ML19298C972

50.69 Apla SE Input L-2018-LLA-0482

ML19298C972
Person / Time
Site:	Calvert Cliffs
Issue date:	10/31/2019
From:	Robert Pascarelli NRC/NRR/DRA/APLA
To:	James Danna NRC/NRR/DORL/LPL1
Jigar Patel
References
EPID L-2018-LLA-0482
Download: ML19298C972 (26)

Text

October 31, 2019 MEMORANDUM TO:

James G. Danna, Chief Plant Licensing Branch I Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation FROM:

Robert Pascarelli, Chief

/RA/

PRA Licensing Branch A Division of Risk Assessment Office of Nuclear Reactor Regulation

SUBJECT:

PROBABILISTIC RISK ASSESSMENT LICENSING BRANCH A SAFETY EVALUATION INPUT FOR CALVERT CLIFFS NUCLEAR POWER PLANT, UNITS 1 AND 2 LICENSE AMENDMENT REQUEST: APPLICATION TO ADOPT TITLE 10 CODE OF FEDERAL REGULATIONS 50.69, RISK-INFORMED CATEGORIZATION AND TREATMENT OF STRUCTURES, SYSTEMS AND COMPONENTS FOR NUCLEAR POWER REACTORS By application dated November 28, 2018 and supplemented by letters dated July 1, July 19 and October 9, 2019, Exelon Generation Company LLC, requested license amendment for Calvert Cliffs Nuclear Power Plant Units 1 and 2 in accordance with part 50.90 and 50.69 of Title 10 of the Code of Federal Regulations (CFR). The requested change is the adoption of 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors.

The Probabilistic Risk Assessment Licensing Branch A (APLA) reviewed the proposed changes using the generic requirements identified in Regulatory Guide (RG) 1.201 and Nuclear Energy Institute (NEI) 00-04. On the basis of our review, and as discussed in the attached safety evaluation, the APLA staff finds that the methodology and approach used by the licensee are consistent with RG 1.201 and NEI 00-04 and therefore acceptable.

Docket Nos. 50-317 50-318

Enclosure:

Safety Evaluation CONTACT: Jigar Patel, NRR/DRA 301-415-2832

ML19298C972 NRR-106 OFFICE NRR/DRA/APLA NRR/DRA/APLA: BC NAME JPatel RPascarelli DATE 10/29/2019 10/31/2019

Enclosure SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. [ ] TO RENEWED FACILITY OPERATING LICENSE NO. []

EXELON GENERATION COMPANY LLC CALVERT CLIFFS NUCLEAR POWER PLANT UNITS 1 AND 2 DOCKET NOS. 50-317 AND 50-318

1.0 INTRODUCTION

By application dated November 28, 2018 (Reference 1), as supplemented by letters dated July 1, July 19 and October 9, 2019, (References 2, 3 and 4), Exelon Generation Company LLC (or the licensee), submitted a license amendment request (LAR) for the Calvert Cliffs Nuclear Power Plant, Units 1 and 2 (CCNPP). The licensee proposed to add a new license condition to the Renewed Facility Operating Licenses to allow the implementation of Title 10 of the Code of Federal Regulations (10 CFR) Section 50.69, Risk-informed categorization and treatment of structures, systems and components for nuclear power reactors. The provisions of 10 CFR 50.69 allow adjustment of the scope of structures, systems and components (SSCs) subject to special treatment requirements (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation) based on a method of categorizing SSCs according to their safety significance.

The supplements provided additional information that clarified the application, did not expand the scope of the application as originally noticed, and did not change the NRC staffs original proposed no significant hazards consideration determination as published in the Federal Register on February 13, 2018 (83 FR 6226).

2.0 REGULATORY EVALUATION

2.1 Risk-Informed Categorization and Treatment of SSCs The risk-informed (RI) approach to regulation enhances and extends the traditional deterministic regulation by considering risk in a comprehensive manner.

Specifically, a RI approach allows consideration of a broader set of potential challenges to safety, providing a logical means for prioritizing these challenges based on safety-significance and allowing consideration of a broader set of resources to defend against these challenges.

Probabilistic risk assessments (PRAs) address credible initiating events by assessing the event frequency. Mitigating system reliability is then assessed, including the potential for common cause failures.

To take advantage of the safety enhancements available through the use of PRA, the NRC promulgated a new regulation, 10 CFR 50.69, in the Federal Register on November 22, 2004 (69 FR 68008), which became effective on December 22, 2004. The provisions of 10 CFR 50.69 allow adjustment of the scope of SSCs subject to special treatment requirements.

Special treatment refers to those requirements that provide increased assurance beyond normal industry practices that SSCs perform their design-basis functions. For SSCs categorized as low safety significance (LSS), alternative treatment requirements may be implemented in accordance with the regulation. For SSCs determined to be of high safety-significance (HSS),

the requirements may not be changed.

Section 50.69 of 10 CFR contains requirements regarding how a licensee categorizes SSCs using a RI process, adjusts treatment requirements consistent with the relative significance of the SSC, and manages the process over the lifetime of the plant. A RI categorization process is employed to determine the safety significance of SSCs and place the SSCs into one of four risk-informed safety class (RISC) categories. The determination of safety significance is performed by an integrated decision-making process, which uses both risk insights and traditional engineering insights. The safety functions include the design-basis functions, as well as functions credited for severe accidents (including external events). Special or alternative treatment for the SSCs is applied as necessary to maintain functionality and reliability; and is a function of the 10 CFR 50.69 categorization process results and associated bases. Finally, periodic assessment activities are conducted to adjust the categorization and/or treatment processes as needed so that SSCs continue to meet all applicable functional requirements.

Section 50.69 of 10 CFR does not allow for the elimination of SSC functional requirements or allow equipment that is required by the deterministic design basis to be removed from the facility. Instead, 10 CFR 50.69 enables licensees to focus their resources on SSCs that make a significant contribution to plant safety. In 2004 when promulgating the 10 CFR 50.69 rule, the Commission stated:

It is important to note that this rulemaking effort, while intended to ensure that the scope of special treatment requirements imposed on SSCs is risk-informed, is not intended to allow for the elimination of SSC functional requirements or to allow equipment that is required by the deterministic design basis to be removed from the facility (i.e., changes to the design of the facility must continue to meet the current requirements governing design change; most notably § 50.59).

Instead, this rulemaking should enable licensees and the staff to focus their resources on SSCs that make a significant contribution to plant safety by restructuring the regulations to allow an alternative risk-informed approach to special treatment. Conversely, for SSCs that do not significantly contribute to plant safety on an individual basis, this approach should allow an acceptable, though reduced, level of confidence (i.e., reasonable confidence) that these SSCs will satisfy functional requirements. However, continued maintenance of the health and safety of the public will depend on effective implementation of

§ 50.69 by the licensee or applicant applying the rule at its nuclear power plant.

2.2 Licensee Proposed Changes In its letter dated November 28, 2018 (Reference 1), the licensee proposed to amend its Renewed Facility Operating Licenses by adding the following license condition that would allow for the implementation of 10 CFR 50.69.

Exelon is approved to implement 10 CFR 50.69 using the processes for categorization of Risk-Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC-4 structures, systems, and components (SSC) using: Probabilistic Risk Assessment (PRA) models to evaluate risk associated with internal events, including internal flooding, and internal fire; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (ANO-2) passive categorization method to assess passive component risk for Class 2 and Class 3 and non-Class SSCs and their associated supports; the results of the non-PRA evaluations that are based on the IPEEE Screening Assessment for external hazards updated using the external hazard screening significance process identified in ASME/ANS PRA Standard RA-Sa-2009 for other external hazards except seismic; and the (EPRI) alternative approach described in EPRI 3002012988 for seismic risk for Tier 1 plants.

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

2.3 Regulatory Review The NRC staff reviewed the licensees application to determine whether: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) activities proposed will be conducted in compliance with the Commissions regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or the health and safety of the public. The NRC staff considered the following regulatory requirements and guidance during its review of the proposed changes.

Regulatory Requirements Section 50.69 of 10 CFR provides an alternative approach for establishing requirements for treatment of SSCs for nuclear power reactors using an integrated and systematic RI process for categorizing SSCs according to their safety significance. Specifically, for SSC categorized as LLS, alternative treatment requirements may be implemented in accordance with the regulation.

For SSCs determined to be HSS, requirements may not be changed.

