ML18136A866

License Amendment Request: Vital Instrument Bus Inverter Allowed Outage Time (AOT) Extension

ML18136A866
Person / Time
Site:	Salem
Issue date:	05/16/2018
From:	Mcfeaters C Public Service Enterprise Group
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
LAR S18-02, LR -N18-0033
Download: ML18136A866 (156)

Text

{{#Wiki_filter:PSEG Nuclear LLC P.O. Box 236, Hancocks Bridge, New Jersey 08038-0236 PSEG Nuclear LLC 10 CFR 50.90 LR-N18-0033 LAR S18-02 MAY l6 '2018 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D.C. 20555-0001 Sale Generating Station, Units 1 and 2 Renewed Facility Operating License Nos. DPR-70 and DPR-75

                    )

NRC Docket Nos. 50-272 and 50-311 * .

Subject:

License Amendment Request: Vital Instrument Bus Inverter Allowed Outage Time (AOT) Extension In accordance with 10 CFR 50.90, PSEG Nuclear LLC (PSEG) hereby requests an amendment to Renewed Facility Operating License No. DPR-70 and DPR-75 for Salem Generating Station (Salem) Units 1 and 2. This license amendment request proposes changes to Technical Specification (TS) 3.8.2.1, "A.C. Distribution - Operating." The proposed change would increase the Vital Instrument Bus (VI B) Inverters allowed outage time (AOT) from 24 hours for the A, B and C inverters to 7 days and from 72 hours for the D inverter to 7 days. The proposed extended AOT is based on application of the Salem Probabilistic Risk Assessment (PRA), and on additional considerations and compensatory actions. The risk evaluation and deterministic engineering analysis supporting the proposed change have been developed in accordance with th guidelines established in NRC Regulatory Guide 1.177, "An Approach for Plant-specific Risk-Informed Decisionmaking: Technical Specifications," and NRC Regulatory Guide 1.174, "An Approach for using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis." The proposed change will allow increased flexibility in the scheduling and performance of corrective maintenance, allow better control and allocation of resources, and reduce the potential for unplanned plant shutdowns. 95-2168 REV. 7/99

      \

MAY 16.2018 10 CFR 50.90 Page 2 LR-N18-0033 PSEG's technical and regulatory evaluation of this LAR and the TS change are provided in an enclosure to this letter which includes the supporting risk-informed evaluation of the proposed change. The proposed change has been evaluated in accordance with 10 CFR 50.91(a)(1}, using the criteria in 10 CFR 50.92(c}, and it has been determined that this request involves no significant hazards considerations. There are no regulatory commitments contained in this letter. PSEG requests N RC approval of the proposed License Amendment within one year of submittal acceptance to be implemented within 60 days of issuance. In accordance with 10 CFR 50.91(b)(1), a copy of this request for amendment has been sent to the State of N ew Jersey. If you have any questions or require additional information, please contact Mr. Lee Marabella at (856) 339-1208. I declare under penalty of perjury that the foregoing is true*and correct. __;;.s- /J_l 6_1._1-=1 Executed on _(Date) ___ Charles V. McFeaters Site Vice President Salem Generating Station

Enclosure:

Request for Changes to Technical Specifications C. Administrator, Region I, N RC Project Manager, N RC N RC Senior Resident Inspector, Salem Mr. P. Mullig an, Chief, N JBNE Mr. L. Marabella, Corporate Commitment Tracking Coordinator Mr. T. Cachaza, Salem Commitment Tracking Coordinator

LR-N18-0033 LAR S18-02 Enclosure Request for Changes to Technical Specifications

LR-N18-0033 LAR S18-02 Enclosure SALEM GENERATING STATION UNITS 1 AND 2 RENEWED FACILITY OPERATING LICENSE NOs. DPR-70 AND DPR-75 NRC DOCKET NOs. 50-272 AND 50-311 License Amendment Request: Inverter Allowed Outage Time (AOT) Extension Table of Contents 1.0

SUMMARY

DESCRIPTION ....................................................................................... 2 2.0 DETAILED DESCRIPTION....................................................................................... 2 2.1 System Design and Operation........................................................................... 2 2.2 Current Technical Specifications Requirement .................................................. 7 2.3 Reason for the Proposed Change ..................................................................... 7 2.4 Description of the Proposed Change ............................................................... 10

3.0 TECHNICAL EVALUATION

.................................................................................... 10 3.1 Deterministic Assessment ............................................................................... 10 3.1.1 Defense in Depth .................................................................................. 10 3.1.2 Safety Margin ........................................................................................ 13 3.2 Risk Assessment............................................................................................. 13 3.2.1 PRA Quality and Technical Adequacy ................................................... 14 3.2.2 Probabilistic Risk Assessment Results .................................................. 25 3.2.3 External Event Considerations .............................................................. 32 3.2.4 Uncertainty Evaluations ........................................................................ 45 3.2.5 Tier 2 - Avoidance of Risk - Significant Plant Configurations ............... 55 3.2.6 Tier 3 - Risk-informed Configuration Management ............................... 55 3.2.7 Risk Summary and Conclusion ............................................................. 57

4.0 REGULATORY EVALUATION

............................................................................... 61 4.1 Applicable Regulatory Requirements/Criteria................................................... 61 4.2 Precedent........................................................................................................ 62 4.2.1 License Amendments ......................................................................... 62 4.2.2 Notices Of Enforcement Discretion .................................................... 63 4.3 No Significant Hazards Consideration Analysis ............................................... 63 4.4 Conclusion ...................................................................................................... 65

5.0 ENVIRONMENTAL CONSIDERATION

.................................................................. 65

6.0 REFERENCES

....................................................................................................... 66 ATTACHMENTS:

1. Technical Specification Page Markups

2. PRA Standard Supporting Requirements

3. Simplified Drawing of Typical Inverter LR-N18-0033 LAR S18-02 Enclosure 1.0

SUMMARY

DESCRIPTION This license amendment request proposes a change which would revise Salem Technical Specification (TS) ACTION 3.8.2.1.b concerning inoperable Vital Instrument Bus (VIB) Inverters. The proposed change would increase the VIB Inverters allowed outage time (AOT) from 24 hours to 7 days for the A, B and C inverters and from 72 hours to 7 days for the D inverter. The proposed change is based on application of the Salem Generating Station (Salem) Probabilistic Risk Assessment (PRA) in support of a risk-informed extension, and on additional considerations and compensatory actions. 2.0 DETAILED DESCRIPTION 2.1 System Design and Operation The safety related 115V A.C. instrument and control power system is divided into four independent power supply channels (A, B, C, and D) for each unit, designed to provide reliable uninterrupted source of power for reactor control instrumentation, reactor protection instrumentation and safety-related equipment. Each channel supplies its associated safety related electrical load group. Vital instrument bus loads are assigned to load groups such that a loss of any one vital instrument bus will not will prevent the operation of the required safety systems during a postulated design basis event. Each of the four 12kVA 115V A.C. vital instrument buses in each unit receives power from its own individual Uninterruptible Power Supply (UPS). Each UPS consists of a rectifier which converts normal source A.C. power from the vital 230V A.C. bus to 125V D.C., and a static inverter which then converts power from D.C. to A.C. In the event of a 230V A.C. power loss or a UPS rectifier malfunction, the corresponding 125V D.C. vital station battery will automatically supply power to the UPS Inverter via the UPS auctioneering circuit, to maintain uninterruptible A.C. output power. Each UPS also contains a 12kVA A.C. Line Regulator and Static Switch that receives Alternate Power Source, vital 230V A.C. power, from the same normal source vital 230V A.C. bus. In the event of a UPS Inverter malfunction, the Static Switch senses a loss of Inverter output voltage and automatically fast transfers the associated vital instrument bus loads to the A.C. Line Regulator 115V A.C. output. When the UPS Inverter voltage returns to normal, the Static Switch will automatically return the associated vital instrument bus loads to the Inverter output. The following table depicts channel designations for each vital instrument bus power feed. A simplified drawing of a typical inverter is provided in Attachment 3. Battery Feed to 230V A.C. Normal 230V A.C. Alternate Power Supply Power Source Power Source No. 1A Vital Bus A A A No. 1B Vital Bus B B B No. 1C Vital Bus C C C No. 1D Vital Bus B B B LR-N18-0033 LAR S18-02 Enclosure Loss of Vital Instrument Bus With a VIB UPS inverter inoperable, the 115V A.C. vital instrument bus is energized from the vital 230V A.C. bus via the A.C. line regulator. In the event of a loss of offsite power (LOP), the affected vital instrument bus will experience a loss of power. Safety function would not be lost as redundant equipment would be available with only one VIB de-energized. The associated EDG can be manually started and loaded in accordance with existing operating procedures if required to restore power. TS 3.8.2.1 Action b requires the vital instrument bus to be energized within 8 hours or to be in at least HOT STANDBY within the next 6 hours. A detailed description of the actions which the operators are directed to perform for the loss of each vital A.C. instrument bus is provided below. Abnormal operating procedures S1(2).OP-AB.115-0001(0002)(0003)(0004), Loss of 1(2)A(B)(C)(D) Vital Instrument Bus are the primary governing procedures for addressing this abnormal condition. Operator actions would focus on mitigating the transient effects, entering the applicable TS Action Statements and coordinating with Maintenance personnel on the restoration of the inverter. Attachments to these procedures provide a description of the effects on the loss of that inverter and the significant effects are summarized below. Unit 1 component designations are used. The principal loss of vital instrument bus effects are listed in the table below: Components/Functions Affected by Loss of Vital Instrument Bus A B C D Associated Solid State Protection System (SSPS) Trains A & B Input X X X X Relays Associated Safeguards Equipment Controller (SEC) Power Supply X X X Associated Source Range (SR), Intermediate Range (IR) Nuclear X X Instrumentation (NI) Associated Power Range (PR) NI X X X X Emergency Diesel Generator (EDG) Volt, Amp, Watt, and Frequency X X X SSPS Train A Power Supply X X SSPS Train B Power Supply X X SSPS Train A Output Relays X SSPS Train B Output Relays X Steam Dump Train A X Steam Dump Train B X Control rods automatic insertion X Auto/manual rod withdrawal blocked X X X Auto/manual rod motion not available X Loss of CFCU instrumentation X X X Auxiliary Feedwater (AFW) Steam Generator inlet valves fail closed X X X Loss of 13 AFW Pump speed control and indication X Letdown Heat Exchanger CCW outlet control valve closes in automatic X Pressurizer level control (conditional) X X X X Control Area Ventilation (CAV) accident pressurized mode initiation X X Residual Heat Removal (RHR) Heat Exchanger (HX) Outlet Flow Control X X Valve fails open Pressurizer spray valves fail closed X LR-N18-0033 LAR S18-02 Enclosure Loss of 1A 115V Vital Instrument Bus Effects of loss of power to the 1A 115V vital instrument bus are summarized below. Channel I Turbine Steamline Inlet Pressure transmitter (PT-505) fails to the no-load value. Control Rods will step in at the maximum rate due to the resulting Tavg/Tref mismatch. An immediate action in the associated abnormal operating procedure directs the Rod Bank Selector Switch to be placed in manual to stop undesirable Control Rod motion. The Steam Dump System is aligned in Main Steam Pressure Control mode due to the demand signal generated in Tavg mode. Pressurizer heaters will de-energize and letdown will isolate if Channel I is selected for pressure and level control. The associated abnormal operating procedure directs Pressurizer control channels to be transferred to unaffected channels to remove erroneous input from protection and control processors. The Letdown Heat Exchanger CCW outlet control valve closes in automatic. The associated abnormal operating procedure provides direction to operate the control valve in manual and restore letdown if flow was isolated. The Chemical and Volume Control System auto makeup initiates. The Boric Acid Flow Control Valve 1CV172 fails open and Primary Water Flow Control to Blender Valve 1CV179 fails closed. The associated abnormal operating procedure directs Charging Pump suction to be aligned to the refueling water storage tank (RWST) if Volume Control Tank level cannot be maintained. Primary Water Flow Control to Blender Valve 1CV179 fails closed and CVCS Makeup system auto makeup initiates. The associated abnormal operating procedure directs Charging Pump suction to be aligned to the refueling water storage tank (RWST) if VCT level cannot be maintained. Source and intermediate range nuclear instrumentation trip logic is one out of two for each range. Reactor trip would occur on source range if power was below Reactor Trip System interlock P-6 and on intermediate range if power was below 10% rated thermal power. Channel I bistables for the 1N41 Power Range Nuclear Instrumentation (NI) trip. The associated abnormal operating procedure directs 1N41 to be placed in a tripped condition to adjust control rods in manual and maintain RCS Tavg within the program range. The AFW steam generator level control valves 13AF21 and 14AF21 fail closed. The associated abnormal operating procedure directs operators to locally control 13 and 14AF21 valves if the 11 Auxiliary Feed Pump is required to maintain steam generator levels. Failure of 11 Component Cooling (CC) system header pressure instrumentation generates start signals to all CC pumps. The associated abnormal operating procedure directs operators to stop any CC pumps not required to support current plant operation. LR-N18-0033 LAR S18-02 Enclosure CFCU 11 outlet water temperature and flow indication and leak detection instrumentation will be lost. The associated abnormal operating procedure directs operators to stop 11 CFCU as a precautionary measure due to loss of temperature, Service Water flow and leak detection indications. The remaining CFCUs may be placed in service to provide containment cooling capabilities. The Unit 1 Control Area Ventilation (CAV) system initiates in accident pressurized mode due to loss of CRIX relay Train "A". The associated abnormal operating procedure provides direction to place the CAV system in the single train operating mode with Unit 2 supplying. CAV is a shared system between Unit 1 and Unit 2 with each unit providing a single train of the two train system. 11 RHR HX Outlet Flow Control Valve 11RH18 will fail open. The associated abnormal operating procedure directs the unaffected 12 RHR loop to be placed in service if required. Loss of 1B 115V Vital Instrument Bus Effects of loss of power to the 1B 115V vital instrument bus are summarized below. Source and intermediate range nuclear instrumentation trip logic is one out of two for each range. Reactor trip would occur on source range if power was below Reactor Trip System interlock P-6 and on intermediate range if power was below 10% rated thermal power. Channel II bistables for the 1N42 Power Range NI trip. The associated abnormal operating procedure directs operators to evaluate placing 1N42 Power Range NI in the tripped condition. The AFW steam generator level control valves 11AF21 and 12AF21 fail closed. The associated abnormal operating procedure directs operators to locally control 11 and 12AF21 valves if the 12 Auxiliary Feed Pump is required to maintain steam generator levels. Failure of 12 Component Cooling (CC) system header pressure instrumentation generates start signals to all CC pumps. The associated abnormal operating procedure directs operators to stop any CC pumps not required to support current plant operation. 12 and 14 CFCU indicating instrumentation will be lost. The associated abnormal operating procedure directs operators to stop 12 and 14 CFCUs as a precautionary measure due to loss of temperature, Service Water flow and leak detection indications. The remaining CFCUs may be placed in service to provide containment cooling capabilities. The Unit 1 Control Area Ventilation (CAV) system initiates in accident pressurized mode due to loss of CRIX relay Train "B". The associated abnormal operating procedure provides direction to place the CAV system in the single train operating mode with Unit 2 supplying. LR-N18-0033 LAR S18-02 Enclosure Temperature and differential pressure (DP) control instrumentation for Auxiliary Building Ventilation will be lost. The alarm response and system operating procedures provide direction to maintain minimum negative pressure within the Auxiliary Building boundary. 12 RHR HX Outlet Flow Control Valve 12RH18 will fail open. The associated abnormal operating procedure directs the unaffected 11 RHR loop to be placed in service if required. Channel II Turbine Steamline Inlet Pressure transmitter (PT-506) fails to the no-load value. The associated abnormal operating procedure directs the Steam Dump System to be aligned in Main Steam Pressure Control mode due to the demand signal generated in Tavg mode. Loss of power to pressurizer level comparator 1LC460D-C results in Letdown isolation and loss of all pressurizer heaters. The associated abnormal operating procedure provides direction to supply temporary power to re-energize 1LC460D-C to restore letdown. Loss of 1C 115V Vital Instrument Bus Effects of loss of power to the 1C 115V vital instrument bus are summarized below. Letdown will isolate if Channel III is selected for pressure and level control. The associated abnormal operating procedure directs Pressurizer control channels to be transferred to unaffected channels. This will allow Letdown to be restored. Pressurizer spray valves fail closed. The associated abnormal operating procedure directs the Pressurizer Pressure Control System to be operated in manual The AFW steam generator level control valves 11-14AF21 fail as-is. A redundant flow path and local manual valve control are available. Channel III bistables for the 1N43 Power Range Nuclear Instrumentation (NI) trip. The associated abnormal operating procedure directs operators to evaluate placing 1N43 Power Range NI in the tripped condition. 13 and 15 CFCU indicating instrumentation will be lost. The associated abnormal operating procedure directs operators to stop 13 and 15 CFCUs as a precautionary measure due to loss of temperature, Service Water flow and leak detection indications. The remaining CFCUs may be placed in service to provide containment cooling capabilities. Loss of 1D 115V Vital Instrument Bus Effects of loss of power to the 1D 115V vital instrument bus are summarized below. Charging Line Seal Pressure Control Valve 1CV71 fails closed and Charging Flow Control Valve 1CV55 fails open. The associated abnormal operating procedure directs local valve operation. LR-N18-0033 LAR S18-02 Enclosure Loss of power to pressurizer level comparator 1LC459C results in Letdown isolation and loss of all pressurizer heaters. The associated abnormal operating procedure provides direction to supply temporary power to re-energize 1LC459C to restore letdown. RHR HX Bypass Valve 1RH20 will fail open. The associated abnormal operating procedure directs operators to component cooling to the in-service RHR HX, as required to control RCS temperature. Channel IV bistables for the 1N44 Power NI trip. The associated abnormal operating procedure directs operators to evaluate placing 1N44 Power Range NI in the tripped condition. Control rods remain trippable. Manual and automatic rod movement is lost. The associated abnormal operating procedure provides direction to adjust Tavg adjusting turbine load, if the turbine is operating, or by operation of the Atmospheric Relief Valves. 2.2 Current Technical Specification Requirements For the sake of simplicity, Unit 1 component designations are used. The current TS 3.8.2.1, Onsite Power Distribution Systems, A.C. Distribution - Operating, Limiting Condition for Operability (LCO) provides a list of A.C. electrical buses which shall be OPERABLE and energized from sources of power other than diesel generators in MODES 1, 2, 3 and 4. This list includes the following: 115 volt Vital Instrument Bus # 1A and Inverter 115 volt Vital Instrument Bus # 1B and Inverter 115 volt Vital Instrument Bus # 1C and Inverter 115 volt Vital Instrument Bus # 1D and Inverter TS 3.8.2.1 ACTION b states, With one inverter inoperable, energize the associated A.C. Vital Bus within 8 hours; restore the inoperable 1A, 1B, or 1C inverter to OPERABLE and energized status within 24 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours; restore the inoperable 1D inverter to OPERABLE and energized status within 72 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours. The current 72 hour AOT for the D VIB inverter is based upon allowing increased operating flexibility because it does not affect the operation of any Safeguards Equipment Controller. The OPERABILITY of the A.C. and D.C. power sources and associated distribution systems during operation ensures that sufficient power will be available to supply the safety related equipment required for (1) the safe shutdown of the facility and (2) the mitigation and control of accident conditions within the facility. The minimum specified independent and redundant A.C. and D.C. power sources and distribution systems satisfy the requirements of General Design Criteria 17 of Appendix A to 10 CFR 50. 2.3 Reason for the Proposed Change Consistent with the objectives of the Nuclear Regulatory Commission's (NRC's) policy entitled "Use of Probabilistic Risk Assessment Methods in Nuclear Activities: Final Policy Statement," LR-N18-0033 LAR S18-02 Enclosure (Probabilistic Risk Assessment [PRA] Policy Statement, the amendment proposed herein provides (1) safety decision-making enhanced by the use of PRA insights, (2) more efficient use of resources, and (3) a reduction in unnecessary burden. The proposed inverter Allowed Outage Time (AOT) extension would provide these benefits by supporting the ability to complete on-line corrective or planned maintenance of an inoperable vital A.C. inverter. These benefits are described in the following table: NRC PRA Policy Statement Objective Anticipated Benefits of Proposed Inverter AOT Enhanced Efficient Reduction In Extension Decision- Use Of Unnecessary making Resources Burden Reduce the potential for unplanned unit shutdowns X X X and minimize the potential need for NOED; Increase the time to perform troubleshooting, repair, and testing following inverter equipment problems, X X which will enhance the safety and reliability of equipment and personnel; Allow time to perform routine maintenance activities on the inverters in MODES 1 through 4, enhancing the ability to focus quality resources on the activity X X X and the availability of the inverters during refueling outage periods. TS 3.8.2.1 Action b currently allows only 24 hours for an inoperable 115V A.C. VIB inverter A, B or C, and 72 hours for inverter D, to troubleshoot and repair, perform post-maintenance testing, and return the inoperable inverter to service. The current AOTs are based on engineering judgment, taking into consideration the time required to repair an inverter and the additional risk to which the unit is exposed because of the inverter inoperability. The 72 hour AOT for the D VIB inverter is based upon allowing increased operating flexibility because it does not affect the operation of any Safeguards Equipment Controller. Mitigating strategies have been implemented to address emergent issues within the current AOTs. These include prepared safety tagouts for inverter troubleshooting and repair, and maintaining stocks of capacitors and burned-in replacement circuit cards. However, as discussed below, the current AOTs can be insufficient in certain instances to support on-line troubleshooting, corrective maintenance, and post-maintenance testing in response to emergent issues. Salem performs preventative maintenance on the VIB inverters during refueling outages. There are no current plans to perform routine preventive maintenance on a scheduled basis at power. Should the need for such maintenance be identified as a result of component performance, the necessary preventive maintenance would be planned and scheduled in accordance with PSEG procedures for on-line work management. If an inverter becomes inoperable due to an emergent issue, the inverter troubleshooting and repair process requires proper electrical safety tagging to be established. A sequence of non-intrusive checks are performed prior to the inverter being de-energized for troubleshooting, including visual inspection for blown fuses, alarm conditions and breaker positions; and measurement of source and output voltages. Upon completion of repairs, and depending on which circuit cards have been removed and replaced, adjustments are performed. Post maintenance testing is required before returning the LR-N18-0033 LAR S18-02 Enclosure UPS to service. Depending on the corrective maintenance, an inverter functional test may also be required. Experience both at Salem and at other nuclear power plants has shown that the current AOTs for restoration of an inoperable VIB inverter are insufficient in certain instances to support on-line troubleshooting, corrective maintenance, and post-maintenance testing while the unit is at power. Specifically, Salem has entered TS 3.8.2.1 LCO due to an inoperable inverter 5 times since 2009. The actual times in the LCO were 9 hours 28 minutes in 2009, 16 hours 39 minutes in 2014, 23 hours 33 minutes in 2016, 16 hours 47 minutes in 2017 and 32 hours 50 minutes in 2018 (for the D inverter): however in these instances, the cause of the failures was readily evident. This allowed the troubleshooting process to be minimized thereby allowing for a quick repair and subsequent testing. In each of the above instances, the inoperable inverter was returned to OPERABLE status within the allowed outage time. The emergent issues were quickly identified, replacement parts were readily available and extensive post-maintenance testing (PMT) and component tuning were not required. However, if the emergent issue had required complex troubleshooting or more extensive post-maintenance testing, or if backup, burnt-in replacement components were not available on site, or if qualified personnel were not immediately available, the process of returning the inverter to OPERABLE status could have taken more than the current AOTs. The recommended burn-in period for replacement circuit cards is 50 hours to properly ensure the integrity of the card. A review of 10 CFR 50.72 event notifications identified 3 instances since 2003 in which plant shutdowns were initiated as required by Technical Specifications when the time to complete inverter troubleshooting and repair exceeded the 24-hour allowed outage time. Other nuclear power plants have had similar instances of inverter failures prompting requests for enforcement discretion (NOED) and for License Amendments for inverter TS Completion Time extensions from 24 hours to 7 days. Callaway was granted enforcement discretion in 2012 for an additional period of 36 hours to restore an inverter to OPERABLE status. FPL Energy Seabrook, LLC received NRC approval of enforcement discretion for an 18-hour extension to the Seabrook Station AOT for an inoperable (i.e., failed) distribution panel inverter. The Nine Mile Point and Watts Bar nuclear stations also received enforcement discretion in 2003 and 2001, respectively, to extend the Completion Time for an inoperable distribution panel inverter. The NRC approvals of the above NOEDs and LARs for the Clinton, North Anna, Braidwood, Byron and Palo Verde Stations are detailed in Section 4.2 of this evaluation. These approved amendments demonstrate that the current Allowed Outage Times for restoration of an inoperable inverter can, in some cases, be insufficient to support on-line troubleshooting, corrective maintenance, and post-maintenance testing which could lead to unplanned unit shutdowns or to requests for enforcement discretion. The proposed AOT increase does not significantly increase the potential for a loss of required instrumentation. While operator actions are required in response to the inoperability of one inverter, the proposed change will reduce the immediate demands on the operations staff preparing for a potential plant shutdown. Once approved, this LAR will better focus the operators on risk significant actions, as compared to actions that are based upon qualitative completion times. LR-N18-0033 LAR S18-02 Enclosure 2.4 Description of the Proposed Change The proposed TS changes (Unit 1 and 2 changes are identical) are described below for Unit 1. Both units changes are indicated on the marked up TS pages provided in Attachment 1 of this submittal. TS 3.8.2.1 ACTION b is being revised as shown below: With one inverter inoperable, energize the associated A.C. Vital Bus within 8 hours; restore the inoperable 1A, 1B or 1C inverter to OPERABLE and energized status within 24 hours7 days or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours; restore the inoperable 1 D inverter to OPERABLE and energized status within 72 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours.

3.0 TECHNICAL EVALUATION

3.1 Deterministic Assessment 3.1.1 Defense-In-Depth

1) Preservation of a reasonable balance among the layers of defense The proposed licensing basis change does not significantly reduce the effectiveness of a layer of defense that exists in the plant design before the implementation of the proposed licensing basis change.

The defense in depth approach to designing and operating Salem is used in order to prevent and mitigate accidents that could release radiation or hazardous materials. This approach provides for multiple independent and redundant layers of defense to compensate for potential human and mechanical failures which ensures that no single layer, no matter how robust, is exclusively relied upon. Defense in depth includes the use of access controls, physical barriers, redundancy, diverse key safety functions, and emergency response measures. The robust plant design to survive hazards and minimize challenges that could result in the occurrence of an event is not affected by the proposed change. The proposed extended AOT does not increase the likelihood of initiating events or create new significant initiating events. It simply provides a risk-informed basis for the completion time. There are a number of actions that are competed by the operations staff as required for the automatic response of the plant when there is a loss of a 115V A.C. vital instrument bus. This LAR has the effect of balancing some of the demands on the operations staff. Once approved, the LAR will permit more focused operator and maintenance technician attention upon risk significant actions, as compared to actions that are based upon qualitative AOTs. The availability and reliability of Systems, Structures or Components (SSCs) providing the safety functions that prevent plant challenges from progressing to core damage are not significantly impacted. The remaining OPERABLE 115 V A.C. inverters are capable of supplying the required loads to safely shutdown the plant. LR-N18-0033 LAR S18-02 Enclosure The proposed extension of the AOT for one inverter to 7 days does not significantly reduce the effectiveness of the emergency preparedness program, including the ability to detect and measure releases of radioactivity, notify offsite agencies and the public, and shelter or evacuate the public as necessary.

2) Preservation of adequate capability of design features without an overreliance on programmatic activities as compensatory measures The proposed licensing basis change does not substitute programmatic activities for design features to an extent that significantly reduces the reliability and availability of design features to perform their safety functions without overreliance on programmatic activities.

No programmatic activities are required as compensatory measures to preserve adequate capability of design features during the extended AOT. Three inverter channels are sufficient to supply the safety related equipment required for (1) the safe shutdown of the facility and (2) the mitigation and control of accident conditions within the facility. Therefore, one inverter being inoperable does not impact the ability of the system to perform its required function. Salem uses abnormal operating procedures which provide direction for operator actions in response to a loss of a VIB inverter. Restoration of power to the associated 115V A.C. vital instrument bus and restoration of affected plant components to normal lineup are also controlled by plant procedures as referenced by the abnormal operating procedure. While timely actions are required when there is a loss of VIB inverter, this LAR will reduce the immediate demands on the operations staff preparing for a potential plant shutdown. Administrative controls consistent with other licensees that have received similar extensions of the inverter allowed outage time, as described in Section 4.2 of this Enclosure will be implemented. The administrative controls are qualitative, prudent actions. Entry into the extended inverter AOT will not be planned concurrent with EDG maintenance, and entry into the extended inverter AOT will not be planned concurrent with planned maintenance on another reactor trip system or ESF actuation system instrumentation channel that could result in that channel being in a tripped condition. These actions are taken because it is recognized that with an inverter inoperable and the vital instrument bus being powered by the backup A.C. distribution system, continued instrument power for that train is dependent on power from the associated EDG following a loss of power event.

3) Preservation of system redundancy, independence, and diversity commensurate with the expected frequency and consequences of challenges to the system, including consideration of uncertainty The proposed licensing basis change does not significantly reduce the redundancy, independence, or diversity of systems.

The proposed extended AOT makes no changes to the system operation or design and therefore has no effect on the expected frequency of challenges or result in a decrease in redundancy, independence, or diversity of the 115 V A.C. power system. Also, redundant power supplies and operator actions are not impacted by these changes. If a redundant LR-N18-0033 LAR S18-02 Enclosure channel should fail or be taken out of service during the extended AOT, Salem would be in TS 3.0.3, requiring a plant shutdown. This requirement is unchanged by this LAR. The proposed extended AOT is consistent with the assumptions in the plants safety analysis, and does not result in a significant increase in risk.

4) Preservation of adequate defense against potential Common Cause Failures (CCFs)

The proposed licensing basis change does not significantly reduce defenses against CCFs that could defeat the redundancy, independence, or diversity of the layers of defense; fission product barriers; and the design, operational, or maintenance aspects of the plant. The extension requested does not reduce defenses against CCF. In fact, these extensions allow more deliberate and thorough troubleshooting following an emerging failure, which improves the causal evaluations performed for equipment issues. Better understanding of any emergent failure causes could lead to investigations or actions to improve the reliability of the unaffected inverters. In addition, the operating environment for these components remains unchanged and there are no changes to the design or operation of the inverters associated with the proposed change, so new common cause failure modes are not introduced. There are no changes to the common environment, inverter or support system design, therefore there are no changes to existing coupling factors. The extent of condition performed as a part of any failure of a safety-related piece of equipment will address these issues as required by plant administrative procedures. Therefore, the defense against potential CCFs remains adequate.

5) Maintain multiple fission product barriers The proposed licensing basis change does not significantly reduce the effectiveness of the multiple fission product barriers.

The fission product barriers (fuel cladding, reactor coolant system, and containment) and their effectiveness are maintained. The proposed changes do not affect the integrity of fission product barriers to limit leakage to the environment. Extending the AOT of the VIB inverters does not result in a significant increase in the frequency of existing challenges to the integrity of the barriers, significantly increase the failure probability of any individual barrier, or introduce new or additional failure dependencies among barriers.

6) Preserve sufficient defense against human errors The proposed licensing basis change does not significantly increase the potential for or create new human errors that might adversely impact one or more layers of defense.

The proposed extended AOT does not require any new operator actions for the existing plant equipment or introduce the potential for new human errors. OP-AA-108-116, Protected Equipment Program [19] incorporates compensatory measures which control what equipment or systems will not be allowed to be taken out of service concurrent with an inverter out of service for planned or unplanned maintenance. There is no change to the Configuration Risk Management Program and therefore there is no increase in the potential LR-N18-0033 LAR S18-02 Enclosure for, or creation of new human errors that might adversely impact one or more layers of defense. No new operating, maintenance, or test procedures are required due to these changes, and no new at-power tests or maintenance activities are expected to occur as a result of these changes. The plant will continue to be operated and maintained as before.

7) Continue to meet the intent of the plants design criteria The proposed licensing basis change does not affect the plants ability to meet the intent of the design criteria referenced in the licensing basis.

The intent of the Salem design criteria is maintained. The plant will continue to be operated and maintained as before. The proposed changes do not involve any physical changes to the design or operation of the 115V A.C. distribution system. The ability of the remaining TS required inverters to perform their required functions is maintained during the extended AOT.

8) Integrated Evaluation of the Defense-in-Depth Considerations There are no changes to the current plant design. The intent of each defense-in-depth consideration addressed above would still be met following implementation of the proposed extended AOT. Therefore, the proposed licensing basis change maintains consistency with the defense-in-depth philosophy.

3.1.2 Safety Margin The impact of the proposed change is consistent with the principle that sufficient safety margins are maintained. Codes and Standards or alternatives approved for use by the NRC are met. The design and operation of the 115V A.C. distribution system is not changed by proposed increase of the AOT. The proposed change does not affect conformance with applicable codes and standards. Safety analysis acceptance criteria in the UFSAR are met. The safety analysis acceptance criteria, as stated in the Salem UFSAR, are not impacted by these changes. Redundant channels will be maintained. Diversity, with regard to ensuring that sufficient power will be available to supply the safety related equipment required for (1) the safe shutdown of the facility and (2) the mitigation and control of accident conditions within the facility will be maintained. The minimum specified independent and redundant A.C. and D.C. power sources and distribution systems will continue to satisfy the requirements of General Design Criteria 17 of Appendix "A" to 10 CFR 50. The proposed changes will not allow plant operation in a configuration outside the design basis. 3.2 Risk Assessment This risk assessment evaluates the proposed extension of the inverter Allowed Outage Times (AOT) from the current 24 or 72 hours to 7 days using the Salem Full-Power Internal Events (FPIE) PRA Model of Record - SA115A. The justification for the use of extended Allowed Outage Times (AOTs) for 115V A.C. inverters is based upon risk-informed and deterministic evaluations consisting of three main elements as cited in RG 1.177: LR-N18-0033 LAR S18-02 Enclosure

1) Tier 1: Assessment of the impact of the proposed TS change using a valid and appropriate PRA model as compared with appropriate acceptance guidelines.

2) Tier 2: Evaluation of equipment relevant to plant risk while the inverter(s) are in the extended AOT. Combinations of out-of-service equipment can be evaluated for their risk significance to determine if additional compensatory measures may be required.

3) Tier 3: Implementation of the Configuration Risk Management Program (CRMP) while the inverter(s) is/are in the extended Allowed Outage Time. The CRMP is used for all work and helps ensure that there is no avoidable increase in plant risk while any inverter maintenance is performed. These programmatic measures provide additional assurance that critical plant safety functions are preserved during the extended inverter AOT.

