ML23053A156
| ML23053A156 | |
| Person / Time | |
|---|---|
| Site: | Limerick  |
| Issue date: | 02/23/2023 |
| From: | Audrey Klett Plant Licensing Branch 1 |
| To: | Constellation Energy Generation |
| Sreenivas V, NRR/DORL/LPLI, 415-2597 | |
| References | |
| EPID L-2021-LLA-0042 | |
| Download: ML23053A156 (1) | |
Text
LIMERICK GENERATING STATION 10 CFR 50.69 ALTERNATE PROCESSES LICENSE AMENDMENT REQUEST PRELIMINARY PARTIAL DENIAL U.S. Nuclear Regulatory Commission Office of Nuclear Reactor Regulation
2 Licensees Proposed Processes
- In 2018, NRC issued the Limerick 50.69 amendment that uses endorsed NEI 00-04 process (ML18165A162)
- Alternate defense-in-depth categorization process
- Alternate pressure boundary categorization process
- Alternate seismic categorization process
3 Purpose and Agenda
- Purpose
- Discuss NRCs basis for a preliminary partial denial of the LAR
- Agenda
- Morning session: pressure boundary components (PBC) process
- Afternoon session: defense-in-depth (DID) process
- After the meeting
- NRC staff will consider the discussion from todays meeting
- NRC staff will inform licensee of intent to pursue denial or other action
4 Summary of Preliminary Denial Basis
- Pressure Boundary Categorization (PBC) Process
- Appears to lack technical justification for list of HSS SSCs
- Appears to have inconsistent risk criteria
- Defense-in-Depth (DID) Categorization Process
- Appears to have inconsistent and lack of correlation to layers of defense
- Appears to inappropriately default to using the IDP and engineering teams to compensate for the reduced rigor in the proposed DID categorization process
- Appears to have insufficient basis for treatment of common cause failures
- Appears to have unjustified mixed use of DID processes
5 PRESSURE BOUNDARY CATEGORIZATION PROCESS
6 Preliminary Denial of Proposed PBC Process Proposal does not appear to have sufficient technical justification for meeting 10 CFR 50.69(c)(1)(ii-iv)
- (ii) does not provide reasonable confidence that the all aspects of the proposed methodology reasonably reflect the current plant configuration and operating practices, and applicable plant and industry operational experience
- (iii) does not maintain DID
- (iv) does not provide reasonable confidence that sufficient safety margins are maintained and that any potential increases in CDF and LERF are small for RISC-3 SSCs Proposal does not appear to have sufficient technical basis for 1.
Allowing many ASME Class 1 SSCs to be LSS 2.
Classifying smaller piping as LSS 3.
Allowing redundant SSCs in the UHS to be designated as LSS 4.
Demonstrating quantitative consequence 5.
Addressing uncertainties and changes in pipe break frequencies Could result in mis-categorizing many SSCs as LSS RAI response and pilot categorization did not appear to address technical questions
7 Issue 1: Insufficient technical basis for allowing many ASME Class 1 SSCs to be LSS Proposed criteria 1, 2, 11-14 provide a process that can result in many ASME Class 1 SSCs to be categorized as LSS and does not appear to have sufficient technical basis, which would be inconsistent with 50.69(c)(1)(ii)
Basis does not appear to demonstrate that these categorizations reasonably reflect the current plant configuration and operating practices as per 50.69(c)(1)(ii)
Miscategorizing Class 1 components as LSS could challenge fission product release barrier function of components (e.g., critical defense in depth function of said components), which is inconsistent with 50.69(c)(1)(iii) requirement to maintain defense in depth
8 Issue 1 (continued)
- The proposed categorization process uses several criteria for defining SSCs as LSS consistent with approach from some RI-ISI programs (ASME Code Cases N-716-1 or 2)
- While these criteria are sufficient for RI-ISI programs, they do not appear to be technically sufficient for the reduction in regulatory treatment allowed under 50.69 HSS and LSS are used differently in RI-ISI and 50.69 (e.g., HSS and LSS are used to prioritize examinations for RI-ISI rather than reduce regulatory treatment, such as that allowed under 50.69)
RI-ISI program has different requirements than 50.69 RI-ISI basis is not commensurate with 50.69 treatments (e.g., insufficient basis to support 50.69(c)(1)(ii)
- ASME Code Cases N-660, Risk-Informed Safety Classification for Use in Risk-Informed Repair/Replacement Activities, and N-662-1, Alternative Repair/Replacement Requirements for Items Classified in Accordance With Risk-Informed Processes, are conditioned in RG 1.147 (50.55a) to only be applicable for ASME Class 2 and 3 SSCs
9 Issue 1 (continued)
- Many ASME Class 1 SSCs are categorized as LSS in Tables 1 and 2 of RAI response dated June 30, 2022
- If designated as LSS, these SSCs would be subject to reduced regulatory treatment under 50.69, which could reduce reliability and challenge the integrity of reactor coolant boundary (50.69(c)(1)(iii))
10 Issue 2: Insufficient technical basis for classifying small diameter piping as LSS
- Proposed criteria 3 and 4 could result in many small SSCs with high CCDPs to be misclassified as LSS and, therefore, appear to be inconsistent with the 50.69(c)(1)(ii) requirement that the categorization process must determine SSC functional importance using an integrated, systematic process