Paragraph 50.69(c) of 10 CFR requires the licensees to use an integrated decision-making process to categorize safety-related and non-safety-related SSCs according to the safety-significance of the functions they perform into one of the following four RISC categories, which are defined in 10 CFR 50.69(a), as follows:

RISC-1:

Safety-related SSCs that perform safety-significant functions1 RISC-2:

Non-safety-related SSCs that perform safety-significant functions RISC-3:

Safety-related SSCs that perform LSS functions RISC-4:

Non-safety-related SSCs that perform LSS functions The SSCs are classified as having either HSS functions (i.e., RISC-1 and RISC-2 categories) or LSS functions (i.e., RISC-3 and RISC-4 categories). For HSS SSCs, 10 CFR 50.69 maintains current regulatory requirements (i.e., it does not remove any requirements from these SSCs) for special treatment. For LSS SSCs, licensees can implement alternative treatment requirements 1 Nuclear Energy Institute (NEI) 00-04 uses the term high-safety-significant (HSS) to refer to SSCs that perform safety-significant functions. The NRC understands HHS to have the same meaning as safety-significant (i.e., SSCs that are categorized as RISC-1 or RISC-2), as used in 10 CFR 50.69.

in accordance with 10 CFR 50.69(b)(1) and 10 CFR 50.69(d). For RISC-3 SSCs, licensees can replace special treatment with an alternative treatment. For RISC-4 SSCs, 10 CFR 50.69 does not impose new treatment requirements and RISC-4 SSCs are removed from the scope of any applicable special treatment requirements identified in 10 CFR 50.69(b)(1).

Paragraph 50.69(c)(1) of 10 CFR states that SSCs must be categorized as RISC-1, RISC-2, RISC-3, or RISC-4 SSCs, using a categorization process that determines if an SSC performs one or more safety-significant functions and identifies those functions. The process must:

(i) Consider results and insights from the plant-specific PRA. This PRA must, at a minimum, model severe accident scenarios resulting from internal initiating events occurring at full power operation. The PRA must be of sufficient quality and level of detail to support the categorization process; and must be subjected to a peer review process assessed against a standard or set of acceptance criteria that is endorsed by the NRC.

(ii) Determine SSC functional importance using an integrated, systematic process for addressing initiating events (internal and external), SSCs, and plant operating modes, including those not modeled in the plant-specific PRA. The functions to be identified and considered include design bases functions and functions credited for mitigation and prevention of severe accidents. All aspects of the integrated, systematic process used to characterize SSC importance must reasonably reflect the current plant configuration and operating practices, and applicable plant and industry operational experience.

(iii) Maintain defense-in-depth (DID).

(iv) Include evaluations that provide reasonable confidence that for SSCs categorized as RISC-3, sufficient safety margins are maintained and that any potential increases in core damage frequency (CDF) and large early release frequency (LERF) resulting from changes in treatment permitted by implementation of Sections 50.69(b)(1) and (d)(2) are small.

(v) Be performed for entire systems and structures, not for selected components within a system or structure.

Paragraph 50.69(c)(2) of 10 CFR states: The SSCs must be categorized by an Integrated Decision-Making Panel (IDP) staffed with expert, plant-knowledgeable members whose expertise includes, at a minimum, PRA, safety analysis, plant operation, design engineering, and system engineering.

Paragraph 50.69(b)(3) of 10 CFR states that the Commission will approve a licensees implementation of this section by issuance of a license amendment if the Commission determines that the categorization process satisfies the requirements of 10 CFR 50.69(c). As stated in 10 CFR 50.69(b), after the NRC approves an application for a license amendment, a licensee may voluntarily comply with 10 CFR 50.69 as an alternative to compliance with the following requirements for LSS SSCs: (i) 10 CFR Part 21, (ii) a portion of 10 CFR 50.46a(b),

(iii) 10 CFR 50.49, (iv) 10 CFR 50.55(e), (v) certain requirements of 10 CFR 50.55a, (vi) 10 CFR 50.65, except for paragraph (a)(4), (vii) 10 CFR 50.72, (viii) 10 CFR 50.73, (ix) Appendix B to 10 CFR Part 50, (x) certain containment leakage testing requirements, and (xi) certain requirements of Appendix A to 10 CFR Part 100.

Guidance Nuclear Energy Institute (NEI) 00-04, Revision 0, 10 CFR 50.69 SSC Categorization Guideline (Reference 5), describes a process for determining the safety-significance of SSCs and categorizing them into the four RISC categories defined in 10 CFR 50.69. This categorization process is an integrated decision-making process that incorporates risk and traditional engineering insights. NEI 00-04, Revision 0, provides options for licensees implementing different approaches depending on the scope of their PRA models. It also allows for the use of non-PRA approaches when PRA models have not been developed to address hazards such as seismic, fire, or shutdown risk. As stated in NRC Regulatory Guide (RG) 1.201, Revision 1, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance (Reference 6), such non-PRA-type evaluations will result in more conservative categorization, in that special treatment requirements will not be allowed to be relaxed for SSCs that are relied upon in such evaluations that are categorized as HSS. The degree of relaxation that the NRC will accept under 10 CFR 50.69 (i.e., SSCs subject to relaxation of special treatment requirements) will be commensurate with the assurance provided by the evaluations performed to assess and characterize the SSCs risk.

Sections 2 through 10 of NEI 00-04 describe steps/elements of the SSC categorization process to be performed for meeting the requirements of 10 CFR 50.69(c), as follows:

Sections 3.2 and 5.1 provide specific guidance corresponding to 10 CFR 50.69(c)(1)(i).

Sections 3, 4, 5, and 7 provide specific guidance corresponding to 10 CFR 50.69(c)(1)(ii).

Section 6 provides specific guidance corresponding to 10 CFR 50.69(c)(1)(iii).

Section 8 provides specific guidance corresponding to 10 CFR 50.69(c)(1)(iv).

Section 2 provides specific guidance corresponding to 10 CFR 50.69(c)(1)(v).

Sections 9 and 10 provide specific guidance corresponding to 10 CFR 50.69(c)(2).

Additionally, Section 11 of NEI 00-04 provides guidance on program documentation and change control related to the requirements of 10 CFR 50.69(e). Section 12 of NEI 00-04 provides guidance on periodic review related to the requirements in 10 CFR 50.69(f). Maintaining change control and periodic review provides confidence that all aspects of the program reasonably reflect the current as-built and as-operated plant configuration and operating practices, and applicable plant and industry operational experience, as required by 10 CFR 50.69(c)(1)(ii).

RG 1.201, Revision 1, endorses the categorization process described in NEI 00-04, Revision 0, with clarifications, limitations, and conditions. RG 1.201 Revision 1 states that the applicant is expected to document, at a minimum, the technical adequacy of the internal initiating events PRA. Licensees may use either PRAs or alternative approaches for hazards other than internal initiating events. The guidance in RG 1.201 Revision 1 clarifies that the NRC staff expects that licensees proposing to use non-PRA approaches in their categorization should provide a basis in the submittal for why the approach and the accompanying method employed to assign safety significance to SSCs is technically acceptable. The guidance further states that as part of the NRCs review and approval of a licensees or applicants application requesting to adopt 10 CFR 50.69, the NRC staff intends to impose a license condition that will explicitly address the scope of the PRA and non-PRA methods used in the licensees categorization approach. If a licensee or applicant wishes to change its categorization approach and the change is outside the bounds of the NRCs license condition (e.g., switch from a seismic margins analysis to a seismic PRA), the licensee or applicant will need to seek NRC approval, via a license amendment, of the implementation of the new approach in their categorization process.

In addition, RG 1.201Revision 1 states that all aspects of NEI 00-04 must be followed to achieve reasonable confidence in the evaluations required by 10 CFR 50.69(c)(1)(iv).

RG 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities (Reference 7), describes an acceptable approach for determining whether the acceptability of the PRA, in total or the parts that are used to support an application, is sufficient to provide confidence in the results, such that the PRA can be used in regulatory decision making for light-water reactors. It endorses, with clarifications, the American Society of Mechanical Engineers (ASME)/American Nuclear Society (ANS) PRA Standard ASME/ANS RA-Sa-2009 (ASME/ANS 2009 Standard or PRA Standard) (Reference 8). This RG provides guidance for determining the technical acceptability of a PRA by comparing the PRA to the relevant parts of the ASME/ANS 2009 Standard using a peer review process. In accordance with the guidance, peer reviews should be used for PRA upgrades. A PRA upgrade is defined in the PRA Standard as the incorporation into a PRA model of a new methodology or significant changes in scope or capability that impact the significant accident sequences or the significant accident progression sequences.

