NL-21-0019, Response to Request for Additional Information Regarding Application to Adopt 10 CFR 50.69, Risk-informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors

Response to Request for Additional Information Regarding Application to Adopt 10 CFR 50.69, Risk-informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors

ML21064A526
Person / Time
Site:	Farley
Issue date:	03/02/2021
From:	Gayheart C Southern Nuclear Operating Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
NL-21-0019
Download: ML21064A526 (151)

Text

~ Southern Nuclear Cheryl A. Gayheart Regulatory Affairs Director 3535 Colonnade Parkway Binningharn, AL 35243 205 992 5316 tel 205 992 7601 fax cagayhea@southemco.com March 2, 2021 Docket Nos. : 50-348 NL-21-0019 50-364 U. S. Nuclear Regulatory Commission ATTN : Document Control Desk Washington, D. C. 20555-0001 Joseph M. Farley Nuclear Plant - Units 1 and 2 Response to Request for Additional Information Regarding Application to Adopt 10 CFR 50.69, "Risk-informed categorization and treatment of structures, systems and components for nuclear power reactors" Ladies and Gentlemen:

By letter dated June 18, 2020, Southern Nuclear Operating Company (SNC) submitted an application to modify the Joseph M. Farley Nuclear Plant (Farley) licensing basis, by the addition of a License Condition, to allow for the implementation of the provisions of Title 10 of the Code of Federal Regulations (10 CFR), Part 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors."

By email dated January 12, 2021 , the Nuclear Regulatory Commission (NRC) staff issued a request for additional information (RAI). Enclosure 1 to this letter provides the SNC response to the NRC staffs RAI. Enclosure 2 provides referenced Electric Power Research Institute (EPRI)

Report 3002017583, "Alternative Approaches for Addressing Seismic Risk in 10 CFR 50.69 Risk-Informed Categorization".

The conclusions of the No Significant Hazards Consideration and Environmental Consideration contained in the original application have been reviewed and are unaffected by this response.

This letter contains no NRC commitments. If you have any questions, please contact Jamie Coleman at 205.992.6611.

I declare under penalty of perjury that the foregoing is true and correct. Executed on the 2nd day of March 2021.

Respectfully submitted, Cheryl G h art Director, Regulatory Affairs Southern Nuclear Operating Company CAG/RMJ

U.S. Nuclear Regulatory Commission NL-21-0019 Page 2

Enclosures:

1. SNC Response to NRC RAI

2. EPRI Report 3002017583 cc: Regional Administrator, Region ll NRR Project Manager - Farley Senior Resident Inspector - Farley Director, Alabama Office of Radiation Control RTYPE: CFA04.054

Joseph M. Farley Nuclear Plant - Units 1 and 2 Response to Request for Additional Information Regarding Application to Adopt 10 CFR 50.69, "Risk-informed categorization and treatment of structures, systems and components for nuclear power reactors" Enclosure 1 SNC Response to NRC RAI to NL-21-0019 SNC Response to NRC RAI NRC RAI 1:

Paragraph (b)(2)(ii) of 10 CFR 50.69 requires that the quality and level of detail of the systematic processes that evaluate the plant for external events during operation are adequate for the categorization of Structures, Systems, and Components.

In the LAR, the licensee proposes to address seismic hazard risk using the alternative seismic approach for seismic Tier-1 plants described in Electric Power Research Institute (EPRI) Report 3002017583, "Alternative Approaches for Addressing Seismic Risk in 10 CFR 50.69 Risk-Informed Categorization" (https://www.epri.com/research/products/000000003002017583) and other qualitative considerations. The NRC staff understands that EPRI 3002017583 is an updated version of EPRI 3002012988 that was reviewed in conjunction with its review of the Calvert Cliffs Nuclear Power Plant (CCNPP), Units 1 and 2, LAR for adoption of 10 CFR 50.69 (precedent) dated November 28, 2018 (ADAMS Accession No. ML18333A022). The staff has not reviewed or endorsed EPRI 3002012988 as a topical report for generic use. As such, each licensee needs to perform a plant-specific review for applicability of the Tier-1 alternative seismic approach. The NRC staff reviewed and approved CCNPP's alternative seismic approach, which was based on information for Tier-1 plants included in EPRI 3002012988 and information provided in the supplements to the CCNPP LAR. Information in the supplements to the CCNPP LAR (ADAMS Accession Nos. ML19130A180, ML19200A216, ML19217A143, and ML19183A012) that was used to support the staff's review and approval of that approach is included in the staff's safety evaluation for the CCNPP LAR (ADAMS Accession No. ML19330D909).

The NRC staff notes that the licensee's proposed alternative seismic approach is similar to that reviewed and approved in the CCNPP safety evaluation. However, the licensee's proposed approach is based on information for Tier-1 plants as described in EPRI 3002017583 instead of EPRI 3002012988.

Further, the staff notes that EPRI 3002017583 does not contain all the information in the supplements to the CCNPP LAR that supported the use of EPRI's alternative seismic approach for Tier-1 plants in the CCNPP plant-specific safety evaluation. Therefore, the licensee is requested to address the following:

(a) The licensee cited EPRI report 3002017583 as applicable to their submittal, please submit EPRI report 3002017583 on the docket.

(b) Identify and describe the differences between EPRI 3002017583 and EPRI 3002012988.

(c) Explain whether EPRI 3002017583 includes all the information from the CCNPP LAR supplements that was used to support the staff's review of the alternative seismic approach for Tier-1 plants described in EPRI 3002012988. If any information from the CCNPP LAR supplements are not included in EPRI 3002017583, justify such exclusion for the licensee's proposed alternative seismic approach or indicate where it is addressed in the licensee's application for Farley.

(d) Based on the responses to items (b) and (c), justify why a separate staff review of EPRI 3002017583 for the licensee's proposed alternative seismic approach is not warranted.

E1-1 to NL-21-0019 SNC Response to NRC RAI (e) Identify and justify any differences between the licensee's proposed alternative seismic approach and the NRC staff approval of the precedent documented in the CCNPP safety evaluation, including any Farley-specific considerations.

SNC Response to NRC RAI 1:

(a) The requested EPRI document is provided as Enclosure 2.

(b) The technical criteria in EPRI Report 3002017583 is unchanged from EPRI Report 3002012988. The Product Description at the beginning of EPRI Report 3002017583 states the following:

"This Technical Update incorporates updates submitted to the NRC in an RAI submittal for the Calvert Cliffs 50.69 LAR into the previous version of this report, EPRI 3002012988. Aside from those updates, the technical criteria in this report remains unchanged."

Exelon provided the seismic alternative markups to Report 3002012988 in Attachment 2 of its July 19, 2019 RAI response submittal (ML19200A216).

In addition, EPRI Report 3002017583 incorporated a few minor editorial changes including the following:

1. Figure 1-2 was edited to include EPRI 3002017583 in the list of §50.69 supplemental guidance documents.

2. Figure 2-2, Low Seismic Hazard Site: Typical SSE to GMRS Comparison -

replaced graph with correct graph.

(c) EPRI 3002017583 has incorporated all the information and follow up actions from the CCNPP LAR supplements that was agreed upon by the NRC staffs review of the alternative seismic approach for Tier -1 plants. Therefore, Attachment 2 of ML19200A216 are applicable to Farley since it is using the updated EPRI Document 3002017583, Alternative Approaches for Addressing Seismic Risk in 10CFR 50.69 Risk-Informed Categorization. Farleys applicability to other CCNPP LAR supplements and attachments are addressed below:

E1-2 to NL-21-0019 SNC Response to NRC RAI Table RAI-01-1. Farley Applicability to CCNPP LAR supplements.

Incorporated Applicable into EPRI Item to Farley 3002017583 Basis ML19130A180 CCNPP Supplement 05/10/2019 The revisions to the CCNPP LAR, expect areas that were specific to Attachment 1 x CCNPP, were included throughout Section 3 of the Farley LAR.

ML19183A012 CCNPP Supplement 07/01/2019 The two paragraphs cited are in Section 3.2.3 of the Farley LAR. The RAI 4 a. x clarification discussed in the CCNPP response would apply to Farley.

Farley has a peer reviewed Seismic PRA that meets the guidance in RAI 4 b. x RG 1.200. All F&Os were closed through the Appendix X process.

SSCs credited for screening of external hazards will be evaluated according to the flow chart in NEI 00-04, Figure 5-6. See SNC RAI 5 x response to RAI 1(e).

In accordance with NEI 00-04 and existing SNC fleet procedures, Interfacing functions/SSC will not be categorized and will not be subject to alternative treatment until categorization of all the systems that are supported is complete unless the function/SSC is initially RAI 6 x categorized as HSS For plant Farley, FLEX methodology, equipment, and associated RAI 8 a. x operator actions are discussed in RAI 2.

For plant Farley, FLEX methodology, equipment, and associated RAI 8 b. x operator actions are discussed in RAI 2.

ML19200A216 CCNPP Supplement 07/19/2019 Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within RAI 1 a. x x EPRI 3002017583 Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within RAI 1 b. x x EPRI 3002017583 E1-3 to NL-21-0019 SNC Response to NRC RAI Table RAI-01-1. Farley Applicability to CCNPP LAR supplements.

Incorporated Applicable into EPRI Item to Farley 3002017583 Basis Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within RAI 1 c. x x EPRI 3002017583 Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within RAI 1 d. x x EPRI 3002017583 Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within RAI 1 e. EPRI 3002017583.

Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within RAI 1 f. x EPRI 3002017583.

Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within RAI 2 a. i. x x EPRI 3002017583 Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within RAI 2 a. ii. x x EPRI 3002017583 Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within RAI 2 b. i. x x EPRI 3002017583 Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within RAI 2 b. ii. x x EPRI 3002017583 Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within RAI 3 a. i. x x EPRI 3002017583 E1-4 to NL-21-0019 SNC Response to NRC RAI Table RAI-01-1. Farley Applicability to CCNPP LAR supplements.

Incorporated Applicable into EPRI Item to Farley 3002017583 Basis Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within RAI 3 a. ii. x x EPRI 3002017583 Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within RAI 3 b. x x EPRI 3002017583 Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within RAI 3 c. i. x x EPRI 3002017583 Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within RAI 3 c. ii. x x EPRI 3002017583 Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within RAI 3 c. iii. x x EPRI 3002017583 Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within RAI 3 c. iv. x x EPRI 3002017583 Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within RAI 3 d. i. x x EPRI 3002017583 Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within RAI 3 d. ii. x x EPRI 3002017583 E1-5 to NL-21-0019 SNC Response to NRC RAI Table RAI-01-1. Farley Applicability to CCNPP LAR supplements.

Incorporated Applicable into EPRI Item to Farley 3002017583 Basis The PRA key assumptions and sources of uncertainty are determined consistent with the definitions in RG 1.200. The Disposition of Key Assumptions/ Sources of Uncertainty are discussed in Attachment 6 RAI 7 a. x of the June 18, 2020 Farley application.

Not applicable to Farley. No new key assumptions and sources of RAI 7 b. uncertainty have been identified for the application.

The Disposition of Key Assumptions/ Sources of Uncertainty are RAI 7 c. x discussed in Attachment 6 of the June 18, 2020 Farley application.

ML19217A143 CCNPP Supplement 08/05/2019 This supplement revised part of the response to RAI 3 c. iv. Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within EPRI RAI 3 c. iv. Revised x x 3002017583.

E1-6 to NL-21-0019 SNC Response to NRC RAI (d) A separate staff review of EPRI 3002017583 for the Farley proposed alternative seismic approach is not warranted based on the following:

i. Other than the incorporation of updates submitted to the NRC in an RAI submittal for the CCNPP 50.69 LAR, the technical criteria from EPRI 3002012988 is unchanged, as described in response 1b; ii. SNC confirmation that EPRI 3002017583 has incorporated the agreed upon information and follow up actions from the CCNPP LAR supplements from NRC staffs review of the alternative seismic approach for Tier 1 as described in response 1c; and iii. Review of CCNPP LAR supplements for their applicability to Farley in response 1c.

(e) In review of the CCNPP SE, two differences were identified from the proposed alternative seismic approach documented in the Farley LAR. As discussed below, both of these differences will be incorporated into the categorization process.

1. In the section Monitoring of Inputs to and Outcome of Proposed Alternative Seismic Approach of the CCNPP SE, the configuration control program for CCNPP had been updated to include a checklist of configuration activities to recognize those systems that have been categorized in accordance with 10 CFR 50.69, to ensure that any physical change to the plant or change to plant documents is evaluated prior to implementing those changes. This checklist is the same as what is included in Section 3.5 of the Farley LAR except for Review of impact to seismic loading and SSE seismic requirements, as well as the method of combining seismic components. This checklist item will also be included in the SNC configuration control program.

2. Section 3.5.3.2 of the CCNPP SE discusses categorization assessment of other external hazard, NEI 00-04 requires that, as part of the external hazard screening, an evaluation be conducted to determine if there are components that participate in screened scenarios and whose failure would result in an unscreened scenario and that such SSCs are required to be high safety-significant in the categorization process. The evaluation is not mentioned in the Farley LAR. This evaluation will also be included in the SNC categorization assessment of other external hazard risk. Consistent with the flow chart in Figure 5-6 in Section 5.4 of NEI 00-04, these components would be considered high safety-significant (HSS).

E1-7 to NL-21-0019 SNC Response to NRC RAI NRC RAI 2:

The NRC memorandum dated May 30, 2017, "Assessment of the Nuclear Energy Institute 16-06, 'Crediting Mitigating Strategies in Risk-Informed Decision Making,' Guidance for Risk-Informed Changes to Plants Licensing Basis" (ADAMS Accession No. ML17031A269), provides the NRC's staff assessment of challenges to incorporating FLEX equipment and strategies into a PRA model in support of risk-informed decision making in accordance with the guidance of RG 1.200, Revision 2.

Section 3.3 of the LAR mentions the PRA modeling of FLEX equipment and FLEX operator actions. More information is needed for the NRC staff to determine the acceptability of incorporation of FLEX equipment into the PRA models. Please provide the following information for the internal events and internal flooding PRAs, as appropriate:

(a) A discussion detailing the extent of incorporation, i.e., summarizing the supplemental equipment and compensatory actions, including FLEX strategies, that have been credited quantitatively for each of the PRA models used to support this application.

(b) A discussion detailing the methodology used to assess the failure probabilities of any modeled equipment credited in the licensee's mitigating strategies (i.e., FLEX). The discussion should include a justification of the rationale for parameter values, and how the uncertainties associated with the parameter values are considered in the categorization process in accordance with ASME/ANS RA-Sa-2009, as endorsed by RG 1.200 (e.g., supporting requirements for HLR-DA-D).

(c) A discussion detailing the methodology used to assess operator actions related to FLEX equipment and the licensee personnel that perform these actions. The discussion should include:

i. A summary of how the licensee evaluated the impact of the plant-specific human error probabilities and associated scenario-specific performance shaping factors listed in (a)-(j) of supporting requirement HR-G3 of ASME/ANS RA-Sa-2009, as endorsed by RG 1.200.

ii. Whether maintenance procedures for the portable equipment were reviewed for possible pre-initiator human failures that renders the equipment unavailable during an event, and whether the probabilities of the pre-initiator human failure events were assessed as described in HLR-HR-D of ASME/ANS RA-Sa-2009, as endorsed by RG 1.200.

iii. If the licensee's procedures governing the initiation or entry into mitigating strategies are ambiguous, vague, or not explicit, a discussion detailing the technical basis for probability of failure to initiate mitigating strategies.

(d) ASME/ANS RA-Sa-2009 defines PRA upgrade as the incorporation into a PRA model of a new methodology or significant changes in scope or capability that impact the significant accident sequences or the significant accident progression sequences. Section 1-5 of Part 1 of ASME/ANS RA-Sa-2009 states that upgrades of a PRA shall receive a peer review in accordance with the requirements specified in the peer review section of each respective part of this standard.

E1-8 to NL-21-0019 SNC Response to NRC RAI

i. Provide an evaluation of the model changes associated with incorporating mitigating strategies, which demonstrates that none of the following criteria is satisfied: (1) use of new methodology, (2) change in scope that impacts the significant accident sequences or the significant accident progression sequences, (3) change in capability that impacts the significant accident sequences or the significant accident progression sequences, OR ii. Propose a mechanism to ensure that a focused-scope peer review is performed on the model changes associated with incorporating mitigating strategies, and associated F&Os are resolved to Capability Category II prior to implementation of the 10 CFR 50.69 categorization program.

(e) OR, as an alternative to Parts (a), (b), (c), and (d), above: Remove credit for FLEX equipment in the PRA used to support this LAR, and provide updated risk results (i.e.,

LAR Attachment 2) that does not credit FLEX equipment and actions.

E1-9 to NL-21-0019 SNC Response to NRC RAI SNC Response to NRC RAI 2 (a) As part of the plant modifications associated with FLEX implementation, certain portable FLEX equipment is stored in the FLEX storage dome and are installed in the plant. The plant procedures have also been revised to include these plant modifications. The FLEX operator actions, and equipment are credited in the Farley Internal Events, Internal Flooding, and Fire PRA models, which are used in 10 CFR 50.69 categorization. A summary of credited FLEX strategies, supplemental equipment, and compensatory actions associated with extended loss of offsite power conditions are shown in Table RAI-02-1.

Table RAI-02-1. Credited FLEX Strategy, Equipment, and Actions in PRA Flex Strategy - Supplemental Compensatory Credited Action Modeled Equipment Actions Stage portable battery powered lighting for use in MCR after load shed x x x Minimize battery load to extend operations of the DC and Vital AC busses x x Open doors for ventilation of the battery and DC equipment rooms x x Manually control the TDAFWP x Opening of the MCR access doors for sufficient ventilation x x Stage and connect 600V Flex DG to DC bus battery chargers x x x Deploy portable fans for switchgear rooms for proper ventilation x x x Stage and connect SG Flex pump in the event the TDAFWP fails x x x Transfer makeup water from RMWST to the CST using the SG Flex pump before CST inventory is exhausted. x x Install portable fans in MCR to maintain an acceptable temperature x x x E1-10 to NL-21-0019 SNC Response to NRC RAI (b) Neither plant-specific data nor generic industry parameter estimates are available for the portable FLEX diesel generators, pumps, and fans; therefore, use of the Farley Bayesian updated data for diesel generators and diesel HVAC fans are used for FLEX diesel generators and fans. Use of generic industry parameter estimates from NUREG/CR-6928 are used for the FLEX pumps.

The portable FLEX diesel generators, pumps, and fans are not like other installed plant equipment, thus an additional factor of two is applied to the unreliability failure probabilities. This escalation is a reasonable approximation of the unreliability of portable FLEX equipment according to the guidance in NEI 12-06 until industry data is published.

The uncertainties associated with the FLEX equipment data values are based upon the uncertainty parameters from the Farley Bayesian updated data (diesel generators and fans) and generic industry data (pumps) and are in accordance with the ASME/ANS PRA Standard. Use of these values should provide a reasonable approximation of the reliability of the FLEX equipment until industry-approved data becomes available for FLEX equipment.

A sensitivity analysis was performed to assess the impact FLEX equipment probability has on CDF and LERF. The FLEX equipment failure probabilities were increased by a factor of five. A factor of 3 means that the resulting sensitivity is larger than the base case 95th percentile. Table RAI-02-2 summarizes the results from the sensitivity. The sensitivity shows there is a small change to CDF and LERF, and the dominant failures of FLEX strategies in the PRA model are HRA related. Since there is no significant impact on CDF or LERF from the parametric uncertainty, there is no significant impact on the 50.69 program risk assessment.

Table RAI-02-2. FLEX Equipment Failure Rate Sensitivity Unit 1 Delta Unit 2 Delta Internal Events CDF 7.0E-08 2.3E-08 LERF 1.4E-10 4.5E-11 Internal Flood CDF 0.0E+00 0.0E+00 LERF 0.0E+00 0.0E+00 Fire CDF 1.5E-06 1.5E-08 LERF 3.3E-09 0.0E+00 Total Delta 1.5E-06 3.8E-08 CDF Total Delta 3.4E-09 4.5E-11 LERF E1-11 to NL-21-0019 SNC Response to NRC RAI (c)

i. The impacts of the performance shaping factors on the HEPs for the operator actions associated with the FLEX modeling were evaluated in HRA Post-Initiators

& Dependency Analysis and are listed in Table RAI-02-3. The aggregate HEP for the FLEX/ELAP actions is approximately 1.0E-1, which is consistent with the NEI 16-06 (Reference F.13) screening probabilities for FLEX strategies and considered to represent a reasonable approximation of the overall failure probability of a complex mitigation strategy employing portable equipment in potentially challenging conditions.

E1-12 to NL-21-0019 SNC Response to NRC RAI Table RAI-02-3. FLEX Credited Actions Credited Action PSF Impact Basis PSF Impact Stage portable For a case in which the determination that AC power will not be recovered within 4 Negative battery powered hours of plant trip has been made by the procedurally directed time frame from plant lighting for use in trip, the operators would potentially be finished with MCR light de-energization with MCR after load shed plenty of time to spare from plant trip. This limited amount of time required to finish the MCR light de-energization would allow them to completely re-perform the MCR light de-energization action, if necessary (based on the slowest recorded validation time). With one operator per unit, this is not a high workload task.

The operators would be working in SBO conditions in which emergency and/or portable lighting would be required.

Minimize battery For a case in which the determination that AC power will not be recovered within 4 Negative load to extend hours of plant trip has been made by the procedurally directed time frame from plant operations of the DC trip, the operators would potentially be finished with load within minimal time from plant and Vital AC busses trip. This would allow them to completely re-perform the load shed action, if necessary (based on the slowest recorded validation time). With one SO per unit, this is not a high workload task.

The SOs would be working in SBO conditions in which emergency and/or portable lighting would be required.

E1-13 to NL-21-0019 SNC Response to NRC RAI Table RAI-02-3. FLEX Credited Actions Credited Action PSF Impact Basis PSF Impact Manually control the For this case, the plant response is not as expected in that there is an extended SBO, Negative TDAFWP but the FLEX strategies are available to mitigate these conditions and the crews have trained to perform them. While the ELAP scenario is undesirable, load shed actions would have been completed successfully or be in progress, SG level would initially be maintained by TDAFW, and adequate time would be available for the SOs to perform the action. There is no indication that the plant is heading toward core damage.

The crew would have adequate time to begin the process of establishing local control of the TDAFW pump, though there are actions to which the responsible SOs would be assigned prior to taking local control of the TDAFW pump. However, those tasks are expected to be complete with adequate time to spare. This does not correlate to conditions in which the crew would be at the limit of what they could achieve in the time that is available. "Low" workload is assigned.

Due to loss of power, Auxiliary Building elevators and HVAC will be unavailable.

Flashlights and headlamps will be available for personnel. Due to heat in the area around the TDAFW pump, the operator may move to a cooler area and make periodic checks on the pump. Continuous monitoring is not required. "Negative" PSFs are considered to always be applicable.

Stage and connect For this case, the plant response is not as expected in that there is an extended SBO, Moderate 600V Flex DG to DC but the FLEX strategies are available to mitigate these conditions and the crews have bus battery chargers trained to perform them. Once ELAP is declared, this is the expected response. While Opening of the MCR the ELAP scenario is undesirable, the load shed action would have been completed access doors for successfully. The TDAFW failure is an additional complication, but the time available sufficient ventilation for the alignment of the 600V FLEX D/G is still the same and the response plan for the generator crew would remain the same. If a serious problem occurred with the pump deployment task that required the crew to help with that task, it would cause a disruption, but this is not assumed to happen.

There is an abundant amount of recovery time available for this action even with debris removal required. The workload is not high.

The lineup includes outdoor activity and for SBO cases, adverse weather is likely (adverse conditions assumed to exist).

E1-14 to NL-21-0019 SNC Response to NRC RAI Table RAI-02-3. FLEX Credited Actions Credited Action PSF Impact Basis PSF Impact Deploy portable fans For this case, the plant response is not as expected in that there is an extended SBO, Moderate for switchgear rooms but the FLEX strategies are available to mitigate these conditions and the crews have for proper ventilation trained to perform them. Once ELAP conditions are identified, this is the expected Stage and connect response. While the ELAP scenario is undesirable, the load shed action would have 600V Flex DG to DC been completed successfully, SG level would initially be being maintained by TDAFW, bus battery chargers and adequate time (many hours) would be available for the alignment of the portable fans for DC Switchgear and Battery Charger Room cooling. However, for the PRA scenarios, TDAFW pump fails as early as 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> from plant trip, which may be before or during the time when the crew is staging and connecting the portable fans. The TDAFW failure is an additional complication, but the time available for the alignment of the fans is still the same and the response plan for the crew would remain the same. If a serious problem occurred with the pump deployment task that required the crew to help with that task, it would cause a disruption, but this is not assumed to happen.

There are several hours available to perform the initial work completing the initiation of the fans after 600V FLEX DG start was described as not challenging by plant staff.

Other than obtaining the ductwork from the FLEX trailer and transport vehicle, the work is performed indoors. If, for some reason, the work is completed near the end of the allow time window, temperatures would be around 120 degrees, which correlates to a "negative" condition. In addition, the work would be performed in emergency lighting conditions, which are not optimal.

E1-15 to NL-21-0019 SNC Response to NRC RAI Table RAI-02-3. FLEX Credited Actions Credited Action PSF Impact Basis PSF Impact Stage and connect For this case, the plant response is not as expected in that there is an extended SBO, High SG Flex pump in the but the FLEX strategies are available to mitigate these conditions and the crews have event the TDAFWP trained to perform them. Once the FLEX strategies are initiated, this is the expected fails Deploy portable response. While the ELAP scenario is undesirable, the load shed action would have fans for switchgear been completed successfully, SG level would initially be being maintained by TDAFW, rooms for proper and adequate time (many hours) would be available for the alignment of the SG FLEX ventilation Pump to help maintain the plant in a stable condition. However, for the PRA scenarios, TDAFW pump fails as early as 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> from plant trip, which may be before or during the time when the crew is staging and connecting the SG FLEX Pump. Loss of the only available SG makeup pump would put pressure on the crew members because unless they succeed, core damage would occur unless AC power is recovered. There is substantial time available to complete the SG FLEX Pump alignment, but the crew members would not have a clear indication of how much time is available to them for the alignment (though it is known for the PRA evaluation). This is considered to be a condition that is not an expected plant response.

Initiate SG Flex For this case, the plant response is not as expected in that there is an extended SBO, Moderate Pump makeup after but the FLEX strategies are available to mitigate these conditions and the crews have TDAFW Pump trained to perform them. While the ELAP scenario is undesirable, load shed actions failure stage and would have been completed successfully, SG level would have been maintained by connect SG Flex TDAFW for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, and adequate time (several hours) would be available for the pump in the event initiation of the SG FLEX Pump to help maintain the plant in a stable condition after the TDAFWP fails completion of the SG FLEX pump staging/connection action. For these reasons, this is not considered to be a high stress action, particularly because of the long period of time over which the action occurs and the significant time margin that is available to the crew.

The crew would have several hours to initiate SG FLEX pump makeup, which does not correlate to conditions in which the crew would be at the limit of what they could achieve in the time that is available. "Low" workload is assigned.

Work in ELAP conditions may require the use of portable lighting, working in difficult positions in the main steam valve room, and would likely be performed and in poor weather conditions related to the loss of offsite power. "Negative" PSFs are considered to always be applicable.

E1-16 to NL-21-0019 SNC Response to NRC RAI ii. Farleys assessment for pre-initiator human failure maintenance events is not possible to cause an event since FLEX equipment is not aligned for operation but stored in FLEX dome during normal operation. Miscalibration of FLEX equipment or errors during maintenance of FLEX equipment do not need to be separately modeled since any miscalibration which fail FLEX equipment when demanded is already accounted for FLEX equipment failure probabilities. These probabilities are estimated based on number of demands and run hours and number of failures. Miscalibration of equipment often causes auto operation signals for normal components. However, FLEX equipment is manually started and aligned only when they are deployed, therefore miscalibration error is not applicable to FLEX equipment.

iii. The modeling used to represent the failure to initiate mitigating strategies was accomplished by using a screening HEP consisting of the operators failing to identify ELAP conditions and enter FLEX strategies. This modeling and quantification is based on the IDHEAS Delay Implementation event tree from EPRI Report 3002013018, Human Reliability Analysis (HRA) for Diverse and Flexible Mitigation Strategies (FLEX) and Use of Portable Equipment.

(d)

i. See response of 2(d)ii.

ii. A focus-scope peer review was performed in December 2019 on FLEX modeling for Plant Farley Internal Events, Internal Flood, and Fire. The scope consisted of a review of 116 relevant SRs contained in Sections 2, 3, and 4 of the ASME/ANS PRA Standard. There were no finding level F&Os to be resolved. All SRs were met at Capability Category II or higher.

(e) Not Applicable E1-17 to NL-21-0019 SNC Response to NRC RAI NRC RAI 3:

RG 1.174, Revision 3, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," provides risk acceptance criteria.

in terms of the change in risk in combination with either total core damage frequency or large early release frequency.

RG 1.174 and Section 6.4 of NUREG 1855, Revision 1, for a Capability Category II risk evaluation, indicate that the mean values of the risk metrics (total and incremental values) need to be compared with risk acceptance guidelines. The mean values referred to are the means of the probability distributions that result from the propagation of the uncertainties on the PRA input parameters and model uncertainties explicitly reelected in the PRA models. In general, the point estimate CDF and LERF obtained by quantification of the cutset probabilities using mean values for each basic event probability does not produce a true mean of the CDF/LERF. Under certain circumstances, a formal propagation of uncertainty may not be required if it can be demonstrated that the state-of-knowledge correlation (SOKC) is unimportant (i.e., the risk results are well below the acceptance guidelines).

Section 8 of NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline, requires a cumulative sensitivity study to evaluate the potential impact on CDF and LERF based on a postulated reduction in reliability due to the special treatment of selected SSCs. The guidance states that the results of this study should be compared to the risk acceptance guidelines of RG 1.174 as a measure of acceptability.

