Text

Pilot Submittal and Request for Exemption for a Risk-Informed Approach to Resolve Generic Safety Issue (GSI)-191
	ML13043A013
Person / Time
Site:	South Texas
Issue date:	01/31/2013
From:	Crenshaw J; South Texas
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	NOC-AE-13002954
	Download: ML13043A013 (111)
	v • d • e

V SMmIFARD Nuclear Operating Company South Texas Pro/ed Ekctric GeneratingStation PO Bax 289 Wadsworth. Texas 77483 -

January 31, 2013 NOC-AE-13002954 10 CFR 50.12 10 CFR 50.46 Document Control Desk U. S. Nuclear Regulatory Commission Washington, DC 20555-0001 South Texas Project Units 1 and 2 Docket Nos. STN 50-498 and STN 50-499 STP Pilot Submittal and Request for Exemption for a Risk-Informed Approach to Resolve Generic Safety Issue (GSI)-191

References:

1. Letter, J. W. Crenshaw, STPNOC, to NRC Document Control Desk, "Status of the South Texas Project Risk-Informed (RI) Approach to Resolve Generic Safety Issue (GSI)-1 91," NOC-AE-1 1002775, dated December 14, 2011 (ML11354A386)

2. Letter, D. W. Rencurrel to NRC Document Control Desk, "GSI-191 Resolution Path Schedule and Commitment Changes," dated June 4, 2012, NOC-AE-1 2002858

3. Letter, John C. Butler, NEI, to William H. Ruland, NRC, "GSI-191 - Current Status and Recommended Actions for Closure," dated May 4, 2012 (ML12142A316)

4. Commission SECY Paper, "Closure Options for Generic Safety Issue - 191, Assessment of Debris Accumulation on Pressurized-Water Reactor Sump Performance," SECY-12-0093, dated July 9, 2012 (ML121320270)

5. Letter, J. E. Dyer, NRC, to A. W. Harrison, STPNOC, Response to letter requesting an exemption of fees, AE-NOC-11002079, dated April 15, 2011 (ML111050388)

This submittal is the request for NRC review and approval of an exemption to enable the STP Nuclear Operating Company (STPNOC) to apply a piloted risk-informed approach for closure of Generic Safety Issue (GSI)-1 91, "Assessment of Debris Accumulation on Pressurized-Water Reactor Sump Performance." This submittal supports closure of Generic Letter (GL) 2004-02, "Potential Impact of Debris Blockage on Emergency Recirculation During Design Basis Accidents at Pressurized-Water Reactors," for the South Texas Project (STP) Units 1 and 2.

STPNOC seeks NRC approval based on a determination that the risk associated with the postulated failure mechanisms due to GSI-191 concerns meets the acceptance guidelines in Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis."

STI 33648174

NOC-AE-1 3002954 Page 2 of 5 This submittal includes a request for exemption from part of NRC's regulations and a description of the STP risk-informed approach. Also included for information purposes are changes to the STP Updated Final Safety Analysis Report (UFSAR) to be implemented pursuant to NRC approval of the risk-informed approach and the exemption request.

By Reference 1, STPNOC submitted to the NRC the preliminary results showing that the risks, Core Damage Frequency (CDF) and Large Early Release Frequency (LERF), associated with GSI-191 concerns are in Region III, "Very Small Changes," of RG 1.174 acceptance guidelines, and notified the NRC of the intent to seek exemption from certain requirements of 10 CFR 50.46, "Acceptance criteria for emergency core cooling systems for light-water nuclear power reactors." By Reference 2, STPNOC committed to STP Units 1 and 2 piloting a risk-informed approach and to seek exemption from certain regulatory requirements to support closure for GSI-191.

Additional details of the STP risk-informed approach and schedule are discussed in References 3 and 4, and in Enclosure 2, "Evaluation of Generic Safety Issue-191 Closure Options," and , "Risk-Informed Approach to Address GSI-191, South Texas Project" of Reference

4. The NRC staff plans to use STPNOC as a pilot for other licensees choosing to use this approach (References 4 and 5). The STP piloted risk-informed approach is expected to result in substantial benefit to both the NRC and industry in support of the development and implementation of risk-informed resolution of GSI-191.

The STP piloted risk-informed approach to closure for GSI-1 91 applies the STP Probabilistic Risk Assessment (PRA) model to quantify the risk associated with GSI-191 concerns by calculating the difference in risk for two cases:

the actual plant configuration for STP Units 1 and 2, risk informed to model the failure mechanism associated with the concerns raised by GSI-191, and

a hypothetical STP plant, identical to the actual model except for the assumption that it is not subject to the concerns raised by GSI-1 91.

The risk associated with GS1-191 concerns includes the effects on long-term cooling due to debris accumulation on Emergency Core Cooling System (ECCS) and Containment Spray System (CSS) sump strainers in recirculation mode, as well as core flow blockage due to in-vessel effects, following loss of coolant accidents (LOCAs). A full spectrum of postulated LOCAs is analyzed, including double-ended guillotine breaks (DEGBs) for all pipe sizes up to the largest pipe in the reactor coolant system (RCS). To inform the PRA with risk insights, the physical processes are modeled as realistically as possible, using results from industry and plant-specific testing, and applying some conservatism, where appropriate. The changes to CDF and LERF associated with GSI-191 concerns are then compared to RG 1.174 acceptance guidelines. provides the general methodology for the proposed risk-informed approach to closure of GSI-1 91, consistent with RG 1.174 guidance. This enclosure describes the required inputs to the PRA model, the basic structure for appropriately modeling the inputs, and performance criteria used to calculate the risk.

Enclosure 2 provides a request for exemption from parts of certain regulatory requirements in accordance with the provisions of § 50.12, and provides justification for the exemption based on the results of the risk-informed approach demonstrating for STP Units 1 and 2 that the

NOC-AE-13002954 Page 3 of 5 calculated risk associated with GSI-191 concerns is in Region Ill, "Very Small Changes," of RG 1.174 acceptance guidelines. The exemption request addresses regulatory requirements, including Appendix A to 10 CFR Part 50 General Design Criteria (GDC), that concern the ECCS and CSS functions for emergency core cooling, containment heat removal, and containment atmosphere cleanup:

§ 50.46(b)(5), Long-term cooling

Criterion 35 - Emergency core cooling

Criterion 38 - Containment heat removal

Criterion 41 - Containment atmosphere cleanup The exemption request also addresses requirements that concern crediting the CSS with reducing the accident source term:

§ 50.67, Accident source term

Criterion 19 - Control room provides the proposed changes to the STP Units 1 and 2 licensing basis, pursuant to NRC approval of the risk-informed approach and exemption request. The current licensing basis for the adequacy of ECCS to meet the criteria of 10 CFR 50.46, including the Appendix K Large-Break Loss-of-Coolant Accident analysis and the associated Chapter 15 accident analysis, remain unchanged. The current licensing basis for demonstrating compliance with the other requirements described above similarly remains unchanged. follows the structure, content and documentation requirements of RG 1.174, and provides references to other supporting documentation. This enclosure provides the details of how the STP piloted approach meets the general guidance and conforms to the risk-informed principles included in RG 1.174:

" Meets the current regulations except as provided in the request for partial exemption.

Is consistent with a defense-in-depth philosophy.

Maintains sufficient safety margins.

" Shows that for STP Units 1 and 2 the change in risk associated with GSI-1 91 concerns is very small, approximately 1.1E-8/yr (delta CDF) and 8.6E-12/yr (delta LERF).

" Includes provisions for monitoring the impact of the change.

To support the completion of work and resolution schedule for closure of GSI-191 as described in Reference 4, STPNOC seeks approval for the risk-informed approach and exemption request by December 2014.

There are no commitments in this letter.

If there are any questions regarding this submittal, please contact Jamie Paul at 361-972-7344, or me at 361-972-7074.

NOC-AE-1 3002954 Page 4 of 5 I declare under penalty of perjury that the foregoing is true and correct.

Executed on , if?171-John W. Crenshaw Vice President Projects, Outages & IT ccc

Enclosures:

1. STP Piloted Risk-Informed Approach to Closure for GS1-191

2. Request for Exemption for STP Piloted Risk-Informed Approach to Closure for GSI-191

3. Changes to the South Texas Project Units 1 and 2 Licensing Basis (Information Only)

4. Risk-Informed Closure of GSI-191, Volume 1.0, Project Summary

NOC-AE-13002954 Page 5 of 5 cc: (paper copy) (electronic copy)

Regional Administrator, Region IV A. H. Gutterman, Esquire U. S. Nuclear Regulatory Commission Morgan, Lewis & Bockius LLP 1600 East Lamar Boulevard Arlington, TX 76011-4511 Balwant K. Singal Stewart Bailey Balwant K. Singal Jack Davis Senior Project Manager Robert Elliott U.S. Nuclear Regulatory Commission Michael Markley One White Flint North (MS 8 B13) John Stang 11555 Rockville Pike U. S. Nuclear Regulatory Commission Rockville, MD 20852 John Ragan NRC Resident Inspector Chris O-Hara U. S. Nuclear Regulatory Commission Jim von Suskil P. 0. Box 289, Mail Code: MN1 16 NRG South Texas LP Wadsworth, TX 77483 Kevin Polio C. M. Canady Richard Pefia City of Austin City Public Service Electric Utility Department 721 Barton Springs Road Peter Nemeth Austin, TX 78704 Crain Caton & James, P.C.

C. Mele City of Austin Richard A. Ratliff Alice Rogers Texas Department of State Health Services

NOC-AE-1 3002954 ENCLOSURE 1 STP Piloted Risk-Informed Approach to Closure for GSI-191

Enclosure 1 NOC-AE-1 3002954 Page 1 of 6 STP Piloted Risk-Informed Approach to Closure for GSI-191 Introduction This enclosure provides the general methodology for the proposed risk-informed approach to closure of GSI-1 91, consistent with RG 1.174 guidance. The required inputs to the plant-specific probabilistic risk assessment (PRA) model, the basic structure for modeling the inputs, and performance criteria used to calculate the risk are discussed below, and in more detail in Enclosure 4.

Backqround Generic Safety Issue (GSI)-191, "Assessment of Debris Accumulation on PWR Sump Performance," concluded that debris could clog the containment sump strainers in PWRs, leading to the loss of net positive suction head for the Emergency Core Cooling System (ECCS) and Containment Spray System (CSS) pumps. The NRC issued Generic Letter (GL) 2004-02, "Potential Impact of Debris Blockage on Emergency Recirculation During Design Basis Accidents at Pressurized-Water Reactors" requesting that licensees address the issues raised by GSI-1 91. GL 2004-02 was focused on demonstrating compliance with 10 CFR 50.46.

In response, the industry implemented plant modifications, such as installing larger sump strainers and removing debris generating (fibrous) insulation from containment, and other compensatory actions to reduce the risk of strainer clogging. Considerable effort has also been made to reduce the uncertainties and conservatisms in the standard models used to assess GSI-191 concerns.

Summary of the STP approach The STP piloted risk-informed approach to closure for GSI-191 applies the plant-specific Probabilistic Risk Assessment (PRA) model to calculate the difference in risk (delta risk) between the actual plant configuration subject to the concerns raised by GSI-191 and a hypothetical plant configuration not subject to GSI-191, but otherwise identical. The difference in risk is a quantification of the risk associated with GSI-191 concerns. This risk includes the effects on long-term cooling due to debris accumulation on the ECCS and CSS containment sump strainers and the in-vessel effects following LOCAs that require recirculation flow from the containment sump to mitigate the event. The quantification of the risk associated with GSI-1 91 concerns conservatively defines the change to be evaluated, as discussed in Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis."

Section II provides the methodology for calculating the risk associated with GSI-1 91 concerns using the probabilistic risk assessment (PRA) model. A full spectrum of postulated LOCAs is analyzed, including double-ended guillotine breaks (DEGBs) for all pipe sizes up to and including the design basis accident (DBA) LOCA. The required inputs to the PRA, the basic structure for modeling the inputs, and performance criteria used to calculate the risk, are described. The physical processes are modeled as

Enclosure 1 NOC-AE-13002954 Page 2 of 6 realistically as possible, using results from industry and plant-specific testing, and applying some conservatism, where appropriate. The risk due to GSI-191 concerns is then shown to meet RG 1.174 acceptance guidelines for changes to Core Damage Frequency (CDF) and Large Early Release Frequency (LERF).

This risk-informed approach is expected to be applicable to plants with substantial fibrous insulation, and also may be beneficial to plants with low to medium fibrous insulation. If the results show high risk, they may be used to assess and prioritize those plant modifications with the highest risk benefit.

Methodology Define the Proposed Change Although this approach does not necessarily result in physical changes to the facility, it is expected to result in changes to the plant's licensing basis. The STP risk-informed approach to closure of GSI-191 evaluates a full spectrum of pipe breaks, including DEGBs up to and including the DBA LOCA. The approach uses a RG 1.200 compliant PRA model, using inputs as described below, to calculate the risk associated with concerns raised by GSI-1 91 based on a comparison of the as-built, as-operated plant to an identical plant with the exception that it is not subject to the phenomena associated with GSI-191 concerns. This difference in risk defines the risk associated with GSI-191 concerns, and the change to be evaluated.

The plant licensing basis considers the requirement for ECCS to satisfy the criterion for long-term core cooling following a LOCA as provided in 10 CFR 50.46(b)(5), and requires ECCS to operate with high probability following a LOCA. Using a risk-informed approach to address the concerns of GSI-1 91, the probability and uncertainty associated with the operation of the ECCS to maintain long-term cooling following a LOCA is quantified. Based on the risk associated with GSI-191 concerns meeting the acceptance guidelines in RG 1.174, with appropriate supporting engineering analysis, justification is provided for a change to the licensing basis which, in addition to the plant's existing licensing basis, provides reasonable assurance for compliance with certain regulatory requirements, and closure for GSI-1 91.

The regulatory requirements include those associated with ECCS and CSS functions for emergency core cooling, containment heat removal, and containment atmosphere cleanup, as provided in § 50.46(b)(5), Appendix A to 10 CFR Part 50 General Design Criteria (GDC) 35, GDC 38, and GDC 41. Also included are the regulatory requirements that concern crediting the CSS with reducing the accident source term, as provided in

§ 50.67 and GDC 19. Application of this methodology is accompanied by a request for exemption that addresses these regulatory requirements.

Engineering Analysis and PRA modeling The method of analysis for the risk-informed approach uses an integrative approach to explicitly provide the probabilities for post-LOCA events. This is accomplished by

Enclosure 1 NOC-AE-1 3002954 Page 3 of 6 modeling the underlying physical phenomena of the basic events and by propagating uncertainties in the physical models.

To determine the risk associated with GSI-191 concerns, under the framework of RG 1.174, the STP piloted risk-informed approach to closure for GSI-191 applies the plant-specific PRA model to calculate the difference in risk (delta risk) for two cases:

Case 1: the actual plant configuration, risk informed to model the failure mechanism associated with the concerns raised by GSI-191, and

Case 2: a hypothetical plant assuming no failure mechanisms associated with the concerns raised by GSI-191, otherwise identical to the actual plant.

The risk associated with GSI-191 concerns is determined for the as-built, as-operated plant (Case 1) and compared with the risk of a plant not subject to the concerns raised by GSI-191 (Case 2), as described in Table 1. The plant-specific PRA model is informed with risk insights to address the risk associated with failure modes associated with GSI-191 concerns, as described in Table 2.

To apply the inputs, the demand recirculation failure probability in the plant-specific PRA model is replaced with basic events (strainer failures, core flow blockage with chemical effects, and boron precipitation in the core), and failure modes leading to core damage are explicitly modeled, excluding those that were previously addressed for the plant using deterministic evaluations.

Failure probabilities and associated uncertainties determined in the supporting engineering analysis provide inputs to the three new top events added to the PRA to accommodate composite GS1-191 failure processes (sump strainer failure, core flow blockage, and boron precipitation in the core). The outcome of a full spectrum of LOCA events is tested against appropriate performance thresholds for the top events, as shown in Table 2.

Using the inputs noted above, the PRA uses risk insights for the failure modes resulting from GSI-191 concerns. The approach defines the change and performs engineering analysis and PRA assessments, which are principle elements of risk-informed, plant-specific decision-making as discussed in RG 1.174.

Ill. Conclusions The risk-informed approach results in the calculation of the risk associated with GSI-1 91 concerns, based on the difference in risk, CDF and LERF, between the as-built, as-operated plant with debris generating insulation, and the hypothetical plant with the insulation removed and therefore not subject to the failure mechanisms associated with GSI-191 related phenomena.

The PRA analysis yields results that are compared to the acceptance guidelines defined by Regulatory Guide 1.174 to show that long-term cooling is ensured with high probability, and provide a basis for NRC approval of the requested licensing actions for closure of GSI-191.

Enclosure 1 NOC-AE-1 3002954 Page 4 of 6 IV. References

1) Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis" (ML100910006)

2) NEI 04-07, "Pressurized Water Reactor Sump Performance Evaluation Methodology," Volume 1 "Pressurized Water Reactor Sump Performance Evaluation Methodology," Revision 0, dated December 2004 (ML050550138)

3) NEI 04-07, "Pressurized Water Reactor Sump Performance Evaluation Methodology," Volume 2 "Safety Evaluation by the Office of Nuclear Reactor Regulation Related to NRC Generic Letter 2004-02, Revision 0, December 6, 2004," Revision 0, dated December 2004 (ML050550156)

4) Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities" V. List of Tables Table 1: General Methodology for Determining Risk Associated with GSI-1 91 Concerns Table 2: Modeling Basic Events, Failure Modes, and Top Events with Performance Thresholds

Enclosure 1 NOC-AE-13002954 Page 5 of 6 Table 1: General Methodology for Determining Risk Associated with GSI-191 Concerns Case 1: Evaluate the risk associated with the concerns raised in GS-1 91 for the as-built, as-operated facility as described in the current licensing basis using a plant-specific, RG 1.200 compliant probabilistic risk assessment (PRA). The PRA is based on realistic assessments to the extent practical and contains conservative assumptions where appropriate. Modeling of basic events, failure modes, and new top events to accommodate composite GSI-191 failure processes with appropriate performance thresholds is described in Table 2.

The inputs to the risk model encompass the concerns raised in GSI-191, including the major topical areas discussed in NEI 04-07 (Reference 2), as appropriate:

o pipe break characterization o debris generation/zone of influence (ZOI), including latent debris o debris transport o chemical effects o strainer head loss, including structural margin o air intrusion o debris penetration o ex-vessel downstream effects o in-vessel downstream effects o boron precipitation

" For each input to the risk model, any differences between the methods to be used in the model and NRC-approved methods are defined (refer to Reference 3 for an example).

For each input to the risk model, an uncertainty quantification process is used to add detail (basic events, refer to Table 2) to the PRA model for the LOCA initiating sequences. Examples of appropriate sources of information include, but are not limited to:

o applicable risk assessments o results obtained from generic industry and/or plant-specific testing o expert elicitation o assumptions, realistic or conservative o qualitative insights based on engineering judgment

For each input to the risk model, interdependencies between the inputs to the model are considered and appropriately described in the risk model.

The risk is determined using a PRA that meets the necessary requirements identified in RG 1.200 (Reference 4), including the capability to model a full spectrum of LOCA events, and the capability for Level 1 and Level 2 risk assessments, including internal and external events.

Case 2: Evaluate the risk assuming no long term cooling failure contributors associated with GSI-191 concerns, and assuming no additional failures. Other than the basic events details associated with GSI-191 concerns, the Case 2 assessment model is identical to model used for Case 1.

Calculate the risk associated with GSI-191 concerns:

The risk associated with GSI-191 concerns is the difference in risk, CDF and LERF, between Case 1 and Case 2 for comparison with the acceptance guidelines in RG 1.174, Section 2.4.

Enclosure 1 NOC-AE-13002954 Page 6 of 6 Table 2: Modeling Basic Events, Failure Modes, and Top Events with Performance Thresholds Using the inputs noted below, applied within the framework described in Table 1, the PRA uses risk insights to address the risk associated with failure modes resulting from GSI-191 concerns.

Basic Events In the plant-specific PRA model, the demand recirculation failure probability is replaced with the following:

Pressure drop due to debris build-up on the sump strainers with chemical effects resulting in loss of net positive suction head (NPSH) margin for pumps

Strainer mechanical collapse

Air ingestion through the sump strainers

Core blockage with chemical effects

Boron precipitation in the core Failure Modes For input into the plant-specific PRA, accident sequences from a full spectrum of LOCAs are analyzed in a realistic time-dependent manner with uncertainty propagation to determine the probabilities of various failures potentially leading to core damage.

The failure modes shall be explicitly modeled in the PRA analysis, except for failure modes that were addressed with no issues of concern as part of previous deterministic evaluations for the plant.

Top Events and Performance Thresholds Failure probabilities and associated uncertainties determined in the supporting engineering analysis are passed to the plant-wide PRA, which determines the incremental risk associated with GSI-191 failure modes with three new top events added to accommodate composite GSI-191 failure processes. The engineering analysis supports the three new top events by testing the outcome of every postulated LOCA scenario against seven performance thresholds, discussed in detail in Enclosure 4, and summarized below.

New Top Events Performance Thresholds

1. Failure at sump strainers 1. Strainer DP > NPSH margin

2. Strainer DP > P-buckle

3. Strainer F-void > 0.02

2. Boron precipitation in the core 4. Core fiber load > cold leg break fiber limit for boron precipitation

5. Core fiber load > hot leg break fiber limit for boron precipitation

3. Core flow blockage 6. Core fiber load > cold leg break fiber limit for flow blockage

7. Core fiber load > hot leg break fiber limit for flow blockage

NOC-AE-1 3002954 ENCLOSURE 2 Request for Exemption for STP Piloted Risk-Informed Approach to Closure for GSI-191

Enclosure 2 NOC-AE-13002954 Page 1 of 11 Request for Exemption for STP Piloted Risk-Informed Approach to Closure for GSI-191 Purpose and Objective of the Exemption Request Pursuant to 10 CFR 50.12(a), STP Nuclear Operating Company (STPNOC) requests an exemption from certain requirements specified under § 50.46 and Appendix A to 10 CFR Part 50, "General Design Criteria." The exemption request is for implementation of a risk-informed approach to closure for Generic Safety Issue (GSI)-1 91, "Assessment of Debris Accumulation on Pressurized-Water Reactor Sump Performance," to support closure of Generic Letter (GL) 2004-02 for South Texas Project (STP) Units 1 and 2, and corresponding changes to the licensing basis subject to NRC approval. Under § 50.12, a licensee may request and the NRC may grant exemptions from the requirements of 10 CFR Part 50 which are authorized by law, will not present an undue risk to the public health and safety, are consistent with the common defense and security, and special circumstances are present. STP Units 1 and 2 are the lead plants for the proposed risk-informed approach to resolution of GSI-191.

STPNOC seeks exemption from criterion (b)(5), "Long-term cooling," as specified in

§ 50.46, "Acceptance criteria for emergency core cooling systems for light-water nuclear power reactors," specifically related to the performance of Emergency Core Cooling System (ECCS) and Containment Spray System (CSS) during the recirculation mode in containment following loss of coolant accidents (LOCAs). As stated in § 50.46(d), "The criteria set forth in paragraph (b), with cooling performance calculated in accordance with an acceptable evaluation model, are in implementation of the general requirements with respect to ECCS cooling performance design set forth in this part, including in particular Criterion 35 of appendix A." As such, STPNOC also seeks an exemption from part of Appendix A of 10 CFR Part 50, General Design Criterion (GDC) 35, as it relates to ECCS performance criterion (b)(5). STPNOC also seeks an exemption from part of other requirements, as specified in the "Regulatory Requirements to Which the Exemption Would Apply" section below.

