Text

Pilot 10 CFR 50.69 License Amendment Request, Draft Risk-Informed Categorization Procedures
	ML112300122
Person / Time
Site:	Vogtle
Issue date:	08/17/2011
From:	Ajluni M; Southern Co, Southern Nuclear Operating Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	NL-11-1451
	Download: ML112300122 (122)
	v • d • e

Mark J. Ajluni, P.E.

Southern Nuclear Nuclear Licensing Director Operating Company, Inc.

40 Inverness Center Parkway Post Office Box 1295 Birmingham, Alabama 35201 Tel 205.992.7673 August 17, 2011 Fax 205.992.7885 Docket Nos.: 50-424 NL-11-1451 SOUTHERN'\\'

50-425 COMPANY U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D. C. 20555-0001 Vogtle Electric Generating Plant Pilot 10 CFR 50.69 License Amendment Request Draft Risk-Informed Categorization Procedures Ladies and Gentlemen:

The Nuclear Regulatory Commission (NRC) by letter dated June 17, 2011, in response to Southern Nuclear Operating Company's (SNC) letter dated December 6, 2010, granted pilot status for the planned SNC Vogtle Electric Generating Plant (VEGP) 10 CFR 50.69 license amendment request.

On March 29, 2011, NRC and SNC met to review SNC's planned approach for implementation of 10 CFR 50.69, risk-informed categorization and treatment of structures, systems, and components (SSCs) for nuclear power reactors. SNC discussed the development of draft risk-informed categorization procedures implementing applicable NRC and industry guidance, specifically NRC Regulatory Guide (RG) 1.201 Revision 1 and NEI 00-04 Revision 0 which is endorsed by RG 1.201. The draft categorization procedures are being used during the ongoing trial categorization of three VEGP systems to test the efficacy of the categorization process prior to documenting the process in the VEGP 10 CFR 50.69 license amendment request.

In response to an NRC request at the referenced meeting, this letter provides the draft risk-informed categorization procedures in Enclosures 1-7.

This letter contains no NRC commitments. If you have any questions, please contact Jack Stringfellow at (205) 992-7037.

Respectfully submitted,

~~~

M. J. Ajluni Nuclear Licensing Director MJAlCL T Ilac

U. S. Nuclear Regulatory Commission NL-11-1451 Page 2

Enclosures:

1. Draft NMP-ES-065, 10 CFR 50.69 Program

2. Draft NMP-ES-065-001, 10 CFR 50.69 Active Component Risk Significance Insights

3. Draft NMP-ES-065-002, 10 CFR 50.69 Passive Component Categorization

4. Draft NMP-ES-065-003, 10 CFR 50.69 Risk Informed Categorization for Structures, Systems, and Components

5. Draft NMP-ES-066, General Guidance for Decision-Making Panels - 50.69 and Surveillance Frequency Control Program

6. Draft NMP-ES-066-002, Integrated Decision-Making Panel for Risk Informed SSC Categorization: Duties and Responsibilities

7. Draft NMP-ES-066-002-F01, Risk Informed Categorization Integrated Decision Making Panel Qualification Form - 50.69 cc:

Southern Nuclear Operating Company Mr. S. E. Kuczynski, Chairman, President & CEO Mr. J. T. Gasser, Executive Vice President Mr. T. E. Tynan, Vice President - Vogtle Ms. P. M. Marino, Vice President - Engineering RType: CVC7000 U. S. Nuclear Regulatory Commission Mr. V. M. McCree, Regional Administrator Mr. P. G. Boyle, NRR Project Manager - Vogtle Mr. L M. Cain, Senior Resident Inspector - Vogtle

Vogtle Electric Generating Plant Pilot 10 CFR 50.69 License Amendment Request Draft Risk-Informed Categorization Procedures Draft NMP-ES-065 10 CFR 50.69 Program

Southern Nuclear Operating Company Nuclear NMP-ES-065 SOUTHERNA Management 10 CFR 50.69 Program Version 1.0 COMPANY F4ttTD fb Strn lhMrWor/t/'

Procedure Page 1 of 17 Procedure Owner:

(Print: Name I Title / Site)

Approved By:

(Peer Team Champion/Procedure Owner's I Date)

Effective Dates:

Corporate FNP VEGP 3-4 This NMP is under the oversight of the Ris Writer(s):

SECTIONS

Southern Nuclear Operating Compan\\,

Nuclear NMP-ES-065 SOUTHERN A Management 10 CFR 50.69 Program Version 1.0 COMPANY ElIt'X] tOMrt!# toll,wtJrldO Procedure Pa~e 2 of 17 Revision Description Version Number Revision Descri tion 1.0 Initial issue

Southern Nuclear Operating Company Nuclear NMP-ES-065 SOUTHERNA Management 10 CFR 50.69 Program Version 1.0 COMPANY Hnerv II) ~t Y4Ml"wtnlJ" Procedure Page 3 of 17 Table of Contents 1.0 Purpose.......................................................................................................................................4 2.0 Applicability..................................................................................................................................5 3.0 References..................................................................................................................................5 4.0 Definitions....................................................................................................................................5 5.0 Responsibilities...............................................................................

................................... 10 6.0 Procedure.................................................................................

.......................................11 7.0 Records..............................................................................

.......................................16 B.O Commitments..................................................................

................................... 16 Attac~lment 1...............................................................

......................17

Southern Nuclear Operatin~ Company Nuclear NMP*ES-06S SOUTHERN A Management 10 CFR SO.69 Program Version 1.0 COMPANY P."ery ffj s,rw y"", W4NJ' Procedure Page 4 of 17 1.0 Purpose 1.1 This procedure provides an overview of the process for implementing 10 CFR SO.69, Risk Informed Categorization and Treatment of Structures, Systems and Components [SSCs] for Nuclear Power Reactors.

1.1.1 The intent of 10 CFR SO.69 is to provide a means for appropriately focusing attention on those SSCs that are most important to safety, while maintaining reasonable confidence that other SSCs will be capable of performing their design functions.

1.1.2 To achieve this, 10 CFR SO.69 permits relaxation of treatment (controls) specified in certain other sections of the regulations SSCs that can be categorized as low safety significant.

1.2 This procedure is supplemented by the following res that, together, form an integrated process for the categorization

NMP-ES-06S-001, 10CFRSO.69 Active

NMP-ES-06S-002, Passive ComnnnOnN

NMP-ES-06S-003, Risk Significance Components

NMP-ES-06S-004, llltt:lrn~lti\\/t:

NMP-ES-066, Integrated

NMP-NL*XXX, Nuclear Licensi

,..,...nl.o,..,...",,..,t,,,til"\\"" of 10 CFR SO.69 1.3 The process described in this nrnf"or nstructions satisfies the requirements of (d), Alternative Treatment Requirements,

, Program Documentation, Change 1.4 above-listed procedures/instructions is guidance document, NEI 00-04, 10 CFR 50.69

iUllaet"ne. Revision O.

Institute (EPRI) Technical Report 1011234, 10 CFR 50.69 Treatment of Structures, Systems and Components, 1.S n"""OIl,"<:,n in anticipation of NRC approval of a license amendment req 50.69. Activities described in this procedure may be performed prior to NRC app amendment. However, the alternative treatment requirements specified in (d) shall NOT be implemented UNLESS the following actions are verified to be 1.S.1 After the license amendment is approved by the NRC, an evaluation shall be performed and documented to ensure that the process described in this procedure meets the requirements of, and is consistent with, the NRC-approved license amendment. The performance of this evaluation shall be tracked via a Condition Report action. This evaluation shall be approved by the Manager, Risk-Informed Engineering and by the Manager, licensing. The procedure shall then be revised at this time to remove this Section.

Southern Nuclear Operating Company Nuclear NMP-ES-065 SOUTHERN A.

Management 10 CFR 50.69 Program Version 1.0 COMPANY Entrv 10 MrtH YMir ~rIJ*

Procedure Page 5 of 17 1.5.2 IF the above evaluation concludes that the process described in this procedure does not meet the requirements of, or is inconsistent with, the approved license amendment, THEN this procedure shall be revised accordingly and any evaluations or activities already performed shall be re-performed using the revised procedural requirements.

2.0 Applicability This procedure is applicable only to those plant systems that have been selected for categorization. Since 10 CFR 50.69 is a voluntary rule, each Site to categorize or not categorize. However, once a system is components in that system MUST be included in the ""'T,Qnr.rl The alternative treatment requirements allowed by 10 safety related SSCs in categorized systems. The imple is performed in a systematic and cost-effective alternative requirements). Until alternative trQ~~tm,or implemented through program and/or proced apply.

This procedure was created and is maintai Engineering Manager.

3.0 References 3.1 1 0 CFR 50.69, Risk-Informed Components For Nuclear Power 3.2 NEI00-04, 10 CFR 3.3 3.4 decide which plant systems categorization, ALL the available for use on low risk, treatment options (e.g., EQ program program are nts continue to Structures, Systems And Guidance for Treatment of 3.5 Categorization 3.6 Categorization for Systems, Structures, and 3.7 Requirements 3.8 ng Panel General Guidance For Risk Informed SSC Decision-Making Panel For Surveillance Frequency 3.9 Decision-making Panel for Risk Informed SSC Categorization:

3.10 NMP-NL-XXX, Nuclear Licensing Procedure for Implementation of 10 CFR 50.69 4.0 Definitions 4.1 Accident Sequence - a representation in terms of an initiating event followed by a sequence of failures or successes of events (such as system, function, or operator performance) that can lead to undesired consequences, with a specified end state (e.g. core damage or large early release).

Southern Nuclear Operating Company Nuclear NMP-ES-065 SOUTHERNA.

Management 10 CFR 50.69 Program Version 1.0 COMPANY finerv tlJS~rw four WorlJ" Procedure Page 6 of 17 4.2 Basic Safety Function (a.k.a Key Safety Function) - one of the key safety functions of the plant, namely reactivity control, core cooling, heat sink, RCS inventory, and containment barrier (It is noted that loss of a single train would typically not constitute a loss of a function).

4.3 Completion Time (Cl) - the amount of time allowed for completing a required action. In the context of this Case, the required action is to restore operability (as defined in the technical specifications) to the affected system or equipment train.

4.4 Complicated Initiating Event - an event that trips the plant safety function. Examples of complicated initiating events i (PWRISWR), loss of condenser (SWRs).

4.5 Conditional Consequence - an estimate of an or a breach of containment, assuming failure of an probability (CCDP>>.

4.6 Conditional Core Damage Probability consequence of core damage given a 4.7 4.8 Containment Barrier - a co including normally closed valves or 4.9 Core Damage oxidation and to result in 4.10 4.11 ication of an impact on a key of all feedwater such as core damage damage an undesired estimate of the probability of an failure (e.g., piping segment nt boundary/isolation function closed upon actuation.

point at which prolonged and involving enough of the core, if released, ber of core damage events per unit of time.

istic design and operational features that a high degree of uncertainty with significant consequences to ance with Reg Gu ide 1.174, the defense-in-depth philosophy is preserved among prevention of core damage, prevention of consequence mitigation.

matic activities to compensate for weaknesses in plant design is

System

, independence, and diversity are preserved commensurate with the expected

, consequences of challenges to the system, and uncertainties (e.g., no risk outliers).

Defenses against potential common cause failures are preserved, and the potential for the introduction of new common cause failure mechanisms is assessed.

Independence of barriers is not degraded.

Defenses against human errors are preserved.

The intent of the General Design Criteria in Appendix A to 10 CFR Part 50 is maintained.

Southern Nuclear Operating Compan~

Nuclear NMP-ES-065 SOUTHERN A.

Management 10 CFR 50.69 Program Version 1.0 COMPANY En~rvl. s,rw Y",.,. WlirIJ' Procedure Page 7 of 17 4.12 Failure - as it applies to passive components, an event involving leakage, rupture, or other condition that would prevent an item from performing its intended safety function.

4.13 Failure Mode - a specific functional manifestation of a failure (Le., the means by which an observer can determine that a failure has occurred) by precluding the successful operation of a piece of equipment, a component, or a system (e.g., fails to start, fails to run, leaks) 4.14 Failure Modes and Effects Analysis (FMEA) - a process for identifying failure modes of specific items and evaluating their effects on other components,

, and systems.

4.15 Failure Potential - likelihood of ruptures or leakage that res pressure-retaining capability of the item or the likelihood of item from performing its safety function (e.g., fails to 4.16 High Safety Significant (HSS) - those SSCs that to safety as identified through a blended risk-informed nrl"\\f"ClC operating experience, and other technical information synonymous with the term "Safety Significant".

4.17 High Safety Significant Function (SSC) 4.18 Initiating Event - an event that

"'IClr!:lTlr,n of the plant by challenging plant control and safety system lead to core damage and/or radioactive release. These C\\l~'nTC and failure of equipment from either internal plant causes (

or fires) or external plant causes (such as earthquakes or hig r sequences of events that challenge plant Iy lead to core damage or large early 4.19

4.

unmitigated release of airborne fission products from the before the effective implementation of off-site protective actions such that there is a potential for early health 4.21 (LERF) - expected number of large early releases (releases ucts from containment) per unit of time.

4.22 Low Safety Sig (LSS) - those SSCs that are not significant contributors to safety as identified through a blended risk-informed process that combines PRA insights, operating experience, and other technical information using lOP evaluations.

4.23 Low Safety Significant Function (SSC) - a function (SSG) for which the Integrated Decision Making Panel has applied a risk-informed process that combines PRA insights, operating experience, and other technical information to determine that safety significance is not high.

Southern Nuclear Operating Company Nuclear NMP-ES-065 SOUIHEANA.

Management 10 CFR 50.69 Program Version 1.0 COMPANY EM1'IJiu $;r~ H1tu' WDrfJ" Procedure Page 8 of 17 4.24 Non-Modeled Hazards - Any of the following risk hazards for which there does not exist an approved PRA quantification model:

Fire risk Seismic risk Other External risks (e.g., high winds, external floods)

Shutdown risk 4.25 Operator Recovery Action - a human action performed to operability from a specific failure or human error in order to consequences of the failure.

4.26 Passive Component - pressure retaining components retaining function.

4.27 Piping Segment - a portion of piping, "'I"Innnr.,n, supports, in which a failure at any location re system, loss of a pump train, indirect 4.28 Plant Mitigative Features - systems, prevent an accident or that can be used to miti 4.29 Pressure-Boundary Failure - p in a reduction or loss of the item's 4.30 Piping Segment - a portion of supports, in which any system, loss of rect nts that can be ed on to uences of an accident g ruptures or leakage that result thereof, and their consequence (e.g., loss of a 4.31 Plant Mitiig, and components that can be relied on to the consequences of an accident.

4.32 ilures involving ruptures or leakage that result capability.

4.

(PRA) - a qualitative and quantitative assessment of the risk maintenance that is measured in terms of frequency of core damage or a radioactive material release and its effects 4.34 assessment of the safety significance of an SSC based on the members and utilizing a systematic process that supplements the 4.35 Risk Informed Safety Classification (RISC) - a method outlined in 10 CFR 50.69 for classifying SSCs into one of the following categories:

RISC-1:

RISC-2:

RISC-3:

RISC-4:

SSCs that are safety-related and perform safety-significant functions.

SSCs that are non-safety-related and perform safety-significant functions.

SSCs that are safety-related and perform low safety-significant functions.

SSCs that are non-safety-related and perform low safety-significant functions.

Southern Nuclear Operating Company Nuclear NMP-ES-065 SOUTHERNA Management 10 CFR 50.69 Program Version 1.0 COMPANY EnertJ /4 S#rw ta.,,.W.,rlJ" Procedure Page 9 of 17 4.36 Risk Metrics - a determination of what activity or conditions produce the risk, and what individual, group, or property is affected by the risk.

4.37 Safety Related - Plant structures, systems, and components necessary to assure:

The integrity of the reactor coolant pressure boundary,

The capability to shut down the reactor and maintain it in a safe shutdown condition, or

The capability to prevent or mitigate the consequences of accidents, which could result in off-site exposures that exceed the guidelines established in 100.

4.38 Safety Significance - the relative importance of an SSC in preventing a negative impact on the health and safety of 4.39 Safety Significant - those SSCs that are significant as identified throug h a blended risk-informed process that combines P erience, and other technical information using IDP evaluations.

h Safety Significant (HSS).

4.40 Safety-significant function (SSC) - a fu Id result in a significant adverse effect on defense-in-d

, or risk. Determi of safety significance is made by the Integrated Decision el using a risk-informed process that combines PRA insights, technical information. [Note: loss of a single train would typically

]

4.41 Sensitivity Studies - analyses assumptions or uncertainties made in the PRA are not masking sensitivity studies include increasing human ron",..""",;

increasing maintenance unavailability, nts.

4.42

- NRC requirements imposed on SSCs that go beyond (industrial) controls and measures and are intended to provide the equipment is capable of meeting its design bases functional n basis conditions. These additional special treatment requirements qualification, change control, documentation, reporting,

, surveillance, and quality assurance requirements.

4.44 Spatial Effect - a failure consequence affecting other systems or components, such as failures due to pipe whip, jet impingement, jet spray, harsh environment, debris generation or flooding.

4.45 Success Criteria - criteria for establishing the minimum number or combination of systems or components required to operate, or minimum levels of performance per component during a specific period of time, to ensure that the safety functions are satisfied.

Southern Nuclear Operating Company Nuclear NMP-ES-065 SOUTHERN A Management 10 CFR 50.69 Program Version 1.0 COMPANY Ellerv tD Sern YDU' World" Procedure Page 10 of 17 4.46 Train - As used in this procedure/instruction, a train consists of a set of equipment (e.g., pump, piping, associated valves, motor, and control power) that individually fulfills a safety function (e.g., high-pressure safety injection) with a mean unavailability of 1 E-02 as credited in Tables 2 and 3 of NMP-ES-065-002. A half train (0.5 trains) shall have a mean unavailability of 1 E-01, 1.5 trains shall have a mean unavailability of 1 E-03, etc.

4.47 Treatment - Activities, processes, and/or controls that are performed or used in the deSign, installation, maintenance, and operation of SSCs as a means of 1) Specifying and procuring SSCs that satisfy performance requirements; 2) Verifying over tim performance is maintained; 3) Controlling activities that could impact perform

4) Providing assessment and feedback of results to adjust activities as meet desired outcomes.

4.48 Treatment Program - That program which implements reatment requirements that have been identified in 10 CFR 50.69 as no longer be safety significant SSCs. Examples of treatment programs include the Equipment Qualification Program.

4.49 Unaffected Backup Train - for passive adversely impacted (i.e., failed or degraded) by the ation.

Impacts can be caused by direct or indirect 5.0 Responsibilities 5.1 5.1.2 the 10 CFR 50.69 process 5.1.3 gineer(s) as required to support the Program 5.1.4 r selected site personnel 5.2 from nce monitoring and periodic reassessments to ensure e categorization of SSCs remains valid and that any implemented have not Significantly degraded the performance of the nts.

5.2.3 ended changes to categorization results resulting from changes to model updates, changes to operational practices, as well as other changes.

5.3 The cognizant Risk-Informed Application engineer is responsible for the following activities:

5.3.1 Providing PRA insights in support of the active risk categorization of system functions and components.

5.3.2 Providing PRA insights in support of the passive risk categorization of system components.

Southern Nuclear Operating Company Nuclear NMP-ES-065 SOUTHERN A Management 10 CFR 50.69 Program Version 1.0 COMPANY e",rv I. fHr71, YOII' l,f1JrlrJ" Procedure Page 11 of 17 5.3.3 Providing the results of other hazards analyses for those hazards that are not modeled in the PRA.

5.4 The cognizant System Engineer is responsible for the following activities:

5.4.1 Developing system functions.

5.4.2 Mapping each component in the system to the system function(s) supported.

5.4.3 Participating in the categorization of active risk for syste ions and components.

5.4.4 Participating in the categorization of passive risk for mponents.

5.5 The Operations representative is responsible for the fo 5.5.1 Providing deterministic responses to the to assess the risk of system functions.

5.5.2 Participating in the categorization of 5.5.3 Participating in the categorization 5.6 5.6.1 Evaluating alternative 5.6.2 Evaluating whether add 5.6.3 Evaluating whether add ISC-1 SSCs to ensure acceptable 5.6.4 Irnn,It:>n'1cr changes as identified above.