LAR Attachment 2 presents estimates of the total CDF and LERF based on the internal events (including flooding) and fire risk. NRC staff notes that for FNP, the total CDF of 8.4E-05 per year begins to approach the RG 1.174, Revision 3, threshold of 1E-04 per year for total CDF without considering the risk increase due to SOKC.

Please address the following:

(a) Demonstrate that FNP's total CDF and LERF mean values meet the RG 1.174 risk acceptance guidelines.

(b) As an alternative to Part (a), provide justification that the FNP risk values represent an acceptable level of risk to public safety.

(c) Clarify, with regards to the NEI 00-04 Section 8 sensitivity study, that the FNP calculation will use the mean risk values of each PRA modeled hazard group. Include in this discussion what steps FNP will perform in the case the sensitivity results exceed the RG 1.174 acceptance guidelines.

(d) Alternatively to Part (c), propose a mechanism that ensures the NEI 00-04 Section 8 cumulative sensitivity study results is in conformance with the RG 1.174 risk acceptance guidelines when the internal events, internal flooding, and fire PRA mean values are used in the study.

E1-18 to NL-21-0019 SNC Response to NRC RAI SNC Response to NRC RAI 3 (a) Tables RAI-03-1 and RAI-03-2 demonstrates the FNP total CDF and LERF mean values meet RG 1.174 risk acceptance guidelines.

RAI-03-1. FNP CDF and LERF Mean Values Unit Hazard CDF/LERF Mean Value IE CDF 2.9E-06 IE LERF 1.9E-08 IF CDF 4.2E-06 IF LERF 1.8E-08 1

F CDF 7.7E-05 F LERF 2.7E-06 S CDF 8.9E-07 S LERF 7.4E-08 IE CDF 3.0E-06 IE LERF 2.0E-08 IF CDF 4.0E-06 IF LERF 1.7E-08 2

F CDF 7.7E-05 F LERF 5.2E-06 S CDF 8.9E-07 S LERF 7.6E-08 Note: IE-Internal Events, IF-Internal Flood, F-Fire, S-Seismic RAI-03-2. Total FNP CDF and LERF Mean Values Unit 1 Total Unit 2 Total CDF 8.4E-05 8.5E-05 I LERF I 2.8E-06 5.3E-06 (b) Not applicable.

(c) The FNP calculation to meet the requirements of the sensitivity study described in NEI 00-04, Section 8, will use mean values for comparison to the RG 1.174 acceptance guidelines. If the sensitivity results exceed the RG 1.174 guidelines, FNP will follow the NEI 00-04 guidance by reducing the FV and RAW threshold values used for categorization. The NEI 00-04 HSS thresholds will be lowered until such time as the RG 1.174 values can again be met. If previously categorized systems are impacted, the existing SSC categorization and treatment process will be followed.

(d) Not applicable.

E1-19

Joseph M. Farley Nuclear Plant - Units 1 and 2 Response to Request for Additional Information Regarding Application to Adopt 10 CFR 50.69, "Risk-informed categorization and treatment of structures, systems and components for nuclear power reactors" Enclosure 2 EPRI Report 3002017583

ELECTRIC POWER EP121I RESEARCH INSTITUTE Alternative Approaches for Addressing Seismic Risk in 10 CFR 50.69 Risk-Informed Categorization 3002017583

Alternative Approaches for Addressing Seismic Risk in 10 CFR 50.69 Risk-Informed Categorization 3002017583 Technical Update, February 2020 EPRI Project Manager J. Richards All or a portion of the requirements of the EPRI Nuclear Quality Assurance Program apply to this product.

YES ELECTRIC POWER RESEARCH INSTITUTE 3420 Hillview Avenue, Palo Alto, California 94304- 1338

• PO Box 10412, Palo Alto, California 94303- 0813

• USA 800.313.3774

• 650.855.2121

• askepri@epri.com

• www.epri.com

DISCLAIMER OF WARRANTIES AND LIMITATION OF LIABILITIES THIS DOCUMENT WAS PR EPARED BY THE ORGANIZATION NAMED BELOW A S AN ACCOUNT OF WORK SPONSORED OR COSPON SORED BY THE ELEC TRIC POWER RESEARCH INSTITUTE, INC. (EPRI). NEITHER EPRI, ANY MEMBER OF EPRI, ANY COSPONSOR, THE ORGANIZATION BELOW, NOR ANY PERSON ACTING ON BEHALF OF ANY OF THEM:

(A) MAKES ANY WARRANTY OR REPRESENTATION WHATSOEVER, EXPRESS OR IMPLIED, (I)

WITH RESPECT T 0 THE USE OF ANY INFORMATION, APPARATUS, METHOD, PROCESS, OR SIMILAR ITEM DISCLOSED IN THIS DOCUMENT, INCLUDING MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, OR (II) THAT SUCH USE DOES NOT INF RINGE ON OR INTE RFERE WITH PRIVATELY OWNED RIGHTS, INCLUDING ANY PARTY'S INTELLECTUAL PROPERTY, OR (Ill) THAT THIS DOCUMENT IS SUITABLE TO ANY PARTICULAR USER'S CIRCUMSTANCE; OR (B) ASSUMES RESPONSIBILITY FOR ANY DAMAGES OR OTHER LIABILITY WHATSOEVER (INCLUDING ANY CONSE Q UENTIAL DAMAGES, EVEN IF EPRI OR ANY EPRI REPRESENTATIVE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES) RESULTING FROM YOUR SELECTION OR USE OF THIS DOCUMENT OR ANY INFORMATION, APPARATUS, METHOD, PROCESS, OR SIMILAR ITEM DISCLOSED IN THIS DOCUMENT.

REFERENCE HEREIN TO ANY SPECIFIC COMMERCIAL PRODUCT, PROCESS , OR SERVICE BY ITS TRADE NAME, TRADEMARK, MANUFACTURER, OR OTHERWISE, DOES NOT NECESSARILY CONSTITUTE OR IMPLY ITS ENDORSEMENT, RECOMMENDATION, OR FAVO RING BYEPRI.

THE FOLLOWING ORGANI ZATION, UNDER CONTRACT TO EPRI, PREPARED THIS REP ORT:

Simpson Gumpertz & Heger Inc THE TECHNICAL CONTENTS OF THIS PRODUCT WERE NOT PREPARED IN ACCORDANCE WITH THE EPRI QUALITY PROGRAM MANUAL THAT FULFILLS THE REQUIREMENTS OF 10 CFR 50, APPENDIX B. THIS PRO DUCT IS NOT SUBJECT TO THE REQU IREMENTS OF 10 CFR PART 21.

This is an EPRI Technical Update report. A Technical Update report is intended as an informal report of continuing research, a meeting, or a topical study. It is not a final EPRI technical report.

NOTE For further information about EPRI, call the EPRI Customer Assistance Center at 800.313.3774 or e- mail askepri@epri.com.

Electric Power Research Institute, EPRI, and TOGETHER. .. SHAPING THE FUTURE OF ELECTRICITY are registered service marks of the Electric Power Research Institute, Inc.

Copyright © 2020 Electric Power Research Institute, Inc. All rights reserved.

ACKNOWLEDGMENTS The following organization, under contract to the Electric Power Research Institute (EPRI),

prepared this report:

Simpson Gumpertz & Heger Inc.

4695 MacArthur Court, Suite 500 Newport Beach, CA 92660 Principal Investigator G. Hardy This report describes research sponsored by EPRI.

EPRI gratefully acknowledges the contributions of the following individuals and their companies who supported development of this report.

Parthasarathy Chandran, Southern Company Thomas John, Dominion Energy Jacob Johnson, Tennessee Valley Authority Jon Kapitz, Nuclear Energy Institute Eugene Kelly, Exelon Generation Stephen Kimbrough, Duke Energy Greg Krueger, Nuclear Energy Institute Allen Moldenhauer, Dominion Energy Barry Sloane, JENSEN HUGHES Philip Tarpinian, Exelon Generation Charles Young, JENSEN HUGHES Joe Vasquez, Dominion Energy William Webster, Dominion Energy This publication is a corporate document that should be cited in the literature in the following manner:

Alternative Approaches for Addressing Seismic Risk in 10 CFR 50.69 Risk-Informed Categorization. EPRI, Palo Alto, CA: 2020. 3002017583.

iii

PRODUCT DESCRIPTION The U. S. Nuclear Regulatory Commission (NRC) amended its regulations to provide an alternative approach for establishing the requirements for treatment of structures, systems, and components (SSCs) for nuclear power reactors using a risk-informed method of categorizing SSCs according to their safety significance. The NRCs 10 CFR 50.69 process allows a plant to categorize the safety significance of its SSCs using a robust categorization process defined in Nuclear Energy Institute (NEI) 00-04, 10 CFR 50.69 SSC Categorization Guideline, as endorsed by the NRC in Regulatory Guide 1.201. The risk-informed categorization process helps focus attention on SSCs that are the most important to plant safety while allowing increased operational flexibility for SSCs that are less important to plant safety.

Background

Seismic risks are one of the screening criteria evaluated in the categorization process specified in NEI 00-04. Seismic risks can be evaluated using a seismic probabilistic risk assessment (Seismic PRA or SPRA) or a seismic margin assessment (SMA) if an SPRA is not available.

Alternatively, they can be screened out if the seismic core damage frequency (SCDF) and seismic large early release frequency (SLERF) are very small compared to the full power internal events (FPIE) PRA core damage frequency and large early-release frequency.

Some plants do not have an acceptable SPRA or SMA and cannot screen out of seismic considerations. Therefore, cost-effective alternatives for accounting for the insights of seismic risks in the 50.69 categorization process must be considered.

This Technical Update incorporates updates submitted to the NRC in an RAI submittal for the Calvert Cliffs 50.69 LAR into the previous version of this report, EPRI 3002012988. Aside from those updates, the technical criteria in this report remains unchanged.

Objectives

• To develop alternative approaches for plants to provide the necessary seismic risk insights within the 50.69 categorization process.

Approach Trial 50.69 categorization evaluations are performed at four plants with SPRAs and high seismic hazards compared to their seismic design bases to determine the seismic-related categorization insights. Those insights are compared with categorization insights at the same plants using their FPIE PRAs and fire PRAs if available to determine the degree to which the seismic insights produce unique categorization insights.

The results of the trial cases are used to develop a risk-informed graded approach based on the degree to which the seismic hazard exceeds the seismic design basis ground motions and the degree to which unique seismic categorization insights are likely.

v

The treatment of potentially seismically correlated failures in SPRAs and identification of seismic interactions can lead to unique 50.69 categorization insights. Therefore, a process is developed to identify the plant conditions that would be treated as seismically correlated failures or interaction failures in an SPRA if one were available. For those conditions, a sensitivity study is recommended using the FPIE PRA to determine the impact of treating such seismic failures as common -cause events. Using this process, the necessary seismic risk insights can be identified for the 50.69 categorization process.

Results Detailed analyses of seismic risks show very few insights to the 50.69 categorization results that uniquely identify SSCs as high-safety-significant. The primary unique categorization insights that would result from treatment of seismic-correlated failures in SPRAs can be derived using a process described in the report. A three-tiered, graded evaluation process is developed for considering seismic risk insights in the 50.69 categorization process.

Keywords 10 CFR 50.69 Risk-informed categorization Seismic risk vi

EPl21 1ELEC TR IC POWER RESEA CH INSTITUTE EXECUTIVE

SUMMARY

Deliverable Number: 3002017583 Product Type: Technical Report Product

Title:

Alternative Approaches for Addressing Seismic Risk in 10 CFR 50.69 Risk-Informed Categorization PRIMARY AUDIENCE: Individuals developing License Amendment Requests to implement 10 CFR 50.69 SECONDARY AUDIENCE: Individuals involved in performing categorization using the 10 CFR 50.69 process KEY RESEARCH QUESTION Can an alternative process be used to provide the necessary seismic risk insights to perform 10 CFR 50.69 categorization without requiring development of a new seismic probab ilistic risk assessment (SPRA) for low and moderate seismic hazard sites?

RESEARCH OVERVIEW Sensitivity studies were performed at four nuclear plants to investigate the degree to which seismic risk insights uniquely contributed to the 10 CFR 50.69 categorization process. These studies were performed at plants with high seismic hazards relative to their design basis and that had developed new SPRAs. The results showed that few if any seismic risk insights uniquely caused an SSC to be classified as high -safety-significant (HSS) under 50.69 criteria and that the unique seismic conditions were generally associated with correlated seismic fragilities. Given these results, a three -tiered graded approach (low, medium, and high) was developed for considering seismi c risks in the 10 CFR 50.69 process. In addition, a sensitivity study process was developed to derive seismic- correlated insights using an internal events probabilistic risk assessment (PRA) and common-cause techniques.

KEY FINDINGS

• At high-seismic-hazard plantswhere the ground motion response spectrum significantly exceeds the safe shutdown earthquakevery few SSCs would be categorized as HSS solely for seismic risk reasons (Section 3).

• At high-seismic-hazard plants, the assumption of correlated seismic equipment failures can lead to unique 50.69 categorization insights (Section 3).

• Risk insights from internal events PRAs, combined with the insights from a fire PRA (if available) and other non- PRA aspects of the 50.69 categorization process, adequately id entify the HSS structures, systems, and components necessary to address seismic risks, with the exception of a few unique seismic challenges.

• A graded approach based on the degree to which the ground motion response spectrum (GMRS) exceeds the safe shutdown earthquake (SSE) can be used to appropriately focus resources on the plants where seismic risk insights are more likely to uniquely contribute to the 50.69 categorization results (Section 2).

• A process is defined to identify conditions where seismically correlated component failures and seismic interactions would be modeled in an SPRA with a sensitivity study to determine the categorization impacts of those conditions using an internal events PRA and common-cause analysis techniques (Section 2.3.1 and Appendices A and B).

vii

EPl21 1ELEC TR IC POWER RESEA CH INSTITUTE EXECUTIVE

SUMMARY

WHY THIS MATTERS Some plants do not have the tools identified in Nuclear Energy Institute (NEI) 00-04 to consider seismic insights in the categorization process. This report provides a graded, cost-effective, alternative process to appropriately consider seismic insights without requiring development of new SPRAs at low and moderate seismic hazard sites. The technical basis for the methods are specific to the 50.69 categorization process and are directly applicable to that process. Any plant with a low or medium seismic hazard would be eligible to apply this process.

HOW TO APPLY RESULTS Plants should compare their GMRS with their SSE and determine if they fall in the low, medium, or high seismic hazard tier. Low-seismic-hazard plants should follow the process outlined in Section 2.2, medium-seismic-hazard plants should follow the process in Section 2.3, and high-seismic-hazard plants should follow the process in Section 2.4.

LEARNING AND ENGAGEMENT OPPORTUNITIES

• Periodic workshops on 50.69-related topics are being held. Contact Pat ORegan for additional information.

EPRI CONTACTS: John Richards, Technical Executive, jrichards@epri.com and Pat ORegan, Technical Executive, poregan@epri.com PROGRAM: Risk and Safety Management, P41 .07.01 IMPLEMENTATION CATEGORY: Reference Together...Shaping the Future of Electricity Electric Power Research Institute 3420 Hillview Avenue, Palo Alto, California 94304- 1338

• PO Box 10412, Palo Alto, California 94303-0813 USA 800.313.3774

• 650.855.2121

• askepri@epri.com

• www.epri.com

© 2020 Electric Power Research Institute (EPRI), Inc. All rights reserved. Electric Power Research Institute, EPRI, and TOGETHER. .. SHAPING THE FUTURE OF ELECTRICITY are registered service marks of the Electric Power Research Institute, Inc.

ACRONYMS AND ABBREVIATIONS AC alternating current ACUBE Advanced Cutset Upper Bound Estimator AFW auxiliary feedwater AFWPH auxiliary feedwater pumphouse ANS American Nuclear Society ANSI American National Standards Institute AOV air-operated valve ASME American Society of Mechanical Engineers BDD binary decision diagram BPVC Boiler and Pressure Vessel Code BWR boiling water reactor CAFTA Computer Aided Fault Tree Analysis System CB circuit breaker CCDP conditional core damage probability CCF common cause failure CCW component cooling water CDF core damage frequency CIV containment isolation valve CLERF conditional large, early release probability CR control rod CRM configuration risk management CST condensate storage tank DG diesel generator DID defense in depth EDG emergency diesel generator ELAP extended loss of alternating current power EPRI Electric Power Research Institute F&O fact and observation FIVE Fire-Induced Vulnerability Evaluation ix

FLEX diverse and flexible mitigation strategies F-MCUB factor-minimum cutset upper bound FPIE full power internal events FPRA fire probabilistic risk assessment FTREX Fault Tree Reliability Evaluation eXpert F-V Fussell-Vesely GE General Electric GIP generic implementation procedure GMRS ground motion response spectrum HCLPF high confidence of low probability of failure HCU hydraulic control unit HHSI high head safety injection HPCI high pressure coolant injection HSS high safety significant HVAC heating, ventilation, and air condition HX heat exchanger IDP integrated decision-making panel IE internal events IEEE The Institute of Electrical and Electronics Engineers IFV Integrated Fussell-Vesely IPEEE Individual Plant Examination of External Events IRAW Integrated Risk Achievement Worth ISRS in-structure response spectra LERF large early release frequency LHSI low head safety injection LOCA loss of coolant accident LOOP loss of off-site power LSS low safety significant LUHS loss of normal access to the ultimate heat sink MCC motor control center MCR main control room MOV motor-operated valve MSA mitigation strategy assessment MWe mega-watt, electric MWt mega-watt, thermal NEI Nuclear Energy Institute x

NPP nuclear power plant NRC Nuclear Regulatory Commission NSCW nuclear service cooling water NSSS nuclear steam supply system NTTF Near Term Task Force OOS out of service PGA peak ground acceleration PRA probabilistic risk assessment PSHA probabilistic seismic hazard analysis PWR pressurized water reactor RAW risk achievement worth RCIC reactor core isolation cooling RCP reactor coolant pump RCS reactor coolant system RG Regulatory Guide RISC risk informed safety class SBO station blackout SCDF seismic-induced core damage frequency SEL seismic equipment list SF severity factor SFP spent fuel pool SGIG safety grade instrument gas SI safety injection SLERF seismic-induced large early release frequency SLOCA seismic-induced loss of coolant accident SMA seismic margin assessment SPCL success path component list SPID screening, prioritization and implementation details SPRA seismic probabilistic risk assessment SQUG Seismic Qualification Utility Group SSC structures, systems and components SSD safe shutdown SSE safe shutdown earthquake SSEL safe shutdown equipment list xi

UHRS uniform hazard response spectra USI Unresolved Safety Issue VAC volts alternating current VDC volts direct current xii

CONTENTS 1 BACKGROUND ...................................................................................................................... 1-1 1.1 Seismic Evaluations at Nuclear Power Plants................................................................. 1-1 1.1.1 Unresolved Safety Issue A-46 ................................................................................. 1-2 1.1.2 Individual Plant Examination of External Events ..................................................... 1-3 1.1.3 Post Fukushima Seismic Reviews ........................................................................... 1-4 1.1.3.1 NTTF Recommendation 2.3 Walkdowns ......................................................... 1-4 1.1.3.2 NTTF Recommendation 2.1 Seismic Evaluations ........................................... 1-4 1.1.3.3 Mitigation Strategy Assessment....................................................................... 1- 5 1.1.4 Insights from Past Seismic Programs and Studies .................................................. 1- 6 1.2 10 CFR 50.69 Categorization Process ............................................................................ 1-7 1.3 Relationship to the Rule and Other Guidance Documents ............................................ 1-13 2 PROPOSED APPROACH ...................................................................................................... 2-1 2.1 Overview of Approaches ................................................................................................. 2-1 2.2 Tier 1 - Low Seismic Hazard / High Seismic Margin Sites ............................................. 2-4 2.2.1 Description of the Approach .................................................................................... 2-4 2.2.2 Technical Basis for Approach .................................................................................. 2-4 2.2.2.1 Integral Assessment ........................................................................................ 2-4 2.2.2.2 Relays and Contactors..................................................................................... 2- 5 2.2.3 Summary/Conclusion/Recommendation ................................................................. 2- 6 2.3 Tier 2 - Moderate Seismic Hazard / Moderate Seismic Margin Sites ............................. 2- 6 2.3.1 Description of the Approach .................................................................................... 2- 6 2.3.2 Technical Basis for Approach ................................................................................ 2-11 2.3.3 Summary ............................................................................................................... 2-12 2.4 Tier 3 - High Seismic Hazard / Low Seismic Margin Sites ........................................... 2-12 3 SEISMIC PRA INSIGHTS AND TRIAL CATEGORIZATION STUDIES CONDUCTED ON HIGH SEISMIC HAZARD SITES ........................................................................................ 3-1 3.1 Introduction to Trial Categorization Studies .................................................................... 3-1 xiii

3.2 Plant A Trial Categorization Evaluation ........................................................................... 3-4 3.2.1 Introduction .............................................................................................................. 3-4 3.2.2 Seismic PRA High Safety Significant Evaluation ..................................................... 3-4 3.2.2.1 Background ...................................................................................................... 3-4 3.2.2.2 Description of Model Used for Analysis ........................................................... 3-4 3.2.3 Full Power Internal Events PRA High Safety Significant Evaluation ....................... 3- 5 3.2.3.1 Background ...................................................................................................... 3- 5 3.2.3.2 Description of Model Used for Analysis ........................................................... 3- 5 3.2.3.3 Identification of Risk Criteria and Analysis of Component Importances .......... 3- 5 3.2.4 Fire PRA High Safety Significant Evaluation ........................................................... 3- 6 3.2.4.1 Description of Model Used for Analysis ........................................................... 3- 6 3.2.4.2 Identification of Risk Criteria and Analysis of Component Importances .......... 3-7 3.2.5 Comparison of Seismic PRA Results to Other PRA Results for High Safety Significant Structures, Systems, and Components .......................................................... 3-7 3.2.5.1 Explicit Modeling .............................................................................................. 3-7 3.2.5.2 Implicit Modeling .............................................................................................. 3-7 3.2.6Analysis and Conclusions ........................................................................................ 3-9 3.3 Plant B Trial Categorization Evaluation ......................................................................... 3- 16 3.3.1 Introduction ............................................................................................................ 3- 16 3.3.1.1 PRA Models ................................................................................................... 3- 16 3.3.2 Seismic PRA High Safety Significant Evaluation ................................................... 3-17 3.3.2.1 Description of Seismic PRA Model ................................................................ 3-17 3.3.2.2 Identification of HSS SSCs from the SPRA ................................................... 3-18 3.3.3 Full Power Internal Events PRA High Safety Significant Evaluation ..................... 3-18 3.3.4 Fire PRA High Safety Significant Evaluation ......................................................... 3-19 3.3.5 Comparison of Seismic PRA results to other PRA results for High Safety Significant Evaluation Structures, Systems, and Components ....................................... 3-19 3.3.5.1 Explicitly Modeled SSCs ................................................................................ 3-19 3.3.5.2 Implicitly Modeled SSCs ................................................................................ 3-19 3.3.5.3 Correlation of SSCs and Common Cause Failures ....................................... 3-21 3.3.6 Analysis and Conclusions...................................................................................... 3-21 3.4 Plant C Trial Categorization Evaluation......................................................................... 3-30 3.4.1 Introduction ............................................................................................................ 3-30 3.4.1.1 Plant Overview ............................................................................................... 3-30 3.4.1.2 PRA Models ................................................................................................... 3-30 xiv

3.4.2 Seismic PRA High Safety Significant Evaluation ................................................... 3-31 3.4.2.1 Description of Seismic PRA Model ................................................................ 3-31 3.4.2.2 Identification of HSS SSCs from the SPRA ................................................... 3-32 3.4.3 Full Power Internal Events PRA High Safety Significant Evaluation ..................... 3-32 3.4.4 Fire PRA High Safety Significant Evaluation ......................................................... 3-32 3.4.5 Comparison of Seismic PRA Results to Other PRA Results for High Safety Significant Structures, Systems, and Components ........................................................ 3-33 3.4.5.1 Explicitly Modeled SSCs ................................................................................ 3-33 3.4.5.2 Implicitly Modeled SSCs ................................................................................ 3-33 3.4.6 Analysis and Conclusions ...................................................................................... 3-34 3.5 Plant D Trial Categorization Evaluation ......................................................................... 3-40 3.5.1 Introduction ............................................................................................................ 3-40 3.5.2 Seismic PRA High Safety Significant Evaluation ................................................... 3-40 3.5.3 Full Power Internal Events PRA High Safety Significant Evaluation ..................... 3-41 3.5.4 Fire PRA High Safety Significant Evaluation ......................................................... 3-41 3.5.5 Comparison of SPRA results to the FPIE PRA results for HSS SSCs .................. 3-41 3.5.5.1 Explicitly Modeled SSCs ................................................................................ 3-41 3.5.5.2 Implicitly Modeled SSCs ................................................................................ 3-41 3.5.5.3 Seismic Fragility Groups and Common Cause Failure .................................. 3-42 3.5.6 Analysis and Conclusions ...................................................................................... 3-43 3.6 Summary of Sensitivity Study Insights .......................................................................... 3-59 3.6.1 Limited Unique Seismic High Safety Significant Structures, Systems, and Components ................................................................................................................... 3- 59 3.6.2 Seismic Correlated Failures .................................................................................. 3- 59 3.6.3 Relays .................................................................................................................... 3- 59 3.6.4 FLEX Components ................................................................................................ 3- 60 3.6.5 Defense-in-Depth Assessment .............................................................................. 3- 61 3.6.6 Civil Structures ...................................................................................................... 3- 61 4

SUMMARY

AND CONCLUSIONS ......................................................................................... 4-1 5 REFERENCES ....................................................................................................................... 5-1 A IDENTIFYING SEISMIC CORRELATED OR SEISMIC INTERACTION SCENARIOS FOR CONSIDERATION IN 50.69 CATEGORIZATION ........................................................... A-1 A.1 Background on Seismic Correlation Considerations in SPRAs ..................................... A-1 A.2 Approach ....................................................................................................................... A-2 xv

B CRITERIA FOR CAPACITY-BASED SCREENING FOR HIGH CAPACITY SSCS ............. B-1 8.1 Approach ....................................................................................................................... 8 -1 8.2 Justification .................................................................................................................... 8 -2 8.3 Conclusion ..................................................................................................................... 8 -3 xvi

LIST OF FIGURES Figure 1- 1 Categorization Process Overview (from NEI 16-09) ................................................. 1-9 Figure 1-2 Relationship With the 10 CFR 50.69 Rule and Other Guidance Documents ......... 1-13 Figure 2- 1 Low Seismic Hazard Site: Low GMRS Peak Acceleration ....................................... 2-3 Figure 2-2 Low Seismic Hazard Site: Typical SSE to GMRS Comparison ................................ 2-3 Figure 2-3 Seismic Correlated Failure Assessment ................................................................... 2-9 Figure 3- 1 Plant A Ground Motion Response Spectrum to Safe Shutdown Earthquake Comparison ........................................................................................................................ 3-2 Figure 3-2 Plant B Ground Motion Response Spectrum to Safe Shutdown Earthquake Comparison ........................................................................................................................ 3-2 Figure 3- 3 Plant C Ground Motion Response Spectrum to Safe Shutdown Earthquake Comparison ........................................................................................................................ 3-3 Figure 3-4 Plant D Ground Motion Response Spectrum to Safe Shutdown Earthquake Comparison ........................................................................................................................ 3-3 Figure 3- 5 High Safety Significant Structures, Systems, and Components for Plant A ........... 3-10 xvii

LIST OF TABLES Table 1-1 Integrated Decision- Making Panel Changes from Preliminary High Safety Significant to Low Safety Significant ................................................................................ 1-12 Table 2- 1 Plants Performing Seismic Probabilistic Risk Assessments for the Fukushima 50.54(f) Letter..................................................................................................................... 2-4 Table 3-1 Trial Plant Summary .................................................................................................. 3-1 Table 3-2 PRA Risk Criteria per NEI 00-04 ............................................................................... 3-6 Table 3-3 Seismic Fragilities Addressed by Explicit Modeling ................................................... 3-7 Table 3-4 Seismic Fragilities Addressed by Implicit Modeling ................................................... 3-8 Table 3-5 Sensitivity Study Results for Plant A ........................................................................ 3-11 Table 3-6 Plant B Passive or Implicitly Modeled SSCs ............................................................ 3-20 Table 3-7 Sensitivity Study Results for Plant B........................................................................ 3-22 Table 3-8 Plant C Passive or Implicitly Modeled SSCs ........................................................... 3-34 Table 3-9 Sensitivity Study Results for Plant C ....................................................................... 3- 35 Table 3-10 Plant D Passive or Implicitly Modeled SSCs ......................................................... 3-42 Table 3-11 Sensitivity Study Results for Plant D ..................................................................... 3-44 Table 4- 1 Alternate Approach Seismic Tiers and Seismic Rick Evaluation Process ................. 4-2 Table A- 1 Correlation Guidance from Sandia National Laboratory Study ................................ A-2 Table B-1 Seismic Fragility References .................................................................................... B-2 xix

1 BACKGROUND The U. S. Nuclear Regulatory Commission (NRC) amended its regulations to provide an alternative approach for establishing the requirements for treatment of structures, systems and components (SSCs) for nuclear power reactors using a risk-informed method of categorizing SSCs according to their safety significance. The NRCs 10 CFR 50.69 process [1] allows a plant to categorize SSCs using a robust categorization process defined in NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline [2], as endorsed by NRC in Regulatory Guide 1.201 [3]. The risk-informed categorization process helps focus attention on SSCs that are the most important to plant safety while allowing increased operational flexibility for SSCs that are less important to plant safety.

One of the criteria evaluated in the categorization process specified in NEI 00-04 is seismic risks, which can be evaluated using a seismic probabilistic risk assessment (Seismic PRA or SPRA), or a seismic margin assessment (SMA) if an SPRA is not available, or screened out if the seismic core damage frequency (SCDF) and seismic large early release frequency (SLERF) are very small compared to the full power internal events (FPIE) PRA CDF and LERF.

There are a number of plants that do not have an SPRA or SMA available to assess seismic risk in the categorization process and cannot screen out of seismic considerations by demonstrating very low seismic risks compared to FPIE risks, therefore a need exists to consider alternatives for considering the insights of seismic risks in the 50.69 categorization process. This report develops alternate approaches for plants to provide the necessary seismic risk insights within the 50.69 categorization process.