RG 1.174, Revision 3, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis (Reference 9), provides guidance on the use of PRA findings and risk insights in support of changes to a plants licensing basis.

This RG provides risk acceptance guidelines for evaluating the results of such evaluations.

NUREG-1855, Revision 1, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision-making, March 2017 (Reference 10), provides guidance on how to treat uncertainties associated with PRA in RI decision making. The guidance fosters an understanding of the uncertainties associated with PRA and their impact on the results of the PRA and provides a pragmatic approach to addressing these uncertainties in the context of the decision making.

3.0 TECHNICAL EVALUATION

3.1 Staffs Method of Review The NRC staff evaluated the licensees application to determine if the proposed changes are consistent with the regulations and guidance discussed in Section 2.0 of this safety evaluation (SE). The NRC staffs review and the documentation of that review in this SE uses the framework of NEI 00-04, Revision 0, as endorsed in RG 1.201, Revision 1.

3.2 Overview of the Categorization Process (NEI 00-04, Section 2)

Paragraph 50.69(b)(2)(i) of 10 CFR states that a licensee voluntarily choosing to implement 10 CFR 50.69 shall submit an application for license amendment under 10 CFR 50.90 that contains a description of the process for categorization of RISC-1, RISC-2, RISC-3 and RISC-4 SSCs. In addition, 10 CFR 50.69(c)(1)(v) states that the process for categorization must be performed for entire systems and structures, not for selected components within a system or structure.

The guidance in RG 1.201 provides that the categorization process described in NEI 00-04, with any noted exceptions or clarifications, is acceptable for implementation of 10 CFR 50.69.

Section 2 of NEI 00-04 states that the categorization process includes eight primary steps:

1. Assembly of Plant-Specific Inputs (Section 3 of NEI 00-04);

2. System Engineering Assessment (Section 4 of NEI 00-04);

3. Component Safety Significance Assessment (Section 5 of NEI 00-04);

4. Defense in Depth Assessment (Section 6 of NEI 00-04);

5. Preliminary Engineering Categorization of Functions (Section 7 of NEI 00-04);

6. Risk Sensitivity Study (Section 8 of NEI 00-04)

7. Integrated Development Plan (IDP) Review (Section 9 of NEI 00-04); and

8. SSC Categorization (Section 10 of NEI 00-04).

The licensee stated in the LAR that it will implement the risk categorization process in accordance with NEI 00-04, as endorsed by RG 1.201. The LAR provided details of the categorization process as follows: (1) summary of the categorization process, (2) order of the sequence of elements or steps that will be performed (function/component level),

(3) explanation of the difference between preliminary HSS and assigned HSS, and (4) identification of which inputs can and which cannot be changed by the IDP from preliminary HSS to LSS.

As summarized in the LAR, the categorization process contains the following elements/steps:

Defining system boundaries (see Section 3.3 of this SE).

Defining system functions and assigning components to functions (see Section 3.4 of this SE).

Risk Characterization. Safety-significance of active components is assessed through a combination of PRA and non-PRA methods, covering all hazards (see Section 3.5 of this SE).

DID characterization performed in accordance with Section 6 of NEI 00-04 (see Section 3.6 of this SE).

Passive Characterization. Passive components are not modeled in the PRA, and therefore, a different assessment method is used to assess the safety-significance of these components. This process addresses those components that have only a pressure-retaining function and the passive function of active components such as the pressure/liquid retention of the body of a motor-operated valve (see Section 3.5.4 of this SE).

Qualitative Characterization. System functions are qualitatively categorized as HSS or LSS based on the seven questions in Section 9.2 of NEI 00-04 (see Section 3.9 of this SE).

Cumulative risk sensitivity study. For PRA-modeled components, an overall risk sensitivity study is used to confirm that the population of LSS components results in acceptably small increases to CDF and LERF and meets the acceptance guidelines of RG 1.174 (see Section 3.8 of this SE).

Review by the IDP. The categorization results are presented to the IDP for review and approval. The IDP reviews the categorization results and makes the final determination on the safety-significance of system functions and components (see Section 3.9 of this SE).

In the LAR, the licensee explained that consistent with NEI 00-04, the categorization of a component or function is preliminary until it has been confirmed by the IDP (see also Section 3.9 of this SE). The licensee stated that a component or function is preliminarily categorized as HSS if any element of the process results in a preliminary HSS determination. This preliminary categorization will be presented to the IDP for review. The IDP will decide the final categorization as further discussed in Section 3.9 of this SE.

In Table 3-1 of the LAR, the licensee describes how some steps of the process are performed at the component level (e.g., all PRA and non-PRA-modeled hazards, containment DID, passive categorization), how some steps are performed at the function level (e.g., qualitative criteria),

and how some steps are performed at the function and component level (e.g., shutdown, core damage, DID).

As discussed in Section 3.7 of this SE, if any SSC is identified as HSS from either the PRA component safety significance assessment (internal events in Section 5.1 of NEI 00-04, integral PRA assessment in Section 5.6 of NEI 00-04) or the DID assessment (Section 6 of NEI 00-04),

the associated system function(s) would be identified as HSS. Once a system function is identified as HSS, then all the components supporting that function are preliminary HSS and will be presented to the IDP for review.

The NRC staff has evaluated the categorization steps; and finds that the licensees process is consistent with all aspects of the process in NEI 00-04, as endorsed by RG 1.201.

3.3 Assembly of Plant-Specific Information (NEI 00-04, Section 3)

Section 3 of NEI 00-04 states that the assembly of plant-specific inputs involves the collection and assessment of the key inputs to the RI categorization process. This includes design and licensing information, PRA analyses, and other relevant plant data sources. In addition, this step includes the critical evaluation of plant-specific risk information to ensure that they are adequate to support this application. The guidance in Section 3 of NEI 00-04 summarizes the use of risk information and the general quality measures that should be applied to the risk analyses supporting the 10 CFR 50.69 categorization as well as the characterization of technical acceptability of both the internal events at power PRA and other risk analyses necessary to implement 10 CFR 50.69.

The licensees risk categorization process uses PRAs to assess risks from internal events (including internal flooding) and from fire. For the other applicable risk hazard groups, the licensees process uses non-PRA methods for the risk characterization. The licensee uses the Electric Power Research Institute (EPRI) alternative approach described in EPRI 3002012988 to assess seismic risk, its individual plant examination of external events (IPEEE) screening to assess the risk from other external hazards (high winds, external floods), and its shutdown safety plan to assess shutdown risk. The use of risk information and quality of PRA is reviewed in Section 3.5 of this SE.

3.4 System Engineering Assessment (NEI 00-04, Section 4)

Paragraph 50.69(c)(1)(ii) of 10 CFR requires licensees to determine SSC functional importance using an integrated, systematic process for addressing initiating events (internal and external),

SSCs, and plant operating modes, including those not modeled in the plant-specific PRA. The functions to be identified and considered include design-basis functions and functions credited for mitigation and prevention of severe accidents. Section 4 of NEI 00-04 provides guidance for developing a systematic engineering assessment involving the identification and development of base information necessary to perform the RI categorization. The assessment includes the following elements: system selection and system boundary definition, identification of system functions, and a mapping of components to functions.

Section 4 of NEI 00-04 states that system selection and boundary definition include defining system boundaries where the system interfaces with other systems.

Section 4 of NEI 00-04 states that a candidate LSS SSC that supports an interfacing system "will remain uncategorized until the interfacing system is considered". In Request for Additional Information (RAI) 6 (Reference 2) the NRC staff requested the licensee confirm that any functions/SSCs that serve as an interface between two or more systems will not be categorized and will not receive alternative treatment prior to completing the categorization for all the systems that they support, or alternatively, to describe and provide detailed technical and regulatory justification for any alternative approach.

In response to RAI #6 (Reference 2), as revised in LAR supplement dated October 9, 2019 (Reference 6), the licensee proposed to categorize an SSC that supports functions in an interfacing system without completing the categorization of that interfacing system, if the following two conditions are met: 1) an interface SSC failure cannot prevent performance of interface system functions, and 2) the risk is limited to passive failures assessed as LSS following the passive categorization process for the applicable pressure boundary segments.

