ML22041A527

Document to Support ACRS Subcommittee Meeting Redline Standard Review Plan 19.0 Probablistic Risk Assessment and Accident Evaluation for New Reactors

ML22041A527
Person / Time
Issue date:	02/09/2022
From:	Office of Nuclear Material Safety and Safeguards
To:
James O'Driscoll
Shared Package
ML22040A074	List: ML22041A225 ML22041A229 ML22041A234 ML22041A271 ML22041A283 ML22041A310 ML22041A335 ML22041A375 ML22041A444 ML22041A446 ML22041A456 ML22041A527 ML22041A532 ML22042A104 ML22042A116
References
10 CFR Part 50, 10 CFR Part 52, NRC-2009-0196, Part 50/52, RIN 3150-AI66
Download: ML22041A527 (44)

Text

THIS DRAFT DOCUMENT IS BEING RELEASED TO SUPPORT THE FEBURARY 18, 2022, ADVISORY COMMITTEE ON REACTOR SAFEGUARDS (ACRS) 10 CFR PART 50/52 RULEMAKING ACTIVITIES SUBCOMMITTEE PUBLIC MEETING. THE NRC STAFF IS NOT REQUESTING OR ACCEPTING PUBLIC COMMENTS ON THIS DRAFT DOCUMENT. THIS DRAFT DOCUMENT HAS NOT BEEN SUBJECT TO NRC MANAGEMENT OR LEGAL REVIEWS AND APPROVALS, AND ITS CONTENTS SHOULD NOT BE INTERPRETED AS OFFICIAL AGENCY POSITIONS.

FOLLOWING THE PUBLIC MEETING WITH THE ACRS, THE NRC STAFF PLANS TO CONTINUE WORKING ON THIS DOCUMENT AND TO CONSIDER OPTIONS FOR INVITING PUBLIC PARTICIPATION IN THE RULEMAKING ACTIVITY.

Revision 3 - December 20154 - May 2022 USNRC STANDARD REVIEW PLAN This Standard Review Plan (SRP), NUREG-0800, has been prepared to establish criteria that the U.S. Nuclear Regulatory Commission (NRC) staff responsible for the review of applications to construct and operate nuclear power plants intends to use in evaluating whether an applicant/licensee meets the NRC regulations. The SRP is not a substitute for the NRC regulations, and compliance with it is not required. However, an applicant is required to identify differences between the design features, analytical techniques, and procedural measures proposed for its facility and the SRP acceptance criteria and evaluate how the proposed alternatives to the SRP acceptance criteria provide an acceptable method of complying with the NRC regulations.

The SRP sections are numbered in accordance with corresponding sections in Regulatory Guide (RG) 1.70, "Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants (LWR Edition)." Not all sections of RG 1.70 have a corresponding review plan section. The SRP sections applicable to a combined license application for a new light-water reactor (LWR) are based on RG 1.206, "Combined License Applications for Nuclear Power Plants (LWR Edition)."." These documents are made available to the public as part of the NRC policy to inform the nuclear industry and the general public of regulatory procedures and policies.

Individual sections of NUREG-0800 will be revised periodically, as appropriate, to accommodate comments and to reflect new information and experience. Comments may be submitted electronically by email to NRO_SRP@nrc.gov Requests for single copies of SRP sections (which may be reproduced) should be made to the U.S. Nuclear Regulatory Commission, Washington, DC 20555, Attention: Reproduction and Distribution Services Section by fax to (301) 415-2289; or by email to DISTRIBUTION@nrc.gov. Electronic copies of this section are available through the NRC public Web site at http://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr0800/, or in the NRC Agencywide Documents Access and Management System (ADAMS), at http://www.nrc.gov/ reading-rm/adams.html, under ADAMS Accession No. ML15089A068.

NUREG-0800 U.S. NUCLEAR REGULATORY COMMISSION STANDARD REVIEW PLAN 19.0 PROBABILISTIC RISK ASSESSMENT AND SEVERE ACCIDENT EVALUATION FOR NEW REACTORS REVIEW RESPONSIBILITIES Primary -

Organization responsible for the review of the applicants probabilistic risk assessment Organization responsible for the review of severe accident design features Secondary -

Organization responsible for the review of structural engineering Technical organizations identified in the Review Interface section of this plan may be consulted, as needed I.

AREAS OF REVIEW

19.0-2 Revision 3 - December 20154 - May 2022 This section of the Standard Review Plan (SRP) pertains to the staff review of the design-specific probabilistic risk assessment (PRA) for a design certification (DC) or manufacturing license (ML) and the plant-specific PRA for a construction permit (CP), operating license (OL),

or combined license (COL) application, respectively. This SRP section also pertains to the staff review of the applicants deterministic evaluation of design features for the prevention or mitigation of severe accidents.

Subsequent to COL issuance, the staff may review the applicant's PRA (or portions thereof) in the context of licensing actions, following the guidance provided in Regulatory Guide (RG) 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, (Ref. 20) and RG 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, (Ref. 21) and SRP Sections 19.1, Determining the Technical Adequacy of Probabilistic Risk Assessment for Risk-Informed License Amendment Requests after Initial Fuel Load, and Section 19.2, Review of Risk Information Used to Support Permanent Plant Specific Changes to the Licensing Basis: General Guidance, (previously SRP Chapter 19). Associated application-specific regulatory guidance and SRP sections should be consulted, while maintaining the validity of the staff findings associated with the licensing basis related to PRA and severe accidents.

The purpose of the staffs review is to ensure that the applicant has adequately addressed the Commissions objectives regarding the appropriate way to address consideration of severe accidents and the use of PRA in the design and operation of facilities under review. These objectives are outlined in RG 1.206, Combined License Applications for Nuclear Power Plants (LWR Edition),, Section C.I.19.2 and should be addressed in Section 19.1.1 of the applicants final safety analysis report (FSAR).

The scope of a DC review is limited to the design-specific aspects within the scope of the design certification. The design-specific PRA developed during the DC stage may not identify site-specific information (e.g., local hazards, switchyard and offsite grid configuration, and ultimate heat sink) and may not explicitly model all aspects of the design (e.g., balance of plant). A seismic PRA cannot be performed without a site-specific probabilistic seismic hazard analysis (PSHA) and as-built information. Consequently, a PRA-based seismic margin analysis (SMA) is acceptable.

This SRP provides guidance for reviewing PRA-based SMA submitted in support of a CP, OL, ML, DC or COL application. DC/COL-ISG-20 Interim Staff Guidance on Implementation of a Probabilistic Risk Assessment-Based Seismic Margin Analysis for New Reactors, dated October 16, 2009 (Ref. 14) discusses post-DC activities to update the PRA-based SMA throughout the licensing process of new reactors, including COL action items and post-licensing activities, to. These activities may be used ensure a coherent and consistent process for the quality of PRA-based SMA to adequately meet the requirements of Title 10 of the Code of Federal Regulations (10 CFR) 50.34(a)(14), 10 CFR 50.34(b)(13), 10 CFR 52.47(a)(27), 10 CFR 52.79(a)(46), 10 CFR 52.79(d)(1), 10 CFR 52.137(a)(25), 10 CFR 52.157(f) (31), and 10 CFR 50.71(h). The applicants design-specific PRA may include assumptions regarding site parameters and the interfaces with undeveloped aspects of the design. This is acceptable at the ML, standard design approval, or DC stage and results in the identification of PRA-based insights that include design, site, and operational assumptions. Although the staff has not published a format and content document specific to DC applications, RG 1.206, Section C.I.19, is intended to include all information needed for the staff to review a CP, OL, or COL application

19.0-3 Revision 3 - December 20154 - May 2022 that does not refer to a DC. Therefore, DC applicants are expected to provide the material in RG 1.206, Section C.I.19, except for those elements that require site-specific or plant-specific information not yet available.

As indicated above, format and content guidance for COL applications is provided in RG 1.206.

CP, OL, and COL applicants not referring to a DC should follow the guidance in RG 1.206, Section C.I.19. The staff will review the full scope of information requested by this guidance.

Where the DC included generic analysis of external events, the COL applicant may demonstrate that the relevant parameters of the generic analysis bound the corresponding site-specific parameters. Alternatively, the COLan applicant may show that a particular initiating event is too infrequent or inconsequential to affect core damage frequency (CDF) or large release frequency (LRF). Otherwise, the event must be included in the description of risk results and insights.

For a COL application that references a DC, the staff review of the PRA for the COL should focus on the plant-specific aspects of the PRA and site-specific design features that deviate from the referenced DC and the associated differences in risk results and insights. Similar limitation in the scope of the review applies to severe accident evaluations. This review corresponds to RG 1.206, Section C.III.19. In accordance with the Statement of Consideration (72 FR 49365), for the revised 10 CFR Part 52, License, Certifications, and Approvals for Nuclear Power Plants, the design-specific PRA is excluded from the Tier 1 or Tier 2 information that comprises the DC information. As a result, the description of the PRA and its results included in Chapter 19 of the DC FSAR is subject to the restrictions of 10 CFR 52.63(a)(1) concerning the finality of DCs.

An applicants OL, COL, or DC FSAR is expected to contain a qualitative description of PRA insights and uses, as well as some quantitative PRA results, such that the staff can perform the review, ensure risk insights were factored into the design, and make the evaluation findings described in this SRP section. To the degree practical, similar information is expected in a preliminary safety analysis report (PSAR) for a CP or an FSAR for a standard design approval (SDA). In accordance with the Statement of Consideration (72 FR 49387) for the revised 10 CFR Part 52, the U.S. Nuclear Regulatory Commission (NRC) expects that, generally, the information that it needs to perform its review of an application from a PRA perspective is that information contained in the applicants FSAR Chapter 19. of the safety analysis report. The staff should issue a request for additional information (RAI) and conduct audits of the complete PRA (e.g., models, analyses, data, and codes) to obtain clarifying information as needed. The staff will document any NRC audits performed in audit reports so that they may be referenced in the staffs safety evaluation report (SER). However, neither the RAIinformation request process nor onsite audits should be used to supplement an incomplete application.

Section IV.A.2.a in each existing design certification rule (DCR) requires COL applicants to provide a plant-specific design control document (DCD) containing the same type of information and using the same organization and numbering as the generic DCD. This applies to the description of the PRA and its results included in Chapter 19 of the FSAR, but does not apply to the PRA that supports a COL application (including, but not limited to, the event tree analyses, the fault tree analyses, the data analyses, the human reliability analyses, the PRA computer model). Furthermore,Section IV.A.2.a in each existing DCRdesign certification rule applies to the overall content and organization of information among the FSAR chapters, but does not apply to the content or organization of information within each FSAR chapter.

Specifically, Chapter 19 of each plant-specific FSAR must describe the PRA and severe accident evaluations; however, the format of information within Chapter 19 is left to the

19.0-4 Revision 3 - December 20154 - May 2022 discretion of each COL applicant. The staff should ensure that applicantseach applicants FSAR Chapter 19 contains the information needed to review the COL application, regardless of how the information is formatted or organized within FSAR Chapter 19. In the future revision of RG 1.206, Section C.III.1 will be revised in accordance with Section IV.A.2.a in each existing DCR.design certification rule.

The structural performance of the containment under severe accident loads reviewed by the staff encompasses: (1) the applicants assessment of the Level C (or factored load) pressure capability of the containment in accordance with 10 CFR 50.44(c)(5); (2) the applicants demonstration of the containment capability to withstand the pressure and temperature loads induced by the more likely severe accident scenarios as stipulated in SECY-93-087, Policy, Technical, and Licensing Issues Pertaining to Evolutionary and Advanced Light-Water Reactor Designs,Section I.J; (3) the applicants containment structural fragility assessment for overpressurization; and (4) the applicants assessment of the seismic capacity of the containment structure in meeting the expectation documented in SECY-93-087,Section II.N.

The staff also reviews the applicants assessment of the structural effects of postulated containment phenomenological challenges such as direct containment heating and ex-vessel explosions loads on the containment. The review and evaluation focus on the structural performance of the containment boundary as the ultimate barrier to radionuclide releases to the environment in a severe accident.

COL Action Items and Certification Requirements and Restrictions. For a DC application, the review will also address COL action items and requirements and restrictions (e.g., interface requirements and site parameters).

For a COL application referencing a DC, a COL applicant must address COL action items (referred to as COL license information in certain DCs) included in the referenced DC.

Additionally, a COL applicant must address requirements and restrictions (e.g., interface requirements and site parameters) included in the referenced DC.

Review Interfaces The organization responsible for structural engineering supports the review of the PRA and severe accident evaluation in two main areas: the applicants evaluation of seismic contributors (specifically the seismic hazard analysis and estimation of seismic capacities (acceleration at which there is high confidence in low probability of failure [HCLPF]) and the applicants analysis of containment performance. This organization provides written input to the SER. Acceptance criteria for these sections are outlined below.

The review of an applicants degree of compliance with requirements of 10 CFR 50.44, Combustible Gas Control for Nuclear Power Reactors, is conducted with guidance in SRP Section 6.2.5 and performed in coordination with the review of containment performance under severe accident conditions.

Other organizations that use the PRA and severe accident evaluation results and insights in their programs, processes, and reviews (e.g., human factors, emergency preparedness, security, inspection, technical specifications (TS), regulatory treatment of nonsafety systems (RTNSS), maintenance rule implementation, fire protection) may need to interface with the PRA staff in evaluating these areas. The PRA staff should be prepared to discuss the prioritization of structures, systems, and components (SSC) based on risk significance, as well as PRA-based insights related to the design. This information will help reviewers of other areas focus their

19.0-5 Revision 3 - December 20154 - May 2022 review on safety-significant issues. In addition, PRA staff reviews Tier 1 to ensure appropriate treatment of important insights and assumptions from the PRA as described in Section C.II.1 of RG 1.206, and SRP Section 14.3, Inspections, Tests, Analyses, and Acceptance Criteria.