1.1 Seismic Evaluations at Nuclear Power Plants Nuclear power plants are built to withstand environmental hazards, including earthquakes. The nuclear power plant regulatory process requires that seismic activity be taken into account as part of the design, operation and maintenance of the nuclear fleet. Safety-significant structures, systems, and components (SSC) are designed to withstand the effects of earthquakes and to maintain the capability to perform their intended safety functions. Several codes and standards govern aspects that directly affect the seismic margins inherent in the nuclear plants along with the estimation of the seismic risks, including standards from the American National Standards Institute (ANSI), American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code (BPVC), American Concrete Institute, and the Institute of Electrical and Electronics Engineers (IEEE).

Historically, when significant new seismic hazard information or new seismic capacity information became available, an assessment of this new data and models was undertaken to assess the impacts of this new data/methods. Several such major seismic reassessments have taken place in the United States that have impacted the majority of the nuclear plants in the fleet.

1-1

=

Background===

1. Unresolved Safety Issue A-46 (Generic Letter 87-02) [4]) - Operability of safety related equipment subjected to earthquakes

2. Individual Plant Examination of External Events (IPEEE) For Severe Accident Vulnerabilities - 10 CFR 50.54(f), (Generic Letter No. 88-20, Supplement 4), [5] -

Seismicity of sites and beyond design basis evaluation

3. NRC Fukushima 50.54(f) letter [6] - Post Fukushima seismic reviews The insights and conclusions from these seismic programs provide a good calibration for the proposed categorization of seismic risk/margin insights within the 50.69 categorization process.

1.1.1 Unresolved Safety Issue A-46 In December 1980, the U.S. Nuclear Regulatory Commission (NRC) initiated Unresolved Safety Issue (USI) A-46, Seismic Qualification of Equipment in Operating Nuclear Plants, [4] to address concerns that seismic qualification of equipment in older nuclear power plants might not be meeting expectations of newer seismic qualification criteria. The purpose of the USI A-46 program was to verify the seismic adequacy of essential equipment in operating plants not qualified in accordance with more recent criteria (that is IEEE 344-1975 [7]). In 1982, the Seismic Qualification Utility Group (SQUG) was formed to develop a practical approach for seismic qualification of equipment in operating plants. The approach developed by SQUG used experience data from equipment in power plants and industrial facilities that experienced actual earthquakes as the primary basis for evaluating the seismic ruggedness and functionality of essential equipment in nuclear power plants. A generic implementation procedure (GIP) [8] was developed that included the evaluation of active electrical and mechanical equipment, relay performance, tanks, heat exchangers cable raceways, and identification and resolution of possible seismic spatial systems interactions. Emphasis was placed on anchorage of equipment (a key insight that contributed to a significant number of earthquake equipment failures) and seismic walkdowns (a key tool to validating the installed condition of plant equipment and confirming characteristics of seismically rugged equipment).

A significant finding of the earthquake experience research is that conventional electrical and mechanical equipment included in the scope of the GIP will withstand earthquakes significantly higher than the design basis earthquakes for eastern U.S. nuclear plants, provided a set of key conditions are met. The guidelines in the GIP provide a systematic, controlled, and well-documented method of applying the lessons learned from review of earthquake experience data.

The GIP screens out those types of conventional equipment that have been shown to be insensitive to earthquake motions expected in eastern U.S. plants and focuses on actual equipment and installation vulnerabilities identified in strong motion earthquakes as well as prior qualification test experience. Modifications were typically made for the safe shutdown equipment that did not meet the GIP criteria.

1-2

Background

1.1.2 Individual Plant Examination of External Events On June 28, 1991, the NRC issued Supplement 4 to Generic Letter (GL) 88-20, "Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities" [4]. This supplement to GL 88-20, referred to as the IPEEE program, requested that each licensee identify and report to the NRC all plant-specific vulnerabilities to severe accidents caused by external events. The IPEEE program included the following four supporting objectives:

• Develop an appreciation of severe accident behavior

• Understand the most likely severe accident sequences that could occur at the licensee's plant under full-power operating conditions

• Gain a qualitative understanding of the overall likelihood of core damage and fission product releases

• Reduce, if necessary, the overall likelihood of core damage and radioactive material releases by modifying, where appropriate, hardware and procedures that would help prevent or mitigate severe accidents Seismic loading was one of the key elements of the IPEEE program. The IPEEE program resulted in a comprehensive seismic risk/margin assessment for the U.S. NPP fleet and, as such, represents a valuable resource for risk- informed applications such as 10 CFR 50.69.

The seismic IPEEE review results for 110 units are summarized in the EPRI 1000895 [9] 1. Of the 75 submittals reviewed, 28 submittals (41 units) used seismic probabilistic risk assessment (PRA) methodology; 45 submittals (65 units) performed seismic margin assessments (SMAs);

and two submittals (four units) used site- specific seismic programs for IPEEE submittals.

Almost all licensees reported in their IPEEE submittals that no plant vulnerabilities were identified with respect to seismic risk (the use of the term "vulnerability" varied widely among the IPEEE submittals). However, most licensees did report at least some seismic "anomalies,"

"outliers," or other concerns. In the few submittals that did identify a seismic vulnerability, the findings were comparable to those identified as outliers or anomalies in other IPEEE submittals.

Seventy percent of the plants proposed improvements as a result of their seismic IPEEE analyses.

1 NRC performed a comparable review of IPEEE results in NUREG-1742, Perspectives Gained from the Individual Plant Examination of External Events (IPEEE) Program. [39]

1-3

=

Background===

1.1.3 Post Fukushima Seismic Reviews Following the accident at the Fukushima Daiichi nuclear power plant resulting from the March 11, 2011, Great Tohoku Earthquake and subsequent tsunami, the NRC established a Near Term Task Force (NTTF) to conduct a systematic review of NRC processes and regulations. The NTTF was also tasked with determining if the agency should make additional improvements to its regulatory system. The NRC issued an information request [6] associated with a seismic assessment on March 12, 2012, including recommendations 2.1 and 2.3 which required seismic evaluations and seismic walkdowns respectively. In addition, one other seismic program that came out of the post Fukushima requirements consisted of an assessment of the new mitigation strategies put into place under NTTF Recommendation 4 [6] by each nuclear plant. Each of these three post Fukushima seismic-related programs are briefly summarized below.

1.1.3.1 NTTF Recommendation 2.3 Walkdowns The NTTF 2.3 program consisted of a relatively near term walkdown review of a sample of the safety related equipment in each U.S. nuclear plant to assess the seismic adequacy. The NRC requested that a walkdown review be conducted to address the plant specific vulnerabilities and to verify the seismic adequacy of the plant to the design basis level. EPRI 1025286 [10] provided technical guidance in 2012 for performing walkdowns to address the NTTF 2.3 request.

Lessons learned from these NTTF 2.3 walkdown reviews consisted of the following:

• The vast majority of the equipment and systems reviewed were demonstrated to be seismically adequate and in compliance with the design basis.

• A relatively minor number of issues were noted from these walkdown reviews:

- Some anchorage conditions were identified that required actions to restore to the original condition

- Some seismic interaction issues were noted

- Some degraded equipment/hardware were noted (missing parts, corrosion, leaks, etc.)

Any issues identified as part of the NTTF 2.3 walkdowns were addressed by the licensees under their corrective action programs.

1.1.3.2 NTTF Recommendation 2.1 Seismic Evaluations NTTF 2.1 was the longer term more detailed assessment of the implications of new seismic hazards on plant risk. The requested seismic information associated with recommendation 2.1 consisted of:

• Updated site-specific seismic hazards at operating nuclear power plants (NPPs)

• A seismic risk evaluation (SMA or seismic probabilistic risk assessment (SPRA)), as applicable, using the updated seismic hazard

• An assessment of the spent fuel pool (SFP) using the updated seismic hazard 1-4

Background

The NRC requested each U.S. nuclear plant to provide information about the current hazard and potential risk posed by seismic events using a graded screening/evaluation approach. Depending on the comparison between the re- evaluated seismic hazard and the current seismic design basis, plants were requested to perform increasing levels of reevaluations. EPRI 1025287 [11] (known as the SPID) documents the methods undertaken by the U.S. nuclear industry to respond to the NTTF 2.1 request.

All U.S. nuclear plants performed a detailed reevaluation of the seismic hazard using modern Probabilistic Seismic Hazard Analysis (PSHA) criteria. These new seismic hazards were reviewed and approved by the NRC and formed the basis for the remainder of the NTTF 2.1 seismic evaluations. A significant number of U.S. plants completed (or are in the process of completing) SPRAs to address the NTTF 2.1 requirements. Four of the plants with new SPRAs have performed sensitivity studies documented in Section 3 to determine if there are any unique seismic insights that contribute to the 10 CFR 50.69 categorization process.

1.1.3.3 Mitigation Strategy Assessment The third program that provided seismic insights for the U.S. NPP fleet consisted of a mitigation strategy assessment (MSA) conducted by all U.S. nuclear plants associated with the beyond seismic design basis evaluations of new mitigation equipment procured following the Fukushima event. The U.S. nuclear power industry initiated a program to add new capabilities and equipment to each plant. This initiative is referred to as FLEX [12] and includes the incorporation of strategies to safely respond to an assumed extended loss of alternating current (AC) power (ELAP) with a loss of normal access to the ultimate heat sink (LUHS) from an unspecified event. The NRC developed a recent regulation (NRC Draft Rule - Mitigation of Beyond Design Basis Events [13]) which required a beyond design basis review for these new FLEX mitigation systems. Relative to earthquakes, this rule required the assessment of the impact on the mitigation systems to the newly re-evaluated seismic hazards.

NEI has documented a detailed approach to demonstrate the seismic adequacy of mitigation strategy systems in NEI 12-06 Appendix H [12]. The seismic methods and criteria for evaluating MSA seismic adequacy incudes a graded approach. Five separate paths have increased requirements as a function of the degree that the latest seismic hazard exceeds the seismic design basis at the nuclear plant. In addition, these paths also take into account the degree/quality of existing seismic risk/margin evaluations that exist for the plant. The requirements and detail of these paths appropriately increase as the potential risk associated with the beyond design basis seismic event is deemed to potentially increase based on screening criteria agreed to by both the NEI/EPRI team as well as the NRC.

1-5

=

Background===

The MSA evaluations require demonstration that the FLEX strategies developed, implemented and maintained in accordance with NRC Order EA-12-049 [14] can be implemented considering the impacts of the reevaluated seismic hazard. The seismic insights from the seismic MSA assessments completed to date included many of the same insights observed from previous seismic programs:

• Anchorage of the equipment is important in the seismic event

• Seismic walkdowns by trained engineers are critical to identifying key issues that can best be identified in the field (for example, seismic interactions and vulnerabilities in operator pathways)

• Operator actions following the seismic event can address some seismic anomalies that occur during the earthquake (for example, resetting of relays, clearing operator pathways of smaller fallen objects) 1.1.4 Insights from Past Seismic Programs and Studies A collective set of insights can be gained from the major seismic programs described above.

While these programs varied in terms of their vintage and their required scope, the seismic insights have been quite consistent.

• Most SSCs have an inherent degree of seismic ruggedness

- Earthquake experience data from large historical earthquakes have shown that the majority of equipment and structure types existing at nuclear power plants perform very well.

- Mechanical equipment (pumps, valves, compressors, diesel generators) have a significant amount of seismic margin due to their being designed for operating loads in addition to the seismic loads.

- Shake table test data demonstrate even higher levels of seismic capacity for safety related SSCs.

- Distributed systems (HVAC ducting, cable trays, welded steel piping) perform very well in earthquakes and tests and have high inherent ruggedness

• A limited set of failure modes and seismic risk contributors exist

- Anchorage - Anchorage is one of the key failure modes that results from earthquakes.

For the safety-related nuclear plant equipment and systems, applicable design codes and standards require that seismic margin be designed into the anchorage. As such, for the moderate hazard sites, anchorage is not expected to contribute to the seismic risk until the earthquake reaches several times the design level.

- Brittle Failure modes - Examples of a brittle failure mode could include configurations such as ceramic materials in electrical equipment or of cast iron anchorage. Past seismic programs such as the USI A-46 and the IPEEE seismic programs have identified these brittle failure modes and where these were identified as issues, modifications were typically conducted.

1-6

Background

- Relay chatter - relay chatter for certain types of relays can occur at moderate earthquake levels. The most problematic relays (referred to as bad actors) were reviewed and addressed already as part of the USI A-46 program. Since relay chatter does not represent a failure of the relay (the relay functions normally following the earthquake), operator actions can be undertaken to address relay chatter effects during the earthquake.

- Seismic interactions - insights from past earthquakes have shown that seismic interactions (block walls falling, lights falling, impact from cabinet deflections, seismic-induced flooding, etc.) can happen at moderate earthquake levels. The most appropriate method to identify these interactions is based on a trained team of engineers performing a walkdown. These walkdowns were integral parts of all three of the seismic programs summarized in Sections 1.1.1 through 1.1.3 above.

- Seismic correlation - Insights from past earthquakes have shown that the seismic damage to similar equipment/systems which are subjected to the same earthquake motions can be correlated. As such, if one cabinet fails during an earthquake, there is a reasonable chance that a similar cabinet in the same area could also fail during the earthquake 2. The seismic correlation insights from past studies 2 are unique to seismic risk studies and are accounted for in an SPRA.

These collective insights have been integrated into the proposed alternate approaches for addressing the seismic risk in the 10 CFR 50.69 risk-informed categorization approach recommended in this report.

1.2 10 CFR 50.69 Categorization Process NEI 00-04 [2] as endorsed in Regulatory Guide 1.201 [3] is one acceptable method for conducting a risk-informed categorization of structures, systems and components (SSCs) that provides evidence and confidence that SSCs will be categorized in a robust and integrated process consistent with 10 CFR 50.69(c)(1)(iv) [1]. The categorization process is performed for entire systems, one or more systems at a time, to ensure that all functions (which are primarily a system-level attribute) for a given component within a given system are appropriately considered.

The process described in NEI 00-04 and presented in Figure 1-1 [16] contains a number of key elements which are summarized below. These elements are used to arrive at a preliminary component categorization (that is, High Safety Significant (HSS) or Low Safety Significant (LSS)).

1. Full power internal events PRA

2. Internal and external hazards

3. Seven qualitative criteria in Section 9.2 of NEI 00 04

4. Defense-in-depth assessment

5. Passive categorization methodology 2

See discussion in Appendix A 1-7

=

Background===

The analyses that can be used to address the hazards in items 1 and 2 above include:

• Internal Event Risk Analysis: Full power internal events PRA, including internal flooding.

• Internal Fire Events: EPRI Fire Induced Vulnerability Evaluation (FIVE) [15] screening process or Fire PRA.

• Seismic Events: Success Path Component List 3 (SPCL) from an IPEEE seismic margin analysis, SPRA or screening if the SPRA CDF is a small fraction of the internal events CDF (that is, <1%).

• Other External Events: (for example, tornados, external floods): External [hazard] PRA model and / or IPEEE screening process.

• Low Power and Shutdown Risks: Qualitative defense-in-depth (DID) shutdown model for shutdown configuration risk management (CRM) based on the framework for DID provided in NUMARC 91-06, Guidance for Industry Actions to Assess Shutdown Management.

3 The term SPCL is used interchangeably in many seismic IPEEE documents with Safe Shutdown Equipment List (SSEL).

1-8

Background

Qualitative Categorization Identify System Evaluate Risk of Each 1 Preliminary HSS if supporting Functions Function1 Components are HSS from PRA

+ Collect System Evaluate Qualitative Internal Events, PRA Integrated Risk Map Each Component Operational Risk of Components to Function Information on sscs 2 cannot be overridden by IDP 3 Safety related HSS SSCs revised by Evaluate Risk in Non- Evaluate Risk in the IDP to be LSS should be PRA Modeled Hazards Shu tdown Modes confirmed by the Defense in Depth Evaluation Probabilistic Risk Assessment Categorization 4 Critical attributes shou ld be determined for all final HSS No - Perform Sensitivity components Study Identify System Component Risk from Yes Boundary and PRA Internal Events Components PRA Integrated Component Risk Component Risk from Yes Other PRA Models No Perform Sensitivity Study HSS LSS 3 Passive Cate9orization

@ 2018 NEI. All rights reserved.

Figure 1-1 Categorization Process Overview (from NEI 16-09) 1-9

=

Background===

With respect to the seven qualitative criteria contain in Section 9.2 of NEI 00-04, the purpose of these considerations is to determine whether these functions/SSCs are not implicitly depended upon to maintain safe shutdown capability, prevention of core damage and maintenance of containment integrity. Specifically, consideration is given to whether:

1. Failure of the active function/SSC will not directly cause an initiating event that was originally screened out of the PRA based on anticipated low frequency of occurrence.

2. Failure of the active function/SSC will not cause a loss of reactor coolant pressure boundary integrity resulting in leakage beyond normal makeup capability.

3. Failure of the active function/SSC will not adversely affect the defense-in-depth remaining to perform the function.

4. The active function/SSC is not called out or relied upon in the plant Emergency/Abnormal Operating Procedures or similar guidance as the sole means for the successful performance of operator actions required to mitigate an accident or transient.

5. The active function/SSC is not called out or relied upon in the plant Emergency/Abnormal Operating Procedures or similar guidance as the sole means of achieving actions for assuring long term containment integrity, monitoring of post-accident conditions, or offsite emergency planning activities.

6. Failure of the active function/SSC will not prevent the plant from reaching or maintaining safe shutdown conditions; and the active function/SSC is not significant to safety during mode changes or shutdown.

7. Failure of the active function/SSC that acts as a barrier to fission product release during plant operation or during severe accidents would not result in the implementation of off-site radiological protective actions.

As discussed in Sections 6 and 9 of NEI 00-04 [2], in cases where the component is safety-related and found to be of low risk significance, it is appropriate to confirm that defense-in-depth is preserved. This includes consideration of the events mitigated, the functions performed, the other systems that support those functions and the complement of other plant capabilities that can be relied upon to prevent core damage and large, early release. Specific criteria are provided for assessing core damage defense-in-depth, including preventing core damage and limiting the frequency of the events being mitigated (Section 6.1), and containment defense-in-depth, including containment bypass, containment isolation, early hydrogen burns and long-term containment integrity (Section 6.2).

1-10

Background

Per NEI 00-04, Defense-in-Depth is maintained if:

1. Reasonable balance is preserved among prevention of core damage, prevention of containment failure or bypass, and mitigation of consequences of an offsite release.

2. There is no over-reliance on programmatic activities and operator actions to compensate for weaknesses in the plant design.

3. System redundancy, independence, and diversity are preserved commensurate with the expected frequency of challenges, consequences of failure of the system, and associated uncertainties in determining these parameters.

4. Potential for common cause failures is taken into account in the risk analysis categorization.

5. The overall redundancy and diversity among the plants systems and barriers is sufficient to ensure that no significant increase in risk would occur.

Finally, pressure boundary components (that is passive components and the passive function of active components) are evaluated using a consequence assessment approach where the component failure is assumed with a probability of 1.0 and only the consequence evaluation is performed. It relies on the conditional core damage and large early release probabilities associated with postulated ruptures. This approach is conservative compared to including the rupture frequency in the categorization as this approach will not allow the categorization of SSCs to be affected by any changes in frequency due to changes in treatment. Deterministic considerations (for example, DID, safety margins) are then also applied to determine the final safety significance from a passive perspective. Component supports are assigned the same safety significance as the highest passively ranked component within the bounds of the associated analytical pipe stress model.

As can be clearly seen, the determination of safety significance through the various elements identified above provides a robust and integrated categorization of SSCs. The results of these elements are used as inputs to arrive at a preliminary component categorization (that is, High Safety Significant (HSS) or Low Safety Significant (LSS)) that is then presented to the Integrated Decision-Making Panel (IDP), a multi-discipline panel of experts that reviews the results of the initial categorization and finalizes the categorization of the SSCs/functions. Note:

the term preliminary HSS or LSS is synonymous with the NEI 00-04 term candidate HSS or LSS. A component or function is preliminarily categorized as HSS if any element of the process results in a preliminary HSS determination in accordance with Table 1-1 below. Consistent with NEI 00-04, the categorization of a component or function will only be preliminary until it has been confirmed by the IDP. Once the IDP confirms that the categorization process was followed appropriately, the final Risk Informed Safety Class (RISC) category can be assigned.

The IDP may direct and approve detailed categorization of components in accordance with NEI 00-04 Section 10.2. The IDP may always elect to change a preliminary LSS component or function to HSS, however the ability to change component categorization from preliminary HSS to LSS is limited. This ability is only available to the IDP for select process steps as described in NEI 00-04 [2] and endorsed by RG 1.201 [3]. Table 1-1 summarizes these IDP limitations in NEI 00-04. The steps of the process are performed at either the function level, component level, or both. This is also summarized in the Table 1-1. A component is assigned its final RISC category upon approval by the IDP.

1-11

=

Background===

As a final note relative to the purpose of this report, the NEI 00-04 section on Integrated Risk Assessment includes the following.

Each risk contributor is initially evaluated separately in order to avoid reliance on a combined result that may mask the results of individual risk contributors. The potential masking is due to the significant differences in the methods, assumptions, conservatisms and uncertainties associated with the risk evaluation of each. In general, the quantification of risks due to external events and non-power operations tend to contain more conservatisms than internal events, at-power risks. As a result, performing the categorization simply on the basis of a mathematically combined total CDF/LERF would lead to inappropriate conclusions. However, it is desirable in a risk-informed process to understand safety significance from an overall perspective, especially for SSCs that were found to be safety-significant due to one or more of these risk contributors.

Table 1-1 Integrated Decision-Making Panel Changes from Preliminary High Safety Significant to Low Safety Significant Drives Categorization Step - IDP Change Element Evaluation Level Associated NEI 00-04 Section HSS to LSS Functions Internal Events Base Not Allowed Yes Case - Section 5.1 Fire, Seismic and Other External Events Allowable No Risk (PRA Base Case Component Modeled) PRA Sensitivity Allowable No Studies Integral PRA Assessment - Section Not Allowed Yes 5.6 Fire, Seismic and Other External Component Not Allowed No Risk (Non - Hazards -

modeled)

Shutdown - Section Function/Component Not Allowed No 5.5 Core Damage -

Function/Component Not Allowed Yes Defense-in- Section 6.1 Depth Containment -

Component Not Allowed Yes Section 6.2 Qualitative Considerations -

Function Allowable N/A Criteria Section 9.2 Passive Passive - Section 4 Segment/Component Not Allowed No 1-12

Background

1.3 Relationship to the Rule and Other Guidance Documents Figure 1-2 illustrates how this report relates to the 50.69 Rule [1] and other guidance documents.

Requirements for implementing risk-informed categorization and treatment of SSCs are described in 10 CFR 50.69 [1], the adoption of which is optional by each licensee. The rule provides requirements for both phases of implementation; categorization and the resulting treatment allowances.

Regulatory RG 1.174(2)

Guidance RG 1.200(3)

RG 1.201(4)

NEI 00-04 (Categorization)

NEI 16-09 (Implementation)

NEI 17-05 (Treatment)

EPRI 1011234 (Implementation & Treatment}

EPRI 1009748 (Alternative Treatment to EQ Applications}

EPRI EPRI 1011783 (RISC-3 Seismic Assessment}

Supplemental EPRI 1015099 (Special Treatment}

Guidance EPRI 1022945 (Risk-Informed Repair/Replacement}

EPRI 3002012984 (Risk-informed Categorization}

EPRI 3002012990 (Alternative Treatment Case Studies}

EPRI 3002015999 (Enhanced Risk-Informed Categorization Methodology for Pressure Boundary Components}

EPRI 3002017583 (Alternative Approaches for Addressing Seismic Risk}

Notes:

{1) "50.69 Risk-informed categorization and t reatment of st ructu res, systems and components for nuclear power reactors" (2) "An approach fo r using probab ilist ic risk assessment in risk-informed decisions on plant-specific changes to the licens ing basis" (3) "An approach fo r determ ining the techn ica l adequacy of probabi li stic risk assessment resu lts for risk- informed activit ies" (4) "Gu idance for catego ri zing structures, systems and components in nuclear power plants accord ing to the ir safety sign ificance" Figure 1-2 Relationship With the 10 CFR 50.69 Rule and Other Guidance Documents 1-13

2 PROPOSED APPROACH The current approaches in NEI 00-04 [2] for considering seismic risks in the categorization process include the following options.

• An SPRA can be used with specified risk ranking and sensitivity studies to determine seismic related HSS SSCs; it is expected that an SPRA used for this purpose would meet RG 1.200

[17]

• An IPEEE Seismic Margins Assessment (SMA) equipment list can be used where all of the SSCs on the equipment list are designated HSS

• If the SPRA CDF is a small fraction of the internal events CDF (that is, <1%), then safety significance of SSCs considered in the SPRA can be considered LSS from a seismic perspective.

There are a number of plants that do not fit into any of these options. These are typically plants with moderate seismic hazards that did not use an SMA for their IPEEE response and were not required to perform an SPRA to respond to the NRCs Fukushima 50.54(f) letter [6]. This situation prompted a review for alternatives that could provide the appropriate seismic related insights to the categorization process.

A series of test cases were evaluated at sites with high seismic hazards and RG 1.200 compliant SPRAs to determine the types of seismic insights that would contribute to 50.69 categorization decisions. These test cases, described in Section 3, led to the development of the graded approach for categorization of seismic inputs described in this section.

2.1 Overview of Approaches A graded approach is recommended that supports the 50.69 categorization process. The key premise of the approach is that most seismic related SSCs that would be categorized as HSS in accordance with NEI 00-04 would also be categorized as HSS for other reasons (that is internal events PRA insights, other external hazard risk insights, Defense-in-Depth considerations).

Therefore, the goal of the graded approach is to identify SSCs that may be categorized as HSS based solely on seismic risk insights.

A second key premise is that the degree to which the plant seismic hazard, represented by the ground motion response spectrum (GMRS), exceeds the plant seismic design basis, represented by the Safe Shutdown Earthquake (SSE), influences the likelihood that unique seismic-related HSS SSCs will be identified. The 50.69 categorization process uses the F-V and RAW importance measures to determine relative ranking of the PRA SSCs. Since these are relative risk measures, even at a plant with low seismic hazards, there will always be a distribution of relative importance measures from high to low. However, at higher seismic hazard plants, the chances of identifying an unusual seismic induced condition that would cause SSCs to be HSS is greater.

For example, the likelihood that nearby block walls will collapse and prevent important SSCs 2-1

Proposed Approach from performing their required functions becomes greater as the seismic hazard increases. In addition, the available seismic margin even in seismically designed SSCs, decreases as the seismic hazard increases, leading to greater likelihood of seismically induced failures and greater challenges to plant systems. Therefore, 50.69 seismic categorization test cases performed using plants with high seismic hazards relative to their seismic design basis would be more likely to identify unique conditions that would lead to the identification of HSS SSCs for unique seismic related reasons. Thus, plants with relatively high seismic hazard were chosen as test cases for the graded approach.

Three tiers are recommended within this graded approach. The primary measure for determining the appropriate tier for a plant is similar to the grading process used in EPRI 1025287 [11] for the Fukushima 50.54(f) letter responses and in NEI 12-06 [12] for the Mitigation Strategy Assessment. This measure is a comparison of the site-specific ground motion response spectrum (GMRS) to the site plant design basis (typically the Safe Shutdown Earthquake (SSE)) over the frequency range of 1.0 to 10 Hz. At sites where the GMRS/SSE ratio is low, there is a lower chance that seismic unique insights would contribute to HSS categorization. At sites where the GMRS/SSE ratio is higher, there are higher chances that seismic unique insights would contribute to HSS categorization.

The three recommended tiers are the following.

• Tier 1: Plants where the GMRS peak acceleration is at or below approximately 0.2g or where the GMRS is below or approximately equal to the SSE between 1.0 Hz and 10 Hz. Examples are shown in Figures 2-1 and 2-2. At these sites, the GMRS is either very low or within the range of the SSE such that unique seismic categorization insights are not expected.

• Tier 2: Plants where the GMRS to SSE comparison between 1.0 Hz and 10 Hz is greater than in Tier 1 but not high enough to be treated as Tier 3. At these sites, the unique seismic categorization insights are expected to be limited.

• Tier 3: Plants where the GMRS to SSE comparison between 1.0 Hz and 10 Hz is high enough that the NRC required the plant to perform an SPRA to respond to the Fukushima 50.54(f) letter [6]. The NRC used a variety of site-specific quantitative and qualitative considerations in making these decisions [for example, 40, 41] and it represents the best available assessment of when an SPRA should be employed in risk-informed evaluations.

The plants in this category are listed in Table 2-1 4. Note that several plants planning to shutdown applied for, and received extensions of their SPRA due dates. Those plants are not included in Table 2-1.

4 Note that several plants planning to shutdown applied for, and received extensions of their SPRA due dates from the NRC. Those plants are not included in Table 2-1. If those shutdown decisions change, they could be treated consistent with Tier 3 plants.

2-2

Proposed Approach 0.80 I I I

+

- Safe Shutdown I I I I Earthquake 0.60 ~

- Ground Motion --~

Response Spectrum I

+

I I I

C I I I I I I 0

• ,.:. I

~ 0.40 Cl/

Qi I I

11 u

ct u I I I I I

I ,,,.... .........._

I_,- ,,-

~

0.20 1""-1.J.: ,

~

I I V"

.A ~

~J- I

......... I I I

I 11 0.00

" '" '111~

__, - I I I

I I 0.10 1.00 10.00 100.00 Frequency (Hz}

Figure 2-1 Low Seismic Hazard Site: Low GMRS Peak Acceleration 0.80 I I I

- Safe Shutdown I I I I Earthquake 0.60 ,-

- Ground Motion I I I Response Spectrum I I I C

I I I I I 0

• ,.:. I I I I.

v~

~ 0.40 ' '

Qi u

Cl/

/ ""I, ~

u ct I I I I I ~ ""- I I I

~

I I I b,,,~~ J_,..