This section addresses the Tier 1 risk assessment for the proposed extension of the inverter AOT. Tier 2 evaluations are supported by the examination of results, such as in Section 3.2.5, to determine if any specific failures dominate the results, and the modeled mitigation strategies discussed in Section 3.2.2.3. Plant configuration changes for planned and unplanned maintenance of the components as well as the maintenance of equipment having risk significance is managed by the Configuration Risk Management Program (CRMP). The CRMP helps ensure that these maintenance activities are carried out with no significant increase in the risk of a severe accident (Tier 3). 3.2.1 PRA Quality and Technical Adequacy The SA115A version of the Salem PRA model is the most recent evaluation of the risk profile at Salem for internal event challenges. The Salem PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, and common cause events. The PRA model quantification process used for the Salem PRA is based on the event tree and linked fault tree methodology, which is a well-known methodology in the industry. PSEG employs a multi-faceted approach to establishing and maintaining the technical adequacy and plant fidelity of the PRA models for all PSEG nuclear generation. This approach includes a proceduralized PRA maintenance and update process, which includes consideration of peer review Findings and Observations (F&Os) and their subsequent resolution. PRA quality is assured for the Salem PRA model and documentation through a combination of the following: Confirmation of the fidelity of the model with the as-built, as-operated plant (see Section 3.2.1.1) Use of methods and approaches consistent with the ASME PRA Standard Use of an Updating Requirement Evaluation (URE) database to track PRA model issues and potential enhancements (See Section 3.2.1.4) Use of a PRA Peer Review (see Section 3.2.1.3) to identify areas for enhancement Use of highly qualified PRA practitioners qualified under the PSEG PRA Risk Management Program Use of internal reviews and interviews with system engineers and operating crew members LR-N18-0033 LAR S18-02 Enclosure 3.2.1.1 PRA Maintenance and Update The PSEG risk management process ensures that the applicable PRA model remains an accurate reflection of the as-built and as-operated plants. This process is defined in the PSEG Risk Management program, which consists of a governing procedure (ER-AA-600, "Risk Management") and subordinate implementation procedures. PSEG procedure ER-AA-600-1015 [10], "FPIE PRA Model Update" delineates the responsibilities and guidelines for updating the full power internal events PRA models at PSEG nuclear generation sites. The overall PSEG Risk Management program, including ER-AA-600-1015 , defines the process for implementing regularly scheduled and interim PRA model updates, for tracking issues identified as potentially affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, industry operating experience), and for controlling the model and associated computer files. In a recent Safety Evaluation [48], the NRC stated that two changes incorporated into SA115A constitute a PRA upgrade. Incorporation of a plant modification that installed a fourth motor driven auxiliary feedwater pump that is independently powered by a separate diesel generator. Refinement of the station blackout event tree sequences to take into account use of FLEX equipment and update of loss of offsite power non-recovery data from Idaho National Laboratory. The impacts of these modifications on this LAR are assessed in a sensitivity analysis in Section 3.2.4.2.4 and actions are tracked in the URE database described in Section 3.2.1.4. To ensure that the current PRA model remains an accurate reflection of the as-built, as-operated plant, the Site Risk Management Engineer (SRME) reviews plant design modifications and any changes to plant procedures or calculations referenced in the PRA that could affect the risk profile and identifies any that need to be evaluated for consideration in future PRA updates. No new plant modifications or revision to plant procedures and calculations referenced in the PRA have been identified since the creation of the SA115A PRA model that would warrant an interim PRA update or that would affect the outcome of this PRA analysis for the inverter AOT extension. In addition to these activities, PSEG risk management procedures provide the guidance for particular risk management and PRA quality and maintenance activities. This guidance includes: Documentation of the PRA model, PRA products, and bases documents The approach for controlling electronic storage of Risk Management (RM) products including PRA update information, PRA models, and PRA applications Guidelines for updating the full power, internal events PRA models Guidance in the use of quantitative and qualitative risk assessments in support of the on-line work control process for risk evaluations of maintenance tasks (corrective maintenance, preventive maintenance, minor maintenance, surveillance tests and modifications) on systems, structures, and components (SSCs) within the scope of the Maintenance Rule (10CFR50.65 (a)(4)) LR-N18-0033 LAR S18-02 Enclosure In accordance with this guidance, regularly scheduled PRA model updates occur approximately every three years, with longer intervals being justified if it can be shown that the PRA continues to adequately represent the as-built, as-operated plant. PSEG completed the SA115A PRA model in December 2016, which was the result of a regularly scheduled update of the PRA model. 3.2.1.2 Pending Changes Identified Against the PRA Model A PRA tracking database record is created for all issues that are identified that could impact the PRA model. This database, the Updating Requirement Evaluation (URE) database includes the identification of those plant changes that could impact the PRA model. The plant modifications, procedure changes, and other PRA model issues identified in the URE database have been reviewed as part of the preparation of the risk assessment for the inverter AOT extension request. Only a few have been identified that could significantly affect the SA115A PRA model or its quantification. See Section 3.2.1.4 for more information regarding the URE database review. 3.2.1.3 Applicability of Peer Review Findings and Observations A PRA Peer Review of the Salem Rev. 4.1 PRA model was performed during November 2008. The peer review was performed against the ASME PRA Standard [4] using the process defined in Nuclear Energy Institute (NEI) 05-04 [11]. The PRA Peer Review resulted in a number of Findings and Observations (F&Os) that indicated that there were a number of supporting requirements (SRs) that were categorized as Not Met for Capability Category II. Since then, several subsequent model revisions (See Table below) were performed to address these F&Os. HISTORY OF SALEM GENERATING STATION PRA MODEL UPDATES INTERNAL MODEL INTERNAL MODEL EVENTS TRUNCATION REVISION EVENTS COMMENTS NAME LERF LIMIT DATE CDF (1/YR) (1/YR) July-93 IPE 6.40E-05 5.23E-06 NR Truncation limit not reported August-96 Model 1.0 5.13E-05 4.75E-06 NR Truncation limit not reported August-98 Model 2.0 5.23E-05 4.75E-06 1.00E-10 June-02 Model 3.0 5.20E-05 5.74E-06 1.00E-10 July-03 Model 3.1 4.10E-05 3.97E-06 1.00E-09 March-05 Model 3.2 2.48E-05 1.01E-06 1.00E-11 March-06 Model 3.2A 6.21E-05 7.61E-06 1.00E-11 No internal flood contribution No internal flood contribution; March-08 Model 4.0 4.54E-05 NR 1.00E-11 LERF results not reported September-08 Model 4.1 4.77E-05 5.06E-06 1.00E-11 March-09 Model 4.2 4.74E-05 5.06E-06 1.00E-11 LR-N18-0033 LAR S18-02 Enclosure HISTORY OF SALEM GENERATING STATION PRA MODEL UPDATES INTERNAL MODEL INTERNAL MODEL EVENTS TRUNCATION REVISION EVENTS COMMENTS NAME LERF LIMIT DATE CDF (1/YR) (1/YR) December-09 Model 4.3 2.55E-05 1.18E-06 1.00E-11 Model September-14 1.55E-05 7.29E-07 1.00E-11 SA112A Model December-16 8.38E-06 4.65E-07 1.00E-11 SA115A Table A-1 through Table A-10 in Attachment 2 summarize each of the F&Os identified during the peer review that was performed in November 2008 and reported in the peer review report [8] with a brief summary of the resolution for each. All changes made during the SA112A model update have been carried through to the SA115A model unless modified by later required changes. A listing of those Supporting Requirements (SRs) that were revised between the 2005 and the 2009 [14] versions of the ASME PRA Standard (as endorsed by RG 1.200) with a description of the change and associated comments is provided in Table A-11. In addition, a gap assessment was also performed against the NRC clarifications and qualifications in Appendix A of RG 1.200 Rev. 2 [5] with regard to the ASME Standard and the comments are tabulated in Table A-12. This assessment evaluates changes in the clarifications and comments between Rev. 1 and Rev. 2 of RG 1.200. Since the peer review already includes the RG 1.200 Rev. 1 clarifications and qualifications when assessing the technical adequacy of the model, no additional tabulation is needed for those. Subsequent to the November 2008 peer review, the SA115A PRA model addressed and resolved those SRs not meeting Capability Category II. Based on the PRA Peer Review process and the updated PRA model (SA115A), the Salem PRA model is deemed satisfactory for use in PRA applications. 3.2.1.4 URE Status The URE (Update Requirement Evaluation) database is a resource and working tool used by the Risk Management Team to ensure that the as-built, as-operated Salem plant configuration is reflected in the PRA. In addition, enhancements to the PRA quality are also identified, tracked, and resolved. The observations are recorded in the URE database. These observations identify potential areas of investigation for future model enhancement. This database was reviewed and potential impacts for open UREs are recorded below in Table 3-1. There are three UREs identified in Table 3-1 as a potential impact, SA2017-018 and SA2017-035 and SA2018-001. SA2017-018 identifies the need for 115V A.C. vital bus support dependency logic for SEC trains B and C, which includes inverter logic. SA2017-035 describes the need for an unavailability term to represent the testing and maintenance of the inverters. Both logic changes described in SA2017-018 and SA2017-035 have been incorporated into LR-N18-0033 LAR S18-02 Enclosure SA115C, the application specific model. See Section 3.2.1.5 for more information on the application specific model. SA2018-001 identifies two plant changes that were incorporated into the PRA, and may require evaluation as possible PRA upgrades. Sensitivity calculations that remove these two changes from the PRA are provided in Section 3.2.4.2.4. Table 3 1 Open URE Review Potential URE Date Comments to affect Number Initiated the LAR? SA2005-019 Unit 2 model needs to be developed 1/12/2006 No Suggestion to provide cross reference between PRA Standard and SA2010-027 where in the document it is addressed N/A No Modification of CVCS pumps; now have mechanical seals that do not SA2012-002 require CCW cooling 1/30/2012 No SA2013-001 Butterfly valves added to SW return lines 7/19/2013 No SA2013-002 Chiller recirculation pump modeling needs to be refined 10/23/2013 No Advanced digital feedwater control system replaced- needs to be SA2014-001 updated in model 12/12/2013 No Review FPRA impact from fire loading associated with new cables SA2014-005 associated with FLEX strategies 3/5/2014 No SA2014-006 Revise manipulation times applied in cold leg recirculation actions 4/21/2014 No SA2014-010 Add in missing pre-initiators in HRA documentation 5/27/2014 No NSAL-14-1 produced preliminary results which warranted a change in RCP seal LOCA leakage. Once more guidance is released, the model SA2014-012 may need to be updated again 6/6/2014 No RCP seal flow rate following loss of all AC power is underestimated in SA2014-017 model 7/10/2014 No Incorporation of SA-STI-004 (surveillance test interval extension) SA2014-018 analysis that was performed on the vital bus undervoltage relays 7/21/2014 No SA2014-021 System notebook maintenance 9/9/2014 No SA2015-007 Development of AFW alternate suction sources 3/24/2015 No SA2015-016 EOOS asymmetry with ECACS between Unit 1 and Unit 2 6/2/2015 No SA2015-017 Potential CCW dependency enhancement 6/10/2015 No SA2015-024 Installation of SW return valves 9/18/2015 No SA2015-028 New RCP seals 10/22/2015 No SA2015-032 Modeling enhancement for EDG failure to load event 12/18/2015 No SA2015-033 Recovery of Offsite power during first hour of event 12/18/2015 No LR-N18-0033 LAR S18-02 Enclosure Table 3 1 Open URE Review Potential URE Date Comments to affect Number Initiated the LAR? SA2016-005 Concurrent maintenance times 4/20/2016 No SA2016-007 Chilled water inter-unit cross-tie 6/27/2016 No SA2016-011 Risk significant actions without details HEP calculations 12/13/2016 No SA2017-001 Basic Event AC5-BAC-ST-I-1153 needs to be renamed 1/3/2017 No SA2017-002 Elimination of cutsets with both ELAP event and non-ELAP event flags 1/21/2017 No SA2017-003 Revised JHEP analysis 2/2/2017 No SA2017-004 SW AOVs for DG cooling support 2/9/2017 No SA2017-005 Improved operator response in procedure for ISLOCA 2/24/2017 No SA2017-006 Spray scenario refinement 3/28/2017 No SA2017-007 Merging of EOOS model logic with MOR 3/28/2017 No SA2017-008 Internal flooding mitigation in SW bays 3/28/2017 No SA2017-009 Add CC3 valves to EOOS red pump list 3/29/2017 No SA2017-010 Internal floods in electrical penetration area 4/18/2017 No SA2017-011 Internal floods in SWIS bays 4/18/2017 No SA2017-012 SA-PRA-003 footnote error regarding CFCUs 4/26/2017 No Non-generic values needed for 3 HEPs recently found to be risk SA2017-013 significant 5/24/2017 No SA2017-014 Logic modifications needed for 28 VDC chargers 6/5/2017 No SA2017-015 SEC actuation for SW20 and SW26 valves 6/8/2017 No SA2017-016 28 VDC battery modeling- output breakers not installed 6/9/2017 No Conditional LOOPs treated as grid-related LOOPs (possible under SA2017-017 conservative probabilities being used) 6/9/2017 No SA2017-018 SEC and 115 VAC vital instrument bus support dependencies 6/9/2017 Yes SA2017-019 Basic Event CM reduced from 1.2E-06 to 1.2E-08 6/21/2017 No SA2017-020 Correction of fault tree logic for ATWS scenarios with LOOP initiators 6/21/2017 No Review modeling of the ability of the opposite unit to provide seal SA2017-021 injection using only the centrifugal charging pump (CCP) 7/14/2017 No Improvement to include Fire Protection (FP) or Service Water (SW) as SA2017-022 an alternate AFW suction source 7/27/2017 No LR-N18-0033 LAR S18-02 Enclosure Table 3 1 Open URE Review Potential URE Date Comments to affect Number Initiated the LAR? Review requirements of NEI 99-02 and SC-MSPI-001 need to be reviewed to determine if there are any changes to MSPI UA tracking for CCW based on the TS change and update model to allow two SA2017-023 outages simultaneously 8/11/2017 No SA2017-024 Review possibility of spray damage for AOV DR6 8/28/2017 No SA2017-025 Documentation of evaluation of MOV and AOV resistance to sprays 9/9/2017 No Review LERF model for opportunities to credit repair of failed SA2017-026 equipment 9/9/2017 No Update JHEP values for JHE-XHE-84M-RCN-116 and JHE-XHE-84F-SA2017-027 RCN-116 to include the floor drain unavailability factor of 0.001 9/12/2017 No Include house events to reflect swap to other charger when a charger SA2017-028 is out of service for maintenance 9/21/2017 No Failure mechanisms for manual valves 1DM427 and 1DM216 should be included in the PRA logic for the suction flowpath from the SA2017-029 Demineralized Water Storage Tanks to the safety related AFW pumps 9/21/2017 No Delete basic events for DC breakers failing to remain shut that were SA2017-030 found to be redundant to other basic events in the PRA model 9/21/2017 No As per SA-16-003 (70192022), surveillances for Engineered Safety Feature Containment Isolation Phase A and Phase B testing have been approved to extend from 18 month intervals to 54 month SA2017-031 intervals; refer to SA-STI-010, Rev. 0 for required PRA model changes 10/31/2017 No As per SA-16-004 (70190253), surveillances for rod control movement have been approved to extend from monthly intervals to quarterly SA2017-032 intervals; refer to SA-STI-009, Rev. 0 for required PRA model changes 10/31/2017 No Add testing and maintenance(T+M) events for 21/22 chillers and 21/23 SA2017-033 CAACS fans 11/16/2017 No SA2017-034 Review modeling of ventilation for the 2C EDG Control Room 12/19/2017 No The Salem PRA model does not currently model maintenance SA2017-035 unavailability for any of its inverters 12/22/2017 Yes Tracking two changes that require evaluation as possible PRA th SA2018-001 Upgrades (4 AFW pump and use FLEX equipment) 4/10/2018 Yes 3.2.1.5 Review of PRA Model Specific to Application Sufficient modeling exists in the PRA to generally represent the components of interest. However, a few changes were needed in order to add details to fully support the analysis of the inverters. The changes have been incorporated to create a new application specific model, SA115C. (Model SA115B was an application-specific model for a different application and has no impact on SA115C.) LR-N18-0033 LAR S18-02 Enclosure Basic events have been added to the model which represent the unavailability of the 115V A.C. Inverters due to testing and maintenance. The new testing and maintenance basic events were placed in all locations which contained inverter failure basic events (see Table 3-2). The unavailability value used for these basic events was taken from the Idaho National Lab (INL) unavailability data [16]. Additionally, while the inverters are in testing/maintenance, A.C. power is aligned from the backup power supply (via a 12kVA AC Line Regulator and Static Switch), and the failure of the automatic bus transfer switch event (AC1-ABT-OO-1A(B/C/D)115) would not apply. This has been incorporated into the model by replacing the automatic switch failure event with an A AND NOT B (AANB) gate, with the A input being the automatic switch failure event and the B input being the new maintenance term. This logic was replicated for all four inverter trains. See Table 3-2 for more information on the new basic events. See Figure 3-1and Figure 3-2 for the Train A example of the transfer switch logic change. These two changes address URE SA2017-035. TABLE 3-2 ASM BASIC EVENTS New Basic Event Value Parent Gate G18X110 G1AB110 AC1-INV-TM-1A115 2.00E-04 G1XV110 AC1-ABT-OO-1A GXB1110 G37X110 AC1-INV-TM-1B115 2.00E-04 G1BB110 AC1-ABT-OO-1B G1CB110 GXC1110 AC1-INV-TM-1C115 2.00E-04 GXC1110X AC1-ABT-OO-1C G1DB110 AC1-INV-TM-1D115 2.00E-04 AC1-ABT-OO-1D LR-N18-0033 LAR 818-02 Enclosure UN.AVAILABILITY OF ALTERIIIATE SOURCE 230 VAC VITAL BUS tA jGtXV102j oQ TRANSFORMER LOSS FAILURE OF OF POWER FO.R ALTERN.ATE 230 VAC ALTERN.ATE TRAINA ... TRAINAPOWER SUPP... IAC1-TFM-LP-1AREGI IG1XV'!03I 8 2.27E-05 a(:.:) FAILURE OF LOOP INITIATING AUTOMATIC BU.S EVEliiT TRANSFER SWITCH F... T-OO- tAt15j

                                                                                                     "'n IAC1-AB 81.E-03                                           **

FIGURE 3-1 PREVIOUS AUTOMATIC BUS TRANSFER SWITCH FAILURE LOGIC FOR TRAIN A UNAVAILABIUTY OF ALTERNATE SOURCE 230 VACVITAL BUS 1A TRANSFORMER LOSS OF FAILURE OF AUTOMATIC FAILURE OF ALTERNATE LOOP INITIATING EVENT POWER FOR ALTERNATE BUS TRANSFER SWITCH 230 VAC TRAIN A POWER TRAIN A SOURCE FOR TRAIN A SUPPLY j\ (AC 1-TFM-LP-1AREG( 8 I T AcJ.Ae -oo.1AI I 1 G 103 li!§ 0 D D 2.27E-05 F AlLURE OF AUTOMATIC 115 VAC INVERTER 1A NOT BUS TRANSFER SWITCH IN TESTING/ FOR TRAIN A MAINTENANCE 115 V AC INVERTER 1A UNAVAILABUEDUE TO TESTING/ MAINTENANCE FIGURE 3-2 SA115C AUTOMATIC BUS TRANSFER SWITCH FAILURE LOGIC FOR TRAIN A LR-N18-0033 LAR S18-02 Enclosure To address URE SA2017-018, the EDG electrical support dependencies are more accurately modeled by adding the 1B 115V A.C. vital bus dependency (gate GXB1100) as an input to OR gate G46X100, and similarly for train C, adding gate GXC1100X under OR gate G47X100. This is equivalent to how train A is being modeled in the SA115A PRA model of record. Additionally, the gate IE-TE (LOOP INITIATING EVENT) was added as an input to gates G1XV102 (UNAVAILABILITY OF ALTERNATE SOURCE 230V A.C. VITAL BUS 1A), G37X102X (UNAVAILABILITY OF ALTERNATE SOURCE 230V A.C. VITAL BUS 1B), and GXCB102X (UNAVAILABILITY OF ALTERNATE SOURCE 230V A.C. VITAL BUS 1C) in order to account for the fact that the alternate power source for 230V A.C. would be rendered unavailable during a LOOP event. The inverter logic is a part of the 115V A.C. vital bus dependency logic. Therefore, the above changes were included in this ASM in order to more accurately represent the change in risk due to an extension of inverter Allowed Outage Time. As concurrent maintenance is not allowed for the 115V A.C. inverters, the following lines of text were added to the mutually exclusive file: CONCURRENT MAINTENANCE NOT ALLOWED FOR INVERTERS AC1-INV-TM-1A115 AC1-INV-TM-1B115 AC1-INV-TM-1A115 AC1-INV-TM-1C115 AC1-INV-TM-1A115 AC1-INV-TM-1D115 AC1-INV-TM-1B115 AC1-INV-TM-1C115 AC1-INV-TM-1B115 AC1-INV-TM-1D115 AC1-INV-TM-1C115 AC1-INV-TM-1D115 New events were added to the PRA model to represent concurrent failures of inverters failing to operate due to common cause failures. The new inverter common cause terms are determined using the alpha factor model. The alpha factors were taken from the Salem SPAR model [17]. The alpha factor ( ) is used in combination with the existing inverter independent failure rate ( ), where k is the number of components being considered and m is the total number of components, in order to determine the common cause failure term ( ). The equation used is shown below and was taken from the INEL Common Cause Failure Data Collection and Analysis System [18]. ( )! ( 1)!

                                      =

( 1)! LR-N18-0033 LAR S18-02 Enclosure Table 3-3 and Table 3-4 below show the type code and basic event information added to the corresponding tables in the SA115C RR database file. TABLE 3-3 INVERTER COMMON CAUSE TERM TYPE CODES TYPE RATE UNITS DESC SOURCE EQUATION _AC1_INV_FR44 7.05E-03 H ALPHA FACTOR 4/4 115V A.C. INVERTERS SPAR MODEL _AC1_INV_FR34 1.03E-02 H ALPHA FACTOR 3/4 115V A.C. INVERTERS SPAR MODEL _AC1_INV_FR24 1.56E-02 H ALPHA FACTOR 2/4 115V A.C. INVERTERS SPAR MODEL AC1_INV_FR44 3.95E-08 H SPAR MODEL AC1INVFR*_AC1_INV_FR44/1 AC1_INV_FR34 1.92E-08 H SPAR MODEL AC1INVFR*_AC1_INV_FR34/3 AC1_INV_FR24 2.91E-08 H SPAR MODEL AC1INVFR*_AC1_INV_FR24/3 AC1INVFR _INV_FR H INVERTER FAILS TO CONTINUE OPERATING NUREG/CR-6928 2010 _INV_FR 5.60E-06 H INVERTER FAILS TO CONTINUE OPERATING NUREG/CR-6928 2010 TABLE 3-4 INVERTER COMMON CAUSE TERM BASIC EVENTS NAME C FACTOR UNITS DESC TYPE CODE PROBABILITY AC1-INV-CC-1ABCD 1 24 H CCF OF 115V A.C. INVERTERS 1A/B/C/D AC1_INV_FR44 9.475E-07 AC1-INV-CC-1ABC 1 24 H CCF OF 115V A.C. INVERTERS 1A/B/C AC1_INV_FR34 4.614E-07 AC1-INV-CC-1ABD 1 24 H CCF OF 115V A.C. INVERTERS 1A/B/D AC1_INV_FR34 4.614E-07 AC1-INV-CC-1ACD 1 24 H CCF OF 115V A.C. INVERTERS 1A/C/D AC1_INV_FR34 4.614E-07 AC1-INV-CC-1BCD 1 24 H CCF OF 115V A.C. INVERTERS 1B/C/D AC1_INV_FR34 4.614E-07 AC1-INV-CC-1AB 1 24 H CCF OF 115V A.C. INVERTERS 1A/B AC1_INV_FR24 6.989E-07 AC1-INV-CC-1AC 1 24 H CCF OF 115V A.C. INVERTERS 1A/C AC1_INV_FR24 6.989E-07 AC1-INV-CC-1AD 1 24 H CCF OF 115V A.C. INVERTERS 1A/D AC1_INV_FR24 6.989E-07 AC1-INV-CC-1BC 1 24 H CCF OF 115V A.C. INVERTERS 1B/C AC1_INV_FR24 6.989E-07 AC1-INV-CC-1BD 1 24 H CCF OF 115V A.C. INVERTERS 1B/D AC1_INV_FR24 6.989E-07 AC1-INV-CC-1CD 1 24 H CCF OF 115V A.C. INVERTERS 1C/D AC1_INV_FR24 6.989E-07 LR-N18-0033 LAR S18-02 Enclosure 3.2.1.6 Technical Adequacy Summary The Salem PRA model, maintenance and update process, and technical capability discussion described above provide a robust basis for concluding that the PRA is suitable for use in risk-informed processes. However, an application specific PRA model (SA115C) was developed in order to more accurately assess the risk increase for this inverter AOT extension. Since this was the only change made to the current Salem PRA MOR (SA115A), the technical adequacy of the SA115A MOR also extends to the application specific PRA model (SA115C). 3.2.2 Probabilistic Risk Assessment Results 3.2.2.1 Tier 1 Evaluation Approach The proposed changes associated with the extended inverter AOT are evaluated using a PRA model closely based on the Salem PRA Model of Record (MOR) to determine that current regulations and applicable requirements continue to be met, that adequate defense-in-depth and sufficient safety margins are maintained, and that any increase in core damage frequency (CDF) and large early release frequency (LERF) is small and consistent with the acceptance guidelines in Regulatory Guide 1.177. The modeling approach is consistent with the NRC guidance for the calculation of the requested risk measures. Regulatory Guide 1.177 is followed to calculate the change in risk measures Incremental Conditional Core Damage Probability (ICCDP) and Incremental Conditional Large Early Release Probability (ICLERP). These conditional probabilities are performed to calculate the risk change during the proposed inverter AOT by setting the appropriate components as failed. In addition, an assessment of the impact of the AOT extension on overall average risk is calculated by assigning an increased testing/maintenance probability to the 115V A.C. inverters. This increased probability is based on the factor of change of the AOT, thereby conservatively assuming that all existing unavailability will be increased by that same factor. Regulatory Guide 1.174 has acceptance guidelines that act as trigger points to address concerns as to whether the proposed change provides reasonable assurance of adequate protection. The Salem internal events PRA is a thorough and detailed PRA model that is robust and capable of supporting the risk-informed decision to increase the inverter AOT. See Section 3.2.1 for a discussion of the PRA technical adequacy. 3.2.2.2 Assumptions The PRA quantitative evaluation of the extended inverter AOT has a number of assumptions. This subsection lists some of the important assumptions. The external event analysis is based on hazard-specific stand-alone calculations of potential risk impacts based on the RG 1.200 peer-reviewed FPIE PRA, supported by qualitative analysis insights from the IPEEE study. As sensitivity cases, common cause failure events are treated using the INL common cause data base developed under the auspices of the NRC. The conditional probability of failure of additional components has been adjusted to account for the hypothetical case that a specified inverter has suffered a failure that is fully susceptible to common cause. This is bounding; not all failure modes would be LR-N18-0033 LAR S18-02 Enclosure susceptible to common cause, and consideration of such would lead to lower conditional probabilities and risk increases. 3.2.2.3 Modeled Maintenance Activities PSEG maintenance practices involve protecting other equipment coincident with maintenance being performed on inverters per OP-AA-108-116, Protected Equipment Program [19]. This procedure requires that if a 115V A.C. Vital Instrument Bus (VIB) is unavailable then the remaining VIBs shall be protected. The PRA MOR directly accounts for this maintenance practice and is reflected in the quantitative analysis. In addition, OP-AA-108-116 directs the Operations and Work Management personnel to routinely monitor various maintenance configurations and protect equipment that could lead to an elevated risk condition (e.g., red risk condition) if it were to become unavailable due to unplanned or emergent conditions. This is normally accomplished using a predictive PRA software tool based on the PRA MOR, i.e., EOOS Configuration Risk Monitor program from the Electric Power Research Institute (EPRI). Specific compensatory measures are discussed in the Tier 2 evaluation, Section 3.2.5. 3.2.2.4 Calculational Approach To determine the effect of the proposed Allowed Outage Time for unavailability of the inverters, the guidance provided in Regulatory Guides 1.174 [1] and 1.177 is used. Thus, the following risk metrics are used to evaluate the risk impacts of extending the inverter AOT: Regulatory Guide 1.174 CDFAVE = change in the annual average CDF due to the increase in on-line maintenance unavailability for the 115V A.C. inverters based on the increased Allowed Outage Time. This risk metric is used to compare against the criteria of Regulatory Guide 1.174 to determine whether a change in CDF is regarded as risk significant. These criteria are a function of the baseline annual average core damage frequency, CDFBASE. LERFAVE = change in the annual average LERF due to the increase in on-line maintenance unavailability for the 115V A.C. inverters based on the increased Allowed Outage Time. Regulatory Guide 1.174 criteria were also applied to judge the significance of changes in this risk metric. Regulatory Guide 1.177 ICCDPINV = incremental conditional core damage probability with the 115V A.C. inverters out-of-service for an interval of time equal to the proposed new Allowed Outage Time (7 days). This risk metric is used as suggested in NUMARC 93-01 [35] to determine whether a proposed increase in Allowed Outage Time has an acceptable risk impact. LR-N18-0033 LAR S18-02 Enclosure ICLERPINV = incremental conditional large early release probability with the 115V A.C. inverters out-of-service for an interval of time equal to the proposed new Allowed Outage Time (7 days). NUMARC 93-01 criteria were also applied to judge the significance of changes in this risk metric. The change in the annual average CDF due to the extension of the 115V A.C. inverters Allowed Outage Time for the specified unavailability, CDFAVE, is evaluated by computing the following: TA TA CDFAVE CDFINV OOS 1 CDFBase TCYCLE TCYCLE CDFAVE = CDFAVE - CDFBASE where: CDFBASE = baseline annual average CDF with average unavailability of inverters consistent with the current Allowed Outage Time. CDFINV-OOS = CDF evaluated from the PRA model with the inverter(s) out-of-service and appropriate compensatory measures implemented. CDFAVE= Average CDF based on an increased 7 day inverter AOT TA = Total outage time proposed for the AOT required for the maintenance action and testing of the inverter(s) (i.e., 7 days). TCycle= For this AOT extension, the cycle is assumed to be a calendar year, 12 months of operation (365 days) A similar approach was used to evaluate the change in the average LERF due to the requested Allowed Outage Time, LERFAVE: TA TA LERFAVE LERFINV OOS 1 LERFBase TCYCLE TCYCLE

