ML25091A093
| ML25091A093 | |
| Person / Time | |
|---|---|
| Site: | Electric Power Research Institute |
| Issue date: | 04/01/2025 |
| From: | Division of Operating Reactor Licensing |
| To: | Electric Power Research Institute |
| References | |
| EPRI TR 3002025288, EPID L-2023-TOP-0031 pre-app, EPID L-2023-TOP-0045 pre-fee, EPID L-2023-NTR-0008 post-fee | |
| Download: ML25091A093 (1) | |
Text
EPRI REPORT 3002025288, ENHANCED RISK-INFORMED CATEGORIZATION METHODOLOGY FOR PRESSURE BOUNDARY COMPONENTS REQUESTS FOR ADDITIONAL INFORMATION (RAIS)
RAI 01 - Accounting for High Consequence Scenarios Background/Issue:
EPRI report criteria 11-13 propose to categorize SSCs as LSS if their individual contribution to CDF is less than 10-6 per year, or if the SSC contribution to LERF is less than 10-7 per year without any consideration of consequences. Further, for CDF contribution between 10-6 per year and 10-8 per year or LERF contribution between 10-7 and 10-9 per year, a sliding scale of consequence consideration of conditional core damage probability (CCDP) or conditional large early release probability (CLERP) of 1.0 or greater than 0.1 or 0.01 is introduced for HSS categorization.
Based on a review of the documents in the audit, the NRC staff found SSCs with a CCDP of greater than 10-4 and a CDF contribution of less than 10-6 per year. Some internal flooding analyses have identified areas with CCDPs greater than 10-3 but would be LSS using the proposed 14 criteria. RISC-3 LSS SSCs would not be covered by American Society of Mechanical Engineers (ASME) Code or 10 CFR Part 50, Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, requirements and can be repaired or replaced with uncodified nonmetallic repairs with no significant operating experience or lower-quality materials with unknown failure probabilities.
The staff notes that prior approved precedents (such as: EPRI TR-112657, Revised Risk-Informed Inservice Inspection Evaluation Procedure" (ADAMS Accession No. ML013470102);
ASME Code Case N-660, "Risk-Informed Safety Classification for Use in Risk-Informed Repair/Replacement ActivitiesSection XI, Division 1," ASME Code Case N-752, "Risk-Informed Categorization and Treatment for Repair/Replacement Activities in Class 2 and 3 SystemsSection XI, Division 1," ANO2-R&R-004, Rev. 1, "ANO-2 Risk-informed Repair and Replacement Methodology" (ADAMS Accession No. ML071150108) currently approved by the NRC for categorization of passive components) considered failure scenarios with a CCDP greater than 10-4, or CLERP greater than 10-5, as high consequence scenarios, resulting in HSS categorization for the corresponding SSCs. Additionally, these approved precedents were consequence-based evaluations, where only the consequences of a postulated passive component failure were evaluated, and the failure frequencies or contribution to CDF/LERF were not taken into account. In contrast to prior approved precedents, the proposed EPRI methodology uses products of CDF (LERF) and CCDP (CLERP) as a comparison to CDF (LERF) which can contain a pipe rupture frequency as low as 10-8 per year (10-9 per year for LERF and CLERP) coupled with a consequence (CCDP or CLERP) as high as 1.0 and still be categorized as LSS. The staff finds the change in CCDP/CLERP thresholds and the introduction of CDF/LERF contributions are insufficiently justified to categorically conclude that those SSCs would be LSS subject to alternative treatments.
Requests:
- a. The staff has identified the issue above regarding potentially not adequately addressing high consequence failures, specifically consequence failures with CCDP greater than 10-4 or CLERP greater than 10-5. Discuss how EPRI intends to modify the TR to address these areas. As discussed during the audit, please provide consideration of the following two options:
Provide a description and justification of how high consequence SSCs with CCDP greater than 10-4 or CLERP greater than 10-5 are addressed.
As an alternative to first item above, provide a clearly defined minimum set of requirements such as the repair methods of nationally recognized postconstruction codes and standards (e.g., ASME B31.1, ASME PCC-2) for SSCs with a CCDP of 10-4 and CLERP of 10-5 or higher.
In determining whether a component is RISC-3, EPRI Technical Report 3002025288 (referred to as TR 3002025288 in the rest of this response) uses a multi-step process consisting of prerequisites (including integrity management), a set of predetermined HSS components, and a plant-specific search for risk-significant passive components to address all passive SSCs.
The ten pre-determined risk-informed criteria are intended to capture common high consequence components building off decades of experience in risk-informing the pressure boundary. The EPRI streamlined RI-ISI methodology (ASME Code Case N-716 as endorsed in Regulatory Guide 1.147, ML21181A222) provides valuable insights for justifying the assignment of HSS for specific Class 2, Class 3 and non-safety related systems/subsystems in the context of in-service inspection (e.g., criteria 1, 2, 3, 4, 11). As discussed in the supplementary information provided by EPRI, valuable inputs were obtained from its application as well as other risk-informed pressure boundary applications (e.g. TR-112657, Rev B-A, WACAP-14572-A, 1006937). However, because of the breadth of 10CFR50.69, those insights could not be the sole basis for an enhanced categorization methodology. As such, additional risk-informed criteria were developed to specifically address the increased scope and content brought about by a 10CFR50.69 application (e.g., criteria 5,6,7,8,9 and 10).
Based on discussions from the March 6, 2025 public meeting, EPRI proposes a revision to clarify that internal flooding is a consideration in HSS criteria 5 and 8. Section 4.2 criteria 5 and 8 proposed revisions are as follows with new text in bold:
Criteria 5:
Portions of the ultimate heat sink (UHS) flow path (for example, service water) whose failures will fail both trains (that is, unisolable failure of the UHS function, or loss of both trains due to spatial impacts (e.g. flood, spray)). (Note: even if piping is isolated/independent, structures such as the service water pumphouse [for example, reservoir, bay] would be expected to be HSS.)
Criteria 8:
For PWR plants, low-volume, intermediate-safety systems that typically consist of two physically independent trains (for example, component cooling water [CCW]) that are, on a plant-specific
basis, physically connected. For example, loss of pressure boundary integrity of train A will drain train B as well or loss of both trains due to spatial impacts (e.g. flood, spray).
Also, during the March 6, 2025 public meeting, the NRC staff and the EPRI team engaged in technical discussions regarding the risk criteria. Based on the insights obtained from this meeting, EPRI is proposing to delete criteria 12 (CDF*CCDP) and criteria 13 (CLERP*LERF) from TR 3002025288. Criteria 11 will be altered to include metrics for both CDF/LERF and CCDP/CLERP. The revisions to criteria 11 are proposed as follows:
Any piping or component, including piping segments or components grouped or subsumed within existing plant initiating event groups (main feedwater breaks inside containment; main steam line breaks outside containment; service water flooding events; interfacing system LOCAs; failures of non-Class 1 RCPB connections, such as instrumentation lines) whose contributions to:
CDF is greater than 1E-06/year, or LERF is greater than 1E-07/year, or whose:
CCDP is greater than 1E-02, or CLERP is greater than 1E-03.
This criteria is applied to a plant-specific PRA model that includes pressure boundary failures (for example, pipe whip, jet impingement, spray, and inventory losses).
Note: The 1E-02 / 1E-03 values are similar to EPRI TR-112657, Rev B-A and deterministic single failure criteria, seismic margin analysis, fire protection (Appendix R) in that having a success path results in adequate protection for low frequency events.
Specifically, criteria 111 requires passive components with a CDF > 1E-6/year (or LERF > 1E-7/year) to be assigned HSS. The CDF and LERF in Criteria 11 is also used in N-716 for streamlined RI-ISI. The Grand Gulf (ML072430005) and DC Cook (ML11073A084) Safety Evaluation Reports for ASME Code Case N-716 relief request confirm these guidelines (CDF>1E-6/year and LERF >1E-7/year) are suitably small and consistent with the decision guidelines for CDF/LERF in RG 1.174. It is also consistent with the guidelines contained in EPRI TR-112657, Rev B-A. Criterion 11 is a defense-in-depth measure to capture plant-specific locations that are important to safety.
The expansion of criteria 11 to include CCDP and CLERP metrics also ensure that low frequency / high consequence scenarios are properly categorized.
It should be noted that high consequence was a term used to identify passive SSCs that exceed a particular CCDP/CLERP threshold, and this is not equivalent to high risk. When CCDP/CLERP is paired with frequency, as in licensees internal flooding PRA models, decision-1 As a point of clarification on the background for RAI 1, criterion 11 does not propose to categorize SSCs as LSS if their individual contribution to CDF is less than 1E-6/year (LERF less than 1E-7/year). SSCs that meet the requirements of Criteria 11 are categorized as HSS.
makers can obtain more holistic insights on both frequency of occurrence and consequences of pipe ruptures in assessing risk, without unduly biasing the results towards overly conservative treatment of SSCs that are not significant to risk as measured by CDF and LERF (RG 1.174).
EPRI TR-112657, WCAP-14572, and N-716 (all NRC approved RI-ISI methodologies) use failure frequencies and CDF/LERF in determining risk/safety significance. Furthermore, failure frequencies and CDF/LERF are an inherent part of risk-informed applications such as risk-informed Technical Specifications (e.g., surveillance frequencies and completion times).
On the prior supplementary information, submitted in June 2024, as part of the on-going NRC review of TR 3002025288 Attachment 4: Updated Chapter 5 Table 7, examples are provided that have improved plant safety through vulnerabilities identified from implementing criteria 11.
Table 7 documents plant hardware modifications, procedure updates, and new NDE and inspection for risk-significant scenarios. Pipe segments with internal flood PRA CDF/LERF of greater than 1E-6/year / 1E-7/year respectively are HSS.
Peer reviewed internal flooding PRA models that use industry experience derived failure rates/pipe rupture frequencies paired with plant-specific direct and indirect effects is consistent with the NRCs PRA Policy Statement that PRA evaluations should be as realistic as practical.