The licensee stated that the interface SSC can be assessed without performing a full interface system categorization because adequate interface system function knowledge is available to perform the functional assessment and passive risk assessment and that categorizing the entire interfacing system would produce the same functional assessment and passive risk significance for the component. The NRC staff notes that passive failure classification proposed by the licensee only affects treatment program for Class 2 and Class 3 pressure-retaining items and their associated supports (exclusive of Class CC and MC items). Passive failures are not normally modelled in PRAs and the licensees proposed passive categorization process relies on the conditional core damage and large early release probabilities following a passive failure, which are determined by imposing the impact of the passive failure on all components modelled in the PRA. This passive categorization method requires the full impact of the passive failure on safety-significance to be evaluated, regardless of which system the component is assigned to.

In addition to the passive categorization method, the licensee also stated it will perform the categorization only if it can confirm that a failure of the interface component cannot prevent performance of an interfacing system function. The NRC staff finds that the licensees proposal as described above will yield the same or more conservative result when (and if) the uncategorized system is categorized and therefore accepts the licensee proposal.

Identification of system functions includes identification of all system functions including design-basis and beyond design-basis functions identified in the PRA and making sure that system functions are consistent with the functions defined in design-basis documentation and maintenance rule functions. The coarse mapping of components to functions involves the initial breakdown of system components into system functions they support. The licensee should then identify, and document system components and equipment associated with each function.

Paragraph 50.69(c)(1)(v) of 10 CFR requires that categorization be performed for entire systems and structures, not for selected components within a system or structure. The process described in the LAR and summarized above is consistent with, and capable of, collecting and organizing information at the system level by defining boundaries, functions, and components.

Therefore, the NRC staff finds that 10 CFR 50.69(c)(1)(v) will be satisfied upon implementation of the licensees 10 CFR 50.69 categorization process.

Section 2.2 of the LAR states that the safety functions in the categorization process include the design-basis functions, as well as functions credited for severe accidents (including external events). Section 3.1.1 of the LAR summarizes the different hazards and plant states for which functional and risk-significant information will be collected. In addition, Section 3.1.1 of the LAR states that the SSC categorization process documentation will include, among other items, system functions identified and categorized with the associated bases and mapping of components to support function(s).

Paragraph 50.69(c)(1)(ii) of 10 CFR requires, in part, that the functions to be identified and considered in the categorization process include design-basis functions and functions credited for mitigation and prevention of severe accidents. NEI 00-04 includes guidance to identify all functions performed by each system and states that the IDP will categorize all system functions.

All system functions include all functions involved in the prevention and mitigation of accidents and may include additional functions not credited as hazard mitigating functions, depending on the system. The LAR summarizes the applicable guidance in NEI 00-04 and states that the guidance in NEI 00-04 will be followed. Therefore, the NRC staff finds that the licensee described a systematic process that will identify design-basis functions and functions credited for mitigation and prevention of severe accidents, consistent with the requirements of 10 CFR 50.69(c)(1)(ii).

3.5 Component Safety Significance Assessment (NEI 00-04, Section 5)

Paragraph 50.69(c)(1)(ii) of 10 CFR requires licensees to determine SSC functional importance using an integrated, systematic process for addressing initiating events (internal and external),

SSCs, and plant operating modes, including those not modeled in the plant-specific PRA. The component safety significance assessment assesses the safety significance of components using quantitative or qualitative risk information from a PRA or other risk assessment methods.

In the NEI 00-04 guidance, component risk significance is assessed separately for the following hazard groups:

Internal Events (including internal flooding)

Fire Seismic Other external hazards (tornadoes, external flooding)

Shutdown Events Paragraph 50.69(c)(1)(i) of 10 CFR requires, in part, the use of PRA to assess risk from internal events as a minimum. This paragraph of the rule further specifies that the PRA used in the categorization process must be of sufficient quality and level of detail and subject to an acceptable peer review process. For the hazards other than internal events, including fire, seismic, other external hazards (high winds, external floods, etc.), and shutdown, 10 CFR 50.69(b)(2) allows, and the guidance in NEI 00-04 summarizes, the use of PRA, if such PRA models exist, or, in the absence of quantifiable PRA, the use of other methods (e.g., fire-induced vulnerability evaluation, seismic margins analysis, IPEEE screening, and shutdown safety management plan).

In LAR Sections 3.1.1 and 3.2.1 through 3.2.5, the licensee described that the CCNPP categorization process uses PRA to assess risks for the internal events (including internal flooding) and from fire. For the other three risk hazard groups, the licensees process uses non-PRA methods for the risk characterization, as follows:

EPRI alternative approach to assess seismic risk IPEEE screening to assess the risk from other external hazards (high winds, external floods)

Shutdown safety plan to assess shutdown risk Passive Components: ANO-2 passive categorization methodology The approaches and methods used by the licensee to assess internal events, other external hazards, and shutdown events, are consistent with the methods included in the NEI 00-04 guidance, as endorsed by RG 1.201. The non-PRA method for the categorization of passive components is consistent with the ANO-2 methodology for passive components (Reference 11) approved for RI safety classification and treatment for repair/replacement activities in Class 2 and 3 moderate and high energy systems. To address seismic events, the licensee proposed to use an alternative method not specified in the NEI 00-04 guidance as endorsed by RG 1.201.

The guidance considers the results and insights from the plant-specific PRA peer reviews as required by 10 CFR 50.69(c)(1)(i), and non-PRA risk characterization as required by 10 CFR 50.69(c)(1)(ii). The application of these methods is reviewed in the following SE subsections: PRA in Subsections 3.5.1 and 3.5.2 and the non-PRA methods in Subsection 3.5.3.

3.5.1 Evaluation of PRA Acceptability to Support the SSC Categorization Process The licensees PRA is comprised of: (1) an internal events PRA that calculates CDF and LERF from internal events, including internal flooding, at full power, and (2) a fire PRA. Paragraph 50.69(c)(1)(i) of 10 CFR requires, in part, that the PRA must be of sufficient quality and level of detail to support the categorization process and must be subjected to a peer review process assessed against a standard or set of acceptance criteria that is endorsed by the NRC.

Paragraph 50.69(b)(2)(iii) of 10 CFR requires the results of the peer review process conducted to meet 10 CFR 50.69(c)(1)(i) be submitted as part of the application. The licensee has submitted this information and the NRC staffs review of this information is presented below.

3.5.1.1 Internal Events PRA The licensee states in LAR Section 3.2 that the PRA models credited in the request are the same PRA models credited in NRCs Technical Specification Task Force (TSTF)-505 SE (Reference 12) with routine maintenance updates applied. In response to RAI 7 (Reference 2),

the licensee stated that FLEX (Diverse and Flexible Coping Strategy) equipment and associated operator actions are not currently credited in the internal events or the fire PRA. Therefore, the staffs review of the internal events and flooding PRAs was based on the results provided in the LAR and TSTF-505 application.

As stated in the LAR and in the TSTF-505 application, a full scope peer review was performed in June 2010 for the internal events PRA (including internal flooding) against the requirements of the PRA standard ASME/ANS RA-Sa-2009 and RG 1.200 Revision 2. A focused-scope peer review was conducted in January 2017 for a PRA upgrade related to changes in the internal flooding PRA, including changes to the pipe break rupture frequencies and was performed against ASME/ANS RA-Sa-2009 PRA Standard using the process in NEI 05-04, Revision 3, Process for Performing Internal Events PRA Peer Reviews Using the ASME/ANS PRA Standard, dated November 2009 (Reference 13). A finding closure review was conducted on the internal events PRA model in January 2017. Closed findings were reviewed and closed using the process documented in Appendix X to NEI 05-04, NEI 07-12, and NEI 12-13, Close-out of Facts and Observations as accepted by NRC in the letter dated May 3, 2017 (Reference 14).

In Attachment 3 of the LAR, the licensee provided and dispositioned two facts and observations (F&Os) related to internal flooding that remained open after the Appendix X F&O closure. The NRC staff finds the dispositions of the two F&Os acceptable for this application since they are documentation related.

Based on the NRC staffs review and on the previous review of the licensees application for TSTF-505 (Reference 12), the staff finds that the internal events and internal flooding PRA has been adequately peer reviewed against the current version of the PRA standard and RG 1.200, and that the licensee has adequately dispositioned the F&Os to support the technical adequacy of the internal events PRA for the Calvert Cliffs 50.69 RI categorization program.

3.5.1.2 Fire PRA The licensee states in the LAR that the PRA models credited in the 50.69 LAR are the same PRA models credited in NRCs TSTF-505 SE (Reference 15) with routine maintenance updates applied. Therefore, the staffs review of the Fire PRA was based on the results provided in the LAR and TSTF-505 application.