The STP risk-informed approach, described in Enclosure 1 and in detail in Enclosure 4, uses the STP PRA to quantify the residual risk from those issues related to GSI-1 91 concerns which have not been resolved using other methods. The supporting engineering analysis, including evaluation of defense-in-depth and safety margin, is developed to conform to RG 1.174.

STPNOC requests NRC approval based upon the determination that the risk-informed method is acceptable, and that the calculated risk meets the acceptance guidelines of RG 1.174.

2. Background

GSI-191 concerns the possibility that debris generated during a LOCA could clog the containment sump strainers in pressurized-water reactors (PWRs) and result in loss of net positive suction head (NPSH) for the ECCS and CSS pumps, impeding the flow of

Enclosure 2 NOC-AE-1 3002954 Page 2 of 11 water from the sump. GL 2004-02 requested licensees to address GSI-1 91 issues, focused on demonstrating compliance with the ECCS acceptance criteria in § 50.46.

GL 2004-02 requested licensees to perform new, more realistic analyses using an NRC-approved methodology and to confirm the functionality of the ECCS and CSS during design basis accidents that require containment sump recirculation.

STP Units 1 and 2 have implemented compensatory and mitigative measures in response to Bulletin 2003-01 and GL 2004-02 to address the potential for sump strainer clogging and other concerns associated with GSI-191. Larger containment sump strainers have been installed that greatly reduce the potential for loss of net positive suction head (NPSH). Additional compensatory measures such as operating procedures and instrumentation to monitor core level and temperature, and actions taken by operators if core blockage is indicated, have been described.

In response to SECY-10-01 13, "Closure Options for Generic Safety Issue - 191, Assessment of Debris Accumulation on Pressurized Water Reactor Sump Performance,"

the Commission issued Staff Requirements Memorandum (SRM)-SECY-10-0113, "Closure Options for Generic Safety Issue (GSI) - 191, Assessment of Debris Accumulation on Pressurized Water Reactor (PWR) Sump Performance," directing the staff to consider alternative options for resolving GSI-1 91 that are innovative and creative, as well as risk-informed and safety conscious, while the industry completed testing in 2011. Subsequently, STPNOC, through interactions with the staff, developed a risk-informed approach for the resolution of GSI-1 91 using the methods described in Regulatory Guide (RG) 1.174. By Reference 6, STPNOC submitted to the NRC the preliminary results showing that the risks, Core Damage Frequency (CDF) and Large Early Release Frequency (LERF), associated with GSI-191 concerns are in Region III, "Very Small Changes," of RG 1.174 acceptance guidelines, and notified the NRC of the intent to seek exemption from certain requirements of § 50.46. SECY-12-0093, "Closure Options for Generic Safety Issue - 191, Assessment of Debris Accumulation on Pressurized-Water Reactor Sump Performance," described the staff plans to use STPNOC as a pilot for other licensees choosing to use this approach.

As stated in SECY-12-0093, the STP piloted risk-informed approach is a graded approach with actions and schedule based on the amount of installed fibrous insulation, and is consistent with the risk management goal of NUREG-2150, "A Proposed Risk Management Regulatory Framework" (Reference 9). The approach incorporates defense-in-depth measures to mitigate the residual risk of strainer or in-vessel issues that have not been resolved, as applicable, during the time required to provide closure for GSI-191.

Confirming the preliminary results, the results from the analysis provided in Enclosure 4 show that the risk associated with GSI-191 concerns is in Region III, "Very Small Changes," of RG 1.174. As such, no additional physical modifications to the South Texas Project (STP) Units 1 and 2 are proposed.

3. Regulatory Requirements to Which the Exemption Would Apply The exemption request is limited to compliance with certain regulatory requirements specific to addressing the concerns associated with GSI-191. This exemption request is

Enclosure 2 NOC-AE-1 3002954 Page 3 of 11 submitted as part of a risk-informed approach for using probabilistic risk assessment (PRA) to provide closure for GSI-1 91, developed to conform to RG 1.174 and the principles for risk-based applications, i.e., that it is consistent with the existing defense-in-depth framework, has no significant impact on safety margin, and can be implemented with appropriate monitoring capability.

STPNOC seeks exemption from part of certain regulatory requirements for the purpose of closure of GSI-191. STPNOC seeks approval of the request for exemption on the basis that the STP probabilistic risk assessment (PRA) results and supporting engineering analysis are acceptable and show that the residual risk associated with GSI-191 meets the acceptance guidelines of RG 1.174, consistent with the Commission's Safety Goals for public health and safety.

The request for exemption applies to the regulatory requirements listed below, which are discussed in GL 2004-02 and associated regulatory guidance. STPNOC seeks exemption to the extent that the applicable regulatory requirement requires additional calculation or other analysis or evaluation to demonstrate compliance, considering only the concerns raised by GSI-191 and specifically the potential effects on plant performance during the recirculation mode in containment following a LOCA, beyond those already provided as part of the current licensing basis. The proposed changes to the licensing basis, shown in Enclosure 3, provide closure to GSI-191 on the basis that the associated risk is shown to meet the RG 1.174 acceptance guidelines, and that in conjunction with the existing licensing basis, the small risk demonstrates adequate compliance with each of the regulatory requirements. The regulatory requirements listed are associated with the ECCS and CSS required functions in recirculation mode following the DBA LOCA that are potentially affected by postulated effects on containment sump performance due to GSI-191 concerns.

Since sump performance and in-vessel effects were not explicitly described in the regulatory requirements, there is no specific language from which to request exemption.

Specific exemption is requested from the applicable regulations as summarized below:

STP requests exemption from the requirement to use a bounding calculation or other deterministic method to model sump performance, considering the concerns discussed in GL 2004-02 and GSI-191, as a validation of the assumptions made in the licensing basis ECCS evaluation model. Rather, STP proposes a risk-informed approach to validate assumptions in the ECCS evaluation model.

3.1 Requirements that Concern ECCS and CSS Functions for Core Cooling and Containment Heat Removal and Atmosphere Cleanup The exemption request pertains to the following regulatory requirements concerning the ECCS containment sump and associated systems, e.g., the Emergency Core Cooling System (ECCS) and containment spray system (CSS), and GDC that require systems be provided to perform specific functions (i.e., emergency core cooling, containment heat removal, and containment atmosphere cleanup) following a postulated design basis accident (DBA).

Enclosure 2 NOC-AE-1 3002954 Page 4 of 11

a. § 50.46(b)(5), "Long-term cooling," states that after any calculated successful initial operation of the ECCS, the calculated core temperature shall be maintained at an acceptably low value and decay heat shall be removed for the extended period of time required by the long-lived radioactivity remaining in the core."

Impact on § 50.46(b)(5): The exemption request is specific to the requirement for demonstrating long-term core cooling capability as required by § 50.46(b)(5) as it pertains to the validation of assumptions made in the licensing basis analysis, and is not intended to be applicable to the other requirements provided in § 50.46 or Appendix K to Part 50. The exemption request applies to the requirement to use a deterministic method to model sump performance to validate assumptions made in the existing licensing basis.

b. GDC 35, "Emergency core cooling," states that a system to provide abundant emergency core cooling shall be provided. The system safety function shall be to transfer heat from the reactor core following any loss of reactor coolant at a rate such that (1) fuel and clad damage that could interfere with continued effective core cooling is prevented and (2) clad metal-water reaction is limited to negligible amounts. Suitable redundancy in components and features, and suitable interconnections, leak detection, isolation, and containment capabilities shall be provided to assure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available) the system safety function can be accomplished, assuming a single failure."

Impact on GDC 35: In conjunction with the existing licensing basis, justification for and approval of the exemption request provides reasonable assurance with high probability that the GDC is met. The exemption request applies to the requirement to use a deterministic method to model sump performance to validate assumptions made in the existing licensing basis

c. GDC 38, "Containmentheat removal," states that a system to remove heat from the reactor containment shall be provided. The system safety function shall be to reduce rapidly, consistent with the functioning of other associated systems, the containment pressure and temperature following any LOCA and maintain them at acceptably low levels. Suitable redundancy in components and features, and suitable interconnections, leak detection, isolation, and containment capabilities shall be provided to assure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available) the system safety function can be accomplished, assuming a single failure.

Impact on GDC 38: In conjunction with the existing licensing basis, justification for and approval of the exemption request provides reasonable assurance with high probability that the GDC is met. The exemption request applies to the requirement to use a deterministic method to model sump performance to validate assumptions made in the existing licensing basis.

Enclosure 2 NOC-AE-13002954 Page 5 of 11

d. GDC 41, "Containmentatmosphere cleanup," states that systems to control fission products, hydrogen, oxygen, and other substances which may be released into the reactor containment shall be provided as necessary to reduce, consistent with the functioning of other associated systems, the concentration and quality of fission products released to the environment following postulated accidents, and to control the concentration of hydrogen or oxygen and other substances in the containment atmosphere following postulated accidents to assure that containment integrity is maintained.

Impact on GDC 41: In conjunction with the existing licensing basis, justification for and approval of the exemption request provides reasonable assurance with high probability that the GDC is met. The exemption request applies to the requirement to use a deterministic method to model sump performance to validate assumptions made in the existing licensing basis.

3.2 Requirements that Concern Crediting CSS with Reducing Accident Source Term:

With respect to regulatory requirements and GDC that concern crediting a CSS with reducing the accident source term, the current licensing basis evaluations are described below:

a. § 50.67, "Accident source term," states the requirements for acceptable radiation dose for the design basis radiological consequence analyses.

Impact on § 50.67: In conjunction with the existing licensing basis, justification for and approval of the exemption request provides reasonable assurance with high probability that the requirements of § 50.67 are met. The exemption request applies to the requirement to use a deterministic method to model sump performance to validate assumptions made in the existing licensing basis.

b. GDC 19, "ControlRoom," states that a control room shall be provided from which actions can be taken to operate the nuclear power unit safely under normal conditions and to maintain it in safe condition under accident conditions, including LOCA. Adequate radiation protection shall be provided to permit access and occupancy of the control room under accident conditions without personnel receiving radiation exposures in excess of 5 rem whole body, or its equivalent to any part of the body, for the duration of the accident. Equipment in appropriate locations outside the control room shall be provided (1) with a design capability for prompt hot shutdown of the reactor, including necessary instrumentation and controls to maintain the unit in a safe condition during hot shutdown, and (2) with a potential capability for subsequent cold shutdown of the reactor through the use of suitable procedures.

c. Impact on GDC 19: In conjunction with the existing licensing basis, justification for and approval of the exemption request provides reasonable assurance with high probability that the GDC is met. The exemption request applies to the requirement to use a deterministic method to model sump performance to validate assumptions made in the existing licensing basis.

Enclosure 2 NOC-AE-13002954 Page 6 of 11 3.3 Evaluation of Impact on the Balance of § 50.46 and Appendix K to Part 50:

The exemption request to support closure for GSI-191 is intended to address ECCS acceptance criterion for long-term cooling as presented in § 50.46(b)(5) and is not applicable to the other acceptance criteria of § 50.46 (peak cladding temperature, maximum cladding oxidation, maximum hydrogen generation, and coolable geometry).

For the purposes of demonstrating the balance of the acceptance criteria of § 50.46(b),

the design and licensing basis descriptions of accidents requiring ECCS operation, including analysis methods, assumptions, and results, which are provided in South Texas Project Electric Generating Station (STPEGS) Updated Final Safety Analysis Report (UFSAR) Chapters 6 and 15 remain unchanged. The performance evaluations for accidents requiring ECCS operation described in UFSAR Chapters 6 and 15, based on the Appendix K Large-Break Loss-of-Coolant Accident (LBLOCA) analysis, demonstrate that for breaks up to and including the double-ended severance of a reactor coolant pipe, the ECCS will limit the clad temperature to below the limit specified in

§ 50.46 and assure that the core will remain in place and substantially intact with its essential heat transfer geometry preserved.

The reference to "acceptableevaluation mode!' in § 50.46(d) is discussed in

§ 50.46(a)(1) and defined in § 50.46(c)(2). The purpose of the risk-informed approach is to evaluate the ECCS sump performance to determine if the sumps are configured properly to provide enough flow to ensure criterion § 50.46(b)(5), "Long-term cooling," is met. This is discussed in GL 2004-02, and in SECY-04-0150 and the NRC safety evaluation report on NEI 04-07 which state:

"While not a component of the 10 CFR 50.46 ECCS evaluation model, the calculation of sump performance is necessary to determine if the sump and the residualheat removal system are configured properly to provide enough flow to ensure long-term cooling, which is an acceptance criterion of 10 CFR 50.46.

Therefore, the staff considers the modeling of sump performance as the validation of assumptionsmade in the ECCS evaluation model. Since the modeling of sump performance is a boundary calculation for the ECCS evaluation model, and acceptable sump performance is necessary for demonstrating long-term core cooling capability (10 CFR 50.46(b)(5)), the requirementsof 10 CFR 50.46 are applicable."

The STP risk-informed approach, as described in Enclosures 1 and 4, uses the PRA model to quantify the risk associated with GSI-1 91, thereby quantifying the residual risk from those issues which have not been resolved using other methods, and to show that it meets the acceptance guidelines defined in RG 1.174. By quantifying this risk, the approach validates assumptions in the STP Units 1 and 2 Appendix K Large-Break Loss-of-Coolant Accident analysis associated with the concerns raised by GSI-1 91.

Therefore, the exemption request is specific to the requirement for demonstrating long-term core cooling capability as required by § 50.46(b)(5) as it pertains to the validation of assumptions made in the ECCS evaluation model, and is not intended to be applicable to other requirements provided in § 50.46 or Appendix K to Part 50.

Enclosure 2 NOC-AE-1 3002954 Page 7 of 11

4. Technical Justification for the Exemption Regulatory Guide (RG) 1.174 provides technical guidance for licensees who request NRC approval for changes in the licensing basis using a risk-informed approach. This guidance establishes five principles that should be considered for risk-informed changes to the licensing basis. The requested exemption is part of a risk-informed approach that addresses the principles stated in RG 1.174, as described below.

a. Compliance with Current Regulations The proposed change in the licensing basis should meet current regulations,unless it is explicitly related to a requested exemption or rule change.

This exemption request implements this principle.

b. Defense-in-Depth The proposed change in the licensing basis should be consistent with the defense-in-depth philosophy.

The exemption request is consistent with the defense-in-depth philosophy in that the following aspects of the facility design and operation are unaffected:

Functional requirements and the design configuration of systems

Existing plant barriers to the release of fission products

Design provisions for redundancy, diversity, and independence

Plant's response to transients or other initiating events

Preventive and mitigative capabilities of plant design features The STP risk-informed approach analyzes a full spectrum of LOCAs, including double-ended guillotine breaks for all piping sizes up to and including the largest pipe in the reactor coolant system (RCS). By requiring that mitigative capability be maintained in a realistic and risk-informed evaluation of GSI-191 for a full spectrum of LOCAs, the approach ensures that defense-in-depth is maintained. Additional discussion on defense-in-depth is summarized in Enclosure 4.

c. Safety Margins The proposed change in the licensing basis should maintain sufficient safety margins.

The requested exemption does not involve a change in any functional requirements or the configuration of plant structures, systems and components (SSCs). Because of the very small risk associated with the change, STPNOC does not expect the need to change any of the safety analyses in the UFSAR. Therefore, sufficient safety margins associated with the design will be maintained by the exemption.

Enclosure 2 NOC-AE-13002954 Page 8 of 11

d. Changes in Risk When proposed changes result in an increase in CDF or risk, the increases should be small and consistent with the Commission's Safety Goal Policy Statement.

The proposed change is defined as the risk associated with GSI-191 concerns.

Using engineering analysis and the PRA this risk has been calculated and shown to be in Region III, "Very Small Changes," and is therefore consistent with the Commission's Safety Goal Policy Statement.

e. Monitoring the Impact of the Proposed Change The impact of the proposed change in the licensing basis should be monitored using performance measurement strategies.

The PRA analysis supporting the change is performed using STPNOC PRA procedures as required for PRA analyses and assessments. Code required inspection programs and other requirements provide monitoring capability.

Additional discussion on monitoring the proposed change is summarized in Enclosure 4.

Enclosure 4 provides a summary of the STP PRA, risk assessment methodology, and engineering analysis, including modeling of physical plant properties and treatment of uncertainties, and references to other supporting information. The results of the risk-informed approach demonstrate that the calculated risk associated with GS-1 91 concerns for STP Units 1 and 2 meets the acceptance guidelines defined by RG 1.174, and provides a basis for the exemption request:

Change in CDF is - 1.1E-8/yr

Change in LERF is - 8.6E-12/yr The STP approach models the physical characteristics of debris generation and transport over a full range of plausible conditions in order to provide inputs to the STP PRA. The PRA is used to calculate the risk (CDF and LERF) associated with GS1-191 for the as-built, as-operating plant, to quantify risk benefit associated with no additional changes to the facility required to address the residual risk associated with GSI-191.

Justification for the exemption, and for closure for GSI-1 91, is based on:

(1) NRC review and approval of the risk-informed approach, and (2) The calculated risk associated with GSI-191 meeting the acceptance guidelines in RG 1.174.

5. Justification for Exemption Pursuant to 10 CFR 50.12(a)(1)

The exemption is authorized by law.

Enclosure 2 NOC-AE-13002954 Page 9 of 11 The NRC has authority under the Atomic Energy Act of 1954, as amended, to grant exemptions from its regulations if doing so would not violate the requirements of law.

This exemption is authorized by law as is provided by 10 CFR 50.12 which provides the NRC authority to grant exemptions from Part 50 requirements with provision of proper justification. Approval of the exemption would not conflict with any provisions of the Atomic Energy Act of 1954, as amended, the Commission's regulations, or any other law The exemption does not present an undue risk to the public health and safety.

The underlying purpose of § 50.46 is to establish acceptance criteria for ECCS performance, and together with GDC 35, to provide a high confidence that the systems will perform the required functions. The underlying purpose of the other applicable regulatory requirements provided in GDC 38, GDC 41, § 50.46 and GDC 19 also provide a high confidence that the systems will perform the required functions. The proposed exemption does not involve any modifications to the plant that could introduce a new accident precursor or affect the probability of postulated accidents, and therefore the probability of postulated accidents is not increased. The PRA and engineering analysis demonstrate that the calculated risk is small and consistent with the intent of the Commission's Safety Goal Policy Statement, which defines an acceptable level of risk that is a small fraction of other risks to which the public is exposed.

The exemption is consistent with the common defense and security.

The exemption involves a change to the licensing basis for the plant that has no relation to the possession of licensed material or any security requirements that apply to STP Units 1 and 2. Therefore the exemption is consistent with the common defense and security.

6. Special Circumstances 10 CFR 50.12(a)(2) states that special circumstances are present whenever any of six listed circumstances exist. The following listed circumstances are applicable to this request.

a. § 50.10(a)(2)(ii) applies because for the use of the proposed risk-informed approach, application of the regulation would not serve the underlying purpose of the regulatory requirements or is not necessary to achieve the underlying purpose of the regulatory requirements. An objective of the regulatory framework is to maintain low risk to the public health and safety. The supporting analysis demonstrates that the associated risk is consistent with the Commission's Safety Goals for nuclear power plants. Consequently, the special circumstance described in § 50.12(a)(2)(ii) applies.

b. § 50.10(a)(2)(iii) applies because compliance with the applicable rules would result in undue hardship or other costs that are significantly in excess of those actions already taken to demonstrate compliance, but without a compensating increase in the level of quality and safety. Absent the exemption, the amount of debris generating contributors in the plant design would need to be reduced. The risk assessment shows that any such modifications to the plant would have a

Enclosure 2 NOC-AE-13002954 Page 10 of 11 very small change in plant risk. The cost and radiological exposure estimates for removal of insulation are significant, approaching tens of millions of dollars and hundreds of person-Rem per unit, depending on the scope of modifications. In comparison, the risk-informed approach is estimated to be a fraction of the cost of the deterministic resolution approach, with no personnel dose consequences based on no projected need for any further modifications needed for closure of GSI-191. Consequently, the special circumstance described in § 50.12(a)(2)(iii) applies.

7. Conclusion Issuance of an exemption to authorize the use of the risk-informed approach is consistent with the provisions of § 50.12(a)(1) and special circumstances required by

§ 50.12(a)(2) are present as discussed above.

The PRA assessment is used to quantify the risk associated with GSI-191 in order to determine the risk impact on the requirement that long-term cooling will be maintained for § 50.46(b)(5). Based on the determination that the risk meets the acceptance guidelines of RG 1.174, the results demonstrate with reasonable assurance that this requirement and other regulatory requirements that rely on ECCS and CSS functions in the recirculation mode are met.

8. Implementation To support the completion of work and resolution schedule for closure of GSI-1 91 as described in SECY-12-0093, STPNOC requests that the exemption request be approved for implementation by December 2014.

9. References

1) Generic Safety Issue (GSI)-1 91, "Assessment of Debris Accumulation on Pressurized-Water Reactor Sump Performance"

2) Generic Letter (GL) 2004-02, "Potential Impact of Debris Blockage on Emergency Recirculation During Design Basis Accidents at Pressurized-Water Reactors," dated September 13, 2004 (ML042360586)

3) Bulletin 2003-01, "Potential Impact of Debris Blockage on Emergency Sump Recirculation at Pressurized-Water Reactors," dated June 9, 2003 (ML031600259)

4) SECY-1 0-0113, "Closure Options for Generic Safety Issue - 191, Assessment of Debris Accumulation on Pressurized Water Reactor Sump Performance," dated August 26, 2010 (ML101820212).

5) Staff Requirements Memorandum (SRM)-SECY-1 0-0113, "Closure Options for Generic Safety Issue [GSI] - 191, Assessment of Debris Accumulation on Pressurized Water Reactor [PWR] Sump Performance," dated December 23, 2010 (ML103570354)

Enclosure 2 NOC-AE-1 3002954 Page 11 of 11

6) Letter, J. W. Crenshaw, STPNOC, to NRC Document Control Desk, "Status of the South Texas Project Risk-Informed (RI) Approach to Resolve Generic Safety Issue (GSI)-191," NOC-AE-11002775, dated December 14, 2011 (MLl 1354A386)

7) Regulatory Guide (RG) 1.174, Revision 2, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis" (ML100910006)

8) Commission SECY Paper, "Closure Options for Generic Safety Issue - 191, Assessment of Debris Accumulation on Pressurized-Water Reactor Sump Performance," SECY-12-0093, dated July 9, 2012 (ML121320270)

9) NUREG-2150, "A Proposed Risk Management Regulatory Framework" (Appendix H, Alternative 1), dated April 2012 (ML12109A277)

10) Letter, T. J. Jordan to Document Control Desk, "Response to a Request for Additional Information Regarding the 60 Day Response to Bulletin 2003-01:

"Potential Impact of Debris Blockage on Emergency Sump Recirculation at Pressurized-Water Reactors (TAC Nos. MB9615 and MB9616)," NOC-AE-05001883, dated July 13, 2005 (ML052000279)

11) SECY-04-0150, "Alternate Approaches for Resolving the Pressurized Water Reactor Sump Blockage Issue (GSI-191), Including Realistic and Risk-Informed Considerations," dated August 16, 2004

12) GSI-191 Safety Evaluation Report, Rev. 0, "Evaluation of NEI Guidance on PWR Sump Performance," dated December 6, 2004 (ML043280007)

13) Staff Requirements Memorandum (SRM)-SECY-1 0-0113, "Closure Options for Generic Safety Issue (GSI) - 191, Assessment of Debris Accumulation on Pressurized Water Reactor [PWR] Sump Performance," dated December 23, 2010 (ML103570354)

14) 51 FR 30028, "Safety Goals for the Operations of Nuclear Power Plants; Policy Statement," FederalRegister,Volume 51, p. 30028, August 4, 1986

NOC-AE-13002954 ENCLOSURE 3 Changes to the South Texas Project Units 1 and 2 Licensing Basis (Information Only)

Enclosure 3 NOC-AE-13002954 Page 1 of 7 Changes to the South Texas Project Units 1 and 2 Licensing Basis (Information Only)

The changes to the STP Updated Final Safety Analysis Report (UFSAR) shown below are provided for information purposes to support NRC review and approval of the risk-informed approach and exemption request. Changes to the UFSAR will be implemented pursuant to NRC approval of the risk-informed approach and the exemption request.

