ML22103A254

Draft Request for Additional Information

ML22103A254
Person / Time
Site:	Limerick
Issue date:	04/19/2022
From:	NRC/NRR/DORL/LPL1
To:	Exelon Generation Co
NRR/DORL/LPL1
References
EPID L-2021-LLA-0042
Download: ML22103A254 (20)

Text

REQUEST FOR ADDITIONAL INFORMATION (RAI)

LIMERICK GENERATING STATION, UNITS 1 AND 2 DOCKET NOS. 05000352 and 05000353 EPID NO. L-2021-LLA-0042 By letters dated March 11, May 5, and December 15, 2021, and February 14, 2022 (Agencywide Documents Access and Management System(ADAMS) Accession Nos. ML21070A412, ML21125A215, ML21349B364, and ML22045A480, respectively), Exelon Generation Company, LLC (the licensee) submitted a license amendment request (LAR) for the Limerick Generating Station, Units1 and2 to revise the license condition in each license to allow the use of alternate defense-in-depth, pressure boundary, and seismic categorization processes in the licensees application of Title 10 of the Code of Federal Regulations (10 CFR),

Section 50.69 (10 CFR 50.69).

In response to the U.S. Nuclear Regulatory Commissions (NRCs) audit plan dated October 1, and October 20, 2021, and January 24 and February 2, 2022 (ADAMS Accession Nos. ML21263A248, ML21295A036, ML22028A183, and ML22034A014, respectively), the licensee provided responses to NRCs audit questions in its Web-based audit portal. The NRC staff has reviewed the information provided by the licensee on its audit portal and has determined that the NRC needs the following additional information to complete its review of the LAR.

RAIs on Alternate Pressure Boundary Components RAI Results of the Alternate Pressure Boundary 10 CFR 50.69 Method Section 50.69(b)(2)(ii) of 10 CFR requires that a LAR include a description of the measures taken to assure that the quality and level of detail of the systematic processes that evaluate the plant for internal and external events during normal operation, low power, and shutdown are adequate for the categorization of structures, systems, components (SSCs).

Section 50.69(b)(2)(iv) of 10 CFR requires that a LAR include a description of, and basis for acceptability of, the evaluations to be conducted to satisfy 10 CFR 50.69(c)(1)(iv). The Statement of Consideration (SoC) on 10 CFR 50.69(b)(2)(iv) of the Final Rule states that the licensee is required to include information about the evaluations they intend to conduct to provide reasonable confidence that the potential increase in risk would be small. The SoC further clarifies that a licensee must provide sufficient information to the NRC, describing the risk sensitivity study and other evaluations and the basis for their acceptability as appropriately representing the potential increase in risk from implementation of the requirements in the rule.

Section 1 of Electric Power Research Institute (EPRI) report 30020159991 states that a second report is anticipated, for 2020, that will provide background on additional investigations and providing implementation guidance. The NRC staff is unaware of whether this report has been published. Section 3.1.3 of Enclosure 1 of the LAR states that the alternate EPRI approach was 1 Electric Power Research Institute (EPRI), 3002015999, Enhanced Risk-Informed Categorization Methodology for Pressure Boundary Components, November 2019.

2 piloted in April 2020 for the entire plant and the results were reasonable and consistent. The NRC staff requests the following information:

A. Results of the alternate pressure boundary categorization. Include the specific difference in results between the existing approved method and the alternate EPRI 3002015999 method.

B. Discussion and justification that support the licensees conclusion that the pilot categorization results are reasonable and consistent.

C. Identify any passive SSCs categorized by the existing approved method that have changed by applying the alternate method.

D. Provide the number and percentage of SSCs determined to be HSS based on Criteria 1 through 10 and, separately, Criteria 11 through 14 provided in Section 4.2 of EPRI 3002015999.

E. Provided details of any follow-up EPRI documentation related to the alternate pressure boundary categorization method. Include in this discussion if the Limerick, and any other plant, pilot results have been reviewed by EPRI to assess impact on the categorization results.

F. If additional relevant EPRI documents have been published (e.g., the second report identified in EPRI 3002015999), then provide them on the docket for NRC staff review of its applicability to this LAR.

RAI Prerequisite No. 1, PRA Technical Adequacy Internal Flooding Model Paragraph (b)(2)(ii) of 10 CFR 50.69 requires a description of the measures taken to assure that the quality and level of detail of the systematic processes that evaluate the plant for internal and external events during normal operation, low power, and shutdown (including the plant-specific PRA, margins-type approaches, or other systematic evaluation techniques used to evaluate severe accident vulnerabilities) are adequate for the categorization of SSCs. Paragraph 50.69(b)(2)(iv) requires a description of, and basis for acceptability of, the evaluations to be conducted to satisfy 10 CFR 50.69(c)(1)(iv). The SoC on Paragraph 50.69(b)(2)(iv) of the rule states that the licensee is required to include information about the evaluations they intend to conduct to provide reasonable confidence that the potential increase in risk would be small.

The SoC further clarifies that a licensee must provide sufficient information to the NRC, describing the risk sensitivity study and other evaluations and the basis for their acceptability as appropriately representing the potential increase in risk from implementation of the requirements in the rule.

Section 3.1.3 of Enclosure 1 of the LAR states that the EPRI 3002015999 methodology is proposed as an alternate to the NRC-accepted ANO-2 R&R-0042 method for SSC categorization. Section 4.1 of the EPRI document specifies prerequisites or requirements that must be met prior to implementing the methodology, including the requirement of a robust 2 Markley, Michael, U.S. Nuclear Regulatory Commission, letter to Vice President, Operation, Arkansas Nuclear One, Entergy Operations, Inc., "Arkansas Nuclear One, Unit 2 - Approval of Request for Alternative AN0-2 R&R-004, Revision 1, Request to Use Risk-Informed Safety Classification and Treatment for Repair/Replacement Activities in Class 2 & 3 Moderate and High Energy Systems," dated April 22, 2009 (ADAMS Accession No. ML090930246.

3 internal events and internal flooding PRA (IFPRA). Section 3.1.3 of Enclosure 1 of the LAR states, for Prerequisite No. 1, that Limerick has a risk-informed in-service inspection (RI-ISI) program that is sufficient for use in categorization based on the gap assessment provided in Section 4.1 of the EPRI report (6 clarifications) and the analysis provided in EPRI 102146712.

The NRC staff notes the analysis of EPRI 1021467 was performed against the 2008 American Society of Mechanical Engineers/American Nuclear Society (ASME/ANS) Probabilistic Risk Assessment (PRA) Standard. It is unclear to the NRC staff which PRA model (i.e., the 2009 ASME/ANS PRA Standard13 peer-reviewed IFPRA model (in accordance with NRC Regulatory Guide (RG) 1.200) or the RI-ISI application model) will be utilized in the Limerick alternate passive categorization process.

