ML19340A025

Issuance of Amendment No. 337 Regarding Adoption of 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structure, Systems, and Components of Nuclear Power Reactors

ML19340A025
Person / Time
Site:	Millstone
Issue date:	01/30/2020
From:	Richard Guzman NRC/NRR/DORL/LPL1
To:	Stoddard D Dominion Energy Nuclear Connecticut
Guzman R
References
EPID L-2019-LLA-0008
Download: ML19340A025 (37)

Text

Mr. Daniel G. Stoddard Senior Vice President and Chief Nuclear Officer Dominion Nuclear Innsbrook Technical Center 5000 Dominion Boulevard Glen Allen, VA 23060-6711 January 30, 2020

SUBJECT:

MILLSTONE POWER STATION, UNIT NO. 2 - ISSUANCE OF AMENDMENT NO. 337 RE: ADOPTION OF 10 CFR 50.69, "RISK-INFORMED CATEGORIZATION AND TREATMENT OF STRUCTURES, SYSTEMS AND COMPONENTS OF NUCLEAR POWER REACTORS" (EPID L-2019-LLA-0008)

Dear Mr. Stoddard:

The U.S. Nuclear Regulatory Commission (the Commission) has issued the enclosed Amendment No. 337 to Renewed Facility Operating License No. DPR-65 for the Millstone Power Station, Unit No. 2 (Millstone 2), in response to your application dated January 17, 2019, as supplemented by letter dated October 3, 2019.

The amendment adds a new license condition to the Millstone 2 Renewed Facility Operating License to allow the implementation of the risk-informed categorization and treatment of structures, systems, and components of nuclear power reactors in accordance with Title 10 of the Code of Federal Regulations Section 50.69.

A copy of the related safety evaluation is also enclosed. Notice of Issuance will be included in the Commission's biweekly Federal Register notice.

Docket No. 50-336

Enclosures:

1. Amendment No. 337 to DPR-65

2. Safety Evaluation cc: Listserv Sincerely, IRA/

Richard V. Guzman, Senior Project Manager Plant Licensing Branch I Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

DOMINION ENERGY NUCLEAR CONNECTICUT, INC.

DOCKET NO. 50-336 MILLSTONE POWER STATION, UNIT NO. 2 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 337 Renewed License No. DPR-65

1.

The U.S. Nuclear Regulatory Commission (the Commission) has found that:

A.

The application for amendment by Dominion Energy Nuclear Connecticut, Inc.

(the licensee) dated January 17, 2019, as supplemented by letter dated October 3, 2019, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I; B.

The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C.

There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D.

The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E.

The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

2.

Accordingly, the license is amended by changes as indicated in the attachment to this license amendment, and Renewed Facility Operating License No. DPR-65 is hereby amended to add paragraph 2.C.(15) to read as follows:

(15)

Adoption of 10 CFR 50.69, "Risk-informed categorization and treatment of structures, systems and components for nuclear power reactors" a) The licensee is approved to implement 10 CFR 50.69 using the processes for categorization of RISC-1, RISC-2, RISC-3, and RISC-4 structures, systems, and components (SSCs) using: Probabilistic Risk Assessment (PRA) model to evaluate risk associated with internal events, including internal flooding; the Appendix R program to evaluate fire risk; and the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (AN0-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; and the results of non-PRA evaluations that are based on the IPEEE [Individual Plant Examination of External Events]

Screening Assessment for External Hazards, i.e., seismic margin analysis (SMA) to evaluate seismic risk, and a screening of other external hazards updated using the external hazard screening significance process identified in ASME/ANS PRA Standard RA-Sa-2009; as specified in Unit 2 License Amendment No. 337 dated January 30, 2020.

b) The licensee will review the completed 10 CFR 50.54(f) reevaluation of external floods and update its 10 CFR 50.69 categorization procedures, as necessary, prior to the adoption of 10 CFR 50.69 to ensure that the potential for external flooding will be incorporated into the categorization process consistent with applicable guidance.

c) Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g.,

change from a seismic margins approach to a seismic probabilistic risk assessment approach).

3.

This license amendment is effective as of the date of issuance, and shall be implemented within 60 days of issuance.

Attachment:

Changes to the Renewed Facility Operating License Date of Issuance: January 30, 2020 FOR THE NUCLEAR REGULATORY COMMISSION

/RA/

James G. Danna, Chief Plant Licensing Branch I Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

ATTACHMENT TO LICENSE AMENDMENT NO. 337 MILLSTONE POWER STATION, UNIT NO. 2 RENEWED FACILITY OPERATING LICENSE NO. DPR-65 DOCKET NO. 50-336 Replace the following page of the Renewed Facility Operating License with the attached revised page. The revised page is identified by amendment number and contains a marginal line indicating the area of change.

Remove 8

(15)

Adoption of 10 CFR 50.69, "Risk-informed categorization and treatment of structures, systems, and components for nuclear power plants" (a)

The licensee is approved to implement 10 CFR 50.69 using the processes for categorization of RISC-1, RISC-2, RISC-3, and RISC-4 structures, systems, and components (SSCs) using: Probabilistic Risk Assessment (PRA) model to evaluate risk associated with internal events, including internal flooding; the Appendix R program to evaluate fire risk; and the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (AN0-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; and the results of non-PRA evaluations that are based on the Individual Plant Examination of External Events (IPEEE)

Screening Assessment for External Hazards, i.e., seismic margin analysis (SMA) to evaluate seismic risk, and a screening of other external hazards updated using the external hazard screening significance process identified in ASME/ANS PRA Standard RA Sa 2009; as specified in Unit 2 License Amendment No. 337 dated January 30, 2020.

(b)

The licensee will review the completed 10 CFR 50.54(f) reevaluation of external floods and update its 10 CFR 50.69 categorization procedures, as necessary, prior to the adoption of 10 CFR 50.69 to ensure that the potential for external flooding will be incorporated into the categorization process consistent with applicable guidance.

(c)

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

D.

This renewed operating license is effective as of its date of issuance and shall expire at midnight July 31, 2035.

Attachment:

1.

Appendix A - Technical Specifications Date of Issuance: November 28, 2005 FOR THE NUCLEAR REGULATORY COMMISSION

/ RA/

J. E. Dyer, Director Office of Nuclear Reactor Regulation Renewed License No. DPR-65 Amendment No. 337

SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 337 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-65 DOMINION ENERGY NUCLEAR CONNECTICUT, INC.

MILLSTONE POWER STATION, UNIT NO. 2 DOCKET NO. 50-336

1.0 INTRODUCTION

By letter dated January 17, 2019 (Reference 1 ), as supplemented by letter dated October 3, 2019 (Reference 2), Dominion Energy Nuclear Connecticut, Inc. (DENC, the licensee) submitted a license amendment request (LAR) for the Millstone Power Station, Unit No. 2 (Millstone 2). The licensee proposed to add a new license condition to Renewed Facility Operating License No. DPR-65 to allow the implementation of Title 10 of the Code of Federal Regulations (10 CFR) Section 50.69, "Risk-informed categorization and treatment of structures, systems and components for nuclear power reactors." The provisions of 10 CFR 50.69 allow adjustment of the scope of structures, systems, and components (SSCs) subject to special treatment requirements (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation) based on a method of categorizing SSCs according to their safety significance.

To support its review, the U.S. Nuclear Regulatory Commission (NRC, the Commission) staff conducted a remote "desk" audit as described in the audit plan dated July 18, 2019 (Reference 3). Based on its review of the LAR and information provided in an online SharePoint site by the licensee, the NRC staff transmitted requests for additional information (RAls) to the licensee by e-mail dated September 5, 2019 (Reference 4), and no audit summary was needed.

By letter dated October 3, 2019, the licensee responded to the RAls.

The supplemental letter dated October 3, 2019, provided additional information that clarified the application, did not expand the scope of the application as originally noticed, and did not change the NRC staff's original proposed no significant hazards consideration determination as published in the Federal Register on March 26, 2019 (84 FR 11337).

2.0

2.1 REGULATORY EVALUATION

Risk-Informed Categorization and Treatment of SSCs A risk-informed (RI) approach to regulation enhances and extends the traditional deterministic regulation by considering risk in a comprehensive manner. Specifically, an RI approach allows consideration of a broader set of potential challenges to safety, providing a logical means for prioritizing these challenges based on safety significance, and allowing consideration of a broader set of resources to defend against these challenges. Probabilistic risk assessments (PRAs) address credible initiating events by assessing the event frequency. Mitigating system reliability is then assessed, including the potential for common-cause failures.

To take advantage of the safety enhancements available through the use of PRA, the NRG promulgated a new regulation, 10 CFR 50.69, published in the Federal Register on November 22, 2004 (69 FR 68008), which became effective on December 22, 2004. The provisions of 10 CFR 50.69 allow adjustment of the scope of SSCs subject to special treatment requirements.

Special treatment refers to those requirements that provide increased assurance beyond normal industry practices that SSCs perform their design-basis functions. For SSCs categorized as low safety-significance, alternative treatment requirements may be implemented in accordance with the regulation. For SSCs determined to be of high safety-significance, the requirements set forth in 10 CFR 50.69(b)(1 )(i) through 50.69(b)(1 )(xi) and 10 CFR 50.69(g) shall apply.

Section 50.69 of 10 CFR contains requirements regarding how a licensee categorizes SSCs using an RI process, adjusts treatment requirements consistent with the relative significance of the SSC, and manages the process over the lifetime of the plant. An RI categorization process is employed to determine the safety significance of SSCs and place the SSCs into one of four risk-informed safety class (RISC) categories. The determination of safety significance is performed by an integrated decision-making process, which uses both risk insights and traditional engineering insights. The safety functions include the design-basis functions, as well as functions credited for severe accidents (including external events). Special or alternative treatment for the SSCs is applied as necessary to maintain functionality and reliability and is a function of the SSC categorization results and associated bases. Finally, periodic assessment activities are conducted to make adjustments to the categorization and/or treatment processes as needed so that SSCs continue to meet all applicable functional requirements.

Section 50.69 of 10 CFR does not allow for the elimination of SSC functional requirements or allow equipment that is required by the deterministic design basis to be removed from the facility. Instead, 10 CFR 50.69 enables licensees to focus their resources on SSCs that make a significant contribution to plant safety. When promulgating the 1 O CFR 50.69 rule, the Commission stated in 69 FR 68011 (November 22, 2004):

It is important to note that this rulemaking effort, while intended to ensure that the scope of special treatment requirements imposed on SSCs is risk-informed, is not intended to allow for the elimination of SSC functional requirements or to allow equipment that is required by the deterministic design basis to be removed from the facility (i.e., changes to the design of the facility must continue to meet the current requirements governing design change; most notably [10 CFR]

50.59). Instead, this rulemaking should enable licensees and the staff to focus their resources on SSCs that make a significant contribution to plant safety by restructuring the regulations to allow an alternative risk-informed approach to special treatment. Conversely, for SSCs that do not significantly contribute to plant safety on an individual basis, this approach should allow an acceptable, though reduced, level of confidence (i.e., "reasonable confidence") that these SSCs will satisfy functional requirements. However, continued maintenance of the health and safety of the public will depend on effective implementation of

[10 CFR] 50.69 by the licensee or applicant applying the rule at its nuclear power plant.