The changes are based on the exemption request (Enclosure 2) submitted in accordance with the provisions of § 50.12 for purposes of resolving Generic Safety Issue (GSI)-1 91, "Assessment of Debris Accumulation on Pressurized-Water Reactor Sump Performance."

The design and licensing basis descriptions of accidents requiring ECCS operation, including analysis methods, assumptions, and results provided in UFSAR Chapters 6 and 15 remain unchanged. The performance evaluations for accidents requiring ECCS operation described in Chapters 6 and 15, based on the South Texas Project Units 1 and 2 Appendix K Large-Break Loss-of-Coolant Accident (LBLOCA) analysis, demonstrate that for breaks up to and including the double-ended severance of a reactor coolant pipe, the ECCS will limit the clad temperature to below the limit specified in § 50.46, and assure that the core will remain in place and substantially intact with its essential heat transfer geometry preserved.

Changes to the UFSAR are shown below in gray highlight.

TABLE 3.12-1 REGULATORY GUIDE MATRIX ABBREVIATIONS:

A Conform to guide No. Regulatory Guide Title UFSAR Reference Revision Status STPEGS Position On STPEGS 1.82 Sumps for Emergency Core 6.2.2.1.2 Proposed Rev 1 A Cooling and Containment 6.2.2.2.3 (5/83)

Spray Systems 6.3.4.1 NOTES

Enclosure 3 NOC-AE-1 3002954 Page 2 of 7 6.2.2.1.2 Containment Emergency Sump Design Bases:

The Containment emergency sump meets the following design bases:

1. Sufficient capacity and redundancy to satisfy the single-failure criteria. To achieve this, each CSS/ECCS train draws water from a separate Containment emergency sump.

2. Capable of satisfying the flow and net positive suction head (NPSH) requirements of the ECCS and the CSS under the most adverse combination of credible occurrences. This includes minimizing the possibility of vortexing in the sump.

3. Minimizes entry of high-density particles (specific gravity of 1.05 or more) or floating debris into the sump and recirculating lines.

4. Sumps are designed in accordance with RG 1 roposedrevision1,My 1983 and with Generic Letter 2004-02 as described in A 6.2.2.2.3 Containment Emergency Sump

Description:

At the beginning of the recirculation phase, the minimum water level above the Containment floor is adequate to provide the required NPSH for the ECCS and CSS pumps. The sumps are designed to RG 1.82, proposed revision 1, May 1983 and to the requirements of Generic Letter 2004-02 as described in . The sump structures are designed to limit approach flow velocities to less than 0.009 ft/sec permitting high-density particles to settle out on the floor and minimize the possibility of clogging the strainers. The sump structures are designed to withstand the maximum expected differential pressure imposed by the accumulation of debris.

6.2.2.3.5 Pump Net Positive Suction Head Requirements:

The minimum available net positive suction head (NPSH) for the CSS pumps is such that an adequate margin is maintained between the required and the available NPSH for both the injection and recirculation phase, ensuring the proper operation of the CSS a u ARecirculation operation gives the limiting NPSH requirements for the CSS pumps The Westinghouse CSS pump design provides for the NPSH requirement to be met by the inherent design of the pump. CSS pumps are vertical motor-driven pumps, each sitting in an individual barrel. The design calls for a distance of 15 ft in this barrel between the suction nozzle centerline and the pump first-stage impeller. The 15-ft liquid-head in the pump barrel is thus expected to inherently satisfy the 15-ft NPSH requirement.

The analysis of available NPSH to the CSS pumps concerns itself with the NPSH at the pump suction nozzle, located at the top of the barrel. Since the pump barrels provide the required

Enclosure 3 NOC-AE-1 3002954 Page 3 of 7 NPSH at the first-stage impeller, the piping layout need provide only sufficient NPSH at the pump suction nozzle to prevent flashing in the barrel.

Two modes of operation have been analyzed for the CSS pumps:

1. Pump taking suction from the RWST and delivering spray to the Containment

2. Pump taking suction from the Containment sump and delivering spray to the Containment Case 2 represents the "worst case" since it gives the minimum available NPSH.

The assumptions and conservatisms used in the analysis are listed below. No exceptions are taken to RG 1.1.

1. Containment pressure equals the vapor pressure of the sump water.

2. The runout flows of each pump are used to account for maximum friction loses.

The minimum flood level in Containment is determined by considering the quantities of water trapped by the refueling cavity.

The results of the analysis show the available NPSH at the first-stage impeller of the CSS pumps to be reater than the required NPSH and show that the fluid at the suction flange is pumpperfrmace i therecrcultionmod There is sufficient NPSH at the suction nozzle to prevent flashing in the barrel, and the analysis meets the guideline of RG 1.1. The NPSH parameters are listed in Table 6.2.2-4.

NPSH for the ECCS pumps is addressed in Section 6.3.

TABLE 6.2.2-4 CSS PUMP NPSH PARAMETERS Required NPSH at Max Flow Rate, ft (max) 16.4 Available NPSH, ft (from RWST) 56.1 (From RCB Emergency Sump) >17.6 (

Enclosure 3 NOC-AE-13002954 Page 4 of 7 6.3.2.2 EauiDment and Comronent Descriptions.

Net Positive Suction Head Available and required net positive suction head (NPSH) for ECCS pumps are shown in Table 6.3-1. The safety intent of Regulatory Guide (RG) 1.1 is met by the design of the ECCS such that adequate NPSH is provided to system pumps.

The NPSH available for the injection mode is determined from the elevation head and the vapor pressure (atmospheric) of the water in the RWST, and the pressure drop in the suction piping from the tanks to the pumps. The NPSH evaluation is based on all pumps operating at maximum flow rate with no credit taken for the elevation head in the tank and full penalty assumed for head loss in the suction lines.

In addition to considering the static head and suction line pressure drop, the calculation of available NPSH in the recirculation mode assumes that the vapor pressure of the liquid in the sump is equal to the Containment ambient pressure. This assures that the actual available NPSH is always greater than the calculated NPSH.

TABLE 6.3-1 EMERGENCY CORE COOLING SYSTEM COMPONENT PARAMETERS High Head Safety Injection Pumps Required NPSH at max. flow rate, ft (max) 16.1 Available NPSH, ft (From RWST) 55.8 (From RCB Emergency Sump) > 17.8(

Low Head Safety Injection Pumps Required NPSH, ft (max) 16.5 Available NPSH, ft (From RWST) 55.1 (From RCB Emergency Sump) > 18.0o

Enclosure 3 NOC-AE-13002954 Page 5 of 7 The UFSAR change for Appendix 6A shown below consists entirely of new content, therefore gray highlight is not used.

RISK-INFORMED APPROACH TO POTENTIAL IMPACT OF DEBRIS BLOCKAGE ON EMERGENCY RECIRCULATION DURING DESIGN BASIS ACCIDENTS INTRODUCTION AND

SUMMARY

NRC Generic Letter 2004-02 (GL 2004-02) "Potential Impact of Debris Blockage on Emergency Recirculation During Design Basis Accidents at Pressurized-Water Reactors," required licensees to perform an evaluation of the ECCS and CSS recirculation functions, and the flowpaths necessary to support those functions, based on the potential susceptibility of sump screens to debris blockage during design basis accidents requiring recirculation operation of ECCS or CSS. This Generic Letter resulted from the Generic Safety Issue (GSI) 191, "Assessment of Debris Accumulation on Pressurized-Water Reactor Sump Performance." As a result of the evaluation required by GL 2004-02 and to ensure system function, sump design modifications were implemented (refer to Section 6.2.2.2.3).

GL 2004-02 sump performance evaluation activities, documented in References 6A-1 and 6A-2, included the following:

Containment walkdowns

Debris generation and transport analysis

Calculation of required and available net positive suction head (NPSH)

Screen requirements

Screen structural analyses

° Potential or planned design/operational/procedural modifications

Downstream effects

Upstream effects

Chemical effects The plant hardware modifications and plant administrative procedures and processes implemented in response to issues identified in GL 2004-02 provide high confidence that the sump design supports long-term core cooling following a design basis loss of coolant accident.

The sump design meets the regulatory requirements listed in GL 2004-02 except as authorized by exemption based on an evaluation, documented in Reference 6A-3, that the risk associated with the current as-built, as-operated plant meets the acceptance guidelines in Regulatory Guide 1.174 (Reference 6A-4).

DISCUSSION The plant licensing basis considers long-term core cooling following a LOCA as identified in 10 CFR 50.46. Long-term cooling is supported by the ECCS which includes the Containment Spray (CS), the High Head Safety Injection (HHSI), the Low Head Safety Injection (LHSI), and the Residual Heat Removal (RHR) systems. The licensing basis requires these particular

Enclosure 3 NOC-AE-13002954 Page 6 of 7 systems to operate with high probability following a LOCA. Using a risk-informed approach to address the concerns of GSI-1 91, the probability and uncertainty associated with the operation of the ECCS to maintain long-term cooling following a LOCA has been quantified. The results show that long-term cooling is ensured with high probability since the risk associated with GSI-191 concerns meets the acceptance guidelines for "Very Small Changes" in Region III as defined in Regulatory Guide 1.174.

The method of analysis uses an integrative approach to explicitly provide the probabilities for a few post-LOCA basic events of the STP plant-specific PRA. This has been done by modeling the underlying physical phenomena of the basic events and by propagating uncertainties in the physical models.

In particular, the demand recirculation failure probability is replaced with the following basic events:

Pressure drop due to build up of debris on the sump strainers with chemical effects resulting in loss of NPSH margin for the ECCS pumps

Strainer mechanical collapse

Air ingestion through the sump strainers

Core blockage with chemical effects

Boron precipitation in the core The accident sequences were analyzed in a realistic time-dependent manner with uncertainty propagation to determine the probabilities of various failures potentially leading to core damage from a spectrum of location-specific pipe breaks for input into STP's plant-specific probabilistic risk assessment (PRA). The specific failure modes that were considered are:

1. Strainer head loss exceeds the NPSH margin for the pumps causing some or all of the ECCS and CSS pumps to fail.

2. Strainer head loss exceeds the strainer structural margin causing the strainer to fail, which could subsequently result in larger quantities and larger sizes of debris being ingested into the ECCS and CSS.

3. Air intrusion exceeds the limits of the ECCS and CSS pumps causing degraded pump performance or complete failure due to gas binding.

4. Debris penetration exceeds ex-vessel effects limits causing a variety of potential equipment and component failures due to wear or clogging.

5. Debris penetration exceeds in-vessel effects limits resulting in partial or full core blockage with insufficient flow to cool the core.

6. Buildup of oxides, crud, LOCA-generated debris, and chemical precipitates on fuel cladding exceeds the limits for heat transfer resulting in unacceptably high peak cladding temperatures.

7. Boron concentration in the core exceeds the solubility limit leading to boron precipitation and subsequently resulting in unacceptable flow blockage or impaired heat removal.

Failure Modes 4 and 6 were conservatively addressed as part of the previous deterministic evaluations for STP with no issues of concern and were therefore not explicitly modeled in the PRA analysis. The remaining failure modes were explicitly modeled.

Enclosure 3 NOC-AE-13002954 Page 7 of 7 Failure probabilities and associated uncertainties determined in the supporting engineering analysis are passed to the plant-wide PRA, which determines the incremental risk associated with GS1-191 failure modes. Three new top events were added to the PRA assessment model to accommodate composite GSI-191 failure processes:

1. Failure at the sump strainer

2. Boron precipitation in the core

3. Blockage of the core The engineering analysis supports the three composite failure probabilities needed for the PRA by testing the outcome of every postulated break scenario against seven performance thresholds:

1. Strainer DP > NPSH margin

2. Strainer DP > P-buckle

3. Strainer F-void > 0.02

4. Core fiber load > cold leg break fiber limit for boron precipitation

5. Core fiber load > hot leg break fiber limit for boron precipitation

6. Core fiber load a cold leg break fiber limit for flow blockage

7. Core fiber load > hot leg break fiber limit for flow blockage Using the inputs noted above, the PRA assessment model is informed with risk insights for the failure modes associated with GSI-191 concerns. The PRA analysis yields results that meet the acceptance guidelines for Region III, "Very Small Changes," as defined by RG 1.174, i.e., the change in CDF is less than 1 E-6/yr and the change in LERF is less than 1 E-7/yr.

REFERENCES Appendix 6A:

6A-1 Correspondence NOC-AE-05001922, dated August 31, 2005 6A-2 Correspondence NOC-AE-08002372, dated December 11, 2008 6A-3 Correspondence NOC-AE-13002954, dated January 31, 2013 6A-4 Regulatory Guide 1.174, "An Approach For Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis" (May 2011)

NOC-AE-13002954 ENCLOSURE 4 Risk-Informed Closure of GSI-191 Volume 1.0 Project Summary

Enclosure 4 NOC-AE-1 3002954 RISK-INFORMED CLOSURE OF GSI-191 VOLUME 1.0 PROJECT

SUMMARY

January 31, 2013 aP) as"l DOCUMENT: STP-RIGSI191-VO1 REVISION: 0 PREPARED BY:

Ernie Kee, Supervisor Risk Projects, STPNOC Risk Management REVIEWED BY:

Zahra Mohaghegh, Ph.D, Soteria Consultants, LLC Seyed Reihani, Ph.D., Soteria Consultants, LLC Reza Kazemi, Ph.D., Soteria Consultants, LLC Ali Mosleh, Ph.D., Soteria Consultants, LLC Don Wakefield, ABS Consulting Bruce C. Letellier, Ph.D., Los Alamos National Laboratory Tim Sande, ENERCON Janet Leavitt, Ph.D., University of New Mexico Coley Chappell, STPNOC Licensing Wes Schulz, STPNOC Design Engineering C. Rick Grantom, PE, STPNOC Risk Projects Steve Blossom, STPNOC Project Management

Enclosure 4 NOC-AE-1 3002954 Contents List of Tables ii List of Figures iii Acknowledgements v Executive Summary vi 1 Proposed Change 1 1.1 Method of Analysis 3 2 Engineering Analysis 3 2.1 Defense-in-Depth and Safety Margin ... 5 2.1.1 D ID . . . . . . . . . . . . . . . . . 5 2.1.2 Safety margin ................ 7 2.2 Risk Impact ...................... 8 2.3 PRA Adequacy ................... 9 2.3.1 Scope of the PRA ............ 10 2.3.2 Level of detail ............... 10 2.3.3 Technical adequacy ........... 10 2.3.4 Plant representation .......... 11 2.4 Acceptance Guidelines .............. 16 2.5 Comparison with Guidelines .......... 18 2.5.1 Types of uncertainties and methods of analysis 19 2.5.2 Parameter uncertainty ......... 21 2.5.3 Model uncertainty ......... 21 2.5.4 Completeness uncertainty 22 2.5.5 Comparisons with acceptance guidel ines . . . 23 2.6 Decision making ................... 24 3 Implementation and Monitoring 24 4 Proposed Change 25 5 Quality Assurance 25 6 Documentation 25 6.1 Introduction ......... ................................ 25 6.2 Archival Documentation ............................... 25 6.3 Submittal Documentation ....... ........................ 26 7 Independent Technical Oversight 28

Enclosure 4 NOC-AE-1 3002954 8 Acronyms 30 9 References 34 Appendices 42 A Appendix A. Reg. Guide 1.174 Checklist Al B Appendix B. NEI 04-07 Comparison B1 C Appendix C. Defense-in-Depth and Safety Margin C1 List of Tables 1 Mean LBLOCA conditional failure probabilities for five plant operating states. Failure probabilities shown are for strainer blockage, core fiber load exceeding flow blockage criteria, and sump differential pressure exceeding Ppbi,,kle. Each Case refers to a plant operating state........ 13 2 Distribution of total conditional failure for LLOCA under Case 43 (one train operating) ......... .............................. 15 3 All cold leg split fractions conditioned on LOCA categories small, medium, and large for Case 43. The fraction going to the hot leg is simply the complement of the cold leg fraction .................. 16 4 Sample attributes of break cases leading to failure for Case 43. In the table: Pipe is a text string defined in the inservice inspection program program; System refers to STP System (all are RCS); Break Size is the size of the break in inches; LOCA size values of 1,2,3 denote small, medium, large LOCA events (all are large); DEGB, YES denotes the fully severed pipe condition (failures dominated by DEGB); RCS Leg denotes break location (CLB or HLB); and Break Location denotes region in the containment building related to debris transport fractions. 17 5 Checklist for Regulatory Guide 1.174 ...... .................. Al 6 Comparison of NEI 04-07 recommended engineering models with the models implemented in the STPNOC Pilot Project .... .......... BI 7 Historical STP responses related to concerns raised in GSI-191 included actions taken, site-specific design features, procedures, and programs that provide defense-in-depth measures (preventive, mitigative, and protective) and safety margin. References to letters, procedures and other guidance documents are also provided ................... C3

Enclosure 4 NOC-AE-13002954 List of Figures 1 Reproduction of "Figure 1, Relationship of Regulatory Guide 1.174 to other risk-informed guidance" [38, Figure 1, Page 6] showing the elements used in the Option 2b analysis .................................... viii 2 Illustration of the engineering model input to the PRA used in the Option 2b GSI-191 resolution ......... ............................ ix 3 Conceptual illustration of the uncertainty quantification process used to add detail (basic events) to the STPNOC PRA analysis in the LOCA initiating event sequences for the Option 2b analysis ....................... x 4 Illustration of the major elements of the STPNOC quality assurance process for risk-informed closure of GSI-191 .................... xii 5 Linear-linear interpolation of bounded Johnson extrema (solid) with nonuniform stratified random break-size profiles (dashed) ........... 13 6 Empirical distribution of total failure probability for Case 43 (one train operating) based on five discrete samples of the NUREG 1829 break-frequency uncertainty envelope. Weighted mean = 4.45 x 10-03 marked as bold dot.......... ................................. 15 7 Reproduction of Figure 4 from Regulatory Guide 1.174, "Acceptance guidelines for core damage frequency", the ACDF, CDF phase plane. 18 8 Reproduction of Figure 5 from Regulatory Guide 1.174, "Acceptance guidelines for large-early-release frequency", the ALERF, LERF phase plane ......... ................................. 18 iii

Enclosure 4 NOC-AE-1 3002954 Abstract The PRA analyses that provide the technical background in a project to close Generic Safety Issue 191 at the South Texas Project using a risk-informed ap-proach are summarized. The overall methodology used in the PRA analyses is summarized. The elements of Regulatory Guide 1.174 required for a Risk-Infor-med license submittal are documented. Qualitative and quantitative results of the PRA analyses are presented. The results of the Project Technical Oversight activities are summarized.

iv

Enclosure 4 NOC-AE-1 3002954 Acknowledgements The Risk-Informed GSI-191 Closure Pilot Program is an effort piloted by the STP Nuclear Operating Company and jointly funded with several other licensees. It is a collaborative work of teams of experts from industry, academia, and a national laboratory. In general, all products are developed jointly and reviewed in regularly scheduled (monthly) Technical Team Meetings and weekly teleconferences as well as in specific review cycles by Independent Oversight (technical evaluation of all materials), STP Nuclear Operating Company project management, and STP Nuclear Operating Company quality management. The business entities, the main areas of investigation, and the principal investigators of the Pilot Program are summarized below.

STP Nuclear Operating Company Project Management, Licensing, Quality Assurance Steve Blossom; Rick Grantom; Ernie Kee; Jamie Paul; Wes Schulz Alion Science and Technology GSI-191 Analysis & Methodology Implementation (GAMI)

Tim Sande (Enercon); Gil Zigler (Enercon); Austin Glover, Clint Shaffer, Joe Tezak (Enercon)

The University of New Mexico Corrosion/HeadLoss Experiments (CHLE)

Kerry Howe, PhD; Janet Leavitt, PhD Los Alamos National Laboratory Containment Accident Stochastic Analysis (CASA) Grande Bruce Letellier, PhD; Gowri Srinivassan, PhD Soteria Consultants, LLC Independent Oversight Zahra Mohagheghl, PhD; Seyed Reihani 2, PhD Texas A&M University Thermal Hydraulics (TH)

Yassin Hassan, PhD; Rodolfo Vaghetto; Saya Lee The University of Texas at Austin Uncertainty Quantification (UQ), Jet Formation Elmira Popova, PhD (1962-2012); David Morton, PhD; Alex Galenko, PhD; Jeremy Tejada, PhD; Erich Schneider, PhD ABS Consulting ProbabilisticRisk Assessment (PRA)

David Johnson, ScD; Don Wakefield KNF Consulting Services, LLC Location-Specific Failure Damage Mechanism (DM)

Karl Fleming; Bengt Lydell (ScandPower) 1 From January 2013, Assistant Professor in Nuclear Engineering Department at the University of Illinois 2

at Urbana Champaign From January 2013, Research Scientist in Nuclear Engineering Department at the University of Illinois at Urbana Champaign v

Enclosure 4 NOC-AE-13002954 Executive Summary The main objective of the STPNOC Risk-Informed GSI-191 Closure Pilot Project [10, 39]

is, "Through a risk-informed approach, establish a technical basis that would demonstrate that the STP as-built, as-operated plant design is sufficient to gain NRC approval to close the issues raised in GSI-191 by the end of 2013." In 2012, the STP approach has been referred to as Option 2b in the industry.

The results presented in this summary are the joint work of STPNOC Risk Management, Los Alamos National Laboratory, The University of Texas at Austin, Texas A&M University, Alion Science and Technology, ABS Consulting, The University of New Mexico, Soteria Consulting, and KNF Consulting, LLC. STPNOC has also collaborated with the PWROG and NEI in development of the Pilot Project.

In the risk-informed approach, STPNOC will seek NRC approval for closure of GSI-191 since the associated risk in STP's containment buildings is very small. STP is committed to investigating plant modifications including insulation removal and other measures (such as selective insulation reinforcement or debris transport mitigation) to preserve sufficient margins for nuclear safety if the risk analysis indicates risk is more than very small.

The project is based on a two-phase approach that addresses all the concerns related to GSI-191. For the initial phase, in 2011, a quantification was performed to understand if a risk-informed approach would be feasible [5]. Since it was shown to be feasible, the project proceeded to a licensing action in 2012 and 2013.

In both the initial risk analysis in 2011 and the 2012 final quantification, the risk was analyzed to be very small. That is, the change in risk was shown to be less than 1x 10-6 in core damage frequency and less than lx 10-7 for large-early release frequency. Although previous realistic testing [7] had shown that chemicals were unlikely to affect the head loss in STP debris beds (sump strainers and fuel assemblies), conservative head loss estimates due to the presence of chemical products were assumed for the initial phase. In 2012, ex-perimental data, specific to the STP units, continued to demonstrate chemical effects are not likely to cause large increases in head loss in STP prototypical post-LOCA environ-ments. Nevertheless, conservative estimates of chemical effects were included in the 2012 quantification.

The methodologies and results from the first phase were presented in the following doc-uments: analysis of results from the physical process solver, uncertainty quantification and RELAP5 thermal-hydraulic analyses [24]; LOCA Frequency analysis [13]; Uncertainty quan-tification methodologies and illustrative examples [41]; Jet formation research [47]; and Chemical effects research and experimental design [46].