A. Clarify which Limerick PRA model (i.e., RG 1.200 or RI-ISI) will be utilized in the alternate passive categorization process. Include in this discussion whether this requirement is applicable to the full power internal events (FPIE) model.

B. Provide a summary of changes, if any, performed in the FPIE and IFPRA to support the alternate passive categorization method.

C. Section 4 of Nuclear Energy Institute (NEI) 00-04, 10 CFR 50.69, SSC Categorization Guideline, states the classification of SSCs with a pressure retaining function should be performed using the ASME Code Case N-660 or, as stated in RG 1.201, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to Their Safety Significance, alternatives that have received specific NRC approval for the 10 CFR 50.69 categorization program. Section I-3 of the Case N-660 states that indirect effects shall be assessed, and Section I-3.1.3(a)(4) provides high safety significant (HSS) criteria related to indirect effects. Sections I-3.0.1, I-3.1.1, and I-3.2.2 of the ANO-2-R&R-004, Revision 1 alternative pressure categorization state that indirect effects, which include spatial interactions such as pipe whip, jet spray, and loss-of-inventory effects (e.g., draining), be assessed in determining the SSCs categorization. During the NRCs audit, the licensee mentioned that indirect effects are addressed in the plants safety analyses. The NRC staff notes that the FPIE and IFPRA analysis usually may not explicitly incorporate indirect effects. For example, supporting requirement IFSN-A6, as updated by NRC endorsement in RG 1.200, at Capability Category II allows for qualitative assessment of flood induced mechanisms:

for the SSCs identified in IFSN-A5, IDENTIFY the susceptibility of each SSC in a flood area to flood-induced failure mechanisms. INCLUDE failure for submergence and spray in the identification process. ASSES qualitatively the impact of flood-induced mechanisms that are not formally addressed (e.g., using the mechanisms listed under Capability Category III of this requirement), by using conservative assumptions.

Further, the proposed EPRI methodology does not mention indirect effects.

Discuss how comprehensive the FPIE and IFPRA analysis is to model indirect effects (e.g., pipe whip, jet impingement, spray, inventory losses, etc.), and justify why it is adequate to support the 10 CFR 50.69 categorization process.

D. Discuss what pipe rupture frequency methodology is employed in the Limerick IFPRA, and justify why it is believed to be adequate to support the alternate passive categorization.

4 E. During the audit, the licensee stated that the Limerick IFPRA uses the EPRI Topical Report (TR) 002000079, Pipe Rupture Frequencies for Internal Flooding PRAs, Revision 3, for the pipe break frequencies. Provide an overview of the EPRI TR-002000079 report and discuss its basis.

Discuss both rupture frequencies and assumed break sizes.

Justify why it is adequate to support the 10 CFR 50.69 categorization process.

RAI Prerequisite No. 2 - Integrity Management Section 50.69(b)(2)(ii) of 10 CFR requires that a LAR include a description of the measures taken to assure that the quality and level of detail of the systematic processes that evaluate the plant for internal and external events during normal operation, low power, and shutdown are adequate for the categorization of SSCs. Section 50.69(b)(2)(iv) of 10 CFR requires that a LAR include a description of, and basis for acceptability of, the evaluations to be conducted to satisfy 10 CFR 50.69(c)(1)(iv). The SoC on 10 CFR 50.69(b)(2)(iv) of the Final Rule states that the licensee is required to include information about the evaluations they intend to conduct to provide reasonable confidence that the potential increase in risk would be small. The SoC further clarifies that a licensee must provide sufficient information to the NRC, describing the risk sensitivity study and other evaluations and the basis for their acceptability as appropriately representing the potential increase in risk from implementation of the requirements in the rule.

Section 3.1.3 of Enclosure 1 of the LAR states that the EPRI 3002015999 methodology is proposed as an alternate to the NRC-accepted ANO-2 R&R-004 method for SSC categorization. Section 4.1 of the EPRI document specifies prerequisites or requirements that must be met prior to implementing the methodology, including the requirement to have robust programs that address localized corrosion, flow-accelerated corrosion, and erosion.

Section 3.1.3 of Enclosure 1 of the LAR states that for Prerequisite No. 2, Limerick programs follow the guidance of all the references listed in the EPRI document. The NRC staff notes that there are other degradation methods (e.g., mechanical wear, fretting, fatigue, and stress corrosion cracking) that can impact the integrity of passive SSCs.

A. Provide justification that other passive component degradation mechanisms should not be addressed with regards to the components integrity.

B. Alternatively to Part (A), provide justification that the exclusion of these degradation mechanisms does not impact the passive categorization process.

RAI Prerequisite No. 3, Protective Measures for Internal Flooding Section 50.69(b)(2)(ii) of 10 CFR requires that a LAR include a description of the measures taken to assure that the quality and level of detail of the systematic processes that evaluate the plant for internal and external events during normal operation, low power, and shutdown are adequate for the categorization of SSCs. Section 50.69(b)(2)(iv) of 10 CFR requires that a LAR include a description of, and basis for acceptability of, the evaluations to be conducted to satisfy 10 CFR 50.69(c)(1)(iv). The SoC on 10 CFR 50.69(b)(2)(iv) of the Final Rule states that the licensee is required to include information about the evaluations they intend to conduct to provide reasonable confidence that the potential increase in risk would be small. The SoC

5 further clarifies that a licensee must provide sufficient information to the NRC, describing the risk sensitivity study and other evaluations and the basis for their acceptability as appropriately representing the potential increase in risk from implementation of the requirements in the rule.

Section 3.1.3 of Enclosure 1 of the LAR states for Prerequisite No. 1, that internal flooding protective measures, such as floor drains and sumps, will be considered low safety significant (LSS) (emphasis added) unless other evaluations determine the failure of these measures invalidate the LSS determination.

The NRC staff notes Section 4.1 of EPRI 3002015999, regarding internal flood protective measures (Prerequisite No. 3), states these measures shall not be categorized as LSS (emphasis added) unless they are evaluated and shown to not invalidate the HSS determinations provided in Section 4.2, Predetermined HSS Passive SSCs. It is unclear to the NRC staff how the Limerick approach is in alignment with the proposed EPRI alternate method.

A. Provide clarification how internal flooding protective measure SSCs will be categorized in the Limerick 10 CFR 50.69 categorization process. Include in this discussion how the Limerick approach is in alignment with the proposed EPRI alternate methodology.