The licensee evaluated the technical adequacy of the Calvert Cliffs Fire PRA model by conducting a full-scope peer review in January 2012 using NEI 07-12, Fire Probabilistic Risk Assessment (FPRA) Peer Review Process Guidelines, Draft Version H, Revision 0, dated November 2008 (Reference 16), and the fire PRA (Part 4) of the PRA standard, as clarified by RG 1.200, Revision 2.

As a result of its review of the NFPA 805 LAR dated September 24, 2013 (Reference 17), as supplemented, the NRC staff concluded in issuance of amendments dated August 30, 2016 (Reference 14), that (1) the fire PRA model adequately represents the current, as-built, as-operated configuration, and is, therefore, capable of modeling the plant as needed; (2) the fire PRA model conforms sufficiently to the applicable industry PRA standards at an appropriate capability category, considering the acceptable disposition of the peer review and NRC staff review findings; and (3) the fire modeling used to support the development of the FPRA has been confirmed as appropriate and acceptable. Similar conclusion was reached during the review of the TSTF-505 application. Based on the review of this LAR, the NRC staff identified no information that would invalidate the staffs NFPA-805 or the TSTF-505 conclusion that the fire PRA is technically acceptable to support risk calculations. Therefore, the NRC staff concludes that the fire PRA is technically acceptable to support the 50.69 program.

3.5.2 Importance Measures and Sensitivity Studies Paragraph 50.69(c)(1)(i) of 10 CFR requires the licensee to consider the results and insights from the PRA during categorization. These requirements are met, in part, by using importance measures and sensitivity studies, as described in the methodology in NEI 00-04, Section 5.

Fussell-Vesely and Risk Achievement Worth importance measures are obtained for each component and each PRA modeled hazard (i.e., separately for the internal events PRA and for the fire PRA) and the values are compared to specified criteria in NEI 00-04. Components that have internal event importance measure values that exceed the criteria are assigned HSS and cannot be changed by the IDP. Components that have fire event importance measures exceeding the criteria are assigned preliminary HSS. Integrated importance measures over all PRA modeled hazards are calculated per Section 5.6 of NEI 00-04, and components for which the integrated measures exceed the criteria are assigned preliminary HSS.

The guidance in NEI 00-04 specifies the sensitivity studies to be conducted for each PRA model. The sensitivity studies are performed to ensure that assumptions associated with these specific uncertain parameters (i.e., human error, common-cause failure, and maintenance probabilities) are not masking the importance of a component. The NEI 00-04 guidance states that any additional applicable sensitivity studies from characterization of PRA adequacy should be considered.

In LAR Section 3.2.7 the licensee stated that it used the detailed process of identifying, characterizing and qualitative screening of model uncertainties found in Section 5.3 of NUREG-1855, Revision 0 (Reference 18) and Section 3.1.1 of EPRI Technical Report (TR)-1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments (Reference 19).

In LAR Attachment 6, the licensee provided a list of key assumptions and sources of modeling uncertainties that were reviewed for the internal events (including internal flooding) and fire PRAs and dispositions for each entry. The assessment concluded that, in general, no additional sensitivity analyses were needed to address PRA model-specific assumptions or sources of uncertainty. In RAI 7 (Reference 3), the NRC staff requested a description of the process used to identify and evaluate generic and plant-specific key assumptions and sources of uncertainty for the internal events, including internal flooding, and fire PRA. In response to RAI 7.c (Reference 3), the licensee reviewed NUREG-1855, Revision 1 (Reference 10) to assess the process and the criteria used to identify the application specific key assumptions and sources of uncertainty. The review of NUREG-1855, Revision 1, identified the need to systematically assess the generic fire PRA uncertainties in Appendix B of EPRI TR-1026511 (Reference 22).

The licensee states that this additional assessment of key sources of fire generic uncertainties was performed and no new potential key sources of model uncertainty or assumptions were identified because of the review. Additional steps of NUREG-1855, Revision 1 were reviewed and determined to either have been addressed by the licensees previous methodology or did not apply since the licensee employed a more conservative methodology. Further, in response to RAI 7.a (Reference 3), the licensee provided a description of the process and criteria used to identify the application specific key assumptions and sources of uncertainties. The licensee stated that as part of the model uncertainty analyses, the potential key assumptions and uncertainties, identified for each ASME PRA element, are reviewed to identify those uncertainties and assumptions which may have the potential to affect the results in order to determine that reasonable alternative assumptions, if available, do not affect the decision; and aggregated in the PRA Uncertainty Assessment Notebook. The licensee further stated that for the 50.69 analysis, the assumptions and uncertainties and their characterizations in the internal events and fire PRA Uncertainty Assessment Notebooks were reviewed specific to the application. Human error was identified as candidate key source of model uncertainty for the 50.69 application. This uncertainty is addressed by NEI 00-04 by requiring sensitivity studies which increase internal events human error basic events to 95th percentile and also decrease to 5th percentile.

Based on its review, the NRC staff finds that the licensee searched for, identified, and evaluated sources of uncertainty in its internal events (including internal flooding) and fire PRAs consistent with the guidance in RG 1.200, Revision 2, NUREG-1855, and EPRI TR-1026511, as applicable. Therefore, the NEI 00-04 guidance to identify additional applicable sensitivity studies is satisfied.

3.5.3 Non-PRA Methods According to 10 CFR 50.69(c)(1)(ii), the licensee shall determine SSC functional importance using an integrated, systematic process for addressing initiating events, SSCs, and plant operating modes, including those not modeled in the plant-specific PRA. The functions to be identified and considered include design-basis functions and functions credited for mitigation and prevention of severe accidents.

As described in the LAR, the licensees categorization process uses the following non-PRA methods:

EPRI alternative approach to assess seismic risk IPEEE screening to assess the risk from other external hazards (high winds, external floods)

Shutdown Safety Plan as described in NUMARC 91-06 (Reference 20) to assess shutdown risk.

The NRC staffs review of these methods is discussed below.

Seismic Risk APLC Other External Hazards (High Winds, External Floods)

APLC Shutdown Risk Paragraph 50.69(c)(1)(ii) of 10 CFR requires the licensee to determine SSC functional importance using an integrated, systematic process for addressing initiating events (internal and external), SSCs, and plant operating modes, including those not modeled in the plant-specific PRA. Consistent with the guidance in NEI 00-04, the licensee proposed using the shutdown safety assessment based on NUMARC 91-06 (Reference 20). NUMARC 91-06 provides considerations for maintaining DID for the five key safety functions during shutdown, namely, decay heat removal capability, inventory control, power availability, reactivity control, and containment - primary/secondary. NUMARC 91-06 specifies that a DID approach should be used with respect to each defined shutdown key safety function. This is accomplished by designating a running and an alternative system/train to accomplish the given key safety function.

The use of NUMARC 91-06 described by the licensee in the submittal is consistent with the guidance in NEI 00-04 Revision 0 as endorsed by RG 1.201 Revision 1. The approach uses an integrated and systematic process that could identify HSS components, consistent with the shutdown evaluation process. Therefore, the NRC staff finds the licensees proposed use of NUMARC 91-06 is acceptable and meets the requirements set forth in 10 CFR 50.69(c)(1)(ii).

3.5.4 Component Safety Significance Assessment for Passive Components Passive components are not modeled in the PRA; therefore, a different assessment method is necessary to assess the safety significance of these components. Passive components are those components having only a pressure-retaining function. This process also addresses the passive function of active components, such as the pressure/liquid retention function of the body of a motor-operated valve.

In Section 3.1.2 of the LAR, the licensee proposed using a categorization method for passive components not cited in NEI 00-04 or RG 1.201 for passive component categorization; but was approved by the NRC for Arkansas Nuclear One, Unit 2 (ANO-2) (Reference 11). The ANO-2 methodology is a RI safety classification and treatment program for repair/replacement activities for Class 2 and Class 3 pressure-retaining items and their associated supports (exclusive of Class CC and MC items), using a modification of the ASME Code Case N-660, Risk-Informed Safety Classification for Use in Risk-Informed Repair/Replacement Activities,Section XI, Division 1 (Reference 21). The ANO-2 methodology relies on the conditional core damage and large early release probabilities associated with pipe ruptures. Safety-significance is generally measured by the frequency and the consequence of, in this case, pipe ruptures. Treatment requirements (including repair/replacement) only affect the frequency of passive component failure. Categorizing solely based on consequences, which measures the safety-significance of the pipe given that it ruptures, is conservative compared to including the rupture frequency in the categorization. The categorization will not be affected by changes in frequency arising from changes to the treatment. Therefore, the NRC staff finds that the use of the repair/replacement methodology is acceptable and appropriate for passive component categorization of Class 2 and Class 3 SSCs.