                                 =

where: LERFBASE = baseline annual average LERF with average unavailability of inverters consistent with the current Allowed Outage Time. LERFAVE= Average LERF based on an increased 7 day inverter OOS LERFINV-OOS =LERF evaluated from the PRA model with the inverter(s) out-of-service and appropriate compensatory measures implemented. TA = Total outage time proposed for the AOT required for the maintenance action and testing of the inverter(s) (i.e., 7 days). TCycle= For this AOT extension, the cycle is assumed to be a calendar year, 12 months of operation (365 days) LR-N18-0033 LAR S18-02 Enclosure In order to calculate CDFINV-OOS and LERFINV-OOS, the testing and maintenance inverter terms are set to true using four individual flag files which are listed in Table 3-5. It is assumed a maximum of one inverter would enter the extended outage in any given year. TABLE 3-5 INVERTER OOS FLAG FILES Case Flag File Inverter A OOS AC1-INV-TM-1A115 EQU .T Inverter B OOS AC1-INV-TM-1B115 EQU .T Inverter C OOS AC1-INV-TM-1C115 EQU .T Inverter D OOS AC1-INV-TM-1D115 EQU .T The incremental conditional core damage probability (ICCDP) and incremental conditional large early release probability (ICLERP) are computed using the definitions from Regulatory Guide 1.177. In terms of the above defined parameters, the definition of ICCDP for the unavailability of the inverters is as follows: ICCDPINV = (CDFINV-OOS - CDFBASE) The ICCDP values are dimensionless probabilities to evaluate the incremental probability of a core damage event over a period of time equal to the extended Allowed Outage Time. Similarly, ICLERP is calculated using the methodology described above: ICLERPINV = (LERFINV-OOS - LERFBASE ) Note that because the time variables are set to 7 days per year for both sets of calculations, CDF/LERF will equal ICCDP/ICLERP for this evaluation. Table 3-6 summarizes the results using the SA115C PRA model for the NRC specified risk metrics (CDF, LERF, ICCDP, and ICLERP) for the proposed change to the AOT of the inverters. The process used to calculate the risk metrics complies with NRC Regulatory Guides 1.174 and 1.177. LR-N18-0033 LAR S18-02 Enclosure Table 3-6 Quantitative Results for the Unavailability of 115V A.C. Inverters CDF/LERF CDF/LERF CDF/LERF RG 1.177 Case Event Trunc INV-OOS AVE ICCDP/ICLERP Guideline CDF 1.00E-11 8.42E-06 8.38E-06 7.85E-10 < 1E-06 Inv A LERF 1.00E-12 4.53E-07 4.47E-07 1.10E-10 < 1E-07 CDF 1.00E-11 8.52E-06 8.38E-06 2.56E-09 < 1E-06 Inv B LERF 1.00E-12 4.56E-07 4.47E-07 1.70E-10 < 1E-07 CDF 1.00E-11 8.77E-06 8.39E-06 7.49E-09 < 1E-06 Inv C LERF 1.00E-12 4.83E-07 4.48E-07 6.90E-10 < 1E-07 CDF 1.00E-11 8.38E-06 8.38E-06 0.00E+00 < 1E-06 Inv D LERF 1.00E-12 4.47E-07 4.47E-07 0.00E+00 < 1E-07 Note that all risk values are significantly below the Acceptance Guidelines of RG 1.177. The calculations of CDF are and LERF are very small, as defined in RG 1.174 (less than 1E-6 and 1E-7 respectively). Salems CDF and LERF are clearly in Region III of Figure 5 in RG 1.174. Therefore, the focus of the uncertainty analysis will be to search for model uncertainties that could approach or exceed the acceptance guidelines. 3.2.2.5 Distribution of Risk Contributors The distribution of initiating event and accident class contributors for the results generated by the Salem Application-Specific Model (ASM) have been reviewed. As the risk metrics depend on the difference between each case and the base case, the importance measures of interest are those of the delterm cutsets, i.e. the difference in the two cutset files. Table 3-7 and Table 3-8 present the initiating events importance measures for delterm FPIE CDF and LERF from the cases for Inverter C, which shows the largest increases. LR-N18-0033 LAR S18-02 Enclosure TABLE 3-7 INITIATING EVENT IMPORTANCE MEASURES FOR CDF Inverter C Initiator Description CDF  % %TT TRANSIENT WITH PCS AVAILABLE INITIATOR 2.47E-06 29% LOOP INITIATOR FOR PLANT/SWITCHYARD - %TES1 UNIT 1 ONLY 1.87E-06 22% %TEW LOOP initiator - weather 1.09E-06 13% %TEG LOOP initiator - Grid 9.06E-07 11% DUAL UNIT LOOP INITIATOR FOR %TES12 PLANT/SWITCHYARD 5.74E-07 7% TRANSIENT WITH PCS UNAVAILABLE %TP INITIATOR 4.96E-07 6% MAIN STEAM LINE BREAK OUTSIDE %TSBO CONTAINMENT INITIATOR 1.74E-07 2% %FLD-SWS-SW-100-B- GENERAL FLOOD IN SW-100-B CAUSED BY 1.14E-07 1% FLD FAILURE OF SWS PIPING %FLD-SWS-SW-100-A- GENERAL FLOOD IN SW-100-A CAUSED BY 1.14E-07 1% FLD FAILURE OF SWS PIPING GENERAL FLOOD WATER SOURCES NOT %FLD-OTH-DG-084-FLD MODELED IN PRA IN DG-084 6.18E-08 1% %FLD-SWS-DG-084 GENERAL FLOOD IN AB-084 CAUSED BY 5.80E-08 1% FLD FAILURE OF SWS PIPING (#1 SW HEADER) %FLD-SWS-DG-084 GENERAL FLOOD IN AB-084 CAUSED BY 5.80E-08 1% FLD FAILURE OF SWS PIPING (#2 SW HEADER) %FLD-SW-100-A-SPR LOCAL SPR FLOOD IN FLOOD AREA SW-100 5.28E-08 1% %FLD-SW-100-B-SPR LOCAL SPR FLOOD IN FLOOD AREA SW-100 5.28E-08 1% GENERAL FLOOD WATER SOURCES NOT %FLD-OTH-TB-088-A-FLD MODELED IN PRA IN TB-088-A 4.27E-08 1% GENERAL FLOOD WATER SOURCES NOT %FLD-OTH-TB-088-B-FLD MODELED IN PRA IN TB-088-B 4.27E-08 1% Other 1.99E-07 2% Total 8.38E-06 100% LR-N18-0033 LAR S18-02 Enclosure TABLE 3-8 INITIATING EVENT IMPORTANCE MEASURES FOR LERF Inverter C Initiator Description LERF  % %TT TRANSIENT WITH PCS AVAILABLE INITIATOR 1.35E-07 30% LOOP INITIATOR FOR PLANT/SWITCHYARD - %TES1 UNIT 1 ONLY 9.96E-08 22% %TEW LOOP initiator - weather 5.66E-08 13% %TEG LOOP initiator - Grid 4.12E-08 9% DUAL UNIT LOOP INITIATOR FOR %TES12 PLANT/SWITCHYARD 2.85E-08 6% TRANSIENT WITH PCS UNAVAILABLE %TP INITIATOR 2.48E-08 6% MAIN STEAM LINE BREAK OUTSIDE %TSBO CONTAINMENT INITIATOR 8.54E-09 2% %FLD-SWS-SW-100-A- GENERAL FLOOD IN SW-100-A CAUSED BY 6.56E-09 1% FLD FAILURE OF SWS PIPING %FLD-SWS-SW-100-B- GENERAL FLOOD IN SW-100-B CAUSED BY 6.56E-09 1% FLD FAILURE OF SWS PIPING STEAM GENERATOR 11 TUBE RUPTURE %S4-A INITIATOR 3.84E-09 1% STEAM GENERATOR 12 TUBE RUPTURE %S4-B INITIATOR 3.84E-09 1% STEAM GENERATOR 13 TUBE RUPTURE %S4-C INITIATOR 3.75E-09 1% STEAM GENERATOR 14 TUBE RUPTURE %S4-D INITIATOR 3.75E-09 1% %FLD-OTH-DG-084- GENERAL FLOOD WATER SOURCES NOT 3.42E-09 1% FLD MODELED IN PRA IN DG-084 %FLD-SWS-DG-084 GENERAL FLOOD IN AB-084 CAUSED BY 3.16E-09 1% FLD FAILURE OF SWS PIPING (#1 SW HEADER) %FLD-SWS-DG-084 GENERAL FLOOD IN AB-084 CAUSED BY 3.16E-09 1% FLD FAILURE OF SWS PIPING (#2 SW HEADER) %FLD-SW-100-A-SPR LOCAL SPR FLOOD IN FLOOD AREA SW-100 2.83E-09 1% %FLD-SW-100-B-SPR LOCAL SPR FLOOD IN FLOOD AREA SW-100 2.83E-09 1% Other 9.46E-09 2% Total 4.47E-07 100% First, a loss of offsite power (LOOP) is overwhelmingly significant to the change in plant risk metrics due to the considered AOT change. The PCS transient initiator (%TT) and LOOP initiators (initiators that begin with %TE) appear in the cutsets via station blackout sequences. The transient initiator reaches that state via a coincident loss of power to the 500kV switchyard. These account for over 80% of CDF and LERF. Such a high importance comports with the inverters sole, vital function as part of A.C. power distribution to Class 1E equipment - any change in plant risk due to their maintenance must naturally proceed from a challenge to A.C. power. The other initiators contribute negligible amounts of risk. LR-N18-0033 LAR S18-02 Enclosure Further review of the delterm cutsets revealed the top actions and equipment contributing to the increase in risk. The top operator actions include failure to locally close the service water turbine header valve, failure to align the FLEX DG, failure to start and align the non-safety related Auxiliary Feedwater System pump, and failure to manually start the emergency diesel generator upon failure of auto start. The top equipment failures leading to an increase in risk include failure of any of the diesel generator and the gas turbine generator. These are as expected because in the event of a loss of offsite power, the top priority is aligning/ starting emergency diesel generators and keeping the core covered. Results from cases for Inverters A and B are slightly different due to differences in loads served. They are both less than the Inverter C cases, with lower contributions due to the turbine trip with a coincident loss of power. Different cutsets appear for these inverters following a steam generator tube rupture due to the need to manually close AFW discharge valves to isolate the ruptured steam generator after random faults of associated buses or transformers, while the power failures also prevent valves from opening for shutdown cooling. However, the overall contributions of these differences are still quite low and less than the Inverter C case. Results from the Inverter D case show zero result at the normal truncation levels. A review of the functions of Inverter D support that result, as its primary loads that impact the PRA are the power to the Auxiliary Spray and AMSAC. Examining cutsets for transients run under conservative conditions to cause more cutsets to be produced, the most likely cutsets would be a combination of a loss of power to an Auxiliary Spray valve with a random PORV failure that would prevent the plant from mitigating a SGTR. On a LOOP, the ATWS Mitigation System Actuation Circuitry failures would be coupled with other instrumentation failures to fail the trip of the main turbine during an ATWS. However, all of these cases are well below normal truncation limits and much less than the other inverter cases. 3.2.2.6 Summary of Results for Internal Events The results presented in Table 3-6 are well below the regulatory guidelines for a license amendment request: The CDF and LERF risk metrics are well below the RG 1.174 acceptance guidelines for Region III, i.e., very small risk change. The ICCDP for the inverter AOT is well below the RG 1.177 acceptance guideline. The ICLERP for the inverter AOT is well below the RG 1.177 acceptance guideline. 3.2.3 External Events Considerations 3.2.3.1 Overview Salem does not have separate probabilistic risk assessments (PRA) for Fire, External Flood, or Seismic events. An internal Fire PRA (FPRA) is currently under development. The FPRA was developed as part of the station license renewal project. However, the FPRA did not yet undergo an industry peer review as required by NRC Regulatory Guide 1.200 for use in risk informed regulatory applications. PSEG is working to complete the FPRA. The current version, which follows the methodology of NUREG/CR-6850 with some incorporation of more recent data and methods can be used to provide valuable insights, but not quantitative information. LR-N18-0033 LAR S18-02 Enclosure Salem completed an Individual Plant Examination of External Events in 1996 [9]. Each of the Salem external event evaluations were reviewed as part of the submittal by the NRC and compared to the requirements of NUREG-1407 [21]. Section 1.4 of the IPEEE summarizes the major findings and states that fire and seismic events were the only important contributors to external events core damage. The fire related CDF was 2.3E-05 per year. The seismic related CDF was 9.5E-06 per year using a more conservative hazard curve (LLNL) and 4.7E-06 per year using a curve described as more realistic (EPRI). Section 1.4.3 of the IPEEE explains how the risk of High Winds, External Flood and other external events were screened out as insignificant. The risk increases related to the plant changes in this application due to fire, seismic, and external flood events are discussed in the following sections. 3.2.3.2 Fire PRA The IPEEE analysis of the impact of internal fires consisted of a screening of fire areas based on EPRI Fire Induced Vulnerability Evaluation (FIVE) methodology [22]. As prescribed by the FIVE methodology, detailed area-by-area equipment and cable inventories were developed from the Appendix R Safe Shutdown Analysis (SSA) [23], and the Fire Hazards Analysis (FHA) [24]. The fire evaluation was performed on the basis of fire areas, which are plant locations completely enclosed by rated fire barriers. The fire area boundaries were assumed to be effective in preventing a fire from spreading from the originating area to another area based on the implementation of a satisfactory fire barrier surveillance and maintenance program, and observation during the walkdown. The fire area boundaries recognized in this study are defined in Sections 3 through 5 of the Salem Generating Station FHA and in the SSA. Qualitatively, an area was screened out if the area neither contained safe shutdown equipment nor called for a manual or automatic plant trip, given the condition that all equipment in the area is damaged. Quantitatively, an area was screened out if the CDF could be shown to be less than 1E-06 per year, assuming a reactor trip and all equipment in the area failed and was unrecoverable. In theory, the contribution to core damage frequency from fires anywhere in the plant may be assessed in detail. However this was impractical due to the large number of possible scenarios and also unnecessary, since fires in many plant areas are incapable of causing significant damage regardless of how severe they become. Consequently, the first stage in performing a fire analysis was to perform a systematic screening of all fire areas in accordance with the FIVE methodology. Areas not screened quantitatively or qualitatively were retained for a further detailed PRA evaluation. The purpose of the qualitative screening was to identify the boundaries of the plant fire areas, together with the location of equipment and cables which, if damaged by fire, would cause a plant shutdown or degradation of shutdown paths identified in the plant's SSA or IPE. This information was then used to qualitatively screen fire areas from further consideration using the criteria developed in the FIVE methodology. The steps involved in qualitative screening included the following: Step 1 - Identification of Fire Areas Step 2 - Identification of Plant Safe Shutdown Systems Step 3 - Identification of Safe Shutdown Equipment in Each Fire Area Step 4 - Perform Fire Area Safe Shutdown Function Evaluation LR-N18-0033 LAR S18-02 Enclosure For the quantitative screening analysis, the FIVE methodology provided a method of screening based on a conservative estimation of the contribution to CDF. The equipment contained within an area was assumed to fail due to a fire. Using an event tree representative of the most significant failure, the contribution to CDF was then calculated. If this contribution was less than 1E-06 per year using the fault tree and event tree models from the IPE, the area or compartment was able to be screened out. Additionally, Section 1.4.2 of Salems IPEEE discusses the station fire risk. As part of this internal fire analysis one potential plant vulnerability was identified, and a plant enhancement has been implemented as a result [25]. There are two sets of cables supplying offsite power to the 4kV vital buses and these are routed through one elevation of the turbine and service buildings before entering the auxiliary building. The two sets provide a redundant source of power to the vital 4kV buses. Thus, if one set is damaged by fire, the second set could provide power to all three buses. In the turbine and service buildings, the two redundant sets of cables are separated by less than 10 feet for a portion of the area. No significant fixed combustible sources are located within 30 feet of the cables and are therefore not considered to be risk significant. However, as a result of the fire IPEEE, transient combustible controls similar to those in place for the auxiliary building, penetration areas and service water intake structure have been put into effect for this area of the turbine and service buildings. The internal fire PRA model was credited with this enhancement and was reflected in the IPEEE results. The total CDF from fire events in the IPEEE was calculated to be 2.3E-05 per year. The top four scenarios are described as follows: 24% of the total CDF (5.5E-06 per year) caused by a fire in the relay room that damages more than one cabinet and requires control room abandonment. Core cooling by alternate shutdown methods is unsuccessful, leading to core damage. 9.1% of the total CDF (2.1E-06 per year) caused by a fire in the control room which damages consoles 1, 2, or 3 and requires control room abandonment. Core cooling by alternate shutdown methods is unsuccessful, leading to core damage. 7.4% of the total CDF (1.7E-06 per year) caused by a relay room fire with damage limited to one electrical cabinet. Control room functions remain available but degraded. Core cooling is unsuccessful, leading to core damage. 4.6% of the total CDF (1.1E-06 per year) caused by a control room fire with damage limited to control console 3. Equipment damage requires control room abandonment. Core cooling by alternate shutdown methods is unsuccessful, leading to core damage. Another perspective of fire risk is the relative importance for a fire in each area. The top four areas are the relay room (31%), control room (30%), the 460V A.C. switchgear room (7%), and the 4kV A.C. switchgear room (7%). Core damage following a relay or control room fire arise primarily from failure to implement alternate shutdown methods following control room abandonment. Such fire scenarios may damage multiple trains of equipment, so the status of a particular component being out-of-service would have a negligible impact since it would have been damaged anyway. The switchgear room fires cause loss of one vital bus. Additional equipment becomes unavailable if the fire is not suppressed. Random failures of equipment unaffected by fire then lead to core damage for these scenarios. LR-N18-0033 LAR S18-02 Enclosure As an additional set of stand-alone calculations, the potential impact of fire events on the risk assessment is considered using inputs from the full-power internal events which has been shown to be technically adequate per peer review in accordance with RG 1.200. The steps to determine the potential impact of fire events for proposed extensions are: Determine fire initiating event frequencies Determine the power sources required for event mitigation Determine the change in inverter unavailability Determine the impact on risk metrics The fire ignition frequencies used for this calculation are from the current work-in-progress fire PRA. The plant-specific internal fire boundaries have been identified and the physical analysis units have been defined in accordance with NUREG/CR-6850. The fire ignition frequencies have been calculated from Supplement 1 of NUREG/CR-6850 (FAQ 08-0048) and NUREG-2169. The frequencies for all of the ignition sources are summed, accounting for severity factors and non-suppression probabilities. Each fire scenario is assumed to impact all but one inverter. This is a conservative assumption, since for any cases that impact all inverter trains, there would be no change in risk due to additional unavailability since they would all be failed by the fire. The extended AOT of the 115V A.C. inverters will have the greatest impact during a loss of offsite power event. Each of the three 4160V A.C. vital buses can be connected to an auto starting Emergency Diesel Generator, which provides emergency power for safe shutdown in the event the offsite power source is lost. The 115V A.C. power system supplies multiple sources, including the safeguards equipment control (SEC) and backup to the three 4160V A.C. vital buses in the event of a loss of all A.C. power event. In the event that a single 115V A.C. inverter is out of service, there is an alternate 230V A.C. power source (via a 12kVA AC Line Regulator and Static Switch) which can provide back-up for that specific bus. In the event that a fire impacts the 230V A.C. power source, the extended outage time of the inverters would be irrelevant. The failure probability of the alternate 230V A.C. source is calculated while an inverter is out of service by solving the 230V A.C. gate in the PRA model. Additionally, a flag file is used to set the inverter testing and maintenance events to true, and set all initiating events to false. There are multiple versions of the alternate 230V A.C. power supply failure gate in the PRA model. Some versions of those gates include diesel generator failure logic which leads to failure of the SEC. In the loss of power conditions being analyzed, the power to the main 1E 4kV buses would be provided by the diesel generator, and therefore a diesel generator failure is irrelevant for the delta-risk calculation since failure of the diesel would leave the actual equipment without power as well. The gates chosen to represent alternate 230V A.C. power therefore only include dependencies between the 4 kV bus and the 120V A.C. panel being powered by the 230V A.C. alternate power. The gates selected are listed in Table 3-10. To determine the change in unavailability for the inverter, the probability of the old inverter testing/maintenance basic event is subtracted from the new increased basic event probability. This was conservatively calculated for all 4 inverters. See Table 3-9 for more details on this calculation. LR-N18-0033 LAR S18-02 Enclosure Table 3-9 Change in Inverter Unavailability Description Basic Event Old UA New UA UAINV 115V A.C. Inverter AC1-INV-TM-2.00E-04 1.40E-03 1.20E-03 1A 1A115 115V A.C. Inverter AC1-INV-TM-2.00E-04 1.40E-03 1.20E-03 1B 1B115 115V A.C. Inverter AC1-INV-TM-2.00E-04 1.40E-03 1.20E-03 1C 1C115 115V A.C. Inverter AC1-INV-TM-2.00E-04 4.67E-04 2.67E-04 1D 1D115 Based on this expected sequence of events, the risk impact related to the change in inverter unavailability can be conservatively estimated as: CDF = FIE-F x UAINV x PBU where: FIE-F = Fire initiating event frequency (based on NRC guidance as discussed above) UAINV = Change in inverter unavailability PBU = Probability of failure of back up 230V power supply The values used for each case are: Table 3-10 Delta CDF Calculation for Fire Events Inverter A B C D FIE = 4.62E-01 4.62E-01 4.62E-01 4.62E-01 UAINV = 1.20E-03 1.20E-03 1.20E-03 2.67E-04 PBU Gate G18X102 G37X102 GXCB102X G1DB102 PBU = 1.53E-04 1.19E-04 1.53E-04 2.83E-04 CDF = 8.48E-08 6.60E-08 8.48E-08 3.49E-08 Following the most conservative case, CDFtotal = 8.48E-08 /yr Since the change in CDF is negligible, the LERF impact will also be negligible and the CDF and LERF changes meet the acceptance criteria in RG 1.174. 3.2.3.3 Seismic PRA The seismic risk analysis provided in the Salem Individual Plant Examination for External Events is based on a detailed Seismic Probabilistic Risk Assessment. A Seismic Probabilistic LR-N18-0033 LAR S18-02 Enclosure Risk Assessment analysis approach was taken to identify any potential seismic vulnerabilities at Salem. The Seismic PRA method was deemed an acceptable methodology identified in NUREG-1407. This PRA technique included consideration of the following elements: Seismic hazard analysis Seismic fragility assessment Seismic systems analysis Quantification of the seismically induced core damage frequency The IPEEE assessment incorporates quantification and model elements (such as system fault trees, event trees, random failure rates, common-cause failures, etc.) consistent with state of the practice in the 1990s. Since the methodology for seismic PRA has evolved significantly, the IPEEE assessment cannot be used for quantitative insights. Therefore, PSEG has neither incorporated the latest seismic hazard information into the IPEEE model nor reviewed the IPEEE assessment to determine the effect of any procedural or equipment changes. Instead, the assessment of extension of inverter AOTs will be based on more recent seismic hazard evaluations and walkdowns and on the up-to-date Salem internal events PRA model. Because damage to equipment during seismic events is often correlated across trains, extension of AOTs for most components will have a negligible impact on seismic risk estimates. If a component is failed during a particular seismic event, its corresponding opposite train component is also likely to fail; therefore, whether it was out-of-service or not is irrelevant. If a component is not failed during a particular seismic event, it will then only contribute to seismic risk when its corresponding opposite train component is out-of-service due to random failures, which are very low and bounded by the internal events analysis. As such, it can qualitatively be inferred that there would be no significant impact on seismic risk due to extending the AOT for these components. As an additional set of stand-alone calculations, the potential impact of seismic events on the risk assessment is considered using inputs from the full-power internal events which has been shown to be technically adequate per peer review in accordance RG 1.200. The steps to determine the potential impact of seismic events for proposed extensions are: Determine the accidents that can result from a seismic event Determine the systems of interest Determine how the system of interest is used to mitigate the seismically induced event Determine the impact on risk metrics The primary seismic event of interest for this assessment is a LOOP. The largest seismic events are expected to cause LOCAs and additional failures, making small changes in the availability of 115V A.C. inverters a negligible impact as discussed above. For a seismically-induced LOOP event, emergency diesel generators (EDGs) are required to start and run, AFW is required to provide secondary side heat removal, and RCP seal cooling (injection or thermal barrier cooling) must continue to prevent an RCP seal LOCA. This neglects the impact of any new RCP seals that may be installed currently or in the future. The only functions that may be impacted by the AOT changes are the power systems required to safely shutdown. The 115V A.C. power system supplies multiple sources, including the LR-N18-0033 LAR S18-02 Enclosure safeguards equipment control (SEC) and backup to the three 4160V A.C. vital buses in the event of a loss of all A.C. power event. The change in risk for seismic events is computed as an incremental conditional core damage probability similar to Section 3.2.2.4. Over a one-year time frame, this is generally equivalent to a change in CDF. The general equation is as follows: ICCDPINV = (CDFINV - CDFBASE)TINV For the case of specific initiating events, each CDF can be calculated as the frequency of the initiating event times the conditional core damage probability (CCDP) given that initiating event, or: ICCDPINV = f(Seismic LOOP)*(CCDPINV - CCDPBASE)*TINV The seismically induced LOOP frequency is calculated by summing all of the seismically-induced LOOPs from all categories of seismic events in LR-N14-0051[26] 1. The calculation of the CCDP values is quantified conservatively assuming that LOOP recovery is not possible. The calculation of ICLERP is similar. Applying these assumptions and calculations, with the TINV set to 7 days per year (1.92E-2) yields the estimates of seismic ICCDP and ICLERP in Table 3-11. Table 3-11 Risk Calculation for Seismic Events Inverter CCDP(INV) CCDP(BASE) CLERP(INV) CLERP(BASE) ICCDP ICLERP A 6.28E-04 6.15E-04 7.11E-05 6.62E-05 5.39E-12 2.06E-12 B 6.89E-04 6.15E-04 7.44E-05 6.62E-05 3.10E-11 3.44E-12 C 6.49E-04 6.15E-04 6.96E-05 6.62E-05 1.39E-11 1.43E-12 D 6.15E-04 6.15E-04 6.62E-05 6.62E-05 0.00E+00 0.00E+00 In summary, for scenarios that would damage multiple trains of equipment, the status of a particular component being out-of-service would have a negligible impact since it would have been damaged anyway. Where a seismic scenario only damages one component, the impact would be seen with the opposite train component out-of-service, and those impacts are estimated to be very low based on these stand-alone calculations. 3.2.3.4 External Flooding PRA 3.2.3.4.1 Background Information Regarding External Flooding The following provides a brief discussion of relevant Salem Flood Protection Features and the highlights of the IPEEE Screening and Re-evaluated Flood Hazard. A later sub-section then summarizes the main results from the risk calculations for the LAR. 1 Frequency based on calculation using values from PSEG's Response to 10 CFR 50.54(f) Recommendation 2.1 of the Near-Term Task Force Review of the Fukushima Accident - Salem Generating Station, LR-N14-0051, March 2014. LR-N18-0033 LAR S18-02 Enclosure Flood Protection Features Salem relies on both passive and active incorporated flood protection features to establish its design basis flood protection. Doors and penetrations in exterior walls of the containment, service water intake, auxiliary and penetration areas are protected against water inflow up to elevation 120.4 ft. Public Service Datum (PSD). Penetrations in exterior walls and slabs of the Station Service Water System intake structure are protected against water inflow up to elevation 126 ft. PSD with wave run up protection to 128.0 ft. PSD. These flood protection features include the buildings themselves, penetration seals, waterproofing, and watertight doors. The Salem flood protection features are part of the design and licensing basis of the plant and have clearly defined hydraulic capability characteristics. During Salem's Response to Recommendation 2.3: Flooding Walkdown of the Near-Term Task Force Review of Insights from the Fukushima Dai-ichi Accident [36, 37, 38], Salem's flood protection features were reviewed and show adequate margin above design basis flood elevations. The flooding walkdown report provides additional information on the flood protection features credited in the Salem licensing basis. Performance of the walkdowns provided confirmation that flood protection features are in place, are in good condition and will perform as credited in the current licensing basis. Minor issues were entered in the PSEG Corrective Action Program (CAP). No operability concerns were identified. As shown in Table 2.1-3 of PSEG Letter LR-N14-0042 [39], watertight door thresholds at Salem are at elevation 10.2 ft. North American Vertical Datum of 1988 (NAVD88) (100.2 ft. PSD). The plant's design basis flood protection features are established to mitigate the effects of a hurricane storm surge event, with the flood protection elevations at 120.4 ft. PSD or higher. Salem flood protection features do not include any temporary features that require implementation of a procedure for performance of manual/operator actions in order for the feature to perform its intended flood protection function. The watertight doors are the only active flood protection features at Salem. The balance of the flood protection features are passive and continually maintain their full hydraulic capability. IPEEE Screening All "other external events" identified in NUREG/CR-2300 have been screened out by bounding probabilistic analyses that demonstrate a core damage frequency of less than the IPEEE screening criterion of 1E-6/yr or by compliance with the 1975 Standard Review Plan (SRP) criteria. For external floods, Salem did a Bounding Analysis as defined in Section 5.2.5 of NUREG-1407. The IPEEE reports that hurricane-induced flooding dominates all other sources of flooding. The walkdown and semi-quantitative analysis of the IPEEE identified 3 potentially significant water ingress paths: 1) penetrations in the 88 level of the Service Building that lead to the Auxiliary Building, 2) flood doors mistakenly left open, and 3) the fabric that seals the gap between the Auxiliary Building penetrations rooms and the containment. Path 1) was judged to be important, and PSEG completed installation of a retrofit penetration seal material in the 1990s that eliminated paths 1) and 3). The current Adverse Environmental Condition procedure, described in the next section, ensures that flood doors are kept closed. Re-evaluated Flood Hazard As discussed in the Flood Hazard Reevaluation Report (FHRR Section 3 of LR-N14-0042), Salem is susceptible to flooding above plant grade from Local Intense Precipitation (LIP) and Storm Surge based flooding events. Probable Maximum Flood events that address the effects of upstream riverine flooding only produce flood levels above plant grade when combined with LR-N18-0033 LAR S18-02 Enclosure storm surge events. Other NUREG/CR-7046 postulated flooding mechanisms do not produce sufficient water surface elevations in the Delaware River and Bay to cause flooding in excess of plant grade. The FHRR (Section 1.3) notes there have been no changes to the flood protection features themselves since initial licensing. Procedural actions have been enhanced to respond to potential flood threats. 3.2.3.4.2 Qualitative Discussion of External Flooding This subsection is structured to show that the margins below the NRC acceptance criteria still apply based on current knowledge of external flooding risk at Salem. PSEG is providing a detailed qualitative assessment based on recent analyses and current procedures that shows that the external flooding risk is still very low. Frequency of External Flooding Mechanisms LIP and Storm Surge based flooding events that produce water levels that challenge the plant's design basis flood protection features are events with annual exceedance probabilities of 1E-6 or smaller, as discussed in Section 2.4 of LR-N14-0042. The annual exceedance probability of flood levels that could exceed the watertight door thresholds did not need to be calculated for the FHRR; however, PSEG did assess these levels during the development of the FHRR and subsequent activities [40]. Based on a representative analysis performed by EPRI [41], the rainfall rate used in Section 2.1 of the FHRR to evaluate the LIP event is estimated to have an annual exceedance probability between 1E-7 to 1E-9. To support development of a trigger to implement watertight door closure for a LIP event, PSEG assessed the rate of rainfall required to exceed watertight door thresholds. Based on the same conservative modeling approaches described in the FHRR (LR-N14-0042, Section 2.1), approximately 6 inches of rain in 6 hours could challenge the threshold. OP-AA-108-111-1001, Severe Weather and Natural Disaster Guidelines, provides a guide for response to impending severe weather conditions by members of Salem/Hope Creek in order to assure personnel and assets are adequately protected. Additionally, it provides programmatic guidance to nuclear personnel for reaction to severe weather conditions [42]. Conservatively, SC.OP-AB.ZZ-0001, Adverse Environmental Conditions, which contains a trigger of a predicted 6 inches of rain in the next 24 hours is now used to implement watertight door closure in advance of a heavy rainfall event [43]. The US Army Corps of Engineers (USACE) completed a Storm Surge Study for Federal Emergency Management Agency (FEMA) Region Ill, which encompasses the Delaware River and Bay areas in 2013 [44]. This study estimated still water surface elevations of 10.7 ft. NAVD and 12.1 ft. NAVD for recurrence intervals of 500 and 1000 years, respectively. These elevations equate to approximately site grade and the watertight door threshold, respectively. Impact of External Flooding Mechanisms on Plant Operation and Structures Including the Ability to Cope with Upset Conditions As discussed in LR-N14-0042, the reevaluated flooding events could produce flood levels that are above the watertight door thresholds, but below the plant's minimum flood-protected elevation of 120.4 ft. PSD. The plant's design basis flood protection features are established to mitigate the effects of a hurricane storm surge event. Protection of safety related systems, structures, and components (SSCs) is ensured by implementing severe weather guidance LR-N18-0033 LAR S18-02 Enclosure document OP-AA-108-111-1001, "Severe Weather and Natural Disaster Guidelines" and abnormal operating procedure SC.OP-AB.ZZ-0001, "Adverse Environmental Conditions". Performance of the walkdowns provided confirmation that flood protection features are in place, are in good condition and will perform as credited in the current licensing basis (CLB). Minor issues were identified and entered in the PSEG CAP. No operability concerns were identified. The overall strategy for protecting the Salem from a flooding event requires simple and straightforward actions. Response to a flood event begins with the Control Room Supervisor monitoring the National Weather Service for storm warnings. Plant safety is then ensured by implementing severe weather guidance and an abnormal operating procedure, which instruct operators to close watertight doors. LR-N14-0042 provides additional discussion of the temporal characteristics of these hypothetical events in Sections 2.10.6. As described later in this document, PSEG operators should execute these procedures with no particular challenge. Operating Experience Associated with Reliability of Flood Protection Measures Evaluation of the overall effectiveness of the Salem flood protection features was performed and documented in the Salem Response to Recommendation 2.3: Flooding Walkdown of the Near-Term Task Force Review of Insights from the Fukushima Daiichi Accident. The review of the flood protection features design and licensing documentation, and subsequent field inspection of the applicable physical flood protection features was implemented per the guidance provided within NEI 12-07 [45]. PSEG has implemented ER-AA-310-101 Condition Monitoring of Maintenance Rule structures [46] for structures such as flood control features: concrete walls and slabs, water-control structure elements, penetration seals, etc. Salem safe shutdown SSCs are currently protected by means of permanent/passive measures and permanent active features, i.e., watertight doors. Watertight door closure can be performed within the warning time provided by proceduralized triggers, as shown by Salem operating experience (e.g., the flooding walkdown report in LR-N12-0370 documents actual closure can be performed within the required period of time following exceedance of a high river water level trigger). Therefore, the manual actions required to implement the flood response strategy (i.e., watertight door closure) are feasible and the overall implementation of the strategy is adequate. Performance of the walkdowns provided confirmation that flood protection features are in place, are in good condition and will perform as credited in the CLB. Minor issues were identified and entered in the PSEG CAP. No operability concerns were identified. Reliability of Operator Actions Operator actions required for flood protection actions are contained in SC.OP-AB.ZZ-0001, Adverse Environmental Conditions. This procedure would be entered for conditions that could result in onsite flooding, including: Extreme High River Levels. Severe weather observed or expected, as reported by the National Weather Service for Salem County, in the form of high winds (greater than 40 mph sustained or greater than 58 mph gusts from any direction) and/or excessive precipitation (Hurricane, Tropical Storm, Tornado, or Severe Thunderstorm Warning). Wind Speeds of greater than 30 mph (sustained) from sector between 140 degrees (SE) to 240 degrees (WSW)predicted to occur within the next 8 hours. LR-N18-0033 LAR S18-02 Enclosure The National Weather Service Probabilistic Quantitative Precipitation Forecast (PQPF) predicts Local Intense Precipitation (LIP) to exceed 6 inches over the next 24 hours. The abnormal procedure directs operators to increase monitoring of river levels and perform closure of water tight doors onsite. Operators have indications available in the control room that are used to monitor river level conditions and the actions to close water tight doors are within the capability of the minimum shift complement to complete. The entry into the abnormal operating procedure under the conditions described above provides sufficient time for the operators to complete required actions such that they can be relied upon to be completed prior to water levels on site approaching the 102 ft. PSD where flooding could impact system operations. Periodic testing of the watertight doors ensures their continued flood protection capability and demonstrates operator proficiency at performing this task. 3.2.3.4.3 Semi-Quantitative Treatment of External Flooding The potential impact of external flooding events on this risk assessment is considered using inputs from the full-power internal events which has been shown to be technically adequate per peer review in accordance RG 1.200. The steps to determine the potential impact of external flooding events for the proposed extensions are: Determine the surrogate initiating event that can be used to simulate an external flood Determine the system response to the initiating event Determine how the system of interest is used to mitigate the flood induced event Determine the impact on risk metrics An upper bound estimate of external flooding hazards was established by comparing external flooding events to a loss of offsite power (LOOP). The NRC Initiating Event data does not include any external-flood induced initiating events, though it does include other external events that have occurred (e.g., fires, seismic events). Weather-induced LOOPs have occurred, and are therefore more frequent than external-flood events. Therefore, it can be assumed that the frequency of an external flooding event is bounded by weather-induced LOOP (frequency of 4.09E-03 per year in the Salem PRA). Furthermore, while an external flooding event may not cause a LOOP, any increased risk due to extended inverter outages will only occur due to a LOOP-type event, so an external-flood-induced LOOP will be assumed. In the internal events PRA, weather-induced LOOP is modeled with a statistically determined recovery curve. While recoverable weather induced LOOPs have been observed with some frequency, unrecoverable events are rare. Thus, use of weather-induced initiating event frequency to bound the non-recovered external event frequency is considered appropriate. However, due to uncertainties regarding recovery of offsite power during an external-flood-induced LOOP, no credit for offsite power recovery will be credited in this calculation. Any external flooding analysis has to address beyond design basis floods and penetration seal failures. A full external flood PRA would be required to quantify the absolute risk of these scenarios, but the analysis in the section only addresses the incremental risk of these floods associated with increasing inverter unavailability. Though the most extreme beyond design basis floods are likely to cause additional failures that would make the status of the inverters inconsequential, for this calculation all external floods are assumed to be at a level where a LOOP is created but the inverters are still important. LR-N18-0033 LAR S18-02 Enclosure Penetration seals could fail at flood levels below the plants design basis level. Salem takes steps to minimize this probability. Additionally, Salem has procedures that will mitigate any accident scenarios associated with penetration seal failures. These potential failures will increase the absolute risk associated with external floods, but will have little effect on the incremental risk associated with inverter unavailability. By using a very conservative initiating event frequency and non-recovery probability for offsite power, the incremental risk is accounted for in the following calculations. The change in risk for an external flood event is computed as an incremental conditional core damage probability similar to Section 3.2.2.4. Over a one-year time frame, this is generally equivalent to a change in CDF. The general equation is as follows: ICCDPINV = (CDFINV - CDFBASE)TINV For the case of specific initiating events, each CDF can be calculated as the frequency of the initiating event times the conditional core damage probability (CCDP) given that initiating event, or: ICCDPINV = f(External Flood LOOP)*(CCDPINV - CCDPBASE)*TINV The calculation of the CCDP values is quantified conservatively assuming that LOOP recovery is not possible. The calculation of ICLERP is similar. Applying these assumptions and calculations, with the TINV set to 7 days per year (1.92E-2 yr) yields the estimates of flood ICCDP and ICLERP in Table 3-12. Table 3-12 Risk Calculation for External Flood Events Inverter CCDP(INV) CCDP(BASE) CLERP(INV) CLERP(BASE) ICCDP ICLERP A 6.28E-04 6.15E-04 7.11E-05 6.62E-05 1.01E-09 3.84E-10 B 6.89E-04 6.15E-04 7.44E-05 6.62E-05 5.79E-09 6.43E-10 C 6.49E-04 6.15E-04 6.96E-05 6.62E-05 2.60E-09 2.67E-10 D 6.15E-04 6.15E-04 6.62E-05 6.62E-05 0.00E+00 0.00E+00 This bounding calculation indicates that total risk is small enough that changes to extend Allowed Outage AOTs for inverters do not have a significant effect on overall risk. The unavailability does not significantly affect this bounding calculation and could not affect a more realistic calculation. The risk increases are several orders of magnitude below the RG 1.177 decision criteria of ICCDP<1.0E-6 and ICLERP<1.0E-7. Thus, changes to risk associated with external floods cannot change the conclusion of the LAR. 3.2.3.5 Other External Hazards In addition to internal fires and seismic events, the Salem IPEEE analysis of high winds or tornados, external floods, transportation accidents, nearby facility accidents, release of onsite chemicals, detritus and other external hazards was accomplished by reviewing the plant environs against regulatory requirements regarding these hazards. The screening assessment took advantage of the fact that the site is co-located with the Hope Creek Generating Station (HCGS), which is a plant that meets the 1975 Standard Review Plan (SRP) criteria [27]. To the LR-N18-0033 LAR S18-02 Enclosure extent that the event assessment is based on location of the site, as opposed to plant specific features, information from Sections 2 and 3 of the latest revision of the HCGS Updated FSAR (UFSAR) [28] was used to supplement information from the Salem UFSAR [29]. The class of external events termed "other external events" were screened out either by compliance with the 1975 SRP criteria or by bounding probabilistic analyses that demonstrated a core damage frequency of less than the IPEEE screening criterion. The external flood assessment provided input to the now completed PSEG Penetration Improvement Program by recommending that a high priority be placed on penetrations through the Auxiliary Building/Service Building walls. The IPEEE provided confidence that no plant-unique external event is known that poses a significant threat of severe accidents and that the Salem units are not vulnerable to other external events. More recently, in response to NRC Order EA-12-049 [30], which was issued following the tsunami and plant consequences experienced at Fukushima-Daichi in March 2011, PSEG developed an Overall Integrated Plan (OIP) [31] to enhance the defense-in-depth countermeasures aimed at mitigating extreme external hazards. The OIP employed the use of Diverse and Flexible Coping Strategies (FLEX) in accordance with the guidance given in NEI 12-06 [32]. This resulted in the deployment of portable FLEX equipment that could be put into service when necessary to mitigate extreme external hazards. Although FLEX is not explicitly modeled in the current PRA model, qualitative insights suggest that the risk due to these other external hazards, as well as other beyond design basis events pursuant to NEI 12-06, would be even less than what was characterized by any historic evaluations performed in support of the IPEEE. 3.2.3.6 External Hazard PRA Summary Due to the fact that Salem does not have a current external events PRA model, the use of stand-alone calculations based on the RG 1.200 peer-reviewed FPIE PRA and insights from IPEEE results was deemed acceptable for use in providing insights into the risk contribution associated with the AOT extension. In summary, the status of a particular inverter being out-of-service would have a negligible impact from an external events perspective. The external event CDFs and LERFs are clearly bounded by the PSEG risk calculations shown in this LAR. In addition, any risk increase would only occur for events that fail all but one (and only one) train of inverters since events that fail all trains or no trains would not be impacted by an extended AOT. Events that failed all but two or three inverters would require multiple random failures, which would be even lower probability than the calculations used. This conclusion is consistent with and supported by the FPIE risk insights. 3.2.4 Discussion of Uncertainty This section evaluates uncertainties that could impact the inverter AOT extension assessment. Overall, this analysis contains all the elements of risk-informed decision-making process described in NUREG-1855 [3]. The structure used to present this information is shown in Figure 3-3, which is taken from the companion document to NUREG-1855 entitled EPRI-1026511, Practical Guidance on the Use of Probabilistic Risk Assessment in Risk-Informed Applications with a Focus on the Treatment of Uncertainty [33]. Table 3-13 provides a roadmap identifying the relevant sections of the uncertainty analysis. LR-N18-0033 LAR S18-02 Enclosure Table 3-13 ROADMAP TO THE UNCERTAINTY ANALYSIS Step Step Summary Document Section 1 Define the risk analysis application to Performed in Section 1. be used to address RG 1.177 2 Assess the adequacy of the existing Performed in Section 3.2.1. Technical PRA models to support the analysis Adequacy of the PRA Model. 3 Perform the initial comparison with the Initial comparison is shown in the acceptance guidelines. Identify Executive Summary and Table 3-7; significant contributors and role of significant contributors (if any) are affected function. identified in Section 3.2.2. 4 Assess the adequacy of the scope of Assessed in Section 3.2.3. the PRA models 5 Perform final comparison with Analyzed in Section 3.2.7. acceptance guidelines - assessment of significance of parameter and model uncertainty 6 Prepare input for the integrated Presented in Section 3.2.7. decision-making process LR-N18-0033 LAR 818-02 Enclosure Yes Yes Step .3! Perform initial rompart withactaft<e.gines. ldentif)l9gnilklllltcontribut<n> son I and *e o( alferu!d function(s) Yes Figure 3-3 Overview of Process for P RA Analysis to Support a Risk Informed Decision 3.2.4.1 Parametric Uncertainty Evaluation The evaluation of the CDF for the inverter AOT extension assessment has been supported by a detailed qualitative and quantitative uncertainty evaluation. The parametric uncertainty quantification is performed using the CAFTA utility, UNCERT, to identify the effect of the parametric correlation. The base model (SA115C) uncertainty distribution for CDF of the application specific model is presented in Figure 3-4. The uncertainty distribution for CDF due to the condition in which an inverter is out of service is shown in Figure 3-5. To be conservative, Inverter C was chosen because it results it the greatest change in risk. Likewise, for LERF, the base model uncertainty distribution is presented in Figure 3-6, with the distribution for LERF while Inverter C is out of service is shown in Figure 3-7. The mean results for each case show similar differences from the point estimates. In addition, the cutset results for the dCDF/LERF assessments were reviewed to determine if an epistemic correlation could influence the mean value determination. From the review of the cutsets, it was determined that the dominant contributors do not involve basic events with epistemic correlations (i.e., the probabilities of multiple basic events within the same cutset for the dominant contributors are not determined from a common parameter value). Per Guideline 2b of EPRI 1016737 [34] it is acceptable to use the point estimate directly in the risk assessment. Therefore, the parameter uncertainty assessment indicates that the use of the point estimate results directly for this assessment is acceptable. LR-N18-0033 LAR S18-02 Enclosure 0.8 I/ 0.6 J I 0.2 I 0 1E-D6 _/ 1E-GS 1E-ll4 1E-ll3 1E-G2 1E-G1 1E+OO 0.8 A 0.6 1\ 0.4 I \ 0.2 I 0 1E-D6 J \. lE-<JS 1E-ll4 1E-ll3 1H2 1H1 1E+OO Parameter Estimate Confidence Range Point Est 8.38E-06 Samples 50000 Mean 8.52E-06 [8.5E-06 I 8.6E-06] 5% 3.65E-06 [3.6E-06 I 3.7E-06] Median 7.07E-06 [7.0E-06 I 7.1E-06] 95% 1.76E-05 [1.7E-05 I 1.8E-05] StdDev 6.53E-06 Skewness 10.23874 Parameter Value Sampling Montecarlo Method Sample Size 50000 Importance FALSE Measures Scope All Cutset File(s) CDF 1E-11.CUT Selected CDF Target(s) Database SA115C.rr FIGURE 3-4 PARAMETRIC UNCERTAINTY DISTRIBUTION FOR SALEM BASE MODE L CDF (SA115C) FOR THE INVERTER AOT EXTENSION APPLICATION MODEL LR-N 18-0033 LAR S18-02 Enclosure 0.8