5.7 for ensuring that the following requirements in

.69, the Final Safety Analysis Report shall be been categorized (from 10 CFR 50.69, part f.2) nt report for any event or condition that would have prevented performing a safety-significant function (from 10 CFR 6.0 6.1 summary of categorization process and a summary of application of uirements that can be implemented after final risk categories are nt in a system. The Nuclear Licensing (NL) department will update the Final Safety is Report when treatments are implemented. The NL department will also submit a licensee event report for any event or condition that would have prevented RISC-1 and RISC-2 SSCs from performing a safety significant function.

6.2 Summary of relationship of this procedure (NMP-ES-065) with associated instructions and NMP-ES-066 (Integrated Decision-Making Panel General Guidance For Risk Informed SSC Categorization Program and Independent Decision-Making Panel For Surveillance Frequency Control Program).

Southern Nuclear Operating Company Nuclear NMP-ES-065 SOUTHERN A Management 10 CFR 50.69 Program Version 1.0 COMPANY l,""trt:llll$ml, YiHII,W.rlJ" Procedure Page 12 of 17 Instructions NMP-ES-065-001 (10CFR50.69 Active Component Risk Significance Insights),

NMP-ES-065-002 (Passive Component Categorization), and NMP-ES-065-003 (Risk Informed Categorization for Systems, Structures, and Components) are associated with NMP-ES-065.

These instructions determine safety significance (High Safety Significant or Low Safety Significant) of each component for a selected system using methods identified in these instructions. The preliminary results will determine the risk categories (e.g., RISC-1, RISC-2, RISC-3, and RISC-4) for each component in a system.

These results are sent to the Integrated Decision Making Panel ES-066 and NMP-ES 066-001). The panel will review and approve the results.

Attachment A shows the above relationship.

6.3 Requirements The following are the requirements that MUST performed.

6.3.1 Training P members and designated Familiarity training on the also be provided to other individuals who may as the cognizant system engineer for the system u 6.3.2 in nuclear power plant applications requires of sound technical quality. At a minimum, the resulting from internal initiating events measures related to core damage frequency (LERF) are used to identify safety amlltlCln other risk contributors must also be assessed either by ing analyses or screening assessments. These other risk risks, other external risks (e.g., tornados, external floods, studies are performed for LSS PRA-modeled sufficient margins exist.

6.4 6.4.1 I be categorized as RISC-1, RISC-2, RISC-3, or RISC-4.

6.4.2 Blended Risk Approach The categorization process blends PRA risk insights with deterministic insights to arrive at a consensus-based risk category for system functions and components. In addition, the risk of passive components or the passive function of active components is separately determined through a similar PRA-deterministic process. The final risk of

SOUTHERN A COMPANY E-;urtyl(l$trn Y(J101J'\\f'IJrlJ' 6.4.3 6.4.4 6.4.5 6.4.6 Southern Nuclear Operating Company Nuclear NMP-ES-065 Management 10 CFR 50.69 Program Version 1.0 Procedure Page 13 of 17 components is the higher of the PRA risk, deterministic risk, or passive risk (if applicable).

Qualitative Insights Qualitative insights should be used to supplement the PRA risk results. Due to PRA assumptions and limitations, such as those mentioned above, qualitative insights are typically needed to categorize components within a particular plant system, primarily because many components in a particular system are not by the PRA. In addition, these insights can provide an alternate and va pective that can be blended with the PRA results to reach an overall risk

. Qualitative insights include, but are not necessarily limited, to the Supplementary analyses that are used to PRA limitations in quantifying the risk during plant may not modeled such as fire risks, seismic risks, IClUIVv,i;), external floods, etc.)

Qualitative risk assessment likelihood of failure of the SSC under Maintenance of d ning function (also referred to as passive passive fu of active components are required to undergo a to determine their passive risk. This process is based on the inspection (RI-ISI) evaluation methodology, supplemented rations. Each piping segment is categorized as HSS uences of an assumed pressure boundary failure. The I<:lT",",nc use both PRA and deterministic insights.

considered HSS based on PRA results, deterministic results, or eva of passive risk (if applicable), shall be categorized as RISC-1 or RISC-2.

Otherwise, they can be categorized as RISC-3 or RISC-4.

Integrated Decision Making Panel sse categorization shall be performed by an lOP, staffed with expert, plant knowledgeable members. For the purpose of the categorization process, the expertise of the lOP members shall include, at a minimum, PRA, safety analysis, plant operation, design engineering, and system engineering. The lOP evaluates PRA risk results along

Southern Nuclear Operating Company SOUTHERNA COMPANY Etr"'VII1~f'H l'O,..r~rlJ*

6.4.7 6.4.8 6.4.9

1.

2.

6.S 6.S.1 Nuclear NMP-ES-06S Management 10 CFR SO.69 Program Version 1.0 Procedure Page 14 of 17 with deterministic insights and defense-in-depth to arrive at consensus-based categorization decisions.

Risk Significant Attributes For each HSS component, the attributes of the component that are associated with its safety significance are identified.

Scope of SSC categorization The categorization process is a voluntary process applied to selected plant systems or structures. However, once a system made, then all the components within the system or structure are not just specific components within a system or structure. The for a particular system or structure includes all system or CCI'1.I"I!:ITOf1 with that system and possessing a unique com the Plant Data Management System (PDMS).

Periodic Reviews and lJolrtnr'm!:l reviews shall be conducted to to review SSC performance.

industry and plant operational categorizations.

on guidance related to 50.69, the Nuclear Licensing Department Report to reflect which systems have Alternative Treatment Requirements are removed from the scope of the following special treatment

Maintenance Rule [10 CFR SO.6S]

Environmental Qualification [10 CFR S0.49]

Seismic Qualification [Portions of Appendix A to 10 CFR Part 100]

Applicable portions of ASME XI repair & replacements, with limitations [10 CFR SO.SSa{g)]

Applicable Portions of IEEE standards [10 CFR SO.SSa(h)]

In-service Testing [10 CFR SO.SSa{f)]

SOUTHERNA.

COMPANY FJI"DltlMrw Y"",.-W"rlJ*

6.5.2 6.5.3 6.5.4 6.5.5 6.5.7 Southern Nuclear Operating Company Nuclear NMP-ES-065 Management 10 CFR 50.69 Program Version 1.0 Procedure Page 15 of 17 In-service Inspection [10 CFR 50.55a(g}]

Local Leak Rate Testing [10 CFR 50 Appendix J]

Quality Requirements [10 CFR 50 Appendix 8]

Deficiency Reporting [10 CFR Part 21]

Event Reporting [10 CFR 50.55(e)]

Notification Requirements [10 CFR 50.72]

It is important to note that although the above requirem no longer be applicable to RISC-3 components, 10 CFR 50.69 does not elimin

'I"toc!,nn requirement that RISC-3 components be capable of performing their functions. Rather, 10 CFR 50.69 provides for the use of alternative rovide "reasonable confidence that RISC-3 SSCs remain capable r safety-related functions under design basis conditions, i ons and environmental conditions and effects throughout their se Treatment Program procedures or g treatment requirements should be are removed from the scope and to applicable, to provide reasonable confidence that eir design basis function.

ar program are implemented requirements continue to program to incorporate treatment requirements r apply per 10 CFR 50.69

'tr"""hn,on't elements that support the design basis alternative treatment options shall be evaluated in order to determine if additional controls or be applied, conSidering their risk significance and operational RISC-shall continue to be subject to existing special treatment requirements. However, in accordance with 10 CFR 50.69, RISC-1 components shall also be evaluated to determine if additional requirements are necessary to ensure that the performance of these components remains consistent with the assumed performance in the categorization process (including the PRA) for beyond design basis functions.

Southern Nuclear Operating Company Nuclear NMP-ES-065 SOUTHERN A.

Management 10 CFR 50.69 Program Version 1.0 COMPANY ERIT'O ttls#rPt YQlilr War/J" Procedure Page 16 of 17 6.5.8 Other Considerations The objective of implementing 10 CFR 50.69 is to allow increased focus and resources to be applied to safety significant SSCS. Given this, plant processes and procedures associated with the operation and maintenance of the plant should be revised to take advantage of the categorization results and the reduction of treatment requirements. The general approach is to increase focus and attention on RISC-1 and RISC-2 components while allowing increased flexibility for RISC-3 and RISC-4 components. Processes that would benefit from this approach include but are not lim Preventive Maintenance Corrective Maintenance Condition Reporting Design Change Control Procurement Work Control Quality Inspections 7.0 Records This procedure itself does not gene procedure generate records.

8.0 Commitments None

_Attachment 1: Summary of relationship of this procedure (NMP-ES-065) with associated instructions and NMP-ES-066 (Integrated Decision Making Panel General Guidance For Risk Informed SSC Categorization Program and Independent Decision-Making Panel For Surveillance Frequency Control Program)

NMP-ES-065 10 CFR 50.69 Program (Categorization and Treatment of SSC)

Provides overview of the 50.69 process and contains all definition NMP-ES-065-003 Active Component Risk Combines results of NMP-ES-065-001 and NMP-ES-065-002.

Bins each component into RISC-1 through 4 categories. These results are sent to lOP (NMP-ES-066-001) for NMP-ES-066-001 review and approval 50.69 IDP Review Review and approve preliminary LSS/HSS designation of ALL components NMP-ES-065-001 Active Component Risk For LSS, review the risk information, defense-in-depth, and Analyze 5 risks via PRA model OR Passive Component Risk safety margins qualitative approach Assigns LSS or HSS Components not modeled are neither LSSorHSS.

Vogtle Electric Generating Plant Pilot 10 CFR 50.69 License Amendment Request Draft Risk-Informed Categorization Procedures Draft NMP-ES-065-001 10 CFR 50.69 Active Component Risk Significance Insights

Southern Nuclear Operating Comj)an~

Nuclear NMP-ES-065-001 SOUTHERN A 10CFR50.69 Active Component Risk Management Version 1.0 COMPANY Significance Insights

""ffX~/Jj.';nu y".J"~IJ*

Instruction Page 1 of 34 Instruction Owner:

(Print: Name / Title / Site)

Approved By:

(Peer Team Champion/Procedure Owner's Signature / Date)

Effective Dates:

Corporate FNP HNP VEGP 1-2 VEGP 3-4 This NMP is under the oversight of the Risk-Informed Engineering Department Writer(s):

Plant Review Board (PRB) review and approval is required for this NMP PROCEDURE USAGE REQUIREMENTS SECTIONS Procedure must be open and readily available at the Continuous Use:

work location. Follow procedure step by step unless otherwise directed by the ~rocedure.

I Procedure or applicable section(s) available at the work

~-

Reference Use:

location for ready reference by person performing steps.

Information Use:

Available on site for reference as needed.

ALL

SOUTHERN A COMPANY F~t'rrrll1~rw 1~IIII.rV411"1Il' Southern Nuclear Operating COl11pany Nuclear 10CFR50.69 Active Component Risk Management Significance Insights Instruction NMP-ES-065-001 Version 1.0 Page 2 of 34 Revision Description Version Number 1.0 Initial issue Revision Descri tion

Southern Nuclear Operating Company Nuclear NMP-ES-06S-001 10CFRSO.69 Active Component Risk SOUTHERN A Management Version 1.0 COMPANY Significance Insights, i.,'.t'-'X'!tfJ,'inn rol.('\\l~,'.l-Instruction Page 3 of 34 1.0 2.0 3.0 4.0 S.O 6.0 7.0 8.0 Purp.ose.............................................................................................................

Applicability

.............................4 Records

................................ 7 commit~~~~~::::::::::: :::: :::::::: :::: ::::::::::::::::: ::::::::: ::::::::::::::: ::::: :::::::::: :::: :::::::::: :::::: ::::::::: :::::::::::::::~:

Southern Nuclear Operating Company Nuclear NMP-ES-065-001 10CFR50.69 Active Component Risk SOUTHERN.\\.

Management Version 1.0 COMPANY Significance Insights

"*,,..~UJ s..1'N r~wrVi".r Instruction Page 4 of 34 The purpose of this 1 OCFR50.69 Active Component Risk Significance Instruction is to promote effective, consistent use of the 1 OCFR50.69 program across the SNC fleet.

This instruction includes requirements and instructions for the determination of risk Significance of Active structures, systems, and components (SSCs) in accordance with 10 CFR 50.69, Risk Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors.

This instruction is part of an integrated categorization process which includes the following procedures/instructions.

NMP-ES-065, 10 CFR 50.69 Program NMP-ES-065-001, 10 CFR 50.69 Active Component Risk Significance Insights

NMP-ES-065-002, 10 CFR 50.69 Passive Risk InSights

NMP-ES-065-003, 10 CFR 50.69 Risk Significance Categorization for Systems, Structures, and Components NMP-ES-066, Integrated Decision Making Panel General Guidance For Risk Informed SSC Categorization Program and Independent Decision-Making Panel For Surveillance Frequency Control Program

NMP-ES-066-001, Integrated Decision-Making Panel For Risk Informed SSC Categorization: Duties And Responsibilities The process described in this instruction and the above-listed procedures/instructions is considered to satisfy the requirements of 10 CFR 50.69 (c), SSC Categorization Process, (e), Feedback and Process Adjustment, and (f). Program Documentation, Change Control, and Records. The scope of this instruction does not include alternative treatment requirements specified in 10 CFR 50.69 (d) and which are discussed separately in instruction NMP-ES-065-004.

NOTE: This instruction has been developed in antiCipation of NRC approval of a license amendment request to adopt 10 CFR 50.69. Categorization activities described in this instruction may be performed prior to NRC approval of the license amendment. However. the alternative treatment requirements specified in 10 CFR 50.69 (d) shall NOT be implemented UNLESS the following actions are verified to be completed:

After the license amendment is approved by the NRC, an evaluation shall be performed and documented to ensure that the process described in this instruction meets the requirements of, and is consistent with, the NRC-approved license amendment. The performance of this evaluation shall be tracked via a Condition Report action. This evaluation shall be approved by the Manager, Risk-Informed Engineering and by the Manager, licenSing. The instruction shall then be revised at this time to remove this Section.

IF the above evaluation concludes that the process described in this instruction does not meet the requirements of, or is inconsistent with, the approved license amendment, THEN this instruction shall be revised accordingly and any evaluations or activities already performed shall be re-performed using the revised procedural requirements.

Southern Nuclear Operating Company Nuclear NMP-ES-065-001 1 OCFR50.69 Active Component Risk SOUTHERN A Management Version 1.0 COMPANY Significance Insights pfIHt,'r/. Str~.. Y9JU' '\\X"IIi1/'

Instruction Page 5 of 34 This instruction is applicable only to those plant systems that have been selected for categorization. Since 10 CFR 50.69 is a voluntary rule, each Site may decide which plant systems to categorize or not categorize. However, once a system is selected for categorization, ALL the components in that system MUST be included in the categorization process.

This instruction was created and is maintained under the direction of the Risk-Informed Engineering Manager.

3.0 {;~R~ftiifi6Qe.

3.1 10 CFR 50.69, "Risk-Informed Categorization And Treatment Of Structures, Systems And Components For Nuclear Power Reactors" 3.2 NEI 00-04, "10 CFR 50.69 SSC Categorization Guide, Revision 0" 3.3 NRC Regulatory Guide 1.201, "Guidelines For Categorizing Structures, Systems, and Components in Nuclear Power Plants According to Their Safety Significance," Rev 1 (for Trial Use), May 2006 3.4 NMP-ES-06S, 10 CFR SO.69 Program 3.5 NMP-ES-06S-002, Passive Risk Insights 3.6 NMP-ES-06S-003, 10CFRSO.69 Risk Informed Categorization for Systems, Structures, and Components 3.7 NMP-ES-06S-004, Alternative Treatment Requirements 3.8 NMP-ES-066, Integrated Decision Making Panel General Guidance For Risk Informed SSC Categorization Program and Independent Decision-Making Panel For Surveillance Frequency Control Program 3.9 NMP-ES-066-001, Integrated Decision-Making Panel For Risk Informed SSC Categorization:

Duties And Responsibilities 3.10 EPRI TR-1 016737, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments" 3.11 NRC Regulatory Guide 1.200, "An Approach For Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities", Rev 2, March 2009 3.12 RA-Sa-2009, "Standard for Level1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications", Addenda to ASME/ANS RA-S-2008, ASME/ANS, 2009.

All definitions are contained in NMP-ES-06S. This instruction shall be used with NMP-ES-06S.

Southern Nuclear Operating Company Nuclear NMP-ES-065-001 1 OCFR50.69 Active Component Risk SOUTHIRNA Management Version 1.0 COMPANY Significance Insights f'wrj.'( N,~ r,no...'Il-ju/iC Instruction Page 6 of 34

~,v.;~. '*.;S<<,p~iI~ib'i!itlis 5.1 Responsibilities for the 1 OCFR50.69 Process are found in NMP-ES-065.

5.2 The cognizant Risk-Informed Application engineer is responsible for the following activities associated with the active SSC risk significance process.

5.2.1 Providing the internal events at power PRA base case risk importances for SSCs in the system under review, for system SSCs modeled in the PRA and system SSCs not modeled in the PRA.

5.2.2 Providing the results of other hazards analyses risk importances and insights for SSCs in the system under review for those hazards that are not modeled in the PRA.

5.2.3 Providing the results of the integrated risk importance analysis for SSCs in the system under review.

5.2.4 Providing the results of sensitivity studies of the impact of uncertainties in assumptions, such as those related to common cause, human reliability, and failure rates for SSCs that are candidate LSS.

5.2.5 Providing additional PRA Model insights which may influence the SSC categorization outcome.

5.2.6 Providing PRA risk changes, resulting from model updates or other factors that could impact existing SSC categorizations.

5.2.7 Over time, partiCipating in the periodic performance review process and analyzing the impact of changes in performance of SSCs categorized as LSS on the risk significance results.

5.3 The cognizant System Engineer is responsible for the following activities associated with the active SSC risk significance process.

5.3.1 Providing the list of systems, functions, and associated SSCs for which risk significance information is required.

5.3.2 Providing design basis and severe accident functions of SSCs relative to each hazard evaluated.

Southern Nuclear Operating Company Nuclear NMP-ES-065-001 10CFR50.69 Active Component Risk SOUTHIRNA Management Version 1.0 COMPANY Significance Insights 1,\\I'lI'It) s.r..,., YclJIfl'llit".M' Instruction Page 7 of 34 6'.o**~~~rQ~E!aqie Reqult~me;nts 6.1.1 Risk Categories SSCs shall be categorized as HSS or LSS using the categorization process outlined in this instruction.

6.1.2 PRA Capability The plant internal events at power PRA model of record is used in this assessment.

The risk-informed categorization of SSCs in nuclear power plant applications requires the use of an appropriately detailed PRA of sound technical quality. At a minimum, the PRA must model severe accident scenarios resulting from internal initiating events occurring at full power operation. NRC expectations for PRA capability for 50.69 categorization application are that the internal events at power PRA will have been peer reviewed against the requirements in the ASME/ANS PRA Standard (e.g., RA-Sa-2009 -- Ref. 3.12 -- or subsequent revisions) as endorsed with NRC clarifications in Reg Guide 1.200 (Ref. 3.11), and shown to meet most requirements in that standard at capability category 1/ or better. If there are areas where the PRA does not meet a requirement at capability category II, an assessment should be made, and documented, regarding the potential impact of such limitations on the 50.69 categorization application and the manner in which they will be compensated for in using the PRA. A similar confirmation of technical adequacy is required for each PRA model used in the categorization process (e.g., internal events at power, internal fire, seismic, etc.).

In using the PRA for 50.69 categorization, a characterization of the adequacy of the PRA, as well as PRA limitations, must be stated as part of the presentation of categorization results to the IDP as a basis for the adequacy of the risk information used in the categorization process.

Such limitations might include hazards that are not modeled (e.g., external initiating events),

plant shutdown risks, and SSCs that are not modeled.

6.1.3 Determination of SSC Importances The assessment of importance for an SSC involves the identification of PRA basic events that represent the SSC. This can include:

events that explicitly model the performance of an SSC (e.g., pump X fails to start),

events that implicitly model an SSC (e.g., some human actions, initiating events, etc.), or a combination of both types of events.

The PRA analyst must identify the events in the PRA that can be used to represent each SSC.

Within this mapping, record whether the PRA explicitly models the performance of the SSC (e.g., pump X fails to start), implicitly models SSC (e.g., via assumption for availability to support a human action, as a contributor to an initiating event, etc.) or a combination of both types of events.