For the second phase, the results of the 2012 quantification are documented in this report (Project Summary) and the references cited. This information is provided as the technical basis for the NRC review of the Pilot Project.

vi

Enclosure 4 NOC-AE-1 3002954 Introduction & Background The purpose of this document is to summarize the PRA 3 quantification supporting the STPNOC 4 license submittal to resolve concerns raised in GSI-191 5 "Assessment of Debris Accumulation on PWR6 Sump Performance" at the STP 7 plants. GSI-191 describes the NRC concerns with potential blockage of the ECCS8 . Over several years of study, the scope of concern has come to include the possibility of effects in the RCS 9 including core blockage from debris and in 2012, linkage to boric acid precipitation in the core. All GSI-191 concerns are related to the LOCA 10 in high energy (Class 1) piping that would result in the release of fibrous material and other potential debris to the ECCS Emergency Sump.

The purpose of the PRA quantification is to understand the risk and uncertainty in the as-built, as-operated plant associated with having fibrous insulation and latent debris in the STP containment buildings. In particular, the PRA quantification forms the basis for what has come to be referred to as Option 2b, "Mitigative Measures and Alternative Methods Approach", identified as a GSI-191 closure path by the NRC Staff in 2012 [39]. The basic elements of the Option 2b submittal are shown in Figure 1, reproduced from RG1.174" [38].

The PRA licensing elements addressed in the analysis are highlighted in Figure 1.

STPNOC operates two identical four-loop Westinghouse-designed NSSSs. Each NSSS12 operated by STPNOC is licensed for 3853 MWth. The NSSS is contained in, and protected by, a large dry containment building with approximately 3,410,000 ft 3 of free volume. The primary elements of the ECCS are the HHSI13, LHSI14 , CS15, and RCFC16 . The three trains mentioned in the descriptions for the HHSI, LHSI, CS, and RCFC systems are completely independent and piped into a single RCS loop. In addition, the HHSI and LHSI can be independently directed to their respective hot leg at their full (run out) flow rate.

Early in 2011, STPNOC began a project to develop risk-informed closure strategies that would meet the intent of the NRC Commission memorandum promulgated by Vietti-Cook in late 2010, while preparing a site-specific licensing submittal. Several public meetings were conducted to inform the NRC staff of the modeling approach and to solicit feedback on the applicability and use of the approach for resolving GSI-191. These meetings included supporting material so that members of the public, and especially other plants, could be informed as well: [45], [66], [51, 49, 50, 52, 53, 54, 55, 57, 58, 59, 60, 61, 62, 63, 9, 56].

In the meetings referred to above, STPNOC described the additional physical models and necessary experimental studies required to support enhancement of the PRA to include 3

Probabilistic Risk Assessment 4

The STP Nuclear Operating Company 5

Generic Safety Issue 191 6

7 Pressurized Water Reactor.

South Texas Project electric generating station

'Emergency Core Cooling System 9

Reactor Coolant System

"°Loss of Coolant Accident "Regulatory Guide 1.174 12 Nuclear Steam Supply System 13High Head Safety Injection 14Low Head Safety Injection "Containment Spray System "The Reactor Containment Fan Coolers vii

Enclosure 4 NOC-AE-1 3002954 u~vie S06 SO.Btc) IOCFR art52 I e fotmedI to Fire Protection, National Ucenses ApplicationCategozaton Fire Protection Certifications, And t Assttion Standard [ jApovals for Nuclear Power Plants II ofSSCt NFPA80S ReugtoulegatoryRguatr Guidel30 Guide kSup ortlin g ud .1 I ud1.0 ud .SGue120 Generic Spotn *0 Guidance INational PRIAConrensusI Standards and Industry Reaed Guidance Figure 1: Reproduction of "Figure 1, Relationship of Regulatory Guide 1.174 to other risk-informed guidance" [38, Figure 1, Page 6] showing the elements used in the Option 2b analysis.

the phenomena associated with concerns raised in GSI-191. The overall approach that was adopted caused minimal impact to the PRA Model of Record [44].

The method of analysis uses an integrative approach to explicitly provide failure probabil-ities for a few post-LOCA basic events of the STPNOC plant-specific PRA (that is, Module 1 of Figure 2). These basic event probabilities are estimated in a separate module (that is, Module 2 of Figure 2) by modeling the underlying physical phenomena of the basic events and by propagating the uncertainties in the physical models. The analysis framework shown in Module 2 is called CASA Grande17 and is explained in detail in Volume 3. The added basic event probabilities are shown as the dotted lines going from Module 2 to Module 1 in Figure 2. A conceptual outline of the uncertainty quantification process used in Module 2 of Figure 2 is illustrated in Figure 3. More details regarding the uncertainty quantification are available in Volume 3.

The added basic events which are related to the recirculation phase of LOCA and shown as the dotted lines coming from the engineering models in Figure 2 are solved outside the PRA in an uncertainty quantification framework. An illustration showing the typical process of uncertainty quantification is shown in Figure 3. As shown, the process models distributions developed in different contexts such as, data measurement analysis and expert judgment.

One challenge that could make sampling and uncertainty propagation difficult would be the potential for fitting and estimating multivariate distributions. In the STPNOC risk-informed methodology, multivariate distributions have been avoided by assuming independence be-tween parameters, where possible, and by enforcing explicit conditional dependencies, where "7 Containment Accident Stochastic Analysis (CASA) and Grande referring to the STPNOC large, dry containment viii

Enclosure 4 NOC-AE-1 3002954 MODULE 1 STPNOC PRA with added features to capture details of concerns associated with GSI-191 Sump failure with added possibility to violate NPSHR and mechanical collapse Basic events to add ECCS pump failure due to air ingestion Figure 2: Illustration of the engineering model input to the PRA used in the Option 2b GSI-191 resolution.

appropriate.

In some cases, the distributions needed for the PRA involve relatively broad distributions which need to be carefully sampled so that the "tails" are properly accounted for. In general, NLHS 1 8 strategies have been developed to properly represent distributions with long tails, especially in LOCA frequencies.

A quality assurance plan was developed to include standard STPNOC practice for PRA assessments. Over the nearly two-year project duration, (nominally weekly) technical review teleconferences were conducted and supplemented at critical product development steps with on-site reviews. In addition, monthly face-to-face Technical Team meetings were held in 2012.

In general, the STP PRA analyst (STP Technical Team Lead) is responsible for review and verification of the PRA inputs developed. The STP PRA analyst review is further sup-l"Nonuniform Latin Hypercube Sampling ix

Enclosure 4 NOC-AE-1 3002954 Uncertainty Modeling Expert Elicitation Fitting Distributions Fitting Multivariate of to Data Distributions Input Parameters Distributionso Sampling From the / Monte oneCroCarlo Ohrapig Other Sampling Sampling :

ns Schemes 'Extreme Events' Input Parameters*

C Computer Model Uncertainty Time Dependency Estimating Time epenency Non-standard~and/or Unknown Functions J Output Analysis Fitting Estimation of Estimating Distributions Different Oupur Multivariate Characteristics Distributions Flow of information Methodologies Challenges Figure 3: Conceptual illustration of the uncertainty quantification process used to add detail (basic events) to the STPNOC PRA analysis in the LOCA initiating event sequences for the Option 2b analysis.

plemented by independent critical peer review intended to help disclose any overlooked technical gaps that would compromise results and, although the analysis is developed for the industrial setting, also help ensure that the overall product is academically defensible.

Independent Technical Oversight also helped to further focus the analysis efforts.

The overall quality assurance plan is illustrated in Figure 4 as a flow chart. Due to the diverse technology required to be implemented in the GSI-191 scope, the PRA inputs originate with products developed by experts in their respective fields. The CASA Grande integrating framework uses the inputs to generate the two main inputs to the PRA, the sump demand failure likelihood and the in-vessel cooling failure likelihood (for each category of LOCA and all possible equipment configurations). These elements are documented by the vendor and the normal STP vendor document review process is followed to assure they are suitable for use as input to the PRA. The overall STPNOC Pilot Project 19 quality assurance methodology is expected to be similar to most utilities' processes for PRA applications and is consistent with industry PRA standards, practices and procedures [see 3].

The technical and RG1.174 documentation that establishes a technical basis to close GSI-191 in an Option 2b approach consists of several volumes:

" Volume 1, Summary (this volume);

" Volume 2, The PRA analysis and quantification; 19 STPNOC Risk-Informed GSI-191 Closure Pilot Project.

X

Enclosure 4 NOC-AE-1 3002954

" Volume 3, The engineering analysis supporting the added basic events and top events needed by the PRA to address the concerns raised in GSI-191;

Volume 4, Quality Assurance documentation, approach, and summary;

" Volume 5 Oversight (four Volumes, Volume 5.1, 5.2, 5.3, and 5.4); and

" Volume 6 Comment and Request for Additional Information Resolution.

Additional documentation (for example the PRA Model Revision 7 and support calculations) are also available through reference.

The remainder of this document is developed to reflect the RG1.174 sectioning. That is, starting with Section 1, (Proposed Change) through Section 6, (Documentation), the section numbering corresponds exactly to the RG1.174 numbering. A summary of the STPNOC Pilot Project Oversight activity is given in Section 7, Independent Technical Oversight. There are many acronyms used throughout the text. For most of the acronyms used in this document, in addition to providing the complete name for them as a footnote when first used, Section 8 provides the complete name again with a short description for each.

As mentioned earlier, the first numbered sections, 1 through 6, correspond to the same sections in RG1.174. A checklist (Appendix A, Appendix A. Reg. Guide 1.174 Checklist) is provided as an additional resource for cross referencing RG1.174 items with the text in this document. Appendix B is provided to give an overview of the models implemented in the STPNOC Pilot Project and how they correspond to those recommended in NEI 04-07 [34].

Finally, Appendix C is a summary of the many historical (that is, prior to the STPNOC Pilot Project) STPNOC actions that have been put in place that address the concerns raised in GSI-191 over the several years leading up to the STPNOC Pilot Project.

xi

Enclosure 4 NOC-AE-1 3002954 Responsiblifty.Contracted service organizatton Peocosau Local quality program STPProcedure: OPGP03-ZT-01 38 Contractor/ Staff Augmentation Volunteer Training and.Qualification Program Input developpment 0

1 Vi

'Responsibifity: LANL orkPoces Local Quality Program, Allon Science VerificationNalildation CASA Frame*

Program 0

0.

Responsibility-.STP Contract Technical Coordinator, Project Technical Lead

- Input to PRA Process STP Technical Document Review Process.

Procedure OPGP04-ZA-0328"EngineerIng Document Processing' Interr nal review supplemented and supported by Independent Oversightl Soteria Consultants I

Inputs to PRA.Verified/Reviewed I

Responsjbildty ABS Consulting PRA Quantification/Output Procesm: RISKMAN'quantificasion, STPNOC PRA current plant model STP PRA Anlyses/Assessment Procedure Procedure OPGPOS-ZE-OOOI"PRA Analyses/Assessments" I

I PRA Application Responslbiity STP Contract Technical Coordinator, Project Technical Lead Process: STP PRA Assessment Process 1

Procedure OPGPO4-ZA-0604'Probabilisitc Risk Assessment Program" Responsibility-.STI Licensing Engineer License Amendment Proceas: STP Ucense Amendment Process Procedure OPGPOS-ZN-O004"Changes to Licensing Basis Documents and Amendments to the Operating Ucense" Figure 4: Illustration of the major elements of the STPNOC quality assurance process for risk-informed closure of GSI-191.

xii

Enclosure 4 NOC-AE-1 3002954 1 PROPOSED CHANGE 1 Proposed Change in place to address the concerns raised in GSI-191 at the start of the STPNOC Pilot Project.

Part of the STPNOC plant licensing ba- In the following section, the primary activ-sis change considers long-term core cooling ities from that history that are already in as identified in 10 CFR §50.46 following a place are summarized.

LOCA. Long-term cooling is supported by the ECCS which system includes the safety-related CS, the HHSI, LHSI, and the RHR 20 Procedures and Activities in system. The STPNOC licensing basis requires the Licensing Basis these particular systems to operate with high Before the STPNOC Pilot Project started, probability following a LOCA. In addition, STPNOC had already taken steps in STP the licensing basis requires evaluation of un-design and operation to help eliminate, or certainty associated with proper operation.

greatly reduce, effects from the concerns

[38]

raised in GSI-191 on long term cooling at In this licensing basis change, STPNOC ex-STP. Some of the steps taken include:

plicitly quantifies the probability and uncer-tainty associated with the operation of the " installing very large, uniform-loading ECCS following a LOCA and shows that long- ECCS strainers with approximately a term cooling is ensured with high probability. factor of ten increased strainer flow area In the current license basis neither the prob- over the strainers originally installed; ability nor the uncertainty that long-term

modifying the STP Emergency Operat-cooling will operate properly following LOCA ing Procedures to terminate Contain-is quantified. Therefore, the licensing basis ment Spray early as a conditional action change is to incorporate the probability and step as a means to conserve RvWST 22 in-uncertainty associated with long-term cool-ventory; ing success of the as-built, as-operated plant (as required in the license basis change). This

removing effectively all Marinite (Cal-requires NRC approval where the cumulative cium Silicate) insulation from the con-risk is shown to be very small [38, Figures 4 tainment building; and 5, Page 16]. 23

" reworking or replacing PWSCC -

susceptible welds in the Steam History of Defense in Depth Generators and the Pressurizer safe and Safety Margin Activities ends; and Since the inception of the GSI-191 issue, STP " performing a comprehensive post-has made significant improvements to pro- maintenance containment cleanup and cesses, programs, design, and operation that, inspection following refueling outages in the unlikely event of a LLOCA 2 1 , would to help ensure material that would mitigate potential consequences. These im- cause strainer blockage is removed.

provements include design modifications to The following primary procedures and ac-the plant hardware, operator training, and tivities are implemented that directly or indi-procedures. Appendix C is provided to help rectly bear on mitigating or eliminating the review the current status and review what is concerns raised in GSI-191:

20 22 Residual Heat Removal System Refueling Water Storage Tank 21 23 Large Break Loss of Coolant Accident primary Water Stress Corrosion Cracking 1

Enclosure 4 NOC-AE-1 3002954 1 PROPOSED CHANGE

" "Condition Reporting Process", STP- which could be transported to the Con-NOC plant procedure, OPGP03-ZX- tainment Sump and cause restriction 0002: The STPNOC process used to of pumps' suctions during LOCA con-identify plant Management, Opera- ditions is present and is the proce-tions, and Work Control of any deficien- dure that satisfies Technical Specifica-cies or issues that may arise. This pro- tions 4.5.2.c.1, 4.6.1.7.1, 4.6.1.7.4, and cess requires identification and evalua- 3.6.1.7.b.

tion of the severity and required actions, to be taken as necessary for safe opera- "ASME Section XI Inservice In-tion. spection", STPNOC plant procedure, OPSP11-RC-0015: This procedure

" "PRA Analyses/Assessments", STP- ensures that the following requirements NOC plant procedure, OPGP05-ZE- of Technical Specifications 4.0.5 /4.4.10 0001: The STPNOC process used in PRA have been satisfied: completion of the as the basis for applications and risk- inservice inspection (ISI) examina-based decision making. tions of STP piping and component welds in accordance with the schedule

" "Design Change Package". STPNOC requirements of the ASME Boiler plant procedure, OPGP04-ZE-0309: The and Pressure Vessel Code,Section XI STPNOC engineering design change pro- (2004 Edition No Addenda); Inservice cess governing all design changes. Sec- Service Inspections of STP piping tion 4 of the design change checklist and equipment; component supports and the supporting descriptions specif- (excluding snubber assemblies [pin-to-ically address maintaining the assump- pin]) in accordance with the schedule tions used for the engineering models in requirements of the Code; completion the STPNOC Pilot Project containment of the Inservice Service Inspections analysis. of the STP containment metal liner in accordance with the schedule re-

" "Inspection of Containment Emergency quirements of the ASME Boiler and Sumps and Strainers Unit #1 1-A, 1- Pressure Vessel Code; completion of B, 1-C Unit #2 2-A, 2-B, 2-C", STP- the examinations of the STP Reactor NOC plant procedure, OPSP04- XC- Coolant Pump flywheels in accordance 0001: The procedure satisfying Techni- with the requirements of Regulatory cal Specifications for ECCS sump oper- Guide 1.14.

ability. The specific procedure purpose is to provide instructions for cleanliness * "Transient Cycle Counting Limits",

and structural inspection of Contain- STPNOC plant procedure, OPEP02-ZE-ment Emergency sumps and strainers 0001: The STPNOC process that pro-1-A, 1-B, 1-C or 2-A, 2-B, 2-C required vides for the monitoring of the num-by Technical Specifications 4.5.2.d and ber of primary and secondary plant op-4.5.3.1.1. erations that are explicitly considered as design transients for the NSSS pri-

" "Initial Containment Inspection to Es- mary system and components. This pro-tablish Integrity", STPNOC plant pro- cedure includes the transients listed un-cedure, OPSP03-XC-0002: The STPNOC der the normal, upset and test condi-process that ensures no loose debris tions in UFSAR Section 3.9, with the 2

Enclosure 4 NOC-AE-13002954 2 ENGINEERING ANALYSIS exception of particular transients dis-

Strainer mechanical collapse.

cussed in Step 1.2 of the procedure. This procedure is based on the recommenda- In order to assess the potential risk to tions of WCAP-12276. long-term core cooling due to the issues raised in GSI-191, a theoretical "perfect "Shielding" STPNOC plant procedure, plant" is hypothesized. The theoretically OPRP07-ZR-0004: The STPNOC pro- perfect plant would not be subject to the pos-cess for a consistent method of deter- tulated failure mechanisms that motivated mining the need for, requesting, eval- GSI-191, and the as-built, as-operated plant uating, installing, modifying, account- nor the theoretically perfect plant would ing for and removing shielding at STP. have any changes in commitments to cur-In particular, OPRP07-ZR-0004 requires rent long-term cooling requirements or per-inspection for signs of wear such as formance of the ECCS.

cracking of the blanket material, dam- By adopting an approach that explicitly aged or corroded grommets, or other assesses the potential risk of the issues raised signs of physical damage. The inspec- in GSI-191, STPNOC would avoid signifi-tion is performed prior to each removal cant cost and worker radiation exposure that and storage and thereby minimizes the would be incurred if using an approach that possibility that transient lead can be in- would bound the risk using extreme assump-troduced in the post-LOCA sump chem- tions in engineering models of the LOCA, the istry. so-called "deterministic approach" as long as the risk is evaluated to be very small. Cost 1.1 Method of Analysis estimates for the two STPNOC are in the range of $50,000,000 to $60,000,000, consis-The method of analysis uses an integrative tent with other estimates in the industry. Ra-approach to explicitly provide the probabili- diation exposure to workers is also very high, ties for a few post-LOCA basic events of the 10OREM to 200REM.

STPNOC plant-specific PRA. This has been done by modeling the underlying physical phenomena of the basic events and by prop- 2 Engineering Analysis agating uncertainties in the physical models.

In particular, the simplistic demand recircu- Title 10 "Energy" of the Code of Federal lation failure probability is replaced with the Regulations (CFR) is the law that applies to following basic events: all domestic commercial nuclear power sta-tions. One of the several legal requirements

" Air ingestion through the sump screen; defined in 10CFR§50.46, "Acceptance crite-

" Pressure drop due to buildup of de- ria for ECCS for light-water nuclear power bris on the sump screens with chemical reactors" is that events leading to a loss of effects; resulting in NPSHA 24 dropping long-term core cooling must be mitigated below NPSHR 25 for the ECCS pumps; with high probability. The main purpose of the ECCS is to mitigate hypothesized LOCA

Boron precipitation; events by supplying cooling water to the reactor. LOCA events can be triggered by

Core blockage with chemical effects; and a valve failure or a structural failure and 24 Net Positive Suction Head Available the ECCS is designed to mitigate the "worst 25 Net Positive Suction Head Required case" of these failures with high probability.

3

Enclosure 4 NOC-AE-1 3002954 2 ENGINEERING ANALYSIS Since 2001, GSI-191 has eluded resolution keeping, ablated concrete, and chemical pre-despite significant efforts by industry and cipitants, are examples of material that, dur-the NRC. Although recent thought has been ing the recirculation phase of a hypothesized given to risk quantification [65, for exam- LOCA, may cause high differential pressure ple] and early recognition of the need for on the ECCS strainers or reactor core fuel risk evaluation was identified, [8, for exam- assemblies if they are transported to the ple], until now serious investigation into risk containment emergency sump and then to quantification has not been undertaken un- the ECCS filter screens. If the conditions as-til now. Instead, resolution has followed a sumed in some of the more extreme hypothe-classical deterministic approach. STPNOC's sized cases were realized, the resulting ECCS view, following an initial quantification [5], is filter screen differential pressure could be suf-that a risk-informed resolution path should ficient to cause core damage due to the loss of be pursued in preference to a determinis- one or more trains of the ECCS. Filter ineffi-tic approach, thereby quantifying the safety ciency may lead to blockage of all the fuel as-margins and identifying any scenarios that semblies which also may result in core dam-pose significant risk in GSI-191. age. In addition to the concerns associated The STPNOC PWR RCS operates at tem- with differential pressures mentioned, the is-peratures higher than about 650'F. As a con- sue of boron precipitation causing reduced sequence, it is important to use high effi- heat transfer in the core has been raised.

ciency insulation to prevent exceeding local In the GSI-191 analysis, the STPNOC PRA and general environmental temperatures in shows the risk to core damage or large early the enclosed space of the reactor contain- release due to the concerns raised in GSI-ment building. NUKON fiberglass insulation 191 in the as-built, as-operated design is very is specified for most high-temperature Class I small . In the analysis, the risk of core dam-piping and components in the STP contain-age and/or large early release is quantified ment buildings. The Reactor Vessel and Re- for a hypothetical plant designed and oper-actor Vessel Head are notable exceptions in-ated in the same manner as the STP plants sulated with RM12 6 . except that it is not subject to the concerns In addition to the containment building raised in GSI-191. The STPNOC PRA meets application, insulation similar to NUKON is the ASME/ANS PRA Standard as Capabil-installed in high temperature steam cycle ap- ity Category II and has successfully provided plications, piping, heaters, valves, etc. Be- the technical basis for several risk-informed cause it is in general usage, STPNOC has a applications at STPNOC RMTS [77, 12]. PRA great deal of experience installing and remov- is relied upon in this analysis to quantify the ing fiberglass insulation. Processes and pro- risk associated with the concerns raised in cedures have been in place for many years GSI-191.

and, as a result, the plant staff has significant experience with fiberglass insulation leading The engineering analysis and experimen-to maintenance efficiencies. tal support for the proposed license basis In the unlikely event of a LOCA, fibrous change are both detailed and broad in scope, insulation ablated from piping and compo- commensurate with the perceived complex-nents insulated with NUKON, paint chips ity of the issues raised in GSI-191. The inher-dislodged from painted surfaces, latent debris ent uncertainty of the analysis is addressed from inefficient containment building house- through the sampling methodology in the uncertainty quantification and by adopting 26 maximum or reasonably high bounds where Reflective Metal Insulation 4

Enclosure 4 NOC-AE-1 3002954 2 ENGINEERING ANALYSIS 2.1 Defense-in-Depth and Safety Margin the analyses or experimental data are incom- loss in fiber debris beds. To prevent introduc-plete. For example, NLHS is used in the un- tion of a direct debris path due to strainer certainty propagation methodology to em- damage, the exposed strainer modules have phasize random samples from the extreme an added protective fence. Taking these steps tails of many uncertain parameters. In par- after the concerns were originally raised in ticular, when defining random break scenar- GSI-191 and within the context of continu-ios, the methodology ensures that DEGB27 ous performance improvement, has greatly conditions are included for every weld in the improved the safety margin and assurance containment within the spectrum of random of DID 28 in the as-built, as-operated STP break sizes that are chosen. NLHS permits plants.

a more precise quantification of variability near the extreme conditions for the same number of random scenarios without bias-2.1 Defense-in-Depth and ing the propagation of uncertainty. Tradi- Safety Margin tional engineering limits are used for equip-No changes are proposed to DID or safety ment performance assessment. Examples are:

margin by this licensing basis change. In-NPSH for ECCS pumps, air entrainment in stead, the risk associated with the traditional the ECCS supply lines, and cooling flow that design basis accident analysis is assessed and is required to remove decay heat.

quantified. In keeping with the Commission's The findings of this analysis indicate that goal to increase the use of risk analysis in the risk associated with the issues raised in regulation, this analysis quantifies the risk GSI-191 is very small and well within the and uncertainty incorporating the impact of Commission's safety goal. There are several steps taken to preserve high levels of nuclear reasons, many associated with a realistic an-safety against perceived risks, while balanc-alytical approach, that contribute to a mini-ing regulatory cost and the need for signif-mal risk result. However, it is most important icant worker exposure to mitigate concerns to note that, following the timeline of the is- where the risk to nuclear safety is significant.

sues motivating GSI-191, STPNOC took sev-eral steps in the design of the ECCS, contain-ment maintenance, operation of the CS sys- 2.1.1 Defense-in-Depth tem, and insulation design that significantly The risk to reliable operation of the as-built, increased the safety margin against the issues as-operated plant DID systems is analyzed to that were raised in GSI-191. The most signiif- be very small. STP has three trains of safety icant change in design was the introduction injection and three trains of containment fan of very large ECCS sump strainers that, un- coolers. The containment fan coolers do not der realistic assumptions of LOCA behavior, rely on the recirculation mode for cooling the shows it is essentially impossible for NPSHA sump water. Decay heat can also be removed to drop below NPSHR for the ECCS pumps. by the steam generators using the auxiliary Some insulation types have shown in- feed water system and the steam generator creased head loss in fiber debris beds. STP- Power Operated Relief Valves.