0.20 I I I I I

..-r , I I 1...,...1""'"1 ~ , I

~ I 11

........ -.......,1 I I I I I I

~1 --ht"" '

I

~

I r- I 0.00 0.10 1.00 10.00 100.00 Frequency (Hz}

Figure 2-2 Low Seismic Hazard Site: Typical SSE to GMRS Comparison 2-3

Proposed Approach Table 2-1 Plants Performing Seismic Probabilistic Risk Assessments for the Fukushima 50.54(f)

Letter Beaver Valley DC Cook Oconee Sequoyah Browns Ferry Diablo Canyon Palisades VC Summer Callaway Dresden Peach Bottom Vogtle Columbia North Anna Robinson watts Bar The criteria for considering seismic risk insights in the 50.69 categorization process for each Tier is described below.

2.2 Tier 1 - Low Seismic Hazard / High Seismic Margin Sites 2.2.1 Description of the Approach For Tier 1 plants, the GMRS is either very low or similar to the SSE such that unique seismic categorization insights are expected to be minimal. Since little to no unique seismic insights, would be anticipated for such sites, the approach is to rely on the 50.69 categorization process using the full power internal events (FPIE) and other risk evaluations along with the Defense-in-Depth, passive evaluations, and Integrated Decision-making Panel (IDP) assessment of the qualitative criteria. This process is expected to adequately identify the safety-significant functions and SSCs required for those functions.

2.2.2 Technical Basis for Approach The test cases described in Section 3 showed that even for plants with high seismic ground motions compared to their design basis, there would be very few if any SSCs designated HSS for seismic unique reasons. At the low seismic hazard sites in Tier 1, the likelihood of identifying a unique seismic condition that would cause an SSC to be designated HSS is very low.

2.2.2.1 Integral Assessment In addition, since the seismic hazards for these sites are low, the seismic CDF would also be expected to be low. This is important because the NEI 00-04 [2] categorization process includes an Integral Assessment that weights the importance from each risk contributor (for example, internal events, fire, SPRAs) by the fraction of the total core damage frequency contributed by that contributor. The risk from an external hazard only drives a component to a required HSS determination if the results of the integral assessment meet the importance measure criteria for HSS. The integral assessment uses the following equations.

2-4

Proposed Approach IlFVij, x CDFj)

IFVi =

LjCDFj Equation 2-1 Integrated Fussell-Vesely Importance where, IFVi = Integrated F-V Importance of Component i over all CDF Contributors FVi, j = F-V Importance of Component i for CDF Contributor j CDFj = CDF of Contributor j IlRAWij, - 1) x CDFj

=1+

LjCDFj Equation 2-2 Integrated Risk Achievement Worth Importance where, IRAWi = Integrated Risk Achievement Worth of Component i over all CDF Contributors RAWi, j = Risk Achievement Worth of Component i for CDF Contributor j CDFj = CDF of Contributor j Using these equations, if the seismic CDF is low, then the SSC importance measures from the SPRA are weighted lower than other risk contributors and the resulting seismic inputs to the categorization process are weighted lower. This would further reduce the likelihood of identifying a unique seismic condition that would cause an SSC to be designated HSS 2.2.2.2 Relays and Contactors The categorization of relays and contactors warrants some additional discussion of how they are addressed in the 50.69 categorization process. Relays and contactors are often considered to be seismically sensitive items and their performance during earthquakes can be important contributors to seismic risks.

FPIE PRAs do not typically model relays explicitly. They are included implicitly as part of modeled assemblies such as Control Panels and Motor Control Centers. For example, in backup power systems, the diesel generator control panel, including the relays inside the panel, would be considered part of the backup power system. If the control panel is determined to be HSS in the FPIE PRA, which is very likely since backup power is important to response of the plant to accidents, then the components in the control panel would be considered HSS by default as part of the HSS function. If a subsequent detailed categorization evaluation of the components in the control panel was performed in accordance with NEI 00-04 [2], then the function of the components in the control panel would be evaluated based on their contribution to successful performance of the control panel function. Therefore, relays that contribute to successful performance of the control panel function, or where intermittent chatter could prevent successful performance, in supporting backup power, would be categorized as HSS.

2-5

Proposed Approach 2.2.3 Summary/Conclusion/Recommendation For Tier 1 plants, the GMRS is either very low or similar to the SSE such that unique seismic categorization insights are expected to be minimal. At the low seismic hazard sites in Tier 1, the likelihood of identifying a unique seismic condition that would cause an SSC to be designated HSS is very low. Therefore, with little to no anticipated unique seismic insights, the 50.69 categorization process using the FPIE PRA and other risk evaluations along with the Defense-in-Depth and qualitative assessment by the Integrated Decision-making Panel (IDP) are expected to adequately identify the safety-significant functions and SSCs required for those functions and no additional seismic reviews are necessary for 50.69 categorization.

2.3 Tier 2 - Moderate Seismic Hazard / Moderate Seismic Margin Sites 2.3.1 Description of the Approach For Tier 2 plants, the GMRS to SSE comparison is higher than Tier 1 plants but not high enough to be treated as Tier 3 plants. In Tier 2, there may be a limited number of unique seismic insights appropriate for consideration in determining HSS SSCs. These insights would be most likely attributed to the possibility of seismically correlated failures or seismic interaction related failures, not identified in the FPIE or Fire PRAs. Therefore, a special sensitivity study is recommended using a Common Cause approach in the FPIE PRA to account for similar categorization insights. These seismic insights would be considered with the other categorization insights by the Integrated Decision-making Panel (IDP) for the final HSS determinations.

The seismic insights from the four seismic categorization test cases are described in Section 3.

One of the key seismic insights is the importance of considering seismic correlation effects on the plant risk. The correlated seismic response of SSCs that may occur in a seismic event is not captured in the internal event PRA or the fire PRA. As such, for 50.69 purposes, for Tier 2 plants should consider these seismic correlation insights when performing system categorization.

Through correlated impacts, seismic events can fail both trains of SSCs in a two-train system depending on the seismic capacity and the seismic demand of the SSCs. Current SPRAs typically assign SSCs to be fully correlated when SSCs have the following same or similar conditions:

• The same seismic capacity based on similar governing failure modes in the same equipment (for example, anchor bolt tensile failure, functional failure based on testing, or bearing failure)

• The same seismic demand based on the location of the equipment (for example, same building, elevation), and similar orientation if the failure is dependent on the earthquake direction.

2-6

Proposed Approach These seismic failures, referred to as correlated failures, are similar in impact to common cause failures (CCFs) that are typically modeled in an internal events PRA. The importance of the CCF basic events in the internal events PRA may be used to assess the importance of the seismic correlated failures. However, the probabilities of internal event CCF basic events are generally lower than the conditional probabilities of seismic correlated failures at higher ground motion levels. In addition, the internal events PRA may not have a CCF failure mode and basic event for some of the SSCs that may be subject to correlated seismic failures. For example, seismic failure of two tanks may be modeled as correlated failures in an SPRA, but common cause failure of tanks in the internal events PRA is typically screened out due to the very low probability of random occurrence.

Another key insight from the four seismic categorization test cases is that seismic interactions (for example, seismic induced falling, deflections and flooding that affect nearby safety related components) are unique to seismic risk studies and can result in seismic unique insights potentially leading to HSS SSCs.

To better assess the importance of SSCs to seismic event response at Tier 2 plants, the internal events PRA may be used with some modifications and augmented by focused seismic walkdowns to obtain an indication of the importance of SSCs for mitigating seismic events. The process is depicted in Figure 2-3 and the steps are summarized. Note that this process is performed on a system basis, as the 50.69 categorization process is performed for a given system.

1. Identify the set of SSCs within the system to be categorized.

2. Group the SSCs within the system into the classes of equipment and distributed systems used for SPRAs. This format of grouping allows for an efficient assessment from a seismic perspective. Industry documents such as the EPRI 3002000709 [18] and EPRI NP-6041-SL [19] identify the list of these classes. For example, separately group all manual valves, all check valves, all MOVs, all AOVs, all pumps, etc. This will make it easier to screen SSCs in the next step, as well as to see which SSCs already have CCF basic events modeled in the FPIE PRA.

3. Refine the list of SSCs in the system being categorized based on a series of screens to minimize the number of SSCs required to be evaluated as part of this correlation sensitivity study. Note that any/all of these screens can be incorporated into the process and that any order of implementing these three screens is acceptable. These screening decisions may be plant specific and likely will involve cost/benefit decisions in terms of how best to complete the sensitivity study.

a. Screen out inherently rugged components. NEI 12-06 Appendix H [12] provides the following list of inherently rugged components.

i. Strainers and small line mounted tanks ii. Welded and bolted piping iii. Manual valves, check valves, and rupture disks iv. Power operated valves (MOVs and AOVs) not required to change state 2-7

Proposed Approach

b. Screen out SSCs that are not used in safety functions that support mitigation of core damage or containment performance. This will likely already be identified as part of the function definition within the 50.69 categorization process. An example would be a chiller system that maintains the temperature of water in a tank but is not part of the safety function of the tank (for example, provides core inventory). The SSCs in the chiller subsystem can be screened.

c. Screen out from further evaluation the SSCs that have already been identified as being HSS from either the FPIE PRA or HSS from the Integral Assessment. For this screening step, the categorization based on the FPIE PRA and the Integral Assessment would need to have already been completed.

4. Those SSCs screened out in Steps 3a, 3b, or 3c can be removed from the sensitivity study. In addition, SSCs screened out below in Step 5c, 6, or 9 can be removed from further seismic consideration.

5. For system components not screened out in Step 3, perform a seismic walkdown focused on the three activities listed below. The purpose of this step is to identify SSCs that could experience seismic correlated failures or could be subject to seismic interactions that would lead to failure of more than one SSC within the system being categorized. The following elements contribute to identifying these conditions.

a. Assess if the subject SSCs would likely experience correlated failures during a seismic event. Seismic correlation walkdown reviews are performed as part of an SPRA and the guidance associated with performing that correlation walkdown is documented in Appendix A.

b. Assess potential seismic interactions to identify conditions that would be treated as seismic correlated failures and therefore, should be evaluated as common cause failures.

Guidance for this seismic interaction walkdown review is also contained in Appendix A.

c. Screen out SSCs that are determined to be sufficiently rugged such that they would not be significant contributors to seismic risk in an SPRA. This screen focuses on the SSC seismic capacity associated with functional failures and anchorage. The screen can also be applied to identified seismic interactions provided the seismic capacity of the interacting item (for example, block wall) has a seismic capacity that meets the screening level. Appendix B contains a description of the approach recommended for this screening.

6. SSCs that are determined through the walkdown to be of high seismic capacity and not included in seismically correlated groups or correlated interaction groups can be screened out from further seismic considerations since their non-seismic failure modes are already addressed in the FPIE PRA and fire PRA.

2-8

Proposed Approach 2 1 Identify SSCs Group SSCs into in system to be equipment classes categorized r ---- - --

1 I

I 3a I

I SSC is I

I Inherently Seismic Rugged not used in function 4 Screened out I

I that mitigates core damage  ::-- - - -Yes,- -......--1.i from further seis mic I or containment consideration I

I I

I I

I I

I I

I I

I 1 Step 3 screens can be performed in any order L------------------------------------------- _ _ _ _ _ _ _ _ J

~ - - - - -No r-------------------------

Sa Sb Identify SSCs Identify seismic considered seismica lly e------11-------1 interaction failures correlated High Seismic =-- - - -Yes- - - - - ~ - -

Capacity 1 Step 5 evaluations are

performed as part of a

seismic walkdown No 7 SSCs Add seismic identified for correlation surrogate common cause Yes  ::-- - - - -No--- - - - - . i or interaction groups to FPIE PRA fai lures 8

Quantify LOOP/SBO SSCs and SLOCA events and meet FV or RAW

) -- - -No calculate FV and RAW thresholds for Importance Measures HSS Figure 2-3 Seismic Correlated Failure Assessment 2-9

Proposed Approach

7. Add new seismic surrogate events to the FPIE PRA logic model for the potential seismically correlated conditions identified in the previous steps. New surrogates should be added to the PRA under the appropriate areas in the logic model. For example, a new surrogate basic event that models seismic correlated failure of two tanks would be added to the PRA logic model under the gates that model the individual tank failures. Seismic interaction surrogate events should be added to the model such that they fail the SSCs affected by the interaction.

For example, a seismic interaction surrogate event that models a block wall falling onto two nearby pumps should be added to the PRA logic model under the gates that model the pumps.

The probability for the new seismic surrogate basic events should be set to a value equivalent to a typical total seismic hazard exceedance frequency above which SPRAs would typically model loss of offsite power and for which correlated failures may be likely. The recommended value is 1.0E-04, but other appropriately justified values may be used.

8. Quantify the FPIE PRA model for LOOP and small LOCA events using the modified model with surrogate events, and calculate importance measures for the seismic surrogate events.

Since the majority of seismic risk in many SPRAs are the LOOP and small LOCA accident sequences, these events represent are the most appropriate events for performing this correlation study. The process is as follows.

a. The recommended event frequency for the LOOP initiator is 1.0 and for the small LOCA initiator is 1.0E-02. The LOOP frequency value of 1.0 is recommended since the probability of the surrogate events (from Step 7) is the total seismic hazard exceedance frequency above which SPRAs would typically model loss of offsite power. The basis for the small LOCA frequency of 1.0E-02 is that seismically-induced small LOCAs require failures that SPRAs show typically occur at much lower frequency than seismically-induced LOOP. Other appropriately justified values small LOCA frequency may be used.

The majority of seismic risk is from the LOOP/SBO and small LOCA accident sequences.

b. Set the frequency for all initiators other than LOOP and small LOCA to 0. Note that many FPIE PRAs have multiple LOOP initiating events (for example, grid centered, switchyard centered, etc.). Only one of these needs to be set to 1.0 in step 8a, above, while all the rest can be set to 0.

c. Since a seismic event that causes a small LOCA is also assumed to cause a LOOP, update the PRA model to account for this. This is typically done by setting a conditional LOOP probability to 1.0, but can be done in any appropriate manner.

d. Many FPIE PRA models credit restoration of offsite power in the LOOP/SBO accident sequences. This credit should not be taken in this process since recovery of offsite power after a seismic event is not generally credited in a seismic event.

9. For each seismic surrogate event, compare the results to the F-V and RAW HSS criteria for common cause components in the FPIE PRA from NEI 00-04 (that is, F-V > 0.005 or RAW > 20). For seismic surrogate events, if the F-V or RAW criteria are met, all SSCs modeled by that surrogate event should be considered HSS.

2-10

Proposed Approach

10. Since this process is a pseudo-deterministic evaluation process rather than a full risk informed process, these seismically correlated group HSS designations should be treated similar to HSS designations using the IPEEE SMA SSEL and in general, not be subject to reconsideration by the Integrated Decision-making Panel (IDP). However, SSCs which are HSS solely due to surrogate events representing seismic induced interactions (for example, block walls impacting equipment) may be downgraded to LSS by the IDP with appropriate justification. In addition, the IDP may direct further engineering evaluation to refine any of the seismic evaluation insights.

2.3.2 Technical Basis for Approach The test cases described in Section 3 showed that even for plants with high seismic ground motions compared to their design basis, there are very few if any SSCs that would be designated HSS for seismic unique reasons and the technical basis for the Tier 1 approach in Section 2.2.2 generally apply for the Tier 2 plants.

The test cases did identify a small number of instances where unique seismic insights associated with seismically correlated failures led to unique HSS SSCs. While these unique HSS SSCs would be unusual for moderate hazard plants, it is prudent to perform additional evaluations to identify the conditions where these correlated failures may occur, and determine their impact in the 50.69 categorization process.

For a system being categorized under 50.69, the process described in Section 2.3.1 identifies the conditions that would be treated as seismically correlated fragilities or interaction consequences if an SPRA were being performed. It screens out SSCs that would either be very low contributors to seismic risk or would not be potential candidates for HSS, or were already categorized as HSS. These SSCs do not require additional seismic evaluations for considerations in the 50.69 categorization process. After that initial work, the evaluation follows a thought process similar to that in a SPRA, using a seismic walkdown to identify correlated conditions and potential seismic interaction and screen low seismic contributors.

The resulting unscreened SSCs are candidates for seismically correlated conditions that should be evaluated for their impacts on 50.69 categorization. In an FPIE PRA, common cause evaluations behave similarly to seismically correlated conditions in that they model the impacts of multiple SSC failures; therefore, the common cause methods can be employed to determine the necessary insights for 50.69 categorization.

The recommended methods and evaluation parameters in Section 2.3.1 for adding the surrogate seismic common cause events into the FPIE PRA and performing the sensitivity study serve to identify to necessary categorization insights. A common cause failure probability of 1.0E-4 is used to align with the total seismic hazard exceedance frequency above which SPRAs would typically model loss of offsite power and for which correlated failures may be likely.

Seismically induced LOOP and small LOCA events represent the majority of seismic risk in many SPRAs and are the most appropriate events for performing this correlation study. The process assumes a LOOP occurs (frequency set to 1.0) and uses a small LOCA frequency of 1.0E-02 because seismically-induced small LOCAs require failures that SPRAs show typically occur at much lower frequency than seismically-induced LOOP. This combination of events typically encompasses the majority of seismic risk.

2-11

Proposed Approach The importance measures derived from this sensitivity study can then be used to identify the appropriate SSCs that should be HSS due to seismically correlated failures or seismic interaction related failures.

2.3.3 Summary For Tier 2 plants, the GMRS to SSE comparison is higher than Tier 1 plants but not high enough to be treated as Tier 3 plants. In Tier 2, there may be a limited number of unique seismic insights, most likely attributed to the possibility of seismically correlated failures, appropriate for consideration in determining HSS SSCs. The special sensitivity study recommended using common cause failures, similar to the approach taken in a FPIE PRA, can identify the appropriate seismic insights to be considered with the other categorization insights by the Integrated Decision-making Panel (IDP) for the final HSS determinations.

2.4 Tier 3 - High Seismic Hazard / Low Seismic Margin Sites For Tier 3 plants, the GMRS to SSE comparison is high enough that no alternate approach for seismic inputs to the 50.69 categorization process is proposed and the existing processes identified in NEI 00-04 for considering seismic risk in the categorization process should be used.

The four seismic categorization test cases described in Section 3 suggest that even for Tier 3 plants, only a limited number of seismic unique insights are likely to contribute to the categorization process. However, in Tier 3 the potential GMRS seismic demands exceed the seismic design bases by high enough ratios that it is difficult to have high confidence that unique seismic conditions would not affect the set of SSCs captured in the categorization process.

Therefore, the available methods in NEI 00-04 can be used to provide seismic inputs to the categorization process. These methods include the use of an SPRA or an SMA as described in Section 5.3 of NEI 00-04 [2].

2-12

3 SEISMIC PRA INSIGHTS AND TRIAL CATEGORIZATION STUDIES CONDUCTED ON HIGH SEISMIC HAZARD SITES Trial 50.69 categorization evaluations were performed at four plants with relatively high seismic hazards using the SPRAs available for these plants. These plants were characterized as having and high seismic hazards, based on the ground motion response spectrum (GMRS), compared to their seismic design bases, defined by the safe shutdown earthquake (SSE). These trial characterizations were undertaken to determine the seismic related categorization insights. Those seismic insights are compared with categorization insights at the same plants using their FPIE PRAs and fire PRAs if available to determine the degree to which the seismic insights produce unique categorization insights. The trial studies were not performed to implement actual SSC 50.69 categorization and did not include the NEI 00-04 criteria for the IDP. The trials were performed to derive seismic related categorization insights in support of this report.

3.1 Introduction to Trial Categorization Studies Sensitivity studies were performed at four sites with newly developed SPRAs. The selected sites represent a distribution of different reactor types, containment types, and nuclear steam supply system (NSSS) types as shown in Table 3-1.

Table 3-1 Trial Plant Summary MWe Pilot Plant NSSS Type Containment Type (Unit 1 / Unit 2)

Plant A 1180 / 1180 GE/BWR4 Mark I (Steel Drywel and Wetwell)

Plant B 1000 / 1000 Westinghouse / 3-loop Large Dry, Subatmospheric Plant C 1150 / 1150 Westinghouse / 4-loop Large Dry Plant D 1000 / 1000 Westinghouse / 4-loop Wet, Ice Condenser As described in Section 2.1, the degree to which the plant seismic hazard (GMRS) exceeds the seismic design basis (SSE) is expected to influence the likelihood that unique seismic-related HSS SSCs will be identified. At higher seismic hazard plants, the chances of identifying an unusual seismic induced condition that would cause SSCs to be HSS is greater. Therefore, 50.69 seismic categorization test cases performed using plants with high GMRS relative to their SSE would be more likely to identify unique conditions that would lead to the identification of HSS SSCs for unique seismic related reasons.

The GMRS to SSE comparisons at the four trial plants are shown in Figures 3-1 through 3-4. In each case, the GMRS exceeds the SSE by a significant margin.

3-1

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Each trial is described in the following sections.

1.40 I I I I l -

I I

I I I 1.20 '- - SSE I I I Figure 3-1 Plant A Ground Motion Response Spectrum to Safe Shutdown Earthquake Comparison 1.40 I I I I

' I 1.20 '- - SSE ~~

'.l 1.00

'- - GMRS 4~-

I I

.V

/

+ .

I I

I . I \ I

-1 I I~ I

§ 0.80

~H-I

~ '

~ j

~

]

Q) 0.60 I I .'

u

<t I I

l I~ I I rs I

I 0.40 ,, j I I I .....

+- +-'- * '-

0.20

/ /( "'- .........

,. V _/t -

I 0.00

0. 10 1.0 0 10.00 100.00 Frequency (Hz)

Figure 3-2 Plant B Ground Motion Response Spectrum to Safe Shutdown Earthquake Comparison 3-2

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites

+

1.40 I I I I I I I 1.20 f- - SSE I I I

I I

~~

1.00 ~

- GMRS . If" -~

~I I

I I I

I , I I

\.

I I

§ 0.80 j \

~

I \

a, "ii 0.60

/,_ '\.

u u

<(

0.40

~- H -rl,~ i -++--

I

~

'l r- i---

y "'J

-I -r-

---

. ~ I 0.20 V ~ , I" 0.00

~

0.10 I~

I -

~

I L 1.00

+ Frequency (Hz) 10.00

- L 100.00 Figure 3-3 Plant C Ground Motion Response Spectrum to Safe Shutdown Earthquake Comparison 1.40 I I I I I I 1.20 - - ssE I I I I I I I 1.00 - - GMRS I I I I I

§ 0.80

~

a, "ii 0.60 j i 1., ~

I.. ~

I

~,

1--

u 11-- 1.1~ l \j

~. --

u

<(

0.40

,r 1\ . .

/ / .. !Iii 7~

~

~-- ~V ,_,,/_ I 0.20 I I *1 V I I 0.00 1-rT I I 0.10 1.00 10.00 100.00 Frequency (Hz)

Figure 3-4 Plant D Ground Motion Response Spectrum to Safe Shutdown Earthquake Comparison 3-3

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3.2 Plant A Trial Categorization Evaluation 3.2.1 Introduction Plant A is a two-unit plant. Each unit has a GE BWR 4 Reactor and Mark I Containment. The initial plant design was 3458 MWt and 1180 MWe per unit. Plant A has implemented various power uprates (Leading Edge Flow Meter, Extended Power Uprate and Measurement Uncertainty Recapture) yielding current ratings of 4016 MWt and 1366 MWe, per unit.

The PRA models used in this study are described below.

3.2.2 Seismic PRA High Safety Significant Evaluation 3.2.2.1 Background The risk-informed categorization of SSCs in nuclear power plant applications requires the use of an appropriately detailed PRA of sound technical quality. Plant A has a preliminary SPRA that is of sufficient quality to support this study. It was Peer Reviewed in March 2017 and is scheduled to be submitted to the NRC in 2018 in response to the Fukushima 50.54f letter [6]. This section will describe how the quantitative insights from the SPRA model are developed for this study.

3.2.2.2 Description of Model Used for Analysis The SPRA models used for this analysis provided seismic insights into the as built, as operated plant. The risk significance of each identified component was examined using the SPRA. This evaluation consisted of examining the results from each unit for both core damage frequency (CDF) and large early release frequency (LERF). The single top SPRA model was created and quantified using the EPRI R&R Workstation software suite [20], with truncation values ranging from 1E-06/yr to 1E-10/yr for CDF and truncation values ranging from 5E-8/yr to 1E-12/yr for LERF. The seismic PRA uses a discretized set of seismic intervals to represent the full seismic hazard, evaluates the seismic CDF and LERF for each seismic interval, and integrates the results over the set of seismic intervals. Due to the special circumstances within seismic modeling (that is, over-counting caused by numerous high failure probability events), the EPRI Advanced Cutset Upper Bound Estimator (ACUBE) code [21], which uses the Binary Decision Diagram (BDD) algorithm, is used for more accurate quantification of the SPRA model.

The risk importances are calculated using cutset results (as typical in an R&R Workstation environment) and the ACUBE software to determine the individual basic event risk importance values. The seismic CDF (SCDF) Fussell-Vesely (F-V) values for SSC fragilities are calculated by integrating the various seismic interval basic event risk importances to determine the risk importance for a given SSC. The SCDF F-V values are based on a weighted sum of the individual SSC F-V values calculated for the individual seismic hazard intervals. In other words, the total F-V of an SSC fragility is the weighted sum of the associated eight SSC fragility basic events (one per hazard interval). Similarly, the SCDF risk achievement worth (RAW) risk importance measures are integrated for all eight basic events. This is typically performed manually in an Excel spreadsheet using the ACUBE output importance information. The seismic LERF (SLERF) F-V and RAW values are calculated using the same method discussed for SCDF.

3-4

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Similar to Internal Events, the component importances were evaluated using the methodology described in NEI 00-04 [2] and the importance calculation criteria identified in Table 5-1 of NEI 00-04. The determination of High Safety Significant (HSS) or Low Safety Significant (LSS) from the SPRA is described in Section 3.2.5.

3.2.3 Full Power Internal Events PRA High Safety Significant Evaluation 3.2.3.1 Background The Plant A full power internal events (FPIE) PRA model was Peer Reviewed in November 2010. It models severe accident scenarios resulting from internal initiating events occurring at full power operation as required to support the 50.69 categorization process. The results of the Internal Events quantification are used as one of the inputs in the 50.69 categorization process.

This section describes how the quantitative insights from the Plant A Internal Events model are developed and used for categorization.

3.2.3.2 Description of Model Used for Analysis The FPIE PRA models used for this analysis were 50.69 application specific models, adjusted to provide better insight into the as built as operated plant.

The risk significance of each identified component was examined using the FPIE PRA. This evaluation consisted of examining the results from both units for both CDF and LERF. While quantifying the FPIE PRA model using the EPRI PRAQuant Software [22], truncation values for CDF and LERF were both 5E-12. The component importances were evaluated using the methodology described in NEI 00-04 [2] and the importance calculation criteria identified in Table 5-1 [2]. The Determination of HSS or LSS from the Internal Events PRA is described in Section 3.2.5.

3.2.3.3 Identif ication of Risk Criteria and Analysis of Component Importances NEI 00-04 [2] provides the following guidance.

An essential element of the SSC categorization process is a plant-specific full power internal events PRA, which should satisfy the accepted standards for PRA technical adequacy, reflect the as-built and as-operated plant, and quantify core damage frequency (CDF) and large early release frequency (LERF) for power operations due to internal events. Assessments of other hazards and modes of plant operation should be reviewed to ensure that the results and/or insights are applicable to the as-built, as-operated plant.

PRAs provide an integrated means to assess relative significance. In cases where applicable quantitative analyses are not available, the categorization process will generally identify more SSCs as safety-significant than in cases where broader scope PRAs are available.

For the purposes of this analysis a full system mapping was not needed as only specific components, identified as HSS by the SPRA were evaluated. In practice a complete system mapping would be performed for the system being evaluated.

Per the NEI 00-04 process, a number of PRA risk significance evaluations are performed to determine the risk significance of PRA-modeled components. In order to perform the PRA risk significance evaluations a mapping of system components to PRA basic events (for example, 3-5

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites pump fails to start, pump fails to run) would be performed. Typical events that are included in the mapping are events representing independent component unreliability, unavailability and common cause failures. Some components may not be explicitly modeled in the PRA however, surrogate events, such as operator actions may be used to provide insights into a components significance.

Basic event component mapping was performed consistent with the 50.69 categorization process.

Each component was evaluated using two PRA importance metrics, Fussell-Vesely (F-V) and Risk Achievement Worth (RAW). Table 3-2 [2] lists the high-level criteria for risk significance of PRA modeled components. Common cause failure (CCF) contribution is included in the evaluation using a separate metric as defined in the table. Per the NEI 00-04 [2] guidance, for each PRA risk significance evaluation discussed below, the PRA F-V values for each basic event are added together for a given component; the maximum value of RAW for each basic event is selected for a given component; and the maximum value of common cause RAW for each basic event is selected for a given component. If a component exceeds any of the HSS criteria, the component is preliminarily categorized as HSS. The evaluation was performed in accordance with Section 5 of NEI 00-04.

Table 3-2 PRA Risk Criteria per NEI 00-04 PRA NEI 00-04 Criteria Ranking Sum of F-V for all basic events modeling the component of interest, including HSS common cause events >0.005 HSS Maximum of component basic event RAW values >2 HSS Maximum of applicable common cause basic events RAW values >20 LSS Modeled SSCs that do not meet any of the HSS criteria 3.2.4 Fire PRA High Safety Significant Evaluation The Plant A Fire PRA was used to perform the 50.69 categorization process evaluation. The model was Peer Reviewed in November 2011 and the F&O Finding Closure Review was conducted in November 2016. This section describes how the quantitative insights from the fire model are developed and used for categorization.

3.2.4.1 Description of Model Used for Analysis The Fire Models used for this analysis were application-specific models adjusted to provide better insight into the as built, as operated plant.

The risk significance of each identified component was examined using the Fire PRA, using the results from both units for both CDF and LERF. While quantifying the Fire PRA model using the EPRI PRAQuant Software [22], truncation values for CDF and LERF were both 5E-12.