Southern Nuclear OJ)erating Company Nuclear NMP-ES-065-001 1 OCFR50.69 Active Component Risk SOUTHERNA Management Version 1.0 COMPANY Significance Insights F'J~I""JlIJ..VtW Y"lWr~'

Instruction Page 8 of 34 The contribution of common cause to a component's importance must also be addressed. If a component does not have a common cause basic event in the PRA to be included in the computation of importances, then an assessment should be made as to whether a common cause event should be added to the model.

6.1.4 Availability of PRA models for Risk Contributor When new PRA models are developed for additional risk contributors (e.g., seismic, other external events, shutdown, etc.) and approved for use in 50.69 categorization, it is NOT necessary to re-categorize systems that have already been categorized using appropriate qualitative analysis (e.g., SMA for seismic risk. Shutdown DID for shutdown risk, etc.)

UNLESS the results of the new PRA models indicate that the risk importances of previously categorized component modeled in the new PRA exceed the criteria for candidate HSS as specified later in this section.

Use the following guidance to determine if a system that was already categorized using a qualitative analysis should be re-categorized using newly-developed models for other risk contributors.

6.1.4.1 Review the set of CDF and LERF basic event importances from the new risk contributor PRA to determine if there are any previously-categorized components for which the new basic event importances exceed the criteria for HSS.

6.1.4.2 IF the new risk contributor PRA basic event importances for any previously categorized components exceed the criteria for HSS, THEN determine the integrated risk importance for those components following the process defined in Steps 6.3 and 6.4.

6.1.4.3 IF, following the integrated risk importance evaluation, the component(s} still meet the criteria for candidate HSS, THEN the systems associated with these components MUST be re-categorized.

6.1.4.4 Re-categorization is NOT required for systems with components whose new risk contributor PRA basic event importances do not meet the criteria for HSS, or whose integrated risk importance evaluation does not meet the criteria for HSS.

However, it may be beneficial to re-categorize these particular components if the risk is lowered.

,-------~---.--------

NOTE Appropriate steps in the following process are to be documented, including the basis. As applicable. this documentation should be entered into a database and coded where practical in order to facilitate data manipulation and retrieval tasks.

Southern Nuclear Operating ComjJarty Nuclear NMP-ES-065-001 SOUTHERN A.

Management 1 OCFR50.69 Active Component Risk Version 1.0 COMPANY Significance Insights F:~('rxy In S#-J"W y".u-\\l-.ilthi'"'

Instruction Page 9 of 34 The NEI 00-04 categorization process addresses a full scope of hazards, as well as plant shutdown safety. Due to the varying levels of uncertainty and degrees of conservatism in the spectrum of risk contributors, the risk significance of SSCs is initially assessed separately from each of five risk perspectives, and then an integrated risk significance evaluation is used to identify SSCs that are potentially safety significant for consideration by the lOP. The 5 risk perspectives are:

Internal Event Risks Fire Risks Seismic Risks Other External Risks (e.g., tornados, external floods, etc.)

Shutdown Risks Separate evaluation is appropriate to avoid reliance on a combined result that may mask the results of individual risk contributors.

Table 6-1 provides a summary of the alternative approaches taken to address each risk contributor. A brief description of each of these aspects is described in the following paragraphs.

Southern Nuclear Operating Company SOUTHERN A COMPANY rUrt.l IO.VI'W r".,rv"HJ" Nuclear Management Instruction 10CFR50.69 Active Component Risk Significance Insights NMP-ES-065-001 Version 1.0 Page 10 of 34 Table 6-1 Summary of Risk Significance Characterization Used in NEI 00-04 I Risk Source Alternative Approaches Scope of Safety-Significant SSCs PRA Required Per PRA Risk Ranking ____

Screening Approaches Not-n/a Internal Events Allowed Fire PRA Per PRA Risk Ranking~

FIVE (Fire Induced Vulnerability All SSCs Necessary to Fire Evaluation)

Maintain Low Risk Seismic PRA Per PRA Risk Ranking SMA (Seismic Margins Analysis)

All SSCs Necessary to Seismic Maintain Low Risk 1

PRA Per PRA Risk Ranking High Winds, IPEEE Screening All SSCs Necessary to Protect I External Floods, Against Hazard etc.

I Shutdown PRA Per PRA Risk Ranking IShutdown Shutdown Safety Plan All SSCs Required to Support I

J Shutdown Safety Plan

Southern Nuclear Operating Company Nuclear NMP-ES-065-001 SOUTHERN A Management 10CFR50.69 Active Component Risk Version 1.0 COMPANY Significance Insights l'nxrl{1Mtw Y;;lilrV..ulj' Instruction Page 11 of 34 6.3.1 The process for assessing risk hazards identified in Table 6-1 is defined below (sections 6.3.2 through 6.3.14), consistent with NEI 00-04 (Ref. 3.2). This process will provide the following risk assessment results to be provided as input to the overall categorization of SSCs.

For components that are modeled by one or more PRAs, an integrated importance assessment (per 6.3.14) of LSS or HSS for each such component.

For any of the above hazards that are NOT modeled in the PRA, the results of the hazards evaluations (bounding, qualitative, or screening) that indicate which components are considered HSS.

For modeled components that are identified as having an integrated importance assessment of LSS, the results of the required sensitivity studies

Modeled components that are identified as having an integrated importance assessment of LSS and are within 10% of the threshold for HSS (referred to as buffer zone components).

6.3.2 Internal Events at Power Risk Importance Using the Internal Events at Power PRA The use of the internal events at power PRA to quantify the risk importance measures for the identified functions and SSCs in the system of interest is described in this section. The overall process is shown in Figure 6-1, per NEI-00-04. This risk importance process, including sensitivity studies, is performed for both CDF and LERF. Components being categorized must satisfy the risk importance criteria described in Table 6-2 for both CDF and LERF in order to be candidate LSS.

Table 6-2 Risk Importance Criteria for HSS I----~~--~~----

~--~------1 Sum of F-V for all basic events modeling the SSC of interest, including common cause events, > 0.005

~~---------------

I Maximum of component basic event RAW values> 2 Maximum of applicable common cause basic events RAW values> 20

Southern Nuclear Operatif!g Company Nuclear NMP-ES-065-001 1 OCFR50.69 Active Component Risk SOUfHERNA Management Version 1.0 COMPANY Significance Insights J:fltfw t *.'i"N"# fIilJlII.I*)lt.u/;/A Instruction Page 12 of 34 Figure 6-1 (NEI-OO-04 Figure 5-2)

RISK E....{PORTA..'l'CE ASSESS:vIE:!\\'Y PROCESS FOR COMPO~"'ENTS ADDRESSED IN rNTER.N"AL EVENTS AT-PO\\VER PRAs.

ldet'tifol Safety Sign~nt MliblJles of Ccmpa1el'tt Inducing SeflSltvity

'"------~,."

Southern Nuclear Operating Company Nuclear NMP-ES-065-001 10CFR50.69 Active Component Risk SOUTHERNA Management Version 1.0 COMPANY Significance Insights 1.<tN'fj '".V.I"I¥ Y_,. \\X.i>ffl/'

Instruction Page 13 of 34 NOTES In calculating the F-V risk importance measure, it is recommended that a CDF (or LERF) truncation level of five orders of magnitude below the baseline CDF (or LERF) value be used for linked fault tree PRAs. In addition, the truncation level used should be sufficient to identify all functions with RAW>2.

In cases where the internal events CDF (or LERF) is dominated by an internal flooding result that has a conservative bias, it is appropriate to break the evaluation of importance measures into two steps. This prevents the conservative bias of the flooding analysis from masking the importance of SSCs not involved in flood scenarios.

The first step uses importance measures computed using the entire internal events PRA.

The second step uses importance measures computed without the dominant contributor included. This prevents "masking" of importance by the dominant L-____~~~~~____________________________________.________

contributor.

6.3.2.1 Identify the PRA basic events that represent the SSCs of interest.

6.3.2.2 Create a mapping of those components to be categorized to the events in the PRA that can be used to represent each component.

a) Within this mapping, record whether the PRA explicitly models the performance of the component (e.g., pump X fails to start), implicitly models the component (e.g., via assumption for availability to support a human action, as a contributor to an initiating event, etc.), or treats the component as a combination of both types of events.

b) If a component of interest does not have a common cause event in the PRA to be included in the computation of importances, then an assessment should be made as to whether a common cause event should be added to the model.

6.3.2.3 Determine if the PRA model importance quantification process accounts for the contribution of the component's role in initiating events. That is, if a component is a contributor to a complicated initiating event (e.g., loss of NSCW or loss of CCW for PWRs, loss of condenser for BWRs), does the PRA model that initiator contribution explicitly (i.e., within the fault tree model) such that the component importances reflect both the mitigation and initiating event contribution?

a) If so, the PRA importance measures provide sufficient scope to perform the initial screening. Steps 6.3.2.6 through 6.3.2.8 define the component's candidate safety significance.

b) If not, additional evaluation as defined in Step 6.3.2.9 is required.

Southern Nuclear Operating Com-'pan~

Nuclear NMP-ES-065-00 1 10CFR50.69 Active Component Risk SOUTHERN A Management Version 1.0 COMPANY Significance Insights 1':...r.t~I4.~ t"ilt-W..rI.r Instruction Page 14 of 34 6.3.2.4 If the PRA model importance accounts for the contribution in initiating events. then for each component of interest, use the internal events at power PRA to calculate the F-V and RAW for that component.

a) The F-V importance of a component is the sum of the F-V importances for the failure modes of the component relevant to the function being evaluated.

Risk reduction worth (RRW) is also an acceptable measure in place of F-V because the F-V criteria can be readily converted to RRW criteria.

b) The RAW importance of a component is the maximum of the RAW values computed for basic events involving failure modes of the individual component.

c)

The RAW importance of the common cause events involving a component must also be evaluated. The maximum of the applicable common cause basic event RAW values is used.

6.3.2.5 If the PRA model importance accounts for the contribution in initiating events and if any of the risk importance criteria listed in Table 6-2 are exceeded for a component, that component is considered candidate high safety significant, and its safety significant attributes must be documented. Table 6-3 provides examples of the use of these criteria.

6.3.2.6 If the PRA model importance accounts for the contribution in initiating events and if the component's risk importances are less than each of the criteria in Table 6-2, then include the component in the set of potential candidate LSS components for which sensitivity studies are to be performed (Step 6.3.3).

6.3.2.7 For those components for which the PRA model importance quantification process does not account for the contribution of the component's role in initiating events, the following evaluations are required.

a) Determine whether the component exceeds any of the risk importance criteria in Table 6-2.

b) If so, the component is candidate safety-significant. Identify complicated initiating events for which F-V importance is > 0.005 and determine if the component can directly cause one of these complicated initiating events.

1. If the component can directly cause a complicated initiating event with F-V> 0.005, then document the component's safety significant attributes relative to both mitigation and event initiation.

2. If the component cannot directly cause a complicated initiating event with F-V > 0.005, then document the component's safety significant attributes relative to mitigation.

c)

If not, then:

1. If the component can directly cause a complicated initiating event with F-V > 0.005, then the component is candidate safety significant.

Document the component's safety significant attributes relative to event initiation.

2. If the component cannot directly cause a complicated initiating event with F-V > 0.005, then include the component in the set of potential candidate LSS components for which sensitivity studies are to be performed (Step 6.3.3).

Southern Nuclear Operating Companj' Nuclear NMP-ES-065-001 1 OCFR50.69 Active Component Risk SOVTHERNA Management Version 1.0 COMPANY Significance Insights Ft<ny.r Id SUN YaNyW.,tltl*

Instruction Page 15 of 34 Table 6-3 EXAMPLE IMPORTANCE

SUMMARY

(NEI-OO-04 Table 5-1}

ICOMPONENT FAILURE MODE F-V RAW CCF RAW 1 Valve 'A' Fails to 0 en 0.002 1.7 n/a 2 Valve 'A' Fails to Remain Closed 0.00002 1.1 n/a 3 Valve 'A' In Maintenance (Closed) 0.0035 1.7 n/a

,4 Common Cause Failure of Valves 'A',

0.004 n/a 54

'B', &'C' to Ot!en 15 Common Cause Failure of Valves 'A' 0.0007 n/a 5.6

& 'B' to 0t!en 16 Common Cause Failure of Valves 'A' 0.0006 n/a 4.9

& 'C' to 0 en 0.01082 1.7 54 (max)

Component Importance

{sum}

{max}

I Criteria

> 0.005

>2

>20 i Candidate Safet -si nificant?

Yes No Yes In this example, valve 'A' would be considered candidate safety significant on two bases, either one of which would be sufficient to identify the component as candidate safety-significant:

(1) The total F-V exceeded the criterion of 0.005, and (2) The RAW criterion was also met for the common cause group including valve 'A'.

Note that valve 'A', valve 'B' and valve 'C' would be identified as candidate safety-significant due to this criterion.

The component failure mode which contributes significantly to the importance of valve 'A' is failure to open (failure modes 1,4, 5 and 6 as shown above). This failure mode is used in the identification of safety-significant attributes. If an individual failure mode had not alone exceeded the screening I. criteria, then the sigl1ificantly contributing failure modes would be used in defining the attributes.

6.3.3 Internal Events at Power PRA Sensitivity Studies 6.3.3.1 If the importance measures computed by the PRA tool indicate that ALL components, including non-safety-related components, are HSS, then the recommended sensitivity studies are not needed for the system that is being categorized.

However. if the importance measures computed by the PRA tool do not indicate that a component meets the F-V or RAW criteria for HSS (Le., may be candidate LSS), then sensitivity studies are used to determine whether other conditions might lead to the component being safety-significant, based on the same F-V and RAW criteria used in the base case.

If an SSC that had been initially identified as candidate LSS is found to exceed the safety significance thresholds in one of the specified sensitivity studies, this information is to be documented as part of the information package to be considered in the risk significance categorization (per Ref. 3.6). This information package is ultimately provided to the IDP (per Ref. 3.8) for consideration, along with an explanation of the results of the sensitivity study.

Southern Nuclear Operating Company Nuclear NMP-ES-065-001 10CFRSO.69 Active Component Risk SOUTHERN A.

Management Version 1.0 COMPANY Significance Insights rlfN'i'l w.'krrv Y66/r It.d,/'

Instruction Page 16 of 34 6.3.3.2 The recommended sensitivity studies for internal events PRA are identified in Table 6-4.

a) The sensitivity studies on human error rates, common cause failures, and maintenance unavailabilities are performed to ensure that assumptions of the PRA are not masking the importance of an SSC. In these sensitivities, the indicated changes are made to ALL of the associated basic events in the PRA, not just those associated with the system being categorized. For example, in the first sensitivity, the 9Sth percentile values are used for ALL HEPs in the PRA.

b) In cases where plant-specific uncertainty distributions are not readily available, other PRAs should be reviewed to identify appropriate parameter ranges. Experience with plant-specific PRAs has shown that the variations in distributions are relatively small, especially with respect the ratio of the mean and 95th percentile values in lognormal distributions (the most common distribution used in PRAs). Guidance on evaluation of uncertainty, and identification of important and key assumptions and sources of uncertainty in the PRA, is provided in EPRI TR-1016737.

c)

If the sensitivity studies identify that the component could be safety Significant, then the safety-significant attributes that yielded that conclusion should be identified.

Table 6-4 Sensitivity Studies For Internal Events PRA (adapted from NEI-OO-04 Table 5-2) l

--~.---..--~

Sensitivity Study I

~--------I I' Increase all human error basic events to their 95th percentile value I

Decrease all human error basic events to their 5th percentile value

Increase all component common cause events to their 95th percentile value

Decrease all component common cause events to their 5th percentile value

Set all maintenance unavailability terms to 0.0

~

Any applicable sensitivity studies identified in the characterization O~;RA I adequacy and identification of important assumptions and sources of uncertainty.

I I

6.3.3.3 If, following the sensitivity studies, the component is still found to be LSS from an internal events perspective, it is a candidate for RISC-3 or RISC-4. In this case the analyst is to identify qualitative reasons as to why the component is of low risk significance from the internal events at power perspective (e.g., does not perform an important function, there is excess redundancy in the system or function, low frequency of challenge, etc.). The component is retained as candidate low safety significant from an internal events at power risk perspective.

Southern Nuclear Operating Company Nuclear NMP-ES-065-001 SOUTHERN A Management 10CFR50.69 Active Component Risk Version 1.0 COMPANY Significance Insights roO"" t3 ".......,.." f_1' 'Kiul,,'

Instruction Page 17 of 34 6.3.4 Internal Fire Risk Importance Evaluation using Fire PRA 6.3.4.1 For plants with a fire PRA, the generalized safety significance process is the same as the process for an internal events at power PRA. This process is shown on Figure 6-2, and is discussed in the following steps.

NOTE The risk importance process used for the internal events at power PRA is slightly modified to consider the fact that most fire PRAs do not have the ability to aggregate the mitigation importance of a component with the fire initiation contribution. For that reason, components are evaluated using standard importance measures for their mitigation capability only.

L __

6.3.4.2 Use the Fire PRA to quantify the fire risk importance measures for the identified SSCs in the system of interest. The overall process is shown in Figure 6-2, per NEI-00-04.

NOTE If the fire PRA COF, including all screened scenarios, is a small fraction of the internal events at power COF (Le., <1 %), then safety significance of SSCs considered in the fire PRA can be considered LSS from a fire perspective.

Note Fire suppression systems that are evaluated using the fire risk analysis can be categorized using this process. However, in order to apply this categorization process to suppression systems, specific sensitivity studies may be required to identify their relative importance, consistent with F-V and RAW (guarantee success/failure). In general, fire barriers would not be in the scope of this guideline unless the fire risk analysis allows the quantification of the impacts of failure of the barrier.

In cases where the impact of fire barrier failure can be evaluated in the risk analysis, the categorization process is applicable.

Sensitivity studies should be used to identify the role a barrier plays in maintaining risk levels.

6.3.4.3 This risk importance process is performed for both COF and LERF.

NOTE Where LERF cannot be quantitatively linked into the fire model, the inSights from the internal events LERF model should be qualitatively coupled with the assessment of fire impacts on containment isolation to develop recommendations for the lOP on contributors.

Southern Nuclear Operating Company Nuclear NMP-ES-06S-001 10CFRSO.69 Active Component Risk SOUTHIRNA Management Version 1.0 COMPANY Significance Insights F'NfflYlO.VI'F'# Y<ulIl"\\t.iuIJ" Instruction Page 18 of 34 6.3.4.4 For each component of interest, use the fire PRA to calculate the F-V and RAW for that component.

6.3.4.S If any of the risk importance criteria listed in Table 6-2 are exceeded for a component, that component is considered candidate high safety-significant, and its safety significant attributes must be documented. Table 6-3 provides additional guidance in evaluating risk importance results.

6.3.5 Internal Fire PRA Risk Importance Sensitivity Studies 6.3.S.1 If the component's risk importances are less than each of the criteria in Table 6-3, then perform the recommended fire PRA sensitivity studies (as identified in Table 6-S).

6.3.S.2 If the sensitivity studies identify that the component could be safety-significant, then the component is designated as candidate high safety-significant from a fire risk perspective and the attributes which yielded that conclusion should be identified.

6.3.S.3 If the sensitivity studies confirm that the component's risk importances are less than each of the criteria in Table 6-2, then the component may be candidate low safety significant from a fire risk perspective.

a) If such a component is not safety related, then it is candidate low safety significant from a fire risk perspective.

b) If such a component is safety-related, then qualitative reasons must be identified as to why the component is of low fire risk significance (e.g., does not perform an important function, there is excess redundancy in the system or function, low frequency of challenge, etc.), and the component is retained as candidate low safety significant from a fire risk perspective.

Table 6-5 Sensitivity Studies For Fire PRA 1_~~~___~~___~a_~aPte~ from NEI-OO-04:able 5-3)

I Sensitivity Study ~

I* Increase all human error basic events to their 95th percentile v_a_lu_e__~---l I

Decrease all human error basic events to their 5th value

.* Increase aI/ component common cause events to their 95th percentile value

Decrease all component common cause events to their 5th percentile value

Set all maintenance unavailability terms to 0.0 I* No credit for manual suppression

Any applicable sensitivity studies identified in the characterization of PRA adequacy and identification of important assumptions and sources of uncertainty.

