ML20010D223

Draft RG 1.200 for 01/16/2020 Public Meeting to Discuss Proposed Revisions to Regulatory Guide (RG) 1.200, an Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities

ML20010D223
Person / Time
Issue date:	01/10/2020
From:	Anders Gilbertson, Ed Miller, Sunil Weerakkody NRC/NRR/DORL/LPL2-1, Office of Nuclear Regulatory Research
To:
Miller E
Shared Package
ML20010D221	List: ML20010D222 ML20010D223 ML20010D224
References
Download: ML20010D223 (134)

Text

1 Miller, Ed From:

Miller, Ed Sent:

Friday, January 10, 2020 7:41 AM To:

Miller, Ed

Subject:

Material for 1/16/2020 Public Meeting - Draft RG 1.200 Attachments:

DG-1362 (Draft RG 1.200 R3 Public Preview) 200109.pdf Attached is the subject presentation material for the Jan 16, 2020, public meeting.

U.S. NUCLEAR REGULATORY COMMISSION DRAFT REGULATORY GUIDE DG-1362 Proposed Revision 3 to Regulatory Guide 1.200 Issue Date: Month (TBD) 2020 Technical Lead: Anders Gilbertson This RG is being issued in draft form to involve the public in the development of regulatory guidance in this area. It has not received final staff review or approval and does not represent an NRC final staff position. Public comments are being solicited on this DG and its associated regulatory analysis. Comments should be accompanied by appropriate supporting data. Comments may be submitted through the Federal rulemaking Web site, http://www.regulations.gov, by searching for draft regulatory guide DG-1362. Alternatively, comments may be submitted to the Office of Administration, Mailstop: TWFN 7A-06M, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, ATTN:

Program Management, Announcements and Editing Staff. Comments must be submitted by the date indicated in the Federal Register notice.

Electronic copies of this DG, previous versions of DGs, and other recently issued guides are available through the NRCs public Web site under the Regulatory Guides document collection of the NRC Library at https://nrcweb.nrc.gov/reading-rm/doc-collections/reg-guides/. The DG is also available through the NRCs Agencywide Documents Access and Management System (ADAMS) at http://www.nrc.gov/reading-rm/adams.html, under Accession No. MLXXXXXXXXX. The regulatory analysis may be found in ADAMS under Accession No. MLXXXXXXXXX.

AN APPROACH FOR DETERMINING THE ACCEPTABILITY OF PROBABILISTIC RISK ASSESSMENT RESULTS FOR RISK-INFORMED ACTIVITIES A. INTRODUCTION Purpose This regulatory guide (RG) describes an approach that is acceptable to the staff of the U.S.

Nuclear Regulatory Commission (NRC) for determining whether the acceptability of the probabilistic risk assessment (PRA), in total or the parts that are used to support an application, is sufficient to provide confidence in the results, such that the PRA can be used in regulatory decision-making for light-water reactors (LWRs). When used in support of an application, this regulatory guide will obviate the need for an in-depth review of the base PRA by NRC reviewers, allowing them to focus their review on key assumptions and areas identified by peer reviewers as being of concern and relevant to the application.

NRC staff may perform a more in-depth review of the PRA acceptability for applications such as design certifications or combined licenses where following aspects of this guide may not be feasible. This regulatory guide is intended to be consistent with the NRCs PRA Policy Statement and reflect and endorse guidance provided by standards-setting and nuclear industry organizations.

Applicability This RG applies to LWR licensees subject to Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Domestic Licensing of Production and Utilization Facilities (Ref. 1), and 10 CFR Part 52, Licenses, Certifications, and Approvals for Nuclear Power Plants (Ref. 2).

Applicable Regulations 10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities. The regulations in this part provide for the licensing of production and utilization facilities pursuant to the Atomic Energy Act of 1954, as amended and Title II of the Energy Reorganization Act of 1974.

DRAFT WORK PRODUCT DG-1362, Page 2 10 CFR Part 52, Licenses, Certifications, and Approvals for Nuclear Power Plants. The regulations in this part govern the issuance of early site permits, standard design certifications, combined licenses, standard design approvals, and manufacturing licenses for nuclear power facilities pursuant to the Atomic Energy Act of 1954, as amended and Title II of the Energy Reorganization Act of 1974.

Related Guidance NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, provides guidance to the NRC staff in performing safety reviews of construction permit or operating license applications (including requests for amendments) under 10 CFR Part 50 and early site permit, design certification, combined license, standard design approval, or manufacturing license applications under 10 CFR Part 52 (including requests for amendments). NUREG-0800, Section 19.1, titled Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities (Ref. 3), is designed to guide the NRC staff in its evaluations of licensee requests for changes to the licensing basis that apply risk insights. Guidance developed in selected application-specific RGs and the corresponding chapters of NUREG-0800 also applies to these types of licensing basis changes.

Furthermore, NUREG -0800, Section 19.0, titled Probabilistic Risk Assessment and Severe Accident Evaluation for New Reactors (Ref. 4), pertains to the staff review of the design-specific PRA for a design certification and plant-specific PRA for a combined license application, respectively.

NUREG-1855, Revision 1, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking (Ref. 5), provides guidance on how to treat uncertainties associated with PRA in risk-informed decisionmaking. This guidance is intended to foster an understanding of the uncertainties associated with PRA and their impact on the results of PRA.

RG 1.160, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants (Ref. 6),

provides guidance on acceptable methods for demonstrating compliance with the provisions of 10 CFR 50.65, Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants (Ref. 7).

RG 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis (Ref. 8), provides guidance on acceptable approach for developing risk-informed applications for a licensing basis change that considers engineering issues and applies risk insights.

RG 1.175, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Inservice Testing (Ref. 9), provides guidance on acceptable methods for using PRA information with established traditional engineering information in the development of risk-informed inservice testing programs.

RG 1.177, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications (Ref. 10), provides the guidance on acceptable methods for using risk information to evaluate changes to nuclear power plant technical specification completion times and surveillance frequencies to assess the impact of such proposed changes on the risk associated with plant operation.

DRAFT WORK PRODUCT DG-1362, Page 3 RG 1.178, An Approach for Plant-Specific, Risk-Informed Decisionmaking for Inservice Inspection of Piping (Ref. 11), provides guidance on acceptable approaches for meeting the existing requirements in Section XI of the American Society of Mechanical Engineers (ASME)

Boiler and Pressure Vessel Code, as referenced by 10 CFR 50.55a, Codes and Standards (Ref. 12), for the scope and frequency of inspection of inservice inspection programs, including the application of risk-informed inservice inspection programs.

RG 1.201, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to Their Safety Significance (Ref. 13), provides guidance on an acceptable method for use in complying with the Commissions requirements in 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors (Ref. 14), with respect to the categorization of structures, systems, and components that are considered in risk-informing special treatment requirements.

RG 1.205, Risk-Informed, Performance-Based Fire Protection for Existing Light-Water Nuclear Power Plants (Ref. 15), provides guidance for use in complying with the requirements the NRC has promulgated for risk-informed, performance-based fire protection programs that comply with 10 CFR 50.48(c), National Fire Protection Association Standard NFPA 805 (Ref. 16), and the referenced 2001 Edition of the National Fire Protection Association (NFPA) standard, NFPA 805, Performance-Based Standard for Fire Protection for Light-Water Reactor Electric Generating Plants (Ref. 17).

RG 1.206, Combined License Applications for Nuclear Power Plants (LWR Edition) (Ref. 18),

provides guidance on the information contained in and submitted with a combined license application. Section C.I.19 discusses the requirements in 10 CFR Part 52 for a combined license (COL) applicant to conduct a plant-specific PRA and to describe the plant-specific PRA and its results within its final safety analysis report. The revision to 10 CFR Part 50 included a requirement for the COL holder to maintain and upgrade the PRA periodically throughout the life of the plant, and a requirement to demonstrate PRA technical adequacy (i.e., PRA acceptability).

DC/COL-ISG-028, Interim Staff Guidance on Assessing the Technical Adequacy of the Advanced Light-Water Reactor Probabilistic Risk Assessment for the Design Certification Application and Combined License Application (Ref. 19). This guidance is needed because the PRA Standard was developed for currently operating reactors. As a result, for PRAs developed for the Design Certification and COL application stages, some supporting requirements in the PRA Standard are not applicable or cannot be achieved as written, while other supporting requirements need some clarification to understand how they can be achieved.

Purpose of Regulatory Guides The NRC issues RGs to describe to the public methods that the staff considers acceptable for use in implementing specific parts of the agencys regulations, to explain techniques that the staff uses in evaluating specific problems or postulated events, and to provide guidance to applicants. Regulatory guides are not substitutes for regulations and compliance with them is not required. Methods and solutions that differ from those set forth in RGs will be deemed acceptable if they provide a basis for the findings required for the issuance or continuance of a permit or license by the Commission.

DRAFT WORK PRODUCT DG-1362, Page 4 Paperwork Reduction Act This RG provides voluntary guidance for implementing the mandatory information collections in 10 CFR Parts 50 and 52 that are subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et.

seq.). These information collections were approved by the Office of Management and Budget (OMB),

approval numbers 3150-0011 and 3150-0151. Send comments regarding this information collection to the Information Services Branch (T6-A10M), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to Infocollects.Resource@nrc.gov, and to the OMB reviewer at: OMB Office of Information and Regulatory Affairs (3150-0011 and 3150-0151), Attn: Desk Officer for the Nuclear Regulatory Commission, 725 17th Street, NW Washington, DC, 20503; e-mail:

oira_submission@omb.eop.gov.

Public Protection Notification The NRC may not conduct or sponsor, and a person is not required to respond to, a collection of information unless the document requesting or requiring the collection displays a currently valid OMB control number.

DRAFT WORK PRODUCT DG-1362, Page 5 B. DISCUSSION Reason for Revision This revision of Regulatory Guide (RG) 1.200 (Revision 3) addresses new industry guidance and issues identified since the last revision was issued. Specifically, this revision accomplishes the following:

Endorses NEI 17-07, Revision 2, Performance of PRA Peer Reviews Using the ASME/ANS PRA Standard (Ref. 20)

Endorses requirements in ASME/ANS RA-S Case 1 for seismic PRA, Case for ASME/ANS RA-Sb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment of Nuclear Power Plant Applications (Ref. 21)

Endorses requirements for the peer review of newly developed methods Endorses a process for determining whether a change to a probabilistic risk assessment (PRA) is classified as PRA maintenance or a PRA upgrade Endorses definitions related to newly developed methods, PRA maintenance, and PRA upgrade Enhances guidance related to key assumptions and sources of uncertainty This revision retains the endorsement of ASME/ANS RA-Sa-2009, from RG 1.200, Revision 2, without any changes.

=

Background===

In 1995, the U.S. Nuclear Regulatory Commission (NRC) issued a Policy Statement titled, Use of Probabilistic Risk Assessment Methods in Nuclear Regulatory Activities; Finial Policy Statement (Ref. 22). This Policy Statement encourages the use of probabilistic risk assessment (PRA) in all regulatory matters and states that, the use of PRA technology should be increased to the extent supported by the state-of-the-art in PRA methods and data and in a manner that complements the NRCs deterministic approach. Additionally, on July 28, 2000, the staff issued SECY-00-0162, Addressing PRA Quality in Risk-Informed Activities (Ref. 23), which describes an approach for addressing PRA quality in risk-informed activities, including identification of the scope and minimal functional attributes of a technically acceptable PRA. Subsequently, on July 13, 2004, the staff issued SECY-04-0118, Plan for the Implementation of the Commissions Phased Approach to PRA Quality (Ref. 24), which presents the staffs approach to defining the needed PRA quality for current or anticipated applications, as well as the process for achieving this quality, while allowing risk-informed decisions to be made using currently available methods until all of the necessary guidance documents are developed and implemented.

SECY-07-0042, Status of the Plan for the Implementation of the Commissions Phased Approach to Probabilistic Risk Assessment Quality (Ref. 25), provides an update to the staff plan.

Since the 1995 NRC policy statement, many applications of PRA have been implemented or undertaken in risk-informed regulatory activities, including modification of the NRCs reactor safety inspection program and initiation of work to modify reactor safety regulations. Fundamentally, the staff must have confidence that the information developed from a PRA is sound and reliable. Consequently, the PRA technical content must be complete, correct, accurate, and produces insights with appropriate

DRAFT WORK PRODUCT DG-1362, Page 6 fidelity to support any decision contemplated. As a result, the sufficiency of technical content of the PRA determines the acceptability of a PRA1. PRA acceptability is defined as the ability of a PRA to support risk-informed regulatory decisionmaking. PRA acceptability is measured in terms of the PRA scope, level of detail, conformance with Regulatory Position C.1.2 of this regulatory guide, and representation of the modeled plant.

This regulatory guide 1) provides guidance to licensees on how to meet the staff position in Section C for determining the acceptability of the base PRA used in support of a risk-informed regulatory activity; and 2) endorses national consensus PRA standards and industry guidance on the PRA peer review process. National consensus PRA standards provide the minimum requirements to be met for a base PRA to be considered acceptable, which includes both technical requirements and process-related requirements such as those related to peer review, configuration control, and PRA maintenance. It is important to note that the minimum requirements in the consensus PRA standards are not regulatory requirements. Similarly, reference to and use of the term requirement in this RG should not be construed as relating to a regulatory requirement unless specifically referred to as such. The PRA peer review process is used to determine whether a base PRA meets the requirements provided in the national consensus PRA standard. An acceptable PRA peer review approach is one that is performed according to an established process by qualified personnel and that documents the results and identifies both strengths and weaknesses of the base PRA. In this way, the NRC regulatory position, national consensus PRA standards, and the PRA peer review process all depend on each other to achieve PRA acceptability, as illustrated in Figure 1. When used in support of an application, this regulatory guide will obviate the need for an in-depth review of the base PRA by NRC reviewers, allowing them to focus their review on key assumptions and areas identified by peer reviewers as being of concern and relevant to the application.

Figure 1. NRC general framework for achieving PRA acceptability This regulatory guide provides guidance on one way to show PRA acceptability needed for a base PRA used in a risk-informed integrated decision-making process. More specifically, this regulatory guide provides guidance in the following four areas:

1 The term PRA acceptability and related phrasings are synonymous with previously used terms such as PRA quality and PRA technical adequacy. The resolution of DPO-2016-001 (ML17013A015) directs the staff to consistently use the term PRA acceptability with respect to the scope, level of detail, conformance with PRA technical elements (i.e.,

technical adequacy), and plant representation of a PRA as related to the outcome of the NRC staffs review of a given risk-informed application.

DRAFT WORK PRODUCT DG-1362, Page 7

1.

defining the acceptability of a base PRA

2.

the NRCs position on national consensus PRA standards, industry PRA peer review program documents, and other related industry documents, as needed

3.

demonstration that the base PRA (in total or specific pieces) used in regulatory applications is acceptable

4.

documentation to support a regulatory decision This regulatory guide supports other NRC regulatory guides that address risk-informed activities.

As such, other regulatory guides invoke RG 1.200 in order to ensure the acceptability of the base PRA, from which the application-specific PRA is derived. Other application-specific regulatory guides provide guidance on how the base PRA can be used in the decision under consideration. If the acceptability of the base PRA is a consideration for the application in question, the application-specific regulatory guide will reference this regulatory guide for the necessary guidance in determining the acceptability of the base PRA.

Examples of application-specific regulatory guidance documents include (1) NUREG-0800, Section 19.2, Review of Risk Information Used to Support Permanent Plant-Specific Changes to the Licensing Basis: General Guidance (Ref. 26), which provide general guidance on applications that address changes to the licensing basis; (2) application-specific regulatory guides such as RG 1.174 (Ref. 8), RG 1.175 (Ref. 9), RG 1.177 (Ref. 10), and RG 1.178 (Ref. 11); and (3) regulatory guides associated with implementation of certain regulations, such as RG 1.201 (Ref. 13), particularly those that rely on a plant-specific PRA to implement the rule (e.g., Title 10 of the Code of Federal Regulations (10 CFR) Part 52). In addition, the NRC has prepared corresponding chapters of NUREG-0800 (i.e., the standard review plan (SRP)) for the application-specific guides. Figure 2 illustrates the relationship of RG 1.200 to some examples of risk-informed activities, application-specific guidance, national consensus PRA standards, and industry programs.

Figure 2. Relationship of Regulatory Guide 1.200 to Other Risk-Informed Guidance

DRAFT WORK PRODUCT DG-1362, Page 8 Regulatory guides addressing specific applications, such as RG 1.201, allow for the use of PRAs that are not full-scope (e.g., they may not include contributions from external initiating events or low-power and shutdown (LPSD) modes of operation). Those regulatory guides do, however, state that the missing PRA scope items are to be addressed in some way, such as using bounding analyses to justify excluding missing PRA scope items, or by limiting the scope of the application. This regulatory guide does not address non-PRA methods such as bounding analyses and limiting the scope of an application; rather, this guide only addresses PRA methods. NUREG-1855 provides guidance on how to perform acceptable bounding analyses and on limiting the scope of the application.

Application-specific regulatory guides have been and continue to be developed to provide guidance on the use of PRA information. For example, RG 1.174 and the related guidance in Section 19.2 of the SRP, provide general guidance on applications that address risk-informed changes to the licensing basis. Although, RG 1.174 is written in the context of one regulatory activity specific to operating reactors (license amendments), its underlying philosophy and principles are applicable to a broad spectrum of reactor regulatory activities. Key aspects of these guidance documents include the following:

They describe a risk-informed integrated decision-making process that characterizes how risk information is used and, more specifically, it clarifies that such information is one element of the decision-making process. That is, decisions are expected to be reached in an integrated fashion, considering traditional engineering and risk information, and may be based on qualitative factors as well as quantitative analyses and information.

They reflect the staffs recognition that the PRA developed to support regulatory decisions (i.e.,

as derived from the base PRA) can vary in terms of the scope, level of detail, and the level of conformance with the technical elements in a PRA standard. The PRA is to be commensurate with the application for which it is intended and the role the PRA results play in the integrated decisionmaking process. For some applications and decisions, only particular pieces2 of the PRA need to be used. In other applications, a full-scope PRA is needed. General guidance regarding scope, level of detail, and quality for a PRA is provided in the application-specific documents.

National consensus PRA standards have been under development by the American Society of Mechanical Engineers (ASME) and the American Nuclear Society (ANS). In February 2009, ASME and ANS jointly issued ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications (Ref. 27), referred to hereafter as the ASME/ANS Level 1/LERF PRA standard. The ASME/ANS Level 1/LERF PRA standard is for an at-power, Level 1 and limited Level 2 PRA of internal and external hazards for light-water reactors (LWRs). Appendix A of this RG provides the staff endorsement of the requirements in the ASME/ANS Level 1/LERF PRA standard. The staff endorsement is based on the staffs review the requirements in the ASME/ANS Level 1/LERF PRA standard against the regulatory position in Section C of this RG.

Additionally, in November 2017, ASME and ANS jointly issued ASME/ANS RA-S Case 1, Case for ASME/ANS RA-Sb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment of Nuclear Power Plant Applications, which provides a proposed alternative set of requirements related to the requirements for seismic PRA in Part 5 of ASME/ANS RA-Sa-2009.

Appendix B of this RG provides the staff endorsement of the requirements for seismic PRA in ASME/ANS RA-S Case 1. Similar to the staff endorsement of the ASME/ANS Level 1/LERF PRA 2

In this regulatory guide, a piece of a PRA can be understood to be equivalent to that piece of the analysis for which an applicable PRA standard identifies a supporting level requirement.

DRAFT WORK PRODUCT DG-1362, Page 9 standard, the staff endorsement is based on the staffs review the seismic PRA requirements in ASME/ANS RA-S Case 1 against the related regulatory position in Section C of this RG.

The scope of ASME and ANS standards development activities include developing and maintaining national consensus PRA standards for the following types of PRA:

PRA for new LWRs applying for a design certification (DC) or combined operating license (COL);

Advanced non-LWR PRA; Low-power and shutdown, Level 1 and limited Level 2 PRA for LWRs; Level 2 PRA for LWRs; Level 3 PRA for LWRs; and Multi-unit PRA.

A PRA peer review program was developed and has been applied by the reactor owners groups for several years. The Nuclear Energy Institute (NEI) issued the PRA peer review guidance document NEI 17-07, Revision 2, Performance of PRA Peer Reviews Using the ASME/ANS PRA Standard, which provides guidance on how to perform a PRA peer review to meet the PRA peer review requirements in the ASME/ANS Level 1/LERF PRA standard. Consistent with the scope of the ASME/ANS Level 1/LERF PRA standard, NEI 17-07, Revision 2, addresses PRA peer reviews for internal and external hazards as well as follow-on PRA peer reviews. The staff position on NEI 17-07, Revision 2, in Section C.2.2 of this guide endorses NEI 17-07, Revision 2, in its entirety as a means of satisfying the peer review requirements in the ASME/ANS Level 1/LERF PRA standard, as endorsed by the NRC in this guide. The following are other related NEI guidance documents on PRA peer review from which NEI 17-07, Revision 2, was developed:

NEI 00-02, Probabilistic Risk Assessment Peer Review Process Guidance (Ref. 28);

NEI 05-04, Process for Performing Follow-On PRA Peer Reviews Using the ASME PRA Standard (Ref. 29);

NEI 07-12, Fire Probabilistic Risk Assessment (FPRA) Peer Review Process Guidelines (Ref. 30);

NEI 12-13, External Hazards PRA Peer Review Process Guidelines (Ref. 31);

NRC endorsement of NEI 00-02, NEI 05-04, and NEI 07-12 are provided in the Appendices of RG 1.200, Revision 2. On March 7, 2018, the NRC staff issued a letter determining that NEI 12-13 is suitable for use in risk-informed licensing applications, as modified by the staffs comments on NEI 12-13 (Ref. 32). Additionally, on May 3, 2017, the NRC staff issued a letter (Ref. 33) determining that the process proposed an NEI-developed Appendix to NEI 05-04, NEI 07-12, and NEI 12-13, referred to as Appendix X (Ref. 34), for the close out of PRA peer review Facts and Observations (F&Os) is acceptable, subject to the NRCs conditions of acceptance. NEI 17-07, Revision 2, was developed to consolidate the guidance in the above four guidance documents and to include the F&O closure process accepted by the NRC.

DRAFT WORK PRODUCT DG-1362, Page 10 Harmonization with International Standards The International Atomic Energy Agency (IAEA) works with member states and other partners to promote the safe, secure, and peaceful use of nuclear technologies. The IAEA develops safety standards for protecting people and the environment from harmful effects of ionizing radiation. These standards provide a system of safety fundamentals, safety requirements, and safety guides reflecting an international consensus on what constitutes a high level of safety. This system includes technical principles and guidance to be considered for the development of PRA (also referred to as probabilistic safety assessment (PSA)) of nuclear power plants:

IAEA Safety Standards Series No. SSG-3, Development and Application of Level 1 Probabilistic Safety Assessment for Nuclear Power Plants (Ref. 35).

IAEA Safety Standards Series No. SSG-4, Development and Application of Level 2 Probabilistic Safety Assessment for Nuclear Power Plants (Ref. 36).

This RG incorporates similar design and performance guidelines and is consistent with the safety principles provided in these publications.

Documents Discussed in Staff Regulatory Guidance This RG endorses the use of one or more codes or standards developed by external organizations, and other third-party guidance documents. These codes, standards and third-party guidance documents may contain references to other codes, standards or third-party guidance documents (secondary references). If a secondary reference has itself been incorporated by reference into NRC regulations as a requirement, then licensees and applicants must comply with that standard as set forth in the regulation. If the secondary reference has been endorsed in a RG as an acceptable approach for meeting an NRC requirement, then the standard constitutes a method acceptable to the NRC staff for meeting that regulatory requirement as described in the specific RG. If the secondary reference has neither been incorporated by reference into NRC regulations nor endorsed in a RG, then the secondary reference is neither a legally-binding requirement nor a generic NRC approved acceptable approach for meeting an NRC requirement. However, licensees and applicants may consider and use the information in the secondary reference, if appropriately justified, consistent with current regulatory practice, and consistent with applicable NRC requirements.

DRAFT WORK PRODUCT DG-1362, Page 11 C. STAFF REGULATORY GUIDANCE

1.

An Acceptable Base PRA This section describes one acceptable approach for defining the acceptability of a base probabilistic risk assessment (PRA) used in regulatory decision-making for commercial light-water reactor (LWR) nuclear power plants. As defined in the glossary of this regulatory guide, a method or approach is considered to be a PRA when it (1) provides a quantitative assessment of the identified risk in terms of scenarios that result in undesired consequences (e.g., core damage or a large early release) and their frequencies, and (2) is comprised of specific technical elements in performing the quantification.

Additionally, the base PRA is defined as the PRA from which results or insights are derived or that is modified and/or manipulated to support a risk-informed U.S. Nuclear Regulatory Commission (NRC) regulatory activity. The base PRA provides a quantitative assessment of the identified risk of the as-built and as-operated plant in terms of scenarios that result in undesired consequences (e.g., core damage or a large early release) and their frequencies and is comprised of specific technical elements in performing the quantification. The base PRA serves as the foundational representation of the as-built and as-operated plant necessary to support an application. A method or approach that does not provide a quantified assessment of the defined risk and does not include the technical elements specified in Regulatory Position C.1.2 is not considered to be a PRA. In some cases, such as applications related to Title 10 of the Code of Federal Regulations (10 CFR) Section 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors, the PRA used in the application may be the base PRA. Regulatory Position C.1 and its subsections provides guidance in the following four areas that collectively determine the acceptability of a base PRA:

1.

Scope of a base PRA: The scope of a base PRA is defined in terms of (1) the metrics used to characterize risk, (2) the plant operating states for which the risk is to be evaluated, and (3) the causes of initiating events (hazard groups) that can potentially challenge and disrupt the normal operation of the plant and, if not prevented or mitigated, would eventually result in core damage and/or a large release. The scope of a base PRA is determined by its intended use for representing the as-built and as-operated plant. It is envisioned, however, that for currently operating reactors and for reactor at the design certification (DC) or combined operating license (COL) application stage, some applications may require a full-scope Level 1 and some aspects of a Level 2 PRA. Regulatory Position C.1.1 provides guidance with respect to a full-scope Level 1 and Level 2 PRA.

2.

Technical elements of a base PRA: The PRA technical elements are defined in terms of the fundamental technical analyses needed to develop and quantify the base PRA model for its intended purpose (e.g., determination of a specific risk metric). The characteristics and attributes of the PRA technical elements define specific requirements that need to be met to successfully perform those technical analyses and achieve a defined objective. Regulatory Position C.1.2 provides guidance on the technical elements of a full-scope Level 1 and Level 2 PRA.

3.

Level of detail of a base PRA: The level of detail of a base PRA is defined in terms of the resolution of the modeling used to represent the behavior and operations of the plant. A minimal level of detail is necessary to ensure that the impacts of designed-in dependencies (e.g., support system dependencies, functional dependencies, and dependencies on operator actions) are correctly captured. This minimal level of detail is implicit in the technical elements comprising the base PRA and their associated characteristics and attributes. Regulatory Position C.1.3 provides guidance on the level of detail for a base PRA.

DRAFT WORK PRODUCT DG-1362, Page 12

4.

Plant representation and PRA configuration control: Plant representation is defined in terms of how closely the base PRA represents the plant as it is actually built and operated. In general, PRA results used to support an application must be derived from a base PRA model that represents the as-built and as-operated plant to the extent needed to support the application.

Consequently, the base PRA needs to be maintained and upgraded, where necessary, to ensure it represents the as-built and as-operated plant. However, for some applications, the plant may only be in the DC or COL of licensing, at which point the plant is neither built nor operated. At these licensing stages, the base PRA model is intended to reflect the as-designed plant. Regulatory Position C.1.4 provides guidance on plant representation in the base PRA.

Scope of a Base PRA The scope of a base PRA is defined by the challenges included in the analysis and the level of analysis performed. Specifically, the base PRA scope is defined in the following terms:

metrics used to characterize the risk, plant operating states (POSs) for which the risk is to be evaluated, and causes of initiating events (hazard groups) that can potentially challenge and disrupt the normal operation of the plant.

Risk characterization is typically expressed by metrics of core damage frequency (CDF) and large early release frequency (LERF) (as surrogates for latent and early fatality risks, respectively, for operating light-water reactors). Large release frequency (LRF) is used as a risk metric for LWR DC and COL applicants, as approved in the staff requirements memorandum on SECY-90-016, Evolutionary Light Water Reactor (LWR) Certification Issues and Their Relationships to Current Regulatory Requirements (Ref. 37). The CDF and LERF metrics are defined in a functional sense as follows:

Core damage frequency is defined as the sum of the frequencies of those accidents that result in uncovery and heatup of the reactor core to the point at which prolonged oxidation and severe fuel damage are anticipated and involving enough of the core, if released, to result in offsite public health effects.

Large early release frequency is defined as the sum of the frequencies of those accidents leading to rapid, unmitigated release of airborne fission products from the containment to the environment occurring before the effective implementation of offsite emergency response and protective actions such that there is the potential for early health effects. (Such accidents generally include unscrubbed releases associated with early containment failure shortly after vessel breach, containment bypass events, and loss of containment isolation.)

Issues related to the reliability of barriers, containment integrity and consequence mitigation in particular, are addressed by other parts of the decision-making process, such as consideration of defense-in-depth. To provide the risk perspective for use in decision-making, a Level 1 PRA needs to assess the CDF risk metric; a limited Level 2 PRA is needed to assess the LERF risk metric; and a full Level 2 PRA is needed to assess the LRF risk metric.