Revision 5 of EPRIs Pipe Rupture Frequencies for Internal Flooding Probabilistic Risk Assessment, provides service experience through 2020 to determine the frequencies.
The expansion of criteria 11 ensures that the categorization process picks up plant-specific outliers from both a CDF/LERF and CCDP/CLERP perspective and assigns these as HSS. For those components/segments that are binned as RISC-3, existing plant processes such as the corrective action programs, performance monitoring, and the procurement/design control remain in place to ensure reasonable confidence in equipment performance.
While RISC-3 SSCs may be exempted from certain special treatment requirements, it is important to note that when components are repaired or replaced, including those using 10 CFR 50.69 allowances, the repair/replacement must comply with the station licensing and design bases. Generally, stations prefer to perform like-for-like repairs or replacements as these are typically less resource intensive. When like-for-like is not feasible and/or cost-effective, the repair/replacement is evaluated against the stations design and licensing basis in accordance with the stations Design Control process. Changes to SSCs (e.g. repairs or replacements) are evaluated using various technical products depending on the degree of change in fit, form or function of the component. Evaluations increase in complexity commensurate with the degree of change to ensure all aspects of the design are evaluated. Design tasks are performed in a planned and controlled manner. These evaluations are sufficiently detailed as to purpose, method, assumptions, design input, references, and units such that a person technically qualified in the subject can review and understand the design analysis and verify its adequacy.
Applicable design inputs, such as design bases, regulatory requirements, codes and standards, are identified, documented, and their selection reviewed and approved. As an example, design input requirements include the following (but the list is not all inclusive):
Basic functions of SSCs Performance requirements such as capacity, rating, and system output Codes and standards Design conditions, such as pressure, temperature, and voltage Loads, such as seismic, thermal, and dynamic Environmental conditions anticipated during operation Operational requirements under various plant conditions
Control of design basis and plant configuration is important to ensure that the plants design, operation, maintenance, and modifications remain consistent with the facilitys design and licensing-basis documents (e.g. UFSAR, etc.). The 10 CFR 50.59 process for changes to an SSC (or the facility in general) is used to determine if a change to the plant is permitted as a licensee directed activity or if prior NRC approval is required.
To further confirm the performance and establishing reasonable confidence for RISC-3 components, the PWROG developed the document titled, Supply Chain, Procurement Engineering, and Design Engineering Roadmap for Procurement of RISC-3 Items. This document provides standard industry alignment for supply chain, procurement engineers, and design engineers within procurement and configuration control process for RISC-3 SSCs. The document defines RISC-3 Like-for-Like (industrial grade physically and functionally the same as previously supplied for safety related use), RISC-3 Equivalent Items (industrial grade that is physically different than item supplied under Appendix B), and RISC-3 Design Equivalent Item (industrial grade that are not like for like or design-equivalent but meet system design requirements and associated site-specific implemented procedure or equivalent). The document provides further guidance on procurement to ensure reasonable confidence expectations can be met, including:
RISC-3 Procurement (General) o Prior to making a RISC-3 Procurement, it is necessary for a cognizant individual to determine availability of an industrial grade item (6.4).
o Is the item currently purchased as Commercial Grade and dedicated for use in safety related applications? Under a RISC-3 Procurement, the items can be purchased and not dedicated; therefore, these items meet the definition of RISC-3 Like-for-Like Items, provided the same items are purchased (6.4.1) o Will the OEM manufacture the same item out of equivalent materials without imposing special treatment requirements (e.g. make the same item from corresponding ASTM materials in lieu of ASME materials and without imposing any special treatment requirements, such that it is interchangeable with no effect on function)? If so, this would be a RISC-3 Like-for-Like Item and not require further evaluation (6.4.2)
RISC-3 Procurement Using Standard Item Equivalency Process (SIEP) or Standard Design Process (SDP) o Determining reasonable confidence is more involved when trying to approve an item that is physically and/or functionally different than the original. The nuclear industry has developed a Standard Item Equivalency Process and Standard Design Process for use in evaluating items that are physically and/or functionally different from the original, regardless of safety class. Use of the SIEP, SDP, or equivalent processes to evaluate replacement items that are physically and/or functionally different than the original (including addressing seismic and/or environmental conditions, as applicable), in conjunction with the other requirements of 10 CFR 50.69, provides reasonable confidence that the items will perform their design basis safety related function (7.0).
o In general, RISC-3 Equivalent Items and RISC-3 Design Equivalent Items can be purchased in the same manner as RISC-3 Like-for-Like Items from non-Appendix B suppliers and without 10 CFR Part21 reportability requirements (7.0).
Procurement Considerations:
o Prior to procurement of RISC-3 Equivalent Items or RISC-3 Design Equivalent Items, engineering review and/or evaluation is required to ensure, with
reasonable confidence, that RISC-3 SSCs remain capable of performing their safety-related functions under design basis conditions, including seismic conditions and environmental conditions, as applicable, throughout their service life (13.1) o Technical requirements (e.g. temperature/pressure rating, size, voltage, amps, current rating, mounting consideration, material specifications, initial qualification requirements, etc.) the item must meet may need to be specified differently for purchase of functional replacement items, in lieu of referencing existing drawings, specifications, etc. (13.3).
Furthermore, candidate RISC-3 segments are subjected to a sensitivity study, which increases the failure rate by a factor of 3 as required by Section 4.3 of TR 3002025288 (and consistent with currently approved guidance in NEI 00-04). Any segment(s) that exceeds the RG 1.174 acceptance criteria will be provided to the IDP as candidate HSS. The remaining RISC-3 segments will be presented to the IDP as candidate LSS.
Consistent with the guidance in NEI 00-04 (and summarized in Table 1 on TR 3002025288) once passive segments are categorized as HSS (meeting any one of the eleven criteria), the IDP is not allowed to change HSS to LSS. The IDP, serving as a multi-disciplinary review panel, ensures all attributes of the evaluations are fully addressed to provide a valid risk-informed conclusion or decision that addresses the maintenance of defense-in-depth and adequate safety margin. This is explicitly covered in existing industry instruction documents and templates developed and maintained by the Nuclear Energy Institute (NEI), under the suite of documents covering the implementation of 10 CFR 50.69 (titled Risk Informed Engineering Programs (under RIEP-NEI-16-005):
When applying the methodology in TR 3002025288:
The IDP shall ensure the prerequisites in Section 4.1 of TR 3002025288 are met The IDP shall confirm the assignment of HSS components (from the results of using criteria 1 through 11) is appropriate.
The IDP shall confirm that the assignment of HSS criteria is valid in the context of other hazards (fire, seismic, other hazards).
For those segments that receive a final LSS assignment, the prerequisites shall continue to be met, i.e.:
PRA technical adequacy requirements, which include periodic maintenance and updates of the inputs, quality, and results that can impact applications such as 10 CFR 50.69.
Integrity management programs (e.g., localized corrosion programs for raw-water cooling systems), feedback and process adjustment.
Additionally, per 10CFR50.69(d)(2), the licensee will continue to be required to meet the following requirements:
Shall ensure, with reasonable confidence, that RISC-3 SSCs remain capable of performing their safety related functions under design basis conditions, including seismic conditions and environmental conditions and effects throughout their service life.
The treatment of RISC-3 SSCs must be consistent with the categorization process.
Inspection and testing, and corrective action shall be provided for RISC-3 SSCs.
Any segment assigned as LSS will have a negligible impact on plant risk consistent with US NRC risk-informed decision making criteria (even if CDF and LERF were not previously directly used in 50.69 passive categorization), as there is no change to plant design basis or system configuration (e.g., a two-train system with a specific required flow rate will remain a two-train system without any reduction in redundancy), defense in depth is maintained, and the prerequisites of Section 4.1 in TR 3002025288 and the requirements of 10CFR50.69(d)(2) will ensure that these components shall continue to reliably perform their safety related function under design basis conditions.
Because of:
The robust assessment of the overall risk, The multiple criteria that pre-determine HSS categorization for specific SSCs (e.g., all Class 1 are HSS without any considerations for changing to LSS),
The use of CDF/LERF/CCDP/CLERP thresholds that are consistent with risk-informed guidance, Required sensitivity analysis, increasing the failure rate of candidate RISC-3 components by a factor of 3, and Licensees programs and processes, and 10CFR50.69 rule requirements, to ensure RISC-3 SSCs continue to meet design function.
It is deemed that the alternative of imposing additional commitments to specific codes and standards is not needed, and would represent a deviation from the SOC for 50.69:
Through this rulemaking, RISC-3 SSCs are removed from the scope of these requirements and instead are subject to the requirements in § 50.69(d)(2). For the reasons discussed in Section III.4.0, the Commission has determined that for low safety significant SSCs, it is not necessary to impose the specific detailed provisions of the Code, as endorsed by NRC, and these requirements can be replaced by the more high-level alternative treatment requirements, which allow greater flexibility to licensees in implementation.
RAI 02 - SSC Categorization as a Single Plant Unit Background/Issue: 10 CFR 50.69(c)(1)(v) requires that the 10 CFR 50.69 categorization process be performed for entire systems and structures, not for selected components within a system or structure. The final rules SoC explain that This required scope ensures that all safety functions associated with a system or structure are properly identified and evaluated when determining the safety significance of individual components within a system or structure and that the entire set of components that comprise a system or structure are considered and addressed.
EPRI TR 3002025288 Section 4.4, Alternative Treatment Requirements Under 10 CFR 50.69(d)(2), states that this enhanced methodology defines the pressure boundary function of each individual plant unit as a system for 10 CFR 50.69 categorization and alternative treatment purposes. Consistent with 10 CFR 50.69 rule language and several citations in the final rules SoC, the system boundaries for the pressure boundary function are limited to pressure retention. Therefore, there will be no other important functions that would escape categorization and appropriate assignment of safety significance. As covered in the Statements of Condition, this ensures that all safety functions in the selected system are properly identified and categorized regarding their safety significance.
Further, Table 7 of the TR, Comparison to 10 CFR 50.69(c)(1) states that the enhanced methodology requires categorization of all systems providing a pressure boundary function.
