L-MT-16-001, 54005-CALC-001, Revision 2, Evaluation of Risk Significance of Permanent ILRT Extension

54005-CALC-001, Revision 2, Evaluation of Risk Significance of Permanent ILRT Extension

ML16047A273
Person / Time
Site:	Monticello
Issue date:	02/08/2016
From:	Mary Johnson, Sattler J, Wright K Jensen Hughes
To:	Office of Nuclear Reactor Regulation
Shared Package
ML16047A336	List: L-MT-16-001, 54005-CALC-001, Revision 2, Evaluation of Risk Significance of Permanent ILRT Extension ML16047A272
References
L-MT-16-001 54005-CALC-001, Rev. 2
Download: ML16047A273 (142)

Text

JENSEN HUGHES 0

Advancing the Science of Safety Monticello Nuclear Generating Station:

Evaluation of Risk Significance of Permanent ILRT Extension 54005-CALC-O01 Prepared for:

Monticello Nuclear Generating Station Project Number: 1RCA54005 Project

Title:

Permanent ILRT Extension Revision: 2 Name and Date Preaer.ustn Satle..I."ILL ,i~alysge by Justin Sattler Prepaer: usti Setlerj , te: 2016.02.05 12:04:27-06O00

• 7 ~ L~1~e: 2016.02.05 12:o5:4-o6'0o, Review Method Design Review [] Alternate Calculation D]

Appovd b: athewJons n . _________Diiia,,y signed by Matt ohnson Aprvdb:

ateUohsn */ *: b'aid>*

2016.02.08 11:42:06-06'00'

/ .... fj Revision 2 Page 1 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension REVISION RECORD

SUMMARY

Revision Revision Summary 0 Initial issue with client comments incorporated 1 Updated Sections 5.3.4 and 7.0 based on client comments 2 Added references 41-58 and added references to Appendix A Page 2 of 142 Revision 22 Revision Page 2 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension TABLE OF CONTENTS 1.0 PURPOSE........................................................................................ 4 2.0 SCOPE ........................................................................................... 4

3.0 REFERENCES

.................................................................................. 6 4.0 ASSUMPTIONS AND LIMITATIONS ........................................................ 9 5.0 METHODOLOGY and analysis .............................................................. 10 5.1 Inputs .......................................................................................... 10 5.1.1 General Resources Available ......................................................... 10 5.1.2 Plant Specific Inputs .................................................................. 13 5.1.3 Impact of Extension on Detection of Component Failures that Lead to Leakage (Small and Large).................................................................... 14 5.2 Analysis ..................................................................................... 15 5.2.1 Step 1 - Quantify the Baseline Risk in Terms of Frequency per Reactor Year....16 5.2.2 Step 2 - Develop Plant-Specific Person-Remn Dose (Population Dose)............ 19 5.2.3 Step 3 - Evaluate Risk Impact of Extending Type ATest Interval from 10 to 15 Years ................................................................................. 22 5.2.4 Step 4 - Determine the Change in Risk in Terms of LERF ......................... 23 5.2.5 Step 5 - Determine the Impact on the Conditional Containment Failure Probability

...................................................................................... 24 5.2.6 Impact of Extension on Detection of Steel Liner Corrosion that Leads to Leakage

...................................................................................... 25 5.3 Sensitivities ................................................................................. 27 5.3.1 Potential Impact from External Events Contribution................................. 27 5.3.2 Potential Impact from Steel Liner Corrosion Likelihood ............................. 29 5.3.3 Expert Elicitation Sensitivity........................................................... 30 5.3.4 Containment Accident Pressure Sensitivity.......................................... 32 5.3.5 Power Supply Coordination Sensitivity............................................... 34 6.0 RESULTS ....................................................................................... 35

7.0 CONCLUSION

S AND RECOMMENDATIONS............................................. 36 A. Appendix A: PRA Technical Adequacy ..................................................... 38 Revision 2 Page 3 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 1.0 PURPOSE The purpose of this analysis is to provide a risk assessment of permanently extending the currently allowed containment Type A Integrated Leak Rate Test (ILRT) interval to fifteen years.

The extension would allow for substantial cost savings as the ILRT could be deferred for additional scheduled refueling outages for the Monticello Nuclear Generating Plant (MNGP).

The risk assessment follows the guidelines from NEI 94-01, Revision 3-A [Reference 1], the methodology used in EPRI TR-104285 [Reference 2], the NEI "Interim Guidance for Performing Risk Impact Assessments in Support of One-Time Extensions for Containment Integrated Leakage Rate Test Surveillance Intervals" from November 2001 [Reference 3], the NRC regulatory guidance on the use of Probabilistic Risk Assessment (PRA) as stated in Regulatory Guide 1.200 as applied to ILRT interval extensions, risk insights in support of a request for a plant's licensing basis as outlined in Regulatory Guide (RG) 1.174 [Reference 4], the methodology used for Calvert Cliffs to estimate the likelihood and risk implications of corrosion-induced leakage of steel liners going undetected during the extended test interval [Reference 5],

and the methodology used in EPRI 1018243, Revision 2-A of EPRI 1009325 [Reference 24].

2.0 SCOPE Revisions to 10CFR50, Appendix J (Option B) allow individual plants to extend the Integrated Leak Rate Test (ILRT) Type A surveillance testing frequency requirement from three in ten years to at least once in ten years. The revised Type A frequency is based on an acceptable performance history defined as two consecutive periodic Type A tests at least 24 months apart in which the calculated performance leakage rate was less than limiting containment leakage rate of 1ILa.

The basis for the current 10-year test interval is provided in Section 11.0 of NEI 94-01, Revision 0, and established in 1995 during development of the performance-based Option B to Appendix J. Section 11.0 of NEI 94-01 states that NUREG-1493, "Performance-Based Containment Leak Test Program," September 1995 [Reference 6], provides the technical basis to support rulemaking to revise leakage rate testing requirements contained in Option B to Appendix J. The basis consisted of qualitative and quantitative assessment of the risk impact (in terms of increased public dose) associated with a range of extended leakage rate test intervals. To supplement the NRC's rulemaking basis, NEI undertook a similar study. The results of that study are documented in Electric Power Research Institute (EPRI) Research Project TR-104285, "Risk Impact Assessment of Revised Containment Leak Rate Testing Intervals."

The NRC report on performance-based leak testing, NUREG-1493, analyzed the effects of containment leakage on the health and safety of the public and the benefits realized from the containment leak rate testing. In that analysis, it was determined that for a representative BWR plant (i.e., Peach Bottom), that increasing the containment leak rate from the nominal 0.5% per day to 5 percent per day leads to a barely perceptible increase in total population exposure, and increasing the leak rate to 50% per day increases the total population exposure by less than 1%. Because ILRTs represent substantial resource expenditures, it is desirable to show that extending the ILRT interval will not lead to a substantial increase in risk from containment isolation failures to support a reduction in the test frequency for MNGP.

NEI 94-01 Revision 2-A contains a Safety Evaluation Report that supports using EPRI Report No.

1009325 Revision 2-A, "Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals," for performing risk impact assessments in support of ILRT extensions [Reference 24].

The Guidance provided in Appendix H of EPRI Report No. 1009325 Revision 2-A builds on the EPRI Risk Assessment methodology, EPRI TR-104285. This methodology is followed to determine the appropriate risk information for use in evaluating the impact of the proposed ILRT changes.

Revision 2 Page 4 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension It should be noted that containment leak-tight integrity is also verified through periodic in-service inspections conducted in accordance with the requirements of the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code Section Xl. More specifically, Subsection IWE provides the rules and requirements for in-service inspection of Class MC pressure-retaining components and their integral attachments, and of metallic shell and penetration liners of Class CC pressure-retaining components and their integral attachments in light-water cooled plants. Furthermore, NRC regulations 10 CFR 50.55a(b)(2)(ix)(E) require licensees to conduct visual inspections of the accessible areas of the interior of the containment. The associated change to NEI 94-01 will require that visual examinations be conducted during at least three other outages, and in the outage during which the ILRT is being conducted. These requirements will not be changed as a result of the extended ILRT interval. In addition, Appendix J, Type B local leak tests performed to verify the leak-tight integrity of containment penetration bellows, airlocks, seals, and gaskets are also not affected by the change to the Type A test frequency.

The acceptance guidelines in RG 1.174 are used to assess the acceptability of this permanent extension of the Type A test interval beyond that established during the Option B rulemaking of Appendix J. RG 1.174 defines very small changes in the risk-acceptance guidelines as increases in Core Damage Frequency (CDF) less than 10-6 per reactor year and increases in Large Early Release Frequency (LERF) less than 10-7 per reactor year. Since containment accident pressure is credited in support of ECCS performance to mitigate design basis accidents at MNGP, the ILRT extension may impact CDF. A detailed sensitivity study is performed and described in Section 5.3.4; this shows the ILRT extension has only a very small effect on CDF. Therefore, the more relevant risk-impact metric is LERF. RG 1.174 also defines small changes in LERF as below 10-6 per reactor year. RG 1.174 discusses defense-in-depth and encourages the use of risk analysis techniques to help ensure and show that key principles, such as the defense-in-depth philosophy, are met. Therefore, the increase in the Conditional Containment Failure Probability (CCFP), which helps ensure the defense-in-depth philosophy is maintained, is also calculated.

Regarding CCFP, changes of up to 1.1% have been accepted by the NRC for the one-time requests for extension of ILRT intervals. In context, it is noted that a CCFP of 1/10 (10%) has been approved for application to evolutionary light water designs. Given these perspectives, a change in the CCFP of up to 1.5% is assumed to be small.

In addition, the total annual risk (person rem/year population dose) is examined to demonstrate the relative change in this parameter. While no acceptance guidelines for these additional figures of merit are published, examinations of NUREG-1493 and Safety Evaluation Reports (SER) for one-time interval extension (summarized in Appendix G of Reference 24) indicate a range of incremental increases in population dose that have been accepted by the NRC. The range of incremental population dose increases is from <0.01 to 0.2 person-remn/year and/or 0.002% to 0.46% of the total accident dose. The total doses for the spectrum of all accidents (NUREG-1493 [Reference 6], Figure 7-2) result in health effects that are at least two orders of magnitude less than the NRC Safety Goal Risk. Given these perspectives, a very small population dose is defined as an increase from the baseline interval (3 tests per 10 years) dose of <1.0 person-rem per year or 1% of the total baseline dose, whichever is less restrictive for the risk impact assessment of the proposed extended ILRT interval.

For those plants that credit containment overpressure for the mitigation of design basis accidents, a brief description of whether overpressure is required should be included in this section. In addition, if overpressure is included in the assessment, other risk metrics such as CDF should be described and reported.

Revision 2 Page 5 of 142

54003-CALC-02 Evaluation of Risk Si.qnificance of Permanent ILRT Extension

3.0 REFERENCES

The following references were used in this calculation:

1. Revision 3-A to/Industry Guideline for Implementing Performance-BasedOption of 10 CFR Part50, Appendix J, NEI 94-01, July 2012.

2. Risk Impact Assessment of Revised Containment Leak Rate Testing lntervals, EPRI, Palo Alto, CA, EPRI TR-1 04285, August 1994.

3. Interim Guidance for Performing Risk Impact Assessments in Support of One-Time Extensions for Containment IntegratedLeakage Rate Test Surveillance Intervals, Revision 4, developed for NEI by EPRI and Data Systems and Solutions, October 2001.

4. An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Regulatory Guide 1.174, May 2011.

5. Response to Request for Additional Information Concerningthe License Amendment Request for a One-Time Integrated Leakage Rate Test Extension, Letter from Mr. C. H.

Cruse (Calvert Cliffs Nuclear Power Plant) to NRC Document Control Desk, Docket No.

50-317, March 27, 2002.

6. Performance-Based Containment Leak-Test Program, NUREG-1493, September 1995.

7. Evaluation of Severe Accident Risks: Peach Bottom Unit 2, Main Report NUREG/CR-4551, SAND86-1309, Volume 4, Revision 1, Part 1, October 1990.

8. Letter from R. J. Barrett (Entergy) to u. s. Nuclear Regulatory Commission, IPN-01-007, January 18, 2001.

9. United States Nuclear Regulatory Commission, Indian Point Nuclear Generating Unit No. 3 - Issuance of Amendment Re: Frequency of Performance-Based Leakage Rate Testing (TAC No. MB0178), April 17, 2001.

10. Impact of Containment Building Leakage on LWR Accident Risk, Oak Ridge National Laboratory, NUREG/CR-3539, ORNL/TM-8964, April 1984.

11. Reliability Analysis of Containment Isolation Systems, Pacific Northwest Laboratory, NUREG/CR-4220, PNL-5432, June 1985.

12. Technical Findings and Regulatory Analysis for Generic Safety Issue I1.E.4.3

'Containment Integrity Check', NUREG-1 273, April 1988.

13. Review of Light Water Reactor Regulatory Requirements, Pacific Northwest Laboratory, NUREG/CR-4330, PNL-5809, Volume 2, June 1986.

14. Shutdown Risk Impact Assessment for Extended Containment Leakage Testing Intervals Utilizing ORAMTM , EPRI, Palo Alto, CA, TR-105189, Final Report, May 1995.

15. Severe Accident Risks: An Assessment for Five U. S. Nuclear Power Plants, NUREG-1150, December 1990.

16. United States Nuclear Regulatory Commission, Reactor Safety Study, WASH-1400, October 1975.

17. Calculation PRA-MT-QU, Revision 3.2, Monticello Nuclear Generating Plant, "MNGP Quantification Notebook."

18. Calculation PRA-MT-L2, Revision 3.2, Monticello Nuclear Generating Plant, "MNGP Level 2 Notebook."

19. Monticello Nuclear Generating Plant, Application for Renewed Operating License, Appendix E - Environmental Report, 2005.

Revision 2 Page 6 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension

20. Anthony R. Pietrangelo, One-time extensions of containment integrated leak rate test interval - additional information, NEI letter to Administrative Points of Contact, November 30, 2001.

21. Letter from J. A. Hutton (Exelon, Peach Bottom) to U. S. Nuclear Regulatory Commission, Docket No. 50-278, License No. DPR-56, LAR-01-00430, dated May 30, 2001.

22. Risk Assessment for Joseph M. FarleyNuclear Plant Regarding ILRT (Type A)

Extension Request, prepared for Southern Nuclear Operating Co. by ERIN Engineering and Research, P0293010002-I1929-030602, March 2002.

23. Letter from D. E. Young (Florida Power, Crystal River) to U. S. Nuclear Regulatory Commission, 3F0401-11, dated April 25, 2001.

24. Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals, Revision 2-A of 1009325, EPRI, Palo Alto, CA. 1018243, October 2008.

25. Risk Assessment for Vogtle Electric Generating Plant Regarding the ILRT (Type A)

Extension Request, prepared for Southern Nuclear Operating Co. by ERIN Engineering and Research, February 2003.

26. Perspectives Gained from the IPEEE Program, USNRC, NUREG-1 742, April 2002.

27. "Renewed Facility Operating License DPR-22 for Monticello Nuclear Generating Plant,"

Technical Specifications, Docket No. 50-263, November 8, 2006.

28. Letter L-14-121, ML14111A291, FENOC Evaluation of the Proposed Amendment, Beaver Valley Power Station, Unit Nos. I and 2, April 2014.

29. Technical Letter Report ML112070867, Containment Liner Corrosion Operating Experience Summary, Revision 1, August 2011.

30. P0495020001-1969-040502, Monticello Nuclear Generating Plant, "Risk Assessment for Monticello Nuclear Generating Plant Regarding ILRT (Type A) Extension Request," April 2002.

31. Armstrong, J., Simplified Level 2 Modeling Guidelines: WOG PROJECT: PA-RMSC-0088, Westinghouse, WCAP-1 6341 -P, November 2005.

32. IPEEE, "Monticello Individual Plant Examination of External Events (IPEEE)," Revision 1, NSPLMI-95001, November 1995.

33. "Correction to Appendix C of the Monticello Individual Plant Examination of External Events," ML103610324, December 20, 2010.

34. Generic Issue 199 (G1-199), ML100270582, September 2010, "Implications of Updated Probabilistic Seismic Hazard Estimates in Central and Eastern United States on Existing Plants: Safety/Risk Assessment."

35. "The Nuclear Energy Institute - Seismic Risk Evaluations for Plants in the Central and Eastern United States," ML14083A596, March 2014.

36. Calculation FPRA-MT-QU, "Monticello Nuclear Generating Plant Fire PRA Quantification Notebook," Revision 3.

37. Monticello Nuclear Generating Plant PRA Peer Review Report Using ASME PRA Standard Requirements, BWR Owners Group, June 2013.

38. Calculation PRA-CALC-15-003, "Monticello Fire PRA MAAP Analysis," Revision 0, July 2015.

39. Calculation C495070003-7740, "Identification of Risk Implications due to Extended Power Uprate at Monticello," March 2008.

Revision 2 Revison 2Page 7 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension

40. Calculation FPRA-MT-UNC, "Monticello Nuclear Generating Plant Fire PRA Uncertainty and Sensitivity Notebook," Revision 3.

41. ASME/ANS RA-Sa-2009, Addenda to ASME/ANS RA-S-2008: Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications.

42. Calculation PRA-MT-DA, Revision 3.3, Monticello Nuclear Generating Plant, "Data Analysis Notebook."

43. Calculation PRA-MT-SY-CFW, Revision 3.3, Monticello Nuclear Generating Plant, "Condensate and Feedwater System Notebook."

44. Calculation PRA-MT-IF-IE, Revision 3.3, Monticello Nuclear Generating Plant, "Flooding Initiating Events Analysis Notebook."

45. Calculation FPRA-MT-HR, Revision 3, "Monticello Nuclear Generating Plant Fire PRA Fire Human Reliability Analysis Notebook."

46. Calculation PRA-MT-HRA, Revision 3.3, Monticello Nuclear Generating Plant, "MNGP Human Reliability Analysis Notebook."

47. Calculation PRA-MT-IF-AS, Revision 3.3, Monticello Nuclear Generating Plant, "Internal Flooding Accident Sequence Analysis Notebook."

48. Calculation FPRA-MT-PP, Revision 2, 'Monticello Nuclear Generating Plant Fire PRA Plant Partitioning Notebook."

49. Calculation FPRA-MT-ES, Revision 2, "Monticello Nuclear Generating Plant Fire PRA Equipment Selection Notebook."

50. Calculation FPRA-MT-PRM, Revision 3, "Monticello Nuclear Generating Plant Fire PRA Plant Response Model Notebook."

51. Calculation FPRA-MT-SCA, Revision 3, "Monticello Nuclear Generating Plant Fire PRA Single Compartment Analysis Notebook."

52. Calculation FPRA-MT-MCA, Revision 3, "Monticello Nuclear Generating Plant Fire PRA Multi-Compartment Analysis Notebook."

53. Calculation FPRA-MT-IF, Revision 2, "Monticello Nuclear Generating Plant Fire PRA Fire Ignition Frequencies Notebook."

54. Calculation FPRA-MT-MCR, Revision 3, "Monticello Nuclear Generating Plant Fire PRA Main Control Room Analysis Notebook."

55. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of ProbabilisticRisk Assessment Results for Risk-Informed Activities, Revision 2, March 2009.

56. NEI 07-12, Fire ProbabilisticRisk Assessment (FPRA) PeerReview Process Guidelines, Revision 1.

57. NEI 05-04, Process for Performing Internal Events PRA Peer Reviews Using the ASME/ANS PRA Standard, Revision 2.

58. Calculation PRA-MT-WI, Monticello Nuclear Generating Plant, "System Walkdown and Interview Notebook."

Page 8 of 142 Revision 22 Page 8 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 4.0 ASSUMPTIONS AND LIMITATIONS The following assumptions were used in the calculation:

• The technical adequacy of the MNGP PRA is either consistent with the requirements of Regulatory Guide 1.200 or where gaps exist, the gaps have been addressed, as is relevant to this ILRT interval extension, as detailed in Appendix A.

• The MNGP Level 1 and Level 2 internal events PRA models provide representative results.

• It is appropriate to use the MNGP internal events PRA model to effectively describe the risk change attributable to the ILRT extension. An extensive sensitivity study is done in Section 5.3.1 to show the effect of including external event models for the ILRT extension. The Seismic risk from GI-199 [Reference 34] and Fire PRA (model Revision

1) are used for this sensitivity analysis.

- Dose results for the containment failures modeled in the PSA can be characterized by information provided in NUREG/CR-4551 [Reference 7]. They are estimated by scaling the NUREG/CR-4551 results by population differences for Monticello compared to the NUREG/CR4551 reference plant. The representative containment leakage for Class 1 sequences is 1La. Class 3 accounts for increased leakage due to Type A inspection failures.

• The lowest consequence calculations (i.e., intact containment and small leakages) are based on scaling the NUREG/CR-4551 [Reference 7] results for such cases using population differences, and also based on differences in the allowable Technical Specification Leakage. Class 7 releases are based on values provided in Reference 19.

• The representative containment leakage for Class 3a sequences is I10La based on the previously approved methodology performed for Indian Point Unit 3 [Reference 8, Reference 9].

• The representative containment leakage for Class 3b sequences is 100OLa based on the guidance provided in EPRI Report No. 1009325, Revision 2-A (EPRI 1018243)

[Reference 24].

• The Class 3b can be very conservatively categorized as LERF based on the previously approved methodology [Reference 8, Reference 9].

• The impact on population doses from containment bypass scenarios is not altered by the proposed ILRT extension, but is accounted for in the EPRI methodology as a separate entry for comparison purposes. Since the containment bypass contribution to population dose is fixed, no changes in the conclusions from this analysis will result from this separate categorization.

• The reduction in ILRT frequency does not impact the reliability of containment isolation valves to close in response to a containment isolation signal.

Page 9 of 142 Revision 22 Revision Page 9 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 8.0 METHODOLOGY AND ANALYSIS 5.1 Inputs This section summarizes the general resources available as input (Section 5.1.1) and the plant specific resources required (Section 5.1.2).

5.1.1 General Resources Available Various industry studies on containment leakage risk assessment are briefly summarized here:

1. NUREG/CR-3539 [Reference 10]

2. NUREG/CR-4220 [Reference 11]

3. NUREG-1273 [Reference 12]

4. NUREG/CR-4330 [Reference 13]

5. EPRI TR-105189 [Reference 14]

6. NUREG-1493 [Reference 6]

7. EPRI TR-104285 [Reference 2]

8. NUREG-1 150 [Reference 15] and NUREG/CR-4551 [Reference 7]

9. NEI Interim Guidance [Reference 3, Reference 20]

10. Calvert Cliffs liner corrosion analysis [Reference 5]

11. EPRI Report No. 1009325, Revision 2-A (EPRI 1018243), Appendix H [Reference 24]

This first study is applicable because it provides one basis for the threshold that could be used in the Level 2 PRA for the size of containment leakage that is considered significant and is to be included in the model. The second study is applicable because it provides a basis of the probability for significant pre-existing containment leakage at the time of a core damage accident. The third study is applicable because it is a subsequent study to NUREG/CR-4220 that undertook a more extensive evaluation of the same database. The fourth study provides an assessment of the impact of different containment leakage rates on plant risk. The fifth study provides an assessment of the impact on shutdown risk from ILRT test interval extension. The sixth study is the NRC's cost-benefit analysis of various alternative approaches regarding extending the test intervals and increasing the allowable leakage rates for containment integrated and local leak rate tests. The seventh study is an EPRI study of the impact of extending ILRT and local leak rate test (LLRT) intervals on at-power public risk. The eighth study provides an ex-plant consequence analysis for a 50-mile radius surrounding a plant that is used as the basis for the consequence analysis of the ILRT interval extension for MNGP. The ninth study includes the NEI recommended methodology (promulgated in two letters) for evaluating the risk associated with obtaining a one-time extension of the ILRT interval. The tenth study addresses the impact of age-related degradation of the containment liners on ILRT evaluations. Finally, the eleventh study builds on the previous work and includes a recommended methodology and template for evaluating the risk associated with a permanent 15-year extension of the ILRT interval.

NUREG/CR-3539 rReference 101 Oak Ridge National Laboratory documented a study of the impact of containment leak rates on public risk in NUREG/CR-3539. This study uses information from WASH-1400 [Reference 16]

as the basis for its risk sensitivity calculations. ORNL concluded that the impact of leakage rates on LWR accident risks is relatively small.

NUREG/CR-4220 [Reference 11]I NUREGICR-4220 is a study performed by Pacific Northwest Laboratories for the NRC in 1985.

The study reviewed over two thousand LERs, ILRT reports and other related records to Revision 2 Page 10 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension calculate the unavailability of containment due to leakage.

NUREG-1 273 [Reference 121 A subsequent NRC study, NUREG-1273, performed a more extensive evaluation of the NUREG/CR-4220 database. This assessment noted that about one-third of the reported events were leakages that were immediately detected and corrected. In addition, this study noted that local leak rate tests can detect "essentially all potential degradations" of the containment isolation system.

NUREG/CR-4330 [Reference 131 NUREG/CR-4330 is a study that examined the risk impacts associated with increasing the allowable containment leakage rates. The details of this report have no direct impact on the modeling approach of the ILRT test interval extension, as NUREG/CR-4330 focuses on leakage rate and the ILRT test interval extension study focuses on the frequency of testing intervals.

However, the general conclusions of NUREG/CR-4330 are consistent with NUREG/CR-3539 and other similar containment leakage risk studies:

".theeffect of containment leakage on overall accident risk is small since risk is dominated by accident sequences that result in failure or bypass of containment."

EPRI TR-105189 [Reference 141 The EPRI study TR-1 05189 is useful to the ILRT test interval extension risk assessment because it provides insight regarding the impact of containment testing on shutdown risk. This study contains a quantitative evaluation (using the EPRI ORAM software) for two reference plants (a BWR-4 and a PWR) of the impact of extending ILRT and LLRT test intervals on shutdown risk. The conclusion from the study is that a small, but measurable, safety benefit is realized from extending the test intervals.

NUREG-1493 [Reference 61 NUREG-1493 is the NRC's cost-benefit analysis for proposed alternatives to reduce containment leakage testing intervals and/or relax allowable leakage rates. The NRC conclusions are consistent with other similar containment leakage risk studies:

Reduction in ILRT frequency from 3 per 10 years to 1 per 20 years results in an "imperceptible" increase in risk.

Given the insensitivity of risk to the containment leak rate and the small fraction of leak paths detected solely by Type A testing, increasing the interval between integrated leak rate tests is possible with minimal impact on public risk.

EPRI TR-104285 [Reference 21 Extending the risk assessment impact beyond shutdown (the earlier EPRI TR-1 05189 study),

the EPRI TR-1 04285 study is a quantitative evaluation of the impact of extending ILRT and LLRT test intervals on at-power public risk. This study combined IPE Level 2 models with NUREG-1 150 Level 3 population dose models to perform the analysis. The study also used the approach of NUREG-1493 in calculating the increase in pre-existing leakage probability due to extending the ILRT and LLRT test intervals.-

EPRI TR-1 04285 uses a simplified Containment Event Tree to subdivide representative core damage frequencies into eight classes of containment response to a core damage accident:

1. Containment intact and isolated

2. Containment isolation failures dependent upon the core damage accident

3. Type A (ILRT) related containment isolation failures Revision 2 Page 11 of 142

54003-CALC-02 of Risk Significance 5400-CAL-02Evaluation of Permanent ILRT Extension

4. Type B (LLRT) related containment isolation failures

5. Type C (LLRT) related containment isolation failures

6. Other penetration related containment isolation failures

7. Containment failures due to core damage accident phenomena

8. Containment bypass Consistent with the other containment leakage risk assessment studies, this study concluded:

".theproposed CLRT (Containment Leak Rate Tests) frequency changes would have a minimal safety impact. The change in risk determined by the analyses is small in both absolute and relative terms. For example, for the PWR analyzed, the change is about 0.04 person-rem per year..."

NUREG-1 150 [Reference 151 and NUREG/CR-4551 [Reference 71 NUREG-1150 and the technical basis, NUREG/CR-4551, provide an ex-plant consequence analysis for a spectrum of accidents including a severe accident with the containment remaining intact (i.e., Tech Spec Leakage). This ex-plant consequence analysis is calculated for the 50-mile radial area surrounding Surry. The ex-plant calculation can be delineated to total person-rem for each identified Accident Progression Bin (APB) from NUREG/CR-4551. With the MNGP Level 2 model end-states assigned to one of the NUREG/CR-4551 APBs, it is considered adequate to represent MNGP. (The meteorology and site differences other than population are assumed not to play a significant role in this evaluation.)

NEl Interim Guidance for Performingq Risk Impact Assessments In Support of One-Time Extensions for Containment Inteqrated Leakagqe Rate Test Surveillance Intervals [Reference 3, Reference 201 The guidance provided in this document builds on the EPRI risk impact assessment methodology [Reference 2] and the NRC performance-based containment leakage test program

[Reference 6], and considers approaches utilized in various submittals, including Indian Point 3 (and associated NRC SER) and Crystal River.

Calvert Cliffs Response to Request for Additional Information Concerning the License Amendment for a One-Time Integqrated Leakage Rate Test Extension [Reference 51 This submittal to the NRC describes a method for determining the change in likelihood, due to extending the ILRT, of detecting liner corrosion, and the corresponding change in risk. The methodology was developed for Calvert Cliffs in response to a request for additional information regarding how the potential leakage due to age-related degradation mechanisms was factored into the risk assessment for the ILRT one-time extension. The Calvert Cliffs analysis was performed for a concrete cylinder and dome and a concrete basemat, each with a steel liner.

EPRI Report No. 1009325, Revision 2-A. Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals [Reference 241 This report provides a generally applicable assessment of the risk involved in extension of ILRT test intervals to permanent 15-year intervals. Appendix H of this document provides guidance for performing plant-specific supplemental risk impact assessments and builds on the previous EPRI risk impact assessment methodology [Reference 2] and the NRC performance-based containment leakage test program [Reference 6], and considers approaches utilized in various submittals, including Indian Point 3 (and associated NRC SER) and Crystal River.

The approach included in this guidance document is used in the MNGP assessment to determine the estimated increase in risk associated with the ILRT extension. This document includes the bases for the values assigned in determining the probability of leakage for the EPRI Class 3a and 3b scenarios in this analysis, as described in Section 5.2.

Revision 2 Page 12 of 142

54003-CALC-02 5400-OAL-02Evaluation of Risk Significance of Permanent ILRT Extension 5.1.2 Plant Specific Inputs The plant-specific information used to perform the MNGP ILRT Extension Risk Assessment includes the following:

Level 1 Model results [Reference 17]

Level 2 Model results [Reference 18]

Release category definitions used in the Level 2 Model [Reference 18]

Population Dose calculations by release category [Reference 19, Reference 7]

ILRT results to demonstrate adequacy of the administrative and hardware issues [Reference 30]

MNGP Model The Internal Events PRA Model that is used for MNGP is characteristic of the as-built plant. The current Level 1 model (MNGP PRA Model Revision 3.2) [Reference 17] is a linked fault tree model. The CDF is 8.OIE-6/year [Reference 17], and the LERE is 9.20E-7/year [Reference 18].

Table 5-1 and Table 5-2 provide a summary of the Internal Events ODE and LERF results for MNGP PRA Model Revision 3.2. Note: the apportioning of the sequences is done via quantification of the Revision 3.2 PRA model and examining the sequence flags, not taken directly from the results reported in References 17 and 18 because the sequence-apportioned results do not sum to the total risk; for example, the sum of the risk in Table B-I of Reference 17 is 7.52E-6/year (instead of the actual ODE of 8.01E-6/year).

The total Fire ODE is 4.11E-5/year; the total Fire LERF is 5.31E-6/year [Reference 36]. The GI-199 Seismic CDF is 1.9E-5 [Reference 34]. Refer to Section 5.3.1 for further details on external events as they pertain to this analysis.

Table 5-1 - Internal Events CDF (MNGP PRA Model Revision 3.2)

Internal Events Frequency (per year)

ATVVS 1.59E-07 LOCA I1.48E-07 ISLOCA 2.88E-09 SORV 2.76E-07 Transient 7.43E-06 Total Internal Events CDF 8.OIE-06 Table 5 Internal Events LERF (MNGP PRA Model Revision 3.2)

Internal Events Frequency (per year)

ATWS 6.OOE-08 LOCA I .46E-09 ISLOCA 2.62E-09 SORV 8.1 4E-08 Transient 7.75E-07 Total Internal Events LERF 9.20E-07 Revision 2 Revison 2Page 13 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Release CateQory Definitions Table 5-3 defines the accident classes used in the ILRT extension evaluation, which is consistent with the EPRI methodology [Reference 2]. These containment failure classifications are used in this analysis to determine the risk impact of extending the Containment Type A test interval, as described in Section 5.2 of this report.

Table 5-3 - EPRI Containment Failure Classification [Reference 2]

Class Description Containment remains intact including accident sequences that do not lead to containment failure inthe 1long term. The release of fission products (and attendant consequences) is determined by the maximum allowable leakage rate values La, under Appendix J for that plant.

Containment isolation failures (as reported inthe Individual Plant Examinations) including those accidents 2in which there is a failure to isolate the containment.

3 Independent (or random) isolation failures include those accidents inwhich the pre-existing isolation failure to seal (i.e., provide a leak-tight containment) is not dependent on the sequence in progress.

Independent (or random) isolation failures include those accidents inwhich the pre-existing isolation failure to seal is not dependent on the sequence in progress. This class is similar to Class 3 isolation failures, but is applicable to sequences involving Type B tests and their potential failures. These are the Type B-tested components that have isolated, but exhibit excessive leakage.

Independent (or random) isolation failures including those accidents in which the pre-existing isolation 5 failure to seal is not dependent on the sequence in progress. This class is similar to Class 4 isolation failures, but is applicable to sequences involving Type C test and their potential failures.

Containment isolation failures including those leak paths covered in the plant test and maintenance 6requirements or verified per in-service inspection and testing (ISI/IST) program.

Accidents involving containment failure induced by severe accident phenomena. Changes inAppendix J testing requirements do not impact these accidents.

8 Accidents in which the containment is bypassed (either as an initial condition or induced by phenomena) are included in Class 8. Changes inAppendix J testing requirements do not impact these accidents.

5.1.3 Impact of Extension on Detection of Component Failures that Lead to Leakage (Small and Large)

The ILRT can detect a number of component failures such as liner breach, failure of certain bellows arrangements, and failure of some sealing surfaces, which can lead to leakage. The proposed ILRT test interval extension may influence the conditional probability of detecting these types of failures. To ensure that this effect is properly addressed, the EPRI Class 3 accident class, as defined in Table 5-3, is divided into two sub-classes, Class 3a and Class 3b, representing small and large leakage failures respectively.

The probability of the EPRI Class 3a and Class 3b failures is determined consistent with the EPRI Guidance [Reference 24]. For Class 3a, the probability is based on the maximum likelihood estimate of failure (arithmetic average) from the available data (i.e., 2 "small" failures in 217 tests leads to "large" failures in 217 tests (i.e., 2 1 217 =0.0092). For Class 3b, the probability is based on the Jeifreys non-informative prior (i.e., 0.5 /218 = 0.0023).

In a follow-up letter [Reference 20] to their ILRT guidance document [Reference 3], NEI issued additional information concerning the potential that the calculated delta LERF values for several plants may fall above the "very small change" guidelines of the NRC Regulatory Guide 1.174

[Reference 4]. This additional NEI information includes a discussion of conservatisms in the quantitative guidance for ALERF. NEI describes ways to demonstrate that, using plant-specific calculations, the ALERF is smaller than that calculated by the simplified method.

Revision 2 Page 14 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension The supplemental information states:

The methodology employed for determining LERF (Class 3b frequency) involves conseniatively multiplying the CDF by the failure probabilityfor this class (3b) of accident. This was done for simplicity and to maintain conservatism. However, some plant-specific accident classes leading to core damage are likely to include individual sequences that either may already (independently) cause a LERF or could never cause a LERF, and are thus not associated with a postulated large Type A containment leakage path (LERF). These contributors can be removed from Class 3b in the evaluation of LERF by multiplying the Class 3b probabilityby only that portion of CDF that may be impacted by Type A leakage.

The application of this additional guidance to the analysis for MNGP, as detailed in Section 5.2, involves subtracting the LERF from the CDF that is applied to Class 3b. To be consistent, the same change is made to the Class 3a ODE, even though these events are not considered LERF.

Consistent with the NEI Guidance [Reference 3], the change in the leak detection probability can be estimated by comparing the average time that a leak could exist without detection. For example, the average time that a leak could go undetected with a three-year test interval is 1.5 years (3 years / 2), and the average time that a leak could exist without detection for a ten-year interval is 5 years (10 years / 2). This change would lead to a non-detection probability that is a factor of 3.33 (5.0/1.5) higher for the probability of a leak that is detectable only by ILRT testing.

Correspondingly, an extension of the ILRT interval to 15 years can be estimated to lead to a factor of 5 ((15/2)11.5) increase in the non-detection probability of a leak.

It should be noted that using the methodology discussed above is very conservative compared to previous submittals (e.g., the 1P3 request for a one-time ILRT extension that was approved by the NRC [Reference 9]) because it does not factor in the possibility that the failures could be detected by other tests (e.g., the Type B local leak rate tests that will still occur). Eliminating this possibility conservatively over-estimates the factor increases attributable to the ILRT extension.

5.2 Analysis The application of the approach based on the guidance contained in EPRI Report No. 1009325, Revision 2-A, Appendix H [Reference 24], EPRI TR-104285 [Reference 2] and previous risk assessment submittals on this subject [References 5, 8, 21, 22, and 23] have led to the following results. The results are displayed according to the eight accident classes defined in the EPRI report, as described in Table 5-4.

The analysis performed examined MNGP-specific accident sequences in which the containment remains intact or the containment is impaired. Specifically, the breakdown of the severe accidents, contributing to risk, was considered in the following manner:

Core damage sequences in which the containment remains intact initially and in the long term (EPRI TR-104285, Class 1 sequences [Reference 2]).

Core damage sequences in which containment integrity is impaired due to random isolation failures of plant components other than those associated with Type B or Type C test components. For example, liner breach or bellow leakage (EPRI TR-104285, Class 3 sequences [Refere*nce 2]).

Accident sequences involving containment bypassed (EPRI TR-104285, Class 8 sequences

[Reference 2]), large containment isolation failures (EPRI TR-104285, Class 2 sequences

[Reference 2]), and small containment isolation "failure-to-seal" events (EPRI TR-104285, Class 4 and 5 sequences [Reference 2]) are accounted for in this evaluation as part of the baseline risk profile. However, they are not affected by the ILRT frequency change.

Revision 2 Revison 2Page 15 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Class 4 and 5 sequences are impacted by changes in Type B and C test intervals; therefore, changes in the Type A test interval do not impact these sequences.

Table 5 EPRI Accident Class Definitions Accident Classes Description (Containment Release Type) 1 No Containment Failure 2 Large Isolation Failures (Failure to Close) 3a Small Isolation Failures (Liner Breach) 3b Large Isolation Failures (Liner Breach) 4 Small Isolation Failures (Failure to Seal - Type B) 5 Small Isolation Failures (Failure to Seal - Type C) 6 Other Isolation Failures (e.g., Dependent Failures) 7 Failures Induced by Phenomena (Early and Late) 8 Bypass (Interfacing System LOCA)

CDF All CET End States (Including Very Low and No Release)

The steps taken to perform this risk assessment evaluation are as follows:

Step 1 - Quantify the baseline risk in terms of frequency per reactor year for each of the accident classes presented in Table 5-4.

Step 2 - Develop plant-specific person-rem dose (population dose) per reactor year for each of the eight accident classes.

Step 3 - Evaluate risk impact of extending Type A test interval from 3 in 10 years to 1 in 15" years and 1 in 10 years to1I in 15 years.

Step 4 - Determine the change in risk in terms of Large Early Release Frequency (LERF) in accordance with RG 1.174 [Reference 4].

Step 5 - Determine the impact on the Conditional Containment Failure Probability (CCFP).

5.2.1 Step 1 - Quantify the Baseline Risk in Terms of Frequency per Reactor Year As previously described, the extension of the Type A interval does not influence those accident progressions that involve large containment isolation failures, Type B or Type C testing, or containment failure induced by severe accident phenomena.

For the assessment of ILRT impacts on the risk profile, the potential for pre-existing leaks is included in the model. (These events are represented by the Class 3 sequences in EPRI TR-104285 [Reference 2].) The question on containment integrity was modified to include the probability of a liner breach or bellows failure (due to excessive leakage) at the time of core damage. Two failure modes were considered for the Class 3 sequences. These are Class 3a (small breach) and Class 3b (large breach).

The frequencies for the severe accident classes defined in Table 5-4 were developed for MNGP by first determining the frequencies for Classes 1, 2, 7, and 8. Table 5-5 presents the frequency and EPRI category for each sequence. Table 5-6 presents the grouping of the release categories in EPRI Classes. Table 5-7 provides a summary of the accident sequence frequencies that can lead to radionuclide release to the public and have been derived consistent with the'definitions of accident classes defined in EPRI TR-104285 [Reference 2], the NEI Interim Guidance [Reference 3], and guidance provided in EPRI Report No. 1009325, Revision Revision 2 Page 16 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension 2-A [Reference 24]. Adjustments were made to the Class 3b and hence Class 1 frequencies to account for the impact of undetected corrosion of the steel liner per the methodology described in Section 5.2.6. Note: calculations were performed with more digits than shown in this section.

Therefore, minor differences may occur ifthe calculations in these sections are followed explicitly.

Class 3 Sequences. This group consists of all core damage accident progression bins for which a pre-existing leakage in the containment structure (e.g., containment liner) exists that can only be detected by performing a Type A ILRT. The probability of leakage detectable by a Type A ILRT is calculated to determine the impact of extending the testing interval. The Class 3 calculation is divided into two classes: Class 3a is defined as a small liner breach (La < leakage

< 10La), and Class 3b is defined as a large liner breach (1OLa < leakage < 100L2 ).

Data reported in EPRI 1009325, Revision 2-A [Reference 24] states that two events could have been detected only during the performance of an ILRT and thus impact risk due to change in ILRT frequency. There were a total of 217 successful ILRTs during this data collection period.

Therefore, the probability of leakage is determined for Class 3a as shown in the following equation:

2 Pczass 3 a - 21= 0.0092 Multiplying the CDF by the probability of a Class 3a leak yields the Class 3a frequency contribution in accordance with guidance provided in Reference 24. As described in Section 5.1.3, additional consideration is made to not apply failure probabilities on those cases that are already LERF scenarios. Therefore, LERF contributions from CDF are removed. The frequency of a Class 3a failure is calculated by the following equation:

Frqms~ = Pcczass3a * (CDF - LERE) 217 * (8.0 1E-6 - 9.20OE-7) = 6.54E-08 In the database of 217 ILRTs, there are zero containment leakage events that could result in a large early release. Therefore, the Jeifreys non-informative prior is used to estimate a failure rate and is illustrated in the following equations:

Number of Failures+ 1/2 Jeffreys Failure Probability =

Number of Tests + 1 o + 1/2 Pclass3b = 17n -- 0.0023 The frequency of a Class 3b failure is calculated by the following equation:

Frqzs~ = class3b * (CDF - LERF) 21*

.5- (8.O1E-6 - 9.20E-7) = 1.63E-08 For this analysis, the associated containment leakage for Class 3a is 10OLa and for Class 3b is 100La. These assignments are consistent with the guidance provided in Reference 24.

• Class 1 Sequences. This group consists of all core damage accident progression bins for which the containment remains intact (modeled as Technical Specification Leakage). Table 5-5 shows the Level 2 results. These values are adjusted from Section 7.2.1 of Reference 18. The values provided in Section 7.2.1 of Reference 18 sum to greater than the CDF because some of the

,results are non-minimal (e.g., a small early release may also progress to a medium intermediate release). The negligible release frequency is preserved because its frequency could not also be classified as a significant release. The rest of the release categories are reduced by a ratio so Revision 2 Page 17 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension the release frequencies sum to the total CDF. The frequency per year is initially determined from the EPRI Accident Class I (Intact) frequency listed in Table 5-5 and then subtracting the EPRI Class 3a and 3b frequency (to preserve total CDF), calculated below:

Freqciass1 = Freqjntact - (Feczs~ + Frqzasb Class 2 Sequences. This group consists of core damage accident progression bins with large containment isolation failures. This is calculated by adding the frequency of events FAILED-007 (1 .70E-10) and FAILED-012 (2.02E-9). This is explained in the CONT-ISO entry in Table A-I of Reference 18; the values are provided in Appendix D of Reference 18. The frequency per year for these sequences is obtained from the EPRI Accident Class 2 frequency listed in Table 5-5.

Class 4 Sequences. This group consists of all core damage accident progression bins for which containment isolation failure-to-seal of Type B test components occurs. Because these failures are detected by Type B tests which are unaffected by the Type A ILRT, this group is not evaluated any further in the analysis, consistent with approved methodology.

Class 5 Sequences. This group consists of all core damage accident progression bins for which a containment isolation failure-to-seal of Type C test components occurs. Because the failures are detected by Type C tests which are unaffected by the Type A ILRT, this group is not evaluated any further in this analysis, consistent with approved methodology.

Class Ei Sequences. These are sequences that involve core damage accident progression bins for which a failure-to-seal containment leakage due to failure to isolate the containment occurs.

These sequences are dominated by misalignment of containment isolation valves following a test/maintenance evolution. All other failure modes are bounded by the Class 2 assumptions.

This accident class is also not evaluated further.

Class 7 Sequences. This group consists of all core damage accident progression bins in which containment failure is induced by severe accident phenomena (e.g., overpressure). As discussed for the Class I sequences, this data is taken from Section 7.2.1 of Reference 18 and reduced by a ratio so the release frequencies sum to the total CDF. Release frequencies are classified based on timing of release (early, intermediate, or late) and magnitude of release (small, medium, or large). For this analysis, the frequency is determined from the EPRI Accident Class 7 frequency listed in Table 5-5.

Class 8 Sequences. This group consists of risk from core damage accident class 5 (containment bypass). This value is taken from Figure 4.2-2 of Reference 17. For this analysis, the total frequency is listed in Table 5-5.

LERF quantification is distributed into EPRI categories based on release categories. Table 5-4 shows this distribution.

Revision 22 Page 18 of 142 Revision Page 18 of 142

54003-CALC-02 of Risk Significance of Permanent ILRT Extension 5400-CAL-02Evaluation Table 5-5 - Release Category Frequencies Release Description of Outcome EPRI Frequency (lyr)

Category Category NCF No Containment Failure 1 1.78E-06 CIS Containment Isolation Failure 2 2.19E-09 LERF (no Large Early Release Frequency (excluding containment 7 bypass) bypass) 6.60E-07 MERF Medium Early Release Frequency 7 1.31 E-06 SERF Small Early Release Frequency 7 3.86E-08 LIRF Large Intermediate Release Frequency 7 4.03E-07 MIRF Medium Intermediate Release Frequency 7 2.65E-06 SIRF Small Intermediate Release Frequency 7 2.12E-07 LLRF Large Late Release Frequency 7 2.98E-07 MLRF Medium Late Release Frequency 7 6.63E-07 ISLOCA Interfacing Systems LOCA 8 2.88E-09 Contribution to EPRI Classification 7 6.23E-06 Table 5 Release Category Frequencies Containment End State EPRI Category Frequency (/yr)

Intact Containment 1 1.78E-06 Large Isolation Failure 2 2.19E-09 Failures Induced by Phenomena 7 6.23E-06 ISLOCA 8 2.88E-09 Table 5 Baseline Risk Profile Class Description Frequency (Jyr) 1 No containment failure 1.70E-06 2 2 Large containment isolation failures 2.19E-09 3a Small isolation failures (liner breach) 6.54E-08 3b Large isolation failures (liner breach) I.63E-08 4 Small isolation failures - failure to seal (type B) E 5 Small isolation failures - failure to seal (type C) E 6 Containment isolation failures (dependent failure, personnel errors)

• 7 Severe accident phenomena induced failure (early and late) 6.23E-06 8 Containment bypass 2.88E-09 Total 8.01 E-06

1. E represents a probabilistically insignificant value or a Class that is unaffected by the Type A ILRT.

2. The Class 3a and 3b frequencies are subtracted from Class 1 to preserve total CDF.

6.2.2 Step 2 - Develop Plant-Specific Person-Remn Dose (Population Dose)

Plant-specific release analyses were performed to estimate the person-rem doses to the population within a 50-mile radius from the plant. Reference 19 provides the population dose for Class 7 releases based on timing (early or late) and magnitude (small, medium, or large). Early releases are categorized as occurring before six hours (after declaration of General Emergency); late releases are categorized as occurring after six hours [Reference 19]. This does not perfectly align with the release frequency delineation provided in the Level 2 analysis Revision 2 Page 19 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension

[Reference 18], which has early, intermediate, and late release timing with the interval separations being four hours and 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Therefore, the first two hours of the intermediate releases map to the Reference 19 early release, and the last 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> of the intermediate releases map to the Reference 19 late release; there is not precise way to do this mapping. The overly conservative method would be to assign all the intermediate release frequency to the Reference 19 early release. A more reasonable method is to assign some of the intermediate release frequency to the early release frequency and some to the late release frequency. This is done by calculating the per-hour release from the Reference 18 early release frequency, assuming the same per-hour release occurs for the first two hours of the intermediate time period, and re-categorizing this to the early release frequency; the remaining intermediate frequency gets re-categorized to the late release frequency. Since release generally decreases on a per-hour bases as time progresses and early release is more consequential to the public, this method for dividing the intermediate release is conservative, yet reasonable. This method is done separately for small, medium, and large releases.

The population dose for Classes 1, 2, and 8 are calculated using the methodology of scaling Peach Bottom population doses to MNGP [Reference 7]. The adjustment factor for reactor power level (AFpower) is defined as the ratio of the power level at MNGP (PLM) [Reference 27] to that at Peach Bottom Unit 2 (PLP) [Reference 7]. This adjustment factor is calculated as follows:

A~power = PLM / PLP = 2004 / 3293 =0.609 The adjustment factor for technical specification (TS) allowed containment leakage is defined as the ratio of the containment leakage at Monticello (LRM) to that at Peach Bottom Unit 2 (LRP).

This adjustment factor is calculated as follows:

AFleakage = LRM / LRP Since the leakage rates are in terms of the containment volume, the ratio of containment volumes is needed to relate the leakage rates. The TS maximum allowed containment leakage at MNGP (TSM) is 1.2%/day [Reference 27]; the containment free volume at MNGP (VOLM) iS 240,000 ft3 [Section 2.1 of Reference 18]. The TS maximum allowed containment leakage at Peach Bottom Unit 2 (TSpg) is 0.5%/day [Reference 7]; the containment free volume at Peach Bottom Unit 2 (VOLPB) is 307,000 ft3 [Reference 7].Therefore, LRM = TSM

• VOLM LRP -- TSpB

• VOLpB AFleakage = (1.2

• 240000) / (0.5

• 307000) = 1.876 The adjustment factor for population (AFpopuiation) is defined as the ratio of the population within 50-mile radius of MNGP (POPM) [Reference 19] to that of Peach Bottom Unit 2 (POPP)

[Reference 7]. The 2030 population surrounding MNGP was conservatively estimated as 3,903,243 [Section F.3.1 of Reference 19]. This adjustment factor is calculated as follows:

AFpopuiation =POPM / POPP = 3903243 / 3.02E+6 =1.292 Consequences dependent on the INTACT TS Leakage (collapsed accident progression bins 8 and 10).

AFINTACT = AFpower

• AFLeakage

• AFpopuiation =0.609

• 1.88

• 1.29 = 1.476 Since the other categories are not dependent on the TS Leakage, the adjustment factor (AF) is calculated by combining the factors as follows:

AF =AFpower

• AFpopulation =0.609

• 1.29 =0.787 Page 20 of 142 Revision 22 Revision Page 20 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension The population dose data in NUREG/CR-4551 for Peach Bottom Unit 2 [Reference 7] is reported in ten distinct collapsed accident progression bins (CAPBs). For this ILRT extension application, CAPB38 and CAPI310 are categorized in EPRI Accident Class 1; CAPB3 is categorized in EPRI Accident Class 2; and CAPB7 is categorized in EPRI Accident Class 8.

Based on the above adjustment factors and the 50-mile population dose (person-rem) for each CAPB3 considered in the NUREG/CR-4551 Peach Bottom Unit 2 study, the MNGP population doses (MPD) for Classes 2 and 8 are calculated as follows:

MPDclassi AFINTACT

• PDcApB8 +- AFINTACT

• PDCAPB10 = 1.476

• 4.94E+3 + 1.476

• 0 = 7.29E+/-3 MPDclass 2 =AF

• PDCAPB3 = 0.787

• 2.97E+6 =2.34E+6 MPDcia~s8s AF

• PDCApB7 = 0.787

• 1.95E+6 =1.53E+6 Table 5-8 provides a correlation of MNGP population dose to EPRI Accident Class. Table 5-9 provides population dose for each EPRI accident class.

The population dose for EPRI Accident Classes 3a and 3b were calculated based on the guidance provided in EPRI Report No. 1009325, Revision 2-A [Reference 24] as follows:

EPRI Class 3a PopulationDose = 10

• 7.29E+3 =7.29E+/-4 EPRI Class 3b PopulationDose = :100

• 7.29E+3 = 7.29E+5 Table 5-8 - Mapping of Population Dose to EPRI Accident Class EPRI Category Frequency (lyr) Dose (person-rem)

Class 1 1.78E-06 7.29E+03 Class 2 2.19E-O9 2.34E+06 Class 6 N/A - Included in Class 2 Class 7 6.23E-06 1.87E+06 Class 8 2.88E-09 I1.53E+06 Table 5-9 - Baseline Population Doses Class Description Population Dose (person-rem) 1 No containment failure 7.29E+03 2 Large containment isolation failures 2.34E+06 3a Small isolation failures (liner breach) 7.29E+04 1 3b Large isolation failures (liner breach) 7.29E+05 2 4 Small isolation failures - failure to seal (type B) N/A 5 Small isolation failures - failure to seal (type C) N/A 6 Containment isolation failures (dependent failure, personnel errors) N/A 7 Severe accident phenomena induced failure (early and late) 1 .87E+06 8 Containment bypass 1 :53E+06

1. 10*La 1O*La lO0*La

2. I OO*La Page 21 of 142 Revision 22 Revision Page 21 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension 5.2.3 Step 3 - Evaluate Risk Impact of Extending Type A Test Interval from 10 to 15 Years The next step is to evaluate the risk impact of extending the test interval from its current 10-year interval to a 15-year interval. To do this, an evaluation must first be made of the risk associated with the 10-year interval, since the base case applies to 3-year interval (i.e., a simplified representation of a 3-to-10 interval).

Risk Impact Due to 10-Year Test Interval As previously stated, Type A tests impact only Class 3 sequences. For Class 3 sequences, the release magnitude is not impacted by the change in test interval (a small or large breach remains the same, even though the probability of not detecting the breach increases). Thus, only the frequency of Class 3a and Class 3b sequences is impacted. The risk contribution is changed based on the NEI guidance as described in Section 5.1.3 by a factor of 10/3 compared to the base case values. The Class 3a and 3b frequencies are calculated as follows:

Freqczass3 aloyr = -- * -* Frqzas = 1-0 - * (8.01E-6 -9.20E-7) =2.18E-7 10 .5 10 .5 Freqczass3 biayr y- * -28* Freqc1 mssl = 3~ * -18* (8.01E-6 -9.20E-7) = 5.42E-8 The results of the calculation for a 10-year interval are presented in Table 5-10.

Table 5 Risk Profile for Once in 10 Year ILRT Class Description Frequency Contribution Population Dose Population (lyr) (%) (person-rem) Dose Rate (person-rem/yr) 1 No containment failure 2 1.51E-06 18.82% 7.29E+03 1.10E-02 2 Large containment isolation 2.19E-09 0.03% 2.34E+06 5.12E-03 failures 3a Small isolation failures (liner 2.18E-07 2.72% 7.29E+04 1.59E-02 breach) 3b Large isolation failures 5.42E-08 0.68% 7.29E+05 3.95E-02 (liner breach) 4 Small isolation failures - E 1*

failure to seal (type B) 5 Small isolation failures -

• failure to seal (type C)

Containment isolation 6 failures (dependent failure,

• a personnel errors)

Severe accident 7 phenomena induced failure 6.23E-06 77.72% 1.87E+06 1.16E+01 (early and late) 8 Containment bypass 2.88E-09 0.04% 1.53E+06 4.42E-03 Total 8.01E-06 1.17E+01

1. s represents a probabilistically insignificant value or a Class that is unaffected by the Type A ILRT.

2. The Class 1 frequency is reduced by the frequency of Class 3a and Class 3b in order to preserve total CDF.

Revision 2 Page 22 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Risk Impact Due to 15-Year Test Interval The risk contribution for a 15-year interval is calculated in a manner similar to the 10-year interval. The difference is in the increase in probability of leakage in Classes 3a and 3b. For this case, the value used in the analysis is a factor of 5 compared to the 3-year interval value, as described in Section 5.1.3. The Class 3a and 3b frequencies are calculated as follows:

Frqls~asr=15 2 reqc 3s27E-7

.. .. Fe~ 1 5 1 * (8.0 1E-6 -9.20OE-7)=3.7-15 .5 Fr ls1= *.

5 9.20E-7) 8.13E-8 Frq--sbly = ?qias * (8.01E-6 - =

The results of the calculation for a 15-year interval are presented in Table 5-11.