B. If the Limerick process is not in alignment with the EPRI guidance, then provide justification that the Limerick approach does not impact categorization.

RAI Pre-determined HSS SSCs Criteria Section 50.69(b)(2)(ii) of 10 CFR requires that a LAR include a description of the measures taken to assure that the quality and level of detail of the systematic processes that evaluate the plant for internal and external events during normal operation, low power, and shutdown are adequate for the categorization of SSCs. Section 50.69(b)(2)(iv) of 10 CFR requires that a LAR include a description of, and basis for acceptability of, the evaluations to be conducted to satisfy 10 CFR 50.69(c)(1)(iv). The SoC on 10 CFR 50.69(b)(2)(iv) of the Final Rule states that the licensee is required to include information about the evaluations they intend to conduct to provide reasonable confidence that the potential increase in risk would be small. The SoC further clarifies that a licensee must provide sufficient information to the NRC, describing the risk sensitivity study and other evaluations and the basis for their acceptability as appropriately representing the potential increase in risk from implementation of the requirements in the rule.

Section 3.1.3 of Enclosure 1 of the LAR states that the EPRI 3002015999 methodology is proposed as an alternate to the NRC-accepted ANO-2 R&R-004 method for passive SSC categorization. Section 4.2 of the EPRI document provides criteria for identifying predetermined HSS SSCs.

A. Part (a) of the Criterion No. 1 specifies that the Class 1 portions of the reactor coolant pressure boundary can be categorized as LSS when the component failure allows the reactor to be shut down and cooled down in an orderly manner, assuming makeup is provided by the reactor coolant makeup system. It is unclear to the NRC staff what the Limerick definition/criteria for an orderly shutdown and cooldown (e.g., hot or cold shutdown) to be used in determining the applicability of Part (a).

Provide details on what constitutes an acceptable shutdown and cooldown in an orderly manner for the alternate pressure boundary method. Include in this discussion the

6 long-term requirement of the reactor coolant makeup system to achieve safe shutdown conditions.

B. Table 4-1 of EPRI 3002015999 appears to provide the basis for the list of predetermined HSS SSCs. The basis criteria appear to include consistency with the current (ANO-2) passive categorization process and industry insights from the RI-ISI program. Item Nos. 8 through 10 appear to rely on engineering judgement and experience. It is unclear to the NRC staff if the proposed alternate method is sufficiently comprehensive to identify all the necessary HSS SSCs given the apparent reliance on insights, judgements, and experience.

Provide justification that the EPRI determination of predetermined HSS SSCs is comprehensive and adequate to identify all SSCs that should be HSS.

C. Criterion No. 9 implies those passive heat exchangers whose failure does not allow reactor coolant to bypass primary containment can be categorized as LSS. It is unclear to the NRC staff if this criterion applies to all Limerick plant modes of operation.

i.

Provide clarification on the Limerick plant modes that will be included in the passive categorization process.

ii.

If not all Limerick plant modes are included in the passive categorization process, then provide justification that the exclusion of those Limerick plant modes does not adversely impact the categorization process.

D. Criterion Nos. 11, 12, and 13 provide several risk threshold values to determine when a passive SSC can be designated LSS. These three criteria refer to piping segments in determining the risk impact of piping failures. It appears the calculation of initiating event frequency (IEF) when estimating the risk contribution of piping components will be determined based on pipe segments. However, the methodology does not explain how piping segments3 will be defined when estimating its risk contribution. Consequently, the staff is unclear if the risk calculation will include the entire length of a passive system, those passive segments not screened as HSS (e.g., candidate LSS) based on the first ten criteria of the alternate method, or a smaller segment. In addition, with regards to Criterion Nos. 12 and 13, no justification is provided supporting the risk threshold values delineated in Figures 4-1 and 4-2. Hence, the NRC staff is unclear of the basis in choosing the risk threshold values for Criterion Nos. 12 and 13 and why they are appropriate for categorization of pressure-boundary SSCs. Lastly, it appears that the risk calculations only utilize the internal flooding PRA model.

The staff notes that other pressure boundary failure events, such as loss of coolant accidents (LOCAs), steam generator tube ruptures, main steam line breaks, and main feedwater line breaks are addressed in the internal events PRA model. It is unclear to 3 American Society of Mechanical Engineers (ASME) Code Case N-660, Risk-Informed Safety Classification for Use in Risk-Informed Repair/Replacement Activities,Section XI, Division 1, July 2002, defines a piping segment for categorization purposes

7 the NRC staff how the internal flooding PRA model can address candidate LSS SSCs associated with internal event pressure boundary failures. Therefore:

i.

Provide details of what constitutes a piping segment to be evaluated for Criterion Nos. 11, 12, and 13. If the definition differs from the NEI 00-04 endorsed definition, then include in this discussion a justification that the determination of piping segments does not adversely impact the categorization process.

ii.

Provide details of how the IEF will be determined for the passive SSCs being evaluated in either Criterion Nos. 11, 12, or 13. If the analysis includes the entire length of a passive system, then include in this discussion only those portions screened as LSS by Criterion Nos. 1 through 10 of the alternate categorization method, or a smaller segment.

iii.

Regarding Criterion Nos. 12 and 13, explain the basis for the risk threshold values of the proposed alternate pressure boundary categorization method.

Include in this discussion justification that these threshold values do not adversely impact the categorization process.

iv.

Provide clarification on what PRA hazard models are used to determine pressure boundary failure initiators associated with the three risk value criteria.

1. If the internal flooding PRA model is only used, then provide details and justification how the risk values of pressure boundary initiators not included in the internal flooding PRA will be calculated.

2. Alternatively to Part (1), provide justification that excluding the internal events PRA from the alternate method does not adversely impact the categorization process.

v.

During the audit, the licensee provided a list of internal flood scenarios that describe the flood type (i.e., spray, flood, or major flood), the flood area, and the system sources (e.g., fire protection and service water). The NRC staff understands that the internal flood PRA analysis allows this breakdown if there is a difference in plant impact, such as different SSCs impacted or operator action timing. However, the passive categorization process, as described in NEI 00-04, assesses the entire impact of a passive SSC. This process, for example, would include the aggregate spray, flood, and major flood impacts. It is unclear to the NRC staff how Criterion Nos. 11, 12, and 13, which appear to evaluate scenario specific risk, adequately evaluate the total risk associated with an SSC.

Therefore:

Either justify that splitting the impacts of a single passive SSC into multiple scenarios and evaluating on a single scenario basis adequately assesses the cumulative risk impact of that SSC for Criterion Nos. 11, 12, and 13; or explain how the licensee will ensure the alternate proposed method assesses the cumulative impact of a passive SSC.