NOC took steps to remove, or ensure that The normal charging system is an alter-they were not installed, effectively all insula- nate flow path that can be aligned to the tion (such as Microtherm and Calcium Sili- RWST if the ECCS pumps become unavail-cate) that could contribute to increased head able for any reason. An entire volume of 27 Double-Ended Guillotine Break 28Defense-in-Depth 5

Enclosure 4 NOC-AE-1 3002954 2 ENGINEERING ANALYSIS 2.1 Defense-in-Depth and Safety Margin the RWST (approximately 500,000 gallons) 2.1.1.2 Defense-in-Depth prin-can be refilled and injected into the contain- ciple. The analysis shows that DID is ment per design. Normally, STP can refill the maintained with high probability. The RWST in less than a day. When indicated availability and reliability of the systems by the Emergency Operating Procedures, the supporting DID continue to be assured Reactor Coolant Pumps can be operated to with high probability with consideration cool the core and prevent core damage. of uncertainty. The analysis shows there is The risk associated with the concerns practically no risk to containment integrity raised in GSI-191 with the as-built, as- associated with the concerns raised in GSI-operated plant to the likelihood for radiation 191 and therefore, the license basis change release as evaluated by LERF 29 is effectively would indicate that as-built, as-operated zero. The concerns raised in GSI-191 have no containment design remains adequate to bearing on containment integrity or on the prevent a significant release into the en-release of radiation. vironment. In quantification of the risk, no credit is taken for additional operator 2.1.1.1 General design criteria. actions or programatic activities beyond the Because the analysis evaluates the risk of existing as-built, as-operated plant.

the as-built, as-operated plant, the tradi-tional engineering analysis that forms the 2.1.1.3 Uncertainties of chemical basis for the design remains intact and is effects. As part of the analysis, experi-inherently included in the analysis. That ments have been developed to investigate the is, the design criteria ultimately result in significance of the concerns raised in GSI-certain performance standards for the ECCS, 191 for post-LOCA environments specific to such as required flow rates, support system the STP plants. The experiments performed availability, equipment failure combinations, examined conditions under which specific etc. All commitments to design criteria re-forms of chemical precipitates, particularly main intact, however, they cannot guarantee A1OOH, can be formed: in-situ over short that core damage or large early release are time frames (on the order of hours and days) prevented for every postulated scenario.

by, for example, direct injection of aluminum Therefore, as previously mentioned, the salts; ex-situ (as in surrogate preparations licensing basis change evaluates the signifi-developed elsewhere in the industry); as well cance of the (non-zero) risk associated with as those formed by actual corrosion sources the as-built, as-operated plant. Because (such as aluminum, zinc, concrete, etc.) in the design criteria are robust and because prototypical post-LOCA environments.

changes to the design have been made to Experiments have shown that using ex-address specific GSI-191 concerns, the risk has been analyzed and is very small. The situ methods of precipitate formation pro-duced precipitate forms that are much more analysis incorporates extreme effects of likely to result in head loss impacts in debris chemical phenomena on debris bed differen-tial pressures as well as boron precipitation. beds than those formed in-situ. Finally, and consistent with previous observations [7], the Even with these extreme assumptions, the more recent experimental work performed probability for core damage is found to be very small and there is no effect on large for this analysis provides evidence that the chemical corrosion process that would take early release.

place in an actual post-LOCA environment 29 Large Early Release Frequency is significantly more benign to debris bed 6

Enclosure 4 NOC-AE-1 3002954 2 ENGINEERING ANALYSIS 2.1 Defense-in-Depth and Safety Margin head loss than any of the surrogate (in-situ ined.

or ex-situ) methods. The results of the chem- Because current testing of STP conditions ical effects experimental program that are has not been fully comprehensive, a multi-most similar to the actual post-LOCA sump plier has been applied to all debris-bed head conditions give confidence that experiments loss calculations to compensate for residual performed with surrogate preparations rep- uncertainties.

resent an upper bound for chemical effects on debris bed head loss. 2.1.2 Safety margin.

In each scenaxio, the tails of extreme distri-2.1.1.4 Uncertainties of head loss. butions are sampled and propagated through The head loss associated with debris beds to the PRA. Where appropriate, the uncer-can be shown to be dependent on not only tainty distributions envelope attributes of chemicals, but also on the presence of par- both aleatory uncertainty and epistemic un-ticulates transported to the sump area. Such certainty. As explained later in this report, particulates have been hypothesized to re- the only component of epistemic uncertainty sult from failure of coatings unqualified for that is explicitly preserved in the present high radiation and post-LOCA fluid chem- analysis is the component attributable to the istry. The transport and failure extent of break-frequency size distributions taken from such particulates have been conservatively NUREG-1829. All other sources of variabil-estimated in the STPNOC Pilot Project analy- ity have been integrated into the estimates of sis so as to preserve their effect on the result. failure probability reported for the compos-The failure extent and rate of failure used in ite failure modes used in the PRA. Compos-the STPNOC Pilot Project is supported by ex- ite failure modes applied in the PRA include:

perimental evidence. (1) strainer failure by excessive differential Experiments have been conducted in a pressure, excessive deaeration, and mechani-high temperature vertical loop using ex- cal buckling; (2) core blockage; and (3) boron pected post-LOCA fluid conditions (pH, precipitation. Also, experimental results for boron and buffer chemical concentrations, chemical effects were obtained with existing and temperature) to examine the uncertainty amounts of aluminum exposed to post-LOCA of coefficients derived in correlations com- fluids and they indicated very little to no pre-monly used in the analysis of head loss cipitate formation.

concerns raised in GSI-191, for example, Although such an extreme scenario would NUREG 6224. The experiments investigated never be expected based on realistic analy-a wide range of particulate size distribution sis of the LOCA response, thermal-hydraulic and types (for example, different forms of sil- engineering evaluations of core flow block-icon carbide and iron oxide) and, in these ex- age scenarios were conducted to understand periments the NUREG 6224 correlation has safety margin in these scenarios. In these been shown to bound actual head loss in beds evaluations [69], assessments of extreme con-with post-LOCA fluid flow, chemistry, partic- ditions of core blockage are included. In these ulate, and bed formation prototypical of the analyses, it was shown that with complete STP plants. The experiments help in under- blockage of the core inlet and all bypass standing the uncertainty and margin in the paths, only medium and large break cold leg analysis where the head loss from many dif- LOCA would result in core damage. In addi-ferent hypothesized break sizes and locations tion, detailed modeling of the core and re-with different debris loads had to be exam- actor vessel showed that only one fuel as-7

Enclosure 4 NOC-AE-1 3002954 2 ENGINEERING ANALYSIS 2.2 Risk Impact sembly flow passage needs to remain clear ception of the Reactor Vessel nozzle welds.

to prevent fuel overheating. The analyses in- The reactor vessel nozzle welds are less of cluded locating the open fuel assembly either a concern in the GSI-191 analysis than other at the core center or at an extreme periphery break locations since the reactor vessel is cov-location. Multi-dimensional vessel and core ered with RMI, and the primary shield wall simulations at the time of recirculation show would protect the majority of fiberglass insu-that the core inflow is highly asymmetric in- lation in the steam generator compartments.

dicating that it would be likely that several STPNOC is in compliance with ASME Sec-fuel assemblies would not be blocked by de- tion XI weld inspections.

bris that might penetrate the ECCS sump The insulation, paint and concrete damage screens. choice of the Z0130 used in the STPNOC en-The chemical effects testing that has been gineering calculation is expanded to account conducted so far has shown that chemical for pipe whip. No credit is taken in the cal-precipitation does not tend to occur in so- culations for piping constraints (especially on lution in the STP post-LOCA environment. large bore pipes) that would reduce the ZOI In cases where precipitation does occur, the based on pipe whip restraint. Finally, Ballew current test results suggest that the precipi- et al. [1] have shown the choices of the ZOIs tates that actually form in solution have dif- used in the GSI-191 risk analysis is signifi-ferent morphology from the surrogate pre- cantly overestimated [34, Section 3.4.2].

cipitates and are likely to have less impact on total head loss. It is possible that under 2.2 Evaluation of risk impact some extreme scenarios, chemical effects may be more significant than those observed dur- The risk assessment shows that any increases ing the recently completed tests. To address in CDF 31 and risk are very small and con-this possibility, a chemical effects bumnp-up sistent with the intent of the NRC's Safety factor probability distribution with a tail in- Goal Policy Statement. The expected change cluding 15x, 18x, and 24x increases for small, in CDF and LERF is very small in the analy-medium, and large breaks, respectively, was sis which includes internal and external haz-included in the CASA Grande evaluation. The ards in an at-power model which bounds risk purpose of the extreme tail was to preserve contribution. An in-depth and comprehen-a 10-05 probability of meeting or exceeding sive risk assessment using the STPNOC PRA the stated limits while also preserving expec- was used to derive the quantified estimate tation values between 2 and 3 (factors of 2x of the total impact of the proposed change to 3x) for each LOCA category. In addition, as opposed to a qualitative assessment using, the contributions of chemical effects from for example, performance measures.

limiting experiments with ex-situ prepared Because pressures and temperatures are precipitates [23] are inherently assumed in greatly reduced in plant operating Modes 4, the core flow blockage success criteria which 5, and 6, the concerns raised in GSI-191 can was developed as a bounding value for all not be realized in these shutdown modes of PWRs. Several other conservative assump- operation. For Mode 3, the at-power model tions leading to safety margin in the as-built, is bounding and can be used as a surrogate as-operated plant are detailed by NEI [35]. for Mode 3 operation.

The quantitative risk metrics evaluated in All STP large bore piping PWSCC-susceptible welds (nozzle welds) have been 30 Zone of Influence replaced or otherwise mitigated with the ex- 31 Core Damage Frequency 8

Enclosure 4 NOC-AE-1 3002954 2 ENGINEERING ANALYSIS 2.3 PRA Adequacy the analysis are CDF and LERF. There may LOCA in more detail, the main concerns are be risk metrics that are not reflected (or are with MLOCA 32 and LLOCA. As mentioned inadequately reflected) by changes to CDF earlier in Section 2.1.2, thermal-hydraulic re-and LERF. Other risk metrics were consid- sponse analysis shows that long-term core ered, especially effects on containment in- cooling is not challenged in SLOCA 33 sce-tegrity. However, there are no concerns re- narios. The STPNOC PRA, like other simi-lated to GSI-191 that have a bearing on con- lar PRAs, included a very simplistic demand tainment integrity following a LOCA identi- failure probability for recirculation failure.

fied in the analysis. Therefore, there is no The GSI-191 risk analysis required a much effect on LERF and, therefore, no impacts to better understanding of the failure proba-offsite consequences. bility and concomitant uncertainty for re-The STPNOC PRA has been reviewed on circulation failure than the simplistic basic multiple occasions by the NRC. The last in- event value used in the past. In order to dependent peer review was for STPNOC PRA support a more informed basis for recircu-Revision 5 and Revision 5 was assessed in lation failure, the basic event likelihood and that review to be adequate for use in STP- uncertainty needed engineering analysis sup-NOC PRA applications. Since Revision 5, port. A detailed uncertainty quantification there have not been any major changes to was performed to solve the required engineer-the PRA that require additional peer review. ing models and propagate their uncertainty The PRA is currently at Revision 7, released to obtain a recirculation failure probability.

late in 2012. The concerns raised in GSI-191 Similarly, the basic event failure likelihood are isolated to long-term cooling in LOCAs. and uncertainty for ECCS pump performance Other initiating events included in the PRA only included mechanical and electrical fail-are, therefore, unimportant compared to the ures. However, the concerns raised in GSI-191 LOCA event trees. The STP baseline CDF required an assessment of the likelihood for and LERF are substantially below the Com- air ingestion and inadequate NPSHA when mission Safety Goal when the as-built, as- debris beds are hypothesized to form on the operated plant risk is evaluated with the con- ECCS sump strainers. These added failure cerns raised in GSI-191 included. That is to mechanisms were included in the PRA with say that there is very little risk associated their failure probability and uncertainty de-with the concerns raised in GSI-191 because, termined through uncertainty propagation of when incrementally added into the analyzed appropriate physical models as described in average plant risk, the risk contribution is detail in Volume 3. The failure thresholds negligible. for these kinds of events are from a stan-dard engineering analysis of allowable air and NPSHA for the pumps during a worst case 2.3 Technical adequacy LOCA scenario.

the PRA Analysis Finally, downstream effects of core block-age and boron precipitation were included The STPNOC PRA is a full-scope integrated with the possibility of recirculation failure.

Level I and Level II PRA. Further details con- Again, the added failure mechanisms were cerning the technical adequacy of the STP- included in the PRA with their failure prob-NOC PRA are found in Volume 4. However, ability and uncertainty determined through and as mentioned earlier, the GSI-191 con-cerns center around LOCA and in particular, 32Medium Break Loss of Coolant Accident 33 the recirculation phase of LOCA. Going into Small Break Loss of Coolant Accident 9

Enclosure 4 NOC-AE-1 3002954 2 ENGINEERING ANALYSIS 2.3 PRA Adequaqy uncertainty propagation of appropriate phys- detailed engineering analysis is performed ical models. in an uncertainty quantification framework that evaluates the required failure modes of 2.3.1 Scope of the PRA ECCS and core cooling (in-vessel effects).

Significant detail is included in the engi-The scope of the STPNOC PRA is Level I neering analysis used to develop the new and Level II, including external and inter- basic events and top events required. De-nal hazards such as internal floods, seismic tails include physical models and mecha-events, internal fires, high winds, external nisms known to lead to failure, and the anal-flooding, etc. This level of detail is actually yses include experimental evidence used to not required because none of the LLOCAs are support particular areas of concern.

evaluated in external events so consequently, GSI-191 issues do not appear. The concerns 2.3.3 Technical adequacy raised in GSI-191 are related to LOCA and, in fact, the at-power LLOCA and MLOCA The safety issues associated with GSI-191 are initiating events are the most important of within the scope of current PRAs that meet the concerns. The STPNOC PRA is an at- Regulatory Guide 1.200 [36, 37], Revision 1 power PRA and, as such, no shutdown LOCA or Revision 2. LOCAs are internal event ini-events are considered. The at-power scenar- tiators included in all versions of Regula-ios bound the low power and shutdown LOCA tory Guide 1.200. The STPNOC PRA has events, not only because the decay heat load been peer reviewed relative to internal events is significantly reduced, but because the en- (includes LOCA initiators). Since STPNOC's ergy available for debris generation is much PRA is compliant with RG 1.200, Revision 1 less. Therefore, the STPNOC PRA overall for internal events, it is compliant with Reg-scope is sufficient to address the concerns as- ulatory Guide 1.200, Revision 2 for assessing sociated with GSI-191. the risk associated with GSI-191.

With relationship to LOCA, the STPNOC The technical adequacy of the PRA analy-PRA Revision 7 initiating event frequency is sis is robust. The assumptions and/or actual taken from the most recent database used modeling of the concerns raised in GSI-191 in PRA analyses [11]. Eide et al. refer to are either bounded in other work by exper-NUREG/CR 1829 [68] as the basis for LOCA imental evidence or analysis, or by analysis initiating event frequencies. The frequencies and experimentation specifically performed used in the STPNOC PRA LOCA initiating for the STPNOC PRA evaluation. The STP-event trees are preserved in the engineering NOC PRA is used in risk-informed applica-analysis used to develop failure probabilities tions extensively at STP.

at locations throughout the Class 1 piping The methodologies, applications, and re-in the STP containment buildings. Also, the sults derived from the STPNOC PRA are re-LOCA epistemic uncertainties used in the en- viewed by peers in benchmarking and other gineering analysis are taken from the same activities and are also regularly published in NUREG-1829 table used by Eide et al.. the open literature and symposia. These are, for example, Liming and Kee [25], Liming et al. [26], Moiseytseva and Kee [32], Kee 2.3.2 Level of detail et al. [21], Galenko et al. [15], EPRI [12],

As mentioned previously, the PRA is not Wang et al. [71], Kee and Yilmaz [22], Kee significantly changed to specifically address and Popova [19], Yilmaz et al. [76], Yilmaz the concerns raised in GSI-191. Instead, a and Kee [73], Rodgers et al. [43], Kee et al.

10

Enclosure 4 NOC-AE-1 3002954 2 ENGINEERING ANALYSIS 2.3 PRA Adequacy

[20], Yilmaz and Kee [74, 75]. In some cases, * (1) strainer AP > NPSHR Margin; STPNOC has been the industry leader in PRA applications and application develop- * (2) strainer AP > Pbuckl3, ment, and in setting standards and practices. 35

(3) strainer 0 d Foi > 0.02; In the GSI-191 risk-informed resolution, STP-NOC has followed the practices and methods * (4) core fiber load > CLB 36 fiber limit known to be acceptable and consistent with for boron precipitation; industry PRA practices and standards.

(5) core fiber load > HLB 37 fiber limit 2.3.4 Plant representation for boron precipitation; The STPNOC PRA and the engineering anal- * (6) core fiber load > CLB fiber limit for ysis supporting the GSI-191 analysis are rep- flow blockage; and resentative of the as-built, as-operated plant.

The STPNOC PRA is reviewed for compli- * (7) core fiber load > HLB fiber limit for ance/adherence with the plant design and flow blockage.

plant data review every 36 months as a UF-SAR Chapter 13.7 commitment required for (1) through (3) above are counted as fail-PRA applications. Section 2.3.4.1 is a sum- ures if any single operable strainer exceeds mary of the engineering analysis support- the performance thresholds at any time dur-ing the PRA analysis in the STPNOC Pi- ing the 36-hornu calculation. (4) through (5) lot Project. The STPNOC PRA configuration are assessed against the accumulated fiber control is in accordance with STPNOC plant penetration from all operable strainers, and processes [4]. they must exceed the performance thresh-old before the time of Hot-Leg injection to be counted as failures. The thresholds for 2.3.4.1 Model of the LOCA pro-(5) were set infinitely high so that only cesses, CASA Grande One of the pri-exceedance of the CLB boron precipitation mary functions served by CASA Grande in loading (4) was recorded as failure. This the STPNOC Pilot Project is quantifying con-approach is reasonable because the thresh-ditional failure probabilities related to GSI-old for failure in (4) is substantially lower 191 phenomena for various plant Modes and than for (5) through (7), and because (4)

ECCS operating states. Failure probabilities through (7) all depend on (1) through (3),

are passed to the PRA to determine the de-and all the performance thresholds depend cision metrics for acceptance. Three new top on the same internal flow distribution and events are added to the PRA to accommo-fiber accumulation processes.

date composite GSI-191 failure processes:

Violation of any of the seven performance

failure at the sump strainer; thresholds is counted as an independent fail-ure. Thus, it is possible that a single scenario

" boron precipitation in the core; and can contribute to both a strainer-related fail-ure tally, and a core-fiber-load failure tally.

blockage of the core. After a suite of scenarios is performed, the These three composite failure probabilities 34 Strainer mechanical failure limit are calculated by testing the outcome of ev- 35 Void Fraction 6

ery postulated break scenaxio against seven " Cold Leg Break 3

performance thresholds: 7Hot Leg Break 11

Enclosure 4 NOC-AE-1 3002954 2 ENGINEERING ANALYSIS 2.3 PR.A Adequacy sum of probability weights for failed scenar- lowing discussion explains the origin and the ios within each LOCA category is divided by mechanics of this averaging process.

the sum of probability weights for all scenar- The NUREG 1829 tables [68] assign con-ios within each LOCA category to generate fidence levels to estimates of annual occur-the conditional failure probabilities needed rence frequency as a function of break size.

for the PRA. Table 1 reports the mean con- This assignment of confidence level defines ditional failure probability associated with an envelope of epistemic uncertainty that each composite failure mode for each of five was fit using bounded Johnson probability plant operating states (Cases). No failures density functions at each discrete break size were recorded for small or medium-break for which percentiles of confidence were tab-events, and later discussion will explain that ulated. The purpose of these fits was to en-only the higher range of large-break events able interpolation of the confidence bands contributed to failure. In addition to the at any intermediate break size of interest.

composite PRA failure modes, total failure The relationship defined by NUREG 1829 probability conditioned on the LOCA cate- between annual occurrence frequency (events gory is also provided. per year) and break size is presented in terms Table 1 results can be interpreted in of a ccdf38 . This format implies that under-the following ways. Design-basis accident re- lying probability density function, pdf3 9 has sponse with three trains operable (Case 1) is been integrated, and it is important to con-estimated to incur a total failure probability sider the form of the pdfs before selecting an of 0.09% given that a LLOCA occurs (that is, interpolation scheme that will be applied to 9 failures in every 10,000 large-break events). the ccdfs. Conversely, any presumption about If only one train is operable (Case 43), this interpolation of the ccdf has implications for estimate increases to 0.45%. The primary the implied form of the pdf.

contributor to the increase is the additional A pdf defined for break size must define head loss incurred at the single strainer by the probability per unit of size that a break collecting all of the debris that is distributed occurs within the interval between the dis-in proportion to flow across three strainers crete sizes tabulated in NUREG 1829. With-under Case 1. Conversely, failures incurred out knowing the details of how fracture me-by exceeding the boron fiber load are reduced chanics processes were treated during compi-(compare first and last columns) because lation of the NUREG 1829 table, it is difficult less cumulative fiber is penetrating the sin- to defend any assumption other than uni-gle, highly loaded strainer. Blockage failure form probability density between the tabu-is reported as zero probability because the lated discrete sizes. Uniform probability den-thresholds were set very high, partly to avoid sity means that any break size within the in-double counting blockage failures for events terval is equally likely. Uniform (constant) that first exceed the bounding low value for break-size probability between two ccdf val-fiber-load thresholds related to boron precip- ues is easily calculated as the positive dif-itation in the core. ference between the complementary cumula-tive annual frequencies divided by the posi-Conditional failure probabilities reported tive range of size across the interval divided in Table 1 are described as "mean" or "ex-by the total annual exceedance frequency for pected" values because five point estimates 3

associated with independent samples of the "Complementary cumulative distribution NUREG-1829 break frequency envelope have function been averaged for use in the PRA. The fol- 39 Probability density function 12

Enclosure 4 NOC-AE-1 3002954 2 ENGINEERING ANALYSIS 2.3 PRA Adequacy Table 1: Mean LBLOCA conditional failure probabilities for five plant operating states. Failure probabilities shown are for strainer blockage, core fiber load exceed-ing flow blockage criteria, and sump differential pressure exceeding Ppb,ckle. Each Case refers to a plant operating state.