Similar to the FPIE PRA, the component importance measures were evaluated using the methodology described in NEI 00-04 and the importance calculation criteria identified in Table 3-2. The determination of HSS or LSS from the Fire PRA is described in Section 3.2.5.

3-6

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3.2.4.2 Identification of Risk Criteria and Analysis of Component Importances The same criteria and methodology as described in Section 3.2.3.3 (FPIE PRA) was also used to determine a components safety significance with respect to the Fire PRA.

3.2.5 Comparison of Seismic PRA Results to Other PRA Results for High Safety Significant Structures, Systems, and Components Each seismic failure event (fragility group) in the SPRA that exceeded the HSS thresholds was evaluated to determine if the same HSS determination would be made from either the FPIE PRA, FPRA or both. The HSS numerical criteria from Table 3-2 were applied to all PRAs used in this study. Table 3-5 provides the results of this comparison.

3.2.5.1 Explicit Modeling As described in earlier sections some components can be explicitly represented in the PRA by using basic events that represent either unreliability or unavailability of the SSC. For the purposes of this study, some of the seismic failure event identified as being HSS from the SPRA were explicitly modeled in either the Internal Events PRA, Fire PRA or both. These fragilities are shown in Table 3-3.

Table 3-3 Seismic Fragilities Addressed by Explicit Modeling Fragility Group Description OSP Offsite Power S- NRBY2 - Nearby Hydroelectric Plant (Offsite Power Source)

S-ACPA1- 120 VAC Bus 00Y03 S- DCB S10- 250 VDC Bus 30D11 S- DCBS2- 125 VDC Buses/MCCs 0(A-D)D13 S- DCBS4- DC Panel 20D24, 30D21 S- DCBT1 - DC Batteries 2(A-D)D01, 3(A-D)D01 SCRAM RPV Internals (Scram)

BOC Break Outside Containment SML Seismic Induced Medium LOCA S-PCI2 Primary Containment Isolation (Inboard and Outboard MSIVs) 3.2.5.2 Implicit Modeling As described in earlier sections some components can be implicitly represented in the PRA by using basic events such as super components or operator actions as examples. For the purposes of this study, some of the seismic failure events (fragility groups) identified as being HSS from the SPRA were implicitly modeled in either the FPIE PRA, the Fire PRA or both. The 3-7

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites methodology for choosing the implicit modeling for each of the seismic failure events of interest is summarized in Table 3-4.

Table 3-4 Seismic Fragilities Addressed by Implicit Modeling Seismic Description of Fragility Implicit Modeling Fragility Group This is a correlated relay group. Some of the relays within this group are explicitly modeled but some are not.

Correlated Relay Group However, the relays supported 4 kV busses are modeled S-CC014 14 (All 4KV Buses in the FPIE PRA and Fire PRA and are HSS. The failure of Unrecoverable) the 4 kV busses was used as a surrogate to bound the relay categorization.

Similar to S-CC014, this fragility is a correlated relay group.

Some of the relays within this fragility are expl icitly modeled Correlated Relay Group but some are not. However, the relays supported 4 kV S-CC023 23 (All 4KV Buses busses are modeled in the FPIE PRA and Fire PRA and Unrecoverable) are HSS. The failure of the 4 kV busses was used a surrogate to bound the relays categorization.

The fuel oil tanks are not specifically modeled in the FPIE or Fire PRA models. However, they support the EDGs which are HSS in both the FPIE and Fire PRA models and E1- E4 EDG Fuel Oil would be implicitly mapped to the failure of the EDGs.

S-DGTK2 Day Tank O(A-D)T40 Additionally, both the EDGs and EDG fuel oil tanks would be modeled in the same function during the categorization process, therefore since the EDGs are HSS in the FPIE PRA model, so would the fuel oil tanks.

Correlated Relay Group Failure of this group leads to the failure of the DIV 1 and S-CC127A 127 and 157 (EDG A DIV3 EDGs. For this reason, the relays were implicitly and C-Recoverable) mapped to the failure of their impacted EDG.

Relay Chatter Event Failure of this group leads to failure of the DIV 2 EDG. For 187 (EDG B-S-CC187 this reason, the relays were implicitly mapped to the failure Recoverable via of their impacted EDG.

operator action)

Relay Chatter Event Failure of this group leads to failure of the DIV 4 EDG. For 191 (EDG D-S-CC191 this reason, the relays were implicitly mapped to the failure recoverable via of their impacted EDG.

operator action)

The relays associated with this group are not explicitly Relay Chatter Event modeled; however, failure of the components lead to failure 211 (HPCI -

S-CC211 of the HPCI Pump. For that reason, the components are recoverable via considered HSS by implicitly mapping them to the failure of operator action) the HPCI Pump.

3-8

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-4 (continued)

Seismic Fragilities Addressed by Implicit Modeling Seismic Description of Fragility Implicit Modeling Fragility Group The relays associated with this group are not explicitly Relay Chatter Event modeled; however, failure of the components lead to failure S-CC229 229 (RCIC inboard of the RCIC Inboard Isolation Valve. For that reason, the isolation valve) components are considered HSS by implicitly mapping them to the failure of the RCIC Inboard Isolation Valve.

The relays associated with this group are not explicitly Relay Chatter Event modeled however, failure of the components lead to failure 230 (RCIC -

S-CC230 of the RCIC Pump. For that reason, the components are recoverable via considered HSS by implicitly mapping them to the failure of operator action) the RCIC Pump.

Failures of the condensate storage tanks are modeled in the FPIE and Fire PRAs however, the failure probability is so low that the events truncate out of the cutsets. The Condensate Storage tanks can also be implicitly represented by operator S-CNCT1 Tank (CST) 20T010 actions. The operator action to refill the CST was used to and 30T010 gain an insight into the importance of the CST as this action did not truncate out of the cutsets. This action was determined to be HSS.

Similar to the S-CNCT1, the SGIG tank is explicitly modeled in the FPIE PRA but is LSS due to the low probability of failure. The tank can also be implicitly represented by operator actions. The operator action to S-SSGTK1 SGIG Nitrogen Tank a lign the tank was used to gain an insight into the importance of the SGIG tank as this action did not trun cate out of the cutsets. The dependent operator actions were also used to determine the safety significance of the SGIG tank.

The panels are not modeled explicitly in the FPIE PRA models but the panels support numerous components Panel 20C003, which are modeled as basic events in the PRA model.

S-CEPA1 20C004C, 30C003, Many of the basic events modeling the supported 30C004C, 00C29(A-D) components are HSS. For this reason it can be determined that the panels associated with this fragility group are also HSS.

3.2.6 Analysis and Conclusions Examination of the Plant A SPRA, FPIE PRA and Fire PRA information and results in Table 3-5 shows that all SSCs or correlated fragility groups that are HSS in the SPRA are also HSS in the FPIE PRA or Fire PRA or both. This is shown graphically in Figure 3-5. There are 23 fragility groups in the SPRA that meet the F-V or RAW criteria for HSS. Of those 23 groups, 22 would also be identified as HSS in the FPIE PRA, 17 would be HSS in the FPRA, 12 would be HSS from implicit modeling, and five would be HSS from passive categorization considerations.

3-9

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Every SSC that is HSS due to seismic considerations would also be HSS for other considerations and there are no HSS insights uniquely due to seismic.

The Plant A HSS SPRA SSCs are bounded by the HSS SSCs in the FPIE PRA or Fire PRA or both. No exceptions or outliers were identified.

FPIE HSS 1,650 Seismic HSS 469*

.. SPRA HSS SSCs include 185 control rods and 185 hydraulic control units that are HSS Figure 3-5 High Safety Significant Structures, Systems, and Components for Plant A 3-10

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-5 Sensitivity Study Results for Plant A Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Correlation Seismic PRA Passive Cat.

Seismic Description of FPIE PRA Implicit Fire PRA System Fragility Fragility Failure Comments Review Group Group Component Component Mode of Modeling Description ID SSC Generic Fragility (for example, OSP Offsite Power ceramic Anchorage insulators in plant switchyard)

Correlated Relay Group Contact Device Relays in Bay S-CC014- 14 (All 4KV CRL SI- Functional 8, B Buses Overcurrent Emergency Unrecoverable)

Power Correlated Relay Group Relays in:

Contact Device S-CC023- 23 (All 4KV Bay 2, Bay4 Functional CRLs Buses, Bays Recoverable)

Generic Fragility (for Nearby example, S-NRBY2- Hydroelectric ceramic Anchorage Plant (OSP) insulators in Nearby Dam switchyard) 3-11

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3 5 (continued)

Sensitivity Study Results for Plant A Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Correlation Seismic PRA Passive Cat.

Seismic Description of FPIE PRA Implicit Fire PRA System Fragility Fragility Failure Comments Review Group Group Component Component Mode of Modeling Description ID SSC The fuel oil tanks are not specifically modeled in the FPIE and Fire PRA models.

However, they support the EDGs which are HSS in both E1-E4 EOG 0AT040 the FPIE and FPRA models.

Fuel Oil Day EOG Fuel Oil S-DGTK2- 0BT040 Anchorage Both the EDGs and EOG fuel Tank 0(A- Day Tanks 0CT040 oil tanks would be modeled in D)T40 the same function during the categorization process and therefore the EDGs being HSS in the PRA model would drive the fuel oil tanks HSS.

120VAC Bus Emergency S-ACPA1- 120 VAC Bus 00Y03 Anchorage 00Y03 Power Correlated 0-528-132-Relay Group AG12 Contact Device S-CC127A- 127 and 157 Functional CRLs 0-528-132-(EOG A and C-Recoverable) CG12 Relay Chatter Event 187 Contact Device 0-528-132-S-CC187- Functional (EOG 8- CRL BG12 Recoverable)

Relay Chatter Event 191 Contact Device 0-528-132-S-CC191- Functional (EOG D- CRL DG12 Recoverable) 3-12

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3 5 (continued)

Sensitivity Study Results for Plant A Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Correlation Seismic PRA Passive Cat.

Seismic Description of FPIE PRA Implicit Fire PRA System Fragility Fragility Failure Comments Review Group Group Component Component Mode of Modeling Description ID SSC DC Power 250VDC Bus 250VDC HPCI S-DCBS10- 30D11 Anchorage System 30D11 BUS 0AD013, 125 voe 125 voe 0BD013, S-DCBS2- Buses/MC Cs Functional Buses/MC Cs 0CD013, 0(A-D)D13 0DO013 DC Power Most DC buses are DC Batteries Systems 125 voe individually HSS and CCF of S-DCBT1- 2(A-D)D01, 3AD01 Anchorage Battery all are HSS in both FPIE and 3(A-D)D01 FPRA (EBS13ALLCWI0).

DC Panel 125 voe S-DCBS4- 20D24 Anchorage 20D24, 30D21 Panel Relay Chatter Event 211 Contact Device S-CC211- 2-23A-K036 Functional (HPCI - CRL recoverable)

Relay Chatter Event229 Safety (RCIC inboard Contact Device S-CC229- 2-13A-K012 Functional Injection isolation CRL valve - Unre-coverable)

Relay Chatter Event230 Contact Device S-CC230- 2-13A-K022 Functional (RCIC- CRL recoverable) 3-13

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3 5 (continued)

Sensitivity Study Results for Plant A Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Correlation Seismic PRA Passive Cat.

Seismic Description of FPIE PRA Implicit Fire PRA System Fragility Fragility Failure Comments Review Group Group Component Component Mode of Modeling Description ID SSC Reactor RPV Internals RPV core Protection SCRAM Anchorage (Scram) shroud leg System Condensate Onsite Storage Tank Condensate 20T010, HSS due to operator action to Water S-CNCT1- Anchorage 20T010, Storage Tanks 30T010 align to the CST Sources 30T010 RCS piping THE BOC Initiating Events outside are HSS but a review of the Break Outside containment BOC Anchorage components involved has Containment (for example, also been performed to Main Steam identify any HSS individually Lines)

Piping RCS piping inside Seismic containment Medium LOCA is HSS in the SML Induced (for example, Anchorage Internal Events Model Medium LOCA between 2" and 6" diameter)

SGIG Tank is not HSS Safety CAD Liquid Explicitly but it is HSS due to Grade SGIG Nitrogen S-SGTK1- Nitrogen 00T116 Anchorage implicit modeling in operator Instrument Tank Storage Tank actions (AHU--CADDXD2, Gas AHU--CADDXl3) 3-14

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3 5 (continued)

Sensitivity Study Results for Plant A Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Correlation Seismic PRA Passive Cat.

Seismic Description of FPIE PRA Implicit Fire PRA System Fragility Fragility Comments Review Failure Group Group Component Component Mode of Modeling Description ID SSC The Panels are not modeled explicitly in the PRA models but the panels Panel 20C003, 00C29A, support numerous 20C004C, MISC 00C29B, components which are S-CEPA1- 30C003, Panels Anchorage Panels 00C29C, modeled as basic events in 30C004C, 00C29D the PRA model. Many of 00C29(A-D) the basic events modeling the supported components are HSS.

AO-2-01-086A AO-2-01-0868 Primary AO-2-01-086C Containment Mapped to FPH--MSTDXl2.

Contain- Isolation Outboard AO-2-01-086D MSIVS Fail to Remain S-PCl2 Functional ment (Inboard and MSIVs AO-3-01-086A Open During Transient.

Outboard Also HSS due to %VMSL AO-3-01-0868 MSIVs)

AO-3-01-086C AO-3-01-086D 22 17 12 5 23 Seismic Fragility Totals 23 Groups classified as 0 HSS via overlapping 50.69 criteria 3-15

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3.3 Plant B Trial Categorization Evaluation This section documents the sensitivity performed using the Plant B SPRA.

3.3.1 Introduction Plant B is a two-unit Westinghouse PWR (three loop) site with a large, dry sub- atmospheric containments and approximately 1,000 MWe each. They entered commercial operation in 1978 (Unit 1) and 1980 (Unit 2). Water from an adjacent lake is used to cool the main condensers.

Emergency core cooling is accomplished by three High Head Safety Injection (HHSI) pumps and two Low Head Safety Injection (LHSI) pumps. The HHSI pumps also provide normal Charging and Reactor Coolant Pump (RCP) seal injection during non-accident conditions. There are two Emergency Diesel Generators (EDGs) that power the two emergency buses if offsite power is lost. There are four 120 VAC vital buses (two per emergency bus) powered by either the batteries/inverters (four total) or directly from the emergency buses through transformers.

Three Auxiliary Feedwater (AFW) pumps (two motor-driven and one turbine-driven) provide steam generator cooling if the main Feedwater pumps are unavailable. The ultimate heat sink is from the 22.5 million-gallon Service Water reservoir, where four pumps provide SW flow to both units via two headers. Two auxiliary SW pumps that take lake water suction are also available to provide SW to the station.

3.3.1.1 PRA Models The FPIE PRA and SPRA models contain logic for quantifying CDF and LERF for each unit.

For this sensitivity, the results are from the Unit 1 PRA models only. The results for Unit 2 would be similar given that both units are nearly identical.

The Plant B SPRA model was developed from the latest FPIE PRA. That is, seismic fragility groups that model seismic failure of the SSCs were added to the appropriate locations in the fault trees. The accident sequences that model the various seismic-induced initiating events (LOCAs, SBO, etc.) were developed from the FPIE PRA accident sequences. The SPRA has top gates (Ux-CDF-SEISMIC and Ux-LERF-SEISMIC) which are quantified using the EPRI PRAQuant code. The cutsets are then processed using ACUBE to obtain the final seismic CDF and LERF as well as the importance data.

The FPIE PRA underwent a full scope peer review in 2014. The FPIE model has been revised to address all F&Os that impact model logic. The remaining F&Os are for documentation improvements and are not expected to impact the results. These were reviewed as part of the development of the SPRA to verify no impact on the SPRA results.

The SPRA model used for this sensitivity was peer reviewed in July 2017. The SPRA model is in the process of being revised to address the F&Os. The results of this sensitivity are not expected to be impacted by these F&Os.

The following three upgrades have been incorporated into the FPIE and SPRA models. The first upgrade is credit for FLEX in the Station Blackout (SBO) sequences has been added to both the FPIE and SPRA models. The FLEX mitigating actions modeled are load shedding the batteries and aligning the FLEX 120VAC generators to power the vital AC buses and maintain instrumentation. Also, the FLEX mitigating action to align the FLEX RCS Injection Pump for 3-16

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites RCS makeup from the RCP seal leakage is modeled in the SBO sequences. This upgrade was peer reviewed in July 2017 as part of the SPRA peer review. The review team determined that the FLEX modeling was appropriate but identified that the uncertainties relating to Human Reliability Analysis of the FLEX actions and the failure data of the FLEX SSCs should be investigated further. Sensitivities will be included in the final SPRA submittal. The team also recommended improvements in the documentation of the FLEX modeling. The results of the SPRA are not expected to be impacted by these F&Os.

The second upgrade involves using a convolution approach to modeling recovery of offsite power in the SBO sequences. This is only applicable to the FPIE model since the SPRA SBO sequences do not credit offsite power recovery.

The third upgrade involves the replacement of the Reactor Coolant Pump (RCP) seals with the low leakage Flowserve N-9000 seals. The final RCP seal was replaced in March 2018.

Therefore, the SPRA credits the Flowserve RCP seal LCOA model (that is not the Westinghouse seal LOCA model). This is upgrade has not been peer reviewed at this time but will be scheduled in 2018. The Flowserve seal LOCA model used in the Plant B FPIE and SPRA model is essentially the same as the logic used in a nearly identical plant FPIE PRA model that had a focused peer review of the upgrade in 2016. Since the PRA models for both plants are developed and maintained by the utility PRA group using the same procedures and methods, the RCP seal LOCA models are nearly identical. The F&Os from the nearly identical plant focused scope peer review of the RCP seal LOCA model were reviewed and verified to not impact the results of the Plant B SPRA.

3.3.2 Seismic PRA High Safety Significant Evaluation This section contains a summary of the SPRA Model and identification of HSS SSCs from the SPRA.

3.3.2.1 Description of Seismic PRA Model The SPRA is integrated into the FPIE PRA by adding seismic failure gates under the appropriate portions of the logic model that model the other failures of the SSCs (for example, pump failing to start). Seismic failures of SSCs are modeled using fragility groups, which represent failure of groups of SSCs, typically both (multiple) trains if the SSCs are assumed to be correlated. Most of the SSCs are assumed to be correlated given similar design, location, and configuration. For example, both Low Head Safety Injection (LHSI) pumps, 1-SI-P-1A &1B, are assumed to be correlated because they are both located in the Safeguards building, are of similar design and are installed in the same configuration. Therefore, seismic failure of these pumps is modeled using fragility group SEIS-SI-P-1AB, which is placed in the logic model under the gates for both LHSI pumps.

The seismic hazard curve is divided into eight intervals and is modeled by eight seismic initiating basic events %G01 through %G08. Each fragility group is therefore modeled by eight seismic failure basic events representing the probability of failure for each of the eight seismic intervals of the seismic hazard curve. The seismic failure basic events in the LHSI pump fragility group are SEIS-SI-P-1AB-C-%G01 through SEIS-SI-P-1AB-C-%G08.

3-17

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites The SPRA model is quantified using EPRI PRAQuant to generate the cutsets, which are then processed with ACUBE [21] that uses the Binary Decision Diagram (BDD) to obtain a more accurate solution that reduces the overestimation that occurs when basic event probabilities are high. The model was quantified using truncation limits of 1.0E-09 and 1.0E-10 for SCDF and SLERF, respectively. ACUBE allows processing a subset of cutsets using the BDD since computer memory typically limits the number of cutsets that can be processed. The remaining cutsets are then processed by the factored-minimum cutset upper bound (F-MCUB) routine.

ACUBE combines these to obtain the final SCDF and SLERF as well as their importances. For Plant B, 2,000 cutsets were processed for the SCDF importances and 1,500 cutsets were processed for the SLERF importance.

ACUBE generates Fussell-Vesely (F-V) and Risk Achievement Worth (RAW) importance data for each basic event or fragility group in the cutsets. Both F-V and RAW are used to obtain the importance of the fragility groups. The same approach used by Plant A was used for Plant B in combining the importances of each of the eight seismic failure basic events to obtain the importance of the fragility group.

3.3.2.2 Identification of HSS SSCs from the SPRA Fragility groups are considered High Safety Significant (HSS) if the group F-V is greater than 0.005 or if the group RAW is greater than 2.0 for CDF or LERF. Thus, if a group has a SCDF (SLERF) F-V or RAW that meet these HSS thresholds, then the SSCs in the group are considered HSS. In the example of the LHSI pump fragility group, SEIS-SI-P-1AB, both 1-SI-P-1A and 1-SI-P-1B pumps would be considered HSS if the fragility group SCDF (SLERF) F-V or RAW meet the HSS threshold.

The SPRA also models non-seismic failures (for example, failure to start, run) of SSCs that can impact mitigating functions. Only two SSCs, the diesel-driven fire pump (1-FP-P-2) and the FLEX 120VAC generator (0-BDB-GEN-1A) have F-V importance greater than 0.005. The remaining basic events that model the non-seismic failures have F-Vs and RAWs that are less than the thresholds for HSS.

The results from the SCDF and SLERF quantification and importances show that 36 fragility groups and two non-seismic failure basic events are considered HSS. Table 3-7 lists these fragility groups and basic events. The SSCs that are modeled by these fragility groups are also listed in the table. There are over 200 SSCs within these fragility groups that are considered HSS for seismic risk.

3.3.3 Full Power Internal Events PRA High Safety Significant Evaluation In the FPIE model, failure of SSCs are modeled for the different failure modes, such as pumps, fans, compressors, etc. failing to start, failing to run, failure to load, and out of service for test or maintenance. Additional failure modes may be modeled depending on the component. Common cause failures of the components are also included in the FPIE to account for possible design, maintenance and latent defects that could be common between similar components within the trains.

3-18

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites These SSC failures are modeled as basic events in the FPIE model. There are over 2800 basic events in the Plant B unit 1 FPIE PRA that model over 1300 SSCs. The FPIE PRA is quantified using the EPRI PRAQuant software [22] to obtain the CDF and LERF cutsets. The truncations selected for these meet the PRA Standard for acceptable truncation. For CDF, a truncation of 1.0E-12 was used, while a truncation of 1.0E-13 was used for LERF. The importances are obtained from the cutsets directly (that is ACUBE is not used). A component is considered HSS if the sum of the CDF (LERF) F-Vs of the failure modes for the component is greater than 5.0E-03, or if any failure mode CDF (LERF) RAW is greater than 2.0. A common cause failure basic event is considered HSS if the CDF (LERF) RAW is greater than 20. Of the 1300 SSCs, approximately 380 are HSS. The 50.69 categorization for Plant B using the FPIE importances has not been completed at this time. Therefore, the importance data is taken from the latest PRA input to the Maintenance Rule risk ranking and the latest FPIE PRA quantification results.

3.3.4 Fire PRA High Safety Significant Evaluation Plant B does not have a Fire PRA at this time. So, the HSS comparison is only with the FPIE PRA results.

3.3.5 Comparison of Seismic PRA results to other PRA results for High Safety Significant Evaluation Structures, Systems, and Components Table 3-7 contains the SPRA fragility groups that are HSS along with the SSCs that make up those fragility groups. The table also shows whether the corresponding FPIE basic events are HSS. The mapping of the seismic fragility groups to the corresponding basic events in the FPIE generally fell into two groups. Many of the seismic fragility groups model SSCs that are explicitly modeled in the FPIE PRA. Other fragility groups model passive SSCs or SSCs that are not directly modeled in the FPIE but the SSC functions are explicitly modeled. The following sections provide more details of how the fragility groups are mapped to the basic events in the FPIE PRA.

3.3 .5.1 Explicitly Modeled SSCs Most of the SSCs modeled by the fragility groups are explicitly modeled in the FPIE PRA.

Fragility groups that model mechanical SSCs such as pumps, fans, EDGs, MOVs, and AOVs typically are modeled in the FPIE PRA. For example, the SEIS-SI-P-1AB fragility group models seismic failure of the Low Head Safety Injections pumps 1-SI-P-1A and 1B. The FPIE PRA has basic events that model failure to start, failure to run, and out of service for test and maintenance, which are modeled by basic events 1SI-PSB--FS-1A, 1SI-PSB--FR-1A, and 1SI-PSB--TM-1A, respectively for the A pump. The FPIE PRA also includes common cause failure of these pumps using basic events 1SI-PSB22FS-1A+B and 1SI-PSB22FR-1A+B for failure to start and run, respectively. Therefore, the mapping of the SSCs modeled in the seismic fragility groups for these types of SSCs is relatively straightforward.

3.3 .5.2 Implicitly Modeled SSCs Some of the seismic fragility groups model seismic failure of SSCs that are not explicitly modeled in the FPIE PRA. Table 3-6 contains details of how these fragility groups are mapped to corresponding basic events in the FPIE.

3-19

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-6 Plant B Passive or Implicitly Modeled SSCs Scope Description Building failures are not typically modeled in the FPIE PRA given their relatively low probability of random failure. The SPRA models building failures as failing the SSCs within the building. Therefore, in the comparison with the FPIE PRA, the seismic fragility groups that model building failures were mapped to basic events in the FPIE PRA that Buildings model failure of the SSCs within the building (typically the CCF of the SSCs). For example, seismic fragility group SEIS - BLDG-AFWPH models failure of the Auxiliary Feedwater Pumphouse. This fragility group is mapped to the CCF basic event 1FW- PSB33FR-ALL-AFW, which models common cause failure of the AFW pumps inside the pumphouse.

Failures of MCR panels are typically not modeled in the FPIE PRA because of their relatively low probability of random failure. The SPRA models failure of the panels as failing Operator actions that rely on the Electrical Panels such as panels for indications and control of mitigating functions. Therefore, Main Control Room the seismic failure of the MCR panels fragility group was mapped to (MCR) Panels, FLEX an HEP in the FPIE PRA.

distribution panels, Vital Bus panels For the FLEX distribution panels where the FLEX 120VAC generators are connected to power the vital buses, the seismic fragility group for the FLEX panels is mapped to the vital bus basic events in the FPIE PRA.

Containment penetrations except for containment isolation valves, are Containment penetrations typically not modeled in the FPIE given their relatively low probability such as electrical and of random failure. The SPRA models failure of the reactor containment mechanical penetrations, building, which includes electrical and mechanical penetrations, the fuel transfer tube, and hatches, and fuel transfer tube. Failure of these result in direct LERF containment hatches and therefore are mapped to the LERF-83 plant damage state in the FPIE, which models direct LERF caused by containment bypass.

The FPIE PRA does model some relays for impacts on the functions of actuation systems (for example, Safety Injection, Containment Depressurization, etc.). The SPRA models relay chatter which impacts specific SSC functions due to spurious actuations (for example, starting/stopping of pumps, opening/closing of valves). Therefore, the Relays seismic fragility groups that model relay chatter are mapped to the basic events of the corresponding SSC functions that are impacted in the FPIE PRA. The relays could also have been categorized in this sensitivity based on whether the cabinet the relays are located in are HSS.

Piping failure is modeled in the FPIE PRA as part of the internal flooding portion of the model as well as failure of the RCS piping resulting in the various size LOCAs. The SPRA models piping failures Piping of the RCS with seismic fragility groups for the various size LOCAs.

Therefore, these groups are mapped to the corresponding LOCA basic events in the FPIE PRA.

3-20

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3.3 .5.3 Correlation of SSCs and Common Cause Failures Nearly all of the seismic fragility groups in the SPRA model correlated failures of the SSCs in the group. That is, given the common design, location, installation, and orientation of the SSCs, it is expected that both trains SSCs will fail given the same ground motion during a seismic event. This is similar to the modeling of common cause failures (CCF) in the FPIE PRA, where for multiple SSCs that have the same design and are maintained using the same maintenance processes, there is a probability that both components (for example, pumps) in the trains could fail due to common cause. However, some SSCs have such low failure probabilities in the FPIE PRA that common cause failures are not typically modeled. Tanks, heat exchangers, and electrical SSCs such as switchgear and motor control centers, are some examples of SSCs that may not have common cause failures modeled. In this sensitivity, the fragility groups that model correlated failures but do not have CCF basic events modeled in the FPIE were flagged in Table 3-7 with a check mark in the Correlation Review column. The six fragility groups identified here are all electrical SSCs such as switchgear, breakers, and electrical panels.

3.3.6 Analysis and Conclusions As shown in Table 3-7, all SSCs modeled by the seismic fragility groups that are HSS in the SPRA are also HSS in the FPIE PRA. The 38 HSS seismic fragility groups in the SPRA, which model over 200 SSCs, are also HSS in the FPIE PRA. And the two non-seismic failure basic events that are HSS in the SPRA are also HSS in the FPIE PRA.

This sensitivity shows that all of the SSCs that are HSS in the SPRA are also HSS in the FPIE PRA.

3-21

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-7 Sensitivity Study Results for Plant B Correlation Review Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic PRA Seismic Description FPIE PRA Passive Cat.

Implicit Fire PRA System Fragility of Fragility Failure Comments Group Group Component Component Mode of Modeling Description ID SSC 1-BLD-BLD-RC-BLDG, 1- Containment is not modeled in the CE-EH-1, 1- FPIE PRA; but failure of the SEIS- Reactor 1-BLD-BLD-CE-PH-1, 1- Structural N/A containment building would result BLDG-RC Containment RC-BLDG FH-TB-1, 1- in failure of RCS piping, etc., which PE-EP*, 1- are considered HSS; PEN-PN*

1-CV-TV-SEIS-CV- Containment 150AfB/C/D 1-CV-TV-TV- Vacuum Functional N/A 150AfB/C/D 1-CV-SOV-150ABCD CIVs 150AfB/C/D Containment Integrity 1-RS Inside 1RSIA01-SEIS-RS- 1-RS RELAY Relay chatter - Not explicitly Recirc Spray P-1AB- 1RSIA01- Functional N/A modeled in the FPIE PRA; Chatter Pump 1-RS RLY RELAY fails the function of the RS pumps.