Table 5*-11 - Risk Profile for Once in 15 Year ILRT Class Description Frequency Contribution Population Dose Population (lyr) (%) (person-rem) Dose Rate (person-remlyr) 1 No containment failure 2 1.37E-06 17.12% 7.29E+03 1.00E-02 2 Large containment 2.19E-09 0.03% 2.34E+06 5.12E-03 isolation failures 3a Sml(liner slto breach)alrs 3.27E-07 4.08% 7.29E+04 2.38E-02 3b Large isolation failures 8.13E-08 1.02% 7.29E+05 5.93E-02 (liner breach) 4 Small isolation failures -

• failure to seal (type B) 5 Small isolation failures -

• 1d*

failure to seal (type C)

Containment isolation 6 failures (dependent failure,

• 1 personnel errors)

Severe accident 7 phenomena induced failure 6.23E-06 77.72% 1.87E+06 1.16E+01 (early and late) 8 Containment bypass 2.88E-09 0.04% 1.53E+06 4.42E-03 Total 8.01E-06 1.17E+01

1. E represents a probabilistically insignificant value or a Class that is unaffected by the Type A ILRT.

2. The Class I frequency is reduced by the frequency of Class 3a and Class 3b in order to preserve total CDF.

5.2.4 Step 4 - Determine the Change in Risk in Terms of LERF The risk increase associated with extending the ILRT interval involves the potential that a core damage event that normally would result in only a small radioactive release from an intact containment could, in fact, result in a larger release due to the increase in probability of failure to detect a pre-existing leak. With strict adherence to the EPRI guidance, 100% of the Class 3b contribution would be considered LERF.

Regulatory Guide 1.174 [Reference 41 provides guidance for determining the risk impact of plant-specific changes to the licensing basis. RG 1.174 [Reference 4] defines very small changes in risk as resulting in increases of CDF less than 10-6/year and increases in LERF less Revision 2 Page 23 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension than 10-7/year, and small changes in LERF as less than 10- 6/year. Since containment accident pressure is credited in support of ECCS performance to mitigate design basis accidents at MNGP, the ILRT extension may impact CDE. A detailed sensitivity study is performed and described in Section 5.3.4; this shows the ILRT extension has only a very small effect on CDF.

Therefore, the more relevant risk-impact metric is LERF.

For MNGP, 100% of the frequency of Class 3b sequences can be used as a very conservative first-order estimate to approximate the potential increase in LERF from the ILRT interval extension (consistent with the EPRI guidance methodology). Based on a 10-year test interval from Table 5-10, the Class 3b frequency is 5.42E-8/year; based on a 15-year test interval from Table 5-11, the Class 3b frequency is 8.13E-8/year. Thus, the increase in the overall probability of LERF due to Class 3b sequences that is due to increasing the ILRT test interval from 3 to 15 years is 6.51E-08/year. Similarly, the increase due to increasing the interval from 10 to 15 years is 2.71 E-8/year. As can be seen, even with the conservatisms included in the evaluation (per the EPRI methodology), the estimated change in LERE is within the criteria for a very small change when comparing the 15-year results to the current 10-year requirement and the original 3-year requirement. Table 5-12 summarizes these results.

Table 5-12 - Impact on LERF due to Extended Type A Testing Intervals ILRT Inspection Interval 3 Years (baseline) 10 Years 15 Years Class 3b (Type A LERF) 1.63E-08 5.42E-08 8.13E-08 ALERF (3 year baseline) 3.80E-08 6.51E-08 ALERF (10 year baseline) j 2.71E-08 The increase in the overall probability of LERF due to Class 3b sequences is less than 10-r.

Therefore, the ALERF is considered very small [Reference 4].

5.2.5 Step 5 - Determine the Impact on the Conditional Containment Failure Probability Another parameter that the NRC guidance in RG 1.174 [Reference 4] states can provide input into the decision-making process is the change in the conditional containment failure probability (CCFP). The CCFP is defined as the probability of containment failure given the occurrence of an accident. This probability can be expressed using the following equation:

CCFP1 -f (ncf)

CDF where f(ncf) is the frequency of those sequences that do not result in containment failure; this frequency is determined by summing the Class 1 and Class 3a results [Reference 24]. Table 5-13 shows the steps and results of this calculation. The difference in CCFP between the 3-year test interval and 15-year test interval is 0.812%.

Table 5-13 - Impact on CCFP due to Extended Type A Testing Intervals ILRT Inspection Interval 3 Years (baseline) 10 Years 15 Years f(ncf) (/yr) 1.76E-06 1.73E-06 1.70E-06 f(ncf)/CDF 0.220 0.215 0.212 CCFP 0.780 0.785 0.788 ACCFP (3 year baseline) , :4 j 0.474% 0.812%

ACCFP (10 year baseline) ;t::*:i':

.,  ;* 0.338%

Revision 2 Page 24 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension As stated in Section 2.0, a change in the CCFP of up to 1.5% is assumed to be small. The increase in the CCFP from the 3 in 10 year interval to I in 15 year interval is 0.812%. Therefore, this increase is judged to be very small.

5.2.6 Impact of Extension on Detection of Steel Liner Corrosion that Leads to Leakage An estimate of the likelihood and risk implications of corrosion-induced leakage of the steel liners occurring and going undetected during the extended test interval is evaluated using a methodology similar to the Calvert Cliffs liner corrosion analysis [Reference 5]. The Calvert Cliffs analysis was performed for a concrete cylinder and dome and a concrete basemat, each with a steel liner.

The following approach is used to determine the change in likelihood, due to extending the ILRT, of detecting corrosion of the containment steel liner [Section 5.1.5.1 of Reference 241.

This likelihood is then used to determine the resulting change in risk. Consistent with the Calvert Cliffs analysis, the following issues are addressed:

• Differences between the containment basemat and the containment cylinder and dome

• The historical steel liner flaw likelihood due to concealed corrosion

• The impact of aging

• The corrosion leakage dependency on containment pressure

• The likelihood that visual inspections will be effective at detecting a flaw Assumptions

• Based on a review of industry events, an Oyster Creek incident is assumed to be applicable to MNGP for a concealed shell failure in the floor. In the Calvert Cliffs analysis, this event was assumed not to be applicable and a half failure was assumed for basemat concealed liner corrosion due to the lack of identified failures (See Table 5-14, Step 1).

• The two corrosion events used to estimate the liner flaw probability in the Calvedt Cliffs previous analysis are assumed to still be applicable.

• Consistent with the Calvedt Cliffs analysis, the estimated historical flaw probability data period is also limited to 5.5 years to reflect the years since September 1996 when 10 CFR 50.55a started requiring visual inspection. Additional success data was not used to limit the aging impact of this corrosion issue, even though inspections were being performed prior to this date (and have been performed since the time frame of the Calvedt Cliffs analysis) (See Table 5-14, Step 1).

• Consistent with the Calvedt Cliffs analysis, the steel liner flaw likelihood is assumed to double every five years. This is based solely on judgment and is included in this analysis to address the increased likelihood of corrosion as the steel liner ages (See Table 5-14, Steps 2 and 3). Sensitivity studies are included that address doubling this rate every ten years and every two years.

• In the Calvedt Cliffs analysis, the likelihood of the containment atmosphere reaching the outside atmosphere, given that a liner flaw exists, was estimated as 1.1% for the cylinder and dome, and 0.11% (10% of the cylinder failure probability) for the basemat. These values were determined from an assessment of the probability versus containment pressure. For MNGP, the containment design pressure is 56 psig [Reference 271.

Probabilities of 1% for the cylinder and dome, and 0.1% for the basemat are used in this analysis, and sensitivity studies are included in Section 5.3.2 (See Table 5-14, Step 4).

• Consistent with the Calvedt Cliffs analysis, the likelihood of leakage escape (due to crack formation) in the basemat region is considered to be less likely than the containment Revision 2 Page 25 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension cylinder and dome region (See Table 5-14, Step 4).

• Consistent with the Calvert Cliffs analysis, a 5% visual inspection detection failure likelihood given the flaw is visible and a total detection failure likelihood of 10% is used.

To date, all liner corrosion events have been detected through visual inspection (See Table 5-14, Step 5).

• Consistent with the Calvert Cliffs analysis, all non-detectable containment failures are assumed to result in early releases. This approach avoids a detailed analysis of containment failure timing and operator recovery actions.

Table 5 Steel Liner Corrosion Base Case Step Description Containment Cylinder and Containment Basemat Dame (85%) (15%)

Historical liner flaw likelihood Events: 2 Events: 1 Failure data: containment location (Brunswick 2 and North Anna 2) 1 / (70 x 5.5) = 2.60E-03 specific 2 /(70 x 5.5) = 5.19E-03 Success data: based on 70 steel-lined containments and 5.5 years since the 10CFR 50.55a requirements of periodic visual inspections of containment surfaces Year Failure rate Year Failure rate Aged adjusted liner flaw likelihood During the 15-year interval, assume 1 2.05E-03 1 1.03E-03 failure rate doubles every five years average 5-10 5.19E-03 average 5-10 2.60E-03 2 (14.9% increase per year). The 15 1.43E-02 15 7.14E-03 average for the 5th to 10th year set to the historical failure rate. 15 year average =6.44E-03 15 year average =3.22E-03 Increase in flaw likelihood between 3 and 15 years Uses aged adjusted 0.73% (i to 3 years) 0.36% (i to 3 years) 3 liner flaw likelihood (Step 2), 4.18% (i to 10 years) 2.08% (i to 10 years) assuming failure rate doubles every 9.66% (i to 15 years) 4.82% (i to 15 years) five years.

4 Likelihood of breach in containment 1% 0.1%

given liner flaw 10%

5% failure to identify visual flaws plus 5% likelihood that the flaw is Viul npcto dtcio aiue not visible (not through-cylinder 100%

likelihood btcudbdeetdyIL). Cannot be visually inspected All events have been detected through visual inspection. 5%

visible failure detection is a conservative assumption.

0.00073% (3 years) 0.000360% (3 years) 0.73% x 1%x10% 0.36% xO.1% xl00%

Likelihood of non-detected 0.00418% (10 years) 0.00208% (10 years) 6 containment leakage (Steps 3 x 4 x 41%~1 0 .8 .%x10 0.00966% (15 years) 0.00482% (15 years) 9.66% xl% xI1% 4.82% xO.1% x 10%

The total likelihood of the corrosion-induced, non-detected containment leakage is the sum of Revision 2 Page 26 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Step 6 for the containment cylinder and dome, and the containment basemat, as summarized below for MNGP.

Table 5 Total Likelihood on Non-Detected Containment Leakage Due to Corrosion for MNGP Description At 3 years: 0.00073% + 0.000360% = 0.00109%

At 10 years: 0.00418% + 0.00208% = 0.00626%

At 15 years: 0.00966% + 0.00482% = 0.01448%

The above factors are applied to those core damage accidents that are not already independently LERF or that could never result in LERF.

The two corrosion events that were initiated from the non-visible (backside) portion of the containment liner used to estimate the liner flaw probability in the Calvert Cliffs analysis are assumed to be applicable to this containment analysis. These events, one at North Anna Unit 2 (September 1999) caused by timber embedded in the concrete immediately behind the containment liner, and one at Brunswick Unit 2 (April 1999) caused by a cloth work glove embedded in the concrete next to the liner, were initiated from the nonvisible (backside) portion of the containment liner. A search of the NRC website LER database identified two additional events have occurred since the Calvert Cliffs analysis was performed. In January 2000, a 3/16-inch circular through-liner hole was found at Cook Nuclear Plant Unit 2 caused by a wooden brush handle embedded immediately behind the containment liner. The other event occurred in April 2009, where a through-liner hole approximately 3/8-inch by 1-inch in size was identified in the Beaver Valley Power Station Unit 1 (BVPS-1) containment liner caused by pitting originating from the concrete side due to a piece of wood that was left behind during the original construction that came in contact with the steel liner. Two other containment liner through-wall hole events occurred at Turkey Point Units 3 and 4 in October 2010 and November 2006, respectively. However, these events originated from the visible side caused by the failure of the coating system, which was not designed for periodic immersion service, and are not considered to be applicable to this analysis. More recently, in October 2013, some through-wall containment liner holes were identified at BVPS-1, with a combined total area of approximately 0.395 square inches. The cause of these through-wall liner holes was attributed to corrosion originating from the outside concrete surface due to the presence of rayon fiber foreign material that was left behind during the original construction and was contacting the steel liner

[Reference 28]. For risk evaluation purposes, these five total corrosion events occurring in 66 operating plants with steel containment liners over a 17.1 year period from September 1996 to October 4, 2013 (i.e., 5/(66"17.1) = 4.43E-03) are bounded by the estimated historical flaw probability based on the two events in the 5.5 year period of the Calvert Cliffs analysis (i.e.,

2/(70"5.5) = 5.19E-03) incorporated in the EPRI guidance.

5.3 Sensitivities 5.3.1 Potential Impact from External Events Contribution An assessment of the impact of external events is performed. The primary purpose for this investigation is the determination of the total LERF following an increase in the ILRT testing interval from 3 in 10 years to I in 15 years.

Although MNGP is not transitioning to NFPA 805 licensing basis for fire protection, MNGP created a Fire PRA (FPRA) model following instruction from NUREG/CR-6850. Therefore, the Fire PRA model is deemed applicable for this calculation.

Revision 2 Page 27 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension The Fire PRA model Revision 3 was used to obtain the fire CDF and LERE values [Reference 36]. As described in Section 5.1.3, consideration is made to not apply failure probabilities on those cases that are already LERF scenarios. Therefore, LERF contributions from CDF are removed from the calculation of Class 3b contribution. The following shows the calculation for Class 3b:

0.5

~ ~lssb..C..-LRE * (4.11E 5.3 1E-6) :8.2 1E-8 10 10 0.5 Freqcjass3bi~yr --

• Pctass3b * (CDF - LERF) = * *(4.11E-5 -5.31E-6>= 2.74E-7 Frqts~l~ =

• Pctass~, * (CDF - LERF) = 5*--1 * (4.11E-5 - 5.31E-6)= 4.10E-7 The Seismic PRA results from the IPEEE Seismic Margins Analysis do not result in estimate of CDF [Reference 32]. The 2014 Seismic Reevaluations for operating reactor sites [Reference 35] states the conclusions reached in 2010 by G1-199 [Reference 34] remain valid for estimating Seismic CDF at plants in the Central and Eastern United States, which includes MNGP. The most conservative Seismic CDF reported in Table D-1 of Reference 34 is 1 .90E-5. Applying the internal event LERF/CDF ratio to the seismic CDF yields an estimated seismic LERF of 2.18E-6, as shown by the equation below.

LERFseismic CDFseismic

• LERFIE / CDFIE= 1.90E-5

• 9.20E-7 / 8.01E-6 = 2.18E-6 Subtracting seismic LERF from CDF, the Class 3b frequency can be calculated by the following formulas:

Freqctass3 b = class3b * (CDF - LERF) = 21 * (1.90E-5 -2.18E-6) =3.86E-8 10 10 0.5 Freqctass3 bi°Yr 73"*cass3b * (CDF -LERF) 3 21.9E .8-)12E 1515 0.5 Frqlasb~y *~~a.. CD LR) .. * -- * (1.90E-5 -2.18E-6)= 1.93E-7 Frectas~bsyr3" ctss~* *(CD LEF)3 218 The MNGP IPEEE analysis of high winds, tornadoes, external floods, transportation accidents, nearby facility accidents, and other external hazards resulted in screening these events from further consideration. Per Section C.1 .3 of Reference 33, screened hazards contribute less than 10-/year to COF; therefore, for this sensitivity a conservative CDF. of 10-6 is used for all other external events. Applying the internal event LERF/CDF ratio to the other external events COF yields an estimated high wind LERE of 1.15E-7. Again subtracting LERF from CDF, the Class 3b frequency can be calculated by the following formulas:

Frectss~ =Pcpass3b * (CDF - LERF) = o21 * (1.OE 1.15E-7) =2.03E-9 218 10 10 0.5 Freqcjass3 bl°yr = 7

• Pcasb* (CDF - LERF) = -- * --1 * (1.0E 1.15E-7) = 6.77E-9 13521 .8 Frq~asbly 7*~c.. (D -LRF .. * -- * (1.OE-6 - 1.15E-7) = 1.0 2E-8 The fire, seismic, and high wind contributions to Class 3b frequencies are then combined to obtain the total external event contribution to Class 3b frequencies. The change in LERF is calculated for the 1 in 10 year and 1 in 15 year cases and the change defined for the external events in Table 5-16.

Page 28 of 142 Revision 2 Revision2 Page 28 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Table 5-16 - MNGP External Event Impact on ILRT LERF Calculation Hazard EPRI Accident Class 3b Frequency LERF Increase (from 3 perl10years to 1 3 per 10 year I per 10 year I per15 years per 15 years)

External Events 1.23E-07 4.09E-07 6.13E-07 4.91 E-07 Internal Events 1.63E-08 5.42E-08 8.13E-08 6.51 E-08 Comnbin ed 1.39 E-07 4.63E-07 6.95 E-07 5.56 E-07 The internal event results are also provided to allow a composite value to be defined. When both the internal and external event contributions are combined, the total change in LERE of 5.56E-7 meets the guidance for small change in risk, as it exceeds 1.0E-7Iyr and remains less than 1 .0E-6 change in LERF. For this change in LERF to be acceptable, total LERF must be less than 1 .0E-5. The total LERF value is calculated below:

LERF = LERFinternal + LERFseismic + LERFfire + LERFoth~er + LERFcass3Bincreas

=9.20E-7/yr + 2.18E-6/yr + 5.31E-6/yr + 1.15E -07/yr + 5.56E-7/yr= 9.08E-6/yr As specified in Regulatory Guide 1.174 [Reference 4], since the total LERF is less than 1.0E-5, it is acceptable for the ALERF to be between 1.0E-7 and 1 .0E-6.

5.3.2 Potential Impact from Steel Liner Corrosion Likelihood A quantitative assessment of the contribution of steel liner corrosion likelihood impact was performed for the risk impact assessment for extended ILRT intervals. As a sensitivity run, the internal event CDF was used to calculate the Class 3b frequency. The impact on the Class 3b frequency due to increases in the ILRT surveillance interval was calculated for steel liner corrosion likelihood using the relationships described in Section 5.2.6. The EPRI Category 3b frequencies for the 3 per 10-year, 10-year, and 15-year ILRT intervals were quantified using the internal events COF. The change in the LERF, change in CCFP, and change in Annual Dose Rate due to extending the ILRT interval from 3 in 10 years to 1 in 10 years, orto 1 in 15 years are provided in Table 5-1"7 -Table 5-19. The steel liner corrosion likelihood was increased by a factor of 1000, 10000, and 100000. Except for extreme factors of 10000 and 100000, the corrosion likelihood is relatively insensitive to the results.

Page 29 of 142 Revision 22 Revision Page 29 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5400-CAC~0 Evauaton f Rik Sgniicace o Pemannt IRT xtesio Table 5-17 - Steel Liner Corrosion Sensitivity Case: 3B Contribution 3b 3b 3b LERF LERF LERF Frequency Frequency Frequency Increase Increase Increase (3-per-l0 (1-per-10 (I-per-I5 (3-per-l0 to (3-per-l0 to (I-per-10 to year JLRT) year ILRT) year ILRT) I-per-10) 1-per-IS5) 1-per-I 5)

Internal Event 3B 1.63E-08 5.42E-08 8.13E-08 3.80E-08 6.51E-08 2.71E-08 Contribution Corrosion Likelihood 3.77E-11 1.32E-10 2.14E-10 9.44E-11 1.76E-10 8.14E-11 X 1000 Corrosion Likelihood 4.14E-11 2.02E-10 4.57E-10 1.61E-10 4.15E-10 2.54E-10 X 10000 Corrosion Likelihood 7.80E-11 9.03E-10 2.89E-09 8.25E-10 2.81E-09 1.98E-09 X 100000 Table 5-18 - Steel Liner Corrosion Sensitivity: CCFP CCFP CCFP CCFP CCFP CCFP CCFP Increase Increase Increase (3-per-l0 (I-per-l0 (1-per-IS5 (3-per-l 0 to (3-per-l0 to (I-per-l0 to year ILRT) year ILRT) year ILRT) I-per-l0) 1-per-I5) 1-per-I15)

Baslin 7.80E-01 7.85E-01 7.88E-01 4.74E-03 8.12E-03 3.38E-03 Corrosion Likelihood 7.80E-01 7.85E-01 7.88E-01 4.79E-03 8.21 E-03 3.42E-03 X 1000 Corrosion Likelihood 7.80E-01 7.85E-01 7.89E-01 5.25E-03 9.01 E-03 3.75E-03 X 10000 Corrosion Likelihood 7.82E-01 7.92E-01 7.99E-01 9.90E-03 1.70E-02 7.07E-03 X 100000 Table 5-19 - Steel Liner Corrosion Sensitivity: Dose Rate Dose Rate Dose Rate Dose Rate Dose Rate Dose Rate Dose Rate Increase Increase Increase (3-per-b0 (I-per-l0 (I-per-IS year (3-per-10 to (3-per-l0 to I- (I-per-l0 to year ILRT) year ILRT) ILRT) I-per-l0) per-IS) I-per-IS)

Dose Rate 1.19E-02 3.95E-02 5.93E-02 2.77E-02 4.74E-02 1.98E-02 Corrosion Likelihood 1.20E-02 4.20E-02 6.79E-02 3.00E-02 5.59E-02 2.59E.-02 X 1000 Corrosion Likelihood 1.32E-02 6.43E-02 1.45E-01 5.11E-02 1.32E-01 8.09E-02 X 10000 Corrosion Likelihood 2.48E-02 2.87E-01 9.1 8E-01 .-2.62 E-01 8.93E-01 .6.31 E-01 X 100000 5.3.3 Expert Elicitation Sensitivity Another sensitivity case on the impacts of assumptions regarding pre-existing containment defect or flaw probabilities of occurrence and magnitude, or size of the flaw, is performed as Revision 2 Page 30 of 142

54003-CALC-02 Evaluation of Risk Siqnificance of Permanent ILRT Extension described in Reference 24. In this sensitivity case, an expert elicitation was conducted to develop probabilities for pre-existing containment defects that would be detected by the ILRT only based on the historical testing data.

Using the expert knowledge, this information was extrapolated into a probability-versus-magnitude relationship for pre-existing containment defects [Reference 24]. The failure mechanism analysis also used the historical ILRT data augmented with expert judgment to develop the results. Details of the expert elicitation process and results are contained in Reference 24. The expert elicitation process has the advantage of considering the available data for small leakage events, which have occurred in the data, and extrapolate those events and probabilities of occurrence to the potential for large magnitude leakage events.

The expert elicitation results are used to develop sensitivity cases for the risk impact assessment. Employing the results requires the application of the ILRT interval methodology using the expert elicitation to change the probability of pre-existing leakage in the containment.

The baseline assessment uses the Jeifreys non-informative prior and the expert elicitation sensitivity study uses the results of the expert elicitation. In addition, given the relationship between leakage magnitude and probability, larger leakage that is more representative of large early release frequency, can be reflected. For the purposes of this sensitivity, the same leakage magnitudes that are used in the basic methodology (i.e., 10 L2 for small and 100 La for large) are used here. Table 5-20 presents the magnitudes and probabilities associated with the Jeifreys non-informative prior and the expert elicitation used in the base methodology and this sensitivity case.

Table 5 MNGP Summary of ILRT Extension Using Expert Elicitation Values (from Reference 24)

Leakage Size (La) Expert Elicitation Mean Probability of Occurrence Percent Reduction 10 3.88E-03 86%

100 2.47E-04 91%

Taking the baseline analysis and using the values provided in Table 5-9 - Table 5-1 1 for the expert elicitation sensitivity yields the results in Table 5-21.

Table 5 MNGP Summary of ILRT Extension Using Expert Elicitation Values Accident ILRT Interval Cas3 per 10 Years 1 per 10 Years I per 15 Years Base Adjusted Dose Dose Rate Frequency Dose Rate Frequency Dose Rate Frequency Base (person- (person- (person- (person-Frequency remn) remlyr) rem/yr) rem/yr) 1 1.78E-06 1.75E-06 7.29E+03 1.28E-02 1.68E-06 1.23E-02 1.63E-06 1.19E-02 2 2.19E-09 2.19E-09 2.34E+06 5.12E-03 2.19E-09 5.12E-03 2.19E-09 5.12E-03 3a N/A 2.75E-08 7.29E+04 2.01E-03 9.17E-08 6.69E-03 1.38E-07 1.00E-02 3b N/A 1.75E-09 7.29E+05 1.28E-03 5.84E-09 4.26E-03 8.76E-09 6.39E-03 4-6 0.O0E+00 0.00E+00 0.00E+00 0.00E+O0 0.00E+00 0.00E+00 0.O0E+00 0.00E+00 7 6.23E-06 6.23E-06 1.87E+06 1.16E+01 6.23E-06 1.16E+01 6.23E-06 1.16E+01 8 2.88E-09 2.88E-09 1.53E+06 4.42E-03 2.88E-09 4.42E-03 2.88E-09 4.42E-03 Totals 8.01E-06 8.01E-06 6.55E+06 1.16E+01 8.01E-06 1.17E+01 8.01E-06 1.17E+01 ALERF (3 per N/A 4.09E-09 7.01E-09 10 yrs base)

ALERF (1 per N/A N/A 2.92E-09 10 yrs base)

CCFP 77.81% 77.86% 77.89%

Revision 2 Page 31 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension The results illustrate how the expert elicitation reduces the overall change in LERF and the overall results are more favorable with regard to the change in risk.

5.3.4 Containment Accident Pressure Sensitivity In general, CDF is not significantly impacted by an extension of the ILRT interval. However, since containment accident pressure is credited in support of EGOS performance to mitigate design basis accidents at MNGP, the ILRT extension may impact GOF. Therefore, a detailed sensitivity study was performed to quantify the potential effect on GDF.

This sensitivity case investigates the impact of containment accident pressure (CAP) credit on low pressure (LP) ECCS NPSH determination during design-basis accidents. This sensitivity study is performed similarly to the sensitivity study discussed in detail in Appendix F of the extended power uprate (EPU) risk assessment [Reference 39]. This sensitivity study assesses the impact on plant risk if containment accident pressure is assumed not present (e.g.,

postulated pre-existing primary containment failure) during the postulated accident scenarios such that inadequate LP EGOS pump NPSH occurs. This sensitivity is performed by modification and quantification of the Internal Events and Fire PRA models. As described in Sections F.2 and F.5 of Reference 39, there are two types of scenario sequences that can lead to GAP failure:

1. LOGA initiator, suppression pool cooling (SPC) not initiated within 10 minutes, containment isolation failure at 0 minutes, operators fail to throttle LP EGOS flow within 10 minutes, existing plant conditions result in NPSH (probability =0.1; discussion in Section F.2 of Reference 39), and LP EGGS pumps fail due to inadequate NPSH

2. LOGA initiator, one division of EGGS available, SPO not initiated within 10 minutes, containment isolation failure at 0 minutes, existing plant conditions result in NPSH (probability = 0.5; discussion in Section F.2 of Reference 39), and LP EGGS pumps fail due to inadequate NPSH For the Fire PRA sensitivity, the LOGA initiator is a fire-induced spurious open failure of two or more relief valves. For the IE PRA sensitivity, the LOGA initiator is modeled conservatively as either a large or medium LOGA. The basic event stating that SPC is not initiated within t=10 minutes is conservatively assigned a 1.0 probability, and reflects the assumption of being a short-term scenario.

The human error probability basic event for operator failure to throttle LP EGGS is calculated using the same human reliability analysis methodology (i.e., NUREG/CR4772) used in the MNGP PRA:

• Per the plant EOPs and operator training, the operators will throttle EGGS flow as necessary per NPSH curves existing on the EOP flowcharts

• The time of the initial cue to the operators for the need to throttle EGGS flow is estimated at t=5 minutes for the first scenario. This is the point at which available head is nearing the required NPSH and which flow fluctuations may be notable to the operator.

• The end of the available time window to the operator is conservatively estimated at t=1 0 minutes and is the time at which pump head collapse is assumed to occur. This time is judged conservative.

• Manipulating LP EGGS pump flow is a manual action performed at the main control panels in the control room. The time required to travel to the proper panel(s) and perform the flow manipulation is estimated at 1 min.

• Therefore, the available diagnosis time to the operator is (10 mmn - 5 min.) - 1 min = 4 minutes.

Page 32 of 142 Revision 22 Revision Page 32 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension

• Using the MNGP PRA HRA Methodology (i.e., NUREG/CR-4772), the diagnosis error contribution for a diagnosis time frame of 4 minutes is 2.5E-1; and the manipulation error rate for performing the action is 5E-3. The total HEP for failure to throttle is 2.55E-1.

In conditions of inadequate NPSH, the pumps will experience surging and cavitation but will not necessarily fail. However, this analysis conservatively assumes the low pressure ECCS pumps fail with a probability of 1.0 given inadequate NPSH and failure to throttle. The probability of an unisolated containment at the time of the accident is modeled as the Class 3b pre-existing leak probability. Two separate probabilities are used to obtain a change in risk: 2.3E-3 for the baseline case (as discussed in Section 5.1.3) and 5

• 2.3E-3 = 1.15E-2 for the extended 15-year ILRT interval. In addition to credit for containment accident pressure for ECOS NPSH, the MNGP PRA model credits containment venting after a loss of decay heat removal. The model includes logic for controlled containment venting and uncontrolled containment venting. The Class 3b pre-existing leak probability is an additional chance that venting is uncontrolled.

Uncontrolled venting precludes credit for LPCI and Core Spray as long-term low pressure makeup sources.

Table 5-22 shows the results of the CAP sensitivity for the Internal Events and Fire PRA. The results, which are based on the conservative modeling described in the preceding section, show the increase in the overall CDF due to increased likelihood of pre-existing leakages causing loss of sufficient LP ECCS NPSH is 9.83E-8, which is much is less than 106. Therefore, the ACDF is considered very small [Reference 41.

Table 5-22 - Impact on CDF due to Extended Type A Testing Intervals and Loss of LP ECCS NPSH CAP Risk Metric Baseline Risk Sensitivity Risk A Change  % Change (3-year ILRT interval) (15-year ILRT interval)

IE CDF 8.O1E-6 8.11E-6 9.51E-8 1.19%

Fire CDF 4.11E-5 4.11E-5 3.19E-9 0.0078%

Combined ODE 4.91 E-5 4.92E-5 9.83E-8 0.20%

With the ACDF assumed to result directly in LERE, the ALERF is also 9.83E-08. When this ALERF is considered with the ALERE calculated in section 5.2.4 for internal events, the total ALERE is 9.83E-08 + 6.51 E-08 = 1.63E-07, which is slightly above the Region Ill (very small) threshold and into Region II (small) for ALERF. Summing the delta LERE based on the EPRI method and this CAP sensitivity is conservative because not all of the increase in CDF would also be increase in LERF. Given this conservatism, the conservatisms noted in this CAP sensitivity, and the ILRT methodology of considering a Class 3b failure as a LERF contributor, the total ALERF when including the ACDF estimate from a loss of CAP is considered to be very small and the results developed in section 5.2.4 are considered representative for the total.

ALERF due to the ILRT interval extension.

Page 33 of 142 Revision 22 Page 33 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5.3.5 Power Supply Coordination Sensitivity This sensitivity study is performed to assess the quantitative impact from the open status of Fire PRA F&O 5-5 (details of F&O 5-5 are in Section A.4), regarding a small set of power supplies, credited in the Fire PRA, where a coordination study does not exist. Without verified coordination, a fault on a load cable may trip the power supply feed breaker supplying power to the bus that feeds the load. Since the power supply feeding the load may not be coordinated, it is assumed that the fault may also trip the breaker supplying the next upstream power supply.

In order to assess the quantitative impact of possibly finding some circuits are not coordinated, the sensitivity study is performed by modeling the following:

• Finding the cables associated with loads on power supplies without verified coordination.

• Finding the fire scenarios that impact those cables.

• Failing the power supply that supplies the load with impacted cables, to simulate opening of the power supply feed beaker from the next upstream bus to the power supply with the load.

• Failing the next power supply's feed breaker on the bus upstream of the feed breaker to the power supply with the impacted load, since lack of coordination may cause the upstream feeder to trip.

The Fire PRA model was adjusted to model failure of these power supplies and quantified. The specific power supplies and function codes are listed in Table 5-6 of Reference 40.

As shown in Table 5-23, this sensitivity study shows a very small increase in the Fire CDF and LERF. Therefore, ther'e is negligible impact from this open F&O on the usage of the Fire PRA CDF and LERF in the ILRT Extension Risk Analysis.

Table 5 Power Supply Coordination Sensitivity: Fire PRA Results Risk Metric Baseline Risk Sensitivity Risk  % Change CDF 4.11E-5 4.12E-5 0.20%

LERF 5.31E-6 5.39E-6 1.43%

Page 34 of 142 Revision 22 Page 34 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 6.0 RESULTS The results from this ILRT extension risk assessment for MNGP are summarized in Table 6-1.

Table 6-1 - ILRT Extension Summary Class Dose Base Case Extend to Extend to (person-remn) 3 in 10 Years 1 in 10 Years 1 in 15 Years CDF/Year Person- CDFIYear Person- CDFIYear Person-Rem/Year Rein/Year Rem/Year 1 7.29E+03 1.70E-06 1.24E-02 1.51E-O6 1.10E-02 1.37E-06 1.00E-02 2 2.34E+06 2.19E-09 5.12E-03 2.19E-09 5.12E-03 2.19E-09 5.12E-03 3a 7.29E+04 6.54E-08 4.77E-03 2.18E-07 1.59E-02 3.27E-07 2.38E-02 3b 7.29E+05 1.63E-08 1.19E-02 5.42E-08 3.95E-02 8.13E-08 5.93E-02 4-6 0.00E+00 0.00E+00 0.00E+00 0.00E+00 0.00E+00 0.00E+00 0.00E+00 7 1.87E+06 6.23E-06 1.16E+01 6.23E-06 1.16E+01 6.23E-06 1.16E+01 8 1.53E+06 2.88E-09 4.42E-03 2.88E-09 4.42E-03 2.88E-09 4.42E-03 Total 8.01E-06 1.17E+0t 8.01E-06 1.17E+01 8.01E-06 1.17E+01 ILRT Dose Rate from 3a and 3b___________ __________

ATotal From 3 Years N/A 3.74E-02 6.41 E-02 Dose Rate From 10 Years N/A N/A 2.67E-02

%ADose From 3 Years N/A 0.321% 0.550%

Rate From 10 Years N/A N/A 0.228%

3b Frequency (LERF)______________________

ALERF From 3 Years N/A 3.80E-08 I 6.51E-08 From 10 Years N/A LN/A j 2.71E-08 CCFP %_________ _______ __

ACCFP%

From 3 Years N/A F 0.474% 1 0.812%

From 10 Years N/A LN/A J 0.338%

Page 35 of 142 Revision 22 Revision Page 35 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension

7.0 CONCLUSION

S AND RECOMMENDATIONS Based on the results from Section 5.2 and the sensitivity calculations presented in Section 5.3, the following conclusions regarding the assessment of the plant risk are associated with extending the Type A ILRT test frequency to 15 years:

Regulatory Guide 1.174 [Reference 4] provides guidance for determining the risk impact of plant-specific changes to the licensing basis. Regulatory Guide 1.174 defines very small changes in risk as resulting in increases of CDF less than 1.OE-O6/year. Since MNGP relies on containment accident pressure for ECOS NPSH during certain design basis accidents, extending the ILRT interval may impact CDF. The MNGP PRA model was used to estimate the potential change in CDF if containment accident pressure was unavailable due to a pre-existing containment leak. The containment accident pressure sensitivity study performed in Section 5.3.4 conservatively estimates that the potential increase in the overall CDF would be 9.83E-08, which is "very small" using the acceptance guidelines of Regulatory Guide 1.174 [Reference 41.

• Regulatory Guide 1.174 [Reference 4] provides guidance for determining the risk impact of plant-specific changes to the licensing basis. Regulatory Guide 1.174 defines very small changes in risk as resulting increases in LERF less than I1.OE-07/year. The increase in LERF resulting from a change in the Type A ILRT test interval from 3 in 10 years to 1 in 15 years is estimated as 6.51 E-08/year using the EPRI guidance; this value increases negligibly ifthe risk impact of corrosion-induced leakage of the steel liners occurring and going undetected during the extended test interval is included. As such, the estimated change in LERF is determined to be "very small" using the acceptance guidelines of Regulatory Guide 1.174 [Reference 4].

• The effect resulting from changing the Type A test frequency to 1-per-15 years, measured as an increase to the total integrated plant risk for those accident sequences influenced by Type A testing, is 0.064 person-rem/year. EPRI Report No. 1009325, Revision 2-A [Reference 24] states that a very small population dose is defined as an increase of < 1.0 person-rem per year, or < 1% of the total population dose, whichever is less restrictive for the risk impact assessment of the extended ILRT intervals. The results of this calculation meet these criteria. Moreover, the risk impact for the ILRT extension when compared to other severe accident risks is negligible.

• The increase in the conditional containment failure probability from the 3 in 10 year interval to I in 15 year interval is 0.812%. EPRI Report No. 1009325, Revision 2-A

[Reference 24] states that increases in CCFP of -<1.5% is very small. Therefore, this increase is judged to be very small.

Therefore, increasing the ILRT interval to 15 years is considered to be insignificant since it represents a very small change to the MNGP risk profile.

Previous Assessments The NRC in NUREG-1493 [Reference 6] has previously concluded that:

• Reducing the frequency of Type Atests (ILRTs) from 3 per 10 years to 1 per 20 years was found to lead to an imperceptible increase in risk. The estimated increase in risk is very small because ILRTs identify only a few potential containment leakage paths that cannot be identified by Type B or Type C testing, and the leaks that have been found by Type A tests have been only marginally above existing requirements.

Page 36 of 142 Revision 22 Page 36 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension

• Given the insensitivity of risk to containment leakage rate and the small fraction of leakage paths detected solely by Type A testing, increasing the interval between integrated leakage-rate tests is possible with minimal impact on public risk. The impact of relaxing the ILRT frequency beyond 1 in 20 years has not been evaluated. Beyond testing the performance of containment penetrations, ILRTs also test integrity of the containment structure.

The findings for MNGP confirm these general findings on a plant-specific basis considering the severe accidents evaluated for MNGP, the MNGP containment failure modes, and the local population surrounding MNGP.

Page 37 of 142 Revision 22 Revision Page 37 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension A. APPENDIX A: PRA TECHNICAL ADEQUACY A.1. Internal Events PRA Quality Statement for Permanent 15-Year ILRT Extension The MNGP internal events PRA model (Revision 3.2) is used to calculate CDF and LERF for the permanent 15-year ILRT extension. Any elements of the supporting requirements detailed in ASME/ANS RA-Sa-2009 [Reference 41] that could be significantly affected by the application are required to meet Capability Category II requirements.

The internal events PRA provides an adequate base model for the development of the permanent 15-year ILRT extension. The MNGP PRA Peer Review was performed in April 2013 using the NEI 05-04 process [Reference 57], the ASME PRA Standard [Reference 41] and Regulatory Guide 1.200, Rev. 2 [Reference 55]. The purpose of this review was to provide a method for establishing the technical adequacy of the PRA for the spectrum of potential risk-'

informed plant licensing applications for which the PRA may be used. The 2013 MNGP PRA Peer Review was a full-scope review of the Technical Elements of the internal events and internal flood, at-power PRA.

The ASME PRA Standard has 325 individual SRs for the Internal Events At-Power PRA (Part 2)

[Reference 41], and Internal Flood At-Power PRA (Part 3). The MNGP Peer Review included all these SRs. Twelve SRs were judged to be not applicable. Of the remaining 313 ASME PRA Standard SRs, 93% are supportive of Capability Category II or greater [Reference 37].

Section A.3 presents an assessment of all ASME/ANS PRA Standard [Reference 41] supporting requirements that were assessed to be "Not Met" at Capability Category II in the 2013 peer review or were assessed to be "Met" but had related Findings. F&Os from the 2013 peer review have been resolved. Therefore, the MNGP Internal Events PRA was judged to meet Capability Category II consistent with RG 1.200 guidance.

A.2. Fire PRA Quality Statement for Permanent 15-Year ILRT Extension The MNGP Fire Probabilistic Risk Assessment (FPRA) Peer Review was performed March 2-6, 2015 at the Xcel Energy Offices in Minneapolis using the NEI 07-12 process [Reference 56], the ASME PRA Standard [Reference 41], and Regulatory Guide 1.200, Rev. 2 [Reference 55]. The purpose of this review was to establish the technical adequacy of the FPRA for the spectrum of potential risk-informed plant licensing applications for which the FPRA may be used. The 2015 MNGP FPRA Peer Review was a full-scope review of all of the technical elements of the MNGP at-power January 2015 Rev. Ia Fire PRA against all technical elements in Section 4 of the ASME/ANS Combined PRA Standard, including the referenced internal events Supporting Requirements (SRs) in Section 2 of the ASME/ANS Combined PRA Standard [Reference 41].

The Peer Review team consisted of six team members, with extensive qualifications in all areas of FPRA as required by NEI 07-12 [Reference 56] and one working observer. The team members experience averaged over 20 years in PRA or Fire Protection, with extensive experience in FPRA, the FPRA Section of the Standard, and NUREG/CR-6850.

The Fire PRA Section of the ASME PRA Standard has 182 individual SRs, and references 237 individual SRs in the internal events PRA section of the Standard; the MNGP Peer Review included all of the SRs and all applicable reference SRs (see Table A.2-1). For the assessment of the reviewed ASME PRA Standard SRs, 102 unique Facts and Observations (F&Os) have been generated by the Peer Review team, 73 were peer review Findings, 28 were Suggestions, and one was considered a best practice. There were no "Unreviewed Analysis Methods" identified during the review. One F&O (5-5) remains open and is addressed by a sensitivity analysis in Section 5.3.5. The rest of the F&Os have been resolved as not affecting the ILRT extension analysis. Section A.4 presents the Findings and their resolutions.

Revision 2 Page 38 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Table A.2-1 - MNGP Fire PRA Assessment Capability Categorie es#SRs  % TotalISRs  % Assessed SRs Not Met (I, II, or Ill) 53 12.65% 19.56%

6 1.43% 2.21%

I'l 10 2.39% 3.69%

II 23 5.49% 8.49%

19 4.53% 7.01%

III 1 0.24% 0.37%

Met (All) 159 37.95% 58.67%

Not Reviewed 0 0% N/A Not Applicable 148 35.32% N/A Total 419 100% 100%

Page 39 of 142 Revision Revision 2 Page 39 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension A.3. Monticello PRA Response to RG 1.200 Peer Review Findings Change Number: MT-I13-0025 (IE)

Brief Problem

Description:

ASEP is used for assessment of all pre-initiator HFEs. A detailed assessment was not used for significant HFEs.

F&O Number: 1-6 Technical Element: HR Detailed Problem

Description:

ASEP is used for assessment of all pre-initiator HFEs. A detailed assessment was not used for significant HFEs. The standard defines "significant basic event: a basic event that contributes significantly to the computed risks for a specific hazard group. For internal events, this includes any basic event that has an

.FV importance greater than 0.005 or a RAW importance greater than 2. (See Part 2 Requirements DA-C13, DA-D1, DA-03, DA-D5, DA-D8, HR-D2, and HR-G1.)" For examples of pre-initiator important HEPs see Table E-1 of PRA-MT-QU. (This F&O originated from SR HR-D2)

Proposed Solution: Use detailed assessment for significant pre-initiator HFEs, e.g., THERP Risk Impact: Specific requirement for Cat II not met.

Actual Solution:

Significant pre-initiator HEPs, as found in the MNGP Rev 3.00 model, we re-evaluated with the THERP methodology. The following significant pre-initiator HEPs were identified in the Rev 3.0D model:

IPTP207WXZ, KCHV-SF-9Z, SPEP111 AXZ, and SPEPi111BXZ. Pre-initiator HEP KCHT8089CZ was also significant but was determined to be modeled less accurately by the THERP methodology and hence the detailed ASEP methodology was retained. KCHTB089CZ is a miscalibration pre-initiator HFE. In the THERP methodology under Execution Steps there really is no appropriate Error of Commission to choose for miscalibration errors, so Basic Error of Commission was chosen which has a high value of 1 E-

02. Using the THERP methodology and not applying any testing recovery credit, the HEP was 5.6E-03 which was higher and less accurate than the ASEP value. Once the testing recovery credit was applied (again maintenance done during shutdown but EDG testing done monthly) the value was reduced to 3.5E-05 which seems far too low. An error of commission item in the HRAC tool needs to be developed for miscalibration for this to be more accurately portrayed in HRAC.

The MNGP Rev 3.01 model was re-verified to identify any newly significant pre-initiator HEPs and found one significant pre-initiator HEP (NNTRAINBXZ) that was reanalyzed with the THERP methodology.

Miscalibration HEPs Q-672ABCD44Z, Q-2352AB-22Z, and NSP4237HIZ were also identified as significant but have been previously discussed to be inaccurately represented by the THERP methodology. Common cause HEPs QSV672EFX22Z and HPTRCHPSX22Z were also found to be significant. Common cause failures are not well accounted for in the THERP methodology since THERP does not allow for the inclusion of the dependence between the two single failures. There was no obvious option in the HRA Calculator tool for modeling activities that impact more than one train hence the detailed ASEP methodology was retained. Other significant HEPs that were already discussed and re-examined were KCHT8089CZ, SPEPI111 BXZ, and KCHV-SF-9Z.

Impact on ILRT Extension:

The ILRT application used the Rev. 3.2 model. These updates have been made in the Rev. 3.2 model.

Therefore, there is no impact to the ILRT extension.

Page 40 of 142 Revision 22 Revision Page 40 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I13-0026 (IE)

Brief Problem

Description:

(This F&O originated from SR IE-A8) A relatively robust process for system engineering interviews and documentation of same is included in PRA-MT-WI, Rev. 3.0.

F&O Number: 3-2 Technical Element: IE Detailed Problem

Description:

(This F&O originated from SR IE-A8) A relatively robust process for system engineering interviews and documentation of same is included in PRA-MT-WI, Rev. 3.0. However, the form used to document system engineer interviews does not include a section or any criteria relating to whether failure of the system in question could cause an initiating event. Therefore, this SR is met only to CC 1.

Proposed Solution: Possible resolution is to re-interact with system engineers regarding the potential for overlooked initiating events, and document the results of that interaction.

Risk Impact: This F&O is deemed a Finding as it prevents the SR from meeting CC I1.

Actual Solution:

Since the Peer Review, an Interview with Plant System Engineers and operators was performed to decide whether any initiating events were overlooked. Each system engineer was interviewed to verify that a failure of their system would not cause a plant trip, which is documented in the Walkdown and Interview Notebook [Reference 58]. All system engineers concluded that the initiating event fault trees modeled in the PRA were satisfactory in that no initiating events were overlooked. of the WI Notebook [Reference 58] under the statement below documents that this work was performed:

Verify with plant personnel to determine if potential initiating events have been over looked.

Impact on ILRT Extension:

The ILRT application used the Rev. 3.2 model. These documentation updates have been made for the Rev. 3.2 model. Therefore, there is no impact to the ILRT extension.

Page 41 of 142 Revision 22 Page 41 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I13-0027 (IE)

Brief Problem

Description:

During review of the CAFTA fault tree files, some instances of credit for repair of hardware (EDGs) were note that do not seem to be justified. An example is under gate AA1 31 of the AAC fault tree model.

F&O Number: 3-6 Technical Element: SY Detailed Problem

Description:

During review of the CAFTA fault tree files, some instances of credit for repair of hardware (EDGs) were noted that do not seem to be justified. An example is under gate AA1 31 of the AAC fault tree model.

Under the cited gate, failure to recover a diesel-generator is ANDed with "EDG 11 FAILURES WITH POTENTIAL TO RECOVER". Two issues were noted. First, there is not a corresponding gate for EDG 11 comprised of "failures that cannot be recovered'. Second, some of the EDG 11 failures that are recovered, e.g., EDG 11 00S for corrective maintenance, appear to be unjustified. (This F&O originated from SR SY-A24)

Proposed Solution: Search for instances of repair of hardware faults in the logic model, and for each instance identified consider whether credit for recovery/repair is justified. If not, revise the affected fault tree model. If so, document an adequate justification for the repair credit.

Risk Impact: Moving some of the EDG failures out from under the AND (i.e., recovery) gate may result in an appreciable impact on CDF.

Actual Solution:

An evaluation was conducted to investigate the basis for which components (basic events) should or should not be in the scope of EDG recovery. EDG non-recoverable failures are modeled under several gates. Certain accident sequences which require rapid response were excluded (NO-RECOVERY) from the scope of the recovery of the EDGs (for example floods that directly fail the EDG or ATWS). Failures of EDG cooling via HVAC or ESW were also excluded since it is assumed that failures of these systems would cause EDG overheating and hence be non-recoverable (for EDG 11 gate AA049 for EDG12 gate AA086).

RADS data for plants with similar EDGs were reviewed from 1999 to the present. The failures were reviewed and binned based on their time to recover (unavailability), so that an appropriate recovery probability could be calculated. These failures were categorized to determine their potential ability to be recovered. The following failure categories were determined to be recoverable:

1. Include components within EDG boundary. These components are inherently in the scope of the recovery data provided from the RADS database. This database is includes MSPI EDG data entries from all US nuclear power plants.

2. Include corrective maintenance as part of EDG since it represents unplanned unavailability (UA) data.

This unplanned UA was utilized to calculate EDG recovery fraction.

3. Include preventative maintenance since the average planned maintenance is less than six hours per month with most months less than three hours. Recovery would be complete or back out of PM and place EDG back into service.

4. Events that do not directly disable the EDG, hence EDG recovery is not applicable but has a separate recovery credit (e.g. FLOODING ANDed with ALOWFUELHY) is allowed.

5. Include support system recoverable events. These events contribute to unplanned UA for EDGs which was utilized to calculate EDG recovery fraction.

6. Include recoverable Human Actions such as the failure to address low fuel oil. These events may cause temporary loss of EDG but recovery not expected to be difficult.

Impact on ILRT Extension:

The PRA model had been investigated; it was determined the recoverable and non-recoverable EDG failures were modeled correctly. Therefore, there is no impact to the ILRT extension.

Revision 2 Page 42 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I13-0028 (IE)

Brief Problem

Description:

PRA-MT-QU Rev 3 and PRA-MT-L2-AS document the codes used and limitations that may impact applications in Section 2.4.

F&O Number: 4-2 Technical Element: LE Detailed Problem

Description:

PRA-MT-QU Rev 3 and PRA-MT-L2-AS document the codes used and limitations that may impact applications in Section 2.4. However, there is no discussion related to the impact of HEP dependencies on applications that may be requested from the site. For example, using the current seed values for the HFE dependencies would prevent MT from being able to obtain cutsets at a truncation of IlE-12 which is required for MSPI (i.e. 7 orders of magnitude below CDE). (This F&O originated from SR QU-F5)

Proposed Solution: Discuss this limitation in the documentation for the current model. In the future, determine the appropriate method for HFE dependency which will allow truncation at an appropriate limit for support of applications.

Risk Impact: MSPI requires that models be quantified at 7 orders of magnitude below the CDE. This will require MT to truncate at a limit of at least 1E-12 which is unattainable based on discussion in Section 3.5 of PRA-MT-QU. Therefore, this item is a finding.

Actual Solution:

The MSPI Sensitivity was quantified for the MT Rev 3.0E model and truncated down to 6E-i13 without any modification to our quantification process. It is believed that the improvements to the HEP dependency analysis along with other improvements have made this possible. Model revisions after Rev 3.0E have also been tested and have been successful. Since the model's risk has gone down the truncation also has to progress down which makes quantification at these lower truncations more difficult. Similarly with Pr's most recent model, quantification had to be broken up by initiator to meet these lower truncations.

The resulting cutsets are simply appended afterwards. This will be documented in the MSPI Basis document and is documented in the convergence study within the Quantification Notebook [Reference 17].

Impact on ILRT Extension:

The ILRT application used the Rev. 3.2 model. These updates have been made in previous models.

Therefore, there is no impact to the ILRT extension.

Page 43 of 142 Revision 22 Page 43 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-13-0030 (IE)

Brief Problem

Description:

Section 8.1 of PRA-MT-L2-AS gives a table, Table 8.2, which identifies the sources of model uncertainties and assumptions that could impact the PRA model.

F&O Number: 4-6 Technical Element: LE Detailed Problem

Description:

Section 8.1 of PRA-MT-L2-AS gives a table, Table 8.2, which identifies the sources of model uncertainties and assumptions that could impact the PRA model. In this table is a description for the impact on the PRA model, but there doesn't appear to be a sound basis. For example, for the second item in the table, namely Debris Coolability in the Drywell, the 'approach taken' states that the event is set to FALSE but is provided for the purpose 'of performing sensitivity studies on this assumption;' however, no sensitivity is performed. (This F&O originated from SR LE-F3)

Proposed Solution: Perform sensitivity analysis to characterize the key model uncertainties identified.

Risk Impact: The sensitivity analysis performed should help to characterize the uncertainties identified; however, there aren't any supporting sensitivities performed for the identified uncertainties. Therefore the SR is not met.

Actual Solution:

PRA calculation PRA-CALC-13-001 (Level 2 Sensitivity Studies - Model Rev 3.1) was generated to document the detailed level 2 sensitivity studies performed by Applied Reliability Engineering Inc. (AREI) in response to the internal events peer review finding (F&O number 4-6, concerning ASME/ANS RA-Sa Supporting Requirement LE-F3). Section 8.3 (Level 2 Sensitivity Studies) was added to revision 3.1 of the Level 2 PRA Notebook [Reference 18] to summarize each of the studies documented in this PRA calculation. PRA-CALC-13-001 is referred to in the Level 2 PRA Notebook [Reference 18] as reference

1. 43. PRA-CALC-13-O01 has been reviewed and reviewer signed. All the above statements are accurate.

The scope of the sensitivity studies was determined by agreement between the XCEL MNGP Team and AREI.

Impact on ILRT Extension:

These are documentation issues, and they have been resolved in the previous revision. Therefore, there is no impact to the ILRT extension.

Page 44 of 142 Revision 22 Page 44 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-13-0031 (IE)

Brief Problem

Description:

Section 5.2 of PRA-MT-DA states that coincident maintenance at MT is not a common practice but there is no evidence that coincident maintenance activities have been reviewed for applicability of the PRA model.

F&O Number: 4-10 Technical Element: DA Detailed Problem

Description:

Section 5.2 of PRA-MT-DA states that coincident maintenance at MT is not a common practice but there is no evidence that coincident maintenance activities have been reviewed for applicability of the PRA model. However, review of the fault tree demonstrates that RHR-A and RHR-C are taken OOS for corrective maintenance per review of event RLOOPAXXCM in the CAFTA fault tree. This is a clear example of coincident maintenance that should be examined and reviewed for impact on the PRA model. (This F&O originated from SR DA-C14)

Proposed Solution: Document/provide evidence of a review of past planned maintenance to identify any coincident maintenance activities and determine the impact on the PRA model for any items that are identified. A process for coincident maintenance review and impact on the model has been provided via email as one example that this SR can be MET.

Risk Impact: SR is NOT MET because SR requirement is not satisfied.

Actual Solution:

First, high risk combinations were identified that could occur due to online preventive maintenance coupled with random corrective maintenance. These combinations were identified by assigning probabilistic values consistent with those observed for the system combinations from actual plant experience. Second, a detailed cycle plan review was performed for theperiod 2009-2012 to verify that the risk significant combinations of components!/trains were not coincidently taken out of service. The result of this review concluded that there are no coincident maintenance outages as a matter of practice at Monticello.

See Section 5.2 the Data Notebook [Reference 42] for further discussion on this item.

Impact on ILRT Extension:

A review concluded there are no coincident maintenance outages at Monticello. Therefore, there is no impact to the ILRT extension.

Page 45 of 142 Revision 22 Page 45 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5400-CAC-0 Evauaton f Rik Sgniicace o Pemannt IRT xtesio Change Number: MT-I13-0032 (IE)

Brief Problem

Description:

During review of the RHR fault tree, an asymmetry was identified in the fault tree related to Div I and Div 11Flow diversion. Specifically, gates R009-A and R01 0-A should be similar just as R012-A and R013-A are.

F&O Number: 4-11 Technical Element: QU Detailed Problem

Description:

During review of the RHR fault tree, an asymmetry was identified in the fault tree related to Div I and Div II Flow diversion. Specifically, gates R009-A and R01 0-A should be similar just as R012-A and R013-A are.

The non-symmetry occurs due to including maintenance events under the fail to run gate for one pump and not the other three pumps in the RHR system (or at the very least one of the pumps in the other division). The model should be consistent or documentation should be provided describing the reason for the asymmetry. (This F&O originated from SR QU-F2)

Proposed Solution: Correct the model or documentation for the RHR system fault tree.

Risk Impact: Documentation issue Actual Solution:

In the RHR fault tree, the description of gate R009_1 was ". .. common cause failure to start of 2 or 3 pumps" where the proper gate description should have been ". .. common cause failure to run of 2 or 3 pumps". All basic events under this gate are run failures. It appears that the mislabeling of this gate led to the inclusion of maintenance events under the gate, as maintenance events are included under the run failure gates for all of the RHR pumps. The gate name (R009_1) description was corrected to reflect it is a failure to run gate, and the maintenance events under the gate were removed. A review of the fault tree was conducted to verify the proper inclusion of maintenance events under the appropriate (failure to start) gates for each of the four RHR pumps.

