) comprehensively reviewed to identify Key assumptions and Possible Resolution uncertainties. This review did not identify any assumptions or Systematically review each of the initiating event sources of uncertainty that were notebooks for assumptions and sources of model key to this application. Refer to uncertainty.

Table A.7-4. Therefore this issue does not impact this application 3-10 HR-04 Met Recovery is non-conservatively credited for periodic checks Qualitative assessment

{2018) of manual valves after the initial pre-initiator error is made.

The identified issue is specific to HEP-A-CHS-V299. This event has (This F&O originated from SR HR-D4) a Birnbaum of 8.8E-8. This HEP affects the reliability ofthe BA Possible Resolution system which was already assumed failed in the PRA Recalculate the recovery credited from periodic acceptability aggregate impact surveillances (performed separately from the original sensitivity study due to other procedure) as suggested in the basis section.

findings. Therefore this issue does not impact this application

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 19 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding* Supporting .Capability Description Disposition for ILRT Extension Number Requirement (s) Category {CC}

3-11 HR-D4 Met No justification is provided for using lower bound Assessment with Sensitivity (2018) miscalibration recovery factor. The impact of the potential underestimation of pre-initiator (This F&O originated from SR HR-D4) human event probabilities was

- assessed with the PRA Possible Resolution acceptability aggregate impact sensitivity study, which multiplied Provide justification to use a recovery error of commission pre-initiator event probabilities by of 1.60E-02 (TH ERP Table 20-22, Item 4) such as the use of a factor of 3. The results of the independent verification that goes beyond concurrent cumulative sensitivity study verification. demonstrate that the MPS3-R08 model is adequate to support this application. The results of the cumulative sensitivity study demonstrate that the MPS3-R08 model is adequate to support this application. Therefore, this issue does not impact this application.

An error was found for the HEP-A-EGF-V006-12 Qualitative Assessment 3-13 HR-DS Met (2018) dependency. It was determined that this error applies to a HEP which is (This F&O originated from SR HR-DS) included in PRA documentation for historical reasons but not Possible Resolution part of the PRA model. This deficiency adversely impacts the Change the HEP override for EGF-V006 to 9.31E-06. readability of the PRA model. It does not adversely affect the PRA Quantification results.

Therefore, this issue does not impact this application.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 20 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC) 21-4 HR-Fl cc 1/11 The operator actions to align the AFW pumps to the CST or Assessment with Sensitivit~

(2018) to refill the DWST with firewater, is combined in one HFE.

The impact of potential underestimation of Human (This F&O originated from SR HR-Fl)

Unreliability was assessed with the PRA acceptability aggregate Possible Resolution impact sensitivity study, which multiplied Human Event Define two individual HFEs, one for the operator action to Probabilities in the model by a align the AFW pumps to the CST and one for the action to factor of 3. The results of the refill the DWST with firewater.

cumulative sensitivity study demonstrate that the MPS3-R08 model is adequate to support this application. Therefore, this issue does not impact this application.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 21 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s} Category (CC}

19-1 HR-Gl CC II The use of the automatic assignments of cognitive recovery Assessment with Sensitivity (2018) probability in the HRA Cal_culator can result in extremely low HEPcog for actions with large time margins. The impact of this deficiency was assessed with the PRA For post-initiator operator actions, cognitive recovery is acceptability aggregate impact modeled via the HRA Calculator by crediting actions such as sensitivity study, which self-review. Those recovery actions have a probability of multiplied Human Event either 0.5 or 0.1. For some actions, multiple recoveries may Probabilities in the model by a be appropriate. However, if the Dependency Factor (DF) is factor of 3. The results of the chosen to be anything except 'N/A', the non-recovery cumulative sensitivity study pr~bability is the original HEP x DF. Thus, for actions with demonstrate that the MPS3-R08 large time margin, the default Dependency Factor*is ZD model is adequate to support (zero dependence) and the non-recovery probability is this application. Therefore, this equal to the original HEP. issue does not impact this application.

(This F&O originated from SR HR-Gl)

Possible Resolution Check operator actions evaluated in the HRA Calculator where the total HEPcog is extremely low (E-5 to E-6). If this is due to the use of zero dependence (ZD) or low dependence (LD), consider replacing the Dependency Factor with N/A (i.e. do not use the dependency model)

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 22 of 87

~--*****

Table A.7-1 Disposition of OPEN Peer Review Findings Fin~ing Supporting Capability Description Disposition for ILRT Extension Number Requirement {s) _ _ Category (CC) ---

21-1 HR-Gl CC II Execution errors in HRA Calculator are not evaluated for Assessment with Sensitivity (2018) each critical step in the procedures.

The impact of potential underestimation of Human (This F&O originated from SR HR-Gl)

Unreliability was assessed with the PRA acceptability aggregate Possible Resolu!I.on impact sensitivity study, which multiplied Human Event Assess the execution error for HEPs at the individual

[ Probabilities in the model by a procedure step level. For exam pie, this would include foctor of 3. The results of the separate steps where individual valves need to be opened cumulative sensitivity study or pumps started.

demonstrate that the MPS3-R08 model is adequate to support this application. Therefore, this issue does not impact this application.

21-2 HR-G4 CC II There is an inconsistency in what is defined as the delay Assessment with Sensitivity

{2018} time and cognitive time in HRA Calculator.

The impact of potential underestimation of Human (This F&O originated from SR HR G4)

Unreliability was assessed with the PRA acceptability aggregate Possible Resolution impact sensitivity study, which multiplied Human Event Evaluate delay times as the time is cue received when it is Probabilities in the model by a based on thermal hydraulic analysis.

factor of 3. The results of the cumulative sensitivity study demonstrate that the MPS3-R08 model is adequate to support this application. Therefore, this issue does not impact this

. ~

application.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 23 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC}

HR-GS-01 HR-GS cc Ill The HR.2 Notebook states in Attachment 1, Revision 5 that RESOLVED (2012) HR-E3 cc 11/111 MPS3 "Updated the HRA for some of the HEPs based on new The HRA operator interviews timing and review of the procedures.-" but does not identify have been performed and this which ones. The Operator Surveys are all dated 2006 and issue is no longer applicable to refer to the old HFE naming scheme so it does not appear that these relate to the updated HFEs. Even the new HFEs added as the MPS3 PRA model. ,-

part of Revision 5 (HEP-C-MANMSI, HEP-C-RHR, HEP-C-TRIPRCP-LODC, and HEP-C-FTSEDG) do not have documentation of talk-th roughs, only stating "Tl/2 and Tm based on procedure talk-through" in the HRA Calculator file Time Window screen.

Possible Resolution According to Dominion Memorandum MEMO-PRA-2011-0002 Rev 0, "PRA Plan for Validation of Human Error Probabilities,"

operator interviews are scheduled to be performed and simulator exercises will be observed to validate times assumed in the HRA/PRA. For this reason, the assessment for this HR was changed from "Not Met" to "Met". However, since the original schedule was that MPS3 interviews would be performed by June 2012, the findirig is retained as a reminder to PRA staff to complete this task.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 24 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC)

No documentation is provided in Notebook HR.2 that checks Qualitative Assessment 3-9 HR-G6 NOT MET the consistency of the HFEs and final HEPs relative to each

{2018) other to check their reasonableness. This deficiency adversely impacts the Justification of the PRA (This F&O originated from SR HR-G6) model results. It does not Possible Resolution adversely affect the PRA Quantification results.

Check (and document) the consistency of the HF Es and final Therefore, this issue does not HEPs relative to each other to check their reasonableness.

One option is check the final HEPs for any outliers. Verify that impact this application those HEPs that are much higher and lower than average are reasonable given the scenario context, plant history, procedures, operational practices, and experience HR-G7-01 HR-G7 Met The dependency HEPs in Column D of the "New HEP Dep" RESOLVED (2012) worksheet do not consistently match the New Prob values The specific inconsistencies in Column V of the "Output from HRA Calculator" identified in the HRA worksheet. For example, Combination 67 looks like it dependency analysis have been should be SE-OS according to row 291, Column V of the revised and this issue is no "Output from HRA Calculator" worksheet, but 3E-04 is longer applicable to the MPS3 used. It looks as if the individual probability for HEP-C-PRA model.

FTSAFW was mistakenly used as the dependency HEP for this combination.

Possible Resolution Conduct an internal review of the dependency analysis spreadsheet and correct as necessary.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 25 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding *Supporting  :- Capability Description Disposition for IL.RT Extension Number . Requirement {sI .Category (ccf *

3-8 HR-12 Met Documentation for operator interviews is not detailed Qualitative Assessment (2018) enough to justify that interpretation of the procedures was consistent with plant observations and training procedures This deficiency adversely impacts and confirm the response models for scenarios modeled. the Justification of the PRA model results. It does not (This F&O originated from SR HR-12) adversely affect the PRA Quantification results.

Possible Resolution Therefore, this issue does not impact this application Provide more detailed documentation for the process that was used in conducting the operator interviews to assure the interviews address the interpretation of procedures and confirmation of the response model.

21-5 HR-13 NOT MET Documentation of plant-specific assumptions and sources gualitative Assessment (2018) of uncertainty are missing from the notebooks.

PRA assumptions and Uncertainties have been (This F&O originated from SR HR-13) comprehensively reviewed to

- identify key assumptions and Possible Resolution uncertainties. This review did not identify any assumptions or Systematically review each of the human reliability analysis sources of uncertainty that were notebooks for assumptions and sources of model key to this application. Refer to uncertainty.

Table A.74. Therefore this issue i does not impact this application

Serial No.19-211 Docket No. 50-423

/ Attachment 3, Enclosure A, Page 26 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings

- .Finding _ :: ~upporting Capability*'~

_~'ffe: -,,

Description < -.; Disposition for ILRT Extension

. Number 11 Reqliirement (s} Category (CC):.' .<,

3-14 IE-Al Met There are potential initiating events identified in the system Qualitative Assessment

{2018) IE-AS CC II screening process, however no further evaluation was Model documentation was performed to determine if these should be added to the reviewed and it was determined model.

that the discussion of the screening results was deficient, (This F&O originated from SR IE-Al) but the results of the screening analysis are not deficient. This Possible Resolution d*eficiency adversely impacts the readability of the PRA model. It r Expand the scope of Attachment 6 in IE.1 to include does not adversely affect the possible initiating events identified in Table 2~2b or provide PRA Quantification results.

justification that no further review is required.