Plant operating states are used to subdivide the plant operating cycle into unique states, such that the plant response can be assumed to be the same within the given POS for a given initiating event.

Operational characteristics (such as reactor power level; in-vessel temperature, pressure, and coolant level; equipment operability; and changes in decay heat load or plant conditions that allow new success

DRAFT WORK PRODUCT DG-1362, Page 13 criteria or reactor coolant system or containment configuration) are examined to identify those relevant to defining POSs. These characteristics are used to define the states, and the fraction of time spent in each state is estimated using plant-specific information. The risk perspective is based on the total risk associated with the operation of the reactor, which includes not only at-power operation, but also low-power and shutdown (LPSD) conditions. For some applications, the risk impact may affect some modes of operation, but not others.

A hazard group is a group of similar causes of initiating events that are assessed in a PRA using a common approach, methods, and likelihood data for characterizing the effect on the plant. Hazard group are characterized as either an internal or external hazard type, where the division between these hazard types are defined by the plant boundary in the PRA. The hazard groups addressed in this regulatory guide that are typically evaluated using a PRA include the following:

• internal events

• seismic events

• other hazard groups

• internal floods

• high wind (see Appendix D)

• internal fire

• external flood Other hazard groups that may be analyzed using a PRA can be internal hazards (e.g., turbine-generated missiles, onsite releases of hazardous material) or external hazards (e.g., extreme ambient temperature, external fire). Appendix D provides a listing of these other hazard groups together with the internal and external hazards listed above and includes a general description for each hazard group.

Initiating events are perturbations to the steady state operation of the plant that challenges plant control and safety systems and whose failure could lead to core damage and or radioactivity release.

Initiating events may be caused by internal hazards such as equipment failure, operator actions, or a flood or fire internal to the plant; external hazards such as an earthquake, external flood, or high wind; or the other hazard groups, which may be human-caused or naturally occurring events. Appendix D of this RG provides a more complete listing of such hazards. The risk perspective is based on a consideration of total risk, which includes risk contributions both internal and external hazards.

Technical Elements of a Base PRA and Associated Characteristics and Attributes Table 1 provides the list of general technical elements that are necessary for an acceptable Level 1 and Level 2 base PRA. A base PRA that is missing one or more of these elements would not be considered a complete base PRA.

Table 1. Technical Elements of a Base PRA SCOPE OF ANALYSIS TECHNICAL ELEMENT Level 1 Initiating event analysis Success criteria analysis Accident sequence analysis Systems analysis Parameter estimation analysis Human reliability analysis Quantification Level 2 Plant damage state analysis Accident progression analysis Quantification Source term analysis Interpretation of results and documentation are technical elements of both Level 1 and Level 2 base PRAs.

These technical elements are applicable to the base PRA models constructed to address each of the risk contributors (hazard groups) to risk for each of the POSs. Because additional analyses are

DRAFT WORK PRODUCT DG-1362, Page 14 required to characterize their impact on the plant in terms of causing initiating events and mitigating equipment failures; internal floods, internal fire, seismic, high wind and external flood are discussed separately in Regulatory Positions C.1.2.3 through C.1.2.5, C.1.2.7, and C.1.2.8, respectively. It may be possible to screen other hazards, consequently the technical element for screening and conservative analysis of other hazards is discussed in Regulatory Position C.1.2.6. Regulatory Position C.1.2.9 provides a discussion of the technical elements associated with PRA for other hazards. While the technical elements are the same for each POS, other considerations, within a specific technical element, may need to be addressed for LPSD conditions; these are discussed in Regulatory Position C.1.2.10. In order to better understand the results, it is important to examine the different contributors on both an individual and relative basis. Therefore, the technical element on the interpretation of results is discussed separately in Regulatory Position C.1.2.11. The technical element on documentation of the PRA is discussed in Regulatory Position C.1.2.12.

Technical Elements for Level 1, Internal Events, At-Power PRA This Section identifies the technical elements for a Level 1, internal events, at-power PRA. The objective for each technical element is briefly described and the characteristics and attributes needed to achieve the objective are provided in the subsequent table. The technical elements for a Level 1, internal events, at-power PRA are:

initiating event analysis success criteria analysis accident sequence analysis systems analysis parameter estimation analysis human reliability analysis quantification Initiating event analysis identifies and characterizes the events that both challenge normal plant operation during power or shutdown conditions and require successful mitigation by plant equipment and personnel to prevent core damage from occurring. Events that have occurred at the plant and those that have a reasonable probability of occurring are identified and characterized. An understanding of the nature of the events is performed such that a grouping of the events, with the groups defined by similarity of system and plant responses (based on the success criteria), may be performed to manage the large number of potential events that can challenge the plant.

Success criteria analysis determines the minimum requirements for each function (and ultimately the systems used to perform the functions) to prevent core damage (or to mitigate a release) given an initiating event. The requirements defining the success criteria are based on acceptable engineering analyses that represent the design and operation of the plant under consideration. For a function to be successful, the criteria are dependent on the initiator and the conditions created by the initiator. The computer codes used to perform the analyses for developing the success criteria are validated and verified for both technical integrity and suitability to assess plant conditions for the reactor pressure, temperature, and flow range of interest, and they accurately analyze the phenomena of interest.

Calculations are performed by personnel who are qualified to perform the types of analyses of interest and are well trained in the use of the codes.

Accident sequence analysis models, chronologically (to the extent practical), the different possible progressions of events (i.e., accident sequences) that can occur from the start of the initiating event to either successful mitigation or core damage. The accident sequences account for the systems that are used (and available) and operator actions performed to mitigate the initiator based on the defined

DRAFT WORK PRODUCT DG-1362, Page 15 success criteria and plant operating procedures (e.g., plant emergency and abnormal operating procedures) and training. The availability of a system includes consideration of the functional, phenomenological, and operational dependencies and interfaces between the various systems and operator actions during the course of the accident progression.

Systems analysis identifies the various combinations of failures that can prevent the system from performing its function as defined by the success criteria. The model representing the various failure combinations includes, from an as-built and as-operated perspective, the system hardware and instrumentation (and their associated failure modes) and human failure events that would prevent the system from performing its defined function. The basic events representing equipment and human failures are developed in sufficient detail in the model to account for dependencies among the various systems and to distinguish the specific equipment or human events that have a major impact on the systems ability to perform its function.

Parameter estimation analysis quantifies the frequencies of the initiating events, as well as the equipment failure probabilities and equipment unavailabilities of the modeled systems. The estimation process includes a mechanism for addressing uncertainties and has the ability to combine different sources of data in a coherent manner, including the actual operating history and experience of the plant when it is of sufficient quality, as well as applicable generic experience.

Human reliability analysis identifies and provides probabilities for the human failure events that can negatively impact normal or emergency plant operations. The human failure events associated with normal plant operation include the events that leave the system (as defined by the success criteria) in an unrevealed, unavailable state. The human failure events associated with emergency plant operation represent those human actions that, if not performed, do not allow the needed system to function.

Quantification of the probabilities of these human failure events is based on plant-and accident-specific conditions, where applicable, including any dependencies among actions and conditions.

Quantification provides an estimation of the CDF given the design and/or operation the plant (depending whether the plant is in the design or operating stage). Regardless of the plant stage, the CDF is based on the summation of the estimated CDF from each accident sequence for each initiator group. If truncation of accident sequences and cut sets is applied, truncation limits are set so that the overall model results are not impacted in such a way that significant accident sequences or contributors are eliminated.

Therefore, the truncation value is selected so that the required results are stable with respect to further reduction in the truncation value.

Table 2 provides a summary of characteristics and attributes needed for the technical elements for a Level 1 PRA for internal events. The characteristics and attributes are provided for at-power conditions.

Table 2. Summary of Technical Characteristics and Attributes of a Level 1, Internal Events PRA for the At-Power Operating Mode Element Technical Characteristics and Attributes Initiating Event Analysis Sufficiently detailed identification and characterization of initiating events Grouping of individual events according to plant response and mitigating requirements Proper screening of any individual or grouped initiating events Note: It is recognized that for those new reactor designs with substantially lower risk profiles (e.g., internal events CDF below 10-6/year) that the quantitative screening value should be adjusted according to the corresponding baseline risk value.

DRAFT WORK PRODUCT DG-1362, Page 16 Table 2. Summary of Technical Characteristics and Attributes of a Level 1, Internal Events PRA for the At-Power Operating Mode Element Technical Characteristics and Attributes Success Criteria Analysis Based on best-estimate engineering analyses applicable to the actual plant design and operation, as available Codes developed in sufficient detail to:

analyze the phenomena of interest be applicable in the pressure, temperature, and flow range of interest Accident Sequence Development Analysis Defined in terms of hardware, operator action, and timing requirements and desired end states (e.g., core damage or plant damage states)

Includes necessary and sufficient equipment (safety and non-safety) reasonably expected to be used to mitigate initiators Includes functional, phenomenological, and operational dependencies and interfaces Systems Analysis Models developed in sufficient detail to achieve the following purposes:

Reflect the as-designed, as-built and as-operated plant (as applicable) including how it has performed during the plant history for operating plants Reflect the success criteria for the systems to mitigate each identified accident sequence Capture impact of dependencies, including support systems and abnormal environmental impacts Include both active and passive components and failure modes that impact the function of the system Include common-cause failures, human errors, unavailability resulting from test and maintenance, etc.

Parameter Estimation Analysis Estimation of parameters associated with initiating event, basic event probability models, recovery actions, and unavailability events using plant-specific and generic data as applicable Estimation is consistent with component boundaries Estimation includes a characterization of the uncertainty Human Reliability Analysis Identification and definition of the human failure events that would result in initiating events or pre-and post-accident human failure events that would impact the mitigation of initiating events Quantification of the associated human error probabilities considering scenario (where applicable) and plant-specific factors (as available) and including appropriate dependencies (both pre-and post-accident)

NUREG-1792 (Ref. 38) and NUREG-1842 (Ref. 39) provide good practices for meeting the above characteristics and attributes Quantification Estimation of the CDF for modeled sequences that are not screened as a result of truncation, given as a mean value Estimation of the accident sequence CDFs for each initiating event group Truncation values set relative to the total plant CDF such that the CDF is stable with respect to further reduction in the truncation value Technical Elements for Level 2, Internal Events PRA This Section identifies the technical elements for a Level 2, internal events PRA. The objective for each technical element is briefly described and the characteristics and attributes needed to achieve the objective are provided in the subsequent table. The technical elements for a Level 2, internal events PRA are:

DRAFT WORK PRODUCT DG-1362, Page 17 plant damage state analysis accident progression analysis source term analysis quantification Plant damage state analysis groups similar core damage scenarios together to allow a practical assessment of the severe accident progression and containment response resulting from the full spectrum of core damage accidents identified in the Level 1 analysis. The plant damage state analysis defines the attributes of the core damage scenarios that represent boundary conditions in the assessment of severe accident progression and containment response that ultimately affect the resulting radionuclide releases.

The attributes address the dependencies between the containment systems modeled in the Level 2 analysis with the core damage accident sequence models to fully account for mutual dependencies. Core damage scenarios with similar attributes are grouped together to allow for efficient evaluation of the Level 2 response.

Accident progression analysis models the different series of events that challenge containment integrity for the core damage scenarios represented in the plant damage states. The accident progressions account for interactions among severe accident phenomena and system and human responses to identify credible containment failure modes, including failure to isolate the containment. The timing of major accident events and the subsequent loadings produced on the containment are evaluated against the capacity of the containment to withstand the potential challenges. The containment performance during the severe accident is characterized by the timing (e.g., early versus late), size (e.g., catastrophic versus bypass), and location of any containment failures. The codes used to perform the analysis are validated and verified for both technical integrity and suitability. Calculations are performed by personnel qualified to perform the types of analyses of interest and well-trained in the use of the codes.

Source term analysis characterizes the radiological release to the environment resulting from each severe accident sequence leading to containment failure or bypass. The characterization includes the time, elevation, and energy of the release and the amount, form, and size of the radioactive material that is released to the environment. The source term analysis is sufficient to determine whether a large early release or a large late release occurs. A large early release is one involving the rapid, unmitigated release of airborne fission products from the containment to the environment occurring before the effective implementation of offsite emergency response and protective actions such that there is a potential for early health effects. Such accidents generally include unscrubbed releases associated with early containment failure at or shortly after vessel breach, containment bypass events, and loss of containment isolation. With large late release, unmitigated release from containment occurs in a timeframe that allows effective evacuation of the close-in population making early health effects are unlikely.

Quantification integrates the accident progression models and source term evaluation to provide estimates of the frequency of radionuclide releases that could be expected following the identified core damage accidents. This quantitative evaluation reflects the different magnitudes and timing of radionuclide releases and specifically allows for identification of LERF or LRF.

Table 3 provides a summary of the characteristics and attributes needed for the technical elements for a Level 2 PRA for internal events. The characteristics and attributes are provided for both at-power conditions.

DRAFT WORK PRODUCT DG-1362, Page 18 Table 3. Summary of Technical Characteristics and Attributes of a Level 2, Internal Events PRA Element Technical Characteristics and Attributes Plant Damage State Analysis Identification of the attributes of the core damage scenarios that influence severe accident progression, containment performance, and any subsequent radionuclide releases Grouping of core damage scenarios with similar attributes into plant damage states Carryover of relevant information from Level 1 to Level 2 Severe Accident Progression Analysis Use of appropriate codes by qualified trained users with an understanding of the code limitations and the means for addressing the limitations Assessment of the credible severe accident phenomena via a structured process Assessment of containment system performance including linkage with failure modes on non-containment systems Establishment of the capacity of the containment to withstand severe accident environments Assessment of accident progression timing, including timing of loss of containment failure integrity Source Term Analysis Assessment of radionuclide releases including appreciation of timing, location, amount, and form of release Grouping of radionuclide releases into smaller subsets of representative source terms with emphasis on large early release and large late release Quantification Estimation of the frequency of different containment failure modes and resulting radionuclide source terms Technical Elements for Level 1, Internal Flood, At-Power PRA PRA models of internal floods are based on the internal events PRA model, which are modified to include the impact of the identified flood scenarios in terms of causing initiating events, and failing equipment used to respond to initiating events. This Section identifies the technical elements for a Level 1, internal flood, at-power PRA. The objective for each technical element is briefly described and the characteristics and attributes needed to achieve the objective are provided in the subsequent table.

The technical elements for a Level 1, internal flood, at-power PRA are:

flood area partitioning flood source analysis flood scenario analysis flood scenario delineation and quantification The quantification task specific to internal floods is similar in nature to that for the internal events. Because of its dependence on the internal events model, the flood analysis incorporates the elements of Sections C.1.2.1 and C.1.2.2, as necessary.

Flood area partitioning divides the plant into flood areas that are used as the basis for the flood analysis. Flood areas are defined on the basis of physical barriers, mitigation features, and propagation pathways.

Flood source analysis identifies the flood sources in each flood area that are attributable to equipment (e.g., piping, valves, pumps) and other sources internal to the plant (e.g., tanks) along with the affected structures, systems, and components (SSCs). Flood mechanisms examined include failure modes of components, human-induced mechanisms, and other water-releasing events. Flood types (e.g., leak, rupture, spray) and flood sizes are determined. Plant walkdowns are performed to verify the accuracy of

DRAFT WORK PRODUCT DG-1362, Page 19 the information. It is recognized that at the design and initial licensing stage, plant walkdowns are not possible.

Flood scenario analysis identifies the potential flood scenarios for each flood source by identifying flood propagation paths of water from the flood source to its accumulation point (e.g., pipe and cable penetrations, doors, stairwells, failure of doors or walls). Plant design features or operator actions that have the ability to terminate the flood are identified. The susceptibility of each SSC in a flood area to flood-induced mechanisms is examined (e.g., submergence, spray, pipe whip, and jet impingement). Flood scenarios are developed by examining the potential for propagation and giving credit for flood mitigation. Flood scenarios can be eliminated on the basis of screening criteria. The screening criteria used are well-defined and justified.

Flood scenario delineation and quantification provide an estimation of the CDF of the plant that includes internal floods. The frequency of flood-induced initiating events that represent the design, operation, and experience of the plant are quantified. The Level 1 models are modified and the internal flood accident sequences quantified to (1) modify accident sequence models to address flood phenomena, (2) perform necessary calculations to determine success criteria for flood mitigation, (3) perform parameter estimation analysis to include flood as a failure mode, (4) perform human reliability analysis to account for performance shaping factors that are attributable to flood, and (5) quantify internal flood accident sequence CDF.

Table 4 summarizes the characteristics and attributes needed for the technical elements of an internal flood analysis.

Table 4. Summary of Technical Characteristics and Attributes of a Level 1, Internal Flood PRA for the At-Power Operating Mode Element Technical Characteristics and Attributes Flood Area Partioning Flood areas defined based on plant features that can restrict flood Verification of area definitions through plant walkdowns Flood Source Analysis Sufficiently detailed identification and characterization of the following:

SSCs located within each area flood sources and flood mechanisms type of water release and capacity Elimination of flood sources and areas uses well-defined and justified screening criteria Verification of the information through plant walkdowns for as-built plants Flood Scenario Analysis Identification and evaluation of the following:

flood propagation paths flood mitigating plant design features (e.g., drains and sumps) and operator actions the susceptibility of SSCs in each flood area to the different types of floods Elimination of flood scenarios uses well-defined and justified screening criteria

DRAFT WORK PRODUCT DG-1362, Page 20 Table 4. Summary of Technical Characteristics and Attributes of a Level 1, Internal Flood PRA for the At-Power Operating Mode Element Technical Characteristics and Attributes Flood Scenario Delineation and Quantification Identification and grouping of flood-induced initiating events on the basis of a structured and systematic process Estimation of flood initiating event frequencies Modification of the Level 1 models to account for flood effects including uncertainties Estimation of CDF for chosen flood sequences Elimination of flood scenarios uses well-defined and justified screening criteria Technical Elements for Level 1, Internal Fire, At-Power PRA PRA models of internal fire are based on the internal events PRA model, which are modified to include the impact of the identified fire scenarios in terms of causing initiating events (plant transients and loss-of-coolant accidents (LOCAs)) and the failing equipment used to respond to initiating events.

Because of its dependence on the internal events model, the internal fire analysis incorporates the elements of Sections C.1.2.1 and C.1.2.2 of this guide as necessary. This Section identifies the technical elements for a Level 1, internal fire, at-power PRA. The objective for each technical element is briefly described and the characteristics and attributes needed to achieve the objective are provided in the subsequent table. The technical elements for a Level 1, internal fire, at-power PRA are:

plant boundary definition and partitioning equipment selection cable selection qualitative screening fire PRA plant response model fire scenario selection and analysis fire ignition frequencies quantitative screening circuit failure fire risk quantification fire/seismic interactions Plant boundary definition and partitioning establish the overall boundaries of the fire PRA and divides the area within that boundary into smaller regions (i.e., physical analysis units), commonly known as fire areas or compartments. The entire fire PRA is generally organized according to these physical analysis units.

Equipment selection identifies the equipment to be included in the fire PRA model. This equipment is selected from the equipment included in the internal events PRA and in the plants fire protection program and analysis (i.e., the postfire safe-shutdown analysis) that, if failed by a fire, could produce a plant initiator or affect the plant response. Fire-induced spurious actuations are of particular interest. The selected equipment is mapped to the physical analysis units.

Cable selection identifies those cables associated with the equipment identified in the equipment selection technical element. The selected cables are mapped to the physical analysis units.

DRAFT WORK PRODUCT DG-1362, Page 21 Qualitative screening is an optional element that may be used to eliminate certain physical analysis units defined in the plant boundary definition and partitioning element that can be shown to be unimportant to fire risk. General, qualitative criteria are typically applied. Those physical analysis units screened out in this technical element play no role in the more detailed quantitative assessment.

Fire PRA plant response model develops a logic model that represents the plant response following a fire. This model is based upon the internal events PRA model which is modified to account for fire effects. These modifications include system, structure, and component failures that specifically result from fire and consider of fire-specific procedures. The latter are processed through the human reliability analysis technical element.

Fire scenario selection and analysis defines and analyzes fire event scenarios that capture the plant fire risk associated with each physical analysis unit. Fire scenarios are defined in terms of ignition sources, fire growth and propagation, fire detection, fire suppression, and cables and equipment (targets) damaged by the fire. Main control room fire scenarios, including control room abandonment, are analyzed explicitly. Multicompartment fire propagation scenarios, including scenarios from all screened physical analysis units, are also assessed.

Fire ignition frequencies are estimated for the ignition sources postulated for the fire scenarios.

Ignition sources consist of in situ sources, such as electrical cabinets or batteries, and other sources such as transient fires. U.S. nuclear power industry fire event frequencies, possibly augmented with plant-specific experience, are used where available to establish the fire ignition frequencies. Other sources are generally used only for cases when the U.S. nuclear power industry does not provide the representative frequency.

Quantitative screening involves eliminating physical analysis units from further quantitative analysis based on their quantitative contribution to fire risk. Quantitative screening criteria are established in terms of fire-induced CDF and LERF/LRF. This element is not required, although it is expected to be used in most applications. Note that, unlike the physical analysis units screened during qualitative screening, the CDF and LERF/LRF contributions of each of these quantitatively screened units are retained and reported as a part of the total plant fire risk in the fire risk quantification element. All physical analysis units are reconsidered as a part of the multicompartment fire scenario analysis, regardless of the quantitative screening results.

Circuit failure analysis treats the impact of fire-induced circuit failures upon the plant response.

In particular, spurious actuations from hot shorts (inter-cable and intra-cable) are analyzed. The conditional probability of the particular circuit failure is identified and assigned.

Post-fire human reliability analysis is conducted to identify operator actions and related human failure events (HFEs), both within and outside the main control room, for inclusion in the plant response model. This element also includes quantification of human error probabilities for the modeled actions.

Modeled operator actions include those introduced into the plant response model resulting strictly from fire-related emergency procedures and those actions retained from the internal events PRA. The latter HFEs are modified to account for fire effects.

Fire risk quantification calculates the fire-induced CDF and LERF/LRF contributions to plant risk and identifies significant contributors to each. In this element, the plant response model is quantified for the set of fire scenarios to produce conditional core damage probability and conditional large early release probability (CLERP) or conditional large release probability (CLRP) values. The conditional core damage probability and CLERP/CLRP values are mathematically combined with the corresponding fire

DRAFT WORK PRODUCT DG-1362, Page 22 ignition frequencies and the conditional probabilities of fire damage for the appropriate fire scenario to yield fire-induced CDF and LERF/LRF.

Seismic/fire interactions is a qualitative review of the plant fire risk caused by a potential earthquake. This element seeks to ensure that such seismic/fire interactions have been considered and their impacts assessed. A more thorough treatment of seismic/fire interactions is included in the technical elements of the seismic PRA.

Table 5 summarizes the characteristics and attributes needed for the technical elements of an internal fire analysis.

Table 5. Summary of Technical Characteristics and Attributes of a Level 1, Internal Fire PRA for the At-Power Operating Mode Element Technical Characteristics and Attributes Plant Boundary Definition and Partitioning Global analysis boundary captures all plant locations relevant to the fire PRA.

Physical analysis units are identified by credited partitioning elements that are capable of substantially confining fire damage behaviors.

Equipment Selection Equipment is selected for inclusion in the plant response model that will lead to a fire-induced plant initiator, or that is needed to respond to such an initiator (including equipment subject to fire-induced spurious actuation that affects the plant response).

The number of spurious actuations to be addressed increases according to the significance of the consequence (e.g., interfacing systems LOCA).

Instrumentation and support equipment are included.

Cable Selection Cables that are required to support the operation of fire PRA equipment (defined in the equipment selection element) are identified and located.

Qualitative Screening (Optional Element)

Screened out physical analysis units represent negligible contributions to risk and are considered no further.

Fire PRA Plant Response Model Based upon the internal events PRA, the logic model is adjusted to add new fire-induced initiating events and modified or new accident sequences, operator actions, and accident progressions (in particular those from spurious actuations).

Inapplicable aspects of the internal events PRA model are bypassed.

Fire Scenario Selection and Analysis Fire scenarios are defined in terms of ignition sources, fire growth and propagation, fire detection, fire suppression, and cables and equipment (targets) damaged by fire.

The effectiveness of various fire protection features and systems is assessed (e.g., fixed suppression systems).

Appropriate fire modeling tools are applied.

The technical basis is established for statistical and empirical models in the context of the fire scenarios (e.g., fire brigade response).

Scenarios involving the fire-induced failure of structural steel are identified and assessed (at least qualitatively).

DRAFT WORK PRODUCT DG-1362, Page 23 Table 5. Summary of Technical Characteristics and Attributes of a Level 1, Internal Fire PRA for the At-Power Operating Mode Element Technical Characteristics and Attributes Fire Ignition Frequencies Frequencies are established for ignition sources and consequently for physical analysis units.

Transient fires should be postulated for all physical analysis units regardless of administrative controls.

Appropriate justification must be provided to use nonnuclear experience to determine fire ignition frequency.

Quantitative Screening Physical analysis units that are screened out from more refined quantitative analysis are retained to establish CDF and LERF/LRF.

Typically, those fire PRA contributions to CDF and LERF/LRF that are established in the quantitative screening phase are conservatively characterized.

Circuit Failure Analysis The conditional probability of occurrence of various circuit failure modes given cable damage from a fire is based upon cable and circuit features.

Postfire Human Reliability Analysis Operator actions and related post-initiator HFEs, conducted both within and outside of the main control room, are addressed.

The effects of fire-specific procedures are identified and incorporated into the plant response model.

Plausible and feasible recovery actions, assessed for the effects of fire, are identified and quantified.

Undesired operator actions resulting from spurious indications are addressed.

Operator actions from the internal events PRA that are retained in the fire PRA are assessed for fire effects.

Fire Risk Quantification For each fire scenario, the fire risk results are quantified by combining the fire ignition frequency, the probability of fire damage and the conditional core damage probability (and CLRP/CLERP) from the fire PRA plant response model Total fire-induced CDF and LERF/LRF are calculated for the plant and significant contributors identified The contribution of quantitatively screened scenarios (from the quantitative screening element) is added to yield the total risk values Seismic Fire Interactions Potential interactions resulting from an earthquake and a resulting fire that might contribute to plant risk are reviewed qualitatively Qualitative assessment verifies that such interactions have been considered and that steps are taken to ensure that the potential risk contributions are mitigated Technical Elements for Level 1, Seismic, At-Power PRA Earthquakes can cause different initiating events than those considered in an internal-event PRA, and can cause simultaneous failures of multiple redundant components, an important common-cause effect that needs to be included in a probabilistic seismic analysis. All possible levels of earthquakes along with their frequencies of occurrence and consequential damage to plant systems and components are considered in a probabilistic seismic analysis. This Section identifies the technical elements for a Level 1, seismic, at-power PRA. The objective for each technical element is briefly described and the

DRAFT WORK PRODUCT DG-1362, Page 24 characteristics and attributes needed to achieve the objective are provided in the subsequent table. The technical elements for a Level 1, seismic, at-power PRA are:

Seismic hazard analysis Seismic fragility analysis Seismic Plant response analysis Seismic Hazard Analysis is used to express the seismic hazard in terms of the frequency of exceedance for selected ground motion parameters during a specified time interval using a site-specific probabilistic hazard analysis that incorporates the available recent site-specific information and uses up-to-date databases. The analysis involves identification of earthquake sources, evaluation of the regional earthquake history, and an estimate of the intensity of the earthquake-induced ground motion at the site.

At most sites the objective is to estimate the probability or frequency of exceeding different levels of vibratory ground motion. However, in some cases other seismic hazards are included, such as fault displacement, soil liquefaction, soil settlement, and earthquake-induced external flood. For all the various hazards the objective is to estimate the probability or frequency of the hazard as a function of its intensity.

The complexity of the hazard analysis depends on the complexity of the seismic situation at the site, as well as the ultimate intended use of the seismic PRA. Where no prior study exists, the site-specific probabilistic seismic hazard needs to be generated, however, in many cases an existing study can be used for a site-specific assessment. In a probabilistic seismic hazard analysis, an essential part of the methodology is the consideration of both aleatory and epistemic uncertainties, and typically results in generating a set of hazard curves, defined at specified fractile (confidence) levels and a mean hazard curve.

Seismic Fragility Analysis estimates the conditional probability of SSC failures at a given value of a seismic motion parameter such as peak ground acceleration, peak spectral acceleration, floor spectral acceleration, etc. Seismic fragilities used in a seismic PRA are expected to be realistic and plant-specific based on actual current conditions of the SSCs in the plant, as confirmed through a detailed walkdown of the plant. The fragilities of all the systems modeled in the accident sequences are included.

Seismic Plant Response Analysis calculates the frequencies of severe core damage and radioactive release to the environment by combining the plant logic model with component fragilities and seismic hazard estimates. The analysis is usually carried out by using the internal events PRA model as the foundation and adding basic events relating to seismically-induced failures of SSCs to the internal events PRA model. Additionally, SSCs are introduced that are uniquely applicable to seismic risk (e.g.,

relays) and some parts of the internal events PRA model that do not apply or that can be screened out based on the impact on the base seismic PRA are eliminated. For example, recovery of offsite power is highly unlikely after a large earthquake and therefore parts of the internal events model related to offsite power recovery can often be eliminated. Further screening of out of low-probability, non-seismic failures and human-error events may also be possible, although significant non-seismic failures and human errors must be included. Therefore the seismic PRA model is usually adapted from the internal events, at-power PRA model to incorporate unique seismic related aspects that are different from the at-power, internal events PRA model. In some cases, instead of starting with the internal events model and adapting it, a special seismic model is created from scratch. In this case it is especially important to check for consistency with the internal events model regarding plant response and the cause-effect relationships of the failures. In any case, the seismic PRA model includes all significant seismic causes initiating events and seismic induced SSC failures, as well as significant non-seismic failures and human errors. The model reflects the as-built and as-operated plant.