The organizations that are responsible for the review of the design of the plant for external natural hazards (e.g., earthquakes, high winds, external fires, external flooding), hazards related to human activities (e.g., transportation and local industry) and in-plant area hazards (internal fire and flooding) may need to support the PRA staff in reviewing these hazards. The PRA staff may also request support from the organizations that review the systems and thermal-hydraulic (T-H) analyses to ensure that the applicants PRA properly considers and addresses important issues (e.g., failure mechanisms, system interactions, and T-H modeling and uncertainties).

The organizations responsible for the review of severe accident issues, including severe accident management alternatives, in Sections 7.2 and 7.3 of the Environmental Report (ER) need to maintain coordination with the PRA staff to assure consistency in the review of severe accident information given in the ER and the review of severe accident evaluations in Chapter 19 of the FSAR.

The NRC technical branch responsible for PRA reviews the acceptability of the applicants methodology for identifying risk-important human actions. The human factors engineering staff is responsible for ensuring that risk-important human actions included in HFEthe design process are the same as those identified in Chapter 19. The NRC reviewers should be aware that risk-important human actions may be distributed throughout multiple Chapter 19 tables, a practice that has caused delay in completing reviews.

The NRC technical branch responsible for the review of information in Chapter 19 of a DC or COLnew reactor application obtains support from reviewers responsible for the review of instrumentation and control (I&C) described in Chapter 7 of a DC or COL FSARanew reactor safety analysis report, as necessary, to confirm that:

1.

The analysis adequately accounts for the I&C systems relied upon;

2.

There is reasonable assurance that the I&C systems needed for mitigation of events beyond the design basis (including severe accidents) are designed to perform their intended function in the environment expected during the event, and over the time span for which they are needed;

3.

All common -cause failure (CCF) mechanisms for digital instrumentation and control (DI&C) systems have been accounted for in the PRA.

II.

ACCEPTANCE CRITERIA Requirements for DC Applicants

1.

10 CFR 51.55(a) states that each DC application must include a separate document entitled Applicants Environmental Report - Standard Design Certification, which must address the costs and benefits of the severe accident mitigation design alternatives (SAMDA), and the bases for not incorporating SAMDAs in the design to be certified.

2.

10 CFR 52.47(a)(1) states that each DC application must include the site parameters postulated for the design, and an analysis and evaluation of the design in terms of those site parameters.

19.0-6 Revision 3 - December 20154 - May 2022

3.

10 CFR 52.47(a)(2) states that it is expected that the standard plant will reflect through its design, construction, and operation an extremely low probability for accidents that could result in the release of radioactive fission products.

4.

10 CFR 52.47(a)(4) states that each DC application must contain an FSAR that includes an analysis and evaluation of the design and performance of SSCs with the objective of assessing the risk to public health and safety resulting from operation of the facility and including determination of the margins of safety during normal operations and transient conditions anticipated during the life of the facility, and the SSCs provided for the prevention of accidents and the mitigation of the consequences of accidents.

5.

10 CFR 52.47(a)(8) states that a DC application must contain an FSAR that provides the information necessary to demonstrate compliance with any technically relevant portions of the Three Mile Island requirements set forth in 10 CFR 50.34(f), except paragraphs 10 CFR 50.34(f)(1)(xii), 10 CFR 50.34(f)(2)(ix), and 10 CFR 50.34 (f)(3)(v).

6.

10 CFR 52.47(a)(23) states that a DC application for light-water reactor (LWR) designs must contain an FSAR that includes a description and analysis of design features for the prevention and mitigation of severe accidents, e.g., challenges to containment integrity caused by core-concrete interaction, steam explosion, high-pressure core melt ejection, hydrogen combustion, and containment bypass.

Note: The Statement of Consideration (72 FR 49380) for the 2007 revision of 10 CFR Part 52 states that postulated severe accidents are not design-basis accidents (DBA) and the severe accident design features do not have to meet the requirements for DBA (see SECY-93-087, Policy, Technical, and Licensing Issues Pertaining to Evolutionary and Advanced Light-Water Reactor Designs, dated April 2, 1993). However, the severe accident design features are part of a plants design-basis information.

7.

10 CFR 52.47(a)(27) states that a DC application must contain an FSAR that includes description of the design-specific PRA and its results.

Note:

The Statement of Consideration (72 FR 49365) for the 2007 revision of 10 CFR Part 52 states that the definition of Tier 2 in Section II.E.1 of the DCRsdesign certification rules has been modified to exclude the design-specific PRA and the evaluation of SAMDAs. The PRA and SAMDA evaluations do not need to be included in Tier 2 because they are not part of the design-basis information.

The Statement of Consideration (72 FR 49380) for the 2007 revision of 10 CFR Part 52 states the understanding that the complete PRA (e.g., codes) will be available for NRC inspection at the applicants offices, if needed. The NRC expects that, generally, the information that it needs to perform its review of the DC application from a PRA perspective is that information that will be contained in applicants FSAR Chapter 19.

Prior to the revision to 10 CFR Part 52 in August 2007, regulations required DC applicants to separately submit their PRAs. As a result, Chapter 19 of the

19.0-7 Revision 3 - December 20154 - May 2022 design-specific DCDs submitted before the issuance of this rule revision did not include many PRA quantitative results.

Part of the PRA required by 10 CFR 50.71(h)(1) no later than initial fuel load is the seismic PRA. Since this cannot be completed until the plant is built, Chapter 19 of the DCD must describe the assumed seismic hazard and results of a PRA-based SMA.

8.

10 CFR 52.47(b)(2) states that a DC application must contain an ER as required by 10 CFR 51.55.

Note: The Statement of Consideration (72 FR 49443) for the 2007 revision of 10 CFR Part 52 states that this assessment is distinct from, and in addition to, the requirement in paragraph 10 CFR 52.47(a)(23) to provide a description and analysis of severe accident design features.

Requirements for COL Applicants

1.

10 CFR 51.50(c) states that each COL application must include a separate document entitled Applicants Environmental Report - Combined License Stage. If the COL references a DC, then the COL ER may incorporate by reference the environmental assessment previously prepared by the NRC for the referenced DC. If the DC environmental assessment is referenced, then the COL ER must contain information to demonstrate that the site characteristics for the COL site fall within the site parameters in the DC environmental assessment.

2.

10 CFR 52.79(a)(1) states that each COL application must include the boundaries of the site; the proposed general location of each facility on the site; the seismic, meteorological, hydrologic, and geologic characteristics of the proposed site (with appropriate consideration of the most severe of the natural phenomena that have been historically reported for the site and surrounding area as well as sufficient margin to account for limited accuracy, quantity, and time in which the historical data have been accumulated). It must also include the location and description of any nearby industrial, military, or transportation facilities and routes. It must provide the existing and projected future population profile of the area surrounding the site. Finally, it must include a description and safety assessment of the site on which the facility is to be located.

3.

10 CFR 52.79(a)(2) states that it is expected that reactors will reflect through their design, construction, and operation an extremely low probability for accidents that could result in the release of radioactive fission products.

4.

10 CFR 52.79(a)(5) states that a COL application must contain an FSAR that includes an analysis and evaluation of the design and performance of SSCs with the objective of assessing the risk to public health and safety resulting from operation of the facility and including determination of the margins of safety during normal operations and transient conditions anticipated during the life of the facility, and the SSCs provided for the prevention of accidents and the mitigation of the consequences of accidents.

5.

10 CFR 52.79(a)(17) states that a COL application for a LWR design must contain an FSAR that provides the information with respect to compliance with a technically relevant positions of the Three Mile Island (TMI) requirements in 10 CFR 50.34(f), with

19.0-8 Revision 3 - December 20154 - May 2022 the exception of 10 CFR 50.34(f)(1)(xii), 10 CFR 50.34(f)(2)(ix), 10 CFR 50.34(f)(2)(xxv) and 10 CFR 50.34(f)(3)(v).

6.

10 CFR 52.79(a)(18) states that a COL application must contain the information required by 10 CFR 50.69(b)(2), if the applicant seeks to use risk-informed treatment of SSCs in accordance with 10 CFR 50.69.

7.

10 CFR 52.79(a)(38) states that a COL application for a LWR design must contain an FSAR that includes a description and analysis of design features for the prevention and mitigation of severe accidents, for example, challenges to containment integrity caused by core-concrete interaction, steam explosion, high-pressure core melt ejection, hydrogen combustion, and containment bypass.

8.

10 CFR 52.79(a)(46) states that a COL application must contain an FSAR that includes a description of the plant-specific PRA and its results.

Note:

The Statement of Consideration (72 FR 49387) for the 2007 revision of 10 CFR Part 52 states the understanding that the complete PRA (e.g., codes) would be available for NRC inspection at the applicants offices, if needed. The NRC expects that, generally, the information that it needs to perform its review of the COL application from a PRA perspective is that information that will be contained in applicants FSAR Chapter 19.

RG 1.206 provides guidance on reporting PRA-related information. As discussed in the Statement of Consideration (72 FR 49387) for the 2007 revision of 10 CFR Part 52 the guidance focuses on qualitative description of insights and uses, but also acknowledges that some quantitative PRA results should be submitted.

In accordance with the requirements in 10 CFR 52.79(d)(1), COL applicants must provide the basis for determining that the SMA of the DCD is applicable to the proposed plant or perform a plant-specific SMA. In any case, a plant-specific supplement must identify any SSCs outside the scope of the DCD that are relied upon for safe shutdown after an earthquake.

9.

10 CFR 52.79(c)(1), 10 CFR 52.79 (d)(1), and 10 CFR 52.79 (e)(1) state that if a COL application references a standard design approval, standard DC, or the use of one or more manufactured nuclear power reactors licensed under Subpart F of 10 CFR Part 52, then the plant-specific PRA information must use the PRA information for the design approval, DC, or manufactured reactor, respectively, and must be updated to account for site-specific design information and any design changes or departures.

Note: The Statement of Consideration (72 FR 49388) for the 2007 revision of 10 CFR Part 52 states in the case where a COL application is referencing a DC, the NRC only expects the design changes and differences in the modeling (or its uses) pertinent to the PRA information to be addressed to meet the submittal requirement of 10 CFR 52.79(d)(1).

10.

Section IV.A.2.a of each DCRdesign certification rule states that a COL application which references a DC must include a plant-specific FSAR containing the same type of

19.0-9 Revision 3 - December 20154 - May 2022 information and using the same organization and numbering as the generic DCD for the certified design, as modified and supplemented by the applicants exemptions and departures.

Requirements for Manufacturing License Applicants

1. 10 CFR 51.54(a) states that each ML application must include a separate document entitled Applicants Environmental ReportManufacturing License, which must address the costs and benefits of the SAMDA and the bases for not incorporating SAMDAs in the design to be manufactured.

2. 10 CFR 52.157(c) states that each ML application must contain an FSAR that includes an analysis and evaluation of the design and performance of SSCs with the objective of assessing the risk to public health and safety resulting from operation of the facility. The FSAR must also include a determination of the margins of safety during normal operations and transient conditions anticipated during the life of the facility, and the SSCs provided for the prevention of accidents and the mitigation of the consequences of accidents.

3. 10 CFR 52.157(f)(12) states that eachML application must contain an FSAR that provides the information necessary to demonstrate compliance with any technically relevant portions of the Three Mile Island requirements set forth in 10 CFR 50.34(f), except 10 CFR 50.34(f)(1)(xii), 10 CFR 50.34(f)(2)(ix), and 10 CFR 50.34 (f)(3)(v).

4. 10 CFR 52.157(f)(23) states that eachML application for LWR designs must contain an FSAR that includes a description and analysis of design features for the prevention and mitigation of severe accidents, such as challenges to containment integrity caused by core-concrete interaction, steam explosion, high-pressure core melt ejection, hydrogen combustion, and containment bypass.

Note: The Statement of Consideration (72 FR 49380) for the 2007 revision of 10 CFR Part 52 states that postulated severe accidents are not DBAs and the severe accident design features do not have to meet the requirements for DBAs (see SECY-93-087, Policy, Technical, and Licensing Issues Pertaining to Evolutionary and Advanced Light-Water Reactor (ALWR) Designs, dated April 2, 1993). However, the severe accident design features are part of a plants design-basis information.

5. 10 CFR 52.157(f)(31) states that each ML application must contain an FSAR that describes the design-specific PRA and its results.

Note:

The Statement of Consideration (72 FR 49365) for the 2007 revision of 10 CFR Part 52 states that the NRC has modified the definition of Tier 2 in Section II.E.1 of the design certification rules to exclude the design-specific PRA and the evaluation of SAMDAs. Tier 2 does not need to include the PRA and SAMDA evaluations because they are not part of the design-basis information.

The Statement of Consideration (72 FR 49380) for the 2007 revision of 10 CFR Part 52 states the understanding that the complete PRA (e.g., codes) will be available for NRC inspection at the applicants offices, if needed. The NRC

19.0-10 Revision 3 - December 20154 - May 2022 expects that, generally, the information that it needs to perform its review of the DC application from a PRA perspective is the information that will be contained in applicants FSAR Chapter 19.

Prior to the revision to 10 CFR Part 52 in August 2007, regulations required DC applicants to submit their PRAs separately. As a result, Chapter 19 of the design-specific DCDs submitted before the issuance of this rule revision did not include many PRA quantitative results.

Part of the PRA required by 10 CFR 50.71(h)(1) no later than initial fuel load is the seismic PRA. Since this cannot be completed until the plant is built, Chapter 19 of the DCD must describe the assumed seismic hazard and results of a PRA-based SMA.

6. 10 CFR 52.47(b)(2) states that each ML application must contain an ER as required by 10 CFR 51.55.

Note: The Statement of Consideration (72 FR 49443) for the 2007 revision of 10 CFR Part 52 states that this assessment is distinct from, and in addition to, the requirement in 10 CFR 52.47(a)(23) to provide a description and analysis of severe accident design features.

Requirements for Construction Permit Applicants

1.

10 CFR 51.50(c) states that each CP application must include a separate document entitled Applicants Environmental ReportConstruction Permit Stage, which shall contain the information specified in 10 CFR 51.45, 10 CFR 51.51, and 10 CFR 51.52.

2.