                              /

0.6 I 0.4 I I J 0.2 0 18l6 1E-ll5 1E*04 1E-<J3 1E*02 1E-ll1 1E.OO 08 /!\. 0.6 I\ I ' I \ 0.4 02 0 1E-o6 J 1E-o5 1E-04 1E-ll3 1E-o2 1E-G1 1E+OO Parameter Estimate Confidence Range Point Est 8.77E-06 Samples 50000 Mean 8.95E-06 [8.9E-06, 9.0E-06] 5% 3.89E-06 [3.9E-06, 3.9E-06] Median 7.47E-06 [7.4E-06 , 7.5E-06] 95% 1.80E-05 [1.8E-05, 1.8E-05] StdDev 7.02E-06 Skewness 16.27634 Parameter Value Sampling Method Montecarlo Sample Size 50000 Importance FALSE Measures Scope All Cutset File(s) CDF_1E-11 DELTA C.CUT Selected Target(s) CDF Database SA115C. rr FIGURE 3-5 PARAMETRIC UNCERTAINTY DISTRIBUTION FOR SALEM CDF REPRESENTING THE INVERTER AOT EXTENSION LR-N 18-0033 LAR S18-02 Enclosure 0.8 0.6 I 0.4 I 0.2 I 0 lE-08

                     /_

1E-ll7 lE-{)6 1815 1E41 lE-03 lE-02 1E-01 1E+OO OS G\. 0.6 /\ 0.4 I \ 02 II \ 0 j \ 1E-Q8 1E-ll7 1E<l6 1E-o5 1E-ll4 1E-03 1E 1E-ll1 1E+OD Parameter Estimate Confidence Range Point Est- 4.47E-07 Samples 50000 Mean 4.50E-07 [4.5E-07 I 4.5E-07] 5% 1.52E-07 [1.5E-07 I 1.5E-07] Median 3.57E-07 [3.5E-07 I 3.6E-07] 95% 1.01E-06 [1.0E-06 I 1.0E-06] StdDev 4.39E-07 Skewness 21.42005 Parameter Value Sampling Method Montecarlo Sample Size 50000 Importance FALSE Measures Scope All Cutset File(s) LERF 1E-12.CUT Selected Target(s) LERF Database SA115C.rr FIGURE 3-6 PARAMETRIC UNCERTAINTY DISTRIBUTION FOR SALEM BASE MODEL LERF (SA115C) FOR THE INVERTER AOT EXTENSION APPLICATION MODEL LR-N18-0033 LAR S18-02 Enclosure 0.8 I I I I lE-07

                      /        lE-06    lE-{15         1E-<l4 1E<l3         1E<l2     1E.01      lE+OO 08                   ""

0.6 I\ 0.4 l \ 02 I \ IJI

                               \

0 1E-Q8 1E.07 1E..il6 1E.o5 1E-<l4 1E-<J3 1E<l2 1E.01 1e....oo Parameter Estimate Confidence Range Point Est 4.83E-07 Samples 50000 Mean 4.90E-07 [4.9E-07, 4.9E-07] 5% 1.64E-07 [1.6E-07 , 1.7E-07] Median 3.85E-07 [3.8E-07, 3.9E-07] 95% 1.10E-06 [1.1E-06, 1.1E-06] StdDev 4.76E-07 Skewness 15.74544 Parameter Value Sampling Montecarlo Method Sample Size 50000 Importance FALSE Measures Scope All LERF_1E-Cutset File(s) 12 DELTA C. CUT Selected LERF Target(s) Database SA115C.rr FIGURE 3-7 PARAMETRIC UNCERTAINTY DISTRIBUTION FOR SALEM LERF REPRESENTING THE INVERTER AOT EXTENSION LR-N18-0033 LAR S18-02 Enclosure 3.2.4.2 Model Uncertainty The assessment of model uncertainty utilizes the guidance provided in EPRI 1016737 and in NUREG-1855 and considers the following: Characterize the manner in which the PRA model is used in the application. Characterize modifications to the PRA model. Identify application-specific contributors. Assess sources of model uncertainty in the context of important contributors. o Also consider other sources of model uncertainty from the base PRA model assessment for the identification of candidate key sources of uncertainty. o Screen based on relevance to parts of PRA needed or based on relevance to the results. Identify sources of model uncertainty and related assumptions relevant to the application. o This involves the formulation of sensitivity studies for those sources of uncertainty that may challenge the acceptance guidelines and an interpretation of the results. 3.2.4.2.1 Characterize the Manner in which the PRA Model is used in the Application The manner in which the PRA model is used in this application is fully described in Section 3.2 and is not reproduced here. 3.2.4.2.2 Characterize Modifications to the PRA Model The minor changes made to the PRA model of record (MOR) are described in Section 3.2.1.5. These changes made to the model do not introduce any application-specific sources of model uncertainty for this analysis. 3.2.4.2.3 Identify Application-Specific Contributors Application-specific contributors are fully discussed in Section 3.2.2.5 via examination of resulting cutsets and delete-term cutsets. The important contributors to the delta-risk metrics were identified as increases due to a few specific initiating events that are more impacted by the potentially increased unavailabilities. These initiating events are based on industry and plant-specific data and calculated using accepted realistic methods. Therefore, these application-specific contributors do not introduce any new sources of model uncertainty. 3.2.4.2.4 Assess Sources of Model Uncertainty in Context of Important Contributors to the Base Model A review of the identified sources of model uncertainty from the base model assessment as identified by implementing the process outlined in EPRI 1016737 for Salem was performed to determine which of those items are potentially applicable for this assessment even though they did not appear as a dominant contributor in the base assessment for the application. Based on this review, some of the items were already identified and many do not warrant further analysis, but the following items were added for investigation since they were judged to be potentially applicable for this application. Method of Calculating CDF/LERF Treatment of CCFs when one component is failed LR-N18-0033 LAR S18-02 Enclosure Testing and maintenance events Significant fault tree modifications made to PRA model SA115A o Implementation of Mitigating Systems Performance Index (MSPI) pump (4th Auxiliary Feedwater (AFW) pump) o Station Blackout (SBO) event tree enhancements that make use of FLEX equipment for extended loss of A.C. power (ELAP) scenarios Method of Calculating CDF/LERF Another method of calculating CDF and LERF was considered which calculates CDFAVE and LERFAVE by adjusting the inverter testing and maintenance terms by a factor proportional to the change in allowed outage time. The changes are shown in Table 3-14. Table 3-14 New Inverter Unavailability for Sensitivity Factor of Description Basic Event Old UA New UA Change 115V A.C. Inverter AC1-INV-TM-1A115 2.00E-04 1.40E-03 7 1A 115V A.C. Inverter AC1-INV-TM-1B115 2.00E-04 1.40E-03 7 1B 115V A.C. Inverter AC1-INV-TM-1C115 2.00E-04 1.40E-03 7 1C 115V A.C. Inverter AC1-INV-TM-1D115 2.00E-04 4.67E-04 2.33 1D Examining of resulting internal events cutsets and delete-term cutsets, there is zero change in the average CDF and LERF. At the truncations used for the model of record, the inverter testing and maintenance (T&M) terms do not appear in either the CDF or LERF cutsets. After the unavailability of these terms is increased as described in this sensitivity, any cutsets containing the T&M terms still fall below truncation and do not appear in the cutsets. Common Cause Failure Event Sensitivity Based on the identified important contributors and the addition of applicable base PRA model sources of uncertainty identified above, the next step is to perform an assessment to determine if sources of uncertainty have been addressed in the PRA that affect the important contributors for the application. For the ICCDP/ICLERP calculations where selected components are set to unavailable, a sensitivity study was performed which conservatively adjusts the CCF failure probabilities and uses the corresponding failure events instead of the testing and maintenance terms. This is done by setting the independent failure probability to 1 when solving the common cause failure equations. This is considered conservative since not all failures would be subject to common cause failure modes. In addition, using the failure terms instead of the test and maintenance terms introduces another conservatism by assuming that the backup power supply is not already aligned. The results of this sensitivity study are shown in Table 3-15, and show that the LR-N18-0033 LAR S18-02 Enclosure calculated risk changes are still well below the acceptance criteria. Therefore, this is not identified as a model uncertainty that could impact the decision. Table 3-15 Sensitivity Results for Common Cause Failure Modes Case Trunc Result ICCDP/ICLERPSENS RG 1.177 Limit Inv. A 1.00E-11 1.31E-05 9.09E-08 1.00E-06 CDF Inv. A 1.00E-12 8.30E-07 7.35E-09 1.00E-07 LERF Inv. B 1.00E-11 1.33E-05 9.44E-08 1.00E-06 CDF Inv. B 1.00E-12 8.42E-07 7.57E-09 1.00E-07 LERF Inv. C 1.00E-11 1.23E-05 7.44E-08 1.00E-06 CDF Inv. C 1.00E-12 8.25E-07 7.26E-09 1.00E-07 LERF Inv. D 1.00E-11 1.16E-05 6.20E-08 1.00E-06 CDF Inv. D 1.00E-12 7.25E-07 5.34E-09 1.00E-07 LERF Testing and Maintenance Event Sensitivity The test and maintenance events in the model for the inverters are set based on plant data or on historical values that are considered conservative. In these risk evaluations, these unavailability terms are conservatively increased, and the results are still well below the acceptance criteria. Therefore, there is no unique model uncertainty related to these event probabilities that would impact the model to the extent to impact the decision. Recent SA115A Model Change Sensitivity During the SA115A PRA update the Mitigating Systems Performance Index (MSPI) pump (4th Auxiliary Feedwater pump) was incorporated in the PRA model. Additionally, enhancements were made to the Station Blackout (SBO) event tree that make use of FLEX equipment for extended loss of A.C. power (ELAP) scenarios. In order to determine the model sensitivity to these two changes, both the MSPI pump and FLEX diesel generator were failed in the model and the CDF/LERF for the AOT extension was recalculated. The results meet the RG 1.174 guidelines and are listed in Table 3-16. LR-N18-0033 LAR S18-02 Enclosure Table 3-16 AOT Extension Sensitivity to Model Changes Failure Delta Case Trunc Cutsets Result CDF/LERFAVE Event CDF/LERF Base (no MSPI Pump or FLEX CDF 1.00E-11 46615 1.74E-05 DG) Base (no MSPI Pump or FLEX LERF 1.00E-12 52509 8.36E-07 DG) Inverter A OOS CDF 1.00E-11 51175 1.80E-05 1.75E-05 1.03E-08(1) Inverter A OOS LERF 1.00E-12 60498 8.73E-07 8.37E-07 7.11E-10(1) Inverter B OOS CDF 1.00E-11 52685 1.83E-05 1.75E-05 1.55E-08(1) Inverter B OOS LERF 1.00E-12 59531 8.90E-07 8.37E-07 1.03E-09(1) Inverter C OOS CDF 1.00E-11 55004 2.63E-05 1.76E-05 1.70E-07(1) Inverter C OOS LERF 1.00E-12 62316 1.71E-06 8.53E-07 1.68E-08(1) Inverter D OOS CDF 1.00E-11 46615 1.74E-05 1.74E-05 0.00E+00(1) Inverter D OOS LERF 1.00E-12 52509 8.36E-07 8.36E-07 0.00E+00(1) Table Note:

1. Region III of RG 1.174 -- very small risk changes.

3.2.4.2.5 Identify Sources of Model Uncertainty and Related Assumptions Relevant to the Application Based on the evaluation of important contributors above, no items were identified as key sources of uncertainty that would impact the risk results to an extent to affect the decision. 3.2.4.3 Completeness Uncertainty As discussed in Section 3.2.3, external hazards from fire, seismic, and external flooding events were addressed using conservative quantitative and qualitative analyses as not having a significant contribution to any risk increases associated with these AOT extensions. Other external hazards, as discussed in the IPEEE, were screened out as being insignificant. Therefore, only two hazard groups (internal events and internal floods) were explicitly calculated for this risk assessment. There is no major form of completeness uncertainty that would impact the results of this assessment. The risk analysis in this LAR shows the risk increases associated with on-line inverter maintenance. The need for inverter maintenance could emerge while in Mode 3. The plant spends less time in Mode 3 than it does on-line, thus the likelihood of needing maintenance is lower. The risk increases associated with on-line maintenance bound the risk increases associated with Mode 3 maintenance. Thus, the risk associated with shutdown maintenance is also bounded and does not need to be quantified in this LAR. Therefore, there is no major form of completeness uncertainty that would impact the results of this assessment. LR-N18-0033 LAR S18-02 Enclosure 3.2.5 Tier 2. Avoidance of Risk Significant Plant Configurations The risk metrics calculated in Section 3.2.2 demonstrate that Salem is well within the acceptance criteria for the proposed inverter AOT extension in its current configuration. The risk insights discussed in Section 3.2.2.5 did not identify any equipment outage or plant configuration with extremely high risk contributions while an inverter is out of service. Therefore, no plant configuration or equipment outage would require enhancements to Technical Specifications or plant procedures. Nevertheless, PSEG has identified a set of Compensatory Measures that would improve the plants defense-in-depth with one inverter in maintenance and further increase the available margin to the acceptance guidelines, should it be judged necessary. These measures are presented below. The following are a list of identified compensatory measures to be used during planned inverter outages that are qualitative, prudent actions, consistent with other licensees that have received similar extensions of the inverter allowed out-of-service time.

1. Entry into the extended inverter AOT will not be planned concurrent with EDG maintenance.

2. Entry into the extended inverter AOT will not be planned concurrent with planned maintenance on another reactor trip system or ESF actuation system instrumentation channel that could result in that channel being in a tripped condition.

The practical implementation of these compensatory measures in the PRA model has taken the following approach: Compensatory Measure 1 is not directly credited, though Salem does credit an existing manual action to start EDGs if the automatic signal fails. This compensatory action is taken because it is recognized that with an inverter inoperable and the instrument bus being powered by the back-up transformer, instrument power for that train is dependent on power from the associated DG following a loss of offsite power event. Compensatory Measure 2 is not directly credited in the risk metric calculations. This is a conservative assumption. 3.2.6 Tier 3. Risk-Informed Configuration Management Implementation of the Salem Configuration Risk Management Program, which meets the requirements in Regulatory Guide 1.177 Section 2.3.7.2, helps to ensure there is no significant risk increase while maintenance is being performed. This tier is important because all possible risk-significant configurations under Tier 2 cannot be predicted. Salem implements the applicable portions of the Maintenance Rule by using the endorsed guidance of Section 11.0 of NUMARC 93-01. Salem uses the Equipment Out of Service (EOOS) Configuration Risk Monitor program from the Electric Power Research Institute (EPRI) to implement 10 CFR 50.65(a)(4). EOOS uses the same fault trees and database as the internal events PRA model, so it is fully capable of evaluating CDF and LERF for internal events. The loading and use of EOOS is procedurally controlled by the PSEG PRA procedures. LR-N18-0033 LAR S18-02 Enclosure Salem procedures recognize there are limitations in EOOS and specifically direct consideration of external events and site activities that can result in significant plant events. Some conditions are evaluated in EOOS through multiplication factors; others procedurally lead to other meditative actions including plant color changes. Fire risk management actions, which are governed by the same set of procedures and implemented by the same staff, are determined from the deterministic fire safe shutdown procedures from 10 CFR 50 Appendix R. When maintenance or testing is scheduled, the Operations, Work Week Management and Site Risk Management staff perform and review weekly risk analyses using the EOOS program. For unplanned or emerging equipment failures, control room personnel will enter the configuration into the EOOS. In either case, the configuration will be evaluated to assess and manage the risk. Risk associated with unavailable plant equipment is assessed at Salem as required by 10 CFR 50.65(a) (4). The PSEG work management administrative procedure governs on-line risk assessments. The on-line risk assessment is a blended approach using qualitative or defense in-depth considerations and quantifiable PRA risk insights when available to complement the qualitative assessment. Salem communicates on-line plant risk using three risk tiers (GREEN, YELLOW, and RED). The criteria for these tiers are as follows: Configuration Risk Management Criteria Color Risk Th reshold Required Action I CD P1 l <1 6-6 for 7 da yduration No speci1c actions are required.

                                               .AND Green           No LOOP High Risk Evolution (HRE)
                                                .AND I LER pi:Z:O  <1  6-7 for 7 da yduration Umit the unavailabilitytime byestablishing a I C DP1 l >1 6- 6 Brill < 1 6-5 for 7 day duration continuous worio: schedule or pro\lide justi1icali on.

OR Protect SS Cs which would cause an unplanned Yellow LO OP High Risk Evolutio n (HRE) entry into a Red risk condilion it lost concurrent with OR other SSCs being unavailable tlr mairtenance. I LER pi:Z:O >1 6- 7 .AND < 1 6-6 for 7 day duration It is unacceJtable to volun1aril yenter this condition.

                                        >1 6-5 tlr 7 dayduralion IC D P1 l                                       !E an emergent condilion causes. or degradation Red                                   OR                         maycause an u nplanned entry into this condition.

immediate actions shall be 1aken to restore and/or ILEFIPI:Z:O >-1E-6 tlr7 daydl raiJI protect SS Cs relied u pon 1Xl miligate events, a nd to contact the stalion dutymanager for direction and support. (1l Incremental Core Damage Probability (2l Incremental Large Early Release Probability The on-line risk level for both Salem units will remain GREEN for an outage of any single component seeped into this proposed change. At this level, risk is considered close to baseline, and compliance with technical specification requirements would be considered adequate risk management. Nevertheless, PSEG maintenance practices involve protecting other inverters coincident with maintenance being performed on a single inverter per OP-AA-1 08-116, Protected Equipment Program. This procedure states that if an inverter train is unavailable as LR-N18-0033 LAR S18-02 Enclosure permitted by technical specifications, the remaining operable trains shall be protected. The PRA MOR directly accounts for this maintenance practice and is reflected in the quantitative analysis. Protecting equipment requires posting of signs and robust barriers to alert personnel not to approach the protected equipment. Work on protected equipment is generally disallowed. Minor exceptions exist for activities such as inspections, security patrols, or emergency operations. Other exceptions may be authorized by the station shift manager in writing. If additional unplanned equipment unavailability occurs, station procedures direct that the risk be re-evaluated, and if found to be unacceptable, compensatory actions are taken until such a time that the risk is reduced to an acceptable level. In addition, OP-AA-108-116 directs the Operations and Work Management personnel to routinely monitor various maintenance configurations and protect equipment that could lead to an elevated risk condition (e.g., red risk condition) if it were to become unavailable due to unplanned or emergent conditions. This is normally accomplished using the EOOS PRA software tool, supplemented by operations and work management procedures. 3.2.7 Risk Summary and Conclusion Consistent with the NRCs approach to risk-informed regulation, PSEG has identified particular Technical Specification (TS) requirements that are restrictive in nature and, if relaxed, have a minimal impact on the safety of the plant. These Technical Specifications require that the 115V A.C. inverter Allowed Outage Times (AOT) (also referred to as Completion Times) be restricted to 24 hours for trains A, B, and C, and 72 hours for train D. The proposed change is to increase the AOTs for all trains from the currently specified time to 7 days. This section summarizes the risk metrics requested by the NRC Regulatory Guides, provides the calculated results using the SA115C Salem PRA models, and presents the conclusion of this assessment for the extended inverter AOT analysis. 3.2.7.1 Regulatory Guidelines As described earlier, the probabilistic risk assessment input to the decision making process has been defined in detail by the NRC in two Regulatory Guides, Regulatory Guides 1.174 and 1.177. The NRC has specified in Regulatory Guides the risk metrics that should be calculated to provide input into the decision making process. The risk metrics chosen by the NRC in their Regulatory Guides include the following: The change in Core Damage Frequency (CDF) (Reg. Guide 1.174) The change in Large Early Release Frequency (LERF) (Reg. Guide 1.174) The Incremental Conditional Core Damage Probability (ICCDP) (Reg. Guide 1.177) The Incremental Conditional Large Early Release Probability (ICLERP) (Reg. Guide 1.177) These risk metrics were all calculated using the SA115C PRA models (see Section 3.2.1.5), which were developed as application specific models to more accurately assess the incremental LR-N18-0033 LAR S18-02 Enclosure increase in risk for these extended AOT analyses by adding inverter and common cause failure terms. Quantitative guidelines are defined by the NRC in RG 1.174 and 1.177 for what is an acceptably small change in risk: The Salem calculated ICCDP and ICLERP for the inverter AOT extensions are sufficiently below the guidelines of <1.0E-06 and <1.0E-07, respectively, to be able to call the risk change small. Hence, the guidelines of Reg. Guide 1.177 for the increased inverter AOTs have been met. See the Executive Summary and Table 3-6 for the quantitative results. Furthermore, the evaluation of changes in CDF and LERF due to the AOT extensions have been shown to be an order of magnitude below the displayed area for Region III as depicted in RG1.174. See Table 3-6 for numerical results. These calculations support the increase in the inverter AOTs from a quantitative risk-informed perspective. 3.2.7.2 PRA Model The quantitative evaluation of the risk metrics for this application was performed using the SA115C Salem PRA Application Specific Model. This included the following changes to the SA115A PRA Model of Record: Addition of inverter maintenance terms Addition of inverter common cause failure terms Addition of logic which models the automatic bus transfer switch EDG electrical support dependencies are more accurately modeled Mutually exclusive file has been edited to exclude concurrent maintenance of inverters 3.2.7.3 Quantitative PRA Results: Regulatory Guide 1.177 and 1.174 This subsection includes the quantitative PRA results using the SA115C Salem PRA model. The calculated results using the application specific PRA model are shown in Table 3-17. The results are compared with the acceptance guidelines that are specified by the NRC in Regulatory Guide 1.174 and Regulatory Guide 1.177. The comparison of the CDF and LERF risk metrics with Regulatory Guide 1.174 guidelines are graphically depicted in Figure 3-8 and Figure 3-9, respectively. These results provide a good indication that the risk associated with this proposed extension of the inverter AOTs is very small. These results are also reinforced by the Tier 2 and Tier 3 assessments. 3.2.7.4 External Hazards Considerations The evaluation of risk due to fire, seismic, and external flooding events was based on conservative quantitative and qualitative analyses, along with insights gleaned from the IPEEE. Within this analysis, Section 3.2.3.2 addresses fire risk, Section 3.2.3.3 addresses seismic risk, LR-N18-0033 LAR S18-02 Enclosure and Section 3.2.3.4 addresses external flooding risk. For this particular AOT extension, there are no significant increases in risk expected due to any of these external hazards. With regard to fire hazards, since the specified inverters and their support systems do not show a high dependence on the results of the fire model, it was concluded in Section 3.2.3.2 that the risk increase would be negligible due to extending the AOTs. This insight was based on the fact that the unavailability of the 115V A.C. inverters does not have a high impact on the ability to mitigate any of the dominant fire risk contributors. With regard to seismic hazards, because damage to equipment during seismic events is often correlated across trains, extension of AOTs for 115V A.C. inverters will have a negligible impact on Seismic risk estimates. A stand-alone conservative calculation also shows a negligible impact on Seismic risk. As such, it is concluded that there would be no significant impact on seismic risk due to extending the AOT for these inverters. A similar calculation for external floods also shows a negligible risk increase due to extending the AOT for the 115V A.C. inverters. Other external hazards were screened as being insignificant, as documented in Section 1.4.3 of the Salem IPEEE, and as such, were not deemed applicable to this analysis for the AOT extension. 3.2.7.5 Conclusion The risk change calculated with the SA115C Salem PRA model for the proposed 115V A.C. inverter AOT extension is considered to be very small. The ICCDP and ICLERP for the inverter unavailability is sufficiently below the guidelines of <1.0E-06 and <1.0E-07, respectively, to be able to call the risk change small. Hence, the guidelines of RG1.177 for the increased Allowed Outage Times have been met. Furthermore, the calculated changes in CDF and LERF due to the inverter AOT extension have been shown to meet the risk significance criteria of Regulatory Guide 1.174 with substantial margin, i.e., Region III which represents very small risk changes. Table 3-17 provides a listing of the numerical results, with Figure 3-8 and Figure 3-9 showing a graphical depiction of the CDF and LERF results. These calculations support the increase in the inverter AOT extension from a quantitative risk-informed perspective, which includes following established PSEG maintenance practices as discussed in Section 3.2.2.3. TABLE 3-17 RESULTS OF RISK EVALUATION FOR SALEM CDF/LERF RG 1.177 RG 1.174Evaluation Case Event ICCDP/ICLERP Guideline CDF 7.85E-10 < 1E-06 Region III - very small Inv A LERF 1.10E-10 < 1E-07 Region III - very small Inv B CDF 2.56E-09 < 1E-06 Region III - very small LR-N18-0033 LAR S18-02 Enclosure CDF/LERF RG 1.177 RG 1.174Evaluation Case Event ICCDP/ICLERP Guideline LERF 1.70E-10 < 1E-07 Region III - very small CDF 7.49E-09 < 1E-06 Region III - very small Inv C LERF 6.90E-10 < 1E-07 Region III - very small CDF 0.00E+00 < 1E-06 Region III - very small Inv D LERF 0.00E+00 < 1E-07 Region III - very small LR-N 18-0033 LAR S18-02 Enclosure 1o** CDF FIGU R E 3-8 ACCEPTANCE GUI DELINES FOR COR E DAMAGE FREQUENCY (CDF) t u.. a:

  ..(

10... 10*8 10*5 LERF Jlt FIGURE 3-9 ACCEPTANCE GUIDELINES FOR LARGE EARLY R ELEASE F REQUENCY (LERF)

4.0 REGULATORY EVALUATION

LR-N18-0033 LAR S18-02 Enclosure 4.1 Applicable Regulatory Requirements and Criteria 10 CFR 50.36 Technical Specifications 10 CFR 50.36, Technical Specifications, identifies the requirements for the Technical Specification categories for operating power plants: (1) Safety limits, limiting safety system settings, and limiting control settings, (2) Limiting conditions for operation, (3) Surveillance requirements, (4) Design features, (5) Administrative controls, (6) Decommissioning and (7) Initial notification, and (8) Written Reports. For Limiting conditions for operation, 10 CFR 50.36 states: Limiting conditions for operation are the lowest functional capability or performance levels of equipment required for safe operation of the facility. When a limiting condition for operation of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the technical specifications until the condition can be met. The OPERABILITY of the inverters is consistent with the initial assumptions of the accident analyses and is based on meeting the design basis of the unit. The inverters are a part of the distribution system and, as such, satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 10 CFR 50 Appendix A General Design Criteria (GDC) Salem Generating Station was designed using the Atomic Industrial Forum (AIF) general design criteria as published in a letter to the Atomic Energy Commission (AEC) from E. A. Wiggin, Atomic Industrial Forum, dated October 2, 1967. In addition to the AIF General Design Criteria, the Salem Generating Station (SGS) was designed to comply with Public Service Electric & Gas (PSE&G's) understanding of the intent of the AEC's proposed General Design Criteria, as published for comment by the AEC in July, 1967. The proposed GDCs applicable to this proposed change are 24 - Emergency Power for Protection Systems," 25 - Demonstration of Functional Operability of Protective Systems and 39 - Emergency Power for Engineered Safety Features. A comparison of the Salem plant design with 10 CFR 50, Appendix A, (General Design Criteria for Nuclear Power Plants dated July 7, 1971) was performed and documented in Salem UFSAR Section 3.1.3. The Salem Plant design conforms to the intent of "General Design Criteria for Nuclear Power Plants," (10 CFR 50, Appendix A) dated July 7, 1971 with exceptions noted in the UFSAR. 10 CFR 50.65, "Requirements for monitoring the effectiveness of maintenance at nuclear power plants," requires that preventive maintenance activities must be sufficient to provide reasonable assurance that SSCs are capable of fulfilling their intended functions. As it relates to the proposed inverter Allowed Outage Time extension, 10 CFR 50.65(a)(4) requires the assessment and management of the increase in risk that may result from proposed maintenance activities. As discussed previously, the Salem Maintenance Rule program monitors the reliability and availability of the A.C. inverters and ensures that appropriate management attention and goal setting are applied based on pre-established performance criteria. The A.C. inverters are all currently in the 10 CFR 50.65(a)(2) Maintenance Rule category (i.e., the A.C. inverters are meeting established performance criteria). The Salem CRMP is consistent with 10 CFR 50.65(a)(4), and is managed to ensure that risk-significant plant configurations will not be entered for planned maintenance activities, and that appropriate actions will be taken should unforeseen events place the plant in a risk significant configuration during the proposed extended A.C. inverter Allowed Outage Time. Therefore, the proposed extension of the A.C. inverter Allowed Outage Time from 24/72 hours to 7 days are not anticipated to result in exceeding the current established Maintenance Rule criteria for the A.C. inverters. LR-N18-0033 LAR S18-02 Enclosure 10 CFR 50.63, "Loss of all alternating current power," requires that nuclear power plants must be able to withstand a loss of all A.C. power for an established period of time and recover from a station blackout. The proposed extension of the A.C. inverter Completion Time from 24/72 hours to 7 days has no significant effect on the ability to withstand a loss of all A.C. power and recover from a station blackout. 4.2 Precedent 4.2.1 License Amendments The changes proposed herein to the Allowed Outage Time for restoration of an inoperable A.C. inverter are similar to those previously approved by the NRC for the Clinton Power Station, North Anna Power Station, Byron and Braidwood Stations, and Palo Verde Station. These previous approvals are discussed below. Palo Verde Nuclear Generating Station By Arizona Public Service (APS) letter dated September 29, 2009 (ADAMS accession ML092810227), as supplemented by APS letters dated June 24, 2010 (ML101880263), September 03, 2010 (ML102571398), and September 24, 2010 (ML102720481), APS requested NRC approval of a Palo Verde Nuclear Generating Station TS change to extend the inverter Allowed Outage Time. The NRC approved the change in License Amendment Nos. 180 for Palo Verde, Units 1, 2 and 3, issued September 29, 2010 (ML102670352). The amendment issued for the Palo Verde Nuclear Generating Station was substantively equivalent to the amendment requested herein for Salem, in that it revised TS 3.8.7, "Inverters - Operating," to change the Allowed Outage Time for restoration of an inoperable inverter from 24 hours to 7 days. Clinton Power Station By AmerGen Energy Company, LLC (AmerGen) letter dated April 26, 2004 (ADAMS Accession ML041210913), as supplemented by AmerGen letters dated April 18, 2005 (ML051080395), October 11, 2005 (ML052910184), and May 19, 2006 (ML061500124), AmerGen requested NRC approval of a Clinton Power Station TS change to extend the Completion Time for Nuclear System Protection System Inverters. The NRC approved the change in License Amendment No. 174 for the Clinton Power Station, Unit 1, issued May 26, 2006 (ML061160181). The amendment issued for the Clinton Power Station was substantively equivalent to the amendment requested herein for Salem, in that it revised TS 3.8.7, "Inverters - Operating," to change the Completion Time for restoration of an inoperable inverter from 24 hours to 7 days. North Anna Power Station By Virginia Electric and Power Company (VEPC) letter dated December 13, 2002 (ADAMS accession ML023600217), as supplemented by VEPC letters dated May 8, 2003 (ML031400019), December 17, 2003 (ML033580639), February 12, 2004 (ML040550548), and March 9, 2004 (ML040700512), VEPC requested NRC approval of a North Anna Power Station TS change to extend the inverter Allowed Outage Time. The NRC approved the change in License Amendment Nos. 235 and 217 for the North Anna Power Station, Units 1 and 2, respectively, issued May 12, 2004 (ML041380438). The amendment issued for the North Anna Power Station was substantively equivalent to the amendment requested herein for Salem, in LR-N18-0033 LAR S18-02 Enclosure that it revised TS 3.8.7, "Inverters - Operating," to change the Allowed Outage Time for restoration of an inoperable inverter from 24 hours to 7 days. Byron and Braidwood Power Stations By Exelon Generation Co., LLC (Exelon) letter dated October 16, 2002 (ADAMS accession ML023020061), as supplemented by Exelon letters dated June 20, 2003 , October 14, 2003 (ML032900989), and November 7, 2003 (ML033160196), Exelon requested NRC approval of TS changes to extend the inverter Completion Time for the Byron and Braidwood Stations. The NRC approved the changes in License Amendment Nos. 135 for the Byron Station, Units 1 and 2, and Amendment Nos. 129 for the Braidwood Station, Units 1 and 2, issued November 19, 2003 (ML032830455). The amendments issued for the Byron and Braidwood Stations were substantively equivalent to the amendment requested herein for Salem, in that they revised TS.3.8.7, "Inverters - Operating," to change the Completion Time for restoration of an inoperable inverter from 24 hours to 7 days. 4.2.2 Notice of Enforcement Discretion (NOED) Nuclear power plants with instances of inverter failures prompting requests for NOEDs to extend the Completion Time for an inoperable distribution panel inverter.

1) NRC Letter to Union Electric Company, "Notice of Enforcement Discretion for Union Electric Company Regarding Callaway Plant Unit 1 [TAC NO. ME9277, NOED No.

12-4-002]," dated August 23, 2012 (ADAMS Accession No. ML12237A010). This NOED granted enforcement discretion for an additional 36 hours.

2) NRC Letter to FPL Energy Seabrook, LLC, "Notice of Enforcement Discretion for FPL Energy Seabrook, LLC, Regarding Seabrook Station, NOED No. 2005-01-01,"

dated December 5, 2005 (ADAMS Accession No. ML053400372). This NOED granted an AOT extension of 18 hours.

3) NRC Letter to Nine Mile Point Nuclear Station, LLC, "Notice of Enforcement Discretion Regarding Nine Mile Point Unit 2, NOED No. 2003-03-01-002," dated August 18, 2003 (ADAMS Accession No. ML032310080). This NOED granted an AOT extension of 18 hours.

4) NRC Letter to Tennessee Valley Authority, "Notice of Enforcement Discretion for Tennessee Valley Authority Regarding Watts Bar Nuclear Plant Unit 1, NOED No.

2001-2-001," dated March 8, 2001 (ADAMS Accession No. ML010680211). This NOED granted an AOT extension of 24 hours. 4.3 No Significant Hazards Consideration PSEG Nuclear LLC (PSEG) requests approval of a change to the Salem Generating Station (Salem) Technical Specifications (TS) concerning Alternating Current (AC) Inverters. The proposed change would extend the Allowed Outage Time (AOT) for an inoperable inverter from 24 hours for the A, B and C inverters to 7 days and from 72 hours for the D inverter to 7 days. The proposed new allowed outage time (AOT) is based on application of the Salem Probabilistic Risk Assessment (PRA) in support of a risk-informed extension, and on additional considerations and compensatory actions. The risk evaluation and deterministic engineering analysis supporting the proposed change were developed in accordance with the guidelines established in Regulatory Guide (RG) 1.177, "An Approach for Plant-Specific Risk-informed Decision-making: Technical Specifications," and Regulatory Guide 1.174, "An Approach for LR-N18-0033 LAR S18-02 Enclosure Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis." PSEG Nuclear (PSEG) has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, Issuance of amendment, as discussed below:

1. Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No. The proposed TS amendment does not affect the design of the vital A.C. inverters, the operational characteristics or function of the inverters, the interfaces between the inverters and other plant systems, or the reliability of the inverters. An inoperable vital A.C. inverter is not considered an initiator of an analyzed event. In addition, TS Actions and the associated Allowed Outage Times are not initiators of previously evaluated accidents. Extending the Allowed Outage Time for an inoperable vital A.C. inverter would not have a significant impact on the frequency of occurrence of an accident previously evaluated. The proposed amendment will not result in modifications to plant activities associated with inverter maintenance, but rather, provides operational flexibility by allowing additional time to perform inverter troubleshooting, corrective maintenance, and post-maintenance testing on-line. The proposed extension of the Allowed Outage Time for an inoperable vital A.C. inverter will not significantly affect the capability of the inverters to perform their safety function, which is to ensure an uninterruptible supply of 115-volt A.C. electrical power to the associated power distribution subsystems. An evaluation, using PRA methods, confirmed that the increase in plant risk associated with implementation of the proposed Allowed Outage Time extension is consistent with the NRC's Safety Goal Policy Statement, as further described in RG 1.174 and RG 1.177. In addition, a deterministic evaluation concluded that plant defense-in-depth philosophy will be maintained with the proposed Allowed Outage Time extension. There will be no impact on the source term or pathways assumed in accidents previously evaluated. No analysis assumptions will be changed and there will be no adverse effects on onsite or offsite doses as the result of an accident. Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No. The proposed amendment does not involve physical alteration of the Salem Generating Station. No new equipment is being introduced, and installed equipment is not being operated in a new or different manner. There is no change being made to the parameters within which Salem is operated. There are no setpoints at which protective or mitigating actions are initiated that are affected by this proposed action. The use of LR-N18-0033 LAR S18-02 Enclosure the alternate Class 1E power source for the vital A.C. instrument bus is consistent with the Salem plant design. The change does not alter assumptions made in the safety analysis. This proposed action will not alter the manner in which equipment operation is initiated, nor will the functional demands on credited equipment be changed. No alteration is proposed to the procedures that ensure Salem remains within analyzed limits, and no change is being made to procedures relied upon to respond to an off-normal event. As such, no new failure modes are being introduced. Therefore, the proposed changes do not create the possibility of a new or different kind of accident from any previously evaluated.