E. Criterion No. 14 provides three considerations related to restraints or supports. The first consideration, 14.a, states that supports (for example, component support, hanger, or snubber) may remain uncategorized until a need is identified. Section 3.1.3 of

8 to the LAR states that the improved methodology represents a more efficient process since it is performed for all piping segments in the plant and not the system-by-system approach of the currently approved approaches. It is unclear to the NRC staff how the first consideration is in alignment with the entire plant analysis approach specified in the alternate method and what constitutes an identified need (for example, whether the associated supports of a passive non-safety related SSC categorized as HSS by the alternate method would be required to be categorized).

i.

Provide the criteria to determine when categorization of supports is required.

ii.

Provide justification that the exclusion of support categorization does not adversely impact plant safety.

E. Table 3-1 of the EPRI report lists a number of alternatives considered for alternate passive component categorization and identifies limitations and challenges associated of each of the considered alternatives. Some identified limitations include the need to address standby system pressure boundary failures and spatial effects.

Describe whether and how the self-identified limitations are addressed by the proposed alternate passive categorization methodology. If not addressed, then justify why they have no impact on the 10 CFR 50.69 categorization.

RAI Pressure Boundary Defense-In-Depth Section 50.69(b)(2)(ii) of 10 CFR requires that a LAR include a description of the measures taken to assure that the quality and level of detail of the systematic processes that evaluate the plant for internal and external events during normal operation, low power, and shutdown are adequate for the categorization of SSCs. Section 50.69(b)(2)(iv) of 10 CFR requires that a LAR include a description of, and basis for acceptability of, the evaluations to be conducted to satisfy 10 CFR 50.69(c)(1)(iv). The SoC on 10 CFR 50.69(b)(2)(iv) of the Final Rule states that the licensee is required to include information about the evaluations they intend to conduct to provide reasonable confidence that the potential increase in risk would be small. The SoC further clarifies that a licensee must provide sufficient information to the NRC, describing the risk sensitivity study and other evaluations and the basis for their acceptability as appropriately representing the potential increase in risk from implementation of the requirements in the rule.

Section 2.2 of Enclosure 1 to the LAR states that the licensee will either use the ANO-2 passive categorization method for Class 2 and 3 SSCs or will use the alternate method described in EPRI 3002015999. Section 3.1.2 of the same enclosure states that certain pressure boundary failure events will not be addressed by the alternate defense-in-depth method described in Pressurized Water Reactor Owners Group (PWROG)-20015-NP4 but, rather, will be assessed by the pressure boundary categorization process (e.g., either by the ANO-2 method or by the EPRI 3002015999 method).

Section 3.3.3 of the enclosure to the NRC safety evaluation of the ANO-2 alternate pressure boundary categorization process states licensee personnel will verify that assigning each segment to the LSS category is not contrary to maintaining defense-in-depth. While EPRI 3002015999 states that the alternate pressure boundary method addresses 4 PWROG-20015-NP, "Alternate 10 CFR 50.69 Defense-in-Depth Categorization Process," PA-RMSC-1769, Revision 0, March 2021.

9 defense-in-depth, insufficient information is provided in either the EPRI report or the LAR that explains how defense-in-depth is maintained for pressure boundary components classified as LSS.

The EPRI 3002015999 alternate pressure boundary method does not completely address defense-in-depth for all HSS considerations (e.g., passive candidate LSS SSCs). Therefore:

A. Provide justification for how each pressure boundary component that is categorized LSS is evaluated maintaining the defense-in-depth philosophy.

B. If the passive SSCs categorized as LSS are not evaluated for defense-in-depth, then provide justification that the exclusion of these SSCs from defense-in-depth consideration does not adversely impact the categorization process.

C. The NRC-accepted the ANO-2 R&R-004 method for SSC categorization describes a two-stage categorization process. In the first stage, PRA analyses (or a series of tables which are equivalent to PRA analyses) are used to identify HSS SSCs. In the second stage, licensee personnel re-evaluate the remaining potentially LSS segments. For each segment, qualitative considerations are addressed through a series of conditions or questions. The responses to these questions support the systematic determination on whether SSCs that are not assigned HSS by the quantitative PRA results should, nevertheless, be assigned HSS based on qualitative considerations. In contrast, the proposed alternate method does not appear to address any qualitative considerations.

Therefore:

i.

Provide justification that the exclusion of the ANO-2 R&R-004 qualitative criteria does not adversely impact the 10 CFR 50.69 categorization process.

ii.

Describe how those SSCs not explicitly modeled in the PRA are to be categorized.

D. During the audit, the licensee stated that if a pressure boundary SSC can fail a critical safety function, then it will be designated HSS. However, the staff notes that containment bypass scenarios (e.g., interfacing system LOCAs (ISLOCAs)) can result in the failure of the containment safety function. Table I-4 of the ANO-2 alternate pressure boundary process (also Code Case N-660) identifies containment bypass events based on failure type and number, resulting in High or Medium. ASME Code Case N-716-1 does not appear to take into consideration passive failures that lead directly to containment bypass. Section 6.2 of NEI 00-04 states that containment bypass events, such as ISLOCAs for boiling water reactors, are important challenges to large early release frequency (LERF) risk, and that the licensee should automatically designate an SSC as candidate HSS if it can initiate an ISLOCA.

Provide justification why specific guidance on containment bypass events, such as ISLOCAs, is not necessary for the alternate passive categorization.

E. Provide justification that passive SSCs whose failures could result in containment bypass should not be classified as candidate HSS.

10 RAI Sources of Uncertainty Sections 50.69(c)(1)(i) and 50.69(c)(1)(ii) of 10 CFR require that a licensees PRA be of sufficient quality and level of detail to support the SSC categorization process, and that all aspects of the integrated, systematic process used to characterize SSC importance must reasonably reflect the current plant configuration and operating practices, and applicable plant and industry operational experience.

The guidance in Section 5 of NEI 00-04, as endorsed by RG 1.201, Revision 1, stipulates identification of any applicable sensitivity studies to be used during the categorization process that are associated with the licensees choice of specific models and assumptions, as discussed in RG 1.174.5 The staff notes that the guidance in NEI 00-04 stipulates identification of any applicable sensitivity studies to be used during the categorization process that are associated with the licensees choice of specific PRA models and assumptions, to address uncertainty. The sensitivity studies are performed to ensure that assumptions and sources of uncertainty (e.g., human error, common cause failure, and maintenance probabilities) do not mask the importance of SSCs.

The approved ANO-2 methodology for categorization on passive pressure-retaining components is a consequence-based method and assumes a large pressure boundary failure.