10 CFR 50.34(a) states that each CP application must include a PSAR and specifies the minimum information required.

3.

10 CFR 50.34(a)(1)(i) states that the PSAR must include a description and safety assessment of the site on which the facility is to be located, with appropriate attention to features affecting facility design. The assessment must contain an analysis and evaluation of the major SSCs of the facility that bear significantly on the acceptability of the site.

4.

10 CFR 50.34(a)(1)(ii) states that the PSAR must include a description and safety assessment of the site and a safety assessment of the facility. The NRC expects that reactors will reflect through their design, construction and operation an extremely low probability for accidents that could result in the release of significant quantities of radioactive fission products.

5.

10 CFR 50.34(a)(3)(i) states that the PSAR must contain the preliminary design of the facility including the principal design criteria for the facility

6.

10 CFR 50.34(a)(3)(ii) states that the PSAR must contain the design bases and their relation to the principal design criteria.

7.

10 CFR 50.34(a)(3)(iii) states that the PSAR must contain information relative to the materials of construction, general arrangement, and approximate dimensions, sufficient to provide reasonable assurance that the final design will conform to the design bases with adequate margin for safety.

19.0-11 Revision 3 - December 20154 - May 2022

8.

10 CFR 50.34(a)(4) states that the PSAR must contain a preliminary analysis and evaluation of the design and performance of SSCs of the facility with the objective of assessing the risk to public health and safety resulting from operation of the facility. The PSAR must include a determination of the margins of safety during normal operations and transient conditions anticipated during the life of the facility, and the adequacy of SSCs provided for the prevention of accidents and the mitigation of the consequences of accidents.

9.

10 CFR 50.34(a)(15) states that the PSAR must include a description and analysis of design features for the prevention and mitigation of severe accidents.

10.

10 CFR 50.34(a)(14) states that the PSAR must describe the plant-specific PRA and its results.

Requirements for Operating License Applicants

1.

10 CFR 50.34(b) states that each OL application shall include an FSAR that describes the facility, presents the design bases and the limits on its operation, and gives a safety analysis of the SSCs and of the facility as a whole.

2.

10 CFR 50.34(b)(4) states that the FSAR must include a final analysis and evaluation of the design and performance of SSCs with the objective of assessing the risk to public health and safety resulting from facility operation and taking into account any pertinent information developed since the submittal of the PSAR.

3.

10 CFR 50.34(b)(14) states that the PSAR must include a description and analysis of design features for the prevention and mitigation of severe accidents.

4.

10 CFR 50.34(b)(13) states that the PSAR must describe the plant-specific PRA and its results.

SRP Acceptance Criteria

Background

Specific SRP acceptance criteria to meet the relevant requirements of the NRC regulations identified above are as follows for the review described in this SRP section. The SRP is not a substitute for the NRC regulations, and compliance with it is not required. However, an applicant is required to identify differences between the design features, analytical techniques, and procedural measures proposed for its facility and those corresponding features, techniques, and measures in the SRP acceptance criteria, and evaluate how the proposed alternatives to the SRP acceptance criteria provide acceptable methods of compliance with the NRC regulations that underlie the acceptance criteria.

The SRP acceptance criteria are derived from Commission direction and staff guidance published in multiple documents, including the following:

1.

Policy Statement, Severe Reactor Accidents Regarding Future Designs and Existing Plants, 50 FR 32138, August 8, 1985.

2.

Policy Statement, Safety Goals for the Operations of Nuclear Power Plants, 51 FR 28044, August 4, 1986.

19.0-12 Revision 3 - December 20154 - May 2022

3.

Policy Statement, Nuclear Power Plant Standardization, 52 FR 34884, September 15, 1987.

4.

Policy Statement, Regulation of Advanced Nuclear Power Plants, 59 FR 35461, July 12, 1994.

5.

Policy Statement, The Use of Probabilistic Risk Assessment Methods in Nuclear Regulatory Activities, 60 FR 42622, August 16, 1995.

6.

SECY-90-016, Evolutionary Light-Water Reactor (LWR) Certification Issues and their Relationship to Current Regulatory Requirements, Agencywide Documents Access and Management System (ADAMS) Accession No. ML003707849, dated January 12, 1990, and the related staff requirements memorandum (SRM), ADAMS Accession No. ML003707885, dated June 26, 1990.

7.

SECY-93-087, Policy, Technical, and Licensing Issues Pertaining to Evolutionary and Advanced Light-Water Reactor Designs, ADAMS Accession No. ML003708021, dated April 2, 1993, and the related SRM, ADAMS Accession No. ML003708056, dated July 21, 1993.

8.

SECY-93-087 and the Commissions SRM provide guidance for meeting the deterministic containment performance goal (CPG) in the evaluation of the passive Advanced Light Water Reactors (ALWRs)advanced light-water reactors as a complement to the conditional containment failure probability (CCFP) approach. SECY-93-087 indicates the following with respect to the deterministic containment performance assessment:

The containment should maintain its role as a reliable, leaktightleak-tight barrier (e.g., by ensuring that containment stresses do not exceed American Society of Mechanical Engineers (ASME) Service Level service level C limits for metal containment or factored load category for concrete containments) for approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following the onset of core damage under the most likely severe accident challenges, and that following this 24-hour period, the containment should continue to provide a barrier against the uncontrolled release of fission products.

9.

SECY-93-087,Section II.N, and the Commissions SRM also provide guidance for a sequence-level seismic margins analysis (SMA).SMA. PRA insights will be used to support a margin-type assessment of seismic events. A PRA-based SMA will consider sequence-level HCLPFs and fragilities for all sequences leading to core damage or containment failure up to approximately 1.67 times the ground motion acceleration of the design-basis safe-shutdown earthquake (SSE).

10.

SECY-96-128, Policy and Key Technical Issues Pertaining to the Westinghouse AP600 Standardized Passive Reactor Design, ADAMS Accession No. ML003708224, dated June 12, 1996, and the related SRM, ADAMS Accession No. ML003708192, dated January 15, 1997.

11.

RG. 1.7, Control of Combustible Gas Concentrations in Containment, Revision 3, March 2007.

19.0-13 Revision 3 - December 20154 - May 2022

12.

RG 1.216, Containment Structural Integrity Evaluation for Internal Pressure Loadings above Design-Basis Pressure, Revision 0, August 2010.

13.

SECY-97-044, Policy and Key Technical Issues Pertaining to the Westinghouse AP600 Standardized Passive Reactor Design, ADAMS Accession No. ML003708316, dated February 18, 1997, and the related SRM, ADAMS Accession No. ML003708232, dated June 30, 1997.

The above NRC policy statements provide guidance regarding the appropriate course of action to address severe accidents and the use of PRA. The SRMs relating to SECY-90-016, SECY-93-087, SECY-96-128, and SECY-97-044 provide Commission-approved guidance for implementing features in new designs to prevent severe accidents and to mitigate their effects, should they occur. In particular, the SRM on SECY-93-087 provides direction about the treatment of external events in PRAs to support DC and COL applications. Specifically:

1.

The Commission approved the use of 1.67 times the design-basis SSE for a margin-type assessment of seismic events.

2.

The Commission approved the use of PRA insights to support a margins-type assessment of seismic events. A PRA-based SMA will consider sequence-level HCLPF and fragilities for all sequences leading to core damage or containment failures up to approximately one and two thirds the ground motion acceleration of the Design-Basisdesign-basis SSE.

3.

The Commission approved the use of simplified probabilistic methods, such as but not limited to the Electric Power Research Institute (EPRI) Fire-Induced Vulnerability Evaluation (FIVE) methodology, to evaluate fire risk.

4.

The Commission approved the staffs position that advanced LWR vendors should perform bounding analyses of site-specific external events likely to be a challenge to the plant (such as river flooding, storm surge, tsunami, volcanism, high winds, and hurricanes). When a site is chosen, its characteristics should be compared to those assumed in the bounding analyses to ensure that the site is enveloped. If the site is enveloped, the COL applicant need not perform further PRA evaluations for these external events. The COL applicant should perform site-specific PRA evaluations to address any site-specific hazards for which a bounding analysis was not performed or which are not enveloped by the bounding analyses to ensure that no vulnerabilities due to siting exist.

In addition, Regulatory Issue Summary (RIS) 07-06, Regulatory Guide 1.200 Implementation, dated March 22, 2007, states that PRAs required under 10 CFR Part 52 should use NRC-endorsed consensus standards to the extent practicable.

Acceptance Criteria Based on these guidance documents and the major objectives stated in Subsection I, the staff has established the following acceptance criteria for its review. These acceptance criteria apply to the PRA and severe accident evaluation in general. Specific subsets of the criteria apply to individual elements of the applicants analyses (e.g., Level 1 shutdown PRA, severe accident management).

19.0-14 Revision 3 - December 20154 - May 2022

1.

The staff will determine whether the applicant has used the PRA to do the following:

A.

Identify and address potential design features and plant operational vulnerabilities; for example, vulnerabilities in which a small number of failures could lead to core damage, containment failure, or large releases that could drive plant risk to unacceptable levels with respect to the Commissions goals.

B.

Reduce or eliminate the significant risk contributors of existing operating plants0F1 applicable to the new design, by introducing appropriate features and requirements.

C.

Select among alternative features, operational strategies, and design options.

2.

The staff will determine whether the applicant has adequately demonstrated that the risk associated with the design compares favorably against the Commissions goals of less than 1 x x 10-4 per year (//yr) for CDF and less than 1 x x 10-6/yr for LRF.

3.

The staff will determine whether the design compares favorably with the Commissions approved use of a CPGcontainment performance goal, which includes (1) a deterministic goal that containment integrity be maintained for approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following the onset of core damage for the more likely severe accident challenges and (2) a probabilistic goal that the conditional containment failure probability be less than 0.1 for the composite of all core-damage sequences assessed in the PRA. The staff will determine whether the applicant has adequately demonstrated that the design properly balances preventive and mitigative features and represents a reduction in risk when compared to existing operating plants. The staff will determine whether the applicant has provided a sound technical basis for selecting the most likely severe accident challenges or followed the approach outlined in Section C.3.1(a) of RG 1.216.1F2

4.

The staff will determine whether the applicant has identified risk-informed safety insights based on systematic evaluations of the risk associated with the design. The applicant should identify and describe the following:

A.

The designs robustness, levels of defense-in-depth, and tolerance of severe accidents initiated by either internal or external events B.

The risk significance of potential human errors associated with the design

5.

The staff will determine whether the applicant has complied with 10 CFR 50.34(f)(1)(i):

Perform a plant/site specific probabilistic risk assessment, the aim of which is to seek such improvements in the reliability of core and containment heat removal systems as are significant and practical and do not impact excessively on the plant.

6.

The staff will determine whether the applicant has used the PRA results and insights, including those from uncertainty analyses, importance analyses, and sensitivity 1 The reference to existing operating plants applies to the LWR plant technology that existed at the time the Commission issued its Severe Accident Policy Statement on August 8, 1985.

2 RG 1.216, Containment Structural Integrity Evaluation for Internal Pressure Loadings above Design-Basis Pressure, states that:

The applicant provides the technical basis for identifying the more likely severe accident challenges. The staff will review the technical basis for identifying the more likely severe accident challenges on a case-by-case basis. An example of an acceptable way to identify the more likely severe accident challenges is to consider the sequences or plant damage states that, when ordered by percentage contribution, represent 90 percent or more of the core damage frequency.

19.0-15 Revision 3 - December 20154 - May 2022 studies, in an integrated fashion. Expected uses of the PRA are listed in RG 1.206, Section C.I.19.2, and should be addressed in Section 19.1.1 of the applicants FSAR, as well as in the descriptions of programs that receive input from the PRA. The guidance documents related to the specific programs that receive input from the PRA contain acceptance criteria related to these programs. For example, Section C.I.17.4 of RG 1.206 presents the reliability assurance program (RAP) submittal guidance and SRP Section 17.4 gives the associated staff review guidance, including acceptance criteria.

7.

The staff will determine whether the applicant has performed risk importance studies to determine the: (1) importance of components to risk; (2) importance of systems to risk; (3) importance of operator actions to risk; and (4) importance of initiating events to risk.

Both risk increase (e.g., risk-achievement worth; Birnbaum importance) and risk-decrease (e.g., Fussell-Vesely importance; risk-reduction worth) measures should be used.

8.

The staff will determine whether the applicants uncertainty analysis identifies major contributors to the uncertainty associated with the estimated risks. For designs using passive safety systems and active defense-in-depth systems, the staff will determine whether the applicant has performed sensitivity studies without credit for the nonsafety-related defense-in-depth systems. These studies provide additional insights about the risk importance of the defense-in-depth systems that are taken into account in selecting nonsafety-related systems for regulatory treatment according to the RTNSS process (See SRP Section 19.3 for additional information).

9.

Consistent with the guidance in Section 5 of RG 1.174, the staff expects that the applicant will have subjected its PRA to quality control. In accordance with the Statement of Consideration (72 FR 49365) for the revised 10 CFR Part 52, the PRA is not part of the design-basis information, therefore, the PRA is not subject to the quality assurance requirements of 10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities, Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants. However, the applicant should describe the quality control program that was applied to the PRA. The reviewer should verify that this quality control program includes, as a minimum, the following elements:

A.

Use of personnel qualified for the analysis B.

Use of procedures that ensure control of documentation, including revisions, and provide for independent review, verification, or checking of calculations and information used in the analyses C.

Documentation and maintenance of records, including archival documentation as well as submittal documentation D.

Use of procedures that ensure that appropriate attention and corrective actions are taken if assumptions, analyses, or information used previously are changed or determined to be in error

10.

The staff will determine whether the technical adequacy of the PRA is sufficient to justify the specific results and risk insights that are used to support the DC or COLnew reactor application. Toward this end, the applicants PRA submittal should be consistent with prevailing PRA standards, guidance, and good practices as needed to support its uses

19.0-16 Revision 3 - December 20154 - May 2022 and applications and as endorsed by the NRC (e.g., RG 1.200). As discussed in RGs 1.174 and 1.200, the quality of a PRA is measured in terms of its appropriateness with respect to scope, level of detail, and technical adequacy. Technical adequacy should be assessed via a peer review as described in RG 1.200.2F3 The applicants adherence to the recommendations provided in RGs 1.174 and 1.200 pertaining to quality and technical adequacy will result in a more efficient and consistent NRC staff review process. With respect to PRA quality, the following items are noted:

A.