The statements in the TR appear to imply that all the pressure-retaining components in the plant are considered as one system and that only the pressure-retaining function will be used to define the system. The staff does not find the TR provides sufficient explanation on how the proposed passive categorization will be implemented in the overall 50.69 categorization and did not find sufficient justification to support the statement that all safety functions in the selected system are properly identified and categorized regarding their safety significance.
Figure 1 of the TR, Categorization process overview, depicts the overall 50.69 categorization process as intended to be implemented, and shows that the passive categorization is performed in parallel to the other aspects of the categorization, such as considerations based on PRA and other qualitative consideration. All these aspects are considered for the preliminary categorization step, per the guidance in Nuclear Energy Institute (NEI) 00-04 Section 7. The guidance in NEI 00-04 Section 7 states that SSCs that support multiple functions should be assigned the highest risk significant of any function that the SSC, or part thereof, supports.
Finally, the inputs from the preliminary categorization are provided to the integrated decision-making panel (IDP). Table 1 of the TR states that the IDP cannot change categorization from HSS to LSS for passive components.
Requests:
- a.
Clarify what is meant by that statements that the methodology defines the pressure boundary function of each individual plant unit as a system. Describe how the EPRI methodology proposes to organize passive components in systems for the purpose of
the passive component categorization. Describe how system functions are defined per Section 4 of NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline in the context of passive SSCs.
The system boundaries for the pressure boundary function are limited to pressure retention. By only considering the passive/pressure retaining function, no active functions are categorized as part of implementing TR 3002025288. Categorization of active functions/components will continue to follow the guidance in NEI 00-04. For consistent application of TR 3002025288, the wording in Section 4.4 is revised as follows:
This enhanced methodology is applied to the whole plant for the pressure retention function (e.g., all systems providing a pressure boundary function) for 10 CFR 50.69 categorization (whereas the traditional passive methodology is applied on a system-by-system basis). This is consistent with 10 CFR 50.69 rule language and several citations in the final rules Statement of Considerations (the system boundaries for the pressure boundary function are limited to pressure retention). By limiting the scope to the pressure retaining function, all other functions (e.g., active functions) must follow the existing process for categorization in NEI 00-04.
This whole plant approach is consistent with 10 CFR 50.69 and NRCs approval of the ANO RI-RRA applications [29, 30]. That is, RI-RRA categorization and treatment are limited to the pressure retaining function. For example, a motor-operated valve body can be RI-categorized as LSS without RI-categorizing its active functions (for example, valve fails to open or valve fails to close). This is further documented in the NRCs letter to Vogtle Units 1 and 2 - Issuance of Amendments RE: Use of 10 CFR 50.69 (ML14237A034) as summarized below:
In the response, the licensee confirmed that the failure of a passive component (e.g., motor operated valve body) that supports an HSS active function may be assigned LSS by the passive categorization methodology if confirmed LSS by the IDP. This can occur because, for example, there are no common cause failures (CCF) among passive components (i.e., multiple and simultaneous pipe ruptures are not expected), so an active function may be HSS due to CCF considerations but the individual pressure retaining components whose individual failures do not fail the function can be LSS. The NRC staff finds that risk assessments generally do not consider the very unlikely simultaneous multiple failures of passive components (except for external hazard events impacts that should be included in the external hazard evaluation) and therefore the proposed method is acceptable.
Similarly, alternative repair/replacement activities can be applied to the LSS pressure-retaining function of the valve body, and the active function will continue to be maintained through existing practices.
The statements in the TR are not intended to designate pressure-retaining components in the plant as one system in a way that would impact the categorization of active functions per the current guidance in NEI 00-04. Because the enhanced passive categorization uses the experience of categorizing passive functions in various previously approved applications by the US NRC, pre-determined criteria provide an upfront categorization for certain pressure-retaining components. This is in distinction to the current approach in NEI 00-04, where once a system is chosen both the active and passive functions are categorized by the licensee.
As such, a licensee may submit for approval to implement 10 CFR 50.69 and choose not to categorize any system (neither active, nor passive function) or choose a small subset of specific systems and not categorize other systems. Defining upfront categorization (which can include an HSS determination) assigns a result (HSS or LSS) across the plant and, if the plant proceeds in categorizing a system(s) further, both the active and passive functions need to be considered per the current guidance (no change).
The pre-determined categorization of pressure retaining functions does not impact the active function categorization (i.e., there is no allowance to categorize the passive function as LSS and automatically assign the LSS categorization to the active function). In the current method, if the licensee chooses to categorize several systems, they will need to have both active and passive functions considered, with the difference under the enhanced methodology being that all of the pressure-retaining components will have been categorized as HSS/LSS. The active function will be categorized via the approved NEI 00-04 guidance (and alternate treatments remain the same, as TR 3002025288 does not change any of the alternate treatment requirements, which still remain in place for RISC-3 items).
More importantly, because the pre-determined criteria are strictly applicable to the pressure-retaining portion of the passive categorization, no change in special treatment for RISC-3 components is allowed until all aspects of the enhanced methodology and relevant portions of NEI 00-04 are completed (prerequisites, criteria 1-11, sensitivity study, and IDP) and an LSS categorization is confirmed by the IDP. While a pressure boundary component may have a HSS or LSS categorization via the enhanced methodology, no change in the active function special treatment is allowed from the current safety-related treatment. Only if the guidance in NEI 00-04 for active function were to be followed, and the safety-related active function were to be identified as LSS (i.e., binned as RISC-3) following the current approach in NEI 00-04 would the potential for alternate treatments of the active function be allowed.
As such, the guidance does not imply, nor does it provide any options for the active function of a safety-related (or non-safety-related) component to be categorized as LSS without complying with the current NEI 00-04 guidance. Doing so would not follow guidance in TR 3002025288 and NEI 00-04, for active functions, which are not in scope of TR 3002025288.
A peer reviewed internal flooding model that meets the ASME/ANS PRA Standard (consistent with US NRC technical adequacy expectations) is part of the enhanced categorization methodology. The internal flooding model is intended to identify plant-specific HSS components using a plant-specific PRA of pressure boundary failures. This includes impacts of the pressure boundary failure, impacts of the pressure boundary failure on the active system it supports, as well as impacts of the pressure boundary failure on any other plant SSC (i.e., all relevant active and passive functions). This includes direct effects (e.g. loss of the flow path) of the component failure and indirect effects of the component failure (e.g. flooding, spray, pipe whip, loss of inventory). This comprehensive assessment of total plant impact (i.e., active and passive functions) caused by a postulated pressure boundary component failure is then used to determine
the HSS or LSS assignment of that pressure boundary component. As such, there are no safety functions (i.e., active or passive) associated with other components or systems that would not be properly identified and evaluated and therefore improperly determine the safety significance of the pressure boundary components under evaluation even before the guidance in TR 3002025288 is implemented.
In other words, implementation of the enhanced categorization methodology ensures the licensee develop a wider understanding of the implication of passive failures than the current approach. From a practical perspective, this effort is very similar to the initial RI-ISI pilot plant applications (i.e., Millstone Unit 3, Surry Units 1 & 2, ANO Unit 2, and Fitzpatrick) which were all full-scope applications. As such, the enhanced methodology is a full scope risk-informed categorization effort and provides more insights into the plants understanding of passive failures than currently required.
- b. As indicated in Figure 1 of the TR, the passive categorization is one aspect of the systematic and integrated categorization process outlined in NEI 00-04. Describe further how the passive categorization will be executed part of the overall integrated categorization process. Describe how the guidance in NEI 00-04 Section 7 for preliminary categorization will be implemented for passive components. How will all aspects of the categorization process be considered for the preliminary categorization of SSCs (both active and passive) that will be provided to the IDP?
As stated in part (a), the passive categorization will continue to follow the applicable guidance outlined in NEI 00-04, with the addition of the prerequisites, the pre-determined set of HSS components (criteria 1-10) and the plant-specific review for risk-significant components (criteria 11). TR 3002025288 does not change active function categorization process.
Exercising the process in TR 3002025288 would allow for pre-determined criteria to be applied upfront to the pressure-retaining function as described in Section 4.2. When using TR 3002025288, the existing integrated categorization process (e.g., NEI 00-04) would remain in place for components with active functions (i.e., no change in the active function or the integrated approach).
NEI 00-04 Section 7 is relevant for active functions and components. As a passive only methodology, TR 3002025288 only categorizes the pressure retention function. When using the enhanced passive methodology, similar to the existing passive methodology, Section 7 will continue to be followed for active functions and components.
Consistent with the existing approach (ANO-2 and NEI 00-04) fire, seismic and other hazards need to be considered. The current approach as described in NEI 00-04 for assessing these hazards should be used to ensure the assignment of HSS criteria is valid in the context of these hazards (fire, seismic, and other hazards). Please see the edits to the TR below to clarify these expectations.
From a practical implementation perspective, the passive/pressure boundary categorization will be presented to the IDP as a completed package (e.g., the full plant evaluation, that is all safety related and non-safety related pressure boundary components) for final categorization. After this
categorization, as new systems are categorized - each system results will include the active and passive functions for IDP review and concurrence. The active functions will continue to be categorized consistent with guidance in NEI 00-04 as currently performed. This sequence assures the IDP can assess the entire pressure boundary system at the beginning (IDP panel specific to categorization based on TR 3002025288) and also assures that each subsequent system characterization (that is active and pressure boundary functions) also reflect the entire NEI 00-04 process.
To fully address the systematic and integrated categorization interactions with NEI 00-04, it is being proposed to add a new section to chapter 4 of 3002025288 (Section 4.5 NEI 00-04 Integration Guidance) as follows:
After the performance of the evaluations required by sections 4.1, 4.2 and 4.3 a preliminary (candidate) HSS / LSS assignment of all safety related and non-safety related pressure retaining components has been completed. To determine the final HSS / LSS assignments the remaining relevant portions of NEI 00-04 must be completed including:
Fire Assessment (NEI 00-04 Section 5.2),
Seismic Assessment (NEI 00-04 Section 5.3),
Assessment of Other External Hazards (NEI 00-04 Section 5.4),
Integral Assessment (NEI 00-04 Section 5.6),
Additionally, as required by Section 9.2 of NEI 00-04, the IDP is responsible for reviewing candidate HSS and LSS assignments and determining the final HSS and LSS assignment.