Southern Nuclear Operating Company Nuclear NMP-ES-065-001 10CFR50.69 Active Component Risk SOUTHERN A Management Version 1.0 COMPANY Significance Insights 1',u-xrtl1-S#m Yullli'1rllt/J"'

Instruction Page 19 of 34 6.3.6 Internal Fire Safety Significance Without Fire PRA 6.3.6.1 For plants for which a fire PRA has not been developed, NEI-00-04 allows the use of the EPRI Fire Induced Vulnerability Evaluation (FIVE) methodology, which is a process to assist in identifying potential fire susceptibilities and vulnerabilities. As SNC plants do not have FIVE analyses, the alternative approach selected for plants without a fire PRA is to use the plant Fire Safe Shutdown analysis.

NOTE Although this is a departure from NEI-00-04, it represents an additional deterministic conservatism in the process, as it will reduce the benefit that might otherwise be derived from a risk-informed categorization of fire risk importance using a fire PRA.

6.3.6.2 For each component, identify the fire design basis and severe accident functions of the component.

6.3.6.3 Review the plant's Fire Safe Shutdown analysis to determine if the component is credited as part of the safe shutdown paths evaluated.

a) If a component is credited as part of a fire safe shutdown path, it is considered safety-significant from a fire risk perspective, and the attributes which yielded that conclusion should be identified. For example, document which key safety function(s) the component supports in the Fire Safe Shutdown analysis, and any relevant assumptions in the Fire Safe Shutdown analysis regarding component availability or reliability.

b) If the component does not participate in the safe shutdown path, then it is considered a candidate low safety-significant with respect to internal fire risk.

Southern Nuclear Operating Company Nuclear NMP-ES-065-001 1 OCFR50.69 Active Component Risk SOVTHERNA Management Version 1.0 COMPANY Significance Insights

'Hffj!,UI,!j,,/# 'Q_,.U,.IJ' Instruction Page 20 of 34 Figure 6-2 RISK Th1PORT.':\\"'~CI PROCESS fOR COlv[PONENTS AnnRFSSF.n IN;:;TRF. SETS"-fTC &

OY--iER EXTER.'fAL HAZARD PRAs I<t>W11ify 9:.rl"Y Signifkont

Atributes of CompOl1~l"It

Southern Nuclear Operating Company Nuclear NMP-ES-065-001 SOUTHERN A.

Management 10CFR50.69 Active Component Risk Version 1.0 COMPANY Significance Insights T.tX.".S#rrt f..-r\\f:;'I"U' Instruction Page 21 of 34 6.3.7 Seismic Risk Importance Evaluation using Seismic PRA 6.3.7.1 For plants with a seismic PRA, the generalized safety significance process is the same as the process for an internal events at power PRA. This process is shown on Figure 6-2, and is discussed in the following steps.

NOTE The risk importance process used for the internal events at power PRA is slightly modified to consider the fact that seismic events cannot be caused by plant components, hence there is no initiation contribution to importance. For that reason, components are evaluated using standard importance measures for their mitigation capability only.

6.3.7.2 Use the seismic PRA to quantify the fire risk importance measures for the identified SSCs in the system of interest. The overall process is shown in Figure 6-2, per NEI-OO-04.

NOTE If the seismic PRA CDF, including all screened scenarios, is a small fraction of the internal events at power CDF (i.e., <1 %), then safety significance of SSCs considered in the seismic PRA can be considered LSS from a seismic perspective.

NOTE SSCs may have been screened out of the seismic PRA due to inherent seismic robustness. That is, in the development of the seismic PRA, certain SSCs may have been judged to have sufficiently high seismic capability that they would not be significant contributors to seismic risk within the capability of the seismic risk model, and therefore not included in the model. For such screened SSCs, regardless of their categorization outcome, it is important that the inherent seismic robustness that allows them to be screened out of the seismic PRA should be retained. For example, categorization of such screened components as RISC-3 or RISC-4 should not be viewed as implying that they do not need to retain their design seismic capability (they do). These considerations are necessary to maintain the validity of the categorization process.

6.3.7.3 This risk importance process is performed for both CDF and LERF.

NOTE Where LERF cannot be quantitatively linked into the seismic model, the insights from the internal events LERF model should be qualitatively coupled with the assessment of seismic impacts on containment isolation to develop recommendations for the IDP on LERF contributors.

6.3.7.4 For each component of interest, use the seismic PRA to calculate the F-V and RAW for that component.

Southern Nuclear Operating Company Nuclear NMP-ES-065-001 10CFR50.69 Active Component Risk SOUTHERN A Management Version 1.0 COMPANY Significance Insights l.. ffty I",\\;"'f"" r... 1' 'fA.dJ' Instruction Page 22 of 34 6.3.7.5 If any of the risk importance criteria in Table 6-2 are exceeded for a component, that component is considered candidate high safety-significant, and its safety significant attributes must be documented. Table 6-3 provides additional guidance in evaluating risk importance results.

6.3.8 Seismic PRA Risk Importance Sensitivity Studies 6.3.8.1 If the component's risk importances are less than each of the criteria in Table 6 2, then perform the recommended seismic PRA sensitivity studies (as identified in Table 6-6).

6.3.8.2 If the sensitivity studies identify that the component could be safety-significant, then the component is designated as candidate high safety-significant from a seismic risk perspective and the attributes which yielded that conclusion should be identified.

6.3.8.3 If the sensitivity studies confirm that the component's risk importances are less than each of the criteria in Table 6-2, then the component may be candidate low safety significant from a seismic risk perspective.

a)

If such a component is not safety related, then it is candidate low safety significant from a seismic risk perspective.

b)

If such a component is safety-related, then qualitative reasons must be identified as to why the component is of low seismic risk significance (e.g., does not perform an important function, there is excess redundancy in the system or function, low frequency of challenge, etc.), and the component is retained as candidate low safety significant from a seismic risk perspective.

Table 6-6 Sensitivity Studies For Seismic PRA I

(adapted from NEI-OO-04 Table 5-4)

Sensitivity Study

Increase all human error basic events to their 95th percentile value

Decrease all human error basic events to their 5th percentile value

Increase all component common cause events to their 95th percentile value I. Decrease all component common cause events to their 5th percentile value r.-5et all maintenance unavailability terms to 0.0

-,-,-----------0

Use correlated fragilities for all SSCs in a given area

Any applicable sensitivity studies identified in the characterization of PRA adequacy and identification of important assumptions and sources of uncertainty.

Southern Nuclear Operating Company Nuclear NMP-ES-065-001 1 OCFR50.69 Active Component Risk SOUTHERN A Management Version 1.0 COMPANY Significance Insights r~NJ!' llJ.V;rff };'",rW'iu!J Instruction Page 23 of 34 6.3.9 Seismic Safety Significance Without Seismic PRA For plants for which a seismic PRA has not been developed, NEI-OO-04 allows the use of the seismic margins methodology (e.g., as performed for the IPEEE),

which is a screening approach to evaluating seismic hazards. It does not generate core damage values; rather, it simply assists in identifying potential seismic susceptibilities and vulnerabilities.

6.3.9.1 For each component, identify the seismic design basis and severe accident functions of the component.

6.3.9.2 Review the plant's Seismic Margins Analysis to determine if the component is credited as part of the safe shutdown paths evaluated.

a)

If a component is credited as part of a seismic-margins-evaluated safe shutdown path, it is considered safety-significant from a seismic risk perspective, and the attributes which yielded that conclusion should be identified.

b)

If the component does not participate in the seismic safe shutdown path, then it is considered a candidate low safety-significant with respect to seismic risk.

6.3.10 Other External Hazards Risk Evaluation Using PRA 6.3.10.1 For plants with a PRA that evaluates other external hazards, the generalized safety significance process is as shown on Figure 6-2, and is discussed in the following steps.

6.3.10.2 Determine whether the system or structure is evaluated in the external hazards PRA'

Personnel knowledgeable in the scope, level of detail, and assumptions of the external hazards PRA should make these determinations.

6.3.10.3 If the system or structure is determined to be evaluated in the external hazards PRA, then the following steps are used to determine candidate safety significance.

NOTE The risk importance process used for the internal events at power PRA is slightly modified to consider the fact that external events cannot be caused by plant components, hence there is no initiation contribution to importance. For that reason, components are evaluated using standard importance measures for their mitigation capability only.

Southern Nuclear Operating Company Nuclear NMP-ES-065-001 SOUTHERNA Management 10CFR50.69 Active Component Risk Version 1.0 COMPANY Significance Insights l"U'.rx.¥ If),~rr'# Y"'"'t-.~II-Irl Instruction Page 24 of 34 6.3.10.4 Use the other external hazards PRA to quantify the external hazards risk importance measures for the identified SSCs in the system of interest.

NOTE the other external hazards PRA COF, including all screened scenarios, is a small of the internal events at power COF (i.e., <1 %), then safety Significance of considered in the external hazards PRA can be considered LSS from an other hazard perspective.

6.3.10.5 This risk importance process is performed for both COF and LERF.

Where LERF cannot be quantitatively linked into the other external events model, the inSights from the internal events LERF model should be qualitatively coupled with the assessment of other external events impacts on containment isolation to develop recommendations for the lOP on LERF contributors.

'---------------------------..-----~--.----'

6.3.10.6 Follow the evaluation process steps for seismic risk importance evaluation, in section 6.3.7 and 6.3.8 (sensitivity studies as indicated in Table 6-6; note that the sensitivity for "correlated fragilities" applies and should be interpreted as fragilities related to the other hazard in question).

6.3.11 Other External Hazards Risk Evaluation Without PRA 6.3.11.1 If the plant does not have an external hazards PRA, then use the external hazards screening evaluation performed to support the requirements of the IPEEE.

Personnel knowledgeable in the scope, level of detail, and assumptions of the external hazards analysis should make these determinations.

6.3.11.2 If the SSC is evaluated in the external hazards screening analysis, then the following steps are used to determine candidate safety significance.

6.3.11.3 For each component, identify the other external hazard design basis and severe accident functions of the component.

6.3.11.4 Review the plant's IPEEE other external hazards screening evaluation to determine if the component is credited as part of the safe shutdown paths evaluated.

a) If a component is credited as part of an other external hazards-evaluated safe shutdown path, it is considered safety-significant from an other external hazards perspective, and the attributes which yielded that conclusion should be identified.

b) If the component does not participate in an other external hazards evaluated shutdown path, it is candidate low safety-significant with respect to the other external hazard risk, IF it can be shown that:

Southern Nuclear Operating Company Nuclear NMP-ES-065-001 1 OCFR50.69 Active Component Risk SOVTHERNA Management Version 1.0 COMPANY Significance Insights r... rxt I.S"rf'lf' Y"IU' V.,;l.'

Instruction Page 25 of 34

the component either did not participate in any external hazard scenarios that were screened during the external hazards evaluation. or

even if credit for the component was removed. the screened scenario would not become unscreened NOTE If a system/structure is not involved in either an external hazards PRA or external hazards screening evaluation. then the SSC is categorized as candidate LSS from the standpOint of other external risks.

6.3.12 Shutdown Safety Assessment Using Shutdown PRA 6.3.12.1 For plants with a shutdown PRA that is comparable to an at-power PRA (Le.,

generates annual average CDF/LERF). the generalized safety significance process is the same as the process for an internal events at power PRA. This process is shown in Figure 6-1.

6.3.12.2 Follow the process defined in steps 6.3.2 and 6.3.3 using the shutdown PRA.

NOTE If the shutdown PRA CDF is a small fraction of the internal events at power CDF (Le..

<1 %), then safety significance of SSCs considered in the shutdown PRA can be considered LSS from a shutdown perspective.

6.3.13 Shutdown Safety Assessment Using NUMARC 91-06 Program 6.3.13.1 NUMARC 91-06 specifies that a defense in depth approach should be used with respect to each defined shutdown key safety function. This is generally accomplished by deSignating a running and alternative system/train to accomplish the given key safety function. In the shutdown safety assessment process guidance provided in NEI-00-04. a component is identified as safety significant for shutdown conditions for either of the following reasons:

a) When multiple systems/trains are available to satisfy the key safety function.

those SSCs that support the primary and first alternative methods to satisfy the key safety function are considered to be the "primary shutdown safety system" and are thus candidate safety-significant with respect to shutdown risk.

NOTE In this assessment. primary shutdown safety system and first alternative shutdown safety system refer to a system or systems with the following attributes:

It has a technical basis for its ability to perform the function.

It has margin to fulfill the safety function.

It does not require extensive manual manipulation to fulfill its safety function. --.J

Southern Nuclear Operating Company Nuclear NMP-ES-065-001 1 OCFR50.69 Active Component Risk SOUTHERN A Management Version 1.0 COMPANY Significance Insights Instruction Page 26 of 34 FIff!')!tW,'¥rw )'<<1,..,.11*.-"'*

b} If the component's failure would initiate a shutdown event (e.g., loss of shutdown cooling, drain down, etc.), it is candidate safety-significant with respect to shutdown risk.

6.3.13.2 If the component does not participate in either of the manners identified in 6.3.13.1, then it is considered candidate low safety significance with respect to shutdown safety.

Southern Nuclear Operating Company Nuclear NMP-ES-065-001 10CFR50.69 Active Component Risk SOUTHERN A Management Version 1.0 COMPANY Significance Insights

""."rp 10.U:t'ff lu.o.. Vi>;I,t Instruction Page 27 of 34 6.3.14 Integral Assessment of Overall Risk Significance 6.3.14.1 Each risk contributor is initially evaluated separately in the preceding steps in order to avoid reliance on a combined result that might mask the results of individual risk contributors, due to the significant differences in the methods, assumptions, conservatisms, and uncertainties associated with the risk evaluation of each. In general, the quantification of risks due to external events and non-power operations tend to contain more conservatisms than internal events, at-power risks. As a result, performing the categorization simply on the basis of a mathematically combined total CDF/LERF would lead to inappropriate conclusions. For example, an SSC that is very important for a hazard that contributes only 1 % to the total CDF/LERF may be found to have low importance measures when the integral assessment is performed. Therefore, it is desirable in a risk-informed process to understand safety significance from an overall perspective, especially for SSCs that were found to be safety-significant due to one or more of these risk contributors. Note that the integral risk assessment addresses all of the PRA-modeled SSCs, not only those that have already been determined to be safety significant. However, the integrated importance cannot be higher than the maximum of the individual measures.

6.3.14.2 The integrated importance measure weights the importance from each risk contributor (e.g., internal events, fire, seismic PRAs) by the fraction of the total core damage frequency contributed by that contributor. The following formulas define how such measures are to be computed for CDF.

Integrated F-V Importance:

IFV; =2:(FVi,j

CDFj ) I r (CDFj )

J J

Where, IFV1 = Integrated F-V Importance of Component i over all CDF Contributors (Le.,

the set of contributors for which PRAs are available and used in the categorization, e.g., internal events, fire, seismic and shutdown)

FVI,j = F-V Importance of Component i for CDF Contributor j CDFj = CDF of Contributor j Integrated Risk Achievement Worth Importance:

IRAW; =1 + [ "ijRAWi,j - 1)

CDFj ] I L (CDFj )

j j

Where, IRAW, = Integrated Risk Achievement Worth of Component i over all CDF contributors RAWi,j =Risk Achievement Worth of Component i for CDF Contributor j CDFj= CDF of Contributor j

Southern Nuclear Operatina Company Nuclear NMP-ES-065-001 10CFR50.69 Active Component Risk SOUTHIRNA Management Version 1.0 COMPANY Significance Insights 1:"NX'II{1.~rW' r"..r'!li>,j~'

Instruction Page 28 of 34 6.3.14.3 Once calculated, an assessment should be made of these integrated values against the screening criteria of F-V >0.005, RAW> 2.0 for individual basic events, and RAW> 20 for common cause basic events.

For example, an SSC that is very important for a hazard that contributes only 1 % to the total CDF/LERF would be found to have very low importance measures when the integrated assessment is performed.

In no case should the importance from the integral assessment become higher than the maximum of the individual measures.

However, it is possible that the integral value could be significantly less than the highest contributor, if that contributor is small relative to the total CDF/LERF.

6.3.14.4 The same process should be used for LERF, if available.

6.3.14.5 The results of the integrated assessment should be documented and reported to the lOP as part of the categorization input package. This integrated assessment allows the lOP to determine whether the safety significance of the SSC should be based on the significance for that individual hazard or from the overall integrated result, avoiding a strict reliance on a mathematical formula that ignores the significant dissimilarities in the calculated risk results.

Southern Nuclear Operating Company Nuclear NMP-ES-065-001 SOUTHERNA Management 10CFR50.69 Active Component Risk Version 1.0 COMPANY Significance Insights f'fft'f'bld!w*./'r'tl9."~io,.t.t Instruction Page 29 of 34 6.4.1 The following provides background information regarding risk sensitivity studies for evaluation of the risk implications of changes in special treatment.

An overall risk sensitivity study is required by the process defined in NEI-00-04.

This sensitivity study should be performed for each individual plant system as the categorization of its functions is provided to the lOP. A sensitivity study should be performed for the system, and a cumulative sensitivity for all the SSCs categorized using this process. This is intended to provide the lOP with both the overall assessment of the potential risk implications and the relative contribution of each system.

6.4.1.1 The final step in the process of categorizing SSCs into risk-informed safety classifications involves the evaluation of the risk implications of changes in special treatment.

One of the guiding principles of this process is that changes in treatment should not significantly degrade performance for RISC-3 SSCs and should maintain or improve the performance of RISC-2 SSCs

Thus, it is anticipated that there would be little, if any, net increase in risk.

This risk sensitivity study is made using the available PRAs to evaluate the potential impact on COF and LERF, based on a postulated change in reliability.

For categorizations that rely on PRAs, this sensitivity is useful because the importance measures used in the initial safety significance assessment were based on the individual SSCs considered. Changes in performance can influence not only the importance measures for the SSCs that have changes in performance, but also others. Thus, the aggregate impact of the changes should be evaluated to assess whether new risk insights are revealed.

NOTE It is not necessary to address the cumulative impact of SSCs for hazards where screening tools such as SMA were used because if they are included in the screening analysis they are considered high safety-significant, thus there would be no change in treatment and no change in performance.

6.4.1.2 Risk sensitivity studies should be realistic, i.e., should not model unreasonable increases in component unreliability. In this risk sensitivity study, the unreliability of all modeled low safety-significant SSCs is increased simultaneously by a common multiplier as an indication of the potential trend in COF and LERF, if there were a degradation in the performance of low safety significant SSCs. A factor of between 3 and 5 is recommended in NEI-00-04.

However, the particular factor value is determined specific to the plant, based on a combination of ability to detect trends in performance degradation (i.e., lower limit of the range of factors that might be selected), and margins to the HSS risk significance thresholds (Le., upper limit of the range of factors that might be selected). The following provide some guidance regarding selection of an appropriate risk sensitivity factor, which may change over time.

Southern Nuclear Operating Company Nuclear NMP-ES-065-001 1 OCFR50.69 Active Component Risk SOUTHERN A Management Version 1.0 COMPANY Significance Insights r",..rtr'" s,,.~ Y4jfI'1J,.dJ' Instruction Page 30 of 34 Increasing the unreliability of all LSS SSCs by a factor of 3 to 5 provides a general indication of the potential trend in CDF and LERF, if there were a degradation in the performance of all LSS SSCs.

Such degradation is extremely unlikely for an entire group of components.

The plant corrective action program would see a substantial rise in failure events and corrective actions would be taken long before the entire population experienced such degradation. In the extreme, individual components could see variations in performance on this order, but it is exceedingly unlikely that the performance of a large group of components would all shift in an unfavorable manner at the same time.

The risk sensitivity study should be performed by manipulating the basic event values for components that were identified in the categorization process as having low safety significance because they do not support a safety-significant function. Both random and common cause PRA basic events for failure modes of the component that are relevant to the function being considered should be increased by the selected factor noted above.

The existing performance monitoring program must be capable of detecting a change in reliability of the LSS components by the selected factor. Standard practices used for setting performance criteria based on failures under the Maintenance Rule are applicable. This includes consideration of currently expected number of failures for the number of demands/hours of operation, and the expected number of failures for the expected future number of demands/hours of operation, for the population of SSCs that are LSS and candidate LSS. So, for example, if a factor of 3 is chosen for the risk sensitivity, the performance monitoring program must be capable of detecting an increase in unreliability for all LSS components by that amount. If not, a higher factor must be chosen.

6.4.2 Perform Initial Sensitivity Study 6.4.2.1 Prepare an initial sensitivity study for presentation to the lOP as an indication of the potential aggregate risk impacts.

6.4.2.2 Perform this sensitivity study for each individual plant system as the categorization of its functions is provided to the lOP.