The licensee states in the LAR that all ASME Code Class 1 SSCs with a pressure retaining function, as well as supports, will be assigned HHS for passive categorization which cannot be changed by the IDP. Because all Class 1 SSCs and supports will be considered HSS, and only Class 2 and Class 3 SSCs will be categorized using the ANO-2 passive categorization methodology consistent with previous NRC staff approval, the NRC staff finds the licensees proposed approach for passive categorization is acceptable for the 10 CFR 50.69 categorization process.

3.5.5 Summary The NRC staff reviewed the PRA and the non-PRA methods used by the licensee in its 10 CFR 50.69 categorization process to assess the safety significance of active and passive components and finds these methods acceptable and consistent with RG 1.201 and the NRC endorsed guidance in NEI 00-04. The NRC staff approves the use of the following methods in the licensees 10 CFR 50.69 categorization process:

PRA to assess internal events, including internal flooding risk Fire PRA to assess fire risk EPRI alternative approach to assess seismic risk Screening using IPEEE to assess risk from other external hazards (high winds, external floods)

Shutdown safety assessment process to assess shutdown risk ANO-2 (see Reference 11) passive categorization method to assess passive component risk for Class 2, Class 3 and non-Code class SSCs and their associated supports 3.6 DID (NEI 00-04, Section 6)

Paragraph 50.69(c)(1)(iii) of 10 CFR requires that the process used for categorizing SSCs must maintain DID. NEI 00-04, Section 6, provides guidance on assessment of DID. In Section 3.1.1 of the LAR, the licensee states that it will require an SSC categorized as HSS based on the DID assessment in Section 6 of NEI 00-04 to be categorized as HSS.

Figure 6-1 in NEI 00-04 provides guidance to assess design-basis DID based on the frequency of the design-basis internal initiating event and the number of redundant and diverse trains nominally available to mitigate the initiating event. For each initiating event frequency, components are assigned as HSS if fewer than the indicated number of mitigating trains are nominally available. Section 6 of NEI 00-04 also provides guidance to assess containment DID based on preserving containment isolation and long-term containment integrity and on preventing containment bypass and early hydrogen burns.

RG 1.201 endorses the guidance in Section 6 of NEI 00-04; but notes that the containment isolation criteria in this section of the guidance are separate and distinct from those set forth in 10 CFR 50.69(b)(1)(x). The criteria in 10 CFR 50.69(b)(1)(x) are to be used in determining which containment penetrations and valves may be exempted from the Type B and Type C leakage testing requirements in both Options A and B of Appendix J to 10 CFR Part 50. The criteria provided in paragraph 50.69(b)(1)(x) criteria of 10 CFR not to determine the proper RISC category for containment isolation valves or penetrations.

In LAR Section 3.1.1 The licensee clarified that it will require an SSC to be categorized as HSS based on the DID assessment performed in accordance with NEI 00-04. Based on its review, the NRC staff finds the licensees categorization process is consistent with the NRC-endorsed guidance in NEI 00-04 and therefore fulfills the 10 CFR 50.69(c)(1)(iii) criterion that DID is maintained.

3.7 Preliminary Engineering Categorization of Functions (NEI 00-04, Section 7)

All the information collected and evaluated in the licensees engineering evaluations is provided to the IDP, as described in Section 7 of NEI 00-04. The IDP will make the final decision about the safety-significance of SSCs based on guidelines in NEI 00-04, the information they receive, and their expertise.

In LAR Section 3.1.1, the licensee stated that if any SSC is identified as HSS from either the integrated risk component safety-significance assessment (Section 5 of NEI 00-04), the DID assessment (Section 6 of NEI 00-04), or the qualitative criteria (Section 9 of NEI 00-04), the associated system function(s) would be identified as HSS. The licensee also stated that once a system function is identified as HSS then all the components that support that function are preliminary HSS. Table 3-1 of the LAR explains safety-significance of functions will be categorized as preliminary HSS only if it is supported by component determined to be HSS from a PRA-based assessment (i.e., internal events PRA and integrated PRA importance measures described in Section 5.6 of NEI 00-04). Components that are identified as HSS from using the non-PRA approaches (EPRI alternative seismic approach, shutdown risk, and other external hazards) will not drive the system function(s) they support to be assigned HHS.

The NRC staff finds that the above description provided by the licensee for the preliminary categorization process is consistent with the guidance in NEI 00-04, as endorsed in RG 1.201 and is, therefore acceptable.

3.8 Risk Sensitivity Study (NEI 00-04, Section 8)

Paragraph 50.69(c)(1)(iv) of 10 CFR requires, in part, that any potential increases in CDF and LERF resulting from changes to treatment are small. The categorization process described in Section 8 of NEI 00-04, as endorsed by RG 1.201, includes an overall risk sensitivity study for all the LSS components to assure that if the unreliability of the components was increased, the increase in risk would be small (i.e., meet the acceptance guidelines of RG 1.174 Revision 3).

Section 3.1.1 and Section 3.2.7 of the LAR clarify that in the sensitivity study, the unreliability of all LSS SSCs modeled in the PRA(s) will be increased by a factor of 3. Separate sensitivity studies are to be performed for each system categorized, as well as a cumulative sensitivity study for all the SSCs categorized through the 10 CFR 50.69 process.

This sensitivity study, together with the periodic review process discussed in Section 3.10 of this SE, assure that the potential cumulative risk increase from the categorization is maintained acceptably low. The performance monitoring process monitors the component performance to ensure that potential increases in failure rates of categorized components are detected and addressed before reaching the rate assumed in the sensitivity study. The NRC staff finds that the licensee will perform the risk sensitivity study consistent with the guidance in Section 8 of NEI 00-04 and, therefore, will assure that the potential cumulative risk increase from the categorization is maintained acceptably low, as required by 10 CFR 50.69(c)(1)(iv).

3.9 Integrated Decision-making Panel Review and SSC Categorization (NEI 00-04, Sections 9 and 10)

As required by Section 50.69(c)(2) of 10 CFR, the SSCs must be categorized by an IDP staffed with expert, plant-knowledgeable members whose expertise includes, at a minimum, PRA, safety analysis, plant operations, design engineering, and system engineering. LAR Section 3.1.1 states that the IDP will be composed of a group of at least five experts who collectively have expertise in plant operation, design (mechanical and electrical) engineering, system engineering, safety analysis, and PRA. Therefore, the IDP will comprise the required expertise.

The guidance in NEI 00-04, as endorsed in RG 1.201, provides confidence that the IDP expertise is sufficient to perform the categorization and that the results of the different evaluations (PRA and non-PRA) are used in an integrated, systematic process, as required by 10 CFR 50.69(c)(1)(ii).

In Section 3.1.1 of the LAR the licensee discussed that at least three members of the IDP will have a minimum of five years of experience at the plant, and there will be at least one member of the IDP who has a minimum of three years of experience in modeling and updating of the plant-specific PRA. The licensee further states that the IDP will be trained in the specific technical aspects and requirements related to the categorization process. This Training will address, at a minimum, the purpose of the categorization; present treatment requirements for SSCs, including requirements for design-basis events; PRA fundamentals; details of the plant-specific PRA, including the modeling, scope, and assumptions; the interpretation of risk importance measures, and the role of sensitivity studies and the change-in-risk evaluations; and the DID philosophy and requirements to maintain this philosophy.

Based on its review, the NRC staff finds that the licensees IDP areas of expertise meet the requirements in 10 CFR 50.69(c)(2), and the additional descriptions of the IDP characteristics, training, processes, and decision guidelines are consistent with NEI 00-04, as endorsed by RG 1.201. Therefore, all aspects of the integrated, systematic process used to characterize SSCs will reasonably reflect current plant configuration and operating practices, and applicable plant and industry operational experience as required by 10 CFR 50.69(c)(1)(ii).

The licensee stated in Section 3.1.1 of the LAR that the assessments of the qualitative considerations are agreed upon by the IPD in accordance with Section 9.2. In some cases, a 50.69 categorization team may provide preliminary assessments of the seven considerations for the IDPs consideration; however, the final assessments of the seven considerations are the direct responsibility of the IDP. These seven considerations are addressed preliminarily by the 50.69 categorization team for at least the system functions that are not found to be HSS due to any other categorization step. Each of the seven considerations requires a supporting justification for confirming or not confirming that consideration. If the 50.69 categorization team determines that one or more of the seven considerations cannot be confirmed, then that function is presented to the IDP as preliminary HSS. Conversely, if all the seven considerations are confirmed, then the function is presented to the IDP as preliminary LSS. The final assessment of the qualitative criteria is the direct responsibility of the IDP and that if the IDP determines that any one of them cannot be confirmed (false response) for a function, then the final categorization of that function is HSS. The NRC staff finds that the licensees proposed use of the seven qualitative questions in the 10 CFR 50.69 categorization process is consistent with the guidance in NEI 00-04 and, therefore, acceptable.