In contrast, the alternative EPRI approach proposes to use the internal flooding PRA model with built-in initiating event frequencies, assumed pipe break sizes, screening of flooding sources and flooding scenarios, credit for drains, doors, and human actions. The PRA assumptions and sources of uncertainty could have an impact on the categorization results from the proposed alternative passive categorization method. The EPRI report does not discuss any consideration of PRA uncertainty. Therefore:

A. Discuss and justify how the proposed passive methodology considers PRA assumptions and sources of uncertainty and how is it consistent with the guidance of NUREG-1855.6 B. Provide a list of identified sources of uncertainty related to the proposed method. Include in this discussion how the Limerick categorization program will address these items.

RAI-08 -ISLOCA Flooding Considerations Section 50.69(b)(2)(ii) of 10 CFR requires that a LAR include a description of the measures taken to assure that the quality and level of detail of the systematic processes that evaluate the plant for internal and external events during normal operation, low power, and shutdown are adequate for the categorization of SSCs. Section 50.69(b)(2)(iv) of 10 CFR requires that a LAR include a description of, and basis for acceptability of, the evaluations to be conducted to satisfy 10 CFR 50.69(c)(1)(iv). The SoC on 10 CFR 50.69(b)(2)(iv) of the Final Rule states that the licensee is required to include information about the evaluations they intend to conduct to provide reasonable confidence that the potential increase in risk would be small. The SoC further clarifies that a licensee must provide sufficient information to the NRC describing the risk 5 U.S. Nuclear Regulatory Commission, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Regulatory Guide 1.174, Revision 3, January 2018 (ADAMS Accession No. ML17317A256).

6 https://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr1855/index.html

11 sensitivity study and other evaluations and the basis for their acceptability while appropriately representing the potential increase in risk from implementation of the requirements in the rule.

ISLOCA events do not seem to be typically incorporated in the internal flood analysis but could have an additional internal flood impact besides impacting water inventory and bypassing containment, as captured in the FPIE PRA. During the audit, the licensee demonstrated being below the risk thresholds of the proposed method by splitting the internal events ISLOCA sequence initiators on a system basis. Therefore:

A. Discuss how the Limerick FPIE model incorporates the internal flood aspect for the ISLOCA scenarios.

B. If not modeled, then provide justification that the exclusion of the internal flood impact of ISLOCA events does not adversely impact the 10 CFR 50.69 categorization.

C. Alternatively, to Part (B), propose a mechanism to ensure that the internal flood impact associated with ISLOCAs are incorporated into the Limerick FPIE model prior to using the alternate EPRI pressure boundary categorization method.

D. Provide justification for performing risk impact determination by splitting the ISLOCA scenario on a system basis. Justify why the approach does not impact the10 CFR 50.69 categorization.

RAIs on Defense-in-Depth RAI PRA Technical Adequacy Prerequisites Section 50.69(b)(2)(ii) of 10 CFR requires, in part, that a LAR include a description of the measures taken to assure that the quality and level of detail of the systematic processes that evaluate the plant for internal and external events during normal operation, low power, and shutdown are adequate for the categorization of SSCs.

Step 1.b of PWROG-20015-NP states the following:

Findings related to the following ASME/ANS RA-Sa-2009 PRA Standard []

technical areas must be closed or dispositioned as not impacting the categorization process:

1) Accident sequence analysis

2) Success criteria

3) Initiating event frequencies

4) Truncation

5) Common cause groupings A. The ASME/ANS 2009 PRA standard has other areas related to FPIE PRA, such as:

system analysis, data analysis, human reliability analysis and large early release.

Explain why the other technical elements in the PRA standard are not considered a prerequisite for the applying the proposed alternate defense-in-depth approach.

B. With regards to items 1 and 2, explain whether all supporting requirements under Accident Sequence and Success Criteria technical elements of the ASME/ANS-2009

12 PRA standard are considered a prerequisite. If not, then explain why they were not considered.

C. With regards to item 3, initiating event frequencies, explain whether all supporting requirements under the initiating events technical element of the PRA standard are considered a prerequisite.

D. Discuss whether and how future changes to the PRA standard will be taken into account.

E. If any relevant changes have been made to the PWROG-20015 guidance, then provide them on the docket for NRC staff review of its applicability to this LAR.

RAI Core Damage Defense in Depth Cutset Filtering Section 50.69(b)(2)(ii) of 10 CFR requires, in part, that a LAR include a description of the measures taken to assure that the quality and level of detail of the systematic processes that evaluate the plant for internal and external events during normal operation, low power, and shutdown are adequate for the categorization of SSCs.

A. Step 7.a of PWROG-20015-NP states the following with regards to cutsets filtering:

Filter to only cutsets that have an initiating event and a single basic event representing a failure of an SSC, including an independent failure, a common cause failure, or a human failure event (HFE) which leads to core damage. Ensure cutsets that include flags, split fractions, and other house or special events with an initiating event and a single basic event are not discarded.

Explain how the HFEs are taken into account and whether a recovery action could preclude a cutset from being screened in. If so, then explain how that conforms with RG 1.174, Revision 3 defense-in-depth guidance of not overly relying on human actions.

i.

Provide a review of Limerick PRA cutsets that meet the HSS thresholds for core damage defense in depth.

ii. Further discuss the criteria used for filtering the cutsets. Justify why the proposed method cutset filtering is adequate to assess all defense-in-depth aspects in determining significance.

B. PRA models have additional approximations, such as capacity factors, phenomenological events, and split fractions, built into the model. The ASME/ANS-2009 PRA Standard, regarding Supporting Requirement for Accident Sequence Analysis Index No. B3 (SR AS-B3), states that phenomenological conditions that impact the success of the system or function to be included in the models. The failure of an SSC directly attributed to an event (e.g., seismic or flooding) are failed by the initiating event basic event. During the audit, the licensee stated that certain elements (i.e.,

phenomenological events which may be related to the failure of SSCs) are ignored as basic events in the cutset screening. The treatment of these events is unclear to the NRC staff and may be inconsistent. Provide the basis for the proposed alternate method not crediting phenomenological failures as SSCs in the cutset review.

13 C. The considerations for maintaining defense-in-depth in RG 1.174 include preventing overreliance on programmatic activities (Consideration No. 2) and preserving sufficient defense against human errors (Consideration No. 6). The proposed method would only identify HSS categorization cutsets that went to core damage because of a failure of single operator action. Secondly, credit for repair or recovery in the PRA model would result in LSS categorization for SSCs that are in cutsets with repair and recovery actions. Therefore:

i.

Explain the type of recovery and repair actions credited in the Limerick PRA.

ii.