Maintenance events are similarly located for each pump under gate R050 for P-202A, gate R055 for P-2020, gate R068 for P-202D, and gate R063 for P-202B. Gates R009- and R010-A are now symmetrical.

Impact on ILRT Extension:

The ILRT application used the Rev. 3.2 model. These updates have been made in previous models.

Therefore, there is no impact to the ILRT extension.

Page 46 of 142 Revision 22 Page 46 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5400-CAC-0 Evauaton f Rik Sgniicace o Pemannt IRT xtesio Change Number: MT-I13-0033 (IE)

Brief Problem

Description:

The use of a half failure for plant-specific data is being questioned. A SSC either fails to perform its function or it doesn't.

F&O Number: 5-12 Technical Element: DA Detailed Problem

Description:

The use of a half failure for plant-specific data is being questioned. A SSC either fails to perform its function or it doesn't. Examples include:

1) A valve that had minor leakage was considered a half failure. This should be determined if the valve could perform its safety function or not.

2) A pump started, stopped, and then restarted successfully. What caused the pump to restart? Was it a manual restart or automatic?

3) A valve did not meet an IST requirement during a surveillance test. Would the valve still be able to perform its function?

4) A valve was not able to maintain a required flow, but could maintain a specific flow. Is that specific flow acceptable for success criteria? If it is, then no failure. (This F&O originated from SR DA-C4)

Proposed Solution: Review the cases where a half failure is given and determine ifthose are PRA failures or not.

Risk Impact: The basis for identifying events as failures was not clearly defined and is viewed as atypical. Therefore, this is a finding.

Actual Solution:

All half failure rates as reported in Rev 3.0 of the Data Notebook [Reference 42] were reviewed to determine ifthe component failed to perform its intended function. The half failures were adjusted accordingly (to be counted as 0 or 1) depending on the scenario with a confirmation from system engineers. These changes were corrected in the basic event type code database titled "MNGP_REV_3-01.EGS_06-05-13_IE_&_type .code_.Database.mdb" and included in any future revisions.

The database file has since been split into two: one for type codes and one for initiating events. The new type code database is titled: "MNGPTCREV_3-1-N.EGS_08-14-13.mdb". Paragraph description now added in Section 4.5.4 of the Data Notebook [Reference 42].

Impact on ILRT Extension:

The ILRT application used the Rev. 3.2 model. These updates have been made in previous models.

Therefore, there is no impact to the ILRT extension.

Page 47 of 142 Revision 22 Revision Page 47 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-13-0034 (IE)

Brief Problem

Description:

The times that components were in their standby statuses were estimated by using a general understanding of average system operation (i.e., a pump in a 2 out of 3 pump system would have 1/3 probability in standby).

F&O Number: 5-15 Technical Element: DA Detailed Problem

Description:

The times that components were in their standby statuses were estimated by using a general understanding of average system operation (i.e., a pump in a 2 out of 3 pump system would have 1/3 probability in standby). Plant-specific operational records were not reviewed. Therefore, this SR is MET at CAT I, but NOT MET at CAT IlIll1. (This F&O originated from SR DA-C8)

Proposed Solution: Review plant-specific data to capture more realistic standby probabilities.

The use of PI data to determine running data combined with the time the SSC is unavailable may be used to determine the plant-specific standby time.

Risk Impact: Because plant-specific operational records were not reviewed, this SR is not met at CAT Il/Ill, therefore this is a finding.

Actual Solution:

The standby data for the DC, SW, and AIR systems were collected from the SOMs, PI Systems, or Procedure 4953-PM respectively to establish more realistic probabilities for the standby flags BE of redundant components. For systems which lacked sufficient data in P1 Systems and SOMs logs, system engineer interviews were conducted to determine appropriate standby fractions. The following systems lacked sufficient plant data: CRDH, HVAC, and RBCCW. The time period reviewed was 2008 to 2012, except for the AIR system which was recently upgraded in 2010. The spreadsheet titled, "MT Standby Fraction.xls" documents this work.

Impact on ILRT Extension:

Plant-specific standby fractions have been incorporated into the model. Therefore, there is no impact to the ILRT extension.

Page 48 of 142 Revision 22 Page 48 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I13-0035 (IE)

Brief Problem

Description:

Mean values and uncertainty intervals were provided through Bayesian updating. However, a number of important basic events in Section 7.1 of PRA-MT-DA were given point estimates without any associated uncertainty values.

F&O Number: 5-16 Technical Element: DA Detailed Problem

Description:

Mean values and uncertainty intervals were provided through Bayesian updating. However, a number of important basic events in Section 7.1 of PRA-MT-DA were given point estimates without any associated uncertainty values. More importantly, no sensitivity studies were performed to ascertain the impact of the point estimates on the model. (This F&O originated from SR DA-D3)

Proposed Solution: Assign appropriate uncertainty values to the point estimates given in Section 7.1 and perform sensitivity studies to determine the impact of these values to the model.

Risk impact: These point estimates may have a large impact on the model, therefore this is a finding.

Actual Solution:

For events not linked to Type Codes, the uncertainty bounds for basic events are defined by the use of lognormal distribution Error Factors (EFs) and are assigned as follows:

When available, EFs or Variances are obtained based on the distribution values provided by the data source. When such information is not available, the general EF guidelines below are used.

1-Human Error Probabilities: related to Human Error are based on information in Section 7 of NUREG/CR-1 278 (Handbook of HRA). The Equipment EF guidelines are based on comparison with various data sources.

2- for failure rates probabilities related to Special BE, an engineering judgment and comparisons with similar BE data was utilized.

Table 7-la Guideline related for probabilities missing distribution attributes is listed in the Data notebook section 7.1 [Reference 42].

Sensitivity studies were performed to determine significant point estimate basic events. The Sensitivity study concluded three basic events which are fairly important to LERF only. These events are JUMPERS

'Hardware needed to align alternate power supply to div. 2 250V DC fails", MVR4543XXN "Hard-pipe vent rupture disk PSD-4543 fails to open", and XPP-SRV--L "SRV tailpipe rupture in the wet-well airspace". Each basic event contributes an increase in LERF risk by more than 10% in comparison to all special events included in the study.

The insights from the study indicate that our model is sensitive to the following basic events:

JUMPERS: The original probability was conservatively estimated to be 1.OE-3. Since this failure only pertains to the jumper cables themselves this failure probability is much higher than other passive components (heat exchangers or check valves). Additionally, this procedure and equipment has been functionally tested (during the 2005 refueling outage) to provide battery charging following a complete discharge.

MVR4543XXN: The only feasible ways that the rupture disk would not open when containment pressure challenges containment integrity (>100 psig) is if the incorrect rupture disk is installed, multiple rupture disks are installed together, or the rupture disk is manufactured incorrectly. The probability of installing multiple disks together is considered to be negligible because of the level of training and experience of Revision 2 Revison 2Page 49 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension maintenance workers, as well as the quality assurance program at the site. This original estimated probability of 1 .0E-3 was found to be conservative since the failure rate is much higher than the failure rate to similar passive components.

XPP-SRV--L: The probability of 3.6006 E-04 is assumed to have a testing period of 2 years for three of the SRVs, and 4 years for the other five SRVs. The probability that a rupture is present (on any SRV tailpipe) is calculated by using a calculation type 5 event with a failure rate for all eight SRV tailpipes (estimated to be a total of 100 feet of piping) with an average testing period of 3.25 years. The piping structural analysis performed in PRA-MEMO-12-007 also concluded that the most limited pipe stress in the SRV tail pipe is below water line not in the airspace. Therefore, the probability is also reasonable given the calculation method and the location of the rupture.

Impact on ILRT Extension:

Further evaluation post-peer review determined no changes to the model were necessary. Uncertainty characterization does not affect the ILRT application. There is no impact to the ILRT extension.

Page 50 of 142 Revision 22 Page 50 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I13-0036 (IE)

Brief Problem

Description:

Section 4.0 discusses the use of Bayesian Updating of generic priors to provide posterior distributions. Generic information was primarily collected from NUREG/CR-6928.

F&O Number: 5-17 Technical Element: DA Detailed Problem

Description:

Section 4.0 discusses the use of Bayesian Updating of generic priors to provide posterior distributions.

Generic information was primarily collected from NUREG/CR-6928. A number of parameters did not have plant-specific information, therefore only generic information was used. (This F&O originated from SR DA-Dl)

Proposed Solution: An industry reference for a probability of consequential LOOP is given in NUREG/CR-6890 Vol. 1, Section 6.3. Alternately, obtain generic data and perform a Bayesian update using plant-specific data to generate a posterior value.

Risk Impact: This SR requires realistic parameter estimates for significant basic events based on relevant generic and plant-specific evidence. There is no evidence to support a realistic parameter estimate for the consequential LOOP (ALOOPXXXXL). Therefore this is finding.

Actual Solution:

The consequential LOOP basic event was reanalyzed and broken up into two different types based on the scenario. The first is the possibility that a LOCA event with the automatic start of the large ECCS pumps induces a grid or plant instability that leads to a LOOP. The second possibility was the consideration of LOOP due to transient. EPRI has reviewed NRC references (such as NUREG/CR-6890 Vol 1) and provided estimates for conditional LOOP frequencies. The EPRI guidance provided the following recommended values:

1. Consequential LOOP for initiators with LOCA was given a frequency of 2.4E-2 per year. The new.

basic event name for this scenario is ALOOPWLOCA.

2. The consequential LOOP caused by a Transient was given a frequency of 2.4E-3 per year. The new basic event name for this scenario is ALOOPTRANS.

Bayesian updating of data was performed on risk significant components from the 2004 Monticello PRA Model (CDF and LERF). The 2004 Monticello model was the model of record at the time of the project's commencement. When the data is updated again, the events which are given a Bayesian update will also be revisited.

The reasonableness check of the Prior versus Posterior was performed using the mean of the Posterior to the 90% confidence intervals of the prior 5th-95th percentile. This check verified that that mean of the Posterior with 90% confidence falls between the Prior's 5 th and 95th percentile values. This work was performed and documented per Suggestion 5-13 (PCD MT-I13-0077).

Impact on ILRT Extension:

Work that was done to resolve this F&O has been completed and incorporated into the PRA model.

Therefore, there is no impact to the ILRT extension.

Page 51 of 142 Revision 22 Revision Page 51 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I13-0037 (IE)

Brief Problem

Description:

The system description for the Condensate and Feedwater system (PRA-SY-CFW) states that the oil coolers for the new condensate pumps being installed will be dependent on Service Water; however, SW isn't listed as a required support system.

F&O Number: 6-4 Technical Element: SY Detailed Problem

Description:

The system description for the Condensate and Feedwater system (PRA-SY-CFW) states that the oil coolers for the new condensate pumps being installed will be dependent on Service Water; however, SW isn't listed as a required support system. (This F&O originated from SR SY-B9)

Proposed Solution: Include SW as a required support system for CFW.

Risk Impact: Documentation and model issue. This dependency may have an appreciable impact on CDF.

Actual Solution:

The CFW fault tree (CFW Rev 3.0.B.ABS_04-30-1 3.caf) was revised to include service water as a dependency for the condensate pumps. Specifically, gate T_SW-SW was added under gates F009, F009-S, F010 and F010-S. The revised fault tree was renamed "CFW Rev 3.0.C.TPW_05-17-13.caf" and filed appropriately. The system notebook for the CFW system [Reference 43] was revised to reflect these changes. A similar PCD (MT-I12-0034) was already established, and will be closed out in conjunction with this PCD. Additionally, PCD MT-11-0027, which is more general but related to EPU changes to the CFW system, will be updated to note the change from this PCD.

Also, feedwater long-term DC dependencies were changed to be long-term instead of short-term.

Specifically gate T_D-DC111b-S was changed to T_D-DC11lb-L under the F051 gate and gate T_D-DC211b-S was changed to T_D-DC2I11-L under gate F054.

Impact on ILRT Extension:

Work that was done to resolve this F&O has been completed and incorporated into the PRA model.

Therefore, there is no impact to the ILRT extension.

Page 52 of 142 Revision 22 Page 52 of 142

54003-CALC-02 Evaluation of Risk Si.qnificance of Permanent ILRT Extension 5400-CAC-0 Evauaton f Rik Sqniicace o Pemannt IRT xtesio Change Number: MT-I13-0038 (IE)

Brief Problem

Description:

PRA-MT-IF-IE Rev 3 includes the information regarding the potential sources of flooding. However, the inadvertent actuation of the fire suppression system is not discussed as a potential initiating event.

F&O Number: 6-6 Technical Element: IFSO Detailed Problem

Description:

PRA-MT-IF-IE Rev 3 includes the information regarding the potential sources of flooding. However, the inadvertent actuation of the fire suppression system is not discussed as a potential initiating event. (This F&O originated from SR IFSO-A4)

Proposed Solution: Perform the evaluation of inadvertent fire suppression actuation and include it in PRA-MT-IF-IE.

Risk Impact: This evaluation is a requirement of this SR.

Actual Solution:

The following information has been added to the Internal Flooding Initiating Events (PRA-MT-IF-IE)

Notebook [Reference 44], Section 2.1: CAP 1266742 evaluated the FPS with regard to effects on plant equipment/areas if inadvertent system actuation were to occur. The conclusion of the evaluation is that inadvertent actuation would not affect any safety-related equipment's ability to perform its function. This evaluation further supports the following positions regarding inadvertent actuation of the fire suppression system in the MNGP PRA Model.

Sprinkler System The effects of an inadvertent sprinkler discharge are bounded by the effects modeled for random pipe breaks in the same area. The spray effects of a sprinkler discharge would likely be less since the sprinkler targets a specific location while a random pipe break is assumed to spray everything in the room.

Additionally, all small FPS piping containing the sprinklers is included in the random FPS pipe break frequencies calculated for the various flood areas. Given that MNGP does not have a history of random sprinkler discharges leading to a plant transient and such events are so rare throughout the industry that no failure data has been developed for such events, inadvertent sprinkler discharge is considered to be within the bounds of uncertainty for the existing flood scenarios hence is not explicitly modeled.

Delugqe System The effects of an inadvertent actuation of a deluge system are bounded by the effects modeled for random pipe breaks in the same area. The spray effects of a deluge discharge would likely be less since the deluge system is focused on a specific set of targets while a random pipe break is assumed to spray everything in the room. The human actions associated with isolation of a deluge discharge are considerably different than those for a random pipe break, however. The control room will receive a unique alarm for a deluge discharge indicating exactly where the operator should investigate instead of simply receiving a 'fire pump running' alarm leaving the operator to search for the location of the event.

Additionally, the isolation of the deluge discharge can be performed at the discharge location by simply closing the deluge valve rather than having to travel to the intake structure to locally trip the fire pumps.

While explicit inclusion of this deluge system actuation would increase the initiating event frequency slightly, this increasewould be more than offset by the decreased HEP associated with the isolation of the deluge discharge. Thus, inadvertent actuation of a deluge system is considered to be within the uncertainty bounds of the existing flood scenarios and is not explicitly modeled.

Impact on ILRT Extension:

The evaluation of inadvertent fire suppression actuation is included in PRA-MT-IF-IE. This documentation issue is resolved. There is no impact to the ILRT extension.

Revision 2 Page 53 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-13-0039 (IE)

Brief Problem

Description:

There is no evidence of plant-specific analysis completed or research done to identify or collect repair time information.

F&O Number: 7-6 Technical Element: DA Detailed Problem

Description:

There is no evidence of plant-specific analysis completed or research done to identify or collect repair time information. The EDG recovery values in Table 1 of PRA -MT-SY-RECAC are based solely on a generic data source. This is contrary to the SR requirement to gather both generic and plant specific information. (This F&O originated from SR DA-C15)

Proposed Solution: If EDG recovery is used in the model, base the values on plant specific experience of EDG repair or show "that the plant EDGs are sufficiently similar... such that the generic data can be used to characterize the EDG repair probability" as stated in the EPRI LOOP Technical Guidelines.

Risk Impact: No plant-specific experience is given for repairs which appear to be very plant specific in nature.

Actual Solution:

Data from the NRC's Reliability and Availability Data System (RADS) was utilized to calculate an updated EDG recovery estimate. RADS was used to obtain more data to establish a larger data population than only MNGP related failures. This analysis used similar assumptions and methodology utilized by the most recent NRC diesel generator repair time estimates. The RADS Unplanned Unavailability (UUA) outage data for similarly designed EDGs from 1998-201 0 was utilized to characterize diesel generator repair probabilities. Each UUA event was categorized into their respective time span. The sum of events within the time span was calculated. The percent recovered was calculated based on the total of UUA events (1,401). The result of this analysis is provided in Appendix A in the RECAC (AC Recovery) Notebook Rev.

3.1.

Impact on ILRT Extension:

Work that was done to resolve this F&O has been completed and incorporated into the PRA model.

Therefore, there is no impact to the ILRT extension.

Page 54 of 142 Revision 22 Revision Page 54 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I13-0040 (IE)

Brief Problem

Description:

(This F&O originated from SR QU-B3) Convergence is only demonstrated when quantifying with nominal HEP values. There is no convergence demonstrated when the method described in PRA-MT-QU Rev 3 is used for quantification.

F&O Number: 7-7 Technical Element: QU Detailed Problem

Description:

(This F&O originated from SR QU-B3) Convergence is only demonstrated when quantifying with nominal HEP values. There is no convergence demonstrated when the method described in PRA-MT-QU Rev 3 is used for quantification. The truncation level (1 E-1 0) is quite high even given the E-05 ODE value. Also little basis is given for using the 1E-1 0 truncation rather than the possible lower E-11I truncation.

Proposed Solution: Review the model to identify what is limiting the quantification truncation. The self-identified issue of dependent HEP methodology is one potential factor but others could exist.

Risk Impact: A sufficiently low converged truncation is required for many applications such as MSPI.

Actual Solution:

Convergence of the internal events only ODE, complete ODE, and LERF has been tested and proven for each model revision since Rev 3.0E. Quantification at truncation levels required by MSPI (7 orders below converged CDF value) were also successful. No pre or post quantification modification to the model was required to establish this convergence. It is believed that since the Peer Review the improvements to the HEP dependency analysis along with other improvements have made this possible. Since the model's risk has gone down since Rev 3.0 the truncation must also progress down to meet the MSPI requirement, which makes quantification at these lower truncations more difficult. To solve at these lower truncations, quantification is performed on smaller groups of initiators with the resulting cutsets appended post quantification. This is a simple and accurate method to quantify the model at these rarely used truncation levels. The final convergence study will be documented in the Quantification Notebook [Reference 17].

The Rev 3.1 model was solved at a truncation of IE-13 by splitting the initiators into four groups by flags.

Convergence of total ODE, no flood ODE, and total LERF were established at 1E-1 2, 1 E-1 3, and 1 E-1 2 truncations respectively.

Impact on ILRT Extension:

The ILRT application used the Rev. 3.2 model. These updates have been made in previous models.

Therefore, there is no impact to the ILRT extension.

Page 55 of 142 Revision 22 Page 55 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-13-0041 (IE)

Brief Problem

Description:

Truncation is only 5 orders of magnitude below CDF. This is less than general industry practice. PRA-MT-QU Rev 3 states that it is because the model quantification fails at lower truncation levels as a result of the joint HEP methodology used.

F&O Number: 7-9 Technical Element: QU Detailed Problem

Description:

Truncation is only 5 orders of magnitude below CDF. This is less than general industry practice. PRAMT-QU Rev 3.0 states that it is because the model quantification fails at lower truncation levels as a result of the joint HEP methodology used. (This F&O originated from SR QU-B2)

Proposed Solution: Identify and resolve the issues with quantification to allow quantification at truncation levels required by the standard and for applications. This may include review of the incorporation of HEP dependencies into the quantification, and review of fault tree structure to optimize quantification effectiveness among other possibilities.

Risk Impact: Events can become significant due to many lower value cutsets containing those events whose summed value is important.

Actual Solution:

Convergence of the internal events only CDF, complete CDF, and LERF has been tested and proven for each model revision since Rev 3.0E. Quantification at truncation levels required by MSPI (7 orders below converged CDF value) were also successful. No pre or post quantification modification to the model was required to establish this convergence. It is believed that since the Peer Review the improvements to the HEP dependency analysis along with other improvements have made this possible. Since the model's risk has gone down since Rev 3.0 the truncation must also progress down to meet the MSPI requirement, which makes quantification at these lower truncations more difficult. To solve at these lower truncations, quantification is performed on smaller groups of initiators with the resulting cutsets appended post quantification. This is a simple and accurate method to quantify the model at these rarely used truncation levels. The final convergence study will be documented in the Quantification Notebook [Reference 17].

The Rev 3.1 model was solved at a truncation of 1E-1 3 by splitting the initiators into four groups by flags.

Convergence of total CDF, no flood CDF, and total LERF were established at 1E-1 2, 1E-1 3, and 1E-1 2 truncations respectively.

Impact on ILRT Extension:

The ILRT application used the Rev. 3.2 model. These updates have been made in previous models.

Therefore, there is no impact to the ILRT extension.

Revision 2 Revison 2Page 56 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I13-0042 (IE)

Brief Problem

Description:

The reasonableness check appears to be limited to whether the individual values are reasonable, not whether similar (timing, complexity, out of control room etc.) actions when compared to each other have reasonable values, which is the intent of the SR.

F&O Number: 7-15 Technical Element: HR Detailed Problem

Description:

The reasonableness check appears to be limited to whether the individual values are reasonable, not whether similar (timing, complexity, out of control room etc.) actions when compared to each other have reasonable values, which is the intent of the SR. (This F&O originated from SR HR-G6)

Proposed Solution: Perform the reasonableness check between events.

Risk Impact: Comparison between events with similarities is an important part of validating the values.

Actual Solution:

Since the Peer Review multiple reviews of the post initiator HEPs were performed using the HRA Calculator to get an accurate picture of the overall HRA analysis. A stress review report was generated and reviewed for all HEPs to ensure that the assigned stress levels are accurate. In general actions that are rarely performed, are outside the control room, or have little time to perform were assigned a higher stress level. The locations of HEPs were also reviewed to ensure that consistent naming was used for accurate use in the dependency analysis. A review of the complete HEP values against other similar actions was also performed. Any screening value HEPs that were found to be risk significant were developed further to establish a more accurate failure probability. Similar actions, such as flood isolations and manual depressurizations, were reviewed collectively to validate that actions that have more time or are located in the control room were given a lower failure probability. These reviews have been documented in Section 8.2 of the HRA Notebook, Rev 3.1 [Reference 45].

Impact on ILRT Extension:

The ILRT application used the Rev. 3.2 model. This documentation update has been made in previous models. Therefore, there is no impact to the ILRT extension.

Page 57 of 142 Revision 22 Page 57 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I13-0043 (IE)

Brief Problem

Description:

However, it appears that combinations (up to 6) HEPs appearing in cutsets are inappropriately analyzed for dependency resulting in over 8000 dependent combinations.

F&O Number: 7-16 Technical Element: HR Detailed Problem

Description:

The dependency analysis was performed using the HRA calculator which is an acceptable method to perform the dependency analysis and there is evidence that the limitation of the HRA calculator dependency module on the sequence of events times for multiple HEPs within a cutset was addressed at least in part. However, it appears that combinations (up to 6) HEPs appearing in cutsets are inappropriately analyzed for dependency resulting in over 8000 dependent combinations. This analysis does not account for the subset of HEPs where the dependency is addressed via the separate cognitive and execution events. (This F&O originated from SR HR-G7)

Proposed Solution: Redo the dependency analysis using an awareness of the mix of HEP types, the concept of minimum values, consideration of whether the large number of HEPs in a single cutset is appropriate while retaining the current correct addressing of the cutset length limitations and time sequencing of HEPs from the current analysis. Review available industry guidance on performance of HEP dependency analysis to garner the best, most efficient way to perform the analysis. Ensure the software limitations are explicitly addressed in the dependency analysis process.

Risk Impact: Large sets of HEPs in a cutset may be due to the mix of methods (separate cognitive and execution events with the dependencies explicitly addressed and combined events not addressing dependency). Where the dependency was addressed by the separate events method already, these should be removed from or limited in the dependency analysis.

Actual Solution:

Post model Rev 3.0, a large effort was conducted to simplify and standardize the post initiator HRA analysis. First, cognitive and execution only HEPs were combined into one single HEP to create a more logical and simplified method for accounting for dependencies between HEPs. Second, an effort was conducted to combine the remaining HEPs that were very similar such as high pressure injection with FW or HPCI/RCIC. The number of flood isolation HEPs were reduced from 57 to 12 based on their HEP value and similarity of action. Model logic that duplicated the same operator action for different timings were also removed since these actions are not actually separate (for example depressurizing with one SRV or three). The efforts previously described have reduced the number of HEPs from 160 to 79 and reduced the HEP combos from approximately 12,000 (Rev 3.0) to 1,600 in the Rev 3.1 model. The amount of HEPs and dependencies is now well within the limitations of the current software used for HRA (HRA Calculator) and quantification (CAFTA and FTREX).

See Table 22 in the PRA-MT-HR Notebook [Reference 46] for the summary of the work performed to standardize the HRA analysis by combining cognitive and execution HEPs from the 2004 model.

Impact on ILRT Extension:

The ILRT application used the Rev. 3.2 model. These updates have been made in previous models.

Therefore, there is no impact to the ILRT extension.

Page 58 of 142 Revision 22 Revision Page 58 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5400-CAC-0 Evauaton f Rik Sgniicace o Pemannt IRT xtesio Change Number: MT-I13-0044 (IE)

Brief Problem

Description:

Part of a reasonableness check should be an evaluation as to whether very low HEP values make sense*. Common industry practice is to employ a floor or lower limit value of 1E-06 or 5E-07 to any HEP calculated value below these limits.

F&O Number: 7-17 Technical Element: H-R Detailed Problem

Description:

Part of a reasonableness check should be an evaluation as to whether very low HEP values make sense. Common industry practice is to employ a floor or lower limit value of 1E-06 or 5E-07 to any HEP calculated value below these limits. This applies to both independent and dependent HEP values. For example from the DAC, combination 1 has a resultant dependent HEP value of E-1 1.This is mainly an issue with the dependent HEP values. (This F&O originated from SR HR-G6)

Proposed Solution: Incorporate the use of floor values in the HRA analysis.

Risk Impact: Use of extremely low HEP values is not realistic from a human performance perspective and can skew the PRA results.

Actual Solution:

All post Rev 3.0 quantifications now include a floor limit of independent or dependent combinations of HEPs of 1E-7. This number is currently being debated among the industry and regulators and is consistent with Prairie Island. A floor limit of the single HEP was set to 1E-5 in the HRAC database. This single HEP floor limit is rarely used for post initiator HEPs, XDEPHOURSY and J2NDPHRS-Y only.

These are reserved for simple control room actions which need to be performed within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. Multiple pre-initiator HEPs have this screening level value.

Impact on ILRT Extension:

The ILRT application used the Rev. 3.2 model. These updates have been made in previous models.

Therefore, there is no impact to the ILRT extension.

Page 59 of 142 Revision 22 Page 59 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I13-0045 (IE)

Brief Problem

Description:

A comparison of MNGP results with other plants was documented in Section 4.3.6.

F&O Number: 8-1 Technical Element: QU Detailed Problem

Description:

A comparison of MNGP results with other plants was documented in Section 4.3.6. Loss of 125 VDC initiators are a much higher contribution to ODE than for the other three comparison plants, but no adequate explanation was offered as to why there is such a large discrepancy. (This F&O originated from SR QU-D4)

Proposed Solution: State physical reasons why the 125 VDC initiators are more significant for MNGP, or else identify why these cutsets may be "artificially" high, e.g., use of HEP dependencies.

Risk Impact: The SR states that the causes for significant differences with other comparison plants needs to be identified.

Actual Solution:

A discussion comparing Monticello's results to other similarly designed BWRs will not be created until the Rev 3.1 model is frozen July 1 5th. This discussion will not affect the PRA model or its applications. The importance of the complete loss of 125VDC was researched and found to be a result of having the common cause failure of all three battery chargers fails short term injection. This basic event was removed since only two of the three battery chargers are normally in service with the backup in standby.

The basic event was replaced with the common cause of two battery chargers failing and the backup also failing independently. These changes reduce the overall ODE significance for complete loss of 125VDC from ~18% (Rev 3.0) to 0.0% (3.0H) at a IE-9 truncation, which is much more consistent with other similar BWRs. The modeling for complete loss of either single train of 125VDC is about a 1% contributor for non-flood scenarios.

Discussion was added to describe the differences between Monticello and other similarly designed plants in Section 4.3.6 of the QU Notebook [Reference 17]. Comparisons to other similarly designed plants were made to the best of our ability based on the information provided.

Impact on ILRT Extension:

The ILRT application used the Rev. 3.2 model. These updates have been made in previous models.

Therefore, there is no impact to the ILRT extension.

Page 60 of 142 Revision 22 Page 60 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I13-0046 (IE)

Brief Problem

Description:

Based on a review of the CAFTA database file (PRA-MT-DA-CDF-OPT Rev 3.0.RR), it appears that Error Factors were assigned to both Beta and Gamma distributions in the Type Code table instead of using variance values.

F&O Number: 8-5 Technical Element: QU Detailed Problem

Description:

Based on a review of the CAFTA database file (PRA-MT-DA-CDF-OPT Rev 3.0.RR), it appears that Error Factors were assigned to both Beta and Gamma distributions in the Type Code table instead of using variance values. In Attachment 1 of the Data notebook (PRA-MT-DA), the same type codes listed have assigned variance values for their Beta or Gamma distribution. This appears to be a discrepancy in the way the data was utilized in estimating the CDF uncertainty intervals. (This F&O originated from SR QU-E3)

Proposed Solution: Revise the distribution parameters in the Type Code table of the CAFTA database such that they are consistent with the PRA documentation. If necessary, the parametric uncertainty analysis may need to be re-performed in order to more accurately estimate the ODE and LERF uncertainty intervals.

Risk Impact: For RG 1.200 compliance in order to meet Capability Category II, the mechanisms listed under Category III of the Standard are required to be qualitatively addressed.

Actual Solution:

The Uncertainty Parameters that were implemented in CAFTA were reviewed to assure the data is using the proper uncertainty parameter (Error factor or variance) according to the type of Distribution (Gamma, Beta, and Iognormal). The data notebook [Reference 42] was updated to be consistent with the CAFTA database. A list of the appropriate parameters with the distribution type is listed in the Data notebook

[Reference 42], Section 2.

Impact on ILRT Extension:

The ILRT application used the Rev. 3.2 model. These updates have been made in previous models.

Therefore, there is no impact to the ILRT extension.

Page 61 of 142 Revision 22 Page 61 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I13-0047 (IE)

Brief Problem

Description:

It appears that the Category Ill items, such as pipe whip, humidity, condensation, and temperature were not qualitatively addressed (see NRC Resolution, which is required for Cat. 11)(This F&O originated from SR IFSN-A6)

F&O Number: 8-8 Technical Element: IFSN Detailed Problem

Description:

It appears that the Category Ill items, such as pipe whip, humidity, condensation, and temperature were not qualitatively addressed (see NRC Resolution, which is required for Cat. II). (This F&O originated from SR IFSN-A6)

Proposed Solution: The mechanisms listed for Capability Category Ill should be qualitatively addressed using conservative methods and treatments to show what additional impact, if any, may be imposed on existing internal flood scenarios.

Risk Impact: Basis for Significance for RG 1.200 compliance in order to meet Capability Category II, the mechanisms listed under Category Ill of the Standard are required to be qualitatively addressed. This will have little to no impact of CDF or LERF.

Actual Solution:

Per the resolution requested from the Peer Review, a qualitative assessment was performed for the following flood failure mechanisms to meet Capability Category II criteria:

- Submergence

- Spray

- Jet Impingement

- Pipe Whip

- Humidity

- Condensation

- Temperature Spray and submergence effects are specifically discussed and accounted for throughout the Internal Flooding Accident Sequence Notebook [Reference 47] for those internal flooding scenarios that are impacted. All internal flood initiators account for submergence and spray.

Jet Impingement and Pipe Whip are assumed to have no effect on the internal flooding analysis unless specifically stated in the internal flooding scenario. This assumption is based on the research provided in NUREG/CR-3231 which found that these potential impacts of pipe breaks require very specific pipe spacing/orientation, rarely result in a complete (guillotine) break, and even if pipe break occurs, significant reduction in cross sectional area of the target pipe follows. The instances which all these conditions are met are few in MNGP and the probability of these types of events coincident with a flood initiator is sufficiently remote. Assumption #5 was added to the "General Assumption" Section 2.2 of the Internal Flooding Accident Sequence Notebook, PRA-MT-I F-AS [Reference 47].

Humidity, Condensation, and temperature effects are assumed to be encompassed in the bounding, conservative assumption that all spray floods in the MNGP flood model fail the entire room where the flood exists irrespective of room size or pipe orientation. Assumption #6 was added to the "General Assumption' Section 2.2 of the Internal Flooding Accident Sequence Notebook, PRA-MT-IF-AS

[Reference 47].

Impact on ILRT Extension:

The ILRT application used the Rev. 3.2 model. These updates have been made in previous models.

Therefore, there is no impact to the ILRT extension.

Revision 2 Page 62 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension A.4. Monticello PRA Response to Fire PRA Peer Review Findings Change Number: MT-15-0014 F&O Number: 1-18 Associated SR(s): PP-B5 Detailed Problem

Description:

During conduct of the plant walk down on 3/4/2015 two such separation elements were identified that are representative of the elements that should be credited for separation. The double doors located in the barrier separating FZ-2C and FZ-2B are held open with fusible link hold-open devices. Another example is the normally open fire damper located in the barrier separating FZ-2A and FZ-2B. These two instances are examples only and should not be considered indicative of all such occurrences. Information concerning the credit of such elements should be added to the justification for separation of such Fire Zones. Accordingly this SR is judged to be Met at CC I.

Proposed Solution: Ensure that available, active fire barrier elements are credited in the partitioning.

Basis for Significance: Satisfaction of CCII for this SR requires crediting active fire barrier elements such as active fire doors.

Actual Solution:

• Section 3.0 has been revised such that fire dampers are not included in the list of non-credited active partitioning features. Instead, the Plant Boundary and Partitioning Notebook [Reference 48] clearly states that fire dampers located in credited fire barriers are credited in the plant partitioning scheme. The failure probability of these dampers to contain fire effects is captured in the multi-compartment analysis.

• Section 3.0 has also been revised to state that normally open fire doors that are held open by a fusible link are also credited in the plant partitioning scheme. The only normally open fire doors that are credited in the analysis are Doors 41 0A and 410OB, which separate Fire Zone 2B and Fire Zone 20.

By crediting this active feature, an update to the multi-compartment analysis was also necessary.

Specifically, the barrier failure probability for these doors was set equal to a screening value of 0.1; a typical normally closed doorway is assigned a barrier failure probability of 7.4E-03.

It should be noted that no other active partitioning features, such as a water curtain, are credited in the plant partitioning scheme.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 63 of 142 Revision 22 Page 63 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0042 F&O Number: 2-3 Associated SR(s): PP-B7, PP-C3 Detailed Problem

Description:

According to the Section 4.0 of the Plant Boundary and Partitioning Notebook confirmatory walk downs of the plant partitioning was performed to verify the conditions and characteristics of the credited partitioning elements for each Fire Zone and to verify that the zone drawings reflect as-built conditions. According to the notebook the information obtained during these walk downs is documented in the Monticello Fire Modeling Database and in Tables A-i and A-2 of the notebook.

Table A-i of the plant partitioning notebook includes walk down notes which provide a list of the Fire Areas and Fire Zones that are considered in the Fire PRA. Specifically this table lists Fire Area, Fire Zone, Room Elevations, Building Name, Description, and FHA Drawing No. Table A-2 provides the confirmatory walk down documentation which entails the Fire Zone ID, originator and review initials and preparer and reviewer dates. Neither table includes information specific to partitioning element characteristics.

According to Section 4.0 of the Plant Boundary and Partitioning Notebook Fire Zone information from the plant partitioning task is contained in the Plant Fire Modeling Database (FMDB) in tables tblCompartmentlnfo, tblRooms, and tblZones. The information in these tables was reviewed and found to contain very little information concerning the partitioning element characteristics. Most of the information contained in these table concerns information associated with location (i.e., building, elevation, Fire Zone, Fire Area, transient mapping, etc.), cable loading, influencing factors, detection, suppression, instrument air details, etc. The only information that pertains to partitioning element characteristics is wall material, wall thickness, and no. of doors. These fields are populated as follows for every Fire Zone: wall material

= concrete; wall thickness = 2ft; no. of doors = 1.

Based on this review, the documentation provided does not support conduct of a confirmatory walkdown that confirmed the conditions and characteristics of credited partitioning elements.

Proposed Solution: Provide documentation that addresses the acceptability of the credited partitioning elements.

Basis for Significance: The requirement is to perform confirmatory walkdowns that confirm the conditions and characteristics of credited partitioning elements.

Actual Solution:

The appendices to the Plant boundary and Partitioning Notebook [Reference 48] have been updated to include scans of the notes taken during the confirmatory walkdowns conducted in support of the plant partitioning task. These notes provide documentation of the conditions and characteristics of credited partitioning elements.

Impact on ILRT Extension:

This is a documentation issue and is resolved. There is no impact on the ILRT Extension Risk Analysis.

Page 64 of 142 Revision 22 Page 64 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5400-CAC-0 Evauaton f Rik Sgniicace o Pemannt IRT xtesio Change Number: MT-15-0043 F&O Number: 2-4 Associated SR(s): PP-B2, PP-C3 Detailed Problem

Description:

According to the Section 3.0 of the Plant Boundary and Partitioning Notebook the FPRA credits nonrated-fire barriers as detailed in Table 3-2. Table 3-2 provides a listing of each credited non-rated-fire barrier.

The information provided includes Fire Zone, Adjacent Zone, Orientation to Adjacent Zone, Barrier Type, Construction and Walk down Comments. The walk down comments included in this table typically state

'Barrier Observed'; three exceptions provide a little detail concerning openings in the barrier. Reference is made to the Monticello Updated Safety Analysis Report, Fire Protection Program, Updated Fire Hazard Analysis Revision 30, with regard to barrier construction and to the Plant Partitioning Walk down Notes.

However, the notebook provides no justification/evaluation that would indicate that the credited non-fire-rated barriers should substantially contain the damaging effects of fire.

Proposed Solution: Provide documentation that addresses the acceptability of the credited partitioning elements.

Basis for Significance: The requirement is to JUSTIFY that the credited non-fire rated barriers will substantially contain the damaging effects of fire.

Actual Solution:

The appendices to the Plant boundary and Partitioning Notebook [Reference 48] have been updated to include scans of the notes taken during the confirmatory walkdowns conducted in support of the plant partitioning task. These notes provide documentation of the conditions and characteristics of credited partitioning elements.

Impact on ILRT Extension:

This is a documentation issue and is resolved. There is no impact on the ILRT Extension Risk Analysis.

Page 65 of 142 Revision 22 Revision Page 65 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0053 F&O Number: 4-1 Associated SR(s): PP-Al, PP-C2 Detailed Problem

Description:

The Global Analysis Boundary excludes several buildings and structures in Section 2.0 of Notebook 01601 5-RPT-02, however, and there is no detailed discussion related to the impact on an adjacent PAU such as distance between structures and/or building construction.

Proposed Solution: Provide additional documentation regarding the basis for screening of excluded structures including building construction and actual distances to adequately justify excluding the structures from potential impact on FPRA components in an adjacent PAU.

Basis for Significance: There is a potential for buildings/structures screened out of the global analysis boundary that could impact adjacent buildings/PAUs that contain FPRA components.

Actual Solution:

Section 2.0 of the Plant Boundary Definition and Partitioning Notebook [Reference 48] has been revised to more clearly document the basis by which buildings within the global analysis boundary were screened.

Revision 0 of the Plant Boundary Definition and Partitioning Notebook [Reference 48] screened a number of the locations on the basis that the screened building did not contain plant systems or components contributing to fire risk.

The revised Plant Boundary Definition and Partitioning Notebook [Reference 48] includes an evaluation of the potential impacts of fires occurring in these screened locations. Specifically, this evaluation ensures that a fire occurring in these screened locations will not impact plant systems or components contributing to fire risk that are located in other plant buildings within the global analysis boundary.

Impact on ILRT Extension:

The F&O is resolved. There is no impact on the ILRT Extension Risk Analysis.

Revision 2 Revison 2Page 66 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0008 F&O Number: 1-12 Associated SR(s): ES-Al, ES-A3, ES-A4, ES-A5, ES-A6 Detailed Problem

Description:

A review for plant-specific MSOs was performed as part of the expert panel process, but the FPRA development team did not produce documentation of a thorough review. Therefore the identification of equipment including spurious operation related to initiating events or plant response may not be complete. Plant-specific MSO review would include, but is not limited to, 1) a P&ID review of all plant systems for potential MSO scenarios that impact the FPRA development, 2) identification of ISLOCA pathways screened from the FPIE PRA and, 3) for LERF, a review of containment isolation pathways screened from consideration from FPIE LERF that are relevant to the FPRA LERF PRM in the context of fire-induced spurious operations.

Proposed Solution: Perform a more thorough review of MNGP plant systems for potential MSO scenarios that are not addressed by the generic BWR MSO scenarios, including plant-specific spurious operations or MSO scenarios that cause or contribute to initiating events, or plant response.

Basis for Significance: Review for plant-specific MSOs would potentially identify spurious operations that cause or contribute to initiating events.

Actual Solution:

After the peer review, a plant-specific MSO review was held. An expert panel was re-convened with most of the members of the original FPRA MSO review panel taking part. The panel included experts from PRA, safe shutdown, and plant systems. During the meeting the panel reviewed P&lDs of all plant systems for potential MSO scenarios that impact the FPRA development, ISLOCA pathways and also containment isolation pathways. It was determined that all of the plant-specific MSOs had been identified previously and were included in the original MSO review.

The review of the plant-specific MSOs is now clearly referenced in the ES notebook [Reference 49].

Impact on ILRT Extension:

The F&O resolution identifies that the FPRA model accounted for all MSOs. The documentation has been updated to reflect the resolution. There is no impact to the ILRT Extension Analysis.

Revision 2 Revison 2Page 67 of 142

54003-CALC-02 of Risk Significance of Permanent ILRT Extension 5400-CAL-02Evaluation Change Number: MT-15-0010 F&O Number: 1-14 Associated SR(s): ES-Cl Detailed Problem

Description:

Section 5.5, Table 3 and Table 4 identify additional mitigating, instrumentation, and diagnostic equipment important to human response in the event of a fire. The peer review examined the instruments identified and issues were identified:

MHVPLOCAL-YEF - No cues are identified (HFE is not in the table).

No cue appears to be modeled for ALT-OIL-Y, yet Table 3 lists FI-4393 as a cue.

The ALOWFUEL-Y is used for DG 1 and DG 2 modeling but selects instrumentation for DG 13. DG 13 was used as a proxy for the other two diesels. The day tank instrumentation is not correct for 13 DG and should be revisited to model the correct instruments.

No cues are modeled for ALT-I NJ-PB-Y and ALT-INJ-PD2-Y. The FPRA development team indicated during the review week that: 'For these HFEs, there is no significant dependency on indication. The failure of all high pressure and low pressure injection systems cannot be missed by the operators, which will lead them to explore alternate means of injection.' However, no review was performed of the potential for spurious indication (ES-C2) to mislead the operators regarding status of core cooling I operation of an EGOS pump.

C4H-EASY-Y - Loss of ammeter / voltmeter for either load center appears to fail the operator action for both load centers, which appears conservative.

ALOWFUELHY and ALOWFUEL-Y were carried over from the internal events PRA and are anticipated to be removed in the next revision of the Internal Events model due to plant modifications. Based on this, the Fire PRA may also be updated accordingly to remove these HFEs. In the case these HFEs are elected to remain in the Fire PRA model, the underlying cue modeling may need further refinement to tie each tank to its associated indication. FS-3236 and FS-3237 are in the model under gates A-INSTR-11I and A-INSTR-12.

Cues listed for ADG13BFD-Y in ES notebook Table 3 are FIDGI/C-08 and F/DG2/C-292. The HRA Calculator indicates that both cues are needed to perform the action. Only F/DGI/C-08 modeled (gate AA024-1). The FPRA development team indicated during the review week that: 'In case of SBO, there will be multiple cues in the control room (loss of lights, loss of equipment) that will lead the operators to use OGi13 as a backup to feed essential loads. It seems that Basic Event AICC08FRQR was conservatively inserted here and could be removed altogether from Gate AAO24-1.' Therefore further work is needed to ensure the modeling and documentation are reasonable I representative.

Cues for ALTBATCHGY documented as 'No indication, visual verification,' which is unclear. The FPRA development team indicated during the review week that: 'This HFE is related to ADG1 3BFD-Y, discussed previously. In case of SBO, it is expected that there would be multiple cues that would lead the operators to provide power to battery chargers, making the direct modeling of such cues in the model unnecessary.' Therefore further work is needed to ensure the modeling and documentation are reasonable I representative.

ALTINJNOMY: Remarks for ALTINJNOMY say Reactor water level at ASDS, but the gate modeled for the cues for ALTINJNOMY is the same gate modeled for ALTINJMINY and ALTINJHRSY. The FPRA development team indicated during the review week that: 'The notebook indicates that reactor water level indication is available at the ASDS panel, but this key monitoring indication is also available in the control

.room.' Further work is needed to ensure the modeling and documentation are reasonable I representative.

Proposed Solution: Identify instrumentation that is relevant to the operator actions for which HFEs are defined or modified to account for the context of fire scenarios in the Fire PRA, per SRs HRA-BI and HRA-B2.

Basis for Significance: Several issues identified, and therefore a finding is assessed.

Revision 2 Page 68 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Actual Solution:

MHVPLOCAL-YEF - The HFE name is actually "MHPVLOCAL-YEF". The cue for this HFE identified by the Fire HRA is drywell pressure above 2 psig, so the HFE and its associated instrumentation were added to Table 3 of the ES Notebook [Reference 49] and to the FPRA model.

ALT-OIL-Y - The ES Notebook [Reference 49] was corrected to remove FI-4393. The cue for ALT-OIL-Y is that the alternate means to provide fuel to the DGs has failed. The current FPRA modeling is correct, but will be coordinated in the future with changes to the internal events model along with related HFEs ALOWFUEL-Y and ALOWFUELHY (see below).

ALOWFUEL-Y and ALOWFUELHY -

ALOWFUELHY has been removed from the internal events model and the modeling of the diesel oil system has been revised to include the following HFEs:

OALTIL.Y Fail to align fuel oil supply from gas powered pump or supply DFP tank with division 1 FOTPs OLOWFUEL-Y Fail to start second diesel oil pump in division iffirst pump fails There are 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> available to refuel the diesel generators (as indicated in the time window data of the HFE*), at which point the fire is expected to be extinguished. The operators would be aware that the fuel supply to the diesel needs to be checked. In particular, Step 1 of sections E.1 and E.2 of Operations Procedure B.09.08-05 directs the operators to record EDG parameters on the log sheet contained in procedure 2301, EDG Operating Logs. Procedure 2301 requires hourly logging of Day Tank Fuel Oil Level as well as Base Tank Fuel Oil Level for an EDG that is in operation. Within the fuel oil day tank room for each of the EDG's, there is a local level indicator (LIS-1 528 and LIS-1 529) for the day tanks (T-45A, and T-45B respectively). Mounted on each of the EDG base tanks, there is base tank fuel oil level indication. Thus, indication for the level would always be available (as least as long as the fire is not in the room, but if it is, the tank is not credited in the Fire PRA). Therefore, the current modeling of the Fire PRA, which includes failure of the human actions by fire-induced loss of level sensors is conservative and overestimates the risk.

ALT-INJ-PB-Y and ALT-INJ-PD2-Y - BWR flow charts are designed to prompt multiple parameter checks for RPV level, RPV pressure and drywell pressure. Given the list of indications for these HFEs in ES Notebook [Reference 49] Table 3, it is unlikely that a single spurious indication could mislead the operators. In addition, spurious indications for these level and pressure instruments are routinely addressed in operator classroom and simulator training. Therefore, no specific review is planned.

C4H-EASY-Y - No ammeter/voltmeter is needed, so the instrumentation gate associated with this HFE was deleted from the model. The ES notebook [Reference 49] removed the instruments from Table 3.

ADG1 3BFD-Y - No frequency meter is needed, therefore basic event AICC08FRQR was deleted from the FPRA model. The ES notebook [Reference 49] removed the instruments from Table 3 and change the Remarks to, "In case of SBO, there will be multiple cues in the control room (loss of lights, loss of equipment)."

ALTBATCHGY - In case of SBO, it is expected that there would be multiple cues that would lead the operators to provide power to battery chargers, the direct modeling of such cues in the model is unnecessary and so was deleted from the FPRA model. This was coordinated with the model changes for ADG13BFD-Y and the text in Table 3 of the ES Notebook was clarified [Reference 49].

ALTINJNOMY, ALTINJMINY and ALTINJHRSY - The current modeling strategy is considered to be correct. Alternate injection will be performed from the control room, using the instrumentation available there.

To address the F&O, the following actions were taken:

• Changed Table 3 of the ES Notebook [Reference 49] to include the control room indication; Page 69 of 142 Revision 22 Page 69 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension

• Clarified the note in Table 3 of the ES notebook [Reference 49] to state that RPV level indication is also available at the ASDS panel, as modeled by Gate L-RX-LVL (LI-41 08 and LI.-41 07 are indications at the ASDS panel);

• In the fault tree, clarified at Gate L-RX-LVL that the indication is located at the ASDS panel.

Impact on ILRT Extension:

The impact of this HEP is small because the action timing is long. There is negligible impact to the ILRT Extension Analysis.

Page 70 of 142 Revision 2 Page 70 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0011 F&O Number: 1-15 Associated SR(s): ES-C2 Detailed Problem

Description:

No documentation is provided of a review to identify instrumentation associated with each operator action to be addressed in the FPRA whereby one of the modes of failure to be considered is spurious operation of the instrument.

Proposed Solution: Identify instrumentation associated with each operator action to be addressed in the FPRA based on fire-induced failure of any single instrument whereby one of the modes of failure to be considered is spurious operation of the instrument.

Basis for Significance: The potential for fire-induced spurious operations of instrumentation to impact the successful performance of operator actions needs to be considered.

Actual Solution:

The Fire NRA Notebook [Reference 45] Appendix G documents the detailed procedure review that was performed to identify single instruments that if spuriously operated would be likely to cause an undesired operator response because there was no clear requirement in the procedure to check or verify the instrument reading before taking an action. Such instances are rare due to continual industry and internal plant reviews of procedures.

As a result of this review, fifteen (15) such procedure cases (involving eighteen different instruments) were identified and are listed in Fire NRA Notebook Table 5-2 [Reference 45]. a further review was performed by Xcel staff with significant system and operations knowledge, as well as by the fire HRA team. As a result of this review, the updated disposition of the eighteen (18) indications is the following:

• Nine (9) were not credited in the fire PRA model because the equipment associated with the instruments is already considered failed during a fire;

• Four (4) were found to have been miscategorized as leading to an undesired action because operator disablement of the system or equipment when it is specifically required to function is not considered credible.

• Three (3) were not modeled because the postulated undesired operator action, to shut down equipment one by one until the ground is identified, is not considered credible, given that operators are generally aware of potential spurious signals caused by fire; and

• Two (2) were not needed in the model because the cable-induced failure causing the spurious indication already causes the failure of the component (EDG) functional state.

Table 5-2 of the Fire NRA Notebook [Reference 45] has been updated accordingly and the Equipment Selection [Reference 49] Notebook section 5.5.2 was revised as necessary to include documentation of this update.

Regarding spurious operation of instruments associated with modeled operator actions (HFEs), as noted in F&O 1-22, the fire NRA modeling strategy has been to presume degraded cues and to penalize the HFE on that basis. This strategy is consistent with the guidance in NUREG-1 921 for considering the impact of confusing or less than optimal cues due to fire on operator performance.

Impact on ILRT Extension:

The F&O resolution identifies documentation updates that have been completed. There is no impact on the ILRT Risk Extension Analysis.

Page 71 of 142 Revision 22 Page 71 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0012 F&O Number: 1-16 Associated SR(s): ES-Al, ES-A4, ES-A5, ES-A6 Detailed Problem

Description:

The FPIE initiating events analysis reviewed plant systems for initiating events potential and screened out the systems as applicable. No documentation was provided for the FPRA development to review this screening to determine whether any screening performed for the FPIE is not applicable in the context of fire. The peer review examined this list in the FPIE internal events notebook and identified one system to consider for inclusion in the FPRA: Off gas holdup. Failure of the system can cause loss of condenser vacuum, and this is implicitly treated in the EPIE PRA by the loss of condenser initiating event. However, such impact could result from fire damage, and therefore would need to be considered for the FPRA equipment selection.

Proposed Solution: Review the FPIE initiating events development for screening of initiating events for internal events that do no remain valid in the context of fire, and include the applicable equipment on the FPRA equipment list.

Basis for Significance: Systematic issue Actual Solution:

All systems that were considered for initiating events in the FPIE were considered for the FPRA. No systems that were screened for the internal events initiating events analysis were required to be added for the FPRA.

The offgas holdup system is considered in the Fire PRA and is modeled in the CDR (Main Condenser) system tree. Components from this system were included in the FPRA ES and had cable selection performed. This system was modeled in the FPRA at the time of peer review and is still included in the current model.

The following offgas holdup system components are modeled in the FPRA. Details about how these are modeled can be found in the ES database and PRM model.

BE NAME BE Description Passport Equipld GCMCl001AR12 Offgas compressor C-i1001A fails to run C-i1001A GCMC1001BRl2 Offgas compressor C-i1001B fails to run C-1001B GCMCl001lBS OG COMPRESSOR C-I O01B FAILS TO START C-l00iB GCMC1002AR12 Chiller compressor C-i1002A fails to run C-1002A GCMC100O2BR1 2 Chiller compressor C-1002B fails to run C-1002B GCMC1 002BS CHILLER COMPRESSOR C-1002B FAILS TO START C-i1002B GPMP100O2AR1 2 CHILLED WATER PUMP P-i1002A FAILS TO RUN P-i1002A GPMP100O2BR1 2 CHILLED WATER PUMP P-i1002B FAILS TO RUN P-i1002B GPMPI1002BS CHILLED WATER PUMP P-i1002B FAILS TO START P-i 002B GVACV1 928F AOV CV-i1928 FAILS TO REMAIN OPEN CV-i1928 GVACV7583F AOV HCV-7583 FAILS TO REMAIN OPEN HCV-7583 GVACV7583N AOV HCV-7583 FAILS TO OPEN HCV-7583 Impact on ILRT Extension:

This F&O is resolved. The model included the appropriate treatment for all Internal Event model initiating events. There is no impact on the ILRT Extension Risk Analysis.

Page 72 of 142 Revision 22 Page 72 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0018 F&O Number: 1-21 Associated SR(s): HR-Fl, HR-F2, ES-C2, HRA-B4, HRA-E1 Detailed Problem

Description:

No documentation of inclusion of the undesired operator actions documented in Table 5.2 of the HRA notebook into the FPRA was provided in the FPRA notebooks, in particular the plant response model notebook.

The peer review observed that impacts for level transmitters related to undesired actions (LS-1 3-74, FT-1095A, FT-i1095B) were modeled incidentally in the FPRA, but the functional states related to spurious operation were not included for these transmitters on the FPRA equipment list nor included in the FPRA, and no corresponding undesired HFEs were defined. 150/151-510-A and 150/151-510-B and 150/151-510-C are related to a potential undesired action that could stop P-61, but no functional states related to spurious operation were identified in the equipment selection nor included in the FPRA and no undesired HFE was modeled. The FPRA development team indicated that P-61 is assumed to be failed for the FPRA development, but the review team suggests that it is better to include the modeling and assume that it also is failed (due to the potential that later PRA updates could credit P-61, and this potential undesired action would need to be captured).

No functional states related to spurious operation were identified in the equipment selection nor included in the FPRA and no undesired HFE(s) was modeled related toTS-7048, TS-7056, TS-7050, TS-7058.

The FPRA development team indicated that the undesired HFE(s) that would arise from spurious operation of these instruments related to SW operation, which they indicated was not modeled in the FPRA. However, SW was observed to be modeled in the FPRA.

No functional states related to spurious operation were identified in the equipment selection nor included in the FPRA and no undesired HFE(s) was modeled related 186-502, TIS-7320, 159N/DGI, and 159N/DG2. (This F&O originated from SR HRA-B4)

Proposed Solution: Include HFEs for cases where fire-induced instrumentation failure of any single instrument could cause an undesired operator action.

Basis for Significance: The FPRA does not included modeling of HFEs for cases where fire-induced instrumentation failure of any single instrument could cause an undesired operator action.

Actual Solution:

As stated in the response to F&O 1-15, Fire HRA Notebook [Reference 45] Table 5-2 lists the fifteen (15) procedure cases (involving eighteen different instruments) that were originally identified where single instrument spurious operation was considered likely to cause an undesired operator response.

In response to this F&O, a further review was performed by Xcel staff with significant system and operations knowledge, as well as by the fire HRA team. As a result of this review, the updated disposition of the eighteen (18) indications is the following:

• Nine (9) were not credited in the fire PRA model because the equipment associated with the instruments is already considered failed during a fire;

• Four (4) were found to have been miscategorized as leading to an undesired action because operator disablement of the system or equipment when it is specifically required to function is not considered credible.