6.4.2.3 In identifying the specific factor to be used in the risk sensitivity study, check that the cumulative risk increase computed with the unreliabilities of all previously categorized LSS and candidate LSS SSCs simultaneously increased by the selected factor cannot lead to exceeding the quantitative acceptance guidelines of Reg. Guide 1.174.

6.4.2.4 In cases where the categorization process identifies beyond design basis functions that will be addressed for RISC-1, Le., if special treatment requirements were added to address important beyond design basis functions, effectively improving the reliability of the SSC, it may also be advisable to perform a sensitivity study reducing the unreliability (Le., increasing the reliability) of these safety-significant SSCs by a similar factor, depending upon the specific changes in special treatment.

Southern Nuclear Operating Company Nuclear NMP-ES-06S-001 10CFRSO.69 Active Component Risk SOUTHERN A.

Management Version 1.0 COMPANY Significance Insights l"wrr.r/~SuffY<l.. rlf.>>;IJ Instruction Page 31 of 34

The cumulative changes in CDF and LERF computed in such sensitivity studies should be compared to the risk acceptance guidelines of Reg. Guide 1.174 as a measure of their acceptability.

In addition, importance measures from these sensitivity studies can provide insight as to which SSCs and which failure modes are most significant.

6.4.2.S Determine if the recommended FVand RAW threshold values used in the screening need to be changed based on results of this sensitivity study.

If the risk evaluation shows that the changes in CDF and LERF as a result of changes in special treatment requirements are not within the acceptance guidelines of the Regulatory Guide 1.174, then a lower F-V threshold value may be needed (e.g., > 0.0025 = HSS) for a re-evaluation of SSCs risk ranking.

This may result in re-categorizing some of the candidate LSS SSCs as safety significant SSCs.

6.4.3 Perform cumulative sensitivity for all the SSCs categorized using this process.

6.4.3.1 Repeat the above process to evaluate the cumulative impact of a" LSS components for all systems that have been categorized.

6.4.4 Provide results of individual system and cumulative sensitivity studies to the IDP 6.4.4.1 This should provide the IDP with both the overall assessment of the potential risk implications and the relative contribution of each system.

6.4.5 Re-evaluate sensitivities after lOP consideration 6.4.5.1 The sensitivity studies should be checked and revised when the lOP has completed its final categorization if the lOP has changed SSC categorizations, to assure that the conclusions regarding the potential aggregate impact have not changed significantly.

6.4.5.2 If the categorization of SSCs is done at different times, the sensitivity study should consider the potential cumulative impact of all SSCs categorized, not individual systems or components.

Southern Nuclear Operating Company Nuclear NMP-ES-06S-001 10CFRSO.69 Active Component Risk SOUTHERN A Management Version 1.0 COMPANY Significance Insights Ffu,"X.,If1.VJ<rY tri'Y \\JilfiJ' Instruction Page 32 of 34 A planned and phased implementation of SSC categorization over several years could result in later SSC categorization activities impacting earlier SSC categorization schemes. Thus, a review of the impact of the current categorization activity on previous categorizations should be performed. A determination needs to be made whether the integrated sensitivity study or the defense in depth implication considerations in previous categorizations have been changed as a result of these later categorization activities. If such changes are found, they should be presented to the lOP for consideration in their deliberations on the categorization of the latest system. This review of previous categorization may be focused to those SSCs affected by the categorization of additional functions, and does not obviate or replace the reviews.

6.5.1 Perform PRA Reviews to ensure continued validity of categorization results and to review SSC performance.

6.S.1.1 Periodic update of the PRA (at least once per every other refueling outage for Unit 1) must be performed, after which a review must be done for al\\ SSCs that have been categorized, to evaluate changes to plant design, operational practices, and industry and plant operational experience for impact on existing categorizations. The PRA update should address significant changes in operating experience for categorized SSCs, where appropriate.

Additional reviews, in addition to the periodic reviews, may be needed if a PRA model or other risk information is upgraded (as defined in Ref. 3.12). In such cases, a post-mode I-upgrade review of the SSC categorization should also be performed to determine if previously-performed categorization results may be affected by the model changes.

6.S.1.2 In most cases, the categorization would be expected to be unaffected by changes in the plant-specific risk information. However, in some instances, an updated PRA model could result in new RAW and F-V importance measures that are significantly different from those in the original categorization. Although this would suggest a potential change in the categorization, it is important to recognize that RAW and F-V are relative (to total CDF or LERF) importance measures, such that a decrease in CDF or LERF might result in an increase in relative importance of an SSC, and vice-versa. In these cases, the assessment of whether a change in categorization is appropriate should be based on the absolute value of the importance measures.

The absolute importance is the product of the base CDF/LERF and the importance measure ([RAW-1] or Fussell-Vesely). This is done in order to not inadvertently assess an SSC as safety significant when it's relative importance (FV and RAW) has gone up only due to a decrease in overall CDF/LERF.

Consider the following examples:

I' Southern Nuclear Operating Company Nuclear NMP-ES-065-001 10CFR50.69 Active Component Risk SOUTHERN A Management Version 1.0 COMPANY Significance Insights l~tlUs..!'I'" Yl1IlIfrW'ouJj' Instruction Page 33 of 34 (a) A PRA model change has resulted in an increase in at-power CDF. A component previously categorized as HSS now no longer meets the F-V and RAW criteria for HSS according to the new CDF or LERF values. This would suggest potential re-categorization consideration (to LSS) by the IDP. However, this would only be appropriate if the updated absolute importance measures were also below the HSS threshold. If the updated absolute importance measures indicate HSS, then the component remains HSS.

(b) A PRA model change has resulted in a decrease in at-power CDF. A component previously categorized as LSS now meets the F-V and RAW criteria for HSS according to the new CDF or LERF values. This would suggest potential re-categorization to HSS after consideration by the IDP.

However, this would only be appropriate if the updated absolute importance measures were also above the HSS threshold. If the absolute importance measures are not above the threshold, this is an indication that the relative importance has increased only as a result of the reduction in CDF or LERF (i.e., an indication of an overall safety improvement), so a chance in categorization would not be indicated.

When a change to the categorization of an SSC is suggested by a change in the PRA model as determined from the absolute importance measures, such changes should be presented to the IDP for concurrence.

Southern Nuclear Operating Company Nuclear NMP-ES-065-001 1 OCFR50.69 Active Component Risk SOUTHERNA Management Version 1.0 COMPANY Significance Insights r.."1.V ro "':rrl r~f<rV;iu/J' Instruction Page 34 of 34 Results generated by this instruction are considered QA records. They will be stored per NMP ES-065-003.

None

Vogtle Electric Generating Plant Pilot 10 CFR 50.69 License Amendment Request Draft Risk-Informed Categorization Procedures Draft NMP-ES-065-002 10 CFR 50.69 Passive Component Categorization

Southern Nuclear Operating Company Nuclear NMP~ES~065-002 10CFR50.69 Passive Component SOUTHERN A Management Rev. 1.0 COMPANY Categorization Ene,." 10 Slrpt YMlr W'orlrr Instruction Page 1 of 19 Instruction Owner:

(Print: Name / Title I Site)

Approved By:

(Peer Team Champion/Procedure Owner's Effective Dates:

Corporate FNP VEGP 3-4 Continuous Reference Use:

Southern Nuclear Operating Company Nuclear NMP-ES-065-002 10CFR50.69 Passive Component SOUTHERN A.

Management Rev. 1.0 COMPANY Categorization Instruction Page 2 of 19 Instruction Version Description Erurt:! UJSlrvr Y"II,.. m,rlJ"

Southern Nuclear Operating Company Nuclear NMP-ES-065-002 10CFR50.69 Passive Component SOUTHERNA Management Rev 1.0 COMPANY Categoriza tion Instruction Instruction Pajle 3 of 19 Entrt1'ttStmu YIJ'IO'WttrlJ'"

Table of Contents 1.0 Purpose...........................................................................................................................................4 2.0 Applicability.....................................................................................................................................4 4.0 Definitions...........................................................................................

...................................... 5 5.0 Responsibilities.............................................................................

.........................................5 6.0 Procedure...............................................................................

.......................................... 5 6.1 General Requirements....................................................

.................................... 5 6.2 Consequence Evaluation.......................................

.............................. 6 6.3 Classification.....................................................

...................... 12 8.0 Commitments.................................................

................ 14

Southern Nuclear Operating Company Nuclear NMP-ES-065-002 10CFR50.69 Passive Component SOUTHERN A Management Rev 1.0 COMPANY Categorization EM1'DIOS<<trvt YQllrW#rUl' Instruction Page 4 of 19 1.0 Purpose The purpose of this 10CFR50.69 Passive Component Categorization Instruction is to promote effective, consistent use of the 1 OCFR50.69 program across the SNC fleet.

This instruction includes requirements and instructions for the

~nlY,ont and review of the risk-informed categorization of Passive Components in support FR50.69 application.

2.0 Applicability This instruction is applicable only to those plant categorization and contain passive components.

This instruction is applicable to activities Categorization performed by Southern supplemental personnel.

3.0 References 3.1 NMP-ES-065, 10 CFR 50.69 3.2 Significance Insights 3.3 for Systems, Structures, and 3.4 DeCision-making Panel for Risk Informed SSC Categorization:

by the Office of Nuclear Reactor Regulation Request for

, Revision 1, Request to Use Risk-informed Safety Classification r/Replacement Activities in Class 2 and 3 Moderate and High and Fourth 10-Year In-service Inspection Intervals, dated April 22, 3.7 0,10 CFR 50.69 SSC Categorization Guideline, July, 2005.

3.8 10CFR50.69 Final Rule, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors, November 22, 2004.

Southern Nuclear Operating Company Nuclear NMP-ES-065-002 10CFR50.69 Passive Component SOUTHERN A Management Rev 1.0 COMPANY Categorization E1U7:lto$#1'wY'I'w"rbr Instruction Page 5 of 19 3.9 EPRI TR-112657, Rev B-A, Revised EPRI Risk-Informed In-service Inspection Evaluation Procedure, EPRI, Palo Alto, CA: 1999.

3.10 NUMARC 91-06, "Guidelines for Industry Actions to Address Shutdown Managemenf' dated 1991.

3.11 NUREG-0800, section 3.6.1 "Plant Design for Protection Agai

......"''"' Piping Failures in Fluid Systems Outside Containment 3.12 NUREG-0800, section 3.6.2 "Determination of Rupture Associated with the Postulated Rupture of Piping 4.0 Definitions All definitions are contained in NMP 5.0 Responsibilities Responsibilities for the 1 6.0 Procedure Note:

The source documents for methodology mentioned in this instruction is EPRI Report TR 112657, Rev B-A.

IF further details on the evaluation of operator actions and its impact on the consequence ranking; the evaluation and ranking of the consequence impact groups; and configurations and the evaluation of shutdown and external events are needed, consult EPRI Report TR 112657, Rev B-A.

IF additional guidance needs to be provided in this instruction to incorporate EPRI Report TR-112657, Rev 6-A requirements, contact Risk-Informed Engineering Department.

6.1 6.1.1 Scope 6.1.1.1 The process for determining the Passive Component Categorization shall be applied on a system basis, including all components and their associated supports within the selected system(s).

Southern Nuclear Operating Company Nuclear NMP-ES-065-002 10CFR50.69 Passive Component SOUTHERN A Management Rev 1.0 COMPANY Categorization Instruction PaQe 6 of 19 E1U"D to~f'tIt r.l'it' Wtwltr 6.1.1.2 This process is applied to Class 2, 3 and non Class systems or their associated supports (exclusive of Class CC and MC items).

6.1.2 Attachment A provides an overview of the Passive Component Categorization process 6.1.3 Categorization Components and component supports in systems the evaluation contained in this instruction shall be classified High Safety (HSS) or Low Safety Significant (LSS) in accordance with sections 6.1.4 Required Disciplines Necessary personnel to perform review and documentation should following disciplines should be includ (a) probabilistic (b) plant nno,r'!:>t'I, one discipline, but are not required to be 6.2 and documentation burden, components may be grouped that are based on similar conditional consequence (I.e.,

of the piping segment). To accomplish this grouping, direct and shall be assessed for each piping segment.

Category for each piping segment is determined from the Modes and Effects Analysis (FMEA) and Impact Group Assessment as ed in sections 6.2.2 and 6.2.3, respectively.

6.2.1.3 Throughout the evaluations of sections 6.2 and 6.3, credit may be taken for plant features and operator actions to the extent these would not be affected by failure of the segment under consideration. To take credit for operator actions, the following features shall be provided:

Southern Nuclear Operating Company Nuclear NMP-ES-065-002 10CFR50.69 Passive Component SOUTHERN A.

Management Rev 1.0 COMPANY Categorization E,,'rgyttlMrwYlHlrWYwur Instruction Page 7 of 19 6.2.1.3.1 An alarm or other system feature to provide clear indication of failure, 6.2.1.3.2 Equipment activated to recover from the condition must not be affected by the failure, 6.2.1.3.3 Time duration and resources are sufficient to perform operator action, 6.2.1.3.4 Plant procedures to define operator 6.2.1.3.5 Operator training in the procedures.

6.2.1.4 Success criteria diagrams shall be initiating events.

Southern Nuclear Operating Company Nuclear NMP-ES-065-002 10CFR50.69 Passive Component SOUTHERNA Management Rev 1.0 COMPANY Categorization Etu'V'"" ~rlf# ¥Qur Whrltr Instruction Page 8 of 19 6.2.2 Failure Modes and Effects Analysis (FMEA)

Identify potential failure modes for each system OR piping segment and evaluate their effects. This evaluation shall consider the following:

6.2.2.1 Pressure Boundary Failure Size - The consequence evaluation shall be conducted for a spectrum of pressure boundary sizes (Le. small to large). The failure size that results in the ence ranking shall be used. In lieu of this, a small leak may be it can be ensured that the possibility of a large pressure-bou re has been precluded (e.g. presence of a flow restricting 0 6.2.2.2 Isolability of the Break - A break valve, a closed isolation valve, signal. In lieu of automatic consistent with 6.2.1.3.

6.2.2.3

.g., spray, pipe ip) and loss supports multiple functions).

6.2.2.4 the postulated piping failure are lant-specific PRA and the plant segments that are not pecific PRA, analysis might means of detecting a failure, and the with the system and other affected should include possible automatic and of system function shall be evaluated.

",C!t,onr'o of redundancy for accident mitigation

- The consequence evaluation and ranking is organized ence impact groups as discussed in section 6.2.3. The system configurations for these impact groups are defined

Southern Nuclear Operating Company Nuclear NMP-ES-065-002 10CFR50.69 Passive Component SOUTHERN A Management Rev 1.0 COMPANY Categorization EJtI!"XJI I.$,rw YlUJr Wilrkr Instruction Page 9 of 19 6.2.3 Impact Group Assessment The results of the FMEA evaluation for each system, or portion thereof, shall be classified into one of three core damage Impact Groups: initiating event, system, or combination. In addition, failures shall also be evaluated for their importance relative to containment performance.

Each system, or portion thereof, shall be part' lated piping failures that cause an initiating event, disable a C>\\lc>'torn causing an initiating event, or cause an initiating event and disable Evaluations in steps 6.2.3.1 through 6.2 importance relative to core damage.

The consequence category c.t"..:J'U

piping segment within each impact group following.

6.2.3.1 Initiating Event nt When the postu initiating event (e.g., loss of feedwater, rC<:I,f"'Tnr be classified into one of four categories: high, m event category shall be assi be one of the Design Basis Event All applicable design basis events previously pdated final safety analysis report or PRA shall g event classified as Category I (routine sidered in this analysis.

that result in Category II (Anticipated Event), Category III Event), or Category IV (limiting Fault or ACCident). the category shall be assigned to the initiating event according co core damage probability (CCDP) criteria specified in

5. Differences in the consequence rank between the use of Table 5 shall be reviewed, justified and documented or the higher uence rank assigned.

The quantitative index for the initiating impact group is the ratio of the core damage frequency due to the event to the frequency for that initiating event in the base PRA

Southern Nuclear Operating Company Nuclear NMP-ES-065-002 10CFR50.69 Passive Component SOUTHERN...\\.

Management Rev 1.0 COMPANY Categorization Instruction Page 10 of 19 EiUrgylPMHI# ~ur WT.rltr 6.2.3.2 System Impact Group Assessment The consequence category of a failure that does not cause an initiating event, but degrades or fails a system/train/loop essential to prevention of core damage, shall be evaluated. This evaluation shall include all safety functions supported by the segment as well as all safety functions impacted by the failure of the segment. This evaluation shall be based on the following:

Frequency of challenge that determines the affected function of the system is called upon. This to the frequency of events that require the system operation.

Number of backup systems

, trains, or portions of trains) available, which unaffected systems (portions of systems, to perform the same mitigating with Table 2 as High, VU~JOU into design basis event may be used to assign with Table 5 in lieu of Table 2 provided (e.g., one full train unavailability approximately with the failure scenario being evaluated.

between the use of Table 2 and 5 shall be or the higher consequence rank assigned.

index for system impact group is the product of the change damage frequency (CCDF) and the exposure time.

-Iat,,,,n'"

in depth purposes, all postulated failures leading to backup trains) shall be assigned a high consequence.

Impact Group Assessment uence category for a piping segment whose failure results in both ng event and the degradation or loss of a system shall be determined Table 3. The consequence category is a function of two factors:

Use of the system to mitigate the induced initiating event;

Number of unaffected backup systems or trains available to perform the same function.

Southern Nuclear Qperating Company Nuclear NMP-ES-06S-002 10CFRSO.69 Passive Component SOUIHERNA Management Rev 1.0 COMPANY Categorization Instruction Page 11 of 19 E""D ttt,f/4'H Yggr WorlJ'"

Quantitative indices may be used to assign consequence categories in accordance with Table S in lieu of Table 3 provided the quantitative basis of Table 3 (e.g., one full-train unavailability approximately 10-2) is consistent with the failure scenario being evaluated. Differences in the consequence rank between the use of Table 3 and S shall be reviewed, justified and documented or the higher consequence rank assigned.

6.2.3.4 Containment Performance Impact Group The previously established consequence

.1, 6.2.3.2, or 6.2.3.3) shall be reviewed and adjusted to reflect the failure's impact on in containment performance. This as follows:

Table 4 shall be used to failures that can lead to

For postulated fai bypasses containment, the q be used.

6.2.3.S Shutdown ope previously established consequence to reflect the pressure boundary failure's g shutdown.

initiators and systems will for operation, and their effect on performance.

==, the effect of pressure-boundary containment performance shall be operations, safety functions, and success criteria change stages of other modes of operation.

exposure time for the majority of the piping associated with utdown operation is typically less than 10 percent per year. The time associated with being in a more risk-significant configuration is even shorter, depending on the function or system that is being evaluated.

The unavailability of mitigating trains could be higher due to planned maintenance activities. Shutdown guidelines need to be evaluated to assure that sufficient redundancy is protected during different modes of operation.

Southern Nuclear Operating Company Nuclear NMP-ES-065-002 10CFR50.69 Passive Component SOUTHERN A Management Rev 1.0 COMPANY Categorization Instruction PaQe 12 of 19 IIIU,." tos"rtI# l11ur Wbrld"

Recovery time may be longer, thus allowing for multiple operator actions.

6.2.3.6 External events shall be evaluated. The previously established consequence rank shall be reviewed and adjusted to reflect the pressure boundary failure's impact on the mitigation of external events. The of external events on core damage and containment performance from two perspectives, as follows:

External events that can cause seismic events), and External events that do failure, but create and events {e.g. fi 6.3 Classification Piping segments may be g

, if the analysis and assessment performed in section 6.2 failures to be the same.

The classification shall be as ned to be a Medium, Low, or None (no change to COI1SE~auel ce category in any table by the consequence evaluation 6.2 shall be determined to be HSS or LSS by conSidering the in 6.3.1.2.1 through 6.3.1.2.6 below. Under the same conditions of

.2.1, a large pressure boundary leak does not need to be assumed.

may be taken for plant features and operator actions to the extent would not be affected by failure of the segment under consideration. If features and operator actions are credited, they shall be consistent with those credited in section 6.2.1.3.

The following conditions shall be evaluated and answered TRUE or FALSE.

Southern Nuclear Operating Company SOUTHERN A COMPANY EneJ"D 10 s,,1'W y"gr \\l1Irt.r Nuclear NMP-ES-06S-002 10CFRSO.69 Passive Component Management Rev 1.0 Categorization Instruction PaJJe 13 of 19 6.3.1.2.1 6.3.1.2.2 6.3.1.2.3 6.3.1.2.4 6.3.1.2.S Failure of the pressure retaining function of the segment will not directly or indirectly (e.g., through spatial effects) fail a basic safety function.