Therefore, this issue does not impact this application

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 27 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s} Category (CC) 3-19 IE-A3 Met A spurious safety injection initiating event is identified in Qualitative Assessment (2018) the plant specific operating experience review, however The initiating events analysis was the spurious safety injection was removed from the model.

reviewed and it was determined that Spurious Safety Injection (This F&O originated from SR IE-A3) was removed from the model on the basis of a design change Possible Resolution which installed a Cold Leg Injection Permissive (P-19) to the Add the spurious safety injection initiating event to the PRA safety injection cold leg injection model or provide additional technical justification for valves {3SIH*MV8801A/B) to exclusion of spurious SI. If justified, consider the potential permit the cold leg injection of a lower initiating event frequency based on the design valves to automatically open change.

upon safety injection only when actual reactor coolant system (RCS) pressure has degraded to the low pressure reactor trip setpoint. As a result of this design change, operators at MPS3 have a long time available (70min) to terminate spurious SI or restore letdown to prevent challenging a PORV. A quantitative screening for Spurious SI needs to be developed to resolve this issue and is expected to justify exclusion of Spurious SI from the PRA model. Therefore this issue does not affect this application.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 28 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting ** Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC) 3-20 IE-AS CC II Loss of Control Building HVAC screened out as an initiating Qualitative Assessment (2018) event without sufficient justification.

This deficiency adversely impacts the Justification of the PRA (This F&O originated from SR IE-AS) model results. It does not adversely affect the PRA Possible Resolution Quantification results.

Provide justification in Notebook IE.1 that loss of Control Therefore, this issue does not Building HVAC would not result in an initiating event or impact this application include it in the model as an initiating event.

3-34 IE-A6 CC II Electrical busses and panels have not been evaluated as a Assessment with Sensitivity

{2018) potential initiating event for common cause failures and This finding identifies that during system alignments.

support system initiating frequencies may be (This F&O originated from SR IE-A6) underestimated due to incomplete consideration of Possible Resolution common cause failures This deficiency was assessed with the Evaluate the loss of electrical busses and panels due to PRA acceptability aggregate common cause failures or system alignment and the impact sensitivity study, which potential as an initiating event.

multiplied support system initiators by a factor of 3. The results of the cumulative sensitivity study demonstrate that the MPS3-R08 model is adequate to support this application. Therefore, this issue does not impact this application.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 29 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding .

Supporting* Capability Description . Disposition for ILRT Extension Number Requirement (s)- : Category (~C) 3-16 IE-A7 Met Shutdown events were not reviewed to determine if the Qualitative Assessment (2018) event could also occur during at power conditions.

This deficiency identifies that the level of detail in the plant (This F&O originated from SR IE-A7) specific MPS3 initiator event identification analysis is not Possible Resolution sufficient to fully conform to supporting requirement IE-A7.

Include review of events from shutdown conditions to Nonetheless, the identification determine if the event could also occur during at power analysis does consider plant conditions and cause a different type of initiator.

shutdown events over the entire life of the plant (approximately 33 years) and is considered to be sufficiently complete with respect to this application. Given that events that occur during shutdown modes (especially cold shutdown and lower modes) have relatively low relevance to at-power operation, and that the station spends a relatively short amount of time in shutdown and transition modes where it is

\

vulnerable to these events.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 30 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Sup~~rting 'Capability ..'. ' 1. ~

Description ; . Disposition for ILRT Extension".:*

Number Requirement (s) Category (CC)

• 3-18 IE-A9 CCI No evidence could be found that plant-specific operating Qualitative Assessment (2018) experience was reviewed for initiating event precursors.

This deficiency identifies that the level of detail in the plant (This F&O originated from SR IE-A9) specific MPS3 initiator event identification analysis is not Possible Resolution sufficient to fully conform to supporting requirement IE-A9 at Review plant-specific operating experience for initiating category II. Nonetheless, the event precursors and document this review. Include the identification analysis does events that were reviewed along with any corresponding consider plant shutdown events dispositions. - over the entire life of the plant (approximately 33 years) and is considered to be sufficiently complete with respect to this application. Note that event precursor review is not required in order to meet capability category I.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 31 of 87 Table A.7~1 Disposition of OPEN Peer Review Findings finging

• Supporting . *Capability Description Disposition for ILRT*Exte.nsi<>".1

-Number *Requirement (s} Category (~'cf'  ;

3-24 IE-83 NOT MET Grouping of initiating events do not appear to be bounded Assessment with Sensitivitv (2018} by the worst case impact for all the initiating events within This finding identifies that that group.

grouping for support system initiators require re-evaluation.

(This F&O originated from SR IE-B3)

Inappropriate grouping can potentially result in Possible Resolution underestimation (or overestimation) of support Re-evaluate the subsuming of initiating events in Notebook system initiating event IE.l. Verify that the initiating event that is used to bound frequencies. This deficiency was really contains all of the impacts of the initiating events assessed *with the PRA that are subsumed within it. Revise the grouping if needed acceptability aggregate impact to assure the modeled initiator is bounding.

sensitivity study, which multiplied support system initiators by a factor of 3. The results of the cumulative sensitivity study demonstrate that the MPS3-R08 model is adequate to support this application. Therefore, this issue does not impact this application.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 32 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting C.;ipability . '

Description Disposition for ILRT Extension_

Number Requiremen~ (s) Category (CC} "

3-22 IE-Cl Met General plant transients and loss of main feedwater Assessment with Sensitivit~

{2018) initiating events do not account for generic industry data.

This finding adversely impacts There is no justification why the plant specific-data alone is the Justification of GPT and adequate.

LMFW frequencies. The impact of the potential underestimation (This F&O originated from SR IE-Cl) of these frequencies was assessed with the PRA Possible Resolution acceptability aggregate impact sensitivity study, which Provide justification that there is adequate plant-specific multiplied the LMFW frequency data for general plant transients and loss of main by a factor of 3. A detailed feedwater so that it is not necessary to account for generic assessment for GPT was data in order to characterize the parameter value and its performed to confirm that the uncertainty. If it cannot be justified, then incorporate the modeled GPT frequency was generic data for these initiators.

adequate for this application.

The results of the cumulative sensitivity study demonstrate that the MPS3-R08 model is adequate to support this application. Therefore, this issue does not impact this application.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 33 of 87 Tabl~ A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extensjon

• Number Requirement (s) Category (CG) 3-33 IE-Cl Met Several loss of equipment ini_tiating events have been Assessment with Sensitivity (2018) subsumed, however the increase in initiating event This finding identifies that frequency has not been accounted for.

grouping for support system initiators require re-evaluation.

(This F&O originated from SR IE-Cl)

Inappropriate grouping can potentially result in Possible Resolution underestimation (or overestimation) of support In cases where an initiator has been subsumed to another system initiating event initiator, verify that the initiator frequency is properly frequencies. This deficiency was modified to account for the subsuming.

assessed with the PRA acceptability aggregate impact sensitivity study, which multiplied support system initiators by a factor of 3. The results of the cumulative sensitivity study demonstrate that the MPS3-R08 model is adequate to support this application. Therefore, this issue

/

does not impact this application.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 34 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings finding

• Supporting ;

• Capability . .

~'

. .. Description

• DispositfonJor ILRT Extension

Number Requirement (s)

• categQcy (CC)  ;

3-27 IE-ClS Met Uncertainty in the initiating event frequencies is not well Qualitative Assessment

{2018) characterized. Error factors, median values and mean This deficiency adversely impacts values are provided, however there is no further discussion.

the Justification of the PRA model results. It does not (This F&O originated from SR IE-ClS) adversely affect the PRA Quantification results .

. Possible Resolution Therefore, this issue does not impact this application Characterize the uncertainty in the initiating event frequencies by, for example, comparing the distributions with the generic data distributions.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 35 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition fos:.ILRT Extension

• Number Requirement (s) Category (CC) 3-23 IE-C2 Met The data used for the plant-specific initiating events is not Assessment with Sensitivity (2018) current.

This finding identifies that recent industry operating experience (This F&O originated from SR IE-C2) has not been included in initiating event frequencies.

Possible Resolution Plant initiating event history was reviewed and it was determined Update the plant specific data used for initiating events to that MPS3 experienced 4 reactor reflect recent plant operating experience.

trips and 1 LOOP during this time period. This deficiency was assessed with the PRA acceptability aggregate impact sensitivity study, which multiplied LOOP frequency by a factor of 3. A detailed assessment for GPT was performed to confirm that the modeled GPT frequency was adequate for this application.

The results of the cumulative sensitivity study demonstrate that the MPS3-R08 model is adequate to support this application. Therefore, this issue does not impact this application.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 36 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC) 3-15 IE-D1 Met There is a statement in Notebook'IE.1 that the evaluation Qualitative Assessment (2018) of initiating events resulting from common cause failures This deficiency adversely impacts and routine system alignments has not been performed.

the readability of the PRA model.

It does not adversely affect the (This F&O originated from SR IE-D1)

PRA Quantification results.

Therefore, this issue does not Possible Resolution impact this application Update Notebook IE.1 to rem_ove the statement that this systematic evaluation of initiating events has not been performed, since it has been performed.

3-29 IE-D1 Met The documentation contains historical information that Qualitative Assessment (2018) conflicts with the current model version.

This deficiency adversely impacts the readability of the PRA model.

(This F&O originated from SR IE-D1)

It does not adversely affect the PRA Quantification results.

Possible Resolution Therefore, this issue does not impact this application Review the documentation and remove historical statements that are no longer applicable.

3-17 IE-D2 NOT MET Documentation of operator interviews for verifying Qualitative Assessment

{2018) initiating event completeness is insufficient.

This deficiency adversely impacts the readability of the PRA model.

(This F&O originated from SR IE-D2)

It does not adversely affect the PRA Quantification results.

Possible Resolution Therefore, this issue does not impact this application Document the SRO interview in formal interview sheets documenting the specific questions asked and corresponding responses.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 37 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC) .