• Three (3) were not modeled because the postulated undesired operator action, to shut down equipment one by one until the ground is identified, is not considered credible, given that operators are generally aware of potential spurious signals caused by fire; and

• Two (2) were not needed in the model because the cable-induced failure causing the spurious indication already causes the failure of the component (EDG) functional state.

Revision 2 Revison 2Page 73 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Table 5-2 of the Fire HRA Notebook [Reference 45] has been updated accordingly and the Equipment Selection Notebook [Reference 49] was revised as necessary to include documentation of this update (Section 5.5.2).

It should be noted, however, that in several cases, it has been suggested that a warning could be added to the procedure in question that the signal is spurious in case of a fire in particular Fire Zones.

Impact on ILRT Extension:

The F&O resolution indicates that documentation of the review has been added to the Fire HRA notebook

[Reference 45]. This F&O has no impact on the ILRT Extension Risk Analysis.

Page 74 of 142 Revision 22 Page 74 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0029 F&O Number: 1-35 Associated SR(S): ES-C2 Detailed Problem

Description:

Instruments were identified from the review of ARPs whose spurious operation could result in undesired operator actions, but it is not clear from the FPRA documentation whether these instrument spurious operations were added to the FPRA equipment list. Later confirmation was made during the review that some of the identified instruments were not added to the FPRA equipment list.

Proposed Solution: Include instrumentation whose fire-induced failure, including Spurious indication, even ifthey are not relevant to the HFEs for which instrumentation is identified within the scope defined by ES-Cl, on the FPRA equipment list if the failure could cause an undesired operator action related to that portion of the plant design credited in the analysis.

Basis for Significance: Instrumentation whose fire-induced failure, including spurious indication, even if they are not relevant to the HFEs for which instrumentation is identified within the scope defined by ES-Cl, is to be included on the FPRA equipment list ifthe failure could cause an undesired operator action related to that portion of the plant design credited in the analysis.

Actual Solution:

As stated in the responses to F&Os 1-15 and 1-21, the fifteen (15) procedure cases (involving eighteen different instruments) that were identified where single instruments that if spuriously operated would be likely to cause an undesired operator response are listed in Fire HRA Notebook [Reference 451 Table 5.2.

The scope defined by ES-Cl refers to HRA-Bl, which in turn refers to HRA-Al, whose scope is the internal events HFEs carried over to the fire HRA. The procedure review included the full spectrum of AOPs, EOPs and ARPs, not just those associated with the internal events HFEs credited in the Fire PRA.

The results of the procedure review are summarized in Table 5.2 and documented in detail in Appendix G of the Fire HRA notebook [Reference 45].

Upon the issuance of the question posed in this and other F&Os during the Peer Review, the list of instrumentation identified in Table 5.2 was reviewed by Xcel staff with significant operations and training background, as well as by the fire HRA team. As a result, the updated disposition of the eighteen (18) indications is the following:

• Nine (9) were not credited in the fire PRA model because the equipment associated with the instruments is already considered failed during a fire;

• Four (4) were found to have been miscategorized as leading to an undesired action because operator disablement of the system or equipment when it is specifically required to function is not considered credible.

• Three (3) were not modeled because the postulated undesired operator action, to shut down equipment one by one until the ground is identified, is not considered credible, given that operators are generally aware of potential spurious signals caused by fire; and

• Two (2) were not needed in the model because the cable-induced failure causing the spurious indication already causes the failure of the component (EDG) functional state.

Table 5-2 of the Fire HRA Notebook [Reference 45] has been updated accordingly and the Plant Response Model [Reference 50] and Equipment Selection Notebook [Reference 49] will be revised as necessary to include documentation of this update.

It should be noted, however, that in several cases, it has been suggested that a warning could be added to the procedure in question that the signal is spurious in case of a fire in particular Fire Zones.

Impact on ILRT Extension:

The F&O resolution indicates that documentation of the review has been added to the Fire HRA notebook

[Reference 45]. This F&O has no impact on the ILRT Extension Risk Analysis.

Revision 2 Page 75 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0089 F&O Number: 5-2 Associated SR(s): ES-A1, ES-A4, ES-A5, ES-A6, ES-B2 Detailed Problem

Description:

The evaluation of potential MSOs included in the Equipment Selection and Plant Response Model Notebooks, 01601 5-RPT-03, were, in general, found to be very narrowly focused and based largely on the assessments originally developed for fire safe shutdown. Further, a review of these assessments revealed incomplete evaluation or treatment of various MSOs. Specific examples are cited below:

MSO 2a - Spurious head vent was scr'eened based on line size for the safe shutdown analysis. However, spurious head vent involves a loss of RCS integrity and needs to be retained per ES-A5 and equipment are to be placed on the FPRA equipment list.

MSO 2b - The MSO was considered by the FPRA development to be a high consequence initiation event (non-isolable LOCA outside containment). It was evaluated as such, and determined to require four spurious actuations. Therefore, it was not required to be added to the model, per ES-A6. However, the peer review noted that three spurious actuations will produce MSO 2b: two MSIVs spuriously open on a steam line (inboard and outboard), and one of two turbine bypass valves fail to close (BPV-1 1 or BPV-12), and therefore will be retained per ES-A6 and equipment placed on the FPRA equipment list and developed in the plant response model.

MSO 2i Spurious Drywell Spray valves - There is no discussion of impact on LPCI.

MSO 2d - Not modeled, based on small LOCA leakage potential (40-70 gpm). However, MSO 2d involves a loss of RCS integrity and needs to be retained per ES-AS and equipment are to be placed on the FPRA equipment list.

MSO 2e - This MSO involves a fire induced LOCA through the SCRAM discharge volume; screened from the FPRA equipment list using cable selection I routing arguments. Cable selection / routing arguments are not applicable to the equipment selection process and are not an applicable bases for ES screening.

MSO 5g - Asynchronous paralleling of onsite power sources. Included in the model, but the potential initiating event impacts are not documented. Support system initiating events are modeled by the general transient event tree in the MNGP PRA model, so probably a documentation issue only, unless the loss of two buses due to the asynchronous paralleling alters the applicability to the general transient event tree.

MSO 2-New Potential pumping of suppression pool to the CST. Screened based on plant modifications to prevent pumping of suppression pool to the CST. Regardless of modifications, the pertinent equipment would need to be included on the FPRA equipment list unless a means is found to screen them (e.g., based on the number of spurious operations, or based on passive devices such as orifices or manual valves). If orifices used, would need to reference the thermal hydraulic calculation.

MSO 21, 2-new-6 Assessment of spurious CS or RHR without flow paths does not include impact on the increase in temperature of the suppression pool from spuriously running pumps. Also, the potential impacts from pump running on minimum flow for an extended period not discussed (the possibility for pump damage). The potential for pump dead-heading was addressed by assessment of MSOs through plant modifications. Modifications address fire safe shutdown, but it is not clear whether these modifications permit screening from the PRA / FPRA equipment list.

MSO 2m Assessment seems to be inconclusive. It states that three phase hot shorts 'appear to be required'. It also references a manual valve that is not identified on the drawings. This is only a documentation issue only; there is need only to clarify the documentation.

Flow diversion scenarios for HPCI and RCIC do not evaluate transfer of inventory from Pool to CST and vice versa (including CST overfill)

MSO 4r,s,t,u - Containment overpressure is not included in the model, despite being critical to the operation of CS and RHR pumps. Justification is provided for exclusion of major valves, but there was no evaluation of all of the potential spurious operations that could reduce containment overpressure. In addition, the MSO evaluation report identifies several treatments for alternate safe shutdown.

Modifications address fire safe shutdown, but it is not clear whether these modifications permit screening Revision 2 Page 76 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension from the PRA I FPRA equipment list (For example, one plant modification made for 4s allows fire safe shutdown to address the MSO from the alternate shutdown panel. The PRA may model scenarios that don't involve alternate shutdown that could be impacted by MSO 4s).

MSO 5a This MSO is not addressed. The modeling only treats failure of load shed. It does not address diesel challenges due to simultaneous 9or out of sequence) breaker closures or overloading due to multiple sequential breaker closures.

MSO 5d The evaluation of spurious RHRSW does not take into account that RHRSW flow path is normally isolated by valves at the heat exchangers.

MSO 5f It is not clear that the evaluation of paralleling the Diesel with offsite power is complete. Divisional separation does not provide an allowable basis to screen equipment from the FPRA equipment list. It only addresses 'most cases' and refers to a mod on only one of the diesel generators.

There is no discussion of combinations of MSOs e.g., cumulative impact on inventory control function of SORV plus head vent, or multiple recirc pump fail to trip, etc.

MSO 5h - Based on discussion with FPRA development team, MNGP switchyards are synchronized, however, it was difficult for the review team to ascertain this from the documentation.

There is no discussion of combinations of MSOs such as spurious head vent plus a single SRV, or failure of two recirc pumps to trip.

Proposed Solution: Complete review of generic MSOs and address MSO combinations.

Basis for Significance: This F&O is classified as a finding as several of the MSOs in question could prove to be risk significant.

Actual Solution:

After the peer review, generic MSOs evaluations were reviewed and revised to provide additional detail and clarification, and include new evaluations for a number of MSOs. MSO combinations were considered and addressed where applicable. Updated MSO evaluations are documented in the Equipment Selection [Reference 49] and Plant Response Model Notebooks [Reference 501. The specific concerns cited in this F&O were addressed as follows:

MSO 2a - Evaluation revised to provide details related to the basis for screening; the scenario is screened based on thermal-hydraulic analysis performed and documented in EC 20901 and EC 20902.

MSO 2b - MSO developed and included in model. Evaluation revised.

MSO 2i - EC 20669 QF-0525 installs a shorting circuit using control room switches 10A-S9AIB for RHR Valves MO-2020 and MO-2021, respectively. The installation of a shorting circuit ensures that the RHR Drywell Spray Outboard Isolation Valves, MO-2020 (Division 1) and MO-2021 (Division 2), remain in their normal closed position in the event of a fire. No operator action is required to preclude spurious opening of MO-2020 or MO-2021.

MSO 2d - Evaluation revised to provide details related to the basis for screening; the scenario is screened based on thermal-hydraulic analysis performed and documented in EC 20901 and EC 20902.

MSO 2e - Evaluation revised to provide details related to the basis for screening; the scenario is screened based on thermal-hydraulic analysis performed and documented in EC 20901 and EC 20902.

MSO 5g - Evaluation was revised to include a discussion of how the MSO was incorporated into the model sequence logic.

MSO 2-New-2 - Evaluation revised to discuss consequences of all potential sources of water to the CST.

MSO remains screened. Evaluation of flow diversion scenarios for HPCI and RCIC that transfer inventory from Pool to CST and vice versa (including CST overfill) are included.

MSO 21, 2-new The evaluation of MSO 2-new-6 includes the assessment of the CS and RHR spurious starts. An increase in temperature of the suppression pool is not considered for evaluation at MNGP due to timing for the event.

MSO 2m - Documentation issue only. Evaluation revised to clarify.

MSO 4r,s,t,u - Evaluations revised to address all of potential spurious operations that could reduce containment overpressure. EC 20901 includes MSO's originally screened out as being "insignificant" to Revision 2 Page 77 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension assess the risk of combined MSO's, up to a maximum of four simultaneous spuriously operating components. In all MSO cases, the acceptance criteria are met. It was determined upon review of MSO 4r that its disposition was sufficient.

MSO 5a - MSO evaluation provided to address potential DG failures due to additional components loading. Evaluation includes input from plant systems analysts.

MSO 5d - The evaluation was updated to further clarify that the spurious start of the RHRSW pumps is not included due to the current modeling bounding the MSO. The CVs that isolate the RHRSW pumps are modeled in the logic and fail the pump. A spurious start of the pump would also require a failure of the CVs, which is already modeled. Therefore modeling spurious start of the pump is unnecessary.

MSO 5f - The evaluation was updated to clarify that the modification installed precludes the MSO from occurring.

MSO 5h - Evaluation revised to discuss switchyard breaker operation. All are controlled either locally in the subyard and/or from the grid system control center. The only breakers in the switchyard that can be operated from the Monticello Plant Control Room are the main generator output breakers.

Text was added to the MSO section to clarify that combinations of MSOs, such as spurious head vent plus a single SRV, or failure of two recirc pumps to trip, were considered during the MSO expert panel meeting, but no additional scenarios were identified.

The updated MSO evaluations are included in the referenced ES and PRM notebooks [References 49 and 50].

Impact on ILRT Extension:

Each MSO issue has been addressed and the model has been revised. There is no direct impact to the ILRT Extension Analysis.

Page 78 of 142 Revision 22 Page 78 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0090 F&O Number: 5-3 Associated SR(s): ES-B1, ES-DI Detailed Problem

Description:

The following deficiencies were noted in the ES documentation:

1. There is no documentation of the basis for exclusion of SSEL components. This had to be provided informally by the PRA team.

2. The list of screened components in Table D-1 includes events that should retain their random failure values as well as those that should be failed.

3. The MSO evaluation table is not consistent in use of 'not modeled' vs 'modeled' in its disposition column. In some cases these entries conflict with the discussion of the assessment of the MSO.

4. In some cases, the MSO Evaluation table in the ES report is not consistent with the similar table in the PRM report.

5. These are several basic events that have no basis for screening in table D-1.

Proposed Solution: Provide a separate table that includes disposition of all SSEL components and make changes as necessary to ensure consistency, completeness and clarity of documentation.

Basis for Significance: This is considered a finding based on the need for additional information to be provided in order to evaluate SR ES-B2.

Actual Solution:

1. The documentation of SSEL dispositions is included in the updated ES notebook [Reference 49] and ES database.

2. The update ES notebook [Reference 49] includes updated text that indicates that all screened components will retain their random failures. There is also now a column that indicates if a component is always failed in the model.

3. The MSO table in the updated notebook text is updated to reflect the proper "modeled" or "not modeled" dispositions.

4. The MSO tables in the updated ES report and PRM report have been revised so they are consistent.

5. A review of the basic events in D-1 was performed and the updated ES Notebook [Reference 49]

includes a screening basis for all entries.

Impact on ILRT Extension:

This documentation F&O has been resolved. There is no impact on the ILRT Extension Risk Analysis.

Page 79 of 142 Revision 22 Page 79 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0091 F&O Number: 5-4 Associated SR(s): ES-Al, ES-A4, ES-A5, ES-A6, ES-B2 Detailed Problem

Description:

Fault propagation sequences (single spurious or no spurious) are not modeled and can have a significant impact on mitigation. An example would be the fault of a 4 kV load cable and damage to its breaker of dc power source that prevents the breaker from opening. The incoming breaker (from offsite power or diesel) would open de-energizing the bus. If the incoming breaker is also impacted, the sequence could include loss of the next upstream bus as well.

Proposed Solution: Include fault propagation logic in the model for breakers with separate control circuits.

Basis for Significance: This F&O is a finding given that the omitted sequences have a high potential to be risk significant.

Actual Solution:

A review was performed of the fault propagation sequences that could occur for specific fire scenarios.

The cable pairs that can cause the faults on the upstream buses were checked to ensure that all pairs that were both failed in specific fire scenarios had the upstream bus failures included in the scenarios as well. This process was documented in the PRM notebook [Reference 50].

Impact on ILRT Extension:

The resolution to the F&O indicates that fault propagation is appropriately modeled. There is no impact on the ILRT Extension Analysis.

Page 80 of 142 Revision 22 Page 80 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0092 F&O Number: 5-5 Associated SR(s): CS-B 1, CS-C4 Detailed Problem

Description:

For power supplies addressed by existing coordination analyses, the studies must be reviewed to confirm coordination exists for fire PRA credited power supplies for the configurations credited in the fire PRA. In some cases a study may conclude that a power supply is not coordinated, requires credit for cable length to achieve coordination, or is only coordinated in certain power distribution configurations (e.g., not cross-tied).

For power supplies not previously evaluated, the evaluation must be performed.

For those power supplies credited in the fire PRA that are not adequately coordinated, adjustments to the cable mapping and/or modeling of the components must be made. (This F&O originated from SR CS-BI)

Proposed Solution: Review existing overcurrent protection analyses to confirm that coordination exists for fire PRA credited power supplies for the configurations credited in the fire PRA. Evaluate power supplies not addressed by existing calculations. Identify any additional circuits and cables whose failure could challenge power supply availability due to inadequate electrical overcurrent protective device coordination.

Basis for Significance: An evaluation of electrical coordination was not performed and has the potential for risk significant impact on the fire PRA.

Actual Solution:

This is an open F&O. A sensitivity analysis is documented in the Fire PRA Sensitivity and Uncertainty Notebook section 5.3.1 [Reference 40]. The sensitivity analysis summary is documented in section 5.3.5 of this calculation.

Impact on ILRT Extension:

A sensitivity was performed in Section 5.3.5 to assess the potential quantitative impact of incorporating power supply coordination into the Fire PRA. The results of the sensitivity study show a very small increase in the Fire CDF and LERF. Therefore, there is negligible impact from this open F&O on the usage of the Fire PRA CDF and LERF in the ILRT Extension Risk Analysis.

Page 81 of 142 Revision 22 Revision Page 81 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0093 F&O Number: 5-6 Associated SR(s): CS-Cl Detailed Problem

Description:

The review team noted the following documentation items associated with the CS element:

1. Assumption number 4 in Section 4 of the CS notebook states: 'It was assumed that the cable selection and circuit analysis that supported the Appendix R Safe Shutdown Equipment List (SSEL) was complete and correct. This information as previously documented in the Monticello Appendix R Database (MNGP APPR.mdb) as part of the Appendix R Safe Shutdown Analysis (SSA). A review of these components was completed to determine ifthe cable selection for Appendix R was appropriate and/or bounding for Fire PRA applications'. Per interview with FPRA development team, existing Appendix R circuit analyses were, in fact, not assumed to be complete and correct. Each package was validated using modern criteria - not simply reviewed for applicability. This is an important and necessary activity and the documentation should be clarified to identify that it was performed. Section 5.2 should also be revised.

2. In Table B-5 of the ES notebook, MSIV-ISOL-A:AvaiI:Avail is not currently used in the fire PRA and can be deleted.

3. Table 0-1 of the ES notebook, which identifies relays screened from CS, also includes relays that are 'included' by virtue of equivalence to other components or pseudo-components. Additional data should be provided to identify how they are included (reference the analyzed event), and would be better presented in a separate table.

(This F&O originated from SR CS-C2)

Proposed Solution: Make the necessary document changes.

Basis for Significance: This is considered a finding as item I is the validation of a critical input and must be properly represented in the documentation.

Actual Solution:

1. Assumption 4 of Section 4.0 and Case I of Section 5.2 has been updated to better clarify that Appendix R circuit analysis packages were validated for usage in the Fire PRA.

2. N/A to this notebook, update performed in the PRM notebook [Reference 50].

3. N/A to this notebook, update performed in the ES notebook [Reference 49].

Impact on ILRT Extension:

This documentation finding has no impact on the ILRT Extension Analysis.

Page 82 of 142 Revision 22 Page 82 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0094 F&O Number: 5-7 Associated SR(s): CS-Al Detailed Problem

Description:

The circuit analyses for some pseudo-components were found to be broad and merit further refinement.

For example, the circuit analyses for the spurious ADS pseudo-components include cables that are must fail in combination to result in spurious ADS.

Proposed Solution: Refine circuit analyses associated with risk significant failures.

Basis for Significance: Conservatisms exist in circuit analysis associated with risk significant failures.

Actual Solution:

The circuit analysis for pseudo-components and all components are analyzed at a functional state level to match the basic events in the Fire PRA model. All risk significant basic events as identified during cutset reviews are evaluated to determine whether further detailed circuit analysis can be performed in order to reduce any conservatisms in the circuit analysis of the corresponding function state.

The circuit analysis and function states for the ADS pseudo-components were developed in the MNGP Fire PRA at a train level (A and B) instead of for each ADS Initiation relay due to the common cables (different conductors) associated with the 2E-K6A and 2E-K7A relays (similar for B), see drawing NX-7831-143-2. This cable routing on the main scheme of the pseudo eliminates some of the conservativeness of the ADS Initiation relay contacts being in series with each other, see NX-7831-143-2.

However, conservatism does exist in the pseudo components by including off scheme cables that affect the spurious actuation of relays 2E-K6A and 2E-K7A.

For the ADS pseudo-components, the circuit analysis has now been broken down from two pseudos into four, one for each ADS Initiation relay.

ADS-CHANN EL-K6A:Avail:Non-Spur ADS-CHANN EL-K7A:Avail:Non-Spur ADS-CHANNEL-K6B:AvaiI:Non-Spur ADS-CHANN EL-K7B:Avail:Non-Spur The Fire PRA model has been updated to incorporate AND gate logic of each ADS Initiation pseudo on a train level.

Impact on ILRT Extension:

The results of this F&O resolution are that the spurious ADS pseudo components still have conservative cable selection, so the Fire induced CDF and LERF are conservative for the ILRT Application.

Page 83 of 142 Revision 22 Page 83 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent !LRT Extension Change Number: MT-15-0022 F&O Number: 1-26 Associated SR(s): AS-Al0, AS-A4, AS-A5, AS-A7, PRM-B5, PRM-C1 Detailed Problem

Description:

The alternate shutdown (ASD) accident sequence development is developed for the case in which 40 minutes are available to establish alternate shutdown to establish core cooling through the use of core spray train B and decay heat removal through RHR train B3.

Issues were identified associated with the accident sequence and system modeling development for ASD:

Spurious SRV opening due to hot short impact is not addressed by the ASO modeling. Analysis performed under EPU and MSO conditions (EC 20955) demonstrated that spurious operation of the SRVs in the ASDS scenario for seven minutes would not adversely impact Monticello's safe shutdown analysis, and would not jeopardize the safe and stable condition of the fuel. Based on observation by the peer review, the referenced calculation, EC 20955, does not support this claim in that time frame. The peer review team queried regarding the time available for one SRV open to reach core damage, and the FPRA development team indicated 17 minutes are available. Therefore, two 'relevant accident sequences are presented, which are not modeled: 1) SRVs spuriously open for seven minutes or less and reclose due to hot short(s) going to ground; the time available to perform ASD may need to be adjusted for this case. The FPRA development team performed a MAAP run for the peer review team and found that 30 minutes are available to perform ASD is one SRV spuriously opens for seven minutes and recloses, and 27 minutes are available if two SRVs are spuriously open for seven minutes. These T/H results significantly impact the timing for the HFE development for ASD (as currently modeled in the HRA calculator, there would be insufficient time available to execute ASO). This strongly suggests that additional HFEs would need to be identified for this particular ASD sequence; and 2) SRVs spuriously open and do not reclose in time to be mitigated by ASD or to prevent core damage, including probabilities for hot short duration. (This F&O originated from SR PRM-B9)

Proposed Solution: Ensure that the accident sequence development for alternate shutdown accounts for all applicable MSO scenarios.

Basis for Significance: ASD is a risk-significant FPRA contributor.

Actual Solution:

Draft T/H analyses were recently performed to ascertain the time available for human actions at the ASDS panel. These T/H analyses account for various numbers of SRVs spuriously opening, each yielding a different time window. The ASD model and associated human failure events (HFEs) have been updated accordingly to reflect the latest data.

Impact on ILRT Extension:

The T/H analysis is finalized [Reference 38]. The F&O is resolved, and there should be no impact on the ILRT Extension Risk Analysis.

Revision 2 Revison 2Page 84 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0035 F&O Number: 1-40 Associated SR(s): SY-A5 Detailed Problem

Description:

System modeling was added for: alternate shutdown modeling, instrumentation that supports operator actions modeled by the FPRA, as well as system modeling for MSOs 2c, 2j, 2k, 2o, 2ai, 2aj, 3a, 3b, 3c, and 5a (failure of load shed only), 5g, 7a. No documentation is provided on the consideration of the potential effects of alternate system alignments.

MSO scenarios introduce new equipment and new flow paths into the PRA, which potentially are impacted by alternate system alignments. As an example, MSO 2c models spurious opening of the steam line drains, and an alternate system alignment could alter the destination of the leakage flow. The FPRA development team would need to at least examine the potential for any of the new components / flow paths modeled, and document what they found. No documentation and no self-assessment of SY-A5 were provided in the notebooks.

Proposed Solution: Include the effects of both normal and alternate system alignments, to the extent needed for CDF and LERF determination.

Basis for Significance: Potential alternate alignments need to be considered in the development of system models.

Actual Solution:

Normal, alternate, and emergency system alignments are captured by the use of flags in the internal events PRA model as documented in Section 1 of each of the PRA system notebooks.

Review of new system modeling for MSOs, alternate shutdown, and added instrumentation, did not identify any system alignments that were not already considered as part of the internal events modeling.

The PRM notebook [Reference 50] has been revised to include a statement about the review of potential alignments.

Impact on ILRT Extension:

The F&O is resolved and there is no impact on the ILRT Extension Risk Analysis.

Page 85 of 142 Revision 22 Page 85 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0050 F&O Number: 3-6 Associated SR(s): PRM-B1 0 Detailed Problem

Description:

The Fire PRA plant response model was not successfully modified to fail SSCs not selected in the ES element. Representative examples of this include:

1. In the PRM notebook, the basis for exclusion of MSO 5j is that 'Monticello does not credit operation of service water', however, service water is not failed in the logic model.

2. In section 3.2 of the PRM notebook Water, it states that use of the Fire Water System as a back-up to LPCI is not credited, however, this is not failed in the model.

3. In both the ES notebook and PRM notebook, it is stated that CRDH and SLBC were not used in the fire PRA, however, these are not successfully failed in the model. They were failed by putting appropriate flags set to 1.0 in the model. However, basic events for SBLCS components (L) and HFE's appear in the results. Basic events for CR0 pump random failures (J) also appear in the model, with random failure probabilities. If the systems are correctly FLAGGED out, there should not be random failures of these systems. If the correct component is flagged, the logical 1.0 should propagate to the top of the tree, eliminating all other random failures. The fact that random events for these systems appear in cutsets indicate the correct basic event has not been chosen to be flagged.

This particular example is not expected to be risk significant.

4. Individual components identified in Table D-1 of the ES notebook as not credited were not failed in the PRM [e.g., FPAP1AXXXR12-S - CONDENSATE PUMP P-1A FAILS TO RUN (SHORT TERM)]

5. Conversely - Basic events that were not failed in the model, yet were not included in table C-i as credited [e.g., ABSLPCIAXG - LPCI MCC FAULT (MCC-133A)]

Proposed Solution: For systems equipment that were included in the Internal Events PRA but were not selected in the ES element, and that are potentially vulnerable to fire-induced failure, are to be failed in the worst possible failure mode, including spurious operation.

Basis for Significance: Inadvertent credit for non-selected equipment is a potentially risk significant error.

Actual Solution:

At the time of peer review, the documentation for this particular file lagged behind the model updates and therefore did not appropriately reflect what was modeled. Both the flag file and the documentation has been updated to reflect the non-credited components in the master flag file appropriately. In addition, components that did not have cable selection have been either failed or dispositioned appropriately in the notebook.

A review of the ES notebook [Reference 49] and master flag file was completed and both files were updated to properly reflect the components and systems that were not credited in the model.

Systems affected by these updates include the fire water system, service water, CRDH and SBLC.

Impact on ILRT Extension:

This F&O is resolved and there is no impact on the ILRT Risk Extension Analysis.

Page 86 of 142 Revision 22 Page 86 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0051 F&O Number: 3-8 Associated SR(s): AS-A9, PRM-B7, SC-A3, SC-B1, SC-B3, SC-B5, SC-Cl, SC-C2 Detailed Problem

Description:

The peer review identified cases where new or modified success criteria would be needed to support the Fire PRA, as discussed below, but no thermal hydraulic calculations or success criteria development were found specifically developed for the FPRA.

Based on the review by peers, the following issues were identified. These are based on limited time to review and are only examples.

Regarding spurious SRV opening due to hot short impact analysis performed under EPU and MSO conditions (EC 20955) demonstrated that spurious operation of the SRVs in the ASDS scenario for seven minutes would not adversely impact Monticello's safe shutdown analysis, and would not jeopardize the safe and stable condition of the fuel. Based on observation by the peer review, the referenced calculation, EC 20955, does not support this claim. The peer review team queried regarding the time available for one SRV open to reach core damage, and the FPRA development team indicated 17 minutes is available, but no specific thermal hydraulic calculation was documented. Therefore, thermal hydraulic calculations need to be developed or referenced to support ASD accident sequence modeling for the cases in which spuriously open SRV(s) reclose as well as spuriously open SRV(s) do not reclose.

T/H calculations are needed for the following FPRA cases:

A) 1 SRV open for 7 minutes: Time at which injection must occur to prevent core damage.

B) 2 SRV open for 7 minutes: Time at which injection must occur to prevent core damage.

C) SRVs spuriously open and do not reclose in time to be mitigated by ASD or to prevent core damage, including probabilities for hot short duration.

The need for success criteria development has been noted by the peer review for MSO 5a (additional loads on diesel): the number of additional loads and the specific impact to the diesels have not been determined. The success criteria development will need be confirmed to be consistent with the features, procedures, and operating philosophy of the plant. (This F&O originated from SR PRM-B7)

Proposed Solution: Identify any cases where new or modified success criteria will be needed to support the Fire PRA consistent with the HLR-SCA and HLR-SC-B of Section 2 and their supporting requirements.

Basis for Significance: ASD modeling is risk-significant. MSO 5a was screened from FPRA modeling without success criteria consideration for the DGs.

Actual Solution:

Regarding spurious SRV openings, draft T/H analyses were recently performed to ascertain the time available for human actions at the ASDS panel. These T/H analyses account for various numbers of SRVs spuriously opening, each yielding a different time window. The ASD model and associated human failure events (HFEs) have been updated accordingly to reflect the latest data.

The modeling for MSO 5a was developed using input from plant personnel and is documented in the PRM notebook [Reference 50]. The modeling is considered to be conservative and is based on the features, procedures, and operating philosophy of the plant. The MSO results in the total loss of the EDG.

Impact on ILRT Extension:

The T/H analysis is finalized [Reference 38]. There is no impact to the ILRT extension analysis.

Page 87 of 142 Revision 22 Page 87 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0106 F&O Number: 6-8 Associated SR(s): PRM-CI, AS-C2, AS-Cl, SC-Cl, SC-C2, SY-Ci, SY-C2 Detailed Problem

Description:

Appendix B of the Plant Response Model notebook documents the modeling changes made for the FPRA, but does not go into detail for all of the logic changes made to create the fire PRA. The peer review noted that 798 gates added to the FPIE PRA model for the FPRA development, and 427 FPIE gates were altered for the FPRA. Detailed information should be provided for how the FPIE PRA model was converted into the fire PRA, including system modeling, success criteria development, and accident sequence analysis.

A more thorough discussion is required on the development of the ASD logic, including the back referenced SRs in AS/SC/SY/DA. Regarding the alternate shutdown modeling, Section B.4 provides a brief description of the development for the alternate shutdown model. However, limited discussion is provided on logic changes made to the system models for alternate shutdown, and the new events added. The new ASD logic created basic events associated with unique cable failures. No details are provided in the documentation to support that effort. More documentation also is needed of the processes used to develop accident sequences and treat dependencies in accident sequences, including the inputs, methods, and results, such as: the success criteria established, a description of the accident progression, and the interface of the accident sequence model with plant damage states.

Proposed Solution: Document the Fire PRA plant response model consistent with HLR-PRM-C, HLR-AS-C, HLR-SC-C, and HLR-SY-C and their SRs, in a manner that facilitates Fire PRA applications, upgrades, and peer review.

Basis for Significance: Documentation of the system modeling, success criteria development, and accident sequence analysis is needed to facilitate PRA applications, upgrades, and peer review.

Actual Solution:

The PRM notebook [Reference 50] was updated to include a more detailed description of the changes made to the internal events modeling for the FPRA. Several tables were added to Appendix B to clarify changes made to the system fault trees. These tables include information for changes related to ASD, power supply dependencies, MSO modeling, and other unique cable selection updates made for fire-specific failures.

The discussion on the development of the ASD logic in Appendix B.4 was also updated and more detail was added in the PRM notebook [Reference 50] as well as the HRA notebook [Reference 46]. Detailed discussion was added on logic changes made to the system models for alternate shutdown, and the new events that were added, including the special basic events for components that have alternate cable selection when they are operated from the ASD panel. Additional information on success criteria used for ASD sequences was also added based on new MAAP runs that were performed to refine the ASD logic.

Impact on ILRT Extension:

The F&O is documentation related and is closed. There is no impact on the ILRT Extension Risk Analysis.

Page 88 of 142 Revision 22 Page 88 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-01 07 F&O Number: 6-9 Associated SR(s): SY-A19, PRM-Bg, SY-Al, SY-A16, SY-A14, SY-B9, SY-B5 Detailed Problem

Description:

Common cause and test and maintenance, and pre-initiator human error basic events for core spray and RHR are missing from the ASD Logic. Additionally, the alternate shutdown modeling of core spray train B is also missing the failure mode for: 'CS Pump P-208B to run after the first hour.' Also, the review found that power supplies for some of the active components were missing from the alternate shutdown logic.

(This F&O originated from SR DA-E2)

Proposed Solution: Include component failure mode basic events and system dependencies for system modeling added for the FPRA consistent with HLR-SY-A, and HLR-SY-B.

Basis for Significance: Missing random failure basic events underestimate the unavailabilities of systems and trains modeled for alternate shutdown, which has a risk-significant impact on the FPRA results.

Actual Solution:

Some of the new basic events that were added to the model were not linked to existing type code data.

The model was updated so that all new basic events are connected to existing Type codes so that the proper data are connected and existing data documentation is correlated.

RHR and CS logic for ASO have been reviewed and basic events for common cause failures, test and maintenance, as well as pre-initiator human failure events (HFEs) have been added where appropriate.

CPCP208BXTI2-ASD (CS PUMP P-208B FAILS TO RUN 1ST HOUR) has been added to the ASD logic.

The ASD logics were updated after the peer review to remove conservatism in the overall modeling approach and this pump was included in the updated modeling.

A detailed review of all power supplies in the model was completed and the appropriate supplies have been added to the model. This is documented in Appendix B of the PRM notebook [Reference 50].

Impact on ILRT Extension:

The F&O is resolved, and is no impact on the ILRT Extension Risk Analysis.

Page 89 of 142 Revision 22 Page 89 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0097 F&O Number: 6-Il Associated SR(s): PRM-B9, SY-Al, UNC-A2, DA-E2 Detailed Problem

Description:

Basic events added to the FPRA associated with the following failure modes have failure probabilities set to zero:

UPS panel fault Circuit breaker fails to remain open Circuit breaker fails to open Fused disconnect switch, fuse spuriously fails Transformer fault CS pump fails to start CS pump fails to run 1st hour MOV fails to remain open MOV fails to open MOV fails to close 125 VDC distribution panel fault AOV fails to remain closed AOV fails to remain open Level transmitter spurious operation RHR Pump fails to run RHR Pump fails to start Solenoid valve fails to transfer (This F&O originated from SR SY-A2)

Proposed Solution: Include failure probabilities for system modeling added for the FPRA consistent with HLR-SY-A, and HLR-SY-B.

Basis for Significance: Basic event probabilities of zero underestimate the unavailabilities of systems and trains modeled for the FPRA, including the alternate shutdown modeling, which has a risk-significant impact on the FPRA results.

Actual Solution:

A full review of the basic events in the model was completed and all events that had no associated unavailability data were updated to use type code data where necessary. The basic events that previously did not have unavailability data were all newly added for the FPRA and mostly associated with ASD.

In the case of the UPS panel fault and any other basic events that were split out to represent primary and alternate or AC and DC power supplies, these unavailabilities are captured in the original BE associated with the specific component. These new BEs are only used for fire impacts and are only set to true in specific fire scenarios.

Impact on ILRT Extension:

The F&O is resolved and there is no impact on the ILRT Extension Risk Analysis.

Page 90 of 142 Revision 22 Page 90 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-01 08 F&O Number: 7-3 Associated SR(s): PRM-A4, PRM-CI, SY-Al, PRM-B9 Detailed Problem

Description:

The purpose SR PRM-A4 is to confirm that the plant response model is constructed in such a manner that it reflects the failure of identified equipment due to the loss of the associated equipment selected cables.

Based on the review by peers, the following issues were identified. These are based on limited time to review and are only examples.

The fault tree modeling of essential cues for HFE HPI-CNTRLY is not correct. The cues are modeled under gate F-HEP-CNTRLML, and ANDed with the medium LOCA initiator IE_MLOCA 2.72E-4/yr (with no FPRA IE modeled there). The FPRA development team concurred that the cues modeling gate LRPV-INSTR should be input into OR gate F020 (Ored with HPI-CNTRLY).

Equipment Selection report 01601 5-RPT-03 Table B-2 identifies ADS-CHANNEL-A:AvaiI:Non-Spur and ADS-CHANNEL-B:AvaiI:Non-Spur low level pseudo functions and equipment dependencies. It was determined during CS that the cables were properly mapped to the ADS pseudo component. Equipment SV271A, C, and D are dependent on both ADS A and B channel cables. However, review of the FRANX database FPRA ODE 2-2 determined improper Component to basic event mapping was made to the PRM. ADS channel A is mapped to SV271A and ADS channel B is mapped to the remaining SV271C and D.

A review of pseudo components MSIV-ISOL-A:Avail:Avail and LLS-DIV-B1 :Avail: Non-Spur as identified in the ES procedure determined there was no modeling of the component to basic event relationship. From peer discussion it was determined that the noted pseudo-components were determined not required in the model following cut set review by the utility.

In addition, there was no evidence that the interlocks on the cable selection data worksheets were reviewed and properly incorporated into the PRM.

Proposed Solution: Perform the review of equipment selected through to PRM basic events to confirm the Fire PRA plant response model is consistent with the scope and location of equipment and cables (accounting for cable damage effects on the equipment of interest) per Section 4.2.2 and Section 4.2.3.

Basis for Significance: From the review performed it appears there may be two PRM related areas requiring additional review. Review the PRM model for correct component to basic event mapping particularly in areas where component mapping is directed to more than one channel or division of components. And, identify and correct the appropriate documentation of selected equipment and/or response modeling.

Actual Solution:

Following the peer review, a review of the pseudo component and interlock modeling was performed and changes were incorporated into the model. This is documented in the updated FPRA PRM notebook

[Reference 50]. The logic for MSIV-ISOL pseudos was added at this time. The logic for the ADS-CHANNEL pseudos was also updated. New, more specific, ADS channel pseudos were added to the model as described in F&O 5-7 and replaced the existing ADS-CHANNEL-A and ADS-CHANNEL-B components.

The instrumentation modeling for HPI-CNTRLY was also fixed in the model. The gate I-HEP-HPI-CNTRL, which is an OR gate with the HEP and instrumentation gate L-RPV-INSTR, was included in gate 1038 where the original HEP was in the model.

Impact on ILRT Extension:

The F&O is resolved and there is no impact on the ILRT Extension Risk Analysis.

Page 91 of 142 Revision 22 Page 91 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0044 F&O Number: 2-10 Associated SR(s): FSS-C5 Detailed Problem

Description:

The damage mechanism for soldered piping (instrument air) is discussed resulting in a conclusion that piping located in a plume should be considered damaged, however a criterion for this damage is not established.

Proposed Solution: Establish a measurable damage criterion for soldered piping and provide the corresponding justification.

Basis for Significance: This SR requires the justification of damage criteria used in the Fire PRA. The criterion suggested for soldered piping needs to be fully developed and justified. Instrument air is fire risk-significant.

Actual Solution:

Appendix F of the Single Compartment Analysis Notebook [Reference 51] documents the methodology used to evaluate fire scenarios that may cause the depressurization of the instrument air piping. Such an event is assumed to lead to failure of the instrument air system in the Fire PRA model.

In Appendix F.3 of the Single Compartment Analysis Notebook [Reference 51], Piping Specification Standard PSRS_PSRS1 13_1 is referenced. This specification standard indicates that the fittings in the instrument air piping system are silver brazed. Silver brazing is a joining process whereby a non-ferrous filler alloy is heated to its melting temperature; this melting temperature is usually above 800°F (430°C) and distributed between two or more close-fitting parts by capillary attraction. At its liquid temperature, the molten filler metal interacts with a thin layer of the base metal, cooling to form an exceptionally strong, sealed joint due to grain structure interaction.

The brazing process temperatures are in the range of pre-flashover conditions in a fire event (approximately 600°C). The brazing process temperature is well within the range of fire plume conditions at a relatively short distance from the fire. Therefore, the analysis conservatively assumes that any piping exposed to fire plume conditions will cause a failure of the piping.

Document Condition Evaluation 01390623-01 indicates that the instrument air compressors would not be able to maintain adequate flow and pressure if a 2 inch line break were to occur. The Fire PRA assumes that depressurization will occur in those instances where the failed piping is at least 1.5 inches in diameter.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Revision 2 Revison 2Page 92 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0055 F&O Number: 4-11 Associated SR(s): FSS-D4 Detailed Problem

Description:

An initial ambient temperature of 20°C was utilized in the fire modeling calculations for all MNGP fire zones. This ambient temperature does not appear to be appropriate for areas that are not temperature controlled such as the Turbine Building, Diesel Generator Building, and areas of the Reactor Building.

Proposed Solution: Utilize an appropriate initial ambient temperature for non-temperature controlled areas and update the fire modeling calculations as necessary.

Basis for Significance: The use of a higher initial ambient temperature could impact the required HRR, damage time, and therefore, the severity factors and non-suppression probabilities.

Actual Solution:

The fire modeling calculations in the MNGP Fire PRA are performed with the in the following three fire models:

1. The Heskestad's Fire Plume Temperature Correlation (see Section 5.3.1 of NUREG 1805)

2. The Point Source Flame Radiation Model (see Section 9.3 of NUREG1 805)

3. The Zone Model CFAST mostly used for determination of hot gas layer development inside a fire zone.

Validation studies were conducted for the use of these models in the MNGP Fire PRA. Chapter 4 of NUREG 1934 lists the following model biases. Values larger than 1.0 indicate that the models tend to over predict the relevant fire condition. In contrast, values less than 1.0 indicate that the values are under-predicted.

• Between 0.73 and 0.94 for the Heskestad's Fire Plume Temperature correlation. It should be noted that these values are based on experiments where plume temperatures measured inside the hot gas layer, and therefore, are not fully applicable to zone of influence calculations in the early stages of the fire before the hot gas layer develops.

• Between 1.42 and 2.02 for the Point Source Flame Radiation model (ambient temperature is not a factor in this calculations), and

• 1.06 for the hot gas layer temperature in CFAST.

NUREG 1934, Table 4.1, reports that CFAST over predicts hot gas layer temperatures by six percent.

The MNGP fire PRA utilizes the thermoplastic damage criteria of 205oC therefore six percent of the damage criteria is approximately 12 degrees Celsius. Given the over-predictions in the models listed above, together with the conservative use of heat release rate values (98th percent values are recommended in NUREG/CR-6850 for screening purposes), relatively small changes in the ambient temperature will not affect the predictions and the corresponding implementation in the Fire PRA.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 93 of 142 Revision 22 Page 93 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0064 F&O Number: 4-20 Associated SR(s): FSS-C5, FSS-D9 Detailed Problem

Description:

Although the damage criteria for sensitive electronics is defined in the Single Compartment Analysis Notebook 016015-RPT-06 and zones of influence (critical distances) are calculated in the Fire Modeling Database, there is no specific discussion of how specific sensitive electronics at Monticello are analyzed in the FPRA.

Proposed Solution: The Single Compartment Analysis Notebook 01 601 5-RPT-06 and the Fire Modeling Database require an update to specifically discuss the treatment of sensitive electronic targets, for temperature, heat flux, and smoke impacts, in the FPRA including the use of the guidance in Fire PRA FAQ 13-0004.

Basis for Significance: There is no documentation ensuring the sensitive electronics have been addressed in accordance with the damage criteria of NUREG/CR-6850 or analyzed in accordance with the guidance in Fire PRA FAQ 13-0004.

Actual Solution:

The Fire PRA Single Compartment Analysis notebook [Reference 51] has been updated to reflect the analysis associated with sensitive electronics. The treatment of sensitive electronics is as follows:

1. In Fire Zone 8, all the cabinets are closed. Therefore, the guidance in FAQ 13-0004 is applicable.

That is, the fire generated conditions associated with damaging thermoset cables are necessary to damage sensitive electronics inside a closed cabinet. Specifically to this fire zone: 1)

Electrical cabinets that are both ignition sources and targets are failed at ignition time, failing all the sensitive electronics inside the panel, 2) The adjacent bank of cabinet is failed at the time of the first cable tray failure above the ignition source, which fails sensitive electronics in the adjacent panel, 3) the hot gas layer scenario for the room fails all the targets in the fire zone at the thermoplastic damage temperature of (approximately 200 00), which fail all sensitive electronics in the room, 4) the multi compartment scenarios where Fire Zone 8 is the 'exposed" compartment credit the manual suppression at the time of the hot gas layer in the 'exposed" (i.e.,

in Fire Zone 8)- therefore the sensitive electronics in inside the panels are failed at the thermoplastic damage criteria in the room.

2. In Fire Zone 9, FAQ 13-0004 does not apply to the main control board because the back of the board is open. The FAQ however applies to any sensitive electronics in the closed cabinets behind the main control board. For the specific case of the closed cabinets behind the main control board, as well as for the main control board panels, the control room is abandoned at temperatures around 100 °C (see Appendix A of 01 601 5-RPT-07), at which point no equipment is credited, regardless if the panels are open or closed. Currently, the model does not credit any suppression where the control room is the exposed compartment. Therefore, targets in the control room are assumed to fail at ignition.

For all other fire zones, there are no open panels containing sensitive electronics. During plant walkdowns, observations confirmed that all panels were closed. Therefore, the guidance in FAQ 13-0004 is applicable. That is, the fire generated conditions associated with damaging thermoset cables are necessary to damage sensitive electronics inside a closed cabinet.

Impact on ILRT Extension:

This is a documentation F&O and is resolved. There is no impact to the 1LRT Extension Risk Analysis.

Page 94 of 142 Revision 22 Revision Page 94 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0065 F&O Number: 4-21 Associated SR(s): FSS-C8 Detailed Problem

Description:

A technical basis for the fire resistance of the embedded cables credited in the Fire PRA analysis is not provided.

Proposed Solution: The technical basis for the fire resistance of any credited embedded cables should be established. The integrity of all credited cable 'protection' should be established with respect to potential fire related exposure to which the protection may be exposed (direct flame impingement, HEAF, etc.).

Basis for Significance: The FPRA currently 'protects' embedded cables from damage due to fire impacts without technical justification ensuring the integrity of the embedded protection for all fire scenarios.

Actual Solution:

The MNGP Single Compartment Analysis Notebook [Reference 51] has been updated to clarify the technical basis used to establish target sets for embedded or wrapped cables:

• There are no fire wraps credited in the Fire PRA at MNGP. Therefore, no fire wrap credit is included in the detailed fire modeling analysis.

• Electrical raceways that are fully embedded (e.g., those located within the floor slab or within a wall) are not vulnerable to fire effects. The concrete will prevent direct flame impingement, contain HEAF events, and prevent heating of these raceways by combustion products.

Inspection of the barriers is conducted in accordance with Procedure 0275-01: Fire Barrier Penetration Seal Visual Inspection, which ensures that there are no cracks or vulnerabilities in the material in which the raceway is embedded.

A list of embedded raceways has also been added to the Single Compartment Analysis Notebook

[Reference 51].

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 95 of 142 Revision 22 Page 95 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0066 F&O Number: 4-22 Associated SR(s): FSS-D1, FSS-D2 Detailed Problem

Description:

The combined effects of a hot gas layer and plume or radiant damage to a target are not considered in the fire modeling. There is no specific threshold over which the fire modeling tools are identified as being used outside their limits.

The detection/suppression model is critical for application of the severity factor and non-suppression probabilities. Although the inputs (distance to detector/sprinkler) are conservative, the model used is not validated and may not be conservative.

Proposed Solution: Provide a specific threshold over which the hot gas layer effects need to be addressed. Provide a modified methodology for incorporating these effects when significant. Provide V&V basis and applicability range for the DETACT model used or utilize a model that has already been verified and validated.

Basis for Significance: The plume hot gas layer interaction could impact the plume temperature at targets and thus impact time to damage, severity factors, and non-suppression probabilities. There is a potential that the DETACT model does not provide conservative results.

Actual Solution:

For targets located above the fire, Heskestad plume temperature equation (

Reference:

NUREG-1 805) is used to calculate the temperature of the fire plume at the target closest to the source. Using this equation, the critical heat release rate can be calculated for each source. The time at which this target is damaged is equal to the time at which the ignition source reaches the critical heat release, using the guidance on fire growth times in NUREG/CR-6850; transient sources reach their 98th percentile peak heat release in 2 minutes and fixed ignition sources reach their 98th percentile peak heat release rate in 12 minutes.

As a conservatism, the MNGP Fire PRA assumes that all targets located within the 98th percentile Zone of Influence (ZOI) are damaged at the time at which the first (nearest) target is damaged. In other words, the time to damage for all targets within the 98th percentile ZOI is equal to the time at which the critical heat release rate is achieved.

By assuming that all targets in the ZOI are lost when the first target is damaged, the MNGP Fire PRA postulates damage early in the scenario progression. At this early time in the scenario, the temperature of the hot gas layer has not appreciably changed. In other words, the temperature of the fire zone remains close to ambient. Therefore, the temperature predicted by the Heskestad plume equation is appropriate for use in the MNGP Fire PRA.

Impact on ILRT Extension:

The F&O is resolved and there is no impact to the ILRT Extension Risk Analysis.

Page 96 of 142 Revision 22 Revision Page 96 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0067 F&O Number: 4-23 Associated SR(s): FSS-D7 Detailed Problem

Description:

There is no generic estimate or plant-specific value assigned to the non-suppression probability.

Proposed Solution: Assign a plant-specific unavailability value for the credited suppression and detection systems to be included to the nonsuppression probabilities.

Alternatively, assign a generic estimate for unavailability and perform a review of the suppression and detection systems for outlier behavior relative to system unavailability.

Basis for Significance: The non-suppression values are only based on the NUREG/CR-6850 generic values for unreliability with no account for unavailability.

Actual Solution:

Halon Suppression System Unlike many other automatic suppression systems used in U.S. nuclear plants, the halon suppression system in the cable spreading room is subject to the Maintenance Rule program. The Maintenance Rule Program sets strict availability and reliability criteria for this system. As such, a plant-specific unavailability value of 4E-3 is fully supported by the requirements of this program and the documented availability data.

In the MNGP Fire PRA, the non-suppression probability for each credited automatic suppression system is equal to the sum of the plant-specific unavailability for that system and the generic system unreliability given in Appendix P of NUREG/CR-6850. In the case of the halon suppression system, the generic system unreliability is equal to 0.05. Therefore, the total non-suppression probability for the cable spreading room halon suppression system is equal to 0.054.

All Other Credited Detection and Suppression Systems Plant specific unavailability values for the credited suppression and detection systems were developed through a search of the Passport Action Tracking Database for a 10-year period from 9/18/2005 to 7/15/2015.

The resulting data export consisted of the dates and times at which a fire impairment was established and then closed. [See Section 6.1.3.3 for the tables used to calculate the unavailability values.] Given the impairment durations documented in the preceding table, the total unavailability factor for the system type can be calculated by dividing the total unavailability of each system type (the sum of the duration of the impairments on those systems) over the time period from which the data was taken (3587 days). In the MNGP Fire PRA, the non-suppression probability for each credited automatic suppression system is equal to the sum of the plant-specific unavailability for that system and the generic system unreliability given in Appendix P of NUREG/CR-6850. [The total plant-specific unavailability and generic system unreliability values are given in Section 6.1.3.3.] The MNGP Fire Modeling Database has been updated to reflect this revised non-suppression probability to include the plant specific unavailability value.

Impact on ILRT Extension:

The F&O is resolved and there is no impact to the ILRT Extension Risk Analysis.

Page 97 of 142 Revision 22 Revision Page 97 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0068 F&O Number: 4-24 Associated SR(s): FSS-D7 Detailed Problem

Description:

The automatic Halon system in the Cable Spreading Room is assigned a non-suppression probability of 0.004 based on the Maintenance Rule program which indicates that 'the system has been available 99.6% of the time since 2006, at least by the rules of the Maintenance Rule Program'.

Proposed Solution: Update the non-suppression probability for the Cable Spreading Room automatic Halon system to incorporate the NUREG/CR-6850 unreliability value and the plant-specific unavailability value.

Basis for Significance: The FPRA is incorrectly utilizing the unavailability value (0.004) for the non-suppression probability for this system which should account for unreliability and unavailability.

Actual Solution:

Unlike many other automatic suppression systems used in U.S. nuclear plants, the halon suppression system in the cable spreading room is subject to the Maintenance Rule program. The Maintenance Rule Program sets strict availability and reliability criteria for this system. As such, a plant-specific unavailability value of 4E-3 is fully supported by the requirements of this program and the documented availability data.

In the MNGP Fire PRA, the non-suppression probability for each credited automatic suppression system is equal to the sum of the plant-specific unavailability for that system and the generic system unreliability given in Appendix P of NUREG/CR-6850. In the case of the halon suppression system, the generic system unreliability is equal to 0.05. Therefore, the total non-suppression probability for the cable spreading room halon suppression system is equal to 0.054.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 98 of 142 Revision 22 Page 98 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0072 F&O Number: 4-28 Associated SR(s): FSS-A2 Detailed Problem

Description:

Cables assigned to the Yard fire zone located in manholes and duct banks are not included in the whole compartment burn scenario.

Additionally, bus duct targets are not included as FPRA targets damaged in whole compartment/hot gas layer scenarios in fire zones where they are located.

Proposed Solution: Include cables in the yard manholes/duct banks as FPRA targets in the Yard whole compartment burn scenario or alternatively, perform detailed fire modeling of the yard to justify exclusion of the cables in the yard from fire scenarios located aboveground.

Include bus duct targets as damaged in the FPRA for all fire zone scenarios that could impact the bus ducts, including whole compartment burns and hot gas layer scenarios.

Basis for Significance: The risk impact of these targets have not been analyzed.

Actual Solution:

The fire scenario associated with full zone damage for Fire Zone Yard has been corrected to include all cables in manholes and duct banks located in this zone. Specifically, components that are directly mapped to functional states and Basic Events are now included.

To include all Basic Events for components and cables found in the Yard, the following verifications were conducted:

1. The fire scenario associated with full zone damage to the Yard, which is originated and maintained in the Fire modeling Database was reviewed to ensure that all the targets mapped to the Yard were accounted for.

2. The FRANX quantification tables (i.e., FRANX Scenarios table and FRANX Zone To Raceway table) generated in the fire modeling database and exported to FRANX were reviewed to ensure that the Yard scenario was appropriately specified.

3. The FRANX quantification was reviewed to ensure that the scenario was treated and quantified correctly FRANX.

The risk contribution of the full zone burn in the Yard is now correctly accounted for in the MNGP Fire PRA.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 99 of 142 Revision 22 Page 99 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5400-CAC-0 Evluaionof iskSigifianc ofPeranet IRT xtesio Change Number: MT-15-0073 F&O Number: 4-29 Associated SR(s): FSS-AI, FQ-A3 Detailed Problem

Description:

Appendix E of the Single Compartment Analysis Notebook 016015-RPT-06 identifies that scenarios for cable fires caused by welding and cutting and self-ignited cable fires result in high total COF contributions and further evaluation and refinement will be completed after risk reduction activities are completed.

These scenarios are not currently quantified in the FPRA model.

Proposed Solution: Perform risk reduction refinements of the scenarios for cable fires caused by welding and cutting and self-ignited cable fires and include the scenarios in the FPRA quantification.

Basis for Significance: Probable risk-significant impact Actual Solution:

The risk contribution for self-ignited cable fires and cable fires due to welding and cutting have been included in the Fire PRA following the guidance described in FAQ 13-0005. Appendix E.2 of the Single Compartment Analysis Notebook [Reference 51] has been updated to reflect this analysis.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 100 of 142 Revision 22 Page 100 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0076 F&O Number: 4-31 Associated SR(s): FSS-A2, FSS-A3, FSS-A5, FSS-B2, FSS-D3, FQ-E1 Detailed Problem

Description:

The current Fire PRA model contains numerous risk significant fire scenarios that are modeled as bounding fire scenarios (whole compartment burns) resulting in unrealistically high CDF/LERF values.

Additionally, for fire zones where detailed fire modeling was performed, numerous bounding assumptions have been applied without further refinement. These include the following:

• Heat release rates of 1002 kW were utilized for closed electrical cabinets, including MCCs.

• Transient scenarios fail all targets up to the ceiling without consideration of the zone of influence.

• Fixed and transient scenarios are mapped to all targets located within a 'transient zone' without consideration of actual zone of influence of the scenario.

• The use of bounding areas and volumes in the CFAST model groups which are smaller than the actual fire zone configuration.

• The use of a peak heat release rate for motor (electrical) fires of 211 kW as opposed to the 69 kW heat release rate identified in NUREG/CR-6850.

• The use of bounding heat release rate calculations in FLASH-CAT for electrical cabinet fires, transient fires, and fixed sources including spread/propagation of cable trays (including tray stack configurations) as opposed to actual plant configurations.

• The use of a single door opening in the CFAST hot gas layer calculations as opposed to the actual openings of the fire zone.

• Failing all conduits in the PAU for every scenario in the PAU.

• Instrument air piping when exposed to fire plume conditions is considered damaged by fire scenario regardless of temperature of the piping and elevation above the source.