There are no regulatory requirements in 10 CFR Part 52 that specifically pertain to PRA quality with respect to DC or COL applications.

B.

RG 1.206 and this SRP section indicate the expected scope and level of detail of a PRA used to support a DC or COL application. Exceptions to this expected scope and level of detail may be acceptable if adequately justified by the applicant.

11.

PRAs that meet the applicable supporting standards for Capability Category I and meet the high-level requirements defined in the ASME PRA Standard (ASME/ANS RA--S-2008-2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, and the addenda in ASME/ANS RA--Sa-20092009) should generally be acceptable for DC and COL applications.

Alternatively, the applicant may identify, and justify the acceptability of, alternative measures for addressing PRA quality and technical adequacy. The staff should specifically review the acceptability of these alternative measures in the context of the specific uses of the PRA in the licensing process.

12.

In making its determination of technical adequacy of the PRA, the staff will consider the information provided by applicants in FSAR Chapter 19 and responses to the staff's RAIs or obtained by the staff during onsite audits. In addressing the technical adequacy of the PRA, the applicant should discuss:

A.

Prior NRC staff review of the PRA (e.g., during the DC process), findings (i.e., facts and observations) from that review, disposition of those findings, and the relevance of that review to the technical adequacy of the current plant-specific PRA.

B.

The scope, level of detail, and technical adequacy needed to support the specific uses and risk-informed applications.

C.

The method used for determination of technical adequacy for pertinent PRA scope areas for which the NRC has not endorsed PRA standards (i.e., identify 3 Peer review of the DC PRA is not required prior to application. However, if a peer review was conducted prior to the application; the staff should examine the peer review report. If a certain aspect of the PRA deviates from accepted good practices, the applicant/holder should justify that this deficiency does not impact the PRA results or risk insights. Otherwise, applicants/holders need to correct the deficiency and resubmit the PRA results and risk insights. If a peer review has not been performed, the applicants/holders should justify why their PRAs are adequate in terms of scope, level of detail, and technical acceptability. PRA self-assessment is an acceptable tool for assessing the technical adequacy of a PRA performed in support of an application for a design certification. If the applicants/holders justification fails to provide the staff with an appropriate level of confidence in the models, results, and insights, the staff should conduct an audit of the applicants/holders PRA against the technical elements described in RG 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, to determine the PRA technical adequacy.

19.0-17 Revision 3 - December 20154 - May 2022 the guidance and good practices documents relied upon to determine the technical adequacy of the PRA).

D.

The independent peer review process, including the qualifications of the team members and the findings identified as a result of the review.

E.

The process for dispositioning independent peer review findings and maintaining or upgrading the PRA, as appropriate, to ensure that it reasonably reflects the as-designed, as-built, and as-operated plant, including the corrective action and feedback mechanisms involving the periodic evaluation of the PRA, consistent with its uses and risk-informed applications, on the basis of actual plant-specific equipment, train, and system performance and relevant industry operational experience.

13.

The staff will determine whether the assumptions made in the applicants PRA during design development and certification, in which a specific site may not have been identified or all aspects of the design (e.g., balance of plant) may not have been fully developed, are identified in the DC application and either remain valid or are adequately addressed within the COL application.

14.

The staff will determine whether FSAR Chapter 19 includes PRA quantitative and qualitative results, including CDF, LRF, the identification of key PRA assumptions, the identification of PRA-based insights, and discussion of the results and insights from importance, sensitivity, and uncertainty analyses.

15.

The staff will determine whether the internal events PRA quantitative results are provided for internal fires and floods and their contributions.

16.

It is acceptable for applicants to report significant risk contributors by separate hazard groups (i.e., provide separate lists of the contributors for internal events, the contributors for internal floods, the contributors for seismic events, the contributors for internal fires, etc.). Applicants may also elect to develop an integrated list of significant risk contributors that summarize the results across all hazard groups.

17.

In the context of the PRA results and insights, the term significant is intended to be consistent with its definition in RG 1.200. The definitions of significant accident sequence and significant contributor are suitable for both LERF and LRF. Using any other definition of significant inconsistent with the definitions provided by RG 1.200 shall be subject to additional staff review and approval.

18.

The NRC staff should review the applicants PRA maintenance process, which should be described in FSAR Chapter 19, including planned implementation of the program during design, construction and operation phases of the facility. The NRC expects COL applicants to describe their approach for maintaining and periodically upgrading the PRA in accordance with RG 1.206, Section C.I.19.7 and RG 1.200. PRA maintenance should commence at the time of application for both DC and COL applicants. If the certification is issued, the generic PRA would not need to be updated except as appropriate in connection with a DC amendment request. The NRC staff should confirm that the PRA maintenance process provides that the PRA performed in support of a COL application be updated to reflect plant modifications if there are changes to the design during the design, construction and operation phases of the facility. For purposes of reporting the

19.0-18 Revision 3 - December 20154 - May 2022 effects of plant modifications and changes to the NRC in accordance with the requirements of 10 CFR 50.71(e), the NRC expects the following when changes affect the PRA:

A.

PRA numerical changes should be reported when the cumulative risk impact of the changes resulting from the plant modifications, design changes or departures from the DC is more than a 10% change (either positive or negative) in the total CDF or total LRF from what was previously reported.

B.

All changes in key assumptions per RG 1.200 and all changes in risk insights as defined in RG 1.206 including differences between the updated risk insights and the certified design risk insights should also be reported to the NRC in accordance with the guidance in Section C.III of RG 1.206.

C.

All changes or departures from the design that result in a revision of PRA-based qualitative results should also be reported to the NRC.

19.

10 CFR 50.71(h)(2) states that each COL holder must licensee required to maintain and upgrade thea PRA required by 10 CFR 50.71(h)(1). This means that COL holders, in accordance with 10 CFR 50.71(h),) must continue to do so until the cessation of operations. The applicant must upgrade the PRA used to support the COLlicense to cover those initiating events and modes of operation contained in NRC-endorsed consensus standards that exist one year prior to each required upgrade..

20.

RG 1.200 describes the elements of a PRA maintenance and update program that is acceptable to the staff. If the staff can confirm that the applicants proposed program includes the key elements described in RG 1.200, it may conclude that such a program is acceptable.

21.

The PRA Standard in Part 7, Requirements for High Wind Events At-Power PRA, does not specify Supporting Requirements for Capability Category 1 for developing the wind hazard. In the analysis of high winds, tornado frequencies developed with methods and data in NUREG/CR-4461, Revision 1, and based on data for the central region of the United States will normally be acceptable because the central region of the country has the highest occurrence rate of tornadoes and the highest tornado intensities.

22.

In the analysis of high winds, tornados may not always be bounding with respect to the damaging effects of missiles. In coastal regions prone to severe hurricanes, a missile generated by hurricane force winds may be more damaging than one created by a tornado. Interim Staff Guidance DC/COL-ISG-024 pertaining to RG 1.221 provides an acceptable approach for treatment of hurricane missiles in the PRA.

23.

Section 5 of RG 1.7 provides criteria acceptable to the NRC staff for demonstrating the requirements in 10 CFR 50.44(c)(5) regarding containment structural integrity have been met.

24.

The RG 1.216 describes methods that the NRC staff considers acceptable for (1) predicting the internal pressure capacity for containment structures above the design-basis accident pressure, (2) demonstrating containment structural integrity related to combustible gas control, and (3) demonstrating containment structural integrity through

19.0-19 Revision 3 - December 20154 - May 2022 an analysis that specifically addresses the Commissions performance goals related to the prevention and mitigation of severe accidents.

Acceptance Criteria for a PRA-based SMA This section provides guidance for the NRC reviewer of an applicants PRA-based SMA.

However, if an applicant performs a seismic PRA (SPRA),, then the staff should confirm that a peer review to Part 5 of the ASME/ANS PRA Standard has been performed and that the SPRAseismic PRA meets Capability Category 1 of that Standard.

25.

The staff will determine whether the applicant has performed a PRA-based SMA to determine the seismic capacity of the plant and for each sequence that may lead to core damage or large release.

26.

The design-specific plant system and accident sequence analysis for a PRA-based SMA is performed in accordance with, at a minimum, the Capability Category I requirements of Section 5-2.3 of Part 5 of the ASME/ANS PRA Standard (Ref. 6), with the exceptions that the analysis does not need to be based on site-specific and plant-specific information and does not have to rely on an as-built and as-operated plant.

27.

Screening of rugged SSCs may be performed in a PRA-based SMA based on the DCs Certified Seismic Design Response Spectracertified seismic design response spectra (CSDRS) with its peak ground acceleration (PGA) scaled by a factor of 1.67. The basis for the screening should be adequately documented and ensure that the so-called supercomponents, as described in Note 3 of Section 5-2.3 of Part 5 of the ASME/ANS PRA standardStandard, will not control the plant seismic margin capacity.

28.

The staff will determine whether a safe-shutdown equipment list (SSEL) (for the seismic hazard approach) or a seismic equipment list (SEL) (for the seismic PRA approach) has been prepared which documents the SSCs associated with the accident sequences that will require seismic fragility evaluation for determining sequence-level HCLPF.

29.

The seismic fragility evaluation of SSCs may be performed based on Capability Category I requirements of Section 5-2.2 of Part 5 of the ASME/ANS PRA standardStandard to the extent applicable as endorsed by RG 1.200. Such an evaluation is acceptable with the following exceptions for implementing Part 5 for DCs:

A.

For review of DC applications, the seismic fragility calculations are based on design-specific information provided within the scope of a DC application. Site-and plant-specific information cannot be relied on for computing seismic fragility because this information is normally not available during the review of the DC application. Two methods, separation of variable and conservative deterministic failure margin (Ref. 11 and 13), are acceptable for determining seismic fragility.

B.

The seismic fragility calculation should use the response spectrum shape defined as the DCs CSDRS.

30.

Generic data (such as test data, generic seismic qualification test data, and test experience data) can be used to support the seismic fragility analysis of components or equipment; however, justification should be provided to demonstrate that the generic

19.0-20 Revision 3 - December 20154 - May 2022 data are consistent and applicable to components or equipment within the scope of the DC.

31.

The procedure described in E.5 of the EPRI TR Report 1002988 (Ref. 8) is acceptable for developing fragilities for components or equipment on the SEL, which is to be qualified by seismic qualification tests. If an applicant uses EPRI Report 1002988 to develop fragilities, there should be less than a 1 percent probability of failure at ground motion equal to 1.67 times the CSDRS, including consideration of testing uncertainties.

32.

The seismic demands to equipment defined in terms of the required response spectra should use CSDRS-based (or hard rock high frequency, if applicable) seismic input and account for the structural amplifications caused by the supporting structures, including soil-structure interaction effects and supporting systems, and incorporate an additional seismic margin factor, as appropriate.

33.

The HCLPF value for an SSC is earthquake motion level at which there is a high (95%)

confidence of a low (at most 5%) probability of failure. The composite uncertainty (Beta c) may be used to approximate the HCLPF, which would be the ground motion level at which the composite probability of failure is at most 1%.

34.

The HCLPF value should be expressed in terms of PGA in the PRA-based SMA process.

35.

The plant-level HCLPF capacity should be determined based on the sequence-level HCLPF values for all sequences as identified in the design-specific plant system and accident sequence analysis.

36.

The Min-Max method3F4 is acceptable for computing sequence-level HCLPF values.

37.

The staff will determine whether the design-specific plant-level HCLPF value has been demonstrated to be equal to or greater than 1.67 times the CSDRS PGA.

III.

REVIEW PROCEDURES General Principles The reviewer will select material from the procedures described below, as may be appropriate for a particular case. These review procedures are based on the identified SRP acceptance criteria. If the application deviates from these acceptance criteria, the staff should determine that the proposed alternative provides an acceptable method of complying with the relevant NRC requirements identified in Subsection II.

The staff will review the description of the PRA and its results in order to make the evaluation findings described in this SRP section. In addition to a qualitative description, the staff will review some quantitative results (e.g., mean core damage frequencies, mean large release 4 A Min-Max method is used to determine the HCLPF capacity for an accident sequence from the HCLPF capacities of the contributing SSC failures, or the HCLPF capacity for the plant as a whole from the HCLPF capacities of the group of seismic-initiated accident sequences. The overall HCLPF capacity of two or more SSCs that contribute to a sequence using OR Boolean logic is equal to the lowest individual HCLPF capacity of the constituents of the group. If AND Boolean logic is used, the HCLPF capacity of the group is equal to the highest individual HCLPF capacity of the constituents. When evaluating several accident sequences to determine the plant level HCLPF capacity, the plant-level HCLPF capacity is equal to the lowest of the sequence-level HCLPF capacities.

19.0-21 Revision 3 - December 20154 - May 2022 frequencies, and importance measures). The NRC should review this information to ensure that it is able to conclude that the applicant has performed sufficiently complete and scrutable analyses, the results and insights support the application, and the applicant has in place programs and processes that will enable it to maintain an up-to-date PRA for these uses and applications.

RG 1.206, Section C.I.19, provides detailed guidance on the information expected to be included in Chapter 19 of the applicants FSAR. Specific application content that the staff should review is not reproduced in this SRP section, only review guidance on specific topics.

Instead, the staff should use RG 1.206 in parallel with the SRP to determine that the appropriate topics have been addressed by the applicant. Although Chapter 19 of the applicants FSAR should include the information needed by the staff to determine that the relevant acceptance criteria have been met, some staff audits of the PRA and supporting analyses may be necessary to fully understand, review, and confirm the PRA results, insights, and associated analytical bases. The staff may refer to the summary reports from these audits in the SER.