For SSCs that are categorized as high safety-significant (HSS), existing treatment requirements are maintained or potentially enhanced. Conversely, for SSCs categorized as low safety-significant (LSS) that do not significantly contribute to plant safety on an individual basis, the regulation allows an alternative RI approach to treatment that provides a reasonable level of confidence that these SSCs will satisfy functional requirements.

2.2 Licensee's Proposed Changes The licensee proposed the addition of the following condition to the renewed facility operating license for Millstone 2 to document the NRC's approval of the use of 10 CFR 50.69:

The licensee is approved to implement 10 CFR 50.69 using the processes for categorization of RISC-1, RISC-2, RISC-3, and RISC-4 structures, systems, and components (SSCs) using: Probabilistic Risk Assessment (PRA) model to evaluate risk associated with internal events, including internal flooding; and the Appendix R program to evaluate fire risk; and the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (AN0-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; and the results of non-PRA evaluations that are based on the IPEEE [Individual Plant Examination of External Events] Screening Assessment for External Hazards, i.e., seismic margin analysis (SMA) to evaluate seismic risk, and a screening of other external hazards updated using the external hazard screening significance process identified in ASME/ANS PRA Standard RA-Sa-2009; as specified in Unit 2 License Amendment No. [XXX] dated [DATE].

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

The licensee also proposed the following regulatory commitments in its LAR dated January 17, 2019, as supplemented by letter dated October 3, 2019:

The categorization prerequisites specified in Attachment 1 to Enclosure 1:

DENC will establish procedure(s) prior to the use of the categorization process on a plant system. The procedure(s) will contain the elements/steps listed below.

Integrated Decision-Making Panel (IDP) member qualification requirements Qualitative assessment of system functions. System functions are qualitatively categorized as preliminary High Safety Significant (HSS) or Low Safety Significant (LSS) based on the seven criteria in Section 9 of NEI 00-04 (see Section 3.2 of this enclosure). Any component supporting an HSS function is categorized as preliminary HSS. Components supporting an LSS function are categorized as preliminary LSS.

Component safety significance assessment. Safety significance of active components is assessed through a combination of Probabilistic Risk

2.3 Assessment (PRA) and non-PRA methods, covering all hazards. Safety significance of passive components is assessed using a methodology for passive components.

Assessment of defense-in-depth (DID) and safety margin. Safety-Related components that are categorized as preliminary LSS are evaluated for their role in providing DID and safety margin and, if appropriate, upgraded to HSS.

Review by the IDP. The categorization results are presented to the IDP for review and approval. The IDP reviews the categorization results and makes the final determination on the safety significance of system functions and components.

Risk sensitivity study. For PRA-modeled components, an overall risk sensitivity study is used to confirm that the population of preliminary LSS components results in acceptably small increases to core damage frequency (CDF) and large early release frequency (LERF) and meets the acceptance guidelines of Regulatory Guide 1.17 4.

Periodic reviews are performed to ensure continued categorization validity and acceptable performance for those SSCs that have been categorized.

Documentation requirements per Section 3.1.1 of the enclosure.

Prior to implementation of the MPS2 [Millstone Power Station, Unit 2]

1 O CFR 50.69 categorization program, the MPS2 PRA internal events model of the steam generator tube rupture (SGTR) accident sequence will be revised to remove credit for achieving safe and stable conditions at 32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br />.

DENC will review the completed reevaluation of external floods to ensure that the potential for external flooding will be incorporated into the categorization consistent with the guidelines for external events evaluation described in NEI 00-04. The 50.69 categorization procedure will be updated to reference the reevaluation of external floods to ensure that both SSCs relied on in unscreened scenarios and SSCs whose failure would cause screened scenarios to become unscreened are appropriately identified and categorized according to Figure 5-6 in NEI 00-04.

A sensitivity study will be performed per NEI 00-04 to increase the component common cause events to their 5th and 95th percentile values as part of the required 50.69 PRA categorization sensitivity cases. Additionally, a sensitivity study will be performed on the independent FLEX failures using the 5th and 95th percentile values.

Regulatory Review The NRC staff reviewed the licensee's application to determine whether (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) activities proposed will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or the health and safety of the public. The staff considered the following regulatory requirements and guidance during its review of the proposed changes.

Regulatory Requirements Section 50.69 of 10 CFR provides an alternative approach for establishing requirements for treatment of SSCs for nuclear power reactors using an RI method of categorizing SSCs according to their safety significance. Specifically, for SSCs categorized as LSS, alternative treatment requirements may be implemented in accordance with the regulation. For SSCs determined to be HSS, requirements may not be changed.

Section 50.69(c) of 1 O CFR requires licensees to use an integrated decision-making process to categorize safety-related and nonsafety-related SSCs according to the safety significance of the functions they perform into one of the following four RISC categories, which are defined in 10 CFR 50.69(a), as follows:

RISC-1:

RISC-2:

RISC-3:

RISC-4:

Safety-related SSCs that perform safety-significant functions 1 Nonsafety-related SSCs that perform safety-significant functions Safety-related SSCs that perform LSS functions Nonsafety-related SSCs that perform LSS functions The SS.Cs are classified as having either HSS functions (i.e., RISC-1 and RISC-2 categories) or LSS functions (i.e., RISC-3 and RISC-4 categories). For HSS SSCs, 10 CFR 50.69 maintains current regulatory requirements (i.e., it does not remove any requirements from these SSCs) for special treatment. For LSS SSCs, licensees can implement alternative treatment requirements in accordance with 10 CFR 50.69(b )( 1) and 10 CFR 50.69( d). For RISC-3 SSCs, licensees can replace special treatment with an alternative treatment. For RISC-4 SSCs, 10 CFR 50.69 does not impose new treatment requirements, and RISC-4 SSCs are removed from the scope of any applicable special treatment requirements identified in 10 CFR 50.69(b )( 1 ).

Paragraph 50.69(c)(1) of 10 CFR states that SSCs must be categorized as RISC-1, RISC-2, RISC-3, or RISC-4 SSCs using a categorization process that determines if an SSC performs one or more safety-significant functions and identifies those functions. The process must:

(i)

Consider results and insights from the plant-specific PRA. This PRA must at a minimum model severe accident scenarios resulting from internal initiating events occurring at full power operation. The PRA must be of sufficient quality and level of detail to support the categorization process and must be subjected to a peer review process assessed against a standard or set of acceptance criteria that is endorsed by the NRC.

1 Nuclear Energy Institute (NEI) 00-04 uses the term "high-safety-significant (HSS)" to refer to SSCs that perform safety-significant functions. The NRC understands HSS to have the same meaning as "safety-significant" (i.e., SSCs that are categorized as RISC-1 or RISC-2), as used in 10 CFR 50.69.

(ii) Determine SSC functional importance using an integrated, systematic process for addressing initiating events (internal and external), SSCs, and plant operating modes, including those not modeled in the plant-specific PRA. The functions to be identified and considered include design bases functions and functions credited for mitigation and prevention of severe accidents. All aspects of the integrated, systematic process used to characterize SSC importance must reasonably reflect the current plant configuration and operating practices, and applicable plant and industry operational experience.

(iii) Maintain defense-in-depth.

(iv) Include evaluations that provide reasonable confidence that for SSCs categorized as RISC-3, sufficient safety margins are maintained and that any potential increases in core damage frequency (CDF) and large early release frequency (LERF) resulting from changes in treatment permitted by implementation of Sections 50.69(b )( 1) and ( d)(2) are small.

(v) Be performed for entire systems and structures, not for selected components within a system or structure.

Paragraph 50.69(c)(2) of 10 CFR states: "The SSCs must be categorized by an Integrated Decision-Making Panel (IDP) staffed with expert, plant-knowledgeable members whose expertise includes, at a minimum, PRA, safety analysis, plant operation, design engineering, and system engineering."

Paragraph 50.69(b)(3) of 10 CFR states that the Commission will approve a licensee's implementation of this section by issuance of a license amendment if the Commission determines that the categorization process satisfies the requirements in 10 CFR 50.69{c). As stated in 10 CFR 50.69(b ), after the NRC approves an application for a license amendment, a licensee may voluntarily comply with 1 O CFR 50.69 as an alternative to compliance with the following requirements for LSS SSCs: (i) 10 CFR Part 21, (ii) a portion of 10 CFR 50.46a(b),

(iii) 10 CFR 50.49, (iv) 10 CFR 50.55( e ), (v) certain requirements in 10 CFR 50.55a, (vi) 10 CFR 50.65, except for paragraph (a)(4), (vii) 10 CFR 50.72, (viii) 10 CFR 50.73, (ix) Appendix B to 10 CFR Part 50, (x) certain containment leakage testing requirements, and (xi) certain requirements in Appendix A to 10 CFR Part 100.

Guidance NRG-endorsed Nuclear Energy Institute (NEI) 00-04, Revision 0, "10 CFR 50.69 SSC Categorization Guideline" (Reference 5), describes a process for determining the safety significance of SSCs and categorizing them into the four RISC categories defined in 10 CFR 50.69. This categorization process is an integrated decision-making process that incorporates risk and traditional engineering insights. The guidance in NEI 00-04 provides options for licensees implementing different approaches depending on the scope of their PRA models. It also allows the use of non-PRA approaches when PRAs have not been performed to address hazards such as seismic, fire, or shutdown risk. As stated in NRC Regulatory Guide (RG) 1.201 (For Trial Use), Revision 1, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance" (Reference 6), such non-PRA-type evaluations will result in more conservative categorization, in that special treatment requirements will not be allowed to be relaxed for SSCs that are relied upon in such evaluations that are categorized as HSS. The degree of relaxation that the NRC will accept under 10 CFR 50.69 (i.e., SSCs subject to relaxation of special treatment requirements) will be commensurate with the assurance provided by the evaluation.

Sections 2 through 10 of NEI 00-04 describe a method for meeting the requirements in 10 CFR 50.69(c), as follows:

Sections 3.2 and 5.1 provide specific guidance corresponding to 10 CFR 50.69(c)(1 )(i).

Sections 3, 4, 5, and 7 provide specific guidance corresponding to 10 CFR 50.69(c)(1)(ii).

Section 6 provides specific guidance corresponding to 10 CFR 50.69(c)(1)(iii).

Section 8 provides specific guidance corresponding to 10 CFR 50.69(c)(1)(iv).

Section 2 provides specific guidance corresponding to 10 CFR 50.69(c)(1)(v).