3. Does the proposed amendment involve a significant reduction in a margin of safety?

Response: No. Margin of safety is related to the confidence in the ability of the fission product barriers to perform their design functions during and following an accident. These barriers include the fuel cladding, the reactor coolant system, and the containment system. The proposed change, which would increase the AOT from 24/72 hours to 7 days for one inoperable inverter, does not exceed or alter a setpoint, design basis or safety limit. Therefore, the proposed amendment does not involve a significant reduction in a margin of safety. 4.4 Conclusion In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5.0 ENVIRONMENTAL CONSIDERATION

A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluent that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment. LR-N18-0033 LAR S18-02 Enclosure

6.0 REFERENCES

1. Regulatory Guide 1.174: An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, USNRC, Revision 2, May 2011.

2. Regulatory Guide 1.177: An Approach for Plant-Specific, Risk-Informed Decision-Making: Technical Specifications, USNRC, Revision 1, May 2011.

3. U.S. Nuclear Regulatory Commission, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision-making, NUREG-1855, Revision 1, ML15026A512.

4. American Society of Mechanical Engineers, Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, (ASME RA-S-2002), Addenda RA-Sb-2005, December 2005.

5. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk Informed Activities, Revision 2, March 2009.

6. PSEG, Salem Generating Station Individual Plant Examination, July 1993.

7. NRC Generic Letter 88-20, Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10 CFR 50.54(f), Supplement 4, June 28, 1991.

8. Westinghouse, RG 1.200 PRA Peer Review Against the ASME PRA Standard Requirements for the Salem Generating Station, Units 1 and 2 PRA, LTR-RAM-II 001, June 2009.

9. PSEG, Salem Generating Station Individual Plant Examination of External Events, January 1996.

10. PSEG, FPIE PRA Model Update, ER-AA-600-1015, Revision 8.

11. NEI 05-04, Revision 1 (Draft), Process for Performing Follow-On PRA Peer Reviews Using the ASME PRA Standard (Internal Events), Nuclear Energy Institute, November 2007.

12. Salem Generating Station, Mitigating System Performance Index Basis Document, SC-MSPI-001, Revision 12, December 2016.

13. Salem Generating Station, Quantification Notebook, SA-PRA-014, Revision 1, December 2016.

14. American Society of Mechanical Engineers, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addenda to ASME/ANS RA-S-2008 (ASME/ANS RA-Sa-2009), February 2009.

15. Salem Full Power Internal Events PRA Model, SA115A. August 2016.

16. INEL SPAR Basic Event Unavailability Data and Results, 2015 Parameter Estimation Update 2015.

17. Salem NRC SPAR Model, version 8.50.

18. INEL-94/0066 Common-Cause Failure Data Collection and Analysis System Volume 2

       - Definition and Classification of Common-Cause Failure Events," Idaho National Engineering Laboratory. December 1995.

19. PSEG, Protected Equipment Program, OP-AA-108-116, Revision 12.

20. Individual Plant Examination for Severe Accident Vulnerabilities-10 CFR 50.54(f),

Generic Letter 88-20, November 23, 1988.

21. NUREG-1407, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities, June 1991.

22. Professional Loss Control, Inc., Fire-Induced Vulnerability Evaluation (FIVE)

Methodology Plant Screening Guide, EPRI TR-100370, Electric Power Research Institute, April 1992. LR-N18-0033 LAR S18-02 Enclosure

23. PSEG, Salem Fire Protection Report - Safe Shutdown Analysis, DE-PS.ZZ-0001(Q),

Rev. 1, 1991.

24. PSEG, Salem Fire Protection Report - Fire Hazards Analysis, DE-PS.ZZ-001(Q)-A2-FHA, Rev. 4, 1993.

25. PSEG, Action Request for Reducing Potential Risk to Cables Routed Through the Turbine and Service Buildings Which Supply Offsite Power to the 4kV Vital Buses, 1995.

26. U.S. NRC's Response to 10 CFR 50.54(f) Recommendation 2.1 of the Near-Term Task Force Review of the Fukushima Accident - Salem Generating Station, LR-N14-0051, March 2014.

27. U.S. Nuclear Regulatory Commission, Standard Review Plan for Review of Safety Analysis Report for Nuclear Power Plants, NUREG-75/187, December 1975.

28. PSEG, Hope Creek Generating Station Updated Safety Analysis Report, Sections 2 and 3, Latest Revision.

29. PSEG, Salem Generating Station Updated Safety Analysis Report, Sections 2 and 3, Latest Revision.

30. NRC Order Number EA-12-049, Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events, March 12, 2012.

31. PSEG Nuclear, PSEG Nuclear LLCs Overall Integrated Plan for the Salem Generating Station in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events (Order Number EA-12-049), LR-N13-0034, February 28, 2013.

32. Nuclear Energy Institute (NEI) 12-06, Diverse and Flexible Coping Strategies (FLEX)

Implementation Guide, Rev. 0, August 2012.

33. Practical Guidance on the Use of Probabilistic Risk Assessment in Risk-Informed Applications with a Focus on the Treatment of Uncertainty, EPRI Report 1026511, Palo Alto, CA December 2012.

34. Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, EPRI Report 1016737, Palo Alto, CA, December 2008.

35. USNRC, "Industry Guidelines for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, NUMARC 93-01, Revision 4D," June 2015.

36. PSEG Letter LR-N12-0370, Salem Generating Station Response to Recommendation 2.3: Flooding Walkdown of the Near-Term Task Force Review of Insights from the Fukushima Dai-chi Accident, Nov. 26, 2012, ML123340583.

37. NRC, Nuclear Regulatory Commission Report for the Audit Of PSEG Nuclear LLC's Flood Hazard Reevaluation Report Submittals Relating to the Near-Term Task Force Recommendation 2.1-Flooding for Salem Nuclear Generating Station, Units 1 and 2, January 8, 2016, ML15364A073.

38. NRC, Salem Generating Station Units 1 And 2- Staff Assessment of Flooding Walkdown Report Supporting Implementation of Near-Term Task Force Recommendation 2.3 Related to the Fukushima Dai-Ichi Nuclear Power Plant Accident, June 16, 2014, ML14140A307.

39. PSEG Letter LR-N14-0042, PSEG Nuclear LLC's Response to Request for Information Regarding Flooding Aspects of Recommendation 2.1 of the Near-Term Task Force Review of Insights from the Fukushima Dai-chi Accident- Salem Generating Station Flood Hazard Reevaluation, March 11, 2014, ML14071A401.

40. PSEG Letter LR-N16-0161, Salem Generating Station's Flood Hazards Mitigating Strategies Assessment (MSA) Report Submittal, Dec. 30, 2016, ML16365A151.

41. EPRI Report 3002004400, "Local Precipitation-Frequency Studies, Development of 1-Hour/1-Square Mile Precipitation-Frequency Relationships for Two Example Nuclear Power Plant Sites," 2014.

LR-N18-0033 LAR S18-02 Enclosure

42. PSEG, OP-AA-108-111-1001, Severe Weather and Natural Disaster Guidelines.

43. PSEG, SC.OP-AB.ZZ-0001, Adverse Environmental Conditions.

44. USACE Report ERDC/CHL TR-11-1, Report 5, "Coastal Storm Surge Analysis: Storm Surge Results," November 2013.

45. NEI 12-07, "Guidelines for Performing Verification Walkdowns of Plant Flood Protection Features," Revision 0-A dated May 2012 (ML12173A215).

46. PSEG Document ER-AA-310-101, "Condition Monitoring of Structures," Revision 0.

47. NRC Policy Statement, "Use of Probabilistic Risk Assessment Methods in Nuclear Activities: Final Policy Statement," Federal Register, Vol. 60, p. 42622 (60 FR 42622),

August 16, 1995.

48. NRC, Salem Nuclear Generating Station, Unit Nos. 1 and 2- Issuance of Amendments Re: Containment Fan Coil Unit Allowed Outage Time Extension (CAC Nos. MF9364 and MF9365; EPID L-2017-LLA-0212)

LR-N18-0033 LAR S18-02 Attachment 1 Technical Specification Pages with Proposed Changes

LR-N18-0033 LAR S18-02 TECHNICAL SPECIFICATION PAGES WITH PROPOSED CHANGES The following Technical Specifications for Renewed Facility Operating License DPR-70 are affected by this change request: Technical Specification Page 3.8.2.1 3/4 8-6 TECHNICAL SPECIFICATION PAGES WITH PROPOSED CHANGES The following Technical Specifications for Renewed Facility Operating License DPR-75 are affected by this change request: Technical Specification Page 3.8.2.1 3/4 8-8

LR-N18-0033 LAR S18-02 Attachment 2 PRA Standard Supporting Requirements

LR-N18-0033 LAR S18-02 TABLE A-1 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INITIATING EVENTS ANALYSIS RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # Table 2-2 in the IE notebook (SA-PRA-001), which was revised during the 2012 PRA model update, lists the basis for this event not being a unique plant trip initiator. For the The plant-specific search only addresses supporting systems. The case in which the charging system is lost, this leads to a listing is not encompassing of possible plant-specific initiators found SR slowly developing transient that can be easily IE-A1 IE-A1 IE-A1-01 at other plants such as a loss of charging (impact on RCP seal Not Met accommodated with high reliability using plant response cooling). Loss of charging would lead to a reactor trip and would procedures to avoid an unnecessary plant transient event. decrease redundancy for RCP seal cooling. Based on reviews of potential missing initiating events, it was concluded that no initiating events were missing and therefore the intent of this SR is met. Consideration of some initiating events may be required based on IE-A2 IE-A2 SR Met N/A shutdown requirement. The plant-specific history indicates that on 12/31/01 an event SR IE-A3-001, Spurious SI was added to the SA112A model as initiating IE-A3 IE-A3 occurred resulting in SI. The categorization of initiating events does Not Met IE-A3-002 event Tsi. No further action required. not account for this or the case of ESFAS actuation. Section 2.1 of the initiating events notebook indicates that comparisons were made to industry data and to other plants. The available documentation lists that past PRAs are examined. SR Additional information was added to the IE notebook (SA-IE-A4 IE-A3a IE-A3-001 However, there appears to be no documentation of this evaluation Not Met PRA-001, rev. 3) at the end of Section 2 to compare with consideration of plants of similar design. initiators from Watts Bar, South Texas Project, Surry, and Byron/Braidwood. No further action required. The observation associated with IE-A4 says, The analysis only addresses support systems and does not address the impact of other operating systems (such as charging) with regard to events resulting in a plant upset and subsequent The analysis only addresses support systems and does not address trip signal. IE-A4 asks for a systematic review of plant SR Met: IE-A5 IE-A4 IE-A4-001 the impact of other operating systems (such as charging) with regard systems to identify potential initiating events. A systematic (CC I) to events resulting in a plant upset and subsequent trip signal. review was performed in the IE notebook and documented in Table 2-2. Loss of charging was not included as a separate initiator based on screening criterion identified in the initiating events notebook. Also, see the response for SR IE-A1. No further action required. SR See supporting requirement IE-A4. Not all potential systems were IE-A6 IE-A4a IE-A4-001 N/A Not Met addressed. LR-N18-0033 LAR S18-02 TABLE A-1 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INITIATING EVENTS ANALYSIS RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # Appropriate evidence exists that LERs were reviewed for SA PRA Initiating Events Notebook, SA-PRA-001, Revision 0, other than "at-power" conditions to determine whether or not Section 2.2.1 and 2.2.2 describe the review of Salem Generating SR a new initiator should be added that was not already IE-A7 IE-A5 IE-A5-01 Station Experience and Trip Review. No mention is made of Not Met incorporated into the PRA model. The LERs reviewed are consideration of events that occurred at conditions other than at-documented in the initiating events notebook (SA-PRA-001 power operation. revision 2). No further action required. A Maintenance Rule Expert Panel meeting was held on 10/5/2012 to review the updated Initiating Events Notebook with plant personnel representing plant operations, maintenance, engineering and safety analysis in order to determine if potential initiating events had been overlooked. Some of the items discussed during the interview included:

• Grassing events were appropriately binned as %Tp initiators
• Loss of non-vital bus G needed to be added as a %Tt SA PRA Initiating Events Notebook, SA-PRA-001, Revision 0, initiator Section 2.1.2 does not indicate that plant operations, maintenance, SR Met:

IE-A8 IE-A6 IA-A6-01 engineering, and safety analysis personnel were interviewed or

• The plant shutdown in July 2011 that was related to the (CC I) included in the review process for the initiating events notebook to SJ10 cracked weld needed to be identified determine if potential initiating events have been overlooked.
• The appropriateness of binning spurious SI trips with an existing initiator
• Loss of a 4kV vital bus does not directly lead to a plant trip
• Manual shutdowns should not be credited in the transient initiating event category Based on this review, it was concluded that no initiating events were missing and therefore the intent of this SR is met.

LR-N18-0033 LAR S18-02 TABLE A-1 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INITIATING EVENTS ANALYSIS RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # A list of LERs was previously reviewed for the existence of any initiating event precursors. A statement was added to SA PRA Initiating Events Notebook, SA-PRA-001, Revision 0, the IE notebook documenting that this review was previously SR Met: Section 2.1.2 does not indicate that a review of plant-specific or IE-A9 IE-A7 IE-A7-01 performed. Since industry information was also reviewed in (CC I) industry operating experience was performed for the purpose of addition to plant-specific information, this SR could actually identifying initiating event precursors. be considered as being met at Capability Category III. No further action required. IE-A8 This SR was deleted in RA-Sb-2005. N/A IE-A9 This SR was deleted in RA-Sb-2005. N/A SA PRA Initiating Events Notebook, SA-PRA-001, Revision 0, Section 2.1.3 describes the consideration of multi-unit site initiating IE-A10 IE-A10 SR Met events. Based on that analysis, dual unit initiating events for loss of N/A service water, loss of control air, and loss of offsite power were included. IE-B1 IE-B1 SR Met N/A A structured process was followed in the grouping of the initiating IE-B2 IE-B2 SR Met N/A events. Initiating events may be grouped reasonably in accordance with SR IE-B3 as long as the impacts are comparable to existing initiators and the grouping does not impact The potential for SI actuation is placed in the general transient significant accident sequences. Spurious SI will generally category with events such as reactor trip and considered to be no SR be recovered (by resetting SI) and the event will be a IE-B3 IE-B3 IE-B3-001 worse than the reactor trip. However, unmitigated SI events can Not Met transient. If SI is not reset prior to PORV operation, a logic challenge a PORV resulting in a consequential LOCA. These two change was added to the SA112A PRA model to transfer to events should not be grouped. the small LOCA event tree. See the Initiating Events Notebook for further details (SA-PRA-001). No further action required. IE-B4 IE-B4 SR Met Grouping of initiating events was performed. N/A LR-N18-0033 LAR S18-02 TABLE A-1 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INITIATING EVENTS ANALYSIS RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # SA PRA Initiating Events Notebook, SA-PRA-001, Revision 0, Section 2.1.3 describes the consideration of multi-unit site initiating events. Based on that analysis, dual unit initiating events for loss of IE-B5 IE-B5 SR Met N/A service water, loss of control air, and loss of offsite power were included. There is no indication that these events were subsumed into other events. Based on a review of Sections 3.0 of Salem SA-PRA-001, Revision 0, "Initiating Events," initiating event frequencies have been calculated using relevant generic and plant-specific data. Generic As part of updating initiating event frequencies, use of newer data is from NUREG/CR-5750, Rates of Initiating Events at U.S. loss of offsite power (LOOP) data was incorporated into the Nuclear Power Plants: 1987-1995. More recent industry sources of CAFTA model database as part of the 2012 PRA update, IE-C1 IE-C1 SR Met IE-C1-01 initiating event data such as from NUREG/CR-6928, "Industry- including dual-unit LOOP events. See the Initiating Events Average Performance for Components and Initiating Events at U.S. Notebook for further details (SA-PRA-003). The normal Commercial Nuclear Power Plants," should be used. For initiators PRA update process (ER-AA-600-1015) ensures that this when plant-specific data is available, the initiating event frequency is activity is routinely performed. No further action required. calculation by Bayesian updating the industry prior with the plant-specific data. The most recent applicable plant specific data has been used to quantify the initiating event frequencies, based on a review of IE-C2 IE-C1a SR Met N/A Section 3.1 of Salem SA-PRA-001, Revision. 0, "Initiating Events." The plant-specific data is from 10/1/2000 to 12/31/2006. Section 3.3 of the Salem SA-PRA-001, Revision 0 notebook has a brief discussion of the special initiators developed using fault trees. It references the applicable system model notebooks along with the basic event for the initiator in the fault tree. For the loss of SW Support system initiators that were developed using fault initiator, notebook SA-PRA-005.13, Revision 0 was reviewed for the trees were identified in the Initiating Events Notebook (SA-IE-C3 IE-C1b SR Met IE-C1b-01 modeling of the initiator. There was no description of the how the PRA-001 revision 2 Section 3.5) with reference made to the loss of SW initiator is modeled as an initiator. Also, there did not applicable system notebook for model development and appear to be documentation of the recoveries credited in the initiator details. No further action required. fault trees and whether the actions are justified for preventing the initiator. This SR is considered met but SR IE-D2 will be considered not met for documentation. Based on a review of Section 3.2 of the Salem SA-PRA-001, IE-C4 IE-C2 SR Met Revision 0 notebook, Bayesian updating has been performed N/A appropriately and complies with this SR. LR-N18-0033 LAR S18-02 TABLE A-1 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INITIATING EVENTS ANALYSIS RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # The initiators that are fault trees, loss of SW, loss of Capability This was implemented in the CAFTA PRA model SR Category, loss of control area ventilation, and others, do not appear SA112A.CAF with the event AVAIL-FACTOR set to the IE-C5 IE-C3 IE-C3-01 Not Met to be based on reactor year. For example, under gate IE-TSW, value of 0.925 as determined in the Initiating Events basic event SWS-PIP-RP-TBHDR has a mission time of 8760 hours. Notebook (SA-PRA-001). No further action required. Based on discussions with plant personnel (see response to IE-A6-01), it was determined that loss of 4kV non-vital buses affect the balance of plant operations and lead to an Quantitative screening does not appear to be performed, based on a eventual turbine trip, which is accounted for in the event review of the Salem SA-PRA-001, Revision 0 notebook. Therefore, frequency for turbine trip (%Tt). Loss of a 4kV vital bus can subsection a) and b) of this SR are considered met. However, SR lead to unavailability of standby ECCS equipment, but it IE-C6 IE-C4 IE-A1-01 subsection c) of this SR does not appear to be met as noted in the Not Met does not lead to an automatic plant trip. As such, this was review for SR IE-A1, some events that require the plant to be shut not considered a possible transient event. This was down due to technical specifications were screened (e.g., loss of a documented in Table 2-2 of the Initiating Events Notebook 4KV bus). (SA-PRA-001). Based on this review, it was concluded that no initiating events were missing and therefore the intent of this SR is met. IE-C7 IE-C5 SR N/A Time trend analysis is not required for a Capability Category II rating. N/A Section 3.3 of the Salem SA-PRA-001 Revision 0 notebook provides some limited description of the initiators that are fault trees. Details of the modeling of the system fault tree are provided in the applicable system notebooks. Applicable systems-analysis requirements for fault-tree modeling appear to have been used. The IE-C8 IE-C6 SR Met IE-C1b-01 N/A initiating event modeling is performed to the same level of detail as the fault trees used for the modeling of post-initiator operation of mitigating systems and appears to be appropriate. The documentation of the development of the initiator fault trees could be enhanced. Initiating events that rely upon fault tree modeling correctly produce IE-C9 IE-C7 SR Met N/A failure frequencies rather than top event probabilities. LR-N18-0033 LAR S18-02 TABLE A-1 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INITIATING EVENTS ANALYSIS RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # The logic under gates IE-TSW and IE-TCC were reviewed in fault tree SIR4.Caf. The fault tree models used to calculate initiating event frequencies appear to model all relevant combinations of IE-C10 IE-C8 SR Met N/A events involving the annual frequency of one component failure combined with the unavailability (or failure during the repair time of the first component) of other components. The logic under gates IE-TSW and IE-TCC were reviewed in fault tree SIR4.Caf. A human reliability analysis was used to calculate the IE-C11 IE-C9 SR Met probability of failure of the operator actions credited under these N/A gates as documented in Salem model notebook SA-PRA-004, Revision 0. Tables 2-5, 2-6 and 2-7 in the Initiating Events Notebook (SA-PRA-001) provide event types, along with their descriptions, for the South Texas Project, Watts Bar Project Tables 3-6 and 3-7 contain a comparison of the initiator frequencies and Surry Project, respectively. This data is given in order used in the Salem model as compared with NUREG/CR-5750. to provide the reader with other categorization schemes for However, there is no comparison with other sources. . Since IE-C12 IE-C10 SR Met IE-C10-01 similar plants to which the Salem plant may be compared. It many of the frequencies used in the Salem model use the same was shown that these categorization schemes for initiating frequencies from NUREG/CR-5750, such as the LOCAs, the tables events are consistent with the Salem PRA model. Based on should be updated with a comparison with other similar plants. this updated comparison to other plants, it was concluded that the intent of this SR is met. F&O IE-C10-01 is a suggestion-level F&O. SR Met Initiating event frequencies for rare events and extremely rare events IE-C13 IE-C11 N/A (CC I/II) are based on generic data. Section 3.5 of the Salem SA-PRA-001, Revision 0 notebook provides some description of the ISLOCA screening, quantification of SR Met the initiator frequency and the event tree development. The details IE-C14 IE-C12 N/A (CC I/II) of the ISLOCA analysis are contained in PLG Report Number PLG-0826, Containment Bypass Analysis. The analysis considers the requirements in this SR as appropriate. Mean values and error factors are developed for the initiating event IE-C15 IE-C13 SR Met frequencies modeled as documented in Sections 3.2, 3.3 and 3.4 of N/A the Salem SA-PRA-001, Revision 0. LR-N18-0033 LAR S18-02 Attachment 2 TABLE A-1 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INITIATING EVENTS ANALYSIS RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # The initiating event analysis documentation is a logical format consistent with the major high level requirements for initiating event IE-D1 IE-D1 SR Met N/A analysis. Improvements can be made to the notebook as noted by the F&Os in the other SRs. The Salem initiating event notebook SA-PRA-001, Revision 0 provides good documentation of the identification, grouping, and evaluation of plant-specific data, screening and quantification of the IE-D2 IE-D2 SR Met N/A frequencies. However, as noted in a number of the F&Os for HLR IE-A, B and C, the notebook lacks sufficient documentation for verifying the requirements of some SRs. This issue of uncertainty and key assumptions has been While assumptions are documented to some degree in the Salem addressed with the creation of the PRA Uncertainty SR SC-C3-01, SA-PRA-001, Revision 0 notebook, a systematic review/listing of IE-D3 IE-D3 Notebook (SA-PRA-018) during the PRA model update that Not Met SC-C3-02 assumptions and sources of uncertainty as defined by the Standard resulted in the PRA Model of Record SA112A. No further is not documented or referenced in the initiating events notebooks. action required. TABLE A-2 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR ACCIDENT SEQUENCE ANALYSIS RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # Accident Sequences and Event Tree Development Notebook, SA-PRA-002, Revision 0 describes the method used for development of the Event tree figures were included in the Accident Sequence - accident sequences and event trees covering all three required aspects. AS-A1 AS-A1 SR Met AS-A1-01 Event Tree (SA-PRA-002, revision 1) notebook as Appendix The graphical representation of the event trees is not included in the A. No further action required. notebook, but is available through reference to the appropriate CAFTA event tree files. LR-N18-0033 LAR S18-02 Attachment 2 TABLE A-2 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR ACCIDENT SEQUENCE ANALYSIS RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # Accident Sequences and Event Tree Development Notebook, SA-PRA-002, Revision 0 describes the method used for development of the AS-A2 AS-A2 SR Met accident sequences and event trees. Section 2.0 describes the key N/A safety functions necessary to reach a safe, stable state and prevent core damage. Accident Sequences and Event Tree Development Notebook, SA-PRA-002, Revision 0 describes the method used for development of the AS-A3 AS-A3 SR Met N/A accident sequences and event trees. Sections 3 through 9 define systems that can be used to mitigate each modeled initiating event class. Accident Sequences and Event Tree Development Notebook, SA-PRA-002, Revision 0 describes the method used for development of the AS-A4 AS-A4 SR Met accident sequences and event trees. Sections 3 through 9 describes the N/A achievement of key safety functions for each initiating event. Operator actions are described in general terms. Initiating events may be grouped reasonably in accordance with SR IE-B3 as long as the impacts are comparable to existing initiators and the grouping does not impact significant accident sequences. Spurious SI will generally Spurious SI is subsumed into the Turbine Trip initiating event and, be recovered (by resetting SI) and the event will be a AS-A5 AS-A5 SR Met IE-B3-01 therefore, into the General Transient event tree. However, the path transient. If SI is not reset prior to PORV operation, a logic through the EOPs would be different for the two events. change was added to the SA112A PRA model to transfer to the small LOCA event tree. See the Initiating Events Notebook for further details (SA-PRA-001). No further action required. Accident Sequences and Event Tree Development Notebook, SA-PRA-AS-A6 AS-A6 SR Met 002, Revision 0 describes the accident sequences in accordance with the N/A timing of the event to the extent practical. LR-N18-0033 LAR S18-02 Attachment 2 TABLE A-2 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR ACCIDENT SEQUENCE ANALYSIS RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # Sequence endstates that exhibit identical core damage characteristics were combined. The only reason that there Accident Sequences and Event Tree Development Notebook, SA-PRA- are two different endstates identified is to distinguish 002, Revision 0 delineates the possible accident sequences for each between an isolated and non-isolated containment. A modeled initiating event. However, some sequences are not explicitly revision was made to the Accident Sequence Notebook (SA-modeled in the single-top fault tree (e.g., TT sequences S04 and S05 are PRA-002) to state that sequences were combined that combined into a single fault tree gate). No documentation was found to exhibit identical core damage characteristics under a single describe the basis of these combinations. In addition, SA-PRA-002, gate in the fault tree logic for Level 1 sequences in order to Revision 0, Section 3.3.4.5 states that the Te3 and Te4 event trees have conserve core damage numerical results. No further action SR Met AS-A7-01, AS-A7 AS-A7 sequences that were not modeled because they have "very low required. (CC I/II) AS-A7-02 frequencies." No basis for this assessment was documented. The VS ISLOCA sequence with no piping failure is assumed to be terminated with operator isolation of the suction path using the pump suction isolation MOVs. However, isolation cannot be accomplished until primary pressure is reduced. The potential for flooding of adjacent areas by water lost through the RHR pump seals and/or RHR heat exchangers prior to isolation does not appear to have been evaluated. LR-N18-0033 LAR S18-02 Attachment 2 TABLE A-2 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR ACCIDENT SEQUENCE ANALYSIS RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # There is no "double-counting" of offsite power recovery being applied in the SA115A PRA model. The concept of a diesel-mission run time of 6.2 hours that was developed in Section 10.0 of the Data notebook was meant to estimate a "time-averaged" value for which the EDG would be required to run and supply AC power prior to recovery of an offsite power source. The RBU terms that are employed in the PRA model are not recovery terms but flags that are meant to delineate a particular set of circumstances during a Accident Sequences and Event Tree Development Notebook, SA-PRA-particular accident sequence to allow the appropriate 002, Revision 0 and the associated CAFTA event trees define the end "recovery before uncovery" probability to be applied to the state of each sequence as success or core damage. However, the SBO cutset in question. This is separate from the run time that sequences S08, S11, S14 and S17 are assumed to be successful based was calculated in determining how long, on average, the on offsite power recovery. Operator action to restore mitigating systems EDG would be expected to run prior to recovery of offsite after power recovery is not addressed. In addition, given the fact that power, which was based on the worst set of conditions, i.e., power recovery is only credible out to 4 hours, 20 hours of mitigating weather-related causes. This approach is also consistent system operation and the potential failures of that equipment over a AS-A8 AS-A8 SR Met AS-A8-01 with other Westinghouse PWR PRA models. For the issue significant portion of the 24 hour mission time is not being addressed. of mitigating systems that would be required to function This failure to address recovery of mitigating systems following power following the possible recovery of offsite power, they are not recovery does not ensure a safe, stable end state has been reached for explicitly modeled as being subject to "restart" failures due some SBO sequences. There is also concern that the application of to the fact that system start failures are on the order of 1E-3. offsite power recovery is included twice in the modeling of the SBO event. However, a sensitivity analysis was performed that Recovery is credited in the application of a diesel mission time of 6 hours estimated the frequency of LOOP events that result in and again through the application of offsite power recovery top event successful recovery of offsite power, which was added to RBU. the initiating event frequency for transient events without PCS (%TP). The resultant CDF calculated with this adjusted %TP frequency resulted in a 0.5% increase in CDF and a 0.4% increase in LERF. Because of these small changes in CDF and LERF, there is no expected impact on MSPI results and the requisite change to PRA model logic for these additional sequences can be deferred until a future PRA update (see URE # 2015-028). For this URE, there is no further action required. Accident Sequences and Event Tree Development Notebook, SA-PRA-SR Met: AS-A9 AS-A9 002, Revision 0 Section 2.0 indicates that success criteria was based on N/A (CC II) combination of generic, similar plant, and plant-specific sources. LR-N18-0033 LAR S18-02 Attachment 2 TABLE A-2 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR ACCIDENT SEQUENCE ANALYSIS RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # Systems and operator actions required to meet each key safety function are discussed in general terms in the Accident Sequences and Event Tree Development Notebook, SA-PRA-002, Revision 0 Sections 3 A weighted average analysis of the size of a RCP seal through 9. Operator actions and diverse systems to satisfy top events are LOCA with various configurations of successful means of included in the fault tree but are grouped under common top events in the heat removal mitigation with offsite power non-recovery AS- AS- SR Met: AS-A10-01 accident sequence model (e.g., core decay heat removal includes AFS, probabilities was performed and is consistent with other A10 A10 (CC I) operator action to depressurize, and condensate under a common top Westinghouse PWR models. This is described in Appendix event). However, the modeling of offsite power recovery in the SBO C of SA-PRA-002 Revision 3. There is no further action event tree does not explicitly model the differences in recovery times or required. plant response associated with different RCP seal leakage rates. Instead, a single lumped recovery event is modeled. Transfer of certain sequences to other event trees is Transfers between event trees are described in the Accident Sequences AS- AS- discussed for each event tree in the event tress construction SR Met AS-A11-01 and Event Tree Development Notebook, SA-PRA-002, Revision 0 A11 A11 section of the Accident Sequence - Event Tree notebook. Sections 3 through 9. No further action required. This requirement is met by Sections 3 and 9 of the Accident Sequence notebook. These sections identify the mitigating systems and how the AS-B1 AS-B1 SR Met N/A accident progresses depending the equipment availability. The single-top fault tree model explicitly models initiator impacts on mitigating systems. This requirement is met by Sections 3 and 9 of the Accident Sequence AS-B2 AS-B2 SR Met notebook. These sections identify the mitigating systems and how the N/A accident progresses depending the equipment availability. The environmental conditions are considered (Section 3.6) for AS-B3 AS-B3 SR Met recirculation. The clogging of the sumps is addressed in the system N/A notebook. AS-B4 AS-B4 SR N/A This model does not use the split fraction method. N/A This SR is geared towards other methodologies than CAFTA. The event trees and the fault trees are of sufficient detail to address intersystem AS-B5 AS-B5 SR Met N/A dependencies and train level interfaces. In CAFTA these two requirements are done at the fault tree level. AS- This requirement is addressed in the system models. Therefore it will be AS-B6 SR N/A N/A B5a address in the review of the System Notebook. LR-N18-0033 LAR S18-02 Attachment 2 TABLE A-2 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR ACCIDENT SEQUENCE ANALYSIS RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # The SBO/LOOP, battery depletion, and room cooling are all addressed in SR the Accident Sequence notebook. However, the lumped treatment of AS-B7 AS-B6 AS-A8-01 See above response for SR AS-A8. Not Met offsite power recovery into both the diesel mission time calculation and the RBU recovery factor could overestimate the potential for recovery. The accident sequences are analyzed in a manner that allows application, AS-C1 AS-C1 SR Met N/A upgrades, and peer review to be accomplished in a timely. The HRA and Level 2 notebooks now adequately address procedural guidance and important operator actions in sufficient detail to allow traceability of references used and description of how HEPs are being applied to their SR The operator actions are not part of the event tree as required by this appropriate accident sequences. Since the Level 2 logic is AS-C2 AS-C2 AS-C2-01 Not Met Supporting Requirement. The requirements of c, d and e are not met. explained in detail in Appendices A, B, and C of the Level 2 Notebook, it was not necessary to expand any of the event trees. The operator actions referred to in the above description are discussed in the Level 2 Notebook. At any event, there is no further action required. In Notice of Clarification to Revision 1 of Regulatory Guide 1.200, FRN July 27, 2007, Accession number: ML071170054, the NRC provided their clarification related to assumptions and sources of uncertainty. The NRC stated that Key assumptions and sources have meaning only within the This issue of uncertainty and key assumptions has been scope of an application. For a base PRA, the plant needs to identify and addressed with the creation of the PRA Uncertainty SR characterize assumptions and sources of uncertainty. Characterization AS-C3 AS-C3 SC-C3-02 Notebook (SA-PRA-018) during the PRA model update that Not Met can be qualitative. ANO2 has documented the assumptions that they resulted in the PRA Model of Record SA112A. No further used for the accident sequence analyses. The uncertainty notebook is in action required. draft form and therefore is not reviewable. The uncertainty portion of this requirement is not met. The assumption were in the notebook so this part of the requirement is met. A suggestion is that an assumption section be added to the notebook. LR-N18-0033 LAR S18-02 TABLE A-3 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SUCCESS CRITERIA RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF RESOLUTION Category F&Os SR # SR # The ASME standard defines core damage as "uncovery and heatup of the reactor core to the point at which prolonged oxidation and severe fuel damage involving a large section of the core is The definition of core damage has been clarified as part of SR anticipated." In the Salem PRA Success Criteria Notebook, SA-PRA- the 2012 PRA update and properly reflected in both the SC-A1 SC-A1 SC-A1-01 Not Met 003, a "big picture" definition as described in the ASME PRA standard Success Criteria and Accident Sequence - Event Tree appears to missing. In the Salem PRA, core damage is defined as notebooks. No further action required. maintaining core temperature below 1200 degrees F which deals with heatup but not uncovery. In the Salem PRA, core cooling was defined as successful if core exit This was a documentation issue that has since been temperatures do not exceed 1200 degrees F. This represents the resolved by revising the Level 1 Success Criteria Notebook temperature below which no core damage is expected to occur and (SA-PRA-003) to definitively state in Section 2.4 that core the core exit thermocouple temperature at which the operators cooling is successful if the mass-averaged temperature of SR transfer to severe accident guidelines. The 1200 degrees F core SC-A2 SC-A2 SC-A2-01 the hottest core node does not exceed 1800 deg. F. This is Not Met temperature success criteria were interpreted to be the core hottest also consistent with the definition of core damage stated in node temperature (TCRHOT) in MAAP. However, in the TH notebook Section 2.2.1 of the Thermal-Hydraulic MAAP PRA a peak cladding temperature of 1800 degrees F was referenced. The Notebook (SA-PRA-007) that references this same value of MAAP code used 1800 degrees as TCRHOT. Also, there is no 1800 deg. F. No further action required. mention of core collapsed liquid level. N/A SC-A3 This SR was deleted in RA-Sb-2005. N/A The success criteria for each of the key safety functions is specified in SC-A3 SC-A4 SR Met N/A the success criteria notebook. The only system that is shared is the VCA system. This system is SC-SC-A4 SR Met identified as being shared and the common initiating event is N/A A4a discussed. Accident sequences are terminated at 24 hours, except under two conditions: SR Met: 1. The plant is brought to a condition where return to power operation SC-A5 SC-A5 N/A (CC II/III) is possible in less than 24 hours, or