However, for instances in which additional information is needed to complete the staffs review of the FSAR, the staff will use the RAI process. Reviewers utilizing the RAI process should make it clear to the applicant that if an RAI results in substantive change to information in the FSAR or DCD, these documents must be revised to reflect the new information.

For additional information, the staff should consider the information provided in Chapter 19 of past SERs for advanced LWRs. The NRC issued the Final Safety Evaluation Report (FSER) for the DC of the Advanced Boiling-Water Reactor design (ABWR) as NUREG-1503, the FSER for the DC of the System 80+ reactor design as NUREG-1462, the FSER for the DC of the AP600 design as NUREG-1512, and the FSER for the DC of the AP1000 design as NUREG-1793.

The staff issued the FSER for the DC of the Economic, Simplified, Boiling-Water Reactor (ESBWR) design by letter dated March 9, 2011. It is available at ADAMS Accession No. ML103470210. In addition, although it relates to the staff review of license applications requesting risk-informed changes to an applicants licensing bases, Section A.11 of SRP Section 19.2 lists documents that the staff could use as reference or background material during the review process. The bibliography lists documents by category, covering desirable PRA attributes, review of the PRA, uncertainty and sensitivity analyses, and use of the PRA in risk ranking. It also provides a bibliography for aspects of PRA modeling (e.g., initiating events, CCF modeling, human performance modeling).

As expressed in the review interfaces portion of Subsection I of this SRP section, other technical branches are expected to use the applicants PRA results and insights to inform their review based on risk significance.

RG 1.206 indicates the expected scope and level of detail of a PRA used to support a DC or COL application. Exceptions to this expected scope and level of detail may be acceptable if adequately justified by the applicant.

For review of a DC application, the reviewer should follow the above procedures to verify that the design, including requirements and restrictions (e.g., interface requirements and site parameters), set forth in the FSAR meet the acceptance criteria. DCs have referred to the FSAR as the DCD. The reviewer should also consider the appropriateness of identified COL action items. The reviewer may identify additional COL action items; however, to ensure these COL action items are addressed during a COL application, they should be added to the DC FSAR.

19.0-22 Revision 3 - December 20154 - May 2022 For review of a COL application, the scope of the review is dependent on whether the COL applicant references a DC, an early site permit or other NRC approvals (e.g., manufacturing license, site suitability report or topical report).

Specific Review Guidance The staffs review focuses on the methods, results and insights of the design-specific or plant-specific PRA and severe accident evaluations.

Design-Specific PRA (Specific Areas of Review)

1.

The staff reviews the process used by the applicant to develop its design-specific or plant-specific PRA, including supporting or associated analyses (e.g., T-H analyses, human reliability analyses).

2.

The staff reviews the applicants process for maintaining and upgrading the PRA, as necessary, to ensure that (1) it reasonably reflects the plant design, operation, and experience and (2) its scope, level of detail, and technical adequacy are appropriate for its use in complying with the relevant regulations for new reactors.

3.

The staff reviews the applicants uses and risk-informed applications (or proposed uses and applications)4F5 of the PRA for each phase (i.e., design, licensing, construction operations). Specifically, the PRA staff should interface with the primary review branch in the evaluation of licensee programs that use the PRA results and insights (e.g.,

human factors program, maintenance rule implementation, RAP). Likewise, the PRA staff should interface with the primary review branch in the evaluation of specific risk-informed applications (e.g., 10 CFR 50.69 implementation, risk-informed performance-based fire protection implementation, risk-informed inservice inspection, risk-informed inservice testing). When the applicant enters a new phase, the staff may review any changes to the uses and applications.

4.

The staff reviews the description of the applicants PRA in Chapter 19 of the FSAR and its associated results and insights, addressing the full scope of information outlined in RG 1.206, Section C.I.19. In particular, the staff should review the applicants identification of significant plant features (including nonsafety-related systems) and operator actions that are important to reduce risk and confirm that the plant will meet the expectation identified above that reactors will reflect an extremely low probability for accidents that could result in the release of significant quantities of radioactive fission products. In addition, for a COL referencing a DC, the staff should compare the COL applicant's PRA-based insights with those described in the DC to identify potential changes and to verify that the applicant has properly dispositioned each insight.

5.

The staff review should include a broad (qualitative and quantitative) comparison of risks, by initiating event category, between the proposed design and existing operating 5 If the applicant is merely identifying expected uses and applications of the PRA in subsequent phases, the staff will typically not perform detailed reviews of this information, but rather, will use this information in planning and preparing for these reviews in the subsequent phases. However, if the applicant requests, as part of its application, review and approval of a risk-informed application that will be implemented during a later phase, the staff will perform the necessary review. For example, at the COL phase, an applicant may propose to implement 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors, during the construction phase and need to have that risk-informed application approved before that time. The staff should use additional guidance outside this SRP section (e.g., RG 1.174 and RG 1.178 for risk-informed TS) to support these reviews.

19.0-23 Revision 3 - December 20154 - May 2022 plant designs (from which the proposed design evolved) to identify the major design features that contribute to the reduced risk of the proposed design compared to existing plant designs (e.g., passive systems, less reliance on offsite and onsite power for accident mitigation, and divisional separation).

6.

The staff reviews key assumptions in the PRA related to design areas that have not been completed. Where a design acceptance criteria (DAC) has been approved by the Commission, the staff allows the DAC approach to be used in specific areas (i.e.,

radiation protection, piping, instrumentation and controls, and human factors engineering) in lieu of detailed design information. However, to allow staff to evaluate the resolution of severe accident issues in the design and to ascertain how the risk insights from the design PRA are derived, DC applicants should address those portions of the design covered by DAC in the design PRAs to the extent practicable. If it is not practical to model certain areas that employ DAC in the design PRA, the applicant should identify those areas and qualitatively assess their impacts on the PRA results and insights. Any assumptions made regarding the reliability or performance of SSCs under DAC during this process shall be verified when the design is finalized. Furthermore, the staff should review the DC applicants PRA in accordance with the available guidance on parts of the design where DAC are used.

7.

The staff reviews the PRA-related inspections, tests, analyses and acceptance criteria (ITAAC), COL action items, and other commitments, including any actions identified or proposed to address them. The applicants PRA-based insights table may be a good starting point for this review, as it should identify these items. The staff should note any item that cannot be resolved until after the COL application phase and review the commitments and schedule for resolution of the given items, and the proposed method of completion.

Design-Specific PRA (Level I PRA Technical Adequacy)

1.

The reviewer confirms that the applicant has: (1) identified those high-level requirements or attributes of the applicable PRA standard that the PRA did not embody, (2) addressed the impact on the qualitative and quantitative results of the PRA of excluding those high-level requirements or attributes of the standard that are applicable but have not been incorporated. The PRA is excluded from Tier 2 of the DC and it is not part of the design-basis information. However, the PRA is used to help identify Tier 1 (e.g., ITAAC) and Tier 2 information, including, but not limited to risk insights as described in Section C.II.1 of RG 1.206.

2.

RG 1.200 contains the staff's guidance concerning PRA technical adequacy and peer review. Peer review of the DC PRA is not required prior to application, however, if a peer review or self-assessment was conducted prior to the application, the staff should examine the documented results. If a certain aspect of the PRA does not follow the positions in RG 1.200, the applicant should justify that this aspect of the PRA is acceptable and does not impact the PRA results or risk insights. Otherwise, applicants need to correct the deficiency and resubmit the PRA results and risk insights. If a peer review has not been performed, the applicants should justify why their PRAs are adequate in terms of scope, level of detail, and technical adequacy. If the applicants justification fails to provide the staff with an appropriate level of confidence in the models, results, and insights, the staff should conduct an audit of the applicants PRA

19.0-24 Revision 3 - December 20154 - May 2022 against the technical elements described in RG 1.200 to determine the PRA technical adequacy.

Design-Specific PRA (Procedures Specific to Passive Designs)

1.

The issue of T-H uncertainties in passive plant designs arises from the passive nature of the safety-related systems used for accident mitigation. Passive safety systems rely on natural forces, such as gravity, to perform their safety functions. Such driving forces are small compared to those of pumped systems, and the uncertainty in their values, as predicted by a best-estimate T-H analysis, can be of comparable magnitude to the predicted values themselves. Therefore, some accident sequences with a frequency high enough to impact results, but not predicted to lead to core damage by a best-estimate T-H analysis, may actually lead to core damage when PRA models consider T-H uncertainties. One approach to addressing this issue is to perform sensitivity studies to see the effect of assuming bounding values for T-H parameters on success criteria and performing studies of the sensitivity of changes in success criteria on CDF.

A.

The reviewer assures that the applicant has (1) identified all key T-H parameters that could affect the reliability of a passive system and introduce uncertainty into the determination of success criteria, and (2) accounted for the uncertainty in the analyses that establish the success criteria.

B.

The reviewer examines the results of any sensitivity studies performed by the applicant and the choice of T-H accident analysis codes used to perform such studies. Applicants frequently use the Modular Accident Analysis Program (MAAP) code for such studies. The staff is aware of T-H modeling issues with the code that could compromise its ability to confirm the validity of the PRA success criteria involving minimal sets of mitigating equipment. Use of this code is acceptable only if sufficient benchmarking studies have been done which compare MAAP results with those of a T-H code the staff has reviewed and approved and show that MAAP is able to capture the important T-H phenomena and the timing of such phenomena in simulations of accident sequences included in the PRA. If a small set of accident scenarios is used in the studies, the reviewer confirms that the applicant has provided an adequate rationale for its selection of scenarios, including a discussion of the criteria used for selection.

2.

For passive plant designs, the staff reviews the applicants use of the PRA to identify nonsafety-related, SSCs that require regulatory treatment (i.e., to support the RTNSS program). Specifically this includes the following evaluations performed by the applicant as described in SRP 19.3:

A.

Evaluation of the risk significance of nonsafety systems using the Focused PRA B.

Evaluation of uncertainties associated with assumptions made in the PRA models of passive systems C.

PRA initiating event frequency evaluation Design-Specific PRA (Procedures Specific to Integral Pressurized Water Reactors)

19.0-25 Revision 3 - December 20154 - May 2022

1.

For small, modular integral pressurized water reactor designs, the staff reviews the results and description of the applicants risk assessment for a single reactor module; and, if the applicant is seeking approval of an application for a plant containing multiple modules, the staff reviews the applicants assessment of risk from accidents that could affect multiple modules to ensure appropriate treatment of important insights related to multi-module design and operation.

The staff will verify that the applicant has:

i.

Used a systematic process to identify accident sequences, including significant human errors, that lead to multiple module core damages or large releases and described them in the application ii.

Selected alternative features, operational strategies, and design options to prevent these sequences from occurring and demonstrated that these accident sequences are not significant contributors to risk. These operational strategies should also provide reasonable assurance that there is sufficient ability to mitigate multiple core damages accidents.

2.

Shutdown and refueling operations for small, modular reactor designs may be performed in ways which are new and completely different from those used at large traditional LWRs either licensed or under review by the NRC. In these cases, a more in-depth review will be needed to assure that the PRA model is of acceptable scope, level of detail, and technical adequacy. Reviewers should confirm that applicants identify and describe the expected plant operating states (POS) in a refueling outage between the time the output breaker to the grid is opened for plant shutdown and when it is closed to resume power operation after the outage. The reasonableness of the PRA model for low power and shutdown modes of operation cannot be judged without a description of each POS that includes an estimate of the expected time in the POS, a description of the expected changes in configuration of the nuclear steam supply system, a description of the methods of removing heat from the fuel during each POS, a description of the automatic and human actions expected to occur during each POS and an assessment of the potential upset conditions and human errors during each POS that could contribute to a loss of decay heat removal.

Design-Specific PRA (Level 2 PRA)

For DC applications and COL applications not referencing the Level 2 PRA in the DC, the reviewer5F6 carries out an independent assessment of the plant response to selected severe accident scenarios using the latest version of the MELCOR computer code. The assessment should examine accident scenarios from the PRA, which are chosen based on a combination of frequency, consequence, and dominant risk. Some of these scenarios should be similar or identical to sequences analyzed by the applicant and reported in the PRA. The reviewer compares the results of corresponding sequences and release categories in the two studies. If the results of the assessment do not support and confirm the applicants simulation of the accident progression, analysis methodology, and interpretations of its analyses of the reactor, containment, and system 6 Support from an independent contractor or staff in the Office of Research may be necessary.

19.0-26 Revision 3 - December 20154 - May 2022 response to severe accidents, the reviewer engages with the applicant to resolve the differences in results.

Design-Specific PRA (PRA for Non-Power Modes of Operation)

1.

Given that shutdown risk may be highly outage-specific, the staff reviews the shutdown PRA insights to confirm that operational assumptions used to develop an average shutdown model (e.g., use of nozzle dams, outage schedule, containment status, procedural requirements) have been clearly documented in the FSAR. If licensee practices deviate dramatically from these assumptions in the future, the insights obtained from the shutdown PRA may no longer be valid. It is the COL applicants responsibility to confirm the assumptions made at the DC stage, and if done properly should capture any significant differences.

2.

The staff reviews the applicants assumptions related to equipment availability and compares them to TS requirements. Risk-significant equipment should be evaluated with respect to 10 CFR 50.36(c)(2)(ii)(D) to determine whether additional TS requirements are needed.

3.

The staff reviews the applicants implementation of the applicable expeditious actions outlined in NRC Generic Letter (GL) 88-17 (Ref. 15). The staff needs to ensure that the applicant is meeting the expeditious actions consistent with the guidance for meeting the guidelines in GL 88-17 which are described in detail in Enclosures 1 and 2 of the GL.

Deviation from GL 88-17 guidance could lead to configurations where cold leg penetrations are permitted to be open in Pressurized Water Reactors (PWRs) without the appropriate steam generator (SG) manway open or when nozzle dams are installed in the wrong order. Such configurations may invalidate PRA results. Staff may review NRC Information Notice (IN) 88-36 (Ref. 17) to understand the risks associated with these configurations. The staff also reviews the licensees ability to close containment as described in GL 88-17.

4.