Sections 9 and 10 provide specific guidance corresponding to 10 CFR 50.69(c)(2).

Additionally, Section 11 of NEI 00-04 provides guidance on program documentation and change control related to the requirements in 10 CFR 50.69(e), and Section 12 of NEI 00-04 provides guidance on periodic review related to the requirements in 10 CFR 50.69(f). Maintaining change control and periodic review provides confidence that all aspects of the program reasonably reflect the current plant configuration and operating practices, and applicable plant and industry operational experience, as required by 10 CFR 50.69(c)(1 )(ii).

Revision 1 of RG 1.201 endorses the categorization method described in NEI 00-04, with clarifications, limitations, and conditions. The guidance in RG 1.201 states that the applicant is expected to document, at a minimum, the technical adequacy of the internal initiating events PRA. Licensees may use either PRAs or alternative approaches for hazards other than internal initiating events. The guidance in RG 1.201 clarifies that the NRC staff expects that licensees proposing to use non-PRA approaches in their categorization should provide a basis in the submittal for why the approach and the accompanying method employed to assign safety significance to SSCs is technically adequate. The guidance further states that as part of the NRC's review and approval of a licensee's or applicant's application requesting to implement 10 CFR 50.69, the NRC staff intends to impose a license condition that will explicitly address the scope of the PRA and non-PRA methods used in the licensee's categorization approach. If a licensee or applicant wishes to change its categorization approach, and the change is outside the bounds of the NRC's license condition (e.g., switch from a seismic margins analysis to a seismic PRA), the licensee or applicant will need to seek NRC approval, by a license amendment, for the implementation of the new approach in its categorization process. In addition, RG 1.201 states that all aspects of NEI 00-04 must be followed.

RG 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk Informed Activities," dated March 2009 (Reference 7),

describes an acceptable approach for determining whether the quality of the PRA, in total, or the parts that are used to support an application, is sufficient to provide confidence in the results such that the PRA can be used in regulatory decisionmaking for light-water reactors. It endorses, with clarifications, the American Society of Mechanical Engineers (ASME)/American Nuclear Society (ANS) PRA Standard ASME/ANS RA-Sa-2009, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications,"

dated February 2009 ("ASME/ANS 2009 Standard" or "PRA Standard") (Reference 8). This RG provides guidance for determining the technical acceptability of a PRA by comparing the PRA to the relevant parts of the ASME/ANS 2009 Standard using a peer review process. In accordance with the guidance, peer reviews should be used for PRA upgrades. A PRA upgrade is defined in the PRA standard as "the incorporation into a PRA model of a new methodology or significant changes in scope or capability that impact the significant accident sequences or the significant accident progression sequences."

RG 1.17 4, Revision 3, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," dated January 2018 (Reference 9), provides guidance on the use of PRA findings and risk insights in support of changes to a plant's licensing basis. This RG provides risk acceptance guidelines for evaluating the results of such evaluations.

3.0 TECHNICAL EVALUATION

3.1 Staff's Method of Review The NRC staff evaluated the licensee's application to determine whether the proposed changes are consistent with the regulations and guidance discussed in Section 2 of this safety evaluation (SE). The staff's review and the documentation of that review in this SE use the framework of NEI 00-04.

3.2 Overview of the Categorization Process (NEI 00-04, Section 2)

Paragraph 50.69(b )(2)(i) of 1 O CFR states that a licensee voluntarily choosing to implement 10 CFR 50.69 shall submit an application for license amendment under 10 CFR 50.90 that contains a description of the process for categorization of RISC-1, RISC-2, RISC-3, and RISC-4 SSCs. In addition, 10 CFR 50.69(c)(1 )(v) states that the process for categorization must be performed for entire systems and structures, not for selected components within a system or structure.

The guidance in RG 1.201 provides that the categorization process described in NEI 00-04, with any noted exceptions or clarifications, is acceptable for implementation of 10 CFR 50.69.

Section 2 of NEI 00-04 states that the categorization process includes eight primary steps:

1. Assembly of Plant-Specific Inputs (Section 3 of NEI 00-04)

2. System Engineering Assessment (Section 4 of NEI 00-04)

3. Component Safety Significance Assessment (Section 5 of NEI 00-04)

4. Defense-in-Depth Assessment (Section 6 of NEI 00-04)

5. Preliminary Engineering Categorization of Functions (Section 7 of NEI 00-04 )

6. Risk Sensitivity Study (Section 8 of NEI 00-04)

7. IDP Review and Approval (Section 9 of NEI 00-04)

8. SSC Categorization (Section 10 of NEI 00-04)

The licensee stated in the LAR that it will implement the risk categorization process in accordance with NEI 00-04, as endorsed by RG 1.201. The LAR provided details of the categorization process as follows: (1) summary of the categorization process, (2) order of the sequence of elements or steps that will be performed (function/component level),

(3) explanation of the difference between preliminary HSS and assigned HSS, and (4) identification of which inputs can and which cannot be changed by the IDP from preliminary HSS to LSS.

As summarized in the licensee's LAR, the categorization process contains the following elements/steps:

Assembly of plant-specific inputs (Section 3 of NEI 00-04) (see Section 3.3 of this SE).

Defining system boundaries, identifying system functions, and assigning components to functions (Section 4 of NEI 00-04) (see Section 3.4 of this SE).

Risk Characterization. Safety-significance of active components is assessed through a combination of PRA and non-PRA methods, covering all hazards (Section 5 of NEI 00-04) (see Section 3.5 of this SE).

Passive Characterization. Passive components are not modeled in the PRA and, therefore, a different assessment method is used to assess the safety significance of these components. This process addresses those components that have only a pressure-retaining function and the passive function of active components, such as the pressure/liquid retention of the body of a motor-operated valve (see Section 3.5.4 of this SE).

Defense-in-depth (DID) characterization performed in accordance with Section 6 of NEI 00-04 (see Section 3.6 of this SE).

Preliminary engineering categorization performed in accordance with Section 7 of NEI 00-04 ( see Section 3. 7 of this SE).

Cumulative Risk Sensitivity Study. For PRA-modeled components, an overall risk sensitivity study is used to confirm that the population of LSS components results in acceptably small increases to CDF and LERF and meets the acceptance guidelines of RG 1.17 4 (Section 8 of NEI 00-04) ( see Section 3.8 of this SE).

Qualitative Characterization. System functions are qualitatively categorized as HSS or LSS based on the seven qualitative criteria in Section 9.2 of NEI 00-04 (see Section 3.9 of this SE).

Review by the IDP. The categorization results are presented to the IDP for review and approval. The IDP reviews the categorization results and makes the final determination on the safety significance of system functions and components (Sections 9 and 10 of NEI 00-04) (see Section 3.9 of this SE).

In Table 3-1 of the LAR (Table 1 below), the licensee provided details on how some steps of the process are performed at the component (or segment/component) level (e.g., all PRA and non-PRA-modeled hazards, containment DID, passive categorization), how some steps are performed at the function level (e.g., qualitative criteria), and how some steps are performed at the function and component level (e.g., shutdown, core damage DID).

In LAR Section 3.1.1, the licensee explained that consistent with NEI 00-04, the categorization of a component or function is "preliminary" until it has been confirmed by the IDP. The licensee stated that a component or function is preliminarily categorized as HSS if any element of the process results in a preliminary HSS determination. This preliminary categorization will be presented to the IDP for review. The IDP will decide the final categorization as discussed in Section 3.9 of this SE.

In LAR Section 3.1.1, the licensee provided clarifications on how some steps of the process are performed at the component level (e.g., all PRA and non-PRA-modeled hazards, containment DID, passive categorization), some steps are performed at the function level (e.g., qualitative criteria), and some steps are performed at the function and component level (e.g., shutdown, core damage DID).

As discussed in Section 3. 7 of this SE, if any SSC is identified as HSS from either the PRA component safety-significance assessment (internal events in Section 5.1 of NEI 00-04, integral PRA assessment in Section 5.6 of NEI 00-04), the DID assessment (Section 6 of NEI 00-04), or the qualitative criteria (Section 9 of NEI 00-04), the associated system function(s) would be identified as HSS. Once a system function is identified as HSS, then all the components supporting that function are preliminary HSS and will be presented to the IDP for review.

As discussed in Section 3.9 of this SE, the licensee explained in LAR Section 3.1.1 that the seven qualitative criteria are addressed preliminarily by the 1 O CFR 50.69 categorization team prior to the IDP. The licensee further clarified that if the IDP determines that any one of the seven qualitative criteria cannot be confirmed (false response) for a system function, then the final categorization of that function will be HSS.

The NRC staff has evaluated the categorization steps and the associated clarifications provided by the licensee in the LAR and RAI responses and finds that the licensee's process is consistent with all aspects of the process in NEI 00-04, as endorsed by RG 1.201.

Table 1 IOP Drives Categor1zation Step -

Evaluation Change Associated Element NEI 00-04 Section Level HSSto Functions LSS Internal Events Base Case Not Allowed Yes

- Section 5.1 Fire, Seismic, and Other External Allowable No Risk (PRA Events Base Case Component Modeled)

PRA Sensitivity Studies Allowable No Integral PRA Assessment -

Not Allowed Yes Section 5.6 Fire, Seismic, and Other External Component Not Allowed No Hazards Risk (Non-modeled) Shutdown - Section 5.5 Function/

Not Allowed No Component Defense-in-Core Damage - Section 6.1 Function/

Not Allowed Yes Depth Component IOP Drives Categorization Step -

Evaluation Change Associated Element NEI 00-04 Section level HSSto Functions LSS Containment - Section 6.2 Component Not Allowed Yes Qualitative Considerations - Section 9.2 Function Allowable for N/A Criteria Considerations Passive Passive - Section 4 Segment/

Not Allowed No Component 3.3 Assembly of Plant-Specific Inputs (NEI 00-04, Section 3)

Section 3 of NEI 00-04 states that the assembly of plant-specific inputs involves the collection and assessment of the key inputs to the RI categorization process. This includes design and licensing information, PRA analyses, and other relevant plant data sources. In addition, this step includes the critical evaluation of plant-specific risk information to ensure that it is adequate to support this application. The guidance in Section 3 of NEI 00-04 summarizes the use of risk information and the general quality measures that should be applied to the risk analyses supporting the 10 CFR 50.69 categorization, as well as the characterization of technical acceptability of both the internal events at power PRA and other risk analyses necessary to implement 1 O CFR 50.69.

The licensee's risk categorization process uses PRA to assess risks from internal events (including internal flooding). For the other applicable risk hazard groups, the licensee's process uses non-PRA methods for the risk characterization. The licensee uses its Appendix R safe shutdown analysis in the Millstone 2 categorization process to evaluate safety significance related to the fire hazard, its seismic margin analysis (SMA) to assess seismic risk, and its shutdown safety plan to assess shutdown risk. The use of risk information and quality of PRA is reviewed in Section 3.5 of this SE.