3-26 IE-D2 NOT MET There are many examples where there is not sufficient Qualitative Assessment (2018} IE-C6 NOT MET basis for screening out initiating events based on reactor This deficiency adversely impacts shutdown not being an immediate occurrence.

the Justification of the PRA model results. It does not (This F&O originated from SR IE-D2}

adversely affect the PRA Quantification results.

Possible Resolution Therefore, this issue does not impact this application Provide further justification for screening based on supporting evaluations that the resulting reactor shutdown is not an immediate occurrence.

IF-IF EV-AS- IFEV-AS NOT MET It is not clear that the flood-initiating event frequency for Qualitative Assessment 01 each flood scenario group is calculated using the applicable This finding identifies that flood (2012} requirements in 2-2.1. Modify flood-initiating event frequencies have been frequencies to calculate frequencies on a per-reactor year calculated on a calendar year basis and provide clarification in the IF PRA documentation basis and not reactor-year basis.

(spreadsheet(s) and notebook text) that clearly indicates This tends to overestimate flood the initiating event frequency calculations in units of per-initiating event frequencies.

reactor-.year. Document the basis for the availability factor Therefore, this issue does not used to convert initiating event frequencies to events per impact this application reactor year, or provide a cross reference.

Possible Resolution See F&O description.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 38 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Suppqrting Cc;1pability

• Description 1 Disposition for ILRT Extension '

Number Requirement (s) Cc:1tegory (CC)*

IF-IFEV-A7- IFEV-A7 NOT MET The analytical process used to identify potential flood Qualitative Assessment 01 IFS0-A4 NOT MET scenarios appears to be incomplete. It is not clear how the This deficiency adversely impacts (2012) IFSO-B2 Met four human-induced flood scenarios, and only those four the Justification of the PRA scenarios, were identified. For example, there is no model results. It does not discussion to indicate that tanks were systematically adversely affect the PRA reviewed to evaluate the potential for human-induced Quantification results.

flooding {e.g., inadvertent opening of valves, overfilling).

Therefore, this issue does not Although it is recognized that certain human induced impact this application modes may not be significant contributors to MPS3 flooding, the analytical process used to identify potential flood scenarios needs to be described in order to assess whether all potential human-induced flood modes were adequately considered.

Possible Resolution Revise the flooding analysis to define the process used to identify human-induced flood scenarios, apply the process to all applicable flood areas, and document the development of the identified scenario frequencies.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 39 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supportii;ig Capability

'.

• Description Disposition forlLRT- Extension Number Requirement (s) Category.(CC) -

IF-IFPP-B2-01 IFPP-B2 NOT MET Most floor areas are based pn the Fire Hazards Analysis, Qualitative assessment (2012) IFPP-Al . Met however, some fire areas are partitioned into a number of This deficiency adversely impacts flood areas, or split between multiple flood areas. The basis the Justification of the PRA for this partitioning is not provided in the documentation.

model results. It does not The documentation requires enhancement to provide in adversely affect the PRA Table 1 or elsewhere, {1) for partitioning where fire areas Quantification results.

are followed, the basis for deciding that the Fire Area Therefore, this issue does not Partitioning was applicable to flood, and (2) for partitioning impact this application where fire areas are not followed, the basis for defining flood areas different than the fire areas.

Possible Resolution No possible resolution was provided by the 2012 peer review team.

IF-IFPP-B2-02 IFPP-B2 NOT MET The reason for eliminating Unit 2 areas and multi-unit areas Qualitative assessment (2012) IFPP-A3 Met from further analysis is not included in the documentation.

This deficiency adversely impacts IFSO-A2 Met The documentation requires enhancement to identify Unit the Justification of the PRA IFEV-A4 Met 2/Multi-unit areas that were considered for flood analysis model results. It does not IFSN-All Met and the rationale for exclusion.

adversely affect the PRA Quantification results.

Possible Resolution Therefore, this issue does not impact this application Update IF notebooks to include discussion on evaluation of Unit 2 and multi-unit areas (See discussion in self-assessment for SR IF-Alb)

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 40 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension

• Number Requirement (s) Category (Cc}*

IF-IFSN-A3-01 IFSN-A3 Met As noted in the text of the accompanying SR discussion, the Qualitative Assessment (2012) documentation of HEPs in IF.2 and HR.10 needs to be made This deficiency adversely impacts consistent.

the readability of the PRA model.

It does not adversely affect the Possible Resolution PRA Quantification results.

Therefore, this issue does not No possible resolution was provided by the 2012 peer impact this application review team.

I F-1 FSN-A8-01 IFSN-A8 NOT MET* The IF.2 notebook provides adequate discussion of barrier Qualitative assessment (2012) failure, but there is no discussion of barrier unavailability This deficiency adversely impacts due to maintenance. In addition, there is no discussion of the Justification of the PRA drain check valves. If drain check valves exist, performance model results. It does not of drain check valves during a flooding event needs to be adversely affect the PRA addressed. If there are no drain check valves, the Quantification results.

documentation should be revised to state that fact.

Therefore, this issue does not impact this application Possible Resolution Include in analysis evaluation of barrier unavailability due to maintenance and performance of drain check valves during a flooding event. If there are no drain check valves, document this fact.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 41 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC)

IF-IFSO-A4- IFSO-A4 NOT MET According to the self-assessment, non-piping (e.g., Assessment with Sensitivity 01 IFSO-B2 Met expansion joints, bellows, etc.) and inadvertent sprinkler This finding has identified that (2012) IFEV-A7 NOT MET actuation are currently not addressed or modeled. The IF.3 the flood scenario identification IFEV-B2 Met Notebook section on Maintenance Related Flooding may be incomplete with respect Frequencies doesn't correctly capture what was done in the to non-piping sources such as MPS3JF.2_R4_Flood_Scenarios.xls, Table 7 worksheet. In expansion joints. The MPS3 PRA addition, this is appropriate for flow diversion events, but it model generally has very low does not address overfilling and inadvertent fire sensitivity to internal flooding suppression system actuation modes.

scenarios. This deficiency was assessed with the PRA Possible Resolution acceptability aggregate impact sensitivity study, which MPS3 should plan to address failure of gaskets, expansion multiplied flood frequency joints, fittings, seals or other such non-piping components estimates in the model by a in order to comply with the standard. Although it is factor of 3. The results of the recognized that certain human induced modes may not be cumulative sensitivity study significant contributors to MPS3 flooding, the rationale demonstrate that the MPS3-R08 should be documented nevertheless, such as "Because the model is adequate to support tanks are located in the yard, overfilling is not considered this application. Therefore, this to be a relevant flooding scenario."

issue does not impact this application.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 42 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting . _Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC)

LE-02-01 LE-02 NOT MET The penetration failure analysis in the PSS is likely outdated Qualitative Assessment (2012) as the impact of elevated temperatures on the The EPRI ILRT metho9ology does performance of penetrations and seals apparently wasn't not utilize the penetration addressed. The containment capacity analysis should failure frequency model from consider degradation of seal performance at elevated the PRA model to perform its temperatures. This analysis is based on research change in risk analysis.

conducted after the 1983 publication date of the PSS. The Therefore, this deficiency does seal/penetration analysis should review the conditions not impact this application.

experienced by the seals/penetrations and determine, based on current information, whether the seals would fail.

Possible Resolution No possible resolution was provided by the 2012 peer review team.

LE-DS-01 LE-OS CC II There was insufficient documentation of the secondary side RESOLVED (2012) isolation logic in the LERF documentation. The LE The associated documentation documents should provide a detailed discussion of the has been revised and this issue is isolation logic, referencing other documents (e.g., the HRA considered resolved.

notebook) as needed.

Note: This finding was Possible Resolution intentionally omitted from the M PS3 TSTF-425 LAR because it No possible resolution was provided by the 2012 peer was considered resolved at that review team.

time.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 43 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings

. Finding . Supporting . Capability '

Description Disposition for ILRT Extension Number Requirement (s) <Zategory {CC) 5-1 QU-A3 CCI The state-of-knowledge-correlation (SOKC) is not Assessment with Sensitivit~

(2018) adequately evaluated for several type codes. For example This finding has identified that TCs CCSMOV-FC, BA-MOV-FC, CH-MOV-FC, FW-MOV-the model does not account for FC, QS-MOV-FC, RC-MOV-FC, RH-MOV-FC, RS-MOV-the state of knowledge FC, S!HMOV-FC, SILMOV-FC, and SW-MOV-FC all have correlation, which could the same distribution based on the same prior and on the potentially have a modest same plant-specific data.

impact.on mean CDF (not point estimate). This deficiency was (This F&O originated from SR QU-A3) assessed with the PRA acceptability aggregate impact Possible Resolution sensitivity study, which multiplied component Link all parameters which use the same data source to a unreliability estimates by a single parameter so that UNCERT is able to properly factor of 3. The results of the calculate the distributions. It is recommended that the use cumulative sensitivity study of the EQUATION field in the TC table be used to link TCs demonstrate that the MPS3-R08 that are based on the same data back to one single TC for model is adequate to support the data source.

this application. Therefore, this issue does not impact this

-OR-application.

Apply an adjustment factor using recovery rules for significant events.

-OR-Demonstrate that the events affected are NOT significant (CC-II only requires SOKC to be accounted for significant events). -- "" - *"-"""""""

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 44 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description

• Disposition for ILRT Extension Number Requirement (s) Category (CC)*

22-13 QU-A3 CCI The modeling for valve leakage supporting ISLOCA seems to Qualitative Assessment

{2018) IE-C14 cc 1/11 be simplified (single event).

This application is not sensitive to CDF related to containment (This F&O originated from SR QU-A3) bypass sequences. Therefore, this issue does not impact this Possible Resolution application Evaluate the need to address state-of-knowledge-correlations for specific failure modes of components included in the lSLOCA model. Include SOKC in the ISLOCA model based on its significance to LERF.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 45 of 87 Table A. 7-1 Disposition of OPEN Peer Review Findings Finding Supporting. -~apability- ..

Des~ripfion

• Disposition for ILRT Extension Number Requirement (s) Category (CC) ..

5-4 QU-Bl Met Known limitations of the codes used in the MPS3 PRA are not Qualitative Assessment (2018) addressed. The following code versions are used in the MPS3 PRA: This deficiency adversely impacts the Justification of the PRA

• CAFTA Version 5.4 model results. It does not

• PRAQuant Version 5.1 adversely affect the PRA

• Qrecover Version 2.5

. FTREX Version 1.5 Quantification results.