The staff reviews the applicants implementation of industry guidance for safety during outages provided in NUMARC-91-06 (Ref. 10). In particular, the staff should assure that, if the applicant plans to use freeze seals, the potential for loss-of-coolant accidents due to failed freeze seals has been considered in the PRA. The potential for such accidents is discussed in NRC IN 91-41 (Ref. 18). Reviewers should also confirm the existence of an adequate means to control reactor vessel level and an adequate means to control reactor vessel temperature and pressure during shutdown in Boiling Water Reactors (BWRsa boiling-water reactor (BWR).

5.

The staff reviews the low power and shutdown Level 2 analysis using methods similar to the at power assessment, considering (1) an estimation of containment capacity considering the capacity of any temporary penetrations, and (2) the feasibility of operators to close containment before adverse environmental conditions prevent closure.

The staff reviews the low power and shutdown internal flood and internal fire analysis using methods similar to the at power assessment, considering (1) each defined plant operational state, (2) the impact of breached or failed fire barriers that could impact a fire area, and (3) the impact of impaired or disabled flood barriers that could impact a flood zone.

19.0-27 Revision 3 - December 20154 - May 2022

6.

Accidents during non-power modes of operation generally are not part of the design bases of the facility. Consequently, non-power operations, associated accident sequences and specific accident phenomenology are not considered in the review of the accident analyses provided in Chapter 15 of the FSAR. Indeed, the staffs review of the level of safety during non-power modes of operation provided by the design of the facility and operating procedures and controls in place is limited to the review of the PRA for non-power modes of operation. This puts additional burden on the PRA reviewer to pursue issues, as necessary, to assure that the PRA model has fidelity and the assumptions in the risk analyses are justified. In some cases the reviewer may need to engage reviewers from other technical branches that have expertise in particular areas (e.g., systems operation, T-H performance, operating experience). Reviewers should therefore be aware of the following issues related to safety during non-power modes of operation:

A.

Based on previous PRAs, studies by the EPRI and studies performed by the staff, roughly 80 percent of risk for traditional PWR designs occurs during periods when the reactor coolant system is drained and open (midloop operation is a subset of this condition).

B.

The time it takes to reach the boiling point in the reactor vessel following loss of the decay heat removal function can be very short during PWR midloop operation (e.g., as little as 12 minutes). Steaming into the containment will lead to intolerable conditions that could seriously affect the ability of personnel to close the containment.

C.

During reduced inventory operation in a PWR, a large vent for the reactor coolant system (RCS), such as a hot leg SG plenum man waymanway, is necessary before opening a cold leg penetration to prevent expelling water from the core following a loss of residual heat removal. RCS piping penetrations may exist below the active fuel and pathways may exist via connected systems that could lead to draining the reactor vessel. In these cases, reviewers should identify the isolation functions available and operable and assure, then ensure that they are treated accurately in the PRA model.

Design-Specific PRA (PRA-Based SMA)

1.

Staff responsible for the review of the description and results of the applicants PRA review the design-specific plant system and accident sequence analysis in accordance with the acceptance criteria given in Section II of this SRP.

2.

Staff responsible for the review of the seismic and structural design of the facility review (1) the applicants evaluation of seismic fragilities, and (2) the applicants determination of plant-level HCLPF in accordance with the acceptance criteria given in Section II of this SRP.

The staff reviewing the plant system and accident sequence analysis verifies that the applicant has considered random equipment failures, seismic interactions, as well as operator actions in the plant system and accident sequence analysis as applicable. It is important that the plant systems analysis focus on those sequences leading to core damage or containment failures, including applicable sequences leading to the following containment failures: (1) loss of containment integrity, (2) loss of containment isolation, and (3) loss of function for prevention of

19.0-28 Revision 3 - December 20154 - May 2022 containment bypass. The applicant should address the following operating modes in the analysis: (1) at power (full power), (2) low power, and (3) shutdown.

Design-Specific PRA (Treatment of Internal Fires)

1.

The NRC staff reviews the findings of the peer review to Part 4 of the ASME/ANS PRA Standard, if available. The reviewer reviews the applicants assessment of the risk associated with internal fires. NUREG/CR-6850 (EPRI 1011989), Fire PRA Methodology for Nuclear Power Facilities, issued September 2005 and EPRI TR-100370, Fire-Induced Vulnerability Evaluation (FIVE), EPRI, April 1992 are methods acceptable to the staff for performing fire PRA in support of certification of a new reactor design or initial licensing of a new reactor. The FIVE methodology is considered to be a simplified method suitable for identifying fire vulnerabilities and performing screening evaluations. NUREG/CR-6850 is considered to be a preferable method for performing fire PRA to support applications for design certification or a COL because methodological issues raised in past fire risk analyses, including individual plant examination of fire analyses, have been addressed in NUREG/CR-6850. Reviewers may find that applicants for design certification use an approach to implementing the analysis tasks in NUREG/CR-6850 that is simpler than that suggested in NUREG/CR-6850. This can occur when the specifics of cable routings, ignition sources, and target locations in each fire zone of the plant are not known at the time the design certification application is submitted. Such an approach may be acceptable if conservative assumptions are used such that it is reasonable to conclude that the results bound those expected with the more detailed approach described in NUREG/CR-6850 with respect to CDF and LRF. Examples of conservative assumptions that have been accepted by the staff in previous reviews are listed below:

A.

Fire ignition in any fire area continues to grow unchecked into a fully developed fire without credit for fire suppression and causes the maximum possible damage to SSCs in the area.

B.

Bounding fire initiating event frequencies are applied.

C.

No credit is taken for the distance between fire sources and targets.

D.

All fire-induced equipment damage occurs at the beginning of the event.

E.

Any fire in the switchyard is assumed to result in a reactor trip.

F.

Although design features have been implemented to prevent spurious actuations induced by a single fire in a building, the PRA should assume that fire propagation in the building may lead to spurious actuation of equipment that could cause initiating events or prevent mitigating systems from operating properly.

2.

The reviewer confirms that the fire risk analysis uses the same systems and accident sequence models as the internal events evaluation.

3.

The reviewer confirms that the applicant has determined the appropriate internal event sequences based on the specific fire location and correctly modified these sequences to

19.0-29 Revision 3 - December 20154 - May 2022 consider the effects of specific fires and include the possibility of fire propagation through potentially failed fire barriers.

4.

The reviewer confirms that the applicant reports the CDF and LRF derived from the fire PRA in the FSAR and provides a characterization of the dominant accident sequences and associated major contributors to CDF for each sequence in the FSAR.

Design-Specific PRA (Treatment of High Winds)

The NRC staff reviews the findings of the peer review to Part 7 of the ASME/ANS PRA Standard, if available. The reviewer evaluates the applicants methodology and use of data for estimating initiating event frequencies and assumptions in its high winds risk assessment and verifies that the methodology is consistent with the state-of-the art and that the assumptions are reasonable for estimating the CDF associated with high wind events that could damage the plant.

Design-Specific PRA (Procedures for Specific PRA Audit Topics)

1.

The staff will determine whether the scope, level of detail, and technical adequacy of the design-specific and plant-specific PRA are appropriate for the application and any identified uses and risk-informed applications, as follows:

A.

The applicants analyses should be comprehensive in scope and address all applicable internal and external events and all plant operating modes. Since some aspects of the applicants approach may involve non-PRA techniques to address specific events (e.g., PRA-based seismic margins), the PRA staff review should ensure that the scope of the applicants analyses is appropriate for the identified uses and applications of the PRA.

B.

The level of detail of the applicants PRA should be commensurate with the identified uses and applications of the PRA (e.g., sufficient to gain risk-informed insights and use such insights, in conjunction with assumptions made in the PRA, to identify and support requirements important to the design and plant operation). The PRA should reasonably reflect the actual plant design, construction, operational practices, and relevant operational experience of the applicant and the industry. The burden is on the applicant to justify that the PRA approach, methods, and data, as well as the requisite level of detail necessary for the NRC staffs review and assessment, are appropriate. RGs 1.174 and 1.200 provide additional guidance on the level of detail that should be included in the PRA. If detailed design information (e.g., regarding cable and pipe routing) is not available or if it can be shown that detailed modeling does not provide significant additional information, it is acceptable to make bounding-type assumptions consistent with the guidelines in RG 1.200. However, the risk models should still be able to identify vulnerabilities as well as design and operational requirements such as ITAAC and COL action items. In addition, the bounding assumptions should not mask any risk-significant information about the design and its operation.

2.

The staff will determine whether the applicant has performed sensitivity studies sufficient to gain insights about the impact of uncertainties (and the potential lack of detailed models) on the estimated risk. The objectives of the sensitivity studies should include

19.0-30 Revision 3 - December 20154 - May 2022 (1) determining the sensitivity of the estimated risk to potential biases in numerical values, such as initiating event frequencies, failure probabilities, and equipment unavailabilities, (2) determining the impact of the potential lack of modeling details on the estimated risk, and (3) determining the sensitivity of the estimated risk to previously raised issues (e.g., motor-operated valve reliability). As noted in Element 1.1 of Table A-1 in Appendix A to RG 1.200, special emphasis should be placed on PRA modeling of novel and passive features in the design, as well as addressing issues related to those features, such as DI&C, explosive (squib) valves, and the issue of T-H uncertainties.

3.

The following guidelines for reviewing DI&C system risk assessments are based on the lessons learned from previously accepted new reactor DI&C system PRA reviews. The review should consider the following steps, as applicable, to ensure that the risk contributions from DI&C, including software, are reflected adequately in the overall plant risk results:

A.

The level of review of the DI&C portion of the PRA may be limited due to limitations such as the lack of design details, lack of applicable data, and the lack of consensus in the technical community regarding acceptable modeling techniques for determining the risk significance of the DI&C system. The level of review should be proportional to the use of results and insights from the applicants DI&C risk assessment.

B.

The modeling of DI&C systems should include the identification of how DI&C systems can fail and what these failures can affect. The failure modes of DI&C systems are often identified by the performance of failure modes and effects analyses (FMEA). It is difficult to define DI&C system failure modes especially for software because they occur in various ways depending on specific applications. Also, failure modes, causes, or effects often are intertwined or defined ambiguously, and sometimes overlap or are contradictory. The reviewer should review the depth of the FMEA or other hazard analysis techniques employed by the applicant to ensure the process employed is systematic and comprehensive in its identification of failure modes. The PRA reviewer should work with the I&C reviewer to evaluate the methodology and results provided by the applicant. Examine applicant documentation to ensure that the most significant failure modes of the DI&C are documented with a description of the sequence of events that need to take place to fail the system. The sequence of events should realistically represent the systems behavior at the level of detail of the model.

C.

The DI&C system CCF events should be identified by the applicant and the bases for grouping of CCFs should be provided. Review the discussion of how the applicant determined the probabilities associated with CCFs. The PRA reviewer should work closely with the I&C reviewer responsible for implementing SRP Section 7.1, Fundamental Design Principles, to evaluate the applicants justifications.

D.

Uncertainties in DI&C modeling and data should be addressed in the DI&C risk assessment. It is expected that the DI&C risk assessment will address uncertainties by at least performing a number of sensitivity studies that vary modeling assumptions, reliability data, and parameter values both at the

19.0-31 Revision 3 - December 20154 - May 2022 component and system level. The reviewer should evaluate the sensitivity studies performed by the applicant on the PRA models and data to assess the effect of uncertainty on CDF, risk, and PRA insights. Sensitivity studies may be particularly helpful in assessing the effectiveness of design attributes. Additional support for the review and treatment of uncertainties is provided by NUREG-1855, Volume 1, Main Report: Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, dated March 2009.

E.

The DI&C reviewer should confirm that DI&C system equipment is capable of meeting its safety function in environments associated with accident sequences modeled in the PRA. This is done in collaboration with the reviewer for the PRA and severe accident evaluation that provides input on the expected environments that need to be considered.

F.

The PRA reviewer should confirm that the impact of external events (i.e., seismic, fire, high winds, flood, and others) on DI&C has been addressed in the PRA. The DI&C reviewer confirms that an appropriate failure mode and effects assessment for external hazards has been performed for the purpose of supporting treatment of DI&C in the PRA. A specific concern is the impact of fire on DI&C systems.

G.

Important scope, boundary condition, and modeling assumptions need to be determined and evaluated. Verify that the assumptions made in developing the PRA model and data are realistic, and that the associated technical justifications are sound and documented. The reviewer should pay attention to assumptions about the potential effects from failure of defensive measures.6F7 A DI&C defensive measure may have the unintended consequence of causing spurious trips or spuriously failing functional capabilities. The applicant should describe the segregation process that prevents this from occurring. The PRA reviewer should work with the I&C reviewer to evaluate the process discussed by the applicant.

H.

The PRA reviewer should evaluate the treatment of the recovery actions taken for loss of DI&C functions, referring to RG 1.200 and good practices in human reliability assessment (HRA) for additional guidance. Coordinate the review with staff evaluating areas such as main control room design, and minimum alarms and controls inventory. If recovery actions are modeled, they should consider loss of instrumentation and the time available to complete such action.

I.

Verify that a method for quantifying the contribution of software failures to DI&C system reliability was used and documented.

J.

It is important to evaluate claims by applicants regarding the credit that should be given for defensive design features. Verify that key assumptions from the DI&C PRA are captured under the applicants design reliability assurance program (D-RAP), which is described in SRP Chapter 17, Section 17.4. The applicant should describe adequately where and how the D-RAP captures the DI&C system key 7 i.e., measures that provide DI&C fault prevention, removal, and tolerance, e.g., memory allocation, network/bus design features, automatic tester system, diagnostics, and data acquisition system.

19.0-32 Revision 3 - December 20154 - May 2022 assumptions, such as how future software and hardware modifications will be conducted to ensure that high reliability and availability are maintained over the life of the plant.

The following 10 additional steps, as applicable, are included if a more detailed review is needed (e.g., through field audits):

A.