3.4 System Engineering Assessment (NEI 00-04, Section 4)

Paragraph 50.69(c)(1)(ii) of 10 CFR requires licensees to determine SSC functional importance using an integrated, systematic process for addressing initiating events (internal and external), SSCs, and plant operating modes, including those not modeled in the plant-specific PRA. The functions to be identified and considered include design-basis functions and functions credited for mitigation and prevention of severe accidents.

Section 4 of NEI 00-04 provides guidance for developing a systematic engineering assessment involving the identification and development of base information necessary to perform the RI categorization. The assessment includes the following elements: system selection and system boundary definition, identification of system functions, and a mapping of components to functions.

Section 4 of NEI 00-04 states that system selection and boundary definition include defining system boundaries where the system interfaces with other systems. Identification of system functions includes identification of all system functions, including design-basis and beyond design-basis functions identified in the PRA, and making sure that system functions are consistent with the functions defined in design-basis documentation and maintenance rule functions. The coarse mapping of components to functions involves the initial breakdown of system components into system functions they support. The licensee should then identify and document system components and equipment associated with each function. However, there may be circumstances where the categorization of a candidate LSS SSC within the scope of the system being considered cannot be completed because it also supports an interfacing system. In this case, the SSC will remain uncategorized until the interfacing system is considered.

Paragraph 50.69( c )( 1 )(v) of 10 CFR requires that categorization be performed for entire systems and structures, not for selected components within a system or structure. The NRC staff determined that the licensee's systematic assessment process, as described in the LAR, is consistent with the guidance summarized above, and capable of collecting and organizing information at the system level by defining boundaries, functions, and components. Therefore, the NRC staff finds that 10 CFR 50.69(c)(1)(v) will be satisfied upon implementation of the licensee's 1 O CFR 50.69 categorization process.

Section 2.2 of the LAR states that the safety functions in the categorization process include the design-basis functions, as well as functions credited for severe accidents (including external events). Section 3.1.1 of the LAR summarizes the different hazards and plant states for which functional and risk-significant information will be collected. In addition, Section 3.1.1 of the LAR states that the SSC categorization process documentation will include, among other items, system functions identified and categorized with the associated bases and mapping of components to support function(s).

Paragraph 50.69(c)(1 )(ii) of 10 CFR requires, in part, that the functions to be identified and considered in the categorization process include design-basis functions and functions credited for mitigation and prevention of severe accidents. NEI 00-04 includes guidance to identify all functions performed by each system and states that the IDP will categorize all system functions.

All system functions include all functions involved in the prevention and mitigation of accidents

• and may include additional functions not credited as hazard mitigating functions, depending on the system. The LAR summarizes the applicable guidance in NEI 00-04 and states that the guidance in NEI 00-04 will be followed. Therefore, the NRC staff finds that the licensee described a systematic process that will identify design-basis functions and functions credited for mitigation and prevention of severe accidents, consistent with the requirements in 10 CFR 50.59(c)(1)(ii).

3.5 Component Safety-Significance Assessment (NEI 00-04, Section 5)

Paragraph 50.69(c)(1 )(ii) of 10 CFR requires licensees to determine SSC functional importance using an integrated, systematic process for addressing initiating events (internal and external),

SSCs, and plant operating modes, including those not modeled in the plant-specific PRA. The component safety-significance assessment assesses the safety significance of components using quantitative or qualitative risk information from a PRA or other risk assessment methods.

In the NEI 00-04 guidance, component risk significance is assessed separately for five hazard groups:

Internal event risks (including internal flooding)

Fire risks Seismic risks Other external risks (tornadoes, external floods)

Shutdown risks Paragraph 50.69(c}(1)(i) of 10 CFR requires, in part, the use of PRA to assess risk from internal events as a minimum. The regulation specifies that the PRA used in the categorization process must be of sufficient quality and level of detail and subject to an acceptable peer review process. For the hazards other than internal events, including fire, seismic, other external hazards (high winds, external floods, etc.), and shutdown, 10 CFR 50.69(b)(2) allows, and the NEI 00-04 guidance summarizes, the use of PRA if such PRA models exist, or, in the absence of quantifiable PRA, the use of other methods (e.g., fire-induced vulnerability evaluation, SMA, individual plant examination of external events (IPEEE) screening, and shutdown safety plan).

As stated in Sections 3.1.1 and 3.2.1 through 3.2.5 of the LAR, the licensee's categorization process uses PRA to assess risks from internal events (including internal flooding). For the other four risk hazard groups, the licensee's process uses non-PRA approaches for the risk characterization, as follows:

Appendix R Safe Shutdown Equipment List (SSEL) to assess fire risk SMA SSEL to assess the risk from seismic events IPEEE screening to assess the risk from other external hazards Shutdown safety plan to assess shutdown risk The approaches used by the licensee to assess internal events, seismic hazards, other external hazards, and shutdown risk are consistent with the approaches included in the NEI 00-04 guidance, as endorsed by RG 1.201, and, therefore, acceptable to the NRC staff. The application of these approaches is reviewed in the following SE subsections: PRA in Subsections 3.5.1 and 3.5.2, and the non-PRA methods in Subsection 3.5.3. However, the use of the Appendix R SSEL to assess fire risk is not consistent with NEI 00-04 and is considered a deviation from the applicable guidance. The acceptability of using the Appendix R SSEL is evaluated in Subsection 3.5.3 of this SE.

3.5.1 Capability and Quality of the PRA to Support the Categorization Process The licensee's PRA is comprised of an internal events PRA that calculates CDF and LERF from internal events, including internal flooding, at full power. Paragraph 50.69(c)(1)(i) of 10 CFR requires, in part, that the PRA must be of sufficient quality and level of detail to support the categorization process and must be subjected to a peer review process assessed against a standard or set of acceptance criteria that is endorsed by the NRC. Paragraph 50.69(b)(2)(iii) of 1 O CFR requires the results of the PRA review process conducted to meet 10 CFR 50.69(c)(1)(i) be submitted as part of the application. The licensee has submitted this information, and the NRC staff's review of this information is presented below.

3.5.1.1 Internal Events PRA The NRC staff's review of the internal events and internal flooding PRA was based on the results of the peer review of the internal events PRA, the associated facts and observations (F&O) closure review described in LAR Section 3.3, and the previously docketed information on PRA quality submitted to the NRC for the relocation of surveillance frequencies to licensee control (Technical Specifications Task Force (TSTF) Traveler TSTF-425, dated October 29, 2015 (Reference 10), and the request to revise to the integrated leak rate test Type A and Type C test intervals, dated September 29, 2018 (Reference 11 )).

In Section 3.3 of the LAR, the licenses states that the interval events and internal flooding PRA was subject to focused-scope peer reviews in September 2012, March 2018, and July 2018, in accordance with RG 1.200, Revision 2, and covered all supporting requirements in the ASME/ANS 2009 Standard.

In Section 3.3 of the LAR, the licensee stated that in March 2018, an F&O closure review was performed by an independent team on all internal events and internal flooding finding-level F&Os. This F&O closure review was performed as detailed in Appendix X (Reference 12) to the guidance in NEI 05-04 (Reference 13), NEI 07-12 (Reference 14), and NEI 12-13 (Reference 15) concerning the process, "Close-Out of Facts and Observations." The NRC staff accepted, with conditions, a final version of Appendix X to NEI 05-04, NEI 07-12, and NEI 12-13 by letter dated May 3, 2017 (Reference 16).

The licensee submitted a list of all the open F&Os from peer reviews, including the F&Os that remained open after the F&O closure review, in LAR Attachment 3. Attachment 3 listed eight F&Os with applicable dispositions for this application. The NRC staff reviewed the licensee's resolution of all the peer review findings and assessed the potential impact of the findings on the categorization. Seven of the F&Os were dispositioned as documentation updates (which have been resolved) that would not impact the 10 CFR 50.69 categorization results. The remaining F&O is discussed below.

The description of F&O SA-A5-01 states that the licensee's PRA identifies the base mission time as safe and stable within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. However, one steam generator tube rupture (SGTR) sequence requires 32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br /> to reach safe and stable conditions. The licensee's LAR disposition states that before implementation, the Millstone 2 PRA internal events model of the SGTR accident sequence will be revised to remove credit for achieving safe and stable conditions at 32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br />. In response to NRC staff RAI 01 requesting a mechanism that ensures that the proposed change will be made before categorization, the licensee stated that F&O finding number SC-A5-01 has been resolved by removing credit to mitigate the SGTR accident sequence where safe and stable conditions were achieved at 32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br />. The staff finds this response acceptable and complete because the change has already been made.

In response to NRC staff RAI 04 (Reference 2), the licensee stated that diverse and flexible coping (FLEX) strategies have been credited in the Millstone 2 PRA model. Specifically, the licensee models the failure of two redundant portable diesel-driven transfer pumps and four additional FLEX strategies: (1) maintaining availability of vital instrumentation, which includes load shedding the direct current (DC) buses; (2) manually controlling turbine driven auxiliary feedwater pump flow after DC power is shed, which incorporates existing logic for long-term cooling via the turbine driven auxiliary feedwater pump; (3) providing alternate sources to replenish the condensate storage tank by aligning one of the two portable beyond design-basis (BDB) transfer pumps (one pre-staged in the turbine building, the other in the BDB storage dome); and (4) refueling of the portable BDB diesel transfer pump.

In response to NRC staff RAI 04b.ii (Reference 2), the licensee stated that the failure to start and failure to run data for the diesel-driven transfer pumps, as well as common cause failures (CCFs), were developed using the generic NUREG/CR-6928 values for a diesel-driven pump.

To compensate for potential differences between mobile equipment and permanently installed equipment failure parameters, the licensee multiplied the generic NUREG/CR-6928 valuesfor a diesel-driven pump by a factor of 5. In accordance with NEI 00-04, the licensee committed to perform a sensitivity study by replacing all the component common cause events with their 5th and 95th percentile values as part of the required 10 CFR 50.69 PRA categorization sensitivity cases. NEI 00-04 also provides for additional PRA-specific sensitivity studies to address additional sources of uncertainty. The licensee stated that it will perform an additional sensitivity study by replacing the FLEX failure parameters with their 5th and 95th percentile values. In the October 3, 2019 RAI response letter, the licensee committed to include these two sensitivity studies because determination of these failure parameters is incomplete.

In response to NRC staff RAI 04b.iii (Reference 2), the licensee stated that FLEX-related equipment and operator actions have been credited in the internal events and internal flooding station blackout scenarios. The modeled FLEX strategies include DC bus load shedding, manual control of the turbine driven auxiliary feedwater pump, and aligning and using alternative sources to replenish the condensate storage tank. The alternative condensate storage tank replenish sources credited transporting, aligning, and refueling two portable transfer pumps.