The IDP may change the categorization of a component from LSS to HSS based on its assessment and decision-making. As outlined in NEI 00-04, Section 10.2, and confirmed in the LAR, the IDP may re-categorize components supporting an HHS function from HSS to LSS only if: (1) a credible failure of the component would not preclude the fulfillment of the HSS function and (2) the component was not categorized as HSS based on internal events PRA, fire PRA, integrated PRA component risk, alternative EPRI seismic approach, other external hazards, shutdown, DID or passive categorization. The licensee also explained that NEI 00-04, Section 4.0, discusses additional functions that may be identified (e.g., fill and drain) to group and consider potentially LSS components that may have been initially associated with an HSS function but that do not support the critical attributes of that HSS function.

Paragraph 50.69(c)(1)(iv) of 10 CFR requires reasonable confidence that sufficient safety margins are maintained for SSCs categorized as RISC-3. The licensee addresses safety margins through an integrated engineering evaluation that would nominally be addressed by the IDP. Consistent with the discussion in NEI 00-04 guidance endorsed by RG 1.201, the IDP need not explicitly consider safety margins. Sufficient safety margins will be maintained because the RISC-3 SSCs will remain capable of performing their safety-related functions as required by 10 CFR 50.69(d)(2), and because any potential increase in CDF and LERF that might stem from changes in RISC-3 SSC reliability due to reduced treatment permitted by 10 CFR 50.69 will be maintained small, as required by 10 CFR 50.69(c)(1)(iv). Therefore, the NRC staff finds that the program implemented by the licensee, consistent with the endorsed guidance in NEI 00-04, fulfills the 10 CFR 50.69(c)(1)(iv) criteria that sufficient safety margins are maintained.

3.10 Program Documentation, Change Control, and Periodic Review (NEI 00-04, Sections 11 and 12)

Paragraph 50.69(c)(1)(ii) of 10 CFR requires, in part, that all aspects of the integrated, systematic process used to characterize SSC importance must reasonably reflect the current plant configuration and operating practices and applicable plant and industry operating experience. Section 11 of NEI 00-04, as endorsed in RG 1.201, provides guidance on program documentation and change control, and Section 12 provides guidance on periodic review.

These sections are described in NEI 00-04 with respect to satisfying 10 CFR 50.69(e) and 10 CFR 50.69(f), respectively. Maintaining change control and periodic review will also maintain confidence that all aspects of the program reflect current plant operation.

Section 50.69(e) of 10 CFR requires periodic updates to the licensees PRA and SSC categorization. The NRC staff finds that changes over time to the PRA and SSC reliabilities are inevitable, and such changes are recognized by the 10 CFR 50.69(e) provision requiring periodic updates. As provided in RG 1.200, the NRC staff review of the PRA quality and level of detail reported in this SE is based primarily on determining how the licensee has resolved key assumptions and areas identified by peer reviewers as being of concern (i.e., F&Os).

As described in the LAR Section 3.2.6, the licensee has administrative controls in place to ensure that the PRA models used to support the categorization reflect the as-built, as-operated plant over time. The licensees process includes regularly scheduled and interim (as needed)

PRA model updates. The process includes provisions for monitoring issues affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, industry operational experience), for assessing the risk impact of unincorporated changes, and for controlling the model and associated computer files. The process also includes reevaluating previously categorized systems to ensure the continued validity of the categorization. Routine PRA updates are performed every two refueling cycles at a minimum.

The NRC staff finds that this description is consistent with the requirements for feedback and process adjustment required by 10 CFR 50.69(e), and is, therefore, acceptable.

Section 50.69(f) of 10 CFR requires program documentation, change control, and records. In LAR Section 3.2.6, the licensee stated that it will implement a process that addresses the guidance in Section 11 of NEI 00-04 pertaining to program documentation and change control records. Section 3.1.1 of the LAR states that the RISC categorization process documentation will including the following 10 elements:

Program procedures used in the categorization System functions identified and categorized with the associated bases Mapping of components to support function(s)

PRA model results, including sensitivity studies Hazards analyses, as applicable Passive categorization results and bases Categorization results, including all associated bases and RISC classifications Component critical attributes for HSS SSCs Results of periodic reviews and SSC performance evaluations IDP meeting minutes and qualification/training records for the IDP members In addition, LAR Attachment 1 (List of Categorization Prerequisites) states that the licensee will establish procedures for the use of the categorization process that contains the following elements: (1) IDP member qualification requirements, (2) qualitative assessment of system functions, (3) component safety-significance assessment, (4) assessment of DID and safety margin, (5) review by the IDP and final determination of safety-significance for system functions and components, (6) risk sensitivity studies to confirm that the risk acceptance guidelines of RG 1.174 are met, (7) periodic review to ensure continued categorization validity and acceptable performance for SSCs that have been categorized, and (8) documentation requirements identified in LAR Section 3.1.1. Procedures are formal plant documents and changes will be tracked providing change control and records of the changes.

These categorization documents and records, as described by the licensee, include documentation and record change controls consistent with NEI 00-04, and endorsed by RG 1.201, and are in conformance with the requirements of 10 CFR 50.69(f)(1). Therefore, the NRC staff finds the documentation and records acceptable.

Based on its review of the submittal, the NRC staff finds that the change control and performance monitoring of categorized SSCs and PRA updates will sufficiently capture and evaluate component failures to identify significant changes in the failure probabilities. In addition, the PRA update program and associated re-evaluation of component importance will appropriately consider the effects of changing failure probabilities and changing plant configuration on the component safety significant categories. As discussed above, the NRC staff finds the process in NEI 00-04 and the LAR will meet the requirements of 10 CFR 50.69(e) and 10 CFR 50.69(f), respectively. Therefore, the process used to characterize SSC importance will reasonably reflect the current plant configuration and operating practices, and applicable plant and industry operational experience required in 10 CFR 50.69(c)(1)(ii).

3.11 Technical Conclusion The NRC staff reviewed the licensees 10 CFR 50.69 categorization process and concludes that the licensee adequately implements 10 CFR 50.69 using models, methods, and approaches consistent with NEI 00-04, Revision 0, and RG 1.201 and, therefore, satisfies the requirements of 10 CFR 50.69(c). Based on its review, the NRC staff finds the licensees proposed categorization process acceptable for categorizing the safety significance of SSCs. Specifically, the NRC staff concludes that the licensees categorization process:

(1) considers results and insights from plant-specific internal events (including internal flooding), and fire PRAs, which are of sufficient quality and level of detail to support the categorization process and that have been subjected to a peer review process against RG 1.200, Revision 2, as reviewed in Section 3.5.1 of this SE and, therefore, meets the requirements in 10 CFR 50.69(c)(1)(i);

(2) determines SSC functional importance using an integrated systematic process that reasonably reflects the current plant configuration, operating practices, and applicable plant and industry operational experience, as reviewed in Sections 3.3, 3.4, 3.5, 3.7, and 3.10 of this SE and, therefore, meets the requirements in 10 CFR 50.69(c)(1)(ii);

(3) maintains defense-in-depth, as reviewed in Section 3.6 of this SE and, therefore, meets the requirements in 10 CFR 50.69(c)(1)(iii);

(4) includes evaluations that provide reasonable confidence that for SSCs categorized as RISC-3, sufficient safety margins are maintained and that any potential increases in CDF and LERF resulting from changes in treatment are small, as reviewed in Section 3.8 of this SE and therefore, meets the requirements in 10 CFR 50.69(c)(1)(iv);

(5) is performed for entire systems and structures, rather than for selected components within a system or structure, as reviewed in Section 3.3 of this SE, and therefore, the requirements in 10 CFR 50.69(c)(1)(v) will be met upon implementation; and (6) includes categorization by IDP, staffed with expert, plant-knowledgeable members whose expertise includes, at a minimum, PRA, safety analysis, plant operation, design engineering and system engineering, as reviewed in Section 3.9 of this SE and, therefore, meets the requirements in 10 CFR 50.69(c)(2).