Verify that physical and logical dependencies are identified and their bases provided in the DI&C PRA. The probabilistic model should encompass all relevant dependencies of a DI&C system on its support systems. For example, if the same DI&C hardware is used for implementing several DI&C systems that perform different functions, a failure in the hardware, software, or system of the DI&C platform may adversely affect all these functions. Should these functions be needed at the same time, they would be affected simultaneously. This impact should be explicitly included in the probabilistic model. The DI&C system probabilistic model should be fully integrated with the probabilistic model of other systems. Coordinate with the I&C reviewer.

B.

Ensure that spurious actuations of diverse backup systems or functions are evaluated and the overall risk impact documented.

C.

Common cause failures can occur in areas where there is sharing of design, application, or functional attributes, or where there is sharing of environmental challenges. Review the extent to which the DI&C systems were examined by the applicant to determine the existence of such areas. Each of the areas found to share such attributes should be evaluated in the DI&C analysis to determine where CCF should be modeled and to estimate their contribution. Based on the results of this evaluation, D&IC software and/or hardware/software dependent CCFs may need to be applied in several areas within subsystems (e.g., logic groups), among subsystems of the same division, across divisions or trains, and across systems. For example, CCF assignments should be based on similarity in design and function of component or system modules.

The CCF events should be identified and modeled by the applicant. The CCF probabilities and their bases should be evaluated and provided based on an evaluation of coupling mechanisms (e.g., similarity, design defects, external events, and environmental effects) combined with an evaluation of defensive measures meant to protect against CCF (e.g., separation and independence, operational testing, maintenance, diagnostics, self-testing, fault tolerance, and software/hardware design/development techniques and processes). Failures of system modules common across multiple applications should be identified (e.g., CCF of common function modules). If the safety functions of a DI&C system (and the redundancy within safety functions) use common software, dependency should be identified for software faults. That is, when common software is used for different safety functions (or in the redundancy within a safety function) it may fail each function. Hardware CCF between different safety functions using the same hardware should be identified. Dependencies between hardware and software should be identified. The applicant should provide the rationale for the degree of dependency assumed for DI&C CCF.

19.0-33 Revision 3 - December 20154 - May 2022 An important expectation is that the applicant included sufficient equipment in the CCF groups. The evaluation should address why various channels, trains, systems, etc., were or were not placed in each CCF group. The justification should discuss common software/hardware among the equipment considered and the level(s) of dependency among them. The reviewer should work with the I&C reviewer to evaluate the applicants justifications.

D.

It is important to evaluate claims by applicants regarding the credit that should be given for defensive design features. Design features such as fault tolerance, diagnostics, and self testing are intended to increase the safety of DI&C systems, and therefore are expected to have a positive effect on the systems safety.

However, these features may also have a negative impact on the safety of DI&C systems if they are not designed properly or fail to operate appropriately. The potentially negative effects of these features should be included in the probabilistic model. The PRA should account for the possibility that after a failure is detected, the system may fail to reconfigure properly, may be set up into a configuration that is less safe than the original, may fail to mitigate the failure altogether, or the design feature itself may contain the fault. The benefits of these features also may be credited in the PRA. Care should be taken to ensure that design features intended to improve safety are modeled correctly (e.g., ensuring that the beneficial impacts of these features are only credited for appropriate failure modes and that the limitations, including failure of the design feature itself, is considered in the model).

An issue associated with including a design feature such as fault tolerance in a DI&C system modeled in a PRA is that its design may be such that it can only detect, and hence mitigate, certain types of failures. A feature may not detect all the failure modes of the associated component, but just the ones it was designed to detect. The PRA model should only give credit to the ability of these features to automatically mitigate these specific failure modes; it should consider that all remaining failure modes cannot be automatically tolerated. Those failure modes that were not tested should not be considered in the fault coverage, and should be included explicitly in the logic model.

When a specific datum from a generic database, such as a failure rate of a digital component, is used in a DI&C risk assessment, the risk analyst, in conjunction with the I&C reviewer, should assess whether the datum was adjusted for the contribution of design features specifically intended to limit those postulated failures. If so, the failure rate may be used in the PRA, but no additional fault coverage should be applied to the component, unless it is demonstrated that the two fault coverages are independent. Otherwise, applying the same or similar fault coverages would generate a non-conservative estimate of the components failure rate. A fault-tolerant feature of a DI&C system can be explicitly included either in the logic model or in the PRA data, but not both.

With respect to the above design features, the concept of fault coverage is used to express the probability that a failure will be tolerated for the types of failures that were tested. Fault coverage is a function of the failures that were used in testing. It is essential that the reviewer be aware of the types of failures that were used in testing to apply a value of fault coverage to a PRA model.

19.0-34 Revision 3 - December 20154 - May 2022 How fault coverage is measured and defined should be evaluated by the risk analyst in conjunction with the I&C reviewer.

E.

If a DI&C system shares a communication network with other DI&C systems, the effects on all systems due to failures of the network should be modeled jointly.

The impact of communication faults on the related components or systems should be evaluated, and any failure considered relevant should be included in the probabilistic model.

F.

If hardware, software, and system CCF probabilities are treated together in the PRA and if the applicant uses standard methods such as the multiple Greek letter method, alpha factor method, or beta factor method to model DI&C system CCFs, an NRC audit of these calculations, their bases, and the modeling assumptions may be warranted.

G.

The data for hardware failure rates (including CCF) will likely be more robust than the software failure data. Review of applicant claims regarding data should be proportional to the use made of the PRA results. If limited use is made, limited review is necessary. If the applicant claims CCF rates that are more than an order of magnitude lower than other component groups (especially for software),

an NRC audit of data calculations may be warranted. Data (either public or system-specific) have been a limiting factor in the evaluation of risk for DI&C systems. The guidelines in Subsection 4.5.6, Data Analysis, of the ASME Standard for PRA, ASME/ANS RA-Sa-2009, for nuclear power plant applications should be satisfied consistent with the clarifications and qualifications of RG 1.200. Determine if the process used to determine basic event probabilities is reasonable. Check the assumptions made in calculating the probabilities of basic events (unavailabilities). Confirm that the data used in the PRA are appropriate for the hardware and software version being modeled, or that adequate justification is provided.

Note that a fault-tolerant feature of a DI&C system (or one of its components) can be explicitly included either in the logic model or in the probabilistic data of the components in the model. It should not be included in both because this would result in double-counting the features contribution.

H.

If the values of the data used appear to be skewed and use of different values might change the insights drawn from the DI&C risk assessment, confirm that the data meet the following criteria:

a. The data are obtained from the operating experience of the same equipment as that being evaluated, and preferably in the same or similar applications and operating environment. Uncertainty bounds should appropriately reflect the level of uncertainty. (Applies to both component-specific and generic data)

b. The sources for raw data or generic databases are provided. (Applies to both component-specific and generic data)

c. The method used in estimating the parameters is documented, so that the results can be reproduced. (Applies to component specific data)

19.0-35 Revision 3 - December 20154 - May 2022

d. If the system being modeled is qualified for its environment but the data obtained are not drawn from systems qualified for that environment, the data should account for the differences in application environments. (Applies to both component-specific and generic data)

e. Data for CCF meet the above criteria in Ha to Hd. (Applies to both component-specific and generic data, as appropriate)

f. Data for fault coverage meet the above criteria in Ha to Hd. (Applies to both component-specific and generic data, as appropriate)

g. Documentation is included on how the basic event probabilities are calculated in terms of failure rates, mission times, and test and maintenance frequencies. (Applies to both component-specific and generic data)

I.

The use of DI&C systems in nuclear power plants raises the issue of dynamic interactions, specifically:

a. The interactions between a plant system and the plants physical processes, (i.e., the value of process variables), and

b. The interactions within a DI&C system (e.g., communication between different components, multi-tasking, multiplexing, etc.).

The reviewer should confirm that interactions have been addressed in the PRA model for DI&C systems or should evaluate the rationale for not modeling them.

J.

Target reliability and availability specifications should be described adequately for the operational phase of D-RAP (details of the operational phase are provided in SRP Sections 17.4 and 17.6). If the PRA lacks sufficient quantitative results to determine target values, the applicant should describe adequately how expert judgment will establish reliability and availability goals. How the applicant will carry out performance monitoring for diverse backup systems (if necessary) and DI&C systems should be clearly explained. These specified values should be defined to help ensure that no safety conclusions based on review of the risk analysis of the DI&C are compromised once the plant is operational. Coordinate this review with NRC staff evaluating the levels of diversity and defense-in-depth (D3) in the DI&C system. An implementation and monitoring program should address how the applicant will ensure that the design continues to reflect the assumed reliability of the systems and components during plant operation.

Severe Accident Evaluation (FSAR Section 19.2)

1.

The staff reviews the applicants description and analysis of the design features to prevent and mitigate severe accidents, in accordance with the requirements in 10 CFR 52.47(23) or 10 CFR 52.79(a)(38), for a DC or a COL application, respectively.

This review should specifically address the issues identified in SECY-90-016 and SECY-93-087 (listed with their SRMs above) for prevention (e.g., anticipated transients without scram, midloop operation, station blackout, fire protection, and intersystem loss-of-coolant accident) and mitigation (e.g., hydrogen generation and control, core debris

19.0-36 Revision 3 - December 20154 - May 2022 coolability, high-pressure core melt ejection, containment performance, dedicated containment vent penetration, equipment survivability).

2.

The staff reviews the information provided by the applicant to satisfy the requirements of 10 CFR 52.47(8) or 10 CFR 52.79(a)(17), for a DC or a COL application, respectively.

In particular, both regulations invoke 10 CFR 50.34(f)(1)(i) to specify that a design-specific or plant-specific PRA should be performed to seek improvements in core heat removal system reliability and containment heat removal system reliability that are significant and practical and do not excessively impact the plant.

3.

The reviewer compares the design features that affect containment performance and the calculated performance of the containment with published results for operating plants and evaluates whether or not the design under review is robust and has a high tolerance for severe accidents when compared to that of the operating plants. The comparison and conclusions are documented in the SER.

4.

The reviewer identifies the design features and requirements introduced by the applicant to reduce or eliminate significant contributors to risk in existing operating plants and evaluates the extent to which these features provide a good balance between prevention and mitigation. The evaluation is documented in the SER.

5.

Using acceptance criteria listed above in Section II, the reviewer evaluates the applicants assessment of structural performance of the containment under severe accident loads which encompasses: (1) an assessment of the Level C (or factored load) pressure capability of the containment in accordance with 10 CFR 50.44(c)(5),

(2) demonstration of the containment capability to withstand the pressure and temperature loads induced by the more likely severe accident scenarios as stipulated in SECY-93-087,Section I.J, (3) a containment structural fragility assessment for overpressurization, and (4) seismic HCLPF assessment of the containment in meeting the SECY-93-087,Section II.N, expectation.

IV.

EVALUATION FINDINGS The reviewer verifies that the applicant has provided sufficient information and that the review and calculations (if applicable) support conclusions of the following type to be included in the staffs SER. The reviewer also states the bases for those conclusions.

In the SER, the staff should provide a summary description of the applicants design-specific or plant-specific PRA and severe accident evaluations, following the topical outline provided in RG 1.206, Section C.I.19. The SER should also identify the PRA and severe accident evaluation information that the applicant docketed and the information reviewed by the NRC during audits. The results of the staff review, including staff audits, should reflect a consistent and scrutable evaluation of the applicants PRA and severe accident evaluations.

Based on an evaluation of the acceptance criteria from Subsection II of this SRP section, with guidance given in Subsection III, the staff will generally need to make a finding in the following areas:

1.

The applicant has used the PRA and severe accident evaluation to identify and assess the balance of preventive and mitigative features, including consideration of operator

19.0-37 Revision 3 - December 20154 - May 2022 actions. The Commission anticipates that the plant's operation will reflect a reduction in risk compared to existing operating plants.

2.

The applicant has used PRA results and insights to support other programs, as identified in Subsection I of this SRP section.

3.

The PRA reasonably reflects the as-designed, as-built, and as-operated plant, and the PRA maintenance program will ensure that the PRA will continue to reflect the as-designed, as-built, and as-operated plant, consistent with its identified uses and applications.

4.

The PRA is of the appropriate scope, level of detail, and technical adequacy for its identified uses and applications.

5.

Appropriate ITAAC (including design acceptance criteria if applicable), interface requirements, and COL items have been identified.

6.

The applicant has performed adequate systematic evaluations of the risk associated with the design and used them to identify risk-informed safety insights in a manner consistent with the Commissions stated goals.

7.

In accordance with the Commissions objectives for new reactor designs, the applicant has introduced appropriate and effective design features that contribute to the mitigation of severe accidents. The Commission anticipates that these features will reduce the significant risk contributors when compared to existing operating plants.

8.

The applicants containment performance evaluation meets the requirement of 10 CFR 50.44, the SECY-93-087 expectations for containment structural performance, and the staffs expectation of the quality of the containment pressure fragility analysis.

9.

For DC and COL reviews, the findings will also summarize the staffs evaluation of requirements and restrictions (e.g., interface requirements and site parameters) and COL action items relevant to this SRP section.

V.

IMPLEMENTATION The staff will use this SRP section in performing safety evaluations of DC and COL applications submitted pursuant to 10 CFR Part 52. Except when the applicant proposes an acceptable alternative method for complying with specified portions of the Commissions regulations, the staff will use the method described herein to evaluate conformance with Commission regulations.

The provisions of this SRP section apply to reviews of applications submitted six months or more after the date of issuance of this SRP section, unless superseded by a later revision.

VI.

REFERENCES

1.

50 FR 32128, Severe Reactor Accidents Regarding Future Designs and Existing Plants, Federal Register, Volume 50, No. 153, pp. 32138-32150, August 8, 1985.

2.

51 FR 28044, Safety Goals for the Operations of Nuclear Power Plants Policy Statement, Federal Register, Volume 51, No. 149, pp 28044-28049, August 4, 1986.

19.0-38 Revision 3 - December 20154 - May 2022

3.

52 FR 34884, Nuclear Power Plant Standardization, Federal Register, Volume 52, No. 178, pp. 34884-34886, September 15, 1987.

4.