The failure parameters for the equipment was increased by a factor of 5 above the generic values for similar, permanently installed equipment. The licensee stated that an analysis performed in accordance with HR-A1 and HR-B1 of the ASME/ANS 2009 Standard concluded that no pre-initiators were required to be added to the PRA model. In addition, the licensee stated that the actions taken to enter into FLEX strategies are proceduralized and specific.

The licensee stated that it used the Electric Power Research Institute (EPRI) human reliability analysis (HRA) calculator to quantify human failure events, explicitly addressing all performance shaping factors identified in HR-G3. The licensee determined that the addition of FLEX to the PRA and using the HRA calculator to quantify FLEX-related actions constituted using a PRA method in a different context and, therefore, is considered a PRA upgrade. As a result, the licensee subjected the applicable changes to the PRA to a focused scope peer review in March 2018. The peer review concluded that the FLEX modeling met Capability Category II (CC II) with no F&Os. The NRC staff considers that transporting, installing, and aligning portable equipment may involve key assumptions and sources of uncertainty, in addition to those accepted in existing state-of-practice HRA methods (e.g., the EPRI HRA calculator).

However, the action to deploy portable equipment at Millstone 2 is (1) a secondary FLEX strategy (i.e., a pre-staged pump in the turbine building is the primary pump used), (2) a very small part to the overall FLEX strategy, and (3) only credited in the station blackout accident sequence. Based on the information provided by the licensee and summarized above, the impact on the 1 O CFR 50.69 categorization process associated with the uncertainties in the FLEX human error probabilities (HEPs) should be minimal, and any non-minimal impact should be identified during the standard HEP sensitivity study that is part of the categorization process, and, therefore, the NRC staff finds the inclusion of the FLEX strategies acceptable for implementation of 10 CFR 59.69.

Paragraph 50.69( c )( 1 )(i) of 10 CFR requires, in part, that any plant-specific PRA used in the categorization must be of sufficient quality and level of detail to support the categorization process and must be subjected to a peer review process assessed against a standard that is endorsed by the NRC. RG 1.200 provides guidance for determining the technical acceptability of internal events and internal flooding PRAs by comparing the PRAs to the relevant parts of the ASME/ANS 2009 Standard using a peer review process. Based on its review, the NRC staff finds that the licensee has followed the guidance in RG 1.200 and submitted the results of the peer review, and, therefore, meets the requirement in 10 CFR 50.69(b)(2)(iii). The NRC staff has reviewed the peer review results and finds that the quality and level of detail of the internal events and internal flooding PRA is sufficient to support the categorization of SSCs as required by 10 CFR 50.69 (b)(2)(ii) using the process endorsed by the NRC staff in RG 1.201.

Therefore, the NRC staff concludes that the quality of the internal events and internal flooding PRA meets the requirement in 10 CFR 50.69(c)(1)(i).

3.5.2 Importance Measures and Sensitivity Studies Paragraph 50.69(c)(1)(i) of 10 CFR requires the licensee to consider the results and insights from the PRA during categorization. These requirements are met, in part, by using importance measures and sensitivity studies, as described in NEI 00-04, Section 5. Fussell-Vesely and Risk Achievement Worth importance measures are obtained for each component and each PRA modeled hazard (e.g., separately for the internal events PRA and for the fire PRA, etc.) and the values are compared to specified criteria in NEI 00-04. Components that have internal event importance measure values that exceed the criteria are assigned HSS and cannot be changed by the IDP. Integrated importance measures over all PRA modeled hazards are calculated per Section 5.6 of NEI 00-04, and components for which the integrated measures exceed the criteria are assigned preliminary HSS.

The guidance in NEI 00-04 specifies sensitivity studies to be conducted for each PRA model.

The sensitivity studies are performed to ensure that assumptions associated with these specific uncertain parameters (i.e., human error, CCF, and maintenance probabilities) are not masking the importance of a component. The NEI 00-04 guidance states that any additional "applicable sensitivity studies" from characterization of PRA adequacy should be considered. Section 3.2. 7 of the LAR describes how the licensee searched for additional issues in the internal events (including internal flooding) PRA that should be evaluated with a sensitivity study. The licensee stated that the detailed process of identifying, characterizing, and qualitative screening of model uncertainties followed the guidance in Section 7.2 of NUREG-1855, Revision 1, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking," dated March 2017 (Reference 17), and Section 3.1.1 of EPRI Technical Report (TR)-1016737, "Treatment of Parameter and Modeling Uncertainty for Probabilistic Risk Assessments," dated December 2008 (Reference 18). The licensee reviewed the list of assumptions and sources of uncertainty in the guidance to identify those which would be significant for the evaluation of this application. If the Millstone 2 PRA model used a non-conservative treatment or methods that are not commonly accepted, the licensee reviewed the underlying assumption or source of uncertainty to determine its impact on this application. The licensee stated that only those assumptions or sources of uncertainty that could significantly impact the risk calculations were considered key for this application. In response to NRC staff RAI 05 (Reference 2), the licensee clarified that the licensee's use of "significant" assumptions and sources of uncertainty is synonymous with "key" assumptions and sources of uncertainty, as defined in RG 1.200, Revision 2, and that the licensee's identification of key assumptions and sources of uncertainty is based on this definition.

The licensee identified and dispositioned the following key Millstone 2 PRA model-specific assumptions and sources of uncertainty for this application in Attachment 6 to the LAR.

1)

ECCS [emergency core cooling system] sump blockage probability is currently based on data from the mid-1990s, whereas more recent data is available from WCAP-16882, Rev. 1, "PRA Modeling of Debris-Induced Failure of Long Term Core Cooling via Recirculation Sumps." A sensitivity study will be performed using the newer sump blockage probabilities.

2)

Thermally-induced SGTR is based on conservative NUREG-1570 analysis, whereas less conservative data is available from EPRI TR-107623-V1, Rev. 1, "Steam Generator Tube Integrity Risk Assessment." A sensitivity study will be performed in accordance with NEI 00-04, Section 5 using less conservative data from the aforementioned EPRI report.

The NRC staff reviewed the dispositions in Attachment 6 to the LAR and confirmed that the licensee addressed the uncertainty evaluations associated with the Millstone 2 risk categorization process using the processes discussed in Section 5 of NEI 00-04. Based on its review, the NRC staff finds that the licensee searched for, identified, and evaluated sources of uncertainty in its internal events (including internal flooding) PRA consistent with the guidance in RG 1.200, Revision 2; NUREG-1855; and EPRI TR-1016737, as applicable. Therefore, the NEI 00-04 guidance to identify additional "applicable sensitivity studies" is satisfied.

3.5.3 Non-PRA Methods According to 10 CFR 50.69(c)(ii), SSC functional importance uses an integrated, systematic process for addressing initiating events, SSCs, and plant operating modes, including those not modeled in the plant-specific PRA. The functions to be identified and considered include design-bases functions and functions credited for mitigation and prevention of severe accidents.

As described in the LAR, as supplemented, the licensee's categorization process uses the following non-PRA methods:

Appendix R SSEL to assess fire risk SMA to assess seismic risk Screening during the IPEEE to assess risk from other external hazards Shutdown safety plan as described in NUMARC 91-06 (Reference 19) to assess shutdown risk The NRC staff's review of these methods is discussed below.

Fire Risk Section 3.2.2 of the LAR states that the Millstone 2 categorization process will use the fire SSEL for evaluation of safety significance related to fire hazards. The licensee states that this approach addresses conditions defined by 10 CFR Part 50, Appendix R, NRC Branch Technical Position CMEB 9.5-1, regulatory exemptions, and fire-induced multiple spurious operations to identify equipment. However, this approach is a deviation from the guidance in NEI 00-04. In response to NRC staff RAI 07 (Reference 2), the licensee stated that the proposed approach for identifying HSS SSCs for internal fire hazards, by use of the SSEL, is similar to the NEI 00-04 acceptable method for seismic hazards in that the measure of safety significance categorizes all system functions and associated SSCs that are involved in the safe-shutdown success paths as HSS.

The licensee stated that at an NRC public meeting held on September 6, 2017,2 NEI and industry stakeholders met with the NRC to describe a proposed approach for identifying HSS SSCs in the 10 CFR 50.69 application for internal fire hazards. The response to NRC staff RAI 03a further clarified that the industry's 10 CFR 50.69 Coordinating Committee performed a study involving several plants to compare the number of HSS SSCs identified by each of three approaches: ( 1) fire PRA, (2) fire-induced vulnerability evaluation, and (3) SSEL. The committee concluded that each approach is more conservative than the previous approach, resulting in more HSS SSCs. The licensee further stated that in addition to categorizing equipment on the Appendix R SSEL as HSS, all fire protection equipment, including detection, suppression, and barriers (e.g., fire dampers) will be categorized as HSS.

The NRC staff has previously reviewed and accepted the use of a fire SSEL (augmented by all fire detection equipment not included in the SSEL) as proposed by the licensee.3 Based on that review, the NRC staff concluded that the fire SSEL is a conservative approach to categorizing SSCs according to fire risk, and that the SSEL list of SSCs is retained and updated as required by the licensee's implementation of 10 CFR Part 50, Appendix R. Therefore, the NRC staff finds that the proposed approach meets 10 CFR 50.69(c}(1 )(ii) by using an integrated and systematic process to identify HSS components associated with fire risk, and is, therefore, an acceptable approach.

Seismic Risk To assess seismic risk for the 10 CFR 50.69 categorization process, the licensee will use the SMA method. The SMA is a screening method that does not quantify CDF. The licensee used the SMA method during its IPEEE in response to Generic Letter 88-20, Supplement 4, "Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities -

10 CFR 50.54(f)," dated June 1991 (Reference 20). The SMA method includes the development of the seismic SSEL, which contains the components that would be needed during and after a seismic event. The SSEL identifies one preferred and one alternate path capable of achieving and maintaining safe shutdown conditions for at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following an earthquake. The licensee states in Section 3.2.3 of the LAR that it will follow the NEI 00-04 approach using the SSEL to identify credited equipment as HSS, regardless of its capacity, frequency of challenge, or level of functional diversity. The licensee stated in the LAR that it had conducted an updated evaluation of the SMA SSEL to reflect the current as-built and as-operated plant. In addition, the licensee stated that future changes to the plant will be evaluated as needed to determine their impact on the SMA and risk categorization process.

Consistent with NEI 00-04, the licensee's 10 CFR 50.69 categorization process considers all components in the SSEL as HSS based on seismic risk.

The approach proposed by the licensee meets 10 CFR 50.69(c)(1)(ii) by using an integrated and systematic process to identify HSS components consistent with the seismic risk evaluation process, as described in NEI 00-04. Therefore, the NRC staff finds the licensee's proposed approach acceptable.