In meeting the technical characteristics and attributes for the seismic portion of an external hazard PRA, a seismic margins method is not considered to be an acceptable approach because a seismic margins

DRAFT WORK PRODUCT DG-1362, Page 25 method does not define and quantify seismically-induced accident sequences. Table 7 provides a summary of the characteristics and attributes needed for the technical elements for a seismic event analysis.

Table 7. Summary of Technical Characteristics and Attributes of a Level 1, Seismic PRA for the At-Power Operating Mode Element Technical Characteristics and Attributes Probabilistic Seismic Analysis Seismic hazard analysis establishes the frequency of earthquakes at the site site-specific examines all credible sources of damaging earthquakes includes current information based on comprehensive data, including geological, seismological, and geophysical data local site topography historical information reflects the composite distribution of the informed technical community.

level of analysis depends on application and site complexity Aleatory and epistemic uncertainties in the hazard analysis (in characterizing the seismic sources and the ground motion propagation) properly accounted for fully propagated allow estimates of fractile hazard curves, median and mean hazard curves, uniform hazard response spectra Spectral shape used in the seismic PRA based on a site-specific evaluation broad-band, smooth spectral shapes for lower-seismicity sites acceptable if shown to be appropriate for the site uniform hazard response spectra acceptable if it reflects the site-specific shape Need to assess whether for the specific application, other seismic hazards need to be included in the seismic PRA, such as fault displacement landslide, soil liquefaction soil settlement Seismic Fragility Analysis Seismic fragility estimate plant-specific realistic includes all systems that participate in accident sequences included in the seismic-PRA systems model basis for screening of high capacity components is fully described Seismic fragility evaluation performed for critical SSCs based on review of plant design documents earthquake experience data fragility test data generic qualification test data (use is justified) analytical approaches using plant-and location-specific seismic demand information

DRAFT WORK PRODUCT DG-1362, Page 26 Table 7. Summary of Technical Characteristics and Attributes of a Level 1, Seismic PRA for the At-Power Operating Mode Element Technical Characteristics and Attributes walkdowns walkdowns focus on as-built and as-operated plant configuration, including:

anchorage lateral seismic support potential systems interactions Seismic Plant Response Analysis The seismic PRA models include seismic-caused initiating events seismically induced SSC failures nonseismically induced unavailabilities, other significant failures (including human errors) that can lead to CDF or LERF The seismic PRA models adapted to incorporate seismic-analysis aspects that are different from corresponding aspects found in the at-power, internal events PRA model reflects the as-built and as-operated plant being analyzed Quantification of CDF and LERF integrates the seismic hazard the seismic fragilities the systems analysis Technical Elements for Screening and Conservative Analysis of Other Hazards or Events for Level 1, At-Power PRA Screening methods can often be employed to show that the contribution of many other hazards or other events (e.g., initiating events, accidents sequences) to CDF and/or LERF/LRF is insignificant. The fundamental criteria that have been recognized for screening out are the following: an event can be screened out either (1) if it meets the criteria in the NRCs 1975 Standard Review Plan (SRP) or a later revision; or (2) if it can be shown using a demonstrably conservative analysis that the mean value of the design-basis hazard used in the plant design is less than 10-5 per year and that the conditional core damage probability is less than 10-1, given the occurrence of the design-basis-hazard event; or (3) if it can be shown using a demonstrably conservative analysis that the CDF is less than 10-6 per year. It is recognized that for those new reactor designs with substantially lower risk profiles (e.g., internal events CDF below 10-6 per year), the quantitative screening value should be adjusted according to the relative baseline risk value.

Screening and Conservative Analysis is usually the first task an analyst performs when conducting an other hazards PRA. All natural hazards and man-made events that apply to the site under consideration are first identified. Appendix D provides a list of hazards that need to be addressed and may be eliminated from a detailed PRA if they can be screened out based on the screening criteria defined above. A preliminary screening, using a defined set of screening criteria, is used to eliminate events matching the criteria from further consideration. Further screening can be performed by using a bounding or demonstrably conservative analysis with defined quantitative screening criteria to demonstrate that the risk from some external events is sufficiently low to eliminate them from additional consideration.

Walkdowns of the plant site and plant buildings are used to confirm the assumptions used for the screening basis. For some risk-informed applications, the validity of the assumptions used to screen out a hazard from the base PRA may need to be examined and confirmed by the staff.

DRAFT WORK PRODUCT DG-1362, Page 27 Table 6 summarizes the characteristics and attributes needed for the technical elements of a hazard screening analysis.

Table 6. Summary of Technical Characteristics and Attributes of Screening and Conservative Analysis of Other Hazard Element Technical Characteristics and Attributes Screening and Conservative Analysis All potential external events that can affect the site identified.

Preliminary screening performed using a defined set of criteria.

Bounding or conservative analysis performed using defined quantitative screening criteria.

Basis for screening confirmed with walkdown.

Technical Elements for Level 1, High Wind, At-Power PRA Screening methods can often be used to show that the contribution of high wind to CDF and/or LERF/LRF is insignificant. The considerations in this section apply to those high wind phenomena that have not been screened out. The types of high wind events that need to be considered in the analysis are site dependent. These can include tornados and their effects, cyclones, hurricanes, and typhoons, as well as thunderstorms, squall lines, and other weather fronts. It is assumed that the high wind PRA is based on modifications made to an existing up-to-date internal events, at-power Level 1 and Level 2 /LERF PRA.

The technical elements for a high wind PRA are similar to those for a seismic PRA. This Section identifies the technical elements for a Level 1, high wind, at-power PRA. The objective for each technical element is briefly described and the characteristics and attributes needed to achieve the objective are provided in the subsequent table. The technical elements for a Level 1, high wind, at-power PRA are:

high wind hazards analysis high wind fragility analysis high wind plant response analysis High Wind Hazard Analysis estimates the frequency of high wind at the site using a site-specific probabilistic wind hazard analysis that incorporates the available recent regional and site-specific information and uses up-to-date databases. Uncertainties in the models and parameter values are properly accounted for and fully propagated to allow the derivation of a mean hazard curve from the family of hazard curves obtained.

High Wind Fragility Analysis is an evaluation that is performed to estimate plant-specific, realistic wind fragilities for those structures, or systems, or components (or their combination) whose failure contributes to core damage or large early release.

High Wind Plant Response Analysis uses a high wind PRA systems model that includes all significant high wind-caused initiating events and other failures that can lead to core damage or large early release. The model is adapted from the internal events, at-power PRA model to incorporate unique high wind analysis aspects that are different from the at-power, internal events PRA model.

Table 8 summarizes the characteristics and attributes needed for the technical elements of a high wind analysis.

DRAFT WORK PRODUCT DG-1362, Page 28 Table 8. Summary of Technical Characteristics and Attributes of a Level 1, High Wind PRA for the At-Power Operating Mode Element Technical Characteristics and Attributes High Wind Hazard Analysis Probabilistic wind hazard analysis results in frequency of high wind at the site based on site-specific data reflects recent information Uncertainties in the models and parameter values properly accounted for fully propagated allow estimate of mean hazard curve High Wind Fragility Analysis Wind fragility estimate plant-specific, realistic all SSCs whose failure contributes to core damage or large early release included High Wind Plant Response Analysis Wind PRA model includes all significant wind-caused initiating events includes other significant failures (both those that are wind-caused and those that are random failures) that can lead to CDF or LERF/LRF.

adapted from the internal events, at-power PRA model incorporates unique wind-analysis aspects that are different from the at-power, internal events PRA model.

Technical Elements for Level 1, External Flood, At-Power PRA Screening methods can often be employed to show that the contribution of some external flood events to core damage frequency and/or large release frequency is insignificant. The considerations in this section apply to those flood phenomena that have not been screened out. The analysis of how the flood pathways and water levels cause the failure of SSCs following ingress into the plant structures is similar to the analysis in the internal flood PRA. The technical elements for an external flood PRA are similar to those for an internal flood PRA and seismic PRA. The types of external flood phenomena that need to be considered in the analysis are dependent on the site. Both natural phenomena, such as river or lake flooding, ocean flooding from high tides or storm surges, unusually high precipitation, tsunamis, seiches, etc., as well as man-made events such as failures of dams, levees, and dikes, are considered. It is assumed that the external flood PRA is based on modifications made to an existing up-to-date internal events, at-power PRA. This Section identifies the technical elements for a Level 1, external flood, at-power PRA. The objective for each technical element is briefly described and the characteristics and attributes needed to achieve the objective are provided in the subsequent table. The technical elements for a Level 1, external flood, at-power PRA are:

external flood hazard analysis external flood fragility analysis external flood plant response analysis External Flood Hazard Analysis estimates the frequency of external flood at the site using a site-specific probabilistic hazard analysis that incorporates the available recent site-specific information and uses up-to-date databases. Uncertainties in the models and parameter values are properly accounted for and fully propagated to allow the derivation of a mean hazard curve from the family of hazard curves obtained.

DRAFT WORK PRODUCT DG-1362, Page 29 External Flood Fragility Analysis is an evaluation that is performed to estimate plant-specific, realistic flood fragilities for those structures, or systems, or components (or their combination) whose failure contributes to core damage or large early release.

External Flood Plant Response Analysis uses an external flood PRA model that includes all significant flood-caused initiating events and other failures that can lead to core damage or large early release. The model is adapted from the internal events, at-power PRA model to incorporate unique flood-analysis aspects that are different from the at-power, internal events PRA model.

Table 9 summarizes the characteristics and attributes needed for the technical elements of an external flood analysis.

Table 9. Summary of Technical Characteristics and Attributes of a Level 1, External Flood PRA for the At-Power Operating Mode Element Technical Characteristics and Attributes External Flood Hazard Analysis Probabilistic flood hazard analysis results in frequency of external flood at the site based on site-specific data reflects recent information Uncertainties in the models and parameter values properly accounted for fully propagated allow estimate of mean hazard curve External Flood Fragility Analysis Flood fragility estimate plant-specific, realistic all SSCs whose failure contributes to core damage or large early release included External Flood Plant Response Analysis External flood PRA model includes all significant flood-caused initiating events includes other significant failures (both those that are caused by the flood and those that are random failures) that can lead to CDF or LERF/LRF adapted from the internal events, at-power PRA model incorporates unique flood-analysis aspects that are different from the at-power, internal events PRA model.

Technical Elements for Level 1, Other Hazards, At-Power PRA Screening methods can often be employed to show that the contribution of many other hazards to CDF and/or LERF/LRF is insignificant. The considerations in this section apply to those other hazards (provided in Appendix D) that have not been screened out. Therefore, this set of technical elements applies to the development of a detailed PRA for a hazard group other than the internal events, internal flood, internal fire, seismic, high wind, or external flood hazard groups (i.e., other hazards). It should be noted that because of the limited collective experience of the analysis community in the area of other hazards PRA, an extensive peer review is particularly important for such a PRA. This Section identifies the technical elements for a Level 1, other hazards, at-power PRA. The objective for each technical element is briefly described and the characteristics and attributes needed to achieve the objective are provided in the subsequent table. The technical elements for a Level 1, other hazards, at-power PRA are:

DRAFT WORK PRODUCT DG-1362, Page 30 other hazard analysis other hazard fragility analysis other hazard plant response analysis Other Hazard Analysis establishes the frequency of occurrence of different intensities of the hazard being analyzed and uses a site-specific probabilistic evaluation that is based on recent available data and site-specific information. Historical data or a phenomenological model, or a mixture of the two is used in the analysis.

Other Hazard Fragility Analysis is an evaluation that is performed to estimate the fragility or vulnerability of a structure, or system, or component (or their combination) whose failure contributes to core damage or large early release (or large release). The fragility analysis uses plant-specific information and an accepted engineering method for evaluating failures.

Other Hazard Plant Response Analysis uses a model that includes all important initiating events and other important failures caused by the effects of the hazard that can lead to core damage or large early release (or large release). The model is adapted from the internal events, at-power PRA model to incorporate unique aspects related to the hazard analyzed that are different from the at-power, internal events PRA model.

Table 10 summarizes the characteristics and attributes needed for the technical elements of other hazards analysis.

Table 10. Summary of Technical Characteristics and Attributes of a Level 1, Other Hazard PRA for the At-Power Operating Mode Element Technical Characteristics and Attributes Other Hazard Analysis Hazard analysis results in frequency of occurrence of hazard at the site based on site-specific data reflects recent information uses historical data or a phenomenological model, or a mixture of the two Other Hazard Fragility Analysis Fragility estimate plant-specific, SSC-specific information uses accepted engineering methods Other Hazard Plant Response Analysis Hazard model includes all important initiating events related to hazard analyzed includes other significant failures (both those that are caused by the external hazard and those that are not) that can lead to CDF or LERF/LRF adapted from the internal events, at-power PRA model incorporates unique aspects related to hazard analyzed that are different from the at-power, internal events PRA model.

Technical Elements for Level 1 and Level 2 Low-Power and Shutdown PRA The objectives of the technical elements for a Level 1 or Level 2 low-power and shutdown PRA are similar to the objectives of the technical elements for a Level 1, internal events, at-power PRA and a Level 2, internal events PRA, as described in sections C.1.2.1 and C.1.2.2, respectively. Table 11

DRAFT WORK PRODUCT DG-1362, Page 31 provides the technical characteristics and attributes needed for accomplishing the objectives of the technical elements, with respect to a Level 1 or Level 2 low-power and shutdown PRA.

Table 11. Summary of Technical Characteristics and Attributes of a Level 1 and Level 2, Internal Events PRA for the Low Power and Shutdown Operating Modes Element Technical Characteristic and Attributes Level 1 Internal Events Plant Operating States The Level 1 PRA involves identification and characterization of a set of plant operational states during LPSD operations that are representative of all the plant states not covered in the full-power PRA The LPSD evolution is divided into POSs based on the unique impact on plant response to facilitate the practicality and efficiency of the PRA Each LPSD POS required to be considered for the specific application is identified and characterized as to all important conditions affecting the delineation and evaluation of core damage and large early release The conditions include decay heat level, reactor coolant system configuration, reactor level, pressure and temperature, containment configuration, and the assumed representative plant system configurations within the POS LPSD POSs that are subsumed into each other are shown to be represented by the characteristics of the subsuming group The duration and number of entries into each POS are determined The development, grouping, and quantification of the POSs are documented in a manner that facilitates PRA applications, upgrades, and peer review Initiating Event Analysis The initiating event analysis includes the same characteristics and attributes as for at-power, as well as the following:

examination of human-induced initiating events, for example, those resulting from maintenance activities, including different types of LOCAs (e.g., drain-down events as opposed to pipe breaks) review of plant operational practices in grouping of events Success Criteria Analysis The success criteria analysis includes the same characteristics and attributes as for at-power, as well as an analysis appropriate to the POS definition and characterization Accident Sequence Development Analysis The accident sequence development analysis includes the same characteristics and attributes as for at-power, as well as an accounting for changing plant conditions within a POS Systems Analysis The systems analysis includes the same characteristics and attributes as for at-power, as well as the identification of conditions varying from one POS to another for spatial and environmental hazards, systems actuation signals, system inventories (e.g., air)

Parameter Estimation Analysis The parameter estimation analysis includes the same characteristics and attributes as for at-power, as well as the following:

performance of estimation on a POS-specific basis, when necessary consideration of plant-specific data unique to POS (i.e., not applicable to at-power)

Human Reliability Analysis The human reliability analysis includes the same characteristics and attributes as for at-power, as well as the following:

DRAFT WORK PRODUCT DG-1362, Page 32 Table 11. Summary of Technical Characteristics and Attributes of a Level 1 and Level 2, Internal Events PRA for the Low Power and Shutdown Operating Modes Element Technical Characteristic and Attributes differentiation between calibration errors that may impact equipment performance at-power versus low-power and shutdown POSs increased emphasis on contributions to initiating events performance of the analysis on a POS basis identification of dependent human failure events, particularly between those resulting in initiating events and those associated with responses to the initiating events justification for credit of operator actions credited for recovery in slowly developing scenarios (e.g., recovery times greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />)

Quantification Quantification includes the same characteristics and attributes for at-power, as well as the estimation of CDF and LERF/LRF for each POS Level 2 Internal Events Plant Damage State Analysis The plant damage state analysis includes the same characteristics and attributes as for at-power Severe Accident Progression Analysis The severe accident progression analysis includes the same characteristics and attributes as for at-power, as well as the following:

estimation of containment capacity based on the capacity of temporary closure, although for some POSs, containment may be open or have a reduced pressure capability assessment of the feasibility of the ability of operators to close containment before (1) adverse environmental conditions (e.g., temperature, radiation, humidity, noise) prevent closure or (2) core cooling is impacted Quantification Quantification includes the same characteristics and attributes as for at-power.

Source Term Analysis The source term analysis includes the same characteristics and attributes as for at-power.

NOTE:

(1) For low-power and shutdown conditions, the following characteristics and attributes are also needed:

verification of temporary alignments for the specific outage or average modeled outage for data collection identification of existing flood barriers that may be impaired or disabled that could impact the flood zone consideration of automatic responses that may differ from at-power conditions identification of fire barriers that may be breached that could impact fire propagation between fire areas and fire zones.

Technical Elements for Interpretation of Results (Including Uncertainty Analysis)

The results of the Level 1 PRA are examined to identify the contributors sorted by hazard group, initiating events (e.g., transients, LOCAs) or specific hazard plant damage states (e.g., fire scenarios, internal flood scenarios, seismic plant damage states), accident sequences, equipment failures, and human errors. Methods such as importance measure calculations (e.g., Fussell-Vesely Importance, risk achievement worth, risk reduction worth, and Birnbaum Importance) are used to identify the contributions of various events to the estimation of CDF for both individual sequences and the total CDF [i.e., both contributors to the total CDF, including the contribution from the different hazard groups and different operating modes (i.e., full-and low-power and shutdown) and contributors to each contributing sequence are identified].

DRAFT WORK PRODUCT DG-1362, Page 33 The results of the Level 2 PRA are examined to identify the contributors (e.g., containment failure mode, physical phenomena) to the model estimation of LERF or LRF for both individual sequences and the model as a whole, using such tools as importance measure calculations (e.g., Fussell-Vesely Importance, risk achievement worth, risk reduction worth, and Birnbaum Importance).

For many applications, it is necessary to combine the PRA results from different hazard groups (e.g., from internal events, internal fire, and seismic events). For this reason, an important aspect in interpreting the PRA results is understanding both the level of detail associated with the modeling of each of the hazard groups, and the hazard group-specific model uncertainties. With respect to the level of detail, for example, the analysis of specific scope items such as internal fire, internal flood, or seismic events typically involves a successive screening approach, so that more detailed analysis can focus on the more significant contributions. The potential conservatism associated with the evaluation of the less significant contributors using this approach is assessed for each hazard group.

In addition, each of the hazard groups has unique sources of uncertainty which can influence the insights derived from the quantified PRA model. These sources can be a result from the parameter values used to quantify the PRA or from the models used to reflect the phenomena associated with the accident progression delineated in the PRA. The impact of parameter uncertainties on the quantitative results is assessed. Uncertainty and sensitivity analyses identify and characterize sources of uncertainty as well as the potential sensitivities of the results to related assumptions and modeling approximations.

Assumptions related to the sources of model uncertainty and any conservatisms introduced by the analysis approaches can bias the assessment of importance measures with respect to the combined risk assessment and the relative contributions of the hazard groups to the various risk metrics. Therefore, the sources of model uncertainty are identified and their impact on the results analyzed for each hazard group individually, so that, when it is necessary to combine the PRA results, the overall results can be characterized appropriately. The sensitivity of the model results to key assumptions and sources of uncertainty from modeling assumptions, model boundary conditions, and other assumptions is evaluated.

Such evaluations should include sensitivity analyses to look at assumptions both individually and in logical combinations. The combinations analyzed are chosen to account for interactions among the variables. NUREG-1855 provides guidance on the treatment of uncertainties associated with PRA as well as guidelines regarding defining, identifying, and characterizing different sources of uncertainty.

Table 12 summarizes the characteristics and attributes needed for the technical elements of interpretation of results.

Table 12. Summary of Technical Characteristics and Attributes for Interpretation of Level 1 and Level 2 PRA Results Element Technical Characteristics and Attributes Level 1 PRA Interpretation of Results Identification of the significant contributors to CDF (hazard groups, initiating events, specific hazard plant damage states, accident sequences, equipment failures and human errors)

Identification of sources of uncertainty and their potential impact on the PRA model Understanding of the impact of the assumptions on the CDF and the identification of the accident sequence and their contributors Level 2 PRA

DRAFT WORK PRODUCT DG-1362, Page 34 Interpretation of Results Identification of the contributors to containment failure, resulting source terms, LERF and LRF Identification of sources of uncertainty and their impact on the PRA model Understanding of the impact of the assumptions on Level 2 results Technical Elements for PRA Documentation The documentation of the PRA model needs to provide the necessary information so that the results can easily be reproduced and justified. The sources of information used in the PRA also need to be referenced and retrievable. The methodology used to perform each aspect of the work is described either through documenting the actual process in the PRA documentation, or through reference to existing methodology documents. Sources of uncertainty (both parameter and model) are identified and their impact on the results are assessed generally for each technical element. A source of model uncertainty is one that is related to an issue for which there is no consensus approach or model (e.g., choice of data source, success criteria, reactor coolant pressure seal LOCA model, human reliability model). A key source of uncertainty is where the choice of approach or model is known to have an impact on the PRA results in terms of introducing new accident sequences, changing the relative importance of sequences, or significantly affecting the overall CDF, LERF, or LRF estimates that might have an impact on the use of the PRA in decision-making. Assumptions made in performing the analyses are identified and documented along with their justification to the extent that the context of the assumption is understood.

The results (e.g., products and outcomes) from the various analyses are documented.

Table 13 summarizes the characteristics and attributes needed for documentation for each hazard group and associated technical elements.

Table 13. Summary of Technical Characteristics and Attributes for PRA Documentation Element Technical Characteristics and Attributes Traceability and Justification The documentation is sufficient to facilitate independent peer reviews.

The documentation describes the interim results (sufficient to provide traceability and defensibility of the final results) and the final results, insights, and sources of uncertainties.

Walkdown process, where applicable, and results are fully described.

1.3 Level of Detail of a Base PRA For each given technical element, the level of detail modeled in the base PRA may vary. The detail may vary from the degree to which (1) plant design and operation is modeled, (2) specific plant experience is incorporated into the model, and (3) realism is incorporated into the analyses that reflect the expected plant response. Regardless of the level of detail developed in the base PRA, the technical characteristics and attributes need to be addressed. That is, each characteristic and attribute is always addressed, but the degree to which it is addressed may vary. In general, the level of detail for the base PRA needs to be consistent with current good practice3.

The level of detail needed in a PRA that supports a risk-informed decision is dependent on the application. The application may involve using the PRA during different plant stages (i.e., design, construction, and operation). Consequently, a PRA used to support a design certification will not have the same level of detail as a PRA of a plant that has several years of operating experience. While it is 3

The glossary in this regulatory guide provides a definition of the term current good practice.

DRAFT WORK PRODUCT DG-1362, Page 35 recognized that the level of detail may vary depending on the application, each of the technical elements and its attributes need to be addressed.

1.4 Plant Representation and PRA Configuration Control The PRA results used to support an application are derived from a base PRA model, the latter of which represents the as-designed, as-built, and as-operated plant to the extent needed to support the application. A PRA application is a documented analysis based in part or whole on a plant-specific PRA that is used to assist in decision making with regard to the design, licensing, procurement, construction, operation, or maintenance of a nuclear power plant. In the context of regulatory activities, an application includes the use of PRA results to support decisions related to any regulated activity regardless of whether the NRC or the licensee makes the decision. Therefore, a process for developing, maintaining, and upgrading an acceptable base PRA is established. This process involves identifying and using plant information to develop and modify the base PRA whenever changes to the plant require changes to the base PRA. The licensee will consider the cumulative impact of those plant changes or PRA model improvements, as needed, on the results of the PRA and applications being performed between any periodic update of the PRA; changes that would impact risk-informed decisions are addressed in the context of the application or implemented prior to the application. The process is performed such that the plant information identified and used in the base PRA reflects the as-designed, as-built, and as-operated plant and is as realistic as possible in assessing the risk. The information sources include the applicable design, operation, maintenance, and engineering characteristics of the plant.

For those SSCs and human actions used in the development of the base PRA, the following information is identified, integrated, and used in the base PRA:

plant design information reflecting the normal and emergency configurations of the plant plant operational information with regard to plant procedures and practices plant test and maintenance procedures and practices engineering aspects of the plant design Further, plant walkdowns are conducted to ensure that information sources being used actually reflect the plants as-built and as-operated condition. In some cases, corroborating information obtained from the documented information sources for the plant and other information may only be gained by direct observations. It is recognized that at the design and initial licensing stages, plant walkdowns are not possible.

Table 14 describes the technical characteristics and attributes needed to for the above types of information.

DRAFT WORK PRODUCT DG-1362, Page 36 Table 14. Summary of Technical Characteristics and Attributes for Information Sources Used in the Base PRA Development Type of Information Characteristics and attributes (See Note)

Design The safety functions required to maintain the plant in a safe stable state and prevent core or containment damage Identification of those SSCs that are credited in the base PRA to perform the above functions The functional relationships among the SSCs including both functional and hardware dependencies The normal and emergency configurations of the SSCs The automatic and manual (human interface) aspects of equipment initiation, actuation, operation, as well as isolation and termination The SSCs capabilities (flows, pressures, actuation timing, environmental operating limits)

Spatial layout, sizing, and accessibility information related to the credited SSCs Other design information needed to support the base PRA modeling of the plant Operational That information needed to reflect the actual operating procedures and practices used at the plant including when and how operators interface with plant equipment as well as how plant staff monitor equipment operation and status That information needed to reflect the operating history of the plant as well as any events involving significant human interaction Maintenance That information needed to reflect planned and typical unplanned tests and maintenance activities and their relationship to the status, timing, and duration of the availability of equipment Historical information related to the maintenance practices and experience at the plant Engineering The design margins in the capabilities of the SSCs Operating environmental limits of the equipment Expected thermal hydraulic plant response to different states of equipment (such as for establishing success criteria)

Other engineering information needed to support the base PRA modeling of the plant It is recognized that for reactors in the design or construction stage, the level of operational and maintenance information may vary.

As a plant operates over time, its associated risk may change. This change may occur for the following reasons:

Operating data may change the availability or reliability of the plants structures, systems, and components.

Plant design or operation may change.

The PRA model may change as a result of improved methods or techniques.

Therefore, to ensure the base PRA represents the risk of the current as-built and as-operated plant, the base PRA needs to be maintained and upgraded over time. Table 15 provides the characteristics and attributes needed for an acceptable process for maintaining and upgrading the base PRA. In addition, Appendix C provides guidance on whether the change to the PRA model is to be considered PRA maintenance or a PRA upgrade.

DRAFT WORK PRODUCT DG-1362, Page 37 Table 15. Summary of Technical Characteristics and Attributes for a PRA Configuration Control Process Characteristics and Attributes Monitor PRA inputs and collect new information Ensure cumulative impact of pending plant changes are considered Maintain configuration control of the computer codes used in the base PRA Identify when the base PRA model needs to be updated based on new information or new models/techniques/tools Ensure peer review is performed on PRA upgrades

2.

Consensus PRA Standards and Industry PRA Programs One acceptable approach to demonstrate conformance with Regulatory Position C.1 is to use a national consensus PRA standard or standards that address the scope of the base PRA. ASME and ANS have issued the ASME/ANS Level 1/LERF PRA standard, ASME/ANS RA-Sa-2009, which provides process and technical requirements for an at-power, Level 1 and limited Level 2 LWR PRA for internal hazards (i.e., internal events, internal floods, and internal fire), and external hazards (i.e., seismic, high wind, external flood and other external events) (Ref. 27). ASME and ANS have also issued ASME/ANS RA-S Case 1, which provides a proposed alternative set of requirements related to the requirements for seismic PRA in Part 5 of the ASME/ANS Level 1/LERF PRA standard (Ref. 21). These consensus PRA standards establish requirements for what an acceptable base PRA needs to include, including acceptable process requirements; however, these PRA standards do not address how to meet the requirements for an acceptable PRA. It is important to note that the minimum requirements in the consensus PRA standards are not regulatory requirements. Similarly, reference to and use of the term requirement in this RG should not be construed as relating to a regulatory requirement unless specifically referred to as such.

Regulatory Position C.2.1 of this regulatory guide provides the staff position on the use of a national consensus PRA standard to meet Regulatory Position C.1. To demonstrate acceptability of the PRA, a peer review is needed to determine if the intent of the requirements in the consensus PRA standard is met so that it can be demonstrated that the base PRA model is in conformance with Regulatory Position C.1. Regulatory Position C.2.2 of this regulatory guide provides the staff position on the use of PRA peer reviews to this effect, including staff endorsement of related industry PRA peer review guidance. When the peer review accounts for Regulatory Position C.2.2 and the PRA is assessed against a consensus PRA standard consistent with Regulatory Positions C.1 and C.2.1, the PRA is considered to be acceptable for supporting that risk-informed regulatory application.