Therefore, this issue does not

• EOOS Version 3.5

• SYSIMP Version 2.0 impact this application All versions of software listed above have more current versions.

While most software has been updated to add new features and/or efficiencies, some software updates have been made to correct errors in the code. Specifically, Qrecover has had multiple corrections to the code such as:

• Version 2.6 - Fixed a problem in supporting commas in the rule header line

• Version 2.9 - Corrected a problem when using Qrecover from a .NET applications (e.g., PRAQuant or FRANX) when on a 64-bit operating system.

(This F&O originated from SR QU-Bl)

Possible Resolution -

Provide a basis for the code versions used. An adequate basis will include disposition of each known problem/issue/limitation as included in the update history for each code. This could be simplified by using the latest published code versions.

All codes used in the MPS3 PRA must be reviewed to ensure adequate characterization and disposition of limitations.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 46 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC) 5-8 QU-B6 Met Complementary logic is included in the fault tree, but is not Qualitative Assessment

{2018) implemented at this time. The XCOM gates are modules set This deficiency adversely impacts to 0, which results in a 1.0 event in the cutset due to the the readability of the PRA model NOT gate above each XCOM module. In effect, this makes (sequence flags). It does not the XCOM modules act as sequence flags.

adversely affect the PRA Quantification results.

(This F&O originated from SR QU-B6)

Therefore, this issue does not impact this application Possible Resolution Replace XCOM modules with flag events, or remove them altogether. Also update associated documentation (Notebook QU.1 Section 2.3.1).

22-1 QU-B7 Met The process used to IDENTIFY mutually exclusive events in Assessment with Sensitivity (2018) cutset results is not provided. Existing documentation is The impact of the potential fragmented (contained in various locations, such as underestimation of System individual system notebooks).

unreliability was assessed with the PRA acceptability aggregate (This F&O originated from SR QU-B7) impact sensitivity study, which multiplied component Possible Resolution unreliability estimates by a factor of 3. The results of the Develop a comprehensive process for IDENTIFYING logic for cumulative sensitivity study mutually exclusive combinations. Ensure that significant demonstrate that the MPS3-R08 cutsets are reviewed for mutually exclusive combinations.

model is adequate to support this application. Therefore, this issue does not impact this application.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 47 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding . Supporting *capability '

Description Disposition for 11.:RT Extension Number Requirement (s) Category (CC} ..

22-2 QU-88 Met The process used to CORRECT mutually exclusive events in Assessment with Sensitivity (2018} cutset results is not provided. Existing documentation is The impact of the potential fragmented (contained in various locations, such as underestimation of System individual system notebooks) and outdated in some cases unreliability was assessed with (e.g., MUTIOP is referenced in Notebook SY.3, but does not the PRA acceptability aggregate exist in the model).

impact sensitivity study, which multiplied component (This F&O originated from SR QU-88}

unreliability estimates by a factor of 3. The results of the Possible Resolution cumulative sensitivity study demonstrate that the MPS3-R08 A comprehensive process for CORRECTING mutually model is adequate to support exclusive combinations must be produced.

this application. Therefore, this issue does not impact this System-specific discussion can remain in the individual application.

notebooks, but must be updated to reflect the current model.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 48 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC) 2-4 QU-B8 Met Cutsets such as the following were identified as mutually Assessment with Sensitivity (2018) exclusive: 3RS-PSB--FS-1A and 3RS-PSB--FS-1C on the basis The impact of the potential that the configuration is impossible because the common underestimation of System cause failure {CCF) basic event covers the listed events.

unreliability was assessed with the PRA acceptability aggregate (This F&O originated from SR QU-B8) impact sensitivity study, which multiplied component Possible Resolution unreliability estimates by a factor of 3. The results of the Mutually exclusive logic created based on the assumption cumulative sensitivity study that the common cause failure covers the independent demonstrate that the MPS3-R08 failures must be reviewed and updated. For example, to model is adequate to support make this mutually exclusive logic applicable, the logic this application. Therefore, this could be ANDed with the appropriate common cause issue does not impact this failure of both events, or otherwise this logic can be application.

removed from the mutually exclusive events.

Note that CCF events should be treated as minimal over the independent failures.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 49 of 87 Table A. 7-1 Disposition of OPEN Peer Review Findings Finding - Supporting Capapiljty

' Description Disposition for ILRT !:xtension Number Requirement (s) Category (CC) .,

2-5 QU-89 NOT MET A review of basic events shows that '3-FLAG-*' events are Qualitative Assessment

{2018) not set to TRUE or FALSE prior to generating cutsets.

3FLAG events were reviewed and it was confirmed that these (This F&O originated from SR QU-B9) events do not generate non-minimakutsets. If these events Possible Resolution did generate non-minimal cutsets it would have the effect Ensure that non-minimal cutsets are not being generated of overestimating CDF/LERF.

because of flag events. Possible resolutions are to identify Therefore, this issue does not logic flags so that FTREX will treat flags as TRUE (or FALSE}

impact this application and thus not create non-minimal cutsets OR remove non-minimal cutsets via post-processing OR otherwise demonstrate that non-minimal cutsets are not being generated due to the presence of flag events.

22-10 QU-Cl Met The following type C HFEs are excluded from the Qualitative Assessment

{2018) dependency analysis.

These HEPs have been excluded from the dependency analysis HEP-C-COND, HEP-C-FTSSW, HEP-C-OCD-SLOCA, HEP-C-because the actions are assumed SBOREALIGN, HEP-C-SWSTRAIN to be unsuccessful (PROB=l}

Therefore, this deficiency (This F&O originated from SR QU-Cl) adversely impacts the readability of the PRA model. It does not Possible Resolution adversely affect the PRA Quantification results.

Ensure that the impact of all HFEs is considered in the I Therefore, this issue does not development of joint HFEs or provide a basis for excluding impact this application specific HFEs.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 50 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC}

2-8 QU-Dl Met In their cutset review, Dominion determined that some of Qualitative Assessment

{2018) QU-D5 NOT MET the cutsets were logically incorrect, but modeling issues The identified issues have been causing the incorrect cutsets were not addressed (resolved logged in Dominion's or dispositioned). This can be found in QU.2, Attachment 2 configuration tracking database,

{CDF) and Attachment 3 {LERF), for example, non-which have been systematically significant CDF cutset #14855 and LERF cutset #1026. In assessed for impact on this some cases, modeling issues appear to have been logged in application separately. Refer to Dominion's PRACC (issue tracking) database, but remain table A.7-3 open. Many of these cutsets with open issues are top contributors to risk including cutset # 31, 32, 60, 62, 63, 65, 70, 71, 72, 74, 75, 76, 77, 84, 85, 87, 88, 89, 90, 92, 93, 94, 95, and 97.

{This F&O originated from SR QU-Dl)

Possible Resolution Any cutsets (significant or non-significant) that were identified as illogical should result in model corrections.

After such corrections, all cutsets included in the cutset review must be valid (iterate until true).

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 51 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability

• Description Disposition for ILRT Extension Number Requirement (s) Category (CC) 22-5 QU-D5 NOT MET Only a small number of non-significant cutsets were Qualitative Assessment (2018) reviewed for CDF and LERF.

This deficiency adversely impacts the Justification of the PRA (This F&O originated from SR QU-D5}

model results. It does not adversely affect the PRA Possible Resolution Quantification results.

Therefore, this issue does not Review an adequate sampling to determine they are impact this application reasonable and have physical meaning. For example, review non-significant cutsets in a manner consistent with the white paper on the NEI Peer Review Task Force web board ('Non-Significant Cutsets, January 2015'): review 10 cutsets per decade (order of magnitude) starting at the significant cutset limit down to the truncation limit.

Significant cutsets are as defined in QU-F6. Selection of the specific cutsets to review should avoid selecting similar cutsets.

The review should be documented. For example, include:

• A description of the process used to select the non-significant cutsets

• The results of the review, that is, discuss any model changes required (what was found to be flawed and what was done to address the flaw)

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 52 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability " '

Description .. Disposition for ILRTExtension Number Requirement {s) category (CC) 22-7 QU-D6 cc 11/111 From Notebook QU.2 section 2.7.3: "'The SGTR Qualitative Assessment

{2018) contribution to CDF for MPS3 is relatively low compared This application is not sensitive with Seabrook and STP. Having a more complete System to CDF related to containment model for SGTR would likely increase SGTR CDF." When bypass sequences. Therefore, questioned, Dominion produced a PRACC report {ID 16235, this issue does not impact this 3/28/2012) which indicates that this is a known open item.

application (This F&O originated from SR QU-D6)

Possible Resolution Develop the SGTR model as needed to bound or realistically characterize the risk contribution.

Also consider the potential impact of undeveloped modeling for other initiators. '*

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 53 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting C;:ipability '

Description .. Disposition for ILRT Extension Number Requirement (s) Category (CC} ..

22-6 QU-D7 NOT MET Insufficient discussion of the component important results Qualitative Assessment (2018) is provided. For example, the TD AFW pump and both DGs This deficiency adversely impacts appear as the top contributors. High-level explanation the Justification of the PRA should be provided, such as an explanation that loss of model results. It does not both DGs leads to SBO sequences, such as SB0-2 and SBO-adversely affect the PRA 15 which are identified as top sequence contributors.

Quantification results.

Therefore, this issue does not (This F&O originated from SR QU-D7) impact this application Possible Resolution Provide more detailed discussion of component and basic event importance. This does not need to be a line-by-line explanation of component and basic event importance, but the discussion must at least cover all significant components and basic events identified for CDF (Section 2.2.4) and LERF (Section 2.5.6) at a high level. For example, 3DG-EDG--TM-A and 3DG-EDG--FR-A are both related to DG A failures, and can be discussed together (as long as the different failure modes are not significant in the context of accident sequences).