2. Core damage or containment failure is predicted to occur within a few hours after the 24 hour limitation.

Success criteria are based on plant-specific features, procedures and SC-A6 SC-A6 SR Met N/A operation. LR-N18-0033 LAR S18-02 TABLE A-3 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SUCCESS CRITERIA RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF RESOLUTION Category F&Os SR # SR # SR Met: Plant-specific MAAP analyses have been performed to determine SC-B1 SC-B1 N/A (CC II) success criteria SC-B2 SC-B2 SR N/A Expert judgment is not used in the success criteria development. N/A T/H analyses are consistent with the initiating event groups and SC-B3 SC-B3 SR Met N/A accident sequences. Section 1.3 of the Success Criteria Notebook (SA-PRA-003) now discusses the limitations of the MAAP computer code. Relative to the Salem Generating Station, this The MAAP Thermal-Hydraulic Calculations Notebook (SA-PRA-007, means that the minimum systems required to mitigate a Revision 1), Sections 1.2 and 1.3 provide a discussion of the codes large break LOCA should be based on a source other than SR available and the advantages associated with using MAAP, SC-B4 SC-B4 SC-B4-01 MAAP. In this case, the success criteria was defined using Not Met respectively. However, MAAP is used in establishing large LOCA analyses related to the plants licensing basis. Other code success criteria, although the code is not suitable for analysis of this limitations were listed in Table 1-2 of this notebook. Since plant upset. A discussion of code limitations is not provided. this issue has been addressed through the use of the plants licensing basis, the issue associated with this SR has been adequately addressed. Table 2-1 of SA-PRA-003 provides a summary of the overall success criteria for the Salem Generating Station for In-Vessel Core Cooling, RCS Integrity, and Containment Integrity. Table 2-2 of the notebook shows the general SR A check of the reasonableness and acceptability of the success SC-B5 SC-B5 SC-B5-01 success criteria for the Byron and Braidwood nuclear Not Met criteria results is not documented. stations, which reveals that Salems success criteria is consistent with other Westinghouse plants. These comparisons confirm the reasonableness of the success criteria results, and meet the intent of this SR. The Level 1 Success Criteria Notebook (SA-PRA-003, Revision 0), MAAP4 Parameter File Notebook (SA-PRA-009, Revision 1), and This issue has no impact on the quality of the PRA and was MAAP Thermal-Hydraulic Calculations Notebook (SA-PRA-007, only meant to aid reviewers in identifying where each of the SC-C1 SC-C1 SR Met SC-C1-01 Revision 1) document the success criteria analyses. However, it elements of the PRA Standard are being addressed. As would be helpful to provide a cross reference to the PRA Standard such, this is only a documentation issue and may remain requirements to facilitate PRA applications, upgrades, and peer open for now. No further action required. reviews. SC-C2 SC-C2 SR Met The success criteria development process has been documented. N/A LR-N18-0033 LAR S18-02 TABLE A-3 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SUCCESS CRITERIA RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF RESOLUTION Category F&Os SR # SR # Each PRA System Notebook (SA-PRA-005.####) now has a section that lists assumptions that were made as part of the systems analysis. The Uncertainty Notebook (SA-PRA-018) was officially issued and includes a section on model Assumptions are embedded in the documentation rather than uncertainty and references both EPRI 1026511, which captured in a specific section. Sources of uncertainty are addressed SR SC-C3-01, addresses the use of PRA and the treatment of uncertainty, SC-C3 SC-C3 in a draft evaluation using guidance from draft EPRI report, Not Met SC-C3-02 and EPRI 1016737, which addresses the treatment of "Treatment of Parameter and Model Uncertainty for Probabilistic Risk parameter and model uncertainty. The results of the Salem Assessments." Uncertainty analysis clarify the importance of assumptions that were made during development of the Success Criteria Notebook (SA-PRA-003). As such, there is no further action required. LR-N18-0033 LAR S18-02 Attachment 2 TABLE A-4 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # The system models are consistent with similar PWR PRAs and SY-A1 SY-A1 SR Met address system responses found in the accident sequence N/A response. The system model documentation includes references to SY-A2 SY-A2 SR Met drawings, control logic, procedures and technical specifications. N/A Training drawings are included in the documentation. Based on documentation for the system notebooks information SY-A3 SY-A3 SR Met N/A was reviewed. Plant walkdowns for the systems modeled in the PRA were The system notebooks do not provide any walkdown SR documented in Appendix C of each of the Salem PRA System SY-A4 SY-A4 SY-A4-01 information. A walkdown document was made available to the Not Met Notebooks (SA-PRA-005.#### series). No further action peer review but has not been reviewed and formally released. required. Modeling addresses plant configurations necessary to support SY-A5 SY-A5 SR Met N/A success criteria. The System Model Notebooks (SA-PRA-005.#### series) were revised to more clearly define system boundaries of modeled systems using one-line diagrams depicted in Section 2.3 of these notebooks. For example, for the Safety Injection (SI) system, the system boundary includes all of the components in the SI system whose failure could potentially prevent water from The system notebooks do not provide definitive explanation of SR reaching the RCS, but the system boundaries do not branch into SY-A6 SY-A6 SY-A6-01 boundary information and do not provide illustration of modeled Not Met the other ECCS systems. Figure 2-1 in this system notebook components. shows a diagram of the SI system boundary, and various highlighted colors show the different modes of operation of SI. Not all of the components highlighted along the paths were modeled in the PRA. For example, many valves are not modeled because their failure does not prevent water from being injected into the core. Also see SY-A8. SR Met: SY-A7 SY-A7 N/A (CC III) LR-N18-0033 LAR S18-02 Attachment 2 TABLE A-4 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # Boundary definitions for plant systems were better defined in the PRA System Notebooks (SA-PRA-005.#### series) during the 2012 PRA Update by incorporating drawings with highlighted SR SY-A8 SY-A8 SY-A8-01 Boundaries not defined. boundaries in order to help the reader better visualize the Not Met modeled system boundaries. The Data Notebook (SA-PRA-010, Rev. 2) has also been revised in order to explain how component boundaries were defined. N/A SY-A9 This SR was deleted in RA-Sb-2005. N/A Since the Emergency Diesel Generator (EDG) Day Tanks are modeled as being part of the component boundary for the EDGs, the failure probabilities used for the EDG events used in the SA115A PRA model inherently include the failure of Day Tanks to perform their function, e.g., rupture, plugged lines, etc. SR SY-A9 SY-A10 SY-A10-01 Diesel generator modeling. However, a failure mode that could cause failure of the fuel oil Not Met transfer pumps involves miscalibration of the day tank level instrumentation, which was included in the SA115A PRA model. The Vital AC system notebook now includes a discussion about the EDG day tanks being part of the component boundary definition used for the EDGs. SY-A10 SY-A11 SR Met N/A Although the Emergency Diesel Generator (EDG) Day Tanks are considered to be within the component boundary of the EDGs (see response to SY-A9), the fuel oil transfer system was not, and as such, was explicitly modeled in the SA115A PRA model. Also, there are Human Error Probability (HEP) events SR Some components listed in the standard supporting requirement included in the SA115A PRA model that model failure to realign SY-A11 SY-A12 SY-A12-01 Not Met are absent from some system models. ventilation dampers, e.g., see event RD3-XHE-MM (OPERATORS FAIL TO ALIGN CAV FOR MAINT MODE) in the HRA Notebook (SA-PRA-004). This and other HEPs that make use of AB.CAV procedures have been appropriately analyzed in the HRA notebook and included in the SA115A PRA model where appropriate. No further action required. SY-A12 SY-A12a SR Met N/A LR-N18-0033 LAR S18-02 Attachment 2 TABLE A-4 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # SY-A13 SY-A12b SR Met Modeling guidance included consideration of divergence paths. N/A The probability of manual valves transferring shut was not generally modeled as the failure probability is exceedingly low and can be excluded via the use of the criteria found in ASME Supporting Requirement (SR) SY-A15: One or more failure modes for a component may be excluded from the systems model if the contribution of them to the total failure rate or probability is less than 1% of the total failure rate or probability SR Review of models identified several exclusions of failure modes for that component when the effects on system operation are SY-A14 SY-A13 SY-A13-01 Not Met on a global basis without justification. the same. However, SR SY-A15 should be referred to in Section 3.1 (Generic Assumptions) of each PRA System Notebook to support the decision to exclude low probability events. Since this is only a documentation issue, there is no impact on either CDF or LERF due to the fact that the exclusion of manual valves spuriously changing state was appropriately addressed in the PRA model. As such, this issue has no impact on the results for this license amendment request. SY-A15 SY-A14 SR N/A No assessment performed. N/A SR Met: SY-A16 SY-A15 N/A (CC III) SY-A17 SY-A16 SR Met N/A SY-A18 SY-A17 SR Met N/A SY-A19 SY-A18 SR Met N/A SY-A20 SY-A18a SR Met N/A All PRA System notebooks were revised to add generic SR assumptions on components not performing beyond their design SY-A21 SY-A19 SY-A19-01 No documentation of assessment. Not Met operating conditions unless otherwise specified. No further action is required. SR Met: SY-A22 SY-A20 SY-A20-01 No analyses provided. N/A (CC I) LR-N18-0033 LAR S18-02 Attachment 2 TABLE A-4 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # The state of knowledge correlation was addressed as part of the SR Multiple type code descriptions are used for the same data such SY-A23 SY-A21 SY-A21-01 2012 PRA update. See the Salem PRA Data Notebook (SA-Not Met that the second part of the SR is not met. PRA-010) for further details. No further action required. SY-A24 SY-A22 SR Met N/A SR Met: SY-B1 SY-B1 N/A (CC II/III) SR Met: SY-B2 SY-B2 N/A (CC I/II) Industry common cause failure data is collected from the NRC/INL Common Cause Database [CCF Parameter Estimations, 2012 Update]. Due to the relative rarity of common cause events, generic data is used for the Salem PRA model. The Alpha-Factor Methodology was used for common cause modeling in the Salem PRA. Mean values for the alpha factors were obtained and used to determine the Common Cause Factor, which is input into the CAFTA BE database Factor field. A few CCF events were determined using sources other than the NRC/INL data. SR For some cases the selection of CCF combinations are not SY-B3 SY-B3 SY-B3-01 In particular, to address the issue of completeness regarding Not Met complete and those selected are not the most limiting. various combination of failures, and due to the small probabilities and uncertainty that is involved with interim CCF combinations involving a population size of 6, it was deemed adequate in modeling the 2 of 6 (loss of one division), 4 of 6 (loss of two divisions), and 6 of 6 event combinations (loss of all three divisions) in estimating the total risk associated with DC battery charger common cause failures. The common cause modeling was limited to only those combinations that are consequential and important to risk. Refer to Appendix D of the Data Notebook (SA-PRA-010) for further details. LR-N18-0033 LAR S18-02 Attachment 2 TABLE A-4 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # The MGL parameter model was not used for common cause failure probabilities used in the Salem PRA model. Instead, the Alpha-Factor Methodology was used. As stated in the response for SY-B3-01, certain interim combinations for DC battery SR Some combinations are absent which when using MGL can chargers involving a population size of 6 were omitted due to SY-B4 SY-B4 SY-B3-01 Not Met underestimate the CCF contribution. their small probabilities and inherent uncertainty, with only the important common cause combinations being retained, e.g., 2 of 6, 4 of 6, and 6 of 6. Since MGL is not used for these events, the missing combinations do not significantly underestimate the CCF contributions. Since the heated water system was not required as an immediate support system for system success, it was not explicitly modeled due to the fact that freezing of water lines is a Documentation for several system notebooks (AFW, CVCS and slowly developing event with ample time for procedural direction SR SY-B5 SY-B5 SY-B5-01 RWST) indicated that the heated water circulating system was and any necessary repair. It was also explicitly stated in the Not Met required to prevent freezing, but was not modeled. system modeling documentation that the heating water system was not required during the PRA mission time of 24 hours, e.g., see Section 2.5.4 of the AFS and MFWS System Notebook (SA-PRA-005.0001). As such, no further action is required. No analysis documented As part of the 2012 PRA Update, all PRA System Notebooks were revised to follow a more consistent outline with information better organized to allow a more effective review and understanding of the documentation including sections on SR No documentation provided related to analysis of support SY-B6 SY-B6 SY-B6-01 shared/required systems. In addressing this particular SR, Not Met system requirements. There appears to be no analysis of section 4.4 in each PRA System Notebook (SA-PRA-005.#### support system requirements concurrent with their definition in series) documents the support system requirements and the system notebooks. Perform the required engineering dependencies for all modeled system components in the PRA analysis. model. LR-N18-0033 LAR S18-02 Attachment 2 TABLE A-4 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # As part of the 2012 PRA Update, this information has been clarified and references provided for success criteria in the System Notebooks using a more consistent approach that will now make it much easier for the reviewer to identify such information. Also, fault tree modeling and operator actions were updated during the 2012 PRA update using the latest design SR Met: The support system modeling is mostly based on conservative SY-B7 SY-B7 SY-B7-01 calculations for the control room envelope. The results of the (CC I) criteria. SA112A PRA model showed that loss of Control Area Ventilation (CAV) scenarios are now about a factor of ten less than what previously existed in the peer-reviewed PRA model (PRA Model, Rev. 4.1). Therefore, any conservatism that may exist in the design basis calculations for CAV is not important to the PRA results. As such, there is no further action required. SY-B8 SY-B8 SR Met SY-A4-01 Walkdowns are not formally complete N/A N/A SY-B9 This SR was deleted in RA-Sb-2005. N/A SR The need for heating of the RWST is not modeled although the SY-B9 SY-B10 SY-B5-01 See above response for SR SY-B5. Not Met system notebook indicates the need for heating. This issue was addressed as part of the 2012 PRA Update. In particular, the AFW system and SI actuation logic and automatic initiation signals were reviewed and revisions made and SR Some AFW signals (SI, LOSP) are not defined and no additional logic added to the PRA model where appropriate. SY-B10 SY-B11 SY-B11-01 Not Met justification for exclusion is provided. Specifically, Section 2.6 of the AFW PRA System Notebooks (SA-PRA-005.0001) documents the actuation signals that are modeled in the PRA for automatic system actuation. Necessary signals are now modeled, meeting the intent of this SR. LR-N18-0033 LAR S18-02 Attachment 2 TABLE A-4 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # An average value for the expected run-time of the Emergency Diesel Generators (EDGs) and their supporting components, such as the fuel oil transfer pumps, was derived based on a convolution involving non-recovery of offsite power data and EDG run-time failure probabilities. This analysis is documented SR in Section 10.0 of the Salem PRA Data Notebook (SA-PRA-SY-B11 SY-B12 SY-B12-01 Some identified mission times are less than required. Not Met 010), which was performed during the PRA update that resulted in the SA112A model. This exercise resulted in an average run time of 6.2 hours for the EDGs, which was also used for the EDG fuel oil transfer pumps. However, the AFW turbine-driven pump was assigned a mission time of 24 hours. No further action required. SY-B12 SY-B13 SR Met N/A SY-B13 SY-B14 SR Met N/A SR No documentation of an evaluation for potential adverse SY-B14 SY-B15 See above response for SR SY-A21. Not Met environments. The issue of instrument miscalibration was modeled using Human Error Probability (HEP) pre-initiator events that were included in the appropriate sections of the Salem SA112A PRA SR Operator starts for standby equipment not defined. No SY-B15 SY-B16 HR-C3-01 model to capture the unavailability of instruments due to Not Met miscalibration of under voltage relays. miscalibration errors. These HEPs are documented in the Salem HRA Notebook (SA-PRA-004). No further action required. SY-C1 SY-C1 SR Met N/A The Salem PRA System Notebooks were revised and enhanced as part of the PRA model update that resulted in the SA112A SR System documentation does not provide some required PRA model, which occurred after the peer review was SY-C2 SY-C2 SY-C2-01 Not Met documentation. performed in 2008. Since this issue was a documentation issue, there would be no impact on the results for this license amendment request. LR-N18-0033 LAR S18-02 Attachment 2 TABLE A-4 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEMS ANALYSIS RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # The Salem PRA System Notebooks were revised and enhanced as part of the PRA model update that resulted in the SA112A PRA model, which occurred after the peer review was SR performed in 2008. In particular, Section 3 of the System SY-C3 SY-C3 SC-C3-02 Assumptions are not present Not Met Notebooks (SA-PRA-005.#### series) now lists both generic and system-specific PRA modeling assumptions. Since this issue was a documentation issue, there would be no impact on the results for this license amendment request. LR-N18-0033 LAR S18-02 TABLE A-5 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR HUMAN RELIABILITY ANALYSIS RA- RA-Sa- Sb- Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 2005 Category F&Os SR # SR # This requirement is met by the process outlined in Section 2.2 of HR-A1 HR-A1 SR Met N/A the HRA Notebook. This requirement is met by the process outlined in Section 2.2 of HR-A2 HR-A2 SR Met N/A the HRA Notebook. This requirement is met by the process outlined in Section 2.3.4 of HR-A3 HR-A3 SR Met N/A the HRA Notebook. SR Met: (CC This requirement is met by the process outlined in Section 4.3.3.1 HR-B1 HR-B1 N/A II/III) of the HRA Notebook. This requirement is directly in violation of the first sentence of The HRA notebook (SA-PRA-004) was revised to address SR Section 4.3.3.1 which allows screening of actions that could this issue in order to clarify that screening of this nature HR-B2 HR-B2 HR-B2-01 Not Met simultaneously have an impact on multiple trains of a redundant was not performed. Therefore, this SR is now met and system or diverse systems. there is no further action required. This requirement is met by including the description of the HFE HR-C1 HR-C1 SR Met N/A with each HFE analysis (see Tables 5.1.1, 5.1.2 and 5.1.3) The HRA notebooks specified that the LARs were reviewed and SR Met: (CC HR-C2 HR-C2 the descriptions indicate modes of unavailability have been N/A II/III) included. The issue of instrument miscalibration was modeled using Human Error Probability (HEP) pre-initiator events that There is no documentation showing that miscalibration as a mode were included in the appropriate sections of the Salem of failure of initiation of standby systems was considered. An HR-C3 HR-C3 SR Not Met HR-C3-01 SA112A PRA model to capture the unavailability of example of this is that there is no HFE for miscalibration of bus instruments due to miscalibration errors. These HEPs are under voltage bus, RPS relays, etc. documented in the Salem HRA Notebook (SA-PRA-004). No further action required. HR-D1 HR-D1 SR Met Since the EPRI HRA Calculator was used this requirement is met. N/A SR Met: (CC This meets Capability Category II since there was one screening HR-D2 HR-D2 N/A II) value used for pre-initiators. This requirement is met due to the fact that the EPRI HRA SR Met: (CC HR-D3 HR-D3 Calculator is used. The Calculator requires human shaping N/A II/III) factors which includes these requirements. This requirement is met due to the fact that the EPRI HRA HR-D4 HR-D4 SR Met Calculator is used. The Calculator requires human shaping N/A factors which includes these requirements. HR-D5 HR-D5 SR Met This requirement is met in Section 5.2.2. N/A LR-N18-0033 LAR S18-02 TABLE A-5 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR HUMAN RELIABILITY ANALYSIS RA- RA-Sa- Sb- Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 2005 Category F&Os SR # SR # The Salem PRA Uncertainty Notebook (SA-PRA-018) was officially issued as part of the SA112A PRA model update and includes sources of uncertainties associated with The uncertainty analysis has not been done. The mean values Human Reliability Analysis (HRA). This document makes HR-D6 HR-D6 SR Not Met SC-C3-02 were used since the HRA Calculator was used for this analysis. use of both EPRI 1026511, which addresses the use of PRA and the treatment of uncertainty, and EPRI 1016737, which addresses the treatment of parameter and model uncertainty. As such, there is no further action required. SR Met: (CC There was no requirement to check reasonableness of HEPs in HR-D7 HR-D7 N/A I/II) light of the plants experience. This requirement is met by the methodology section of the HRA HR-E1 HR-E1 SR Met N/A Notebook. HR-E2 HR-E2 SR Met This requirement is met by Section 2.1 of the HRA Notebook. N/A SR Met: (CC HR-E3 HR-E3 This requirement is met in Section 2.6 of the HRA Notebook. N/A II/III) SR Met: (CC HR-E4 HR-E4 This requirement is met in Section 2.6 of the HRA Notebook. N/A II/III) This requirement is met at the Capability Category I/II level SR Met: (CC HR-F1 HR-F1 because several HFEs included several responses which are N/A I/II) grouped into one HFE. The accident sequence specific timing of time window for The HRA Notebook (SA-PRA-004) has been revised as successful completion for CCS-XHE-FO-ISOLT is based on a part of the 2012 PRA update that resulted in the SA112A calculation that does not address leakage. The calculation S-CC- PRA model. The notebook now describes the available MDC-2111 is for loss of Service Water and does not address system windows for operator intervention and use of cues leakage of the Component Cooling Water System. The time for all the important and risk-significant Human Error window should account for leakage that would drain the CCW Probability (HEP) events. With regard to the specific HR-F2-01, HR-F2 HR-F2 SR Not Met system and make it inoperable. This is the limiting time since the comments made against this SR, event CCS-XHE-FO-HR-F2-02 CCW system will continue to cool with the leak until the surge tank ISOLT is no longer being used in the PRA model, as it is drained. Other examples of problems with timing are the lack of was a legacy event that no longer applies to the current documentation for the timing used. This is noted in HRAs: CIS- treatment of internal flood mitigation. Events CIS-XHE-XHE-FC-XLCNT, AND MSS-XHE-FO-MS10. It should be noted FC-XLCNT and MSS-XHE-FO-MS10 were analyzed in that only a sampling was performed and that this may involve detail with justification cited for the system time window many more HRA analysis. that was used in developing the human error probability. LR-N18-0033 LAR S18-02 TABLE A-5 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR HUMAN RELIABILITY ANALYSIS RA- RA-Sa- Sb- Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 2005 Category F&Os SR # SR # While industry consensus has not been achieved in adopting a consistent methodology to appropriately The notebook does document which HEP's are risk significant and analyze the many actions associated with remote the ones that are not use screening values. The reason this does shutdown activities, a detailed HEP calculation is no SR Met: (CC not meet Capability Category I is that the human action from the HR-G1 HR-G1 HR-G1-01 longer required for RRS-XHE-FO-SDRSP as it is not risk I) shutdown panel, RRS-XHE-FO-SDRSP, is risk significant but still significant in the SA112A model. Per Category II of HR-uses a screening value. This requirement must have a detailed G1, screening values may be assigned to HEPs for non-analysis for significant HFEs. significant human failure basic events. No further action required. This requirement was met since the EPRI HRA Calculator was HR-G2 HR-G2 SR Met N/A used for the analysis. SR Met: (CC This requirement was met since the EPRI HRA Calculator was HR-G3 HR-G3 N/A II/III) used for the analysis. The accident sequence specific timing of time window for successful completion for CCS-XHE-FO-ISOLT is based on a calculation that does not address leakage. The calculation S-CC-MDC-2111 is for loss of Service Water and does not address leakage of the Component Cooling Water System. The time window should account for leakage that would drain the CCW HR-F2-01, HR-G4 HR-G4 SR Not Met system and make it inoperable. This is the limiting time since the See above response for SR HR-F2. HR-F2-02 CCW system will continue to cool with the leak until the surge tank is drained. Other examples of problems with timing are the lack of documentation for the timing used. This is noted in HRAs: CIS-XHE-FC-XLCNT, and MSS-XHE-FO-MS10. It should be noted that only a sampling was performed and that this may involve many more HRA analysis. SR Met: (CC HR-G5 HR-G5 This requirement was met by Section 2.6 during plant visits. N/A II/III) This requirement was met by Section 2.6 during plant visits and HR-G6 HR-G6 SR Met N/A operator interviews. This requirement is met by Section 5.2 of the HRA Notebook, HR-G7 HR-G7 SR Met N/A Dependent Operator Actions. N/A HR-G8 This SR was deleted in RA-Sb-2005. N/A LR-N18-0033 LAR S18-02 TABLE A-5 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR HUMAN RELIABILITY ANALYSIS RA- RA-Sa- Sb- Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 2005 Category F&Os SR # SR # The Salem PRA Uncertainty Notebook (SA-PRA-018) was officially issued as part of the SA112A PRA model update and includes sources of uncertainties associated with Human Reliability Analysis (HRA). This document makes HR-G8 HR-G9 SR Not Met SC-C3-02 This requirement is not met. use of both EPRI 1026511, which addresses the use of PRA and the treatment of uncertainty, and EPRI 1016737, which addresses the treatment of parameter and model uncertainty. As such, there is no further action required. SR Met: (CC This requirement was met because the EPRI HRA Calculator was HR-H1 HR-H1 N/A II/III) used and this includes operator recovery actions. This requirement was met because the EPRI HRA Calculator was HR-H2 HR-H2 SR Met N/A used and this includes operator recovery actions. This requirement is met by Section 5.2 of the HRA Notebook, HR-H3 HR-H3 SR Met N/A Dependent Operator Actions. The use of the EPRI HRA Calculator and the documentation in the HR-I1 HR-I1 SR Met N/A HRA Notebook meets this requirement. The use of the EPRI HRA Calculator and the documentation in the HR-I2 HR-I2 SR Met N/A HRA Notebook meets this requirement. HR-I3 HR-I3 SR Not Met SC-C3-02 This requirement is not met. See above response for SR HR-G8. LR-N18-0033 LAR S18-02 TABLE A-6 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra-Sa- Ra-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # The PSEG ER-AA-600 series of procedures exist to Need to develop Salem specific site procedures. address this issue. Specifically ER-AA-600-1015 SR Met: Salem specific site procedures should be developed for addresses maintenance and update of the internal DA-A1 DA-A1 DA-A1-01 (CC II/III) maintenance of site specific PRAs. events PRA model. They may be found and retrieved Recommendation is to develop Salem specific site procedures. using the site's database known as DCRMS. There is no further action required. Boundary definitions for plant systems were better No discussion of component boundary definition is provided in defined in the System Notebooks during the 2012 PRA either the data or systems analysis. Boundaries for unavailability Update by incorporating drawings with highlighted events are not established. Boundary definitions help assure that boundaries in order to help the reader better visualize failures are attributed to the correct component and that calculated the modeled system boundaries. The Data Notebook failure rates and unavailability values are appropriate. Some (SA-PRA-010) was also revised in order to explain how component boundaries are discussed in the notes to Appendix A, DA-A2 DA-A1a SR Not Met DA-A1a-01 component boundaries were defined. This was done by "Generic (Industry) Failure Data" of the Data Notebook. Note 32 referencing Section 5.1 of NUREG/CR-6928 which states to "Assume that CCW/RHR HX failure rates apply to TDAFW contains the definition used for component boundaries Pump Bearing and governor jacket coolers," however unless the for generic industry data. Also, the TDAFW jacket Salem TDAFW pump has unique features that require this to be coolers were removed from the SA112A PRA model modeled separately, cooling to the TDAFW pump is included in the since they are considered within the boundary of the component boundary to the pump in NUREG-6928. TDAFW pump. No further action required. The PRA update for the Rev. 4.3 PRA model included adding uncertainty parameters to the type code Mean values for failure rates appear in the model, however no database, and as part of the 2012 PRA model update, DA-A3 DA-A2 SR Not Met DA-A2-01 uncertainty distributions could be found in the basic events the CAFTA Access database file (SA112A.rr) was checked. updated to include uncertainty parameters for all type codes and basic events used in the SA112A PRA model. No further action required. The data parameters used in the model appear to be appropriately identified. The units for Motor Operated Valves Fails to Close are DA-A4 DA-A3 SR Met demands. The units identified for Motor Operated Valves Fails to N/A Remain Open or Closed are hours. Reference Data Analysis Notebook Section 2.1.1. LR-N18-0033 LAR S18-02 TABLE A-6 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra-Sa- Ra-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # The type codes used and listed in the Data Notebook (SA-PRA-010) do identify the different systems and Components were grouped according to type such as motor-type codes used as well as the basis for their failure operated valve to meet Category 1 of the standard. Components probabilities. Type code failure rates now distinguish were grouped according to mission type, (e.g., standby and SR Met: between clean and dirty water systems, e.g., pumps in DA-B1 DA-B1 DA-B1-01 operating) fails to meet Category II, however as stated in the Data (CC I) the CCS and SWS PRA modeled systems. Also, the Analysis Notebook Section 2.1.1.6, "there is no differentiation internal flood evaluation makes use of pipe rupture between systems (e.g., clean water vs. raw water". Therefore, a full rates categorized by the type and quality of water Category II could not be met. contained within the various water pipes that were analyzed. No further action required. There did not appear to be any outliers in the data reviewed. DA-B2 DA-B2 SR Met Reference Data Analysis Notebook, Section 2.2 and Appendix A N/A and Appendix C. As discussed in DA-A2, the Data Notebook (SA-PRA-010) was revised in order to explain how component boundaries were defined, which is consistent with NUREG/CR-6928, the source of the generic failure rate Generic parameter estimates are obtained from recognized sources data. (principally NUREG/CR-6928). However, no discussion of The most recent PRA update, SA115A, included plant-SR DA-A1a-01, component boundary definition is provided other than a draft specific updates for all unavailability type codes using DA-C1 DA-C1 Not Met DA-C1-01 document. In addition, generic unavailability data is used for some current or past plant specific maintenance rule data. No SSCs without demonstrating that the data is consistent with the test unavailability is based on generic sources. Past and maintenance philosophies for the subject plant. unavailability data from an older model revision is used only for components which show zero unavailability from maintenance rule data as noted in Appendix C of SA-PRA-010, so the impact on the model is slightly conservative and negligible. No further action required. LR-N18-0033 LAR S18-02 TABLE A-6 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra-Sa- Ra-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # In accordance with ER-AA-600-1015, plant specific updating of data should be considered for those events that satisfy either a Fussell-Vesely (FV) value greater than 0.005 or a Risk Achievement Worth (RAW) greater than 2.0. An importance measures report was generated from a CDF cutset listing and a review made of those non-MSPI applicable basic events that exceeded this criteria. The associated type codes for these basic events were then identified and are listed in Table 7-1 of the data notebook (SA-PRA-010) to Plant-specific data is only collected for MSPI components. The SR determine the type of plant components for which plant DA-C2 DA-C2 DA-C2-01 draft data procedure provided requires that plant specific data be Not Met specific updating was considered. A search of Salems supplied for SSCs with RAWs > 2 and F-V's > 0.005. SAP database was performed to identify any functional failures that may have occurred within the time period from July 2012 to September 2016. Any applicable failures for the identified equipment types were then recorded in Table 7-1 of the Data Notebook to support a Bayesian update of the generic data. This data update that was incorporated in SA115A now addresses all components with the identified importance values, thereby meeting the intent of this SR. Plant-specific data is collected consistent with design, operation and DA-C3 DA-C3 SR Met N/A experience. LR-N18-0033 LAR S18-02 TABLE A-6 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra-Sa- Ra-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # Formal procedures now currently exist that describe the PRA update process, including what data collection is required. Actual plant-specific failure and unavailability data were obtained from the Salem Maintenance Rule and MSPI programs. In accordance with ER-AA-600-1015, plant specific updating of data should be considered for those events that satisfy either a Fussell-Vesely (FV) value greater than 0.005 or a Risk Achievement Worth (RAW) greater than 2.0. As a matter of practice, all MSPI monitored components, whether risk-significant or not, use plant-specific data to inform the generic industry data (i.e., Bayesian analysis). For other components deemed risk significant, an importance measures report was generated from a CDF cutset listing and a review made Documentation describing the process of evaluating maintenance of those non-MSPI applicable basic events that records was identified in a draft procedure. All failures must be exceeded this criteria. The associated type codes for SR reviewed for applicability to the PRA model and this process should DA-C4 DA-C4 DA-C4-01 these basic events were then identified and were listed Not Met be documented. All plant specific data came from MSPI or the in Table 7-1 of the PRA Data Notebook (SA-PRA-010) Maintenance Rule, however there was no documentation provided to determine the type of plant components for which that these failures were reviewed as PRA failures. plant specific updating was considered. A search of Salems SAP database was performed to identify any functional failures that may have occurred within the time period from July 2012 to September 2016. Any applicable failures for the identified equipment types were then recorded in Table 7-1 of the Data Notebook to support a Bayesian update of the generic data. For failure rates that are time-dependent, e.g., standby failure rates, it was also necessary to record the critical operating hours for Salem Unit 1 and Unit 2, which are listed in Table 7-2 of the Data Notebook for the time period from July 2012 to September 2016. Further details may be found in the PRA Data Notebook (SA-PRA-010). This process, now documented, meets the intent of the SR. LR-N18-0033 LAR S18-02 TABLE A-6 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra-Sa- Ra-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # Failure and unavailability data were obtained from the Salem Maintenance Rule and MSPI programs. The counting of component failures, such as was done for MSPI components, was consistent with industry practice. Failures were obtained from the MSPI Documentation describing the process of evaluating failure records SR reporting process and were handled appropriately DA-C5 DA-C5 DA-C5-01 other than applying MSPI data directly could not be identified. All Not Met during the revision of the Data Notebook (SA-PRA-010) failures must be reviewed for applicability to the PRA model. as part of the 2012 PRA model update. During the 2015 update, the Data notebook was updated to clarify failures occurring within a short time interval can be excluded so as not to skew the data for any one SSC modeled in the PRA. No further action required. Plant-specific reliability data for MSPI monitored components was obtained from the Salem MSPI reporting process and provided in the Appendix B tables of the Data Notebook (SA-PRA-010) in order to facilitate the Bayesian updating process during the Documentation describing the process of evaluating the number of 2012 PRA Update. This process was documented in plant specific demands for standby components could not be Section 7.2 of SA-PRA-010. A sensitivity analysis was identified. Standby components were identified in Table 1 of the performed using additional plant-specific data to Data Analysis Notebook and plant specific demands for some of address issues related to SRs DA-C1 and DA-C2. In all these components were listed in Appendix B, however the basis for SR cases, failure rates and probabilities fall into one of two DA-C6 DA-C6 DA-C6-01 this number of demands was not provided. The draft data Not Met categories, i.e., they were either a part of the plant-procedure states that plant specific data should be estimated by specific data update that used MSPI data, which actual counts of hours or demands from logs or counters, use of included plant-specific demands and run hours from the surveillance procedures to estimate the frequency of demands and MSPI Derivation reports, or they made use of generic run times, or estimates based upon input from the System data from sources such as NUREG/CR-6928. For Engineer. future updates, plant-specific data and Bayesian updating will be extended to include risk-significant components per ER-AA-600-1015. Since this is mainly a documentation issue, there is no impact on the results for this license amendment request. LR-N18-0033 LAR S18-02 TABLE A-6 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra-Sa- Ra-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # Documentation describing the process of collecting the number of Existing performance monitoring programs, such as the surveillance tests and planned maintenance activities on plant Maintenance Rule, already document testing and requirements could not be identified. In Appendix C for example maintenance unavailability information for each of the SR CCS MOVs in test and Maintenance were described. The source of more risk-significant systems modeled in the PRA. The DA-C7 DA-C7 DA-C7-01 Not Met the data was listed as Salem 3.2 PRA, however no specific testing and maintenance unavailability information used breakdown of the surveillance tests included was provided. The in the Salem PRA is a combined value, i.e., draft data procedure identifies surveillance tests as a source of represented by a single basic event. As such, there is data. no further action required. The table cited in the summary description is now labelled as Table A-1 in the Salem PRA Data Notebook (SA-PRA-010), which identifies the failure rates/probabilities to be used for various SSCs modeled in the PRA. The notes to this table help identify which components are considered either normally running or in a standby condition, and also what fraction of the time a component may be considered in either a running or standby condition, e.g., Note 25 for station air compressors. In addition, standby flags were An estimate of times that some components were configured in their employed in the SA112A PRA model to denote which standby status is identified in Table 1 and its notes, however no components are configured in a standby condition so SR Met: that the appropriate failure mode can be applied in the DA-C8 DA-C8 DA-C8-01 documentation of how these estimates were derived was provided. (CC I) fault tree logic. No operational records were provided in order to meet Capability Category II. Two significant updates to the 2010 NUREG/CR-6928 component reliability data sheets includes providing both the Fails to Start data for standby equipment and the Fails to Run <1 HR data with beta distribution. This allowed the data to be easily combined to determine the new Fails to Start failure rate for standby equipment. Therefore, there was no need to identify a specific number standby hours for equipment normally in a standby status, since the standby failure rate model is not applicable to the Salem SA115A PRA model. As such, there is no further action required. LR-N18-0033 LAR S18-02 Attachment 2 TABLE A-6 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra-Sa- Ra-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # Documentation describing the process of estimating the operational Further clarification was provided in the Salem Data time of standby components from testing was identified in draft Notebook (SA-PRA-010) during the 2012 PRA model procedure. Standby components were identified in Table 1 of the DA-C9 DA-C9 SR Not Met DA-C9-01 update (SA112A) to help better explain how estimates Data Analysis Notebook and operational times for some of these for standby time were derived. As such, there is no components were listed in the Data Analysis Notebook, however further action required. the source of the data was not provided. The use surveillance tests and their frequency was used to determine the number of demands for determining plant-specific operating experience for updating generic data that was used for risk significant components modeled in the PRA. For capability category II to be met for PRA Standard Supporting Requirement DA-D1, it requires that realistic parameter estimates be made for significant basic events based on relevant plant-specific evidence. It is the number of Documentation describing the process of reviewing test procedures surveillance tests that is a part of this exercise in to determine surveillance test data could not be identified. No determining more realistic parameter estimates. specific surveillance tests were discussed in the Data Analysis Specifically, the response to APLA-RAI-2 shows that DA-C10 DA-C10 SR Not Met DA-C10-01 the number of demands were determined based on the Notebook. The Systems Analysis Notebooks for specific systems described various surveillance testing, but did not reference number of functional tests for the component of interest surveillance tests by name. (see Table RAI-2-3), which were determined based on configuration risk management schedules in support of 10 CFR 50.65(a)(4) planning and interviews with work control personnel at the Salem plant. This information was necessary for the Bayesian updating process in which the denominator of for the generic demand failure probability is updated with this plant-specific information. Therefore, this F&O has been addressed and Supporting Requirement DA-C10 is considered to be met at Capability Category II. LR-N18-0033 LAR S18-02 Attachment 2 TABLE A-6 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra-Sa- Ra-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # Consistent with industry practice, the failure and unavailability data were obtained from the Salem Documentation describing the process of using maintenance and Maintenance Rule and MSPI programs. The testing durations to determine plant specific durations was identified Maintenance Rule data and MSPI data are traceable to DA-C11 DA-C11 SR Not Met DA-C11-01 in a draft document. No specific surveillance tests were discussed individual occurrences. Therefore, the documentation in the Data Analysis Notebook but MSPI/Maintenance Rule sources does exist and it was not necessary to repeat the were identified. information in the Data Notebook (SA-PRA-010). No further action required. As part of the enhancements made during the 2012 PRA update, the process used for counting maintenance unavailabilities was more clearly described in the Salem PRA Data Notebook (SA-PRA-010). In particular, Section 8.0 of SA-PRA-010 states that unavailability due to test and maintenance was collected from plant records. Specifically, Maintenance Documentation describing the process of how to count maintenance Rule and MSPI unavailability data was used to unavailability was not identified. Plant Specific unavailability was determine train and component unavailability for use in only documented for MSPI components which identifies the DA-C12 DA-C11a SR Not Met DA-C11a-01 the PRA. Generic industry unavailability data was only unavailability for support and frontline systems separately, however used when no other information was available. Salem it could not be determined that this was the case throughout the MRule Manager software and MSPI Derivation Reports model without a specific guidance document. for Unavailability Index were used as the primary sources of plant specific component and/or train unavailability. Because maintenance practices change over time, the best representation of the current plant practices would be seen in the most current data. This being the case, unavailability data was only collected and analyzed from March 2012 through February 2015. LR-N18-0033 LAR S18-02 Attachment 2 TABLE A-6 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra-Sa- Ra-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # Maintenance unavailabilities for shared systems between the two units is addressed in Section 8.1 of the Salem Data Notebook (SA-PRA-010). Specifically, since some of the Maintenance Rule data was for shared systems (e.g., ECAC, GTG), common critical While a table of critical hours was provided and the Maintenance hours were needed. Common critical hours (denoted Unavailability Table provided in Appendix C appears to address as C Hours) were calculated by determining the time DA-C13 DA-C12 SR Not Met DA-C12-01 these hours there was no specific documentation or guidance during which either unit was critical. With regard to document provided that discusses how maintenance was treated for outage durations, it was assumed that the C critical shared systems. hours were the greater of the two units critical hours for any months during which both plants were not critical 100% of the time (e.g., April 2012). If both units were critical for the entire month, the C hours would be the number of hours in the month. A paragraph was added to section 8.2 of the Data Notebook (SA-PRA-010) to document the treatment of concurrent unavailability for SW. Also, Note 12 was added at the bottom of Table C-1 in Appendix C of SA-PRA-010 to denote the actual unavailability values that were used. In general, for other plant systems, the plant records that were reviewed revealed that coincident unavailability amongst safety related trains Coincident unavailability for service water pumps was modeled as was non-existent, but because of the number of SW shown in Appendix C of the Data Analysis Notebook, however, no DA-C14 DA-C13 SR Not Met DA-C13-01 pumps that exist at Salem (a total of six), it would be overall guidance document could be found to ensure all systems possible that a pair of SW pumps could be were reviewed for coincident unavailability. simultaneously taken out for maintenance. However, since the time period of interest did not show any such occurrence, legacy values used in previous versions of the PRA for dual maintenance unavailabilities amongst the SW pumps were maintained. Future versions to the ASME PRA Standard allude to the fact that dual maintenance terms can be excluded if supporting data exists. SR Not DA-C15 DA-C14 SSC repair is not modeled. N/A Applicable SR Not DA-C16 DA-C15 System recovery is not modeled. N/A Applicable LR-N18-0033 LAR S18-02 TABLE A-6 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra-Sa- Ra-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # Plant specific evidence was provided for significant basic events. A SR Met: DA-D1 DA-D1 Bayesian update of generic prior was performed as shown in N/A (CC II) Appendix B of the Data Analysis Notebook. Use of Monte Carlo simulation techniques using the