2.1 Consensus PRA Standards In general, if a consensus PRA standard is used to demonstrate conformance with Regulatory Position C.1, the consensus PRA standard should be based on a predetermined set of principles and objectives. Table 16 provides an acceptable set of principles and objectives that were established and used by ASME and ANS in development of their PRA standards. Principle 3 recognizes that the technical requirements of a PRA can be, and generally are, performed to different capabilities. In developing the various models in the PRA, the different capabilities are distinguished by three attributes, determined by the degree to which the following criteria are met:

The scope and level of detail that reflects the plant design, operation, and maintenance.

The use of plant-specific information versus generic information to represent the as-designed, as-built and as-operated plant.

DRAFT WORK PRODUCT DG-1362, Page 38 The degree of realism that is incorporated into the base PRA model to reflect the expected response of the plant.

Table 16. Principles and Objectives of a Consensus PRA Standard

1. The PRA standard provides well-defined criteria against which the strengths and weaknesses of the PRA may be judged so that decision-makers can determine the degree of reliance that can be placed on the PRA results of interest.

2. The standard is based on current good practices as reflected in publicly available documents. The need for the documentation to be publicly available follows from the fact that the standard may be used to support safety decisions.

3. To facilitate the use of the standard for a wide range of applications, categories can be defined to aid in determining the applicability of the PRA for various types of applications.

4. The standard thoroughly and completely defines what is technically required and should, where appropriate, identify one or more acceptable methods.

5. The standard requires a peer review process that identifies and assesses where the technical requirements of the standard are not met. The standard needs to ensure that the peer review process meets the following criteria:

determines whether methods identified in the standard have been used appropriately determines that, when acceptable methods are not specified in the standard, or when alternative methods are used in lieu of those identified in the standard, the methods used are adequate to meet the requirements of the standard assesses the significance of the results and insights gained from the PRA of not meeting the technical requirements in the standard highlights assumptions that may significantly impact the results and provides an assessment of the reasonableness of the assumptions is flexible and accommodates alternative peer review approaches includes a peer review team that is composed of members who are knowledgeable in the technical elements of a PRA, are familiar with the plant design and operation, and are independent with no conflicts of interest that may influence the outcome of the peer review

[this clause was not in the ASME definition]

6. The standard addresses the maintenance and update of the PRA to incorporate changes that can substantially impact the risk profile so that the PRA adequately represents the current as-designed

[added], as-built and as-operated plant.

7. The standard is a living document. Consequently, it should not impede research. It is structured so that, when improvements in the state of knowledge occur, the standard can easily be updated.

It is recognized that a PRA may not satisfy each technical requirement to the same degree (i.e., capability category as used in an ASME/ANS PRA standard); that is, the capability category achieved for the different technical requirements may vary. This variation can range from (1) the minimum needed to meet the characteristics and attributes for each technical element to (2) the minimum to meet current good practice (i.e., state-of-practice) for each technical element. Further, which capability category is needed to be met for each technical requirement is dependent on the specific application. In general, the staff anticipates that current good practice (i.e., Capability Category II of an ASME/ANS

DRAFT WORK PRODUCT DG-1362, Page 39 PRA standard) is the level of detail that is acceptable for the majority of applications. However, for some applications, Capability Category I may be acceptable for some requirements. There may be other situations where the state-of-practice is not acceptable for a specific application. For example, it is not state-of-practice to include pipe failures in a base PRA model; however, for changes to inservice inspection and pressure boundary repair and replacement requirements, inclusion of pipe failures is needed. Therefore, it cannot be assumed that the state-of-practice is acceptable for every risk-informed application.

The requirements in an ASME/ANS PRA standard are either process-related or are technical in nature. The process-related requirements address the process for application, development, maintenance and upgrade, and peer review. The technical requirements address the technical elements of the PRA and what is necessary to adequately perform that element.

For process requirements, the intent is generally straightforward and the requirement is either met or not met. For the technical requirements, it is not always as straightforward. Many of the technical requirements in an ASME/ANS PRA standard are applied more than once in developing the PRA model.

For example, the requirements for systems analysis in a Level 1, internal events, at-power PRA apply to all systems modeled, and certain data requirements apply to all parameters for which estimates are provided. If among these systems or parameter estimates there are instances where a specific requirement has not been met, it is not necessarily indicative that this requirement has not been met. If the requirement has been met for the majority of the systems or parameter estimates, and the identified instances are understood to be isolated mistakes or oversights, the requirement would be considered to be met. If, however, there is a systematic failure to address the requirement (e.g., component boundaries have not been defined anywhere), then the requirement has not been met. In either case, the instances of noncompliance with the PRA standard requirements are to be (1) rectified or demonstrated not to be relevant to the application and (2) documented.

Further, the technical requirements may be defined at two different levels: (1) high-level requirements and (2) supporting requirements. High-level requirements are defined for each technical element and capture the objective of the technical element. High-level requirements are defined in general terms, need to be met regardless of the capability category, and accommodate different approaches. Supporting requirements are defined for each high-level requirement and are the minimal requirements needed to satisfy the high-level requirement. Consequently, a determination of whether a high-level requirement is met is based on whether the associated supporting requirements are met.

Whether every supporting requirement is needed for a high-level requirement depends on the application and is determined by the application process requirements. All supporting requirements related to newly developed methods are applicable for peer review of newly developed methods.

2.2 Industry Peer Review Program A peer review of the PRA is performed to determine whether the requirements established in the PRA standard, as endorsed by the NRC, have been met. An acceptable peer review approach is one that is performed according to an established process and by qualified personnel and documents the results and identifies both strengths and weaknesses of the PRA. The ASME/ANS Level 1/LERF PRA standard requires a peer review to be performed on the base PRA model, any PRA upgrades, and on the use of any newly developed methods. The ASME/ANS Level 1/LERF PRA standard provides requirements for (1) the establishment of a peer review process, and (2) PRA peer review team qualifications and documentation. A peer review methodology (i.e., process) is documented in the industry-developed peer review program guidance documents (i.e., Refs. 20, 28-31, and 34).

DRAFT WORK PRODUCT DG-1362, Page 40 As stated earlier, the peer review is to be performed against established standards (e.g., the ASME/ANS Level 1/LERF PRA standard). If different criteria are used than those in established PRA standard, then it needs to be demonstrated that these different criteria are consistent with the established PRA standards endorsed by the NRC.

A peer review may be performed on the base PRA model or on a PRA upgrade, which may involve use of a newly developed method, or in the form of an independent assessment reviewing the closure of findings from a peer review. The following sections provide guidance on each of these scenarios.

Peer Review of a Base PRA Model The peer review process includes a documented procedure used to direct the peer review teams evaluation of the acceptability of a base PRA. The review process compares the base PRA against established criteria (e.g., technical requirements defined in a PRA standard that conforms to the PRA characteristics and attributes such as those provided in Regulatory Position C.1.2). In addition to reviewing the methods used in the base PRA, the peer review determines whether the methods were applied correctly. The base PRA models are compared against the plant design and procedures to validate that they reflect the as-designed, or the as-built and as-operated plant. Independent walkdowns are performed to confirm PRA inputs, especially for external hazard PRAs. Assumptions are reviewed to determine if they are appropriate and to assess their impact on the base PRA results. The base PRA results are checked for fidelity with the model structure and for consistency with the results from PRAs for similar plants based on the peer reviewers knowledge. Finally, the peer review process examines the procedures or guidelines established for updating the base PRA to reflect changes in plant design, operation, or experience. The process also needs to provide criteria ensuring that the peer review is current. That is, (1) the peer review needs to address the modifications made to the base PRA since any previous peer reviews, and (2) the peer review needs to address modifications made to the standard since any previous peer reviews.

The team qualifications determine the credibility and adequacy of the peer reviewers. To avoid any perception of a technical conflict of interest, the members of the peer review team will not have performed any work on the base PRA. Each member of the peer review team must have technical expertise in the PRA elements they review, including experience in the specific methods used to develop technical elements of the base PRA. This technical expertise includes experience in performing (not just reviewing) the work in the PRA technical element assigned for review. Knowledge of the key features specific to the plant design and operation is essential.4 Finally, each member of the peer review team needs to be knowledgeable about the peer review process, including the desired characteristics and attributes used to assess the acceptability of the base PRA.

Documentation provides the necessary information to ensure that the peer review process and the findings are traceable, and the bases of the findings are defensible. Descriptions of the qualifications of the peer review team members and the peer review process are documented. The results of the peer review for each technical element and the base PRA update process are described, including the areas in which the base PRA does not meet or exceed the desired characteristics and attributes used in the review process. This includes an assessment of the importance of any identified deficiencies in the base PRA results and how these deficiencies were addressed and resolved.

4 For new reactor designs that have not yet gone into commercial operation, it is recognized that a peer reviewer of the PRA will not have knowledge of plant operation, and familiarity with some plant features (e.g., passive mitigation systems) may be limited. This is not to be construed as a limitation for performing a PRA peer review using personnel who are otherwise qualified and generally familiar with the design and operation of similar plant types (e.g., pressurized-water reactors).

DRAFT WORK PRODUCT DG-1362, Page 41 Table 17 summarizes the characteristics and attributes needed for an acceptable peer review process.

Table 17. Summary of the Characteristics and Attributes of a Peer Review Element Characteristics and Attributes Peer Review Process Uses documented process Uses as a basis for review a set of desired PRA characteristics and attributes Uses a minimum list of review topics to ensure coverage, consistency, and uniformity Reviews PRA methods (newly developed methods, as defined in the Glossary of this regulatory guide, are reviewed against the newly developed methods requirements reference in Section C.2.2.2.2)

Reviews application of methods Reviews assumptions and assesses their validity and appropriateness Determines if PRA represents as-built and as-operated plant Performs independent walkdowns of the plant to confirm PRA inputs Reviews results of each PRA technical element for reasonableness Reviews PRA maintenance and update process Reviews PRA modification attributable to use of different model, techniques, or tools Reviews against modifications to the standard Team Qualifications Independent with no conflicts of interest (i.e., have not performed any work on the base PRA) the peer reviewer is not to assigned an area for review where their current immediate supervisor performed the actual technical analysis Collectively represent expertise in all the technical elements of a base PRA including integration Expertise in the technical element assigned to review Knowledge of the plant design and operation Knowledge of the peer review process Documentation Describes the peer review team qualifications Describes the peer review process Documents where the base PRA does not meet desired characteristics and attributes Assesses and documents significance of deficiencies Documents resolutions of deficiencies sufficient to readily allow implementation of resolutions Describes the scope of the peer review performed (i.e., what was reviewed by the peer review team)

Documents the justification for not reviewing requirements included in the scope of the peer review Any PRA upgrades or newly developed methods Identification of the key assumptions (relative to the base PRA) reviewed and the result of the review Peer Review of PRA Upgrade or of a Newly developed method A peer review is performed on a PRA upgrade, which includes the use of a newly developed method. Appendix C provides the guidance for determining whether a change to the base PRA is a PRA upgrade or a PRA maintenance and, if it is a PRA upgrade, whether the change involves the use of a

DRAFT WORK PRODUCT DG-1362, Page 42 newly developed method. The staff expectations for the peer review of a PRA upgrade are discussed in Section C.2.2.2.1. The staff expectations for the peer review of a newly developed method is discussed in Section C.2.2.2.2.

2.2.2.1 Peer Review of a PRA Upgrade The peer review of a PRA upgrade is a focused-scope peer review in that it only involves reviewing the changes to the PRA model as a result of the upgrade to the PRA model. The glossary in this RG provides a definition for PRA upgrade. A PRA upgrade can include:

Application of a method not previously used in the peer-reviewed plant PRA Implementing a method in a different context Implementing changes that support any supporting requirements previously not reviewed or previously not applicable The peer review for a PRA upgrade uses the related guidance in NEI 17-07, Revision 2.

Section 5.1 of PWROG-19027-NP, Revision 1, provides proposed peer review requirements for Section 1-6 of the ASME/ANS Level 1/LERF PRA standard. The staff reviewed the proposed requirements and conclude that, for a focused-scope peer review, all supporting requirements (SRs) in an high-level requirement (HLR) need to be included in the scope of the focused-scope peer review for an HLR with one or more SRs that received a Finding from the prior peer review.

2.2.2.2 Peer Review of a Newly Developed Method The peer review of a newly developed method assesses whether the newly developed method meets a predetermined set of technical requirements and consequently can be used to support the PRA.

After a newly developed method has been successfully peer reviewed, the newly developed methods implementation into a plant-specific PRA is an upgrade and would need an implementation peer review as summarized in Section C.2.2.2.1 above. The glossary to this RG provides a definition for the term newly developed method and other related terms. Appendix C provides additional discussion about the characteristics and attributes of a newly developed method.

The peer review for a newly developed method needs to use the related guidance in NEI 17-07, Revision 2, to determine whether the peer review is appropriately implemented. The staff expects that, whether it is included in the scope of a broader peer review or is a dedicated focused-scope peer review, the peer review of a newly developed method will meet certain requirements specific to this type of peer review. PWROG-19027-NP, Revision 1, Newly Developed Method Requirements and Peer Review (Ref. 40), provides requirements to this end. The staff endorses the proposed Section 1-7 for the ASME/ANS Level 1/LERF PRA standard as documented in Section 4 of PWROG-19027-NP, Revision 1.

Section 5.2 of PWROG-19027-NP, Revision 1, describes features to be added to a peer review report of a plant PRA that uses newly developed methods and the public availability of newly developed method peer review reports. Section 5.3 of PWROG-19027-NP, Revision 1, provides expectations for the outcome of a peer review of a newly developed method with respect to whether a newly developed method is able to support a PRA. The staff endorse Sections 5.2 and 5.3 of PWROG-19027-NP, Revision 1.

DRAFT WORK PRODUCT DG-1362, Page 43 Facts and Observation Independent Assessment A Facts and Observations (F&O) independent assessment is performed to determine whether the F&Os identified by peer review of the base PRA against a consensus PRA standard (or other comparable peer review) have been appropriately resolved. The F&O independent assessment determines whether the resolution of the F&Os have appropriately resolved the identified deficiency such that the impacted supporting requirements (SRs) in the consensus PRA standard have been met. An acceptable F&O independent assessment approach is one that is performed according to an established process, as endorsed by the NRC, and by qualified personnel and that sufficiently documents the results of the independent assessment. Moreover, in performing an F&O independent assessment, the scope of the independent assessment needs to be identified. The NRC endorses the F&O independent assessment process provided in NEI 17-07, Revision 2, as an acceptable process for meeting Regulatory Position C.2.2.3.

For new reactor designs that have not yet gone into commercial operation, it is recognized that an F&O independent assessment reviewer will not have knowledge of plant operation and familiarity with some plant features (e.g., passive mitigation systems) may be limited. This lack of knowledge is not to be construed as a limitation for performing an F&O independent assessment using personnel who are otherwise qualified and generally familiar with the design and operation of similar plant types (e.g.,

pressurized-water reactors). The ASME/ANS Level 1/LERF PRA standard requires a peer review of the base PRA against the requirements in ASME/ANS Level 1/LERF PRA standard. The ASME/ANS Level 1/LERF PRA standard, however, does not require the PRA owner to resolve the F&Os resulting from the peer review of the base PRA against the ASME/ANS Level 1/LERF PRA standard. An F&O independent assessment methodology (i.e., process) is provided in the industry-developed peer review program guidance document, NEI 17-07, Revision 2. When implementing the guidance in NEI 17-07, Revision 2, consistent with the staffs expectations, use of an F&O independent assessment is acceptable for demonstrating the peer review F&Os have been adequately addressed (i.e., resolved) and the base PRA reflects the resolution of the peer review F&Os. Section 5.1 of PWROG-19027-NP, Revision 1, provides proposed peer review requirements for Section 1-6 of the ASME/ANS Level 1/LERF PRA standard. The staff reviewed the proposed requirements and conclude that documentation of the resolution of a peer review finding needs to describe how the deficiency in the finding was addressed such that it can be easily demonstrated that the associated supporting requirement is met.

The implementation of these staff expectations is intended to provide the needed confidence in the resolution of peer review F&Os against the requirements in the consensus PRA standard such that, when used in support of an application, the staffs need for an in-depth review of the licensees F&O resolutions by NRC reviewers is obviated. This allows the staff to focus their review on key assumptions and areas identified by PRA peer reviewers as being of concern. Consequently, these staff expectations will provide for a more focused and consistent review process. However, the staff may choose to observe an F&O independent review process or audit an F&O independent assessment closure report. Therefore, industry should coordinate with NRC to support NRC observations or audits. The F&O independent assessment is to be performed against an established process accepted by the NRC. If a different process is used other than the accepted process, then it needs to be demonstrated that this different process is consistent with the process, as accepted by the NRC.

NEI 17-07, Revision 2, provides guidance on the conduct and documentation of a PRA peer review, including peer reviews of newly developed methods, follow-on peer reviews, peer reviews of screening and conservative analyses, and the closure of Facts and Observations (F&Os) that result from a peer review. The NRC staff has reviewed NEI 17-07, Revision 2, against the characteristics and attributes for an acceptable PRA peer review process in Regulatory Position C.2.2 through C.2.2.3 with respect to the peer review process for the following:

DRAFT WORK PRODUCT DG-1362, Page 44 a base PRA model a PRA upgrade use of a newly developed method independent assessment for the closure of peer review F&Os The NRC staff endorses NEI 17-07, Revision 2, in its entirety as a means of satisfying the peer review requirements in ASME/ANS RA-Sa-2009, as endorsed by the NRC in Appendix A of this regulatory guide, and for the purpose of meeting Regulatory Position C.2 of this regulatory guide. When the staffs regulatory position in Appendix A on the related peer review requirements are taken into account with the implementation of the guidance in NEI 17-07, Revision 2; a peer review can be used to demonstrate that the base Level 1 and limited Level 2, internal and external hazards, at-power, PRA is acceptable for supporting a risk-informed application. The NRC expects that, if the results of a self-assessment are used to demonstrate the acceptability of a PRA for an application, differences between the current version of the standard as endorsed in Appendix A (i.e., ASME/ANS RA-Sa-2009) and the earlier version (i.e., ASME RA-Sb-2005) be identified and addressed. In addition, future peer reviews should be performed against the established PRA standards and peer review guidance, as endorsed in this guide.

3.

Demonstrating the Acceptability of a PRA Used to Support an Application This section of the regulatory guide provides guidance to licensees on an approach acceptable to the NRC staff to demonstrate that the acceptability of the PRA used, in total or the pieces, to support an application is sufficient to support the analysis.

The application-specific regulatory guides identify the specific PRA results used to support the decision-making and the analysis needed to provide those results. The pieces of the base PRA to support that analysis need to be identified and the guidance in this regulatory guide applies to those pieces.

Regulatory Positions C.3.1 and C.3.2 summarize the expected outcome of the application of the application-specific regulatory guides in determining the scope of application of this regulatory guide.

One acceptable approach to demonstrate conformance with Regulatory Positions C.3.1 and C.3.2 is to use a national consensus standard. The ASME/ANS Level 1/LERF PRA standard provides the technical requirements for this purpose. If the ASME/ANS Level 1/LERF PRA standard is implemented, as endorsed by the staffs regulatory positions in Appendix A of this regulatory guide, Regulatory Positions C.3.1 and C.3.2 are considered to be met.

When using this regulatory guide, it is anticipated that the licensees description of the application will include the following:

SSCs, operator actions, and plant operational characteristics affected by the application a description of the cause-effect relationships related to the change and the affected SSCs, operator actions, and plant operational characteristics mapping of the cause-effect relationships onto PRA model elements identification of the PRA results that will be used to compare against the applicable acceptance criteria or guidelines and how the comparison is to be made the scope of risk contributors (hazard groups and modes of operation) included in the PRA to support the decision

DRAFT WORK PRODUCT DG-1362, Page 45 3.1 Scope of Risk Contributors Addressed by the PRA Model Based on the definition of the application, and in particular the acceptance criteria or guidelines, the scope of risk contributors (internal and external hazards and plant operating modes) for the PRA is identified. For example, if the application is designed around using the acceptance guidelines of Regulatory Guide 1.174, the evaluations of CDF, the change in CDF (i.e., CDF), LERF, and the change in LERF (i.e., LERF) should be performed with a full-scope PRA, including all hazard groups and all modes of operation. However, since many PRAs are not full-scope and do not include models for all risk contributors, decision-makers need to allow for such omissions. Examples of allowances that may be made omitted PRA scope items include using compensatory measures, restricting the implementation of the proposed change to those aspects of the plant covered by the risk model, and using bounding analyses to show the risk contribution is likely not greater than a certain value. However, it should be noted that, consistent with the Commission-endorsed phased PRA quality initiative, all risk contributors that cannot be shown to be insignificant to the decision should be assessed through quantitative risk assessment methods to support risk-informed licensing actions. This regulatory guide is focused specifically on the acceptability of the PRA information used in support of a decision and does not address the acceptability of non-PRA information used to justify the omission of PRA scope items. As noted elsewhere in this guide, a PRA is considered a quantitative risk assessment method.

The consensus PRA standards and industry PRA programs that have been developed, or are in the process of being developed, address a specific scope. For example, the ASME/ANS Level 1/LERF PRA standard and NEI 17-07, Revision 2, addresses a Level 1 and limited Level 2 PRA analysis for all hazards (i.e., internal events, internal flood, internal fire, seismic, high wind, external flood and other hazards),

with respect to at-power operations. As discussed in the Background in Section B of this regulatory guide, other consensus PRA standards are under development that address other levels of PRA analysis and other operating modes. The appendices to this regulatory guide address the different consensus PRA standards or industry PRA programs separately. In using this regulatory guide, the applicant will identify which of these appendices is applicable to the PRA analysis.

3.2 Identification of the Pieces of a PRA Used to Support the Application Based on an understanding of how the PRA model is to be used to achieve the desired results, the licensee will have identified the pieces of the PRA for each hazard group required to support a specific application. This includes the following two categories of items: (1) the PRA logic model elements onto which the cause-effect relationships are mapped (i.e., those directly affected by the application), and (2) all the events with mapped cause-effect relationships that appear in the accident sequences. For some applications, this may be some subset of all items in the base PRA, but for others (e.g., risk-informing the scope of special treatment requirements), all pieces of the PRA model may be relevant.

3.3 Demonstration of PRA Acceptability There are two aspects to demonstrating the acceptability of the pieces of the PRA used to support an application. The first aspect is the assurance that the pieces of the PRA used in the application have been developed and performed in a technically correct manner. The second aspect is the assurance that the assumptions and approximations used in developing the PRA are appropriate.

For the first aspect, assurance that the pieces of the PRA used in the application have been developed and performed in a technically correct manner implies that (1) the PRA model, or those pieces of the model required to support the application, represents the as-designed or as-built and as-operated plant, which, in turn, implies that the PRA reflects the current design and operating practices and experience, where appropriate; (2) the PRA logic model has been developed in a manner consistent with

DRAFT WORK PRODUCT DG-1362, Page 46 industry good practice (see glossary for this regulatory guide) and that it correctly reflects the dependencies amongst systems, components, and operator actions; and (3) the probabilities and frequencies used are estimated consistently with the definitions of the corresponding events in the PRA logic model.

For the second aspect, the current state-of-practice in PRA technology is that there are issues for which there is no consensus on methods of analysis. Furthermore, PRAs are models that rely on certain approximations and judgements to make the models tractable and certain assumptions that address uncertainties related to modeling specific issues. Section C.3.3.2 of this regulatory guide, RG 1.174 and, in more detail, NUREG-1855 provides guidance on how to address and treat the uncertainties associated with a PRA. In accordance with that guidance, the impact of these assumptions and approximations on the results of interest to the application needs to be understood.

3.3.1 Assessment that the PRA Model is Technically Correct When using risk insights based on a PRA model, the decisionmaker must ensure that the PRA model, or at least those pieces of it needed to provide the results, is technically correct as discussed above.

The licensee is to demonstrate that the PRA model represents the current plant design and configuration and represents current operating practices and operating experience to the extent required to support the application. This demonstration can be achieved through a PRA configuration control plan that includes a commitment to update the model periodically to reflect changes that impact the significant accident sequences.

The various consensus PRA standards and industry PRA programs that provide guidance on the development, performance, or reviews of PRAs are addressed individually in the Appendices to this regulatory guide. These Appendices document the staffs regulatory position on each of these standards or programs.

When the issues raised by the staff are taken into account, the consensus PRA standard or PRA peer review program in question is considered to be acceptable for the purpose for which it was intended.

If the pieces of the PRA can be shown to have met the requirements of these documents, with attention paid to the NRCs objections, it can be assumed that the analysis is technically correct. Therefore, the staff should be able to focus on the assumptions and approximations relevant to the application (and discussed below in Section C.3.3.2), and other than an audit, a detailed review by NRC staff of the base model PRA will not be necessary. When deviations from these documents exist, the applicant must demonstrate either that its approach is equivalent or that the influence on the results used in the application are such that no changes occur in the significant accident sequences or contributors.

3.3.2 Assessment of Assumptions and Approximations Since the standards and industry PRA programs are not (or are not expected to be) prescriptive, there is some freedom on how to model certain phenomena or processes in the PRA; different analysts may make different assumptions and still be consistent with the requirements of the standard or the assumptions may be acceptable under the guidelines of the peer review process. The choice of a specific assumption or a particular approximation may, however, influence the results of the PRA. For each application that calls upon this regulatory guide, the assumptions and approximations relevant to that application and those that are key to that application (see glossary in this regulatory guide) are identified.

The key assumptions for a PRA application are generally identified from the assumptions and approximations identified in the base PRA. The identified key assumptions will be used to identify sensitivity studies as input to the decision-making associated with the application. When a key

DRAFT WORK PRODUCT DG-1362, Page 47 assumption is shown to be consistent with a consensus method or approach, that key assumption may no longer be subject to additional sensitivity studies in the context of a PRA application. Each of the documents addressed in the Appendices to this regulatory guide either requires, or directly relates to (in the case of the industry peer review program) a peer review. One of the functions of the peer review is to assess the assumptions and make judgments as to their appropriateness.

4.

Documentation to Support a Regulatory Decision The licensee develops documentation of the PRA model and the analyses performed to support the risk-informed regulatory activity. This documentation comprises both archival (i.e., available for audit) and submittal (i.e., submitted as part of the risk-informed request) documentation. The former may be required on an as needed basis to facilitate the NRC staffs review of the risk-informed submittal.

The results of a PRA are sometimes used to support a decision changing a regulatory activity that is made by the licensee as authorized by a previous licensing decisions. Generally, all such authorizations have an associated PRA change control process that is part of the amendment authorizing the use of a PRA. The licensee will follow the PRA change control process for the approved application. The following archival documentation guidance are associated with the base PRA and they are not affected by any application specific guidance.

4.1 Archival Documentation Archival documentation associated with the base PRA includes the following:

A detailed description of the process used to determine the acceptability of the PRA is provided.

The results of the peer review of the base PRA, PRA upgrades, and use of newly developed methods, and the results of the F&O independent assessment (as discussed in Section C.2.2) are included. In addition, a description of the resolution of all the peer reviews (i.e., base PRA, PRA upgrades, and use of newly developed methods) and F&O independent assessment are included.

The results are documented in such a manner that it is clear why each requirement is considered to have been met. This can be done, for example, by providing a reference to the appropriate section of the PRA model documentation.

The complete documentation of the PRA model is included. If the staff elects to perform an audit on all or any parts of the PRA used in the risk-informed application, the documentation maintained by the licensee must be legible, retrievable (i.e., traceable), and of sufficient detail that the staff can comprehend the bases supporting the results used in the application. Regulatory Position C.1.3 of this guide provides the characteristics and attributes of archival documentation associated with the base PRA.

A description of the process for maintenance, upgrade, and use of newly developed methods is provided. The history is maintained of the activities related to PRA maintenance, PRA upgrades, and use of newly developed PRA. The history includes the results of any peer reviews that were performed as a result of a PRA upgrade or the use of a newly developed method.

The archival documentation associated with a specific application is expected to include enough information to demonstrate that the scope of the review of the base PRA is sufficient to support the application. This includes the following information:

the impact of the application on the plant design, configuration, or operational practices

DRAFT WORK PRODUCT DG-1362, Page 48 the risk assessment, including a description of the methodology used to assess the risk of the application, how the base PRA model was modified to appropriately model the risk impact of the application, and details of quantification and the results the acceptance guidelines and method of comparison the scope of the risk assessment in terms of hazard groups and specific accident scenarios and operating modes modeled the parts of the PRA required to provide the results needed to support comparison with the acceptance guidelines Individual licensees may develop, or sponsor the development, of a newly developed method. In this situation, the licensees docketed information may be referenced by other licensees that use the method in their PRAs. In the subsequent PRAs, and the newly developed method would become an upgrade.

Documentation of the newly developed method used in the PRA model is provided.

Documentation includes a description of the newly developed method, also includes a detailed discussion of the assumptions, scope, limitations of the newly developed method. A detailed discussion of the data used in the newly developed method along with its bases for selection is provided. In addition, a detailed discussion of the technical basis supporting the selection of the assumptions, data, tools, equations, etc. Consistent with NEI 17-07, Revision 2, a non-proprietary version of the documentation summarizing the newly developed method will be made available.

The newly developed method peer review reports and associated documents (e.g., self-assessment reports, method description, etc.)

4.2 Licensee Submittal Documentation To demonstrate that the acceptability of the PRA used in an application is sufficient, the staff expects the following information will be submitted to the NRC. Previously submitted documentation may be referenced if it is adequate for the subject submittal:

To address the need for the PRA model to represent the as-designed or as-built and as-operated

plant, Identification of permanent plant changes (such as design or operational practices) that have an impact on those things modeled in the PRA but have not been incorporated in the base PRA model. If a plant change has not been incorporated, the licensee provides a justification of why the change does not impact the PRA results used to support the application. This justification should be in the form of a sensitivity study that demonstrates the accident sequences or contributors significant to the application decision were not adversely impacted (remained the same).