Assignment the worst case abandonment probability to each MCR ignition source configuration regardless of ventilation condition.

Proposed Solution: Perform detailed scenario analysis for risk significant fire scenarios presently modeled as bounding whole compartment burns and refine bounding assumptions of current detailed fire modeling scenarios.

Basis for Significance: The use of bounding fire scenarios provides unrealistically high CDF/LERF values.

Actual Solution:

The Fire PRA has been developed following the guidance in NUREG/CR-6850. Accordingly, the analysis is initially quantified with conservative assumptions in the definition of the fire scenarios. Conservatisms are removed on an as needed basis as part of the cut set review and risk reduction activities. Cut set reviews and risk reduction activities continued after the peer review. Consequently, some of the conservatisms listed in the F&O have been addressed. In each case, the removal of a conservatism is evaluated to determine the most efficient means of reducing risk.

• In the case of MCC's and Switchgear cabinets, the heat release rate probability distributions have been updated to the ones associated with electrical cabinets with one cable bundle listed in Appendix G of NUREG/CR-6850.

• Transient zones extend from the floor slab to the ceiling slab. By mapping all of the identified targets to the, the Fire PRA assumes that a transient fire may occur anywhere (i.e., at any elevation) in the transient zone.

• .. In Step 1 of Detailed Fire Modeling, all targets in each transient zone are assigned to the ignition

• sources located within that transient zone. Iffuture risk reduction activities warrant a refined approach, the zone of influence of each ignition source will be considered.

Revision 2 Page 101 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension

- The use of bounding volumes in CFAST ensures that the bounding scenario is analyzed. Ifthe FPRA results indicate that the time to hot gas layer formation is overly conservative, then additional CFAST simulations may be considered.

• The peak heat release rate of motor (electrical) fires was updated to 69 kW as opposed to 211 kW per NUREG/CR-6850.

N The use of bounding heat release rate calculations in FLASH-CAT ensures that the uncertainties in the input parameters for the FLASH-CAT method are accounted for.

N The use of a single door opening in the CFAST hot gas layer calculations ensures that the bounding scenario is analyzed. If the FPRA results indicate that the time to hot gas layer formation is overly conservative, then additional CFAST simulations may be considered.

• On an as needed basis, the mapping of conduits to specific fire scenarios has been completed as required for risk reduction by the cut set review process. This approach is used in some scenarios in place of mapping all conduits in the PAU to every scenario in the PAU.

• The assumption that piping exposed to fire plume conditions are damaged by fire limited the scope of the drawing review and walkdowns that supported the development of these scenarios.

The use of the worst-case abandonment probability for each MCR ignition source configuration ensures that changes to the ventilation condition do not require re-analysis of the Fire PRA scenarios.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 102 of 142 Revision 22 Page 102of142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0077 F&O Number: 4-32 Associated SR(s): FSS-A5 Detailed Problem

Description:

The Single Compartment Analysis Notebook 016015-RPT-06 states that electrical cabinet heights are assumed to be 1.8 m (6 ft.) above the floor in the CFAST fire modeling applications. Additionally, the cable trays at MNGP were modeled with 0.46 m (1.5 ft) height between cable trays in a stack, a typical tray arrangement; this value is used in the FLASH-CAT application. Cable tray assumptions in FLASHCAT include that each cable tray contains 61 cables, is two foot in width, and 75% percent of the cable will burn completely. These bounding assumptions may not accurately reflect the as-built configurations and provide non-conservative results.

Proposed Solution: Provide justification that these assumptions reflect or bound all as-built configurations that they are applied to.

Basis for Significance: The use of these assumptions may not accurately reflect plant configurations and could be non-conservative.

Actual Solution:

The following list describes the basis for each of the inputs and provides a basis by which these results bound the as-built configurations. By ensuring that the modeled conditions bound the as-built conditions, it is ensured that results of the Fire PRA are conservative. In each case, future cut set reviews and risk reduction activities may warrant removal of such bounding assumptions. Removal of these conservatisms is evaluated on an as-needed basis.

• Electrical cabinet are assumed to be 6 feet in height. Ignition source walkdowns did not identify any outlier cabinets that are significantly taller than 6 feet. By using the largest typical cabinet height, the calculated time to hot gas layer formation is conservatively calculated. This calculation is conservative because the taller the height at which the fire occurs, the less volume is available above the fire. This smaller volume will reach the critical damage temperature in less time.

• The FLASH-CAT application assumes a distance of 0.46 m (1.5 ft) between cable trays in a stack.

FLASH-CAT was programmed using the equations given in NUREG/CR-7010. In the tests documented in NUREG/CR-7010, the vertical distance between the trays ranged from 0.23 m to 0.46 m (9 in. to 18 in.).

• It is important to note that the burning length of the trays ignited is equal to

• L_(n+1)=L~n+2(h_(n+l) tan(35°))

• where L is length, n is the cable tray index, and h is the vertical distance between trays

• By using this maximum vertical distance between cable trays, the FLASH-CAT model calculates the maximum length ignited in each successive tray.

• The average number of cables installed in a cable tray segment at MNGP is 61. While this value is an average, this number does not affect the calculation since fuel burnout is not expected over the duration of the simulation.

• Inspection of the MNGP raceway drawings indicate that the maximum tray width is 0.61 m (2 ft). By using this maximum tray width, the maximum heat release rate contribution from the burning cable trays is calculated.

The mass fraction of the non-metallic part of the cable that remains after a fire is known as the char yield.

NUREG/CR-701 0 recommends that a char yield value of 0. This value corresponds with approximately 100% of the non-metallic mass of the cable being consumed by a fire. This represents the maximum contribution to the heat release rate from burning thermoplastic cables.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 103 of 142 Revision 22 Page 103of142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0078 F&O Number: 4-33 Associated SR(s): FSS-A5 Detailed Problem

Description:

Wall and corner effects are not accounted for in the FLASH-CAT modeling for heat release rate calculations that are used for the CFAST hot gas layer models.

Proposed Solution: Incorporate wall and corner effects in the FLASH-CAT heat release rate calculations.

Basis for Significance: The HRR rates calculated in FLASH-CAT may be non-conservative for certain fire scenarios impacting hot gas layer timing.

Actual Solution:

The FLASH-CAT modeling of heat release rates using the CFAST hot gas layer models predict hot gas layer formation using bounding assumptions. By ensuring that the modeled conditions bound the as-built conditions, it is ensured that results of the FLASH-CAT model are conservative. These conservatisms include:

• Maximum flame spread rate for thermoplastic cables (0.9 mm/sec)

• Maximum heat release rate per unit area of thermoplastic cable (250 kW/m2)

• Bounding value of cable mass per unit length (0.75 kg/in)

• Bounding value of plastic yield (0.75), which bounds all cables tested in NUREG/CR 7010

• Char yield value of 0. This value corresponds with approximately 100% of the non-metallic mass of the cable being consumed by a fire. This represents the maximum contribution to the heat release rate from burning thermoplastic cables.

• All cable trays are assumed to be 2 ft wide, which is the maximum width measured on the cable tray layout drawings.

N Maximum vertical distance between trays modeled in NUREG/CR-7010 (18 in.)

• Maximum heat release rates of transient fires (317 kW) and electrical cabinet fires (1002 kW).

These heat release rates are equal to the 98th percentile from Table E-1 of NUREG/CR-6850.

• Flame is assumed to spread through up to 12 vertically stacked cable trays, which bounds the as-built plant configuration.

Such conservatisms bound the heat release rates resulting from wall and corner effects.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 104 of 142 Revision 22 Page 104 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0039 F&O Number: 2-1 Associated SR(s): PP-B3, PP-C3 Detailed Problem

Description:

The requirement for this SR is to JUSTIFY credited spatial separation. This section does not provide the required justification. The documentation should include an evaluation that establishes why the separation provided by "space" will ensure that the adverse effects of fire will be substantially contained in each of the adjacent PAUs.

Proposed Solution: Each credited spatial separation barrier should be justified to establish that the barrier will substantially contain the adverse effects of fire.

Basis for Significance: This SR requires that justification be provided for credited spatial separation; no such justification is provided.

Actual Solution:

As stated in Section 3.0 of the Plant Boundary and Partitioning Notebook [Reference 48], the spatial separation between fire zones is not expected to "substantially confine" fire generated conditions such as smoke.

Instead, the probability that fire generated effects propagate across this boundary is captured in the multi-compartment analysis. In the cases where spatial separation is credited between fire zones, a barrier failure probability of 1.0 is assigned to these multi-compartment scenarios. Per the guidance of NUREG/CR-6850, multi-compartment combinations are screened where a hot gas layer is not expected in the exposing zone.

Further, the qualitative assessment provided in the resolution to F&O 4-14 qualitatively addresses the localized effects of fires near openings at credited boundaries. The assessment suggests that the localized fire effects near boundaries is low.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 105 of 142 Revision 22 Page 105 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0054 F&O Number: 4-10 Associated SR(s): FSS-G2 Detailed Problem

Description:

Several MCA zone combinations are screened quantitatively in the Multi-Zone Analysis Notebook 01601 5-RPT-08 based on having a frequency of occurrence of less than 1E-08. However, there is no justification for the screening threshold providing reasonable assurance that the cumulative contribution of the screened physical analysis unit combinations are of low risk significance.

Proposed Solution: Provide detailed justification that the 1E-08 screening is an acceptable threshold for the plant to ensure that the contribution of the cumulative screened combinations are of low risk significance.

Basis for Significance: 1E-08 screening is typically an industry accepted threshold however, no justification is provided.

Actual Solution:

Scenarios with a frequency of occurrence of less than 1E-08 were screened on the basis that when multiplied by the CCDP or CLERP, the total core damage or large early release frequency of these scenario would be insignificant.

In the interest of understanding the cumulative risk contribution of these screened fire scenarios, the FPRA Multi-Zone Analysis Notebook [Reference 52] has been updated to include the total scenario frequency for these screened scenarios. The total scenario frequency for all of the scenarios screened using this criteria is 3.99E-07. This value is the sum of the scenario frequencies for all multi-zone scenarios that were screened because their frequency of occurrence was less than I1E-08. This value does not include the scenario frequency of those multi-zone scenarios that were screened using another basis, such as the lack of a hot gas layer formed in the exposing zone or no new Basic Events impacted in the exposed zone.

It follows that if the CCDP (CLERP) for each scenario was applied, then the total COF (LERF) for these scenarios would be insignificant to the total risk calculation. The total CDF, which is calculated using assuming a OCCP of 1.0, represents less than 1% of the total CDF for MNGP. On this basis, these scenarios are screened from further analysis.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 106 of 142 Revision 22 Page 106 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0057 F&O Number: 4-14 Associated SR(s): FSS-G2 Detailed Problem

Description:

For multi-zone scenario combinations that are screening due to no hot gas layer in the exposed fire zone, there is no consideration for localized target damage in the exposed compartment due to fire exposure near the barrier opening (i.e., targets located in the flow path of postulated hot gases from the exposing fire zone).

Proposed Solution: Perform an assessment for multi-zone analysis to confirm that the screened scenarios do not have targets in the postulated hot gas flow path.

Basis for Significance: Not expected to be significant but there is a potential for additional FPRA target damage.

Actual Solution:

The multi compartment analysis in the MGNP Fire PRA has been developed and implemented following the guidance described in Chapter 11 of NUREG/CR-6850. Consistent with this guidance, multi compartment scenarios have been screened if no hot gas layer scenario is expected in the exposing fire zone. That is, an exposing fire zone that does not generate a hot gas layer scenario is not expected to damage targets in the exposing fire zone.

The fire scenarios described in this finding are outside the recommended guidance in NUREG/CR-6850.

Therefore, these scenarios have not been explicitly analyzed in the MGNP Fire PRA. A number of factors suggest that the risk contribution of these scenarios is low. These factors include:

• Location of Fixed Ignition Sources: Damage to components in the adjacent zone is likely to occur only for fixed ignition sources located near the zone boundary. Only a portion of the ignition sources in a given zone are found near these zone boundaries. Further, it follows that fixed ignition sources located away from the zone boundaries are not likely to damage components in the adjacent zone without propagating through secondary combustibles. In the case of fire propagation through intervening combustibles, there will be time available for manual or automatic suppression, thereby reducing the risk contribution of these scenarios. Therefore, the overall risk contribution of fixed ignition sources is low.

• Location of Transient Ignition Sources: Only transient fire sources that start and are sustained near a fire zone boundary are capable of damaging components in the adjacent zone. By crediting a geometry factor (i.e., a floor area ratio), only a portion of the ignition frequency of the transient fires postulated in the exposing zone would contribute to the total risk of these localized scenarios. Further, the effects of certain transient fires types, such as cable fires and transient fires due to hotwork, are mitigated by prompt detection and prompt suppression activities.

Therefore, it is unlikely that a hotwork fire would damage targets in the adjacent zone. Fire modeling treatments of self-ignited cable fires and junction box fires ensure that damage to targets in the adjacent zone is unlikely. Therefore, only general transients, of which only a portion are located near the boundary, are expected to contribute to the overall risk of these localized scenarios.

• Target Configuration: In order to be damaged by localized fire effects at the boundary, Fire PMA raceways in the adjacent zone would need to be located near that boundary.

• Barrier Features: It is generally accepted that the risk contribution of multi-compartment fires is lower than that of single compartment scenarios. This notion is based on the credited separation features (i.e., fire walls, fire doors, penetration seals, etc.) between fire zones. The failure probability of these separation features is considered to be low.

Consequently, the risk contribution of localized fire effects near zone boundaries is expected to be low.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 107 of 142 Revision 22 Page 107 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-1 5-0058 F&O Number: 4-15 Associated SR(s): FSS-G1 Detailed Problem

Description:

Appendix D identifies the non-suppression probability assigned to each multi-zone scenario combination based on the suppression in the exposing or exposed zone. There were several inconsistencies identified between the zone suppression credited versus the non-suppression probability assigned.

Additionally, the Multi-Zone Analysis Notebook [Reference 52] identifies that Halon suppression 1* not credited in the analysis due to potential barrier openings, however, Appendix D identifies the application of a non-suppression probability for several multi-zone scenarios with only Halon in one of the fire zones.

Proposed Solution: Revise Appendix D of the Multi-Zone Analysis Notebook [Reference 52], the FMDB, and the quantification of the multi-zone scenarios to account for the correct non-suppression probabilities.

Basis for Significance: There is a potential risk impact for changing the non-suppression probabilities between suppression system type, specifically, removing a non-suppression probability for those assigned for Halon protected zones.

Actual Solution:

A comprehensive review of the automatic suppression credit for the multi compartment scenarios was conducted to eliminate the inconsistencies identified during the peer review. In addition, the automatic Halon system is not credited in the multi compartment analysis. The table in the fire modeling database listing the credit for automatic suppression has been updated.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 108 of 142 Revision 22 Page 108 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0059 F&O Number: 4-16 Associated SR(s): FSS-G1 Detailed Problem

Description:

Several fire zones are protected by partial suppression systems which are credited in the multi-zone analysis with no justification to ensure that the partial protection is capable of preventing damage to FPRA targets in the exposed fire zone.

Proposed Solution: Provide appropriate justification that the partial coverage suppression systems credited in the Multi-Zone Analysis Notebook [Reference 52] is capable of preventing FPRA target damage in the exposed zone.

Basis for Significance: There is a possibility that the credit for non-suppression probabilities associated with partial coverage systems may not be appropriate for all multi-zone scenarios.

Actual Solution:

Credit in the multi-compartment analysis for systems providing partial coverage in the fire zones has been removed from the analysis. The table in the fire modeling database listing the credit for automatic suppression has been updated to reflect no credit for systems providing partial coverage (i.e., non-suppression probability has been set to 1.0).

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 109 of 142 Revision 22 Page 109 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5400-CAC-0 Evauaton f Rik Sgniicace o Pemannt IRT xtesio Change Number: MT-I15-0044 F&O Number: 2-5 Associated SR(s): IGN-A7 Detailed Problem

Description:

Section 5.6 discusses the apportionment of generic transient fire ignition frequencies and the development of the influencing factors for each area. The influencing factors were assigned by the FPRA analysts based on engineering judgment and a set of rules documented in Section 5.6.2 of the Ignition Frequency Notebook [Reference 53]. Assignment of these values resulted in a comparatively low result.

Based on the information contained in the Fire Modeling Database the influencing factors average as follows: Maintenance 1.7; Occupancy 2.2; and Storage 1.8. It's typically assumed that these factors will produce an average value, i.e., Medium or 3, by definition. Based on the values stated it appears that the influencing factors may have been underestimated. To increase the accuracy and reliability it's suggested that these values be set or validated by plant operations and maintenance personnel.

For example, numerous fire zones were assigned LOW maintenance factors including H2 Seal Oil/Condensate Pump Area, Turbine Condenser Area, Air Ejector Room, Admin Bldg HVAC Room, ESF Motor Control Center, 13.8 kV Switchgear Rooms, RCIC and HPCI Rooms, Diesel Fuel Oil Pump House, etc. as these zones contain pumps, motors, electrical equipment that would require maintenance.

LOW storage factor was assigned in numerous fire zones including Lube Oil Storage Room, Contaminated Equipment Storage Area, etc. which appear to be defined storage areas in the plant.

Additionally, there are only 13 fire zones that are assigned storage factors greater than LOW.

Proposed Solution: Review the influencing factors with knowledgeable plant personnel to ensure that the factors applied are representative of realistic plant conditions. Consider augmentation of this effort with a review of historical work orders and storage permits to provide definition to the revised factors.

Basis for Significance: By definition, the average of the assigned influencing factors should reflect the average value.

Actual Solution:

A comprehensive review of the influence factors for all the fire zones was conducted to address this finding. As a result of the review, the values for several influence factors were increased to provide a better representation of the transient ignition source likelihood in the fire zone. For example, the storage factor for a number for fire zones was increased to better reflect the storage practices at the fire zone. In addition, the updated influence factors were reviewed by plant personnel. The updated influence factors, documented in the MNGP Fire Ignition Frequency Notebook [Reference 53], are now part of the base model and their impact is reflected in the quantification process.

Impact on ILRT Extension:

This F&O is closed, and there is no impact on the ILRT Extension Risk Analysis.

Page 110 of 142 Revision 22 Page 110 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0088 F&O Number: 4-9 Associated SR(s): IGN-A1, IGN-A7 Detailed Problem

Description:

The Ignition Frequency Notebook 016015-RPT-10 does not utilize the current nuclear power industry guidance for transient influence factors provided in PRA FAQ 12-0064.

Proposed Solution: Utilize the guidance in PRA FAQ 12-0064 for the transient influence factors, including the new factor for hotwork, which is separated from the previous maintenance factor.

Basis for Significance: The guidance in PRA FAQ 12-0064 enhances the guidance previously provided in NUREG/CR-6850. Risk-significant influence on the cable spreading room fire scenarios.

Actual Solution:

Supporting requirement IGN A7 requires a "consistent methodology based on parameters that are expected to influence the likelihood of ignition to apportion high level ignition frequencies". The MNGP utilizes a consistent methodology. The guidance in PRA FAQ 12-0064 describes influence factors lower than the ones available in Chapter 6 of NUREG/CR-6850 for plant configurations that meet specific criteria. For example, influence factors lower than 1.0 can be applied if the room is locked with a key controlling access to general plant personnel. Such configurations are not currently in place in the Fire Zones at MNGP and therefore values less than 1.0 are not used. For the specific guidance of separating hot work from maintenance influence factors, the MNGP Fire PRA reflects both activities in one factor as described in NUREG/CR-6850. To do so, influence factors have been assigned so that they are bounding to each of the activities (i.e., maintenance and/or hotwork activities).

Impact on ILRT Extension:

The F&O is closed, and there is no impact on the ILRT Extension Risk Analysis.

Page 111 of 142 Revision 22 Page 111of142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0100 F&O Number: 6-2 Associated SR(s): IGN-A1, IGN-B1, IGN-B4 Detailed Problem

Description:

The FPRA development review plant-specific experience for fire event outlier experience. No outlier fires were identified for the FPRA. However, subjective criteria (active intervention was needed to prevent potential spread, indications that heat was generated of sufficient intensity and duration to effect components outside the fire source, potentiaJ for secondary combustible ignition) for identifying outlier fire events were not assessed. For example, for one hydrogen fire event, 01003990, that was screened, involved an eight inch flame, which could have damaged equipment.

Additionally, there are several fire events associated with hot work. The results of the hot work fire events may meet the 'objective criteria' specified in the documentation. However, hot work fires should be addressed in the context of whether active intervention was required to suppress the fire.

The methodology discussed in section 5.2.1 of the IGN notebook, does not discuss or review the fire events in the context of the subjective criteria.

Proposed Solution: Apply and document subjective criteria to review plant-specific experience for fire event outlier experience, and update fire frequencies if outliers are found.

Basis for Significance: Subjective criteria not applied in the review of fire events.

Actual Solution:

The following documents the review of the fire events contained within the Fire Ignition Frequencies Notebook [Reference 53] using the criteria given in Section C.2.3 of NUREG/CR-6850 regarding potentially challenging fire events. According to Section 0.2.3 of NUREG/CR-6850, a fire event is to be considered potentially challenging if any one of the following events are true:

• A hose stream, multiple portable fire extinguishers, and/or a fixed fire suppression system (either manually or automatically actuated) were used to suppress the fire

• One or more components outside the boundaries of the ignition source were affected

• Combustible materials outside the boundaries of the fire ignition sources were ignited Further, a fire event may also be considered potentially challenging if any two of the follow features are cited in the fire event report:

• Actuation of an automatic detection system

• A plant trip was experienced

• A reported loss of greater than $5,000 (not including any lost business damages)

• A burning duration or suppression time of 10 minutes or longer A fire was also considered for classification as Potentially Challenging if there was sufficient indication that the fire was self-sustaining:

• It is apparent that active intervention was needed to prevent potential spread.

• Indication that flames or heat was generated of sufficient intensity and duration to cause the ignition of secondary combustibles outside the fire ignition source, or enough to affect components, had such been in close proximity to the ignition source.

• Substantial smoke was generated.

This additional review confirmed the conclusion documented in Section 5.2.1 of the Ignition Frequency Notebook [Reference 53]; specifically, no unusual pattern of fire events can be attributed to a specific ignition source. No update to the generic ignition frequency values is necessary. It is important to note that while several of the events are connected with welding machines and/or welding activities, this result is in line with the generic frequency values for hot work fires given in Supplement 1 to NUREG/CR-6850.

Further, there is no evidence that the hydrogen fire event is any different from the events used to develop the generic ignition frequency values. No other hydrogen fire events were identified during this review, indicating that no distinct fire event history is attributable to this source.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Revision 2 Page 112of142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5400-CAC-0 Evluaionof iskSigifianc ofPeranet IRT xtesio Change Number: MT-I15-0101 F&O Number: 6-3 Associated SR(s): IGN-AI Detailed Problem

Description:

Battery Chargers have been counted as either 10 or Bin 15 in the IGN development.

It appears that well sealed low voltage panels (e.g. lighting panels) have been included in the bin 15 count that should be excluded.

Proposed Solution: Assign all battery chargers into Bin 10.

Well-sealed electrical cabinets that have robustly secured doors and that house only circuits below 440V should be excluded from the counting process.

Basis for Significance: Binning assigned not consistent with equipment type.

Sealed low voltage panels should be excluded from the fire ignition frequency count. Their inclusion unduly dilutes the frequency for bin 15 and reduces the panel frequency for higher risk components.

Actual Solution:

The counting of Battery Chargers has been corrected such that all battery chargers are now mapped to Bin 10. This correction is reflected in the Ignition Frequency Notebook [Reference 53].

The counting for electrical cabinets (i.e., Bin 15) follows the guidance in NUREG/CR-6850 and the clarification for well-sealed panels in Supplement 1 to NUREG/CR-6850. Only small, low voltage wall-mounted panels are screened from the count. Lighting panels are not screened if they have doors that do not meet the criteria for well-sealed panels. This approach ensures that future monitoring of condition of panel is unnecessary.

Impact on ILRT Extension:

The F&O is resolved by stating that the lighting panels did not have well sealed doors. There is no impact to the ILRT Extension Risk Analysis.

Revision 2 Revison 2Page 113 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5400-CAC-0 Evauaton f Rik Sgniicace o Pemannt IRT xtesio Change Number: MT-I15-01 02 F&O Number: 6-4 Associated SR(s): IGN-A7, IGN-BI Detailed Problem

Description:

Chapter 7, of NUREG-6850 Supplement 1 provides two counting methods for segmented bus ducts. The analysis currently counts segmented bus ducts as a 1 for each duct in a given compartment. However this does not apportion the total frequency appropriately. The frequency should be weighted for longer lengths (more segments) in any given compartment. The approach would be to choose Option 1 or Option 2 laid out in Chapter 7 of Supplement 1 to NUREG/CR-6850.

Proposed Solution: Apply Supplement 1 guidance for segmented bus ducts.

Basis for Significance: IGN documentation indicates that Supplement 1 guidance was utilized for segmented bus ducts, but observations indicate that it was not.

Actual Solution:

The Monticello Fire PR.A and Ignition Frequency Notebook [Reference 53] have been updated to reflect the use of 'Counting Approach 2" for segmented bus ducts given in Supplement I to NUREG/CR-6850.

This approach assumes that the fire ignition frequency for segmented bus ducts is apportioned equally along the length of the bus duct. First, the analyst measures the total length of segmented bus ducts as well as the length of segmented bus duct found within each fire compartment. A ratio of the length of segmented bus duct within the compartment to the total length is then calculated. The plant-wide fire ignition frequency is then multiplied by the ratio of segmented bus duct lengths for each fire compartment.

This apportions the total frequency in accordance with the guidance.

Impact on ILRT Extension:

This F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Revision 2 Revison 2Page 114 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5400-CAC-0 Evauaton f Rik Sgniicace o Pemannt IRT xtesio Change Number: MT-15-0016 F&O Number: 1-2 Associated SR(s): HR-E4, HRA-A1, HRA-A2, HRA-A4 Detailed Problem

Description:

Talk-throughs to confirm HEPs and to confirm the response models and 'sequence of events' were conducted during the FPRA development. No follow-on talk-throughs were performed to confirm the response models for the finalized FPRA.

The peer review team performed a walk-through of HFE ALTINJMINYEF. During this walk-through, it was discovered that securing suppression pool cooling valves is needed prior to aligning alternate injection.

This step is not considered in the FPRA HFE development for ALTINJMINYEF. This was only a single HFE that the peer review team selected to walk through.

The review team observes that a talk through of the 'sequence of events' to confirm the HRA modeling would provide assurance that the HRA and PRM development reflects the as-built as-operated plant.

(This F&O originated from SR HR-E4)

Proposed Solution: Talk-throughs to confirm HEPs and to confirm the response models and 'sequence of events' as applicable, particularly for risk-significant HFEs.

oasis for Significance: An issue was identified from just one HFE chosen to be walked down.

Actual Solution:

The original internal events HEPs that were carried over to the FPRA were evaluated in detail through operator interviews and simulator exercise experience. Most recently (July 2014), these HFEs were reviewed by Xcel when conducting the version 3.2 update of the internal events HRA.

Fire specific information used to update these HFEs for the Fire PRA was verified with PRA staff with operations and training experience. New walk-throughs, interviews and simulator exercise observations were conducted for the MCR abandonment HFEs as documented in Appendices C and D of the MNGP Fire HRA Notebook [Reference 46].

However, the Execution step analysis of ALTINJMINYEF in the HRA Calculator does appear to omit the following Step 3 of Part 0 of C.5-3203, as discussed in the Finding:

3. Verify CLOSED the following valves:

MO-2020, RHR DIV 1 DRYWELL SPRAY - OUTBOARD.

MO-2006, RHR DIV 1 DISCHARGE TO TORUS OUTBOARD.

MO-2021, RHR DIV 2 DRYWELL SPRAY - OUTBOARD.

MO-2007, RHR DIV 2 DISCHARGE TO TORUS OUTBOARD.

The Execution portion of this HFE was updated accordingly.

In addition, to ensure that the HRA properly reflects the actions required for fire response, the top 15 risk-significant HFEs of the fire PRA were reviewed against the procedures and the HRA notebook [Reference 46] updated to make changes, as relevant. This review did not yield any changes that would adversely impact the risk results.

Impact on ILRT Extension:

This F&O is resolved. There is no impact on the ILRT Extension Risk Analysis.

Page 115 of 142 Revision 22 Page 115 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0025 F&O Number: 1-3 Associated SR(s): HR-E3, HRA-A1, HRA-A4, HRA-CI, HRA-.E1 Detailed Problem

Description:

Fire specific information used to update the FPIE HFEs for the Fire PRA was verified with PRA staff with operations and training experience. However, no specific documentation of these interactions /

verifications was provided.

New HFE RECRHRSVLY appears to have no documentation of an operator interview.

(This F&O originated from SR HR-E3)

Proposed Solution: Provide documentation of talk-throughs with plant operations and training personnel the procedures and sequence of events to confirm that interpretation of the procedures is consistent with plant observations and training procedures. Ensure that all HFEs modeled in the FPRA receive talk-throughs.

Basis for Significance: Documentation of talk-throughs is needed.

Actual Solution:

As discussed in the response to Finding F&O 1-2, the original internal events HEPs that were carried over to the FPRA were evaluated in detail through operator interviews and simulator exercise experience.

Most recently (July 2014), these HFEs were reviewed by Xcel when conducting the version 3.2 update of the internal events HRA.

As this Finding indicates, Xcel PRA staff with operations and training experience verified the fire specific information used to update these HFEs for the Fire PRA. New walk-throughs, interviews and simulator exercise observations were conducted for the MCR abandonment HFEs as documented in Appendices C and D of the Fire HRA Notebook [Reference 46].

The new fire HFE RECRHRSVLY was also reviewed by cognizant PRA staff, as indicated by the Reviewer signature on the BE Data screen for this HFE in the EPRI HRA Calculator file. For completeness of documentation, further information on this review was added to the Operator Interview Insights screen. However, it should be noted that the action is already proceduralized and the timing is based on a Job Performance Measure (JPM) used for operator training. Plans are to modify the plant fire procedure to add specific cognitive direction for the action.

Documentation regarding the Xcel review of the fire HFEs is given in Section 6.4 of the MNGP Fire HRA Notebook [Reference 46].

Impact on ILRT Extension:

This documentation F&O is resolved. There is no impact on the ILRT Extension Risk Analysis.

Page 116 of 142 Revision 22 Page 116 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0034 F&O Number: 1-4 Associated SR(s): HR-El, HR-G3, HR-G4, HRA-AI, HRA-A2, HRA-B3, HRA-C1, HRA-E1, HR-H2 Detailed Problem

Description:

The following observations were made regarding ensuring that the HRA reflects the as-built as-operated plant.

For HFE MHPVLOCAL-YEF - Fail to operate the HPV using N2 bottles to provide Containment Heat Removal During a Fire Event/SBO, no procedure and no timing are documented.

Also, two risk-significant HFEs were added as part of the FPRA model development based on pending /

draft plant procedures:

ADGMANST-Y - Operator fails to manually start EDG when auto start logic fails during SBO and fire. This action was added based on a pending procedure revision to address post-Fukushima issues. Since this is a pending change, later confirmation will be needed to ensure the FPRA model reflects the as-built, as-operated plant.

RECRHRSVLY - Operator Fails to Manually Control RHRSW Valve CV-1 728 or 1729 in Response to Fire-Induced Failure. Procedure step to be added to Plant Fire procedure to direct operators to procedure B08.01 .03-05, Section H.3. Since this is a proposed procedural change, later confirmation will be needed to ensure the FPRA model reflects the as-built, as-operated plant.

Additional HFEs are listed in Appendix F of the HRA notebook that were developed based on recommended procedure modifications. These are: FW-REFLG-Y, Fail to control FW following reference leg leak, and VFILLCST-Y, Fail to refill the CSTs. When these procedures are implemented, the HRA documentation would need to be revised to ensure the HRA reflects the as-built as-operated plant.

(This F&O originated from SR HR-El)

Proposed Solution: For HFEs that are currently developed based on pending procedure changes or draft procedures, ensure the HFEs reflect the as-built as-operated plant when procedure development is complete.

Basis for Significance: The PRA must reflect the as-built as-operated plant.

Actual Solution:

MNGP Operations reviewed the potential procedure modifications identified in Appendix F of the Fire HRA Notebook [Reference 46] and the following dispositions were made:

For HFE MHPVLOCAL-YEF, it was determined that another procedure (C.5-3505, venting primary containment) already references Plant Fire procedure C.4-A.8-05.08 for the necessary actions.

For FW-REFLG-Y, the necessary action is already addressed by the FDW high pump trip switch on C-06 per procedure C.5-2006 Part C.

For VFILLCST-Y the execution procedure was changed to B.08.09-05 in the "Procedures and Training" tab of the HRAC database, which proceduralizes the refill of the CST by truck and references the SAMG.

Regarding ADGMANST-Y, Operations determined that the procedural direction is already addressed in step 26/27 of the SBO procedure C.4-B.09.02.A. Similarly, for RECRHRSVLY, procedure C.5-3203, Alternate Injection for RPV Makeup, already accounts for the necessary actions.

In summary, all actions identified by the Fire HRA as potentially needing procedure changes are already being addressed by such changes or are already proceduralized.

Impact on ILRT Extension:

The procedures have been revised and this F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 117 of 142 Revision 22 Page 117 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0036 F&O Number: 1-5 Associated SR(s): HR-El, HRA-Al, HRA-A2, HRA-El Detailed Problem

Description:

For HFE F-ASDCOG-YEF, Failure to Implement ASD Decision to Abandon MC, there is a mismatch in the HFE label (YIF in Calculator and YEF in the PRM). (This F&O originated from SR HR-El)

Proposed Solution: Ensure the HFE labeling in the PRM and the HRA Calculator are consistent.

Basis for Significance: Documentation issue Actual Solution:

The label should be YIF. Note that the HFE was refined and now comes in flavors: F-ASDCOGx-YIF, where x is 1, 3, 4, 6, or F.

The PRM notebook [Reference 50] was corrected.

Impact on ILRT Extension:

This F&O is a documentation issue and is closed. There is no impact to the ILRT Extension Risk Analysis.

Page 118 of 142 Revision 22 Page 118 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0038 F&O Number: 1-7 Associated SR(s): HR-GI, LE-C2, HRA-B1, HRA-B3, HRA-C1, HRA-E1 Detailed Problem

Description:

One HFE with LERF risk-significance, (FV = .006, RAW =1), MHPVASDS-H2-YEF, Fail HP vent from ASDS with containment deinerted for fire outside the MCR, is quantified as a screening HEP, and no cues, procedures/training, event timing have been defined. (This F&O originated from SR HRA-83)

Proposed Solution: Ensure that all HFEs modeled in the FPRA receive complete definitions, including accident sequence specific timing of cues, and time window for successful completion, accident sequence specific procedural guidance (e.g., AOPs, EOPs), the availability of cues or other indications for detection and evaluation errors (d) the specific high-level tasks (e.g., train-level) required to achieve the goal of the response.

Ensure that risk-significant HFEs received detailed HEP quantifications.

Basis for Significance: Risk-significant HFE that has not been defined nor developed with a detailed evaluation.

Actual Solution:

HEPs MHPVASDS-H2-Y, MHPVASDS-PD-Y, and MVENTCONT-H2-Y were removed in the internal events model revision 3.3 and in the Fire PRA and replaced with MHPVASDS-Y since this HEP is fully developed (detailed analysis in the HRA Calculator) and is all actions are similar. MVENTCONT-PB-Y, and MVENTCONT-PD-Y were also removed and replaced with MVENTCONTY (detailed analysis in the HRA Calculator) based on similarity of actions. These actions were initially placed in the internal events model for sensitivities.

Impact on ILRT Extension:

This F&O is closed, and there is no impact to the ILRT Extension Risk Analysis.

Page 119 of 142 Revision 2 Revision 2 Page 119 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0015 F&Q Number: 1-19 Associated SR(s): QU-D5, FQ-E1, FQ-F1, HR-G7, HR-H3, HRA-CI, QU-C2, LE-E4, LE-F2, UNC-A2 Detailed Problem

Description:

The HRA dependency analysis uses a joint HEP floor of 1E-7, which is low relative to the guidance (which recommends 1E-6 or 1E-5 depending on the scenario / sequence) particularly in the context of fire scenarios.

The peer review examined the risk-significant dependent HFE combinations risk achievement worth significance and found none with HFE combination probabilities less than 1E-5. However, dependent combinations with low floors may be truncated by the 1 E-12 truncation level. Therefore, it is unknown whether the use of the I1E-7 floor produces a risk-significant impact.

(This F&O originated from SR QU-D5)

Proposed Solution: Examine through sensitivity studies whether use of a higher joint HEP floor, or a lower PRA truncation, would produce risk-significant changes to the FPRA results, and consider the use of a higher joint HEP floor if so.

Basis for Significance: Potential risk-significant impact.

Actual Solution:

The dependency analysis was revised and performed with a general joint HEP floor set to 1.0E-05. For some combinations that involve long-term decay heat removal actions or LERF-reduction specific actions, a minimum joint HEP floor of 1E-06 was used. Maintaining a lower minimum joint probability for these combinations is appropriate because they will take place many hours after the fire, at which point the activation of the Technical Support Center (TSC) would be able to provide a mind frame that allows for a 1E-06 minimum joint dependency threshold. This is documented in the Fire Human Reliability Analysis Notebook [Reference 46].

Impact on ILRT Extension:

This F&O is closed, and there is no impact to the ILRT Extension Risk Analysis.

Page 120 of 142 Revision 22 Page 120 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0019 F&O Number: 1-22 Associated SR(s): HRA-CI Detailed Problem

Description:

The following HFEs contribute significantly to the FPRA results (FV value for the HEP is above 0.005 or the HFE combination(s) in which some appear are above 0.005):

ADGMANST-Y - Operator fails to manually start EDG when auto start logic fails during SBO and fire C4H-EASY-YEF - Fail to restore loads (simple CR action) after LOSP and ECCS load shed given a fire outside the MCR HPI-CNTRLYEF - Fail to control FW, HPCI, or RCIC following a transient given a fire outside the MCR HPI-CNTRLYIF - Fail to control FW, HPCI, or RCIC following a transient given a fire inside the MCR MHPVLOCAL-YEF - Fail to operate the HPV using N2 bottles to provide Containment Heat Removal During a Fire Event/SBO RECBKRVLVYEF - Fail to locally operate breaker or valve on loss of 125 VDC or other circuit failure (exMCR fire)

XDEP40MINYEF - Fail to depressurize within 40 minutes (transient, no SORV) given a fire outside the MCR The HEPs for these HFEs are quantified from the perspective that the relevant cues are degraded (some but not all of the cues are unavailable or spuriously operating). Consideration has not been given to modeling versions of the HFEs where cues are not degraded, and therefore more realistically 'taking into account the context presented by the fire scenarios in the Fire PRA'.

The FPRA development team indicated that because the operators may be distracted by spurious fire induced alarms or misleading ancillary instrumentation not explicitly modeled in the Fire PRA logic. It was considered that failing to account for this possibility may cause the fire risk to be inadequately represented in the model. This is considered by the review team to be a reasonable assessment for the initial FPRA quantifications. However, further consideration is judged to be warranted to assess whether consideration be given to modeling HFEs for the condition where cues are available for the action.

Proposed Solution: Consider defining and modeling HFEs for applicable fire scenarios in which cues are not impacted.

Basis for Significance: Potential risk-significant impact Actual Solution:

The issue of operator distraction or confusion from spurious or potentially contradictory cues has been a key concern of U.S. NRC personnel involved in evaluating and auditing fire HRA. Since the current modeling approach to assess fire HFEs by presuming degraded cues addresses those concerns and is, by the Peer Review's admission "considered by the review team to be a reasonable assessment for the initial FPRA quantifications", no changes were made. Furthermore, these distinctions are not required by the ASME PRA standard. Since this is only a slightly conservative assumption, it does not significantly impact the PRA model and its insights.

Impact on ILRT Extension:

The F&O is resolved. There is no impact on the ILRT Extension Risk Analysis.

Page 121 of 142 Revision 22 Page 121 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0049 F&O Number: 3-4 Associated SR(s): AS-Al0, AS-A4, PRM-B5, PRM-B6, PRM-CI, HRA-B3, HRA-Cl Detailed Problem

Description:

The dominant HFE for the PRA is the failure to provide safe shutdown after control room evacuation.

These actions are aggregated into 3 HFE's, one for a) cognition to evacuate the main control room, b) establishing EDG, c) all other execution actions required for safe shutdown. HFE for a) and b) appear to be reasonable. HFE for c) is quantified by adding 29 separate actions into an aggregated HFE. 21 of the 29 actions are 'recovered'. However, the HRA of the execution error has several unsupported (or weakly supported) assumptions and calculations. The required manpower for this action is only 4 staff. The number of staff required for recovery of 21 actions in 25 minutes is not discussed or justified. The timing is to start at 10 minutes, be completed by 40 minutes and takes 25 minutes to complete. Of the 21 actions applied with recovery, 4 are High dependence and 17 are medium dependence. The timing to substantiate medium dependency is not justified. (This F&O originated from SR HRA-D2)

Proposed Solution: Develop a supportable basis for the aggregate execution HFE for control room evacuation. Provide sensitivity studies for assumptions about manpower, timing, recovery, and dependency.

Basis for Significance: Potentially risk-significant impact Actual Solution:

As part of the path forward for the resolution of F&O 1-20, the HFE execution actions were re-evaluated to 1) remove the extraneous actions that are not credited for mitigation purposes, and 2) group together under separate, individual HFEs the sets of actions that accomplish the same function (pressure/inventory control, and decay heat removal).

In addition, as part of the path forward for the resolution of F&O 1-26, the time windows for the actions supporting ASO were refined into various cases representative of the latest timing data associated with various fire scenarios.

These refinements provide a more realistic representation of the HFEs modeled for MCR abandonment, and a firmer basis for the assumptions made about manpower, timing, recovery, and dependency.

The analysis is documented in Section 8.0 of the Fire HRA Notebook [Reference 46].

Impact on ILRT Extension:

The F&O is resolved. There is no impact on the ILRT Extension Risk Analysis.

Page 122 of 142 Revision 22 Page 122 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-01 04 F&O Number: 6-6 Associated SR(s): AS-Al10, HR-G3, AS-A4, PRM-B5, PRM-B6, PRM-C1, HRA-B3, HRA-CI, HRA-A2 Detailed Problem

Description:

The entry condition for the C.4-C Abnormal Procedures requires the plant operations to determine control room evacuation is required. For cases where the fire is burning for longer than ten minutes as directed by the procedure, or abandonment is imminently obvious, the decision to abandon may be more obvious and indicative of the timing assumed. However, for fires that are suppressed earlier than ten minutes, the cognitive decision to transfer control may require more time than the 10-minute time delay modeled in the PRA, which impacts the time available to perform the ASD actions modeled by HFE, F-ASDEXE-YIF.

Currently the Tsw for F-ASDEXE-YIF is 40 minutes, the Tdelay is 10 minutes, the Tcog is 0 minutes and Texe is 25 minutes, leaving 5 minutes for recovery. However, if the decision to leave the control room is more than 10 minutes, less time will be available for recovery (potentially changing the recommended dependence for recovering execution errors from high dependence to complete dependence) and potentially insufficient time will be available to perform alternate shutdown.

For example, for fire scenario FC9-MCR-1 P-C-263A, a back panel in the main control room is suppressed within five minutes, and only the panel is damaged. Control room is modeled to be eventually abandoned due insufficient control of the plant, and the review team considers that the cognitive decision to transfer control may require more time than 10-minutes time postulated.

The peer review also observed that the alternate shutdown modeling does not account for differences in timing that could arise from MSO scenarios (e.g., SRVs spuriously open).

(This F&O originated from SR HRA-B2)

Proposed Solution: Evaluate the timing defined for the alternate shutdown actions to ensure the HFE definition and modeling to ensure model realism.

Basis for Significance: Potential risk-significant impact Actual Solution:

T/H analyses documented in PRA-CALC-15-003 ("Fire PRA MAAP Analysis") were recently performed to ascertain the time available for human actions at the ASDS panel. These T/H analyses account for various levels of fire damage (for example, the numbers of SRVs spuriously opening), each yielding a different time window.

As part of the resolution of the present F&O and also F&Os 1-20 and 1-26, several human failure events (HFEs) were developed to more realistically represent the timeline of needed human actions under the various fire damage configurations mentioned above.

Refer to Section 8.0 of the Fire HRA Notebook [Reference 46] for details of the analysis.

The HFEs were developed in concert to ensure a coherent integration of their timeline and enhance model realism. With that approach, the timing for the cognitive decision to abandon for fire scenarios that eventually lead to a loss of control was based on the functional impacts of the fire, in particular with regard to reactor pressure and inventory control functions. Because these specific functions are called out in the first minutes following plant trip (i.e., need to establish high-pressure injection, and depressurize if it is unavailable), the operators would be alerted to their loss early in the process. In that respect, the actual duration of the fire is of secondary importance or irrelevant altogether. This is also true of those fire scenarios that eventually lead to loss of control but over a relatively long time window (for example, 40 min as opposed to 20 mai). For these fire scenarios, the decision to abandon is determined by the functions that are lost, not by the duration of the fire. Finally, if the fire affects key systems relatively late in the process (for example, a high-pressure injection system runs initially, but then fails after 15 min), the time window for deciding to abandon would shift, at least, by the amount of time during which cooling occurred.

Impact on ILRT Extension:

This F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Revision 2 Page 123 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0031 F&O Number: 1-37 Associated SR(s): QU-D7, EQ-El Detailed Problem

Description:

No documentation was provided of a review of the importance of components and basic events to determine that they make logical sense.

Proposed Solution: Review the importance of components and basic events to determine that they make logical sense.

Basis for Significance: Review of the importance of components and basic events to determine that they make logical sense is required.

Actual Solution:

The FPRA Quantification notebook [Reference 36] at the time of peer review did not include descriptions of the importance results that were listed in Section 5.4. The updated notebook [Reference 36] includes a summary of the importances for each table of importance results and details on the reasoning for their importance.

Impact on ILRT Extension:

This is a documentation F&O and is closed. There is no impact on the ILRT Extension Analysis.

Change Number: MT-I15-0096 F&O Number: 6-10 Associated SR(s): QU-B2, QU-B3, LE-E4, FQ-D1, FQ-B1 Detailed Problem

Description:

No LERF convergence test for the quantification truncation level was performed.

Proposed Solution: Perform truncation convergence test for LERF.

Basis for Significance: Test for convergence required.

Actual Solution:

The updated FPRA Quantification notebook [Reference 36] includes a LERF convergence test and associated documentation.

Impact on ILRT Extension:

The F&O is resolved, and there is no impact on the ILRT Extension Analysis.

Page 124 of 142 Revision 22 Revision Page 124of142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0037 F&O Number: 1-6 Associated SR(s): QU-E1, QU-E2, AS-C3, DA-E3, HR-13, LE-F3, LE-G4, QU-E4, QU-F4, QU-F5, FSS-H9, IGN-B5, UNC-A1, FQ-F1, HRA-E1, SC-C3, SY-C3, UNC-A2 Detailed Problem

Description:

The treatment of uncertainties is documented in the Uncertainty and Sensitivity notebook, 016015-RPT-15 Rev. la. The Uncertainty and Sensitivity notebook documents a significant effort to identify sources of model uncertainty, however, the spectrum of uncertainties documented is considered incomplete particularly with respect to assumptions made as part of the FPRA development that have not been identified or characterized as model uncertainties in the Uncertainty and Sensitivity notebook and also, in some cases, generic FPRA model uncertainties recommended for inclusion by EPRI 1026511, PRA Applications and Uncertainty.

A) The following summarizes potential additional areas of modeling uncertainty suggested to consider and document:

ES - Additional potential sources of model uncertainty that arise from MNGP FPRA ES notebook assumptions, but not documented by the Uncertainty and Sensitivity notebook are: 1) the screening of MSO scenarios based on the number of hot shorts, 2) passive components have been excluded from the equipment selection, but no discussion is provided for potential heat impacts to indications that rely on reference legs, 3) instrument air piping is appropriately assumed to be failed due to soldiered joints for specific fire scenarios, but modeling uncertainty may be introduced based on the locations of this piping relative to the zones of influence.

PRM - Additional potential sources of model uncertainty that arise from MNGP FPRA PRM notebook assumptions, but not documented by the Uncertainty and Sensitivity notebook are: 1) Assigning the same initiating event to all scenarios in a compartment is conservative. In reality, the operators may initiate a controlled shutdown, precluding some equipment failures; 2) the underlying assumptions and uncertainties identified in MNGP PRA Rev 3.1 PRA model apply to the FPRA as well, and these appear to be discussed in the Uncertainty and Sensitivity notebook; 3) the fire water system alternate supply to RHR via LPCI has not been included due to assumed low significance, but may be revisited later in order to refine the FPRA model.

IGN - Additional potential sources of model uncertainty that arise from MNGP FPRA IGN notebook assumptions, but not documented by the Uncertainty and Sensitivity notebook are: 1) for zones where the analysis shows no cable loading information (i.e. no PRA related cables), a value is used to account for non-PRA related cable loading in the zone; 2) Fire ignition frequencies remain constant over time; 3)

Among the plants, total ignition frequency is the same for the same equipment type, regardless of differences in the quantity and characteristics of the equipment type that may exist in the plant; 4) Within each plant, the likelihood of fire ignition is the same across an equipment type. For example, pumps are assumed to have the same ignition frequency regardless of size, usage level, working environment, etc.

FSS - Some additional sources model uncertainties to consider would be the impact of hot short events to alternate shutdown, the treatment of smoke effects on equipment, and selection of main control board scenarios. Additionally, the following potential sources of model uncertainty were identified by the review team: 1) all cable is assumed to be unqualified for damage and heat release rate. This assumption introduces potential conservative results where qualified cables may be present; 2) performance of CFAST modeling using standardized evaluation volumes that are used to represent actual compartment spaces introduces the potential for conservative and non-conservative results; 3) the treatment of compartment configuration is considered minimal because it is taken from plant drawings, however the actual modeling treatment introduces uncertainty.

CF - An additional potential source of model uncertainty that arises from MNGP FPRA CF notebook assumptions, but not documented by the Uncertainty and Sensitivity notebook is: except as noted in the circuit failure mode notebook, the conditional probability of circuit failure leading to the failure mode of interest given fire-induced cable damage is assumed to be 1.

HRA - Additional potential sources of model uncertainty that arise from MNGP FPRA HRA notebook Revision 2 Page 125 of 142

54003-CALC-02 of Risk Significance of Permanent ILRT Extension 5400-CAL-02Evaluation assumptions, but not documented by the Uncertainty and Sensitivity notebook are: 1) Operator access to areas of the plant controlled by card reader access is determined to have a negligible effect on the timing of operator action performance in this analysis; 2) The crew is aware of the fire location within a short time (i.e. within the first ~-10 minutes of a significant indication of non-normal condition by fire alarms, multiple equipment alarms, and automatic trip); 3) It is assumed that most fires will be extinguished or contained within 70 minutes of the start of the fire, except for more challenging fires (i.e., turbine generator [TIG]

fires, outdoor transformers, high-energy arcing faults, and flammable gas fires). For this reason, operator actions occurring more than 60 minutes after the start of the fire are generally assumed not to be penalized for fire effects; 4) The crew is aware of the need for a plant trip (if it is not automatic); 5) The crew is aware of the need to implement the fire brigade; 6) The crew is aware of the potential for unusual plant behavior as a result of the fire; 7) In general, a fire anywhere in the plant introduces new accident contextual factors and potential dependencies among human actions beyond those typically treated in the internal events PRA that increase (mildly or significantly) the potential for unsafe actions during an accident sequence; 8) Even if one or more Control Room staff members is used to assist in ex-control room activities such as aiding the fire brigade, the minimum allowable number of operators remains available in the Control Room to manage the safe shutdown of the plant, and the crew makeup is similar to that assumed in the Internal Events PRA.

EQ - Assumptions documented in the FQ notebook introduce sources of modeling uncertainty that have not been documented in the Uncertainty and Sensitivity notebook: 1) For 'full-compartment burn' scenarios, all raceways, conduits, and components within the fire compartment, as provided by FRANX, are assumed to fail or operate spuriously, as applicable, with assigned circuit failure mode probabilities if specified. 'Full compartment burn' scenarios are those in which no detailed analysis has been performed and the full compartment is failed at the time of fire ignition; 2) For unscreened multi-compartment fire scenarios, it is assumed that all raceways, conduits, and components within both the exposing fire zone and the exposed fire zone 01601 5-RPT-14 Task Interfaces and Assumptions Revision la Page 7 are failed or operate spuriously, as applicable, with assigned circuit failure mode probabilities if specified, if the fire mitigating systems, such as the fire barrier and the detection/suppression system(s) fail to operate; 3) It is assumed that certain fires in the main control room (Fire Area 9) or relay room (Fire Area

8) may force control room abandonment, requiring the plant to be shutdown manually from outside the main control room (i.e., at the ASDS). One additional modeling uncertainty to consider would be the potential impact of multiple conservatisms to the FPRA results (recommended for inclusion by EPRI 1026511 PRA Applications and Uncertainty).LERF - No identification / characterization of LERF sources of model uncertainty and related assumptions was found in the FPRA documentation.

AS - No model uncertainties associated with the alternate shutdown modeling are provided or characterized.

SC - Regarding spurious SRV opening due to hot short impact analysis performed under EPU and MSO conditions (EC 20955) demonstrated that spurious operation of the SRVs in the ASDS scenario for seven minutes would not adversely impact Monticello's safe shutdown analysis, and would not jeopardize the safe and stable condition of the fuel. Based on observation by the peer review, the referenced calculation, EC 20955, does not support this claim.

SY - No sources of modeling uncertainty and related assumptions are identified for SY.

B) Further, the effects to the FPRA are addressed in very general terms and not specifically characterized. The following summarizes the peer review observations:

ES - One source of modeling uncertainty is identified by the Uncertainty and Sensitivity notebook, which is that the systems assumed to be failed introduce conservatism, with no further discussion. No characterization is provided on the degree to which the conservatism impacts the results, and which portions of the FPRA and the FPRA results are significantly impacted.

PRM - The Uncertainty and Sensitivity notebook reviewed the FPIE sources of model uncertainty, and considered these in the context of fire: 1) the potential to open doors for DG fire pump alternate HVAC are based on room heat up calculations, which have inherent uncertainties, and for fire, the DG fire pump has an enhanced role as a source of alternate injection, thus magnifying the uncertainties, but no specific characterization is provided, such as the quantitative magnitude of the uncertainties to the base FPRA model, 2) operator action for replacement of nitrogen bottles has a system time window of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, but calculations show that the bottles will satisfy the 24-hour mission time, which has a significant impact on Revision 2 Page 126 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5403-CLC-2 Ealutio o Rik Sgniicace f ermnen ILT Etenio the FPRA results, but no further discussion is provided on the magnitude of this impact nor areas of the PRA significantly impacted; 3) HPCI NPSH is modeled in the FPIE PRA to not require closure of MO-2064, although such closure is required by the design basis documented. This modeling approach was carried over into the Fire PRA and as such is a source of uncertainty, potentially magnified by the fact that fire-induced spurious operation could prevent successful closure of the valve, but no specific characterization of the impact to the FPRA model is provided.

HRA - Uncertainties introduced by the industry consensus dependent HRA methodology utilized for the MNGP FPRA are discussed very well, but no characterization of the affect to the PRA is provided, such as the HFE combinations that are risk-significant and a discussion regarding the level of realism represented by this risk-significant combinations.

C) Last, the sources of model uncertainty documented in the Uncertainty and Sensitivity notebook do not specifically document the related assumptions. Conversely, generally for the assumptions documented in each of the FPRA notebooks sources of model uncertainty have not been documented. These issues may be remedied by 1) identifying and documenting the related assumptions for each model uncertainty documented in the Uncertainty and Sensitivity notebook, and 2) rolling up the assumptions documented in each of the notebooks for the FPRA technical elements, placing them into the Uncertainty and Sensitivity Notebook, and documenting the model uncertainties related to each of the assumptions.

(This F&O originated from SR HR-13)

Proposed Solution: Document a more thorough spectrum of sources of model uncertainty, and characterize the impact to the PRA results of each identified model uncertainty.

For each source of model uncertainty, document the related assumptions.

Basis for Significance: Characterization of uncertainty is good, but is not thorough, particularly with respect to assumptions made as part of the FPRA development that have not been identified characterized as model uncertainties in the Uncertainty and Sensitivity notebook.

Section 1 of RG 1.200, 'A Technically Acceptable PRA,' is clear on stating that the impact to the FPRA results is to be characterized:

'Sources of uncertainty (both parameter and model) are identified and their impact on the results assessed. A source of model uncertainty is one that is related to an issue for which there is no consensus approach or model (e.g., choice of data source, success criteria, reactor coolant pressure seal LOCA model, human reliability model) and where the choice of approach or model is known to have an impact on the PRA results in terms of introducing new accident sequences, changing the relative importance of sequences, or significantly affecting the overall CDF, LERF, or LRF estimates that might have an impact on the use of the PRA in decision-making.'

Additionally, characterization of model uncertainties includes identifying the related assumptions.

Actual Solution:

A table was added to Appendix B of the Fire PRA Uncertainty and Sensitivity Analysis, which addresses assumptions listed for each of the individual analyses for the fire PRA. Each of these assumptions is evaluated as to whether or not it is a source of uncertainty in the Fire PRA as well as the overall impact to the Fire PRA.