Case 1 Case 9 Case 22 Case 26 Case 43 Blockage 0 0 0 0 0 6

Boron 6.94x10-0 4 1.82x10 - 03 7.51x10-05 6.15x10-0 5 3.42x1-°0 Fiber Load Sump 2.45x10- 0 4 5.39x10-0 4 1.32x10- 0 3 9.56x10- 0 4 4.45x10-0 3 Failure 03 Total 9.38 x 10-04 2.35 x 10-03 1.40x 10-03 1.02x 10- 4.45 x 10-03 the smallest break size. The integral of a con- interesting visual effect when plotted on stant pdf needed to form a ccdf is a straight log-log axes. As shown in Figure 5, the linear line, and this implies that linear-linear in- ccdf appears as a periodically looping curve terpolation of the NUREG 1829 table is the on a logarithmic scale. Figure 5 illustrates treatment most consistent with the assump- the extreme endpoints of the bounded tion of constant underlying probability den- Johnson fits (solid lines) and several typical sity. random samples of the break-frequency profile that were used in the STPNOC Pilot Project assessment (dashed lines).

NLHS of break-frequency profiles from the Johnson pdf envelope are performed in ex-actly the same manner as for all other ran-dom variables. The nonuniform probability bins are predefined based on the desired number of samples and on the direction of presumed conservatism, then random per-centiles are chosen from within each bin to represent, or "carry", the associated proba-bility weights. For the STPNOC Pilot Project, breaksize (in) five independent random samples were ex-Figure 5: Linear-linear interpola- tracted from the Johnson envelope for each tion of bounded Johnson extrema plant operating state, with an emphasis on (solid) with nonuniform stratified upper percentiles of the break frequency un-random break-size profiles (dashed). certainty envelope. Given a sample of five percentiles, the Johnson fits are then in-verted to find the corresponding annual fre-Linear-linear interpolation of the quencies. It is important to note that all NUREG 1829 table values leads to an Johnson fits are perfectly correlated by us-13

Enclosure 4 NOC-AE-13002954 2 ENGINEERING ANALYSIS 2.3 PRA Adequacy ing the same fixed values of the sampled per- estimates spans a factor of 2 to 4 between the centiles. Finally, the set of annual frequencies minimum and maximum values (0.012/0.003 from each Johnson fit is linearly interpolated = 3.8). This variation is caused solely by to create the break-frequency profiles shown the shape of the randomly selected break-as the dashed lines in Figure 5. frequency profiles, which dictate the relative Each break frequency profile is fully ana- proportion of break frequency by size.

lyzed in CASA Grande using a set of three It is important to reemphasize that CASA batch replicates containing approximately Grande never makes any direct use of the an-2,250 break scenarios each to obtain a point nual break frequency as a time-rate quan-estimate of failure probability for the com- tity. All analyses proceed conditioned on the posite modes. Residual sampling imprecision assumption that a break has already oc-of 20% between the three replicates is typi- curred. Sample profiles taken from the break-cal of this scenario sampling size. Probabil- frequency envelope then describe how to par-ity weights from stratified sampling of the tition the relative occurrence of breaks by Johnson envelope are then used to form the size. CASA Grande further redistributes the weighted conditional means reported in Ta- relative size probability across weld types in ble 1. order to map the cumulative probability of a The current resolution used for batch break as a function of size to discrete loca-size (2250 breaks), replicates (3) and break- tions in the plant [42].

frequency sampling (5) was dictated by prac- The PRA samples directly from the tical evaluation times. Table 2 summarizes NUREG 1829 Johnson pdf fits in each cat-the five point estimates and their associ- egory to preserve the epistemic uncertainty ated probability weights generated for the in LOCA frequency. It is important for CASA total failure probability under plant operat- Grande to use exactly the same represen-ing state, Case 43 (one train operable). The tation of the epistemic uncertainty. The weighted mean is formed simply by multi- Johnson fits are evaluated analytically in plying each point estimate by its probability CASA Grande to generate a table of em-weight and adding the products. Similar dis- pirical pdfs that are manually passed to tributions were formed for all composite fail- the PRA (RISKMANTM model) for repeated ure modes and for all plant operability states, sampling in the risk quantification. Although but only the weighted means are presented in the PRA generates thousands of samples Table 1. from the Johnson pdf during quantification, The cumulative distribution defined for to- CASA Grande samples relatively sparsely tal failure probability under Case 43 (one here. CASA Grande uses one quantification train operable) in Table 2 is plotted in Fig- loop to generate point estimates of failure ure 5 to illustrate how epistemic quantiles probability that are based on parameter vari-could be preserved from the GSI-191 engi- ations and model uncertainties like chem-neering analysis CASA Grande. This distri- ical effects bump up, and an outer loop bution reflects only the uncertainty inher- to preserve the epistemic quantiles of the ent to the estimation of annual break fre- break-frequency envelope (see Section 2.5.1).

quency. All other random variability, includ- Sparse sampling of the epistemic envelope ing ranges on physical phenomena and de- is a consequence of placing emphasis on cision criteria, has been integrated into each aleatory uncertainties (inner loop) that drive point estimate. As shown in Table 1 and Fig- the outcome of each break scenario and re-ure 5, typical variation in failure probability lies on NLHS for generating unbiased esti-14

Enclosure 4 NOC-AE-1 3002954 2 ENGINEERING ANALYSIS 2.3 PRA Adequacy Table 2: Distribution of total conditional failure for LLOCA under Case 43 (one train operating).

Point Failure Johnson prob- Cumulative Probability ability weight probability 0.0 0.0 0.0 3.13 x 10- 0 3 8.22 x 10- 0 8.22 x 10- 01 7.49 x 10-03 4.62 x 10-o3 8.27x 10-01 1.03x 10-02 1.46x 10-01 9.733x 10-01 1.15 x 10-02 1.00 x 10-03 9.74 x 10-01 1.2x 10-02 2.60x 10-o. 1.0 4.45 x 10-03 weighted mean mates of the mean failure probability. Failure distributions similar to those shown in Fig-ure 6 could alternatively be sampled by the PRA to generate distributions of incremen-tal risk attributable to GSI-191 phenomena. COUo.adw U,11ofTotal faduMe PMfro96Oyfa C~se 43 A sampling scheme would necessarily pre-0.92 serve epistemic correlation in the distribu-tion of failure probability that is generated 0.96 by CASA Grande (Figure 6) and shared by 0 94 the RISKMANTM model.

0.92 Another key piece of information passed from CASA Grande to the PRA through the basic events supported is the conditional split fraction for cold leg breaks in each 2 4 6 a 10 12 14 LOCA category. The total break size prob-ability for a single NUREG 1829 profile is distributed across all welds in containment Figure 6: Empirical distribution using the hybrid weighting scheme [42] to ac- of total failure probability for Case count for the contributions of small breaks 43 (one train operating) based on large pipes to the small and medium on five discrete samples of the LOCA categories. Each break scenario sam- NUREG 1829 break-frequency un-pled from this process carries a specific size certainty envelope. Weighted mean and location and a fractional weight of the = 4.45x 10- 0 3 marked as bold dot.

total break-size probability. Before any other physical parameters are considered, the dis-tribution of probability weight can be par-titioned into HLB and CLB events and by LOCA size.

15

Enclosure 4 NOC-AE-1 3002954 2 ENGINEERING ANALYSIS 2.4 Acceptance Guidelines Table 3: All cold leg split fractions conditioned on LOCA categories small, medium, and large for Case 43. The fraction going to the hot leg is simply the complement of the cold leg fraction.

Total Small Medium Large 4.2052034x 10-0' 4.2962813x 10-01 4.8133459x 10-01 4.3059826x 10-01 4.2052034 x 10-°' 4.2962813 x 10-01 4.8133459 x 10-01 4.3059826x 10-01 4.2052034x 10-01 4.2962813 x 10-°' 4.8133459 x 10-01 4.3059826x 10-0' 4.2015626x 10-01 4.2933789x 10-°1 4.8133521 x 10-01 4.3048163x 10"'

4.2015626x 10-01 4.2933789,< 10-0 4.8133521 x 10-01 4.3048163x 10-01 4.2015626x 10"1 4.2933789x 10-1i 4.8133521 x 10-01 4.3048163x 10-0i 4.2014556x 10-01 4.2932931 x 10"1 4.8133576 x 10-01 4.3044256 x 10-01 4.2014556 x 10-01 4.2932931 x 10-01 4.8133576x 10-01 4.3044256 x 10-0i 4.2014556 x 10-01 4.2932931x 10-01 4.8133576 x 10-01 4.3044256x 10-01 4.2210420x 10-01 4.3087029 x 10-01 4.8133228x 10-01 4.3115092x 10-'1 4.2210420x 10-01 4.3087029x 10-01 4.8133228x 10-01 4.3115092x 10-01 4.2210420x 10-01 4.3087029x 10-01 4.8133228x 10-01 4.3115092x 10-01 4.3407111x 10-01 4.3931916x 10-01 4.8118954x 10-01 4.3960731x 10-0' 4.3407111 x 10-01 4.3931916x 10-01 4.8118954xx10-1 4.3960731 x 10-01 4.3407111 x 10-01 4.3931916x 10-01 4.8118954xx10-1 4.3960731x 10-°1 Table 3 itemizes all cold-leg split fractions ure modes in Case 43. This list includes obtained for the fifteen batches associated only the first 34 of 1659 failed scenarios that with Case 43. These values were obtained were tallied during the analysis. The fact by dividing the sum of probability weights that no SLOCA or MLOCA events have been for CLBs in each LOCA category by the sum recorded as failure for any scenario evaluated of probability weights for all breaks in the in this quantification is a strong indication LOCA category. HLB split fractions are sim- that there is a minimum size break below ply the complement of any single entry in which insufficient debris can be formed to the table. Three replicates of 2,250 scenarios challenge the safety systems. The same con-are evaluated for each of five break-frequency sideration explains why most failure scenar-profiles for a total of 3x2250x5 = 33,750 ios involve the DEGB assumption of spheri-scenarios per plant operating state. CLB split cal ZOI simply because more insulation vol-fractions are mildly dependent on the break- ume can be involved in debris generation.

frequency profile shape (note repetition in The above illustration regarding Case 43 in-successive groups of three rows), but they dicates the kinds of insights that can be re-are independent of plant operating state. It alized in the STPNOC Pilot Project analysis is interesting to note that proportion of large approach.

CLBs is substantially smaller than the 50%

proportion assumed in the 2011 [5] quantifi-cation.

2.4 Acceptance Guidelines Table 4 lists a sample of the specific welds, Regions are established on the phase planes break sizes, and general containment zones defined by ACDF, CDF and ALERF, that are associated with one or more fail- LERF, as illustrated in Figure 7 and Fig-16

Enclosure 4 NOC-AE-1 3002954 2 ENGINEERING ANALYSIS 2.4 Acceptance Guidelines Table 4: Sample attributes of break cases leading to failure for Case 43. In the table: Pipe is a text string defined in the inservice inspection program program; System refers to STP System (all are RCS); Break Size is the size of the break in inches; LOCA size values of 1,2,3 denote small, medium, large LOCA events (all are large); DEGB, YES denotes the fully severed pipe condition (failures dominated by DEGB); RCS Leg denotes break location (CLB or HLB); and Break Location denotes region in the containment building related to debris transport fractions.

Pipe System Break LOCA DEGB RCS Break Location Size Size Leg 12RC-1112-BB1 RCS 10.126 3 YES Hot SC Compartment 12RC-1112-BB1 RCS 10.126 3 YES Hot SC Compartment 12RC-1 12-BB1 RCS 10.126 3 YES Hot SG Compartment 12RC-1125-BB1 RCS 10.126 3 YES Cold SC Compartment 12RC-1125-BB1 RCS 10.126 3 YES Cold SG Compartment 12RC-1125-BBl RCS 10.126 3 YES Cold SG Compartment 12RC-1125-BBl RCS 10.126 3 YES Cold SC Compartment 12RC-1125-BB1 RCS 10.126 3 YES Cold SG Compartment 12RC-1125-BB1 RCS 10.126 3 YES Cold SG Compartment 12RC-1212-BB1 RCS 10.126 3 YES Hot SC Compartment 12RC-1212-BB1 RCS 10.126 3 YES Hot SG Compartment 12RC-1212-BB1 RCS 10.126 3 YES Hot SG Compartment 12RC-1212-BB1 RCS 10.126 3 YES Hot SG Compartment 12RC-1221-BB1 RCS 10.126 3 YES Cold SG Compartment 12RC-1221-BB1 RCS 10.126 3 YES Cold SG Compartment 12RC-1221-BB1 RCS 10.126 3 YES Cold SG Compartment 12RC-1221-BB1 RCS 10.126 3 YES Cold SG Compartment 12RC-1221-BB1 RCS 10.126 3 YES Cold SG Compartment 12RC-1221-BB1 RCS 10.126 3 YES Cold SG Compartment 12RC-1221-BB1 RCS 10.126 3 YES Cold SG Compartment 12RC-1312-BB1 RCS 10.126 3 YES Hot SG Compartment 12RC-1312-BB1 RCS 10.126 3 YES Hot SG Compartment 12RC-1312-BB1 RCS 10.126 3 YES Hot SG Compartment 12RC-1312-BB1 RCS 10.126 3 YES Hot SG Compartment 12RC-1312-BB1 RCS 10.126 3 YES Hot SC Compartment 12RC-1322-BB1 RCS 10.126 3 YES Cold SG Compartment 12RC-1322-BB1 RCS 10.126 3 YES Cold SG Compartment 12RC-1322-BB1 RCS 10.126 3 YES Cold SC Compartment 12RC-1322-BB1 RCS 10.126 3 YES Cold SG Compartment 16RC-1412-NSS RCS 12.814 3 YES Hot SG Compartment 16RC-1412-NSS RCS 12.036 3 NO Hot SG Compartment 16RC-1412-NSS RCS 12.814 3 YES Hot SG Compartment 16RC-1412-NSS RCS 11.273 3 NO Hot SG Compartment 16RC-1412-NSS RCS 12.090 3 NO Hot SG Compartment 16RC-1412-NSS RCS 12.118 3 NO Hot SG Compartment 16RC-1412-NSS RCS 12.814 3 YES Hot SC Compartment 16RC-1412-NSS RCS 12.814 3 YES Hot SG Compartment 16RC-1412-NSS RCS 12.814 3 YES Hot SG Compartment 16RC-1412-NSS RCS 12.814 3 YES Hot SG Compartment 17

Enclosure 4 NOC-AE-1 3002954 2 ENGINEERING ANALYSIS 2.5 Comparison with Guidelines ure 8. Acceptance guidelines are established for each region as discussed below. The fig-ures show shading as the values increase t0 on either axis. The shading indicates that greater scrutiny and support would be re-quired for values that approach the region boundaries. Also illustrated, in the figures, is the desired trajectory for changes. That tra-jectory can be realized by using resources on projects that have the maximum risk benefit, a concept that is consistent with the Com- is' 10' lo" LERF 01 mission's direction to use risk insight to best achieve safety goals.

Figure 8: Reproduction of Figure 5 The comparison in the STPNOC GSI-191 from Regulatory Guide 1.174, "Ac-analysis uses the full-scope (including in-ceptance guidelines for large-early-ternal and external hazards, at-power, low release frequency", the ALERF, power, and shutdown) assessment of the LERF phase plane.

change in risk metric and the baseline value of the risk metric (CDF and LERF). As noted above, the shutdown PRA analysis is bounded by the at-power model. In the STP- 2.5 Comparison of PRA NOC GSI-191 analysis, the maximum accept-able increase in CDF is 10-06 and the maxi-results with acceptance mum acceptable increase in LERF is 10-07. guidelines The STPNOC Pilot Project PRA quantifica-tion is detailed in Volume 2. As mentioned 0 previously, the quantification shows that the risk associated with the concerns raised in GSI-191 are very small when compared to the acceptance criteria of RG1.174.

The PRA used in the GSI-191 licensing 10 basis change does not rely solely on nu-merical results for change in risk. Instead, the choice of models, solution methodology and incorporation of uncertainties provides a 16' to' 10" CDF - 3-high level of confidence that the uncertainties in models' parameters has been properly ac-counted for in the results. The safety margin Figure 7: Reproduction of Figure 4 described in Section 2.1.2 associated with use from Regulatory Guide 1.174, "Ac-of the methodology reflected in the license ceptance guidelines for core damage basis change analysis provides assurance that frequency", the ACDF, CDF phase safe operation can be expected without re-plane.

liance on numerical results alone.

As mentioned in Section 2.3.3, the STP-NOC PRA is an integrated Level 1 model 18

Enclosure 4 NOC-AE-1 3002954 2 ENGINEERING ANALYSIS 2.5 Comparison with Guidelines that includes all internal and external events, ZOI will result in scenarios that are conser-Level 1 and Level 2 analysis, the focus of vative.

the GSI-191 concerns are related to LOCA.

The analysis of LOCA initiating event fre- 2.5.1.1 Comments on uncertainty quencies and local pipe failure probabili- types In the PRA community, the concept ties included in development of the basic of "separate" types of probabilities or un-events for the scenarios that address the con- certainties is discussed frequently. In other cerns raised in GSI-191 include the full range communities, probability is simply probabil-of the epistemic uncertainty at each break ity and following quantification there is no size. Qualitative conservatisms that increase distinction as to the source. (See Chapter 3 safety margin (as previously mentioned in of [33] on PHSA 40 for a discussion including, Section 2.1.2) are included along with the "The panel concludes that, unless one ac-quantifiable uncertainties to increase confi- cepts that all uncertainty is fundamentally dence in the adequacy of the results. epistemic, the classification of PHSA uncer-The STPNOC PRA analysis includes un- tainty as aleatory or epistemic is ambigu-certainties that have been postulated in de- ous.") So in an uncertainty quantification terministic analyses for the concerns related framework in which the goal is to obtain as to GSI-191: output a point estimate or a probability dis-tribution on a key performance measure by

ZOI; propagating the probability distributions as-

" Chemical effects; sociated with multiple sources of input un-certainty, there is typically no attempt to

" Debris transport; sort out the contribution due to each source of input uncertainty. That said, it is com-

Head loss; mon practice to carry out a parametric anal-

" Boric acid precipitation; and ysis in which we effectively remove the prob-ability distribution associated with an input

Air ingestion to ECCS pumps. parameter and simply vary the input param-eter over a range of plausible values in or-In some cases, the uncertainties have been der to assess the effect on the output for addressed through well-known conservative 'the key performance measure. Applying this approximations, in other cases, specific ex- idea amounts to analyzing the output in a perimentation has been performed to analyze conditional manner, conditioned on the value the impact of the phenomena on plant per- of the corresponding input parameter. Such formance in response to LOCA. parametric analyses are usually done for one source of uncertainty at a time, as opposed to 2.5.1 Types of uncertainties and trying to simultaneously vary multiple input methods of analysis parameters.

Now reconsider the probability distribu-Both aleatory and epistemic uncertainties tion on the input parameter of focus. Output have been included in the STPNOC PRA.

results for the key performance measure can As mentioned in the previous section (Sec-be reported conditioned on the value of the tion 2.5), uncertainties have also been input parameter, in turn, set to be specific addressed using conservative assumptions quantiles from the input parameter's proba-where appropriate or where large uncertain-4 ties are seen. For example, assuming a larger "Probabilistic Seismic Hazard Analysis 19

Enclosure 4 NOC-AE-13002954 2 ENGINEERING ANALYSIS 2.5 Comparison with Guidelines bility distribution. In this sense we can pre- option is also selected for the uncertainty serve the quantiles associated with a key in- quantification of the difference in the PRA put parameter when analyzing distributional metrics of ACDF and ALERF so that the un-output. The engineering analysis used to de- certainty in the difference is calculated cor-velop the basic event failure probabilities rectly.

for the PRA uses an approach, likely new The one exception to this correlation of in-to PRA practitioners, that optionally inte- put parameters among PRA model elements gTates all uncertainty or preserves the quan- are those considered in CASA Grande. By tiles of selected input distributions (which necessity, the PRA is quantified using fail-some may wish to label as being epistemic ure probability distributions developed in the uncertainty). The LOCA frequency, for exam- CASA Grande analysis which are themselves ple, has a large uncertainty envelope that has functions of many data variables. In the STP-been preserved preserved in this manner. An- NOC Pilot Project quantification, the GSI-191 other large uncertainty envelope that could failure probabilities are quantified separately be preserved in this way is the ECCS strainer for each of the five ECCS pump state com-differential pressure. By preserving the un- binations considered in the STPNOC Pilot certainty quantiles for selected sources, their Project analysis. In this way, the key param-effect can be explicitly observed in the resul- eter of the PRA sequence models (that is tant basic event distributions. sump flow rates) is effectively correlated in In the STPNOC Pilot Project quantifica- RISKMANTM with the CASA Grande analy-tion, the LOCA epistemic uncertainty on fail- sis.

tire probability is quantified separately for In the CASA Grande analysis, failure prob-each of the five ECCS pump combinations abilities associated with engineering models considered in the STPNOC Pilot Project anal- of LOCA phenomena are also evaluated sep-ysis. As a result, the failure probabilities re- arately for five percentiles of the LOCA fre-sulting from GSI-191 phenomena for the five quency uncertainty analysis. These five sets pump combination cases axe correlated with of results are the basis for the five-bin uncer-the correct initiating event frequency associ- tainty distributions on each of the GSI-191 ated with the combination. phenomena failure probabilities.

The RISKMAN TM software used for the The sparse sample of five bins on the STPNOC Pilot Project quantification is specif- distribution of failure probability is not ically designed to appropriately correlate el- an inherent limitation of the CASA Grande ements from a group to which the same pa- methodology, but was chosen only for the rameter value applies. This is accomplished sake of current practicality. A more com-using the "Big Loop Monte Carlo" option se- plete interrogation of the break-frequency lected for the STPNOC Pilot Project quantifi- uncertainty distribution can be made de-cation. Each trial of the "Big Loop Monte pending on the needs of the PRA. The ini-Carlo" option, a random set of values is se- tial presumption was that higher percentiles lected from all input variables in the PRA of the break-frequency distribution would model. These sample values are then used to lead to more conservative estimates of CDF re-evaluate all PRA model elements; that is, and LERF, so more sampling resolution was basic event probabilities, split fraction fail- placed in the upper tails of the envelope (see ure probabilities, initiator frequencies, and Fig. 5). The shape of each break-frequency sequence frequencies that are then summed profile defines the relative LOCA frequen-to give the CDF and LERF. Importantly, the cies as a function of break size, as reflected 20

Enclosure 4 NOC-AE-1 3002954 2 ENGINEERING ANALYSIS 2.5 Comparison with Guidelines in the variation between the five point es-T Over many years of study, the phenom-NI timates of failure probability. RISKMAN ena associated with the concerns raised in samples from the full uncertainty distribu- GSI-191 have been well characterized. How-tion, using 100 percentiles, for the absolute ever, the approach taken by most investiga-LOCA frequency and correlates each sample tors in GSI-191 studies has been to demon-when evaluating the MLOCA and LLOCA ini- strate margin to performance limits by bias-tiating event frequencies. The correlation be- ing inputs, not by studying uncertainty or ac-tween the uncertainties in the relative break tual performance in the as-built, as-operated sizes used in the CASA Grande analysis and plant. In the STPNOC PRA, investigators the absolute LOCA frequencies used in the matched the phenomena to the performance PRA sequences models is not believed to be of the as-built, as-operated plant.

significant and therefore not modeled. In all cases, the difference between re-sults of previous studies and results of the 2.5.2 Parameter uncertainty STPNOC GSI-191 studies can be explained by well-established analytical methods. The Parameter uncertainties are addressed perva- extensive body of work related to the is-sively in the STPNOC PRA analysis. For the sues raised in GSI-191 helps provide assur-physical models addressing the concerns of ance that adequate models and methods are GSI-191, input parameters were derived from available to exploit.

both historical data and physical limits (for Based on the STPNOC Pilot Project anal-example, total contained volume in a tank).

ysis performed, the most important con-The uncertainty associated with all impor-tribution to CDF is the model of chem-tant parameters has been included and sam-ical effects, both on the strainer and in pling of the parameter distributions was done the core. Although (as mentioned previously in LHS 4 1 schemes to accurately preserve the in Section 2.1.2) chemical effects in STP distribution. Human error probabilities are post-LOCA fluid conditions are benign com-included in the STPNOC PRA however, for pared to the conditions assumed for the ex-the most severe accident scenarios (that is periments performed in WCAP 16793-NP, LLOCA), there is very little opportunity for the STPNOC Pilot Project assumes that ad-human actions to cause increases in the fail-verse chemical effects can occur, both at the ure likelihood. In these cases, automatic ac-strainer and in the core. The STPNOC Pilot tuation of the ECCS will occur prior to oper-Project also uses bounding values for strainer ator intervention.

differential pressure, that is, higher differen-tial pressures than observed in experiments 2.5.3 Model uncertainty representative of STP conditions. The model is less sensitive to strainer differential pres-As described on Page vii, the STPNOC PRA sure than core failure loading which is cho-is supplied with failure probabilities result-sen at one half the 15gm/FA limit found in ing from GSI 191 phenomena developed from WCAP 16793-NP as a threshold for the po-engineering models of the phenomena asso-tential of boron precipitation.

ciated with the concerns raised in GSI-191.