2 Agencywide Documents Access and Management System (ADAMS) Accession Nos. ML17249A072 and ML17265A020.

3 ADAMS Accession No. ML19179A135.

Other External Hazards The licensee stated that external hazards were initially evaluated by the licensee during the IPEEE. This hazard category includes all non-seismic external hazards such as transportation and nearby facility accidents and other hazards. The IPEEE external hazard analysis used a progressive screening approach and concluded that all these other hazards are negligible contributors to overall plant risk. Further, the licensee indicated that it had reevaluated these other external hazards using the criteria in the ASME/ANS 2009 Standard.

In Section 3.2.4 of the LAR, the licensee stated that as part of the categorization assessment of other external hazard risk, an evaluation is performed to determine if there are components being categorized that participate in unscreened scenarios and whose failure would result in an unscreened scenario. In response to NRC staff RAI 02a/b/c (Reference 2), the licensee reiterated that all external hazards (excluding internal fires and seismic hazards) will be evaluated in accordance with the flow chart in NEI 00-04, Section 5.4, Figure 5-6, "Other External Hazards." In addition, the licensee clarified that as part of the categorization assessment of "other external hazard" risk, an evaluation is performed to determine if there are components being categorized that participate in screened scenarios and whose failure would result in an unscreened scenario. The licensee stated that those components would be categorized as HSS.

In Attachment 4 in the LAR, the licensee stated: "As part of the NRC 10 CFR 50.54(f) request on Reevaluation of External Floods, Dominion Energy is in the process of evaluating the external flooding hazard at Millstone.... " In NRC staff RAI 02d, the staff requested that the licensee "[p]ropose a mechanism that ensures that the [finalized] potential for external flooding will be incorporated into the categorization." In its October 3, 2019 RAI response letter (Reference 2), the licensee provided a regulatory commitment to review the completed reevaluation of external floods to ensure that the potential for external flooding will be incorporated into the categorization process, consistent with the guidelines for external events evaluation described in NEI 00-04. The licensee stated that the 10 CFR 50.69 categorization procedure will be updated to reference the reevaluation of external floods to ensure that both SSCs relied on in unscreened scenarios, and SSCs whose failure would cause screened scenarios to become unscreened, are appropriately identified and categorized according to Figure 5-6 in NEI 00-04. As acknowledged by the licensee, the specific action of the proposed commitment was updated and made a part of the proposed license condition.4 Because the licensee confirmed that the other external hazard risk evaluation is consistent with NEI 00-04 and because the licensee will review the completed 10 CFR 50.54(f) reevaluation of external floods and update its 10 CFR 50.69 categorization procedures, as necessary, prior to the adoption of 10 CFR 50.69 to ensure that the potential for external flooding will be incorporated into the categorization process consistent with applicable guidance, the NRC staff finds the licensee's treatment of other external hazards acceptable, and 10 CFR 50.69(c)(1 )(ii) is met.

Shutdown Risk Paragraph 50.69(c)(1)(ii) of 10 CFR requires the licensee to determine SSC functional importance using an integrated, systematic process for addressing initiating events (internal and external), SSCs, and plant operating modes, including those not modeled in the plant-specific 4 ADAMS Accession No. ML20010G372.

PRA. Consistent with the NEI 00-04 guidance, the licensee proposes to use the shutdown safety assessment process based on NUMARC 91-06. The guidance in NUMARC 91-06 provides considerations for maintaining DID for the five key safety functions during shutdown -

decay heat removal capability, inventory control, power availability, reactivity control, and containment - primary/secondary. The guidance in NUMARC 91-06 specifies that a DID approach should be used with respect to each defined shutdown key safety function. This is accomplished by designating a running and an alternative system/train to accomplish the given key safety function.

The licensee states that components are categorized with respect to shutdown risk using a non-PRA shutdown assessment as follows:

If the SSC is considered to be part of a "primary shutdown safety system" as defined in NEI 00-04, then that SSC is categorized as preliminary HSS.

If the SSC's failure would initiate an event during shutdown plant conditions (e.g., loss of shutdown cooling, drain down), then that SSC is categorized as preliminary HSS.

As explained above, the shutdown safety assessment method proposed by the licensee is consistent with the guidance in NEI 00-04. In addition, the method meets 10 CFR 50.69( c )( 1 )(ii) by using an integrated and systematic process that could identify HSS components, if they existed, consistent with the shutdown evaluation process, as described in NEI 00-04.

Therefore, the NRC staff finds the licensee's proposed method acceptable.

3.5.4 Component Safety-Significance Assessment for Passive Components Passive components are not modeled in the PRA and, therefore, a different assessment method is necessary to assess the safety significance of these components. Passive components are those components having only a pressure-retaining function. This process also includes the passive function of active components, such as the pressure/liquid retention of the body of a motor-operated valve.

In the LAR, the licensee proposed using a categorization method for passive components not cited in NEI 00-04 for passive component categorization but approved by the NRC for Arkansas Nuclear One, Unit 2 (AN0-2) (Reference 21 ). The AN0-2 methodology is an RI safety classification and treatment program for repair/replacement activities for Class 2 and Class 3 pressure-retaining items and their associated supports ( exclusive of Class CC and MC items),

using a modification of the ASME Code Case N-660, "Risk-Informed Safety Classification for Use in Risk-Informed Repair/Replacement Activities,Section XI, Division 1" (Reference 22).

The AN0-2 methodology relies on the conditional core damage and large early release probabilities associated with pipe ruptures. Safety significance is generally measured by the frequency and the consequence of, in this case, pipe ruptures. Treatment requirements (including repair/replacement) only affect the frequency of passive component failure.

Categorizing solely based on consequences, which measures the safety significance of the pipe given that it ruptures, is conservative compared to including the rupture frequency in the categorization. The categorization will not be affected by changes in frequency arising from changes to the treatment.

In Section 3.1.2 of the LAR, the licensee states that it will only apply the AN0-2 methodology to ASME Class 2 and Class 3 SSCs, and that all ASME Code Class 1 SSCs with a pressure-retaining function, as well as supports, will be assigned HSS for passive categorization, which will result in HSS for its RI safety classification and cannot be changed by the IDP.

Because all Class 1 SSCs and supports will be considered HSS, and only Class 2 and Class 3 SSCs will be categorized using the AN0-2 passive categorization methodology consistent with previous NRC approval, the NRC staff finds the licensee's proposed approach for passive categorization acceptable for the 10 CFR 50.69 categorization process.

3.5.5 Summary The NRC staff reviewed the PRA and the non-PRA methods used by the licensee in its 10 CFR 50.69 categorization process to assess the safety significance of active and passive components and finds these methods acceptable and consistent with RG 1.201 and NEI 00-04.

The NRC staff approves the use of the following methods in the licensee's 10 CFR 50.69 categorization process:

PRA to assess internal events risk and internal flooding Appendix R SSEL to assess fire risk SMA to assess seismic risk Screening using IPEEE to assess risk from other external hazards Shutdown safety plan to assess shutdown risk AN0-2 (see Reference 21) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports Based on its review of the LAR and the licensee's responses to RAls, the NRC staff finds that the PRA and associated PRA evaluations have been developed and reviewed consistent with approaches and methods that the staff has found acceptable as summarized above. The licensee has identified three Millstone 2 specific sensitivity studies that will be conducted consistent with NEI 00-04 guidance that PRA specific sensitivity studies, if identified, should be performed. These three studies are associated with sump blockage, thermally induced SGTR, and the independent failure parameters of portable FLEX equipment. The impact of uncertainties in the FLEX CCF failure parameters will be included in the sensitivity studies on CCF that are included in the NEI 00-04 general guidance. The licensee also stated that the updated flooding hazard analyses required by the 10 CFR 50.54(f) request on reevaluation of external floods uncertainty has not yet been completed. Therefore, this amendment includes as part of the license condition that the licensee will review the completed 10 CFR 50.54(f) reevaluation of external floods and update its 10 CFR 50.69 categorization procedures, as necessary, prior to the adoption of 10 CFR 50.69 to ensure that the potential for external flooding will be incorporated into the categorization process consistent with applicable guidance.

3.6 Assessment of Defense-in-Depth (DID) (NEI 00-04, Section 6)

Paragraph 50.69(c)(1 )(iii) of 10 CFR requires that the process used for categorizing SSCs must maintain DID. Section 6 of NEI 00-04, provides guidance on assessment of DID. In Section 3.1.1 of the LAR, the licensee states that it will require an SSC categorized as HSS based on the DID assessment in Section 6 of NEI 00-04 to be categorized as HSS.

Figure 6-1 in NEI 00-04 provides guidance to assess design-basis DID based on the likelihood of the design-basis internal event initiating event and the number of redundant and diverse trains nominally available to mitigate the initiating event. The likelihood of the initiating events is binned and, for different likelihood bins, HSS is assigned if fewer than the indicated number of mitigating trains are nominally available. Section 6 of NEI 00-04 also provides guidance to assess containment DID based on preserving containment isolation and long-term containment integrity and on preventing containment bypass and early hydrogen burns. The DID for beyond design-basis initiating events is addressed by the PRA categorization process.

RG 1.201 endorses the guidance in NEI 00-04, Section 6, but notes that the containment isolation criteria in this section of NEI 00-04 are separate and distinct from those set forth in 10 CFR 50.69(b )( 1 )(x). The criteria in 10 CFR 50.69(b )( 1 )(x) are to be used in determining which containment penetrations and valves may be exempted from the Type B and Type C leakage testing requirements in both Options A and B of Appendix J to 10 CFR Part 50, but the 10 CFR 50.69(b )( 1 )(x) criteria are not used to determine the proper RISC category for containment isolation valves or penetrations.

Based on its review, the NRC staff finds that the licensee's categorization process is consistent with the NEI 00-04 guidance and fulfills the 10 CFR 50.69(c)(1 )(iii) criterion that DID is maintained.

3.7 Preliminary Engineering Categorization of Functions (NEI 00-04, Section 7)

All of the information collected and evaluated in the different engineering evaluations is collected, organized, and provided to the IDP, as described in NEI 00-04, Section 7. The IDP will make the final decision about the safety significance of SSCs based on guidelines in NEI 00-04, the information they receive, and their expertise.

In LAR Section 3.1.1, the licensee stated that if any component is identified as HSS from either the integrated risk component safety significance assessment (Section 5 of NEI 00-04), the DID assessment (Section 6 of NEI 00-04), or the qualitative criteria (Section 9 of NEI 00-04), the associated system function(s) would be identified as HSS. Once a system function is identified as HSS, then all the components that support that function are categorized as preliminary HSS.

The NRC staff finds that the licensee's preliminary categorization process is consistent with the guidance in NEI 00-04, as endorsed in RG 1.201, and is, therefore, acceptable.