Relays 1RSIB01-RELAY 1-RS-3A-Outside 1RSOA01-SEIS-RS- 1-RS-3A- RELAY Relay chatter - Not explicitly Recirc Spray P-2AB- 1RSOA01- Functional N/A modeled in the FPIE PRA; Chatter Pump 1-RS-3A-RLYSS RELAY fails the function of the RS pumps.

Relays 1RSOB01-RELAY 3-22

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3 7 (continued)

Sensitivity Study Results for Plant B Correlation Review Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic PRA Passive Cat.

Seismic Description FPIE PRA Implicit Fire PRA System Fragility of Fragility Failure Comments Group Group Component Component Mode of Modeling Description ID SSC Failure of the Aux Bldg is not Auxiliary SEIS- modeled in the FPIE PRA; Failure Building 1-BLD-BLD- Shear Wall BLDG-AB- Building N/A of the lower floors of the Auxiliary Lower CT-BLDG Failure LOWER building is assumed to result in Floors direct core damage.

Component Failure of the CCW HXs results in SEIS-CC- Cooling 1-CC-E-1A failure of the SW piping to the HXs, 1-CC-E-1A Anchorage N/A E-1AB Heat 1-CC-E-1B which causes a flood in the Exchangers Auxiliary building.

Core Charging/

Cooling and SEIS-CH- 1-CH Various relays Relay chatter - Not explicitly High Head Inventory P-1ABC- 1CHCC09- in CH pump Functional N/A modeled in the FPIE PRA; Chatter SI Pump Control RLY RELAY circuits fails the function of the CH pumps.

Relays 1-SW-MOV-101A/B/C/D SW Supply 1-SW-MOV-SEIS-Header to 103A/B/C/D MOV- 1-SW-MOV-Recirc Spray Functional N/A QSPH- 101A/B/C/D 1-SW-MOV-HX lsol RSHX 104A/B/C/D Valves 1-SW-MOV-105A/B/C/D 3-23

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3 7 (continued)

Sensitivity Study Results for Plant B Correlation Review Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic PRA Passive Cat.

Seismic Description FPIE PRA Implicit Fire PRA System Fragility of Fragility Failure Comments Group Group Component Component Mode of Modeling Description ID SSC Refueling SEIS-QS- Water Tank 1-QS-TK-1 1-QS-TK-1 N/A TK-1 Storage Overturning Core Tank Cooling and 1-Sl Inventory Low Head SI 1SILA01-Control 1-Sl RELAY Relay chatter - Not explicitly SEIS-SI-P- Pump 1SILA01- Functional N/A modeled in the FPIE PRA; Chatter 1AB-RLY Lockout 1-Sl RELAY fails the function of the SI pumps.

Relays 1SILB01-RELAY 1-RC-FA*

1-RC-LRI* Failure of SEIS-RC- Control 1-RCS- Fuel Hold Criticality CNTRL- Rods/Rx 1-RC-URI* N/A CRDM-xxx Down RODS Internals 1-RCS- Spring CRDM-xxx Not a fragility group; This This SSC is included because it is is the Fire pump out a non-seismic failure that has a F-Secondary 1FP-DDP--

Diesel- of service for 1-FP-P-2 N/A N/A V greater than 0.005 in the SPRA.

Cooling TM-2 Driven Fire maintenance This basic event is also HSS in the Pump being FPIE PRA.

OOS for Maintenance 3-24

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3 7 (continued)

Sensitivity Study Results for Plant B Correlation Review Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic PRA Passive Cat.

Seismic Description FPIE PRA Implicit Fire PRA System Fragility of Fragility Failure Comments Group Group Component Component Mode of Modeling Description ID SSC 1-BLD-BLD- AFW pumphouse and AFW pipe Auxiliary SEIS- AF PH-BLDG tunnel are not modeled in the FPIE Feedwater 1-BLD-BLD-BLDG- Structural N/A PRA; but failure of the pumphouse (AFW) AF PH-BLDG 1-BLD-BLD-AFW or pipe tunnel would fail the AFW Pumphouse AFWT-BLDG pumps.

MSVH failure is not in the FPIE model; but failure of the MSVH SEIS-Main Steam 1-BLD-BLD- 1-BLD-BLD- would fail the SG PORVs, TDAFW BLDG- Structural N/A Valve House MSVH-BLDG MSVH-BLDG pumps steam supply, and direct MSVH LERF; These failures would be HSS in the FPIE PRA.

Emergency Secondary SEIS-CN- Condensate Cooling 1-CN-TK-1 1-CN-TK-1 Anchorage N/A TK-1 Storage Tank 1-FW-GOV-2 Turbine- 1-FW-P-2 SEIS-FW-DrivenAFW 1-FW-P-2 Functional N/A P-2 1-FW-TK-2 Pump 1-MS-TV-115 1-FW Motor- 1FWEA01- Relay chatter - Not explicitly SEIS-FW- DrivenAFW 1-FW RELAY modeled in the FPIE PRA; Chatter P-3AB- Pump 1FWEA01- Functional N/A 1-FW fails the function of the AFW RLY Lockout RELAY 1FWEA01- pumps.

Relays RELAY 3-25

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3 7 (continued)

Sensitivity Study Results for Plant B Correlation Review Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic PRA Seismic Description FPIE PRA Passive Cat.

Implicit Fire PRA System Fragility of Fragility Failure Comments Group Group Component Component Mode of Modeling Description ID SSC Medium (2"- Failure of medium size RCS piping SEIS- 1-BLD-PIPE- 1-BLD-PIPE-6") RCS Generic N/A is modeled in the FPIE PRA and is MLOCA RCS-MLOCA RCS-MLOCA RCS Piping HSS.

Integrity Failure of small size RCS piping is SEIS- Small (1 "-2") 1-BLD-PIPE- 1-BLD-PIPE-Generic N/A modeled in the FPIE PRA and is SLOCA RCS Piping RCS-SLOCA RCS-SLOCA HSS.

1-BLD-PIPE-RCS-Small-Small 1-BLD-PIPE- SSLOCA Failure of very small size RCS RCS SEIS-(>1") RCS RCS- Various CH, Generic N/A piping is modeled in the FPIE PRA Integrity SSLOCA Piping SSLOCA SI and SS and is HSS.

AOVson small lines Not a This SSC is included because it is FLEX 0BDBEDG- fragility a non-seismic failure that has a F-120VAC 0-BDB-GEN-

-FR-1A- group; FLEX N/A N/A V greater than 0.005 in the SPRA.

Generator 1A FLEX 120VAC This basic event is also HSS in the Fails to Run Generator FPIE PRA.

1-BDB-DB PANEL FLEX panels not modeled in the AC Power FLEX FPIE PRA; Mapped to vital bus SEIS-BDB- 1-BDB-DB 1-BDB-DB Seismic Distribution N/A basic event since the FLEX panels DB-123 PANEL PANEL Interaction Panels power the vital buses during a 1-BDB-DB SBO.

PANEL SEIS-EDG- EDG Relays 1-EG-3AX- Various relays Relay chatter - Not explicitly HJ-NR- - Non- 1EGSH10- in EDG Functional N/A modeled in the FPIE PRA; Chatter RLY Recoverable RELAY circuits fails the function of the EDGs.

3-26

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3 7 (continued)

Sensitivity Study Results for Plant B Correlation Review Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic PRA Passive Cat.

Seismic Description FPIE PRA Implicit Fire PRA System Fragility of Fragility Failure Comments Group Group Component Component Mode of Modeling Description ID SSC 1-EG Various relays Relay chatter - Not explicitly SEIS-EDG-EDG Relays 1EGSJ05-K2- in EDG Functional N/A modeled in the FPIE PRA; Chatter HJ-RLY RELAY circuits fails the function of the EDGs.

EDG Output Various relays Relay chatter - Not explicitly SEIS-EE- 1-EG Breaker in EDG output modeled in the FPIE PRA; Chatter BKR-HJ2- 1EGPH01- Functional N/A Lockout breaker fails the function of the EDG output RLY RELAY Relays circuits breakers.

480V Bus Various relays Relay chatter - Not explicitly SEIS-EE- Supply 1-EE in 480V bus modeled in the FPIE PRA; Chatter BKR-HJ8- Breaker 1EJSH01- supply Functional N/A fails the power to the 480V RLY Lockout RELAY breaker emergency buses.

Relays circuits EDG batteries are not explicitly 1-EG-B-01A Combined SEIS-EG- EDG modeled in FPIE, but would fail the 1-EG-B-03C Structural / N/A AC Power B-1234 Batteries 1-EG-B-03C EDG, which is HSS in the FPIE Function PRA.

EDG day tank SEIS-EG- EDG Fuel level P-HAB- Oil Transfer 1-EG-LS-1JA switches, fuel Functional N/A JAB Pumps oil transfer pumps 120VAC SEIS-EP- Vital Bus 1-EP-CB-04A 1-EP-CB-04A Anchorage N/A CB-4ABCD Distribution -04D Panels 1-EE-SS-480V 1H/1J SEIS-EP-Emergency 1-EE-SS-1 H Functional N/A SS-1H-1J 1-EE-ST-Buses 1H/1J 3-27

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3 7 (continued)

Sensitivity Study Results for Plant B Correlation Review Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic PRA Passive Cat.

Seismic Description FPIE PRA Implicit Fire PRA System Fragility of Fragility Failure Comments Group Group Component Component Mode of Modeling Description ID SSC 1-EE-SW-4160V 1H/1J Combined SEIS-EP-Emergency 1-EE-SW-1J Associated Structural / N/A SW-1H-1J Buses breakers in Function switchgear Seismic-Induced SEIS-Loss of LOOP LOOP Generic N/A AC Power LOOP Offsite Power 1-VB-INV 04 120VAC SEIS-VB- 1-EE-TRAN- Regulating Vital Bus Functional N/A INV-1234 Inverters 79A transformers Hand switches Station 1-BY-8-1-11 Structural SEIS-BY-DC Power Batteries 1- 1-BY-8-1-IV failure of N/A 8-1-24 1-BY-8-1-IV 11/1-IV rack SEIS-EP- DC 1-EP-CB-12A DC Power CB- Distribution 1-EP-CB-12A Functional N/A

-12D 12ABCD Panels 1-EI-CB 07 Loss of function of MCR panels are Control SEIS-EI- Main Control not modeled in FPIE PRA, but Room CB-MCR- Room 1-EI-CB-03 1-EI-CB-21 Functional N/A failure would impact HEPs, many Panels PNL Panels 1-EP-CB-B0C of which are HSS in the FPIE PRA.

&D 3-28

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3 7 (continued)

Sensitivity Study Results for Plant B Correlation Review Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic PRA Passive Cat.

Seismic Description FPIE PRA Implicit Fire PRA System Fragility of Fragility Failure Comments Group Group Component Component Mode of Modeling Description ID SSC SWVH is not modeled in the FPIE SEIS- Service PRA; but failure of the Valve house 1-BLD-BLD- 1-BLD-BLD-BLDG- Water Valve Structural N/A would result in failure of SW SWVH-BLDG SWVH-BLDG SWVH House system, which is HSS in the FPIE PRA.

Service Water 1-SW Service 1SWEA01-SEIS-SW- 1-SW RELAY Relay chatter - Not explicitly Water Pump P-1AB- 1SWEA01- Functional N/A modeled in the FPIE PRA; Chatter Lockout 1-SW RLY RELAY fails the function of the Sw pumps.

Relays 1SWEB01-RELAY 38 19 0 38 Seismic Fragility Totals 38 Groups classified as 0 HSS via overlapping 50.69 criteria 3-29

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3.4 Plant C Trial Categorization Evaluation This section documents the sensitivity performed using the Plant C SPRA.

3.4.1 Introduction 3.4.1.1 Plant Overview Plant C is a two-Unit Westinghouse PWR (four loop) site with each unit operating at 1150 MWe.

They entered commercial operation in 1987 (Unit 1) and 1989 (Unit 2). Emergency core cooling is accomplished via two centrifugal charging pumps, two safety injection pumps, and two residual heat removal pumps. There are two Emergency Diesel Generators (EDGs) that power the two emergency buses if offsite power is lost. There are four 120 VAC vital buses (two per emergency bus) powered by either the batteries/inverters or directly from the emergency buses through transformers. Three Auxiliary Feedwater (AFW) pumps (two motor-driven and one turbine-driven) provide steam generator cooling if the main Feedwater pumps are unavailable.

The ultimate heat sink is four mechanical draft cooling towers, where four pumps provide nuclear service cooling water (NSCW) to safety and auxiliary non-safety components. These NSCW pumps also remove the decay heat from the reactor when the plant is offline.

3.4.1.2 PRA Models The FPIE PRA, Fire PRA, and SPRA models contain logic for quantifying CDF and LERF for each unit. For this sensitivity, the results are from the Unit 1 PRA models only.

The SPRA model was developed by modifying the Full Power Internal Events (FPIE) PRA model to incorporate specific aspects of seismic analysis that are different from the FPIE. The logic model appropriately includes seismic-caused initiating events and other failures including seismic-induced SSC failures, non-seismic-induced unreliability and unavailability failure modes (based on the FPIE model), and human errors. The SPRA has top gates which are quantified using the EPRI FRANX software [23]. The cutsets are then processed using ACUBE [21] to obtain the final seismic CDF and LERF as well as the importance data.

The FPIE PRA underwent a full scope peer review in 2009. The FPIE model has been revised to resolve all F&Os received during the peer review. These were reviewed as part of the development of the SPRA to verify no impact on the SPRA results. The Fire PRA underwent a full scope peer review in 2012. The fire model has been revised to resolve all F&Os received during the peer review.

The SPRA model used for this sensitivity was peer reviewed in November 2014. The SPRA model has been revised to address the F&Os.

3-30

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3.4.2 Seismic PRA High Safety Significant Evaluation This section contains a summary of the SPRA Model and identification of HSS SSCs from the SPRA.

3.4.2.1 Description of Seismic PRA Model The Plant C SPRA model was developed by starting with the internal events at power PRA and adapting the model in accordance with guidance in the SPID [11] and PRA Standard [24],

including adding seismic fragility-related basic events to the appropriate portions of the internal events PRA, eliminating some parts of the internal events model that do not apply or that were screened-out, and adjusting the internal events PRA model human reliability analysis to account for response during and following a seismic event. The model is developed using the EPRI CAFTA software suite [25]. This model does not credit non-permanently installed FLEX equipment, but does include low leakage reactor coolant pump (RCP) seals. Both random and seismic-induced failures of modeled SSCs are included.

In the SPRA model, fully correlated components were assigned to correlated component groups so that all components in the group are modeled with the same basic event, such that if one fails, all fail at the seismic magnitude for each hazard bin. The model assumes fully correlated response of same or very similar equipment in the same structure, elevation, and orientation.

Correlated component groups were developed for all redundant components in the model that met these correlation criteria. For correlated groups where there was a significant difference in fragilities, then the higher capacity was used to assign a higher correlated fragility to both components, but the lower capacity component was also assigned a unique seismic capacity that only failed that component. Thus, the lower capacity component could fail by itself, but was guaranteed to fail if the higher capacity component was failed.

The seismic hazard was modeled using 14 discrete hazard intervals (or bins) based on increasing peak ground acceleration. Each bin is treated as a seismic initiator and the SCDF (and SLERF) results are summed over all the bins to obtain the total SCDF (and SLERF). Bin-specific SSC fragilities are used in the accident sequences for each bin.

For the SPRA, the following approach was used to quantify the seismic plant response model and determine seismic CDF and LERF. The EPRI FRANX software [23] was used to discretize the seismic hazard into the 14 seismic initiators, and quantify to produce cutsets and estimate the mean SCDF. The EPRI ACUBE [21] code was then used to calculate the exact probability on the entire set of SCDF/SLERF cutsets. This does not require the typical min cut upper bound approximation which can be excessively conservative when using high-probability events.

Additional details can be found in the following sections, along with descriptions of sensitivity studies, uncertainty estimations and a more complete description on the insights from top contributors to SCDF/SLERF.

The Plant C SPRA approach to determining the importance measures is to calculate the F-V and RAW measures for a component for each seismic acceleration interval, and then develop overall seismic importance values (for F-V and RAW) using the following weighted process to combine the importance values over all seismic acceleration intervals. For a component/basic event, the F-V and RAW are calculated by ACUBE 2.0 for each of the 14 seismic acceleration intervals, resulting in 14 F-V and RAW importance values by interval. The interval F-V values are 3-31

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites weighted based on the seismic acceleration interval CDF divided by the total seismic CDF, and summed together for each seismically failed fragility group to obtain the total F-V from the seismic failure. The RAW values are weighted and summed similarly to the F-V importance values. A similar process and weighting is used for LERF importance measures.

3.4.2.2 Identification of HSS SSCs from the SPRA Components are considered High Safety Significant (HSS) if the group F-V is greater than 0.005 or if the group RAW is greater than 2.0 for CDF or LERF. Therefore, if a group has a SCDF (SLERF) F-V or RAW that meet these HSS thresholds, then the SSCs in the group are considered HSS.

The SPRA also models non-seismic failures (for example, failure to start, run) of SSCs that can impact mitigating functions.

The results from the SCDF and SLERF quantification and importance show that 36 fragility groups and two non-seismic failure basic events are considered HSS. Table 3-9 lists these fragility groups and basic events. The SSCs that are modeled by these fragility groups are also listed in the table.

3.4.3 Full Power Internal Events PRA High Safety Significant Evaluation In the FPIE model, failure of SSCs are modeled for the different failure modes, such as pumps, fans, compressors, etc. failing to start, failing to run, failure to load, and out of service for test or maintenance. Additional failure modes may be modeled depending on the component. Common cause failures of the components are also included in the FPIE to account for possible design, maintenance and latent defects that could be common between similar components within the trains.

These SSC failures are modeled as basic events in the FPIE model. There are over 6000 basic events in the Unit 1 FPIE PRA that model over 1500 SSCs. The FPIE PRA is quantified using the EPRI PRAQuant software [22] to obtain the CDF and LERF cutsets. The truncations selected for these meet the PRA Standard for acceptable truncation. For CDF, a truncation of 1.0E-13 was used, while a truncation of 1.0E-15 was used for LERF. The importances are obtained from the cutsets directly (that is ACUBE is not used). A component is considered HSS if the sum of the CDF (LERF) F-Vs of the failure modes for the component is greater than 5.0E-03, or if any failure mode CDF (LERF) RAW is greater than 2.0.

3.4.4 Fire PRA High Safety Significant Evaluation The Fire PRA uses the FPIE model accident sequences. Fire scenarios were postulated and the equipment and cable failures were propagated through the appropriate accident sequences during the quantification process. The FRANX software [23] and the FTREX [26] quantification engine were used to quantify each fire scenario. FRANX software quantifies a CCDP or a conditional large, early release probability (CLERP) using the Minimal Cutset Upper Bound calculation. The CCDP or CLERP is combined with the product of the fire scenario ignition frequency, NSP and severity factor (SF) to calculate a CDF or LERF.

3-32

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites The FRANX function to create a one top model was used. The one top model was quantified using the EPRI PRAQUANT software and the FTREX quantification engine to obtain a single cutset file which is used for fire risk results, importance measures, and uncertainty evaluation.

The FRANX software interacts with EPRIs CAFTA software suite, which is utilized by the FPIE PRA model. FTREX is the quantification software used for Units 1 and 2 Fire PRA, consistent with the FPIE model. The truncation values for CDF and LERF were 1E-12 and 1E-12 respectively. Similar to internal events the component importances were evaluated using the methodology described in Section 3.2.3. The determination of HSS or LSS from the Fire PRA can be found in Table 3-1 of this report.

3.4.5 Comparison of Seismic PRA Results to Other PRA Results for High Safety Significant Structures, Systems, and Components Table 3-9 contains the SPRA fragility groups that are HSS along with the SSCs that make up those fragility groups. The table also shows whether the corresponding FPIE and Fire basic events are HSS. The mapping of the seismic fragility groups to the corresponding basic events in the FPIE and Fire generally fell into two groups. Many of the seismic fragility groups model SSCs that are explicitly modeled in the FPIE and Fire PRA. Whereas, other fragility groups model passive SSCs or SSCs that are not directly modeled in the FPIE but the SSC functions are explicitly modeled. The following sections provide more details of how the fragility groups are mapped to the basic events in the FPIE PRA.

3.4.5.1 Explicitly Modeled SSCs Most of the SSCs modeled by the fragility groups are explicitly modeled in the FPIE PRA and Fire PRA. Fragility groups that model mechanical SSCs such as pumps, fans, EDGs, MOVs, and AOVs typically are modeled in the FPIE PRA. So the mapping of the SSCs modeled in the seismic fragility groups for these types of SSCs is relatively straightforward.

3.4.5.2 Implicitly Modeled SSCs Some of the seismic fragility groups model seismic failure of SSCs that are not explicitly modeled in the FPIE PRA. Table 3-8 contains details of how these fragility groups are mapped to corresponding basic events in the FPIE.

3-33

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-8 Plant C Passive or Implicitly Modeled SSCs Scope Description Building failures are not typically modeled in the FPIE PRA given their relatively low probability of random failure. The SPRA models building failures as failing key SSCs within the building or as leading directly to core melt or large early release. Therefore, in the comparison with the FPIE PRA or Buildings Fire PRA, the seismic fragility groups that model building failures were mapped to basic events in the FPIE and Fire PRA that model failure of the SSCs within the building.

See Section 3.6.6 for additional discussion of categorization of Civil Structures.

The SPRA models relay chatter which impacts specific SSC functions due to spurious actuations (forexample, starting/stopping of pumps, opening/closing of valves).

Relays Therefore, the seismic fragility groups that model relay chatter are mapped to the basic events of the corresponding SSC functions that are impacted in the FPIE and Fire PRA.

Piping failure is modeled in the FPIE as part of the internal flooding portion of the model as well as failure of the RCS piping resulting in the various size LOCAs. The SPRA models Piping piping failures of the RCS with seismic fragility groups for the various size LOCAs. Therefore, these groups are mapped to the corresponding LOCA basic events in the FPIE PRA.

3.4.6 Analysis and Conclusions As shown in Table 3-9, most SSCs modeled by the seismic fragility groups that are HSS in the SPRA are also HSS in the FPIE and/or the Fire PRA. The 28 seismic fragility groups in the SPRA model over 63 SSCs, of which 23 are also HSS in the FPIE and/or Fire PRA. Eight have non-seismic failure mechanisms (marked as Random Failure in Table 3-9) that are HSS in the SPRA and are also HSS in the FPIE and/or the Fire PRA.

There are five seismic fragility groups that are HSS in the SPRA but not for the other considered risk categories (FPIE PRA, Fire PRA, Implicit Modeling, Passive Categorization). These five fragility groups represent correlated seismic failures or seismic induced internal flooding failures. These insights contributed to the creation of the approach described in Section 2.3.1 to account for the possibility of seismically correlated failures or seismic interaction related failures.

3-34

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-9 Sensitivity Study Results for Plant C Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Passive Seismic PRA Seismic Description C t FPIE PRA Implicit Fire PRA System Fragility of Fragility Failure Comments Group Group Component Component Mode of Correlation Modeling Description ID SSC Review S_1ACBS-120VAC 120 VAC Vital 1ACBSQ3Vl1 - Functional 120PN-Panel CB 180 Panel 1ACBSQ3Vl4 (After)

CB180 S_1ACIV- AC Inverter Vital AC 1ACIVY3IA1 - Functional 120-CB180 CB180 Inverter 11807Y3ID4 (After)

SFTY SF 1ACSDU3001 S_1ACSD- Functional SEQ Features Sequencer - (After)

Sequencer Board 1ACSDU3002 Battery 1AFPMP4002 S_1DCBC- Battery Functional CB180 Charger Charger

- (After)

CB180 1AFPMP4003 Emergency S_1DCBS-125 voe 125 voe Functional Power MCC 1AD1M 1AFPMP4001 MCC-AB MCC (After)

AC/DC and 1BD1M S_1DCBS- All 125VDC 125 voe RL1AFW1512 Functional MCC-ALL MCC MCC 9 (After)

S_1DCBS- 125 voe 1E 125 voe 1CCTKT4001 - Functional PN-CB180- Distr. Panel -

Distr. Panel 1CCTKT4002 (After) 1E CB180 S_1DCBS-125 voe 125 voe 1DCBCB3CM Functional SGR-CB180 Switchgear Switchgear - (After)

CB180 1DCBCB3CDB S_1DCBY-125 voe 125 voe 1DCBCS3DCA Functional CB180 Battery Battery

- (After)

CB180 1DCBCS3DCB 3-35

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-9 (continued)

Sensitivity Study Results for Plant C Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Passive Seismic PRA Seismic Description C t FPIE PRA Implicit Fire PRA System Fragility of Fragility Failure Comments Group Group Component Component Mode of Correlation Modeling Description ID SSC Review Incoming Random N/A 5 N/A5 1M02 FDR 1M0205 Failure BKR Incoming Random N/A5 N/A5 1BA03 FDR 1BA0301 Failure BKR 12s voe Emergency Random N/A5 N/A5 Battery 1DCBCS3DD1 Power Failure 10D18 AC/DC Reactor Trip Random N/A5 N/A5 Breaker 'A', 1RTA, 1RTB Failure Breaker 'B' Breaker to A Train NSCW 11ACDCS3AB Random N/A5 N/A5 Fan #1, #2, B Failure

1. 3,#4 5 This entry is not a Seismic Fragility Group. It is random failure of the SSC to function (i.e. start, run, or other PRA functional failure) 3-36

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-9 (continued)

Sensitivity Study Results for Plant C Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Passive Seismic PRA Seismic Description C t FPIE PRA Implicit Fire PRA System Fragility of Fragility Failure Comments Group Group Component Component Mode of Correlation Modeling Description ID SSC Review 1DCBSS3DCA S_1AFPM- BothAFW AFWMotor Functional MOP MOP Driven Pump

- (After) 1DCBSS3DCC 1DCBSQ3DA1 S_1AFPM- AFWTURB Functional TOP AFWTDP Driven Pump

- (After) 1DCBSQ3DO1 Auxiliary Relay for Relay for Feedwater 1DCBSS3DSA S_1AFW- AFWPump AFWPump Functional AOV-RLY Turb Trip & Turb Trip &

- (During) 1DCBSS3DSD Throttle VLV Throttle VLV AFW, TDAFW Random N/A5 N/A5 11302U4015 Pump, Disch, Failure Isolation Component 1DCBYB3BYA CCWSurge CCWSurge Correlated Failure drives the Cooling S_1CCTK-4 Tank Tank - Anchorage SSC to HSS Water 1DCBYB3BYA Diesel Diesel 1DGG4001 - Functional S_1DG Generator Generator 1DGG4002 (After)

DGAIR DG Vent 1DGDM12050 S_1DGDM- Supply Functional Emergency VENT Damper for Damper for - (After)

Diesel Fans 1-4 1DGDM12054 Fans Generator 1DGFNB7002 DG BLDG DG BLDG S_1DGFN- 000- Functional Correlated Failure drives the ESF Supply ESF Supply FAN 1DGFNB7004 (After) SSC to HSS Fan Fan 000 3-37

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-9 (continued)

Sensitivity Study Results for Plant C Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Passive Seismic PRA Seismic Description C t FPIE PRA Implicit Fire PRA System Fragility of Fragility Failure Comments Group Group Component Component Mode of Correlation Modeling Description ID SSC Review Anchorage Flooding causes LUHS drives Contain-S_1FC- Failure of CTBAUX 1ACUA700200 the SSC to HSS. Considered ment Heat Anchorage ACU-FLD ACU with Cooling Unit 0 as a flooding interaction in the Removal NSCWFLD Correlation Review.

Nuclear 1NSCWW4001 S_1SWFN- fan-NUC Service NSCWTower F01 -

NSCW- SERVCool Anchorage Cooling Fans 1NSCW4002F FANS Tower Water 04 Auxiliary Component ACCWSurge ACCWSurge Correlated Failure drives the S_1XCTK-4 1XCTKT4001 Anchorage Cooling Tank Tank SSC to HSS Water Seismic Correlated anchorage S_CB- Failure of CB 1CHLRC70010 Essential failure of two trains of ESF CHLR- ESF Chillers CB ESF 00-Chilled Anchorage Chillers leads to flooding NSCW- Cause NSCW Chiller 1CHLRC70020 Water such that LUHS drives the FLOOD Flood on CB 00 260 SSC to HSS Residual RCS to RHR Random Heat N/A 6 N/A6 Pump B 1HV8702A Failure Removal Suction MOV 1RCPOPV0 Pressurizer Pressurizer 1PORV0455,1 Random Pressurizer 455A-U, PORVs PORVs PORV456 Failure 456-U 6 This entry is not a Seismic Fragility Group. It is random failure of the SSC to function (i.e. start, run, or other PRA functional failure) 3-38

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-9 (continued)

Sensitivity Study Results for Plant C Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Passive Seismic PRA Seismic Description C t FPIE PRA Implicit Fire PRA System Fragility of Fragility Failure Comments Group Group Component Component Mode of Correlation Modeling Description ID SSC Review Containment, Auxiliary Building, Control HSS due to RAW criteria in Building, the SPRA.

Category 1 Emergency Structures Civil Diesel Structural See Section 3.6.6 for Structures Generator additional discussion of Building, AFW categorization of Civil Pump House, Structures.

Nuclear Safety Cooling Water Towers 17 17 1 0 23 Seismic Fragility Totals 29 Groups classified as 5 HSS via overlapping 50.69 criteria 3-39

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3.5 Plant D Trial Categorization Evaluation This section documents the sensitivity performed using the Plant D SPRA.

3.5.1 Introduction Plant D is a two unit, Westinghouse PWR (four loop) site with sub-atmospheric (ice condenser) containments with each unit operating at approximately 1,150 MWe. Emergency core cooling is accomplished for each unit by two High Head Safety Injection pumps, two Intermediate Head Safety Injection pumps and two Low Head Safety Injection pumps. The high head pumps also provide normal Charging and RCP seal injection during non-accident conditions. There are four Emergency Diesel Generators (EDGs) that power the emergency buses if offsite power is lost.