Documentation that the parts of the PRA required to produce the results used in the decision are performed consistently with the standard as endorsed in the Appendices of this regulatory guide.

If a requirement of the standard (as endorsed in the Appendix to this guide) has not been met, the licensee is to provide a justification of why it is acceptable that the requirement has not been met.

DRAFT WORK PRODUCT DG-1362, Page 49 This justification should be in the form of a sensitivity study that demonstrates the accident sequences or contributors significant to the application were not impacted (remained the same).

A summary of the risk assessment methodology used to assess the risk of the application, including how the base PRA model was modified to appropriately model the risk impact of the application and results. (Note that this is the same as that required in the application-specific regulatory guides.)

Identification of the key assumptions and approximations relevant to the results used in the decision-making process. Also, include the peer reviewers assessment of those assumptions.

These assessments provide information to the NRC staff in their determination of whether the use of these assumptions and approximations is appropriate for the application, or whether sensitivity studies performed to support the decision are appropriate.

A discussion of the resolution of the peer review (or self-assessment, for peer reviews performed using the criteria in NEI 00-02) findings and observations that are applicable to the parts of the PRA required for the application. This decision should take the following forms:

a discussion of how the PRA model has been changed a justification in the form of a sensitivity study that demonstrates the accident sequences or contributors significant to the application decision were not adversely impacted (remained the same) by the particular issue The standards or peer review process documents may recognize different capability categories or grades that are related to level of detail, degree of plant specificity, and degree of realism. The licensees documentation is to identify the use of the parts of the PRA that conform to capability categories or grades lower than deemed required for the given application (See Section 1-3 of ASME/ANS RA-Sa-2009).

Identification of newly developed methods used in the base PRA model.

Identifications of where the PRA model was upgraded from the base PRA model or where newly developed methods were used after the base PRA model was peer reviewed. The licensee is expected to maintain the PRA overtime and update it where warranted; it is not expected that changes to the PRA due to PRA maintenance are to be submitted to the NRC. However, there may be changes to the PRA that involve a PRA upgrade or the use of newly developed methods.

The results of the peer review of these PRA upgrades, including those for the implementation of newly developed methods, need to be submitted to the staff.

DRAFT WORK PRODUCT DG-1362, Page 50 GLOSSARY as-built and as-operated These terms refer to the representation in a PRA model of the current plant design, configuration, procedures, and performance data (e.g., component failure rates).

as-designed, as-to-be-built, and as-to-be-operated The term as-designed refers to the PRA used to model the plant configuration in the design certification or combined operating license stage, in which the plant is not yet built or operated and, therefore, this PRA reflects the plant as it is intended to be built (i.e., as-to-be-built) and as it is intended to be operated (i.e., as-to-be-operated).

assumption An assumption is a decision or judgment that is made in the development of a model, implementation of a method, or conducting an analysis in development of a PRA model for modeling convenience or because of lack of information or state-of-knowledge. An assumption is considered to be credible when it has a sound technical basis and the technical basis would receive broad acceptance within the relevant technical community. However, an assumption may be related to scope or level of detail and is made for modeling convenience in the knowledge that a more detailed model would produce different results.

base PRA The base PRA is the PRA from which results or insights are derived or that is modified and/or manipulated to support a risk-informed NRC regulatory activity. In some cases, such as applications related to Title 10 of the Code of Federal Regulations Section 50.69, the PRA used in the application may be the base PRA. The base PRA provides a quantitative assessment of the identified risk of the as-built and as-operated plant in terms of scenarios that result in undesired consequences (e.g., core damage or a large early release) and their frequencies and is comprised of specific technical elements in performing the quantification. The base PRA serves as the foundational representation of the as-built and as-operated plant necessary to support an application. A method or approach that does not provide a quantified assessment of the defined risk and does not include the technical elements specified in Regulatory Position C.1.2 is not considered to be a PRA.

consensus method/model In the context of risk-informed regulatory decisions, a consensus method or model approach is one that the NRC has used or accepted for the specific risk-informed application for which it is proposed. In general, a consensus method or model has a publicly available published basis and has been peer reviewed and widely adopted by an appropriate stakeholder group. In addition, widely accepted PRA practices may be regarded as consensus models. Examples of the latter include the use of the constant probability of failure on demand model for standby components and the Poisson model for initiating events.

conservative Relates to the use of information (e.g., assumptions) such that the assessed outcome is meant to be less realistic in a cautious manner as compared to the expected outcome.

DRAFT WORK PRODUCT DG-1362, Page 51 current good practice (or state of practice)

Practices that are widely accepted by and implemented throughout the commercial nuclear power industry; have been shown to be technically acceptable in well-documented analyses or engineering assessments that are publicly available; and are accepted by the NRC.

demonstrably conservative Relates to the use of information (e.g., assumptions) that provides high confidence that the assessed outcome is as conservative as it is portrayed to be.

key assumption An assumption is considered to be key to a risk-informed decision when it could affect the PRA results that are being used in a decision and, consequently, may influence the decision being made. An assumption may be a key assumption relative to the base PRA or relative to an application. With respect to a base PRA, an assumption would be considered key if it affects the insights gained from the PRA results.

key source of uncertainty A key source of uncertainty relates to an issue in which there is no consensus approach or model and where the choice of approach or model is known to have an impact on the risk profile (e.g., total CDF and total LERF, the set of initiating events and accident sequences that contribute most to CDF and to LERF) such that it influences a decision being made using the PRA. Such an impact might occur, for example, by introducing a new functional accident sequence or a change to the overall CDF or LERF estimates significant enough to affect insights gained from the PRA.

level of detail Relates to the degree to which (i.e., amount of) information is discretized and included in the model or analysis.

model*

A qualitative and/or quantitative representation that is constructed to portray the inherent characteristics and properties of what is being represented (e.g., a system, component or human performance, theory or phenomenon). A model may be in the form, for example, of a structure, schematic or equation.

Method(s) are used to construct the model under consideration.

newly developed method*

A newly developed method that has either been developed separately from a state-of-practice method or is one that involves a fundamental change to a state-of-practice method. A newly developed method is not a state-of practice or a consensus method.

PRA A method or approach is considered to be a PRA when it (1) provides a quantitative assessment of the identified risk in terms of scenarios that result in undesired consequences (e.g., core damage or a large early release) and their frequencies, and (2) is comprised of specific technical elements in performing the quantification. A method that does not provide a quantified assessment of the defined risk or does not include the technical elements specified in Regulatory Position C.1.2 is not considered to be a PRA.

PRA acceptability The ability of a PRA to support risk-informed regulatory decisionmaking.

PRA acceptability is measured in terms of PRA scope; the level of detail in the PRA; the PRAs conformance with the PRA technical elements in

DRAFT WORK PRODUCT DG-1362, Page 52 Regulatory Position C.1.2 of this regulatory guide; and how closely the PRA represents a plants actual configuration and operations.

PRA application A documented analysis based in part or whole on a plant-specific PRA that is used to assist in decision-making with regard to the design, licensing, procurement, construction, operation, or maintenance of a nuclear power plant.

PRA maintenance*

A change in the PRA that does not meet the definition of PRA upgrade.

PRA method An analytical approach used to satisfy a supporting requirement or collection thereof from a consensus PRA standard in the PRA. An analytical approach is generally a compilation of the analyses, tools, assumptions, and data used to develop a model. For example, application of the MELCOR code, a system level code which contains engineering analyses and assumptions supported by experimental data, is the method used to develop a response model that predicts the performance of the core during PRA transients.

PRA upgrade*

A change in the PRA that results in the applicability of one or more Supporting Requirements (SRs) that were not previously included within the PRA (e.g., performing qualitative screening in Part 4 when the related HLR was previously not applicable, or adding a new hazard model), an implementation of a PRA method in a different context, or the incorporation of a PRA method not previously used.

Realism an accurate representation (to the extent practical) that reflects the expected response of the as-built and as-operated plant.

risk significance Design or operational features of the plant, including operator actions, that are important contributors because of their ability to either increase or decrease the risk. With regard to a risk significant contributor (e.g., risk significant accident sequence, risk significant basic event, risk significant human failure event, etc.), significance (or contribution) is measured with respect to the degree to which the contributor impacts the decision under consideration. For the base PRA model, significance can be measured with respect to the contribution to the total CDF or LERF, or it can be measured with respect to the contribution to the CDF or LERF/LRF for a specific hazard group or POS, depending on the context. For example, for the purposes of defining capability categories, the ASME/ANS PRA Standard defines significance at the hazard group level. Whatever the context, the numerical criteria in the definitions of significant accident sequence and significant basic event/contributor are recommended.

significant accident sequence An accident sequence is considered significant when it part the set of sequences that, when ranked by risk contribution from highest to lowest, compose 95 percent of the CDF or the LERF/LRF, or that individually contribute more than 1 percent to the CDF or LERF/LRF. This set of risk significant accident sequences may be defined functionally or in terms of systems.

DRAFT WORK PRODUCT DG-1362, Page 53 significant basic event/contributor A basic event (i.e., equipment unavailabilities and human failure events) or risk contributor is considered significant when its Fussell-Vesely importance measure value is greater than 0.005 or the risk-achievement worth importance measure value is greater than 2.

state of practice See definition for current good practice.

• These terms and their definitions are reproduced from PWROG-19027-NP, Revision 1.

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-1 APPENDIX A NRC REGULATORY POSITION ON ASME/ANS RA-SA-2009 Introduction The American Society of Mechanical Engineers (ASME) and the American Nuclear Society (ANS) has published ASME RA-Sa-2009, Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications (Ref. 27). The standard states that it sets forth requirements for probabilistic risk assessments (PRAs) used to support risk-informed decision for commercial nuclear power plants, and describes a method for applying these requirements for specific applications. The U.S. Nuclear Regulatory Commission staff has reviewed ASME/ANS RA-Sa-2009 against the characteristics and attributes of an acceptable PRA as discussed in Regulatory Positions C.1 and C.2 of this regulatory guide.

The staffs position on each requirement (referred to in the standard as a requirement, a high-level requirement, or a supporting requirement) in ASME/ANS RA-Sa-2009 is categorized as no objection, no objection with clarification, or no objection subject to the following qualification, and defined as follows:

No objection. The staff has no objection to the requirement.

No objection with clarification. The staff has no objection to the requirement. However, certain requirements, as written, are either unclear or ambiguous, and therefore the staff has provided its understanding of these requirements.

No objection subject to the following qualification. The staff has a technical concern with the requirement and has provided a qualification to resolve the concern.

ASME/ANS RA-Sa-2009 PRA standard is divided into ten parts:

Part 1 general requirements Part 2 technical and peer review requirements for internal events Part 3 technical and peer review requirements for internal flood Part 4 technical and peer review requirements for internal fire events Part 5 technical and peer review requirements for seismic events Part 6 technical and peer review requirements for screening of other external hazards Part 7 technical and peer review requirements for high wind Part 8 technical and peer review requirements for external flood Part 9 technical and peer review requirements for other external hazards Part 10 technical and peer review requirements for seismic margins Tables A-1 through A-10 provides the staffs position on each requirement in Parts 1 thru 10, respectively. A discussion of the staffs concern (issue) and the staff proposed resolution is provided. In the proposed staff resolution, the staff clarification or qualification to the requirement is indicated in either bolded text (i.e., bold) or strikeout text (i.e., strikeout); that is, the necessary additions or deletions to the requirement (as written in the ASME/ANS Level 1/LERF PRA standard) for the staff to have no objection are provided.

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-2 Table A-1. Staff Position on ASME/ANS RA-Sa-2009 Part 1, General Requirements for an At-Power Level 1 and LERF PRA Index No Issue Position Resolution Global References Use of references: the various references, may be acceptable, in general; however, the staff has not reviewed the references, and there may be aspects that are not applicable or not acceptable.

Clarification For every reference cited in the standard (except NEI 00-02): No staff position is provided on this reference. The staff neither approves nor disapproves of information contained in the referenced document.

Section 1-1 1-1.1 thru 1-1.7 No objection Section 1-2 1-2.1 Acronyms COL Acronym is needed Clarification COL: Combined License Other acronyms No objection 1-2.2 Definitions Definitions No objection Section 1-3 1-3.1 thru 1-3.4, 1-3.6 No objection 1-3.5, 2nd paragraph Use of the word significant should match definitions provided in Section 2.2.

Clarification (b) The difference is not significant if the modeled accident sequences accounting for at least 90% 95% of CDF/LERF for the hazard group.

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-3 Table A-1. Staff Position on ASME/ANS RA-Sa-2009 Part 1, General Requirements for an At-Power Level 1 and LERF PRA Index No Issue Position Resolution Figure 1-3-1 See staff proposed resolution for Section 1-1.4.2, text in Box 4 of Figure 1-3.1-1 needs to be modified be consistent with the text.

Clarification Section 1-4 1-4.1 thru 1-4.3.2, 1-4.3.4 thru 1-4.5 No objection 1-4.3.3, 2nd paragraph The intent of this statement/requirement is for the use of outside expert, as such the use of the word should does not provide a minimum requirement.

Clarification The PRA analysis team shall should use outside experts, even when.

Section 1-5 1-5.1 thru 1-5.7 No objection For each relevant Hazard Group, 4 Determine the relative importance to the application, identify the portions of the HG PRA relevant to the application, and for each relevant portion of the hazard group, determine the Capability Category for each SR needed for each potion of PRA to support application 5 PRA scope and risk metrics sufficient to evaluate plant change?

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-4 Table A-1. Staff Position on ASME/ANS RA-Sa-2009 Part 1, General Requirements for an At-Power Level 1 and LERF PRA Index No Issue Position Resolution Section 1-6 1-6.1.1, 1-6.1.2, 1-6.2, 1-6.4, 1-6.5, 1-6.6.2 No objection 1-6.1 The purpose, as written, implies that it is solely an audit against the requirements of Section 4.

A key objective of the peer review is to ensure when evaluating the PRA against the technical requirements, the quality (i.e., strengths and weaknesses) of the PRA; this goal is to be clearly understood by the peer review team.

Further, the statement that the peer review need not assess all aspects of the PRA against all requirements could be taken to imply that some of the requirements could be skipped.

Clarification another purpose of the peer review is to determine the strengths and weaknesses in the PRA. Therefore, the peer review shall also assess the appropriateness of the assumptions. The peer review need not assess all aspects of the PRA against all requirements in the Technical Requirements Section of each respective Part of this Standard; however, enough aspects of the PRA shall be reviewed for the reviewers to achieve consensus on the assessment of each applicable supporting requirement, as well as on the adequacy of methodologies and their implementation for each PRA Element.

1-6.3 As written, there does not appear to be a minimum set. The requirement as written provides suggestions. A minimal set of items is to be provided; the peer reviewers have flexibility in deciding on the scope and level of detail for each of the minimal items.

Clarification The peer review team shall use the requirements of this Standard. For each PRA element, a set of review topics required for the peer review team are provided in the subparagraphs of para.

6.3. Additional material for those Elements may be reviewed depending on the results obtained. These suggestions are not intended to be a minimum or comprehensive list of requirements. The judgment of the reviewer shall be used to determine the specific scope and depth of the review in each of each review topic for each PRA element.

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-5 Table A-1. Staff Position on ASME/ANS RA-Sa-2009 Part 1, General Requirements for an At-Power Level 1 and LERF PRA Index No Issue Position Resolution 1-6.6.1 The specific SRs addressed in the peer review need to be documented. As written it is not clear whether certain essential items are included in the documentation requirements that are necessary to accomplish the goal of the peer review.

Clarification (e) a discussion of the extent to which each PRA Element was reviewed, including a list of SRs that were reviewed Section 1-7 References See global comment on references at start of Table A-1.

Appendix 1-A Global The word significant is used in many places throughout the Appendix.

For example, the term significant changes in scope or capability is used to classify a change as a PRA upgrade, rather than a PRA maintenance.

The term significant change in risk insights is used to indicate when a focused peer review is suggested even for what is nominally classified as a PRA maintenance.

While what is meant by the former is clarified in the examples, what constitutes a significant change in risk insights needs to be defined and added to the defined terms in Section 1-2.

Clarification Add to list of definitions --

Significant change in risk insights:

Whether a change is considered significant is dependent on the context in which the insights are used. A change in the risk insights is considered significant when it has the potential to change a decision being made using the PRA.

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-6 Table A-1. Staff Position on ASME/ANS RA-Sa-2009 Part 1, General Requirements for an At-Power Level 1 and LERF PRA Index No Issue Position Resolution 1-A.3, Examples 1 thru 7, 9, 11-16, 19, 20, 22 thru No objection 1-A.1, 4th paragraph As written, it could be inferred that a newly developed method would not be considered an upgrade.

Clarification... new should be interpreted as new to the subject PRA even though the methodology in question has been applied in other PRAs and includes newly developed methods that have been used in the base PRA by the analyst. It is not intended to imply a newly developed method. This interpretation...

1-A.2 An internal review is recommended in several places. This recommendation is made instead of an outside peer review. It needs to be made clear that this internal review is a type of peer review and should follow the process and requirements for the peer review requirements.

Clarification (d) In the context... A focused review would be warranted.

(e) When performing an internal review, the objective is to assess that the change to the PRA was correctly performed. In performing this assessment, the reviewer should use as guidance those applicable requirements in the standard.

1-A.3, Examples 8, 10, 17 It is assumed that a change to the base PRA that involves a calculation using the same computer code is a PRA maintenance type change rather than a PRA upgrade type change.

This assumption would only be valid if the calculation does not involve any new assumptions and the same analyst is performing the calculation.

Clarification Change:.... using the same computer code that was used for the prior calculations, given the calculation does not involve any new assumptions and the calculation is performed using the same guidance.

NOTE: the words that was used for the prior calculations do not appear in Example #8, staff clarification includes these words in Example #8.

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-7 Table A-1. Staff Position on ASME/ANS RA-Sa-2009 Part 1, General Requirements for an At-Power Level 1 and LERF PRA Index No Issue Position Resolution 1-A.3, Example 18 Changing the definition of core damage without changing the thermal-hydraulic methodology may result in changed success criteria which could change the accident progression delineated by the accident sequences. It is not a foregone conclusion that this is a simple change to the PRA model. It needs to be reviewed to ensure that the resulting changes are appropriate. Further, what would be a significant change is open to interpretation, and would be prudent is not as strong as should.

Clarification Discussion and/or Alternative Recommendation: While this change may not be a new methodology, it could result in changing the success criteria with implications for the development of accident sequences, and potentially on the HRA (through timing), data, and quantification. If this change leads to a significant change in risk insights, a focused peer review should be performed 1-A.3, Example 21 This assumes that the important human actions are of the same nature as the new ones being added and utilize the ASEP method in the exact same manner. This cannot be assumed.

Clarification Rationale: If it can be shown that the previous important human actions fully utilized the ASEP method, and that any deficiencies by the analyst were corrected, then, if there is no significant impact on risk insights, this change falls into.......

1-A.4 References Clarification See global comment on references at start of Table A-1.

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-8 Table A-2. Staff Position on ASME/ANS RA-Sa-2009 Part 2, Technical and Peer Review Requirements for At-Power Internal Events Index No Issue Position Resolution Section 2-1 2-1.1 thru 2-1.3 No objection Section 2-2 2-2.1 No objection 2-2.1 - IE 2-2.1.1 No objection Table 2-2.1-1 No objection Tables 2-2.1-2(a) thru 2-2.1-5(d)

IE-A1 thru IE-A4, IE-A7 thru IE-A10 No objection IE-A5 The search for initiators should go down to the subsystem/train level.

Capability Category III should consider the use of other systematic processes.

Clarification Cat I and II:

PERFORM a systematic evaluation of each system and where necessary down to the subsystem or train level, including support systems.

Cat III:

PERFORM a systematic evaluation of each system down to the subsystem or train level, including support systems.

PERFORM an FMEA (failure modes and effects analysis) or other systematic process to assess.

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-9 Table A-2. Staff Position on ASME/ANS RA-Sa-2009 Part 2, Technical and Peer Review Requirements for At-Power Internal Events Index No Issue Position Resolution IE-A6 Initiating events from common cause or from both routine and non-routine system alignments should be considered.

Clarification Cat II:

resulting from multiple failures, if the equipment failures result from a common cause, and or from routine system alignments resulting from preventive and corrective maintenance.

Cat III:

resulting from multiple failures, including equipment failures resulting from random and common causes, and or from routine system alignments resulting from preventive and corrective maintenance.

IE-B1 thru IE-B5 No objection IE-C1 thru IE-C11, IE-C13 thru IE-C15 No objection IE-C12 Providing a list of generic data sources would be consistent with other SRs related to data.

Clarification COMPARE results and EXPLAIN differences in the initiating event analysis with generic data sources to provide a reasonable check of the results.

An example of an acceptable generic data sources is NUREG/CR-6928 [Note (1)].

Footnote (1)(a) to Table 2-2.1-4(c)

The first example makes an assumption that the hourly failure rate is applicable for all operating conditions.

Clarification Thus, fbus at power = 1x10-7/hr

• 8760 hrs/yr

• 0.90

= 7.9x10-4/reactor year.

In the above example, it is assumed the bus failure rate is applicable for at-power conditions. It should be noted that initiating event frequencies may be variable from one operating state to another due to various factors. In such cases, the contribution from events occurring only during at-power conditions should be utilized.

IE-D1 thru IE-D3 No objection

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-10 Table A-2. Staff Position on ASME/ANS RA-Sa-2009 Part 2, Technical and Peer Review Requirements for At-Power Internal Events Index No Issue Position Resolution 2-2.2 - AS 2-2.2.1 The HLR and associated SRs are written for CDF and not LERF; therefore, references to LERF are not appropriate.

Clarification 2-2.2.1 Objectives. The objectives reflected in the assessment of CDF and LERF is such a way that.

Table 2-2.2-1 No objection Tables 2-2.2-2(a) thru 2-2.2-4(c)

AS-A1 thru AS-A8, AS-A10, AS-A11 No objection AS-A9 The code requirements for acceptability need to be stated.

Clarification Cat II and III:

affect the operability of the mitigating systems. (See SC-B4.)

AS-B1 thru AS-B7 No objection AS-C1 thru AS-C3 No objection 2-2.3 - SC 2-2.3.1 The HLR and associated SRs are written for CDF and not LERF; therefore, references to LERF are not appropriate.

Clarification (a) overall success criteria are defined (i.e.,

core damage and large early release)

Table 2-2.3-1 No objection Tables 2-2.3-2(a) thru 2-2.3-4(c)

SC-A1 thru SC-A6 Note: SC-A3 was deleted in Addendum B.

No objection SC-B1 thru SC-B5 No objection SC-C1 thru SC-C3 No objection

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-11 Table A-2. Staff Position on ASME/ANS RA-Sa-2009 Part 2, Technical and Peer Review Requirements for At-Power Internal Events Index No Issue Position Resolution 2-2.4 - SY 2-2.4.1 No objection Table 2-2.4-1 No objection Tables 2-2.4-2(a) thru 2-2.4-4(c)

SY-A1 thru SY-A23 No objection SY-A24 There are no commonly used analysis methods for recovery in the sense of repair, other than use of actuarial data.

Clarification is justified through an adequate analysis or examination of data collected in accordance with DA-C15 and estimated in accordance with DA-D9. (See DA-C15.)

SY-B1 thru SY-B13, SY-B15 No objection SY-B14 Containment vent and failure can cause more than NPSH problems (e.g., harsh environments).

Clarification Examples of degraded environments include:

(h) harsh environments induced by containment venting, failure of the containment venting ducts, or failure of the containment boundary that may occur prior to the onset of core damage SY-C1 thru SY-C3 No objection 2-2.5 - HR 2-2.5.1 No objection Table 2-2.5-1 No objection Tables 2-2.5-2(a) thru 2-2.5-10(i)

HR-A1 thru HR-A3 No objection HR-B1, HR-B2 No objection HR-C1 thru HR-C3 No objection

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-12 Table A-2. Staff Position on ASME/ANS RA-Sa-2009 Part 2, Technical and Peer Review Requirements for At-Power Internal Events Index No Issue Position Resolution HR-D1, HR-D2HR-D4, HR-D5, HR-D7 No objection HR-D3 Add examples for what is meant by quality in items (a) and (b) of Cat II, III.

Clarification Cat II, III:

(a) the quality (e.g., format, logical structure, ease of use, clarity, and comprehensiveness) of written procedures (for performing tasks) and the type of administrative controls that support independent review (e.g.,

configuration control process, technical review process, training processes, and management emphasis on adherence to procedures). of administrative controls (for independent review)

(b) the quality of the human-machine interface (e.g., adherence to human factors guidelines [Note (3)] and results of any quantitative evaluations of performance per functional requirements), including both the equipment configuration, and instrumentation and control layout (3) NUREG-0700, Rev. 2, Human-System Interface Design Review Guidelines; J.M. OHara, W.S. Brown, P.M. Lewis, and J.J. Persensky, May 2002.

HR-D6 This SR should be written similarly to HR-G9 Clarification PROVIDE an assessment of the uncertainty in the. point estimates of HEPs. CHARACTERIZE the uncertainty in the estimates of the HEPs consistent with the quantification approach, and PROVIDE mean values for use in the quantification of the PRA results.

HR-E1 thru HR-E4 No objection HR-F1, HR-F2 No objection

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-13 Table A-2. Staff Position on ASME/ANS RA-Sa-2009 Part 2, Technical and Peer Review Requirements for At-Power Internal Events Index No Issue Position Resolution HR-G1, HR-G2, HR-G5 thru HR-G7 No objection HR-G3 In item (d) of CC II, III, clarify that clarity refers the meaning of the cues, etc.

In item (a) of CC I and item (g) of CC II, III, clarify that complexity refers to both determining the need for and executing the required response.

Clarification Cat I:

(a) the complexity of detection, diagnosis, decision-making and executing the required response (b)

Cat II, and III:

(d) degree of clarity of the cues/indications in supporting the detection, diagnosis, and decision-making give the plant-specific and scenario-specific context of the event.

(g) complexity of detection, diagnosis and decision-making, and executing the required response.

HR-G4 Requirements concerning the use of thermal/hydraulic codes should be cross-referenced.

Clarification Cat I, II, and III:

BASE. (See SC-B4.) SPECIFY the point in time.

HR-G8 Action verb should be capitalized Clarification CHARACTERIZE Characterize the uncertainty..

HR-H1 thru HR-H3 No objection HR-I1 thru HR-I3 No objection 2-2.6 - DA 2-2.6.1 No objection Table 2-2.6-1 No objection Tables 2-2.6-2(a) thru 2-2.6-6(e)

DA-A1 thru DA-A4 No objection

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-14 Table A-2. Staff Position on ASME/ANS RA-Sa-2009 Part 2, Technical and Peer Review Requirements for At-Power Internal Events Index No Issue Position Resolution DA-B1, DA-B2 No objection DA-C1 thru DA-C14, DA-C16 No objection DA-C15 This SR provides a justification for crediting equipment repair (SY-A24). As written, it could be interpreted as allowing plant-specific data to be discounted in favor of industry data. In reality, for such components as pumps, plant-specific data is likely to be insufficient and a broader base is necessary.

Qualification IDENTIFY instances of plant-specific experience or and, when that is insufficient to estimate failure to repair consistent with DA-D9, applicable industry experience and for each repair, COLLECT.

DA-D2 thru DA-D8 No objection DA-D1 Other approved statistical processes for combining plant-specific and generic data are not available.

Clarification CC II and III:

USE a Bayes update process or equivalent statistical process that assigns that assigns appropriate weight to the statistical significance of the generic and plant specific evidence and provides an appropriate characterization of the uncertainty. CHOOSE.

DA-D9 New requirement needed, DA-C15 was incomplete, only provided for data collection, not quantification of repair.

(See SY-A24.)

Qualification Cat I, II, and III:

For each SSC for which repair is to be modeled, ESTIMATE, based on the data collected in DA-C15, the probability of failure to repair the SSC in time to prevent core damage as a function of the accident sequence in which the SSC failure appears.

DA-E1 thru DA-E3 No objection

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-15 Table A-2. Staff Position on ASME/ANS RA-Sa-2009 Part 2, Technical and Peer Review Requirements for At-Power Internal Events Index No Issue Position Resolution 2-2.7 - QU 2-2.7.1 SRs for LERF quantification reference the SRs in 2-2.8, and therefore, need to be acknowledged in 2-2.8.

Clarification The objectives of the quantification element are to provide an estimate of CDF (and support the quantification of LERF) based upon the plant-specific (b) significant contributors to CDF (and LERF) are identified such as initiating events Table 2-2.7-1 HLR-QU-A, HLR-QU-B, HLR-QU-C, HLR-QU-E, HLR-QU-F No objection Table 2-2.7-1 HLR-QU-D SRs for LERF quantification reference the SRs in 2-2.8 and, therefore, need to be acknowledged in 2-2.8.

Clarification significant contributors to CDF (and LERF), such as initiating events, accident sequences Tables 2-2.7-2(a) thru 2-2.7-7(f)

QU-A1, QU-A4, QU-A5 No objection QU-A2 Need to acknowledge LERF quantification Clarification consistent with the estimation of total CDF (and LERF) to identify significant accident QU-A3 The state-of-knowledge correlation should be accounted for all event probabilities. Left to the analyst to determine the extent of the events to be correlated. Need to also acknowledge LERF quantification Clarification Cat I:

ESTIMATE the point estimate CDF (and LERF)

Cat II:

ESTIMATE the mean CDF (and LERF),

accounting for the state-of-knowledge correlation between event probabilities when significant (see NOTE 1).