Impact on ILRT Extension:

This documentation related F&O is closed. There is no impact on the ILRT Extension Risk Analysis.

Page 127 of 142 Revision 22 Page 127 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0045 F&O Number: 2-6 Associated SR(s): SF-A4 Detailed Problem

Description:

Section 6.4 and 6.5 of the Seismic Fire Interaction Notebook provide a discussion of how plant fire detection and suppression systems may be expected to respond to a seismic event including discussion of the potential impact of system actuations. Section 7.0 of the notebook includes a discussion of how these failures may impact plant response however this discussion is not clearly linked to a review of the plant seismic response procedures.

Proposed Solution: Document the plant seismic response procedures evaluated and document the potential impact of a seismically induced fire and spurious actuation of a fire system to the performance of seismic responses.

Basis for Significance: This SR requires the performance of a qualitative assessment of the potential impact of seismically induced fires and spurious actuation of fire detection/suppression systems review on a seismic response based on review of the plant seismic response procedures.

Actual Solution:

Procedure 4 AWI-08.01 .01, Section 4.5.4 states that site management personnel are responsible for

• Ensuring medically qualified personnel complete fire brigade training

• Ensuring that the content of the brigade training is adequate. This training consists of, in part, a review of all fire protection procedures and strategies.

Such a review of all fire protection procedures and strategies will help in preparing the fire brigade for response following a seismic event.

Additionally, Operations Manual C.4-B.05.14.A, provides direction to isolate close fire protection valve FP-37 (To Admin & Rx Building Headers) if a significant fire system leak occurs in the Plant Administration Building. If FP-37 does not close, then direction is given to close additional valves FP-49, FP-36, and FP-1 14. Isolation of the fire protection system to the Plant Administration Building is required to reduce the risk of flooding the Access Control areas to a depth of 20 inches that would impact I125VDC and 250 VDC battery operability.

Impact on ILRT Extension:

The F&O is closed, and there is no impact on the ILRT Extension Analysis.

Page 128 of 142 Revision 22 Revision Page 128 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0046 F&O Number: 2-7 Associated SR(s): SF-A5 Detailed Problem

Description:

Section 6.6 of the Seismic Fire Interaction Notebook provides a discussion of the potential impact of a seismic event on manual firefighting efforts. The discussion centers around the challenges that the fire brigade may face and the potential for loss of access to their equipment for fighting fires. The discussion does not include an assessment of the fire brigade training procedures or the extent to which this training prepares the brigade members to response to a seismically induced fire response. The discussion of the availability of firefighting material establishes that this equipment is stored in two separate areas and it concludes that this separation should provide access to one or the other following a seismic event, however no justification for this conclusion is provided.

Proposed Solution: Review and assess the fire brigade training procedures with respect to their preparation for response to a seismic event and provide justification for the post-earthquake availability of necessary firefighting resources.

Basis for Significance: SR requires that the fire brigade training procedures be reviewed to assess the extent to which the brigade is prepared for response to a seismic event and their ability to respond with respect availability of firefighting equipment and resources.

Actual Solution:

Procedure 4 AWl-08.01 .01, Section 4.5.4 states that site management personnel are responsible for

• Ensuring medically qualified personnel complete fire brigade training

• Ensuring that the content of the brigade training is adequate. This training consists of, in part, a review of all fire protection procedures and strategies.

Such a review of all fire protection procedures and strategies will help in the preparation of a post-seismic event firefighting resources.

Operations Manual C.4-B.05.14.A, provides direction to isolate close fire protection valve FP-37 (To Admin & Rx Building Headers) if a significant fire system leak occurs in the Plant Administration Building.

If FP-37 does not close, then direction is given to close additional valves FP-49, FP-36, and FP-114.

Isolation of the fire protection system to the Plant Administration Building is required to reduce the risk of flooding the Access Control areas to a depth of 20 inches that would impact 125VDC and 250 VDC battery operability.

Classroom and hands-on debris removal and tool use/safety training is provided to fire brigade members under MNGP lesson plan MT-OPS-FB-006L. This training covers the use of equipment used to clear debris in the aftermath of natural events including earthquakes. Redundant debris removal equipment is stored in multiple locations to assure protection and access to equipment is reasonably assured following a seismic event.

Impact on ILRT Extension:

The F&O is closed, and there is no impact on the ILRT Extension Analysis.

Page 129 of 142 Revision 22 Page 129 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0086 F&O Number: 4-7 Associated SR(s): SF-A3 Detailed Problem

Description:

Section 6.5 states that the procedure to provide alternative fire water directly from the river depends on the fire main being intact. The notebook does not document the assessment of the common cause failure of the yard mains and provide justification for the ability to suppress fires for this failure.

Proposed Solution: Include the assessment of the impact of the common cause failure of the yard mains on the potential to provide fire suppression capability.

Basis for Significance: The notebook does not address suppression capability in the event of the unavailability of the fire main.

Actual Solution:

Site Procedure A.8-02.06, Fire System Management Strategies, provides directions to isolate portions of the fire system in the event of damage or inadvertent actuation. Additionally, this procedure also provides directions to setup a Portable Diesel Fire Pump in order to supply water to backfeed the fire system or to supply water to the plant bypassing all of the fire system.

By this site procedure, the fire brigade is directed to choose the connection point for the portable diesel fire pump. The following options are listed in the procedure in order of preference:

CONNECT one 5-inch supply hose to Fire system at 5-inch Storz connection at north end of #11 Cooling Tower.

CONNECT two 5-inch supply hoses to Fire system at hydrants. [Note: If the Intake Structure was isolated in Step 5.f., feeding Fire system thru Hydrant House #2 is NOT available and a further away hydrant will have to be used.]

CONNECT one 2-1 /2-inch hose to the fire system at Hydrant House #2 (PDP suction from Intake).

In the event that a portion of the fire main is unavailable following a seismic event, the fire brigade is directed to isolate those portions of the system. After the unavailable portions of the fire main are isolated, the fire brigade will choose the appropriate connection point for the portable diesel fire pump, thereby delivering water to the fire system.

In addition, Operations Procedure C.5-3203 (Use of Alternate Injection systems for RPV Makeup) Part D prescribes makeup to the reactor vessel using the fire crosstie to LPCI, which depend on major portions of the fire main being intact. New sections of the C.5-3203 procedure (Parts F and H) now accommodate portable fire pump tie-in to LPCI using fire hoses, thus not being dependent on the fire main being intact.

Impact on ILRT Extension:

The F&O is closed, and there is no impact on the ILRT Extension Analysis.

Page 130 of 142 Revision 22 Revision Page 130 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0007 F&O Number: 1-10 Associated SR~s): LE-F2, UNG-A1 Detailed Problem

Description:

The Fire Quantification notebook, 016015-RPT-14 Rev. la) documents the FPRA results, including discussion of significant fire scenarios, and documentation of the contributions of fire risk by PAU. No discussion is provided however of a review of the contributors from the perspective of reasonableness to assure that excessive conservatisms have not skewed the results. The FPRA development team acknowledges the need for enhancing FPRA realism in light of the relatively high CDF and LERF results, and high risk contributions from specific PAUs, multi-compartment fire scenarios, and one particular HFE carried over from internal events PRA. These enhancements are still underway.

Proposed Solution: Review risk contributors for reasonableness (e.g., to assure excessive conservatisms have not skewed the results, level of plant-specificity is appropriate for significant contributors, etc.).

Basis for Significance: A review of risk contributors for reasonableness is needed to demonstrate technical adequacy of the FPRA.

Actual Solution:

Cutset reviews were performed during the update of the FPRA and during those reviews reasonableness of modeling and results was considered, especially the LERF model. Particular attention was paid to ensure that excessive conservatisms in the model were modified to ensure that the model was sufficiently realistic.

The cutset reviews were documented in the updated FPRA Quantification notebook and included to document the review of reasonableness in the model [Reference 36].

Impact on ILRT Extension:

Since the model was refined to increase realism, the F&O is closed, and there is no impact on the ILRT Extension Analysis.

Revision 2 Revison 2Page 131 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0024 F&O Number: 1-29 Associated SR(s): FSS-B2 Detailed Problem

Description:

The Main Control Room Analysis Notebook 01601 5-RPT-07 incorporates a 10 minute propagation to adjacent panels based on the guidance in Appendix S of NUREG/CR-6850. The lack of Main Control Board partitioning between panels may not support the use of the Appendix S timing.

Proposed Solution: Assess the Main Control Board partitioning between panels to ensure the Appendix S propagation timing is appropriate and provide justification. Alternatively, utilize a method to model the propagation between panels.

Basis for Significance: The propagation timing to the adjacent panels would impact the non-suppression probabilities and time to abandonment.

Actual Solution:

Per Appendix S of NUREG/CR-6850, the propagation time between panels was assumed to be ten minutes when there is a potential for cables in an adjacent panel to be in contact with the panel boundaries. The MNGP Fire PRA uses this ten minute propagation time, which is the value recommended in the guidance. However, due to the lack of partitioning between panels of the Main Control Board, an additional sensitivity analysis was conducted to evaluate the impact of changes to this propagation time.

The sensitivity analysis postulates fire propagation between panels at both five and fifteen minutes after ignition. In order to minimize the flow of combustion products out of the model domain and develop a conservative analysis, it is assumed the mechanical ventilation system is inoperative and all doors remain closed. The results for the abandonment times for the sensitivity analysis are shown in Table 1 below.

Sensitivity to the Time for Cabinet Propagation when the Mechanical Ventilation is Inoperative and All Doors Remain Closed Abandonment Time (min)

Fire Scenario Sensitivity Condition Bin 4 Heat Bin 8 Heat Bin 12 Heat Release Rate Release Rate Release Rate Base (10 minutes) 10.5 (T) 7.0 (T) 5.6 (T)

MCR Open Electronic Cabinet;5miue8.(T66()55()

Multiple Bundles; Spreads5miue8.(T66()55()

15 minutes 10.6 (T) 7.0 (T) 5.6 (T)

The results are considered to be not sensitive to variations in the assumed time for propagation between cabinets. The sensitivity results are discussed below.

• Multiple cable bundle electrical panel fire in the MCR (propagating), variations in abandonment time was less than 2 minutes for a very conservative propagation time of 5 mai. For a propagation time of 15 min, the resulting abandonment time was very similar to the one obtained with the base assumption of 10 minutes.

• Multiple cable bundle electrical panel fire in the MCR (propagating), variations in abandonment time was less than 1 minutes for a very conservative propagation time of 5 min. For a propagation time of 15 min the resulting abandonment time was very similar to the one obtained with the base assumption of 10 minutes.

Since the results of the sensitivity analysis does not suggest large differences in the abandonment times, particularly for the conservative assumption of 5 minutes of propagation between panels, the results assuming 10 minute propagation following the guidance of NUREG/CR-6850 are justified.

Impact on ILRT Extension:

The F&O is closed, and there is no impact on the ILRT Extension Analysis.

Revision 2 Page 132 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0060 F&O Number: 4-17 Associated SR(s): FSS-B2 Detailed Problem

Description:

The Main Control Room Analysis Notebook identifies a non-suppression value for fires limited to the panel based on a time to prompt suppression of 'about 3 minutes'.

Proposed Solution: Provide detailed justification in the Main Control Room Analysis Notebook to support the use of a prompt suppression value in addition to the non-suppression values calculated in the CFAST abandonment models.

Basis for Significance: There is no justification for this value of the time of 3 minutes to prompt suppression.

Actual Solution:

The second revision of manual fire suppression events contained within Supplement 1 to NUREG/CR-6850 reflects the overall process of manual fire suppression in a more continuous manner, crediting suppression activities which begin as soon as a fire has been detected. In the case of the Main Control Room, operators staff this location on a permanent basis. Therefore a fire event that is promptly suppressed accounts for manual suppression by operators before the fire ignition source develops and spreads. Most fires will burn out or be detected by operators in the incipient stage and will be extinguished before spreading.

Supplement I to NUREG/CR-6850 gives manual non-suppression probability for the Main Control Room of 0.33 min-1. Using this value, the time available for suppression prior to spread beyond localized effects is 1/0.33 min-1 . This calculation yields an average time to manual suppression of 3 minutes.

This average time to manual suppression corresponds to values presented in Table 9-1 of the Main Control Room Abandonment Notebook [Reference 54]. In comparison to the values given in Appendix L of NUREG/CR-6850, the likelihood of damage of localized targets used in the Monticello Fire PRA exceeds even the largest value given in Figure L-1 of NUREG/CR-6850. In the MNGP Fire PRA, the split fraction for a fire that is promptly suppressed (i.e., the fire damage remains very localized, which is consistent with all of the main control room fire events considered in the development of the generic frequency value), is obtained solving the exponential distribution for Pr(t < 3 minutes) = 0.63. This is the probability that the damage is limited to the ignition source within the panel by prompt suppression activities. The conditional likelihood of "very localized damage" in NUREG/CR-6850, is much smaller, 8.5E-03.

Impact on ILRT Extension:

The F&O is closed, and there is no impact on the ILRT Extension Analysis.

Page 133 of 142 Revision 22 Page 133of142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent LLRT Extension Change Number: MT-I15-0082 F&O Number: 4-38 Associated SR(s): FSS-B2 Detailed Problem

Description:

The Main Control Room Analysis Notebook 016015-RPT-07 does not address the potential of transient scenarios impacting multiple MCBs or panels. The analysis only assigns a geometric factor of 0.01 for the fraction of transient fire frequency for transients adjacent to the panels which is applied to each panel scenario.

Proposed Solution: Postulate transient scenarios in the Main Control Room that could impact multiple MCBs or panels based on their location on the floor with respect to the zone of influence. Additionally, provide technical justification for the geometric factor of 0.01 for the fraction of transient fires added to the electrical panel frequency.

Basis for Significance: Scenarios do not address the risk impact of fire damage to multiple MOBs or panels.

Actual Solution:

The following F&O response is broken down into two sections: (1) Correction to the use of geometric factor and (2) Revised approach to address potential transient scenarios impacting multiple MCBs or panels.

(1) Correction to Use of Geometric Factor Using the point source flame radiation model described in Section 9.2.5 of the Report 01601 5-RPT-07, it was determined that a transient fire may damage a MCB panel or electrical cabinet if the transient fire is located within 4 feet of that panel.

Using this critical distance, the open floor area around each panel is then measured. This open floor area is used to determine the geometric weighting fraction for each MCB Panel and Electrical Cabinet in the MCR. In Figure 1, the shaded area indicates the open floor area within which a postulated transient fire would damage the panel or cabinet.

PaeEecrcal cabinet or Main rtta..

ithcont*rol Board Panel LItn Panel Length "

Figure 10-1: - Example of Main Control Room Transient Fire Area After measuring the width and length of each panel, the open area around each panel is calculated.

This area is then divided by the total floor area of the Main Control Room to determine the geometric ratio. The risk contribution of transient fires is then captured by adding the geometrically weighted transient fire frequency to the fixed source frequency for each analyzed scenario.

Page 134 of 142 Revision 22 Page 134 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension (2) Revised Approach to Transient Fires Impacting More than One Panel As described in Section 9.1.1 of Report 016015-RPT-07, there are five sequences that describe each fire postulated in the Main Control Room. For each of these five sequences, the ignition frequency of the transient fires calculated in Item (1) of this F&O response is added to the ignition frequency of the panel.

In the cases of Sequences 3 and 4, the fire continues to grow after prompt suppression fails. Sequences 3 and 4 include targets damaged by the radiative fire effects of the ignition source. In other words, MOB panels and electrical cabinets within the radiative zone of influence of the ignition source are damaged during Sequences 3 and 4.

A portion of the transient ignition frequency is mapped to each ignition source and to each Sequence for that ignition source. As such, the analysis captures transient fires that, when prompt suppression fails, cause damage to more than one MOB panel or electrical cabinet based on their location within the transient fire area.

Impact on ILRT Extension:

The F&O is closed, and there is no impact on the ILRT Extension Analysis.

Page 135 of 142 Revision 22 Page 135 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0083 F&O Number: 4-40 Associated SR(s): FSS-B2 Detailed Problem

Description:

The Main Control Room Analysis Notebook 016015-RPT-07 does not address the impact of a transient fire behind the open panels igniting cables inside of the panel.

Proposed Solution: Address the potential for a transient fire located behind an open electrical panel igniting the cables inside of the panel.

Basis for Significance: Potential increases in heat release rate of scenarios are not addressed and could impact risk.

Actual Solution:

Transient fires adjacent to panels in the Main Control Room are assumed to damage panels by assigning the same impacts as fixed-ignition source scenarios originating in the panel. Using this approach, the transient fire frequency is added to the fixed-source frequency in order to reduce the number of scenarios postulated in the control room, and, at the same time, include the transient frequency contribution to fire risk.

It is important to note that the ignition of the cables inside of an open panel by a transient ignition source does not change the impact of the fires; the damage to each panel by a transient fire is equivalent to the panel igniting on its own.

Further, fires igniting within each panel are evaluated for propagation to adjacent panels. By adding the transient fire frequency to the fixed ignition source frequency in these scenarios, the potential for a transient fire to ignite cables in more than one cabinet is already captured.

With regards to the MCR abandonment analysis, it is not necessary to analyze an additional fuel package fire scenario in which a transient fire ignites cables inside of an open panel. Ignition of these secondary combustibles would not measurably impact the time to abandonment calculations presented in Section 6.0 of the MCR Notebook [Reference 54]. Regardless of the location of the transient fuel package (open, wall, corner) and of the environmental conditions (functionality of HVAC, open/closed entry doors),

abandonment conditions were achieved before the fire reached a peak heat release rate of 317 kW.

Importantly, the peak heat release rate of the transient scenario is achieved two minutes after ignition.

Following guidance in Appendix R of NUREG/CR-6850, the exposed cables are not expected to ignite until at least 5 minutes after ignition. Therefore, abandonment conditions would have been achieved prior ignition of these exposed cables.

Impact on ILRT Extension:

• ..The F&O is closed, and there is no impact on the ILRT Extension Analysis.

Revision 2 Revison 2Page 136 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0084 F&O Number: 4-42 Associated SR(s): FSS-B2 Detailed Problem

Description:

The Main Control Room Analysis Notebook 016015-RPT-07 does not reduce the total available floor area by removing equipment floor space when calculating the transient fire frequencies.

Proposed Solution: Reduce the available floor area for transients by removing equipment floor space and recalculate the transient scenario fire frequencies.

Basis for Significance: The reduction of the total available floor area would impact the individual transient fire frequencies.

Actual Solution:

The Main Control Room Analysis Notebook [Reference 54] has been updated such that the transient fire frequencies in the MCR are calculated using the available floor area; the available floor area is calculating by subtracting the equipment floor space from the total floor area of the main control room.

The Monticello Fire PRA postulates a transient fire in front of each panel in the Main Control Room.

These postulated transient fires are considered to have the same impacts as the fixed-ignition-source scenarios originating on the panel. The frequency of these postulated transient fires includes a geometry factor. This geometry factor apportions the total transient frequency assigned to the Main Control Room to the floor area near the panel under consideration. This geometry factor is equal to the ratio of the floor area in which a transient fire may damage a panel (approximately 16 sq. ft) to the total available floor area in which a transient fire may occur. The total available floor area is equal to the total floor area of the Main Control Room (2250 sq. ft) minus the areas of the floor that are permanently occupied by plant equipment (653 sq. ft). The total available floor area in which a transient fire may occur is equal to 1,597 sq. ft.

Impact on ILRT Extension:

The F&O is closed, and there is no impact on the ILRT Extension Analysis.

Page 137 of 142 Revision 2 Revision 2 Page 137 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0109 F&O Number: 7-4 Associated SR(s): SY-AI, PRM-B1, PRM-B9, PRM-C1, FQ-A2 Detailed Problem

Description:

It is not clear if the internal events PRA initiating events and accident sequences applicable to two or more SRVs open similar to LLOCA have been correctly applied. If it is deemed that opening of two or more SRVs does not need to mimic LLOCA, then provisions for a new initiating event, success criteria and accident sequence is required.

PRM calculation 01601 5-RPT-05, MSO 3a and 3b for potential opening of two or more SRVs added additional logic to the PRM. Potential opening of all SRVs mimics sequences similar to Large LOCA.

Review of the PRM calculation noted in section 6.0 that the initiating events and accident sequences embodied in the MNGP internal events model are used as the basis for development of the FPRA model.

Additional information received from the utility representative regarding the review of internal events initiating events determined that Large LOCA was deemed not applicable to the FPRA. Review of the PRM CAFTA model located MSO failure of more than one SRV via gate F_SORV_2of8 with parents to gates different from LLOCA. If it is deemed that opening of all SRVs does not need to mimic LLOCA, then provisions for a new initiating event, success criteria and accident sequence is required.

(This F&O originated from SR PRM-BI)

Proposed Solution: When internal events PRA initiating events and accident sequences for CDF and /

or LERF are utilized, ensure that the FPRA sequences are definitively modeled.

Basis for Significance: It is not clear ifthe internal events PRA initiating events and accident sequences applicable to all SRVs open similar to LLOCA have been correctly applied.

Actual Solution:

The logic in the PRM was updated to map the correct logic to the LLOCA initiating logic. This includes the F_SORV_20F8 gate that models 2 of the 8 SRVs spuriously opening (MSO 3a/b).

Section 6.1 of the PRM notebook [Reference 50] was updated to state the Large LOCA event tree was determined to be applicable to the modeling the plant response to fire-induced spurious opening of two or more SRVs, and the PRM notebook [Reference 50] was revised to clarify the treatment given to fire-induced spurious opening of two or more SRVs.

Impact on ILRT Extension:

There is no impact on the ILRT Extension Risk Analysis.

Revision 2 Revison 2Page 138 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0030 F&O Number: 1-36 Associated SR(s): QU-D2, EQ-El Detailed Problem

Description:

The Quantification notebook documents the sequences of events for the dominant CDF and LERF fire scenarios. However, based on the issues identified for the CS and PRM elements, the review team concludes that cutset reviews were not performed to the extent needed to ensure FPRA model realism.

Proposed Solution: Review the results of the PRA for modeling consistency (e.g., event sequence model's consistency with systems models and success criteria) and operational consistency (e.g., plant configuration, procedures, and plant-specific and industry experience).

Basis for Significance: Risk-significant issues were identified in the FPRA model that would have been observable by review of results, and therefore the review team finds the review the review of results of the PRA for modeling consistency to be insufficient.

Actual Solution:

At the time of peer review, the CDF and LERF numbers were higher than acceptable. This was known going in to review. One of the factors contributing to the high risk values is model conservatisms. Detailed cutset reviews were performed during the quantification process and were documented in the Quantification notebook [Reference 361, however, there were known conservatisms.

After the peer review, the model was refined to address F&Os and reduce risk, including updated ASD modeling, additional CFMLA, etc. Additional cutset reviews were performed. Model realism was considered carefully during these reviews and the reviews were documented as part of the updated Quantification notebook [Reference 36].

Impact on ILRT Extension:

Since the model was refined to increase realism, the F&O is closed, and there is no impact on the ILRT Extension Analysis.

Page 139 of 142 Revision 22 Page 139 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0021 F&O Number: 1-24 Associated SR(s): LE-F2, QU-D5, PRM-A4, PRM-C1, FQ-A3, FQ-Fl, QU-B1, FQ-B1, UNC-A2 Detailed Problem

Description:

The peer review noted issues related to the output produced from the fire modeling database FMDB.

FMDB contains queries that combine the fire scenario information and the cable selection and location information into the tables utilized by FRANX to quantify the FPRA scenarios:

The review team noted that equipment impacts from fire damage for a full burnup scenario of the yard were not translating from the cable selection to the plant response model. Fire damage impacts therefore were missing from the fire scenario modeled. Further review indicated that items coded as '2, for example, in the zone-to-raceway table were not translating into fire impacts due to a missing query in the FM DR. This impacted fire scenarios for the yard, and the scenarios that end with EC5 (i.e., scenarios in which the ignition source is an electrical cabinet for which only the cabinet itself was damaged), in addition to other scenarios.

The review team also noted that all fire scenarios involving HEAF their respective targets are not include were not included in the FPRA PRM modeling.

Based on these observations, the review team did not have confidence that the FMDB demonstrated the capability to generate appropriate results.

Proposed Solution: Demonstrate that the FMDB generates appropriate results as well as outputs to FRANX through a process of verification.

Construct the Fire PRA plant response model consistent with the scope and location of equipment and cables (accounting for cable damage effects on the equipment of interest) per Section 4.2.2 and Section 4.2.3.

Basis for Significance: Potential risk-significant impacts.

Actual Solution:

The fire scenario associated with full zone damage to the Yard has been corrected. To do so, the following verifications have been conducted:

1. The fire scenario associated with full zone damage to the Yard, which is originated and maintained in the Fire modeling Database was reviewed to ensure that all the targets mapped to the Yard were accounted for.

2. The FRANX quantification tables (i.e., FRANX Scenarios table and FRANX Zone To Raceway table) generated in the fire modeling database and exported to FRANX were reviewed to ensure that the Yard scenario was appropriately specified.

3. The FRANX quantification was reviewed to ensure that the scenario was treated and quantified correctly FRANX.

The risk contribution of the full zone burn in the Yard is now correctly accounted for in the MNGP Fire PRA.

Impact on ILRT Extension:

Since the model was refined, the F&O is closed, and there is no impact on the ILRT Extension Analysis.

Revision 2 Revison 2Page 140 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0085 F&O Number: 4-6 Associated SR(s): IGN-AlO, UNC-A2 Detailed Problem

Description:

A sensitivity analysis was not performed for fire ignition frequency bins characterized by an alpha from EPRI 1016735 analysis that are less than or equal to 1 as required by Supplement 1Ito NUREG/CR-6850.

Proposed Solution: Perform and document the sensitivity analysis for fire ignition frequency bins with alpha less than I as required by Supplement 1 to NUREG/CR-6850 in order to utilize the updated ignition frequency values.

Basis for Significance: Supplement 1 to NUREG/CR-6850 requires a sensitivity analysis to be completed in order to utilize the updated fire ignition frequency values.

Actual Solution:

A sensitivity analysis case has been created to quantify the impact of using the generic fire ignition frequencies in NUREG/CR-6850. The Fire PRA has been quantified with the fire ignition frequencies listed in Chapter 6 of NUREG/CR-6850 for those bins with Alpha values less than or equal to 1.0. The results of the quantification are documented in the MNGP UNC Notebook [Reference 40]. The process for quantifying the Fire PRA with these frequencies is identical to the one in the base quantification. That is, the applicable generic frequencies from NUREG/CR-6850 are stored in the Fire Modeling Database and propagated through the fire scenario frequency quantification. The fire scenario frequencies are then imported into FRANX to complete the quantification process.

Impact on ILRT Extension:

The F&O is closed with the completion of 016015-RPT-15 Revision 3, and there is no impact on the ILRT Extension Analysis.

Change Number: MT-I15-0047 F&O Number: 3-10 Associated SR(s): LE-G5, QU-F5, FQ-FI, UNC-A2 Detailed Problem

Description:

LE G-5 requires discussion of modeling limitations and impact on results. This was not performed Proposed Solution: Add discussion of limitations Basis for Significance: There is no documentation of modeling limitations and effect on applications.

Actual Solution:

A discussion of LERF modeling limitations and the potential impact on results was added to the Quantification notebook [Reference 36]. The discussion was added to Section 3 of the quantification notebook [Reference 36].

Impact on ILRT Extension:

The documentation F&O is closed, and there is no impact on the ILRT Extension Analysis.

Page 141 of 142 Revision 22 Page 141 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0105 F&O Number: 6-7 Associated SR(s): PRM-B2, PRM-C1 Detailed Problem

Description:

The peer review exceptions and deficiencies for the 2013 Internal Events PRA were entered and resolved in the POD database and was used as the starting basis for Fire PRA model. However, it does not appear from the documentation that a verification of the internal events PRA dispositions from the 2013 peer review was performed to ensure they do not adversely affect the Fire PRA model, as required by the standard.

From a cursory review of the internal event deficiencies, FPIE F/Os 7-15, 7-17 and 4-2 revealed concerns regarding HRA assumptions and potential impact on the quantification. There is no evidence in the documentation that these concerns were evaluated in the context of the fire PRA.

Proposed Solution: Verify the peer review exceptions and deficiencies for the Internal Events PRA are dispositioned, and the disposition does not adversely affect the development of the Fire PRA plant response model.

Basis for Significance: As required by the standard, the development of the FPRA requires a verification of the dispositions to the peer review exceptions and deficiencies to ensure they not adversely affect the development of the Fire PRA plant response model.

Actual Solution:

Internal Events F&Os 7-15, 7-17 and 4-2 were closed and incorporated in the Internal Events PRA model, which was the basis for the Fire PRA model. The Internal Events PRA model has been reviewed to ensure technical adequacy. Therefore, the concerns of these F&Os have been addressed in the Fire PRA.

The dependency analysis was revised and performed with a general joint HEP floor set to 1.0E-05. For some combinations that involve long-term decay heat removal actions or LERF-reduction specific actions, a minimum joint HEP floor of 1E-06 was used. Maintaining a lower minimum joint probability for these combinations is appropriate because they will take place many hours after the fire, at which point the activation of the Technical Support Center (TSC) would be able to provide a mind frame that allows for a 1 E-06 minimum joint dependency threshold. This is documented in the Fire Human Reliability Analysis Notebook [Reference 46].

Impact on ILRT Extension:

Since the Internal Event PRA F&Os are closed, there is no impact on the ILRT Extension Analysis.

Page 142 of 142 Revision 22 Page 142 of 142

JENSEN HUGHES 0

Advancing the Science of Safety Monticello Nuclear Generating Station:

Evaluation of Risk Significance of Permanent ILRT Extension 54005-CALC-O01 Prepared for:

Monticello Nuclear Generating Station Project Number: 1RCA54005 Project

Title:

Permanent ILRT Extension Revision: 2 Name and Date Preaer.ustn Satle..I."ILL ,i~alysge by Justin Sattler Prepaer: usti Setlerj , te: 2016.02.05 12:04:27-06O00

• 7 ~ L~1~e: 2016.02.05 12:o5:4-o6'0o, Review Method Design Review [] Alternate Calculation D]

Appovd b: athewJons n . _________Diiia,,y signed by Matt ohnson Aprvdb:

ateUohsn */ *: b'aid>*

2016.02.08 11:42:06-06'00'

/ .... fj Revision 2 Page 1 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension REVISION RECORD

SUMMARY

Revision Revision Summary 0 Initial issue with client comments incorporated 1 Updated Sections 5.3.4 and 7.0 based on client comments 2 Added references 41-58 and added references to Appendix A Page 2 of 142 Revision 22 Revision Page 2 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension TABLE OF CONTENTS 1.0 PURPOSE........................................................................................ 4 2.0 SCOPE ........................................................................................... 4

3.0 REFERENCES

.................................................................................. 6 4.0 ASSUMPTIONS AND LIMITATIONS ........................................................ 9 5.0 METHODOLOGY and analysis .............................................................. 10 5.1 Inputs .......................................................................................... 10 5.1.1 General Resources Available ......................................................... 10 5.1.2 Plant Specific Inputs .................................................................. 13 5.1.3 Impact of Extension on Detection of Component Failures that Lead to Leakage (Small and Large).................................................................... 14 5.2 Analysis ..................................................................................... 15 5.2.1 Step 1 - Quantify the Baseline Risk in Terms of Frequency per Reactor Year....16 5.2.2 Step 2 - Develop Plant-Specific Person-Remn Dose (Population Dose)............ 19 5.2.3 Step 3 - Evaluate Risk Impact of Extending Type ATest Interval from 10 to 15 Years ................................................................................. 22 5.2.4 Step 4 - Determine the Change in Risk in Terms of LERF ......................... 23 5.2.5 Step 5 - Determine the Impact on the Conditional Containment Failure Probability

...................................................................................... 24 5.2.6 Impact of Extension on Detection of Steel Liner Corrosion that Leads to Leakage

...................................................................................... 25 5.3 Sensitivities ................................................................................. 27 5.3.1 Potential Impact from External Events Contribution................................. 27 5.3.2 Potential Impact from Steel Liner Corrosion Likelihood ............................. 29 5.3.3 Expert Elicitation Sensitivity........................................................... 30 5.3.4 Containment Accident Pressure Sensitivity.......................................... 32 5.3.5 Power Supply Coordination Sensitivity............................................... 34 6.0 RESULTS ....................................................................................... 35

7.0 CONCLUSION

S AND RECOMMENDATIONS............................................. 36 A. Appendix A: PRA Technical Adequacy ..................................................... 38 Revision 2 Page 3 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 1.0 PURPOSE The purpose of this analysis is to provide a risk assessment of permanently extending the currently allowed containment Type A Integrated Leak Rate Test (ILRT) interval to fifteen years.

The extension would allow for substantial cost savings as the ILRT could be deferred for additional scheduled refueling outages for the Monticello Nuclear Generating Plant (MNGP).

The risk assessment follows the guidelines from NEI 94-01, Revision 3-A [Reference 1], the methodology used in EPRI TR-104285 [Reference 2], the NEI "Interim Guidance for Performing Risk Impact Assessments in Support of One-Time Extensions for Containment Integrated Leakage Rate Test Surveillance Intervals" from November 2001 [Reference 3], the NRC regulatory guidance on the use of Probabilistic Risk Assessment (PRA) as stated in Regulatory Guide 1.200 as applied to ILRT interval extensions, risk insights in support of a request for a plant's licensing basis as outlined in Regulatory Guide (RG) 1.174 [Reference 4], the methodology used for Calvert Cliffs to estimate the likelihood and risk implications of corrosion-induced leakage of steel liners going undetected during the extended test interval [Reference 5],

and the methodology used in EPRI 1018243, Revision 2-A of EPRI 1009325 [Reference 24].

2.0 SCOPE Revisions to 10CFR50, Appendix J (Option B) allow individual plants to extend the Integrated Leak Rate Test (ILRT) Type A surveillance testing frequency requirement from three in ten years to at least once in ten years. The revised Type A frequency is based on an acceptable performance history defined as two consecutive periodic Type A tests at least 24 months apart in which the calculated performance leakage rate was less than limiting containment leakage rate of 1ILa.

The basis for the current 10-year test interval is provided in Section 11.0 of NEI 94-01, Revision 0, and established in 1995 during development of the performance-based Option B to Appendix J. Section 11.0 of NEI 94-01 states that NUREG-1493, "Performance-Based Containment Leak Test Program," September 1995 [Reference 6], provides the technical basis to support rulemaking to revise leakage rate testing requirements contained in Option B to Appendix J. The basis consisted of qualitative and quantitative assessment of the risk impact (in terms of increased public dose) associated with a range of extended leakage rate test intervals. To supplement the NRC's rulemaking basis, NEI undertook a similar study. The results of that study are documented in Electric Power Research Institute (EPRI) Research Project TR-104285, "Risk Impact Assessment of Revised Containment Leak Rate Testing Intervals."

The NRC report on performance-based leak testing, NUREG-1493, analyzed the effects of containment leakage on the health and safety of the public and the benefits realized from the containment leak rate testing. In that analysis, it was determined that for a representative BWR plant (i.e., Peach Bottom), that increasing the containment leak rate from the nominal 0.5% per day to 5 percent per day leads to a barely perceptible increase in total population exposure, and increasing the leak rate to 50% per day increases the total population exposure by less than 1%. Because ILRTs represent substantial resource expenditures, it is desirable to show that extending the ILRT interval will not lead to a substantial increase in risk from containment isolation failures to support a reduction in the test frequency for MNGP.

NEI 94-01 Revision 2-A contains a Safety Evaluation Report that supports using EPRI Report No.

1009325 Revision 2-A, "Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals," for performing risk impact assessments in support of ILRT extensions [Reference 24].

The Guidance provided in Appendix H of EPRI Report No. 1009325 Revision 2-A builds on the EPRI Risk Assessment methodology, EPRI TR-104285. This methodology is followed to determine the appropriate risk information for use in evaluating the impact of the proposed ILRT changes.

Revision 2 Page 4 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension It should be noted that containment leak-tight integrity is also verified through periodic in-service inspections conducted in accordance with the requirements of the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code Section Xl. More specifically, Subsection IWE provides the rules and requirements for in-service inspection of Class MC pressure-retaining components and their integral attachments, and of metallic shell and penetration liners of Class CC pressure-retaining components and their integral attachments in light-water cooled plants. Furthermore, NRC regulations 10 CFR 50.55a(b)(2)(ix)(E) require licensees to conduct visual inspections of the accessible areas of the interior of the containment. The associated change to NEI 94-01 will require that visual examinations be conducted during at least three other outages, and in the outage during which the ILRT is being conducted. These requirements will not be changed as a result of the extended ILRT interval. In addition, Appendix J, Type B local leak tests performed to verify the leak-tight integrity of containment penetration bellows, airlocks, seals, and gaskets are also not affected by the change to the Type A test frequency.

The acceptance guidelines in RG 1.174 are used to assess the acceptability of this permanent extension of the Type A test interval beyond that established during the Option B rulemaking of Appendix J. RG 1.174 defines very small changes in the risk-acceptance guidelines as increases in Core Damage Frequency (CDF) less than 10-6 per reactor year and increases in Large Early Release Frequency (LERF) less than 10-7 per reactor year. Since containment accident pressure is credited in support of ECCS performance to mitigate design basis accidents at MNGP, the ILRT extension may impact CDF. A detailed sensitivity study is performed and described in Section 5.3.4; this shows the ILRT extension has only a very small effect on CDF. Therefore, the more relevant risk-impact metric is LERF. RG 1.174 also defines small changes in LERF as below 10-6 per reactor year. RG 1.174 discusses defense-in-depth and encourages the use of risk analysis techniques to help ensure and show that key principles, such as the defense-in-depth philosophy, are met. Therefore, the increase in the Conditional Containment Failure Probability (CCFP), which helps ensure the defense-in-depth philosophy is maintained, is also calculated.

Regarding CCFP, changes of up to 1.1% have been accepted by the NRC for the one-time requests for extension of ILRT intervals. In context, it is noted that a CCFP of 1/10 (10%) has been approved for application to evolutionary light water designs. Given these perspectives, a change in the CCFP of up to 1.5% is assumed to be small.

In addition, the total annual risk (person rem/year population dose) is examined to demonstrate the relative change in this parameter. While no acceptance guidelines for these additional figures of merit are published, examinations of NUREG-1493 and Safety Evaluation Reports (SER) for one-time interval extension (summarized in Appendix G of Reference 24) indicate a range of incremental increases in population dose that have been accepted by the NRC. The range of incremental population dose increases is from <0.01 to 0.2 person-remn/year and/or 0.002% to 0.46% of the total accident dose. The total doses for the spectrum of all accidents (NUREG-1493 [Reference 6], Figure 7-2) result in health effects that are at least two orders of magnitude less than the NRC Safety Goal Risk. Given these perspectives, a very small population dose is defined as an increase from the baseline interval (3 tests per 10 years) dose of <1.0 person-rem per year or 1% of the total baseline dose, whichever is less restrictive for the risk impact assessment of the proposed extended ILRT interval.

For those plants that credit containment overpressure for the mitigation of design basis accidents, a brief description of whether overpressure is required should be included in this section. In addition, if overpressure is included in the assessment, other risk metrics such as CDF should be described and reported.

Revision 2 Page 5 of 142

54003-CALC-02 Evaluation of Risk Si.qnificance of Permanent ILRT Extension

3.0 REFERENCES

The following references were used in this calculation:

1. Revision 3-A to/Industry Guideline for Implementing Performance-BasedOption of 10 CFR Part50, Appendix J, NEI 94-01, July 2012.

2. Risk Impact Assessment of Revised Containment Leak Rate Testing lntervals, EPRI, Palo Alto, CA, EPRI TR-1 04285, August 1994.

3. Interim Guidance for Performing Risk Impact Assessments in Support of One-Time Extensions for Containment IntegratedLeakage Rate Test Surveillance Intervals, Revision 4, developed for NEI by EPRI and Data Systems and Solutions, October 2001.

4. An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Regulatory Guide 1.174, May 2011.

5. Response to Request for Additional Information Concerningthe License Amendment Request for a One-Time Integrated Leakage Rate Test Extension, Letter from Mr. C. H.

Cruse (Calvert Cliffs Nuclear Power Plant) to NRC Document Control Desk, Docket No.

50-317, March 27, 2002.

6. Performance-Based Containment Leak-Test Program, NUREG-1493, September 1995.

7. Evaluation of Severe Accident Risks: Peach Bottom Unit 2, Main Report NUREG/CR-4551, SAND86-1309, Volume 4, Revision 1, Part 1, October 1990.

8. Letter from R. J. Barrett (Entergy) to u. s. Nuclear Regulatory Commission, IPN-01-007, January 18, 2001.

9. United States Nuclear Regulatory Commission, Indian Point Nuclear Generating Unit No. 3 - Issuance of Amendment Re: Frequency of Performance-Based Leakage Rate Testing (TAC No. MB0178), April 17, 2001.

10. Impact of Containment Building Leakage on LWR Accident Risk, Oak Ridge National Laboratory, NUREG/CR-3539, ORNL/TM-8964, April 1984.

11. Reliability Analysis of Containment Isolation Systems, Pacific Northwest Laboratory, NUREG/CR-4220, PNL-5432, June 1985.

12. Technical Findings and Regulatory Analysis for Generic Safety Issue I1.E.4.3

'Containment Integrity Check', NUREG-1 273, April 1988.

13. Review of Light Water Reactor Regulatory Requirements, Pacific Northwest Laboratory, NUREG/CR-4330, PNL-5809, Volume 2, June 1986.

14. Shutdown Risk Impact Assessment for Extended Containment Leakage Testing Intervals Utilizing ORAMTM , EPRI, Palo Alto, CA, TR-105189, Final Report, May 1995.

15. Severe Accident Risks: An Assessment for Five U. S. Nuclear Power Plants, NUREG-1150, December 1990.

16. United States Nuclear Regulatory Commission, Reactor Safety Study, WASH-1400, October 1975.

17. Calculation PRA-MT-QU, Revision 3.2, Monticello Nuclear Generating Plant, "MNGP Quantification Notebook."

18. Calculation PRA-MT-L2, Revision 3.2, Monticello Nuclear Generating Plant, "MNGP Level 2 Notebook."

19. Monticello Nuclear Generating Plant, Application for Renewed Operating License, Appendix E - Environmental Report, 2005.

Revision 2 Page 6 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension

20. Anthony R. Pietrangelo, One-time extensions of containment integrated leak rate test interval - additional information, NEI letter to Administrative Points of Contact, November 30, 2001.

21. Letter from J. A. Hutton (Exelon, Peach Bottom) to U. S. Nuclear Regulatory Commission, Docket No. 50-278, License No. DPR-56, LAR-01-00430, dated May 30, 2001.

22. Risk Assessment for Joseph M. FarleyNuclear Plant Regarding ILRT (Type A)

Extension Request, prepared for Southern Nuclear Operating Co. by ERIN Engineering and Research, P0293010002-I1929-030602, March 2002.

23. Letter from D. E. Young (Florida Power, Crystal River) to U. S. Nuclear Regulatory Commission, 3F0401-11, dated April 25, 2001.

24. Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals, Revision 2-A of 1009325, EPRI, Palo Alto, CA. 1018243, October 2008.

25. Risk Assessment for Vogtle Electric Generating Plant Regarding the ILRT (Type A)

Extension Request, prepared for Southern Nuclear Operating Co. by ERIN Engineering and Research, February 2003.

26. Perspectives Gained from the IPEEE Program, USNRC, NUREG-1 742, April 2002.

27. "Renewed Facility Operating License DPR-22 for Monticello Nuclear Generating Plant,"

Technical Specifications, Docket No. 50-263, November 8, 2006.

28. Letter L-14-121, ML14111A291, FENOC Evaluation of the Proposed Amendment, Beaver Valley Power Station, Unit Nos. I and 2, April 2014.

29. Technical Letter Report ML112070867, Containment Liner Corrosion Operating Experience Summary, Revision 1, August 2011.

30. P0495020001-1969-040502, Monticello Nuclear Generating Plant, "Risk Assessment for Monticello Nuclear Generating Plant Regarding ILRT (Type A) Extension Request," April 2002.

31. Armstrong, J., Simplified Level 2 Modeling Guidelines: WOG PROJECT: PA-RMSC-0088, Westinghouse, WCAP-1 6341 -P, November 2005.

32. IPEEE, "Monticello Individual Plant Examination of External Events (IPEEE)," Revision 1, NSPLMI-95001, November 1995.

33. "Correction to Appendix C of the Monticello Individual Plant Examination of External Events," ML103610324, December 20, 2010.

34. Generic Issue 199 (G1-199), ML100270582, September 2010, "Implications of Updated Probabilistic Seismic Hazard Estimates in Central and Eastern United States on Existing Plants: Safety/Risk Assessment."

35. "The Nuclear Energy Institute - Seismic Risk Evaluations for Plants in the Central and Eastern United States," ML14083A596, March 2014.

36. Calculation FPRA-MT-QU, "Monticello Nuclear Generating Plant Fire PRA Quantification Notebook," Revision 3.

37. Monticello Nuclear Generating Plant PRA Peer Review Report Using ASME PRA Standard Requirements, BWR Owners Group, June 2013.

38. Calculation PRA-CALC-15-003, "Monticello Fire PRA MAAP Analysis," Revision 0, July 2015.

39. Calculation C495070003-7740, "Identification of Risk Implications due to Extended Power Uprate at Monticello," March 2008.

Revision 2 Revison 2Page 7 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension

40. Calculation FPRA-MT-UNC, "Monticello Nuclear Generating Plant Fire PRA Uncertainty and Sensitivity Notebook," Revision 3.

41. ASME/ANS RA-Sa-2009, Addenda to ASME/ANS RA-S-2008: Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications.

42. Calculation PRA-MT-DA, Revision 3.3, Monticello Nuclear Generating Plant, "Data Analysis Notebook."

43. Calculation PRA-MT-SY-CFW, Revision 3.3, Monticello Nuclear Generating Plant, "Condensate and Feedwater System Notebook."

44. Calculation PRA-MT-IF-IE, Revision 3.3, Monticello Nuclear Generating Plant, "Flooding Initiating Events Analysis Notebook."

45. Calculation FPRA-MT-HR, Revision 3, "Monticello Nuclear Generating Plant Fire PRA Fire Human Reliability Analysis Notebook."

46. Calculation PRA-MT-HRA, Revision 3.3, Monticello Nuclear Generating Plant, "MNGP Human Reliability Analysis Notebook."

47. Calculation PRA-MT-IF-AS, Revision 3.3, Monticello Nuclear Generating Plant, "Internal Flooding Accident Sequence Analysis Notebook."

48. Calculation FPRA-MT-PP, Revision 2, 'Monticello Nuclear Generating Plant Fire PRA Plant Partitioning Notebook."

49. Calculation FPRA-MT-ES, Revision 2, "Monticello Nuclear Generating Plant Fire PRA Equipment Selection Notebook."

50. Calculation FPRA-MT-PRM, Revision 3, "Monticello Nuclear Generating Plant Fire PRA Plant Response Model Notebook."

51. Calculation FPRA-MT-SCA, Revision 3, "Monticello Nuclear Generating Plant Fire PRA Single Compartment Analysis Notebook."

52. Calculation FPRA-MT-MCA, Revision 3, "Monticello Nuclear Generating Plant Fire PRA Multi-Compartment Analysis Notebook."

53. Calculation FPRA-MT-IF, Revision 2, "Monticello Nuclear Generating Plant Fire PRA Fire Ignition Frequencies Notebook."

54. Calculation FPRA-MT-MCR, Revision 3, "Monticello Nuclear Generating Plant Fire PRA Main Control Room Analysis Notebook."

55. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of ProbabilisticRisk Assessment Results for Risk-Informed Activities, Revision 2, March 2009.

56. NEI 07-12, Fire ProbabilisticRisk Assessment (FPRA) PeerReview Process Guidelines, Revision 1.

57. NEI 05-04, Process for Performing Internal Events PRA Peer Reviews Using the ASME/ANS PRA Standard, Revision 2.

58. Calculation PRA-MT-WI, Monticello Nuclear Generating Plant, "System Walkdown and Interview Notebook."

Page 8 of 142 Revision 22 Page 8 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 4.0 ASSUMPTIONS AND LIMITATIONS The following assumptions were used in the calculation:

• The technical adequacy of the MNGP PRA is either consistent with the requirements of Regulatory Guide 1.200 or where gaps exist, the gaps have been addressed, as is relevant to this ILRT interval extension, as detailed in Appendix A.

• The MNGP Level 1 and Level 2 internal events PRA models provide representative results.

• It is appropriate to use the MNGP internal events PRA model to effectively describe the risk change attributable to the ILRT extension. An extensive sensitivity study is done in Section 5.3.1 to show the effect of including external event models for the ILRT extension. The Seismic risk from GI-199 [Reference 34] and Fire PRA (model Revision

1) are used for this sensitivity analysis.

- Dose results for the containment failures modeled in the PSA can be characterized by information provided in NUREG/CR-4551 [Reference 7]. They are estimated by scaling the NUREG/CR-4551 results by population differences for Monticello compared to the NUREG/CR4551 reference plant. The representative containment leakage for Class 1 sequences is 1La. Class 3 accounts for increased leakage due to Type A inspection failures.

• The lowest consequence calculations (i.e., intact containment and small leakages) are based on scaling the NUREG/CR-4551 [Reference 7] results for such cases using population differences, and also based on differences in the allowable Technical Specification Leakage. Class 7 releases are based on values provided in Reference 19.

• The representative containment leakage for Class 3a sequences is I10La based on the previously approved methodology performed for Indian Point Unit 3 [Reference 8, Reference 9].

• The representative containment leakage for Class 3b sequences is 100OLa based on the guidance provided in EPRI Report No. 1009325, Revision 2-A (EPRI 1018243)

[Reference 24].

• The Class 3b can be very conservatively categorized as LERF based on the previously approved methodology [Reference 8, Reference 9].

• The impact on population doses from containment bypass scenarios is not altered by the proposed ILRT extension, but is accounted for in the EPRI methodology as a separate entry for comparison purposes. Since the containment bypass contribution to population dose is fixed, no changes in the conclusions from this analysis will result from this separate categorization.

• The reduction in ILRT frequency does not impact the reliability of containment isolation valves to close in response to a containment isolation signal.

Page 9 of 142 Revision 22 Revision Page 9 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 8.0 METHODOLOGY AND ANALYSIS 5.1 Inputs This section summarizes the general resources available as input (Section 5.1.1) and the plant specific resources required (Section 5.1.2).

5.1.1 General Resources Available Various industry studies on containment leakage risk assessment are briefly summarized here:

1. NUREG/CR-3539 [Reference 10]

2. NUREG/CR-4220 [Reference 11]

3. NUREG-1273 [Reference 12]

4. NUREG/CR-4330 [Reference 13]

5. EPRI TR-105189 [Reference 14]

6. NUREG-1493 [Reference 6]

7. EPRI TR-104285 [Reference 2]

8. NUREG-1 150 [Reference 15] and NUREG/CR-4551 [Reference 7]

9. NEI Interim Guidance [Reference 3, Reference 20]

10. Calvert Cliffs liner corrosion analysis [Reference 5]

11. EPRI Report No. 1009325, Revision 2-A (EPRI 1018243), Appendix H [Reference 24]

This first study is applicable because it provides one basis for the threshold that could be used in the Level 2 PRA for the size of containment leakage that is considered significant and is to be included in the model. The second study is applicable because it provides a basis of the probability for significant pre-existing containment leakage at the time of a core damage accident. The third study is applicable because it is a subsequent study to NUREG/CR-4220 that undertook a more extensive evaluation of the same database. The fourth study provides an assessment of the impact of different containment leakage rates on plant risk. The fifth study provides an assessment of the impact on shutdown risk from ILRT test interval extension. The sixth study is the NRC's cost-benefit analysis of various alternative approaches regarding extending the test intervals and increasing the allowable leakage rates for containment integrated and local leak rate tests. The seventh study is an EPRI study of the impact of extending ILRT and local leak rate test (LLRT) intervals on at-power public risk. The eighth study provides an ex-plant consequence analysis for a 50-mile radius surrounding a plant that is used as the basis for the consequence analysis of the ILRT interval extension for MNGP. The ninth study includes the NEI recommended methodology (promulgated in two letters) for evaluating the risk associated with obtaining a one-time extension of the ILRT interval. The tenth study addresses the impact of age-related degradation of the containment liners on ILRT evaluations. Finally, the eleventh study builds on the previous work and includes a recommended methodology and template for evaluating the risk associated with a permanent 15-year extension of the ILRT interval.

NUREG/CR-3539 rReference 101 Oak Ridge National Laboratory documented a study of the impact of containment leak rates on public risk in NUREG/CR-3539. This study uses information from WASH-1400 [Reference 16]

as the basis for its risk sensitivity calculations. ORNL concluded that the impact of leakage rates on LWR accident risks is relatively small.

NUREG/CR-4220 [Reference 11]I NUREGICR-4220 is a study performed by Pacific Northwest Laboratories for the NRC in 1985.

The study reviewed over two thousand LERs, ILRT reports and other related records to Revision 2 Page 10 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension calculate the unavailability of containment due to leakage.

NUREG-1 273 [Reference 121 A subsequent NRC study, NUREG-1273, performed a more extensive evaluation of the NUREG/CR-4220 database. This assessment noted that about one-third of the reported events were leakages that were immediately detected and corrected. In addition, this study noted that local leak rate tests can detect "essentially all potential degradations" of the containment isolation system.

NUREG/CR-4330 [Reference 131 NUREG/CR-4330 is a study that examined the risk impacts associated with increasing the allowable containment leakage rates. The details of this report have no direct impact on the modeling approach of the ILRT test interval extension, as NUREG/CR-4330 focuses on leakage rate and the ILRT test interval extension study focuses on the frequency of testing intervals.

However, the general conclusions of NUREG/CR-4330 are consistent with NUREG/CR-3539 and other similar containment leakage risk studies:

".theeffect of containment leakage on overall accident risk is small since risk is dominated by accident sequences that result in failure or bypass of containment."

EPRI TR-105189 [Reference 141 The EPRI study TR-1 05189 is useful to the ILRT test interval extension risk assessment because it provides insight regarding the impact of containment testing on shutdown risk. This study contains a quantitative evaluation (using the EPRI ORAM software) for two reference plants (a BWR-4 and a PWR) of the impact of extending ILRT and LLRT test intervals on shutdown risk. The conclusion from the study is that a small, but measurable, safety benefit is realized from extending the test intervals.

NUREG-1493 [Reference 61 NUREG-1493 is the NRC's cost-benefit analysis for proposed alternatives to reduce containment leakage testing intervals and/or relax allowable leakage rates. The NRC conclusions are consistent with other similar containment leakage risk studies:

Reduction in ILRT frequency from 3 per 10 years to 1 per 20 years results in an "imperceptible" increase in risk.

Given the insensitivity of risk to the containment leak rate and the small fraction of leak paths detected solely by Type A testing, increasing the interval between integrated leak rate tests is possible with minimal impact on public risk.

EPRI TR-104285 [Reference 21 Extending the risk assessment impact beyond shutdown (the earlier EPRI TR-1 05189 study),

the EPRI TR-1 04285 study is a quantitative evaluation of the impact of extending ILRT and LLRT test intervals on at-power public risk. This study combined IPE Level 2 models with NUREG-1 150 Level 3 population dose models to perform the analysis. The study also used the approach of NUREG-1493 in calculating the increase in pre-existing leakage probability due to extending the ILRT and LLRT test intervals.-

EPRI TR-1 04285 uses a simplified Containment Event Tree to subdivide representative core damage frequencies into eight classes of containment response to a core damage accident:

1. Containment intact and isolated

2. Containment isolation failures dependent upon the core damage accident

3. Type A (ILRT) related containment isolation failures Revision 2 Page 11 of 142

54003-CALC-02 of Risk Significance 5400-CAL-02Evaluation of Permanent ILRT Extension

4. Type B (LLRT) related containment isolation failures

5. Type C (LLRT) related containment isolation failures

6. Other penetration related containment isolation failures

7. Containment failures due to core damage accident phenomena

8. Containment bypass Consistent with the other containment leakage risk assessment studies, this study concluded:

".theproposed CLRT (Containment Leak Rate Tests) frequency changes would have a minimal safety impact. The change in risk determined by the analyses is small in both absolute and relative terms. For example, for the PWR analyzed, the change is about 0.04 person-rem per year..."

NUREG-1 150 [Reference 151 and NUREG/CR-4551 [Reference 71 NUREG-1150 and the technical basis, NUREG/CR-4551, provide an ex-plant consequence analysis for a spectrum of accidents including a severe accident with the containment remaining intact (i.e., Tech Spec Leakage). This ex-plant consequence analysis is calculated for the 50-mile radial area surrounding Surry. The ex-plant calculation can be delineated to total person-rem for each identified Accident Progression Bin (APB) from NUREG/CR-4551. With the MNGP Level 2 model end-states assigned to one of the NUREG/CR-4551 APBs, it is considered adequate to represent MNGP. (The meteorology and site differences other than population are assumed not to play a significant role in this evaluation.)

NEl Interim Guidance for Performingq Risk Impact Assessments In Support of One-Time Extensions for Containment Inteqrated Leakagqe Rate Test Surveillance Intervals [Reference 3, Reference 201 The guidance provided in this document builds on the EPRI risk impact assessment methodology [Reference 2] and the NRC performance-based containment leakage test program

[Reference 6], and considers approaches utilized in various submittals, including Indian Point 3 (and associated NRC SER) and Crystal River.