Failure of the pressure retaining function of the segment will not prevent the plant from reaching or maintaining safe shutdown conditions; and the pressure retaining function is not significant to safety during mode changes or shutdown.

maintain safe shutdow in the need for actions plant mitigative feature Assume that the n conditions if a outside of plant

s.

be unable to reach or failure results or available backup The pressure retaining upon in the plant guidance as the sole actions required to m function called out or relied res or similar of operator The pressure reta upon in the plant guidance as the sole monitoring activities.

segment will not result in that would result in the actions.

'lc::tr'::Ittl that the defense-in-depth philosophy is is maintained if:

preserved among prevention of core damage, ment failure or bypass, and mitigation of an over-reliance on programmatic activities and operator compensate for weaknesses in the plant design.

","'.:lrgrTl redundancy, independence, and diversity are preserved mensurate with the expected frequency of challenges,

,..r.nC'Ql"1uences of failure of the system, and associated uncertainties in determining these parameters.

Potential for common cause failures is taken into account in the risk analysis categorization.

Independence of fission-product barriers is not degraded.

IF any of the above conditions are answered FALSE, THEN HSS shall be assigned. Otherwise, LSS shall be assigned.

Southern Nuclear Operating Company Nuclear NMP-ES-065-002 10CFR50.69 Passive Component SOUIHERNA.

Management Rev 1.0 COMPANY Categorization EtUrgy leS.,w YuurWtlrl.

Instruction Page 14 of 19 6.3.1.3 If LSS has been assigned from section 6.3.1.2, then this instruction shall verify that there are sufficient margins to account for uncertainty in the engineering analysis and in the supporting data. Margin shall be incorporated when determining performance characteristics and parameters, e.g., piping segment, system, and plant capability or success criteria. Th amount of margin should depend on the uncertainty associated with the parameters in question, the availability of alternatives to for adverse performance, and the consequences of the performance goals.

Sufficient margins are maintained by en analysis acceptance criteria in the plant licensing basis are revisions account for analysis and data uncertainty. If ned then LSS should be assigned; if not, then 6.3.1.4 ification as model in 7.0 Records The results generated by this They will be stored per NMP-ES-065-003.

8.0

Southern Nuclear Operating Company Nuclear NMP-ES-065-002 10CFR50.69 Passive Component SOUTHERN.A Management Rev 1.0 COMPANY Categorization E1Urt:1tg.VI'W Y#lTT\\f&rJor Instruction Page 15 of 19 TABLE 1 CONSEQUENCE CATEGORIES FOR INITIATING EVENT IMPACT GROUP Design Basis Initiating Event Representative Example uence Event Type Initiating Event Initiating Events Category Category Frequency Range (Note 1)

Routine

>1 None Operation II Anticipated 10-1<values1 Low/

Event Medium III Infrequent Event ium Medium/High IV Medium/

High

Nuclear 10CFR50.69 Passive Component SOUINERNA.

Management COMPANY Categorization Rnt'V If) &"VL Yo,..,.Worlir Instruction TABLE 2 GUIDELINES FOR ASSIGNING CONSEQUENCE CATEGORIES TO FAILU~ULTlNG IN SYSTEM OR TRAIN LOSS Affected Systems Frequency EXDosure Time of Challenge Anticipated (DB Cat II)

(1-3 months) 0.0 0.5 Number of Unaffected Backup Trains 1.0 1.5 2.0 2.5 LOW 3.0 LOW I

~ 3.5 LOW Infrequent (DB Cat. III)

(::; 1 day)

All Year Between tests (1-3 months)

LOW LOW*

LOW LOW LOW LOW LOW LOW LOW LOW LOW LOW LOW LOW LOW LOW Unexpected (DB Cat. IV)

LOW*

LOW LOW LOW LOW LOW LOW LOW LOW LOW LOW LOW LOW LOW LOW LOW

- If there is no containment barrier and the medium).

is marked by an *, the consequence category should be increased (medium to high or low to

Southern Nuclear Operating Company Nuclear NMP-ES-065-002 10CFR50.69 Passive Component SOUTHERN A.

Management Rev 1.0 COMPANY Categorization Enuv I. ~nt Y""r W"rlJ" Instruction Page 17 of 19 TABLE 3 CONSEQUENCE CATEGORIES FOR COMBINATION IMPACT GROUP Event Consequence Category Initiating Event and 1 Unaffected Train of High Mitigating System Available Initiating Event and 2 Unaffected Trains of Mitigating Systems Available to,",1"\\1"\\1 from Table 1 Initiating Event and More Than 2 Unaffected Trains of Mitigating Systems Available

,to,",11"\\1"\\1 from Table 1 Initiating Event and No Mitigating System Affected

- The higher classification of this table or Table 1 RES LOCA OUTSIDE OF MEDIUM LOW NONE is a valve that needs to close on demand.

is a valve that needs to remain closed.

TABLES INDICES FOR CONSEQUENCE CATEGORIES RP, no units uence

>1 High 10-6 < value s 1 0"4 10"7 < value s 10"5 Medium S10-6 s10-7 Low No case No chan to base case None

Southern Nuclear Operating Company Nuclear NMP-ES-065-002 10CFR50.69 Passive Component SOUTHERN A Management Rev 1.0 COMPANY Categorization Enf'1Jh;5f',"" Yh'¥rWc,t,.IJ*

Instruction Page 18 of 19 Table 6 Definition of Consequence Impact Groups and Configurations CONSEQUENCES Impact Configuration Description Group Initiating Operating A PBF* occurs in an Event system resulting in an Loss of Standby A PBF occurs in Mitigating result in an Ability mitigating failure is Allowrern Specifi Demand Combination Operating with an additional to the expected initiator)

Containment to impacts, also nment performance PBF -

TJH*"~""" IT'~-T

Southern Nuclear Operating Company Nuclear NMP-ES-065-002 10CFR50.69 Passive Component SOUTHERN A Management Rev 1.0 COMPANY Categorization ElI~rtyIttS.,W Y6IIUWlIrU" Instruction Page 19 of 19 Attachment A Passive Component Categorization Process Segments Perform Failure Modes and Effect Analysis (FMEA)

Bin results of FMEA into one of the following Impact Group Assessments Initiating Event Impact Group (Table 1 OR 5)

System Impact Group (Table 2 OR 5)

Combination Impact Group (Table 3 OR 5)

Perform evaluation of "Containment Performance Impact Group (Table 4 OR 5)"

Review and adjust consequence rank to reflect PBF's impact on:

1) Plant Operation during shutdown

2) Mitigation of external events Segment consequence is Medium, Low, or None. Hence, it is HSS or LSS.

Use 6 criteria (6.3.1.2.1 to 6.3.1.2.6) to confirm HSS or LSS.

Yes

Vogtle Electric Generating Plant Pilot 10 CFR 50.69 License Amendment Request Draft Risk-Informed Categorization Procedures Draft NMP-ES-065-003 10 CFR 50.69 Risk Informed Categorization for Structures, Systems, and Components

Southern Nuclear Operating Company Nuclear NMP-ES-065-003 10CFR50.69 Risk Informed Categorization SOUTHERN A Management Version 1.0 COMPANY for Structures, Systems, and Components elJ#rr:J Itl ~f'H fQMrW.rI"*

Instruction Page 1 of 24 Instruction Owner:

(Print: Name I Title I Site)

Approved By:

(Peer Team ChampiOn/Procedure Owner's I Date)

Effective Dates:

Corporate FNP VEGP 3-4 This NMP is under the oversight of the Risk-Inform Writer(s):

d approval is required for this NMP SECTIONS

Southern Nuclear Operating Company Nuclear NMp*ES*06S*003 10CFRSO.69 Risk Informed Categorization 50UIHERNA Management Version 1.0 COMPANY for Structures, Systems, and Components e"nvf#s#rHYo",,.w()tbr Instruction Page 2 of 24 Revision Description Version Number Revision Descri tion 1.0 Initial issue

Southern Nuclear Operating Company Nuclear NMP-ES-065-003 10CFR50.69 Risk Informed Categorization SOUIHERNA.

Management Version 1.0 COMPANY for Structures, Systems, and Components En.tttJJtt~rw Y"""Wcln,r Procedure Paae 3 of 24 Table of Contents 1.0 Purpose.......................................................................................................................................4 2.0 Applicability..................................................................................................................................4 3.0 References..................................................................................................................................5 4.0 Definitions....................................................................................................................................5 5.0 Responsibilities...............................................................................

...................................... 5 6.0 Procedure................................................................................

......................................... 7 7.0 Records..............................................................................

....................................... 19 8.0 Commitments.................................................................

.................................. 20 - Guidelines for Defense-in-Depth r\\:s::st:::S:S1

............................21

Southern Nuclear Operatinj) Company Nuclear NMP-ES-065-003 10CFR50.69 Risk Informed Categorization SOUTHERN A Management Version 1.0 COMPANY for Structures, Systems, and Components En~rt:I'. &NJ, Y4N,.w.,.IJ" Procedure Page 4 of 24 1.0 Purpose 1.1 This instruction provides guidance to support the categorization of structures, systems, and components (SSCs) in accordance with 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors.

1.2 This instruction is part of an integrated categorization process which includes the following additional procedures/instructions.

NMP-ES-065, 10 CFR 50.69 Program

NMP-ES-065-001, 10CFR50.69 Active Component NMP-ES-065-002, 10CFR50.69 Passive

NMP-ES-066-001, Integrated Decision-making Categorization: Duties and Responsibilities 1.3 The process described in this instruction and the requirements of 10 CFR 50.69 (c),

Process Adjustment. The scope of this requirements specified in 10 CFR 50.69 (d)

NMP-ES-065-004.

1.4 The process described in this industry guidance document, N 1.5 This instruction has been request to adopt 10 C performed prior to requirements actions are 1.5.1 valuation sha uclear Energy Institute (NEI)

Categorization Guideline, Rev. O.

of a license amendment in this instruction may be 11"\\\\A/O\\lO, the alternative treatment plemented UNLESS the following by the NRC, an evaluation shall be performed described in this instruction meets the the NRC-approved license amendment. The tracked via a Condition Report action. This by the Manager, Risk-Informed Engineering and by the instruction shall then be revised at this time to remove this concludes that the process described in this instruction does not nts of, or is inconsistent with, the approved license amendment, shall be revised accordingly and any evaluations or activities shall be re-performed using the revised procedural requirements.

This instruction is applicable only to those plant systems that have been selected for categorization. Since 10 CFR 50.69 is a voluntary rule, each Site may decide which plant systems to categorize or not categorize. However, once a system is selected for categorization, ALL the components in that system MUST be included in the categorization process.

This instruction was created and is maintained under the direction of the Risk-Informed Engineering Manager.

2.0

Southern Nuclear Operating Company Nuclear NMP-ES-065-003 SOUTHERNA.

Management 10CFR50.69 Risk Informed Categorization Version 1.0 COMPANY for Structures, Systems, and Components e,,"Ortf Stttw four WorU" Procedure Page 5 of 24 3.0 References 3.1 10 CFR 50.69, Risk-Informed Categorization And Treatment Of Structures, Systems And Components For Nuclear Power Reactors 3.2 NEt 00-04, 10 CFR 50.69 SSC Categorization Guide, Revision 0 3.3 NIVIP-ES-065, 10 CFR 50.69 Program 3.4 NMP-ES-065-001, 10CFR50.69 Active Component Risk Significance Insights 3.5 NMP-ES-065-002, 10CFR50.69 Passive Component Categori 3.6 NMP-ES-065-004, Alternative Treatment Requirements

3.7 NMP-ES-066

Integrated Decision-Making Panel Ge Categorization Program and Independent Decision Control Program

3.8 NMP-ES-066-001

Integrated Decision-making Duties and Responsibilities 4.0 Definitions All definitions are contained in N 5.0 Responsibilities 5.1 For Risk Informed SSC Surveillance Frequency be used with NMP-ES-065.

5.1.1 insights, and qualitative risk insights to reach functions and components that are performance monitoring and periodic reassessments to ensure of SSCs remains valid and that any implemented not significantly degraded the performance of the associated are presented to the lOP for review.

rn<.3lfUU.'" changes to categorization results resulting from changes to I updates, changes to operational practices, as well as other These changes are presented to the lOP for review.

5.2 rmed Application engineer is responsible for the following activities:

5.2.1 In with Site Management, establishing the criteria for and selecting the plant systems to be categorized.

5.2.2 Providing the PRA base case risk and results of sensitivity studies for SSCs in the system under review, as further detailed in NMP-ES-065-001.

5.2.3 Providing the results of other hazards analyses for those hazards that are not modeled in the PRA, as further detailed in NMP-ES-065-001.

Southern Nuclear Operating Company Nuclear NMP-ES-065-003 SOUTHERN A.

Management 10CFR50.69 Risk Informed Categorization Version 1.0 COMPANY for Structures, Systems, and Components ene"D/eSlrw ~*,.w~.,.[,r Procedure Page 6 of 24 5.2.4 Providing additional PRA Model insights which may influence the SSC categorization outcome.

5.2.5 Providing PRA risk insights in support of the passive risk categorization of SSCs, as further detailed in NMP-ES-065-002.

5.2.6 Providing PRA risk changes, resulting from model updates or other factors that could impact existing SSC categorizations.

5.3 Site Management is responsible for:

5.3.1 Providing input in establishing the criteria for and categorized 5.3.2 Providing the needed resources to support Applicable lOP members System Engineer Operations Representative Supporting material such as 5.4 The cognizant Licensing regulatory or commitment 5.5 the system under review for SC categorization outcome.

supported insights which may influence the SSC performance issues which may influence in the assigned system.

~n,.,.nC!,:>C! to the essential questions used to assess the risk of

Southern Nuclear Operating Company Nuclear NMP-ES-065-003 10CFR50.69 Risk Informed Categorization SOUTHERNA Management Version 1.0 COMPANY for Structures, Systems, and Components tn~'fYI.SitrwYurlfirltl" Procedure Page 7 of 24 6.0 Procedure NOTES Appropriate steps in the following process are to be documented, including the basis. As applicable, this documentation should be entered into a database and coded where practical in order to facilitate data manipulation and retrieval tasks.

6.1 Essential Elements 6.1.1 Risk Categories SSCs shall be categorized as RISC-1, categorization process outlined in SSC performs or supports and if 6.1.2 PRA Capability Additional details are

.69 Active Component Risk Significance Insights.

in plant applications requires of sound technical quality. At a minimum, the rios resulting from internal initiating events itations may include hazards that are not shutdown risks, and SSCs that are not

,vi),)I;;U through supplementary analyses.

es or qualitative methods such as screening should be used to supplement the PRA risk results. Due to PRA itations, such as those mentioned above, qualitative insights are categorize components within a particular plant system, primarily ponents in a particular system are not modeled by the PRA. In nC'.rtI"\\TC' can provide an alternate and valuable perspective that can be the PRA results to reach an overall risk assessment. Qualitative insights are not necessarily limited, to the following:

Supplementary analyses that are used to compensate for PRA limitations in quantifying the risk during plant shutdown and for hazards that may not modeled such as fire risks, seismic risks, and other external risks (e.g., tornadoes, external floods, etc.)

Qualitative risk assessment that considers, like the PRA, the impact and likelihood of failure of the SSC under consideration.

Southern Nuclear Operating Company Nuclear NMP-ES-065-003 SOUTHERN A Management 10CFR50.69 Risk Informed Categorization Version 1.0 COMPANY for Structures, Systems, and Components E,urt11<tS#trtJ, :th:r~rlJ~

Procedure Pa~e 8 of 24 Plant design bases Maintenance of defense-in-depth Maintenance of sufficient safety margins Plant and industry operating experience Operational and maintenance processes 6.1.4 Passive (Pressure Retention) Risk of Components NOTE Additional details are provided in NMP Component Categorization.

6.1.6 PRA results, qualitative results, or evaluation cnnin7~>n as RISC-1 or RISC-2. Otherwise, they NOTE are provided in NMP-ES-066-001 Integrated Decision-making ed SSC Categorization: Duties and Responsibilities.

shall be performed by an lOP, staffed with expert, plant-members. For the purpose of the categorization process, the expertise of the lOP members shall include, at a minimum, PRA, safety analysis, plant operation, design engineering, and system engineering. The lOP evaluates PRA risk results along with qualitative insights and defense-in-depth considerations to arrive at consensus based categorization decisions.

Southern Nuclear OJ)erating Company Nuclear NMP-ES-065-003 10CFR50.69 Risk Informed Categorization SOUTHERNA Management Version 1.0 COMPANY for Structures, Systems, and Components E,Urtl/rtS4'f'IH. i'OIl,WarlJ" Procedure Page 9 of 24 6.1.8 Training Specific training and qualifications requirements for lOP members and designated alternates is detailed in NMP-ES-066-001. Familiarity training on the categorization process should also be provided to other individuals who may participate in the lOP meetings, such as the cognizant system engineer for the system under discussion.

6.1.9 Scope of SSC categorization The categorization process is a voluntary process applied to selected plant systems or structures. However, once a system made, then all the components within the system or structure are

, not just specific components within a system or structure. The for a particular system or structure includes all system or

"'v",";;u~,"" with that system and possessing a unique the Plant Data Management System (PDMS).

6.1.10 Periodic Reviews and...,,,,.-rror,rn reviews shall be conducted to to review SSC performance.

industry and plant operational categorizations.

6.2 Selection of Plant 6.2.1 the and sequence of systems to be but are not limited to expected benefits, PRA system health and reliability.

6.2.2 electrical distribution systems) should not be the supported systems are first categorized.

of individual loads to be determined first which can then be of the supporting SSCs.

6.3 Functional Information 6.3.2 performed by the system.

6.3.2.1 should be identified, not just those that are perceived to be safety This will ensure a complete understanding of the role of the system and its interfaces with other systems.

6.3.2.2 Sources of information for the development of system functions include, but are not limited to, Maintenance Rule functions, design basis documents, system descriptions, Piping and Instrumentation Diagrams (P&IDs), and the Final Safety AnalysiS Report (FSAR).

6.4 Southern Nuclear Operating Company Nuclear NMP-ES-065-003 10CFR50.69 Risk Informed Categorization SOUIHERNA Management Version 1.0 COMPANY for Structures, Systems, and Components e,,~"'D til ~r1J' YM$" WorlJ" Procedure Page 10 of 24 6.3.3 Assign a unique identification number to each function. The system designator should be embedded in the function number.

6.3.4 Identify the components within the system.

6.3.4.1 Typically, this will consist of those components that are uniquely identified on the P&IO(s) or the single line diagrams associated with the system and designated as being part of the system.

6.3.4.2 Component information should be electronically avai from POMS and should be used to identify all active (Le., not spared, d components that are associated with the system of interest.

6.3.4.3 Piping segments should also be included in identified 6.3.5 For each component, identify the system 6.3.5.1 The same sources of inform functions can be used for this task, supple about the component.

6.3.5.2 port a function in another system.

the cooling system but obviously 6.3.5.3 one system function. There may

,::",n.-.o" and added to the list of 6.4.1 relevant to the system or its icant degradations and review for importance, that exhibit poor performance.

on for presentation to the lOP and identify any potential impacts.

(18 months) and historical (past five years) Maintenance Rule (MA) system, including MA status, unreliability and unavailability data, if ny exceedances of performance criteria.

ng commitments for the system or its components and identify any that could impact categorization or treatment.

6.4.3

6.6 Southern Nuclear Operating Company Nuclear NMP-ES-06S-003 10CFRSO.69 Risk Informed Categorization SOUTIIERNA Management Version 1.0 COMPANY for Structures, Systems, and Components

£1I,t'K),.Set'H Y(l~,.Wiir!d" Procedure Page 11 of 24 6.S Risk Evaluations based on PRA or Other Hazards Analyses NOTE Components that are not PRA-modeled (either explicitly or implicitly) are presumed to be neither LSS or HSS but are passed through for consideration by the other portions of the process (i.e., passive risk, risk, and non-modeled hazards evaluations, as applicable).

The categorization process requires the assessment Internal Events Risks, including inte

Fire Risks

Seismic Risks

Other External Risks (e.g.,

Shutdown Risks The process for assessing these with NEI 00-04, Rev. O. This used as input into the overall catleQc studies m

hazards consisting of:

P-ES-06S-001 and is consistent assessment results to be the PRA, the results of the or screening) that indicate which or more PRAs, the individual model and risk, Fire Risk, if modeled) of LSS or HSS as having a PRA risk of LSS, the results of re identified as having a PRA risk of LSS and are within 10%

HSS (referred to as buffer zone components).