3.8 Risk Sensitivity Study (NEI 00-04, Section 8)

Paragraph 50.69(c)(1)(iv) of 10 CFR requires that any potential increases in CDF and LERF resulting from changes to treatment are small. The guidance in Section 8 of NEI 00-04, as endorsed by RG 1.201, includes an overall risk sensitivity study for all the LSS components to confirm that if the unreliability of the components was increased, the increase in risk would be small (i.e., meet the acceptance guidelines of RG 1.17 4 ). Sections 3.1.1 and 3.2. 7 of the LAR clarify that in the sensitivity study, the unreliability of all LSS SSCs modeled in the PRAs will be increased by a factor of 3. Separate sensitivity studies are to be performed for each system categorized, as well as a cumulative sensitivity study for all the SSCs categorized through the 10 CFR 50.69 process.

This sensitivity study, together with the periodic review process discussed in Section 3.10 of this SE, assure that the potential cumulative risk increase from the categorization is small. The performance monitoring process monitors the component performance to ensure that potential increases in failure rates of categorized components are detected and addressed before reaching the rate assumed in the sensitivity study.

The NRC staff finds that the licensee will perform the risk sensitivity study consistent with the guidance in NEI 00-04, Section 8.0, and, therefore, will assure that the potential cumulative risk increase from the categorization is small, as required by 10 CFR 50.69(c)(1)(iv).

3.9 IDP Review and Approval {NEI 00-04, Sections 9 and 10)

Paragraph 50.69(c)(2) of 10 CFR requires that the SSCs must be categorized by an IDP staffed with expert, plant-knowledgeable members whose expertise includes, at a minimum, PRA, safety analysis, plant operations, design engineering, and system engineering. Section 3.1.1 of the LAR clarifies that the IDP will be composed of a group of at least five experts who collectively have expertise in plant operation, design (mechanical and electrical) engineering, system engineering, safety analysis, and PRA. Therefore, the required expertise will be found in the IDP.

The guidance in NEI 00-04, endorsed in RG 1.201, ensures that the IDP expertise is sufficient to perform the categorization and that the results of the different evaluations (PRA and non-PRA) are used in an integrated, systematic process, as required by 10 CFR 50.69( c )( 1 )(ii).

As provided by the NEI 00-04 guidance, and as indicated in LAR, Attachment 1, the process used by the IDP for the categorization of SSCs will be described and documented in a plant procedure.

Section 3.1.1 of the LAR states that at least three members of the IDP will have a minimum of 5 years of experience at the plant, and there will be at least one member of the IDP who has a minimum of 3 years of experience in modeling and updating of the plant-specific PRA.

Section 3.1.1 further clarifies that the IDP will be trained in the specific technical aspects and requirements related to the categorization process. Training will address, at a minimum, the purpose of the categorization; present treatment requirements for SSCs, including requirements for design basis events; PRA fundamentals; details of the plant-specific PRA, including the modeling, scope, and assumptions; the interpretation of risk importance measures and the role of sensitivity studies and the change-in-risk evaluations; and the DID philosophy and requirements to maintain this philosophy.

Based on its review, the NRC staff finds that the licensee's IDP areas of expertise meet the requirements in 10 CFR 50.69(c)(2), and the additional descriptions of the IDP characteristics, training, processes, and decision guidelines are consistent with NEI 00-04, as endorsed by RG 1.201. Therefore, all aspects of the integrated, systematic process used to characterize SSCs will reasonably reflect current plant configuration and operating practices, and applicable plant and industry operational experience as required by 10 CFR 50.69(c)(1 )(ii).

The IDP may change the categorization of a component from LSS to HSS based on its assessment and decision-making. As outlined in NEI 00-04, Section 10.2, the IDP may re-categorize components supporting an HSS function from HSS to LSS only if a credible failure of the component would not preclude the fulfillment of the HSS function and the component was not categorized as HSS based on the six criteria above (i.e., internal events PRA, integrated PRA component risk, SMA, shutdown, passive categorization, and DID).

Paragraph 50.69(c)(1 )(iv) of 10 CFR requires, in part, reasonable confidence that sufficient safety margins are maintained for SSCs categorized as RISC-3. The licensee addresses safety margins through an integrated engineering evaluation that would nominally be addressed by the IDP. Consistent with the discussion in the NEI 00-04 guidance endorsed by RG 1.201, the IDP need not explicitly consider safety margins. Sufficient safety margin will be maintained because the RISC-3 SSCs will remain capable of performing their safety-related functions as required by 10 CFR 50.69(d)(2), and because any potential increases in CDF and LERF that might stem from changes in RISC-3 SSC reliability due to reduced treatment permitted by 10 CFR 50.69 will be maintained small, as required by 10 CFR 50.69(c)(1)(iv). Therefore, the NRC staff finds that the program implemented by the licensee, consistent with the endorsed guidance in NEI 00-04, fulfills the 10 CFR 50.69(c)(1)(iv) criteria that sufficient safety margins are maintained.

3.10 Program Documentation, Change Control. and Periodic Review (NEI 00-04, Sections 11 and 12)

Paragraph 50.69(c)(1 )(ii) of 10 CFR requires, in part, that all aspects of the integrated, systematic process used to characterize SSC importance must reasonably reflect the current plant configuration and operating practices and applicable plant and industry operating experience. Section 11 of NEI 00-04, as endorsed in RG 1.201, provides guidance on program documentation and change control, and Section 12 provides guidance on periodic review.

These sections are described in NEI 00-04 with respect to satisfying 10 CFR 50.69(e) and 10 CFR 50.69(f), respectively. Maintaining change control and periodic review will also maintain confidence that all aspects of the program reflect current plant operation.

Section 50.69(e) of 10 CFR requires periodic updates to the licensee's PRA and SSC categorization. The NRC staff finds that changes over time to the PRA and SSC reliabilities are inevitable, and such changes are recognized by the 10 CFR 50.69(e) provision requiring periodic updates. As provided in RG 1.200, the NRC staff's review of the PRA quality and level of detail reported in this SE is based primarily on determining how the licensee has resolved key assumptions and areas identified by peer reviewers as being of concern (i.e., F&Os). As discussed above in this SE, the NRC staff has concluded that several weaknesses or errors in the PRA will be addressed, as stated in the implementation items prior to implementation of the 10 CFR 50.69 categorization, because they otherwise could have a substantive impact on the PRA results. The results of the review of the current PRA are reported in Section 3.5 of this SE.

As described in LAR Section 3.2.6, the licensee has administrative controls in place to ensure that the PRA models used to support the categorization reflect the as-built, as-operated plant over time. The licensee's process includes regularly scheduled and interim (as needed) PRA model updates. The process includes provisions for monitoring issues affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, industry operational experience) for assessing the risk impact of unincorporated changes and for controlling the model and associated computer files. The process also includes reevaluating previously categorized systems to ensure the continued validity of the categorization. Routine PRA updates are performed every two refueling cycles at a minimum. The NRC staff finds that this description is consistent with the requirements for feedback and process adjustment required by 10 CFR 50.69(e), and is, therefore, acceptable.

Paragraph 50.69(f) of 10 CFR requires program documentation, change control, and records.

In Section 3.2.6 of the LAR, the licensee stated that it will implement a process that addresses the guidance in Section 11 of NEI 00-04 pertaining to program documentation and change control records. Section 3.1.1 of the LAR states that the RISC categorization process documentation will include the following ten elements:

Program procedures used in the categorization System functions identified and categorized with the associated bases Mapping of components to support function(s)

PRA model results, including sensitivity studies Hazards analyses, as applicable Passive categorization results and bases Categorization results, including all associated bases and RISC classifications Component critical attributes for HSS SSCs Results of periodic reviews and SSC performance evaluations IDP meeting minutes and qualification/training records for the IDP members In addition, LAR Attachment 1 (List of Categorization Prerequisites) states that the licensee will established procedures for the use of the categorization process that contain the following elements: (1) IDP member qualification requirements, (2) qualitative assessment of system functions, (3) component safety significance assessment, (4) assessment of DID and safety margin, (5) review by the IDP and final determination of safety significance for system functions and components, (6) risk sensitivity studies to confirm that the risk acceptance guidelines of RG 1.17 4 are met, (7) periodic reviews to ensure continued categorization validity and acceptable performance for SSCs that have been categorized, and (8) documentation requirements identified in LAR Section 3.1.1. Procedures are formal plant documents and changes will be tracked providing change control and records of the changes.

Based on its review of the LAR, as supplemented, the NRC staff finds that the change control and performance monitoring of categorized SSCs and PRA updates will sufficiently capture and evaluate component failures to identify significant changes in the failure probabilities. In addition, the PRA update program and associated reevaluation of component importance will appropriately consider the effects of changing failure probabilities and changing plant configuration on the component safety-significant categories. As discussed above, the NRC staff finds that the process in NEI 00-04 and the LAR will meet the requirements in 1 O CFR 50.69(e) and 10 CFR 50.69(f). Therefore, the process used to characterize SSC importance will reasonably reflect the current plant configuration and operating practices, and applicable plant and industry operational experience required in 10 CFR 50.69(c)(1 )(ii).

3.11 Technical Conclusion The NRC staff reviewed the licensee's 10 CFR 50.69 categorization process and concludes that the licensee adequately implements 10 CFR 50.69 using models, methods, and approaches consistent with NEI 00-04 and RG 1.201 and, therefore, satisfies the requirements in 10 CFR 50.69(c). Based on its review, the NRC staff finds the licensee's proposed categorization process acceptable for categorizing the safety significance of SSCs. Specifically, the staff concludes that the licensee's categorization process:

(1) considers results and insights from a plant-specific internal events (including internal flooding) PRA, which is of sufficient quality and level of detail to support the categorization process and that either has been subjected to a peer review process against RG 1.200, Revision 2, or will be subjected to such a process prior to implementation of the 1 O CFR 50.69 program, as reviewed in Section 3.5.1 of this SE, and, therefore, meets the requirements in 10 CFR 50.69(c)(1 )(i);

(2) determines SSC functional importance using an integrated systematic process that reasonably reflects the current plant configuration, operating practices, and applicable plant and industry operational experience, as reviewed in Sections 3.3, 3.4, 3.5, 3.7, and 3.10 of this SE, and, therefore, meets the requirements in 10 CFR 50.69(c)(1 )(ii);

(3) maintains DID, as reviewed in Section 3.6 of this SE, and, therefore, meets the requirements in 10 CFR 50.69(c)(1)(iii);

( 4) includes evaluations that provide reasonable confidence that for SSCs categorized as RISC-3, sufficient safety margins are maintained and that any potential increases in CDF and LERF resulting from changes in treatment are small, as reviewed in Sections 3.8 and 3.9 of this SE, and, therefore, meets the requirements in 10 CFR 50.69(c)(1)(iv);

(5) is performed for entire systems and structures, rather than for selected components within a system or structure, as reviewed in Section 3.3 of this SE, and, therefore, the requirements in 10 CFR 50.69(c)(1)(v) will be met upon implementation; and (6) includes categorization by IDP, staffed with expert, plant-knowledgeable members whose expertise includes, at a minimum, PRA, safety analysis, plant operation, design engineering and system engineering, as reviewed in Section 3.9 of this SE, and, therefore, meets the requirements in 10 CFR 50.69(c)(2).