Calvert Cliffs Response to Request for Additional Information Concerning the License Amendment for a One-Time Integqrated Leakage Rate Test Extension [Reference 51 This submittal to the NRC describes a method for determining the change in likelihood, due to extending the ILRT, of detecting liner corrosion, and the corresponding change in risk. The methodology was developed for Calvert Cliffs in response to a request for additional information regarding how the potential leakage due to age-related degradation mechanisms was factored into the risk assessment for the ILRT one-time extension. The Calvert Cliffs analysis was performed for a concrete cylinder and dome and a concrete basemat, each with a steel liner.

EPRI Report No. 1009325, Revision 2-A. Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals [Reference 241 This report provides a generally applicable assessment of the risk involved in extension of ILRT test intervals to permanent 15-year intervals. Appendix H of this document provides guidance for performing plant-specific supplemental risk impact assessments and builds on the previous EPRI risk impact assessment methodology [Reference 2] and the NRC performance-based containment leakage test program [Reference 6], and considers approaches utilized in various submittals, including Indian Point 3 (and associated NRC SER) and Crystal River.

The approach included in this guidance document is used in the MNGP assessment to determine the estimated increase in risk associated with the ILRT extension. This document includes the bases for the values assigned in determining the probability of leakage for the EPRI Class 3a and 3b scenarios in this analysis, as described in Section 5.2.

Revision 2 Page 12 of 142

54003-CALC-02 5400-OAL-02Evaluation of Risk Significance of Permanent ILRT Extension 5.1.2 Plant Specific Inputs The plant-specific information used to perform the MNGP ILRT Extension Risk Assessment includes the following:

Level 1 Model results [Reference 17]

Level 2 Model results [Reference 18]

Release category definitions used in the Level 2 Model [Reference 18]

Population Dose calculations by release category [Reference 19, Reference 7]

ILRT results to demonstrate adequacy of the administrative and hardware issues [Reference 30]

MNGP Model The Internal Events PRA Model that is used for MNGP is characteristic of the as-built plant. The current Level 1 model (MNGP PRA Model Revision 3.2) [Reference 17] is a linked fault tree model. The CDF is 8.OIE-6/year [Reference 17], and the LERE is 9.20E-7/year [Reference 18].

Table 5-1 and Table 5-2 provide a summary of the Internal Events ODE and LERF results for MNGP PRA Model Revision 3.2. Note: the apportioning of the sequences is done via quantification of the Revision 3.2 PRA model and examining the sequence flags, not taken directly from the results reported in References 17 and 18 because the sequence-apportioned results do not sum to the total risk; for example, the sum of the risk in Table B-I of Reference 17 is 7.52E-6/year (instead of the actual ODE of 8.01E-6/year).

The total Fire ODE is 4.11E-5/year; the total Fire LERF is 5.31E-6/year [Reference 36]. The GI-199 Seismic CDF is 1.9E-5 [Reference 34]. Refer to Section 5.3.1 for further details on external events as they pertain to this analysis.

Table 5-1 - Internal Events CDF (MNGP PRA Model Revision 3.2)

Internal Events Frequency (per year)

ATVVS 1.59E-07 LOCA I1.48E-07 ISLOCA 2.88E-09 SORV 2.76E-07 Transient 7.43E-06 Total Internal Events CDF 8.OIE-06 Table 5 Internal Events LERF (MNGP PRA Model Revision 3.2)

Internal Events Frequency (per year)

ATWS 6.OOE-08 LOCA I .46E-09 ISLOCA 2.62E-09 SORV 8.1 4E-08 Transient 7.75E-07 Total Internal Events LERF 9.20E-07 Revision 2 Revison 2Page 13 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Release CateQory Definitions Table 5-3 defines the accident classes used in the ILRT extension evaluation, which is consistent with the EPRI methodology [Reference 2]. These containment failure classifications are used in this analysis to determine the risk impact of extending the Containment Type A test interval, as described in Section 5.2 of this report.

Table 5-3 - EPRI Containment Failure Classification [Reference 2]

Class Description Containment remains intact including accident sequences that do not lead to containment failure inthe 1long term. The release of fission products (and attendant consequences) is determined by the maximum allowable leakage rate values La, under Appendix J for that plant.

Containment isolation failures (as reported inthe Individual Plant Examinations) including those accidents 2in which there is a failure to isolate the containment.

3 Independent (or random) isolation failures include those accidents inwhich the pre-existing isolation failure to seal (i.e., provide a leak-tight containment) is not dependent on the sequence in progress.

Independent (or random) isolation failures include those accidents inwhich the pre-existing isolation failure to seal is not dependent on the sequence in progress. This class is similar to Class 3 isolation failures, but is applicable to sequences involving Type B tests and their potential failures. These are the Type B-tested components that have isolated, but exhibit excessive leakage.

Independent (or random) isolation failures including those accidents in which the pre-existing isolation 5 failure to seal is not dependent on the sequence in progress. This class is similar to Class 4 isolation failures, but is applicable to sequences involving Type C test and their potential failures.

Containment isolation failures including those leak paths covered in the plant test and maintenance 6requirements or verified per in-service inspection and testing (ISI/IST) program.

Accidents involving containment failure induced by severe accident phenomena. Changes inAppendix J testing requirements do not impact these accidents.

8 Accidents in which the containment is bypassed (either as an initial condition or induced by phenomena) are included in Class 8. Changes inAppendix J testing requirements do not impact these accidents.

5.1.3 Impact of Extension on Detection of Component Failures that Lead to Leakage (Small and Large)

The ILRT can detect a number of component failures such as liner breach, failure of certain bellows arrangements, and failure of some sealing surfaces, which can lead to leakage. The proposed ILRT test interval extension may influence the conditional probability of detecting these types of failures. To ensure that this effect is properly addressed, the EPRI Class 3 accident class, as defined in Table 5-3, is divided into two sub-classes, Class 3a and Class 3b, representing small and large leakage failures respectively.

The probability of the EPRI Class 3a and Class 3b failures is determined consistent with the EPRI Guidance [Reference 24]. For Class 3a, the probability is based on the maximum likelihood estimate of failure (arithmetic average) from the available data (i.e., 2 "small" failures in 217 tests leads to "large" failures in 217 tests (i.e., 2 1 217 =0.0092). For Class 3b, the probability is based on the Jeifreys non-informative prior (i.e., 0.5 /218 = 0.0023).

In a follow-up letter [Reference 20] to their ILRT guidance document [Reference 3], NEI issued additional information concerning the potential that the calculated delta LERF values for several plants may fall above the "very small change" guidelines of the NRC Regulatory Guide 1.174

[Reference 4]. This additional NEI information includes a discussion of conservatisms in the quantitative guidance for ALERF. NEI describes ways to demonstrate that, using plant-specific calculations, the ALERF is smaller than that calculated by the simplified method.

Revision 2 Page 14 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension The supplemental information states:

The methodology employed for determining LERF (Class 3b frequency) involves conseniatively multiplying the CDF by the failure probabilityfor this class (3b) of accident. This was done for simplicity and to maintain conservatism. However, some plant-specific accident classes leading to core damage are likely to include individual sequences that either may already (independently) cause a LERF or could never cause a LERF, and are thus not associated with a postulated large Type A containment leakage path (LERF). These contributors can be removed from Class 3b in the evaluation of LERF by multiplying the Class 3b probabilityby only that portion of CDF that may be impacted by Type A leakage.

The application of this additional guidance to the analysis for MNGP, as detailed in Section 5.2, involves subtracting the LERF from the CDF that is applied to Class 3b. To be consistent, the same change is made to the Class 3a ODE, even though these events are not considered LERF.

Consistent with the NEI Guidance [Reference 3], the change in the leak detection probability can be estimated by comparing the average time that a leak could exist without detection. For example, the average time that a leak could go undetected with a three-year test interval is 1.5 years (3 years / 2), and the average time that a leak could exist without detection for a ten-year interval is 5 years (10 years / 2). This change would lead to a non-detection probability that is a factor of 3.33 (5.0/1.5) higher for the probability of a leak that is detectable only by ILRT testing.

Correspondingly, an extension of the ILRT interval to 15 years can be estimated to lead to a factor of 5 ((15/2)11.5) increase in the non-detection probability of a leak.

It should be noted that using the methodology discussed above is very conservative compared to previous submittals (e.g., the 1P3 request for a one-time ILRT extension that was approved by the NRC [Reference 9]) because it does not factor in the possibility that the failures could be detected by other tests (e.g., the Type B local leak rate tests that will still occur). Eliminating this possibility conservatively over-estimates the factor increases attributable to the ILRT extension.

5.2 Analysis The application of the approach based on the guidance contained in EPRI Report No. 1009325, Revision 2-A, Appendix H [Reference 24], EPRI TR-104285 [Reference 2] and previous risk assessment submittals on this subject [References 5, 8, 21, 22, and 23] have led to the following results. The results are displayed according to the eight accident classes defined in the EPRI report, as described in Table 5-4.

The analysis performed examined MNGP-specific accident sequences in which the containment remains intact or the containment is impaired. Specifically, the breakdown of the severe accidents, contributing to risk, was considered in the following manner:

Core damage sequences in which the containment remains intact initially and in the long term (EPRI TR-104285, Class 1 sequences [Reference 2]).

Core damage sequences in which containment integrity is impaired due to random isolation failures of plant components other than those associated with Type B or Type C test components. For example, liner breach or bellow leakage (EPRI TR-104285, Class 3 sequences [Refere*nce 2]).

Accident sequences involving containment bypassed (EPRI TR-104285, Class 8 sequences

[Reference 2]), large containment isolation failures (EPRI TR-104285, Class 2 sequences

[Reference 2]), and small containment isolation "failure-to-seal" events (EPRI TR-104285, Class 4 and 5 sequences [Reference 2]) are accounted for in this evaluation as part of the baseline risk profile. However, they are not affected by the ILRT frequency change.

Revision 2 Revison 2Page 15 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Class 4 and 5 sequences are impacted by changes in Type B and C test intervals; therefore, changes in the Type A test interval do not impact these sequences.

Table 5 EPRI Accident Class Definitions Accident Classes Description (Containment Release Type) 1 No Containment Failure 2 Large Isolation Failures (Failure to Close) 3a Small Isolation Failures (Liner Breach) 3b Large Isolation Failures (Liner Breach) 4 Small Isolation Failures (Failure to Seal - Type B) 5 Small Isolation Failures (Failure to Seal - Type C) 6 Other Isolation Failures (e.g., Dependent Failures) 7 Failures Induced by Phenomena (Early and Late) 8 Bypass (Interfacing System LOCA)

CDF All CET End States (Including Very Low and No Release)

The steps taken to perform this risk assessment evaluation are as follows:

Step 1 - Quantify the baseline risk in terms of frequency per reactor year for each of the accident classes presented in Table 5-4.

Step 2 - Develop plant-specific person-rem dose (population dose) per reactor year for each of the eight accident classes.

Step 3 - Evaluate risk impact of extending Type A test interval from 3 in 10 years to 1 in 15" years and 1 in 10 years to1I in 15 years.

Step 4 - Determine the change in risk in terms of Large Early Release Frequency (LERF) in accordance with RG 1.174 [Reference 4].

Step 5 - Determine the impact on the Conditional Containment Failure Probability (CCFP).

5.2.1 Step 1 - Quantify the Baseline Risk in Terms of Frequency per Reactor Year As previously described, the extension of the Type A interval does not influence those accident progressions that involve large containment isolation failures, Type B or Type C testing, or containment failure induced by severe accident phenomena.

For the assessment of ILRT impacts on the risk profile, the potential for pre-existing leaks is included in the model. (These events are represented by the Class 3 sequences in EPRI TR-104285 [Reference 2].) The question on containment integrity was modified to include the probability of a liner breach or bellows failure (due to excessive leakage) at the time of core damage. Two failure modes were considered for the Class 3 sequences. These are Class 3a (small breach) and Class 3b (large breach).

The frequencies for the severe accident classes defined in Table 5-4 were developed for MNGP by first determining the frequencies for Classes 1, 2, 7, and 8. Table 5-5 presents the frequency and EPRI category for each sequence. Table 5-6 presents the grouping of the release categories in EPRI Classes. Table 5-7 provides a summary of the accident sequence frequencies that can lead to radionuclide release to the public and have been derived consistent with the'definitions of accident classes defined in EPRI TR-104285 [Reference 2], the NEI Interim Guidance [Reference 3], and guidance provided in EPRI Report No. 1009325, Revision Revision 2 Page 16 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension 2-A [Reference 24]. Adjustments were made to the Class 3b and hence Class 1 frequencies to account for the impact of undetected corrosion of the steel liner per the methodology described in Section 5.2.6. Note: calculations were performed with more digits than shown in this section.

Therefore, minor differences may occur ifthe calculations in these sections are followed explicitly.

Class 3 Sequences. This group consists of all core damage accident progression bins for which a pre-existing leakage in the containment structure (e.g., containment liner) exists that can only be detected by performing a Type A ILRT. The probability of leakage detectable by a Type A ILRT is calculated to determine the impact of extending the testing interval. The Class 3 calculation is divided into two classes: Class 3a is defined as a small liner breach (La < leakage

< 10La), and Class 3b is defined as a large liner breach (1OLa < leakage < 100L2 ).

Data reported in EPRI 1009325, Revision 2-A [Reference 24] states that two events could have been detected only during the performance of an ILRT and thus impact risk due to change in ILRT frequency. There were a total of 217 successful ILRTs during this data collection period.

Therefore, the probability of leakage is determined for Class 3a as shown in the following equation:

2 Pczass 3 a - 21= 0.0092 Multiplying the CDF by the probability of a Class 3a leak yields the Class 3a frequency contribution in accordance with guidance provided in Reference 24. As described in Section 5.1.3, additional consideration is made to not apply failure probabilities on those cases that are already LERF scenarios. Therefore, LERF contributions from CDF are removed. The frequency of a Class 3a failure is calculated by the following equation:

Frqms~ = Pcczass3a * (CDF - LERE) 217 * (8.0 1E-6 - 9.20OE-7) = 6.54E-08 In the database of 217 ILRTs, there are zero containment leakage events that could result in a large early release. Therefore, the Jeifreys non-informative prior is used to estimate a failure rate and is illustrated in the following equations:

Number of Failures+ 1/2 Jeffreys Failure Probability =

Number of Tests + 1 o + 1/2 Pclass3b = 17n -- 0.0023 The frequency of a Class 3b failure is calculated by the following equation:

Frqzs~ = class3b * (CDF - LERF) 21*

.5- (8.O1E-6 - 9.20E-7) = 1.63E-08 For this analysis, the associated containment leakage for Class 3a is 10OLa and for Class 3b is 100La. These assignments are consistent with the guidance provided in Reference 24.

• Class 1 Sequences. This group consists of all core damage accident progression bins for which the containment remains intact (modeled as Technical Specification Leakage). Table 5-5 shows the Level 2 results. These values are adjusted from Section 7.2.1 of Reference 18. The values provided in Section 7.2.1 of Reference 18 sum to greater than the CDF because some of the

,results are non-minimal (e.g., a small early release may also progress to a medium intermediate release). The negligible release frequency is preserved because its frequency could not also be classified as a significant release. The rest of the release categories are reduced by a ratio so Revision 2 Page 17 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension the release frequencies sum to the total CDF. The frequency per year is initially determined from the EPRI Accident Class I (Intact) frequency listed in Table 5-5 and then subtracting the EPRI Class 3a and 3b frequency (to preserve total CDF), calculated below:

Freqciass1 = Freqjntact - (Feczs~ + Frqzasb Class 2 Sequences. This group consists of core damage accident progression bins with large containment isolation failures. This is calculated by adding the frequency of events FAILED-007 (1 .70E-10) and FAILED-012 (2.02E-9). This is explained in the CONT-ISO entry in Table A-I of Reference 18; the values are provided in Appendix D of Reference 18. The frequency per year for these sequences is obtained from the EPRI Accident Class 2 frequency listed in Table 5-5.

Class 4 Sequences. This group consists of all core damage accident progression bins for which containment isolation failure-to-seal of Type B test components occurs. Because these failures are detected by Type B tests which are unaffected by the Type A ILRT, this group is not evaluated any further in the analysis, consistent with approved methodology.

Class 5 Sequences. This group consists of all core damage accident progression bins for which a containment isolation failure-to-seal of Type C test components occurs. Because the failures are detected by Type C tests which are unaffected by the Type A ILRT, this group is not evaluated any further in this analysis, consistent with approved methodology.

Class Ei Sequences. These are sequences that involve core damage accident progression bins for which a failure-to-seal containment leakage due to failure to isolate the containment occurs.

These sequences are dominated by misalignment of containment isolation valves following a test/maintenance evolution. All other failure modes are bounded by the Class 2 assumptions.

This accident class is also not evaluated further.

Class 7 Sequences. This group consists of all core damage accident progression bins in which containment failure is induced by severe accident phenomena (e.g., overpressure). As discussed for the Class I sequences, this data is taken from Section 7.2.1 of Reference 18 and reduced by a ratio so the release frequencies sum to the total CDF. Release frequencies are classified based on timing of release (early, intermediate, or late) and magnitude of release (small, medium, or large). For this analysis, the frequency is determined from the EPRI Accident Class 7 frequency listed in Table 5-5.

Class 8 Sequences. This group consists of risk from core damage accident class 5 (containment bypass). This value is taken from Figure 4.2-2 of Reference 17. For this analysis, the total frequency is listed in Table 5-5.

LERF quantification is distributed into EPRI categories based on release categories. Table 5-4 shows this distribution.

Revision 22 Page 18 of 142 Revision Page 18 of 142

54003-CALC-02 of Risk Significance of Permanent ILRT Extension 5400-CAL-02Evaluation Table 5-5 - Release Category Frequencies Release Description of Outcome EPRI Frequency (lyr)

Category Category NCF No Containment Failure 1 1.78E-06 CIS Containment Isolation Failure 2 2.19E-09 LERF (no Large Early Release Frequency (excluding containment 7 bypass) bypass) 6.60E-07 MERF Medium Early Release Frequency 7 1.31 E-06 SERF Small Early Release Frequency 7 3.86E-08 LIRF Large Intermediate Release Frequency 7 4.03E-07 MIRF Medium Intermediate Release Frequency 7 2.65E-06 SIRF Small Intermediate Release Frequency 7 2.12E-07 LLRF Large Late Release Frequency 7 2.98E-07 MLRF Medium Late Release Frequency 7 6.63E-07 ISLOCA Interfacing Systems LOCA 8 2.88E-09 Contribution to EPRI Classification 7 6.23E-06 Table 5 Release Category Frequencies Containment End State EPRI Category Frequency (/yr)

Intact Containment 1 1.78E-06 Large Isolation Failure 2 2.19E-09 Failures Induced by Phenomena 7 6.23E-06 ISLOCA 8 2.88E-09 Table 5 Baseline Risk Profile Class Description Frequency (Jyr) 1 No containment failure 1.70E-06 2 2 Large containment isolation failures 2.19E-09 3a Small isolation failures (liner breach) 6.54E-08 3b Large isolation failures (liner breach) I.63E-08 4 Small isolation failures - failure to seal (type B) E 5 Small isolation failures - failure to seal (type C) E 6 Containment isolation failures (dependent failure, personnel errors)

• 7 Severe accident phenomena induced failure (early and late) 6.23E-06 8 Containment bypass 2.88E-09 Total 8.01 E-06

1. E represents a probabilistically insignificant value or a Class that is unaffected by the Type A ILRT.

2. The Class 3a and 3b frequencies are subtracted from Class 1 to preserve total CDF.

6.2.2 Step 2 - Develop Plant-Specific Person-Remn Dose (Population Dose)

Plant-specific release analyses were performed to estimate the person-rem doses to the population within a 50-mile radius from the plant. Reference 19 provides the population dose for Class 7 releases based on timing (early or late) and magnitude (small, medium, or large). Early releases are categorized as occurring before six hours (after declaration of General Emergency); late releases are categorized as occurring after six hours [Reference 19]. This does not perfectly align with the release frequency delineation provided in the Level 2 analysis Revision 2 Page 19 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension

[Reference 18], which has early, intermediate, and late release timing with the interval separations being four hours and 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Therefore, the first two hours of the intermediate releases map to the Reference 19 early release, and the last 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> of the intermediate releases map to the Reference 19 late release; there is not precise way to do this mapping. The overly conservative method would be to assign all the intermediate release frequency to the Reference 19 early release. A more reasonable method is to assign some of the intermediate release frequency to the early release frequency and some to the late release frequency. This is done by calculating the per-hour release from the Reference 18 early release frequency, assuming the same per-hour release occurs for the first two hours of the intermediate time period, and re-categorizing this to the early release frequency; the remaining intermediate frequency gets re-categorized to the late release frequency. Since release generally decreases on a per-hour bases as time progresses and early release is more consequential to the public, this method for dividing the intermediate release is conservative, yet reasonable. This method is done separately for small, medium, and large releases.

The population dose for Classes 1, 2, and 8 are calculated using the methodology of scaling Peach Bottom population doses to MNGP [Reference 7]. The adjustment factor for reactor power level (AFpower) is defined as the ratio of the power level at MNGP (PLM) [Reference 27] to that at Peach Bottom Unit 2 (PLP) [Reference 7]. This adjustment factor is calculated as follows:

A~power = PLM / PLP = 2004 / 3293 =0.609 The adjustment factor for technical specification (TS) allowed containment leakage is defined as the ratio of the containment leakage at Monticello (LRM) to that at Peach Bottom Unit 2 (LRP).

This adjustment factor is calculated as follows:

AFleakage = LRM / LRP Since the leakage rates are in terms of the containment volume, the ratio of containment volumes is needed to relate the leakage rates. The TS maximum allowed containment leakage at MNGP (TSM) is 1.2%/day [Reference 27]; the containment free volume at MNGP (VOLM) iS 240,000 ft3 [Section 2.1 of Reference 18]. The TS maximum allowed containment leakage at Peach Bottom Unit 2 (TSpg) is 0.5%/day [Reference 7]; the containment free volume at Peach Bottom Unit 2 (VOLPB) is 307,000 ft3 [Reference 7].Therefore, LRM = TSM

• VOLM LRP -- TSpB

• VOLpB AFleakage = (1.2

• 240000) / (0.5

• 307000) = 1.876 The adjustment factor for population (AFpopuiation) is defined as the ratio of the population within 50-mile radius of MNGP (POPM) [Reference 19] to that of Peach Bottom Unit 2 (POPP)

[Reference 7]. The 2030 population surrounding MNGP was conservatively estimated as 3,903,243 [Section F.3.1 of Reference 19]. This adjustment factor is calculated as follows:

AFpopuiation =POPM / POPP = 3903243 / 3.02E+6 =1.292 Consequences dependent on the INTACT TS Leakage (collapsed accident progression bins 8 and 10).

AFINTACT = AFpower

• AFLeakage

• AFpopuiation =0.609

• 1.88

• 1.29 = 1.476 Since the other categories are not dependent on the TS Leakage, the adjustment factor (AF) is calculated by combining the factors as follows:

AF =AFpower

• AFpopulation =0.609

• 1.29 =0.787 Page 20 of 142 Revision 22 Revision Page 20 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension The population dose data in NUREG/CR-4551 for Peach Bottom Unit 2 [Reference 7] is reported in ten distinct collapsed accident progression bins (CAPBs). For this ILRT extension application, CAPB38 and CAPI310 are categorized in EPRI Accident Class 1; CAPB3 is categorized in EPRI Accident Class 2; and CAPB7 is categorized in EPRI Accident Class 8.

Based on the above adjustment factors and the 50-mile population dose (person-rem) for each CAPB3 considered in the NUREG/CR-4551 Peach Bottom Unit 2 study, the MNGP population doses (MPD) for Classes 2 and 8 are calculated as follows:

MPDclassi AFINTACT

• PDcApB8 +- AFINTACT

• PDCAPB10 = 1.476

• 4.94E+3 + 1.476

• 0 = 7.29E+/-3 MPDclass 2 =AF

• PDCAPB3 = 0.787

• 2.97E+6 =2.34E+6 MPDcia~s8s AF

• PDCApB7 = 0.787

• 1.95E+6 =1.53E+6 Table 5-8 provides a correlation of MNGP population dose to EPRI Accident Class. Table 5-9 provides population dose for each EPRI accident class.

The population dose for EPRI Accident Classes 3a and 3b were calculated based on the guidance provided in EPRI Report No. 1009325, Revision 2-A [Reference 24] as follows:

EPRI Class 3a PopulationDose = 10

• 7.29E+3 =7.29E+/-4 EPRI Class 3b PopulationDose = :100

• 7.29E+3 = 7.29E+5 Table 5-8 - Mapping of Population Dose to EPRI Accident Class EPRI Category Frequency (lyr) Dose (person-rem)

Class 1 1.78E-06 7.29E+03 Class 2 2.19E-O9 2.34E+06 Class 6 N/A - Included in Class 2 Class 7 6.23E-06 1.87E+06 Class 8 2.88E-09 I1.53E+06 Table 5-9 - Baseline Population Doses Class Description Population Dose (person-rem) 1 No containment failure 7.29E+03 2 Large containment isolation failures 2.34E+06 3a Small isolation failures (liner breach) 7.29E+04 1 3b Large isolation failures (liner breach) 7.29E+05 2 4 Small isolation failures - failure to seal (type B) N/A 5 Small isolation failures - failure to seal (type C) N/A 6 Containment isolation failures (dependent failure, personnel errors) N/A 7 Severe accident phenomena induced failure (early and late) 1 .87E+06 8 Containment bypass 1 :53E+06

1. 10*La 1O*La lO0*La

2. I OO*La Page 21 of 142 Revision 22 Revision Page 21 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension 5.2.3 Step 3 - Evaluate Risk Impact of Extending Type A Test Interval from 10 to 15 Years The next step is to evaluate the risk impact of extending the test interval from its current 10-year interval to a 15-year interval. To do this, an evaluation must first be made of the risk associated with the 10-year interval, since the base case applies to 3-year interval (i.e., a simplified representation of a 3-to-10 interval).

Risk Impact Due to 10-Year Test Interval As previously stated, Type A tests impact only Class 3 sequences. For Class 3 sequences, the release magnitude is not impacted by the change in test interval (a small or large breach remains the same, even though the probability of not detecting the breach increases). Thus, only the frequency of Class 3a and Class 3b sequences is impacted. The risk contribution is changed based on the NEI guidance as described in Section 5.1.3 by a factor of 10/3 compared to the base case values. The Class 3a and 3b frequencies are calculated as follows:

Freqczass3 aloyr = -- * -* Frqzas = 1-0 - * (8.01E-6 -9.20E-7) =2.18E-7 10 .5 10 .5 Freqczass3 biayr y- * -28* Freqc1 mssl = 3~ * -18* (8.01E-6 -9.20E-7) = 5.42E-8 The results of the calculation for a 10-year interval are presented in Table 5-10.

Table 5 Risk Profile for Once in 10 Year ILRT Class Description Frequency Contribution Population Dose Population (lyr) (%) (person-rem) Dose Rate (person-rem/yr) 1 No containment failure 2 1.51E-06 18.82% 7.29E+03 1.10E-02 2 Large containment isolation 2.19E-09 0.03% 2.34E+06 5.12E-03 failures 3a Small isolation failures (liner 2.18E-07 2.72% 7.29E+04 1.59E-02 breach) 3b Large isolation failures 5.42E-08 0.68% 7.29E+05 3.95E-02 (liner breach) 4 Small isolation failures - E 1*

failure to seal (type B) 5 Small isolation failures -

• failure to seal (type C)

Containment isolation 6 failures (dependent failure,

• a personnel errors)

Severe accident 7 phenomena induced failure 6.23E-06 77.72% 1.87E+06 1.16E+01 (early and late) 8 Containment bypass 2.88E-09 0.04% 1.53E+06 4.42E-03 Total 8.01E-06 1.17E+01

1. s represents a probabilistically insignificant value or a Class that is unaffected by the Type A ILRT.

2. The Class 1 frequency is reduced by the frequency of Class 3a and Class 3b in order to preserve total CDF.

Revision 2 Page 22 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Risk Impact Due to 15-Year Test Interval The risk contribution for a 15-year interval is calculated in a manner similar to the 10-year interval. The difference is in the increase in probability of leakage in Classes 3a and 3b. For this case, the value used in the analysis is a factor of 5 compared to the 3-year interval value, as described in Section 5.1.3. The Class 3a and 3b frequencies are calculated as follows:

Frqls~asr=15 2 reqc 3s27E-7

.. .. Fe~ 1 5 1 * (8.0 1E-6 -9.20OE-7)=3.7-15 .5 Fr ls1= *.

5 9.20E-7) 8.13E-8 Frq--sbly = ?qias * (8.01E-6 - =

The results of the calculation for a 15-year interval are presented in Table 5-11.

Table 5*-11 - Risk Profile for Once in 15 Year ILRT Class Description Frequency Contribution Population Dose Population (lyr) (%) (person-rem) Dose Rate (person-remlyr) 1 No containment failure 2 1.37E-06 17.12% 7.29E+03 1.00E-02 2 Large containment 2.19E-09 0.03% 2.34E+06 5.12E-03 isolation failures 3a Sml(liner slto breach)alrs 3.27E-07 4.08% 7.29E+04 2.38E-02 3b Large isolation failures 8.13E-08 1.02% 7.29E+05 5.93E-02 (liner breach) 4 Small isolation failures -

• failure to seal (type B) 5 Small isolation failures -

• 1d*

failure to seal (type C)

Containment isolation 6 failures (dependent failure,

• 1 personnel errors)

Severe accident 7 phenomena induced failure 6.23E-06 77.72% 1.87E+06 1.16E+01 (early and late) 8 Containment bypass 2.88E-09 0.04% 1.53E+06 4.42E-03 Total 8.01E-06 1.17E+01

1. E represents a probabilistically insignificant value or a Class that is unaffected by the Type A ILRT.

2. The Class I frequency is reduced by the frequency of Class 3a and Class 3b in order to preserve total CDF.

5.2.4 Step 4 - Determine the Change in Risk in Terms of LERF The risk increase associated with extending the ILRT interval involves the potential that a core damage event that normally would result in only a small radioactive release from an intact containment could, in fact, result in a larger release due to the increase in probability of failure to detect a pre-existing leak. With strict adherence to the EPRI guidance, 100% of the Class 3b contribution would be considered LERF.

Regulatory Guide 1.174 [Reference 41 provides guidance for determining the risk impact of plant-specific changes to the licensing basis. RG 1.174 [Reference 4] defines very small changes in risk as resulting in increases of CDF less than 10-6/year and increases in LERF less Revision 2 Page 23 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension than 10-7/year, and small changes in LERF as less than 10- 6/year. Since containment accident pressure is credited in support of ECCS performance to mitigate design basis accidents at MNGP, the ILRT extension may impact CDE. A detailed sensitivity study is performed and described in Section 5.3.4; this shows the ILRT extension has only a very small effect on CDF.

Therefore, the more relevant risk-impact metric is LERF.

For MNGP, 100% of the frequency of Class 3b sequences can be used as a very conservative first-order estimate to approximate the potential increase in LERF from the ILRT interval extension (consistent with the EPRI guidance methodology). Based on a 10-year test interval from Table 5-10, the Class 3b frequency is 5.42E-8/year; based on a 15-year test interval from Table 5-11, the Class 3b frequency is 8.13E-8/year. Thus, the increase in the overall probability of LERF due to Class 3b sequences that is due to increasing the ILRT test interval from 3 to 15 years is 6.51E-08/year. Similarly, the increase due to increasing the interval from 10 to 15 years is 2.71 E-8/year. As can be seen, even with the conservatisms included in the evaluation (per the EPRI methodology), the estimated change in LERE is within the criteria for a very small change when comparing the 15-year results to the current 10-year requirement and the original 3-year requirement. Table 5-12 summarizes these results.

Table 5-12 - Impact on LERF due to Extended Type A Testing Intervals ILRT Inspection Interval 3 Years (baseline) 10 Years 15 Years Class 3b (Type A LERF) 1.63E-08 5.42E-08 8.13E-08 ALERF (3 year baseline) 3.80E-08 6.51E-08 ALERF (10 year baseline) j 2.71E-08 The increase in the overall probability of LERF due to Class 3b sequences is less than 10-r.

Therefore, the ALERF is considered very small [Reference 4].

5.2.5 Step 5 - Determine the Impact on the Conditional Containment Failure Probability Another parameter that the NRC guidance in RG 1.174 [Reference 4] states can provide input into the decision-making process is the change in the conditional containment failure probability (CCFP). The CCFP is defined as the probability of containment failure given the occurrence of an accident. This probability can be expressed using the following equation:

CCFP1 -f (ncf)

CDF where f(ncf) is the frequency of those sequences that do not result in containment failure; this frequency is determined by summing the Class 1 and Class 3a results [Reference 24]. Table 5-13 shows the steps and results of this calculation. The difference in CCFP between the 3-year test interval and 15-year test interval is 0.812%.

Table 5-13 - Impact on CCFP due to Extended Type A Testing Intervals ILRT Inspection Interval 3 Years (baseline) 10 Years 15 Years f(ncf) (/yr) 1.76E-06 1.73E-06 1.70E-06 f(ncf)/CDF 0.220 0.215 0.212 CCFP 0.780 0.785 0.788 ACCFP (3 year baseline) , :4 j 0.474% 0.812%

ACCFP (10 year baseline) ;t::*:i':

.,  ;* 0.338%

Revision 2 Page 24 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension As stated in Section 2.0, a change in the CCFP of up to 1.5% is assumed to be small. The increase in the CCFP from the 3 in 10 year interval to I in 15 year interval is 0.812%. Therefore, this increase is judged to be very small.

5.2.6 Impact of Extension on Detection of Steel Liner Corrosion that Leads to Leakage An estimate of the likelihood and risk implications of corrosion-induced leakage of the steel liners occurring and going undetected during the extended test interval is evaluated using a methodology similar to the Calvert Cliffs liner corrosion analysis [Reference 5]. The Calvert Cliffs analysis was performed for a concrete cylinder and dome and a concrete basemat, each with a steel liner.

The following approach is used to determine the change in likelihood, due to extending the ILRT, of detecting corrosion of the containment steel liner [Section 5.1.5.1 of Reference 241.

This likelihood is then used to determine the resulting change in risk. Consistent with the Calvert Cliffs analysis, the following issues are addressed:

• Differences between the containment basemat and the containment cylinder and dome

• The historical steel liner flaw likelihood due to concealed corrosion

• The impact of aging

• The corrosion leakage dependency on containment pressure

• The likelihood that visual inspections will be effective at detecting a flaw Assumptions

• Based on a review of industry events, an Oyster Creek incident is assumed to be applicable to MNGP for a concealed shell failure in the floor. In the Calvert Cliffs analysis, this event was assumed not to be applicable and a half failure was assumed for basemat concealed liner corrosion due to the lack of identified failures (See Table 5-14, Step 1).

• The two corrosion events used to estimate the liner flaw probability in the Calvedt Cliffs previous analysis are assumed to still be applicable.

• Consistent with the Calvedt Cliffs analysis, the estimated historical flaw probability data period is also limited to 5.5 years to reflect the years since September 1996 when 10 CFR 50.55a started requiring visual inspection. Additional success data was not used to limit the aging impact of this corrosion issue, even though inspections were being performed prior to this date (and have been performed since the time frame of the Calvedt Cliffs analysis) (See Table 5-14, Step 1).

• Consistent with the Calvedt Cliffs analysis, the steel liner flaw likelihood is assumed to double every five years. This is based solely on judgment and is included in this analysis to address the increased likelihood of corrosion as the steel liner ages (See Table 5-14, Steps 2 and 3). Sensitivity studies are included that address doubling this rate every ten years and every two years.

• In the Calvedt Cliffs analysis, the likelihood of the containment atmosphere reaching the outside atmosphere, given that a liner flaw exists, was estimated as 1.1% for the cylinder and dome, and 0.11% (10% of the cylinder failure probability) for the basemat. These values were determined from an assessment of the probability versus containment pressure. For MNGP, the containment design pressure is 56 psig [Reference 271.

Probabilities of 1% for the cylinder and dome, and 0.1% for the basemat are used in this analysis, and sensitivity studies are included in Section 5.3.2 (See Table 5-14, Step 4).

• Consistent with the Calvedt Cliffs analysis, the likelihood of leakage escape (due to crack formation) in the basemat region is considered to be less likely than the containment Revision 2 Page 25 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension cylinder and dome region (See Table 5-14, Step 4).

• Consistent with the Calvert Cliffs analysis, a 5% visual inspection detection failure likelihood given the flaw is visible and a total detection failure likelihood of 10% is used.

To date, all liner corrosion events have been detected through visual inspection (See Table 5-14, Step 5).

• Consistent with the Calvert Cliffs analysis, all non-detectable containment failures are assumed to result in early releases. This approach avoids a detailed analysis of containment failure timing and operator recovery actions.

Table 5 Steel Liner Corrosion Base Case Step Description Containment Cylinder and Containment Basemat Dame (85%) (15%)

Historical liner flaw likelihood Events: 2 Events: 1 Failure data: containment location (Brunswick 2 and North Anna 2) 1 / (70 x 5.5) = 2.60E-03 specific 2 /(70 x 5.5) = 5.19E-03 Success data: based on 70 steel-lined containments and 5.5 years since the 10CFR 50.55a requirements of periodic visual inspections of containment surfaces Year Failure rate Year Failure rate Aged adjusted liner flaw likelihood During the 15-year interval, assume 1 2.05E-03 1 1.03E-03 failure rate doubles every five years average 5-10 5.19E-03 average 5-10 2.60E-03 2 (14.9% increase per year). The 15 1.43E-02 15 7.14E-03 average for the 5th to 10th year set to the historical failure rate. 15 year average =6.44E-03 15 year average =3.22E-03 Increase in flaw likelihood between 3 and 15 years Uses aged adjusted 0.73% (i to 3 years) 0.36% (i to 3 years) 3 liner flaw likelihood (Step 2), 4.18% (i to 10 years) 2.08% (i to 10 years) assuming failure rate doubles every 9.66% (i to 15 years) 4.82% (i to 15 years) five years.

4 Likelihood of breach in containment 1% 0.1%

given liner flaw 10%

5% failure to identify visual flaws plus 5% likelihood that the flaw is Viul npcto dtcio aiue not visible (not through-cylinder 100%

likelihood btcudbdeetdyIL). Cannot be visually inspected All events have been detected through visual inspection. 5%

visible failure detection is a conservative assumption.

0.00073% (3 years) 0.000360% (3 years) 0.73% x 1%x10% 0.36% xO.1% xl00%

Likelihood of non-detected 0.00418% (10 years) 0.00208% (10 years) 6 containment leakage (Steps 3 x 4 x 41%~1 0 .8 .%x10 0.00966% (15 years) 0.00482% (15 years) 9.66% xl% xI1% 4.82% xO.1% x 10%

The total likelihood of the corrosion-induced, non-detected containment leakage is the sum of Revision 2 Page 26 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Step 6 for the containment cylinder and dome, and the containment basemat, as summarized below for MNGP.

Table 5 Total Likelihood on Non-Detected Containment Leakage Due to Corrosion for MNGP Description At 3 years: 0.00073% + 0.000360% = 0.00109%

At 10 years: 0.00418% + 0.00208% = 0.00626%

At 15 years: 0.00966% + 0.00482% = 0.01448%

The above factors are applied to those core damage accidents that are not already independently LERF or that could never result in LERF.

The two corrosion events that were initiated from the non-visible (backside) portion of the containment liner used to estimate the liner flaw probability in the Calvert Cliffs analysis are assumed to be applicable to this containment analysis. These events, one at North Anna Unit 2 (September 1999) caused by timber embedded in the concrete immediately behind the containment liner, and one at Brunswick Unit 2 (April 1999) caused by a cloth work glove embedded in the concrete next to the liner, were initiated from the nonvisible (backside) portion of the containment liner. A search of the NRC website LER database identified two additional events have occurred since the Calvert Cliffs analysis was performed. In January 2000, a 3/16-inch circular through-liner hole was found at Cook Nuclear Plant Unit 2 caused by a wooden brush handle embedded immediately behind the containment liner. The other event occurred in April 2009, where a through-liner hole approximately 3/8-inch by 1-inch in size was identified in the Beaver Valley Power Station Unit 1 (BVPS-1) containment liner caused by pitting originating from the concrete side due to a piece of wood that was left behind during the original construction that came in contact with the steel liner. Two other containment liner through-wall hole events occurred at Turkey Point Units 3 and 4 in October 2010 and November 2006, respectively. However, these events originated from the visible side caused by the failure of the coating system, which was not designed for periodic immersion service, and are not considered to be applicable to this analysis. More recently, in October 2013, some through-wall containment liner holes were identified at BVPS-1, with a combined total area of approximately 0.395 square inches. The cause of these through-wall liner holes was attributed to corrosion originating from the outside concrete surface due to the presence of rayon fiber foreign material that was left behind during the original construction and was contacting the steel liner

[Reference 28]. For risk evaluation purposes, these five total corrosion events occurring in 66 operating plants with steel containment liners over a 17.1 year period from September 1996 to October 4, 2013 (i.e., 5/(66"17.1) = 4.43E-03) are bounded by the estimated historical flaw probability based on the two events in the 5.5 year period of the Calvert Cliffs analysis (i.e.,

2/(70"5.5) = 5.19E-03) incorporated in the EPRI guidance.

5.3 Sensitivities 5.3.1 Potential Impact from External Events Contribution An assessment of the impact of external events is performed. The primary purpose for this investigation is the determination of the total LERF following an increase in the ILRT testing interval from 3 in 10 years to I in 15 years.

Although MNGP is not transitioning to NFPA 805 licensing basis for fire protection, MNGP created a Fire PRA (FPRA) model following instruction from NUREG/CR-6850. Therefore, the Fire PRA model is deemed applicable for this calculation.

Revision 2 Page 27 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension The Fire PRA model Revision 3 was used to obtain the fire CDF and LERE values [Reference 36]. As described in Section 5.1.3, consideration is made to not apply failure probabilities on those cases that are already LERF scenarios. Therefore, LERF contributions from CDF are removed from the calculation of Class 3b contribution. The following shows the calculation for Class 3b:

0.5

~ ~lssb..C..-LRE * (4.11E 5.3 1E-6) :8.2 1E-8 10 10 0.5 Freqcjass3bi~yr --

• Pctass3b * (CDF - LERF) = * *(4.11E-5 -5.31E-6>= 2.74E-7 Frqts~l~ =

• Pctass~, * (CDF - LERF) = 5*--1 * (4.11E-5 - 5.31E-6)= 4.10E-7 The Seismic PRA results from the IPEEE Seismic Margins Analysis do not result in estimate of CDF [Reference 32]. The 2014 Seismic Reevaluations for operating reactor sites [Reference 35] states the conclusions reached in 2010 by G1-199 [Reference 34] remain valid for estimating Seismic CDF at plants in the Central and Eastern United States, which includes MNGP. The most conservative Seismic CDF reported in Table D-1 of Reference 34 is 1 .90E-5. Applying the internal event LERF/CDF ratio to the seismic CDF yields an estimated seismic LERF of 2.18E-6, as shown by the equation below.

LERFseismic CDFseismic

• LERFIE / CDFIE= 1.90E-5

• 9.20E-7 / 8.01E-6 = 2.18E-6 Subtracting seismic LERF from CDF, the Class 3b frequency can be calculated by the following formulas:

Freqctass3 b = class3b * (CDF - LERF) = 21 * (1.90E-5 -2.18E-6) =3.86E-8 10 10 0.5 Freqctass3 bi°Yr 73"*cass3b * (CDF -LERF) 3 21.9E .8-)12E 1515 0.5 Frqlasb~y *~~a.. CD LR) .. * -- * (1.90E-5 -2.18E-6)= 1.93E-7 Frectas~bsyr3" ctss~* *(CD LEF)3 218 The MNGP IPEEE analysis of high winds, tornadoes, external floods, transportation accidents, nearby facility accidents, and other external hazards resulted in screening these events from further consideration. Per Section C.1 .3 of Reference 33, screened hazards contribute less than 10-/year to COF; therefore, for this sensitivity a conservative CDF. of 10-6 is used for all other external events. Applying the internal event LERF/CDF ratio to the other external events COF yields an estimated high wind LERE of 1.15E-7. Again subtracting LERF from CDF, the Class 3b frequency can be calculated by the following formulas:

Frectss~ =Pcpass3b * (CDF - LERF) = o21 * (1.OE 1.15E-7) =2.03E-9 218 10 10 0.5 Freqcjass3 bl°yr = 7

• Pcasb* (CDF - LERF) = -- * --1 * (1.0E 1.15E-7) = 6.77E-9 13521 .8 Frq~asbly 7*~c.. (D -LRF .. * -- * (1.OE-6 - 1.15E-7) = 1.0 2E-8 The fire, seismic, and high wind contributions to Class 3b frequencies are then combined to obtain the total external event contribution to Class 3b frequencies. The change in LERF is calculated for the 1 in 10 year and 1 in 15 year cases and the change defined for the external events in Table 5-16.

Page 28 of 142 Revision 2 Revision2 Page 28 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Table 5-16 - MNGP External Event Impact on ILRT LERF Calculation Hazard EPRI Accident Class 3b Frequency LERF Increase (from 3 perl10years to 1 3 per 10 year I per 10 year I per15 years per 15 years)

External Events 1.23E-07 4.09E-07 6.13E-07 4.91 E-07 Internal Events 1.63E-08 5.42E-08 8.13E-08 6.51 E-08 Comnbin ed 1.39 E-07 4.63E-07 6.95 E-07 5.56 E-07 The internal event results are also provided to allow a composite value to be defined. When both the internal and external event contributions are combined, the total change in LERE of 5.56E-7 meets the guidance for small change in risk, as it exceeds 1.0E-7Iyr and remains less than 1 .0E-6 change in LERF. For this change in LERF to be acceptable, total LERF must be less than 1 .0E-5. The total LERF value is calculated below:

LERF = LERFinternal + LERFseismic + LERFfire + LERFoth~er + LERFcass3Bincreas

=9.20E-7/yr + 2.18E-6/yr + 5.31E-6/yr + 1.15E -07/yr + 5.56E-7/yr= 9.08E-6/yr As specified in Regulatory Guide 1.174 [Reference 4], since the total LERF is less than 1.0E-5, it is acceptable for the ALERF to be between 1.0E-7 and 1 .0E-6.

5.3.2 Potential Impact from Steel Liner Corrosion Likelihood A quantitative assessment of the contribution of steel liner corrosion likelihood impact was performed for the risk impact assessment for extended ILRT intervals. As a sensitivity run, the internal event CDF was used to calculate the Class 3b frequency. The impact on the Class 3b frequency due to increases in the ILRT surveillance interval was calculated for steel liner corrosion likelihood using the relationships described in Section 5.2.6. The EPRI Category 3b frequencies for the 3 per 10-year, 10-year, and 15-year ILRT intervals were quantified using the internal events COF. The change in the LERF, change in CCFP, and change in Annual Dose Rate due to extending the ILRT interval from 3 in 10 years to 1 in 10 years, orto 1 in 15 years are provided in Table 5-1"7 -Table 5-19. The steel liner corrosion likelihood was increased by a factor of 1000, 10000, and 100000. Except for extreme factors of 10000 and 100000, the corrosion likelihood is relatively insensitive to the results.

Page 29 of 142 Revision 22 Revision Page 29 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5400-CAC~0 Evauaton f Rik Sgniicace o Pemannt IRT xtesio Table 5-17 - Steel Liner Corrosion Sensitivity Case: 3B Contribution 3b 3b 3b LERF LERF LERF Frequency Frequency Frequency Increase Increase Increase (3-per-l0 (1-per-10 (I-per-I5 (3-per-l0 to (3-per-l0 to (I-per-10 to year JLRT) year ILRT) year ILRT) I-per-10) 1-per-IS5) 1-per-I 5)

Internal Event 3B 1.63E-08 5.42E-08 8.13E-08 3.80E-08 6.51E-08 2.71E-08 Contribution Corrosion Likelihood 3.77E-11 1.32E-10 2.14E-10 9.44E-11 1.76E-10 8.14E-11 X 1000 Corrosion Likelihood 4.14E-11 2.02E-10 4.57E-10 1.61E-10 4.15E-10 2.54E-10 X 10000 Corrosion Likelihood 7.80E-11 9.03E-10 2.89E-09 8.25E-10 2.81E-09 1.98E-09 X 100000 Table 5-18 - Steel Liner Corrosion Sensitivity: CCFP CCFP CCFP CCFP CCFP CCFP CCFP Increase Increase Increase (3-per-l0 (I-per-l0 (1-per-IS5 (3-per-l 0 to (3-per-l0 to (I-per-l0 to year ILRT) year ILRT) year ILRT) I-per-l0) 1-per-I5) 1-per-I15)

Baslin 7.80E-01 7.85E-01 7.88E-01 4.74E-03 8.12E-03 3.38E-03 Corrosion Likelihood 7.80E-01 7.85E-01 7.88E-01 4.79E-03 8.21 E-03 3.42E-03 X 1000 Corrosion Likelihood 7.80E-01 7.85E-01 7.89E-01 5.25E-03 9.01 E-03 3.75E-03 X 10000 Corrosion Likelihood 7.82E-01 7.92E-01 7.99E-01 9.90E-03 1.70E-02 7.07E-03 X 100000 Table 5-19 - Steel Liner Corrosion Sensitivity: Dose Rate Dose Rate Dose Rate Dose Rate Dose Rate Dose Rate Dose Rate Increase Increase Increase (3-per-b0 (I-per-l0 (I-per-IS year (3-per-10 to (3-per-l0 to I- (I-per-l0 to year ILRT) year ILRT) ILRT) I-per-l0) per-IS) I-per-IS)

Dose Rate 1.19E-02 3.95E-02 5.93E-02 2.77E-02 4.74E-02 1.98E-02 Corrosion Likelihood 1.20E-02 4.20E-02 6.79E-02 3.00E-02 5.59E-02 2.59E.-02 X 1000 Corrosion Likelihood 1.32E-02 6.43E-02 1.45E-01 5.11E-02 1.32E-01 8.09E-02 X 10000 Corrosion Likelihood 2.48E-02 2.87E-01 9.1 8E-01 .-2.62 E-01 8.93E-01 .6.31 E-01 X 100000 5.3.3 Expert Elicitation Sensitivity Another sensitivity case on the impacts of assumptions regarding pre-existing containment defect or flaw probabilities of occurrence and magnitude, or size of the flaw, is performed as Revision 2 Page 30 of 142

54003-CALC-02 Evaluation of Risk Siqnificance of Permanent ILRT Extension described in Reference 24. In this sensitivity case, an expert elicitation was conducted to develop probabilities for pre-existing containment defects that would be detected by the ILRT only based on the historical testing data.

Using the expert knowledge, this information was extrapolated into a probability-versus-magnitude relationship for pre-existing containment defects [Reference 24]. The failure mechanism analysis also used the historical ILRT data augmented with expert judgment to develop the results. Details of the expert elicitation process and results are contained in Reference 24. The expert elicitation process has the advantage of considering the available data for small leakage events, which have occurred in the data, and extrapolate those events and probabilities of occurrence to the potential for large magnitude leakage events.

The expert elicitation results are used to develop sensitivity cases for the risk impact assessment. Employing the results requires the application of the ILRT interval methodology using the expert elicitation to change the probability of pre-existing leakage in the containment.

The baseline assessment uses the Jeifreys non-informative prior and the expert elicitation sensitivity study uses the results of the expert elicitation. In addition, given the relationship between leakage magnitude and probability, larger leakage that is more representative of large early release frequency, can be reflected. For the purposes of this sensitivity, the same leakage magnitudes that are used in the basic methodology (i.e., 10 L2 for small and 100 La for large) are used here. Table 5-20 presents the magnitudes and probabilities associated with the Jeifreys non-informative prior and the expert elicitation used in the base methodology and this sensitivity case.

Table 5 MNGP Summary of ILRT Extension Using Expert Elicitation Values (from Reference 24)

Leakage Size (La) Expert Elicitation Mean Probability of Occurrence Percent Reduction 10 3.88E-03 86%

100 2.47E-04 91%

Taking the baseline analysis and using the values provided in Table 5-9 - Table 5-1 1 for the expert elicitation sensitivity yields the results in Table 5-21.

Table 5 MNGP Summary of ILRT Extension Using Expert Elicitation Values Accident ILRT Interval Cas3 per 10 Years 1 per 10 Years I per 15 Years Base Adjusted Dose Dose Rate Frequency Dose Rate Frequency Dose Rate Frequency Base (person- (person- (person- (person-Frequency remn) remlyr) rem/yr) rem/yr) 1 1.78E-06 1.75E-06 7.29E+03 1.28E-02 1.68E-06 1.23E-02 1.63E-06 1.19E-02 2 2.19E-09 2.19E-09 2.34E+06 5.12E-03 2.19E-09 5.12E-03 2.19E-09 5.12E-03 3a N/A 2.75E-08 7.29E+04 2.01E-03 9.17E-08 6.69E-03 1.38E-07 1.00E-02 3b N/A 1.75E-09 7.29E+05 1.28E-03 5.84E-09 4.26E-03 8.76E-09 6.39E-03 4-6 0.O0E+00 0.00E+00 0.00E+00 0.00E+O0 0.00E+00 0.00E+00 0.O0E+00 0.00E+00 7 6.23E-06 6.23E-06 1.87E+06 1.16E+01 6.23E-06 1.16E+01 6.23E-06 1.16E+01 8 2.88E-09 2.88E-09 1.53E+06 4.42E-03 2.88E-09 4.42E-03 2.88E-09 4.42E-03 Totals 8.01E-06 8.01E-06 6.55E+06 1.16E+01 8.01E-06 1.17E+01 8.01E-06 1.17E+01 ALERF (3 per N/A 4.09E-09 7.01E-09 10 yrs base)

ALERF (1 per N/A N/A 2.92E-09 10 yrs base)

CCFP 77.81% 77.86% 77.89%

Revision 2 Page 31 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension The results illustrate how the expert elicitation reduces the overall change in LERF and the overall results are more favorable with regard to the change in risk.

5.3.4 Containment Accident Pressure Sensitivity In general, CDF is not significantly impacted by an extension of the ILRT interval. However, since containment accident pressure is credited in support of EGOS performance to mitigate design basis accidents at MNGP, the ILRT extension may impact GOF. Therefore, a detailed sensitivity study was performed to quantify the potential effect on GDF.

This sensitivity case investigates the impact of containment accident pressure (CAP) credit on low pressure (LP) ECCS NPSH determination during design-basis accidents. This sensitivity study is performed similarly to the sensitivity study discussed in detail in Appendix F of the extended power uprate (EPU) risk assessment [Reference 39]. This sensitivity study assesses the impact on plant risk if containment accident pressure is assumed not present (e.g.,

postulated pre-existing primary containment failure) during the postulated accident scenarios such that inadequate LP EGOS pump NPSH occurs. This sensitivity is performed by modification and quantification of the Internal Events and Fire PRA models. As described in Sections F.2 and F.5 of Reference 39, there are two types of scenario sequences that can lead to GAP failure:

1. LOGA initiator, suppression pool cooling (SPC) not initiated within 10 minutes, containment isolation failure at 0 minutes, operators fail to throttle LP EGOS flow within 10 minutes, existing plant conditions result in NPSH (probability =0.1; discussion in Section F.2 of Reference 39), and LP EGGS pumps fail due to inadequate NPSH

2. LOGA initiator, one division of EGGS available, SPO not initiated within 10 minutes, containment isolation failure at 0 minutes, existing plant conditions result in NPSH (probability = 0.5; discussion in Section F.2 of Reference 39), and LP EGGS pumps fail due to inadequate NPSH For the Fire PRA sensitivity, the LOGA initiator is a fire-induced spurious open failure of two or more relief valves. For the IE PRA sensitivity, the LOGA initiator is modeled conservatively as either a large or medium LOGA. The basic event stating that SPC is not initiated within t=10 minutes is conservatively assigned a 1.0 probability, and reflects the assumption of being a short-term scenario.

The human error probability basic event for operator failure to throttle LP EGGS is calculated using the same human reliability analysis methodology (i.e., NUREG/CR4772) used in the MNGP PRA:

• Per the plant EOPs and operator training, the operators will throttle EGGS flow as necessary per NPSH curves existing on the EOP flowcharts

• The time of the initial cue to the operators for the need to throttle EGGS flow is estimated at t=5 minutes for the first scenario. This is the point at which available head is nearing the required NPSH and which flow fluctuations may be notable to the operator.

• The end of the available time window to the operator is conservatively estimated at t=1 0 minutes and is the time at which pump head collapse is assumed to occur. This time is judged conservative.

• Manipulating LP EGGS pump flow is a manual action performed at the main control panels in the control room. The time required to travel to the proper panel(s) and perform the flow manipulation is estimated at 1 min.

• Therefore, the available diagnosis time to the operator is (10 mmn - 5 min.) - 1 min = 4 minutes.

Page 32 of 142 Revision 22 Revision Page 32 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension

• Using the MNGP PRA HRA Methodology (i.e., NUREG/CR-4772), the diagnosis error contribution for a diagnosis time frame of 4 minutes is 2.5E-1; and the manipulation error rate for performing the action is 5E-3. The total HEP for failure to throttle is 2.55E-1.