- The proposed process does not appear to have a basis to adequately reflect the current plant configuration and operating practices per 50.69(c)(1)(ii)
- Small SSCs have historically had more failures than larger SSCs, so categorizing small diameter but high-CCDP SSCs as LSS could have a significant safety impact (not accounted for in the process)
11 Issue 2 (continued)
- Proposed process appears to be inconsistent with 50.69(c)(1)(iii)
-Proposed criteria 3 and 4 would allow SSCs smaller than nominal pipe size 4 to be designated LSS but does not consider the relative CCDPs for different SSCs
-Therefore, this process could result in many high-CCDP piping SSCs being categorized as LSS (e.g., inappropriately degrading defense-in-depth function of components)
12 Issue 3: Insufficient technical basis for not preserving system redundancy
- Proposed criterion 5 allows SSCs in the ultimate heat sink (UHS) flow path whose failure would not fail both trains of the UHS to be categorized as LSS
- This appears to have insufficient technical basis for applying reduced regulatory treatment to redundant SSCs allowed under 50.69
- Applying the reduced regulatory treatment allowed by 50.69 on such SSCs could reduce the reliability of both trains of the UHS and must be systematically addressed
- Categorizing redundant components, which may have high CCDPs, as LSS solely due to their redundancy appears inconsistent with 10 CFR 50.69(c)(1)(ii)
13 Issue 3 (continued)
- Reducing the regulatory requirements for both trains of the UHS flow path could simultaneously reduce the reliability of both trains and possibly challenge the safety function and fission product release barrier function of components (e.g., critical defense-in-depth function of said components), which are inconsistent with 50.69(c)(1)(iii) requirement to maintain defense in depth
14 Issues 4 and 5: Insufficient technical basis for quantitative consequence and uncertainty
- The proposed process appears to be lacking a risk-informed requirement
- High consequence failures with respect to DID and safety margins are not addressed
- Technical bases for the thresholds do not appear to be clearly defined
- Technical bases do not appear to take uncertainty into account
15 Issue 4: Insufficient technical basis for quantitative consequence
- Proposed criteria 11-13 could miscategorize the significance of SSCs by not considering consequences from
- insufficient justification for the development of risk thresholds for CDF (LERF) and CCDP (CLERP)
- pipe ruptures, such as failures in passive components not modeled in PRA and protective measures which is required by 50.69(c)(1)(ii)
- passive SSC failures (e.g., smaller piping may be screened out of the internal flooding PRA because it is not a source of flooding)
- deterministic cases of lower contribution to overall CDF/LERF with relatively high consequence of a single failure (e.g., challenging 50.69(c)(1)(iii))
16 Issue 4 (continued)
- Proposed numerical criteria for PBC thresholds
- Do not appear to be supported with a justification that (1) describes the quantitative consequences to risk metrics and (2) manages overall plant risk from classifying certain components as LSS
- Do not appear to have sufficient bases for defining thresholds for risk metrics for HSS SSCs:
- Threshold for contribution to CDF of 1E-6 does not appear to capture any SSCs as HSS because individual contributions to CDF are generally lower than 1E-6
- Appear to presuppose LSS categorization for components not modeled in the PRA and not covered in the ten deterministic criteria (e.g., insufficient basis to support 50.69(c)(1)(ii) requirements)
17 Issue 5: Insufficient technical basis for not addressing uncertainties and changes in pipe break frequencies
- By using PRA, proposed criteria 11-13 would categorize passive components as LSS and introduce pipe break frequencies into the categorization process
- This process could introduce a potential significant source of uncertainty not considered in the categorization
- As passive components are categorized as LSS and subject to the reduced regulatory treatment allowed under 50.69, pipe break frequencies could increase
- Proposed process appears to not have sufficient justification for categorization of passive SSCs
- Does not assess the impact on overall CDF and LERF from all candidate passive RISC-3 SSCs to meet the requirements of 50.69(c)(1)(iv)
- Does not cover the potential increase in pipe break frequency and the effects on risk from reducing regulatory treatment (per 50.69) of ASME Class 1 SSCs or SSCs with a high CCDP
18 DEFENSE-IN-DEPTH CATEGORIZATION PROCESS
19 Preliminary Denial of Proposed DID Process
- Proposed process does not appear to have sufficient technical justification for meeting 50.69(c)(1)(ii) and (iii):
- (ii) does not appear to support an integrated and systematic 50.69 categorization process
- (iii) does not appear to provide reasonable confidence that adequate DID is maintained
- Proposed process could result in mis-categorizing SSCs 1.