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 54 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC) "

2-9 QU-E2 NOT MET The identification of important assumptions summarized in Qualitative Assessment (2018) the Notebook QU.4 notebook is incomplete. For example, PRA assumptions and only one assumption is identified as a key assumption from Uncertainties have been the SY analysis.

comprehensively reviewed to identify Key assumptions and Notebook HR.4 states: "Assumptions used in the Post-uncertainties. This review did initiator Human Failure Event Analysis are noted in various not identify any assumptions or sections of this notebook. Consensus models and sources of uncertainty that were approaches have been used for this HRA and no significant key to this application. Refer to (non-trivial) assumptions were necessary to apply the Table A.7-4. Therefore this issue methodologies and to perform the analyses. Therefore, no does not impact this application sensitivity evaluations were necessary to examine analysis assumptions." Similar statements are used in other individual notebooks throughout the MPS3 PRA.

(This F&O originated from SR QU-E2)

Possible Resolution Ensure that assumptions are comprehensively identified.

Discussion within individual notebooks should include assumptions which are judged to be insignificant.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 55 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Descriptio*n Disposition for ILRT Extensi_on Number Requirement (s) Category {CC) 22-8 QU-E3 NOT MET 1. The MPS3 UNCERT model does not converge without removing Qualitative Assessment (2018) events (initiators, HEPs, and CCF).

2. When these events are removed, the UNCERT model does not This deficiency adversely impacts converge to the point estimate. the Justification of the PRA model results. It does not The Millstone 3 Uncertainty Analysis results show that the mean adversely _affect the PRA estimate is >20% different than the point estimate result. Based Quantification results.

on an independent review of the uncertainty analysis it is noted that UNCERT provides errors when processing the model files. Therefore, this issue does not These errors are related to the data distributions used that will impact this application potentially generate a number greater than 1.0 during the MC sampling. This issue can explain slight differences between the point estimate and mean but are not expected to cause large differences.

Based on discussion with Dominion staff, the UNCERT study does not converge because of LOCA initiators specifically. These initiators erroneously use an error factor instead of a variance, which results in an unreasonably high degree of uncertainty. This is documented in configuration control document PRACC 18957.

{This F&O originated from SR QU-E3)

Possible Resolution

1. Correct the LOCA initiator uncertainty distributions as per PRACC 18957

2. Re-perform UN CERT parametric uncertainty study IF the LOCA update to LOCA initiator uncertainty distributions corrects the convergence issue and results in a mean value close --*

to the point estimate value (e.g., within 10% the point estimate),

then no further action is necessary.

ELSE (if UNCERT still does not converge), perform further updates and corrections as necessary to the other initiators, HEPs, and CCFs as needed to achieve UNCERT results that converge to a value close to the point estimate (e.g., within 10% of the point estimate).

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 56 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC) 2-10 QU-E4 NOT MET The impact of assumptions made throughout the various Qualitative Assessment

{2018) notebooks is not adequately assessed in Notebook QU.4. Section 2.1 of Notebook QU.4 includes qualitative assessment of the PRA assumptions and impact for selected assumptions. Common language used to Uncertainties have been assess the PRA impact of many of the listed assumptions is as comprehensively reviewed to follows: "This assumption introduces a slight conservative bias identify Key assumptions and and therefore should be retained as a source of uncertainty for uncertainties. This review did MPS3." For other assumptions, the conclusion is simply, "This not identify any assumptions or assumption should be retained as a source of uncertainty for sources of uncertainty that were MPS3." Either conclusion represents an inadequate level of key to this application. Refer to assessment.

Table A.7-4. Therefore this issue The only quantitative sensitivity studies performed assess the does not impact this application impact of HEP and CCF data (95th/5th percentile values).

Hundreds of assumptions are identified in Notebook SY.2, but the PRA impact of only one single SY assumption is addressed in Notebook QU.4 (Section 2.1). The discussion for this single item states 'This assumption might result in a non-conservatism in the model if the equipment does require ventilation.' This is not an adequate assessment.

(This F&O originated from SR QU-E4)

(See also the F&O on QU-E2 related to the inadequate identification of assumptions.)

Possible Resolution Perform assessments of all assumptions which could impact the PRA result, commensurate with potential impact to the model.

That is, assumptions with the potential for significant impact to the model must be included in a quantitative sensitivity study, while assumptions which will have a negligible impact to the PRA model (with a high degree of certainty) can be addressed in a qualitative manner.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 57 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC) 22-11 QU-Fl NOT MET Although each item noted below is, by itself, a relatively minor Qualitative assessment (2018) issue, the cumulative impact is difficulty in assessing various aspects of the model. For example, it is difficult to confirm that This deficiency adversely impacts the models used to assess accident sequences and uncertainties the readability of the PRA model.

are the same model as used to assess mean risk. It does not adversely affect the PRA Quantification results.

1. Model file names (and perhaps the structure?) are slightly Therefore, this issue does not different than documented in QU.l {Section 2.1) and QU.2.

Documentation refers to a '310Aa' model, while the file naming impact this application structure indicates a 'R08' model (which is also inconsistent with the document revisions, R6 and R7 respectively).

2. The parametric uncertainty study QU.3 includes a copy of the RR database, though the controlled copy is attached to the QU.2 model. This could create a configuration control problem when updating the database.

3. The model files include 'MPS3-R08.qnt' and 'MPS3-R08_Master.qnt'. It appears that _Master is the more complete file, but the documentation is not clear. Discussion with the utility indicated that the _Master file is used for all quantifications.

4. Most of the tables in QU.2 Section 2 do not have numeric table titles. As a result, it is difficult to navigate and refer to the individual tables.

5. QU.3 does not have a table of contents or a numeric identifiers for sections. As a result, it is difficult to navigate and refer to the parts of the parametric uncertainty study.

6. QU.4 Section 6 Compliance references to 5.20 and 5.25, but should be referencing to 5.21 and 5.26.

(This F&O originated from SR QU-Fl)

Possible Resolution Update the.documentation to correct the identified items.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 58 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC) 5-5 QU-Fl NOT MET Various settings used in the quantification codes, such as Qualitative Assessment (2018) Quantifier Settings INI file, are not documented or This deficiency adversely impacts explained.

the Justification of the PRA model results. It does not (This F&O originated from SR QU-Fl) adversely affect the PRA Quantification results.

Possible Resolution Therefore, this issue does not impact this application The selection of key parameters used in the various settings for each code should be explained, whether the settings are left at the default values or customized.

5-2 QU-F5 NOT MET Validation and Verification for QRECOVERY was not Qualitative Assessment (2018) performed.

This deficiency adversely impacts the Justification of the PRA (This F&O originated from SR QU-F5) model results. It does not adversely affect the PRA Possible Resolution Quantification results.

Therefore, this issue does not Perform a validation and verification for QRECOVERY to impact this application assess the capability of QRECOVERY to produce appropriate results as part of the CAFTA software QA (CO-SQA-000-SQA-CAFTA-20150826, Aug. 2015 revision).

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 59 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension*

Number Requirement (s) Category (CC) 5-3 QU-FS NOT MET PRA model documentation does not reference to the Qualitative Assessment (2018) software QA studies for the various codes used in the MPS3 This deficiency adversely impacts PRA that would identify limitations in the quantification the Justification of the PRA process that would impact applications.

model results. It does not adversely affect the PRA (This F&O originated from SR QU-FS)

Quantification results.

Therefore, this issue does not Possible Resolution impact this application Clearly document limitations in the quantification process that would impact applications. For example, add appropriate cross-references in the applicable PRA documentation for the various software QA documentation. The following is a partial listing:

CO-SQA-000-SQA-CAFTA-20150826. pdf CO-SQA-OOO-SQA-CAFTA-20170727.pdf CO-SQA-000-SQA-H RACALCU LATOR-20151102 .pdf CO-SQA-000-SQA-H RACALCULATOR-20170424. pdf CO-SQA-000-SQA-P RACC-20170706. pdf CO-SQA-OOO-SQA-PRAQUANT-20130816.pdf CO-SQA-000-SQA-P RAQUANT-20170726. pdf CO-SQA-OOO-SQA-UNCERT-20180328.pdf

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 60 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC) 1-3 SC-A3 Met RCS depressurization is one of the important functions Assessment with Sensitivity

{2018) credited to support several initiators (e.g. SGTR, ISLOCA).

The impact of these deficiencies However, the Success Criteria notebooks (SC.1, SC.2) do not was assessed with the PRA provide specific documentation of the success criteria used acceptability aggregate impact for depressurization.

sensitivity study, which assumed that the St!=:!am Dumps were In particular, it appears that Steam Dump Valves are unable to support the RCS credited for steam relief. For example, Notebook SC.1 for depressurization function (i.e.

Secondary Heat Removal for Transients, says, "in addition

• failure probability set to 1.0).

to feedwater flow, steam relief is also required. Due to The results of the cumulative redundancy, success of this function is assumed."

sensitivity study demonstrate Presumably, the redundancy includes Steam Dump Valves.

that the MPS3-R08 model is adequate to support this Another example is in SC.1 (p. 12), where the success application. Therefore, this issue criteria for SLOCA injection includes, "1 of 2 LPSI pumps does not impact this application.

(following de pressurization via 1 of 13 ADV or SDV)." While it is understood that this is not credited in the current model, it is not clear how SDVs can be used to cooldown and depressurize the secondary side. SDVs typically isolate for SIS and certainly require condenser cooling with Circ Water to function as a heat removal path.

(This F&O originated from SR SC-A3)

Possible Resolution

..,,. Provide a clear and complete definition of the success criteria for RCS depressurization. In particular, where SDVs are credited, verify that the condenser cooling function is modeled to support steam relief through SDVs.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 61 of 87 Table A.1 ...1 Disposition of OPEN Peer Review Findings firi~~!lg' *: ; Si.lppc_,rting ** * '. '.":'*. C~pa~~lity *' ,

• Descrip,tion* _ Disposition fi)rtLR'r Extension Number.** Requirement (s} _Category (CC) 19-2 SC-A4 Met Section 3.0 of Notebook SC.1 identifies the only shared Assessment with Sensitivity (2018) system between Unit 2 and Unit 3 as the SBO DG. However, The FP model was reviewed and the Fire Protection system is apparently a shared system, it was determined that the but is not documented in the SC notebook. Two Firewater model does not have storage tanks, each with a capacity of 250,000 gal, supply appropriate treatment for FP in b9th Units 2 and 3.

multi-unit scenarios. The impact of this deficiency was assessed (This F&O originated from SR SC-A4) with the PRA acceptability aggregate impact sensitivity Possible Resolution study, assumed the FP system was unable to support the DWST Document the Fire Protection system as a shared system refill or CCE refill functions (i.e.,

and verify that it is appropriately modeled for a multi-unit failure probability set to 1.0).

scenario.