                                                                                                          @RISK Excel add-in was used to derive failure Evaluation of diesel-driven compressor provides example of distributions for the diesel-driven air compressor with DA-D2    DA-D2   SR Met     DA-D2-01  evaluating plant-specific consideration using similar components.

documentation provided in Section 6.3 of the Salem See Data Analysis notebook Section 2.1.3. PRA Data Notebook (SA-PRA-010) during the 2012 PRA model update. No further action required. All parameters identified in Table A-1 of SA-PRA-010 now have a reference provided to show traceability of Observations of SA PRA-010, Table A-1. Mean values were information. Table A-1 is a listing of the generic failure provided along with error factors for most distributions. rates and probabilities that were used in the Salem SR Met: PRA model, and were obtained primarily from the 2010 DA-D3 DA-D3 DA-D3-01 Several items listed in Table A-1 do not contain any reference (CC I) update to NUREG/CR-6928. For those components information for either error factor or basic input parameters from where NUREG/CR-6928 could not be used, other which an error factor can be derived. appropriate sources were used, such as NUCLARR, NUREG/CR-2728, NUREG/CR-5500, and legacy values from earlier Salem PRA models. A paragraph was added to Section 7.2 of the Salem PRA Data Notebook (SA-PRA-010) to document the SR Met: No documentation is present that substantiates that the analysis comparison of updated results with the generic data DA-D4 DA-D4 DA-D4-01 (CC I) was performed. This is sufficient for Category I. during the Salem 2012 PRA model update. Because no abnormalities were identified, no further action is required. SR Met: Values provided for Alpha and MGL methods for significant events DA-D5 DA-D5 N/A (CC II) in the Data Analysis Notebook. LR-N18-0033 LAR S18-02 TABLE A-6 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra-Sa- Ra-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # During the Salem 2012 PRA model update, a paragraph was added to Section 6.1 of the Data Notebook (SA-PRA-010) to document a comparison of SR Met: No apparent comparison of common cause failures to plant the NUREG/CR-6928 values with other generic data DA-D6 DA-D6 DA-D6-01 (CC I) experience was provided in the Data Analysis Notebook. sources, such as NUCLARR and EPRI. No large discrepancies were identified. As such, NUREG/CR-6928 was deemed acceptable for use. No further action required. SR Not DA-D7 DA-D6a No generic data was screened. N/A Applicable SR Not DA-D8 DA-D7 No modifications are known that would impact data. N/A Applicable This URE is a suggestion that has no impact on the The analysis is documented in a manner that could facilitate quality of the PRA and was only meant to aid reviewers applications, upgrades, and PEER reviews. The notebook could be in the traceability of data sources. The current data DA-E1 DA-E1 SR Met DA-E1-01 improved by providing direct references to actual failure numbers in notebook is now traceable to ISIS (replacement for EPIX or CDE numbers in Appendix A. See suggestion. EPIX) and/or CDE. As such, there is no further action required. NUREG/CR-6928, which was used in gathering the generic data for updating the Salem Data Notebook (SA-PRA-010), provides a definition of the component A draft document was provided that documented how to establish boundaries for the modeled components of interest. No component boundaries, how to establish failure probabilities, formal procedure needs to be developed when the data DA-E2 DA-E2 SR Not Met DA-E2-01 sources of generic data, etc. This procedure needs to be source used for the SA115A PRA model already formalized. defines the component boundaries of modeled components. Because this is a documentation issue, there is no impact on the results for this license amendment request. LR-N18-0033 LAR S18-02 TABLE A-6 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS Ra-Sa- Ra-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # Assumptions are appropriately documented throughout the Data Analysis Notebook (SA-PRA-010) where appropriate in order to be consistent with the context of each section. In general, most assumptions may be found within footnotes to the data tables in order to Assumptions were noted in various sections of the Data Analysis explain the basis for derivation of the data. Additionally, Notebook. These need to be gathered into an assumptions section DA-E3 DA-E3 SR Not Met SC-C3-02 the Uncertainty Notebook (SA-PRA-018) was officially in the notebook. Sources of uncertainty were not discussed in the issued and includes a section on model uncertainty and analysis. references both EPRI 1026511, which addresses the use of PRA and the treatment of uncertainty, and EPRI 1016737, which addresses the treatment of parameter and model uncertainty. As such, there is no further action required. LR-N18-0033 LAR S18-02 TABLE A-7 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # The single-top fault tree (S1R4.CAF) integrates the model in a manner that QU-A1 QU-A1 SR Met N/A supports quantification and treatment of dependencies. QU-A2 QU-A2a SR Met Fault tree linking is used in constructing the S1R4.CAF model. N/A The parametric uncertainty analysis was performed and documented in the newly issued Salem PRA Uncertainty Notebook Parametric uncertainty is not performed on the quantification results. In addition, (SA-PRA-018). The uncertainty analysis also SR Met: QU-A3 QU-A2b QU-A2b-01 it is not clear that the same type code is used for multiple events based upon the correctly accounted for the "state-of-(CC I) same underlying data. knowledge" correlation by making the necessary adjustments to the type codes in the CAFTA database file (SA112A.rr). No further action required. The model is quantified using CAFTA software which is capable of reporting QU-A4 QU-A3 SR Met contributors to CDF by initiating event, or at the individual sequence level if N/A desired. Recovery events that have no basis or discussion of applicability were removed from the recovery model logic during the 2012 PRA model update (SA112A). The recovery Recovery events NRAC-12H, NRAC-OSP, and NREDG-4H are included in the files are discussed in the Quantification QU-A5 QU-A4 SR Met QU-A4-01 S1R4REC.CAF file, but their application is not discussed in the Accident notebook (SA-PRA-014). The offiste power Sequences and Event Tree notebook or in the AC Power System Notebook. non-recoveries are discussed in Appendix D of the Accident Sequence Notebook (SA-PRA-002). As such, there is no further action required. The CAFTA software suite and the Forte quantification engine are used in the QU-B1 QU-B1 SR Met quantification. These are standard software products which have been shown to N/A produce appropriate results in industry usage. Salem Quantification Notebook SA PRA-2008-01 Attachment E documents the QU-B2 QU-B2 SR Met N/A convergence analysis performed to set an appropriate truncation value. LR-N18-0033 LAR S18-02 TABLE A-7 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # Attachment E of the Salem Quantification Notebook (SA-PRA-014) for the SA115A PRA model documents the process used to ensure that convergence was achieved for Salem Quantification Notebook SA PRA-2008-01 Attachment E documents the quantification of CDF and LERF cutsets. convergence analysis performed to set an appropriate truncation value. The There was less than a 5% change in CDF in QU-B3 QU-B3 SR Met QU-B3-01 truncation level for both CDF and LERF was set at 1.0E-11. The percentage going from a truncation limit of 1E-11 to 1E-change between 1.0E-10 and 1.0E-11 was 2.2% for CDF, but 6.1% for LERF. 12, and less than a 5% change in LERF when Therefore, this SR was not satisfied for LERF. going from a truncation of 1E-12 to 1E-13. Therefore, the official truncation limits used were 1E-11 for CDF and 1E-12 for LERF. No further action required. Forte uses the minimal cutset upper bound quantification method to produce the QU-B4 QU-B4 SR Met N/A mean value. A new vital AC power PRA system notebook (SA-PRA-005.0020) was created during the 2012 PRA model update. Section 6.8 of this notebook contains an explanation of how circular logic loops were broken for the diesel Creation of different fault tree tops to break circular logic is discussed in the generator support dependencies, and also system notebooks; however the documentation is not sufficient to determine QU-B5 QU-B5 SR Not Met QU-B5-01 lists the affected gates with a description of whether the logic was broken at the appropriate level to ensure unnecessary the modification. The documented review of conservatisms or non-conservatisms. this PRA system notebook provides evidence that the logic was broken at the appropriate level to avoid any unnecessary conservatisms or non-conservatisms. No further action required. Complementary logic is used where needed to account for system successes in QU-B6 QU-B6 SR Met N/A transfers to the LERF model from the Level 1 model. Mutually exclusive logic is included in the linked fault tree under gate DAM-QU-B7 QU-B7a SR Met GDAM100 and combined with the core damage or LERF logic in an "A and not N/A B" gate. LR-N18-0033 LAR S18-02 Attachment 2 TABLE A-7 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # Mutually exclusive logic is included in the linked fault tree under gate DAM-QU-B8 QU-B7b SR Met GDAM100 and combined with the core damage or LERF logic in an "A and not N/A B" gate to remove mutually exclusive combinations during quantification. Flag file S1R4IFL.CAF contains the flag settings as TRUE or FALSE. The QU-B9 QU-B8 SR Met quantification process using PRAQUANT merges the flag file with the PRA N/A model prior to quantification. Split fractions such as the ones mentioned in the summary description (MFI-UNAVAILABLE and G2SW22) are listed in Table A-2 of the PRA Data Notebook (SA-PRA-010) that was revised during the 2012 PRA model update (SA112A) along with Split fractions and undeveloped events are included in the model. Examples references to document the basis of their include main Feedwater availability for ATWS (MFI-UNAVAILABLE) and some values. The split fraction for unavailability of QU-B10 QU-B9 SR Not Met QU-B9-01 Unit 2 systems credited for recovery of Unit 1 CAV failure (G2SW22). The feedwater during an ATWS event was derivation of the values for these events is not documented to allow obtained from WCAP-11992. The estimated determination that consideration has been given to the impact of shared events. value for event G2SW22, which represents insufficient flow from the opposite unit Service Water header, was obtained by quantifying a gate in the PRA model (G1CC324) that explicitly models unavailability of the 12 SW header. The dependency analysis for multiple HFEs is described in the HRA Notebook. The process included a requantification of the model with HEPs set to 0.1 to QU-C1 QU-C1 SR Met capture combinations which could be below normal truncation levels. The final N/A application of dependency correction factors is done through post-processing of the cutsets. QU-C2 QU-C2 SR Met The dependency analysis for multiple HFEs is described in the HRA Notebook. N/A QU-C3 QU-C3 SR N/A The linked event tree methodology is not used for the Salem model. N/A LR-N18-0033 LAR S18-02 TABLE A-7 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # The current system window for the RRS-XHE-FO-SDRSP action (FAILURE OF REMOTE SHUTDOWN UPON LOSS OF CAV) is 4 hours as OP-AB.CAV-0001 reports that the electrical equipment room temperature will exceed 145F in 4.2 hours if no operator action is taken. Use of a joint human error probability (HEP) floor value (1E-6 for the SGS HRA) is the current industry expectation as discussed in NUREG-1792, Good Practices for Implementing HRA. The system window length has no Section 6 of the quantification notebook SA-PRA-2008-01, Revision 4.1 includes impact on the application of the joint HEP a discussion of the top cutsets. The discussion provides good detail of the core QU-D1 QU-D1a SR Met QU-D1a-01 floor value. It is acknowledged that the time damage scenarios. Some of the cutsets appear to be conservative, which are reported for MFW-XHE-FO-COND did reflect discussed more in the F&O. that actions base case (LOFW at time zero) rather than a loss of feedwater upon depletion of the AFWST, which is more representative of the combination. The Salem Dependency Analysis for the 2012 PRA model update was completely revised using the HRA Calculator, which allows the manipulation of timing within a combination. Still, there are no joint HEPs in the Salem HRA with values less than 1E-6 due to the floor value requirement. No further action required. Section 6 of the Quantification Notebook (SA-PRA-014) for the 2015 PRA model update There is no discussion in the quantification notebook that indicates a review of discusses the top 25 cutsets that lead to core the results was performed for the purpose of assessing modeling and operational damage and also addresses the fact that a QU-D2 QU-D1b SR Not Met QU-D1b-01 consistency. Also, since the sequences were not quantified, it is difficult to cutset review was conducted with PSEG perform this verification. personnel in November 2016 to ensure modeling and operational consistency. No further action required. LR-N18-0033 LAR S18-02 TABLE A-7 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # Recovery events that were no longer There is no discussion in the quantification notebook SA-PRA-2008-01, Revision applicable were removed from the recovery 4.1 that indicates this review was completed. model logic during the 2012 PRA model update (SA112A). The use of recovery files QU-D3 QU-D1c SR Not Met QU-A4-01 Review the recovery file to ensure only those events intended to be applied are is discussed in Section 5.3 of the included. Provision of a listing of all recovery events and their intended Quantification notebook (SA-PRA-014). The application in the Quantification Notebook could facilitate this review for future offsite power non-recoveries are discussed in model revisions. Appendix D of the Accident Sequence Notebook (SA-PRA-002). N/A QU-D2 This SR was deleted in RA-Sb-2005 N/A In Tables 2-5 to 2-7 of Section 2.3 of the Initiating Events notebook (SA-PRA-001) a comparison was made to the initiating events used for other PWR PRA models, i.e., South Texas Project, Watts Bar, and Surry to show that there were no applicable event categories that would have been omitted from SR Met: This is a Capability Category I since there is no documentation to indicate that the Salem PRA model. Also, the success QU-D4 QU-D3 QU-D3-01 (CC I) the Salem results were compared to the results of a similar plant. criteria used for the Salem PRA model was benchmarked against the success criteria used for the Byron and Braidwood PRA models in Table 2-2 of the Success Criteria Notebook (SA-PRA-003). Since this is a documentation issue, there is no impact on the results for this license amendment request in extending the inverter AOT. A sampling of non-significant accident cutsets that lead to core damage near the truncation threshold of 1E-11 were inspected to determine the presence of any illogical There is no documentation indicating that a sampling of non-significant accident cutsets. This review was documented in QU-D5 QU-D4 SR Not Met QU-D4-01 cutsets or sequences were reviewed to determine they are reasonable and have Section 6 of the Quantification Notebook (SA-physical meaning. PRA-014) for the 2015 PRA model update (SA115A). The review determined that the cutsets did appear to be reasonable and had physical meaning. No further action required. LR-N18-0033 LAR S18-02 TABLE A-7 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # A description of top 25 cutsets related to CDF are discussed in Section 6 of the Quantification Notebook (SA-PRA-014), which includes those SSCs and operator actions that contribute to event frequencies This requirement was not met because the importance of components and basic and mitigation. Also, Appendix D of SA-PRA-QU-D6 QU-D5a SR Not Met QU-F2-01 events was not performed. There is no definition of significant contributors to 014 discusses the dominant CDF and LERF CDF. No documentation of an analysis for significant contributors to CDF. accident sequences, including a discussion of the type of initiating event and associated SSC failures and operator actions. Since this is a documentation issue, there is no impact on the results for this license amendment request in extending the inverter AOT. A listing of the importance measures for CDF is presented in Section 7 of the Quantification Notebook (SA-PRA-014), and an analysis of the baseline results for CDF and LERF for the SA115A PRA model are discussed in Appendix F of SA-PRA-014. Appendix H This requirement was not met because the importance of components and basic QU-D7 QU-D5b SR Not Met QU-F2-01 discusses the results for LERF as well as the events was not performed. other detailed Level 2 release categories. The review of these results showed that they make logical sense. Also, since this is a documentation issue, there is no impact on the results for this license amendment request in extending the inverter AOT. QU-E1 QU-E1 SR Not Met SC-C3-02 The uncertainty notebook was produced but is not finalized. See response for SR QU-F4. The quantification assumption is that the model been correct analyzed. So that QU-E2 QU-E2 SR Met the assumptions are in the other notebooks and will be documented in the SR for N/A those areas. QU-E3 QU-E3 SR Not Met SC-C3-02 The uncertainty notebook was produced but is not finalized. See response for SR QU-F4. QU-E4 QU-E4 SR Not Met SC-C3-02 The uncertainty notebook was produced but is not finalized. See response for SR QU-F4. QU-F1 QU-F1 SR Met This requirement is met by the Quantification Notebook. N/A LR-N18-0033 LAR S18-02 TABLE A-7 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # The following discussion addresses only those sub-parts that were considered "not met": c) the method of applying recovery events and adjustment for joint HEPs is now described in Section 5 of the Quantification This requirement was only partially met as described below: Notebook (SA-PRA-014); (f) descripton of top (a) This requirement is met by the system and HRA notebooks. 25 cutsets and dominant sequences were (b) There is a cutset review process description. discussed in the Quantification Notebook (c) There is no description of how the success systems are accounted for. (see Section 6 of SA-PRA-014); (g) Human Since a one top tree is used the software already accounts for this. A statement Error Probabilities (HEPs) that were identified stating would be satisfactory. The truncation values and how they were as being "time sensitive" are now discussed determined were documented. The method for applying recovery and how post in the HRA Notebook (SA-PRA-004); (h) initiator HFE's are applied was not described. sensitivity calculations were documented and (d) This requirement was met. discussed in the Uncertainty Notebook (SA-(e) This requirement was met. PRA-018); (i) the Uncertainty Notebook (SA-(f) This requirement was not met since the cutsets per accident sequence were PRA-018) was prepared and issued as part of not discussed. the work scope involved with the Salem 2012 (g) This requirement was not met since equipment or human actions that are the PRA Update Project (SA112A); (j) importance QU-B3-01, QU-F2 QU-F2 SR Not Met key factors in causing the accidents sequences to be non-dominant are not measures are utilized as a part of the process QU-F2-01 discussed. used to document Maintenance Rule (h) This requirement was not met since sensitivities were not documented. products per the ER-AA-310 series of (i) This requirement was not met since the uncertainty notebook was not procedures. Also, the risk poster, which is finalized. produced as part of the rollout process (Risk (j) This requirement is not met since there is no discussion of importance. Application: SA-MISC-002), will also satisfy (k) This requirement is not met because there is not list of mutually exclusive this requirement; (k) a discussion of how events and there justification. mutually exclusive events were treated was (l) This requirement is not met because there is no discussion of asymmetries in provided in Section 5 of the Quantification quantitative modeling to provide application users the necessary understanding Notebook (SA-PRA-014); (l) model regarding why such asymmetries are present in the model. asymmetries were mainly limited to the fact (m) This requirement is met since CAFTA and Forte are being used. Both of that the SA115A PRA model is a Unit 1 these pieces of software are industry standards and therefore no further testing model that relies on Unit 2 equipment for is required. certain support functions, e.g., Demineralized Water and Main Control Room ventilation, which are not developed to the full level of detail as would be required if a dual-unit PRA model was adopted. Based on the above discussion, there is no further action required. LR-N18-0033 LAR S18-02 TABLE A-7 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # SR Met: The reason this is a Capability Category I is that there is not documentation of QU-F3 QU-F3 QU-F2-01 significant contributors such as accident sequences and basic events being See response for SR QU-F2. (CC I) reviewed. Also there is no definition of significant contributors. the Uncertainty Notebook (SA-PRA-018) was officially issued and includes a section on model uncertainty and references both EPRI 1026511, which addresses the use of PRA QU-F4 QU-F4 SR Not Met SC-C3-02 The uncertainty notebook has not been approved. and the treatment of uncertainty, and EPRI 1016737, which addresses the treatment of parameter and model uncertainty. As such, there is no further action required. This requirement is met by the statement about caution when using FV values of QU-F5 QU-F5 SR Met N/A less than 0.1% and RAW values of less than 1E-04. This requirement was not met since there is no definition for significant basic QU-F6 QU-F6 SR Not Met QU-F2-01 See response for SR QU-F2. event, significant cutset, significant accident sequence. LR-N18-0033 LAR S18-02 TABLE A-8 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA-Sa- RA-Sb-2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 Category F&Os SR # SR # Salem internal flooding notebook SA-PRA-012, Revision 0 IFPP-A1 IF-A1 SR Met N/A Appendix B contains a description of the flood areas. Appendix D of the Internal Flood Walkdown Notebook contains a list of plant drawings that define the rooms Salem internal flooding notebook SA-PRA-012, Revision 0 and areas within the plant and how they form the Appendices B and D contain a description of the flood areas. scenario boundaries. Appendix I has the embedded SR Met: The flood areas were generally aligned with the fire areas as PDF drawings listed in Appendix D. It is unnecessary IFPP-A2 IF-A1a IF-A1a-01 discussed in Section B.3. Even though the documentation that to outline the flood area boundaries on a separate set (CC II/III) shows the flood areas/zones could be more descriptive, this SR of drawings when the information that was used to is considered to be met. The F&O is for improving the define the flood boundaries already exists for other documentation of the flood areas and zones. programs, e.g., Fire Hazards Analysis. Since this is a documentation issue, there is no impact on the results for this license amendment request. The buildings and areas that share equipment (e.g., Auxiliary IFPP-A3 IF-A1b SR Met and Turbine buildings) are included in the flood area N/A identifications. N/A IF-A2 This SR was deleted in RA-Sb-2005. N/A The drawings used in the identification and definition of the flood areas appear to be current. Changes to the drawings used IFPP-A4 IF-A3 SR Met N/A should be captured as part of the inputs monitoring in the model update program. Salem internal flooding notebook SA-PRA-012, Revision 0 The raw handwritten notes from the plant walkdowns Appendix A contains a summary of the walkdowns that were were scanned to PDF files (Salem PRA Events.pdf performed. The summary includes some of the important flood IFPP-A5 IF-A4 SR Not Met IF-A4-01 and Salem Water Sources.pdf) and are now features. But walkdown sheets containing the details of the included with the rest of the electronic documentation walkdowns (spatial information, mitigating equipment such as and associated files. No further action required. drains, sumps, doors, wall penetrations, etc.) were not available. LR-N18-0033 LAR S18-02 TABLE A-8 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA-Sa- RA-Sb-2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 Category F&Os SR # SR # Flood sources are documented in the summary of walkdowns in Appendix A of the Salem internal flooding notebook SA-PRA-012, Revision 0, and also in the detailed analysis of the risk IFSO-A1 IF-B1 SR Met N/A significant flood scenarios in Appendix E. Section 2.2.11 documents the assessment of in-leakage from other flood areas (e.g., back flow through drains). The assessment performed in Section 3.0 of Risk The buildings and areas that share equipment (e.g., Auxiliary Application SA-MISC-005 (Resolution of Internal and Turbine buildings) are included in the flood area Flood Peer Review Comments) showed that there IF-B1a-01, IFSO-A2 IF-B1a SR Not Met identifications. However, there was no indication in the were no new multi-unit scenarios that require IF-C4a-01 documentation that flood sources from Unit 2 can impact Unit 1 consideration due to the fact that they were either and vice versa. already postulated or were subsumed by existing scenarios. No further action required. Flooding areas were selected based on the presence of one or more potential flooding sources. Hence, plant areas not subject IFSO-A3 IF-B1b SR Met N/A to flooding were screened as described in Appendix B of the Salem internal flooding notebook SA-PRA-012, Revision 0. Three categories of flooding initiating events were evaluated for the potential flood sources identified: major floods (2000+ gpm), general floods (100 to 2000 gpm) and spray type floods (<100 gpm). The frequency calculation method used (Reference EPRI technical report TR-1013141) for these flood scenarios includes IFSO-A4 IF-B2 SR Met failure modes of components. Section 2.2.9.1.1 of SA-PRA-012, N/A Revision 0 documents the assessment of human-induced flood mechanisms. This section concludes that human induced flood mechanism have a low enough frequency that they can be subsumed with the pipe failure frequencies. Considering the basis documented, this conclusion appears to be reasonable. Three categories of flooding initiating events were evaluated for IFSO-A5 IF-B3 SR Met the potential flood sources identified: major floods (2000+ gpm), N/A general floods (100 to 2000 gpm) and spray type floods. LR-N18-0033 LAR S18-02 TABLE A-8 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA-Sa- RA-Sb-2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 Category F&Os SR # SR # Salem internal flooding notebook SA-PRA-012, Revision 0 Appendix A contains a summary of the walkdowns that were IFSO-A6 IF-B3a SR Not Met IF-A4-01 performed. The summary includes some of the important flood See response for IFPP-A5. features. But walkdown sheets containing the details of the walkdowns were not available. N/A IF-B4 Relocated to IF-C2 N/A An independent assessment was performed to investigate the merit of this peer review finding that deals with propagation pathways and the possible existence of other scenarios that were not already considered or perhaps that were subsumed by other scenarios. The independent study revealed that there Propagation paths for areas are defined for highly risk-significant IFSN-A1 IF-C1 SR Not Met IF-C1-01 were no other postulated scenarios that were not cases only. already considered, or that were more severe than those currently being modeled in the internal flood PRA. The details and results of this analysis are documented in Risk Application SA-MISC-005 (Resolution of Internal Flood Peer Review Comments). LR-N18-0033 LAR S18-02 TABLE A-8 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA-Sa- RA-Sb-2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 Category F&Os SR # SR # For those quantified scenarios, a conservative approach was initially used that considered all PRA-modeled SSCs to be damaged due to a flood originating or propagating into a particular flood area and a conditional core damage probability (CCDP) computed. This CCDP was then multiplied by the flood initiating frequency to estimate the core damage frequency (CDF). If the CDF for a given flood scenario was sufficiently low, e.g., less than about 0.1% of the nominal internal events CDF, then no further refinement was deemed necessary. However, if first estimates of the core damage frequencies for that compartment proved too pessimistic, the affected Plant design features that have the ability to terminate or contain area of the plant was analyzed in greater detail to IFSN-A2 IF-C2 SR Not Met IF-C2-01 the flood propagation are not documented for all defined flood take into account spatial effects, specific flooding flow areas. rates, operator actions, drainage pathways, etc. Hence, the justification for more detailed modeling of certain internal flood scenarios was aimed at removing some of the conservatism of the methodology, while at the same time providing a realistic basis for not assuming complete failure of all scenario-specific equipment due to a credible flooding event. The PRA model was updated in 2012 (SA112A) following the peer review to include all modeled internal flood scenarios and does not numerically screen any on a numerical basis. No further action required. In general, operator action for internal flood mitigation was only credited where needed to reduce the risk where failure of all PRA equipment was deemed too IFSN-A3 IF-C2a SR Not Met IF-C2a-01 This is only addressed for the most risk-significant areas. conservative. Also, automatic isolation and operation of sump pumps or other dewatering equipment were not credited, which was a conservative approach. No further action required. LR-N18-0033 LAR S18-02 TABLE A-8 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA-Sa- RA-Sb-2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 Category F&Os SR # SR # No discussion of required information is provided for the majority IFSN-A4 IF-C2b SR Not Met IF-C2b-01 See response for SR IFSN-A2. of areas. The documentation does not discuss spatial orientation for IFSN-A5 IF-C2c SR Not Met IF-C2c-01 See response for SR IFSN-A2. components in those areas not screened. SR Met: IFSN-A6 IF-C3 Component susceptibility to flood-induced failure is considered. N/A (CC I/II) The robustness of AOVs and MOVs with regard to spray scenarios was an informed judgment based on empirical observation. Repeated walkdowns have confirmed these observations. This observation is also reinforced by a paper presented at the PSA 2008 Appendix D of the PRA Internal Flood Evaluation states that "For ANS conference by J. Lin (Insights from the Updates spray scenarios, however, walkdown observations revealed that of Internal Flooding PRAs), which has been added as Air-Operated Valves (AOVs) and Motor-Operated Valves a reference. Water spray does not generally prevent (MOVs) were of a robust design that would exclude them from AOVs and MOVs from operating, and although it may IFSN-A7 IF-C3a SR Not Met IF-C3a-01 being susceptible to water damage. Hence, these components remotely be possible, the most likely result is that it were not automatically failed (PRA event equal to TRUE) for will not. Therefore, the basis for this assumption is quantification of the CCDP." This is not an adequate basis for deemed adequate and there is no further action determining the susceptibility of these components to flood- required. induced failure mechanisms per this SR. A sensitivity evaluation assuming that all AOVs and MOVs are conservatively damaged in the risk-significant flood area of interest shows that the changes in risk metrics are very minor and would not impact the decision for this inverter AOT. SR Met: Identification of propagation paths for each flood area is not See response for SR IFSN-A1 (F&O IF-C1-01), since IFSN-A8 IF-C3b IF-C3b-01 (CC I) present in documentation. both F&Os are related to the same issue. IFSN-A9 IF-C3c SR Met However, only for most important sequences. N/A LR-N18-0033 LAR S18-02 TABLE A-8 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA-Sa- RA-Sb-2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 Category F&Os SR # SR # In general, internal flood scenarios that were calculated using a conservative methodology that were found to contribute less than 0.1% to CDF were not subjected to any further scrutiny or refinement, since further refinement was deemed unnecessary for the purposes of the full-power internal events (FPIE) The defined flooding scenarios were screened without PRA model. It is unlikely that this particular issue development of flood rate, source, and operator actions. IFSN-A10 IF-C4 SR Not Met IF-C4-01 involving internal floods with a relatively small Detailed assessments were only provided for selected high contribution to CDF would have a measurable impact frequency floods. on the results for this license amendment request. The PRA model was updated in 2012 (SA112A) following the peer review to include all modeled internal flood scenarios and does not numerically screen any on a numerical basis. No further action required. Multi-unit scenarios were considered and analyzed, e.g., scenarios involving AB-084B found in Appendix E of the Internal Flood Summary Notebook. The IF-C4a-01, IFSN-A11 IF-C4a SR Not Met Documentation of multi-unit scenarios could not be identified. assessment in Section 3.0 of Risk Application SA-IF-B1a-01 MISC-005 (Resolution of Internal Flood Peer Review Comments) did not identify any new potential multi-unit scenarios. No further action required. IFSN-A12 IF-C5 SR N/A No flood areas were screened out. N/A IFSN-A13 IF-C5a SR N/A No flood areas were screened out. N/A IFSN-A14 IF-C6 SR N/A No floods were screened out based on human mitigative actions. N/A Screening was not performed based on the criteria defined in IFSN-A15 IF-C7 SR N/A N/A this requirement. No flood sources were screened out based on human mitigative IFSN-A16 IF-C8 SR N/A N/A actions. LR-N18-0033 LAR S18-02 TABLE A-8 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA-Sa- RA-Sb-2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 Category F&Os SR # SR # Walkdowns were performed. However, walkdown sheets with IFSN-A17 IF-C9 SR Met IF-A4-01 See response for SR IFPP-A5. the required information were not available for review. This requirement has been met by Appendices C & D of the IFEV-A1 IF-D1 SR Met N/A Flood Analysis Notebook. N/A IF-D2 This SR was deleted in RA-Sb-2005. N/A IFEV-A2 IF-D3 SR Not Met IF-C4-01 This is an extension of F&O IF-C4-01. See response for SR IFSN-A10. There was no grouping or subsuming of flood initiating scenarios IFEV-A3 IF-D3a SR N/A N/A with other plant initiating event group. There is no evidence that flooding in Unit 2 was considered for IFEV-A4 IF-D4 SR Not Met IF-C4a-01 See response for SR IFSN-A11. its effects on Unit 1. IFEV-A5 IF-D5 SR Met This requirement is met in Appendix D of the Flooding Notebook. N/A SR Met: IFEV-A6 IF-D5a This requirement is met in Appendix D of the Flooding Notebook. N/A (CC II/III) SR Met: Human-induced floods during maintenance were considered in IFEV-A7 IF-D6 N/A (CC I/II) Section 2.2.9.1.1 of the Internal Flood Evaluation. IFEV-A8 IF-D7 SR N/A Flood scenarios were not screened out using these criteria. N/A The CCDPs for each of the scenarios were calculated by setting all initiating events in the PRA model to zero, with either the IFQU-A1 IF-E1 SR Met turbine trip event with PCS available (%TT) or PCS unavailable N/A (%TP) set to a value of 1.0, depending on the nature of the components failed. N/A IF-E2 Moved to IF-C3c N/A LR-N18-0033 LAR S18-02 TABLE A-8 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA-Sa- RA-Sb-2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 Category F&Os SR # SR # All of the components modeled in the PRA that were assigned to the various scenario IDs based on their location in the plant and their susceptibility to water damage from the various modes of IFQU-A2 IF-E3 SR Met flooding, i.e., spray, general flooding, and major flooding. These N/A components were utilized in flag files to set the appropriate basic events to TRUE, representing failure due to water damage, for the quantification of CCDPs for the analyzed scenarios. SR Met: Areas were screened if the product of the sum of the frequencies IFQU-A3 IF-E3a of the flood scenarios for the area and the bounding CCDP were N/A (CC II/III) less than 1E-9/reactor year. No additional analysis of SSC data was performed to support IFQU-A4 IF-E4 SR N/A N/A quantification of flood scenarios IFQU-A5 IF-E5 SR Met Scenario-specific impacts on PSFs are included. N/A IFQU-A6 IF-E5a SR Met Scenario-specific impacts on PSFs are included. N/A Internal flood sequences are quantified in accordance with the IFQU-A7 IF-E6 SR Met N/A QU SRs. The combined effects of failures caused by flooding and due to IFQU-A8 IF-E6a SR Met N/A causes independent of the flooding are included. IFQU-A9 IF-E6b SR Met Both direct and indirect effects are included in the quantification. N/A Flood sequences are represented appropriately in the LERF IFQU-A10 IF-E7 SR Met N/A analysis. Walkdown documentation does not capture this information for IFQU-A11 IF-E8 SR Not Met IF-A4-01 See response for SR IFPP-A5. all flood areas. LR-N18-0033 LAR S18-02 TABLE A-8 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD RA-Sa- RA-Sb-2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION 2009 Category F&Os SR # SR # IFPP-B1, IFSO-B1, The internal flooding analysis documentation can support PRA IFSN-B1, IF-F1 SR Met N/A applications, upgrades, and peer review. IFEV-B1, IFQU-B1 IFPP-B2, The Internal Flood documentation (SA-PRA-012) was IFSO-B2, revised to include missing information and provide See all IF Some documentation elements are missing, as noted in the clarification where necessary during the Salem 2012 IFSN-B2, IF-F2 SR Not Met F&Os Internal Flood F&Os. PRA model update. Since this is a documentation IFEV-B2, issue, there is no impact on the results for this license amendment request. IFQU-B2 IFPP-B3, IFSO-B3, Sources of modeling uncertainty (systemic) Assumptions are documented in the Flooding Notebook. associated with internal flooding is now addressed in IFSN-B3, IF-F3 SR Not Met IF-F3-01 Parametric uncertainty analysis was done but systemic the Salem PRA Uncertainty Notebook (SA-PRA-018), uncertainty is not addressed. which was created during the Salem 2012 PRA model IFEV-B3, update. No further action required. IFQU-B3 LR-N18-0033 LAR S18-02 Attachment 2 TABLE A-9 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR CONFIGURATION CONTROL RA-Sa- RA-Sb-2009 2005 Capability Associated