Consistent with past practice any candidate HSS assignment (i.e. components meeting any one of the 11 criteria or determined to be HSS by a non-PRA external hazard evaluation) cannot be assigned LSS by the IDP. Per NEI 00-04, the IDP may determine a function/SSC has not been appropriately characterized and may be re-evaluated based on insights from the IDP. Also, NEI 00-04 allows for more detailed characterization of the SSC associated with a safety-significant function. This can be performed after the initial IDP, but the basis for that re-categorization must be considered and discussed in a follow up IDP session.
For application of the enhanced categorization methodology for pressure boundary components the IDP shall also confirm that all steps in the process have been followed.
The IDP shall ensure that the prerequisites cited in Section 4.1 are met.
The IDP shall confirm the assignment of HSS components (from the results of using criteria 1 through 11) is appropriate.
The IDP shall confirm that the assignment of HSS criteria is valid in the context of other hazards (fire, seismic, other hazards).
Confirm the intent in TR Table 1 that IDP will not change HSS categorization of passive components.
See part of the response in (b) regarding the IDPs role in passive function categorization.
Additionally, as required by Section 9.2 of NEI 00-04, the IDP is responsible for reviewing candidate HSS and LSS assignments and determining the final HSS and LSS assignment.
The key aspect is that the IDP cannot change a HSS classification for passive function categorization. This is consistent with industry practices in that passive HSS assignment (i.e. components meeting any one of the 11 criteria or determined to HSS by a non-PRA external hazard evaluation) cannot be assigned LSS by the IDP in the final 50.69 categorization process.
- d. Justify how the approach taken in EPRI TR 3002025288 for passive pressure boundary SSC categorization complies with 10 CFR 50.69(c)(1)(v) and the associated statements of considerations to ensure that all safety functions associated with a system or structure are properly identified and evaluated when determining the safety significance of individual components within a system or structure and that the entire set of components that comprise a system or structure are considered and addressed.
10 CFR 50.69(c) requires a categorization process that determines if an SSC (structures, systems and components) performs one or more safety significant functions and identifies those functions.
In particular, 10 CFR 50.69(c)(1)(v) requires that the categorization be performed for entire systems and structures, not for selected components within a system or structure. However, 10 CFR 50.69, the statements of considerations for the final rule (SOC), NEI 00-04 and Reg Guide 1.201 do not provide a prescriptive definition for a system or its boundaries.
As discussed in the SOC, the concern is that by limiting the categorization to isolated components within a complex system, all of the safety functions associated with that complex system might not be properly identified and evaluated and therefore improperly determine the safety significance of the isolated component(s) under evaluation.
It is also noted in the SOC that this requirement should be understood to exclude entire support systems (e.g., if system A is categorized as RISC-3, but is dependent on system B components which in turn have been categorized as RISC-1, then system A is understood not to include the system B components and is not to be categorized as RISC-1).
As discussed in Section 4.4 of TR 3002025288, this enhanced methodology is defining the pressure boundary function as a system for 10CFR50.69 categorization and alternate treatment purposes. When applying the enhanced methodology, in particular criteria 9, 10, and 11, all of the impacts on active and passive functions caused by the loss of the pressure retention function need to be accounted for consistent with the ASME/ANS PRA Standard and Regulatory Guide 1.200 (e.g. all direct and indirect effects of the postulated failure need to be accounted).
This includes impacts of the pressure boundary failure, impacts of the pressure boundary failure
on the active system it supports, as well as impacts of the pressure boundary failure on any other plant SSC (i.e. all relevant active and passive functions). This includes direct effects (e.g. loss of the flow path) of the component failure and indirect effects of the component failure (e.g. flooding, spray, pipe whip, loss of inventory). This comprehensive assessment of total plant impact (i.e., active and passive functions) caused by a postulated pressure boundary component failure is then used to determine the HSS versus LSS assignment of that pressure boundary component.
As such, there are no safety functions (i.e. active or passive) associated with other components or systems that would not be properly identified and evaluated and therefore improperly determine the safety significance of the pressure boundary components under evaluation.
This approach is consistent with and more conservative than a number of NRC precedents. For example, it is consistent with the incorporation of ASME Case N-660 into RG 1.174, Revision 14 in 2005, NRC approval of draft N-752 at ANO-2 for RI-repair/replacement activities in 2009, NRC approval of ASME Case N-752 at ANO 1 and 2 in 2021, NRC approval of ASME Case N-752 at Oconee in 2023, NRC approval of ASME Case N-752 at NextEra in 2024 and NRC approval of N-752 at Entergy in 2024 in that alternate treatment may be applied to pressure boundary components (e.g. repair / replacement activities, quality assurance) without requiring the categorization of supported active functions. These NRC precedents allow for limiting the categorization to only those pressure boundary components within a single supported active system and in many cases allow for limiting the categorization to individual pressure boundary components within a single supported active system. As such, the enhanced methodology is more conversative than these NRC precedents because the enhanced methodology requires that all pressure boundary components within the pressure boundary system (i.e., all safety related and non-safety related pressure boundary components) be categorized thereby increasing the likelihood that RISC-2 components will be identified.
Note: 10CFR50.69(f)(2) requires that Licensees shall update their final safety analysis report (FSAR) to reflect which systems have been categorized.
- e. Can the proposed methodology create a situation where a component is only categorized for its passive function, but the associated active function is left uncategorized? If so, explain why this is acceptable. Also, if the proposed methodology can create situations where a single SSCs receives different categorization based on its active and passive functions, describe and justify such scenarios and the mechanisms on how that would occur. For each scenario, describe and justify how it is ensured that an active HSS function would not be impacted by the LSS designation of a passive SSC that supports that function. Describe the guidance and approach for resolving differences.
Yes, as discussed in (a), the methodology is applied so that a component is only categorized for its passive (pressure retaining) function and the associated active function(s) are left uncategorized. The function(s) will remain uncategorized, and the associated SSCs will not be subject to alternate treatment and therefore will continue to reliably perform its safety related active function.
The proposed enhanced methodology meets the intent of the rule because it has a process in place to prevent the miscategorization between active and passive functions and, ultimately, it is not intended to change the active categorization by only considering the passive function. While the vast majority of passive components only perform a pressure retaining function, there are a number of components (e.g., valves) that perform both active and passive (pressure retaining) functions. As such, it is possible when applying the 10 CFR 50.69 process for an SSC to have an active HSS and passive LSS categorization. As discussed and docketed during the Oconee N-752 relief request review (2023), this question was addressed in the Vogtle pilot plant review for 10 CFR 50.69 implementation in RAI 29 and specifically discussed in the NRC Safety Evaluation for that application. The Vogtle response is provided below with minor edits for clarification.
Vogtle Response (adapted): The NEI 00-04 categorization methodology assigns risk at the component level. Per the methodology, a component gets assigned final risk if any of the following risks is HSS: active risk, passive risk, or defense in depth. Active risk is determined using insights from the PRA and other qualitative considerations. Passive risk is determined using a passive component categorization methodology. Risk associated with defense in depth is determined using guidance provided in the NEI 00-04 categorization methodology.
The final risk of a component is the highest of these three risks. Then the critical attributes are identified for each HSS components to further understand the reason(s) for being HSS.
For example, an HSS Motor Operated Valve (MOV) may have a critical attribute of fail to close because that is what made it HSS. However, the same valve may be LSS for passive risk (i.e., pressure boundary retention) assuming there is sufficient redundancy to respond to the event of interest and LSS from a defense in depth evaluation.
Further, the following words are taken directly from the Safety Evaluation written by NRC staff on the Vogtle 10CFR50.69 LAR:
In the response, the licensee confirmed that the failure of a passive component (e.g., motor operated valve body) that supports an HSS active function may be assigned LSS by the passive categorization methodology if confirmed LSS by the IDP. This can occur because, for example, there are no common cause failures (CCF) among passive components (i.e., multiple and simultaneous pipe ruptures are not expected), so an active function may be HSS due to CCF considerations but the individual pressure retaining components whose individual failures do not fail the function can be LSS. The NRC staff finds that risk assessments generally do not consider the very unlikely simultaneous multiple failures of passive components (except for external hazard events impacts that should be included in the external hazard evaluation) and therefore the proposed method is acceptable.
Additionally, as discussed above, the application of the enhanced methodology is consistent with and more conservative than a number of NRC precedents (e.g., N-660, ANO-2, Oconee, Entergy, NextEra) in that all safety related and non-safety related components must be categorized using the enhanced methodology, as well as subject to the prerequisites of Section 4.1, thereby increasing the likelihood of identifying RISC-2 components (see Section 5.3 of TR 3002025288) as compared to NRC endorsed precedent.