59 FR 35461, Regulation of Advanced Nuclear Power Plants: Statement of Policy, Federal Register, Volume 59, No. 132, pp 35461-35462, July 12, 1994.

5.

60 FR 42622, Use of Nuclear Probabilistic Risk Assessment Methods in Nuclear Regulatory Activities; Final Policy Statement, Federal Register, Volume 60, No. 158, pp. 42622-42629, August 16, 1995.

6.

American Society of Mechanical Engineers/American Nuclear Society, ASME/ANS RA--Sa--2009, Addenda to ASME/ANS RA-S-2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME: New York, NY,. ANS: La Grange Park, IL. February 2009.

Standards are available at http://www.asme.org.

7.

Electric Power Research Institute, EPRI NP-6041, Nuclear Plant Seismic Margin R-1, Palo Alto, CA, August 1991. EPRI reports are available at http://www.epri.com.

8.

Electric Power Research Institute, EPRI TR-1002988, Seismic Fragility Application Guide, Palo Alto, CA, December 2002. EPRI reports are available at http://www.epri.com.

9.

Electric Power Research Institute, EPRI TR-103959, Methodology for Developing Seismic Fragilities, Palo Alto, CA, June 1994. EPRI reports are available at http://www.epri.com.

10.

Nuclear Energy Institute, NEI NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management, December 1991. NEI reports are available at http://www.nei.org.

11.

U.S. Code of Federal Regulations, Domestic Licensing of Production and Utilization, Part 50, Chapter 1, Title 10, Energy.

12.

U.S. Code of Federal Regulations, Environmental Protection Regulations for Domestic Licensing and Related Regulatory Functions, Part 51, Chapter 1, Title 10, Energy.

13.

U.S. Code of Federal Regulations, Licenses, Certifications, and Approvals for Nuclear Power Plants, Part 52, Chapter 1, Title 10, Energy.

14.

U.S. Nuclear Regulatory Commission, DC/COL-ISG-20, Interim Staff Guidance on Implementation of a Probabilistic Risk Assessment-Based Seismic Margin Analysis for New Reactors, October 16, 2009. ADAMS Accession No. ML100491233.

15.

U.S. Nuclear Regulatory Commission, GL 88-17, Loss of Decay Heat Removal, October 17, 1988.

16.

U.S. Nuclear Regulatory Commission, GL 89-01, Implementation of Programmatic Controls for Radiological Effluent Technical Specifications in the Administrative Controls Section of the Technical Specifications and the Relocation of Procedural Details of RETS to the Offsite Dose Calculation Manual or to the Process Control Program, January 31, 1989.

19.0-39 Revision 3 - December 20154 - May 2022

17.

U.S. Nuclear Regulatory Commission, IN 88-36, Possible Sudden Loss of RCS Inventory during Low Coolant Level Operation, June 8, 1988.

18.

U.S. Nuclear Regulatory Commission, IN 91-41,Potential Problems with the Use of Freeze Seals, June 27, 1991.

19.

U.S. Nuclear Regulatory Commission, Control of Combustible Gas Concentrations in Containment, Revision 3, Regulatory Guide 1.7, March 2007. ADAMS Accession No. ML070290080.

20.

U.S. Nuclear Regulatory Commission, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Regulatory Guide 1.174, Revision 2. May 2011. ADAMS Accession No. ML100910006.

21.

U.S. Nuclear Regulatory Commission, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Regulatory Guide 1.200, Revision 2. March 2009. ADAMS Accession No. ML090410014.

22.

U.S. Nuclear Regulatory Commission, Combined License Applications for Nuclear Power Plants (LWR Edition),, Regulatory Guide 1.206. June 2007., Rev. 1. October 2018. ADAMS Accession No. ML070630003ML18131A181.

23.

U.S. Nuclear Regulatory Commission, Containment Structural Integrity Evaluation for Internal Pressure Loadings above Design-Basis Pressure, Regulatory Guide 1.216.

August 2010. ADAMS Accession No. ML093200703.

24.

U.S. Nuclear Regulatory Commission, SECY-90-016, Evolutionary Light-Water Reactor (LWR) Certification Issues and Their Relationship to Current Regulatory Requirements, January 12, 1990. ADAMS Accession No. ML003707849.

25.

U.S. Nuclear Regulatory Commission, SECY-93-087, Policy, Technical, and Licensing Issues Pertaining to Evolutionary and Advanced Light-Water Reactor Designs, April 2, 1993. ADAMS Accession No. ML003708021.

26.

U.S. Nuclear Regulatory Commission, SECY-96-128, Policy and Key Technical Issues Pertaining to the Westinghouse AP600 Standardized Passive Reactor Design, June 12, 1996. ADAMS Accession No. ML003708224.

27.

U.S. Nuclear Regulatory Commission, SECY-97-044, Policy and Key Technical Issues Pertaining to the Westinghouse AP600 Standardized Passive Reactor Design, February 18, 1997. ADAMS Accession No. ML003708316.

28.

U.S. Nuclear Regulatory Commission, SRM-SECY-90-016, Evolutionary Light-Water Reactor (LWR) Certification Issues and their Relationship to Current Regulatory Requirements, June 26, 1990. ADAMS Accession No. ML003707885.

29.

U.S. Nuclear Regulatory Commission, SRM-SECY-93-087, Policy, Technical, and Licensing Issues Pertaining to Evolutionary and Advanced Light-Water Reactor Designs, July 21, 1993. ADAMS Accession No. ML003708056.

19.0-40 Revision 3 - December 20154 - May 2022

30.

U.S. Nuclear Regulatory Commission, SRM-SECY-96-128, Policy and Key Technical Issues Pertaining to the Westinghouse AP600 Standardized Passive Reactor Design, January 15, 1997. ADAMS Accession No. ML003708192.

31.

U.S. Nuclear Regulatory Commission, SRM-SECY-97-044, Policy and Key Technical Issues Pertaining to the Westinghouse AP600 Standardized Passive Reactor Design, June 30, 1997. ADAMS Accession No. ML003708232.

PAPERWORK REDUCTION ACT STATEMENT The information collections contained in the Standard Review Plan are covered by the requirements of 10 CFR Parts 50, 51, and 52, and were approved by the Office of Management and Budget, approval numbers 3150-0011, 3150-0021, and 3150-0151.

PUBLIC PROTECTION NOTIFICATION The NRC may not conduct or sponsor, and a person is not required to respond to, a request for information or an information collection requirement unless the requesting document displays a currently valid OMB control number.

19.0-41 Revision 3 - December 20154 - May 2022 SRP Section 19.0 Description of Changes Section 19.0 PROBABILISTIC RISK ASSESSMENT AND SEVERE ACCIDENT EVALUATION FOR NEW REACTORS This SRP section affirms the technical accuracy and adequacy of the guidance previously provided in Revision 2, dated June 2007 of this SRP. See ADAMS Accession No. ML071700652.

The technical changes incorporated in Revision 3, dated September 2014 include:

(1) incorporation of guidance previously contained in Interim Staff Guidance (ISG)

DC/COL-ISG-003 (ADAMS Accession No. ML081430087) concerning the review of PRA information and severe accident assessments submitted to support DC and COL applications, (2) incorporation of guidance previously contained in ISG DC/COL-ISG-020 (ADAMS Accession No. ML100491233) concerning review of information from PRA-based seismic margin analyses submitted in support of DC and COL applications, (3) incorporation of guidance previously contained in ISG DI&C/COL-ISG-003 (ADAMS Accession No. ML080570048) concerning review of DI&C system PRAs, including treatment of CCFs in PRAs and uncertainty analysis associated with new reactor digital systems, (4) incorporation of additional procedures for review of PRA information and severe accident assessments developed during NRC reviews of DC and COL applications completed after Revision 2 of SRP 19.0 was issued, (5) additional proposed acceptance criteria and review procedures for the staffs review of an applicants assessment of risk from accidents that could affect multiple modules in facilities with small modular integral pressurized water reactors (iPWRs), and (6) additional review procedures for the staffs review of the results of the PRA for non-power modes of operation.

Descriptions of the technical changes in each SRP section are as follows:

I.

AREAS OF REVIEW

1.

The list of the Commissions objectives regarding the appropriate way to address severe accidents and use PRA in the design and operation of facilities under review was removed. RG 1.206 is identified as the proper source for the list.

2.

Added a statement describing the scope of newly added guidance for the review of PRA-based seismic margin analysis.

3.

Added a statement clarifying the various types of information from COL applicants the staff may expect to see when the applicant incorporates by reference a generic risk assessment of external events in the DCD.

4.

Added statements identifying the information that should be provided by applicants for staff review and the format requirements for the information.

5.

Added a statement describing the scope of the staffs review of applicants analysis of containment capability.

6.

Added a statement clarifying the scope of the PRA staffs review of Tier 1 information in the DCD.

19.0-42 Revision 3 - December 20154 - May 2022

7.

Added statements that identify additional organizations with which staff with primary review responsibility may need to interface with.

8.

A statement was added to clarify the interface between the review of combustible gas control and the review of severe accidents.

9.

Several statements were added to clarify the division or responsibility of the PRA reviewer and the I&C reviewer regarding treatment of the DI&C systems in the PRA.

10.

Some considerations for design certification rules were deleted.

II.

ACCEPTANCE CRITERIA

1.

Added a description of 10 CFR 52.47(a)(1) to the list of requirements applicable to DC applicants.

2.

In regards to the requirements in 10 CFR 52.47(a)(27), a statement was added to clarify that a PRA-based SMA is an acceptable surrogate for seismic PRA in a design certification application since a seismic PRA cannot be performed unless the site has been adequately characterized.

3.

Added a statement describing requirements in 10 CFR 52.79(a)(1) for COL applicants.

4.

Added statements describing Commission expectations regarding containment performance and SMA.

5.

Added several statements describing Commission expectations for use of the PRA in advanced reactor design and licensing.

6.

Added (1) a statement to indicate that the PRA is not part of the design bases and therefore not subject to quality assurance requirements in 10 CFR Part 50, Appendix B, and (2) guidelines that establish, at a high level, acceptable elements for a quality assurance program.

7.

Several statements were added that describe the staffs acceptance criteria for technical adequacy of the PRA, including the standards and guidance that will be applied.

8.

Two statements were added that identify specific results from the PRA the staff will need to consider in order to complete its review of Chapter 19 of the FSAR.

9.

Guidance was added regarding acceptable approaches for reporting significant risk contributors in Chapter 19 of the DCD and FSAR, including an acceptable interpretation of the term significant.

10.

A statement was added that describes acceptance criteria pertaining to description of the PRA maintenance program in Chapter 19 of the FSAR.

11.

A statement was added that describes acceptance criteria pertaining to description of the PRA upgrade program in Chapter 19 of the FSAR.

19.0-43 Revision 3 - December 20154 - May 2022

12.

A statement was added describing acceptable methods for determining tornado frequencies.

13.

A statement was added identifying an acceptable method for evaluating containment structural integrity for internal pressure loadings above design-basis pressure.

14.

Several statements were added that describe the acceptance criteria for PRA-based SMA previously contained in DC/COL-ISG-20.

15.

Statements were added to describe the applicability of RG 1.7 and RG 1.216 to the containment performance assessment which is part of the severe accident evaluation.

16.

A footnote was added stating that PRA self-assessment is an acceptable tool for assessing the technical adequacy of a PRA performed in support of an application for a design certification.

17.

A footnote was added to describe Min-Max method which used to determine the HCLPF capacity.

18.

Additional acceptance criteria for the staffs review of an applicants assessment of risk from accidents that could affect multiple modules in facilities with small modular integral pressurized water reactors (iPWRs) were added.

III.

REVIEW PROCEDURES

1.

A statement was added emphasizing the need for reviewers to assure that when RAIs lead to a substantive change to information in the FSAR or DCD, these documents are revised to reflect the new information.

2.

A statement was added to notify readers that the NRC had issued the FSER for the DC of the ESBWR and to identify this FSER as a resource for reviewers to use in their review of Chapter 19 of DC and COL applications.

3.

A statement was added directing reviewers to follow the approach for risk-informing staff review activities provided in the introduction to NUREG-0800 when performing reviews of small, modular iPWRs.

4.

Procedures were added to ensure that reviewers consider specific areas of the PRA in their reviews.

5.

Procedures were added regarding review of results and descriptions of the assessment of internal fires in the PRA.

6.

Procedures were added for reviewing technical adequacy of Level 1 PRA.

7.

Procedures were added for reviewing specific issues associated with passive designs.

8.

Procedures were added for review of topics specific to iPWRs.

19.0-44 Revision 3 - December 20154 - May 2022

9.

Procedures were added for reviewing PRA for Non-Power Modes of Operation.

10.

Procedures were added for review of Level 2 PRA issues.

11.

Procedures were added for reviewing PRA-based SMA.

12.

Procedures were added for review of results and descriptions of the assessment of high winds in the PRA.

13.

Procedures were added for use during audits of the PRA in the applicants office.

14.

Procedures were added for reviewing design features that have been added to mitigate severe accidents.

15.

A statement was added to make clear that the EPRI Fire-Induced Vulnerability Evaluation (FIVE) method is acceptable along with the method in NUREG\\CR-6850 for addressing fire in the PRA.

16.

An explicitly review procedure was added for the containment performance assessment.

17.

Review procedures for the staffs review of an applicants assessment of risk from accidents that could affect multiple modules in facilities with small, modular, integral pressurized water reactors (iPWRs) were added.

18.

Additional review procedures for the staffs review of an applicants assessment of risk from accidents that could affect multiple modules in facilities with small modular integral pressurized water reactors (iPWRs) were added

19.

Additional review procedures for the staffs review of the results of the PRA for non-power modes of operation were added.

IV.

EVALUATION FINDINGS Three additional findings that reviewers should pursue were added. These findings relate to specific objectives of the Commission for use of PRA in the design of new and advanced reactors.

V.

IMPLEMENTATION No Changes VI.

REFERENCES A number of additional documents are referred to in Sections II and III. Complete references for these documents have been added to the reference section (i.e.,Section VI).