as pressure retention risk) for applicable components (Le.,

ents) in the system being categorized shall be determined through NMP-ES-06S-002. The following is a summary of this process as it categorization process.

The passive risk of ASME Class 1 components shall be HSS.

The NMP-ES-06S-002 process will provide, as an input to the overall categorization, a passive risk of either HSS or LSS for applicable components.

A component support, hanger, or snubber shall have the same risk as the passive risk of the highest ranked piping segment within the piping analytical model in which the support is included.

Southern Nuclear Operating Company Nuclear NMP-ES-065-003 10CFR50.69 Risk Informed Categorization SOUTHERN A.

Management Version 1.0 COMPANY for Structures, Systems, and Components e,,~tX1 Jf) s#1'H lOulUJrld" Procedure Page 12 of 24

Other non-piping components that support a pressure retention function (e.g., valves) shall be assigned the same passive risk as the highest ranked piping on either side of the component.

6.7 Qualitative Risk Assessment 6.7.1 Qualitative Risk Assessment of System Functions Each system function shall be categorized as HSS if one of the following questions is answered affirmatively. Otherwise, the I be categorized as LSS.

Does failure of the function directly cause an i Does failure of the function cause a loss integrity resulting in leakage beyond n

Does failure of the function result cyl Operating the successful performance of or transient? This also applies to allow the required actions to be cy/AbnormalOperating ng actions for assuring ent conditions, or offsite also to instrumentation and other actions to be performed.

plant from reaching or maintaining safe significant to safety during mode changes would be unable to reach or maintain safe if the function failure results in the need for actions outside of available backup functions/SSCs.

that acts as a barrier to fission product release during severe accidents result in the implementation of off-site

""lTC,rTn"", actions?

6.7.2 of Components NOTE This section excludes component passive risk, which is discussed in Section 6.6.

Components are given an initial qualitative risk based on the highest risk of any function supported by that component. For example, if the component supports two functions, one being HSS and the other LSS, the component would be assigned an initial qualitative risk of HSS.

Southern Nuclear Operating Company Nuclear NMP-ES-065-003 SOUTHERN A.

Management 10CFR50.69 Risk Informed Categorization Version 1.0 COMPANY for Structures, Systems, and Components

£&1'.&"' Y'I,.~r/J*

Procedure Page 13 of 24 A component may be assigned a risk of LSS even it supports an HSS function if the failure of the component would not preclude the ful'fillment of the HSS function. Specific considerations include, but are not limited to:

There is no credible failure mode for the component that would prevent an HSS function from being fulfilled (e.g., a locked open or locked closed valve, a manually controlled valve, etc.),

A failure of the component would not prevent an HSS function from being fulfilled (e.g., a vent or drain line that is not a significant flow path, components downstream of the first isolation valve from the of the function, etc.), and Instrumentation that would not prevent an radiation monitors that do not have a d Caution and conservative judgment allowances can be taken and the associated justification 6.8 Overall Risk Assessment of Components f the following assessments identified as LSS 6.8.1 Evaluation results for

.5 and NMP-ES-065-001) 6.8.2 Evaluation results for 6.5 and NMP-ES-065-001) 6.8.3 6.8.4 6.9

..cr'nnn 6.8, an additional evaluation is required defense-in-depth related to core damage, term integrity. Details on the methodology for assessment is provided in Attachment 1.

for either core damage or containment integrity cannot a particular component, then the component shall be Otherwise, it remains preliminarily LSS.

6.10 Data for lOP Presentation its associated components, the following data shall be compiled, 6.10.1 6.10.2 Qualitative risk results for system functions 6.10.3 Operating experience review 6.10.4 Assessment of system health and equipment performance 6.10.5 PRA individual model and integrated risk assessments for modeled components 6.10.6 Evaluation results for non-modeled hazards

Southern Nuclear Operating Company Nuclear NMP-ES-065-003 10CFR50.69 Risk Informed Categorization SOUIHERNA.

Management Version 1.0 COMPANY for Structures, Systems, and Components EntrgJfI$erw Y(tNrWerlJ' Procedure Page 14 of 24 6.10.7 Results of PRA sensitivity studies for any of the PRAs used 6.10.8 PRA LSS components that are in the buffer zone 6.10.9 Passive risk for applicable components 6.10.10 Qualitative risk results for system components 6.10.11 Oefense-in-depth assessments 6.11 lOP Evaluation of Risk Results The lOP shall evaluate all of the available risk results and information and develop a consensus on the risk categorization of the system fu omponents using the following guidance.

6.11.1 General Considerations 6.11.1.1 The intent of the lOP review is to categorized with a documented 6.11.1.2 The lOP may request person be present at the meeting to facilitate 6.11.1.3 The lOP does not need to verify function being eval

. This is HSS, all com ng the fu 6.11.1.4 nitial categorization, this is a initial categorization is 6.11.1.5

,the lOP cannot move the SSC 6.11.2 in a sound, consistent, and well essential question should be supported by an appropriate that the answers are reasonable and consistent, both system and, as other systems are categorized, across systems.

modeled components should be understood, including any mIT.::lTlr\\n~ Where there are separate PRAs (e.g., Internal and Fire), the to the lOP should have already been integrated as previously as detailed in NMP-ES-065-001.

results for non-modeled hazards (e.g., seismic risk) should be understood with specific attention to scope, assumptions, and degree of conservatism to the extent that the analyses point to a higher risk than the PRA base case results.

6.11.5 Sensitivity results should be understood including the base and integral risk for each hazard 6.11.6 Passive risk results should be understood with respect to assumptions and use of bounding assessments 6.11.4

Southern Nuclear Operating Company 50UTHERNA COMPANY E"ert:lf.MrwYt;"P'~rlJ" 6.11.7 6.11.8 6.11.9 Nuclear NMP-ES-065-003 10CFR50.69 Risk Informed Categorization Management Version 1.0 for Structures, Systems, and Components Procedure Page 15 of 24 Qualitative risk results for components should be evaluated with particular attention to:

Cases where an LSS component supports an HSS function

Components that provide support for another system

Risk of inadvertent actuation

Consistency within a group of related components (e.g., air operated valve, associated solenoid valve, associated actuating sensor)

Defense in depth and safety margins considerations for related LSS components should be confirmed through the following factors:

The results of the sensitivity study that in""'Q~<

re rate of PRA-modeled components show that the increase in be sufficiently small

The contribution of an SSC to nn:::"'ClnTlr accidents is sufficiently small

There is preservation of system

There is no over-reliance on nsatory measures plant's systems and barriers is risk would occur.

components For non to-safety, the lOP must consider process provides an adequate basis n general, risk analyses should address the SSC nally classified as important-to-safety in order If the lOP concludes that the categorization of P can re-categorize the SSC to HSS. In doing d be identified to assure that any core d m that the lOP felt were significant are nt including beyond design basis functions used in the PRA.

Southern Nuclear Operating Company Nuclear NMP-ES-065-003 10CFRSO.69 Risk Informed Categorization SOUTHERN A Management Version 1.0 COMPANY for Structures, Systems, and Components e"'rrll#!Wrn YIUrl:,,\\f~rIJ' Procedure Page 16 of 24 6.12 Blending of Risk Results and Overall Assessment After evaluating the above results, the lOP will reach consensus on the overall categorization of the system functions and components, subject to the following:

6.12.1 A component that has been identified as HSS by the passive risk assessment must be categorized as HSS, regardless of any other factors.

NOTE For components that have both an active and a passive I risk of the component will of course be the higher of the two.

to continue to assess the active risk and the passive risk separately. For active valve may be assessed as HSS due to its passive risk, the etermined.

Typically, the PRA and qualitative risk assess separation of the two risks becomes useful when "~ClnTln""

6.13. The following criteria generally involve the active 6.12.2 A component that has PRA integrated risk assessment MUST be categorized as factors.

6.12.3 of the non-modeled less of any other factors.

6.12.4 may be revised from LSS to

, the qualitative risk of components may be LSS IF an appropriate justification can be made, bject to the guidance in Section 6.7.2.

6.12.S of the sensitivity studies shall be risk should be increased to HSS.

are still LSS, the risk should be increased to HSS IF the results of ents pOint to a risk of HSS, UNLESS a justification can be by the lOP that the risk should not be increased.

II LSS and in the PRA buffer zone (Le., within 10% of the lOP should consider increasing the risk to HSS.

6.13 6.13.1 categorized as HSS, the attributes of the component that are its safety significance should be reviewed by the lOP. Typically, such developed from one or more of the following sources:

Review the HSS functions that the component supports and determine those actions that the component must perform in order to support the function{s).

For PRA-modeled components, examine the associated failure mode (basic event) and develop the critical attribute as the opposite (e.g., "fail to start on demand" results in an attribute of "start on demand").

Southern Nuclear Operating Company Nuclear NMP-ES-065-003 10CFR50.69 Risk Informed Categorization 50UTHERNA Management Version 1.0 COMPANY for Structures, Systems, and Components e'"rvl(J~rQIIt,~rltl*

Procedure Page 17 of 24

For components that were assessed with a passive risk of HSS, the critical attribute(s) would include, but not necessarily be limited to, pressure retention.

6.13.2 For those components supporting HSS functions but categorized as LSS based on mitigating factors, the attributes of the component that are associated with supporting the HSS functions should be documented as critical, with the clarification that loss of the attribute would not, in and of itself, fail the function.

6.14 Final Classification The lOP will classify the SSCs based on the combination of the significance and their safety related classification as follows:

RISC-1: SSCs that are safety-related and have RISC-2: SSCs that are non-safety-related RISC-3: SSCs that are safety-related and RISC-4:

The results of the final classification of

7.

6.15 6.15.1 Periodic reviews shall validity and performance monitoring for those In support of this, the periodic reviews should:

~t"'fl.r"a~, and applicable plant and n'ln"'I"T on existing categorizations into the categorizations, including updated component since the last review to ensure that

eDiTHDle and that no declining trends are noted. Specific attention those components that have had alternative treatments component performance since the last review to ensure that no are needed to ensure that safety significant functions can still be 6.15.2 to the plant risk profile are identified, or if it is identified that a RI ISC-4 SSC can (or actually did) prevent an HSS function from being satisfied, an immediate evaluation and review should be performed prior to the normally scheduled periodic review.

6.15.3 When a change to the categorization of an SSC is suggested either by a change in plant design or operation that would prevent a safety-significant function from being satisfied or by a change in the PRA model as determined from the absolute importance measures, they should be presented to the lOP for concurrence. In these cases, the lOP would assess the basis for the re-categorization by:

Southern Nuclear OJ)erating Company Nuclear NMP-ES-065-003 10CFR50.69 Risk Informed Categorization SOUIHERNA Management Version 1.0 COMPANY for Structures, Systems, and Components EMtv,*s,rwYOW,.W9rlJ Procedure Page 18 of 24 Review of the primary technical bases for the initial categorization, including the system function(s), the risk importance and the basis for their original categorization, Review of the technical basis for the change (in plant design and operation of PRA model) that has resulted in a suggested change to the SSC categorization including the appropriateness of the manner in which the SSC has been reflected as a result of the change, and Review of the new risk importance and defense in 6.15.4 Risk insights from new PRA models (e.g., seismic re-categorization of the system, unless such In~linnTC than the current overall risk of the component(s).

components need to be evaluated for potential 6.15.5 The lOP will convene to review the results following features require revision:

Risk of system functions and/or Alternative treatments being cu Component critical attributes Documented categc>r!

6.15.6 The lOP has the final necessarily require a a higher integrated risk

, only the affected

n.

6.16 Critical Changes inAlntQ can be removed from the scope of blecte!d to alternative treatment a RISC-3 component from LSS to HSS RISC-1. This type of change is Jre:S5t:,g expeditiously. Critical changes

!I:'U:UH::Ullcr the risk of a safety-related component changes from Tln/"\\"£1,"""'" that have not had any alternative treatments applied are not Critical changes do not apply to increases in the risk of however, such changes can result in a critical change at the are most likely to occur following a revision to the PRA Model(s).

changes may also occur due to new insights, negative performance changes, etc.

6.16.2

Southern Nuclear Operating Company Nuclear NMP-ES-065-003 10CFR50.69 Risk Informed Categorization SOUTHERN A Management Version 1.0 COMPANY for Structures, Systems, and Components EHf'f1/D St'f'H )4UY~rfJ' Procedure Page 19 of 24 6.16.3 As soon as the potential for a critical change is identified, a Condition Report will be initiated, in accordance with the Corrective Action Program. The Condition Report SHALL include the necessary data to support a proper evaluation. At a minimum, the following actions will be generated for the Condition Report.

NOTE If conditions/events do not permit the below timeframes satisfied, the Integrated Working Group Chairman shall ensure compensatory measures are instituted until the next required accomplished.

6.16.3.1 The lOP will convene to determine the the potential change within 14 calendar days of the in action.

6.16.3.2 If an electronic database is being the Plant, the database shall b within 14 days of lOP app 6.16.3.3 6.16.3.4

. ityof activities performed on, or

,,",,,no,,,.. was under the RISC-3 be considered as necessary.

6.16.3.5 Within I"n~:J'nrIO, notify the owner of each alte be by the change. Individual to complete the assessment. A list of be found in NMP-ES-065-004.

6.16.4 that the critical change is not valid, the owners items will be notified as soon as possible, the the decision of the lOP, and any changes will 7.0 7.1 of risk inSights that support the categorization of SSCs as as well as in the associated instructions (NMP-ES-065-001 and NMP (NMP-ES-066) shall be documented to ensure that the process and n<:i'~tol"\\t and reflect the current plant design. Typically, this consist of the following:

Procedures, instructions, or guidelines that describe the processes for the development, evaluation, and use of the SSC categorizations

System functions -- identified and categorized with the associated bases

Mapping of components to supported function(s)

PRA model results, including sensitivity studies

Hazards analyses, as applicable

Southern Nuclear Operating Company Nuclear NMP-ES-06S-003 10CFRSO.69 Risk Informed Categorization SOUIHERNA.

Management Version 1.0 COMPANY for Structures, Systems, and Components EIUrolflfUrw Y/HoI,. WP"

Procedure Page 20 of 24 1/1 Passive risk assessment results and bases 1/1 Categorization results for components, including all associated bases and the RISC classifications 1/1 Component critical attributes 1/1 Results of periodic reviews and SSC performance evaluations 1/1 lOP meeting minutes with associated attachments 7.2 Documents generated by this instruction are considered QA shall be stored using the following R type in the Corporate doc base.

7.2.1 After the lOP approves categorization results of results will be captured in a Risk Based Document (RBD). The RBD ted supporting information that was used to categorize reside in the Corporate doc base, and the Corporate 7.2.2 The lOP meeting minutes shall be 7.3 A suitable plant-wide electronic means of should be implemented. This data is to be a reasonable period of time, n ing the changes.

7.4 The RBD should be updated to i tion data, if applicable, at least at the same frequency as the SS~)OCilatE~a system. This update will take incorporates any changes to the cateac)rizaticm ng those identified during the 7.S of an amendment-type change process.

h a general revision on at least the same e associated system.

8.0

Southern Nuclear Operating Company Nuclear NMP-ES-065-003 SOUTHERN A.

Management 10CFR50.69 Risk Informed Categorization Version 1.0 COMPANY for Structures, Systems, and Components EM'V,. &rtt, Yll#r WOrld-Procedure Page 21 of 24 - Guidelines for Defense-in-Depth Assessments In cases where the component is safety-related and found to be LSS, it is appropriate to confirm that defense-in-depth is preserved. This evaluation should include consideration of the events mitigated, the functions performed, the other systems that support those functions and the complement of other plant capabilities that can be relied upon to prevent core damage and large, early release.

1. Core Damage Defense-in-Depth The initial assessment should consider both the level of defense-*n_r,on,rn and to the frequency of the events being mitigated. Figure 1 is an This figure depicts the internally initiated design basis events report (Le.* the events that were used to identify an SSC as defense-in-depth available, based on the success criteria used defense-in-depth is available to mitigate design basis form to the Significance Determination Process used in same concepts of diverse and redundant trains and The following process is used in applying Figure 1.

zed as

LSS,

Identify the design basis events

For each design basis event, that can support the function or can provide an alternative su Potential combinations of other systems and trains are de

1. Credit may be taken for systems containing RI 2, 3, or 4 in the bullet below), and realistic success used.

For each desig the capability lies significant, classified as

,nifif"!:llnf"t:I Confirmed," then the LSS

If the "Potentially Safety-significant," then the function/SSC should noting that the basis is core damage defense-in-depth.

rmed as LSS, then the SSC remains Candidate LSS for For example, if the low pressure core spray (LPCS) system pumps were LSS in the categorization p information, then their categorization would be confirmed using Figure

1. In this case, the have the function of providing coolant makeup to the RPV at low pressure. This function uired either (a) in response to a large LOCA, or (b) in response to other transients and LOCAs where other coolant makeup systems are failed.

For mitigation of a large LOCA, the low pressure coolant injection (LPCI) function of the RHR system can also support the coolant inventory makeup function. The LPCI function is automatic and consists of at least two redundant trains. Thus, for this LOCA event, in the bottom row of Figure 1, the presence LPCI as a redundant automatic system confirms the low safety significance of LPCS.

Southern Nuclear OperatinjJ Company Nuclear NMP-ES-065-003 SOUTHERNA.

Management 10CFR50.69 Risk Informed Categorization Version 1.0 COMPANY for Structures, Systems, and Components E1I~T('!I.S<<rw YI:IN,\\l'1J,/J" Procedure Page 22 of 24 In order to confirm LSS in high frequency transient events, such as reactor trip, either two redundant systems are required or three or more trains must exist. For BWRs, there are multiple coolant inventory makeup systems that could be used without crediting LPCS (Le., HPCI, Reactor Core Isolation Cooling (RCIC), main feedwater, condensate, and LPCI with Automatic Depressurization System (ADS>>. This exceeds the redundancy and diversity requirements for mitigation of these events.

In order to confirm LSS for mitigation of a stuck open relief valve, one train plus one redundant system is required. In this case, BWRs have LPCI with ADS and HPCI plus drive cooling (CRD) to provide success paths. This provides a redundant system (LPCI/ADS) additional diverse train (HPCI/CRD).

In order to confirm LSS for mitigation of loss of one C<lTCT\\J'_F"C'<lT,:>r least two diverse trains are required. In this case, BWRs would have one train of (a one train system) or RCIC (a one train system) available to meet the

2.

Containment Defense-in-Depth Defense-in-depth should also be assessed for Level 2 PRAs have identified the several containrnont include containment bypass events such as ISLOCA isolation failures (BWR and PWR), and Containment defense-in-depth is also containment failures (e.g., due to loss of categorized as candidate LSS, its Containment Bypass generator following a steam generator tube rupture event?

ment isolation for containment penetrations that are:

containment atmosphere, and

>2" in not locked or only locally operated?

Does the SSC support containment isolation for containment penetrations that are:

Part of the reactor coolant system pressure boundary, and

> 3/8" in diameter, and not locked closed or only locally operated?

Early Hydrogen Burns

Southern Nuclear Operating Company Nuclear NMP-ES-065-003 10CFR50.69 Risk Informed Categorization SOUTHERNA.

Management Version 1.0 COMPANY for Structures, Systems, and Components W1'X!IItS,rJlIY",rUWId' Procedure Page 23 of 24

Does the SSC support operation of hydrogen igniters in ice condenser and Mark III containments?

Long-Term Containment Integrity

Does the SSC support a system function that is not considered in CDF and LERF, but would be the only means for preserving long-term containment integrity post-core damage (e.g.,

containment heat removal)?