2005 - NRC endorsement of ASME Code Case N660 into revision 14 of Reg Guide 1.147, August 2005 2009 - Arkansas Nuclear One, Unit 2 - Approval of Request for Alternative ANO2-R&R-004, Revision 1, Request to Use Risk-Informed Safety Classification and Treatment for
Repair/Replacement Activities in Class 2 and 3 Moderate and High Energy Systems (TAC NO. MD5250), April 22, 2009, ML090930246 2014 - Vogtle Electric Generating Plant, Units 1 and 2 - Issuance of Amendments Re:
Use of 10 CFR 50.69 (TAC NOS. ME9472 AND ME9473), dated December 17, 2014 (ADAMS Accession No. ML14237A034)
Vogtle Electric Generating Plant - Unit 1 and Unit 2 Pilot 10 CFR 50.69 License Amendment Request, Response to Request for Additional Information, dated May 2, 2014 2021 - Arkansas Nuclear One, Units 1 and 2 - Approval of Request for Alternative from Certain Requirements of the American Society of Mechanical Engineers Boiler and Pressure Vessel Code (EPID L-2020-LLR-0076), May 19, 2021, ML21118B039 2023 - Oconee Nuclear Station, Units 1, 2, and 3 - Re: Authorization of Alternative to Use RR-22-0174, Risk-Informed Categorization and Treatment for Repair/Replacement Activities in Class 2 and 3 SystemsSection XI, Division 1 (EPID L-2022-LLR-0060),
December 13, 2023, ML23262A967 Second Response to Request for Additional Information (RAI) Regarding Proposed Alternative to Use American Society of Mechanical Engineers Code Case N-752, Risk-Informed Categorization and Treatment for Repair/Replacement Activities in Class 2 and 3 SystemsSection XI, Division 1 dated October 20, 2023 2024 - Entergy EN-RR-22-0011 for Grand Gulf Nuclear Station, River Bend Station, Waterford 3 (ML22181B114, ML23111A213, ML24012A196, ML24101A388) approved in NRC SE dated May 30, 2024 (ML24060A219, ML24151A238) 2024 - NextEra FRR-23-011 for St. Lucie Units 1 & 2, Turkey Point Units 3 & 4, Seabrook Station, Point Beach Units 1 & 2 (ML23074A155) approved in SE dated June 12, 2024 (ML24149A286, ML24164A193)
RAI 03 - Addressing Uncertainty and Other Events in Individual Assessments Background/Issue: Paragraph 50.69(c)(1)(i) states that the SSC categorization process must consider results and insights from the plant-specific PRA. This PRA must, at a minimum, model severe accident scenarios resulting from internal initiating events occurring at full power operation. The PRA must be of sufficient quality and level of detail to support the categorization process and must be subjected to a peer review process assessed against a standard or set of acceptance criteria that is endorsed by the NRC. In response, Table 7 of TR 3002025288, Comparison to 10 CFR 50.69(c)(1), further states, As stated previously, the plant needs to have a robust internal events PRA, including IF [internal flooding], that addresses failure of all pressure boundary components (main steam line breaks, main feedwater line breaks, internal flooding events, interfacing system LOCA [loss of coolant accident], and so on).
Because this methodology is being used in support of 10 CFR 50.69 applications, the plant-specific PRA needs to be sufficient to support the license amendment request approval process, including consideration of PRA assumptions and sources of uncertainty.
Requests:
- a.
Criteria 11-13 are the only criteria in the methodology that involves a direct use of the licensees PRA model-of-record. From Figure 3, CCDP versus CDF threshold and Figure 4, CLERP versus LERF threshold, it appears that each of the three criteria have hard risk thresholds. Explain how uncertainty is taken into account within the use of these thresholds to categorize a passive pressure-retaining component. Also, explain how the potential cumulative impact of changes is addressed.
EPRI response to 3a:
All pressure boundary failures that are plant initiating events are modeled in the PRA, as required per the NRC-endorsed ASME/ANS Level 1/LERF PRA standard. As discussed in Section 4.1.1 Prerequisite 1: PRA Technical Adequacy, the licensee must have a plant-specific internal events and internal flooding PRA of sufficient quality (peer reviewed against the ASME/ANS PRA Standard) to support the LAR approval process. Pressure boundary failures, such as pipe ruptures, are evaluated quantitatively per criteria 11 of the enhanced methodology. Regarding uncertainty within the use of the thresholds to categorize a passive pressure-retaining component, NUREG-1855 and the two companion EPRI reports (1016737 and 1026511) provides the methodology for assessing and addressing uncertainties in PRA models used in risk-informed decision making.
In implementing 3002025288, the list of assumptions and sources of uncertainty needs to be reviewed to identify those which would be significant for the risk-informed categorization of the pressure boundary. If the plant-specific PRA model uses non-conservative treatments, or uses methods not commonly accepted, the underlying assumption or source of uncertainty would need to be reviewed to determine its impact on the risk-informed categorization of the pressure boundary. Only those assumptions or sources of uncertainty that could significantly impact the categorization risk calculations (i.e., could change a RISC outcome) would be considered key for this application. An example is shown in Table 1.
Supporting Requirement Finding Description Disposition IF-C2b Now IFSN-A4 Appendix E
appears to take credit for drains, however calculation of drain capacity was not evident.
A formal analysis of drain capacities has not been performed.
Section E.5 of the internal flood notebook provides a discussion of flood scenarios in Flood Zone XX. A drain capacity of 60,000 gallons was estimated and credited based on discussion with engineers and review of plant drawings. A probabilistic estimate of drainage failure is provided to address uncertainties in the drainage capacity.
With the exception of Flood Zone RBFLZZ, floor drains were not credited to conservatively estimate the time available for operator intervention.
A conservative estimate was used for floor drain credit, which primarily impacts the associated human action importance; therefore, specific analysis is expected to improve the analysis and will have no material impact on the pressure boundary categorization process.
Additionally, consistent with Section 4.3 of 3002025288, a sensitivity study must be conducted by increasing the failure rates of candidate RISC-3 pressure boundary components. Candidate RISC-3 pressure boundary components that exceed the Regulatory Guide 1.174 acceptance criteria shall be candidate HSS. Since this sensitivity is being conducted for all RISC-3 components it also accounts for the cumulative impact.
To further respond to this input - a proposed revision to prerequisite 1 is to add a third paragraph in Section 4.1.1 to look for potential non-conservatisms or uncommon methods as outlined below:
Prior to using the enhanced categorization methodology, non-conservatisms or the use of methods not commonly accepted must be reviewed to determine their impact, if any, on the risk-informed categorization of the pressure boundary. The analyst should also review key assumptions and sources of model uncertainty in the context of this application.
The potential cumulative impact of changes from implementation of 3002025288 is addressed consistently with, and more conservatively than the existing approved process in NEI 00-04. That is, NEI 00-04 requires that a risk sensitivity analysis be performed for each system that has undergone the 50.69 categorization process by increasing the failure rate of RISC-3 components.
Also, a cumulative risk sensitivity analysis for all systems that have undergone 50.69 categorization process categorized is required. The enhanced passive categorization methodology also requires a sensitivity analysis increasing the failure rate of candidate RISC-3 components by a factor of 3 (consistent with NEI 00-04 guidance). However, because the enhanced methodology is required to be performed on the whole plant (i.e., all pressure boundary systems), the sensitivity analysis will be cumulative of the entire pressure boundary function in that all pressure boundary RISC-3 components will be included.
To make this requirement clearer, it is proposed to modify the third paragraph of Section 4.3 of 3002025288 as follows:
For this effort, pressure boundary components that are modeled in the internal events or internal flooding PRA that have been determined to be RISC-3 shall have their failure rates (such as pipe break frequency) increased by a factor of 3 and their CDF and LERF
quantified so that the cumulative impact of any potential alternate treatment is assessed.
As previously covered, due to the requirements of this enhanced methodology and the requirements that RISC-3 SSCs continue to perform their safety-related functions under design basis conditions, this type of degradation is extremely unlikely for any single component, let alone entire groups of components. Therefore, the factor of 3 is a conservative bound and consistent with NEI 00-04, Section 8.1.
- b.
Discuss and justify how current risk thresholds for Criteria 11-13 take into account cases of lower initiating event frequencies coupled with higher failure consequences. Discuss how these higher failure consequences are considered.
EPRI response to 3b:
Criterion 11 (i.e. 1E-6/year and 1E-7/year risk thresholds for CDF and LERF respectively) is consistent with Regulatory Guide 1.174 risk-informed decision-making acceptance criteria regarding what constitutes low values of risk importance, this has been used in a number of risk-informed applications or in applications where risk insights are used to further the understanding of the acceptability of a plant change/activity.
As discussed in the response to RAI 1, EPRI is proposing to expand criteria 11 and eliminate criteria 12 and 13. Revised criteria 11 is summarized below. Any segment meeting the CDF, LERF, CCDP or CLERP criteria is candidate HSS.
CDF is greater than 1E-06/year, or LERF is greater than 1E-07/year, CCDP is greater than 1E-02, or CLERP is greater than 1E-03.
With expanding Criteria 11 to also include a CCDP/CLERP threshold, this ensures that low-frequency/high consequences scenarios are properly accounted for.
- c.
As a risk-informed process, discuss how the preservation of defense-in-depth and maintenance of safety margins are accounted for in using Criteria 11-13.
Also elaborate on the assessment of qualitative criteria and defense-in-depth for passive categorization, and if any additional guidance is required for the IDP when applying the methodology in EPRI TR 3002025288.
EPRI response to 3c:
While criteria 11 is an important component of the overall enhanced categorization methodology contained in 3002025288, it should not be viewed in isolation. Criteria 11 coupled with criteria 1 through 10, the prerequisites contained in Section 4.1.1 (PRA Technical Adequacy), 4.1.2 (robust program assuring pressure boundary integrity management), and 4.1.3 (barriers against internal flood propagation), 4.1.4 (reflect the as built / as operated plant) together with the assurance of only acceptably small increases in risk consistent with Regulatory Guide 1.174 and meeting the requirements on 10CFR50.69(d)(2) assures that implementation of 3002025288 will not
adversely impact the preservation of defense in depth or maintenance of safety margins. Further implementation of the methodology contained in 3002025288 does not impact defense-in-depth (DID) and safety margins because there is no change to the design or design basis functions of RISC-3 SSCs. Additionally, 10CFR50.69(d)(2) requires that the licensee ensure, with reasonable confidence, that components categorized as LSS (RISC-3 SSCs) remain capable of performing their safety related functions under design basis conditions, including seismic conditions and environmental conditions and effects throughout their service.
The qualitative criteria of the existing process is addressed by the enhanced methodology as provided in the second set of supplemental information provided on June 28, 2024. As detailed in Table 2 (below), these considerations are addressed by the enhanced methodology.
Additionally, as discussed in the response to RAI 2 it is proposed to add a new Section 4.5 (Section 4.5 NEI 00-04 Integration Guidance) which provides additional IDP responsibilities when implementing the enhanced methodology.