4.0 10 CFR 50.69 IMPLEMENTATION LICENSE CONDITION Paragraph 50.69(b )(2) of 10 CFR requires the licensee to submit an application that describes the categorization process. Paragraph 50.69(b)(3) of 10 CFR states that the Commission will approve the licensee's application if it determines that the categorization process satisfies the requirements in 10 CFR 50.69(c). As described in this SE, the NRC staff has concluded that the 10 CFR 50.69 categorization process described in the licensee's application, as supplemented, includes a description of the categorization process that satisfies the requirements in 10 CFR 50.69(c). The NRC staff notes that the licensee described some minor changes to the PRA and PRA methods. The NRC staff determined that these minor changes would not impact the 10 CFR 50.69 categorization process and were similar to occasional future changes to the PRA and PRA methods that occur over time. Therefore, the NRC staff determined that these additional minor changes do not need to be resolved prior to implementation of the 10 CFR 50.69 categorization process and, therefore, can be addressed and resolved using the licensee's periodic review process.

The licensee proposed th~ following condition to its license:

The licensee is approved to implement 10 CFR 50.69 using the processes for categorization of RISC-1, RISC-2, RISC-3, and RISC-4 structures, systems, and components (SSCs) using: Probabilistic Risk Assessment (PRA) model to evaluate risk associated with internal events, including internal flooding; and the Appendix R program to evaluate fire risk; and the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (AN0-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; and the results of non-PRA evaluations that are based on the IPEEE [Individual Plant Examination of External Events] Screening Assessment for External Hazards, i.e., seismic margin analysis (SMA) to evaluate seismic risk, and a screening of other external hazards updated using the external hazard screening significance process identified in ASME/ANS PRA Standard RA-Sa-2009; as specified in Unit 2 License Amendment No. [XXX] dated [DATE].

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

Based on its evaluation in this SE, the NRC staff finds that the proposed license condition is acceptable because it adequately implements 10 CFR 50.69 using models, methods, and approaches consistent with the applicable guidance that has previously been endorsed as acceptable by the NRC.

Additionally, as discussed in Section 3.5.3, "Non-PRA Methods," of this SE, the licensee submitted a regulatory commitment to review the completed reevaluation of external floods and update its 10 CFR 50.69 to ensure that the potential for external flooding will be incorporated into the categorization process. The NRC staff determined that this action is necessary to support the basis of the regulatory review and reasonable assurance finding, as described in Section 2.3 of this SE. Therefore, this proposed commitment has been elevated to a license condition as follows:

The licensee will review the completed 10 CFR 50.54(f) reevaluation of external floods and update its 10 CFR 50.69 categorization procedures, as necessary, prior to the adoption of 10 CFR 50.69 to ensure that the potential for external flooding will be incorporated into the categorization process consistent with applicable guidance.

5.0 STATE CONSULTATION

In accordance with the Commission's regulations, the Connecticut State official was notified on January 6, 2020, of the proposed issuance of the amendment. The State official had no comments.

6.0 ENVIRONMENTAL CONSIDERATION

The amendment changes requirements with respect to the installation or use of facility components located within the restricted area as defined in 1 O CFR Part 20 or changes inspection or surveillance requirements. The NRC staff has determined that the amendment involves no significant increase in the amounts and no significant change in the types of any effluents that may be released offsite and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has previously issued a proposed finding, which was published in the Federal Register on March 26, 2019 (84 FR 11337), that the amendment involves no significant hazards consideration, and there has been no public comment on such finding. Accordingly, the amendment meets the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9). Pursuant to 10 CFR 51.22(b),

no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.

7.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety.

8.0 REFERENCES

1. Sartain, Mark, DENC, to U.S. NRC, "Millstone Power Station Unit 2, Application to Adapt 10 CFR 50.69, 'Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors,"' dated January 17, 2019 (ADAMS Accession No. ML19023A427).

2. Sartain, Mark, DENC, to U.S. NRC, "Millstone Power Station Unit 2, License Amendment Request to Adopt 10 CFR 50.69, Response to NRC Request for Additional Information,"

dated October 3, 2019 (ADAMS Accession No. ML19284A397).

3. Guzman, Richard, U.S. NRC, to Stoddard, Daniel, DENC, "Millstone Power Station, Unit No. 2 - Audit Plan and Setup of Online Reference Portal for License Amendment Request to Adopt 10 CFR 50.69, 'Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors,"' dated July 18, 2019 (ADAMS Accession No. ML19198A197).

4. Guzman, Richard, U.S. NRC, to Sinha, Shayan, DENC, "Millstone Unit 2: Request for Additional Information - LAR to Adopt 10 CFR 50.69," dated September 5, 2019 (ADAMS Accession No. ML19248D755).

5. Nuclear Energy Institute, "10 CFR 50.69 SSC Categorization Guideline," NEI 00-04, Revision 0, dated July 2005 (ADAMS Accession No. ML052900163).

6. U.S. NRC, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance," Regulatory Guide 1.201 (For Trial Use), Revision 1, dated May 2006 (ADAMS Accession No. ML061090627).

7. U.S. NRC, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Regulatory Guide 1.200, Revision 2, dated March 2009 (ADAMS Accession No. ML090410014).

8. American Society of Mechanical Engineers/American Nuclear Society, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," ASME/ANS RA-Sa-2009, dated February 2009 (ADAMS Accession No. ML092870592}.

9. U.S. NRC, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Regulatory Guide 1.174, Revision 3, dated January 2018 (ADAMS Accession No. ML17317A256).

10. Guzman, Richard, U.S. NRC, to Heacock, David, DENC, "Millstone Power Station, Unit No. 2 - Issuance of Amendment Re: Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee Controlled Program, Adoption of TSTF-425, Revision 3," dated October 29, 2015 {ADAMS Accession No. ML15280A242).

11. Guzman, Richard, U.S. NRC, to Stoddard, Daniel, DENC, "Millstone Power Station, Unit No. 2 - Issuance of Amendment No. 335 Regarding Revision to the Integrated Leak Rate Type A and Type C Test Intervals," dated September 25, 2018 {ADAMS Accession No. ML18246A007).

12. Anderson, Victoria, Nuclear Energy Institute, to Rosenberg, Stacey, U.S. NRC, "Final Revision of Appendix X to NEI 05-04/07-12/12-16, Close Out of Facts and Observations

{F&Os)," dated February 21, 2017 (ADAMS Package Accession No. ML17086A431).

13. Nuclear Energy Institute, "Process for Performing Internal Events PRA Peer Reviews Using the ASME/ANS PRA Standard," NEI 05-04, Revision 3, dated November 2009.

14. Nuclear Energy Institute, "Fire Probabilistic Risk Assessment (FPRA) Peer Review Process Guidelines," NEI 07-12, Revision 1, dated June 2010 {ADAMS Package Accession No. ML102230049).

15. Nuclear Energy Institute, "External Hazards PRA Peer Review Process Guidelines,"

NEI 12-13, dated August 2012 {ADAMS Package Accession No. ML122400044).

16. Giitter, Joseph, and Ross-Lee, Mary Jane, U.S. NRC, to Krueger, Greg, Nuclear Energy Institute, "U.S. Nuclear Regulatory Commission Acceptance on Nuclear Energy Institute Appendix X to Guidance 05-04, 07-12, and 12-13, Close-Out of Facts and Observations

{F&Os)," dated May 3, 2017 (ADAMS Accession No. ML17079A427).

17. U.S. NRC, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking," NUREG-1855, Revision 1, dated March 2017 {ADAMS Accession No. ML17062A466).

18. Electric Power Research Institute, "Treatment of Parameter and Modeling Uncertainty for Probabilistic Risk Assessments," EPRI TR-1016737, dated December 2008.

19. Nuclear Management and Resources Council, Inc., "Guidelines for Industry Actions to Assess Shutdown Management," NUMARC 91-06, dated December 1991 {ADAMS Accession No. ML14365A203).

20. U.S. NRC, Generic Letter 88-20, Supplement 4, "Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10 CFR 50.54(f)," dated June 1991.

21. Markley, Michael, U.S. NRC, to Vice President, Operations, Arkansas Nuclear One, Entergy Operations, Inc., "Arkansas Nuclear One, Unit 2 - Approval of Request for Alternative AN02-R&R-004, Revision 1, Request to Use Risk-Informed Safety Classification and Treatment for Repair/Replacement Activities in Class 2 and 3 Moderate and High Energy Systems," dated April 22, 2009 (ADAMS Accession No. ML090930246).

22. ASME Code Case, N-660, "Risk-Informed Safety Classificationfor Use in Risk-Informed Repair/Replacement Activities," dated July 2002.

Principal Contributor: M. Levine Date: January 30, 2020

SUBJECT:

MILLSTONE POWER STATION, UNIT NO. 2-ISSUANCE OF AMENDMENT NO. 337 RE: ADOPTION OF 10 CFR 50.69, "RISK-INFORMED CATEGORIZATION AND TREATMENT OF STRUCTURES, SYSTEMS AND COMPONENTS OF NUCLEAR POWER REACTORS" (EPID L-2019-LLA-0008)

DATED JANUARY 30, 2020 DISTRIBUTION:

PUBLIC RidsACRS_MailCTR Resource RidsNrrDorlLpl1 Resource RidsNrrDexEicb Resource RidsNrrDexEeob Resource RidsNrrDraApla Resource RidsNrrDnrlNphp Resource RidsNrrPMMillstone Resource RidsNrrLALRonewicz Resource RidsRgn1 MailCenter Resource MLevine, NRR SDinsmore, NRR FForsaty, NRR ADAMS A ccess1on N ML19340A025 o.:

OFFICE NRR/DORL/LPL 1/PM NRR/DORL/LPL 1/LA NAME RGuzman LRonewicz DATE 01/07/2020 01/10/2020 OFFICE NRR/DNRL/NPHP/BC*

NRR/DEX/EEOB/BC NAME MMitchell BTitus DATE 12/16/2019 01/06/2020 OFFICE NRR/DNRL/NVIB/BC*

NRR/DEX/EMIB/BC*

NAME HGonzalez SBailey (KHsu for)

DATE 12/16/2019 12/09/2019 OFFICE NRR/DORL/LPL 1/BC NRR/DORL/LPL 1/PM NAME JDanna RGuzman DATE 01/30/2020 01/30/2020 OFFICIAL RECORD COPY

>Y e-ma1

• b

• 1 NRR/DRA/APLA/BC*

BPascarelli 11/25/2019 NRR/DEX/EICB/BC*

MWaters 12/16/2019 OGC-NLO*

JWachutka 01/28/2020

!.