Cat III:

CALCULATE the mean CDF (and LERF) by

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-16 Table A-2. Staff Position on ASME/ANS RA-Sa-2009 Part 2, Technical and Peer Review Requirements for At-Power Internal Events Index No Issue Position Resolution QU-B1 thru,,

QU-B5, QU-B7 thru QU-B10 No objection QU-B6 Need to acknowledge LERF quantification Clarification ACCOUNT for realistic estimation of CDF or LERF. This accounting QU-C1 thru QU-C3 No objection Table 2-2.7-5(d) HLR-QU-D and Table 2-2.7-2(d) objective statement just before table need to agree; SRs for LERF quantification reference the SRs in 2-2.7 and, therefore, need to be acknowledged in 2-2.7.

Clarification significant contributors to CDF (and LERF), such as initiating events, accident sequences QU-D1 thru QU-D7 No objection QU-E1, QU-E2 No objection QU-E3 Need to acknowledge LERF quantification Clarification Cat I and II:

ESTIMATE the uncertainty interval of the CDF (and LERF) results.

QU-E4 The note has no relevance to the base model and could cause confusion; it should be deleted.

Clarification For each source of model uncertainty introduction of a new initiating event)

[Note (1)].

NOTE: For specific applications, And in logical combinations.

QU-F1, QU-F3 thru QU-F6 No objection

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-17 Table A-2. Staff Position on ASME/ANS RA-Sa-2009 Part 2, Technical and Peer Review Requirements for At-Power Internal Events Index No Issue Position Resolution QU-F2 SR needs to use defined term significant instead of dominant. In addition, there is no requirement to perform sensitivity studies, and therefore, requirement is not needed for documentation.

Clarification (g) equipment or human actions that are the key factors in causing the accidents sequences to be non-dominant nonsignificant.

(h) the results of all sensitivity studies 2-2.8 - LE 2-2.8.1 No objection Table 2-2.8-1 No objection Tables 2-2.8-2(a) thru 2-2.8-8(g)

LE-A1 thru LE-A5 No objection LE-B1 thru LE-B3 No objection LE-C1 thru LE-C13 No objection LE-D1 thru LE-D7 No objection LE-E1 thru LE-E4 No objection LE-F1 thru LE-F3 No objection LE-G1, LE-G3 thru LE-G6 No objection LE-G2 There is no requirement to perform sensitivity studies.

Clarification (h) the model integration quantification including uncertainty and sensitivity analyses, as appropriate for the level of analysis Table 2-2.8-9 No objection

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-18 Table A-2. Staff Position on ASME/ANS RA-Sa-2009 Part 2, Technical and Peer Review Requirements for At-Power Internal Events Index No Issue Position Resolution Section 2-3 2-3.1 thru 2-3.3.8.2 No objection Section 2-4 References Clarification See global comment on references at start of Table A-1.

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-19 Table A-3. Staff Position on ASME/ANS RA-Sa-2008 Part 3, Technical and Peer Review Requirements for At-Power Internal Flood Index No Issue Position Resolution Section 3-1 3-1.1 thru 3-1.3 No objection Section 3-2 3-2 No objection 3-2.1 - IFPP 3-2.1.1 No objection Table 3-2.1-1 No objection Tables 3-2.1-2(a) thru 3-2.1-3(b)

IFPP-A1 thru IFPP-A5 No objection IFPP-B1 thru IFPP-B3 No objection 3-2.2 - IFSO 3-2.2.1 No objection Table 3-2.2-1 No objection Tables 3-2.2-2(a) thru 3-2.2-3(b)

IFSO-A2 thru IFSO-A4, IFSO-A6 No objection IFSO-A1 The list of fluid systems should be expanded to include fire protection systems.

Clarification For each flood area... INCLUDE: (a) equipment (e.g., piping, valves, pumps) located in the area that are connected to fluid systems (e.g., circulating water system, service water system, and reactor coolant system, and fire protection system)

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-20 Table A-3. Staff Position on ASME/ANS RA-Sa-2008 Part 3, Technical and Peer Review Requirements for At-Power Internal Flood Index No Issue Position Resolution IFSO-A5 It is necessary to consider a range of flow rates for identified flooding sources, each having a unique frequency of occurrence. For example, small leaks that only cause spray are more likely than large leaks that may cause equipment submergence.

Clarification (b) range of flow rates IFSO-B1 thru IFSO-B3 No objection 3-2.3 - IFSN 3-2.3.1 No objection Table 3-2.3-1 No objection Tables 3-2.3-2(a) thru 3-2.3-3(b)

IFSN-A1 thru IFSN-A5, IFSN-A-7 thru IFSN-A17 No objection

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-21 Table A-3. Staff Position on ASME/ANS RA-Sa-2008 Part 3, Technical and Peer Review Requirements for At-Power Internal Flood Index No Issue Position Resolution IFSN-A6 For Cat II, it is not acceptable to just note that a flood-induced failure mechanism is not included in the scope of the internal flooding analysis. Some level of assessment is required.

Qualification Cat I:

For the SSCs identified in IFSN-A5, IDENTIFY the susceptibility of each SSC in a flood area to flood-induced failure mechanisms. INCLUDE failure by submergence and spray in the identification process.

EITHER:

(a) ASSESS by using conservative assumptions; OR (b) NOTE that these mechanisms are not included in the scope of the evaluation.

Cat II:

For the SSCs identified in IFSN-A5, IDENTIFY the susceptibility of each SSC in a flood area to flood-induced failure mechanisms. INCLUDE failure by submergence and spray in the identification process.

ASSESS qualitatively the impact of flood-induced mechanisms that are not formally addressed (e.g., using the mechanisms listed under Capability Category III of this requirement), by using conservative assumptions.

IFSN-B1 thru IFSN-B3 No objection 3-2.4 - IFEV 3-2.4.1 No objection Table 3-2.4-1 No objection Tables 3-2.4-2(a) thru 3-2.4-3(b)

IFEV-A1 thru IFEV-A8 No objection IFEV-B1 thru IFEV-B3 No objection 3-2.5 - IFQU

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-22 Table A-3. Staff Position on ASME/ANS RA-Sa-2008 Part 3, Technical and Peer Review Requirements for At-Power Internal Flood Index No Issue Position Resolution 3-2.5.1 No objection Table 3-2.5-1 No objection Tables 3-2.5-2(a) thru 3-2.5-3(b)

IFQU-A1 thru IFQU-A7, IFQU-A9 thru IFQU-A11 No objection IFQU-A8 The quantification also needs to include the effect of common-cause failure.

Clarification INCLUDE, in the quantification, the combined effects of including equipment failures, unavailability due to maintenance, common-cause failures and other credible causes.

IFQU-B1 thru IFQU-B3 No objection Section 3-3 3-3.1 thru 3-3.3 No objection Section 3-4 References Clarification See global comment on references at start of Table A-1.

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-23 Table A-4. Staff Position on ASME/ANS RA-Sa-2009 Part 4, Technical and Peer Review Requirements for At-Power Internal Fire Index No Issue Position Resolution Section 4-1 4-1.1 thru 4-1.6 No objection Section 4-2 4-2 No objection 4-2.1 - PP 4-2.1.1, 4-2.1.2 No objection Table 4-2.1-1 No objection Tables 4-2.1-2(a) thru 4-2.1-4(c)

PP-A1 No objection PP-B1 thru PP-B7 No objection PP-C1 thru PP-C4 No objection 4-2.2 - ES 4-2.2 No objection Table 4-2.2-1 HLR-ES-A Grammatical change for clarity Clarification...identify equipment whose failure, including spurious operation, caused by an initiating fire, including spurious operation will would contribute Tables 4-2.2-2(a) thru 4-2.2.5(d)

Table 4-2.2-2(a)

HLR-ES-A Conforming change to HLR-ES-A Clarification identify equipment whose failure, including spurious operation, caused by an initiating fire, including spurious operation will would contribute ES-A2 thru ES-A6 No objection

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-24 Table A-4. Staff Position on ASME/ANS RA-Sa-2009 Part 4, Technical and Peer Review Requirements for At-Power Internal Fire Index No Issue Position Resolution ES-A1 Conforming change to HLR-ES-A Clarification IDENTIFY equipment whose failure, including spurious operation, caused by an initiating fire, including spurious operation would contribute ES-B2, ES-B3, ES-B5 No objection ES-B1 The notes states this requirement is a starting point for selection of mitigating equipment, and that an iterative process will provide the completeness with respect to Table 1-1.3-1, which specifies that the significant contributors be included in the model.

The requirement should represent the end result, not the beginning point.

Although the definition of failure mode in Part 1 includes spurious operation, it is worth explicitly including since it is an important issue.

Qualification Cat II:

IDENTIFY Fire and INCLUDE fire risk-significant equipment from the internal events PRA.

NOTE-ES-B1-7: The gradation across the Fire PRA (other equipment can be assumed failed in the worst possible failure mode, including spurious operation). This will tend ES-B4 SR refers to incorrect SR Clarification equipment identification per SRs ES-B1 through ES-B3B4.

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-25 Table A-4. Staff Position on ASME/ANS RA-Sa-2009 Part 4, Technical and Peer Review Requirements for At-Power Internal Fire Index No Issue Position Resolution ES-C1 There is a concern with the way in which the term significant has been used. It is ambiguous as to whether the reference is to the total CDF, the internal events CDF, or the fire CDF. In order to avoid ambiguity, it is necessary to have a definition of the term significant. The terms significant accident sequence, significant accident progression sequence, significant basic event, significant cutset, and significant contributor are defined in Part 1 within the context of the hazard group, so that in Part 3, they should be interpreted as being measured with respect to the fire risk.

Clarification NOTE-ES-C1-3: is not a significant contributor (as defined in Part 1),

ES-C2 No objection ES-D1 No objection 4-2.3 - CS 4-2.3 No objection Table 4-2.3-1 No objection Tables 4-2.3-2(a) thru 4-2.3-4(c)

CS-A1 thru CS-A9, CS-A11 No objection

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-26 Table A-4. Staff Position on ASME/ANS RA-Sa-2009 Part 4, Technical and Peer Review Requirements for At-Power Internal Fire Index No Issue Position Resolution CS-A10 PP-B1 already allows physical analysis units to be defined in terms of fire areas. As such the distinction between CCI and CCII is unnecessary.

Clarification Cat I:

IDENTIFY the fire areas and CONFIRM terminal end locations.

Cat II:

IDENTIFY and CONFIRM terminal end locations.

Cat I and II:

IDENTIFY the physical analysis units, consistent with the plant partitioning analysis, through which each cable associated with a credited Fire PRA function passes and CONFIRM that the information includes treatment of cable terminal end locations.

CS-B1 No objection CS-C1 thru CS-C4 No objection 4-2.4 - QLS 4-2.4 No objection Table 4-2.4-1 No objection Tables 4-2.4-2(a) thru 4-2.4-3(b)

QLS-A1 thru QLS-A4 No objection QLS-B1 thru QLS-B3 No objection 4-2.5 - PRM 4-2.5 No objection Table 4-2.5-1 No objection Tables 4-2.5-2(a) thru 4-2.5-4(c)

PRM-A1 thru PRM-A4 No objection

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-27 Table A-4. Staff Position on ASME/ANS RA-Sa-2009 Part 4, Technical and Peer Review Requirements for At-Power Internal Fire Index No Issue Position Resolution PRM-B1 thru PRM-B15 No objection PRM-C1 No objection 4-2.6 - FSS 4-2.6 No objection Table 4-2.6-1 No objection Tables 4-2.6-2(a) thru 4-2.6-9(h)

FSS-A1, FSS-A3, FSS-A6 No objection FSS-A2 Need to clarify that spurious operation is a failure mode.

Clarification For each target set, SPECIFY including specification of the failure modes, including spurious operation.

FSS-A4 Use of language, one or more, is problematic, since it does not specify a minimum requirement.

Clarification IDENTIFY sufficient one or more combinations of target sets... has been represented.

FSS-A5 The number of individual fire scenarios and level of detail should be commensurate with the relative risk importance of the physical analysis unit.

Clarification Cat I and II:

For each unscreened can be characterized commensurate with its risk significance.

NOTE FSS-A5-5: It is expected will be commensurate with the capability category and the fire relative risk importance FSS-B1, B2 No objection FSS-C1, FSS-C3 thru FSS-C8 No objection

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-28 Table A-4. Staff Position on ASME/ANS RA-Sa-2009 Part 4, Technical and Peer Review Requirements for At-Power Internal Fire Index No Issue Position Resolution FSS-C2 See Issue for ES-C1 Clarification Cat II and III:

For those scenarios that represent significant contributors to a physical analysis units fire risk, CHARACTERIZE NOTE FSS-C3-3: are not significant contributors (as defined in Part 1),

FSS-D1, FSS-D2, FSS-D4 thru FSS-D11 No objection FSS-D3 Again the either bounded or accurately characterized issue for CC II and CC III.

Clarification Cat I:

in the analysis of each fire scenario such that the fire risk contribution of each unscreened physical analysis unit is bounded.

Cat II:

the fire risk contribution of each unscreened physical analysis unit can be either bounded or accurately characterized.

Cat III:

the fire risk contribution of each unscreened physical analysis unit can be either bounded or accurately characterized and such that the risk FSS-E1 thru FSS-E4 No objection FSS-F1 Use of the term SELECT one or more Clarification Cat II and II:

SELECT one or more fire scenarios(s) a sufficient number of fire scenarios to characterize could damage, including collapse, of the exposed structural steel FSS-F2, FSS-F3 No objection FSS-G1 thru FSS-G6 No objection

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-29 Table A-4. Staff Position on ASME/ANS RA-Sa-2009 Part 4, Technical and Peer Review Requirements for At-Power Internal Fire Index No Issue Position Resolution FSS-H1 thru FSS-H10 No objection 4-2.7 - IGN 4-2.7 No objection Table 4-2.7-1 No objection Tables 4-2.7-2(a) thru 4-2.7-3(b)

IGN-A1 The note, IGN-A1-1, appears to be more relevant to IGN-A2 than it is for IGN-A1. Item (e) only makes sense when there is equivalent nuclear experience.

Clarification NOTE IGN-A1-1(e) if being used as a supplement to, rather than in lieu of, nuclear data, that the fire frequencies calculated are consistent with those derived from nuclear experience ;

IGN-A2 thru IGN-A10 No objection IGN-B1 thru IGN-B5 No objection 4-2.8 - QNS 4-2.8 No objection Table 4-2.8-1 No objection Tables 4-2.8-2(a) thru 4-2.8-5(d)

QNS-A1 No objection QNS-B1, QNS-B2 No objection

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-30 Table A-4. Staff Position on ASME/ANS RA-Sa-2009 Part 4, Technical and Peer Review Requirements for At-Power Internal Fire Index No Issue Position Resolution QNS-C1 The screening criteria in Capability Categories II and III should relate to the total CDF and LERF for the fire risk, not the internal events risk.

See Issue for 4-2.2-2(c).

NOTE ES-C1 Clarification Cat II:

and the sum of the CDF contribution for all screened fire compartments is

<10% of the estimated total CDF for internal fire events and the sum of the LERF contributions for all screened fire compartments is

<10% of the estimated total LERF for internal fire events Cat III:

and the sum of the CDF contributions for all screened fire compartments is

<1% of the estimated total CDF for internal fire events and the sum of the LERF contributions for all screened fire compartments is

<1% of the estimated total LERF for internal fire events QNS-D1, QNS-D2 No objection 4-2.9 - CF 4-2.9 No objection Table 4-2.9-1 No objection Tables 4-2.9-2(a) thru 4-2.9-5(d)

CF-A1 See Issue for ES-C1 Clarification NOTE CF-A1-1: for non-risk significant contributors (as defined in Part 1),

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-31 Table A-4. Staff Position on ASME/ANS RA-Sa-2009 Part 4, Technical and Peer Review Requirements for At-Power Internal Fire Index No Issue Position Resolution CF-A2 No objection CF-B1 No objection 4-2.10 - HRA 4-2.10 No objection Table 4-2.10-1 No objection Tables 4-2.10-2(a) thru 4-2.10-6(e)

HRA-A1 thru HRA-A4 No objection HRA-B1 thru HRA-B4 No objection HRA-C1 No objection HRA-D1 No objection HRA-D1 [Note (1)]

This SR has the same index number as the previous SR.

Clarification HRA-D12 [Note (1)]

HRA-E1 No objection 4-2.11 - SF 4-2.11 No objection Table 4-2.11-1 No objection Tables 4-2.11-2(a) thru 4-2.11-3(e)

SF-A1 thru SF-A5 No objection SF-B1 No objection

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-32 Table A-4. Staff Position on ASME/ANS RA-Sa-2009 Part 4, Technical and Peer Review Requirements for At-Power Internal Fire Index No Issue Position Resolution 4-2.12 - FQ 4-2.12 No objection Table 4-2.12-1 HLR-FQ-E See Issue for ES-C1 Clarification HLR-FQ-E: and significant contributors (as defined in Part 1) to CDF and LERF Tables 4-2.12-2(a) thru 4-2.12-7(f)

FQ-A1 thru FQ-A4 No objection FQ-B1 No objection FQ-C1 No objection FQ-D1 No objection FQ-E1 See Issue for ES-C1 Clarification IDENTIFY significant contributors (as defined in Part 1)

FQ-F1 See Issue for ES-C1 Clarification DOCUMENT the CDF and LERF SRs QU-F2 and QU-F3 are significant contributors (as defined in Part 1);

FQ-F2 No objection 4-2.13 -- UNC 4-2.13 No objection Table 4-2.13-1 No objection UNC-A1, UNC-A2 No objection

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-33 Table A-4. Staff Position on ASME/ANS RA-Sa-2009 Part 4, Technical and Peer Review Requirements for At-Power Internal Fire Index No Issue Position Resolution Section 4-3 4-3.1 No objection 4-3.2 Expertise in Fire HRA is needed for the peer review Clarification fire modeling, and fire protection programs and their elements, and Fire HRA.

4-3.3 No objection 4-3.3.1 thru 4-3.3.13 No objection Section 4-4 References Clarification See global comment on references at start of Table A-1.

Appendix 4-A FPRA Methodology (Nonmandatory)

The staff does not endorse the material in this appendix, and as such, does not have a position (i.e., no objections, no objection with clarification, or no objection with qualification) on any of the material contained in this appendix. However, it should be noted, that consistent with the Commission endorsed phase PRA Quality Initiative, all risk contributors that cannot be shown as insignificant, should be assessed through quantitative risk assessment methods to support risk informed licensing actions.

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-34 Table A-5. Staff Position on ASME/ANS RA-Sa-2009 Part 5, Technical and Peer Review Requirements for At-Power Seismic Events Index No Issue Position Resolution Section 5-1 5-1 No objection Section 5-2 5-2 No objection 5-2.1 - SHA 5-2.1 No objection Table 5-2.1.1, HLR-SHA-A thru HLR-SHA-F, HLR-SHA-J No objection Table 5-2.1-1, HLR-SHA-G Much of the HLR is more how to meet the HLR and should be a SR. Further, the SRs provide the requirements needed in order to meet the HLR. This relationship does not exist here. In addition, this information is also duplicated in the accompanying note. At the least, this text should be removed from the HLR.

Clarification For further use in the SPRA, the spectral shape SHALL be based on a site-specific evaluation taking into account the contributions of deaggregated magnitude-distance results of the probabilistic seismic hazard analysis. Broad-band, smooth spectral shapes,... that would challenge these uniform hazard spectral shapes.

Table 5-2.1-1, HLR-SHA-H Much of the HLR is more how to meet the HLR and should be a SR. Further, the SRs provide the requirements needed in order to meet the HLR. This relationship does not exist here.

Clarification When use... for the intended application. It shall be confirmed that the basic data and interpretations from an existing study are valid.

Table 5-2.1-1, HLR-SHA-I Much of the HLR is more how to meet the HLR and should be a SR. Further, the SRs provide the requirements needed in order to meet the HLR. This Clarification A screening analysis... or the magnitude of hazard consequences, or both. The hazard analysis shall include hazards other than vibratory ground motion if necessary.

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-35 Table A-5. Staff Position on ASME/ANS RA-Sa-2009 Part 5, Technical and Peer Review Requirements for At-Power Seismic Events Index No Issue Position Resolution relationship does not exist here.

Tables 5-2.1-2(a) to 5-2.1-10(j)

SHA-A1 thru SHA-A5 No objection SHA-B1 thru SHA-B3 No objection SHA-C1 thru SHA-C4 No objection SHA-D1 thru SHA-D4 No objection SHA-E1, SHA-E2 No objection SHA-F1 thru SHA-F3 No objection Table 5-2.1-8(g)

See issue for Table 5-2.1-1, HLR-SHA-G Clarification For further use in the SPRA, the spectral shape SHALL be based on a site-specific evaluation taking into account the contributions of deaggregated magnitude-distance results of the probabilistic seismic hazard analysis. Broad-band, smooth spectral shapes,... that would challenge these uniform hazard spectral shapes.

SHA-G1 Spectral shapes used to evaluate in-structure SSCs must include the effects of amplification from both local site conditions and SSI.

Based on IPEEE reviews, certain UHS shapes used for CEUS were not appropriate for the screening purpose.

Clarification NOTE HA-G1: The issue of which spectral shape should be used in the screening of structures, systems, and components (SSCs) and in quantification of SPRA results requires careful consideration. For screening purposes, the spectral shape used should have amplification factors, including effects from both local site conditions as well as soil-structure interaction, such that the demand resulting from the use of this shape is higher than that based on the design spectra. This will preclude premature screening of components and will avoid anomalies such as the screened components (e.g., surrogate elements) being the dominant significant risk contributing components. Additional discussion

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-36 Table A-5. Staff Position on ASME/ANS RA-Sa-2009 Part 5, Technical and Peer Review Requirements for At-Power Seismic Events Index No Issue Position Resolution on this issue can be found in Ref. X.

In the quantification of fragilities and of final risk results, it is important to use as realistic a shape as possible.

Semi-site specific shapes, such as those given in NUREG-0098, have been used in the past and are considered may be adequate for this purpose, provided that they are shown to be reasonably appropriate for the site [42]. The uniform hazard response spectrum (UHS) is acceptable for this purpose if it can be shown that the UHS shape is appropriate for the site. unless evidence comes to light (e.g., within the technical literature) that these UHS do not reflect the spectral shape of the site-specific events. Recent developments [42] indicate that these spectral shapes are not appropriate for CEUS sites where high frequency content is dominant at hard rock sites.

Table 5-2.1-9(h)

See issue for Table 5-2.1-1, HLR-SHA-H Clarification When use... for the intended application. It shall be confirmed that the basic data and interpretations from an existing study are valid.

SHA-H See issue for Table 5-2.1-1, HLR-SHA-H Clarification SHA-H1 Cat I and II:

Use of existing studies ENSURE, in light of established current information, the study meets the requirements in HLR-SHA-A thru HLR-SHA-G.

Cat III:

Use of existing studies not allowed.

DO NOT USE existing studies.

Table 5-2.1-10(i)

See issue for Table 5-2.1-1, HLR-SHA-I Clarification A screening analysis... or the magnitude of hazard consequences, or both. The hazard analysis shall include hazards other than vibratory ground motion if necessary.

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-37 Table A-5. Staff Position on ASME/ANS RA-Sa-2009 Part 5, Technical and Peer Review Requirements for At-Power Seismic Events Index No Issue Position Resolution SHA-I See issue for Table 5-2.1-1, HLR-SHA-I Clarification SHA-I There are no supporting requirements here.

SHA-I1 Cat I, II and III:

PERFORM a screening to determine whether to include other seismic hazards such as fault displacement, landslide, soil liquefaction, or soil settlement in the seismic PRA.

SHA-I2 Cat I, II and III:

ADDRESS the effect of these other seismic hazards through assessment of the frequency of hazard occurrence or the magnitude of hazard consequences, or both.

SHA-J1, thru SHA-J3 No objection 5-2.2 - SFR 5-2.2 No objection 5-2.2 Table 5-2.2-1 No objection Table 5-2.2-2(a) thru 5-2.2-8(g)

SFR-A1, SFR-A2 No objection SFR-B1, SFR-B2 No objection SFR-C1 thru SFR-C6 No objection SFR-D1, SFR-D2 No objection SFR-E1 thru SFR-E5 No objection SFR-F1 thru SFR-F4 No objection SFR-G1 thru SFR-G3 No objection 5-2.3 - SPR 5-2.3 No objection

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-38 Table A-5. Staff Position on ASME/ANS RA-Sa-2009 Part 5, Technical and Peer Review Requirements for At-Power Seismic Events Index No Issue Position Resolution 5-2.3 Table 5-2.3-1 No objection Tables 5-2.3-2(a) thru 5-2.3-7(f)

SPR-A1 thru SPR-A4 No objection SPR-B1 thru SPR-B11 No objection SPR-C1 No objection SPR-D1 No objection SPR-E1 thru SPR-E6 No objection SPR-F1 thru SPR-F3 No objection Section 5-3 5-3 No objection Section 5-4 References Clarification See global comment on references at start of Table A-1.

Appendix 5-A 5-A.1 thru 5-A.3 No objection 5-A.4 References Clarification See global comment on references at start of Table A-1.

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-39 Table A-6. Staff Position on ASME/ANS RA-Sa-2009 Part 6, Technical and Peer Review Requirements for At-Power Screening and Conservative Analysis of Other External Hazards Index No Issue Position Resolution Section 6-1 6-1 No objection Section 6-2 6-2.1 thru 6-2.3 No objection Table 6-2-1 No objection Tables 6-2-2(a) to 6-2-6(e)

EXT-A1, EXT-A2 No objection EXT-B1 thru EXT-B4 No objection EXT-C1 thru EXT-C7 No objection EXT-D1, EXT-D2 No objection EXT-E1, EXT-E2 No objection Section 6-3 6-3.1 thru 6-3.3 No objection Section 6-4 References Clarification See global comment on references at start of Table A-1.

Appendix 6-A No objection 6-A-1 References Clarification See global comment on references at start of Table A-1.

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-40 Table A-7. Staff Position on ASME/ANS RA-Sa-2009, Part 7, Technical and Peer Review Requirements for At-Power High Wind Events Index No Issue Position Resolution Section 7-1 7-1 No objection Section 7-2 7-2 No objection 7-2.1 - WHA 7-2.1 No objection Table 7-2.1-1 No objection Tables 7-2.1-2(a) and 7-2.1-2(b)

WHA-A1 The six elements described in NOTE WIND-A1 provide the details required for the tornado wind hazard analysis and should be included in WIND-A1 as requirements.

Qualification Cat II and III:

In the tornado wind hazard analysis, USE a mean hazard curve can be derived.

INCLUDE the following elements in the tornado wind hazard analysis:

(1) Variation of tornado intensity with occurrence frequency (The frequency of tornado occurrence decreases rapidly with increased Intensity);

(2) Correlation of tornado width and length of damage area; longer tornadoes are usually wider; (3) Correlation of tornado area and intensity; stronger tornadoes are usually larger than weaker tornadoes; (4) Variation in tornado intensity along the damage path length; tornado intensity varies throughout its life cycle; (5) Variation of tornado intensity across the tornado path width.

(6) Variation of tornado differential pressure across the tornado path width.

NOTE WIND-A1: State-of-the-art methodologies are given... can be found in Refs. 13, 56, and 57.

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-41 Table A-7. Staff Position on ASME/ANS RA-Sa-2009, Part 7, Technical and Peer Review Requirements for At-Power High Wind Events Index No Issue Position Resolution Tornado wind hazard analysis SHOULD include the following elements:

(a) variation of tornado intensity with occurrence (f) variation of tornado differential pressure across the tornado path width.

WHA-A2 thru WHA-A5 No objection WHA-B1 thru WHA-B3 No objection 7-2.2 - WFR 7-2.2 No objection Table 7-2.2-1 No objection Tables 7-2.2-2(a thru 7-2.2-3(b))

WFR-A1, WFR-A2 No objection WFR-B1 thru WFR-B3 No objection 7-2.3 - WPR 7-2.3 No objection Table 7-2.3-1 HLR-WPR-A The word significant should be added in this HLR in Table 7-2.3 and in the HLR statement in Table 7-2.3-2(a)

Clarification The wind-PRA systems model shall include wind-caused significant initiating events and other failures that are significant contributors that can Table 7-2.3-1 HLR-WPR-B and HLR-WPR-C No objection Tables 7-2.3-2(a) thru 7-2.3-4(c)

Table 7-2.3-2(a)

The word significant should be added in the Clarification The wind-PRA systems model shall include wind-caused significant initiating events and other failures

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-42 Table A-7. Staff Position on ASME/ANS RA-Sa-2009, Part 7, Technical and Peer Review Requirements for At-Power High Wind Events Index No Issue Position Resolution HLR statement in Table 7-2.3-2(a) that are significant contributors that can WPR-A1thru WPR-A11 No objection WPR-B1, WPR-B2 No objection WPR-C1 thru WPR-C3 No objection Section 7-3 7-3 thru 7-3.3.5 No objection Section 7-4 References Clarification See global comment on references at start of Table A-1.