There are four 120 VAC vital buses for each unit powered by either the batteries/inverters or directly from the emergency buses through transformers. Three Auxiliary Feedwater (AFW) pumps (two motor-driven and one turbine-driven) provide steam generator cooling if the main Feedwater pumps are unavailable. The ultimate heat sink is from the river, where eight pumps provide service water flow to both units via two headers.

The plants FPIE PRA and SPRA models contain logic for quantifying CDF and LERF for each unit. For this sensitivity, the results are from the Unit 1 PRA models only. The results for Unit 2 would be similar given that both units are nearly identical. This plant does not have a fire PRA but instead utilized the Appendix R Safe Shutdown (SSD) list of SSCs to classify components as HSS.

3.5.2 Seismic PRA High Safety Significant Evaluation Seismic failures of SSCs are modeled using fragility groups, which represent failure of groups of SSCs, typically both (multiple) trains if the SSCs are assumed to be correlated. Most of the SSCs are assumed to be correlated given similar design, location, and configuration.

The seismic hazard curve is divided into eight intervals and is modeled by eight seismic initiating basic events %G01 through %G08. Each fragility group is therefore modeled by eight seismic failure basic events representing the probability of failure for each of the eight seismic intervals of the seismic hazard curve.

The SPRA model is quantified using EPRI FRANX [23] to generate the cutsets, which are then processed with ACUBE [21] that uses the Binary Decision Diagram (BDD) to obtain a more accurate solution that reduces the overestimation that occurs when basic event probabilities are high.

ACUBE generates Fussell-Vesely (F-V) and Risk Achievement Worth (RAW) importance data for each basic event in the cutsets. Both F-V and RAW are used to obtain the importance of the fragility groups.

Fragility groups are considered High Safety Significant (HSS) if the group F-V is greater than 0.005 or if the group RAW is greater than 2.0 for CDF or LERF. Thus, if a group has a SCDF (SLERF) F-V or RAW that meet these HSS thresholds, then the SSCs in the group are considered HSS. Table 3-11 lists these fragility groups and basic events. The SSCs that are modeled by these fragility groups are also listed in the table.

3-40

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3.5.3 Full Power Internal Events PRA High Safety Significant Evaluation In the FPIE model, failure of SSCs are modeled for the different failure modes, such as pumps, fans, compressors, etc. failing to start, failing to run, failure to load, and out of service for test or maintenance. Additional failure modes may be modeled depending on the component. Common cause failures of the components are also included in the FPIE to account for possible design, maintenance and latent defects that could be common between similar components within the trains.

The FPIE PRA is quantified using the EPRI PRAQuant [22] software to obtain the CDF and LERF cutsets. The importances are obtained from the cutsets directly (that is ACUBE is not used). A component is considered HSS if the CDF (LERF) F-V of the failure mode for the component is greater than 5.0E-03, or if the CDF (LERF) RAW is greater than 2.0. A common cause failure basic event is considered HSS if the CDF (LERF) RAW is greater than 20.

3.5.4 Fire PRA High Safety Significant Evaluation Plant D does not have a Fire PRA at this time. So, the HSS comparison is only with the FPIE PRA results.

3.5.5 Comparison of SPRA results to the FPIE PRA results for HSS SSCs The mapping of the seismic fragility groups to the corresponding basic events in the FPIE generally fell into two groups. Many of the seismic fragility groups model SSCs that are explicitly modeled in the FPIE PRA. Whereas, other fragility groups model passive SSCs or SSCs that are not directly modeled in the FPIE but the SSC functions are explicitly modeled. The following sections provide more details of how the fragility groups are mapped to the basic events in the FPIE PRA.

3.5.5 .1 Explicitly Modeled SSCs Most of the SSCs modeled by the fragility groups are explicitly modeled in the FPIE PRA.

Fragility groups that model mechanical SSCs such as pumps, fans, EDGs, MOVs, and AOVs typically are modeled in the FPIE PRA. Therefore, the mapping of the SSCs modeled in the seismic fragility groups for these types of SSCs is relatively straightforward.

3.5.5 .2 Implicitly Modeled SSCs Some of the seismic fragility groups model seismic failure of SSCs that are not explicitly modeled in the FPIE PRA. Table 3-10 contains details of how these fragility groups are mapped to corresponding basic events in the FPIE.

3-41

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-10 Plant D Passive or Implicitly Modeled SSCs Scope Description Failures of MCR panels are typically not modeled in the FPIE PRA because of their relatively low probability of random Electrical Panels such as failure. The SPRA models failure of the panels as failing Main Control Room Operator actions that rely on the panels for indications and (MCR) Panels control of mitigating functions. Therefore, the seismic failure of the MCR panels fragility group was mapped to an HEP in the FPIE PRA.

Containment penetrations except for containment isolation valves, are typically not modeled in the FPIE given their Containment penetrations relatively low probability of random failure. The SPRA model such as electrical and includes failure of the containment penetrations by modeling a mechanical penetrations, fragility group for containment penetrations, which includes fuel transfer tube, and electrical and mechanical penetrations, hatches, and the fuel containment hatches transfer tube. Failure of these SSCs are modeled to result in direct LERF due to containment bypass.

The FPIE PRA does model some relays for impacts on the functions of actuation systems (for example, Safety Injection, Containment Depressurization). The SPRA models relay chatter which impacts specific SSC functions due to spurious Relays actuations (for example, starting/stopping of pumps, opening/closing of valves). Therefore, the seismic fragility groups that model relay chatter are mapped to the basic events of the corresponding SSC functions that are impacted in the FPIE PRA.

Piping failure is modeled in the FPIE as part of the internal flooding portion of the model as well as failure of the RCS piping resulting in the various size LOCAs. The SPRA models Piping piping failures of the RCS with seismic fragility groups for the various size LOCAs. Therefore, these groups are mapped to the corresponding LOCA basic events in the FPIE PRA.

3.5.5.3 Seismic Fragi lity Groups and Common Cause Failure Nearly all of the seismic fragility groups in the SPRA model correlated failures of the SSCs they represent. That is, given the common design, location, installation, orientation, and function of the SSCs, it is expected that both trains SSCs will fail given the same ground motion during a seismic event. Therefore, the seismic fragility groups model common cause failure (CCF) of the SSCs during seismic events. In the mapping of the seismic fragility groups to the corresponding basic events in the FPIE PRA, the basic events that model failure of the individual SSC (that is not the CCF basic event) were selected if their F-V or RAW importances indicated they were HSS by themselves. However, if they were not HSS by themselves, then the fragility group was mapped to the CCF basic event.

3-42

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3.5.6 Analysis and Conclusions As shown in Table 3-11, half of the SSCs modeled by the seismic fragility groups that are HSS in the SPRA are also HSS in the FPIE and/or the Fire PRA. The results for Plant D include 21 individual breakers in low and medium voltage switchgear spread over two Seismic Fragility Groups (SEIS_0-24 and SEIS_0-25), which make up the majority of items not explicitly identified as HSS in the FPIE and/or the Fire PRA. There are also two exhaust fans that have seismically correlated failures and four traveling screens that have seismically correlated failures.

These insights contributed to the creation of the approach described in Section 2.3.1 to account for the possibility of seismically correlated failures or seismic interaction related failures.

Finally, the Plant D results identify four seismic fragility groups associated with FLEX that are HSS in the SPRA but not HSS in the FPIE or Fire PRAs. Section 3.6.4 describes FLEX considerations within the 50.69 categorization process.

3-43

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Correlation Seismic PRA Passive Cat.

Seismic FPIE PRA Implicit Description of Fire Risk System Fragility Comments Review Fragility Group Failure Group Component Component Mode of Modeling Description ID SSC Norm FDR Breaker Chatter, Low CNTL&AUX 1-BKR-212-SEIS_0-24 Chatter Voltage Switchgear Vent BD 1A1- A001/10B-A A

480V Breaker Chatter, Low Shutdown BD 1-BKR-212-SEIS_0-24 Chatter Voltage Switchgear 1A1A Nor A001/1B-A Feed Norm FDR Breaker Chatter, Low FORRXMOV 1-BKR-212-SEIS_0-24 Chatter Voltage Switchgear BD 1A1-A (1- A001/88-A MCC-213-A1)

Norm Supply Breaker Chatter, Low 1-BKR-212-AC SEIS_0-24 from 6.9KV Chatter Voltage Switchgear A002/1B-A Power SD BD 1A-A Norm FDR for Breaker Chatter, Low RXMOVBD 1-BKR-212-SEIS_0-24 Chatter Voltage Switchgear 1A1-A (1- A002/8B-A MCC-213-A1)

Norm FDR for Breaker Chatter, Low C&A Vent BD 1-BKR-212-SEIS_0-24 Chatter Voltage Switchgear 181 (1-MCC- 8001/108-B 215-81) 1-BKR-212-8001/18-8, Chatter Breaker Chatter, Low 1-BKR-212-SEIS_0-24 Norm Supply Chatter correlated Voltage Switchgear 8001/18-8 from 6.9KV failure SD BD 18-8 3-44

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Correlation Seismic PRA Passive Cat.

Seismic FPIE PRA Description of Implicit Fire Risk System Fragility Comments Review Fragility Group Failure Group Component Component Mode of Modeling Description ID SSC Norm FDR for Chatter Breaker Chatter, Low RXMOVBD 1-BKR-212-SEIS_0-24 Chatter correlated Voltage Switchgear 181-8(1- 8001/88-8 failure MCC-213-81) 1-BKR-212-8002/18-8, Chatter Breaker Chatter, Low 1-BKR-212-SEIS- 0-24 Norm Supply Chatter correlated Voltage Switchgear 8002/18-8 from 6.9KV failure SD BO 18-8 Norm FDR for Chatter Breaker Chatter, Low RXMOVBD 1-BKR-212-SEIS- 0-24 Chatter correlated Voltage Switchgear 182-8 (1- 8002/88-8 failure MCC-213-82)

AC Norm Supply Breaker Chatter, Low 2-BKR-212-Power SEIS_0-24 from 6.9KV Chatter Voltage Switchgear 8002/18-8 SD BO 28-8 Norm FDR Chatter Breaker Chatter, Low CNTL&AUX 2-BKR-212-SEIS- 0-24 Chatter correlated Voltage Switchgear Vent BO 2A1- A001/10B-A failure A

480V Chatter Breaker Chatter, Low Shutdown BO 2-BKR-212-SEIS 0-24 Chatter correlated

- Voltage Switchgear 2-A1A NOR A001/18-A failure FEED; Norm FDR for Chatter Breaker Chatter, Low RXMOVBD 2-BKR-212-SEIS 0-24 Chatter correlated

- Voltage Switchgear 2A1-A (2- A001/88-A failure MCC-213-A1) 3-45

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Correlation Seismic PRA Passive Cat.

Seismic FPIE PRA Description of Implicit Fire Risk System Fragility Comments Review Fragility Group Failure Group Component Component Mode of Modeling Description ID SSC Norm Supply Chatter Breaker Chatter, Low 2-BKR-212-SEIS 0-24 from 6.9KV Chatter correlated

- Voltage Switchgear SD BO 2A-A A002/1B-A failure Norm FDR for Chatter Breaker Chatter, Low RXMOVBD 2-BKR-212-SEIS- 0-24 Chatter correlated Voltage Switchgear 2A2-A (2- A002/8B-A failure MCC-213-A2)

Norm FDR for Chatter Breaker Chatter, Low C&A Vent BO 2-BKR-212-SEIS 0-24 Chatter correlated

- Voltage Switchgear 281-8 (2- 8001/108-B failure MCC-214-81)

Nor Supply Chatter Breaker Chatter, Low 2-BKR-212-AC SEIS- 0-24 from 6.9KV Chatter correlated Voltage Switchgear 8001/18-8 Power SD BO 28-8 failure Norm FDR for Chatter Breaker Chatter, Low RXMOVBD 2-BKR-212-SEIS- 0-24 Chatter correlated Voltage Switchgear 281-8 (2- 8001/88-8 failure MCC-213-81)

Norm FDR for Chatter Breaker Chatter, Low RXMOVBD 2-BKR-212-SEIS- 0-24 Chatter correlated Voltage Switchgear 282-8 (2- 8002/88-8 failure MCC-213-82)

Norm FDR for Breaker Chatter, Low VITBATT 0-BKR-236-SEIS_0-24 Chatter Voltage Switchgear CHGR Ill (0- 0003-A CHGR-236-3) 3-46

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Correlation Seismic PRA Passive Cat.

Seismic FPIE PRA Description of Implicit Fire Risk System Fragility Comments Review Fragility Group Failure Group Component Component Mode of Modeling Description ID SSC Norm FDR for VITAL Breaker Chatter, Low 0-BKR-236-SEIS_0-24 BATTCHGR IV Chatter Voltage Switchgear 0004A-B (0-CHGR-236-4)

Norm Supply Breaker Chatter, from 6.9KV 1-BKR-211-SEIS_0-25 medium voltage Chatter COMMON 1716/16-A switchgear SWGC Norm Supply Breaker Chatter, from 6.9KV 1-BKR-211-SEIS_0-25 medium voltage Chatter COMMON 1728/16-8 switchgear SWGD AC Power 1-BKR-212-Breaker Chatter, 8001-B, 480V Chatter 1-BKR-212-SEIS_0-25 medium voltage Shutdown Chatter correlated 8001-B switchgear XFMR 181 (1- failure OXF-212-81) 1-BKR-212-Breaker Chatter, 8002-B, 480V Chatter 1-BKR-212-SEIS_0-25 medium voltage Shutdown Chatter correlated 8002-B switchgear XFMR 182 (1- failure OXF-212-82) 1-BKR-211-Breaker Chatter, 6.9kV SDBD 1816/16-A, Chatter SEIS_0-25 medium voltage Breaker 1816, Chatter correlated switchgear 1828 1-BKR-211- failure 1828/16-8 3-47

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Correlation Seismic PRA Passive Cat.

Seismic FPIE PRA Description of Implicit Fire Risk System Fragility Comments Review Fragility Group Failure Group Component Component Mode of Modeling Description ID SSC ALT Supply 1-BKR-211-Breaker Chatter, 1934/1-8, Chatter from 6.9KV SEIS_0-25 medium voltage Chatter correlated Common SWG 1-BKR-211-switchgear failure C,D 1932/1-A 1-BKR-212-A001-A, 480V 1-BKR-212-Breaker Chatter, Shutdown A001-A, Chatter SEIS_0-25 medium voltage XFMR 1A1 (1- Chatter correlated switchgear OXF-212-A1), 1-BKR-212- failure 182 (1-OXF- A002-A 212-A2)

ALT Supply 2-BKR-211-Breaker Chatter, Chatter from 6.9KV 1938/1-8, 2-AC SEIS_0-25 medium voltage Chatter correlated Common SWG BKR-211-Power switchgear failure C,D 1936/1-A 6.9kV Supply to Breaker Chatter, Chatter Transformer 2-BKR-212-SEIS_0-25 medium voltage Chatter correlated 2A1A (2-BKR- A001/A switchgear failure 212-A1-A) 480VSHDN Trans 2A2-A 2-BKR-212-(2-OXF-212-A2- A002-A, Breaker Chatter, Chatter A), 281-8 2-BKR-212-SEIS_0-25 medium voltage Chatter correlated (2-OXF-212- 8001-B, switchgear failure 81-8), 282-8 2-BKR-212-(2-OXF-212- 8002-B 82-8) 3-48

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Correlation Seismic PRA Passive Cat.

Seismic FPIE PRA Description of Implicit Fire Risk System Fragility Comments Review Fragility Group Failure Group Component Component Mode of Modeling Description ID SSC 1-INV-235-0001-D, 1-INV-235-120V AC Vital 0002-E, SEIS_3-1 AUX 480V Inverter Inverter 1-1, 1-11, Anchorage 1-INV-235-1-111, 1-IV 0003-F, 1-INV-235-0004-G 2-INV-235-AC 0001-D, Power 2-INV-235-120V AC Vital 0002-E, SEIS_3-1 AUX 480V Inverter Inverter 2-1, 2-11, Anchorage 2-INV-235-2-111, 2-IV 0003-F, 2-INV-235-0004-G 6.9KV Normal 1-BKR-211-Supply Breaker 1716/16-A, N/A7 N/A7 Random for Shutdown 1-BKR-211-Board 1728/16-8 7 This entry is not a Seismic Fragility Group. It is random failure of the SSC to function (i.e. start, run, or other PRA functional failure) 3-49

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Correlation Seismic PRA Passive Cat.

Seismic FPIE PRA Description of Implicit Fire Risk System Fragility Comments Review Fragility Group Failure Group Component Component Mode of Modeling Description ID SSC 0-BAT-236-0001-D, 0-BAT-236-125VDC Vital DC 0002-E, SEIS_2-1 125VDC Vital Battery Battery I, 11, Functional Power 0-BAT-236-111, IV 0003-F, 0-BAT-236-0004-G 0-CHGR-236-0001-D, 125VVital 0-CHGR-236-DC 125V Vital Battery Battery 0002-E, SEIS_3-3 Functional Power Charger Charger I, 11, 0-CHGR-236-Ill, IV 0003-F, 0-CHGR-236-0004-G 3-50

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Correlation Seismic PRA Passive Cat.

Seismic FPIE PRA Description of Implicit Fire Risk System Fragility Comments Review Fragility Group Failure Group Component Component Mode of Modeling Description ID SSC EDGswould be treated as HSS in the 50.69 defense-1-GEN-082- in-depth EOG random 0001A-A, review.

N/A 8 N/A8 failure to start Random 1-GEN-082- See Section and/or run 00018-8 3.6.5 for additional discussion of Emergency defense-in-Diesel depth.

Generator 1-FAN-030-0447-A, 1-FAN-030-0449-8, Diesel 1-FAN-030-N/A8 N/A8 Generator Random 0451-A, Exhaust Fan 1-FAN-030-0453-8, 1-FAN-030-0459-A Component CCS Surge Tank CCS Surge 1-TANK-070-Cooling SEIS 19-10 Anchorage A Tank A 0001 Water 8 This entry is not a Seismic Fragility Group. It is random failure of the SSC to function (i.e. start, run, or other PRA functional failure) 3-51

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Correlation Seismic PRA Passive Cat.

Seismic FPIE PRA Description of Implicit Fire Risk System Fragility Comments Review Fragility Group Failure Group Component Component Mode of Modeling Description ID SSC Refueling Refueling Water 1-TANK-063-Onsite SEIS 19-14 Water Anchorage Storage Tank 0046 Water Storage Tank Sources SIS Boron SIS Boron 1-TANK-063-SEIS 19-9 Anchorage Injection Tank Injection Tank 0036 1-HTX-070-Component CCS Heat 0185, CCS Heat Cooling SEIS_20-1 Exchanger A, Anchorage Exchanger 1-HTX-070-Water B 0186 6900V STDN AC Relay 6.9 Logic Relay LOG REL 1-PNL-211-A-A, SEIS_S-1 Functional Panel Panel PNL 1A-A, 1-PNL-211-8-8 18-8 3-52

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Correlation Seismic PRA Passive Cat.

Seismic FPIE PRA Description of Implicit Fire Risk System Fragility Comments Review Fragility Group Failure Group Component Component Mode of Modeling Description ID SSC Aux 1-PMP-003-Aux Feedwater Feedwater 0118-A, SEIS_11-6 Anchorage Pump Pump 1A-A, 1-PMP-003-18-8 0128-B Seismic fails TDAFW both AC and Pump Room 1-FAN-030-DC Fans SEIS_17-4 AFW Exhaust Fan 125V DC Functional 0214 together EMERG EXH (correlated FAN seismic failure)

Seismic fails TDAFW Auxiliary both AC and Pump Room Feedwater 1-FAN-030-DC Fans SEIS_17-4 AFW Exhaust Fan 120V AC Functional 0217 together EMERG EXH (correlated FAN seismic failure)

AUXFW TURBINE TDAFWP Control FLOW 1-PNL-276-SEIS_S-17 Anchorage Panels (BECKMAN L381 DWG 797492)

Aux Aux Feedwater 1-PNL-276-SEIS_S-18 Feedwater Functional Controls L381A Control 3-53

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Correlation Seismic PRA Passive Cat.

Seismic FPIE PRA Description of Implicit Fire Risk System Fragility Comments Review Fragility Group Failure Group Component Component Mode of Modeling Description ID SSC 1-TWS-067-0434-A, ERCW 1-TWS-067- Internal Events Ranking Emergency Traveling 0445-8, was based on individual Raw ERCW Traveling SEIS_24-1 Screen 1A-A, Anchorage component, but Internal Cooling Screen 2-TWS-067-18-8, 2A-A, Events RAW for Common Water 0439-A, 28-8 cause of TWS is 23 2-TWS-067-0451-8 Main Control Room Generator& 1-PNL-278-SEIS 5-10 Functional Panel Aux Power M001 120VAC Main Control Room PREFERRED 1-PNL-278-SEIS_5-10 Functional Panel POWER M007 RACK UNIT 1 0-PNL-278-M026A-A, Main Control Room 0-PNL-278-SEIS_5-12 DSL Gen 1A- Functional Panel M026A A Main Cont MCR RM Panels 0-PNL-278-M0268-8, Main Control Room 0-PNL-278-SEIS_5-12 DSL GEN 18- Functional Panel M0268 8MAIN CONT RM 0-PNL-278-M026C-A, Main Control Room 0-PNL-278-SEIS_5-12 DSL GEN 2A- Functional Panel M026C AMAIN CONT RM 3-54

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Correlation Seismic PRA Passive Cat.

Seismic FPIE PRA Description of Implicit Fire Risk System Fragility Comments Review Fragility Group Failure Group Component Component Mode of Modeling Description ID SSC 0-PNL-278-M026D-8, Main Control Room 0-PNL-278-SEIS_S-12 DSL GEN 28- Functional Panel M026D 8MAIN CONT RM MCR Panels ERCWMAIN Main Control Room 0-PNL-278-SEIS_S-12 CNTL RN Functional Panel M027A PNL Main Control Room COMP COOL 0-PNL-278-SEIS_S-12 Functional Panel WATER PNL M0278 FLEX is modeled in Internal events for LOOP 6900V3MW 0-DG-360- but does not show up as SEIS_3MW FLEX Diesel 0003A, FLEX 3MWFLEXDGs Anchorage important. See Section FLEXDG Generator 3A, 0-DG-360- 3.6.4 for additional 38 00038 discussion of FLEX components.

3-55

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Correlation Seismic PRA Passive Cat.

Seismic FPIE PRA Description of Implicit Fire Risk System Fragility Comments Review Fragility Group Failure Group Component Component Mode of Modeling Description ID SSC FLEX is modeled in Internal events 480V for LOOP but FLEX/ESBO 0-DG-360- does not show SEIS_480 225 KVA 000A, up as 480V FLEX Gs Anchorage VFLEXDG DIESEL 0-DG-360- important. See GENERATO 0008 Section 3.6.4 R for additional discussion of FLEX components.

FLEX FLEX is modeled in Internal events for LOOP but O-PNL-360- 0-PNL-360- does not show SEIS_FLE 480VFLEX DG FP/A, 480V FP/A, up as Functional XBUS Buses FLEX Fuse 0-PNL-360- important. See Panel A, B FP/8 Section 3.6.4 for additional discussion of FLEX components.

3-56

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Correlation Seismic PRA Passive Cat.

Seismic FPIE PRA Description of Implicit Fire Risk System Fragility Comments Review Fragility Group Failure Group Component Component Mode of Modeling Description ID SSC FLEX is modeled in O-TANK-360- Internal events 0113, 360- 0-TANK-360- for. See SEIS_FLE 0213,6900V 0113, FLEX FLEX Fuel Tanks Anchorage Section 3.6.4 XTANK 3MWFLEX 0-TANK-360- for additional DG Fuel oil 0213 Storage Tank discussion of FLEX components.

Turbine Driven TDAFW 1-PMP-003-N/A 9 N/A9 Auxiliary Random Pump 0001A-S Feedwater Pump 9 This entry is not a Seismic Fragility Group. It is random failure of the SSC to function (i.e. start, run, or other PRA functional failure) 3-57

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Correlation Seismic PRA Passive Cat.

Seismic FPIE PRA Description of Implicit Fire Risk System Fragility Comments Review Fragility Group Failure Group Component Component Mode of Modeling Description ID SSC Containment penetrations would be treated as HSS in the 50.69 Seismically-induced defense-in-Contain-SEIS Failure of Containment depth review.

ment Various Structural CONPEN Containment penetrations Penetrations See Section Penetrations 3.6.5 for additional discussion of defense-in-depth.

31 4 0 1 35 Seismic Fragility Groups classified as Totals 64 HSS via overlapping 24 50.69 criteria, including 2 items addressed by defense-in-depth criteria 3-58

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3.6 Summary of Sensitivity Study Insights Sections 3.2 through 3.5 describe trial 50.69 categorization evaluations performed at four plants to determine how the seismic related categorization insights compare with categorization insights at the same plants using their FPIE PRAs and fire PRAs, if available. Overall conclusions are summarized in this section.

3.6.1 Limited Unique Seismic High Safety Significant Structures, Systems, and Components In all four trial studies, there were either no components or very few components identified as HSS in the SPRA that were not also HSS for another reason. Therefore, the seismic risk insights provided only limited unique insights into the 50.69 categorization process. And those unique insights were generally associated with SSCs that would be treated as seismically correlated failures in an SPRA. This suggests that the SSCs most important in responding to a seismic event are included within the set of SSCs necessary to respond to other events.

This result should not be interpreted to suggest that there are no SSCs that would be HSS from a seismic hazard. In each study, there were a significant number of HSS SSCs identified using the SPRAs. However, those same SSCs were also HSS for other reasons.

The trial studies indicate that the overall benefits, in terms of seismic risk insights in the 50.69 categorization process, do not warrant the cost of performing an SPRA.

3.6.2 Seismic Correlated Failures Some of the trial studies identified a limited number of seismic-related HSS SSCs due to the way seismically correlated failures are typically treated in SPRAs. For example, if two pumps performing the same function are located side by side in the plant, they are both assumed to fail with the same seismic fragility. These correlated failures can contribute unique seismic insights into the 50.69 categorization process.

In the case of passive items such as tanks, two similar tanks located side by side would generally also be assumed to fail with the same seismic fragility. This correlated failure is not identified by the 50.69 passive categorization process, which relies on the FPIE PRA, which does not model common cause failure of tanks.

The trial studies indicate that special considerations may be necessary for evaluating the potential of seismically correlated failures to influence the categorization process at sites where the correlated failures may be likely.

3.6.3 Relays Relays are important components in NPP seismic evaluations. Many FPIE PRAs do not explicitly include relays in their models and they are usually added to the model for an SPRA.

However, important relays such as those in the emergency power systems are critical to the success of the backup AC power function and therefore would be implicitly addressed by the FPIE PRA insights in the 50.69 categorization process. For example, all four trial evaluations identified parts of the emergency power system as HSS in the SPRA, the FPIE PRA and/or the Fire PRA. If the relays within those systems, or the electrical enclosures housing the relays, are 3-59

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites not explicitly modeled in the FPIE PRA, then their 50.69 categorization would be derived by identifying the importance of the system function and correlating those functions with the specific components. Section 5 of NEI 00-04 provides the following guidance.

Some systems and structures are implicitly modeled in the PRA. It is important that PRA personnel that are knowledgeable in the scope, level of detail, and assumptions of the plant-specific PRA make these determinations. As outlined in Section 1, by focusing on the significance of system functions and then correlating those functions to specific components that support the function, it is possible to address even implicitly modeled components.

Therefore, in the case of relays in the emergency power system, the relays would be implicitly modeled in the FPIE PRA and their function within the system would need to be evaluated to perform 50.69 categorization down to the component level.

3.6.4 FLEX Components As noted in Section 3.5, one of the sensitivity studies identified that some FLEX equipment exceeded the quantitative categorization thresholds within the SPRA but the FLEX equipment was not identified as HSS in the FPIE PRA model. With respect to 50.69 programs, inclusion of FLEX equipment in the PRA model can impact a 50.69 program in two ways; categorization results and application of alternate treatment.

With respect categorization results, inclusion of FLEX equipment in the PRA model (for example, FPIE PRA, seismic PRA) would act to, at worse, make some modeled non-FLEX equipment appear to be less safety significant as compared to the PRA results with the FLEX equipment not modeled. This is because the 50.69 categorization process uses relative risk metrics (that is RAW, F-V) and if the FLEX equipment is providing relative value (for example, reducing CDF), then the other modeled equipment (non-FLEX) would become less important.

That is, some previously categorized RISC-1 components could become RISC-3 components when the FLEX equipment is included in the PRA model. Thus, not including FLEX equipment in the PRA model for 50.69 categorization is at worst conservative from a RISC-3 assignment perspective.

From an alternative treatment perspective, for plants that chose to categorize FLEX equipment, these components will be categorized as either RISC-2 (non-safety related / safety significant) or RISC-4 (non-safety related / non- safety significant). The rule [1] requires that for RISC-2 components:

The licensee shall ensure that SSCs perform their functions consistent with the categorization process assumptions by evaluating treatment being applied to these SSCs to ensure that it supports the key assumptions in the categorization process that relate to their assumed performance.

3-60

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 10 CFR 50.69 was published in 2004. As such, while the rule requirement to ensure that the treatment of RISC-2 SSCs is consistent with the assumed performance in the PRA is a valid position, it does not reflect the maturing of PRAs over the ensuing years such as the need to reflect Regulatory Guide 1.200, Rev 2 and later revisions of the ASME / ANS PRA Standard [24]. Additionally, each 50.69 license amendment request contains a section on PRA Technical Adequacy which assures that the plant-specific PRA is adequate to support the 50.69 categorization effort, including a complete treatment of causes of system failures, reliability and unavailability of modeled SSCs. Thus, by meeting RG1.200 [17] and ASME/ANS Standard [24]

guidance, it is assured that the performance assumed in the PRA for FLEX equipment is consistent with plant practices.

Further, in response to post-Fukushima actions, licensees are required to demonstrate that FLEX equipment is stored, tested, maintained and procedures are in place so that the FLEX equipment can fulfill their stated missions.