Inconsistent or lack of correlation to layers of defense 2.
Inappropriately defaults to using the IDP and engineering teams to compensate for reduced rigor in the proposed DID categorization process 3.
Insufficient basis for treatment of common cause failures 4.
Unjustified mixed use of DID processes
20 Issue 1: Inconsistent or lack of correlation to layers of DID
- Proposed process does not appear to provide reasonable confidence that adequate DID is maintained and, therefore, does not meet 50.69(c)(1)(iii)
- Considering two or more failures within a cutset as representing independent layers of DID could miss basic elements within a cutset that have a common (and dependent) layer of DID
- For example: for high pressure coolant injection and reactor core isolation cooling and automatic depressurization system failures, two steam-driven trains and vessel depressurization have identical pathways for reactor pressure vessel inventory control
21 Issue 1 (continued)
- Counting two basic events appears to not provide any confidence on the robustness of DID process
- Basic events in PRA models generally reflect equipment failures, common cause failures, failures of operator actions, and other modeling assumptions and simplifications that could be dependent on the modeling style of the PRA modeling engineer
- Variations in PRA modeling approaches could result in inconsistent or erroneous categorization results
22 Issue 1 (continued)
- In contrast, the NEI 00-04 DID approach assesses the remaining capability without providing credit for any function/SSC that has been proposed as LSS or for any identical, redundant SSCs within the system that are also classified as LSS
- Solely using PRA models as a surrogate for deterministic DID could overlook the impact of non-PRA modeled SSCs that might have a contribution to higher risk scenarios
23 Issue 2: Inappropriate compensation for reduced rigor Proposed process could inappropriately use the IDP and engineering team as a safeguard (or to compensate) for inadequacies in the DID categorization process Proposed DID process defaults to LSS categorization unless SSCs are explicitly identified as HSS by the PRA cutset screening approach Process has potential to result in significantly more candidate LSS SSCs that need to be evaluated by the IDP and engineering team The IDP may be able to intervene and change categorization of SSCs miscategorized as LSS; however, given the anticipated large number of LSS SSCs, proposed process has the potential to overload the IDP and introduce errors during categorization
24 Issue 2 (continued)
- The existing guidance for IDP repeats DID considerations from RG 1.174; no further guidance is provided; notes that the DID considerations are implicit in the risk categorization process
- The proposed process has the potential to overload IDP and has the potential to introduce errors during categorization
- Example: Response to RAI-11.F identifies several SSCs not modeled in PRA and previously categorized as HSS, which would not be captured by the proposed alternate DID and, therefore, would default to LSS categorization
25 Issue 3: Inadequate basis for treatment of common cause failures
- Proposed process would exclude, from HSS categorization, cutsets that contain CCF events comprising of 4+ SSCs within the common cause component grouping (CCCG)
- However, each SSC failure event within a CCCG may not represent a standalone independent layer of DID
- Existing approved process (NEI 00-04, Revision 0, Chapter 6) excludes like components for remaining capability in DID categorization (i.e., it does not allow credit for any identical, redundant SSCs within the system that are classified as LSS)
26 Issue 4: Unjustified mixed use of DID categorization methodologies Proposed process appears to not have sufficient justification for why using apparently unrelated processes results in an integrated and systematic 50.69 categorization process Licensee proposed to retain the existing NEI 00-04 DID methodology for use on categorizing SSCs, along with the proposed alternate DID process Opposite approaches to DID could introduce errors or inconsistencies in categorization
- NEI 00-04 DID approach assumes HSS unless proven otherwise in an individual matrix evaluation based on deterministic factors
- Alternate DID approach assumes LSS unless proven otherwise in a one-time PRA based evaluation Existing and proposed categorization processes are performed at different points in the categorization procedure, which could introduce inconsistency if performed together
27 Next Steps
- NRC staff will consider the discussion from todays meeting
- NRC staff will inform licensee of intent to pursue denial or other action
28 Abbreviations 50.69 10 CFR 50.69 LERF large early release frequency ASME American Society of Mechanical Engineers LSS low safety-significant CCCG common cause component group NEI Nuclear Energy Institute CCDP conditional core damage probability NRC U.S. Nuclear Regulatory Commission CCF common cause failure PBC pressure boundary categorization CDF core damage frequency PRA probabilistic risk assessment CFR Code of Federal Regulations RAI request for additional information DID defense-in-depth (or defense in depth)
RI-ISI risk-informed inservice inspection HSS high safety-significant RISC risk-informed safety class IDP Integrated decision-making panel SSC structure, system, and component LAR license amendment request UHS ultimate heat sink