Explain and justify how the credit for recovery and repair actions in the PRA impacts the cutset screening (filtering) criteria for defense-in-depth and how it is consistent with the RG 1.174 defense-in-depth considerations.

iii.

Explain how the Limerick PRA models joint human error probabilities (JHEPs).

iv.

Explain and justify how the JHEP modeling impacts the cutset screening (filtering) criteria for defense-in-depth and how it is consistent with the RG 1.174 defense-in-depth considerations.

D. Based on audit discussions, the NRC staff understands that the proposed alternate categorization process categorizes SSCs as HSS only when there is no backup to the SSC failure (e.g., an initiator with only one SSC failure that leads to core damage is considered a single point failure). The licensee clarified during the audit that this method performs its analysis at the SSC level and not the functional level. Section 6.1 of NEI 00-04 performs the defense-in-depth analysis at the functional level in order to identify all the SSCs that support that function (i.e., safety-critical functions) and what events can cause their simultaneous failure. For example, a loss of alternating or direct current bus initiator or a loss of service water cooling initiator can leave one train available for the injection function and a separate train available for the cooling function and would result in HSS categorization for both trains.

Provide justification for events that leave only one SSC available for the required functions to avoid core damage are not designated as HSS.

E. Step 7.a.2 of PWROG-20015-NP states, with regards to common cause failures (CCFs),

Common cause failure groups that are greater than or equal to four can be screened out of the filtered cutsets. During the regulatory audit, the licensee explained that a CCF of 4 or more components is screened out of the filtered cutsets, but a failure of 2 or 3 components out of a group of 4 or more is maintained in the filtered cutsets for defense-in-depth. The rationale provided during the audit was that a CCF of 3 components or less is included in the filtered cutsets to maintain consistency with the guidance in the NEI 00-04 defense-in-depth matrix, which required 3 trains or less as a function of the frequency of the initiating event. The NRC staff notes that the defense-in-depth matrix appears to be at the system train level, which assumes 100 percent train capacity for mitigation, while CCF groups may not map directly to system trains. Therefore:

i.

Provide a list of SSCs modeled in the Limerick PRA that have four or more SSCs in their common cause grouping.

14 ii.

Provide justification for excluding from the filtered cutsets those containing basic events that represent CCFs of 4 or more components.

F. Step 7.b of PWROG-20015-NP states, with regard to cutset quantitative screening, Cutsets with initiating events with frequencies that are less than 1E-04 per year are not included in the alternate core damage defense-in-depth categorization process and can be screened out of the filtered cutsets. During the audit, the licensee provided a list of several internal flood initiators associated with the same system, such as the battery room area, which were split based on their flooding type (e.g., spray, flood, major flood).

It is unclear how the proposed method assesses the defense-in-depth impact of a specific SSC if the combined IEF of their associated scenarios for a specific hazard (e.g., internal flooding and fire) is above the 1E-04 per year threshold.

i.

Discuss whether and how uncertainty in initiating event frequency is taken into account in the alternate defense-in-depth categorization.

ii.

Discuss how it is assured that initiating events would not be split into multiple initiating events of lower frequencies.

iii.

List all initiating events in the Limerick PRA that have an initiating event frequency less than 1E-4 per year.

iv.

Discuss how the proposed method considers the cumulative defense-in-depth impact of a specific SSC when its associated individual scenario IEFs are below the 1E-04 per year threshold.

G. Step 7.f of PWROG-20015-NP states, Consistent with the existing NEI 00-04 defense-in-depth process, SSCs and functions outside the scope of the PRA do not need to be evaluated for core damage defense-in-depth since the level of defense-in-depth is based on the success criteria in the PRA.

i.

Per NEI 00-04, defense-in-depth is to be applied to all SSCs, not only those modeled in the PRA. Therefore, please justify the statements in Step 7.f.

ii.

For Limericks categorization performed using NEI 00-04 guidance, discuss whether there were any SSCs not modeled in the PRA but marked HSS by the NEI 00-04 defense-in-depth approach. If so, then describe them.

H. As a potential sensitivity study, explain the impact on the results of the categorization if the screening criterion was increased to two or three elements (i.e., basic events) for both core damage and containment defense-in-depth cases.

RAI Defense-in-Depth First Order Core Damage Cutset Approach Section 50.69(b)(2)(ii) of 10 CFR requires that a LAR include a description of the measures taken to assure that the quality and level of detail of the systematic processes that evaluate the plant for internal and external events during normal operation, low power, and shutdown are adequate for the categorization of SSCs. Section 50.69(b)(2)(iv) of 10 CFR requires that a LAR include a description of, and basis for acceptability of, the evaluations to be conducted to satisfy10 CFR 50.69(c)(1)(iv). The SoC on 10 CFR 50.69(b)(2)(iv) of the Final Rule states that the licensee is required to include information about the evaluations they intend to conduct to

15 provide reasonable confidence that the potential increase in risk would be small. The SoC further clarifies that a licensee must provide sufficient information to the NRC, describing the risk sensitivity study and other evaluations and the basis for their acceptability as appropriately representing the potential increase in risk from implementation of the requirements in the rule.

Sections 2.1.1.2 and 2.1.2.3 of RG 1.174 provide seven considerations of proposed licensing changes regarding defense-in-depth. The first consideration, Preserve a reasonable balance among the layers of defense, states the licensing change should not significantly reduce the effectiveness of a layer of defense. The fifth consideration, Maintain multiple fission product barriers, states the change should not significantly reduce the effectiveness of these barriers.

Section 3.1.2, Alternate Defense-in-Depth Categorization Process, of the LAR states that cutsets having an initiating event and a single basic event representing either an SSC, CCF, or HFE are to be evaluated for defense-in-depth categorization. It continues by stating that this process meets defense-in-depth guidance Is discussed in PWROG-20015-NP. Section 2.2.5 of the PWROG guidance states that a reasonable balance among the layers of defense is achieved in this method in that there is a reasonable confidence that SSCs will remain capable of performing their safety-related functions.

Regarding fission product barriers, the guidance implies that the method maintains reasonable confidence that the barriers will perform their safety-related functions. The defense-in-depth approach is to ensure that there are multiple layers (e.g., alternate success paths) of mitigation in responding to an event and that the failure of one layer is usually represented by a single basic event. To provide a reasonable balance assessment, a licensee should evaluate all the layers in context of responding to an event, such as redundancy and diversity (no common cause failures across the layers of defense). The single basic event approach (first order cutset) would either identify single point failures that represent a lack of defense-in-depth or common cause failure of several components that represent a lack of diversity. The layered approach of defense-in-depth would be represented by cutsets with two or more basic events.