The results of the cumulative sensitivity study demonstrate that the MPS3-R08 model is adequate to support this application. Therefore, this issue does not impact this application.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 62 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability \

Oescription. Disposition for ILRT Extension Number

• Requirement {s) Category {CC)*

1-1 SC-A6 NOT MET In Section 5.2.3 and Table 5-6 of Notebook SC.1, SSLOCA is Qualitative Assessment (2018) defined as less than 1" break, with injection success criteria The SSLOCA event and of 1 of 4 HPSI/CHG pumps. There are several issues with associated success criteria this initiator:

require additional justification and definition in the model. This

1. No lower limit break size is defined.

resolution is very unlikely to reveal that any changes to

2. No basis provided for the upper limit break size.

Success Criteria are required, because the Injection Node

3. No T/H cases were run that demonstrated a HPSI pump assumes Steam Generator can mitigate the lowest break size in SSLOCA. This concern Cooling is available, creating is whether HPSI pumps provide makeup to the smallest of stable RCS conditions while RCS SSLOCAs without depressurizing the RCS, which may be an slowly depressurizes. Therefore, additional requirement for success.

this issue does not impact this application (This F&O originated from SR SC-A6)

Possible Resolution Provide the complete definition for SSLOCA tied to specific success criteria. For the smallest SSLOCA, verify that the HPSI pumps can provide makeup without operator depressurizing the RCS.

Serial No.19-211 Docket No. 50-423*

Attachment 3, Enclosure A, Page 63 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement(s) Category (CC) 1-7 SC-A6 NOT MET Notebook SC.2 Section 1 states, 11 As a result of a recent Assessment with Sensitivity (2018) power uprate, RELAP calculations (Ref. 7.26) were The impact of this deficiency was performed to confirm that the MAAP analyses performed in assessed with the PRA several of the above attachments remain valid."

acceptability aggregate impact sensitivity study, which However, MAAP cases that are used to support success multiplied Human Event criteria should be based on the current as-built, as-Probabilities in the model by a operated plant, including design power level.

factor of 3. The results of the cumulative sensitivity study (This F&O originated from SR SC-A6) demonstrate that the MPS3-R08 model is adequate to support Possible Resolution this application. Therefore, this issue does not impact this Update MAAP runs with the current power level and verify application.

success criteria and timing windows are unchanged or revise as needed.

1-8 SC-A6 NOT MET The basis for the ATWS success criteria is a series of RELAP Qualitative Assessment

{2018) runs. However, based on SC.2, "The RELAPS files from the This deficiency adversely impacts ATWS success criteria calculations could not be found, and the readability of the PRA model.

a PRACC item" has been issued.

It does not adversely affect the PRA Quantification results.

(This F&O originated from SR SC-A6)

Therefore, this issue does not impact this application Possible Resolution Provide a documented basis for the ATWS success criteria.

If the RELAP analysis is not recoverable, one possible approach is the use of the WCAP-15831-P-A.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 64 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability ..

Description Disposi,ion for ILRT Extension Nµmber Requirement (s) Category (CC) 20-7 SC-A6 NOT MET The documentation of the RCP seal leakage model provided Qualitative Assessment (2018) in Notebook AS.l did not provide sufficient detail to allow This deficiency adversely impacts the reviewer to understand the bases and assumptions the readability of the PRA model.

used to support the model.

It does not adversely affect the PRA Quantification results.

(This F&O originated from SR SC-A6)

Therefore, this issue does not impact this application Possible Resolution It is stated that the RCP seal leakage model is based on WCAP-16175-P-A. However, Millstone 3 uses Flowserve seals installed in Westinghouse pumps and WCAP-16175-P is specific for CE NSSS plants.

If the WCAP is used as the basis for the seal leakage model, the applicability of the WCAP for Millstone 3 needs to be justified since the Millstone 3 RCP seal configuration differs from that described in the WCAP.

Additionally the development of the seal leakage model and any event tree modifications required need to be justified specifically regarding any assumptions or changes made to make the model applicable to Millstone.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 65 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting .. , Capabjlity Description Disposition for ILRT Extension Number Requirement (s) Category (CC) 1-10 SC-AG NOT MET The bases for the Tsw (system window timing) a re not well Assessment with Sensitivit~

(2018) HR-G4 CC II documented for several operator actions. As a result, the While no specific deficiency with peer reviewer was not able to verify the system time Tsw calculations was identified, windows were appropriate.

the impact of potential deficiencies was assessed with (This F&O originated from SR SC-AG) the PRA acceptability aggregate impact sensitivity study, which Possible Resolution multiplied Human Event Probabilities in the model by a For the operator actions listed, identify the specific T/H factor of 3. The results of the case and parameter that is used as the basis for the time cumulative sensitivity study window. If required, explain why a specific parameter is demonstrate that the MPS3-R08 appropriate as the basis for the time window.

model is adequate to support this application. Therefore, this Review the bases for the time windows for the other issue does not impact this operator actions to assure they reference specific cases and application.

parameters or add those specific references.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 66 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability -

Description Disposition for ILRT Extension Number Requirement (s) Category (CC}

1-14 SC-A6 NOT MET The bases for success criteria are identified in Notebook Qualitative Assessment (2018) HR-G4 CC II SC.2, in Section 5.1 Mitigating Function Success Criteria and This deficiency adversely impacts Section 5.2 Event Timing. However, the bases are provided the readability of the PRA model.

in text form without referring to specific MAAP runs and It does not adversely affect the results.

PRA Quantification results.

Therefore, this issue does not (This F&O originated from SR SC-A6) impact this application Possible Resolution For each functional success criteria and operator time window calculation, document the specific code case and specific result from the code case that is used as the basis.

Verify that the identified time windows (e.g., 42 min) are indeed supported by appropriate cases and parameters.

1-5 SC-Bl CC II SC.1 (p. 11) lists the success criteria for LLOCA injection and Qualitative Assessment (2018) includes, "2 of 4 HPSI or charging pumps). SC.2 (p. 7)

This deficiency adversely impacts identifies the basis for this success criteria as the 1983 PSS the readability of the PRA model.

(Ref 7 .2). However, the analysis that supports this success It does not adversely affect the criteria was not available for review.

PRA Quantification results.

Therefore, this issue does not (This F&O originated from SR SC-Bl) impact this application Possible Resolution Remove this success criteria for LLOCA or provide an analysis that justifies it.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 67 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC),.

1-11 SC-BS NOT MET The SC Notebooks do not provide any plant-specific Qualitative Assessment

{2018) comparison of the results of different codes or sources This finding identifies a (e.g., MAAP, RELAP, FSAR) applied to the same MPS3 deficiency with respect to the scenarios to support success criteria and operator time thoroughness ofthe window calculations.

documented reasonableness check of Success Criteria in Also, the SC Notebooks do not provide any comparison of accordance with SC-BS. Given the results of comparison with results of the same analyses the veterancy of the MPS3 performed for similar plants, accounting for differences in Internal Events model It is very unique plant feature.

unlikely that performing this

- review would result in a (This F&O originated from SR SC-BS) significant revision to modeled success criteria. Therefore, no Possible Resolution impact to this application Provide comparisons of available results from different plant-specific sources (codes, references) or with results of the same analyses performed for similar plants (accounting for differences in unique plant feature) for scenario timing or other success criteria. Where the comparisons show significant differences, evaluate the basis for the differences as a check on the primary success criteria sources.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 68 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC}

1-13 SC-Cl NOT MET Success criteria were generally based on thermal/hydraulic Qualitative Assessment (2018) codes including MAAP4 and RELAPS and GOTHIC. These The modeled success criteria codes were used with plant-specific input files that require additional justification produced generally realistic, plant-specific results. Other and definition in the model.

referenced sources include FSAR, SFRM, and Operator Given the veterancy of the MPS3 training material.

Internal Events model, this resolution is very unlikely to However, the bases of the functional success criteria and reveal that any significant operator time windows are a hodge-podge of different changes to success criteria are analyses with different modeling assumptions. Success required. Therefore, this issue criteria supported by multiple codes and sources require does not impact this application documentation of the code applicable, limitations, V&V, maintenance of code updates, etc.

(This F&O originated from SR SC-Cl)

Possible Resolution Either provide full documented bases of all the primary source of success criteria bases OR use MAAP and GOTHIC as primary sources of success criteria. Then other codes and references become good sources of comparative analyses that provide a check on the MAAP and GOTHIC analyses.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 69 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC) 1-2 SC-Cl NOT MET Notebook SC.1 says that the SBO DG is preferentially Qualitative Assessment (2018} aligned to Unit 3 but does not identify what controls that This deficiency adversely impacts alignment. In response to a Peer Review question, the readability of the PRA model.

Dominion explained that Unit 3 operates the SBO DG (i.e., it It does not adversely affect the has an MPS3 location ID, 3BGS-EG1 and the component PRA Quantification results.

auto starts on under-voltage of MPS3 buses 34A and 34B}.

Therefore, this issue does not This provides sufficient basis that Unit 3 would use the SBO impact this application diesel in the event of a multi-unit SBO scenario.

(This F&O originated from SR SC-Cl)

Possible Resolution Document the basis for the assumption that the SBO DG is preferentially aligned to Unit 3.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 70 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supi:,orting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC):

1-6 SC-Cl NOT MET The Notebooks SC.1 and SC.2 identify that MAAP4 is used Qualitative Assessment (2018} to support a number of success criteria cases. However, This deficiency adversely impacts these notebooks lack documentation of a number of issues the readability of the PRA model.

related to the use of MAAP for Level 1 success criteria.

It does not adversely affect the PRA Quantification results.

(This F&O originated from SR SC-Cl)

Therefore, this issue does not impact this application Possible Resolution Provide a clearly documented basis for the MAAP version used to support the current success criteria. This should include:

1. The specific version of MAAP;

2. The V&V of the parameter file with basis that tracks from MAAP 403 to the current version; and

3. A listing of the limitations of the MAAP code currently used and how these limitations are addressed in the use of MAAP. .