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-43 Table A-8. Staff Position on ASME/ANS RA-Sa-2009, Part 8, Technical and Peer Review Requirements for At-Power External Flood Events Index No Issue Position Resolution Section 8-1 8-1 No objection Section 8-2 8-2 No objection 8-2.1 - XFHA 8-2.1 Table 8-2.1-1 No objection Tables 8-2-2(a) and 8-2.1-3(b)

Table 8-2-2(a)

Incorrect table number Clarification Table 8-2-2(a) 8-2.1-2(a)

XFHA-A1 thru XFHA-A6 No objection XFHA-B1 thru XFHA-B3 No objection 8-2.2 - XFFR 8-2.2 Table 8-2.2-1 No objection Tables 8-2-2(a) and 8-2.2-3(b)

Table 8-2-2(a)

Incorrect table number Clarification Table 8-2-2(a) 8-2.2-2(a)

XFFR-A1, XFFR-A2 No objection XFFR-B1 thru XFFR-B3 No objection 8-2.3 8-2.3 No objection Table 8-2.3-1 HLR-XFPR-A The word significant needs to be added in this HLR in Table 8-2.3 and in the HLR statement in Table 8-2.3-2(a)

Clarification The external flooding-PRA systems model shall include wind-caused significant initiating events and other failures that are significant contributors that can Tables 8-2.3-2(a) and 8-2.3-4(c)

Table 8-2.3-2(a)

The word significant needs to be added the HLR statement in Table 8-2.3-2(a)

Clarification The external flooding-PRA systems model shall include wind-caused significant initiating events and other failures that are significant contributors that can

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-44 Table A-8. Staff Position on ASME/ANS RA-Sa-2009, Part 8, Technical and Peer Review Requirements for At-Power External Flood Events Index No Issue Position Resolution XFPR-A thru XFPR-A11 No objection XFPR-B1, XFPR-B2 No objection XFPR-C1 thru XFPR-C3 No objection Section 8-3 8-3 thru 8-3.3.5 No objection Section 8-4 References Clarification See global comment on references at start of Table A-1.

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-45 Table A-9. Staff Position on ASME/ANS RA-Sa-2009, Part 9, Technical and Peer Review Requirements for At-Power Other External Hazards Index No Issue Position Resolution Section 9-1 9-1 No objection Section 9-2 9-2 No objection 9-2.1 - XHA 9-2.1 Table 9-2.1-1 No objection Tables 9-2.1-2(a) and 9-2.1-3(b)

XHA-A1 thru XFHA-A4 No objection XHA-B1 thru XHA-B3 No objection 9-2.2 - XFR 9-2.2 Table 9-2.2-1 No objection Tables 9-2.2-2(a) and 9-2.2-3(b)

XFR-A1, thru XFFR-A4 No objection XFR-B1 thru XFR-B3 No objection 9-2.3 - XPR 9-2.3 No objection Table 9-2.3-1 HLR-XPR-A The word significant should be added in this HLR in Table 9-2.3-1 and in the HLR statement in Table 9-2.3-2(a)

Clarification The external hazard PRA plant model shall include wind-caused significant initiating events and other failures that are significant contributors that can shall include wind-caused significant initiating events and other failures that are significant contributors that can Tables 9-2.3-2(a) and 9-2.3-4(c)

Table 9-2.3-2(a)

The word significant should be added in the HLR statement in Table 9-2.3-2(a)

Clarification The external hazard PRA plant model shall include wind-caused significant initiating events and other failures

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-46 Table A-9. Staff Position on ASME/ANS RA-Sa-2009, Part 9, Technical and Peer Review Requirements for At-Power Other External Hazards Index No Issue Position Resolution that are significant contributors that can XPR-A thru XPR-A11 No objection XPR-B1 thru XFPR-B2 No objection XPR-C1 thru XPR-C3 No objection Section 9-3 9-3.1 thru 9-3.4.5 No objection Section 9-4 References Clarification See global comment on references at start of Table A-1.

DRAFT WORK PRODUCT DG-1362, Appendix A, Page A-47 Table A-10. Staff Position on ASME/ANS RA-Sa-2009 Part 10, Technical and Peer Review Requirements for At-Power Seismic Margins Assessment The staff does not endorse the material in this Part of the standard, and as such, does not have a position (i.e., no objections, no objection with clarification, or no objection with qualification) on any of the material contained in Part 10 of the standard. However, it should be noted, that consistent with the Commission endorsed phase PRA Quality Initiative, all risk contributors that cannot be shown as insignificant, should be assessed using a PRA (as defined in Section C.1) to support risk-informed licensing actions.

DRAFT WORK PRODUCT DG-1362, Appendix B, Page B-1 APPENDIX B NRC REGULATORY POSITION ON ASME/ANS RA-S CASE 1 Introduction The American Society of Mechanical Engineers (ASME) and the American Nuclear Society (ANS) has published ASME/ANS RA-S Case 1, Case for ASME/ANS RA-Sb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment of Nuclear Power Plant Applications (Ref. 21), which is a proposed alternative set of requirements related to requirements for a seismic probabilistic risk assessment (PRA) in Part 5 of ASME/ANS RA-Sa-2009 (Ref. 27). The standard states that it sets forth requirements for probabilistic risk assessments (PRAs) used to support risk-informed decision for commercial nuclear power plants, and describes a method for applying these requirements for specific applications. The NRC staff has reviewed ASME/ANS RA-S Case 1 against the relevant characteristics and attributes for an acceptable PRA as discussed in Regulatory Positions C.1 and C.2 of this regulatory guide. The staffs position on each requirement (referred to in the standard as a requirement, a high-level requirement, or a supporting requirement) in ASME/ANS RA-S Case 1 is categorized as no objection, no objection with clarification, or no objection subject to the following qualification, and defined as follows:

No objection. The staff has no objection to the requirement.

No objection with clarification. The staff has no objection to the requirement. However, certain requirements, as written, are either unclear or ambiguous, and therefore the staff has provided its understanding of these requirements.

No objection subject to the following qualification. The staff has a technical concern with the requirement and has provided a qualification to resolve the concern.

Table B-1 provides the staffs position on each requirement. A discussion of the staffs concern (issue) and the staff proposed resolution is provided. In the proposed staff resolution, the staff clarification or qualification to the requirement is indicated in either bolded text (i.e., bold) or strikeout text (i.e., strikeout); that is, the necessary additions or deletions to the requirement (as written in ASME/ANS RA-S Case 1) for the staff to have no objection are provided.

DRAFT WORK PRODUCT DG-1362, Appendix B, Page B-2 Table B-1. Staff Position on ASME/ANS RA-S Case 1, Case for ASME/ANS RASb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment of Nuclear Power Plant Applications, Technical and Peer Review Requirements of a Level 1, Seismic PRA for the At-Power Operating Mode Index No Issue Position Resolution Section 5-1 5-1.1 to 5-1.2 No objection 5-1.3 The last paragraph of the section states that the internal events PRA model is the starting point to which must be added a number of structures, systems, and components (SSCs) not included in the model but that could fail due to the external hazard. Failure modes caused by the external hazard for SSCs existing in the internal events PRA should also be included.

Clarification The approach to any external hazard PRA typically uses as its starting point the internal-events PRA model to which must be added a number of structures, systems, and components (SSCs) not included in the model but that could fail due to the external hazard and new failure modes caused by the external hazard for SSCs already present in the model. Both the part of the internal-events model dealing with CDF and the part dealing with LERF are used as starting points.

Eliminated Subsections 5-1.4 and 5-1.5 No objection Eliminated Subsection 5-1.6 The Part 5 Code Case does not include the language from Section 5-1.6 in ASME/ANS RA-Sb-2013, which discussed the usage of generic fragility information. Section 5-1.6 in ASME/ANS RA-Sb-2013 indicates that (a)

Analysts should apply caution in the use of generic fragilities and provide justification that the generic fragilities are applicable, and (b) Peer reviews should focus on the use of generic fragilities to ensure that their use is appropriate Clarification Include in the NMA language on the use of generic fragility information as in Section 5-1.6 in ASME/ANS RA-Sb-2013 as follows:

(a) Analysts should apply caution in the use of generic fragilities and provide justification that the generic fragilities are applicable, and (b) Peer reviews should focus on the use of generic fragilities to ensure that their use is appropriate and justified.

DRAFT WORK PRODUCT DG-1362, Appendix B, Page B-3 Table B-1. Staff Position on ASME/ANS RA-S Case 1, Case for ASME/ANS RASb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment of Nuclear Power Plant Applications, Technical and Peer Review Requirements of a Level 1, Seismic PRA for the At-Power Operating Mode Index No Issue Position Resolution and justified. These statements are important because they appropriately identify the scope of interest with respect to generic fragility for both the analysts and the peer-reviewers.

Section 5-2 Introductory text Text was removed from Section 5-2 that helps set the context for the standard requirements.

Clarification Seismic PRA is an integrated activity requiring close interactions among specialists from different fields (e.g.,

seismic hazard analysis, systems analysis, and fragility evaluation). For this reason, it is important that all members of the seismic PRA team be cognizant of all of the SRs in this Part, not just those in their area of expertise, and understand the interactions required between the elements. The analysis requires judgment and extrapolation beyond observed data. Therefore, the analyst is strongly urged to review published seismic PRA reports and to compare his/her plant-specific seismic PRA to the published studies of similar reactor types and system designs. This understanding of the Standard and other seismic PRAs will promote consistency among similar PRAs and risk-informed applications and will also promote reasonableness in the numerical results and risk insights. The peer review is also directed in part toward this same objective reasonableness in the numerical results and risk insights.

Section 5-2.1 Introductory text The first full paragraph of Section 5-2.1 states in part, The requirements described in Part 5-2.1 address these objectives in detail. A probabilistic Clarification The requirements described in Part 5-2.1 address these objectives in detail. A probabilistic seismic hazard analysis (PSHA), which may directly incorporate site response analyses, is used to assess horizontal ground motions at the site.

DRAFT WORK PRODUCT DG-1362, Appendix B, Page B-4 Table B-1. Staff Position on ASME/ANS RA-S Case 1, Case for ASME/ANS RASb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment of Nuclear Power Plant Applications, Technical and Peer Review Requirements of a Level 1, Seismic PRA for the At-Power Operating Mode Index No Issue Position Resolution seismic hazard analysis (PSHA), which may directly incorporate site response analyses, is used to assess horizontal ground motions at the site. It does not seem appropriate to highlight a specific aspect of the PSHA, particularly in such an ambiguous manner.

General comments on the SHA Technical Element The Code Case proposes definitions for the terms primary hazard and Secondary hazard.

However, the Code Case only uses the term primary hazard in the definition of the term secondary hazard, which may not prompt a need to define the term primary hazard. The primary hazard described by the objectives in Section 5-2.1 seems to be the vibratory ground motion.

However, in many instances, but not all, the text refers to secondary hazards from vibratory ground motions but not always. It is unclear whether there is a difference between the way vibratory ground motion is referred to or if these are intended to be synonymous.

Consideration should be given to whether the definition be made more precise to the hazards, primary or secondary, that Clarification

• Ensure consistent use of the term secondary hazards with the definition.

To the extent possible express which secondary seismic hazards are included or, alternatively, which are not.

DRAFT WORK PRODUCT DG-1362, Appendix B, Page B-5 Table B-1. Staff Position on ASME/ANS RA-S Case 1, Case for ASME/ANS RASb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment of Nuclear Power Plant Applications, Technical and Peer Review Requirements of a Level 1, Seismic PRA for the At-Power Operating Mode Index No Issue Position Resolution the Code Case intends to address. For example, does it intend to address tsunamis and seiches? If not, it should not be mentioned.

Table 5-2.1-1 HLR-SHA-A The language of the high level requirement (HLR)

HLR-SHA-A states, The frequency of seismic ground motion at the site shall be based on a site-specific PSHA that represents the center, body, and range of the technically defensible interpretations. The level of analysis, as well as the level of updates when an existing study is the initial basis for the site-specific PSHA, shall be determined based on the intended application and on the technical viability of existing PSHA models. This language is too vague. In particular, the frequency of the ground motion is a natural process. It is their calculation that is based on a PSHA.

Clarification The basis for the calculation of Tthe frequencies of exceeding different levels of vibratory seismic ground motion at the site shall be based on a site-specific PSHA that represents the center, body, and range of the technically defensible interpretations. The level of analysis, as well as the level of updates when an existing study is the initial basis for the site-specific PSHA, shall be determined based on the intended application and on the technical viability of existing PSHA models.

HLR-SHA-B through HLR-SHA-J No objection Table 5-2.1-2 Introductory text No objection SHA-A1 through SHA-A4 No objection

DRAFT WORK PRODUCT DG-1362, Appendix B, Page B-6 Table B-1. Staff Position on ASME/ANS RA-S Case 1, Case for ASME/ANS RASb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment of Nuclear Power Plant Applications, Technical and Peer Review Requirements of a Level 1, Seismic PRA for the At-Power Operating Mode Index No Issue Position Resolution SHA-A5 Regarding supporting requirement SHA-A5 in Table 5-2.1-2, the NRC staff has discouraged use of the damage parameter cumulative absolute velocity (CAV) filter in place of a lower-bound magnitude for the PSHA.

Use of CAV has often been misapplied in PSHAs to improperly filter out larger magnitude events at larger source-to-site distances. Recently completed PSHAs for Near Term Task Force (NTTF) Recommendation 2.1 and combined operating license (COL) and early site permit (ESP) applications no longer use the CAV damage parameter in place of a lower-bound magnitude. NRC staffs related letter pursuant to Title 10 of the Code of Federal Regulations (10 CFR) Section 50.54(f) specified use of M5 (moment magnitude 5) as an appropriate lower-bound magnitude.

Clarification JUSTIFY the specified lower-bound magnitude (or probabilistically defined characterization of magnitudes based on a damage parameter) for use in the hazard analysis, such that earthquakes of magnitudes less than this value are not expected to cause significant damage to the engineered structures or equipment.

SHA-A6 No objection Note (1), Issue 1 Note (1) of Table 5-2.1-2 states in part, The appropriate level of the hazard analysis will depend on project-specific factors and should include considerations such as the safety significance of the nuclear power plant, the Clarification The appropriate level of the hazard analysis will depend on project-specific factors and should include considerations such as the safety significance of the nuclear power plant, the technical complexity and uncertainties in hazard inputs, regulatory oversight and requirements, and the availability of resources.

DRAFT WORK PRODUCT DG-1362, Appendix B, Page B-7 Table B-1. Staff Position on ASME/ANS RA-S Case 1, Case for ASME/ANS RASb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment of Nuclear Power Plant Applications, Technical and Peer Review Requirements of a Level 1, Seismic PRA for the At-Power Operating Mode Index No Issue Position Resolution technical complexity and uncertainties in hazard inputs, regulatory oversight and requirements, and the availability of resources.

Although it is a note and not a requirement, citing the availability of resources as a means of determining the appropriate level of hazard analysis may be misconstrued as a justification for excluding consideration of a safety issue.

Note (1), Issue 2 Note (1) of Table 5-2.1-2 refers to Regulatory Guide (RG) 1.208 as providing an acceptable approach to establishing a lower-bound magnitude for use in the hazard analysis. However, the NRC staff has discouraged use of the damage parameter cumulative absolute velocity (CAV) filter in place of a lower-bound magnitude for the PSHA.

Use of CAV has often been misapplied in PSHAs to improperly filter out larger magnitude events at larger source-to-site distances. Recently completed PSHAs for Near Term Task Force (NTTF) Recommendation 2.1 and combined operating license (COL) and early site permit (ESP) applications no Clarification Remove the following language in Note (1) of Table 5-2.1-2:

RG 1.208 [5-3] provides one acceptable approach to establishing a lower-bound magnitude for use in the hazard analysis.

DRAFT WORK PRODUCT DG-1362, Appendix B, Page B-8 Table B-1. Staff Position on ASME/ANS RA-S Case 1, Case for ASME/ANS RASb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment of Nuclear Power Plant Applications, Technical and Peer Review Requirements of a Level 1, Seismic PRA for the At-Power Operating Mode Index No Issue Position Resolution longer use the CAV damage parameter in place of a lower-bound magnitude. NRC staffs related letter pursuant to Title 10 of the Code of Federal Regulations (10 CFR) Section 50.54(f) specified use of M5 (moment magnitude 5) as an appropriate lower-bound magnitude.

Table 5-2.1-3 Introductory text No objection SHA-B1, SHA-B2 No objection SHA-B3 Sole use of term attenuation in conjunction with modeling ground motions is unnecessarily limiting.

Clarification ENSURE that the data and information are sufficient to characterize attributes important for modeling both regional propagation attenuation of ground motions and local site effects including their associated uncertainties.

SHA-B4 No objection SHA-B5 The current language requires a demonstration that the updated earthquake catalog has been reviewed if an existing PSHA is used.

However, this does not include accounting for the impact of the updated earthquake catalog on the existing PSHA.

Clarification If an existing PSHA is used, DEMONSTRATE that an updated catalog of earthquakes was reviewed in the evaluation to determine if does not make the existing PSHA remains unviable.

Notes No objection Table 5-2.1-4 Introductory text No objection SHA-C1 through SHA-C4 No objection

DRAFT WORK PRODUCT DG-1362, Appendix B, Page B-9 Table B-1. Staff Position on ASME/ANS RA-S Case 1, Case for ASME/ANS RASb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment of Nuclear Power Plant Applications, Technical and Peer Review Requirements of a Level 1, Seismic PRA for the At-Power Operating Mode Index No Issue Position Resolution Notes No objection Table 5-2.1-5 Introductory text No objection SHA-D1 The ground motion characterization model needs to include the interface with site response analysis in terms of a reference soil or rock horizon, as defined by shear wave velocity, density, and damping values.

Clarification In the ground motion characterization model that determines the range of seismic vibratory ground motion that can occur at a site, INCLUDE (a) credible mechanisms governing estimates of vibratory ground motion that can occur at a site, (b) a review of available historical and instrumental seismicity data (including strong motion data) to assess and calibrate the model, and (c) applicable (existing and/or newly developed) ground motion prediction equations for the ground motion estimates, and (d) reference soil or rock horizon (defined by shear wave velocity, density, and damping values).

SHA-D2 No objection SHA-D3 The ground motion characterization model should include ground motion prediction equations (GMPEs) with alternative distance and magnitude scaling behaviors, not just a range of amplitudes.

Clarification ENSURE that uncertainties are included in the model that determine the range of seismic vibratory ground motion that can occur at a site as well as alternative magnitude and distance scaling behaviors in accordance with the level of analysis identified for HLR-SHA-A and the data and information in the update of the PSHA.

SHA-D4 No objection Notes No objection Table 5-2.1-6 Introductory text No objection SHA-E1, No objection

DRAFT WORK PRODUCT DG-1362, Appendix B, Page B-10 Table B-1. Staff Position on ASME/ANS RA-S Case 1, Case for ASME/ANS RASb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment of Nuclear Power Plant Applications, Technical and Peer Review Requirements of a Level 1, Seismic PRA for the At-Power Operating Mode Index No Issue Position Resolution SHA-E2 SHA-E3 The term ENSURE is not the appropriate action verb.

Clarification JUSTIFY ENSURE that the approach used to incorporate the site response analysis into the hazard analysis is justified (e.g., sources of soils and rock material properties used in the analysis, uncertainties in site characterization and material properties, data to identify the depth to bedrock, appropriateness of one-two-or three-dimensional analysis in relation to the site stratigraphy).

Table 5-2.1-7 Introductory text No objection SHA-F1 through SHA-F3 No objection Notes No objection Table 5-2.1-8 Introductory text No objection SHA-G1, SHA-G2 No objection Notes No objection Table 5-2.1-9 Introductory text No objection SHA-H1, SHA-H2 No objection Notes No objection Table 5-2.1-10 Introductory text No objection

DRAFT WORK PRODUCT DG-1362, Appendix B, Page B-11 Table B-1. Staff Position on ASME/ANS RA-S Case 1, Case for ASME/ANS RASb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment of Nuclear Power Plant Applications, Technical and Peer Review Requirements of a Level 1, Seismic PRA for the At-Power Operating Mode Index No Issue Position Resolution SHA-I1 No objection SHA-I2 The supporting requirement uses the terms hazards and secondary hazard interchangeably, which is potentially confusing.

Clarification For those secondary hazards that are not screened out, INCLUDE their effect through assessment of the frequency of hazard occurrence and the magnitude, when applicable, of the secondary hazard.

Note 2 The last sentence of Note (2) in Table 5-2.1-10 is vague and unnecessary.

Clarification The appropriate approach used to justify the basis and methodology used for screening out secondary hazards is hazard-and site-specific. Justification may be based on available public literature and prior hazard studies.

Table 5-2.1-11 Introductory text No objection SHA-J1, SHA-J2 No objection Notes No objection Section 5-2.2 Introductory text No objection Table 5-2.2-1 HLR-SFR-A through HLR-SFR-F No objection Table 5-2.2-2 Introductory text No objection SFR-A1 The intent of supporting requirement SFR-A1 needs additional clarification.

Clarification The NMA already discusses the overall intent of SFR-A1 and distinguishes between failure mechanism and failure mode. Include in the NMA a discussion such as:

DRAFT WORK PRODUCT DG-1362, Appendix B, Page B-12 Table B-1. Staff Position on ASME/ANS RA-S Case 1, Case for ASME/ANS RASb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment of Nuclear Power Plant Applications, Technical and Peer Review Requirements of a Level 1, Seismic PRA for the At-Power Operating Mode Index No Issue Position Resolution The intent of SFR-A1 is to ensure that the fragility analyst provides fragility assessments for the SSCs defined by the systems analyst in the plants SEL and for the relevant failure modes associated to the basic PRA events. The understanding is that fragility assessments relate to failure mechanisms, which, in turn, relate to failure modes defined by the systems analyst.

SFR-A2 The information to be included should be such that it can justify the modeling of SSCs as correlated from a fragility perspective and not simply be relevant.

Justification, more than the examples provided, will be necessary for any correlation other than 0 and 1.

Additionally the phrase fragility correlation should be replaced with fragility dependence.

Dependence between random variables characterize their interrelationship.

Correlation (coefficient) is used to define the dependence structure between random variables. It is also lacking criteria for acceptability of a correlation model.

Clarification INCLUDE information relevant to justifying the modeling of fragility dependency correlation of SSCs and its basis (e.g., similarity of component construction and location, and response spectra at the locations) to support SPR-B4.

Table 5-2.2-3 Introductory text No objection

DRAFT WORK PRODUCT DG-1362, Appendix B, Page B-13 Table B-1. Staff Position on ASME/ANS RA-S Case 1, Case for ASME/ANS RASb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment of Nuclear Power Plant Applications, Technical and Peer Review Requirements of a Level 1, Seismic PRA for the At-Power Operating Mode Index No Issue Position Resolution SFR-B1, through SFR-B3 No objection SFR-B4 The action verb ESTIMATE implies using judgement or qualitative measures which are inconsistent with the intent of the SR. The action verb CALCULATE involves a mathematical process whereas the action verb ESTIMATE does not necessarily involve a calculation (e.g.,

quantification of a probability or frequency) and can be derived qualitatively.

Qualification If median-centered response analysis is performed, CALCULATE ESTIMATE the median response (i.e., structural loads and floor response spectra) and ESTIMATE the variability in the response.

SFR-B5 No objection SFR-B6 In the 2009 revision (SFR-C2), part of the SR asked one to ACCOUNT for the entire spectrum of input ground motion levels displayed in the seismic hazard curves.

This sentence is removed in the code case.

However, this sentence also ensures the quality of the results of the probabilities response analysis.

Qualification If probabilistic response analysis is performed to calculate structural loads and floor response spectra, ENSURE that the number of simulations done (e.g., Monte Carlo simulation or Latin Hypercube Sampling) is large enough to calculate stable responses. ACCOUNT for the entire spectrum of input ground motion levels displayed in the seismic hazard curves.

Table 5-2.2-4 Introductory text No objection SFR-C1 The intent is to provide the basis and methodology to justify that the capacity of the Clarification SPECIFY the basis and methodologies established for the capacity-based screening for the level defined in SPR-B5 (e.g., use of simplified fragility analysis,

DRAFT WORK PRODUCT DG-1362, Appendix B, Page B-14 Table B-1. Staff Position on ASME/ANS RA-S Case 1, Case for ASME/ANS RASb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment of Nuclear Power Plant Applications, Technical and Peer Review Requirements of a Level 1, Seismic PRA for the At-Power Operating Mode Index No Issue Position Resolution SSC exceeds the screening level.

use of applicable generic fragility or qualification data or earthquake experience, and use and applicability of EPRI fragility screening guidance are examples).

SFR-C2 In ASME/ANS RA-Sa-2009, Note (2) of the corresponding supporting requirement (i.e., SFRB2) indicates that the screening criteria do not apply to high-seismic regions such as coastal California. However, SFR-C2 in the Code Case does not discuss this note.

Qualification SPECIFY JUSTIFY the basis for screening of inherently rugged components (e.g., applicability of fragility or qualification test data, earthquake experience, past fragility analysis for similar SSCs and seismic responses, applicable EPRI guidance).

Table 5-2.2-5 Introductory text No objection SFR-D1, SFR-D2 No objection SFR-D3 For CC I: In general, the walkdown AND the fragility evaluation provide the assurance.

This requirement supports that assurance but may not always ensure. Also, vulnerability needs to be defined.

Clarification IDENTIFY seismic vulnerabilities low seismic capacities and to ensure ENSURE that assumptions and the use of generic seismic fragilities are conservative.

SFR-D3 For CC II: The current language implies realistic and plant specific fragilities for all vulnerabilities, which is inconsistent with SFR-E3 and established practice.

Clarification IDENTIFY seismic vulnerabilities to ensure and ENSURE that the seismic fragility calculations can be realistic and plant-specific as needed.

SFR-D4 The walkdown should also focus on operator pathways and potential Clarification FOCUS on potential functional and structural failure modes, equipment anchorage, and support load paths, and

DRAFT WORK PRODUCT DG-1362, Appendix B, Page B-15 Table B-1. Staff Position on ASME/ANS RA-S Case 1, Case for ASME/ANS RASb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment of Nuclear Power Plant Applications, Technical and Peer Review Requirements of a Level 1, Seismic PRA for the At-Power Operating Mode Index No Issue Position Resolution unavailability of those pathways.

SFR-D7 seems to refer to consequences of failure of one SSC on the performance of another SSC including inoperability of the SSC by and operator action.

However, the words added here refer to pathways for ex-control room actions.

pathways necessary for performing required ex-control room actions.

SFR-D5 No objection SFR-D6 In 2009 (SFR-E3) indicates that if component screened out during or following the walkdowns, document anchorage calculation and provide the basis.

However, this statement is removed in the code case and it is not clear if screening out equipment during walkdowns is allowed.

Qualification Add the following or equivalent as a new SFR-D6:

IDENTIFY credible seismic-induced failure for the fire sources provided in SPR-C4. If components are screened out during or following the walkdown, PROVIDE the basis justifying such a screening.

SFR-D7 This supporting requirement appears to prejudge which seismic interactions have the potential to be risk-significant prior to the walkdown. If the intent is that such information will be provided to the walkdown team by the plant-systems analyst it appears to be premature to expect such information to be available at the time of walkdown. Further, such Clarification IDENTIFY potential risk-significant credible seismic interactions including proximity impacts, falling hazards, and differential displacements (e.g., failure and falling of masonry walls and nonseismically designed SSCs, impact between cabinets, differential building displacements). and EVALUATE the consequences of such interactions on SSCs contained in the systems model and on the credited operator actions. (See HLR-SPR-D.)

DRAFT WORK PRODUCT DG-1362, Appendix B, Page B-16 Table B-1. Staff Position on ASME/ANS RA-S Case 1, Case for ASME/ANS RASb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment of Nuclear Power Plant Applications, Technical and Peer Review Requirements of a Level 1, Seismic PRA for the At-Power Operating Mode Index No Issue Position Resolution an intent or appearance of intent can lead to an argument for excluding the plant-systems analyst from the walkdown. The second part of the SR starting with EVALUATE the consequences is expected to capture the risk-importance of the identified interactions.

Table 5-2.2-6 Introductory text No objection SFR-E1 No objection SFR-E2, CC I For CC I: The intent of the requirements should be to identify. In CCI conservative assumptions and data may be used.

Qualification For SSCs identified in SPR-C4SPR-C6 that significantly contribute to seismic core damage frequency and/or seismic large early release frequency, conservatively IDENTIFY relevant failure modes mechanisms of structures, equipment, and soil. ENSURE that the assumptions and data used in the identification are conservative.

SFR-E2, CC II For CC II: The examples listed in the requirement confuse the understanding of the differences between CCI and CCII. The only real difference is that CCI says conservatively IDENTIFY relevant while CCII says IDENTIFY relevant and realistic. This SR also references SPR-C4, but should reference SPR-C6.

Clarification For those SSCs identified in SPR-C4SPR-C6 that significantly contribute to seismic core damage frequency and/or seismic large early release frequency, IDENTIFY relevant and realistic failure mechanisms modes of structures, equipment, and soil.

SFR-E3, SFR-E4 No objection SFR-E5 The SR (CC I and II) refers to SPR-B6 for Clarification For CCI:

DRAFT WORK PRODUCT DG-1362, Appendix B, Page B-17 Table B-1. Staff Position on ASME/ANS RA-S Case 1, Case for ASME/ANS RASb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment of Nuclear Power Plant Applications, Technical and Peer Review Requirements of a Level 1, Seismic PRA for the At-Power Operating Mode Index No Issue Position Resolution identification purposes.

SPR-B6 discusses relay or other similar devices.

This SR also needs to capture or other similar devices which is currently missing not only for consistency but also to prevent any implication that other similar devices need not be considered here.

Additionally, the action verb for the second part of the CC II requirements needs to be capitalized to identify it.