In cases where the answer to any of the above questions is "yes," the candidate HSS. If all of the above questions are answered "no," then complete, if all SSC functions are confirmed as LSS, then the SSC In cases where SSCs are identified as HSS, the ",,,>?,,nL Id be defined. This involves identifying the performance aspects and failure to it being safety-significant. These attributes are to be provided to

Southern Nuclear Operatin~ Comj)an-'y Nuclear NMP-ES-065-003 10CFR50.69 Risk Informed Categorization SOUntERNA Management Version 1.0 COMPANY for Structures, Systems, and Components Enet'f1ls S¥rw YowrWgrltl*

Procedure Page 24 of 24 Figure 1 DEFENSE-IN-DEPTH MATRIX Frequency Design Basis Event

.::::3 diverse trains OR 2

1 train + 1 system with redundancy 2 diverse trains 1 redundant automatic system

>1 per 1-10 yr Reactor Trip Loss of Condenser 1 per 10-102 yr Loss of Offsite Power Total Loss of Main FW Stuck Open SRV (BWR)

MSLB (outside cntmt)

Loss of 1 SR AC Bus Loss of Instr/Cntrl Air SIGNIFICANT SGTR Stuck Open PORV/SV RCP Seal MFLB MSLB L

Vogtle Electric Generating Plant Pilot 10 CFR 50.69 License Amendment Request Draft Risk-Informed Categorization Procedures Draft NMP-ES-066 General Guidance for Decision-Making Panels 50.69 and Surveillance Frequency Control Program

Southern Nuclear Operating Company Nuclear General Guidance for Decision-Making Panels NMP-ES-066 SOUTHERN A.

Management

- 50.69 and Surveillance Frequency Control Version 1.0 COMPANY Instruction Program Page 1 of 6 Ei'J~rvlf).~"N Yau.ir~r.t.r Paul Hayes / Fleet Engineering Services Director / Corporate Instruction Owner: -------------------,,----_____

(Print: Name / Title / Site)

Approved by:

(Peer Team Champion/Procedure

/ Date)

N/A N/A Effective Dates:

Corporate FNP VEGP 3&4 Writer(s):

Vish Patel Stephanie Agee SECTIONS open and readily available at the NONE procedure step by step unless directed by the procedure.

or applicable section(s) available at the NONE for ready reference by person ng steps.

Information Use:

ALL

Southern Nuclear Operating Company Nuclear General Guidance for Decision-Making Panels NMP-ES-066 SOUIHERNA Management

- 50.69 and Surveillance Frequency Control Version 1.0 COMPANY Instruction Program Page 2 of 6 Eu'l1 la Stl r",,.rWMI.d" Version Number Version Description 1.0 Initial Issue

Southern Nuclear Operating Company Nuclear General Guidance for Decision-Making Panels NMP-ES-066 SOUTHERN A.

Management

- 50.69 and Surveillance Frequency Control Version 1.0 COMPANY Instruction Program Page 3 of 6 Entrr116S'nH1 f6ur ~r.tJ" Table of Contents 1.0 Purpose.......................................................................................................................................4 2.0 Applicability..................................................................................................................................4 3.0 References..................................................................................................................................4 4.0 Oefinitions..........................................................................................

.....................................4 5.0 Responsibilities............................................................................

.....................................5 6.0 Procedure..............................................................................

7.0 Records...........................................................................

....................................6

Southern Nuclear Operating Company Nuclear General Guidance for Decision*Making Panels NMp*ES-066 SOUTHERNA Management

- 50.69 and Surveillance Frequency Control Version 1.0 COMPANY Instruction Program Page 4 of 6 E"I:'X'ItD$.uw Ytu,,-WMlJ" 1.0 Purpose This procedure establishes the concepts of the Integrated Decision-making Panel (lOP) for the Risk Informed Tech Spec Initiative 5b process (Surveillance Frequency Control Program (SFCP))

(for which specifics are described in NMP-ES-066-001) and for the 50.69 (Risk Informed Categorization (RIC)) process (for which specifics are described in

. The process specific Site lOPs approve the results of the SFCP and respectively.

2.0 Applicability This procedure is applicable to the 50.69 and SFCP 3.0 References 3.1 NEI 00-04, "10 CFR 50.69 SSC L;ateao,rlza 3.2 3.3

, revision 1 3.4 3.5 NMP-ES-072, Su 3.6 NMP-,-,-,~,vvv-v:

iIIance Frequency Control 3.7 el for Risk Informed SSC Categorization 4.0 4.1 Panel (lOP) - A multi-disciplinary panel of plant - knowledgeable risk and deterministic inputs to determine whether a proposed plant

nc: tlll'1cr'lng plant design and operating practices and experience in 4.1.1 50.69 lOP* the lOP convened to review risk informed categorization of structures systems and components.

4.1.2 SFCP lOP - the lOP convened to review changes to surveillance test intervals under the SFCP.

4.2 Consensus - a group decision making process that not only seeks the agreement of most participants, but also the resolution of differing opinions or objections. That is, not a simple vote,

Southern Nuclear Operating Company Nuclear General Guidance for Decision-Making Panels NMP-ES-066 SOUIHERNA Management

- 50.69 and Surveillance Frequency Control Version 1.0 COMPANY H"trrJ'OMrw Ytlu,.w.rlJ'"

Instruction Program Page 5 of 6 but also consideration of relevant issues raised by the members of the group. For purposes of the lOP, agreement on an outcome by a two-thirds majority of the quorum members is considered consensus. Consensus is required for final decisions regarding safety significant and LSS.

5.0 Responsibilities 5.1 An lOP has the following responsibilities.

5.1.1 Serve as a multi-disciplinary review panel ing broad knowtedge of plant design, licensing requirements, ope tenance practices, risk and experience.

5.1.2 Ensure all attributes of the provide a valid risk informed maintenance of defense-in-de 5.2 The responsibilities of the site lOP for th and the lOP Chairperson are defined in NMP-ES 5.3 The responsibilities of the site lOP for the 1 Chairperson are defined in 5.4 Risk Informed Engineering 5.4.1 5.4.2 before participating in lOP 5.5 6.0 composed of members of varying disciplines as defined by the "rt.."nl"'" document for the specific process (e.g. 10CFR50.69 or Frequency Control Program) 6.1.2 bers are required to be qualified for the specific lOP they are part of.

6.1.3 The site lOP is envisioned as a group that collectively meets the requirements of both the SFCP and 50.69 processes. Depending on which process convenes the lOP, the quorum requirements will vary. The lOP chairperson ensures that the appropriate quorum requirements are met.

6.1.4 The site Operations Manager (or designee) selects individuals to serve on the site lOP, with concurrence of the individuals' department manager.

Southern Nuclear Operating Company Nuclear General Guidance for Decision-Making Panels NMP-ES-066 SOUTHERN A.

Management

- 50.69 and Surveillance Frequency Control Version 1.0 COMPANY Instruction Program Page 6 of 6

[;'nE'V/oSerwY&tUt"WtJrltr 6.1.5 The site Operations Manager (or designee) will act as Chairperson.

6.1.6 The site lOPs will meet on an as needed basis or as designated in the process specific procedures.

6.1.7 A site lOP shall be convened to review material related to a single process. A site lOP convened to review 50.69 material shall NOT an SFCP evaluation.

Likewise, the site lOP convened for review of SFC rial shall NOT review 50.69 packages.

6.1.8 The lOP reviews the material presented to a decision whether to approve the material/change (in the case mended HSS/LSS categorization (in the case of 50.69).

6.1.9 The material should be disc Chairperson should ensure member.

6.1.10 within the records 6.1.11 7.0 Records 7.1 Records Control Program are defined in NMP-ES-066 001.

Process are defined in NMP-ES-066 7.2 002.

VogUe Electric Generating Plant Pilot 10 CFR 50.69 License Amendment Request Draft Risk-Informed Categorization Procedures Draft NMP-ES-066-002 Integrated Decision-Making Panel for Risk Informed SSC Categorization:

Duties and Responsibilities

Southern Nuclear Operating Company Nuclear Integrated Decision-making Panel for Risk SOUYHERNA Management Informed SSC Categorization: Duties and COMPANY EnuVIItS,IWY_rWflrlJ" Instruction Responsibilities Instruction Owner:

(Print: Name I Title I Site) signed by: on:

Approved by:

N/A Effective Dates:

Corporate Writer(s);

PRS review is required for this instruction.

and readily available at the work re step by step unless otherwise or applicable section(s) available at the work ready reference by person performing steps.

Information n site for reference as needed.

NMP-ES-066-002 Version 1.0 Page 1 of 11 VEGP3&4 SECTIONS NONE NONE ALL

Southern Nuclear Operating Company Nuclear Integrated Decision-making Panel for Risk NMP-ES-066-002 SOUTHERNA Management Informed SSC Categorization: Duties and Version 1.0 COMPANY En-t'1:.'!lttSuwY,u;r'Arltl" Instruction Responsibilities Page 2 of 11 Version Number Version Description 1.0 Initial Issue

Southern Nuclear Operating Company Nuclear Integrated Decision-making Panel for Risk NIVIP-ES-066-002 SOUTHERN.\\.

Management Informed SSC Categorization: Duties and Version 1.0 COMPANY Instruction Responsibilities Page 3 of 11 En.'X1If1 fie"" Y9Mr Wln-U-Table of Contents 1.0 Purpose............................................................................................................................................................. 4 2.0 Applicability....................................................................................................................................................... 4 3.0 References........................................................................................................................................................ 5 4.0 Definitions......................................................................................................................................................... 5 5.0 Responsibilities...........................................................................................

......................................... 5 6.0 Procedure.............................................................................................

............................................... 6 7.0 Records..........................................................................................

............................................. 9 8.0 Com m itm ents............................................................................

......................................... 9 --50.69 lOP Meeting Minutes Template..................

.............................. 10

Southern Nuclear Operating Company Nuclear Integrated Decision-making Panel for Risk NMP-ES-066-002 SOUTHERNA Management Inform ed SSC Categorization: Duties and Version 1.0 COMPANY EIIU'C;MMTHy_,.\\t:brJJ'"

Instruction Responsibilities Page 4 of 11 1.0 Purpose 1.1 This procedure establishes the Integrated Decision-making Panel (lOP), and defines its structure, responsibilities, and qualifications. It addresses the lOPs for the 10CFR50.69 risk informed categorization (SO.69) process 1.2 This instruction is part of an integrated categorization ich includes the following additional procedures/instructions.

NMP-ES-065. 10CFRSO.69 Program

NMP-ES-065-003, 10CFR50.69 Risk Infl"\\.rrY\\~

Systems, and Components NMP-ES-065-001, 10CFR50.59 NMP-ES-065-002, 10CFR50.69

NMP-ES 065-004, Alternative T

NMP-ES-066, General Guidance Surveillance Frequency Control 1.3 The process described in to satisfy the requirements of 10 CFR 50.69 paragraph and partially satisfy paragraph (e), Feedback raph (f). Program Oocumenta this instruction does not include in 10 CFR SO.69 (d), which 1.4 review group for the risk informed all sites having an NRC approved 10CFRSO.69 Risk program.

Southern Nuclear Operating Company Nuclear Integrated Decision-making Panel for Risk NMP-ES-066-002 SOUIHERNA Management Informed SSC Categorization: Duties and Version 1.0 COMPANY

&tU'!UIO.Vf'H "u, Wb,l.r Instruction Responsibilities Page 5 of 11 3.0 References 3.1 NEI 00-04, "10 CFR SO.69 SSC Categorization Guideline", Revision 0, July 200S.

3.2 R.G. 1.201, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to Their Safety Significance" 1, July 2006.

3.3 NMP-ES-06S, 10CFRSO.69 Program 3.4 NMP-ES-06S-003, Risk Informed Categorization and Structures, and Components instruction 3.S NMP-ES-066, General Guidance for Decision and Surveillance Frequency Control Program 4.0 Definitions serve in the absence of a qualifications for the lOP Consensus - a group decis seeks the agreement of most participants, but also the objections. That is, not a simple vote, but the members of the group. For by a two-thirds majority of the quorum is required for final decisions 5.0 for which detailed guidance is provided in NMP ights, passive risk insights, and qualitative risk insights to categorization for system functions and components lOP for review.

from performance monitoring and periodic reassessments to basis for the categorization of SSCs remains valid and that any alternative treatments have not significantly degraded the of the associated components.

5.1.3 Evaluating recommended changes to categorization resulting from changes to the plant, PRA model updates, changes to operational practices, as well as other applicable changes.

Southern Nuclear Operating Company Nuclear Integrated Decision-making Panel for Risk NMP-ES-066-002 SOUTHERN A Management Informed SSC Categorization: Duties and Version 1.0 COMPANY bf~'1:Y tll&TIM 1111;r \\IfJ,Jd" Instruction Responsibilities Page 6 of 11 5.2 The site lOP chairperson has the following responsibilities 5.2.1 Schedule and run the site lOP meetings.

5.2.2 Ensure that quorum requirements are met for lOP meetings.

5.2.3 Ensure site lOP meeting minutes are prepared.

5.2.4 Ensure site lOP meeting minutes are approved.

5.3 The site lOP secretary (Risk Informed responsibilities 5.3.1 Ensure that minutes of site lOP uired lOP records per site QA records 5.3.2 Forward the site lOP meeting m lOP oversight committee secretary 5.3.3 Facilitate qualification 5.3.4 6.0 Procedure 6.1 6.1.1

~()nnn()!=:ArI of members covering the Systems Engineering Probabilistic Risk Analysis (PRA)

The site 50.69 lOP should include members from the following organizations a) Site Operations (SRO) b) Safety Analysis c) Site Design Engineering d) Site System Engineering

Southern Nuclear Operating Company Nuclear Integrated Decision-making Panel for Risk NMP-ES-066-002 SOutHERNA.

Management Informed SSC Categorization: Duties and Version 1.0 COMPANY EneI'tY WSeI'H Y_, Wn,./,r Instruction Responsibilities Page 7 of 11 e) Site Risk Informed Application f)

Site Nuclear Licensing g) Site Maintenance 6.1.1.3 The Operations Manager (or deSignee) alternate members to serve on the lOP.

6.1.1.3.1 The qualified alternate(s) are absent member(s).

6.1.1.3.2 The Operations Manager (or 6.1.2 Quorum 6.1.2.1 A Quorum for the 50 persons collectively areas listed in 6.1.1.

6.1.3 Qualifications 6.1.3.1 categorization informed categorization completed an lOP member qualification Jaa,estl~d that a primary and alternate member be qualified in

'ning lOP Training for the 50.69 lOP shall include:

The purpose of risk informed categorization including exempted regulations for low safety significance SSCs.

b) The categorization process c) Risk informed defense in depth philosophy and how it is maintained.

d) Details of the lOP process including roles and responsibilities e) PRA fundamentals pertinent to the 50.69 program f) details of the specific plant PRA analyses used for the

Southern Nuclear Operating Company Nuclear Integrated Decision-making Panel for Risk NMP-ES-066-002 SOUTHERN A Management Informed SSC Categorization: Duties and Version 1.0 COMPANY

£"~'D w&rw Ylu;r "Ad" Instruction Responsibilities Page 8 of 11 preliminary categorization including:

model scope and assumptions (all hazard groups) interpretation of risk importance measures role of sensitivity studies and changes (e.g., impact of PRA model models) in risk evaluations or additional PRA 6.1.4.2 Refresher training should be years.

6.1.4.3 Initial training shall be docum 001-F01.

6.2 Functions 6.2.1 50.69 lOP Meetings 6.2.1.1 The 50.69 lOP should 6.2.1.1.1

'II'"\\lo,t....rt in accordance with NMP 6.2.1.1.2 of the program.

nducted without a quorum present.

, an effort should be made to have all primary absence is unavoidable, an alternate may led. The primary member should notify the Chairperson in of the meeting, if practical, stating the reason{s) for the e lOP Chairperson will ensure the minutes of lOP meetings are prepared.

At a minimum, the minutes will include:

The quorum members attending the meeting, Verification that there was a quorum present, The meeting agenda, The results of the lOP activities including the outcome of the categorization review, the basis for the determination, any

Southern Nuclear Operating Company Nuclear Integrated Decision-making Panel for Risk NMP-ES-066-002 sourHERNA Management Informed SSC Categorization: Duties and Version 1.0 COMPANY EIUl1J It) &rH YDur Wttr/tf' Instruction Responsibilities Page 9 of 11 differing opinions, and any significant issues discussed leading to the decision, Open actions from the meeting.

See attachment 1 for example meeting minute format.

6.2.2.3 The minutes will be numbered sequential reviewed by the members, and 6.2.2.3.1 The minutes for each meeting approved within 30 days of 6.2.2.3.2 A copy of the minutes will Manager for review.

6.2.2.3.3 The meeting m*

. The site lOP C'",,..,......T,,,

stored per site QA 6.2.2.3.4 The site lOP the,..r....nl"\\~"'to 7.0 Records QA Time R-Type record (X)

Life of Plant R

18

Southern Nuclear Operating Company Nuclear Integrated Decision-making Panel for Risk SOUTHERN A Management Informed SSC Categorization: Duties and COMPANY EfUD IV S,'H Ymtr 'WrIYIJ" Instruction Responsibilities 50.69 IDP Meeting Minutes Template 20__

Meeting number:

MEETING CONVENED:

AMIPM THIS MEETING CHAIRED BY:

( ) Chairperson

MEMBERS PRESENT:

Operations

Design engineering

Safety Analysis NMP-ES-066-002 Version 1.0 Page 10 of 11 Page of AM/PM Denotes phone or video attendance Summary of Meeting Minute Contents Periodic monitoring Periodic or unplanned reivew

Southern Nuclear Operating Company Nuclear Integrated Decision-making Panel for Risk NMP-ES-066-002 SOUIHERNA.

Management Informed SSC Categorization: Duties and Version 1.0 COMPANY Instruction Responsibilities Page 11 of 11 EturulD~rw ~"'I'Wtlrlir MEE'rJNG NO,:

DATE:

PAGE OF Minutes:

THESE MINUTES APPROVED IN lOP MEETING NO.:

Date

Vogtle Electric Generating Plant Pilot 10 CFR 50.69 License Amendment Request Draft Risk~lnformed Categorization Procedures Draft NMP-ES-066-002-F01 Risk Informed Categorization Integrated Decision Making Panel Qualification Form - 50.69

'I Southern Nuclear Operating Company Nuclear Risk Informed Categorization Integrated NMP-ES-066-002-F01 SOUIHERNA.

Management Decision Making Panel Qualification Form -

Version 1.0 COMPANY EM7JlIlSerw YeurWDrllr Instruction 50.69 Page 1 of 2 RISK INFORMED CATEGORIZATION INTEGRATED DECISIONMAKING PANEL (lOP) TRAINING/QUALIFICATION RECORD for (site)

Last Name Part A - The following documents shall be read and to the the administrative processes and requirements, preferably prior to com

1.

Risk informed categorization procedures:

NMP-ES-065 =1 OCFR50.69 Program NMP-ES-65-003 =Risk Informed Categorization and T NMP-ES-065-001 = 10CFR50.69 Active Component Risk NMP-ES-065-002 = 10CFR50.69 Passive Components t;ateao-n:

NMP-ES-065-004 =Treatment NMP-ES-066 =General Guidance for Decision NMP-ES-66-002 = Integrated DeCision-Making Responsibilities

3.

I/ance Frequency Control Program 1IIf""7'<>t"',.,: Duties And

[ ]

[] System Engineering

[] Probabilistic Safety Assessment

[] Safety Analysis

[] Licensing

Southern Nuclear Operating Company Nuclear Risk Informed Categorization Integrated NMP-ES-066-002-F01 SOUTHERN A Management Decision Making Panel Qualification Form -

Version 1.0 COMPANY E",rt.1 to SlNIt' Y"",rw"l'l.('

Instruction 50.69 Page 2 of 2

[] Maintenance

4.

Document Industry Experience in above area(s):

5.

Document Plant Specific Experience:

6.

Other Specific Area(s) of expertise and experience:

Part Line Organization Acknowledgement of the individual listed on this form will represent below. Sufficient resources I be provided to perform the IDP roles and Organization/expertise Reprcccnlrcn

[] IDP Chairpers

[ ]

Date:

Site IDP Chairperson:

Date:

hen approved the IDP Chairperson shall submit this form to the for submittal to

v t e Letter Sequence Draft Request
TAC:ME7763, (Open)
Initiation Request Acceptance... Administration Questions Answers Results Approval... Other: ML12061A245
MONTHYEAR2011-08-17 [Table View]

NL-11-1451, Pilot 10 CFR 50.69 License Amendment Request, Draft Risk-Informed Categorization Procedures

Text

Enclosures:

SUMMARY

3.7 NMP-ES-066

3.8 NMP-ES-066-001

Navigation menu

NL-11-1451, Pilot 10 CFR 50.69 License Amendment Request, Draft Risk-Informed Categorization Procedures

Text

Enclosures:

SUMMARY

3.7 NMP-ES-066

3.8 NMP-ES-066-001

Navigation menu

Search