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 71 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding . Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC) 1-9 SC-Cl NOT MET The success criteria analysis is documented in two notebooks Qualitative Assessment (2018} {SC.1, SC.2) and in a number of MAAP cases, with input and output files. These notebooks also refer to RE LAP cases and point This deficiency adversely impacts to other references for thermal/hydraulic analyses that provide the readability of the PRA model.

the bases for some success criteria. However, several issues make It does not adversely affect the the success criteria difficult to use and review. PRA Quantification results.

1. The high level requirement HLR-B provides a broad definition Therefore, this issue does not of success criteria analyses: "thermal/hydraulic, structural, and impact this application other supporting engineering bases" that support success criteria and event timing. It is difficult to other analyses {beyond T/H code analyses) such as room heatup calculations that may be scattered throughout other notebooks and supporting files.

2. The current Notebook SC.2 is a partial update, with some results included in the notebook superseded by new results that are provided only in an Attachment to the notebook. The user/reviewer is left to figure out which cases are current and which have been replaced.

3. Notebook SC.2 provides the bases for success criteria and timing but primarily in the form of paragraphs of text without referencing the specific case and parameter used.

{This F&O originated from SR SC-Cl)

Possible Resolution

1. In the Success Criteria notebooks, provide the documentation of all analyses used to support success criteria and event timing.

This could be in the form of detailed analyses (e.g., MAAP cases) or summaries of analyses with references to other notebooks where the details are contained (e.g., room heatup calculations).

2. Provide a complete update of the SC.2 notebook.

3. Provide explicit references to analysis cases (e.g., MAAP runs) and parameters that support specific success criteria and/or event timing. Tables of success criteria and timing vs specific cases and parameters would be a more efficient way of documenting much of the information in Notebook SC.2.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 72 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC) 4-10 SY-A11 NOT MET There are several cases where passive failure modes have Assessment with Sensitivity (2018) been screened from the model without a quantitative basis This Finding identifies that as required by SY-A15. For example, manual valves passive failure modes have be.en 3SIL *V002 and 3RHS*V006 are shown in the simplified excluded from the systems diagrams but are not modeled in the system fault tree.

analysis without quantitative Also, normally open MOVs and manual valves in the RHR justification as required by SY-system are shown in the simplified diagrams but are not A15. Passive failures are modeled in the system fault tree.

generally not significant contributors to system reliability (This F&O originated from SR SY-A11) because of the relatively low probability of occurrence Possible Resolution relative to active failures and human failures. This deficiency Quantitatively review all screened components and failure was assessed with the PRA modes. Ensure that the screening process used is in acceptability aggregate impact compliance with the requirements of SY-A15 and SY-B13.

sensitivity study, which multiplied component unreliability estimates by a factor of 3. The results of the cumulative sensitivity study demonstrate that the MPS3-R08 model is adequate to support this application. Therefore, this issue does not impact this application.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 73 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC) 20-1 SY-A14 Met In general, failure modes are modeled in the systems Assessment with Sensitivity (2018) analysis consistent with the level of detail of the model. A few instances were identified where data is available for The impact of the potential certain failure modes that were not modeled. underestimation of System unreliability was assessed with (This F&O originated from SR SY-A14) the PRA acceptability aggregate impact sensitivity study, which Possible Resolution multiplied component unreliability estimates by a Ensure all appropriate failure modes are modeled. For factor of 3. The results of the example, review available data in the most recent version cumulative sensitivity study of NUREG/CR-6928 and ensure consideration of failure demonstrate that the MPS3-R08 modes are assessed in the system models that impact model is adequate to support system operability (SY-All). If certain failure modes are this application. Therefore, this excluded from the system models, provide justification for issue does not impact this the exclusion. application.

2-11 SY-A15 NOT MET Component failure modes are excluded from the system Assessment with Sensitivity (2018) models based on qualitative considerations and not The impact of the potential quantitative considerations as specified by the supporting underestimation of System requirement.

unreliability was assessed with the PRA acceptability aggregate (This F&O originated from SR SY-A15) impact sensitivity study, which multiplied component Possible Resolution unreliability estimates by a factor of 3. The results of the Provide quantitative screening criteria for failure modes cumulative sensitivity study that have the ability to impact system operability.

demonstrate that the MPS3-R08 model is adequate to support this application. Therefore, this issue does not impact this application.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 74 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category ( CC) 20-16 SY-A19 Met Review of SY.3 EP shows that unavailability of electrical Assessment with Sensitivity

{2018) DA-C13 CC! components is not consistently modeled with the level of The impact of the potential detail in which the component failures are modeled.

underestimation of System unreliability was assessed with (This F&O originated from SR SY-A19) the PRA acceptability aggregate impact sensitivity study, which Possihle Resolution multiplied component unreliability estimates by a Provide justification for excluding unavailability of the factor of 3. The results of the major electrical components, or model unavailability of the cumulative sensitivity study components in the system model.

demonstrate that the MPS3-R08 model is adequate to support this application. Therefore, this issue does not impact this application.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 75 of 87 Table A.7-1 Disposition 'c;,f OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension*

Number Requirement (s) Category (CC) 20-2 SY-A20 N/A Events representing the simultaneous unavailability of Qualitative Assessment (2018) redundant equipment is included in the PRA model.

This deficiency adversely impacts Specifically, for the boric acid pumps. ,,

1 specific portion of the systems analysis (BA system). The impact (This F&O originated from SR SY-A20) of this deficiency was assessed with the PRA acceptability Possible Resolution aggregate impact sensitivity study, which assumed the BA Provide justification that the boric acid pumps will not be system was unable to support taken out of service simultaneously due to a planned the Emergency Boration function activity, and remove the documentation about the

{i.e., failure probability set to simultaneous maintenance events. Otherwise, calculate 1.0). The results of the probabilities for the coincidental maintenance and include cumulative sensitivity study in the model.

demonstrate that the MPS3-R08 model is adequate to support this application. Therefore, this issue does not impact this application.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 76 of 87 Table A. 7-1 Disposition of OPEN. Peer Review Findings Finding .*.

Supporting Capability Description ,'

Disposition for ILRT Extension Number Requirement (s) Category (CC) .,

20-4 SV-A22 CC II Situations in which component design capabilities may be Qualitative Assessment (2018) exceeded have not been explicitly documented, and This deficiency adversely impacts therefore it is unclear if the components are credited in the readability of the PRA model.

conditions in which their design capabilities are exceeded.

It does not adversely affect the PRA Quantification results.

(This F&O originated from SR SV-A22)

Therefore, this issue does not impact this application Possible Resolution For adverse conditions identified per SV-A21, document any cases where components are being credited in conditions which their design capabilities are exceeded. If design

.conditions are exceeded, document supporting analyses to show that the component can be credited, or remove credit for the component.

4-3 SV-A4 NOT MET Although there is some interaction with plant staff via plant Qualitative Assessment (2018) programs (e.g. MR, MSPI, SDPs) the system notebooks This deficiency adversely impacts acknowledge that there have been no formal interviews or the Justification of the PRA walkdowns to ensure the validity and accuracy of the PRA model results. It does not model. Without interviews and walkdowns it cannot be adversely affect the PRA certain that components, pre-initiators, flow diversion Quantification results.

paths (etc.) have not been overlooked or that the Therefore, this issue does not assumptions and modeling choices made are indeed valid.

impact this application (This F&O originated from SR SV-A4)

Possible Resolution Conduct and document formal walkdowns and interviews with know_ledgeable plant ~taff to confirm that the system

~

analysis correctly reflects the as-built as-operated plant.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 77 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC) 20-6 SV-811 Met In general, it appears that the available inventories of air, Assessment with Sensitivity (2018} power, and cooling are modeled appropriately to support The impact of the revised the mission time. Instances of questionable mission time mission time for Station use were identified for battery lifetime.

Batteries was assessed with the PRA acceptability aggregate (This F&O originated from SR SV-811) impact sensitivity study, which used a revised fault tree system Possible Resolution model which accounted for a revised mission time. The results Clarify the mission time of the batteries used in the PRA to of the cumulative sensitivity support the design life of the batteries. Verify that it has a study demonstrate that the technical basis. Check to see if operator actions to load MPS3-R08 model is adequate to shed are required to support the modeled lifetime. If the support this application.

battery lifetime that can be supported with a technical Therefore, this issue does not basis is different that modeled, evaluate the impact of this impact this application.

change in the mission time on the PRA model.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 78 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability *.  ;

Description Disposition for ILRT Extension Number Requirement (s) Category (CC) .

2-14 SV-B13 NOT MET Components that are required for operation of multiple Assessment with Sensitivit~

(2018} systems have been screened from the system analysis.

The impact of the potential

' underestimation of System SR SV-B13 specifically instructs analysts to not screen unreliability was assessed with components that are required for operation of multiple the PRA acceptability aggregate systems.

impact sensitivity study, which multiplied component (This F&O originated from SR SY-B13) unreliability estimates by a factor of 3. The results of the Possible Resolution cumulative sensitivity study demonstrate that the MPS3-R08 Perform an extent of condition to determine if passive model is adequate to support components that support multiple systems have been this application. Therefore, this screened from the analysis (based on an assumption, or issue does not impact this based on SY-A15 criteria). Model any valves that support application.

multiple systems that may have been improperly screened.

20-10 SV-B3 Met Common cause failures are incorporated into the system Assessment with Sensitivit~

(2018) models in a manner consistent with the common cause The impact of the potential model used for the data analysis. Instances of erroneous underestimation of System common cause groups were identified.

unreliability was assessed with tbe PRA acceptability aggregate (This F&O originated from SR SV-B3}

impact sensitivity study, which multiplied component poss_i_plgBes_Ql!JJion unreliability estimates by a factor of 3. The results of the Determine if the common cause failures of battery chargers cumulative sensitivity study and inverters is applicable and model common cause demonstrate that the MPS3-R08

. failures of the battery chargers and the inverters if model is adequate to support applicable.

this application. Therefore, this issue does not impact this application.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 79 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings

• Fin"di.ng 0 Supporting Capc!bility.