That is, in the PRA, the models are devel- In a classical interpretation, "model un-oped to be accurate representations of the certainty" often refers to the degree of credi-plant including parameter uncertainties. bility held by one prediction of physical phe-nomena compared to that held by alterna-41 Latin Hypercube Sampling tive predictions of the same phenomena. For-21

Enclosure 4 NOC-AE-1 3002954 2 ENGINEERING ANALYSIS 2.5 Comparison with Guidelines mal methods have been developed to com- 2.5.4 Completeness uncertainty pare competing models that have been ini-Although prior investigations in GSI-191 have tialized with as near identical input as possi-focused primarily on "test for success", they ble. Discrepancies between numerical predic-have nevertheless resulted in greater under-tions can then be used to quantify residual standing and characterization of the post-uncertainty in the prediction. These meth-LOCA behavior related to the concerns raised ods can even accommodate subjective mea-in GSI-191. In some cases, greater under-sures of confidence that particular models (or standing has led to adoption of models that none of the models) are more accurate than bound the experimental evidence simply be-the others. Often, the primary difference be-cause the space adopted is too large to fully tween models lies in the degree of spatial res-explore experimentally. As a consequence, olution or physical fidelity, but sometimes, simplistic conservative approaches have been fully mature alternative methods are com-adopted where uncertainty is difficult to pared.

quantify [see 35]. On the other hand, STP-NOC GSI-191 analysis has helped to extend the completeness of uncertainties associated with the concerns raised in GSI-191 by in-In the STPNOC Pilot Project, several new cluding phenomena expected to occur in the predictive models are being applied for the recirculation mode of ECCS operation where first time. These include the debris penetra- traditional analyses end. The STPNOC GSI-tion/filtration model that was benchmarked 191 analysis uses realistic or prototypical con-to test data, and the time-dependent debris ditions to model anticipated post-LOCA phe-circulation model that addresses coolant by- nomena during all LOCA phases. Finally, pass around the reactor core. Relatively sim- where possible, uncertainties are quantified ple, first-order models are extremely useful based on distributions that encompass plant for identifying trends, describing trade-offs conditions and equipment operating states between competing mechanisms, and prior- that, although important to long-term cool-itizing risk contributors; however, additional ing, are not considered in traditional (UF-conservatism is warranted to explicitly ac- SAR Chapter 15) analyses.

knowledge the uncertainty associated with The confidence in completeness of the the predictions of first-order models. For this modeling scope for the concerns raised in reason, additional conservatism was incorpo- GSI-191 is increased due to the number of rated in the treatment of both conventional years of study and work of independent in-and chemical-induced differential head-loss vestigators. In the STPNOC Pilot Project, all estimation. Additional testing is planned to known physical models have been adopted more tightly correlate head loss to STP flow and evaluated in the engineering analysis conditions, and additional testing is under- supporting the PRA.

way to refine the probability distributions As mentioned in Section 2.5.1, epistemic placed on potential chemical head-loss ef- uncertainty has been considered in the STP-fects. The practice of applying an overall in- NOC GSI-191 analysis. Examples of complete-flation factor that is distributed in magni- ness uncertainties that have been considered tude according to the best interpretation of and excluded from the current analysis are available data represents the extent of model listed below:

uncertainty that has been addressed in the

Multiple simultaneous RCS pipe breaks prototype study this far. would result in reduced damage due 22

Enclosure 4 NOC-AE-13002954 2 ENGINEERING ANALYSIS 2.5 Comparison with Guidelines to the very rapid depressurizaton of These are under De-fueled conditions (No the RCS. Although more damage zones Mode), Refueling (Mode 6), and Cold Shut-would be involved, less damage would down (Mode 5). The basis for this is that op-be possible at each location. erating pressures and temperatures are suf-ficiently low so that piping failure mecha-Physical security events that cause a nisms typically associated with LOCA events LOCA. Such events would contribute cannot reasonably be expected to occur.

equally to both the "ideal" plant and Modes 1, 2, 3 and 4 are bounded by the at-the as-built, as-operated plant. The power model.

STPNOC security force undergoes con- The uncertainty quantification in the STP-tinuous evaluation and improvements NOC GSI-191 PRA analysis is a significant are made in processes and procedures improvement in the understanding of RCS that would help preclude such events.

and containment building behavior under

" Events occurring during shutdown LOCA conditions. Uncertainties, not explic-modes of operation (includes lifting and itly quantified, are either bounded by other transport of Heavy Loads). Heavy loads uncertainties associated with more dominant are not being moved during Mode 3. contributors or are sources of uncertainty During the time heavy loads are be- outside the scope and boundary of GSI-191 ing moved, the plant is cooled down safety issues.

and depressurized. The STPNOC pro-cess for control of heavy loads [67] com- 2.5.5 Comparisons with accep-plies with Generic Letter 81-07, Con- tance guidelines trol of Heavy Loads, ANSI N14.6-1978 and NUREG 0612, and the TRM, Sec- As mentioned in Section 2, the STPNOC GSI-191 analysis shows that the risk associated tion 3/4.9.7.

with the concerns raised in GSI-191 is very

Structural failures (containment build- small. Also, as defined byNuclear Regulatory ing, interior containment walls or parti- Commission [38, Figures 4 and 5, Page 16]

tions, that could be postulated to in- and previously mentioned in Section 1, the duce a LOCA). These beyond design STP average CDF and LERF are also very basis events would contribute equally small. The estimates of ACDF and ALERF to both the "ideal plant" and the as- from the STPNOC GSI-191 analysis are far built, as-designed plant. In both cases, less than the Region III acceptance guide-it would be assumed that core damage lines.

and large early release (in the case of In the STPNOC GSI-191 PRA analysis, the containment failure leading to LOCA) mean values used to evaluate the accep-would occur. tance criteria are probability distributions that come from the propagation of the un-

" Organizational decision making and certainties of the input parameters and those safety culture, for example see Mo-model uncertainties explicitly represented in haghegh [27]. STPNOC has a STPNOC the model. The STPNOC GSI-191 PRA anal-has a continuous safety culture evalua-ysis uses a formal propagation of the uncer-tion program that undergoes continuous tainty to account for any state-of-knowledge improvement and examination.

uncertainties that arise from the use of the With regard to plant operating states, some same parameter values for several basic event can be eliminated from further evaluation. probability models.

23

Enclosure 4 NOC-AE-13002954 3 IMPLEMENTATION AND MONITORING Where epistemic uncertainties have been much of the analysis as possible, uncertain-identified in the STPNOC GSI-191 analysis, ties of input parameters in the traditional they have been either reduced through ex- engineering models are propagated through perimental evidence or bounded through as- the uncertainty quantification of basic events sumption as previously mentioned in Sec- and aggregated (with uncertainty distribu-tion 2.1.2. The STPNOC PRA margin to the tions) for use in PRA basic events or top acceptance criteria guidelines is significant, events. By integrating qualitative insights, providing confidence that any contributor to bounding uncertainties, and quantifying the risk that may have been missed or otherwise uncertainties inherent in engineering mod-not modeled would not make a significant els, the STPNOC GSI-191 PRA analysis is a change to the risk determined in the STP- robust, integrated analysis that can be re-NOC GSI-191 analysis. lied on to accurately evaluate the risk asso-In the STPNOC Pilot Project analysis re- ciated with the concerns raised in GSI-191.

liance on importance measures is not neces- Although the STPNOC GSI-191 PRA analy-sary nor used. The focus of the analysis is to sis relies on a full scope PRA, the analysis is understand the risk associated with the con- specifically focused on the concerns raised in cerns raised in GSI-191 and importance mea- GSI-191. In particular, only the LOCA initi-sures, while useful in evaluations concerned ating events are of concern and the physical with other applications, are not useful in the models are directed at long-term cooling.

STPNOC Pilot Project.

As discussed in Section 2.3, the STPNOC PRA is an integrated-level model that in- 3 Implementation and cludes all internal and external events (refer-ring to Level I and Level II analysis) related Monitoring to the GSI-191 post-LOCA concerns. Care has been taken in the STPNOC GSI-191 PRA to As stated in Section 5, no changes are pro-ensure that all concerns associated with GS1- posed to any programs, processes, or de-191 have been addressed in the analysis. sign with regard to the current as-built, as-operated plant that would result in a sig-nificant reduction to safety margin or DID.

2.6 Integrated decision mak- In particular, no changes are proposed to ing any ASME Section XI inspection programs

[16, 64] or mitigation strategies that have As discussed extensively in Section 2.1, there been shown effective in early detection and are many qualitative insights that form the mitigation of weld and material degradation basis for the conclusion in the STPNOC GSI- in PWR Class I piping applications. STPNOC 191 PRA analysis that there is a very small has adopted other programs that help pro-risk for the concerns associated with GSI-191. vide early detection and mitigation of leak-A significant effort has been expended to ex- age in other applications [17]. Additionally, perimentally and analytically investigate the no changes are proposed to design modifica-risk and uncertainties associated with the tions, processes, or programs that have re-concerns raised in GSI-191. sulted from addressing the concerns related Traditional engineering analysis, which to GSI-191 such as those mentioned in Sec-generally ignores uncertainty, has been en- tion 2.1. In particular, design modifications hanced in the STPNOC GSI-191 PRA analysis that could affect any of these measures is by including parameter uncertainties. In as specifically checked for in any design change 24

Enclosure 4 NOC-AE-13002954 6 DOCUMENTATION

[18, Checklist, Page 38]. 6 Documentation 6.1 Introduction The total technical documentation consists 4 Submittal of Pro- of several volumes, Volume 1, Summary, posed Change Volume 2 PRA, Volume 3, the support-ing engineering analysis, CASA Grande, Vol-ume 4, Quality Assurance, and Volumes 5.1 Proposed changes to the STP UFSAR, based through 5.4, Oversight. Additional documen-on NRC approval of the STPNOC Pilot tation such as the PRA Model Revision 7 and Project and LB 4 2 change to resolve GSI-191, support calculations are also made available are submitted in the attachments to letter through reference. In any case, all documen-NOC-AE-13002954 [6]. tation is available in the STPNOC Records Management program.

6.2 Archival Documentation 5 Quality Assurance Volumes 2 and 3 of the STPNOC GSI-191 li-No design, operational, or performance cense basis change submittal are detailed de-changes are proposed to existing safety re- scriptions of the PRA and supporting engi-lated systems, components, or structures in neering analyses conducted and results ob-this analysis. Existing procedures and pro- tained. The analyses are primarily based on grams are unchanged by this license basis traditional engineering analyses that include change. The STPNOC PRA analysis support- experimental data obtained to specifically ing the licensing basis change is performed support the engineering models and analy-using STPNOC PRA procedure as required ses conducted as part of the licensing basis for PRA analyses and assessments [3]. This is change. The full set of documentation cre-the STPNOC approved methodology for ap- ated for this analysis are maintained as qual-plication evaluations using the PRA. ity documents for the life of plant in the RMS 4 3 and can be retrieved using the fol-The support provided for the STPNOC lowing search fields and keywords:

PRA is performed by personnel qualified in their fields of expertise. All work performed " FSUG: D07090703, in the licensing basis analysis is done follow-ing STPNOC procedures for contract person- " TYPE: VENDREC, and nel. An oversight program, Section 7, is in

" SUBTYPE: GSI191.

effect for the duration of the entire project.

All records and documentation are controlled The STPNOC PRA model of record is also under the STPNOC Document Control and maintained in the RMS according to the nor-Records Management systems. A detailed mal PRA maintenance process and can be re-description of the Quality Assurance pro- trieved using the following search fields and gram supporting the STPNOC Pilot Project keywords:

is provided in Volume 4.

FSUG: D6412, 42 43 Licensing Basis Records Management System 25

Enclosure 4 NOC-AE-1 3002954 6 DOCUMENTATION 6.3 Submittal Documentation

" TYPE: DATA, and " No change to offsite dose or worker radi-ation dose is evaluated to occur. By im-

" DOCUMENT NUMBER:

plementing the proposed licensing basis OPGPO1ZA0305.

change, a large worker radiation dose STPNOC PRA analyses are maintained in the that would be incurred to mitigate a STPNOC RMS. The PRA analysis performed hypothesized event having insignificant for this work can be retrieved using the fol- likelihood is avoided.

lowing search fields and keywords:

" No change to existing DID is proposed.

" FSUG: D64, All equipment, as designed, is expected

" TYPE: ANLYS, and to be available and to continue to func-tion with high probability.

" DOCUMENT NUMBER: PRA13001.

The proposed change is documented in the UFSAR, Chapter 6. No changes are 6.3 Submittal Documenta-proposed to any high-risk equipment.

tion In addition to the items listed above, the fol-The STPNOC proposed license basis change lowing also support consistency with the key is consistent with the key principles of risk-principles of risk-informed regulation and informed regulation and NRC staff expecta-NRC staff expectations:

tions based on the following points:

" The requirements for Long-Term Core " The integrity of the Class 1 welds, pip-Cooling summarized in 10 CFR§50.46 ing, and components are maintained at require the supporting systems to op- a high level of reliability through the erate with a high level of probabil- ASME Section XI inspection program; ity including considerations of uncer-tainty. The licensing basis change re-

The materials stored in Contaimnent, quested quantifies the probability and especially any transient lead, should be uncertainty associated with long-term stored as required by Wire [72]. In ad-core cooling following the requirements dition, plant transients are monitored as described in RG1.174. Based on the in the Transient Cycle Counting Limits evaluation documented in the change Program [48];

request showing that the probability is

" The structural integrity and cleanli-very high that long-term core cooling ness of the Containment Sump Strain-will be satisfied, the impact to the li-censing basis is insignificant. ers is monitored prior to leaving the containment [40, 14]. In particular, any

" The proposed change has no impact condition noted that would result in on existing equipment performance re- direct passage of debris is evaluated quirements or performance assessment through the Station Corrective Action (equipment surveillance) requirements. Program [2] and repaired as neces-For certain extremely low probability sary prior to Containment closeout. The scenarios, when the extreme extent of PRA is maintained to reflect the as-the associated uncertainty is taken into built, as-operated plant as described in account, the analysis shows that core the STPNOC UFSAR, Section 13.7.2.3 damage could occur. to reflect the current plant design not 26

Enclosure 4 NOC-AE-1 3002954 6 DOCUAIIENTATION 6.3 Submittal Documentation to exceed every 36 months and to re- probability distributions. In this way, con-flect the equipment performance (com- tributions of specific issues raised in GSI-191 prehensive data update) not to exceed are encapsulated in familiar models and are 60 months. Unless major modifications therefore more easily scrutinized and under-are made to the containment design stood, especially by investigators more famil-or insulation design, no changes should iar with the engineering models of behavior.

be required to the PRA analysis docu- Since much of the previous investigation into mented in this licensing submittal; the issues raised in GSI-191 was not based on risk methodologies, the STPNOC GSI-191

" Information to be provided as part of analysis method is expected to be familiar the plants LB (e.g., FSAR, technical to the majority of previous GSI-191 investi-specifications licensing condition); gators.

" The GSI-191 PRA analysis is not used to enhance or modify safety-related func-tions of SSCs. The STPNOC GSI-191 STPNOC's PRA complies with Regulatory PRA analysis is controlled under the ex- Guide 1.200, Revision 1, however; it does not isting STPNOC PRA application analy- comply with Regulatory Guide 1.200, Revi-sis and assessment process [3]; and sion 2 with respect to Fire PRA and Seismic PRA requirements. Even though STPNOC's

" There are no other changes to the exist- PRA contains both Fire and Seismic PRAs, ing requirements to any systems, struc- they do not meet all the standards require-tures or components as a consequence ments in the current ASME/ANS RA-S-2009 of this licensing basis change. PRA Standard, as endorsed by RG 1.200, Rev. 2, at a Capability Category II level.

The program used to develop the results PRA model changes since the peer review are of the license basis change included an in- detailed in Volume 4 but are minimal. The dependent critical peer review oversight pro- Findings and Observations from the peer re-cess requiring quarterly reporting and criti- view are also reviewed in Volume 4.

cal review question resolution. A summary of Independent Oversight activities and obser-vations is addressed in Section 7 of this docu-ment. More details including Oversight com- STPNOC's PRA remains technically ade-ments and follow-up resolutions are available quate to evaluate and quantify the risk as-upon request (Independent Technical Over- sociated with the concerns raised in GSI-191.

sight, Quarterly Reports [28, 29, 30, 31]). GSI-191 is concerned with LOCA events and As discussed on Page vii, minimal changes these events are explicitly modeled in the were made to the STPNOC PRA such that STPNOC PRA. STPNOC's PRA does meet a new peer review would not be required. Regulatory Guide 1.200, Revision 2 at Ca-Although detailed models of post-LOCA be- pability Category II for LOCA events. For havior are included in the risk analysis, the the risk-informed GSI-191 methodology de-models are not embedded in the PRA. In- scribed in this study, the technical rigor pro-stead, detailed models of post-LOCA behav- vided to the PRA exceeds that performed ior are solved in an uncertainty quantifica- in PRAs used today and is technically more tion framework outside of the PRA and the than adequate to perform a risk-informed ap-results are supplied to the PRA as discrete plication meeting RG1.174 guidance.

27

Enclosure 4 NOC-AE-13002954 7 INDEPENDENT TECHNICAL OVERSIGHT 7 Independent Techni- NOC Pilot Project. Examples of informal ac-tivities were: (1) reviewing pre-meeting tech-cal Oversight nical reports and documents related to NRC public meetings and providing comments; Since January 2012, Soteria Consultants, (2) providing technical support in develop-LLC (Soteria) has provided Independent ing ACRS presentations, and; (3) participat-Technical Oversight of the STPNOC STP-ing in brainstorming sessions on diverse tech-NOC Pilot Project. STPNOC commissioned nical topical areas with the required follow-the oversight group to help ensure the quality up on the proposed ideas. Some of the for-and validity of the research and development mal Oversight activities included: (1) partic-undertaken. The main objective of Indepen-ipating in weekly technical team teleconfer-dent Technical Oversight has been to per-ences and providing feedback; (2) participat-form an in-depth scientific review of the phe-ing in monthly technical meetings and pro-nomenological models and experiments de-viding comments, and; (3) developing four veloped and conducted for the STPNOC Pilot Oversight Quarterly Reports [28, 29, 30, 31].

Project.

Soteria's approach included both "active" In order to make the review process more and "passive" oversight activities. Two mem- thorough and to enhance the effects and effi-bers of Soteria Consultants (Dr. Zahra Mo- ciency of having an oversight function for the haghegh 44 and Dr. Seyed Reihani 45 ) inter- STPNOC Pilot Project, Soteria asked the tech-acted and collaborated with the technical nical team members to provide responses re-teams to provide feedback and to offer active garding each of Soteria's specific comments.

oversight services. Since the project involved The main objectives of Oversight Quar-new research, and because of its multidisci- terly Reports were to: (1) analyze, the re-plinary and integrative nature, it required sponses that Soteria had received from the the oversight group to participate in meet- members of the teams regarding oversight ings and to follow up on discussions and com- comments. The teams' responses were doc-ments with the other team members. Specific umented along with Soteria's responses, res-areas of concerns and reviews were also dis- olutions, and feedback on the unresolved is-cussed with Soteria's associate experts (that sues; (2) provide an up-to-date report of So-is, passive oversight members) including Dr. terias activities during the quarter; (3) com-Ali Mosleh 46 and Dr. Reza Kazemi47 municate additional comments based on the Soteria was involved in both "informal" review of recent reports and participation in and "formal" oversight activities for the STP- the technical meetings and teleconferences, 44 and; (4) facilitate the interaction and col-From Janary 2013, Assistant Professor in laboration of the oversight team with mem-Nuclear Eng. Department at the University of bers of other technical teams. The Over-Illinois at Urbana Champaign.

45 From January 2013, Research Scientist in sight Quarterly Reports contributed to the Nuclear Eng. Department at the University of progress of the project by addressing critical Illinois at Urbana Champaign. peer review of the documents and by high-46 Also, Professor of Mechanical Eng. Depart- lighting an up-to-date elaboration of areas ment at the University of Maryland, College of concern that required further investigation Park. from the technical teams.

47 Also, Operations Research Analyst at the FDA (Individual's opinion and input to this From Soteria's perspective, the STPNOC project are his own personal views and do not Pilot Project is an outstanding blend of ad-reflect in any way that of the FDA). vanced and conventional methods that not 28

Enclosure 4 NOC-AE-1 3002954 7 INDEPENDENT TECHNICAL OVERSIGHT only contributes towards the closure of the GSI-191 issues, but also makes a significant contribution to the formal incorporation of underlying physical failure mechanisms of certain post-LOCA events into PRA. Soteria's oversight activities have concluded that the STPNOC Pilot Project, having a well-designed combination of probabilistic and determinis-tic methodologies, has made important con-tributions to the closure of GSI-191 issues.

The detailed technical results of Soteria's critical reviews are available in the four Over-sight Quarterly Reports [28, 29, 30, 31].

In addition to reviewing the various work-ing documents and analyses in FY 2012, Soteria has been reviewing Volumes 1, 2, 3, and 4 of the submittals and their sup-porting documents. The members of tech-nical teams (that is, PRA GSI-191 Analy-sis & Methodology Implementation; GAMI, Corrosion/Head Loss Experiments; CHLE, CASA Grande, Thermal Hydraulics; TH, Un-certainty Quantification; UQ, and Jet For-mation; JF) have responded to and imple-mented the majority of Soteria's comments.

Some specific comments (e.g., related to ver-tical head-loss tests and blender bed tests, etc.) have not yet been implemented, mainly due to time and budget constraints. The plan is to address these along with NRC's addi-tional comments in FY 2013. The four Over-sight Quarterly Reports [28, 29, 30, 31] in-clude the resolution status of Soteria's com-ments.

Because of the large-scale nature of the STPNOC Pilot Project, Soteria believes that follow-up research, implementation, and ex-periments in FY 2013 would certainly im-prove the quality and validity of the project.

During FY 2013, Soteria team members, who have joined the academic staff of the University of Illinois at Urbana Champaign, will continue the technical oversight function during ongoing technical work and the NRC review process.

29

Enclosure 4 NOC-AE-1 3002954 8 ACRONYMS 8 Acronyms CAD Computer Aided Design a computer aided design model STPNOC is using to rep-resent the containment buildings that includes piping welds and insulation details in order to help accurately assess ablated materials following an hypothesized LOCA.