Table 2 ANO2 RI-RRA Section ANO2 RI-RRA from letter 2CAN010901 (ML090120620)
January 12, 2009 Enhanced Methodology I-3.2 Classification Piping is assigned a RISC value of HSS or LSS.
Piping segments determined to fall into the HIGH consequence category shall be considered HSS.
Piping segments determined to fall into the Medium, Low, or none category shall be determined to be HSS or LSS by considering the 10 additional considerations (evaluated below).
The proposed methodology uses the same designation of HSS and LSS.
The existing and the new proposed methodology defines components RISC determination as only HSS or LSS and does not use the high, medium, low or none categories to evaluate the components.
I-3.2.2 (b) (1)
Classification Considerations:
Additional considerations:
Evaluate the additional considerations:
- 1. Failure of the pressure retaining function of the segment will not fail a basic safety function.
Components whose failure could fail a basic safety function are outlined in the pre-determined HSS criterion. Any pressure boundary failure that could fail a safety function is considered a high consequence (HSS).
Criterion 5 (loss of ultimate heat sink), Criterion 6 (loss of ECCS), Criterion 7 (loss of secondary cooling in a PWR), and Criterion 8 (loss of CCW in a PWR), and Criterion 11-13 address loss of safety functions.
This consideration is still evaluated through the proposed methodology, just in a different approach.
I-3.2.2 (b) (2)
Classification Considerations:
Additional considerations:
Evaluate the additional considerations:
- 2. Failure of the pressure retaining function of the segment will not prevent the plant from reaching or maintaining safe shutdown conditions; and the pressure retaining function is NOT significant to safety during mode changes or shutdown.
Key functions that would prevent the plant from reaching or maintaining safe shutdown conditions include a total loss of reactor pressure control, reactor coolant inventory control, decay heat removal, or the loss of vital auxiliaries (e.g., instrumentation or AC/DC power). These functions are addressed through the proposed methodology in that any pressure boundary failure that could fail these basic safety functions is considered a high consequence (HSS). Criterion 5 (loss of ultimate heat sink),
Criterion 6 (loss of ECCS), Criterion 7 (loss of secondary cooling in a PWR),
and Criterion 8 (loss of CCW in a PWR), and Criterion 11-13 address loss of safety functions (including loss of power due to a pressure boundary failure).
This consideration is still evaluated through the proposed methodology, just in a different approach.
Table 2 ANO2 RI-RRA Section ANO2 RI-RRA from letter 2CAN010901 (ML090120620)
January 12, 2009 Enhanced Methodology I-3.2.2 (b) (3)
Classification Considerations:
Additional considerations:
Evaluate the additional considerations:
The pressure retaining function of the segment is not called out or relied upon in the plant Emergency/Abnormal Operating Procedures or similar guidance as the sole means for the successful performance of operator actions required to mitigate an accident or transient.
The BWROG and PWROG have evaluated the standard plant Emergency Operating Procedures. No instances of any components were found to be the sole means for successful performance of actions required to mitigate and accident or transient.
Further, the PRA model scope includes the equipment needed to successfully mitigate an accident or transient which could lead to core damage or a large early release. If failure of one component leads directly to core damage or large, early release, then its contribution to risk is evaluated in the proposed methodology (please see criterion 11, 12 and 13.
This consideration is still evaluated through the proposed methodology, just in a different approach.
I-3.2.2 (b) (4)
Classification Considerations:
Additional considerations:
Evaluate the additional considerations:
The pressure retaining function of the segment is NOT called out or relied upon in the plant Emergency/Abnormal Operating Procedures or similar guidance as the sole means for assuring long term containment integrity, monitoring of post-accident conditions, or offsite emergency planning activities.
The BWROG and PWROG have evaluated the standard plant Emergency Operating Procedures. No instances of any components were found to be the sole means for assuring long term containment integrity, monitoring of post-accident conditions, or offsite emergency planning activities.
Further, any pressure boundary failure that could fail these basic safety functions is considered a high consequence (HSS). Criterion 5 (loss of ultimate heat sink), Criterion 6 (loss of ECCS), Criterion 7 (loss of secondary cooling in a PWR), and Criterion 8 (loss of CCW in a PWR), and Criteria 11 and 13 address loss of safety functions for maintaining containment integrity.
This consideration is still evaluated through the proposed methodology, just in a different approach.
Table 2 ANO2 RI-RRA Section ANO2 RI-RRA from letter 2CAN010901 (ML090120620)
January 12, 2009 Enhanced Methodology I-3.2.2 (b) (5)
Classification Considerations:
Additional considerations:
Evaluate the additional considerations:
Failure of the pressure retaining function of the segment will not result in an unintentional release of radioactive material that would result in the implementation of offsite radiological protective actions.
The proposed methodology requires all Class 1 SSCs be HSS. Class 1 components compose one of the key fission product barriers.
Further, criterion #9 ensures components that could lead to containment bypass are HSS.
Any other component failures which would lead to LERF, and potentially offsite radiological protective actions, would be identified through Criteria 11 and 13.
This consideration is still evaluated through the proposed methodology, just in a different approach.
I-3.2.2 (b) (6)
Classification Considerations:
Defense-in-Depth Evaluate the Defense-in-Depth considerations:
- 6. Reasonable balance is preserved among prevention of core damage, prevention of containment failure or bypass, and mitigation of an offsite release.
10 CFR 50.69 categorization does not change the design, design basis or operation of plant components. Therefore, reasonable balance is preserved among prevention of core damage, prevention of containment failure or bypass, and mitigation of an offsite release as there is no change to the design, design basis or operation of plant components.
Additionally, the PRA consequence assessment of the methodology requires an evaluation and ranking of postulated failures on core damage and containment performance (e.g., bypass, LERF). Finally, with implementation of the 50.69 process for plant components, the RISC-3 components are still safety-related and are still required to reliably perform their safety-related function (per the rule).
The inherent process maintains this defense-in-depth attribute. No further evaluation is required when implementing the proposed methodology.
Table 2 ANO2 RI-RRA Section ANO2 RI-RRA from letter 2CAN010901 (ML090120620)
January 12, 2009 Enhanced Methodology I-3.2.2 (b) (7)
Classification Considerations:
Defense-in-Depth Evaluate the Defense-in-Depth considerations:
- 7. There is no over-reliance on programmatic activities and operator actions to compensate for weaknesses in the plant design.
The proposed methodology evaluation reflects the as-operated / as-designed plant (per prerequisite #4). This evaluation does not increase the reliance on programmatic activities or operator actions. Operator actions, when credited, are credited consistent with the NRC endorsed PRA standard.
The inherent process maintains this defense-in-depth attribute. No further evaluation is required when implementing the proposed methodology.
I-3.2.2 (b) (8)
Classification Considerations:
Defense-in-Depth Evaluate the Defense-in-Depth considerations:
- 8. System redundancy, independence, and diversity are preserved commensurate with the expected frequency of challenges, consequences of failure of the system, and associated uncertainties in determining these parameters.
System redundancy, independence, and diversity are preserved as there is no change to the design, design basis or operation of plant components by the risk categorization of the plant components. RISC-3 components will still be required to reliably perform their safety-related function as designed by the plants licensing basis.
The inherent process maintains this defense-in-depth attribute. No further evaluation is required when implementing the proposed methodology.
I-3.2.2 (b) (9)
Classification Considerations:
Defense-in-Depth Evaluate the Defense-in-Depth considerations:
- 9. Potential for common cause failures is taken into account in the risk analysis categorization.
Common cause is a fundamental aspect of the PRA consequence evaluation methodology and therefore is taken into account.
The inherent process maintains this defense-in-depth attribute. No further evaluation is required when implementing the proposed methodology.
I-3.2.2 (b) (10)
Classification Considerations:
Defense-in-Depth Evaluate the Defense-in-Depth considerations:
- 10. Independence of fission-product barriers is NOT degraded.
The proposed methodology makes no changes to plant design, including independence of fission-product barriers.
The inherent process maintains this defense-in-depth attribute. No further evaluation is required when implementing the proposed methodology.
- d.
In computing the CDF/LERF and CCDP/CLERP for Criteria 11-13, discuss how various embedded events in PRA models such as recovery actions (i.e., FLEX) and human reliability analyses are taken into account.
EPRI response to 3d:
Human actions/recovery actions credited in the PRA must satisfy the requirements of the ASME/ANS PRA Standard. The technical element - Human Reliability Analysis (HR) of Part 2 of the ASME/ANS PRA Standard outlines the requirements for human actions including that the action(s) must be proceduralized and address plant-specific and scenario-specific influences on human performance, and address the timing and availability of cues. Recovery actions shall only be modeled if the action is plausible and feasible.
Additionally, for internal flooding, the following additional supporting requirements apply, specifically: IFQU-A5 (ensuring additional human failure events are in accordance with the human reliability requirements in Part 2) & IFQU-A6 (accounting for flood scenario-specific performance shaping factors such as additional workload and stress, cue availability, effect of flood on mitigation, timing and recovery actions, etc.).
For HRA, in addition to the ASME/ANS PRA Standard requirements for FLEX there is the NRC memo on modeling of FLEX actions that need to be considered. In the NRC public memo (May 6, 2022; ML22014A084), the NRC updated its assessment of NEI 16-06, Crediting Mitigating Strategies in Risk-Informed Decision Making originally published in a 2017 memo.
With respect to FLEX actions, most licensee credited actions are fed through loss of offsite power (LOOP) events that go to station blackout (SBO) with late failures or direct SBO. Most pressure boundary initiators are generally mapped to transients (e.g., reactor trip or loss of cooling system initiators). For pressure boundary failures, multiple non-pressure retaining related failures would need to occur before typical FLEX actions would be credited (likely near the truncation of the internal flood model). As such, cutsets with FLEX credited are likely to be low frequency events in this context.
- e.
For plants which have a high seismic contribution to pipe rupture, discuss how the results of various analyses (e.g., seismic PRA, Seismic Margins Analysis) are taken into account for Criteria 11-13. If these considerations are addressed qualitatively, please explain how they will be addressed. If these considerations are addressed solely by the IDP, explain how this is communicated to the IDP and what guidance is available for the IDP.