. Description Disposition for ILRT*Extension Number Requirement (s) Category (CC) .

20-13 SY-B3 Met Common cause failures are incorporated into the system Assessment with Sensitivity

{2018) models in a manner consistent with the common cause The impact of the potential model used for the data analysis. Instances of erroneous underestimation of System common cause groups were identified.

unreliability was assessed with the PRA acceptability aggregate (This F&O originated from SR SY-B3) impact sensitivity study, which multiplied component Possible Resolution unreliability estimates by a factor of 3. The results of the Model EDG ventilation CCF or justify why the common cumulative sensitivity study cause failures are not applicable.

demonstrate that the MPS3-R08 model is adequate to support this application. Therefore, this issue does not impact this application.

20-5 SY-B3 Met Common cause failures are incorporated into the system Qualitative Assessment (2018) models in a manner consistent with the common cause The legacy modeling approach model used for the data analysis. Instances of erroneous for EDG Common Cause Failure common cause groups were identified.

overestimates the unreliability of EDGs. Therefore, this issue does (This F&O originated from SR SY-83) not impact this application Possible Resolution Provide justification that this group is not applicable and; if appropriate, remove this common cause group.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 80 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC) 22-12 SY-BS Met As noted in Notebook QU.2 Section 2.7.4, "The internal Assessment with Sensitivity (2018) events system model remains incomplete in some areas. In The impact of the potential some instances, mitigating equipment as well as hardware underestimation of System dependencies are considered implicitly. This should be unreliability was assessed with considered by the analyst when generating applications."

the PRA acceptability aggregate impact sensitivity study, which (This F&O originated from SR SY-BS) multiplied component unreliability estimates by a Possible Resolution factor of 3. The results of the cumulative sensitivity study Identify the instances of incomplete, undeveloped, or demonstrate that the MPS3-R08 implicit system modeling. Characterize the impact of each model is adequate to support such event and evaluate whether the related system model this application. Therefore, this needs to be revised to address these issues. Alternately, issue does not impact this replace these areas with appropriate system modeling.

application.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 81 of 87 Table.A.7-1 Disi,osition of OPEN Peer Review Findings Finding Sup.porting Capability Description Disposition for ll:RT Extension Number Requirement (s) Category (CC) 22-9 SY-BS Met Service water does not show up as an important initiating Assessment with Sensitivity:

(2018) event. Discussion with Dominion staff indicates that this is The impact of this deficiency was the result of incorrect fault tree modeling of system assessed with the PRA dependencies. Specifically, none of the LOSW initiators (see acceptability aggregate impact gate: LOSW) have a modeled consequence of SW sensitivity study, which modified unavailability. They simply propagate to the gate the fault tree to correct this representing transient initiators.

issue. The results of the (This F&O originated from SR SY-BS) cumulative sensitivity study demonstrate that the MPS3-R08 Possible Resolution model is adequate to support this application. Therefore, this Update the modeling for SW dependencies.

issue does not impact this Once model is updated, ensure that the importance of the application.

SW initiator is appropriately documented in QU.4.

Ensure that modeling and characterization of initiator importance is correct for the other support system initiators.

20-8 SY-B6 Met In general, various engineering analyses are used as Qualitative Assessment (2018) reference to determine the need for support systems.

This deficiency adversely impacts However, several instances of screening of support systems the readability of the PRA model.

without further justification were identified.

It does not adversely affect the PRA Quantification results.

(This F&O originated from SR SV-B6) - Therefore, this issue does not impact this application Possible Resolution Perform additional analyses to show that justification for including support system is not needed or explicitly model the support system in the fault tree model.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 82 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporti11g. . -Capability Description Disposition for ILRT Extension Number Requirement (s) Category (CC) .*

SY-86-01 SY-86 Met Existing F&O TH-4 notes that review of "borderline" cases RESOLVED (2012) for room heat-up calculations to support HVAC system The associated documentation dependencies has not been completed. Review of current has been revised and this issue is "borderline" cases needs to be completed to confirm the considered resolved.

engineering analyses that determine the inclusion or exclusion of HVAC systems in those rooms.

Note: This finding was intentionally omitted from the Possible Resolution MPS3 TSTF-425 LAR because it was considered resolved at that Complete and document the review of "borderline" room time.

heat-up calculations and close out F&O TH-4.

20-14 SY-Cl NOT MET The SY.1 Dependency matrix does not include the EOG 'A' Qualitative Assessment

{2018) or 'B' enclosure ventilation dampers even though these This deficiency adversely impacts dampers are required to change state in the PRA which the readability of the PRA model.

requires power (e.g., 3HVP*MOD20A).

It does not adversely affect the PRA Quantification results.

(This F&O originated from SR SY-Cl)

Therefore, this issue does not impact this application Possible Resolution Ensure that all modeled components are included in the SY.1 Dependency matrix and all supports are identified for those components.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 83 of 87 Table A. 7-1 Disposition of OPEN Peer Review Findings Finding Supporting Capability Description Disposition for ILRT Extension Number Requirement (s) . Category (CC) 20-15 SY-Cl NOT MET Millstone has multiple tags for the same component which Qualitative Assessment

{2018) creates confusion. There needs to be a clear mapping This deficiency adversely impacts between the documentation, the modeling, and the tag the readability of the PRA model.

used in the PRA, and these should be consistent.

It does not adversely affect the For example the intake on the 'A' RHR pump train contains PRA Quantification results.

a check valve. Discussion with the site determined that this Therefore, this issue does not valve is referred to as both 3SIL*V002 and also as 8959A. impact this application The confusion is compounded by the fact that the BE in the model uses both names: The BE name is 3SILCKV--FC-3, the BE description says 8959A.

{This F&O originated from SR SY-Cl)

Possible Resolution In cases where multiple tags are used at the site, define the specific tag that will be used in the PRA and ensure that all documentation and modeling uses only this tag.

4-8 SY-Cl NOT MET Section 2.8 of the system notebooks points to the Millstone Qualitative Assessment

{2018) TSs but doesn't list them or state how this information was This deficiency adversely impacts used (e.g. to define MUX events). This does not allow the the readability of the PRA model.

reviewer to determine how operating limitations imposed It does not adversely affect the by TSs were accounted for in the model.

PRA Quantification results.

Therefore, this issue does not (This F&O originated from SR SY-Cl) '

impact this application Possible Resolution

, Review of the specific LCO for Mode 1 for each system in Section 2.8 of the notebooks. State what, if any, impact these LCO have on the system model to document the review.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 84 of 87 Table A.7-1 Disposition of OPEN Peer Review Findings Finding Supporting -~ap,ability

• Description Disposition for ILRTExtension-.

Number Requirement (s) *Category (CC) ... ..

2-16 SY-Cl NOT MET Documentation needs to be improved to ensure flow Qualitative Assessment (2018) SY-A13 Met diversion modeling assumptions across the system This deficiency adversely impacts notebooks are thoroughly described.

the readability of the PRA model.

It does not adversely affect the (This F&O originated from SR SY-Cl).

PRA Quantification results.

Therefore, this issue does not Possible Resolution impact this application Review system notebooks to ensure flow diversion modeling assumptions are appropriately documented.

20-3 SY-Cl NOT MET System conditions that can cause a loss of desired system Qualitative Assessment (2018) SY-A21 Met function are identified but documentation of conditions for This deficiency adversely impacts each modeled system needs to be improved.

the readability of the PRA model.

It does not adversely affect the (This F&O originated from SR SY-Cl).

PRA Quantification results.

Therefore, this issue does not Possible Resolution impact this application Equipment operability considerations are considered and identified for a subset of systems. Revise the documentation to specifically identify conditions for each modeled system.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 86 of 87 Unreviewed PRA Upgrades The MPS3 PRA model currently has one upgrade which has not been peer reviewed shown in Table A.6-2 below:

Table A.7-2 Open Model Upgrades

[)ate / Model Summary of Change. Disposition This upgrade requires evaluation with a Revised RCP seal failure model sensitivity study with respect to RCP seal failure as a result of Design Change probability. RCP seal failure probabilities remain a 2016 / MPS3-M310Aa generic source of uncertainty in industry PRAs.

implementing FLOWSERV low-leakag,e seals (PRACC17327) The 3PR0B-RCP-SEAL-FAILS event in the model was multiplied by a factor of 3 in the PRA acceptability cumulative impact sensitivity study.

Open PRACC review In accordance with Dominion's PRA Configuration Control (PRACC) process, open items in Dominion's PRA Configuration control database were reviewed in order to ensure that the cumulative impact of pending changes to the PRA is considered in this evaluation. As a result of this review, the following items were identified as requiring assessment in PRA acceptability cumulative impact sensitivity study:

Table A.7-3 Pending PRA changes ID Summary DispositiQn 17288 No Equipment or human failures are modeled after The impact of a potential overestimation of the power is recovered in an SBO event. reliability restoring plant equipment following SBO was assessed using the PRA acceptability cumulative impact sensitivity study which multiplied offsite power non-recovery probabilities by a factor of 3.

17779 ATWS sequences in the model with successful The impact of this incomplete success criteria was MFW should have a success criteria requiring assessed with a fault tree change in the PRA emergency boration to shut down the reactor. acceptability cumulative impact sensitivity study which added emergency boration to the ATWS fault tree.

18917 Some SBO sequences are not being considered The impact of this incomplete success criteria was because the model lacks SBO transfer from MLOCA assessed with a fault tree change in the PRA and SLOCA. acceptability cumulative impact sensitivity study which added MLOCA and LLOCA to the SBO fault tree.

Serial No.19-211 Docket No. 50-423 Attachment 3, Enclosure A, Page 87 of 87 Key Uncertainties and Assumptions PRA assumptions and sources of uncertainty were reviewed to identify those* which would be significant for the evaluation of this application. If the MPS3 PRA model used a non-conservative treatment, or methods that are not commonly accepted, the underlying assumption or source of uncertainty was reviewed to determine its impact on this application. Only those assumptions or sources of uncertainty that could significantly impact the risk calculations were considered key for this application. This review did not identify any assumptions or sources of uncertainty that were key to this application.

Table A.7-4 Key Uncertainties and Assumptions ID

" ' . Summ~ry .. Disposition N/A None Identified N/A