CASA Grande Containment Accident Stochastic Analysis (CASA) and Grande referring to the STPNOC large, dry containment the framework used to perform the computer-ized uncertainty quantification (sampling of distributions, propagating uncertainties) to develop basic events that address the issues raised in GSI-191.

ccdf Complementary cumulative distribution function as normally defined: F(x) = 1 -

f %. f(t)dt.

CDF Core Damage Frequency STPNOC calculates core damage frequency using the STP-NOC PRA.

cdf Cumulative distribution function as normally defined: F(x) = f o f(t)dt.

CLB Cold Leg Break is a failure in the RCS piping between the steam generator cold leg nozzle and the reactor vessel cold leg nozzle.

CS Containment Spray System a part of the STP Engineered Safety Systems and consists of three trains (Trains A, B, and C). Only two Containment Spray trains are required to meet the system's spray flow requirements. The STPNOC Containment spray does not pass through the RHR heat exchanger.

DEGB Double-Ended Guillotine Break is a hypothetical condition that can be realized mathematically whereby a pipe instantaneously shears around its circumference and in the same instantaneous time, completely offsets such that the jets from each end of the shear plane can't interfere with each other.

DID Defense-in-Depth is the design concept that includes redundant and/or multiple bar-riers to a particular consequence.

ECCS Emergency Core Cooling System part of the STPNOC engineered safety features.

Foid Void Fraction is the liquid vapor fraction just downstream of the ECCS strainer.

GL 2004-02 NRC Generic Letter 2004-02 was issued in response to the concerns raised in GSI-191 for PWRs.

GSI-191 Generic Safety Issue 191 the NRC Generic Safety Issue number 191.

HHSI High Head Safety Injection a part of the ECCS. The STPNOC plants have three HHSI trains (Trains A, B, and C) that can provide ECCS flow at pressures up to around 1600 psi.

HLB Hot Leg Break is a failure in the RCS piping between the steam generator hot leg nozzle and the reactor vessel hot leg nozzle including the Pressurizer (D Loop).

30

Enclosure 4 NOC-AE-1 3002954 8 ACRONYMS LB Licensing Basis is the collection of commitments and requirements that licensee makes to the regulatory authority (in this case, the NRC) over the course of time.

LERF Large Early Release Frequency STPNOC calculates large early release frequency using the STPNOC PRA.

LHS Latin Hypercube Sampling is a method used in uncertainty quantification to sample a distribution as efficiently as possible while preserving the variability.

LHSI Low Head Safety Injection part of the ECCS. The STPNOC plants have three LHSI trains (Trains A, B, and C) that can provide ECCS flow at pressures up to around 400 psi. The LHSI train is the only ECCS train that uses the RHR heat exchangers for decay heat removal.

LLOCA Large Break Loss of Coolant Accident a hypothetical instantaneous pressure boundary failure that is defined for STPNOC as greater than 6 inch equivalent di-ameter.

LOCA Loss of Coolant Accident a hypothetical instantaneous pressure boundary failure.

MLOCA Medium Break Loss of Coolant Accident a hypothetical instantaneous pressure boundary failure that is defined for STPNOC as greater than 2 inch equivalent diameter but less than 6 inch equivalent diameter.

NLHS Nonuniform Latin Hypercube Sampling is the stratified LHS scheme that divides the cumulative probability into into unequal segments that are (each) randomly sampled to form a sample design matrix.

NPSHA Net Positive Suction Head Available is the total pressure at the eye of the pump impeller. As long as the net positive suction head available is higher then the net positive suction required, the pump will have sufficient pressure at the impeller inlet to operate without cavitation.

NPSHR Net Positive Suction Head Required is the total pressure at the eye of the pump impeller required for the pump to operate properly, without excessive cavitation.

NSSS Nuclear Steam Supply System the nuclear reactor, piping, pumps, steam genera-tors, pressurizer, and auxiliary equipment associated with operation and control of the reactor system.

STPNOC Pilot Project STPNOC Risk-Informed GSI-191 Closure Pilot Project. The NRC works with licensees as they develop methods to address new regulatory ap-proaches. STPNOC requested and was granted Pilot Project status for the methodol-ogy for closing GSI-191 using Option 2b Pbuckle Strainer mechanical failure limit is the differential pressure across the ECCS strainers at which they are analyzed to suffer mechanical damage. The failure limit is approxi-mately 9.35 ftWC.

pdf Probability density function is a differential function having units of "# per unit x" as in, "probability per inch of break size."

31

Enclosure 4 NOC-AE-1 3002954 8 ACRONYMS PHSA Probabilistic Seismic Hazard Analysis is the probabilistic study of seismic events on systems, structures, and components to obtain failure likelihoods.

PRA Probabilistic Risk Assessment the STPNOC PRA is the platform for all quantitative risk assessment licensing activities at STPNOC. The current model (Model of Record) is Revision 7.

PWR Pressurized Water Reactor. The STPNOC site consists of two, four loop, approxi-mately 3800 MWth, Westinghouse Nuclear Steam Supply System reactors.

PWSCC Primary Water Stress Corrosion Cracking is a degradation mechanism for certain types of weld materials, especially Alloy 600.

RCFC The Reactor Containment Fan Coolers a part of the STP Engineered Safety Systems and consist of three trains (Trains A, B, and C).

RCS Reactor Coolant System the STPNOC reactor coolant system is a four loop Westing-house design RG1.174 Regulatory Guide 1.174 is a regulatory guidance document that describes the overall methodology to quantify risk using the PRA together with deterministically-based criteria to evaluate the acceptability of a particular change. The quantitative risk measures are CDF and LERF. The risk is deemed to be "very small" when the change increases CDF less than 10-6 and the LERF less than 10-7.

RHR Residual Heat Removal System a shutdown cooling system consisting of three inde-pendent trains. The RHR heat exchangers are shared with the LHSI train. If the LHSI train is using the heat exchanger for that train, the RHR train must be secured and vice versa.

RM1II Reflective Metal Insulation is a fitted, rigid insulation that uses metal radiation heat shields and dead air space to reduce heat loss.

RMS Records Management System is the STPNOC document storage and retrieval system meeting the requirements of Regulatory Guide 1.33, Revision 2, Quality Assurance Program Requirements (Operation).

RMTS Risk Managed Technical Specifications the allowed outage time for risk significant equipment derived from the configuration risk during the outage time.

RWST Refueling Water Storage Tank the STPNOC reactor water storage tank holds ap-proximately 500,000 gallons of water borated to the all rods out, xenon free boron concentration, approximately 2800 ppm.

SLOCA Small Break Loss of Coolant Accident a hypothetical instantaneous pressure boundary failure that is defined for STPNOC as less than 2 inch equivalent diame-ter and greater than 1/2 inch equivalent diameter.

STP South Texas Project electric generating station is the two commercial nuclear electric generating units located near Wadsworth, TX.

32

Enclosure 4 NOC-AE-1 3002954 8 ACRONYMS STPNOC The STP Nuclear Operating Company is the organization responsible for the safe and efficient operation of the South Texas Project electric generating station.

ZOI Zone of Influence refers to the enclosed volume where damage to materials is hypoth-esized or assumed to occur. The damage assumed is from the energetic jet associated with the hypothesized instantaneous failure of Class 1 piping in the containment build-ing.

33

Enclosure 4 NOC-AE-13002954 9 REFERENCES 9 References

[1] Ballew, D., W. Gurecky, and E. Schneider (2012, November). Flashing Free Jet Analysis.

Internal Report Revision 0, The University of Texas at Austin, Austin, TX.

[2] Billings, D. (2012). Condition Reporting Process. South Texas Project Plant Procedure, OPGP03-ZX-0002.

[3] Billings, M. A. (2010a, August). PRA Analyses/Assessments. South Texas Project Plant Procedure, OPGP05-ZE-0001.

[4] Billings, M. A. (2010b, September 23). South Texas Project Plant Procedure, OPGP01-ZA-0305. STP Procedure OPGP01-ZA-0305, PRA Model Maintenance and Update.

Procedure used to update and maintain the STPNOC PRA model of record.

This procedure also directs application support for STPNOC Risk applications (for example, RMTS, Graded Quality Assurance, 10CFR50.69 Exemption re-quirements)

[5] Crenshaw, J. W. (2012, January). Summary of GSI-191 Risk-Informed Closure Pilot Project 2011: Initial Quantification. Letter from J.W. Crenshaw, Vice President Special Projects to USNRC Document Control Desk.

A summary of South Texas Project's methodology towards a risk-informed resolution of GSI-191 is provided as an enclosure to the letter.

[6] Crenshaw, J. W. (2013, January 31). STP Pilot Submittal and Request for Partial Exemption for a Risk-Informed Approach to Resolve Generic Safety Issue (GSI)-191 (TAC Nos. MF0440 and MF0441). Letter dated January 31, 2013, John Crenshaw, STPNOC, to NRC Document Control Desk.

[7] Dallman, J., B. Letellier, J. Garcia, J. Madrid, W. Roeschy, D. Chen, K. Howe, L. Archuleta, F. Sciacca, and B. P. Jain (2006, December). Integrated Chemical Ef-fects Test Project: Consolidated Data Report. NUREG/CR 6914, Los Alamos National Laboratory, Los Alamos, NM.

[8] Darby, J., D. V. Rao, and B. Letellier (2000). GSI-191 STUDY: TECHNICAL AP-PROACH FOR RISK ASSESSMENT OF PWR SUMP-SCREEN BLOCKAGE. Tech-nical Letter Report LA-UR-00-5186, Los Alamos National Laboratory, Los Alamos, NM.

[9] Diaz, A. (2012, April 17). Federal Register Notice Regarding the Meeting of the ACRS Subcommittee on Thermal Hydraulic Phenomena, May 8-9, 2012, Rockville, Maryland.

Memorandum.

Presentations and discussions with the ACRS subcommittee on the Risk-Informed approach for closing GSI-191. Proceeding transcript title: "Advisory Committee on Reactor Safeguards Subcommittee Open Session", Location:

Rockville, Maryland, Date: WVednesday, May 9, 2012, Work Order Number:

NRC-1609, Neal R. Gross 34

Enclosure 4 NOC-AE-1 3002954 9 REFERENCES

[10] Dyer, J. E. (2011, April). Pilot Project Request, ST-AE-11002079, STI 32860124.

Letter from J. E. Dyer to A. W. Harrison.

Pilot Project status granted to STP for developing a Risk-Informed closure approach to GSI-191

[11] Eide, S., T. Wierman, C. Gentillon, D. Rasmuson, and C. Atwood (2007, February).

Industry-Average Performance for Components and Initiating Events at U.S. Commer-cial Nuclear Power Plants. Technical Report NUREG/CR 6928, NRC, Washington, DC 20555-0001.

[12] EPRI (2008). Risk-Managed Technical Specifications - Lessons Learned from Initial Application at South Texas Project. TR 101672, Electric Power Research Institute, Palo Alto, CA.

[13] Fleming, K. N., B. 0. Lydell, and D. Chrun (2011, October). Development of LOCA Initiating Event Frequencies for South Texas Project GSI-191. Technical report, KnF Consulting Services, LLC, Spokane, WA.

[14] Flynn, C. (2011). Inspection of Containment Emergency Sumps and Strainers Unit #1 1-A, 1-B, 1-C Unit #2 2-A, 2-B, 2-C. South Texas Project Plant Procedure, OPSP04-XC-0001.

[15] Galenko, A., D. Morton, E. Popova, E. Kee, D. Richards, and A. Sun (2005, Septem-ber). Operational Models and Methods for Risk Informed Nuclear Asset Management.

In Proceedings of the 2005 ANS International Topical Meeting on Probabilistic Safety Analysis, PSA05.

[16] Heil, J. (2011, March 23). Boric Acid Corrosion Control Program. South Texas Project Plant Procedure, OPGP03-ZE-0133.

[17] Heil, J. (2012, October 20). RCS Pressure Boundary Inspection for Boric Acid Leaks.

South Texas Project Plant Procedure, OPGP03-ZE-0033.

[18] Howard, C. K. (2012, February 21). Design Change Package. South Texas Project Plant Procedure, OPGP04-ZE-0309.

[19] Kee, E. and E. Popova (2010, November). Risk Applications in Commercial Nuclear Power, Chapter 2, pp. 26-61. INFORMS TutORials in Operations Research. Hanover, MD: Risk and Optimization in an Uncertain World.

[20] Kee, E., S. Rodgers, F. Yilmaz, P. Nelson, P. Rodi, V. Moiseytseva, and C. Gilmore (2012, July). Probability of Critical Station Blackout via Computational Evaluation of Nonrecovery Integrals. In Proceedings of the 20th International Conference on Nuclear Engineering (in print), Number 2012-54569 in ICONE.

[21] Kee, E., A. Sun, A. Richards, J. Liming, J. Salter, and R. Grantom (2004, March).

Using risk-informed asset management for feedwater system preventative maintenance optimization. Journal of NUCLEAR SCIENCE and TECHNOLOGY 41(3), 347-353.

35

Enclosure 4 NOC-AE-13002954 9 REFERENCES

[22] Kee, E. and F. Yilmaz (2010, June). Estimating and Presenting Transient Risk for On-Line Maintenance Using the STP Balance of Plant Model. In Probabilistic Safety Assessment Meeting 2010, Seattle, WA, June 7-11, PSAM10. Probabilistic Safety As-sessment Meeting: PSAM.

[23] Lane, A. E., T. Andreychek, W. A. Byers, R. J. Jacko, E. J. Lahoda, and R. D. R. and (2011, February). Evaluation of Post-Accident Chemical Effects in Containment Sump Fluids to Support GSI-191. WCAP 16350, Westinghouse Electric Company, Pittsburgh, PA.

[24] Letellier, B. (2011). Risk-Informed Resolution of GSI-191 at South Texas Project.

Technical Report Revision 0, South Texas Project, Wadsworth, TX.

[25] Liming, J. and E. Kee (2002, April). Integrated Risk-Informed Asset Management for Commercial Nuclear Power Stations. In Proceedings of the 10th International Conference on Nuclear Engineering, Number 10-22033 in ICONE.

[26] Liming, J. K., E. J. Kee, and G. G. Young (2003, April). Practical application of deci-sion support metrics for power plant risk-informed asset management. In Proceedings of the 11th International Conference on Nuclear Engineering, April 20-23, Tokyo, JAPAN.

[27] Mohaghegh, Z. (2009, March). Socio-Technical Risk Analysis. VDM Verlag.

Discusses how cultural effects such perception of safety of workers, manage-ment communication of safety, etc., can be integrated into a "classic PRA".

[28] Mohaghegh, Z. and S. A. Reihani (2012a, April 14). 1 st Oversight Quarterly Report for STP Risk-Informed Approach to NRC Generic Safety Issue 191 (GSI-191). Quarterly Oversight Report 1, SOTERIA Consultants, LLC, Boston, MA.

[29] Mohaghegh, Z. and S. A. Reihani (2012b, July 11). 2 nd Oversight Quarterly Report for STP Risk-Informed Approach to NRC Generic Safety Issue 191 (GSI-191). Quarterly Oversight Report 2, SOTERIA Consultants, LLC, Boston, MA.

[30] Mohaghegh, Z. and S. A. Reihani (2012c, October 14). 3 rd Oversight Quarterly Report for STP Risk-Informed Approach to NRC Generic Safety Issue 191 (GSI-191). Quarterly Oversight Report 3, SOTERIA Consultants, LLC, Boston, MA.

[31] Mohaghegh, Z. and S. A. Reihani (2013, January 24). 4 th Oversight Quarterly Report for STP Risk-Informed Approach to NRC Generic Safety Issue 191 (GSI-191). Quarterly Oversight Report 4, SOTERIA Consultants, LLC, Boston, MA.

[32] Moiseytseva, V. E. and E. Kee (2004, April). Using RIAM for Optimizing Reactor Vessel Head Leak Failure Mode Maintenance Strategies. In Proceedings of the 12th In-ternational Conference on Nuclear Engineering,Number 12-49376 in ICONE.

[33] National Research Council (1997). Review of Recommendations for ProbabilisticSeis-mic Hazard Analysis:Guidance on Uncertainty and Use of Experts. Panel on Seismic Hazard Evaluation, Committee on Seismology, Commission on Geosciences, Environment, 36

Enclosure 4 NOC-AE-1 3002954 9 REFERENCES and Resources, National Research Council. Washington, DC: The National Academies Press.

[34] NEI (2004, May). Pressurized Water Reactor Sump Performance Evaluation Method-ology. Technical Report 04-07, Nuclear Energy Institute, 1776 I Street, Washington, DC.

[35] NEI (2009). ECCS Recirculation Performance Following Postulated LOCA Event:

GSI-191 Expected Behavior. White Paper.

[36] Nuclear Regulatory Commission (2007, January). AN APPROACH FOR DETER-MINING THE TECHNICAL ADEQUACY OF PROBABILISTIC RISK ASSESSMENT RESULTS FOR RISK-INFORMED ACTIVITIES. Regulatory Guide 1.200, Nuclear Reg-ulatory Commission, WVashington, DC.

[37] Nuclear Regulatory Commission (2009, March). AN APPROACH FOR DETERMIN-ING THE TECHNICAL ADEQUACY OF PROBABILISTIC RISK ASSESSMENT RE-SULTS FOR RISK-INFORMED ACTIVITIES. Regulatory Guide 1.200, Nuclear Regu-latory Commission, Washington, DC.

[38] Nuclear Regulatory Commission (2011, May). REGULATORY GUIDE 1.174 An Ap-proach for Using Probabilistic Risk Assessment In Risk-Informed Decisions On Plant-Specific Changes to the Licensing Basis, Revision 2. Regulatory Guide 1.174, Nuclear Regulatory Commission, Washington, DC.

[39] Nuclear Regulatory Commission (2012, July). CLOSURE OPTIONS FOR GENERIC SAFETY ISSUE - 191, ASSESSMENT OF DEBRIS ACCUMULATION ON PRESSURIZED-WATER REACTOR SUMP PERFORMANCE. Letter (SECY) 12-0093, Nuclear Regulatory Commission, Washington, DC.

[40] Page, M. (2010). Initial Containment Inspection to Establish Integrity. South Texas Project Plant Procedure, OPSP03-XC-0002.

[41] Popova, E. and A. Galenko (2011, December). Uncertainty Quantification (UQ) Meth-ods, Strategies, and Illustrative Examples Used for Resolving the GSI-191 Problem at South Texas Project. Technical Report Revision 0, The University of Texas at Austin, Austin, TX.

[42] Popova, E. and D. Morton (2012, May). Uncertainty modeling of LOCA frequencies and break size distributions for the STP GSI-191 resolution. Technical report, The University of Texas at Austin, Austin, TX.

[43] Rodgers, S. S., C. D. Betancourt, E. Kee, F. Yilmaz, and P. Nelson (2011). Integrated Power Recovery Using Markov Modeling. ASME Journal of Engineering for Gas Turbines and Power Volume 133.

[44] Rodgers, S. S. and R. F. Dunn (2012, August 30). PRA Reference Model Update From STP Rev. 6 to STP Rev. 7. Procedure OPGP01-ZA-0305, Rev. 9 STI 33590701, STPNOC Risk Management, STPNOC, PO Box 289, Wadsworth, TX 77414.

37

Enclosure 4 NOC-AE-1 3002954 9 REFERENCES References the documentation set for the STPNOC PRA Revision 7 released in 2012.

[45] Rosenburg, S. (2011, January). PUBLIC MEETING WITH THE NUCLEAR EN-ERGY INSTITUTE ON STATUS AND PATH FORWARD TO RESOLVE GSI-191.

Memorandum.

[46] Sande, T., K. Howe, and J. Leavitt (2011, October). Expected Impact of Chemical Effects on GSI-191 Risk-Informed Evaluation for South Texas Project. White Paper ALION-REP-STPEGS-8221-02, Revision 0, Jointly, Alion Science and Technology and Univiersity of New Mexico, Albuquerque, NM.

White paper developed in anticipation of the STPNOC GSI-191 chemical ef-fects experimental program. Actual amounts of corrosion materials in the plant and preliminary hypotheses are developed.

[47] Schneider, E., J. Day, and W. Gurecky (2011, December). Simulation Modeling of Jet Formation Progress Report, August - December 2011. Internal Report Revision 0, University of Texas at Austin, Austin, TX.

[48] Shojaei, S. (2010). Transient Cycle Counting Limits. South Texas Project Plant Procedure, 0PEP02-ZE-0001.

[49] Singal, B. K. (2011a, June). FORTHCOMING CONFERENCE CALL WITH STP NUCLEAR OPERATING COMPANY (TAC NOS. ME5358 and ME5359). Memoran-dum.

Initial meeting on the STPNOC overall approach to risk-informed slolution to GSI-191. Overviews of the PRA approach, treatment of LOCA frequen-cies, thermal-hydraulics, jet formation, and downstream effects. The licensing strategy was presented as well (DRAFT Exemption request language).

[50] Singal, B. K. (2011b, July). FORTHCOMING CONFERENCE CALL WITH STP NUCLEAR OPERATING COMPANY (TAC NOS. ME5358 and ME5359). Memoran-dum.

Follow-up discussion to the public meeting held on June 2, 2011, between STP Nuclear Operating Company (STPNOC) and the U.S. Nuclear Regula-tory Commission (NRC) staff to discuss Generic Safety Issue (GSI) 191, "As-sessment of Debris Accumulation on PWR (Pressurized-Water Reactor])Sump Performance." At the June 2 nd meeting, STPNOC discussed a risk-informed GSI-191 resolution option approach regarding Texas Project, Units 1 and 2.

[51] Singal, B. K. (2011c, May). FORTHCOMING MEETING WITH STP NUCLEAR OPERATING COMPANY (TAC NOS. ME5358 and ME5359). Memorandum.

[52] Singal, B. K. (2011d, August). FORTHCOMING MEETING WITH STP NUCLEAR OPERATING COMPANY (TAC NOS. ME5358 and ME5359). Memorandum.

38

Enclosure 4 NOC-AE-1 3002954 9 REFERENCES Overview of the CASA Grande calculation flow starting with a loss-of-coolant accident to sump screen performance. Discussion of computational fluid dy-namics verification plans.

[53] Singal, B. K. (2011e, October). FORTHCOMING PUBLIC MEETING VIA CONFER-ENCE CALL WITH STP NUCLEAR OPERATING COMPANY (TAC NOS. ME5358 and ME5359). Memorandum.

Meeting to discuss the topic of Loss-of-Coolant Accident (LOCA) Initiating Event Frequencies and Uncertainties. These discussions were related to the initial approach which we have come to refer to as the "bottom up" approach.

[54] Singal, B. K. (2011f, September). FORTHCOMING PUBLIC MEETING VIA CON-FERENCE CALL WITH STP NUCLEAR OPERATING COMPANY (TAC NOS.

ME5358 and ME5359). Memorandum.

[55] Singal, B. K. (2011g, November). FORTHCOMING PUBLIC MEETING VIA CON-FERENCE CALL WITH STP NUCLEAR OPERATING COMPANY (TAC NOS.

ME5358 and ME5359). Memorandum.

Initial plans and protocol for integrated chemical effects testing. This testing described would be performed in 2012.

[56] Singal, B. K. (2012a, November 27). FORTHCOMING PUBLIC MEETING VIA CONFERENCE CALL WITH STP NUCLEAR OPERATING COMPANY (TAC NOS.

ME5358 and ME5359). Memorandum.

Chemical effects testing, Coatings, Texas A&M bypass test follow up, Bump-up factor, and non-chemical head loss testing.

[57] Singal, B. K. (2012b, January). FORTHCOMING PUBLIC MEETING VIA CON-FERENCE CALL WITH STP NUCLEAR OPERATING COMPANY (TAC NOS.