EPRI response to 3e:
As stated in RAI 2b, seismic insights need to be considered in the categorization process. The same process for assessing seismic insights (NEI 00-04 Section 5.3) should be used to ensure the HSS criteria is valid for the seismic context.
As summarized in Figure 1 and Table 1 below, NEI 00-04 provides an integrated and
comprehensive process for risk informed categorizing SSCs that incorporates risk insights form various hazards into a final HSS / LSS determination. The enhanced methodology contained in 3002025288 provides an alternative only to that portion of the process pertaining to pressure boundary categorization (e.g., bottom path of Figure 1 and bottom row of Table 1).
Seismic insights as well as other external hazards and shutdown events are incorporated into the overall risk categorization through several avenues. For seismic, these include the use of a SMA, a seismic PRA or the tiered approach defined in EPRI report 3002017583. For fires and other hazards, Licensees will need to follow the guidance contained in NEI 00-04 or describe explicitly in their LAR what alternate approach is being requested.
RAI Qualitative Considerations for Shutdown Operations and External Events Background/Issue: Section 2 of EPRI TR 3002025288 describes how the 10 CFR 50.69 categorization process is performed in accordance with NEI 00-04, Revision 0, as endorsed in Regulatory Guide (RG) 1.201, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to Their Safety Significance, Revision 1.
Figure 1 of EPRI TR 3002025288, Categorization process overview shows passive categorization as a separate path for preliminary categorization of pressure-retaining components, prior to IDP review and final categorization. The NRC notes that the guidance in NEI 00-04 includes considerations for fire, seismic, and other external hazards, which may be assessed qualitatively, as well as additional qualitative criteria and requirements for assessment of defense-in-depth. (These are also shown in Figure 1.) The NRC notes that the NRC approved methodology for passive categorization in ANO2-R&R-004, Revision 1, also includes considerations for assessing shutdown operations, external events, and DID.
Requests:
- a.
It is unclear how the methodology in EPRI TR 3002025288, whether independently or in conjunction with the guidance in NEI 00-04, requires the assessment of shutdown operations and external events, including external events that do not affect likelihood of pressure boundary failure but create demands that might cause pressure boundary failure and events (e.g., fires), for potential impact on the categorization of passive, pressure-retaining components.
Please explain how these considerations are addressed. If these considerations are addressed solely by the IDP, explain how this is communicated to the IDP and what guidance is available for the IDP.
EPRI response to 4a:
See the response for RAI 3e for assessment of seismic considerations. Additionally, as further described in RAI 3e, the prior response outlines how TR 3002025288 works with the process in NEI 00-04 for assessment of fire, seismic, and other external hazards.
For all stations, shutdown risk is evaluated consistent with NUMARC 91-06 (ML14365A203) with a focus on protecting decay heat removal defense in depth. In the enhanced methodology, any pressure boundary failure that could fail a safety function is considered HSS. Criterion 1 (reactor pressure boundary), Criterion 2 (applicable portions of the shutdown cooling pressure boundary function), Criterion 5 (loss of ultimate heat sink), Criterion 6 (loss of ECCS), Criterion 7 (loss of secondary cooling in a PWR), Criterion 8 (loss of CCW in a PWR) and Criterion 9 (heat exchangers that interface with RCS). These systems are relied upon during shutdown conditions and also for decay heat removal. No additional specific review is required for additional pressure boundary failures during shutdown conditions.
RAI 05 - Plant Design Scope for Methodology Background/Issue: EPRI TR 3002025288 states that plant-specific 10 CFR 50.69 system categorization was verified for robustness through evaluation of several boiling water reactor (BWR) and pressurized water reactor (PWR) plants. This group of plants is described as consisting of multiple designs and included earlier-vintage and later-vintage designs. No basis is given for the generic applicability of the EPRI TR to other designs, including ones not yet designed. No limitation is presented in the report regarding which designs the report may be applied.
EPRI clarified, during the audit, that the methodology was not verified for designs such as the NuScale US600 or Westinghouse AP1000. The NRC staff needs this clarified on the docket.
Requests:
- a.
If the methodology was not meant to include such designs, or other future PWR and BWR designs, provide revisions limiting the use of the methodology to the designs for which it was verified.
- b.
If the methodology is meant to include designs other than those evaluated, clarify how this was verified and how it is controlled within the methodology.
EPRI response to 5a&b:
The methodology in TR 3002025288 is limited to plants currently or previously licensed via 10CFRPart50 and plants with renewed licenses under 10CFRPart54.
To fully address the staffs comments, the last paragraph of Section 1 (Introduction) is expanded to include:
To that end, this report provides a proposed enhanced approach for categorizing pressure boundary components for use in 10 CFR 50.69 applications. This methodology is based off of the decades of experience with risk-informing the pressure boundary and is applicable to PWR and BWRs (pursuant to 10 CFR Part 50 and plants with renewed licensees under 10 CFR Part 54).
RAI 06 - Clarification for Required Prerequisite Programs to the Methodology Background/Issue: EPRI TR 3002025288 includes, in Section 4.1, that robust program[s] for localized corrosion, flow accelerated corrosion (FAC), and erosion must be ensured before implementing the categorization in Section 4.2 of the methodology. The necessary quality and effectiveness of such programs is verified through, self-assessment, benchmarking, or peer review for localized corrosion; and reference to EPRI reports for FAC and erosion. The descriptions include optional language such as should.
During the audit EPRI provided an example application that relied on referencing individually identified EPRI guidance documents and an NEI bulletin. Further, it was clarified that applicants changing their programs may fall outside of the methodology, despite this not being explicitly controlled in the methodology. The NRC staff needs this clarified on the docket.
Requests:
- a.
It is unclear within the methodology whether an applicant must meet the descriptions of the three programs or what alternatives would be acceptably similar. Clarify how this should be determined and whether optional elements of the descriptions (those including language like should) are genuinely optional.
A Licensee must have programs that address localized corrosion, flow-accelerated corrosion, and erosion that follow the guidance and recommendations contained in 3002025288 or identify alternatives that would be described in a plant-specific LAR.
- b.
On what basis are the cited programs, or alternatives chosen by an applicant, determined to be sufficiently robust, and what would constitute an indication that these programs were insufficiently robust in implementation or due to future alterations?
EPRI response to 6b:
Programs utilizing the integrity management guidance cited on 3002025288 have been developed over the past 20 years. These programs are well established and grounded in operating experience, an understanding of degradation mechanisms, and how the degradation can evolve over time and the factors (e.g. material, environment) that influence that evolution. This guidance has been peer reviewed by US and international industry subject matter experts and is updated as additional operating experience is obtained and response strategies (e.g. online monitoring versus periodic NDE) evolve.
In addition, each of these integrity management programs is regularly assessed via NRC inspections (Inspection Procedures 49001, 93810, 71002, etc.) that provide continued assurance the programs are being sufficiently implemented and maintained to manage these degradation mechanisms.
During the March 6, 2025 public meeting, a question was asked regarding if CDF/LERF risk insights are considered in any of these integrity management programs to determine inspections,
monitoring, etc., or are these programs based strictly on degradation mechanism susceptibility.
In general, inspection and monitoring requirements for these programs are determined and implemented based primarily on degradation mechanism susceptibility. However, consequence of failure is also considered in the evaluation process in some cases, such as small-bore piping
(<2 inches) susceptible to FAC. To further clarify, a note will be added in 3002025288 for each of these programs stating that CDF/LERF risk insights alone should not be used to relax testing/inspection/monitoring of highly susceptible locations.
As stated in 3002025288, Licensee must have living programs that address localized corrosion, flow-accelerated corrosion, and erosion that follow the guidance and recommendations contained in 3002025288 or identify alternatives that would be described in a plant-specific LAR.
An example is provided below that demonstrates how conformance with the Prerequisite 2 integrity management requirement to have robust programs in place that address (i) localized corrosion, (ii) flow-accelerated corrosion, and (iii) erosion could be met.
(i) Localized Corrosion: Plant X has programs that address localized corrosion (e.g.,
pitting and microbiologically influenced corrosion). The programs follow the guidance in the following EPRI technical reports:
TR-103403 (service water corrosion),
3002003190 (service water chemical addition systems),
TR-102063 (examination of service water systems),
1010059 (service water piping guidelines), and 3002018352 (1016456, Revision 2 which is an update to 1016456, Revision 0 referenced in EPRI 300201599) (management of buried piping)
Therefore, Plant X meets the prerequisite to have a robust program that addresses localized corrosion.
(ii) Flow-Accelerated Corrosion (FAC): Plant X follows the guidance in the industry standard document, EPRI 3002000563 (NSAC 202L R4, Recommendations for an Effective Flow-Accelerated Corrosion Program). Additionally, the FAC programs implement the use of standardized health reporting that is consistent with those developed out of NEI Efficiency Bulletin 16-34, "Streamline Program Health Reporting."
Therefore, Plant X meets the prerequisite to have a robust program that addresses FAC.
(iii) Erosion: Erosion in FAC-susceptible systems is addressed by the FAC Program.
Erosion in non-FAC susceptible systems is addressed by the respective system owner unless another program (such as GL 89-13) addresses erosion in a particular system.
Inspections are selected based on plant experience and engineering judgement and are performed and analyzed in accordance with the guidance in EPRI 3002005530 (Recommendations for an Effective Program Against Erosive Attack).
- c.
The methodology does not explicitly require that these programs continue after implementation of the methodology.
- 1.
How is this controlled in the methodology if these programs were discontinued or modified?
- 2.
How would an applicant referencing this methodology determine whether modifications supported a sufficiently robust program?
EPRI response to 6c:
As stated in Section 4.1 of TR 3002025288, licensees must ensure the integrity management prerequisite for having robust programs for localized corrosion, flow-accelerated corrosion, and erosion have been met before implementing the categorization process described in Section 4.2.