4.0 10 CFR 50.69 IMPLEMENTATION LICENSE CONDITION Section 50.69(b)(2) of 10 CFR requires the licensee to submit an application that describes the categorization process. Section 50.69(b)(3) of 10 CFR states that the Commission will approve the license application if it determines that the categorization process satisfies the requirements of 10 CFR 50.69(c). As described in this SE, the NRC staff has concluded that the 10 CFR 50.69 categorization process described in the licensees application, as supplemented, includes a description of the categorization process that satisfies the requirements of 10 CFR 50.69(c).

In the LAR the licensee proposed to amend its Renewed Facility Operating Licenses by adding the following license condition that would allow for the implementation of 10 CFR 50.69.

Exelon is approved to implement 10 CFR 50.69 using the processes for categorization of Risk-Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC-4 structures, systems, and components (SSC) using: Probabilistic Risk Assessment (PRA) models to evaluate risk associated with internal events, including internal flooding, and internal fire; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (ANO-2) passive categorization method to assess passive component risk for Class 2 and Class 3 and non-Class SSCs and their associated supports; the results of the non-PRA evaluations that are based on the IPEEE Screening Assessment for external hazards updated using the external hazard screening significance process identified in ASME/ANS PRA Standard RA-Sa-2009 for other external hazards except seismic; and the EPRI alternative approach described in EPRI 3002012988 for seismic risk for Tier 1 plants.

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

Based on its evaluation in this SE, the NRC staff finds that the proposed license condition is acceptable because it adequately implements 10 CFR 50.69 using models, methods, and approaches that are acceptable to the NRC and consistent with the applicable guidance that has previously been endorsed as acceptable by the NRC.

5.0 STATE CONSULTATION

In accordance with the Commissions regulations, the Maryland State official was notified of the proposed issuance of the amendments on ____________. The State official had no comments.

6.0 ENVIRONMENTAL CONSIDERATION

DORL

7.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

8.0 REFERENCES

1. Barstow J., Exelon Generation Company, LLC, letter to U.S. Nuclear Regulatory Commission, Calvert Cliffs Nuclear Power Plant, Units 1 and 2, Renewed Facility Operating License Nos. DPR-53 and DPR-69, NRC Docket Nos. 50-317 and 50-318, Application to Adopt 10 CFR 50.69, Risk-Informed categorization and treatment of structures, systems, and components for nuclear power reactors, dated November 28, 2019 (ADAMS Accession No. ML18333A022).

2. Barstow J., Exelon Generation Company, LLC, letter to U.S. Nuclear Regulatory Commission, Calvert Cliffs Nuclear Power Plant, Units 1 and 2, Renewed Facility Operating License Nos. DPR-53 and DPR-69, NRC Docket Nos. 50-317 and 50-318, Response to Request for Additional Information Regarding the Application to Adopt 10 CFR 50.69, Risk-informed categorization and treatment of structures, systems, and components for nuclear power reactors, dated July 1, 2019 (ADAMS Accession No. ML19183A012).

3. Barstow J., Exelon Generation Company, LLC, letter to U.S. Nuclear Regulatory Commission, Calvert Cliffs Nuclear Power Plant, Units 1 and 2, Renewed Facility Operating License Nos. DPR-53 and DPR-69, NRC Docket Nos. 50-317 and 50-318, Response to Request for Additional Information Regarding the Application to Adopt 10 CFR 50.69, Risk-informed categorization and treatment of structures, systems, and components for nuclear power reactors, dated July 19, 2019 (ADAMS Accession No. ML19200A216).

4. Barstow J., Exelon Generation Company, LLC, letter to U.S. Nuclear Regulatory Commission, Calvert Cliffs Nuclear Power Plant, Units 1 and 2, Renewed Facility Operating License Nos. DPR-53 and DPR-69, NRC Docket Nos. 50-317 and 50-318, Revision to Response to Request for Additional Information Regarding the Application to Adopt 10 CFR 50.69, Risk-informed categorization and treatment of structures, systems, and components for nuclear power reactors, dated October 9, 2019 (ADAMS Accession No. ML19282B718).

5. Nuclear Energy Institute, 10 CFR 50.69 SSC Categorization Guideline, NEI 00-04, dated July 2005 (ADAMS Accession No. ML052900163).

6. U.S. Nuclear Regulatory Commission, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to Their Safety Significance, Regulatory Guide 1.201 (For Trial Use), Revision 1, dated May 2006 (ADAMS Accession No. ML061090627).

7. U.S. Nuclear Regulatory Commission, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Regulatory Guide 1.200, Revision 2, dated March 2009 (ADAMS Accession No. ML090410014).

8. American Society of Mechanical Engineers/American Nuclear Society, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME/AND RA-Sa-2009, dated February 2009 (ADAMS Accession No. ML092870592).

9. U.S. Nuclear Regulatory Commission, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Regulatory Guide 1.174, Revision 3, dated January 2018 (ADAMS Accession No. ML17317A256).

10. U.S. Nuclear Regulatory Commission, Guidelines on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, NUREG-1855, Volume 1, dated March 2017 (ADAMS Accession No. ML17062A466).

11. Markley, Michael, U.S. Nuclear Regulatory Commission, letter to Vice President, Operation, Arkansas Nuclear One, Entergy Operations, Inc., Arkansas Nuclear One, Unit 2 - Approval of Request for Alternative ANO-2 R&R-004, Revision 1, Request to Use Risk-Informed Safety Classification and Treatment for Repair/Replacement Activities in Class 2 & 3 Moderate and High Energy Systems, dated April 22, 2009 (ADAMS Accession No. ML090930246).

12. Marshall, Michael, U.S. Nuclear Regulatory Commission, letter to Vice President, Exelon Generation Company, LLC, Calvert Cliffs Nuclear Power Plant, Units 1 and 2 - Issuance of Amendment Nos. 326 and 304 to Add Risk-Informed Completion Time Program (EPID L-2016-LLA-0001), dated October 30, 2018 (ADAMS Accession No. ML18270A130).

13. Nuclear Energy Institute, Process for Performing Internal Events PRA Peer Reviews Using the ASME/ANS PRA Standard, NEI 05-04, Revision 3, dated November 2009.

14. Rosenberg, Stacey, U.S. Nuclear Regulatory Commission, letter to Mr. Greg Krueger (NEI),

U.S. Nuclear Regulatory Commission Acceptance on Nuclear Energy Institute Appendix X to Guidance 05-04, 7-12, and 12-13, Close Out of Facts and Observations (F&Os), May 3, 2017 (ADAMS Accession Number ML17079A427).

15. Guzman, Richard, U.S. Nuclear Regulatory Commission, letter to President and Chief Nuclear Officer, Exelon Generation Company, LLC, Calvert Cliffs Nuclear Power Plant, Units Nos. 1 and 2 - Issuance of Amendments Regarding Transition to a Risk-Informed, Performance-Based Fire Protection Program in Accordance with 10 CFR 50.48(c) (CAC Nos. MF2993 and MF2994), dated August 30, 2016 (ADAMS Accession No. ML16175A359).

16. Nuclear Energy Institute, Fire PRA Peer Review Process Guidelines, NEI 07-12, Revision 1, dated June 2010 (ADAMS Accession No. ML102230049).

17. Gellrich, George, H. Calvert Cliffs Nuclear Power Plant, LLC, letter to U.S. Nuclear Regulatory Commission, Calvert Cliffs Nuclear Power Plant Unit Nos. 1 & 2, Docket Nos.

50-317 & 50-318, License Amendment Request re: Transition to 10 CFR 50.48(c)- NFPA 805 Performance Based Standard for Fire Protection, September 24, 2013 (ADAMS Accession No. ML13301A673).

18. U.S. Nuclear Regulatory Commission, Guidelines on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, NUREG-1855, Volume 1, dated March 2009 (ADAMS Accession No. ML090970525).

19. Electric Power Research Institute, Treatment of Parameter and Modeling Uncertainty for Probabilistic Risk Assessments, EPRI TR-1016737, dated December 2008.

20. Nuclear Management and Resources Council, Guidelines for Industry Actions to Assess Shutdown Management, NUMARC 91-06, dated December 1991 (ADAMS Accession No. ML14365A203).

21. American Society of Mechanical Engineers, Risk-Informed Safety Classification for Use in Risk-Informed Repair/Replacement Activities, ASME Code Case, N-660, dated July 2002.

22. EPRI TR-1026511, Practical Guidance on the Use of Probabilistic Risk Assessment in Risk-Informed Applications with a Focus on the Treatment of Uncertainty, EPRI, Palo Alto, CA, December 2012.