3.6.5 Defense-in-Depth Assessment NEI 00-04 [2] Sections 6.1 (Core Damage Defense-in-Depth) and 6.2 (Containment Defense-in-Depth) provide guidance for incorporating considerations to assure that defense in depth is preserved when categorizing an SSC as low safety significant.

With respect to core damage, the assessment considers both the level of defense-in-depth in preventing core damage and the frequency of the events being mitigated. This ensures that adequate defense-in-depth is available to mitigate design basis events given their likelihood of occurrence, including consideration of diverse and redundant trains and systems in the overall categorization process.

With respect to containment, the assessment considers SSCs that play a role in preventing large, early releases, such as interfacing systems LOCA (BWR and PWR), steam generator tube leak (PWR), containment isolation failures (BWR and PWR), and early hydrogen burns (ice condenser and Mark III containments). Containment defense-in-depth is also assessed for SSCs that play a role in preventing large containment failures (for example, due to loss of containment heat removal).

3.6.6 Civil Structures NEI 00-04 [2] requires that both F-V and RAW importance measures be considered in 50.69 categorization. The RAW importance measure is calculated assuming the SSC (or basic event) is always failed. Although this is a useful importance measure for bounding discussions and for FPIE PRAs, in SPRAs RAW implies that the SSC has no seismic capacity and the RAW insights should be considered with some care when used in an SPRA.

When applied literally for Category 1 civil structures such as Reactor Buildings or Auxiliary Buildings that house critical systems and components, high RAW values can be expected because it implies that the structure is failed. The RAW metric can also be sensitive to cutset truncation depending upon the base probability of the basic event in question and the cutsets in which the basic event participates.

3-61

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites It is recognized that civil structures containing PRA credited equipment (for example, Reactor Building) are likely important to safety because their failure can fail the credited equipment functions. Therefore, if a licensee chooses to categorize structures under 50.69 using the guidance in this report, the recommended practice is to consider civil structures housing HSS SSCs to be HSS themselves, unless otherwise justified. Note that this does not imply that everything inside an HSS structure should then be considered HSS.

3-62

4

SUMMARY

AND CONCLUSIONS The NRCs 10 CFR 50.69 process [1] allows a plant to categorize the safety significance of its SSC using a robust categorization process defined in NEI 00-04 [2], as endorsed by NRC in Regulatory Guide 1.201 [3]. The risk-informed categorization process helps focus attention on SSCs that are the most important to plant safety while allowing increased operational flexibility for SSCs that are less important to plant safety.

One of the screening criteria evaluated in the categorization process specified in NEI 00-04 is seismic risks, which can be evaluated using an SPRA, or an SMA if an SPRA is not available, or screened out if the SCDF and SLERF are very small compared to the FPIE PRA CDF and LERF.

There are a number of plants that do not have an acceptable SPRA or SMA and cannot screen out of seismic considerations, therefore a need exists to consider alternatives for considering the insights of seismic risks in the 50.69 categorization process.

This report develops alternate approaches for plants to provide the necessary seismic risk insights within the 50.69 categorization process. Trial 50.69 categorization evaluations are performed at four plants with SPRAs and high GMRS compared to their SSEs to determine the seismic related categorization insights. Those insights are compared with categorization insights at the same plants using their FPIE PRAs and fire PRAs if available to determine the degree to which the seismic insights produce unique categorization insights.

The trial case results show that there were either no components or very few components identified as HSS in the SPRA that were not also HSS for another reason. Therefore, the seismic risk insights provided only limited unique insights into the 50.69 categorization process. And those unique insights were generally associated with SSCs that would be treated as seismically correlated failures in an SPRA.

These insights are used to develop a three-tiered graded approach for considering seismic risks in the 50.69 categorization process. The tiers are defined based on the degree to which the plant GMRS exceeds the plant SSE, which influences the likelihood that unique seismic-related HSS SSCs will be identified. The tiers and recommended seismic risk evaluation processes are described in Table 4-1.

For Tier 2 seismic hazard plants, a new seismic risk evaluation process is developed to use the FPIE PRA to determine the categorization insights appropriate for seismically correlated failures.

SSCs that would be treated as seismically correlated in an SPRA are identified through a series of reviews and seismic walkdowns, those SSCs are modeled with new common cause failure basic events in the FPIE PRA, and sensitivity studies are performed to determine if specific SSCs should be HSS.

4-1

Summary and Conclusions Table 4-1 Alternate Approach Seismic Tiers and Seismic Rick Evaluation Process Tier Tier Criteria Seismic Risk Evaluation Processes At Tier 1 sites the likelihood of identifyin g a I

unique seismic condition that would cause an Plants where the GMRS peak SSC to be designated HSS is very low.

acceleration is at or below Therefore, with little to no anticipated unique approximately 0.2g or where the seismic insights, the 50.69 categorization GMRS is below or approximately process using the FPIE PRA and other risk equal to the SSE between 1.0 Hz 1 evaluations along with the required Defense-in-and 10 Hz. At these sites, the Depth and Integrated Decision- making Panel GMRS is either very low or within (IDP) qualitative considerations are expected to the range of the SSE such that adequately identify the safety-significant unique seismic categorization functions and SSCs required for those functions insights are expected to be minimal.

and no additional seismic reviews are necessary for 50.69 categorization.

At Tier 2 sites, there may be a limited number of unique seismic insights, most likely attributed to the possibility of seismically correlated Plants where the GMRS to SSE failures, appropriate for consideration in comparison between 1.0 Hz and 10 determining HSS SSCs. The special seismic Hz is greater than in Tier 1 but not risk evaluation process recommended using a 2 high enough to be treated as Tier 3.

Common Cause impact approach in the FPIE At these sites, the unique seismic PRA can identify the appropriate seismic categorization insights are expected insights to be considered with the other to be limited.

categorization insights by the Integrated Decision-making Panel (IDP) for the final HSS determinations.

Plants where the GMRS to SSE At Tier 3 sites, the available methods in comparison between 1.0 Hz and 10 NEI 00-04 [2] can be used to provide seismic Hz is high enough that the NRC 3 inputs to the categorization process. These required the plant to perform an methods include the use of an SPRA or an SPRA to respond to the Fukushima SMA as described in NEI 00-04 Section 5.3.

50.54(f) letter [6].

4-2

5 REFERENCES

1. Nuclear Regulatory Commission, 10 CFR Part 50 Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors; Final Rule, Federal Register / Vol. 69, No. 224 / Monday, November 22, 2004

2. NEI 00-04, Rev 0, 10 CFR 50.69 SSC Categorization Guideline, July 2005.

3. NRC Regulatory Guide 1.201, Rev 1, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance

4. Generic Letter 87-02, Verification of Seismic Adequacy of Mechanical and Electrical Equipment in Operating Reactors, Unresolved Safety Issue (USI) A-46, U.S. Nuclear Regulatory Commission, Washington, DC, February 19, 1987.

5. Generic Letter 88-20, Supplement 4, "Individual Plant Examination of External Events (IPEEE) For Severe Accident Vulnerabilities - 10 CFR 50.54(f), (Generic Letter No. 88-20, Supplement 4)," U.S. Nuclear Regulatory Commission, Washington, DC, June 28, 1991.

6. NRC (E Leeds and M Johnson) Letter to All Power Reactor Licensees et al., Request for Information Pursuant to Title 10 of the Code of Federal Regulations 50.54(f) Regarding Recommendations 2.1, 2.3 and 9.3 of the Near-Term Task Force Review of Insights from the Fukushima Dai-Ichi Accident, March 12, 2012.

7. IEEE Recommended Practice for Seismic Qualification of Class I E Equipment for Nuclear Power Generating Stations. Institute of Electrical and Electronics Engineers. IEEE Standard 344-2004.

8. Generic Implementation Procedure (GIP) for Seismic Verification of Nuclear Plant Equipment, Seismic Qualification Group, Washington, DC: February 1992.

9. IPEEE Seismic Insights: Revision to EPRI Report TR-112932, EPRI, Palo Alto, CA: 2000.

1000895.

10. Seismic Walkdown Guidance: for Resolution of Fukushima Near-Term Task Force Recommendation 2.3: Seismic. EPRI, Palo Alto, CA: 2012. 1025286.

11. Seismic Evaluation Guidance: Screening, Prioritization and Implementation Details (SPID) for the Resolution of Fukushima Near-Term Task Force Recommendation 2.1: Seismic.

EPRI, Palo Alto, CA: 2013. 1025287

12. NEI 12-06, Rev 4, Diverse and Flexible Coping Strategies (FLEX) Implementation Guide, December 2016

13. SECY-16-0142, Draft Final RuleMitigation of Beyond-Design-Basis Events (RIN 3150-AJ49)., December 2016 5-1

References

14. U.S. NRC, Issuance of Order to Modify Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events, Order No.EA-12-049, ADAMS Number ML12054A735, Washington, D.C., March 12, 2012.

15. Fire-Induced Vulnerability Evaluation (FIVE), Rev 2. EPRI, Palo Alto, CA: 2014.

3002000830

16. Risk-Informed Engineering Programs (10 CFR 50.69) Implementation Guidance (DRAFT),

NEI 16-09, Rev 0 (2017)

17. NRC Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, March 2009.

18. Seismic Probabilistic Risk Assessment Implementation Guide. EPRI, Palo Alto, CA: 2013.

3002000709.

19. A Methodology for Assessment of Nuclear Plant Seismic Margin, Revision 1. EPRI, Palo Alto, CA: 1991. NP-6041-SL

20. Risk & Reliability Interface (R&R Interface) Version 2.0. EPRI, Palo Alto, CA: 2015.

3002005279

21. Advanced Cutset Upper Bound Estimator(TM) (ACUBE), Version 2.0. EPRI, Palo Alto, CA:

2014. 3002003169

22. PRAQUANT 5.2. EPRI, Palo Alto, CA: 2015. 3002002796

23. FRANX Version 4.4. EPRI, Palo Alto, CA: 2017. 3002010659

24. Addenda to ASME/ANS RA-S-2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME/ANS RA Sb 2013, ASME, New York (2013).

25. Computer Aided Fault Tree Analysis System, (CAFTA), Version 6.0b. EPRI, Palo Alto, CA:

2014. 3002004316

26. Fault Tree Reliability Evaluation eXpert (FTREX) Version 1.8. EPRI, Palo Alto, CA: 2015.

3002005280

27. NUREG/CR-2015, Vol.8, Seismic Safety Margins Research Program; Systems Analysis (Project VII), Lawrence Livermore National Laboratory, Livermore, California, 1981.

28. NUREG/CR-4840, Procedures for the External Event Core Damage Frequency Analyses for NUREG-1150, SAND88-3102, Sandia National Laboratories, Albuquerque, New Mexico, 1990.

29. NUREG/CR-7237, Correlation of Seismic Performance in Similar SSCs (Structures, Systems, and Components), Published December 2017.

30. Correlation of Earthquake Failures in Selected Categories of Equipment for Application to Seismic Probabilistic Risk Assessments. EPRI, Palo Alto, CA: 2017. 3002010663.

31. Seismic Probabilistic Risk Assessment Implementation Guide. EPRI, Palo Alto, CA: 2003.

1002989

32. SQUG Walkdown Screening and Seismic Evaluation Training Course, Revision 4.6. EPRI, Palo Alto, CA: 2016.

5-2

References

33. NEI (K. Keithline) Letter to NRC (D. Skeen), White Paper Supporting Seismic Evaluation Guidance, Criterion for Capacity-Based Selection of Structures, Systems and Components for Fragility Analyses in a Seismic Risk-based Evaluation, Project Code 689, November 28, 2012

34. Seismic Fragility Applications Guide Update. EPRI, Palo Alto, CA: 2009. 1019200.

35. Seismic Fragility Application Guide. EPRI, Palo Alto, CA: 2002. 1002988

36. Methodology for Developing Seismic Fragilities. EPRI, Palo Alto, CA: 1994. TR-103959

37. High Frequency Program: Application Guidance for Functional Confirmation and Fragility Evaluation. EPRI, Palo Alto, CA: 2015. 3002004396

38. ASCE 7-16, Minimum Design Loads and Associated Criteria for Buildings and Other Structures, 2016.

39. NUREG-1742, Perspectives Gained from the Individual Plant Examination of External Events (IPEEE) Program, Final Report, Volumes 1 and 2, US NRC, April 2002

40. NRC (W. Dean) Letter to All Power Reactor Licensees et. al., Final Determination of Licensee Seismic Probabilistic Risk Assessments Under the Request for Information Pursuant to Title 10 of the Code of Federal Regulations 50.54(F) Regarding Recommendation 2.1 "Seismic" of the Near-Term Task Force Review of Insights from the Fukushima Dal-Ichi Accident, October 27, 2015 (ML15194A015)

41. NRC (M. Franovich) Letter to Duke Energy (E. Kapapoulous, Catawba Nuclear Station, Units 1 and 2, and McGuire Nuclear Station, Units 1 and 2, Screening and Prioritization Results Regarding Seismic Hazard Reevaluations for Recommendation 2.1 of the Near-Term Task Force Review of Insights from the Fukushima Dal-Ichi Accident, December 22, 2016 (ML16344A313) 5-3

A IDENTIFYING SEISMIC CORRELATED OR SEISMIC INTERACTION SCENARIOS FOR CONSIDERATION IN 50.69 CATEGORIZATION Seismic Probabilistic Risk Assessments (SPRAs) have been conducted for a large number of nuclear power plants worldwide in the last 35 years. The methodology has progressed during that period of time and is currently well established with several technical references documenting the methodology. Seismic PRA is different from a full power internal events (FPIE) PRA in two important ways: (a) all possible levels of earthquakes along with their frequencies of occurrence and consequential damage to plant systems and components should be considered, and (b) earthquakes can simultaneously damage multiple redundant components due to the common cause effect of the earthquake. This common cause effect has traditionally been referred to as seismic correlation in the SPRA technical literature. A separate but related potential common cause effect from earthquakes consists of a phenomenon referred to as seismic systems interactions. Seismic systems interaction consists of the failure, displacement or action (for example, spraying from failed piping, impacts from failing block walls) of a structure, system or component (SSC) that negatively affects the credited function of other SSCs in the SPRA.

One of the key seismic insights from the trial studies documented in Section 3 of this report is the importance of considering seismic correlation effects on the 50.69 HSS categorization of plant SSCs. The correlation of SSCs that exists in a seismic event is not typically captured in the FPIE PRA or the fire PRA. As a result, for 50.69 categorization purposes, the Tier 2 plants meeting the criteria in Section 2.3 should include these seismic correlation and interaction insights when performing system categorization. Figure 2.4 provides an overview of the process for the seismic correlated failure assessment and Section 2.3.1 provides the details of that seismic correlation assessment. The purpose of this appendix is to provide an approach to identify the SSCs considered to be seismically correlated (Item 5a in Figure 2.4) and to identify seismic interaction scenarios (Item 5b in Figure 2.4) which could affect the 50.69 categorization.

A.1 Background on Seismic Correlation Considerations in SPRAs The first attempt to programmatically treat the dependencies between seismic responses and between seismic capacities of components was in the seismic risk methodology developed for the Seismic Safety Margins Research Program (SSMRP) at the Lawrence Livermore National Laboratory [27]. The local responses of different components located at different elevations in various buildings were represented by a joint lognormal distribution; similarly, the seismic capacities of these components were also represented by a joint lognormal distribution. This SSMRP methodology consisted of a detailed set of calculations to develop partial correlation coefficients for each of the structures, systems and components (SSCs) in the plant logic model.

Because the application of this methodology was both computationally intensive and data intensive, it was not used in subsequent SPRAs.

A-1

Identifying Seismic Correlated or Seismic Interaction Scenarios for Consideration in 50.69 Categorization Using the results of the SSMRP methodology to perform two SPRAs as trial applications (for Zion and LaSalle), a Sandia Laboratory study [28] developed simplified rules for assigning the response correlation coefficient, thus bypassing the case-by-case SSC partial correlation computations. These simplified rules are provided in Table A-1.

Table A-1 Correlation Guidance from Sandia National Laboratory Study Rule # Correlation Guidance Components on the same floor slab and sensitive to the same spectral frequency 1

range (that is, ZPA, 5-10 Hz. or 10- 15 Hz) will be assigned response correlation = 1.0.

Components on the same floor slab sensitive to different ranges of spectral 2

acceleration will be assigned response correlation = 0.5.

Components on different floor slabs (but in the same building) and sensitive to the 3 same spectral frequency range (ZPA, 5-10 Hz or 10- 15 Hz) will be assigned response correlation = 0.75.

Components on the ground surface (outside tanks, etc.) shall be treated as if they 4

were on the grade floor of an adjacent building "G anged" valve configurations (either parallel or series) will have response 5

correlation = 1.0.

. 6 All other configurations will have response correlation equal to zero.

Recent reports by the NRC [29] and EPRI [30] propose methods to address seismic correlation.

Neither correlation methodology has been piloted to date and will need to be evaluated in order to understand the costs, benefits and limitations of the recommended approaches.

While the studies summarized above proposed a partial correlation characterization, the state of the practice in SPRAs consists of a binary (zero or one) correlation factor. Debate among the SPRA practitioners as to the accuracy, the cost/benefit and the lack of pilot applications of the partial correlation approaches has led to the use of this more simplified binary approach for most SPRAs conducted to date. However, the research associated with these partial correlation studies have laid the foundation for the decisions made in the simplified binary approach and serve to guide the decisions in SPRAs practiced today. For the 50.69 categorization program, the current state of practice (binary approach) for the treatment of correlation is applied.

A.2 Approach Figure 2-3 outlines the approach for identifying unique HSS components for Tier 2 plants. Step 5 of the process consists of a seismic walkdown focused on identifying those SSCs in the system being categorized that would either be (1) evaluated to be seismically correlated in the event of an earthquake or (2) evaluated to be subject to common cause seismic interactions. Confirmatory seismic walkdowns integrated with plant documentation reviews (that is general arrangement drawings and previous seismic walkdown documentation) are the basis for identifying correlations and seismic interactions within Step 5 of the recommended 50.69 categorization process.

A-2

Identifying Seismic Correlated or Seismic Interaction Scenarios for Consideration in 50.69 Categorization Seismic walkdown methods have been documented in past SPRA and SMA methodology reports, including [19], [18] and [31]. In addition, EPRI offers a training course [32] that focuses on the seismic walkdown and also provides additional information on the identification and assessment of seismic interactions. The methods and qualifications for these seismic walkdowns and seismic interaction reviews are well documented in these references and will not be repeated within this report.

The seismic fragility of an SSC can be broken down into two fundamental elements: the seismic capacity is a measure of the strength of the SSC and the seismic demand is a measure of the accelerations/displacements induced by the earthquake at the SSC location. The binary method for the identification of correlated/uncorrelated SSCs in an SPRA is to assign either 100%

correlation or 0% correlation for the fragilities associated with each set of SSCs being addressed.

Since many SSCs could be judged to have some degree of correlation in either the seismic capacity or the seismic response, the ultimate binary correlation decision is typically a judgment of engineers experienced in both seismic capacity and seismic response fields.

The following guidance from references [18] and [31] summarize the seismic correlation process and judgments made in most SPRAs and are the recommended guidance for identifying seismically correlated conditions for moderate seismic hazard plants as described in Section 2.3.1.

1. Review available documentation (general arrangement drawings, previous seismic walkdown documentation, etc.) in advance of the walkdown to support the correlation assessments.

2. Perform a confirmatory walk down of the system being categorized to confirm the characteristics described below.

3. Similar SSCs subject to similar seismic response are assumed to be perfectly correlated (factor = 1.0) and should be included in the Section 2.3.1 evaluation. This includes the following conditions.

a. Similar equipment on the same floor of a structure are typically judged to be fully correlated.

b. Similar equipment on adjacent floors of a structure (resulting in similar demand) are also typically considered to be correlated [29, 30] if the equipment have similar failure modes and fundamental frequencies. As summarized in [18], the Diablo Canyon Long Term Seismic Program performed a more detailed review of seismic correlations and concluded that a high degree of correlation existed between items of similar natural frequencies located on different floors in the same structure.

c. Similar equipment in different but similarly constructed buildings on the same basemat are also judged to be correlated based on the assumption of similar seismic demand.

4. SSCs with different types of failure modes are treated as uncorrelated (correlation factor = 0) and do not need to be included in the Section 2.3.1 evaluation.

A-3

Identifying Seismic Correlated or Seismic Interaction Scenarios for Consideration in 50.69 Categorization

5. Similar SSCs but with significantly different seismic demands are treated as uncorrelated (correlation factor = 0) and do not need to be included in the Section 2.3.1 evaluation.

Examples include:

a. Similar SSCs with similar failure modes but located in different structures, and

b. Similar SSCs with similar governing failure modes located in the same structure, but with significantly different seismic responses.

These correlation guidelines are provided to assist in the identification of SSCs judged to be seismically correlated. Additional guidance is provided in [18] and [31] to support the decisions made on the walkdown. Following completion of the walkdown, the list of correlated SSCs identified should be placed into Step 6 from Figure 2-3.

The second part of the 50.69 categorization walkdown includes the evaluation for seismic interactions which could cause correlated failures within the system being categorized. Potential seismic interactions should be evaluated during the system walkdown to assess whether any credible interactions could result in correlated failures of equipment within the system being categorized. As mentioned above, the approaches for evaluating seismic interactions are well documented in technical references and will not be repeated in this appendix. For purposes of describing the process recommended in this appendix, it is informative to define terminology associated with seismic interaction assessments:

• Interaction Source - the source is a structure, system or component (SSC) that causes the seismic interaction. The sources of seismic interactions can be based on falling items, deflecting items or flood initiators. So an example of a typical seismic interaction source would be an unreinforced block wall or a failed water storage tank that floods an area.

• Interaction Target - the target is the SSC that is being evaluated and is required to maintain its safety function or pressure boundary as part of the seismic risk assessment being conducted. For purposes of this 50.69 correlation evaluation, the equipment in the system being categorized will generally be considered as the targets.

The process for assessing the potential for correlated seismic interactions during the walkdown should consist of the following steps:

1. Review available documentation (general arrangement drawings, previous seismic walkdown documentation, etc.) in advance of the walkdown to support the seismic interaction assessments

2. Perform a confirmatory walk down of the system being categorized to confirm the characteristics described below.

3. Determine if any credible seismic interactions exist in the vicinity of the SSCs being categorized. The walkdown team should screen out those seismic interaction sources not deemed credible based on their experience and training. The walkdown team should also screen out credible sources that would not be expected to damage/fail the target equipment in the system being categorized.

4. Those seismic interaction sources that are not screened out during the walkdown) should be assessed using the methods documented in Appendix B to determine if they may be screened out as high capacity seismic interaction sources.

A-4

Identifying Seismic Correlated or Seismic Interaction Scenarios for Consideration in 50.69 Categorization

5. The remaining seismic interactions that could represent a common cause event (affecting more than a single SSC in the system being categorized) should be added to the list of correlated SSCs identified and evaluated per the Step 6 diamond from Figure 2-3.

Past SPRAs have identified several SSC categories [29] that have been frequently classified as being correlated and, at the same time, their correlation or dependency made a difference to baseline seismic CDF or to the safety insights.

Typical Interaction Sources Typical Interaction Targets

• Masonry walls

• Batteries and racks

• Non-safety related

• Electrical cabinets: motor control centers and structures housing safety switchgear related equipment

• Small tanks: diesel generator fuel oil day tanks

• Large tanks: condensate

• Heat exchangers: such as component cooling water storage tanks or other heat exchangers similar tanks (flooding source)

• Mechanical equipment: long shafted service-water pumps, horizontal auxiliary feed water pumps This list is not intended to be a limiting set for this assessment, instead it serves as operating experience from past SPRAs to be used in the walkdown and correlation assessment to ensure these items are given the appropriate focus.

A-5

B CRITERIA FOR CAPACITY-BASED SCREENING FOR HIGH CAPACITY SSCS Seismic risk insights from past SPRA and SMA studies have shown that high seismic capacity SSCs from the SPRA Seismic Equipment List (SEL) do not typically contribute to the seismic risk. Similarly, those seismic interaction scenarios (for example, block walls, falling objects, and displacements which cause impact with nearby elements) which can be demonstrated to have high seismic capacities, have also not resulted in significant risk contribution in past seismic studies. Therefore, these high seismic capacity SSCs and interactions are unlikely to be categorized as HSS and can be screened out from the 50.69 seismic categorization process. This high seismic capacity screening fits into Step 5c of the flow chart in Figure 2-3. The process for screening individual SSCs documented in EPRI 1025287 [11] (the SPID) will form the backbone for this screening approach. Following this approach, SSCs with a HCLPF capacity greater than the calculated screening level HCLPF could be categorized as low safety significant (LSS).

B.1 Approach As part of the effort to develop the SPID [11], seismic capacity-based criteria were developed to determine which SSCs should have component specific calculated fragility values to ensure that proper focus was given to those SSCs with the potential to be risk-significant. These criteria were developed using a parametric/sensitivity study [33] which provided the basis for the SPID recommendations. SSCs with capacities above the calculated screening level are not expected to have significant impact on the result of the SPRA analyses, the ranking of accident sequences, or the calculated sequence- or plant-level seismic CDF or LERF values. As such, SSCs with capacities above that screening level would also not be expected to be high safety significant (HSS) components within the 50.69 categorization process.

Section 6.4.3 of the SPID [11] identifies the approach to develop a screening HCLPF value for these higher capacity fragilities. Following the SPID approach, a screening HCLPF value is calculated by convolving the fragility of a single element with the site-specific hazard curve such that the SCDF is at most about 5E-7 per year. This can be done with trial and error runs using a quantification code or with a spreadsheet with an assumed composite variability (for example, c= 0.4) as described in [11]. This 5E-7 screening criteria was developed for the higher g

seismic hazard plants where seismic typically has a corresponding higher resulting risk. For a medium to low seismic hazard site this screening level of 5E-7 could potentially be unconservative, therefore an SCDF value of approximately 1/2 of the SPID value, or 2.5E-7 is judged to be more appropriate for purposes of this 50.69 categorization screening assessment.

Other appropriately justified site-specific screening values may be used.

To apply his approach, a seismic fragility must be developed for each SSC that is being assessed as part of the categorization process and compared to screening level developed as described above. The fragility methodology is well established and there are numerous references in the B-1

Criteria for Capacity-Based Screening for High Capacity SSCs literature describing the methods. Four EPRI reports that collectively capture the fragility process are listed in Table B-1.

Table B-1 Seismic Fragility References Topic Title Reference Seismic Fragility Applications Guide EPRI Report 1019200 Update (2009) [34]

Seismic Seismic Fragility Application Guide EPRI 1002988 (2002) [35]

Fragility Methodology for Developing Seismic Guidance EPRI TR- 103959 ( 1994) [36]

Fragilities A Methodology for Assessment of EPRI NP 6041 -SL (1991 )[19]

Nuclear Plant Seismic Margin For nuclear plants without existing SPRAs, one challenge will be to produce in-structure seismic responses for use in these fragilities. Development of finite element models and generation of new seismic response analyses using the current seismic hazard shape at the plant site is one option, however, more simplified and conservative approaches could be used when justified by experienced engineers within the structural dynamics field. These approaches include:

• Scaling of existing plant seismic response analyses where the shapes of the uniform hazard response spectra (UHRS) are similar [35, 19]

• Estimation of high frequency seismic response using an approach in EPRI 3002004396 [37]

which describes a process to estimate seismic responses for hard rock sites that have ground response spectral peaks in the high frequency part of the response spectrum In addition, it may also be possible for fragility analysts to conservatively estimate seismic demands using simplified approaches documented in ASCE 7 [38] for justifying additional SSCs that would have HCLPF capacities above the screening threshold. Assessments made would have to be necessarily conservative (biased towards higher in-structure response spectra (ISRS))

and account for potential variability of ISRS results based on the use of these approximate methods.

B.2 Justification While the SPID capacity-based screening approach is intended as a tool to be used for seismic risk assessments to focus fragility resources on risk-significant SSCs, the concept can be extended to 50.69 categorization. The capacity-based screening approach from the SPID is purposely conservative and is based on a single element leading directly to core damage. In addition, the recommended approach in this Appendix conservatively reduces the SPID target SCDF of 5E-7 by 50%, resulting in a more conservative SCDF value of 2.5E-7. If it is possible to demonstrate a component has a HCLPF above the calculated screening threshold, that component is not expected to be risk-significant in an SPRA. So even in the absence of a formal risk assessment, it is possible to identify certain SSCs with high seismic capacity that would not be expected to be risk-significant.

B-2

Criteria for Capacity-Based Screening for High Capacity SSCs B.3 Conclusion Use of the capacity-based screening approach based on a similar approach documented in the SPID is an acceptable method to screen SSCs into the LSS category for 50.69 categorization.

When SSCs are determined to have HCLPFs greater than this screening level HCLPF, it can be concluded that they would not be risk significant in an SPRA; therefore, those SSCs can be classified as LSS rather than HSS.

B-3

The Electric Power Research Institute, Inc.

(EPRI, www.epri.com) conducts research and development relating to the generation, delivery and use of electricity for the benefit of the public. An independent, nonprofit organization, EPRI brings together its scientists and engineers as well as experts from academia and industry to help address challenges in electricity, including reliability, efficiency, affordability, health, safety and the environment. EPRI also provides technology, policy and economic analyses to drive long-range research and development planning, and supports research in emerging technologies. EPRI members represent 90% of the electricity generated and delivered in the United States with international participation extending to nearly 40 countries.

EPRIs principal offices and laboratories are located in Palo Alto, Calif.; Charlotte, N.C.; Knoxville, Tenn.;

Dallas, Texas; Lenox, Mass.; and Washington, D.C.

TogetherShaping the Future of Electricity

© 2020 Electric Power Research Institute (EPRI), Inc. All rights reserved.

Electric Power Research Institute, EPRI, and TOGETHER. .. SHAPING THE FUTURE OF ELECTRICITY are registered service marks of the Electric Power Research Institute, Inc.

3002017583 Electric Power Research Institute 3420 Hillview Avenue, Palo Alto, California 94304-1338

• PO Box 10412, Palo Alto, California 94303-0813

• USA 800.313.3774

• 650.855.2121

• askepri@epri. com

• www.epri.com