If any of these integrity management programs are discontinued or modified such that this prerequisite is no longer fulfilled, then application of the categorization process using this enhanced passive methodology is not allowed.
To clarify this, an additional concluding paragraph in TR 3002025288 is proposed to confirm that integrity management programs are expected to be maintained:
Consistent with 10CFR50.69(e) Feedback and Process Adjustment, the licensee is required to review changes to the plant, operational practices, applicable plant and industry operational experience, and, as appropriate, update the PRA and SSC categorization and treatment processes. This requirement equally applies to implementing and maintaining integrity management programs.
- d.
The methodology references specific revisions of EPRI reports as necessary robust programs. Describe the process of how an applicant using the methodology will do if or when those references were updated?
EPRI response to 6d:
Applicants would need to assess the impact of any updated references on meeting the prerequisite for robust programs via the feedback and adjustment process of 10CRF50.69(e).
Please see the response to RAI 6c that describes proposed additional text on how integrity management programs advancements should be considered.
- e.
Would the 50.69 categorization need to be revisited if the referenced EPRI reports are revised and/or otherwise become insufficiently robust?
EPRI response to 6e:
Applicants would need to assess the impact of any updated references on meeting the prerequisite for robust programs via the feedback and adjustment process of 10CRF50.69(e).
Please see the response to RAI 6c that describes proposed additional text.
RAI 07 - Reference to Industry Guidance for Quantitative Assessment Background/Issue: EPRI TR 3002025288 includes, in Section 4.2 under Criteria 11-13, that users should rely on industry guidance for a number of risk impacts. It is unclear if NRC review and approval is being sought to generically accept use of unspecified industry guidance (examples are given but are not required) as being sufficient for regulatory review of performance of Criteria 13.
During the audit, EPRI stated that this could be clearer to refer to Prerequisite 4.1.1. The NRC staff needs this clarified on the docket.
Requests:
- a.
Please confirm or clarify if this was the intent.
- b.
Please clarify what industry guidance is meant and for which purpose it is to be used.
EPRI response to 7a&b:
That portion of Section 4.2 could have been worded more clearly. The intent of the paragraph was to state that regardless of whether a pipe segment is determined to be HSS or LSS by criteria 1 through 10, the pipe segment must still be assessed against criteria 11 (to include CDF/LERF and CCDP/CLERP metrics). Criteria 11 uses the plant-specific PRA (internal events and internal flood) to determine if there are any pipe segments that exceed the thresholds provided in criteria
- 11. The term industry guidance in the existing paragraph was intended to reflect the requirements as stated in Prerequisite 4.1.1, in that the plant-specific PRA must be subjected to a peer review assessed against a standard or set of acceptance criteria endorsed by the NRC.
Existing words from section 4.2 For purposes of applying criteria 11-13, the definition of a pipe segment is not a function of whether it was categorized as HSS or LSS according to criteria 1-10. That is, even if a piping segment or a portion of a pipe segment is HSS according to one of the first 10 of the preceding criteria, the impact on risk due to its postulated failure is determined consistent with industry guidance (such as the PRA standard, EPRI 1019194). Also, even if a piping segment or a portion of a pipe segment is LSS according to all of the first 10 criteria, the impact on risk due to its postulated failure is determined consistent with industry guidance.
Proposed changes to section 4.2 For purposes of applying criteria 11, the definition of a pipe segment is not a function of whether it was categorized as HSS or LSS according to criteria 1-10. That is, even if a piping segment or a portion of a pipe segment is HSS according to one of the first 10 of the preceding criteria, the impact on risk due to its postulated failure is determined using the plant-specific PRA (see Prerequisite 4.1.1).
Also, even if a piping segment or a portion of a pipe segment is LSS according to the first 10 criteria, the impact on risk due to its postulated failure is determined using the plant-specific PRA (see Prerequisite 4.1.1).
RAI 08 - Clarification of Reactor Coolant Boundary Categorization Background/Issue: EPRI TR 3002025288 Criteria 1 differentiates components based on whether the components can be isolated from the reactor coolant system by two valves in series. Table 3, HSS criteria: considerations, amends this to note that the piping between these two valves may be medium/low consequence. It is unclear how a valve whose function is dependent on a lower classification can retain a higher classification function as a matter of categorization.
During the audit EPRI stated that this could have been more clearly worded and provided a proposed revision. The NRC staff needs this clarified on the docket.
Requests:
- a.
Submit the proposed revision, similar equivalent, or otherwise clarify why such is not needed.
EPRI response to 8a:
The note in the Table 3 could have been worded more clearly. A proposed revision is as follows:
This is a conservative portrayal of the safety significance of some of the Class 1 piping as experience using the existing methodology has shown that the Class 1 piping between the first and second isolation valve is typically a low consequence rank (e.g., CCDP less than 1E-06).
Note that regardless of this observation, all Class 1 components will be HSS.
RAI 09 - Sensitivity Calculation to Account for Uncertainty Background/Issue: EPRI TR 3002025288 section 4.3 states that analysis using a factor of 3 reduction in reliability for systems categorized as RISC-3 is conservative and appropriate, citing NEI 00-04. It is unclear why this factor is conservative and appropriate in the reversed context of this methodology, where components are presumed LSS by default, in contrast to the traditional 50.69 methodology which presumes components are HSS by default. Notably, the proposed methodology is relatively simplified compared to the traditional use of NEI 00-04 for supporting 10 CFR 50.69 applications which includes a relatively fine-grained assessment of subject systems.
NEI 00-04 does not state that a factor of 3 is appropriate, rather it provides a range of values useful in conducting sensitivity studies of an analysis. No basis is given for this range in NEI 00-04 beyond that it would provide trend insights for the consequences of reductions in reliability due to reduced treatments. The factor of 3 is generally used when assessing sensitivity to uncertainty as it is an approximation of the likely tail of a distribution for active systems. When altering the general approach (e.g. changing from HSS treatment to LSS treatment for passive systems), it is unclear why it is reasonable to assess the future distribution (LSS treatment) as matching the prior distribution (HSS treatment).
Addressing this uncertainty is particularly important in the context of other relaxations in treatment that may occur due to changes in ASME code requirements, for example, that may be implemented separately and concurrently with this methodology. This is particularly important in understanding whether the factor chosen genuinely informs regarding uncertainties in the context of passive systems and the performance monitoring associated with such.
The NRC staff needs a justification of the use of a factor of 3 provided on the docket.
Requests:
- a.
Clarify on what basis a factor of 3 is determined to be conservative. In particular, provide any operating experience meta-analysis and/or data distributions supporting that a factor of 3 is conservative, or realistic for passive systems.
EPRI response to 9a:
As noted in response to RAI 1, passive components with low frequency / high consequence events are more robustly treated by expanding the risk criteria that are categorized as HSS.
Passive components/pipe segments are HSS if any of the following are met from plant-specific review of the PRA, including (new criteria are bolded):
o CDF is greater than 1E-06/year, or o LERF is greater than 1E-07/year, or o CCDP is greater than 1E-02, or o CLERP is greater than 1E-03.
After going through the process in TR 3002025288, the RISC-3 segments have been determined to be low safety significant and not risk-significant. For segments that are candidate RISC-3, the failure rate is increased by a factor of 3, to provide insights on the potential trend in CDF and LERF. The factor of 3 has been applied in over 50 approved 10CFR50.69 licensee applications to date.
As stated in NEI 00-04, Section 8.1, the purpose of utilizing a factor of 3 is that it could provide an indication of the potential trend in CDF and LERF, if there were a degradation in the performance of all RISC-3 SSCs. Such degradation is extremely unlikely for an entire group of components. It is even more remote for implementation of 3002025288 in that the prerequisites that must be implemented as part of the 3002025288 methodology has shown that these programs coupled with Licensees corrective action programs would see a rise in failure events and corrective actions would be taken long before even a small population of RISC-3 items see degradation, let alone the entire population of RISC-3 items experienced such degradation. As such, while there is some possibility that an individual item could see variations in performance on this order, it is exceedingly unlikely that the performance of a large group of items would all shift in an unfavorable manner at the same time.
As stated in 3002025288 as well as the Supplemental information packages previously provided to NRC staff as well as public meetings held with NRC on 3002025288 as well as numerous other industry / NRC interactions (e.g., docketed Licensee submittals, public meetings, ACRS meetings, etc.) it is expected that RISC-3 components will not see an increase in failure rates. This expectation is supported by the fact that 10CFR50.69(d)(2) requires that the license ensure, with reasonable confidence, that RISC-3 SSCs remain capable of performing their safety related functions under design basis conditions, including seismic conditions and environmental conditions and effects throughout their service life and that alternate treatment, if applied, be consistent with the categorization process.
Utility corrective action programs would see a substantial rise in failure events and corrective action would be taken long before an entire population experienced such degradations in performance. If performance degradation is observed, the licensee is required to adjust as the categorization or alternate treatments so that the categorization and results are maintained and valid.
To provide further context, an example was selected from Appendix A-1 (PWR Service Water Data Tables) of EPRI 3002024904, Pipe Rupture Frequencies for Internal Flooding Probabilistic Risk Assessments: Revision 5, for 4-inch, 10-inch and 24-inch pipe sizes that represent spray and double ended guillotine breaks. A comparison table is provided below between 3x mean (failure rates increased by factor of 3) and 95% confidence level. Thus, it can be concluded that the factor of 3 increase approaches the 95th percentile of the uncertainty distribution which has been used in sensitivity analyses.
Pipe Size (in.)
Flow rate @
70psig1 (gpm)
EBS (in.)
CBF Mean RF 95th 3x Mean 4
100 0.63 9.60E-07 10.8 3.64E-06 2.88E-06 4
4503 4.24 7.47E-08 15.3 2.89E-07 2.24E-07 10 100 0.63 3.49E-07 12.3 1.34E-06 1.05E-06 10 18012 8.49 2.08E-08 21.8 7.83E-08 6.23E-08 24 100 0.63 9.75E-08 6.2 3.27E-07 2.93E-07 24 128083 22.63 3.90E-10 54.3 1.11E-09 1.17E-09