ESTIMATE contact-chatter seismic fragilities for relays or other similar devices that are identified in the systems analysis. (See SPR-B6.)

For CCII:

CALCULATE contact-chatter seismic fragilities for relays or other similar devices that are identified in the systems analysis (see SPR-B6) that significantly contribute to seismic core damage frequency and/or seismic large early release frequency.

SFR-E6 For CC II: The action verb for the second part of the CC II requirements needs to be capitalized to identify it. Calculate is the appropriate action verb to be used for this supporting requirement.

Qualification CALCULATE seismic fragilities for credible seismic-induced flood sources (see SFR-D5) and seismic-induced fire sources (see SFR-D6) that significantly contribute to seismic core damage frequency and/or seismic large early release frequency. For those flood and fire sources that do not significantly contribute to seismic core damage frequency and/or seismic large early release frequency, estimate ESTIMATE the seismic fragilities.

Table 5-2.2-7 Introductory text No objection SFR-F1 No objection SFR-F2 Related Table 5-2.2-6 that provides supporting requirements associated with calculation of seismic-fragility parameters use distinct action verbs ESTIMATE and CALCULATE, respectively, for Clarification Regarding list item (i) in SFR-F2:

(i) estimation or calculation of fragility parameter values for each SSC modeled (median capacity, logarithmic standard deviation reflecting the randomness in median capacity, and logarithmic standard deviation representing the uncertainty in median capacity), and

DRAFT WORK PRODUCT DG-1362, Appendix B, Page B-18 Table B-1. Staff Position on ASME/ANS RA-S Case 1, Case for ASME/ANS RASb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment of Nuclear Power Plant Applications, Technical and Peer Review Requirements of a Level 1, Seismic PRA for the At-Power Operating Mode Index No Issue Position Resolution Capability Category I and Capability Category II.

However, the related supporting requirement SFR-F2, item (i) associated with documentation of fragility parameter values only uses the word estimation, but not calculation. Therefore, the documentation supporting requirement item (i) is partly inconsistent with other related supporting requirements.

SFR-F3 No objection Section 5-2.3 Introductory text, Issue 1 The seismic PRA depends on both the capability and completeness of the internal events at-power PRA.

Clarification It is assumed:

• Relative to the systems-analysis requirements contained herein, the seismic PRA analysis team possesses a full-scope internal events, at-power Level 1 and Level 2 LERF PRA, developed either before or concurrently with the seismic PRA.

• The internal-events PRA is then used as the basis for the seismic PRA systems analysis.

It is recognized that the capability and completeness of the seismic PRA is a function of the capability and completeness of the internal events at-power PRA.

Introductory text, Issue 2 The sentence reads like a how to which is not the intent of the Standard.

Further, none of the references cited in the Section are endorsed by the staff. Such references should be moved to the Clarification A general methodology for the modeling and quantification of a seismic PRA is documented in references such as EPRI-3002000709 [5-5], EPRI-1020756 [5-6],

and EPRI-1025294 [5-7].

DRAFT WORK PRODUCT DG-1362, Appendix B, Page B-19 Table B-1. Staff Position on ASME/ANS RA-S Case 1, Case for ASME/ANS RASb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment of Nuclear Power Plant Applications, Technical and Peer Review Requirements of a Level 1, Seismic PRA for the At-Power Operating Mode Index No Issue Position Resolution NMA portion of the Standard.

Introductory text, Issue 3 Cross-references in SFR to SPR (ensure that they also are in SPR).

SPR-B4 includes the reference to SFR-A2 SPR-B5 includes the reference to SFR-C1 SPR-C4 does not cross-reference SFR-D6 SPR-D does not cross-reference SFR-D7 Clarification Include the missing cross-references either in the requirements or footnotes.

Table 5-2.3-1 HLR-SPR-A through HLR-SPR-C No objection HLR-SPR-D The term operator performance can be interpreted in a narrow context to mean only in-control room actions and performance. However, the HLR and the corresponding SRs are applicable to all human actions included in the SPRA.

Clarification Human actions credited in the seismic PRA shall consider seismic-specific challenges to operator performance actions included in the seismic PRA.

HLR-SPR-E No objection HLR-SPR-F This HLR is overly broad since HLR-SHA-J and HLR-SFR-F already address documentation of the seismic hazard evaluation and the seismic fragility evaluation, respectively.

Clarification Documentation of the seismic PRA analysis plant-response model shall be consistent with the applicable supporting requirements.

Table 5-2.3-2 Introductory text No objection

DRAFT WORK PRODUCT DG-1362, Appendix B, Page B-20 Table B-1. Staff Position on ASME/ANS RA-S Case 1, Case for ASME/ANS RASb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment of Nuclear Power Plant Applications, Technical and Peer Review Requirements of a Level 1, Seismic PRA for the At-Power Operating Mode Index No Issue Position Resolution SPR-A1 No objection SPR-A2 It is unclear whether the SR is seeking to identify all possible initiating events from secondary hazards or if the intent is to identification and screen such initiators for inclusion in the plant-systems model.

Clarification Using a systematic process, IDENTIFY credible seismically induced initiating events caused by secondary hazards (e.g.,

seismically induced internal flooding, external flooding, and fire) including those identified in SHA-I2 for consideration retention in the plant-response analysis and model development process.

SPR-A3 The verb encompasses is overly severe and cannot reasonably be achieved in practice. The wording of this SR should be similar to IE-A3 and IE-A4.

Clarification REVIEW plant-specific response to past seismic events, as well as other available seismic risk evaluations for nuclear plants, to ensure that the list of initiating events included in the evaluation encompasses accounts for industry experience.

SPR-A4 The plant-response analysis should include all identified events.

Clarification INCLUDE in the plant-response analysis the events identified in SPR-A1, and SPR-A2, and SPR-A3 above.

Notes No objection Table 5-2.3-3 Introductory text No objection SPR-B1 No objection SPR-B2 Due to the input from the fire and internal flooding PRAs, and possibly other hazard PRAs, in addition to internal events the findings from all relevant PRAs should be appropriately dispositioned.

Additionally, it is not clear what is intended by the latter part of this SR (does not adversely affect).

Qualification ENSURE that the peer review findings for the internal-events and other hazard PRAs that are relevant to the seismic PRA are resolved and that the disposition does not adversely affect into the development of the seismic PRA plant-response model.

DRAFT WORK PRODUCT DG-1362, Appendix B, Page B-21 Table B-1. Staff Position on ASME/ANS RA-S Case 1, Case for ASME/ANS RASb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment of Nuclear Power Plant Applications, Technical and Peer Review Requirements of a Level 1, Seismic PRA for the At-Power Operating Mode Index No Issue Position Resolution SPR-B3 Incorrect reference to SPR-C4 instead of SPR-C6.

Clarification INCLUDE seismically induced failures representing the failure modes of interest in the seismic PRA plant-response model (e.g., tank rupture, pump failure to start/run, etc.). (See SPR-C4SPR-C6.)

SPR-B4 No objection SPR-B5 The justification for the appropriate capacity based screening level needs to be provided.

Neither the action verb for this SR nor that used for SFR-C1 achieves that purpose.

Qualification SPECIFY JUSTIFY (e.g. based on the contribution to the risk quantification) an appropriate the set of criteria to be used in support of the screening of SSC failure modes on the basis of fragility. (See SFR-C1.)

SPR-B6 The term with a significant contributor to CDF or LERF is not defined. How can one determine the significance without performing the calculation?

Clarification USE a systematic approach to INCLUDE in the system analysis the effects of those relays or similar devices susceptible to contact chatter whose contact chatter results in the unavailability or spurious actuation of SSCs on the seismic equipment list. with a significant contribution to CDF or LERF.

SPR-B7 through SPR-B11 No objection Notes No objection Table 5-2.3-4 Introductory text No objection SPR-C1 through SPR-C6 No objection Table 5-2.3-5 Introductory text No objection SPR-D1, SPR-D2 No objection

DRAFT WORK PRODUCT DG-1362, Appendix B, Page B-22 Table B-1. Staff Position on ASME/ANS RA-S Case 1, Case for ASME/ANS RASb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment of Nuclear Power Plant Applications, Technical and Peer Review Requirements of a Level 1, Seismic PRA for the At-Power Operating Mode Index No Issue Position Resolution SPR-D3 Cue availability as well as dependencies are integral part of HRA analyses and maybe affected by seismic events.

Clarification For CC I:

CALCULATE the HEPs for all HFEs taking into account relevant seismic-related effects on control room and ex-control room post-initiator actions in accordance with the SRs for HLR-HR-G in Part 2 of this Standard as set forth under Capability Category I. In addressing influencing factors and the timing considerations covered in SRs HR-G3, HRG4, and HR-G5 in Part 2, attention is to be given to how the seismic event alters any previous assessments in non-seismic analyses including: additional workload and stress; effects of the seismic event on mitigation, cue availability, dependencies, required response, timing, accessibility, and potential for physical harm; and seismic-specific job aids and training.

For CC II:

CALCULATE the HEPs for all HFEs taking into account relevant seismic-related effects on control room and ex-control room post-initiator actions in accordance with the SRs for HLR-HR-G in Part 2 of this Standard as set forth under Capability Category II. In addressing influencing factors and the timing considerations covered in SRs HR-G3, HRG4, and HR-G5 in Part 2, attention is to be given to how the seismic event alters any previous assessments in non-seismic analyses including: additional workload and stress; effects of the seismic event on mitigation, cue availability, dependencies, required response, timing, accessibility, and potential for physical harm; and seismic-specific job aids and training.

SPR-D4 The action verb ESTIMATE implies using judgement or qualitative measures only which are Qualification For significant HFEs, ESTIMATE DETERMINE the timing aspects of the response actions (i.e., time of relevant indication, time available to complete

DRAFT WORK PRODUCT DG-1362, Appendix B, Page B-23 Table B-1. Staff Position on ASME/ANS RA-S Case 1, Case for ASME/ANS RASb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment of Nuclear Power Plant Applications, Technical and Peer Review Requirements of a Level 1, Seismic PRA for the At-Power Operating Mode Index No Issue Position Resolution inconsistent with the intent of the SR. Some of the examples of approaches provide more information than an estimate.

action, and time required to complete action) recognizing the sequence of events and expected seismic conditions based on one or a combination of the following approaches:

(a) Walk-throughs or talk-throughs of procedures with plant operations or training personnel (b) Simulator observations (c) Plant-specific thermal-hydraulic analyses (d) Realistic and applicable generic or similar plant thermal-hydraulic analyses.

Based on a review of procedures with plant operations or training personnel and recognizing the sequence of events and expected seismic conditions, CONFIRM for nonsignificant HFEs the timing aspects of the response actions.

SPR-D5 No objection Notes No objection Table 5-2.3-6 Introductory text No objection SPR-E1 through SPR-E3 No objection SPR-E4 The phrase dominant sequence insights is not defined in either Addendum A or Addendum B. Use of the term dominant was decided not to be used anywhere in the standard.

Clarification USE the quantification process to ensure that the components screened out, based on the screening level defined in SPR-B5, do not become a significant contributor or do not invalidate the dominant significant sequence insights of the seismic PRA.

SPR-E5 For CC II: It is not possible or necessary to quantify all uncertainties.

Clarification For CC II: QUANTIFY the mean core damage frequency and large early release frequency and propagate the parameter uncertainty that results from each input (i.e., the seismic hazard, the seismic

DRAFT WORK PRODUCT DG-1362, Appendix B, Page B-24 Table B-1. Staff Position on ASME/ANS RA-S Case 1, Case for ASME/ANS RASb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment of Nuclear Power Plant Applications, Technical and Peer Review Requirements of a Level 1, Seismic PRA for the At-Power Operating Mode Index No Issue Position Resolution fragilities, and the systems analysis).

SPR-E6 No objection SPR-E7 For CC II: The reference to Part 2 is missing for HLR-QU-E for CCII.

Clarification For CC II: PERFORM the uncertainty analysis consistent with HLR-QU-E of Part 2 addressing key assumptions in the hazard analysis (see SHA-J2), fragility analysis (see SFR-F3), and system modeling for Capability Category II.

Notes No objection Table 5-2.3-7 Introductory text No objection SPR-F1 No objection SPR-F2 The Code Case needs to specify the type of documentation to be provided, rather than relying on the discretion of the user.

Clarification DOCUMENT the process used in the seismic plant-response analysis and quantification, including. For example, this documentation typically includes a description of SPR-F3 No objection Notes No objection Section 5-3 Section 5-3 No objection Section 5-4 Section 5-4 No objection Nonmandatory Appendix 5-A Nonmandatory Appendix 5-A No objection

DRAFT WORK PRODUCT DG-1362, Appendix C, Page C-1 APPENDIX C GUIDANCE FOR CLASSIFYING CHANGES TO A PRA AS PRA MAINTENANCE OR A PRA UPGRADE A change to a base probabilistic risk assessment (PRA) may involve PRA maintenance, a PRA upgrade, or the use of a newly developed method. The distinction between these activities are important because a PRA upgrade or the use of a newly developed method need to be peer reviewed, whereas changes due to PRA maintenance do not need to be peer reviewed. When a peer review is needed, the level of detail of the peer review and the peer review team member qualifications differ between the peer review for a PRA upgrade and the peer review for the use of a newly developed method.

C.1 PRA Maintenance and PRA Upgrades PRA maintenance activities do not need a peer review because the base PRA will have been previously peer reviewed and the licensee has not made fundamental changes to the base PRA.

Consequently, the licensee will have demonstrated experience in applying the methods in the base PRA model. This is not true for PRA upgrades or use of a newly developed method which have not been previously peer reviewed. Therefore, the licensee has not demonstrated experience in applying the changes to the base PRA.

In applying the guidance described in staff position on peer reviews for PRA upgrades or new PRA methods (Section C.2.2), it needs to be determined whether the change to the PRA is PRA maintenance or a PRA upgrade, which includes the use of a newly developed method. Since PRA maintenance is defined as a change to the PRA that does not meet the definition of a PRA upgrade, the classification process is focused on determining whether a change to the PRA is a PRA upgrade, which includes use of newly developed methods. The definitions of the terms PRA upgrade, state-of-practice, PRA method, consensus method, and newly developed method are provided in the glossary of this regulatory guide. Consistent with these definitions, a change to the PRA is considered a PRA upgrade when the change results in the:

1) application of a PRA method previously used in the peer reviewed plant PRA that a) causes one or more supporting requirements in a consensus PRA standard to be applicable that were not applicable in the previous peer review (i.e., including changes in capability category; or b) is being applied in a different context

2) application of a PRA method not previously used in the peer reviewed plant PRA that a) is a consensus method or a newly developed method that has been subjected to a newly developed method peer review or, if the method is neither, it b) has been developed separately from a state-of-practice method or involves a fundamental change to a state-of-practice method (i.e., a newly developed method)

Changes related to list item 2.b require a newly developed method peer review, consistent with the staff position in Section C.2.2.2.2. Consistent with the above criteria for classifying a change to the PRA as PRA maintenance or a PRA upgrade and the definitions in the glossary of this regulatory guide,

DRAFT WORK PRODUCT DG-1362, Appendix C, Page C-2 the U.S. Nuclear Regulatory Commission (NRC) staff endorse the guidance provided in Section 3 of PWROG-19027-NP as one acceptable approach for determining whether a change to a PRA model is classified as PRA maintenance or a PRA upgrade.

C.2 Newly Developed Method A newly developed method is a method that has either been developed separately from a state-of-practice method or is one that involves a fundamental change to a state-of-practice method with respect to use in a PRA. A newly developed method for a PRA may well be used by other industries or other applications, but it has not been used to meet the requirements for a PRA model as defined by an applicable American Society of Mechanical Engineers (ASME)/American Nuclear Society (ANS) consensus PRA standard, and as endorsed in this regulatory guide. Therefore, a newly developed method is not considered to be part of the state-of-practice in developing PRA models for a nuclear power plant.

The NRC staff endorse the definition of the term newly developed method provided in PWROG-19027-NP, Newly Developed Method Requirements and Peer Review (Ref. 40), which has been reproduced in the glossary of this regulatory guide for reference.

As indicated in the definition of a newly developed method, such a method may have been developed separately from an existing method. Although the purpose and goal of the newly developed method may be similar to that of an existing method, the newly developed methods technical bases (e.g.,

assumptions and data) and the tools (e.g., analyses, equations) used to formulate the method are fundamentally different than that of the existing method. Additionally, a newly developed method may have been developed from an existing method that has been modified. A modified existing method is considered a newly developed method when the modifications result in fundamental changes to the technical bases and tools used to formulate the method. When a modified existing method does not result in such fundamental changes, it would be considered a revised method.

DRAFT WORK PRODUCT DG-1362, Appendix D, Page D-1 APPENDIX D OTHER HAZARDS There are numerous hazards (or threats) that can challenge the risk of a nuclear power plant.

They are hazards because they pose a threat in that they have the ability to have an adverse impact on the design and operation of the facility. These hazards are generally events or natural (or man-made) phenomena and are generally classified as either internal hazards or external hazards. Internal hazards are generally groups of hazards that occur internal to the plant site boundary while external hazards are generally groups of hazards that occur external to the plant site boundary. Historically, the hazards groups comprising internal hazards include occurrences such as equipment failures, human failure events, and flood and fire internal to the plant; and, external hazards include occurrences such as earthquakes, high wind and flood. There are, however, other hazards (both internal and external) that need to be considered for their potential impact on the risk, and which can formulate other hazard groups. In addition, a specific event may only pose a threat because it causes a condition which then challenges the design and operation of the plant A minimum list of hazards and their potential impacts that need to be considered are listed below in Table E-1. A hazard can be defined in three ways:

1.

A natural phenomenon, event, or accident that poses a direct risk to a facility

2.

A natural phenomenon or event that only poses a risk to a facility because it causes a hazard.

3.

A phenomenon that is exacerbated as a result of a hazard and then poses a risk to a facility.

The first is referred to as primary hazards. For simplicity, the latter two are referred to as secondary hazards. The analyst needs to evaluate each hazard to determine whether other primary or secondary hazards, given the specific facility (and its location), are possible.

In addition, the analyst needs to perform an evaluation to determine if the hazard (whether primary or secondary) can result in other impacts that pose a threat to the design and operation of the facility. The impacts are the actual adverse effects on the design and operation causing a functional failure of the plants SSCs or operator actions. Table E-2 provides a list of potential causes and conditions associated with the various hazards. These causes and conditions need to be considered when identifying and assessing potential hazards.

Table E-1. List of Hazards Hazard Group/Hazard Analyzed Hazard Impacts and Secondary Hazards INTERNAL HAZARDS Internal Events Failures of SSCs and human errors internal to the defined plant boundary.

Internal Fire Effects of fire that originate within the defined plant boundary Internal Flood Flooding that results from leaks or ruptures of liquid systems (e.g., tanks, pipes, valves, pumps) originating inside the plant site boundary.

EXTERNAL HAZARDS External flood:

An excess of water outside the plant boundary that causes functional failure to plant SSCs. Hazards that could potentially result in an external flood include:

DRAFT WORK PRODUCT DG-1362, Appendix D, Page D-2 Hazard Group/Hazard Analyzed Hazard Impacts and Secondary Hazards Dam Failure Flooding that results from the failure (i.e., structural collapse, severe leakage, or overtopping) of a dam that produces excess water flow past the structure.

Secondary hazards, the result of a dam failure, include, but not necessarily limited to:

• Low lake or river water level

• River and stream overflow

• River diversion Hurricane (Tropical Cyclone)

Flooding that results from the intense rain fall from the hurricane (tropical cyclone). Secondary hazards, the result of a hurricane, include, but not necessarily limited to:

• Dam failure

• High tide

• River and stream overflow

• Seiche

• Storm surge

• Wave Ice Blockage Flooding due to downstream blockages of ice on a river. Secondary hazards, the result of an ice blockage, include, but not necessarily limited to:

• River and stream overflow Local Intense Precipitation Flooding that results from intense local rainfall. Secondary hazard, the result of a local intense precipitation, include, but not necessarily limited to:

• Dam failure

• River and stream overflow Seiche Flooding from water displaced by an oscillation of the surface of a landlocked body of water, such as a lake, that can vary in period from minutes to several hours.

Storm Surge Flooding that results from an abnormal rise in sea level due to atmospheric pressure changes and strong wind generally accompanied by an intense storm.

Secondary hazards, the result of a storm surge, include, but not necessarily limited to:

• High tide

• River and stream overflow

• Wave Tsunami Flooding that results from a series of long-period sea waves that displaces massive amounts of water as a result of an impulsive disturbance, such as a, major submarine slides or landslides. Secondary hazards, the result of a tsunami, include, but not necessarily limited to:

• River and stream overflow High Wind:

Strong winds resulting in dynamic loading or missiles on SCCS causing functional failure. Hazards that could potentially result in high wind include:

DRAFT WORK PRODUCT DG-1362, Appendix D, Page D-3 Hazard Group/Hazard Analyzed Hazard Impacts and Secondary Hazards Hurricane (Tropical Cyclone)

Winds Severe winds developed from a tropical depression resulting in missiles or dynamic loading on SSCs. Secondary hazards, the result of a hurricane, include, but not necessarily limited to:

• Tornado Straight Wind A strong wind resulting in missiles or dynamic loading on SSCs that is not associated with either hurricanes or tornadoes.

Tornado A strong whirlwind that results in missiles or dynamic loading on SSCs.

Tectonic Activity (see Note 1)

Severe force that changes the structure of the earths crust causing SSC functional failure. Hazards that could potentially result in tectonic include Seismic Activity Sudden ground motion or vibration of the Earth as produced by a rapid release of stored-up energy along an active fault. Secondary hazards, the result of a seismic activity, includes, but not necessarily limited to

• Avalanche (both rock and snow)

• Dam failure

• Industrial accidents

• Landslide

• Seiche

• Tsunami

• Vehicle accidents Volcanic Activity Opening of earths crust resulting in tephra (i.e., rock fragments and particles ejected by volcanic eruption), lava flows, lahars (i.e., mud flows down volcano slopes), volcanic gases, pyroclastic flows (i.e., fast-moving flow of hot gas and volcanic matter moving down and away from a volcano), and landslides.

Indirect impacts include distant ash fallout (e.g., 10s to potentially 1,000s of miles away). Secondary hazards, the result of volcanic activity, includes, but not necessarily limited to:

• Seismic

• Fire Note 1 Seismic activity and volcanic activity are hazards in the tectonic activity hazard group. However, historically, seismic activity has been evaluated as a hazard group (Part 5 of this standard). Volcanic activity would be evaluated as a hazard group as part of other hazards.

OTHER HAZARDS External Fire:

Direct (e.g., thermal effects) and indirect effects (e.g., generation of combustion products, transport of firebrand) of a fire outside the plant boundary that causes functional failure of plant SSCs. Hazards that could potentially result in external fire include Wildfire, forest fire, grass fire The different causes of fire that can occur outside the site boundary.

Extreme Temperature An occurrence of extreme heat or cold temperatures causing SSC functional failure. Hazards that could potentially result in extreme temperature include

DRAFT WORK PRODUCT DG-1362, Appendix D, Page D-4 Hazard Group/Hazard Analyzed Hazard Impacts and Secondary Hazards High Ambient Temperature Effects on SSCs operation due to abnormally high ambient temperatures resulting from weather phenomena. Secondary hazards, the result of high ambient temperatures, includes, but not necessarily limited to:

• Low Lake or River Water Level Low Ambient Temperature Effects on SSC operation due to abnormally low ambient temperatures resulting from weather phenomena. A secondary hazard, the result of low ambient temperatures, includes, but not necessarily limited to:

• Frost

• Ice cover

• Snow Ground Shifts Surface movement of the ground (not associated with tectonic activity) causing SSC functional failure. Hazards that could potentially result in ground shifts include Avalanche Rapid flow of a large mass of accumulated frozen precipitation and other debris down a sloped surface resulting in dynamic loading of SSCs at or in the plant analyzed area causing functional failure, or adverse impact on natural water supplies used for heat rejection.

Coastal Erosion Removal of material from a shoreline of a body of water (e.g., river, lake, ocean) due to surface processes (e.g., wave action, tidal currents, wave currents, drainage, or winds and including river bed scouring) that results in damage to foundation of SSCs at or in the plant analyzed area causing functional failure.

Landslide Dynamic loading of SSCs or impacts on natural water supplies used for heat rejection due to movement of rock, soil, and mud down a sloped surface (i.e.,

does not include frozen precipitation).

Soil Shrink-Swell Dynamic forces on structures foundations due to the expansion (swelling) and contraction (shrinking) of soil resulting from changes in the soil moisture content.

Industrial Accidents Accidents occurring offsite at a facility, or man-made accidents occurring onsite, causing functional failure of plant SSCs. Hazards that could potentially result in an industrial accident include:

Heavy Load Drop The uncontrolled lowering of a load to the point where contact with an underlying surface or some object stops any further decent.

Industrial or military accident An accident at an offsite industrial or military facility that results in a release of toxic gases, a release of combustion products, a release of radioactivity, an explosion, or the generation of missiles.

Onsite Hazardous Material Release A release of hazardous material including, but not limited to toxic or asphyxiant gases, liquids, combustion products, or radioactivity. Such releases may be concurrent with or induce an explosion or the generation of missiles. In this context, an onsite release of radioactivity is assumed to be associated with low-level radioactive waste.

DRAFT WORK PRODUCT DG-1362, Appendix D, Page D-5 Hazard Group/Hazard Analyzed Hazard Impacts and Secondary Hazards Pipeline Accident A release of hazardous material, a release of combustion products, an explosion, or generation of missiles due to an accident involving the rupture of a pipeline carrying hazardous materials.

Site-Generated Missiles Damage to safety-related structures, systems, and components (SSCs) from a missile generated from rotating turbines or other stuff. Damage may result from a falling missile or a missile ejected directly toward safety-related SSCs (i.e., low-trajectory missiles).

Transportation Accidents Accidents involving transportation resulting in collision with SSCs, a release of hazardous materials or combustion products, an explosion, or a generation of missiles, causing functional failure of SSCs. Hazards that could potentially result in transportation accidents include:

Aircraft An aircraft (either a portion of [e.g., missile] or the entire aircraft) that collides either directly or indirectly (i.e., skidding impact with one or more structures, systems, or components (SSCs) at or in the plant analyzed area causing functional failure. Secondary hazards, the result of the aircraft accident, includes, but not necessarily limited to:

• fire Vehicle, railcar, marine An accident of a vehicle, railcar or ship (boat) that involves a collision, derailment, potentially resulting in fire, explosions, toxic releases, missiles, etc.

Other Natural Phenomena An observable geologic or meteorological event that causes functional failure of SSCs. Hazards that could potentially result in other natural phenomena include:

Biological Events Accumulation or deposition of vegetation or organisms (e.g., zebra mussels, clams, fish, algae, etc.) on an intake structure or internal to a system that uses raw cooling water from a source of surface water, and therefore, causing its functional failure.

Drought A shortage of surface water supplies due to a period of below-average precipitation in a given region, thereby depleting the water supply needed for the various water cooling functions to the facility.

Dust Storm Persistent heavy winds transporting sand or dust that infiltrate SSCs at or in the plant analyzed area causing functional failure.

Fog Low lying water vapor in form of cloud or obscuring haze of atmospheric dust or smoke resulting in impeded visibility that could result in transportation accident.

Hail A shower of ice or hard snow that could result in transportation accidents or directly causing dynamic loading or freezing conditions as a result of ice coverage.

Ice Blockage Flooding due to downstream blockages of ice on a river. Secondary hazards, the result of an ice blockage, include, but not necessarily limited to:

• River and stream overflow

DRAFT WORK PRODUCT DG-1362, Appendix D, Page D-6 Hazard Group/Hazard Analyzed Hazard Impacts and Secondary Hazards Lightning Effects on SSCs due to a sudden electrical discharge from a cloud to the ground or Earth-bound object.

Snow The accumulation of snow resulting could result in transportation accidents, or directly cause dynamic loading or freezing conditions as a result of snow cover.

Extraterrestrial Object Impacts A release of energy due to the impact of a space object such as a meteoroid, comet, or man-made satellite with the Earths atmosphere, a direct impact with the Earths surface, or a combination of these effects. This hazard is analyzed with respect to direct impacts of an SSC and indirect impact effects such as thermal effects (e.g., radiative heat transfer), overpressure effects, seismic effects, and the effects of ejecta resulting from a ground strike.

Table E-2. List of Hazard Causes and Conditions Combustion/fire - resulting in burning, release of hot/toxic gases, release of combustion products, or heat causing functional failure of SSCs and/or ability of operator to perform.

Debris effects - resulting in clogging of filters or adversely effecting equipment performance.

Dynamic forces (from dynamic or static loading) - resulting in structural damage to SSCs causing functional failure of SSCs or impeded operator ability to perform Explosions - resulting in fire, missiles, gas releases Effects on operator ability to:

perform an action due to physical obstacles perform a cognitive function see breath communicate obtain available information (e.g., poor procedures, poor or no indication)

High energy arcs Missiles - projectiles damaging structures and equipment Physical obstruction - movement of structures or equipment reducing accessibility Reduced air quality - combustion products affecting equipment or operator performance Reduced availability of cooling water Structural failure, including collapse functional failure (e.g., break in containment, or settlement of a structure)

DRAFT WORK PRODUCT DG-1362, Appendix D, Page D-7 loss of structural integrity Thermal effects including Heat transfer (Radiative, conductive, or convective, advection (i.e., bulk transport of a fluid))

Steam Water effects - water infiltration, submergence or spray causing corrosion, loss of electrical integrity (e.g., electrical short), clogging, inaccessibility, structural failure