It is unclear to the NRC staff the basis for why this approach is adequate for defense-in-depth categorizations. Table 4 of the LAR supplement dated May 5, 2021, regarding functions identified as HSS by the alternate method, lists the low-pressure core injection (LPCI) mode and suppression pool cooling mode of the residual heat removal system and providing air or gas to the automatic depression system (ADS) relief valves or other steam relief valves. These are backup functions to the other functions (e.g., feedwater, reactor core isolation cooling (RCIC),

and high-pressure injection (HPCI)) that would normally require failure first. Therefore, the associated accident sequences for these functions would be represented in two or more ordered cutsets. It is unclear to the staff how these functions were determined to be HSS by the first order method of the alternate approach.

Therefore, the NRC staff requests the following:

A. Clarify if the intent of the alternate defense-in-depth method is to assign candidate HSS to SSCs that provide only one layer of defense to an event (e.g., no defense-in-depth exists).

B. RG 1.174, Revision 3, states that risk-informed implementation changes are permitted for small increases in risk when the maintenance of sufficient defense in depth is reasonably assured. Item 3 of Section 2.2.5 of PWROG-20015-NP, Revision 1, states that regarding compliance with RG 1.174, system redundancy, independence, and

16 diversity are preserved since no system design modifications are made by the proposed alternate method. The NRC staff notes that RG 1.174 states that the preservation is in the context of the expected frequency and consequences of challenges to the system.

The PWROG method appears to consider the frequency of challenges; however, it does not appear to consider the reliability of systems responding to those challenges. During the audit, the licensee stated that the proposed use of first order cutsets (i.e., those with a single SSC failure) is consistent with the safety analysis single failure criterion (i.e., core damage or large early releases can be avoided for design events and one SSC failure).

Sections 6.2.1.1.3.3 (regarding containment accident response analysis) and 6.3.1.1.2 (regarding core damage) of the Limerick updated final safety analysis report (UFSAR) appear to demonstrate the need for multiple layers of SSCs in responding to design accidents. For example, Case A analysis in Section 6.2.1.1.3.3.1.6 (regarding long-term accident responses) assumes the availability of HPCI, core spray, and all LPCI pumps.

With regards to emergency core cooling system scenarios, Part d of Section 6.3.1.1.2 has combinations of LPCI, core spray, ADS, and HPCI with some systems having a multiple loop requirement.

As shown in Figure 6-1 of NEI 00-04, not all layers of defense-in-depth should be categorized as HSS. However, it is unclear to the NRC staff why only SSCs that provide one layer of defense-in-depth are categorized as HSS, especially when there is no apparent reliability consideration in the proposed alternate method (e.g., SSCs with high failure rates such as the shared function of the safety-related HPCI train and non-safety RCIC train). Therefore:

i.

Provide justification on how the first order cutset meets the RG 1.174 requirement to identify essential SSCs that preserve the required level of defense-in-depth based on challenges to the responding systems.

ii.

Provide justification how the first order cutset criterion takes into consideration the reliability of systems in determining the number of layers of defense-in-depth in responding to plant challenges. Include in this discussion how the proposed approach is consistent with the Limerick UFSAR in identifying the required number of layers of defense-in-depth for design events.

iii.

Explain how the reliability of each layer of defense-in-depth is taken into consideration by the proposed method. Include in this discussion justification why an SSC is not categorized as HSS when it has only one backup to avoid core damage is an SSC with significant unavailability and reliability.

C. The NRC staff notes the licensees demonstration of the alternate defense-in-depth method presented during the audit identified approximately 34 cutsets in what appeared to be in the 1E-11 per year core damage frequency range. A typical PRA analysis quantitatively results in thousands of cutsets in the 1E-11 range, which are usually not in the top 100 high frequency contributors to core damage frequency range and, therefore, not risk-significant. It is unclear to the NRC staff how the proposed method uses risk significant cutsets when identifying HSS SSCs. Provide justification how the proposed method incorporates risk-significant cutsets in its categorization process. Include in this

17 discussion why there are no apparent specified consideration of the most risk significant cutsets (i.e., 1E-06 to 1E-07 per year) in the proposed method.

D. Defense-in-depth consideration Item 3 of RG 1.174 states that diversity is accomplished by having equipment that performs the same function rely on different attributes, such as different principles of operation, different physical variables, different conditions of operation. It further states that diversity is required when high availability and reliability of a function is required so that a single design feature does not fail that function.

Section 2.2.5 of PWROG-20015-NP states that the diversity requirement is not impacted since there are no plant modifications resulting from the categorization.

i.

Provide details of how the proposed method identifies and assesses the defense-in-depth diversity requirement for risk-significant scenarios.

ii.

Provide justification that this method meets the RG 1.174 consideration of preserving system redundancy, independence, and diversity commensurate with the expected frequency and consequences of challenges to the system, including consideration of uncertainty.

E. Table 4 of the LAR supplement dated May 5, 2021, provides the functions identified as HSS by the alternate method, including the low-pressure core injection mode and suppression pool cooling mode of the residual heat removal system and providing air or gas to the automatic depression system relief valves or other steam relief valves. These functions appear to be backup or support functions to other primary functions (e.g.,

feedwater, reactor core isolation cooling, and high-pressure injection). Therefore, it appears the associated accident sequences for these functions would be represented in cutsets with two or more basic events. It is unclear to the NRC staff how these functions were determined to be HSS by the first order method of the alternate approach.

Explain and justify how the functions provided in Table 4 of the supplement dated May 5, 2021, were determined by the alternate method using first order cutsets.

F. Tables 3 and 5 of LAR supplement dated May 5, 2021, provide 11 functions that were categorized as LSS by the proposed alternate defense-in-depth, which were previously identified as HSS based on the NEI 00-04, Chapter 6, Defense-in-depth Assessment.

Three of the functions appear to have changed to LSS because of the alternate core damage defense-in-depth methodology. These include one function for each of the following systems: core spray, reactor enclosure heating, ventilation, and air conditioning, and control enclosure heating, ventilation, and air conditioning. The LAR supplement states that sufficient redundancy and diversity exists. For each of these three functions, provide a summary of the available redundancy and diversity. Discuss the categorization results based on NEI 00-04. Explain whether the listed diversity is credited in the Limerick design basis.

G. RG 1.174, Revision 3, Section C.2.1.1.3, Evaluating the Impact of the Proposed Licensing Basis Change on Defense in Depth, states that to address the unknown and unforeseen failure mechanisms or phenomena, the licensees evaluation of this defense-in-depth consideration should also address insights based on traditional engineering approaches. Results and insights of the risk assessment might be used to support the conclusion; however, the results and insights of the risk assessment should not be the only basis for justifying that this defense-in-depth consideration is met. The

18 licensee should consider the impact of the proposed licensing basis change on each of the layers of defense.