SUMMARY

OF ASSESSMENT

SUMMARY

OF RESOLUTION Category F&Os SR # SR # Salem specific site procedures should be developed for Maintenance The Salem Generating Station has since developed site-of site specific PRAs. Develop Salem specific site procedures. specific procedures for maintenance and use of PRA MU-A1 MU-A1 SR Met MU-A1-01 models. They are officially controlled and accessed via DCRMS. No further action is required. This requirement is met in Section 4.1.2 of procedure ER-AA-600- N/A MU-A2 MU-A2 SR Met 1015, "FPIE PRA Model Update," Revision 6. This requirement is met in Sections 4.1.3 and 4.2.2 of procedure ER- N/A AA-600-1015, "FPIE PRA Model Update," Revision 6. Section 4.1.3 MU-B1 MU-B1 SR Met addresses how Updating Requirements (URE) puts are processed. Section 4.2.2 addresses review of UREs not dispositional into the next model update. This requirement is met in Sections 4.1.3, and 4.2.1 of procedure N/A ER-AA-600-1015, "FPIE PRA Model Update," Revision 6. This MU-B2 MU-B2 SR Met requirement is met for periodic updates in the project planning phase in Section 4.2.1 of the subject procedure and Section 4.1.3 for unscheduled updates. Since the other Supporting Requirements are met this SR is met by N/A MU-B3 MU-B3 SR Met default. There is no reference to the requirement for a PRA peer review for Step 4.5.5.3.A of ER-AA-600-1015 addresses this upgrades. concern regarding PRA upgrades and the possibility for MU-B4 MU-B4 SR Not Met MU-B4-01 needing a limited peer review against the ASME PRA Standard. There is no reference to a review of the cumulative impact of Step 4.3.1 of ER-AA-600-1015 addresses this concern MU-C1 MU-C1 SR Not Met MU-C1-01 pending changes. regarding cumulative impact of pending PRA model changes. No further action is required. This requirement is met in Section 4.2.7 of procedure ER-AA-600- N/A MU-D1 MU-D1 SR Met 1015, "FPIE PRA Model Update," Revision 6. This requirement is met in Sections 4.1 and 4.2 of procedure ER-AA- N/A MU-E1 MU-E1 SR Met 600-1014, "Risk Management Configuration Control," Revision 5. All items are met except for item (f), the review of the cumulative N/A MU-F1 MU-F1 SR Met impact of pending changes. See F & O MU-C1-01. LR-N18-0033 LAR S18-02 TABLE A-10 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR LERF RA-Sa- RA-Sb-2009 2005 Capability Associated F&Os Summary of Assessment Summary of Resolution Category SR # SR # Level 2 Analysis notebook, SA-PRA-015, Section 2 addresses those LE-A1 LE-A1 SR Met physical characteristics at the time of core damage that can influence N/A LERF. Level 2 Analysis notebook, SA-PRA-015, Appendix A addresses LE-A2 LE-A2 SR Met accident sequence characteristics at the time of core damage that N/A can influence LERF. Level 2 Analysis notebook, SA-PRA-015, Appendix A addresses LE-A3 LE-A3 SR Met those adjustments needed between the Level 1 event trees and the N/A containment event trees. Level 2 Analysis notebook, SA-PRA-015, Appendix A addresses LE-A4 LE-A4 SR Met those adjustments needed between the Level 1 event trees and the N/A containment event trees. Level 2 Analysis notebook, SA-PRA-015, Appendix A defines the LE-A5 LE-A5 SR Met N/A plant damage state groupings in Section 3. Level 2 Analysis notebook, SA-PRA-015, Sections 1 and 2 discuss SR Met: unique plant issues and LERF contributors. The issues identified in LE-B1 LE-B1 N/A (CC II) Table 4.5.9-3 are addressed with the exception of in-vessel recovery which is not credited. LR-N18-0033 LAR S18-02 TABLE A-10 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR LERF RA-Sa- RA-Sb-2009 2005 Capability Associated F&Os Summary of Assessment Summary of Resolution Category SR # SR # Category II for LE-B2 says "using applicable generic or plant-specific analyses for significant containment challenges," while conservative analyses can be used for non-significant challenges. Conservative analyses were not used for significant challenges, though they were used for initial categorization. MAAP analyses and plant-specific analyses were used to support the final LERF contributors. Use of plant-specific parameters, such as containment fragility, are SR Met: Analysis does address challenges, but plant-specific analyses are documented in the Level 2 Analysis Notebook LE-B2 LE-B2 LE-B2-01 (CC I) treated in a conservative manner. (SA-PRA-015). Section 2.0 of SA-PRA-015 states that in order to assess the accident progression following a core damage event, the Level 2 analysis used a containment event tree shown in Figure 2-1 of SA-PRA-015 to determine the type of release, if any. Each node in the event tree is based on plant-specific Salem parameters, recent accident progression research, and other Salem-specific analyses. Where applicable, the documentation was updated to emphasize realistic, plant-specific analyses. SR Met: MAAP analyses using plant-specific inputs performed, but utilized in LE-B3 LE-B3 N/A (CC II) a somewhat conservative manner. LR-N18-0033 LAR S18-02 TABLE A-10 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR LERF RA-Sa- RA-Sb-2009 2005 Capability Associated F&Os Summary of Assessment Summary of Resolution Category SR # SR # A discussion of LERF and its definition were added to the Level 2 Notebook (SA-PRA-015) in order to explain how LERF and non-LERF designations were developed and assigned. Specifically, Section 5.0 of this notebook defines the major release categories that were evaluated: INTACT - Containment structure and function succeed and prevent a large or late release of fission products. LATE - Containment failure occurs, but is SR Met: considered late because of a significant time Analysis of non-LERF or analysis of factors contributing to non-LERF LE-C1 LE-C1 LE-C1-01 delay between core damage and containment (CC I) was not addressed. failure. LERF - Containment failure occurs early in the scenario. Early releases are defined as those releases that occur within a short time following core damage, such that adequate evacuation time is not available to protect the public from prompt health effects. SERF - Containment is bypassed, such as due to an initiating steam generator tube rupture, but successful filling of the steam generator scrubs the release to reduce it to a small magnitude. LR-N18-0033 LAR S18-02 TABLE A-10 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR LERF RA-Sa- RA-Sb-2009 2005 Capability Associated F&Os Summary of Assessment Summary of Resolution Category SR # SR # Of the human error probabilities (HEPs) that were associated with containment isolation actions, only SJS-XHE-FO-MANAC (Operator fails to open or close valves per EOPs) was found to exceed the criteria for risk significance, and the failure probability was evaluated in detail (not a screening value) in the SA115A PRA model. There were only two SR Met: Screening values appear to have been used for containment isolation HEPs that were found to be risk-significant in LE-C2 LE-C2a LE-C2a-01 actions. No operator actions are directly called out in the (CC I) the SA115A model, i.e., time-critical operator containment event tree. actions. They were AFS-XHE-FO-REC1 (Operator failure to close AFW discharge valves locally) and ISL-XHE-VD1 (Operator fails to isolate RHR to avoid ISLOCA). These HEPs are both documented in Appendix F of the HRA Notebook (SA-PRA-004) and will require a detailed evaluation as part of a future scheduled PRA update. The Quantification Notebook (SA-PRA-014) discussed some of the dominant initiators that lead to LERF in Appendix H where pre-emptive actions could be taken to reduce the SR Met: Repair of failed equipment is not addressed in the Level 2 Analysis impact to LERF, e.g., installation of door LE-C3 LE-C2b LE-C2b-01 (CC I) notebook, SA-PRA-015. sweeps to reduce the flow of water into the 230/460 VAC switchgear rooms due to internal floods, but no repair of failed equipment was directly credited or modeled in the SA115A model for mitigation of LERF sequences. LR-N18-0033 LAR S18-02 TABLE A-10 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR LERF RA-Sa- RA-Sb-2009 2005 Capability Associated F&Os Summary of Assessment Summary of Resolution Category SR # SR # Since the time of the peer review, potential scrubbing of SGTR releases was added to the PRA model. In addition, text was added to the Level 2 Analysis Notebook (SA-PRA-015) to describe mitigating actions and beneficial SR Met: failures that are modeled. Even without Fission product scrubbing and mitigating actions by plant staff are not LE-C4 LE-C3 LE-C3-01 operator action, some scrubbing does occur in (CC I) addressed. the thermal-hydraulic modeling of SGTRs, if applicable, such as in release category LERF-SGTR-AFW, which represents sequences caused by a steam generator tube rupture that have successful operation of auxiliary feedwater. SR Met: LE-C5 LE-C4 Realistic generic success criteria appear to have been used. N/A (CC II) LE-C6 LE-C5 SR Met N/A LE-C7 LE-C6 SR Met N/A LE-C8 LE-C7 SR Met One top model. N/A Since there was no credit given in the SA115A PRA model for equipment survivability or LE-C9 LE-C8a SR Not Met LE-C8a-01 No discussion provided in the documentation related to environment. human actions under adverse environments, there was no need to justify any type of credit. SR Met: LE-C10 LE-C8b LE-C8a-01 No analysis provided. N/A (CC I) SR Met: LE-C11 LE-C9a LE-C8a-01 No credit taken. N/A (CC I) LR-N18-0033 LAR S18-02 TABLE A-10 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR LERF RA-Sa- RA-Sb-2009 2005 Capability Associated F&Os Summary of Assessment Summary of Resolution Category SR # SR # SR Met: LE-C12 LE-C9b LE-C8a-01 N/A (CC I) SR Met: Section 2 notes that credit is not taken for scrubbing of SGTR LE-C13 LE-C10 LE-C3-01 N/A (CC I) damage scenarios. The Cat II SR requires "a realistic containment capacity analysis for the significant containment challenges" and "a conservative or a combination of conservative and realistic evaluation of containment capacity for nonsignificant containment challenges." In the Salem Level 2 analysis, early containment failure is not a significant contributor, therefore conservative or a combination of realistic and SR Met: conservative evaluations are acceptable. The LE-D1 LE-D1a LE-D1a-01 Early containment loads are addressed using NUREG information. early containment failure probabilities from the (CC I) NUREGs are based on plant-specific analysis or generic analysis that is adjusted to be applicable to Salem. Also, a Salem-specific containment structural evaluation and failure characterization that had been performed for a previous revision of the PRA was used in the SA115A Level 2 analysis due still being applicable. Therefore, no further work is necessary to comply with Category II of LE-D1. Section 2.2 of the Success Criteria Notebook (SA-PRA-003) now references the evaluation LE-D2 LE-D1b SR Not Met LE-D1b-01 No analysis for penetrations, hatches, seals of penetrations, hatches and seals for containment. SR Not LE-D3 LE-D2 N/A Applicable LR-N18-0033 LAR S18-02 TABLE A-10 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR LERF RA-Sa- RA-Sb-2009 2005 Capability Associated F&Os Summary of Assessment Summary of Resolution Category SR # SR # SR Met: LE-D4 LE-D3 N/A (CC II) SR Met: LE-D5 LE-D4 N/A (CC II) SR Met: LE-D6 LE-D5 N/A (CC II) The Containment Isolation System Notebook (SA-PRA-005.0007) now provides a set of criteria to determine whether containment penetrations should be modeled for their safety significance in the PRA, such as size of line, number of valve isolations, etc. The Success Criteria Notebook (SA-PRA-003) in Section 2.2 states that containment The CI model (SA-PRA-005.07) does not provide sufficient penetrations, hatches and seals were also LE-D7 LE-D6 SR Not Met LE-D6-01 information and does not address potential failures due to air locks or evaluated and found to have a higher pressure other locations. capacity than the meridional membrane capacity of the dome that proved to be the limiting failure location. The basis for this statement may be found in PSEG document S-C.ZZ-NEE-0686 (Probabilistic Engineering Evaluation of Salem Units 1 and 2 Containment Performance for Beyond Design Basis Conditions). LE-E1 LE-E1 SR Met Appropriate SSC and HFE values are utilized. N/A SR Met: See the F&O response for the 2009 SR LE-LE-E2 LE-E2 LE-D1a-01 The LERF analysis makes heavy use of the NUREG documents. D1, since both F&Os are related to the same (CC I) issue. LR-N18-0033 LAR S18-02 TABLE A-10 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR LERF RA-Sa- RA-Sb-2009 2005 Capability Associated F&Os Summary of Assessment Summary of Resolution Category SR # SR # The Level 2 Analysis Notebook (SA-PRA-015) explains in detail those accident sequences that satisfy the definition for LERF, and are SR Met: listed in Table 7-1, which defines the type of Early containment failures, bypass sequences, and isolation failures LE-E3 LE-E3 LE-D1a-01 accident sequence and initiating event that is (CC I) are designated as LERF contributors. involved. To satisfy this F&O, more detail was given in this section of SA-PRA-015 that better explains what accident progression sequences can lead to LERF. LERF is quantified consistent with the applicable requirements. A LE-E4 LE-E4 SR Met QU-B3-01 N/A minor issue related to truncation limit is identified in QU-B3-01. SR Met: Table 8-2 of the Salem PRA Level 2 Analysis Notebook shows the LE-F1 LE-F1a N/A (CC II/III) calculated results for the detailed release categories. A summary of the Level 2 results is provided in Appendix H of the Quantification Notebook (SA-PRA-014). The comparison to the value for CDF was discussed, in which it was noted that the direct sum of the four major Level 2 Other than verifying that the sum of the three end states (INTACT, endstates (INTACT, LERF, SERF, and LATE), LATE and LERF) is approximately equal to the core damage which was 9.5E-06/yr, is a little more than the LE-F2 LE-F1b SR Not Met LE-F1b-01 frequency, no checks on the reasonableness of the LERF calculation of CDF at 8.4E-6/yr for the SA115A contributors is documented. PRA model. This is due to summation of low probability sequences below the truncation threshold used for the quantification of CDF and the inclusion of non-minimal Level 1 sequences in the summation of the Level 2 release categories. Bounding assumptions are identified in the documentation. Sources SR Met: of uncertainty are addressed in a draft evaluation using guidance See the F&O response for the 2009 SR LE-N/A LE-F2 SC-C3-02 from draft EPRI report, "Treatment of Parameter and Model G4, since both F&Os are related to the same (CC I) Uncertainty for Probabilistic Risk Assessments." No documentation issue. of sensitivity studies was found. LR-N18-0033 LAR S18-02 TABLE A-10 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR LERF RA-Sa- RA-Sb-2009 2005 Capability Associated F&Os Summary of Assessment Summary of Resolution Category SR # SR # The uncertainty associated with LERF was LERF uncertainties are not characterized consistent with the addressed in the Salem PRA Uncertainty LE-F3 LE-F3 SR Not Met LE-F3-01 requirements in Tables 4.5.8-2(d) and 4.5.8-2(e). Notebook (SA-PRA-018), with the results being presented in Section 5.1.2.1. The LERF analysis documentation appears to be adequate for LE-G1 LE-G1 SR Met N/A supporting PRA applications, upgrades, and peer review. The LERF notebook documents the process used to arrive at the LE-G2 LE-G2 SR Met N/A LERF estimates. SR Met: Table 8-2 of the Salem PRA Level 2 Analysis Notebook shows the LE-G3 LE-G3 N/A (CC II/III) calculated results for the detailed release categories. This issue has no impact on the quality of the PRA and is only meant to aid reviewers in identifying what assumptions were made during development of the Success Criteria Notebook (SA-PRA-003). Each PRA System Assumptions are embedded in the documentation rather than Notebook (SA-PRA-005.####) now has a SC-C3-01, captured in a specific section. Sources of uncertainty are addressed section that lists assumptions that were made LE-G4 LE-G4 SR Not Met in a draft evaluation using guidance from draft EPRI report, as part of the systems analysis. Also, the SC-C3-02 "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Uncertainty Notebook (SA-PRA-018) was Assessments." No documentation of sensitivity studies was found. officially issued and includes a section on model uncertainty and references both EPRI 1026511, which addresses the use of PRA and the treatment of uncertainty, and EPRI 1016737, which addresses the treatment of parameter and model uncertainty. LR-N18-0033 LAR S18-02 TABLE A-10 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR LERF RA-Sa- RA-Sb-2009 2005 Capability Associated F&Os Summary of Assessment Summary of Resolution Category SR # SR # Appendix A of the Uncertainty Notebook (SA-PRA-018) discusses model uncertainty issues and plant-specific issue characterizations that can be extended to identification of impacts on various risk applications. For example, the treatment of core melt arrest in-vessel has been limited. However, recent NRC work has indicated that there may be more potential than previously credited. For this particular Limitations in the LERF analysis that would impact applications are issue, Salem has taken the approach that no LE-G5 LE-G5 SR Not Met LE-G5-01 not documented. credit will be given for recovery of core cooling following core damage and prior to reactor vessel failures. In other words, all core damage sequences proceed to vessel failure. Although this issue could provide an impact to certain applications related to Level 2 release categories, this particular LAR dealing with extending the Technical Specification AOT for unavailability is relatively unimportant with regard to LERF. LR-N18-0033 LAR S18-02 TABLE A-10 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR LERF RA-Sa- RA-Sb-2009 2005 Capability Associated F&Os Summary of Assessment Summary of Resolution Category SR # SR # A significant accident progression sequence is one of the set of accident sequences contributing to large early release frequency resulting from the analysis of a specific hazard group that, when rank-ordered by decreasing frequency, sum to a specified percentage of the large early release frequency, or that individually contribute more than a specified percentage of large early release frequency for A definition for significant accident progression sequence is not that hazard group. Specifically, the summed LE-G6 LE-G6 SR Not Met LE-G6-01 documented. percentage is 95% and the individual percentage is 1% of the applicable hazard group. The dominant accident sequences that contribute to LERF are listed and described in Section D of the Quantification Notebook (SA-PRA-014), and the relative contribution to LERF for each of the modeled initiating events is listed in Appendix F of SA-PRA-014. Since this is a documentation issue, it has no impact on the results for this LAR. LR-N18-0033 LAR S18-02 TABLE A-11 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF REVISED SUPPORTING REQUIREMENTS RA-Sa-2009 RA-Sb-2005 DESCRIPTION OF CHANGE COMMENTS SR # SR # The SA112A PRA Model of Record (MOR) makes use of dual Service Water pump maintenance terms based on previous maintenance activities, which Coincident unavailability due to maintenance for redundant may not have been considered as being routine or repetitive evolutions. As equipment is now being based on the activity being the result such, the more recent version of this Supporting Requirement implies that of a planned, repetitive activity that is based on plant these maintenance terms can be removed from the PRA model if the DA-C14 DA-C13 experience. This implies that maintenance terms used in the maintenance activity is not considered a planned and repetitive activity. The PRA model that represent multiple SSCs being unavailable net effect is that this may result in a slight decrease in CDF and LERF if the should not be used unless the activity is a routine planned SW pump dual maintenance terms are removed from the PRA model. An evolution. Updating Requirement Evaluation (URE) record has been recorded (SA2016-005) to capture this as part of the maintenance and update of the Salem PRA model. This has no impact on the Salem PRA MOR as the resolution of circular logic The newer version of the Supporting Requirement (SR) states was more clearly documented during the 2012 PRA model update in the that when resolving circular logic to NOT introduce any PRA System Notebook for vital AC power (SA-PRA-005.0020). A review of QU-B5 QU-B5 unnecessary conservatisms or non-conservatisms, whereas this document in Section 6.8 provides evidence that unnecessary the previous version of the Standard used the work AVOID. conservatisms or non-conservatisms were NOT introduced as a result of resolving circular logic issues. During the 2012 PRA model update, the Uncertainty Notebook (SA-PRA-The newer version of this Supporting Requirement redefines 018) was officially issued and includes a comprehensive treatment on model the treatment of model uncertainty and related assumptions uncertainty and assumptions for both CDF and LERF, using references that with the intent of IDENTIFYING how the PRA model is include EPRI 1026511, which addresses the use of PRA and the treatment QU-E4 QU-E4 affected, whereas the older version was focused more on an of uncertainty, and EPRI 1016737, which addresses the treatment of EVALUATION of sensitivity studies as it related to model parameter and model uncertainty. As such, the PRA model documentation uncertainty and assumptions. is in compliance with the 2009 version of the ASME PRA Standard with regard to this Supporting Requirement. The newer version of this SR redefines the treatment of model uncertainty and related assumptions by referring to QU-E4, whereas the earlier requirement referenced an QU-F4 QU-F4 example listing of "key assumptions" and "key sources of See response for SR QU-E4. uncertainty," such as success criteria, reliability data, modeling uncertainties, completeness of initiating events, spatical dependencies, etc. The change for this SR involves the same change involving LE-F3 LE-F3 the treatment of uncertainty and assumptions as for CDF, See response for SR QU-E4. except that the focus is on LERF. LR-N18-0033 LAR S18-02 TABLE A-12 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF REGULATORY POSITION CHANGES FROM REG GUIDE 1.200 REV 1 TO REV 2 (APPENDIX A) RA-Sa-2009 SR # RA-Sb-2005 SR # DESCRIPTION OF RG 1.200, REV. 2, COMMENTS (RG 1.200 Rev 2) (RG 1.200 Rev 1) REGULATORY POSITION (CAT II) The search for initiators should go down to the subsystem/train level. Capability Category III should consider the use of other systematic processes. IE-A5 IE-A4 No change from RG 1.200 Rev 1 to Rev 2. Cat I and II: PERFORM a systematic evaluation of each system and where necessary down to the subsystem or train level, including support systems. Initiating events from common cause or from both routine and non-routine system alignments should be considered. Change from and to or in RG 1.200 Rev 2 does not IE-A6 IE-A4a Cat II: change underlying purpose already addressed by Rev 1. resulting from multiple failures, if the equipment failures result from a common cause, and or from routine system alignments resulting from preventive and corrective maintenance. Providing a list of generic data sources would be consistent with other SRs related to data. Change to a different NUREG as an example does not IE-C12 IE-C10 COMPARE results and EXPLAIN differences in the initiating event analysis change the evaluation already addressed by Rev 1. with generic data sources to provide a reasonable check of the results. An example of an acceptable generic data sources is NUREG/CR-6928 [Note (1)]. LR-N18-0033 LAR S18-02 TABLE A-12 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF REGULATORY POSITION CHANGES FROM REG GUIDE 1.200 REV 1 TO REV 2 (APPENDIX A) RA-Sa-2009 SR # RA-Sb-2005 SR # DESCRIPTION OF RG 1.200, REV. 2, COMMENTS (RG 1.200 Rev 2) (RG 1.200 Rev 1) REGULATORY POSITION (CAT II) The first example makes an assumption that the hourly failure rate is applicable for all operating conditions. Thus, Footnote (1)(a) to Footnote 3 to fbus at power = 1x10-7/hr

• 8760 hrs/yr
• 0.90 = 7.9x10-4/reactor year. No change from RG 1.200 Rev 1 to Rev 2.

Table 2-2.1-4(c) Table 4.5.1-2(c) In the above example, it is assumed the bus failure rate is applicable for at-power conditions. It should be noted that initiating event frequencies may be variable from one operating state to another due to various factors. In such cases, the contribution from events occurring only during at-power conditions should be utilized. The HLR and associated SRs are written for CDF and not LERF; therefore, references to LERF are not appropriate. 2-2.2.1 4.5.2.1 No change from RG 1.200 Rev 1 to Rev 2. 2-2.2.1 Objectives. The objectives reflected in the assessment of CDF and LERF is such a way that. The code requirements for acceptability need to be stated. AS-A9 AS-A9 No change from RG 1.200 Rev 1 to Rev 2. Cat II and III: affect the operability of the mitigating systems. (See SC-B4.) The HLR and associated SRs are written for CDF and not LERF; therefore, references to LERF are not appropriate. 2-2.3.1 4.5.3.1 No change from RG 1.200 Rev 1 to Rev 2. (a) overall success criteria are defined (i.e., core damage and large early release) LR-N18-0033 LAR S18-02 TABLE A-12 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF REGULATORY POSITION CHANGES FROM REG GUIDE 1.200 REV 1 TO REV 2 (APPENDIX A) RA-Sa-2009 SR # RA-Sb-2005 SR # DESCRIPTION OF RG 1.200, REV. 2, COMMENTS (RG 1.200 Rev 2) (RG 1.200 Rev 1) REGULATORY POSITION (CAT II) There are no commonly used analysis methods for recovery in the sense of repair, other than use of actuarial data. No change from RG 1.200 Rev 1 to Rev 2 (other than SY-A24 SY-A22 changing the numbering to DA-C15 and D9 from DA-C14 is justified through an adequate analysis or examination of data and D8 collected in accordance with DA-C15 and estimated in accordance with DA-D9. (See DA-C15.) Containment vent and failure can cause more than NPSH problems (e.g., harsh environments). Added detail about failure of the containment venting ducts, or failure of the containment boundary to the example does not significantly change the Salem SY-B14 SY-B15 Examples of degraded environments include: response. See resolution in Table 3-4: All PRA System notebooks were revised to add generic assumptions on (h) harsh environments induced by containment venting, failure of the components not performing beyond their design operating containment venting ducts, or failure of the containment boundary conditions unless otherwise specified. that may occur prior to the onset of core damage Add examples for what is meant by quality in items (a) and (b) of Cat II, III. Cat II, III: (a) the quality (e.g., format, logical structure, ease of use, clarity, and comprehensiveness) of written procedures (for performing tasks) and the type of administrative controls that support independent review (e.g., configuration control process, technical review process, training This change from Rev 1 to Rev 2 is only meant to processes, and management emphasis on adherence to procedures). properly document the reference to Note 3. There is no HR-D3 HR-D3 of administrative controls (for independent review) impact on the conformance of the SA115A PRA model to RG 1.200, Rev. 2. (b) the quality of the human-machine interface (e.g., adherence to human factors guidelines [Note (3)] and results of any quantitative evaluations of performance per functional requirements), including both the equipment configuration, and instrumentation and control layout (3) NUREG-0700, Rev. 2, Human-System Interface Design Review Guidelines; J.M. OHara, W.S. Brown, P.M. Lewis, and J.J. Persensky, May 2002. LR-N18-0033 LAR S18-02 TABLE A-12 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF REGULATORY POSITION CHANGES FROM REG GUIDE 1.200 REV 1 TO REV 2 (APPENDIX A) RA-Sa-2009 SR # RA-Sb-2005 SR # DESCRIPTION OF RG 1.200, REV. 2, COMMENTS (RG 1.200 Rev 2) (RG 1.200 Rev 1) REGULATORY POSITION (CAT II) This SR should be written similarly to HR-G9 New clarification. The SA115A PRA model does report HEP values based on their mean point estimates as HR-D6 HR-D6 PROVIDE an assessment of the uncertainty in the . point estimates of provided by the HRA Calculator software. As such, there HEPs. CHARACTERIZE the uncertainty in the estimates of the HEPs is no impact on the conformance of the SA115A PRA consistent with the quantification approach, and PROVIDE mean model to RG 1.200, Rev. 2. values for use in the quantification of the PRA results. In item (d) of CC II, III, clarify that clarity refers the meaning of the cues, etc. In item (a) of CC I and item (g) of CC II, III, clarify that complexity refers to both determining the need for and executing the required response. Rev 2 separates Cat I from Cat II/III, and adds more detail to item (d) for Cat II. This added detail already exists in item (g) of Rev 1. The use of the HRA Calculator HR-G3 HR-G3 Cat II, and III: supports this level of detail in the Salem HRA, as was documented in the review against Rev 1, so there is no (d) degree of clarity of the cues/indications in supporting the detection, impact on the conformance of the SA115A PRA model to diagnosis, and decision-making give the plant-specific and scenario- Rev 2. specific context of the event. (g) complexity of detection, diagnosis and decision-making, and executing the required response. Requirements concerning the use of thermal/hydraulic codes should be cross-referenced. HR-G4 HR-G4 No change from RG 1.200 Rev 1 to Rev 2. Cat I, II, and III: BASE. (See SC-B4.) SPECIFY the point in time. Action verb should be capitalized HR-G8 HR-G9 This is a typographical correction only. CHARACTERIZE Characterize the uncertainty .. LR-N18-0033 LAR S18-02 TABLE A-12 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF REGULATORY POSITION CHANGES FROM REG GUIDE 1.200 REV 1 TO REV 2 (APPENDIX A) RA-Sa-2009 SR # RA-Sb-2005 SR # DESCRIPTION OF RG 1.200, REV. 2, COMMENTS (RG 1.200 Rev 2) (RG 1.200 Rev 1) REGULATORY POSITION (CAT II) This SR provides a justification for crediting equipment repair (SYA24). As written, it could be interpreted as allowing plant-specific data to be discounted in favor of industry data. In reality, for such components as pumps, plant-specific data is likely to be insufficient and a broader base is This Supporting Requirement (SR) is not applicable for DA-C15 DA-C14 necessary. the Salem PRA model since no credit is being taken for repair of equipment following initial failure. IDENTIFY instances of plant-specific experience or and, when that is insufficient to estimate failure to repair consistent with DA-D9, applicable industry experience and for each repair, COLLECT. Other approved statistical processes for combining plant-specific and generic data are not available. DA-D1 DA-D1 CC II and III: No change from RG 1.200 Rev 1 to Rev 2. USE a Bayes update process or equivalent statistical process that assigns that assigns appropriate weight to the statistical significance of the generic and plant specific evidence and provides an appropriate characterization of the uncertainty. CHOOSE. New requirement needed, DA-C15 was incomplete, only provided for data collection, not quantification of repair. (See SY-A24.) DA-D9 N/A Cat I, II, and III: See response for SR DA-C15. For each SSC for which repair is to be modeled, ESTIMATE, based on the data collected in DA-C15, the probability of failure to repair the SSC in time to prevent core damage as a function of the accident sequence in which the SSC failure appears. LR-N18-0033 LAR S18-02 TABLE A-12 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF REGULATORY POSITION CHANGES FROM REG GUIDE 1.200 REV 1 TO REV 2 (APPENDIX A) RA-Sa-2009 SR # RA-Sb-2005 SR # DESCRIPTION OF RG 1.200, REV. 2, COMMENTS (RG 1.200 Rev 2) (RG 1.200 Rev 1) REGULATORY POSITION (CAT II) SRs for LERF quantification reference the SRs in 2-2.8, and therefore, need to be acknowledged in 2-2.8. 2-2.7.1 4.5.8.1 The objectives of the quantification element are to provide an estimate of No change from RG 1.200 Rev 1 to Rev 2. CDF (and support the quantification of LERF) based upon the plant-specific (b) significant contributors to CDF (and LERF) are identified such as initiating events SRs for LERF quantification reference the SRs in 2-2.8 and, therefore, need to be acknowledged in 2-2.8. Table 2-2.7-1 Table 4.5.8-1 No change from RG 1.200 Rev 1 to Rev 2. HLR-QU-D HLR-QU-D significant contributors to CDF (and LERF), such as initiating events, accident sequences Need to acknowledge LERF quantification The addition of LERF is covered by the assessment of QU-A2 QU-A2a the LE supporting requirements. consistent with the estimation of total CDF (and LERF) to identify significant accident The state-of-knowledge correlation should be accounted for all event probabilities. Left to the analyst to determine the extent of the events to be correlated. Need to also acknowledge LERF quantification The addition of LERF is covered by the assessment of the LE supporting requirements. QU-A3 QU-A2b Cat II: The when significant deletion was unchanged from Rev 1 to Rev 2. ESTIMATE the mean CDF (and LERF), accounting for the state-of-knowledge correlation between event probabilities when significant (see NOTE 1). LR-N18-0033 LAR S18-02 TABLE A-12 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF REGULATORY POSITION CHANGES FROM REG GUIDE 1.200 REV 1 TO REV 2 (APPENDIX A) RA-Sa-2009 SR # RA-Sb-2005 SR # DESCRIPTION OF RG 1.200, REV. 2, COMMENTS (RG 1.200 Rev 2) (RG 1.200 Rev 1) REGULATORY POSITION (CAT II) Need to acknowledge LERF quantification The addition of LERF is covered by the assessment of QU-B6 QU-B6 the LE supporting requirements. ACCOUNT for realistic estimation of CDF or LERF. This accounting HLR-QU-D and Table 2-2.7-2(d) objective statement just before table need to agree; SRs for LERF quantification reference the SRs in 2-2.7 and, therefore, need to be acknowledged in 2-2.7. Table 2-2.7-5(d) Table 4.5.8-2(d) No change from RG 1.200 Rev 1 to Rev 2. significant contributors to CDF (and LERF), such as initiating events, accident sequences Need to acknowledge LERF quantification The addition of LERF is covered by the assessment of QU-E3 QU-E3 Cat I and II: the LE supporting requirements. ESTIMATE the uncertainty interval of the CDF (and LERF) results. The note has no relevance to the base model and could cause confusion; it should be deleted. Deletion of the note does not change the conformance of QU-E4 QU-E4 For each source of model uncertainty introduction of a new initiating the SA115A PRA model to Rev 2. event) [Note (1)]. NOTE: For specific applications, And in logical combinations. SR needs to use defined term significant instead of dominant. In addition, there is no requirement to perform sensitivity studies, and therefore, requirement is not needed for documentation. Changes to (g) are the same in Rev 1 and Rev 2. QU-F2 QU-F2 Deletion of (h) does not change the conformance of the (g) equipment or human actions that are the key factors in causing the SA115A PRA model to Rev 2. accidents sequences to be non-dominant nonsignificant. (h) the results of all sensitivity studies LR-N18-0033 LAR S18-02 TABLE A-12 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF REGULATORY POSITION CHANGES FROM REG GUIDE 1.200 REV 1 TO REV 2 (APPENDIX A) RA-Sa-2009 SR # RA-Sb-2005 SR # DESCRIPTION OF RG 1.200, REV. 2, COMMENTS (RG 1.200 Rev 2) (RG 1.200 Rev 1) REGULATORY POSITION (CAT II) There is no requirement to perform sensitivity studies. Deletion of the requirement for sensitivity studies does LE-G2 LE-G2 not change the conformance of the SA115A PRA model (h) the model integration quantification including uncertainty and to Rev 2. sensitivity analyses, as appropriate for the level of analysis The list of fluid systems should be expanded to include fire protection systems. IFSO-A1 IF-B1 No change from RG 1.200 Rev 1 to Rev 2. For each flood area ... INCLUDE: (a) equipment (e.g., piping, valves, pumps) located in the area that are connected to fluid systems (e.g., circulating water system, service water system, and reactor coolant system, and fire protection system) It is necessary to consider a range of flow rates for identified flooding sources, each having a unique frequency of occurrence. For example, small leaks that only cause spray are more likely than large leaks that may IFSO-A5 IF-B3 cause equipment submergence. No change from RG 1.200 Rev 1 to Rev 2. (b) range of flow rates LR-N18-0033 LAR S18-02 TABLE A-12 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF REGULATORY POSITION CHANGES FROM REG GUIDE 1.200 REV 1 TO REV 2 (APPENDIX A) RA-Sa-2009 SR # RA-Sb-2005 SR # DESCRIPTION OF RG 1.200, REV. 2, COMMENTS (RG 1.200 Rev 2) (RG 1.200 Rev 1) REGULATORY POSITION (CAT II) Component susceptibility to flood damage due to either submergence or spray effects was identified for various types of SSCs in section 2.2.5 of the Internal Flood PRA Notebook (SA-PRA-012). Damage to SSCs due to jet impingement, pipe whip, elevated temperature, humidity, and excessive condensation are attributed to High Energy Line Break type of scenarios which are modeled using feedwater and steam line break initiating events that are already a part of the full power internal events (FPIE) For Cat II, it is not acceptable to just note that a flood-induced failure PRA model. Also, these high energy line break (HELB) mechanism is not included in the scope of the internal flooding analysis. scenarios are covered under the Design and Licensing Some level of assessment is required. process where Equipment Qualification of safety related SSCs is required as part of the Design and Licensing Cat II: basis. For the SSCs identified in IFSN-A5, IDENTIFY the susceptibility of each SSC in a flood area to flood-induced failure mechanisms. IFSN-A6 IF-C3 In addition, most high energy system piping is located in INCLUDE failure by submergence and spray in the identification an outside environment at Salem since the Salem turbine process. deck is open to the atmosphere. Within the Auxiliary Building, high energy steam piping that supplies the ASSESS qualitatively the impact of flood-induced mechanisms that motive force for the turbine-driven Auxiliary Feedwater are not formally addressed (e.g., using the mechanisms listed under (AFW) pump is contained within an enclosure designed Capability Category III of this requirement), by using conservative for HELB scenarios. assumptions. The water systems associated with internal flood hazards are typically below 200 deg. F and less than 275 psig, which are incapable of producing the flood-induced mechanisms associated with HELB scenarios. As such, the damage mechanisms associated with HELB scenarios (i.e., mechanisms listed under Capability Category III) are not applicable to the modeled internal flood scenarios in the Salem FPIE PRA model. The quantification also needs to include the effect of common-cause failure. Addition of common-cause failures was unchanged from IFQU-A8 IF-E6a INCLUDE, in the quantification, the combined effects of including Rev 1 to Rev 2. equipment failures, unavailability due to maintenance, common-cause failures and other credible causes. LR-N18-0033 LAR S18-02 TABLE A-12 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES WITH CONSIDERATION OF REGULATORY POSITION CHANGES FROM REG GUIDE 1.200 REV 1 TO REV 2 (APPENDIX A) RA-Sa-2009 SR # RA-Sb-2005 SR # DESCRIPTION OF RG 1.200, REV. 2, COMMENTS (RG 1.200 Rev 2) (RG 1.200 Rev 1) REGULATORY POSITION (CAT II) See global comment on references at start of Table A-1. Use of references: the various references, may be acceptable, in general; References (from however, the staff has not reviewed the references, and there may be both Table A-2 Start of Table A-1 aspects that are not applicable or not acceptable. No change from RG 1.200 Rev 1 to Rev 2. and A-3) For every reference cited in the standard (except NEI 00-02): No staff position is provided on this reference. The staff neither approves nor disapproves of information contained in the referenced document. LR-N18-0033 LAR S18-02 Attachment 3 Simplified Drawing of Typical Inverter LR-N18-0033 LAR S18-02 Simplified Drawing of Typical Inverter 230Y,3til A IINVJA5YB AC/OC POWER SUPPLY

                                            @             FOR NO. lA VITAL INSTRUMENT INVERTER 200A RECTIFIER 200A                             lBKRlAqYC AUCTlONEER ...____.

CIRCUIT 200A 12KVA 240ttJqv

                        -400A                                     ) II' STATIC REGULATOR l2KVA OAMAL:

120YAC SUPPLY ALTERNATE 120VPC SUPPLY lHVERTER OUTPUT N <t 2- ':£!

                                      }}