Explain how the proposed defense-in-depth methodology addresses this aspect of RG 1.174, Revision 3.

H. RG 1.174 Defense-in-Depth Consideration Item No. 1, reasonable balance among the layers of defense, states that the context of layers of defense is to prevent any events from progressing to core damage. Section 6.1 of NEI 00-04, regarding core damage defense-in-depth, states that internally initiated design basis events considered in the licensees safety analysis report are to assess their appropriate defense-in-depth requirements for categorization. The NRC staff notes that Section 8.3.2.1.1.2 of the Limerick UFSAR identifies other design basis event fires (e.g., safe shutdown and station blackout). Section 7.1.2.7.11 of the UFSAR states that electrical train system separation is based on credible events, such as pipe ruptures and fires, and Section 7.3.2.1.2.2.3 addresses the fire protection system and its design basis.

Section 2.2.2 of PWROG-20015-NP states that only the FPIE PRA model is used for the proposed alternate method. It is unclear to the NRC staff why this method excludes other hazard PRA models (e.g., internal flooding, fire) when they represent events that lead to core damage.

Provide justification that the exclusion of other hazard PRA models from the alternate defense-in-depth method is consistent with the RG 1.174 defense-in-depth consideration of addressing any event that leads to core damage and the NEI 00-04 requirement for internally initiated design related events.

RAI Defense-in-Depth First Order Large Early Release Cutset Approach and Screening Section 50.69(b)(2)(ii) of 10 CFR requires that a LAR include a description of the measures taken to assure that the quality and level of detail of the systematic processes that evaluate the plant for internal and external events during normal operation, low power, and shutdown are adequate for the categorization of SSCs. Section 50.69(b)(2)(iv) requires that a LAR include a description of, and basis for acceptability of, the evaluations to be conducted to satisfy 10 CFR 50.69(c)(1)(iv). The SoC on 10 CFR 50.69(b)(2)(iv) of the Final Rule states that the licensee is required to include information about the evaluations they intend to conduct to provide reasonable confidence that the potential increase in risk would be small. The SoC further clarifies that a licensee must provide sufficient information to the NRC, describing the risk sensitivity study and other evaluations and the basis for their acceptability as appropriately representing the potential increase in risk from implementation of the requirements in the Rule.

Sections 2.1.1.2 and 2.1.2.3 of RG 1.174 provide seven considerations of proposed licensing changes regarding defense-in-depth. The first consideration, Preserve a reasonable balance among the layers of defense, states the licensing change should not significantly reduce the effectiveness of a layer of defense. The fifth consideration, Maintain multiple fission product barriers, states the change should not significantly reduce the effectiveness of these barriers.

Section 3.1.2 of Enclosure 1 to the LAR states that the process used for core damage defense-in-depth is the same as the one used for containment defense-in-depth with the exception that the FPIE LERF PRA model will be used as discussed in PWROG-20015-NP, and each system categorized continues using the guidance in NEI 00-04, Section 6.2, Long-Term

19 Containment Integrity. Section 2.2.5 of the PWROG guidance states that a reasonable balance among the layers of defense is achieved in this method because there is a reasonable confidence that SSCs will remain capable of performing their safety-related functions.

Regarding fission product barriers, the method is stated to maintain reasonable confidence that the barriers will perform their safety-related functions.

A. Step 8.b.1 of the PWROG guidance states to only filter cutsets with a single basic event (e.g., SSC failure, CCF, or HFE) that leads to containment failure. The NRC staff notes that core damage cutsets that lead to a plant damage state proceeding to a large early release event usually contains more than one failure: typically, at least one failure leading to core damage and one failure related to loss of containment. It is unclear to the NRC staff if the containment defense-in-depth approach applies the filtering process to the core damage cutset failures or to the containment-related failures. During the audit, the licensee clarified that only basic events representing failures that resulted in both core damage and large early release would be screened for HSS consideration.

The Limerick pilot of the proposed alternate method did not identify any SSCs as HSS for the containment defense in depth. Provide justification that the proposed method for defense-in-depth is in accordance with the seven defense-in-depth considerations of RG 1.174, with particular emphasis on items 1 (i.e., preserve reasonable balance among the layers of defense) and 5 (i.e., maintain multiple fission product barriers).

B. The single basic event approach (first order cutset) will either identify single point failures that represent a lack of defense-in-depth or common cause failure of several components that represent a lack of diversity. The layered approach of defense-in-depth would be represented by cutsets with two or more basic events. It is unclear to the NRC staff the basis of why this approach is adequate for defense-in-depth categorizations.

i.

Clarify if the intent of the alternate defense-in-depth method is to assign candidate HSS to SSCs that provide only one layer of defense to an event (e.g., no defense-in-depth exists).

ii.

Regarding SSCs that have only one back-up function that is not diverse, explain and justify why the SSC should not be categorized as HSS. Include in this discussion how this explanation is in accordance with the seven defense-in-depth considerations of RG 1.174.

iii.

With regards to the answer to Parts i and ii above, provide justification that this approach does not adversely impact the categorization process.

C. Step 8.b.2.a of the PWROG guidance states that cutsets with IEFs less than 1E-04 per year may be screened from the alternate defense-in-depth approach. Section 6.2 of NEI 00-04 provides guidance for considering containment bypass events, such as ISLOCAs, in determining passive SSC categorization. Containment bypass events usually have an IEF < 1E-04/year, yet they are significant contributors to LERF risk since they bypass the containment. Therefore:

i.

Describe how the alternate containment defense-in-depth approach assesses containment bypass events. Include in this discussion the treatment of cutsets that do not contain a containment-related SSC failure that was not part of the core damage cutset.

20 ii.

Provide justification that the screening of a containment bypass events associated with an IEF < 1E-04/year is consistent with the seven defense-in-depth RG 1.174 considerations. Include in this discussion how the third layer of defense for public health and safety is bypassed.

D. The guidance on containment defense-in-depth in Chapter 6 of NEI 00-04 contains the following questions to decide whether SSCs are to be HSS that address containment isolation:

Does the SSC support containment isolation for containment penetrations that are:

o directly connected to containment atmosphere, and o > 2 inches in diameter, and o not locked closed or only locally operated?

Does the SSC support containment isolation for containment penetrations that are:

o part of the reactor coolant system pressure boundary, and o > 3/8 inches in diameter, and o not locked closed or only locally operated?

Describe how the containment penetrations are modeled in the Limerick PRA. Describe whether and, if yes, how the above considerations on containment isolation defense-in-depth from NEI 00-04 are addressed by the new proposed alternate defense-in-depth.