In conditions of inadequate NPSH, the pumps will experience surging and cavitation but will not necessarily fail. However, this analysis conservatively assumes the low pressure ECCS pumps fail with a probability of 1.0 given inadequate NPSH and failure to throttle. The probability of an unisolated containment at the time of the accident is modeled as the Class 3b pre-existing leak probability. Two separate probabilities are used to obtain a change in risk: 2.3E-3 for the baseline case (as discussed in Section 5.1.3) and 5

• 2.3E-3 = 1.15E-2 for the extended 15-year ILRT interval. In addition to credit for containment accident pressure for ECOS NPSH, the MNGP PRA model credits containment venting after a loss of decay heat removal. The model includes logic for controlled containment venting and uncontrolled containment venting. The Class 3b pre-existing leak probability is an additional chance that venting is uncontrolled.

Uncontrolled venting precludes credit for LPCI and Core Spray as long-term low pressure makeup sources.

Table 5-22 shows the results of the CAP sensitivity for the Internal Events and Fire PRA. The results, which are based on the conservative modeling described in the preceding section, show the increase in the overall CDF due to increased likelihood of pre-existing leakages causing loss of sufficient LP ECCS NPSH is 9.83E-8, which is much is less than 106. Therefore, the ACDF is considered very small [Reference 41.

Table 5-22 - Impact on CDF due to Extended Type A Testing Intervals and Loss of LP ECCS NPSH CAP Risk Metric Baseline Risk Sensitivity Risk A Change  % Change (3-year ILRT interval) (15-year ILRT interval)

IE CDF 8.O1E-6 8.11E-6 9.51E-8 1.19%

Fire CDF 4.11E-5 4.11E-5 3.19E-9 0.0078%

Combined ODE 4.91 E-5 4.92E-5 9.83E-8 0.20%

With the ACDF assumed to result directly in LERE, the ALERF is also 9.83E-08. When this ALERF is considered with the ALERE calculated in section 5.2.4 for internal events, the total ALERE is 9.83E-08 + 6.51 E-08 = 1.63E-07, which is slightly above the Region Ill (very small) threshold and into Region II (small) for ALERF. Summing the delta LERE based on the EPRI method and this CAP sensitivity is conservative because not all of the increase in CDF would also be increase in LERF. Given this conservatism, the conservatisms noted in this CAP sensitivity, and the ILRT methodology of considering a Class 3b failure as a LERF contributor, the total ALERF when including the ACDF estimate from a loss of CAP is considered to be very small and the results developed in section 5.2.4 are considered representative for the total.

ALERF due to the ILRT interval extension.

Page 33 of 142 Revision 22 Page 33 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5.3.5 Power Supply Coordination Sensitivity This sensitivity study is performed to assess the quantitative impact from the open status of Fire PRA F&O 5-5 (details of F&O 5-5 are in Section A.4), regarding a small set of power supplies, credited in the Fire PRA, where a coordination study does not exist. Without verified coordination, a fault on a load cable may trip the power supply feed breaker supplying power to the bus that feeds the load. Since the power supply feeding the load may not be coordinated, it is assumed that the fault may also trip the breaker supplying the next upstream power supply.

In order to assess the quantitative impact of possibly finding some circuits are not coordinated, the sensitivity study is performed by modeling the following:

• Finding the cables associated with loads on power supplies without verified coordination.

• Finding the fire scenarios that impact those cables.

• Failing the power supply that supplies the load with impacted cables, to simulate opening of the power supply feed beaker from the next upstream bus to the power supply with the load.

• Failing the next power supply's feed breaker on the bus upstream of the feed breaker to the power supply with the impacted load, since lack of coordination may cause the upstream feeder to trip.

The Fire PRA model was adjusted to model failure of these power supplies and quantified. The specific power supplies and function codes are listed in Table 5-6 of Reference 40.

As shown in Table 5-23, this sensitivity study shows a very small increase in the Fire CDF and LERF. Therefore, ther'e is negligible impact from this open F&O on the usage of the Fire PRA CDF and LERF in the ILRT Extension Risk Analysis.

Table 5 Power Supply Coordination Sensitivity: Fire PRA Results Risk Metric Baseline Risk Sensitivity Risk  % Change CDF 4.11E-5 4.12E-5 0.20%

LERF 5.31E-6 5.39E-6 1.43%

Page 34 of 142 Revision 22 Page 34 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 6.0 RESULTS The results from this ILRT extension risk assessment for MNGP are summarized in Table 6-1.

Table 6-1 - ILRT Extension Summary Class Dose Base Case Extend to Extend to (person-remn) 3 in 10 Years 1 in 10 Years 1 in 15 Years CDF/Year Person- CDFIYear Person- CDFIYear Person-Rem/Year Rein/Year Rem/Year 1 7.29E+03 1.70E-06 1.24E-02 1.51E-O6 1.10E-02 1.37E-06 1.00E-02 2 2.34E+06 2.19E-09 5.12E-03 2.19E-09 5.12E-03 2.19E-09 5.12E-03 3a 7.29E+04 6.54E-08 4.77E-03 2.18E-07 1.59E-02 3.27E-07 2.38E-02 3b 7.29E+05 1.63E-08 1.19E-02 5.42E-08 3.95E-02 8.13E-08 5.93E-02 4-6 0.00E+00 0.00E+00 0.00E+00 0.00E+00 0.00E+00 0.00E+00 0.00E+00 7 1.87E+06 6.23E-06 1.16E+01 6.23E-06 1.16E+01 6.23E-06 1.16E+01 8 1.53E+06 2.88E-09 4.42E-03 2.88E-09 4.42E-03 2.88E-09 4.42E-03 Total 8.01E-06 1.17E+0t 8.01E-06 1.17E+01 8.01E-06 1.17E+01 ILRT Dose Rate from 3a and 3b___________ __________

ATotal From 3 Years N/A 3.74E-02 6.41 E-02 Dose Rate From 10 Years N/A N/A 2.67E-02

%ADose From 3 Years N/A 0.321% 0.550%

Rate From 10 Years N/A N/A 0.228%

3b Frequency (LERF)______________________

ALERF From 3 Years N/A 3.80E-08 I 6.51E-08 From 10 Years N/A LN/A j 2.71E-08 CCFP %_________ _______ __

ACCFP%

From 3 Years N/A F 0.474% 1 0.812%

From 10 Years N/A LN/A J 0.338%

Page 35 of 142 Revision 22 Revision Page 35 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension

7.0 CONCLUSION

S AND RECOMMENDATIONS Based on the results from Section 5.2 and the sensitivity calculations presented in Section 5.3, the following conclusions regarding the assessment of the plant risk are associated with extending the Type A ILRT test frequency to 15 years:

Regulatory Guide 1.174 [Reference 4] provides guidance for determining the risk impact of plant-specific changes to the licensing basis. Regulatory Guide 1.174 defines very small changes in risk as resulting in increases of CDF less than 1.OE-O6/year. Since MNGP relies on containment accident pressure for ECOS NPSH during certain design basis accidents, extending the ILRT interval may impact CDF. The MNGP PRA model was used to estimate the potential change in CDF if containment accident pressure was unavailable due to a pre-existing containment leak. The containment accident pressure sensitivity study performed in Section 5.3.4 conservatively estimates that the potential increase in the overall CDF would be 9.83E-08, which is "very small" using the acceptance guidelines of Regulatory Guide 1.174 [Reference 41.

• Regulatory Guide 1.174 [Reference 4] provides guidance for determining the risk impact of plant-specific changes to the licensing basis. Regulatory Guide 1.174 defines very small changes in risk as resulting increases in LERF less than I1.OE-07/year. The increase in LERF resulting from a change in the Type A ILRT test interval from 3 in 10 years to 1 in 15 years is estimated as 6.51 E-08/year using the EPRI guidance; this value increases negligibly ifthe risk impact of corrosion-induced leakage of the steel liners occurring and going undetected during the extended test interval is included. As such, the estimated change in LERF is determined to be "very small" using the acceptance guidelines of Regulatory Guide 1.174 [Reference 4].

• The effect resulting from changing the Type A test frequency to 1-per-15 years, measured as an increase to the total integrated plant risk for those accident sequences influenced by Type A testing, is 0.064 person-rem/year. EPRI Report No. 1009325, Revision 2-A [Reference 24] states that a very small population dose is defined as an increase of < 1.0 person-rem per year, or < 1% of the total population dose, whichever is less restrictive for the risk impact assessment of the extended ILRT intervals. The results of this calculation meet these criteria. Moreover, the risk impact for the ILRT extension when compared to other severe accident risks is negligible.

• The increase in the conditional containment failure probability from the 3 in 10 year interval to I in 15 year interval is 0.812%. EPRI Report No. 1009325, Revision 2-A

[Reference 24] states that increases in CCFP of -<1.5% is very small. Therefore, this increase is judged to be very small.

Therefore, increasing the ILRT interval to 15 years is considered to be insignificant since it represents a very small change to the MNGP risk profile.

Previous Assessments The NRC in NUREG-1493 [Reference 6] has previously concluded that:

• Reducing the frequency of Type Atests (ILRTs) from 3 per 10 years to 1 per 20 years was found to lead to an imperceptible increase in risk. The estimated increase in risk is very small because ILRTs identify only a few potential containment leakage paths that cannot be identified by Type B or Type C testing, and the leaks that have been found by Type A tests have been only marginally above existing requirements.

Page 36 of 142 Revision 22 Page 36 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension

• Given the insensitivity of risk to containment leakage rate and the small fraction of leakage paths detected solely by Type A testing, increasing the interval between integrated leakage-rate tests is possible with minimal impact on public risk. The impact of relaxing the ILRT frequency beyond 1 in 20 years has not been evaluated. Beyond testing the performance of containment penetrations, ILRTs also test integrity of the containment structure.

The findings for MNGP confirm these general findings on a plant-specific basis considering the severe accidents evaluated for MNGP, the MNGP containment failure modes, and the local population surrounding MNGP.

Page 37 of 142 Revision 22 Revision Page 37 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension A. APPENDIX A: PRA TECHNICAL ADEQUACY A.1. Internal Events PRA Quality Statement for Permanent 15-Year ILRT Extension The MNGP internal events PRA model (Revision 3.2) is used to calculate CDF and LERF for the permanent 15-year ILRT extension. Any elements of the supporting requirements detailed in ASME/ANS RA-Sa-2009 [Reference 41] that could be significantly affected by the application are required to meet Capability Category II requirements.

The internal events PRA provides an adequate base model for the development of the permanent 15-year ILRT extension. The MNGP PRA Peer Review was performed in April 2013 using the NEI 05-04 process [Reference 57], the ASME PRA Standard [Reference 41] and Regulatory Guide 1.200, Rev. 2 [Reference 55]. The purpose of this review was to provide a method for establishing the technical adequacy of the PRA for the spectrum of potential risk-'

informed plant licensing applications for which the PRA may be used. The 2013 MNGP PRA Peer Review was a full-scope review of the Technical Elements of the internal events and internal flood, at-power PRA.

The ASME PRA Standard has 325 individual SRs for the Internal Events At-Power PRA (Part 2)

[Reference 41], and Internal Flood At-Power PRA (Part 3). The MNGP Peer Review included all these SRs. Twelve SRs were judged to be not applicable. Of the remaining 313 ASME PRA Standard SRs, 93% are supportive of Capability Category II or greater [Reference 37].

Section A.3 presents an assessment of all ASME/ANS PRA Standard [Reference 41] supporting requirements that were assessed to be "Not Met" at Capability Category II in the 2013 peer review or were assessed to be "Met" but had related Findings. F&Os from the 2013 peer review have been resolved. Therefore, the MNGP Internal Events PRA was judged to meet Capability Category II consistent with RG 1.200 guidance.

A.2. Fire PRA Quality Statement for Permanent 15-Year ILRT Extension The MNGP Fire Probabilistic Risk Assessment (FPRA) Peer Review was performed March 2-6, 2015 at the Xcel Energy Offices in Minneapolis using the NEI 07-12 process [Reference 56], the ASME PRA Standard [Reference 41], and Regulatory Guide 1.200, Rev. 2 [Reference 55]. The purpose of this review was to establish the technical adequacy of the FPRA for the spectrum of potential risk-informed plant licensing applications for which the FPRA may be used. The 2015 MNGP FPRA Peer Review was a full-scope review of all of the technical elements of the MNGP at-power January 2015 Rev. Ia Fire PRA against all technical elements in Section 4 of the ASME/ANS Combined PRA Standard, including the referenced internal events Supporting Requirements (SRs) in Section 2 of the ASME/ANS Combined PRA Standard [Reference 41].

The Peer Review team consisted of six team members, with extensive qualifications in all areas of FPRA as required by NEI 07-12 [Reference 56] and one working observer. The team members experience averaged over 20 years in PRA or Fire Protection, with extensive experience in FPRA, the FPRA Section of the Standard, and NUREG/CR-6850.

The Fire PRA Section of the ASME PRA Standard has 182 individual SRs, and references 237 individual SRs in the internal events PRA section of the Standard; the MNGP Peer Review included all of the SRs and all applicable reference SRs (see Table A.2-1). For the assessment of the reviewed ASME PRA Standard SRs, 102 unique Facts and Observations (F&Os) have been generated by the Peer Review team, 73 were peer review Findings, 28 were Suggestions, and one was considered a best practice. There were no "Unreviewed Analysis Methods" identified during the review. One F&O (5-5) remains open and is addressed by a sensitivity analysis in Section 5.3.5. The rest of the F&Os have been resolved as not affecting the ILRT extension analysis. Section A.4 presents the Findings and their resolutions.

Revision 2 Page 38 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Table A.2-1 - MNGP Fire PRA Assessment Capability Categorie es#SRs  % TotalISRs  % Assessed SRs Not Met (I, II, or Ill) 53 12.65% 19.56%

6 1.43% 2.21%

I'l 10 2.39% 3.69%

II 23 5.49% 8.49%

19 4.53% 7.01%

III 1 0.24% 0.37%

Met (All) 159 37.95% 58.67%

Not Reviewed 0 0% N/A Not Applicable 148 35.32% N/A Total 419 100% 100%

Page 39 of 142 Revision Revision 2 Page 39 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension A.3. Monticello PRA Response to RG 1.200 Peer Review Findings Change Number: MT-I13-0025 (IE)

Brief Problem

Description:

ASEP is used for assessment of all pre-initiator HFEs. A detailed assessment was not used for significant HFEs.

F&O Number: 1-6 Technical Element: HR Detailed Problem

Description:

ASEP is used for assessment of all pre-initiator HFEs. A detailed assessment was not used for significant HFEs. The standard defines "significant basic event: a basic event that contributes significantly to the computed risks for a specific hazard group. For internal events, this includes any basic event that has an

.FV importance greater than 0.005 or a RAW importance greater than 2. (See Part 2 Requirements DA-C13, DA-D1, DA-03, DA-D5, DA-D8, HR-D2, and HR-G1.)" For examples of pre-initiator important HEPs see Table E-1 of PRA-MT-QU. (This F&O originated from SR HR-D2)

Proposed Solution: Use detailed assessment for significant pre-initiator HFEs, e.g., THERP Risk Impact: Specific requirement for Cat II not met.

Actual Solution:

Significant pre-initiator HEPs, as found in the MNGP Rev 3.00 model, we re-evaluated with the THERP methodology. The following significant pre-initiator HEPs were identified in the Rev 3.0D model:

IPTP207WXZ, KCHV-SF-9Z, SPEP111 AXZ, and SPEPi111BXZ. Pre-initiator HEP KCHT8089CZ was also significant but was determined to be modeled less accurately by the THERP methodology and hence the detailed ASEP methodology was retained. KCHTB089CZ is a miscalibration pre-initiator HFE. In the THERP methodology under Execution Steps there really is no appropriate Error of Commission to choose for miscalibration errors, so Basic Error of Commission was chosen which has a high value of 1 E-

02. Using the THERP methodology and not applying any testing recovery credit, the HEP was 5.6E-03 which was higher and less accurate than the ASEP value. Once the testing recovery credit was applied (again maintenance done during shutdown but EDG testing done monthly) the value was reduced to 3.5E-05 which seems far too low. An error of commission item in the HRAC tool needs to be developed for miscalibration for this to be more accurately portrayed in HRAC.

The MNGP Rev 3.01 model was re-verified to identify any newly significant pre-initiator HEPs and found one significant pre-initiator HEP (NNTRAINBXZ) that was reanalyzed with the THERP methodology.

Miscalibration HEPs Q-672ABCD44Z, Q-2352AB-22Z, and NSP4237HIZ were also identified as significant but have been previously discussed to be inaccurately represented by the THERP methodology. Common cause HEPs QSV672EFX22Z and HPTRCHPSX22Z were also found to be significant. Common cause failures are not well accounted for in the THERP methodology since THERP does not allow for the inclusion of the dependence between the two single failures. There was no obvious option in the HRA Calculator tool for modeling activities that impact more than one train hence the detailed ASEP methodology was retained. Other significant HEPs that were already discussed and re-examined were KCHT8089CZ, SPEPI111 BXZ, and KCHV-SF-9Z.

Impact on ILRT Extension:

The ILRT application used the Rev. 3.2 model. These updates have been made in the Rev. 3.2 model.

Therefore, there is no impact to the ILRT extension.

Page 40 of 142 Revision 22 Revision Page 40 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I13-0026 (IE)

Brief Problem

Description:

(This F&O originated from SR IE-A8) A relatively robust process for system engineering interviews and documentation of same is included in PRA-MT-WI, Rev. 3.0.

F&O Number: 3-2 Technical Element: IE Detailed Problem

Description:

(This F&O originated from SR IE-A8) A relatively robust process for system engineering interviews and documentation of same is included in PRA-MT-WI, Rev. 3.0. However, the form used to document system engineer interviews does not include a section or any criteria relating to whether failure of the system in question could cause an initiating event. Therefore, this SR is met only to CC 1.

Proposed Solution: Possible resolution is to re-interact with system engineers regarding the potential for overlooked initiating events, and document the results of that interaction.

Risk Impact: This F&O is deemed a Finding as it prevents the SR from meeting CC I1.

Actual Solution:

Since the Peer Review, an Interview with Plant System Engineers and operators was performed to decide whether any initiating events were overlooked. Each system engineer was interviewed to verify that a failure of their system would not cause a plant trip, which is documented in the Walkdown and Interview Notebook [Reference 58]. All system engineers concluded that the initiating event fault trees modeled in the PRA were satisfactory in that no initiating events were overlooked. of the WI Notebook [Reference 58] under the statement below documents that this work was performed:

Verify with plant personnel to determine if potential initiating events have been over looked.

Impact on ILRT Extension:

The ILRT application used the Rev. 3.2 model. These documentation updates have been made for the Rev. 3.2 model. Therefore, there is no impact to the ILRT extension.

Page 41 of 142 Revision 22 Page 41 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I13-0027 (IE)

Brief Problem

Description:

During review of the CAFTA fault tree files, some instances of credit for repair of hardware (EDGs) were note that do not seem to be justified. An example is under gate AA1 31 of the AAC fault tree model.

F&O Number: 3-6 Technical Element: SY Detailed Problem

Description:

During review of the CAFTA fault tree files, some instances of credit for repair of hardware (EDGs) were noted that do not seem to be justified. An example is under gate AA1 31 of the AAC fault tree model.

Under the cited gate, failure to recover a diesel-generator is ANDed with "EDG 11 FAILURES WITH POTENTIAL TO RECOVER". Two issues were noted. First, there is not a corresponding gate for EDG 11 comprised of "failures that cannot be recovered'. Second, some of the EDG 11 failures that are recovered, e.g., EDG 11 00S for corrective maintenance, appear to be unjustified. (This F&O originated from SR SY-A24)

Proposed Solution: Search for instances of repair of hardware faults in the logic model, and for each instance identified consider whether credit for recovery/repair is justified. If not, revise the affected fault tree model. If so, document an adequate justification for the repair credit.

Risk Impact: Moving some of the EDG failures out from under the AND (i.e., recovery) gate may result in an appreciable impact on CDF.

Actual Solution:

An evaluation was conducted to investigate the basis for which components (basic events) should or should not be in the scope of EDG recovery. EDG non-recoverable failures are modeled under several gates. Certain accident sequences which require rapid response were excluded (NO-RECOVERY) from the scope of the recovery of the EDGs (for example floods that directly fail the EDG or ATWS). Failures of EDG cooling via HVAC or ESW were also excluded since it is assumed that failures of these systems would cause EDG overheating and hence be non-recoverable (for EDG 11 gate AA049 for EDG12 gate AA086).

RADS data for plants with similar EDGs were reviewed from 1999 to the present. The failures were reviewed and binned based on their time to recover (unavailability), so that an appropriate recovery probability could be calculated. These failures were categorized to determine their potential ability to be recovered. The following failure categories were determined to be recoverable:

1. Include components within EDG boundary. These components are inherently in the scope of the recovery data provided from the RADS database. This database is includes MSPI EDG data entries from all US nuclear power plants.

2. Include corrective maintenance as part of EDG since it represents unplanned unavailability (UA) data.

This unplanned UA was utilized to calculate EDG recovery fraction.

3. Include preventative maintenance since the average planned maintenance is less than six hours per month with most months less than three hours. Recovery would be complete or back out of PM and place EDG back into service.

4. Events that do not directly disable the EDG, hence EDG recovery is not applicable but has a separate recovery credit (e.g. FLOODING ANDed with ALOWFUELHY) is allowed.

5. Include support system recoverable events. These events contribute to unplanned UA for EDGs which was utilized to calculate EDG recovery fraction.

6. Include recoverable Human Actions such as the failure to address low fuel oil. These events may cause temporary loss of EDG but recovery not expected to be difficult.

Impact on ILRT Extension:

The PRA model had been investigated; it was determined the recoverable and non-recoverable EDG failures were modeled correctly. Therefore, there is no impact to the ILRT extension.

Revision 2 Page 42 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I13-0028 (IE)

Brief Problem

Description:

PRA-MT-QU Rev 3 and PRA-MT-L2-AS document the codes used and limitations that may impact applications in Section 2.4.

F&O Number: 4-2 Technical Element: LE Detailed Problem

Description:

PRA-MT-QU Rev 3 and PRA-MT-L2-AS document the codes used and limitations that may impact applications in Section 2.4. However, there is no discussion related to the impact of HEP dependencies on applications that may be requested from the site. For example, using the current seed values for the HFE dependencies would prevent MT from being able to obtain cutsets at a truncation of IlE-12 which is required for MSPI (i.e. 7 orders of magnitude below CDE). (This F&O originated from SR QU-F5)

Proposed Solution: Discuss this limitation in the documentation for the current model. In the future, determine the appropriate method for HFE dependency which will allow truncation at an appropriate limit for support of applications.

Risk Impact: MSPI requires that models be quantified at 7 orders of magnitude below the CDE. This will require MT to truncate at a limit of at least 1E-12 which is unattainable based on discussion in Section 3.5 of PRA-MT-QU. Therefore, this item is a finding.

Actual Solution:

The MSPI Sensitivity was quantified for the MT Rev 3.0E model and truncated down to 6E-i13 without any modification to our quantification process. It is believed that the improvements to the HEP dependency analysis along with other improvements have made this possible. Model revisions after Rev 3.0E have also been tested and have been successful. Since the model's risk has gone down the truncation also has to progress down which makes quantification at these lower truncations more difficult. Similarly with Pr's most recent model, quantification had to be broken up by initiator to meet these lower truncations.

The resulting cutsets are simply appended afterwards. This will be documented in the MSPI Basis document and is documented in the convergence study within the Quantification Notebook [Reference 17].

Impact on ILRT Extension:

The ILRT application used the Rev. 3.2 model. These updates have been made in previous models.

Therefore, there is no impact to the ILRT extension.

Page 43 of 142 Revision 22 Page 43 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-13-0030 (IE)

Brief Problem

Description:

Section 8.1 of PRA-MT-L2-AS gives a table, Table 8.2, which identifies the sources of model uncertainties and assumptions that could impact the PRA model.

F&O Number: 4-6 Technical Element: LE Detailed Problem

Description:

Section 8.1 of PRA-MT-L2-AS gives a table, Table 8.2, which identifies the sources of model uncertainties and assumptions that could impact the PRA model. In this table is a description for the impact on the PRA model, but there doesn't appear to be a sound basis. For example, for the second item in the table, namely Debris Coolability in the Drywell, the 'approach taken' states that the event is set to FALSE but is provided for the purpose 'of performing sensitivity studies on this assumption;' however, no sensitivity is performed. (This F&O originated from SR LE-F3)

Proposed Solution: Perform sensitivity analysis to characterize the key model uncertainties identified.

Risk Impact: The sensitivity analysis performed should help to characterize the uncertainties identified; however, there aren't any supporting sensitivities performed for the identified uncertainties. Therefore the SR is not met.

Actual Solution:

PRA calculation PRA-CALC-13-001 (Level 2 Sensitivity Studies - Model Rev 3.1) was generated to document the detailed level 2 sensitivity studies performed by Applied Reliability Engineering Inc. (AREI) in response to the internal events peer review finding (F&O number 4-6, concerning ASME/ANS RA-Sa Supporting Requirement LE-F3). Section 8.3 (Level 2 Sensitivity Studies) was added to revision 3.1 of the Level 2 PRA Notebook [Reference 18] to summarize each of the studies documented in this PRA calculation. PRA-CALC-13-001 is referred to in the Level 2 PRA Notebook [Reference 18] as reference

1. 43. PRA-CALC-13-O01 has been reviewed and reviewer signed. All the above statements are accurate.

The scope of the sensitivity studies was determined by agreement between the XCEL MNGP Team and AREI.

Impact on ILRT Extension:

These are documentation issues, and they have been resolved in the previous revision. Therefore, there is no impact to the ILRT extension.

Page 44 of 142 Revision 22 Page 44 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-13-0031 (IE)

Brief Problem

Description:

Section 5.2 of PRA-MT-DA states that coincident maintenance at MT is not a common practice but there is no evidence that coincident maintenance activities have been reviewed for applicability of the PRA model.

F&O Number: 4-10 Technical Element: DA Detailed Problem

Description:

Section 5.2 of PRA-MT-DA states that coincident maintenance at MT is not a common practice but there is no evidence that coincident maintenance activities have been reviewed for applicability of the PRA model. However, review of the fault tree demonstrates that RHR-A and RHR-C are taken OOS for corrective maintenance per review of event RLOOPAXXCM in the CAFTA fault tree. This is a clear example of coincident maintenance that should be examined and reviewed for impact on the PRA model. (This F&O originated from SR DA-C14)

Proposed Solution: Document/provide evidence of a review of past planned maintenance to identify any coincident maintenance activities and determine the impact on the PRA model for any items that are identified. A process for coincident maintenance review and impact on the model has been provided via email as one example that this SR can be MET.

Risk Impact: SR is NOT MET because SR requirement is not satisfied.

Actual Solution:

First, high risk combinations were identified that could occur due to online preventive maintenance coupled with random corrective maintenance. These combinations were identified by assigning probabilistic values consistent with those observed for the system combinations from actual plant experience. Second, a detailed cycle plan review was performed for theperiod 2009-2012 to verify that the risk significant combinations of components!/trains were not coincidently taken out of service. The result of this review concluded that there are no coincident maintenance outages as a matter of practice at Monticello.

See Section 5.2 the Data Notebook [Reference 42] for further discussion on this item.

Impact on ILRT Extension:

A review concluded there are no coincident maintenance outages at Monticello. Therefore, there is no impact to the ILRT extension.

Page 45 of 142 Revision 22 Page 45 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5400-CAC-0 Evauaton f Rik Sgniicace o Pemannt IRT xtesio Change Number: MT-I13-0032 (IE)

Brief Problem

Description:

During review of the RHR fault tree, an asymmetry was identified in the fault tree related to Div I and Div 11Flow diversion. Specifically, gates R009-A and R01 0-A should be similar just as R012-A and R013-A are.

F&O Number: 4-11 Technical Element: QU Detailed Problem

Description:

During review of the RHR fault tree, an asymmetry was identified in the fault tree related to Div I and Div II Flow diversion. Specifically, gates R009-A and R01 0-A should be similar just as R012-A and R013-A are.

The non-symmetry occurs due to including maintenance events under the fail to run gate for one pump and not the other three pumps in the RHR system (or at the very least one of the pumps in the other division). The model should be consistent or documentation should be provided describing the reason for the asymmetry. (This F&O originated from SR QU-F2)

Proposed Solution: Correct the model or documentation for the RHR system fault tree.

Risk Impact: Documentation issue Actual Solution:

In the RHR fault tree, the description of gate R009_1 was ". .. common cause failure to start of 2 or 3 pumps" where the proper gate description should have been ". .. common cause failure to run of 2 or 3 pumps". All basic events under this gate are run failures. It appears that the mislabeling of this gate led to the inclusion of maintenance events under the gate, as maintenance events are included under the run failure gates for all of the RHR pumps. The gate name (R009_1) description was corrected to reflect it is a failure to run gate, and the maintenance events under the gate were removed. A review of the fault tree was conducted to verify the proper inclusion of maintenance events under the appropriate (failure to start) gates for each of the four RHR pumps.

Maintenance events are similarly located for each pump under gate R050 for P-202A, gate R055 for P-2020, gate R068 for P-202D, and gate R063 for P-202B. Gates R009- and R010-A are now symmetrical.

Impact on ILRT Extension:

The ILRT application used the Rev. 3.2 model. These updates have been made in previous models.

Therefore, there is no impact to the ILRT extension.

Page 46 of 142 Revision 22 Page 46 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5400-CAC-0 Evauaton f Rik Sgniicace o Pemannt IRT xtesio Change Number: MT-I13-0033 (IE)

Brief Problem

Description:

The use of a half failure for plant-specific data is being questioned. A SSC either fails to perform its function or it doesn't.

F&O Number: 5-12 Technical Element: DA Detailed Problem

Description:

The use of a half failure for plant-specific data is being questioned. A SSC either fails to perform its function or it doesn't. Examples include:

1) A valve that had minor leakage was considered a half failure. This should be determined if the valve could perform its safety function or not.

2) A pump started, stopped, and then restarted successfully. What caused the pump to restart? Was it a manual restart or automatic?

3) A valve did not meet an IST requirement during a surveillance test. Would the valve still be able to perform its function?

4) A valve was not able to maintain a required flow, but could maintain a specific flow. Is that specific flow acceptable for success criteria? If it is, then no failure. (This F&O originated from SR DA-C4)

Proposed Solution: Review the cases where a half failure is given and determine ifthose are PRA failures or not.

Risk Impact: The basis for identifying events as failures was not clearly defined and is viewed as atypical. Therefore, this is a finding.

Actual Solution:

All half failure rates as reported in Rev 3.0 of the Data Notebook [Reference 42] were reviewed to determine ifthe component failed to perform its intended function. The half failures were adjusted accordingly (to be counted as 0 or 1) depending on the scenario with a confirmation from system engineers. These changes were corrected in the basic event type code database titled "MNGP_REV_3-01.EGS_06-05-13_IE_&_type .code_.Database.mdb" and included in any future revisions.

The database file has since been split into two: one for type codes and one for initiating events. The new type code database is titled: "MNGPTCREV_3-1-N.EGS_08-14-13.mdb". Paragraph description now added in Section 4.5.4 of the Data Notebook [Reference 42].

Impact on ILRT Extension:

The ILRT application used the Rev. 3.2 model. These updates have been made in previous models.

Therefore, there is no impact to the ILRT extension.

Page 47 of 142 Revision 22 Revision Page 47 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-13-0034 (IE)

Brief Problem

Description:

The times that components were in their standby statuses were estimated by using a general understanding of average system operation (i.e., a pump in a 2 out of 3 pump system would have 1/3 probability in standby).

F&O Number: 5-15 Technical Element: DA Detailed Problem

Description:

The times that components were in their standby statuses were estimated by using a general understanding of average system operation (i.e., a pump in a 2 out of 3 pump system would have 1/3 probability in standby). Plant-specific operational records were not reviewed. Therefore, this SR is MET at CAT I, but NOT MET at CAT IlIll1. (This F&O originated from SR DA-C8)

Proposed Solution: Review plant-specific data to capture more realistic standby probabilities.

The use of PI data to determine running data combined with the time the SSC is unavailable may be used to determine the plant-specific standby time.

Risk Impact: Because plant-specific operational records were not reviewed, this SR is not met at CAT Il/Ill, therefore this is a finding.

Actual Solution:

The standby data for the DC, SW, and AIR systems were collected from the SOMs, PI Systems, or Procedure 4953-PM respectively to establish more realistic probabilities for the standby flags BE of redundant components. For systems which lacked sufficient data in P1 Systems and SOMs logs, system engineer interviews were conducted to determine appropriate standby fractions. The following systems lacked sufficient plant data: CRDH, HVAC, and RBCCW. The time period reviewed was 2008 to 2012, except for the AIR system which was recently upgraded in 2010. The spreadsheet titled, "MT Standby Fraction.xls" documents this work.

Impact on ILRT Extension:

Plant-specific standby fractions have been incorporated into the model. Therefore, there is no impact to the ILRT extension.

Page 48 of 142 Revision 22 Page 48 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I13-0035 (IE)

Brief Problem

Description:

Mean values and uncertainty intervals were provided through Bayesian updating. However, a number of important basic events in Section 7.1 of PRA-MT-DA were given point estimates without any associated uncertainty values.

F&O Number: 5-16 Technical Element: DA Detailed Problem

Description:

Mean values and uncertainty intervals were provided through Bayesian updating. However, a number of important basic events in Section 7.1 of PRA-MT-DA were given point estimates without any associated uncertainty values. More importantly, no sensitivity studies were performed to ascertain the impact of the point estimates on the model. (This F&O originated from SR DA-D3)

Proposed Solution: Assign appropriate uncertainty values to the point estimates given in Section 7.1 and perform sensitivity studies to determine the impact of these values to the model.

Risk impact: These point estimates may have a large impact on the model, therefore this is a finding.

Actual Solution:

For events not linked to Type Codes, the uncertainty bounds for basic events are defined by the use of lognormal distribution Error Factors (EFs) and are assigned as follows:

When available, EFs or Variances are obtained based on the distribution values provided by the data source. When such information is not available, the general EF guidelines below are used.

1-Human Error Probabilities: related to Human Error are based on information in Section 7 of NUREG/CR-1 278 (Handbook of HRA). The Equipment EF guidelines are based on comparison with various data sources.

2- for failure rates probabilities related to Special BE, an engineering judgment and comparisons with similar BE data was utilized.

Table 7-la Guideline related for probabilities missing distribution attributes is listed in the Data notebook section 7.1 [Reference 42].

Sensitivity studies were performed to determine significant point estimate basic events. The Sensitivity study concluded three basic events which are fairly important to LERF only. These events are JUMPERS

'Hardware needed to align alternate power supply to div. 2 250V DC fails", MVR4543XXN "Hard-pipe vent rupture disk PSD-4543 fails to open", and XPP-SRV--L "SRV tailpipe rupture in the wet-well airspace". Each basic event contributes an increase in LERF risk by more than 10% in comparison to all special events included in the study.

The insights from the study indicate that our model is sensitive to the following basic events:

JUMPERS: The original probability was conservatively estimated to be 1.OE-3. Since this failure only pertains to the jumper cables themselves this failure probability is much higher than other passive components (heat exchangers or check valves). Additionally, this procedure and equipment has been functionally tested (during the 2005 refueling outage) to provide battery charging following a complete discharge.

MVR4543XXN: The only feasible ways that the rupture disk would not open when containment pressure challenges containment integrity (>100 psig) is if the incorrect rupture disk is installed, multiple rupture disks are installed together, or the rupture disk is manufactured incorrectly. The probability of installing multiple disks together is considered to be negligible because of the level of training and experience of Revision 2 Revison 2Page 49 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension maintenance workers, as well as the quality assurance program at the site. This original estimated probability of 1 .0E-3 was found to be conservative since the failure rate is much higher than the failure rate to similar passive components.

XPP-SRV--L: The probability of 3.6006 E-04 is assumed to have a testing period of 2 years for three of the SRVs, and 4 years for the other five SRVs. The probability that a rupture is present (on any SRV tailpipe) is calculated by using a calculation type 5 event with a failure rate for all eight SRV tailpipes (estimated to be a total of 100 feet of piping) with an average testing period of 3.25 years. The piping structural analysis performed in PRA-MEMO-12-007 also concluded that the most limited pipe stress in the SRV tail pipe is below water line not in the airspace. Therefore, the probability is also reasonable given the calculation method and the location of the rupture.

Impact on ILRT Extension:

Further evaluation post-peer review determined no changes to the model were necessary. Uncertainty characterization does not affect the ILRT application. There is no impact to the ILRT extension.

Page 50 of 142 Revision 22 Page 50 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I13-0036 (IE)

Brief Problem

Description:

Section 4.0 discusses the use of Bayesian Updating of generic priors to provide posterior distributions. Generic information was primarily collected from NUREG/CR-6928.

F&O Number: 5-17 Technical Element: DA Detailed Problem

Description:

Section 4.0 discusses the use of Bayesian Updating of generic priors to provide posterior distributions.

Generic information was primarily collected from NUREG/CR-6928. A number of parameters did not have plant-specific information, therefore only generic information was used. (This F&O originated from SR DA-Dl)

Proposed Solution: An industry reference for a probability of consequential LOOP is given in NUREG/CR-6890 Vol. 1, Section 6.3. Alternately, obtain generic data and perform a Bayesian update using plant-specific data to generate a posterior value.

Risk Impact: This SR requires realistic parameter estimates for significant basic events based on relevant generic and plant-specific evidence. There is no evidence to support a realistic parameter estimate for the consequential LOOP (ALOOPXXXXL). Therefore this is finding.

Actual Solution:

The consequential LOOP basic event was reanalyzed and broken up into two different types based on the scenario. The first is the possibility that a LOCA event with the automatic start of the large ECCS pumps induces a grid or plant instability that leads to a LOOP. The second possibility was the consideration of LOOP due to transient. EPRI has reviewed NRC references (such as NUREG/CR-6890 Vol 1) and provided estimates for conditional LOOP frequencies. The EPRI guidance provided the following recommended values:

1. Consequential LOOP for initiators with LOCA was given a frequency of 2.4E-2 per year. The new.

basic event name for this scenario is ALOOPWLOCA.

2. The consequential LOOP caused by a Transient was given a frequency of 2.4E-3 per year. The new basic event name for this scenario is ALOOPTRANS.

Bayesian updating of data was performed on risk significant components from the 2004 Monticello PRA Model (CDF and LERF). The 2004 Monticello model was the model of record at the time of the project's commencement. When the data is updated again, the events which are given a Bayesian update will also be revisited.

The reasonableness check of the Prior versus Posterior was performed using the mean of the Posterior to the 90% confidence intervals of the prior 5th-95th percentile. This check verified that that mean of the Posterior with 90% confidence falls between the Prior's 5 th and 95th percentile values. This work was performed and documented per Suggestion 5-13 (PCD MT-I13-0077).

Impact on ILRT Extension:

Work that was done to resolve this F&O has been completed and incorporated into the PRA model.

Therefore, there is no impact to the ILRT extension.

Page 51 of 142 Revision 22 Revision Page 51 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I13-0037 (IE)

Brief Problem

Description:

The system description for the Condensate and Feedwater system (PRA-SY-CFW) states that the oil coolers for the new condensate pumps being installed will be dependent on Service Water; however, SW isn't listed as a required support system.

F&O Number: 6-4 Technical Element: SY Detailed Problem

Description:

The system description for the Condensate and Feedwater system (PRA-SY-CFW) states that the oil coolers for the new condensate pumps being installed will be dependent on Service Water; however, SW isn't listed as a required support system. (This F&O originated from SR SY-B9)

Proposed Solution: Include SW as a required support system for CFW.

Risk Impact: Documentation and model issue. This dependency may have an appreciable impact on CDF.

Actual Solution:

The CFW fault tree (CFW Rev 3.0.B.ABS_04-30-1 3.caf) was revised to include service water as a dependency for the condensate pumps. Specifically, gate T_SW-SW was added under gates F009, F009-S, F010 and F010-S. The revised fault tree was renamed "CFW Rev 3.0.C.TPW_05-17-13.caf" and filed appropriately. The system notebook for the CFW system [Reference 43] was revised to reflect these changes. A similar PCD (MT-I12-0034) was already established, and will be closed out in conjunction with this PCD. Additionally, PCD MT-11-0027, which is more general but related to EPU changes to the CFW system, will be updated to note the change from this PCD.

Also, feedwater long-term DC dependencies were changed to be long-term instead of short-term.

Specifically gate T_D-DC111b-S was changed to T_D-DC11lb-L under the F051 gate and gate T_D-DC211b-S was changed to T_D-DC2I11-L under gate F054.

Impact on ILRT Extension:

Work that was done to resolve this F&O has been completed and incorporated into the PRA model.

Therefore, there is no impact to the ILRT extension.

Page 52 of 142 Revision 22 Page 52 of 142

54003-CALC-02 Evaluation of Risk Si.qnificance of Permanent ILRT Extension 5400-CAC-0 Evauaton f Rik Sqniicace o Pemannt IRT xtesio Change Number: MT-I13-0038 (IE)

Brief Problem

Description:

PRA-MT-IF-IE Rev 3 includes the information regarding the potential sources of flooding. However, the inadvertent actuation of the fire suppression system is not discussed as a potential initiating event.

F&O Number: 6-6 Technical Element: IFSO Detailed Problem

Description:

PRA-MT-IF-IE Rev 3 includes the information regarding the potential sources of flooding. However, the inadvertent actuation of the fire suppression system is not discussed as a potential initiating event. (This F&O originated from SR IFSO-A4)

Proposed Solution: Perform the evaluation of inadvertent fire suppression actuation and include it in PRA-MT-IF-IE.

Risk Impact: This evaluation is a requirement of this SR.

Actual Solution:

The following information has been added to the Internal Flooding Initiating Events (PRA-MT-IF-IE)

Notebook [Reference 44], Section 2.1: CAP 1266742 evaluated the FPS with regard to effects on plant equipment/areas if inadvertent system actuation were to occur. The conclusion of the evaluation is that inadvertent actuation would not affect any safety-related equipment's ability to perform its function. This evaluation further supports the following positions regarding inadvertent actuation of the fire suppression system in the MNGP PRA Model.

Sprinkler System The effects of an inadvertent sprinkler discharge are bounded by the effects modeled for random pipe breaks in the same area. The spray effects of a sprinkler discharge would likely be less since the sprinkler targets a specific location while a random pipe break is assumed to spray everything in the room.

Additionally, all small FPS piping containing the sprinklers is included in the random FPS pipe break frequencies calculated for the various flood areas. Given that MNGP does not have a history of random sprinkler discharges leading to a plant transient and such events are so rare throughout the industry that no failure data has been developed for such events, inadvertent sprinkler discharge is considered to be within the bounds of uncertainty for the existing flood scenarios hence is not explicitly modeled.

Delugqe System The effects of an inadvertent actuation of a deluge system are bounded by the effects modeled for random pipe breaks in the same area. The spray effects of a deluge discharge would likely be less since the deluge system is focused on a specific set of targets while a random pipe break is assumed to spray everything in the room. The human actions associated with isolation of a deluge discharge are considerably different than those for a random pipe break, however. The control room will receive a unique alarm for a deluge discharge indicating exactly where the operator should investigate instead of simply receiving a 'fire pump running' alarm leaving the operator to search for the location of the event.

Additionally, the isolation of the deluge discharge can be performed at the discharge location by simply closing the deluge valve rather than having to travel to the intake structure to locally trip the fire pumps.

While explicit inclusion of this deluge system actuation would increase the initiating event frequency slightly, this increasewould be more than offset by the decreased HEP associated with the isolation of the deluge discharge. Thus, inadvertent actuation of a deluge system is considered to be within the uncertainty bounds of the existing flood scenarios and is not explicitly modeled.

Impact on ILRT Extension:

The evaluation of inadvertent fire suppression actuation is included in PRA-MT-IF-IE. This documentation issue is resolved. There is no impact to the ILRT extension.

Revision 2 Page 53 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-13-0039 (IE)

Brief Problem

Description:

There is no evidence of plant-specific analysis completed or research done to identify or collect repair time information.

F&O Number: 7-6 Technical Element: DA Detailed Problem

Description:

There is no evidence of plant-specific analysis completed or research done to identify or collect repair time information. The EDG recovery values in Table 1 of PRA -MT-SY-RECAC are based solely on a generic data source. This is contrary to the SR requirement to gather both generic and plant specific information. (This F&O originated from SR DA-C15)

Proposed Solution: If EDG recovery is used in the model, base the values on plant specific experience of EDG repair or show "that the plant EDGs are sufficiently similar... such that the generic data can be used to characterize the EDG repair probability" as stated in the EPRI LOOP Technical Guidelines.

Risk Impact: No plant-specific experience is given for repairs which appear to be very plant specific in nature.

Actual Solution:

Data from the NRC's Reliability and Availability Data System (RADS) was utilized to calculate an updated EDG recovery estimate. RADS was used to obtain more data to establish a larger data population than only MNGP related failures. This analysis used similar assumptions and methodology utilized by the most recent NRC diesel generator repair time estimates. The RADS Unplanned Unavailability (UUA) outage data for similarly designed EDGs from 1998-201 0 was utilized to characterize diesel generator repair probabilities. Each UUA event was categorized into their respective time span. The sum of events within the time span was calculated. The percent recovered was calculated based on the total of UUA events (1,401). The result of this analysis is provided in Appendix A in the RECAC (AC Recovery) Notebook Rev.

3.1.

Impact on ILRT Extension:

Work that was done to resolve this F&O has been completed and incorporated into the PRA model.

Therefore, there is no impact to the ILRT extension.

Page 54 of 142 Revision 22 Revision Page 54 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I13-0040 (IE)

Brief Problem

Description:

(This F&O originated from SR QU-B3) Convergence is only demonstrated when quantifying with nominal HEP values. There is no convergence demonstrated when the method described in PRA-MT-QU Rev 3 is used for quantification.

F&O Number: 7-7 Technical Element: QU Detailed Problem

Description:

(This F&O originated from SR QU-B3) Convergence is only demonstrated when quantifying with nominal HEP values. There is no convergence demonstrated when the method described in PRA-MT-QU Rev 3 is used for quantification. The truncation level (1 E-1 0) is quite high even given the E-05 ODE value. Also little basis is given for using the 1E-1 0 truncation rather than the possible lower E-11I truncation.

Proposed Solution: Review the model to identify what is limiting the quantification truncation. The self-identified issue of dependent HEP methodology is one potential factor but others could exist.

Risk Impact: A sufficiently low converged truncation is required for many applications such as MSPI.

Actual Solution:

Convergence of the internal events only ODE, complete ODE, and LERF has been tested and proven for each model revision since Rev 3.0E. Quantification at truncation levels required by MSPI (7 orders below converged CDF value) were also successful. No pre or post quantification modification to the model was required to establish this convergence. It is believed that since the Peer Review the improvements to the HEP dependency analysis along with other improvements have made this possible. Since the model's risk has gone down since Rev 3.0 the truncation must also progress down to meet the MSPI requirement, which makes quantification at these lower truncations more difficult. To solve at these lower truncations, quantification is performed on smaller groups of initiators with the resulting cutsets appended post quantification. This is a simple and accurate method to quantify the model at these rarely used truncation levels. The final convergence study will be documented in the Quantification Notebook [Reference 17].

The Rev 3.1 model was solved at a truncation of IE-13 by splitting the initiators into four groups by flags.

Convergence of total ODE, no flood ODE, and total LERF were established at 1E-1 2, 1 E-1 3, and 1 E-1 2 truncations respectively.

Impact on ILRT Extension:

The ILRT application used the Rev. 3.2 model. These updates have been made in previous models.

Therefore, there is no impact to the ILRT extension.

Page 55 of 142 Revision 22 Page 55 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-13-0041 (IE)

Brief Problem

Description:

Truncation is only 5 orders of magnitude below CDF. This is less than general industry practice. PRA-MT-QU Rev 3 states that it is because the model quantification fails at lower truncation levels as a result of the joint HEP methodology used.

F&O Number: 7-9 Technical Element: QU Detailed Problem

Description:

Truncation is only 5 orders of magnitude below CDF. This is less than general industry practice. PRAMT-QU Rev 3.0 states that it is because the model quantification fails at lower truncation levels as a result of the joint HEP methodology used. (This F&O originated from SR QU-B2)

Proposed Solution: Identify and resolve the issues with quantification to allow quantification at truncation levels required by the standard and for applications. This may include review of the incorporation of HEP dependencies into the quantification, and review of fault tree structure to optimize quantification effectiveness among other possibilities.

Risk Impact: Events can become significant due to many lower value cutsets containing those events whose summed value is important.

Actual Solution:

Convergence of the internal events only CDF, complete CDF, and LERF has been tested and proven for each model revision since Rev 3.0E. Quantification at truncation levels required by MSPI (7 orders below converged CDF value) were also successful. No pre or post quantification modification to the model was required to establish this convergence. It is believed that since the Peer Review the improvements to the HEP dependency analysis along with other improvements have made this possible. Since the model's risk has gone down since Rev 3.0 the truncation must also progress down to meet the MSPI requirement, which makes quantification at these lower truncations more difficult. To solve at these lower truncations, quantification is performed on smaller groups of initiators with the resulting cutsets appended post quantification. This is a simple and accurate method to quantify the model at these rarely used truncation levels. The final convergence study will be documented in the Quantification Notebook [Reference 17].

The Rev 3.1 model was solved at a truncation of 1E-1 3 by splitting the initiators into four groups by flags.

Convergence of total CDF, no flood CDF, and total LERF were established at 1E-1 2, 1E-1 3, and 1E-1 2 truncations respectively.

Impact on ILRT Extension:

The ILRT application used the Rev. 3.2 model. These updates have been made in previous models.

Therefore, there is no impact to the ILRT extension.

Revision 2 Revison 2Page 56 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I13-0042 (IE)

Brief Problem

Description:

The reasonableness check appears to be limited to whether the individual values are reasonable, not whether similar (timing, complexity, out of control room etc.) actions when compared to each other have reasonable values, which is the intent of the SR.

F&O Number: 7-15 Technical Element: HR Detailed Problem

Description:

The reasonableness check appears to be limited to whether the individual values are reasonable, not whether similar (timing, complexity, out of control room etc.) actions when compared to each other have reasonable values, which is the intent of the SR. (This F&O originated from SR HR-G6)

Proposed Solution: Perform the reasonableness check between events.

Risk Impact: Comparison between events with similarities is an important part of validating the values.

Actual Solution:

Since the Peer Review multiple reviews of the post initiator HEPs were performed using the HRA Calculator to get an accurate picture of the overall HRA analysis. A stress review report was generated and reviewed for all HEPs to ensure that the assigned stress levels are accurate. In general actions that are rarely performed, are outside the control room, or have little time to perform were assigned a higher stress level. The locations of HEPs were also reviewed to ensure that consistent naming was used for accurate use in the dependency analysis. A review of the complete HEP values against other similar actions was also performed. Any screening value HEPs that were found to be risk significant were developed further to establish a more accurate failure probability. Similar actions, such as flood isolations and manual depressurizations, were reviewed collectively to validate that actions that have more time or are located in the control room were given a lower failure probability. These reviews have been documented in Section 8.2 of the HRA Notebook, Rev 3.1 [Reference 45].

Impact on ILRT Extension:

The ILRT application used the Rev. 3.2 model. This documentation update has been made in previous models. Therefore, there is no impact to the ILRT extension.

Page 57 of 142 Revision 22 Page 57 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I13-0043 (IE)

Brief Problem

Description:

However, it appears that combinations (up to 6) HEPs appearing in cutsets are inappropriately analyzed for dependency resulting in over 8000 dependent combinations.

F&O Number: 7-16 Technical Element: HR Detailed Problem

Description:

The dependency analysis was performed using the HRA calculator which is an acceptable method to perform the dependency analysis and there is evidence that the limitation of the HRA calculator dependency module on the sequence of events times for multiple HEPs within a cutset was addressed at least in part. However, it appears that combinations (up to 6) HEPs appearing in cutsets are inappropriately analyzed for dependency resulting in over 8000 dependent combinations. This analysis does not account for the subset of HEPs where the dependency is addressed via the separate cognitive and execution events. (This F&O originated from SR HR-G7)

Proposed Solution: Redo the dependency analysis using an awareness of the mix of HEP types, the concept of minimum values, consideration of whether the large number of HEPs in a single cutset is appropriate while retaining the current correct addressing of the cutset length limitations and time sequencing of HEPs from the current analysis. Review available industry guidance on performance of HEP dependency analysis to garner the best, most efficient way to perform the analysis. Ensure the software limitations are explicitly addressed in the dependency analysis process.

Risk Impact: Large sets of HEPs in a cutset may be due to the mix of methods (separate cognitive and execution events with the dependencies explicitly addressed and combined events not addressing dependency). Where the dependency was addressed by the separate events method already, these should be removed from or limited in the dependency analysis.

Actual Solution:

Post model Rev 3.0, a large effort was conducted to simplify and standardize the post initiator HRA analysis. First, cognitive and execution only HEPs were combined into one single HEP to create a more logical and simplified method for accounting for dependencies between HEPs. Second, an effort was conducted to combine the remaining HEPs that were very similar such as high pressure injection with FW or HPCI/RCIC. The number of flood isolation HEPs were reduced from 57 to 12 based on their HEP value and similarity of action. Model logic that duplicated the same operator action for different timings were also removed since these actions are not actually separate (for example depressurizing with one SRV or three). The efforts previously described have reduced the number of HEPs from 160 to 79 and reduced the HEP combos from approximately 12,000 (Rev 3.0) to 1,600 in the Rev 3.1 model. The amount of HEPs and dependencies is now well within the limitations of the current software used for HRA (HRA Calculator) and quantification (CAFTA and FTREX).

See Table 22 in the PRA-MT-HR Notebook [Reference 46] for the summary of the work performed to standardize the HRA analysis by combining cognitive and execution HEPs from the 2004 model.

Impact on ILRT Extension:

The ILRT application used the Rev. 3.2 model. These updates have been made in previous models.

Therefore, there is no impact to the ILRT extension.

Page 58 of 142 Revision 22 Revision Page 58 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5400-CAC-0 Evauaton f Rik Sgniicace o Pemannt IRT xtesio Change Number: MT-I13-0044 (IE)

Brief Problem

Description:

Part of a reasonableness check should be an evaluation as to whether very low HEP values make sense*. Common industry practice is to employ a floor or lower limit value of 1E-06 or 5E-07 to any HEP calculated value below these limits.

F&O Number: 7-17 Technical Element: H-R Detailed Problem

Description:

Part of a reasonableness check should be an evaluation as to whether very low HEP values make sense. Common industry practice is to employ a floor or lower limit value of 1E-06 or 5E-07 to any HEP calculated value below these limits. This applies to both independent and dependent HEP values. For example from the DAC, combination 1 has a resultant dependent HEP value of E-1 1.This is mainly an issue with the dependent HEP values. (This F&O originated from SR HR-G6)

Proposed Solution: Incorporate the use of floor values in the HRA analysis.

Risk Impact: Use of extremely low HEP values is not realistic from a human performance perspective and can skew the PRA results.

Actual Solution:

All post Rev 3.0 quantifications now include a floor limit of independent or dependent combinations of HEPs of 1E-7. This number is currently being debated among the industry and regulators and is consistent with Prairie Island. A floor limit of the single HEP was set to 1E-5 in the HRAC database. This single HEP floor limit is rarely used for post initiator HEPs, XDEPHOURSY and J2NDPHRS-Y only.

These are reserved for simple control room actions which need to be performed within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. Multiple pre-initiator HEPs have this screening level value.

Impact on ILRT Extension:

The ILRT application used the Rev. 3.2 model. These updates have been made in previous models.

Therefore, there is no impact to the ILRT extension.

Page 59 of 142 Revision 22 Page 59 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I13-0045 (IE)

Brief Problem

Description:

A comparison of MNGP results with other plants was documented in Section 4.3.6.

F&O Number: 8-1 Technical Element: QU Detailed Problem

Description:

A comparison of MNGP results with other plants was documented in Section 4.3.6. Loss of 125 VDC initiators are a much higher contribution to ODE than for the other three comparison plants, but no adequate explanation was offered as to why there is such a large discrepancy. (This F&O originated from SR QU-D4)

Proposed Solution: State physical reasons why the 125 VDC initiators are more significant for MNGP, or else identify why these cutsets may be "artificially" high, e.g., use of HEP dependencies.

Risk Impact: The SR states that the causes for significant differences with other comparison plants needs to be identified.

Actual Solution:

A discussion comparing Monticello's results to other similarly designed BWRs will not be created until the Rev 3.1 model is frozen July 1 5th. This discussion will not affect the PRA model or its applications. The importance of the complete loss of 125VDC was researched and found to be a result of having the common cause failure of all three battery chargers fails short term injection. This basic event was removed since only two of the three battery chargers are normally in service with the backup in standby.

The basic event was replaced with the common cause of two battery chargers failing and the backup also failing independently. These changes reduce the overall ODE significance for complete loss of 125VDC from ~18% (Rev 3.0) to 0.0% (3.0H) at a IE-9 truncation, which is much more consistent with other similar BWRs. The modeling for complete loss of either single train of 125VDC is about a 1% contributor for non-flood scenarios.

Discussion was added to describe the differences between Monticello and other similarly designed plants in Section 4.3.6 of the QU Notebook [Reference 17]. Comparisons to other similarly designed plants were made to the best of our ability based on the information provided.

Impact on ILRT Extension:

The ILRT application used the Rev. 3.2 model. These updates have been made in previous models.

Therefore, there is no impact to the ILRT extension.

Page 60 of 142 Revision 22 Page 60 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I13-0046 (IE)

Brief Problem

Description:

Based on a review of the CAFTA database file (PRA-MT-DA-CDF-OPT Rev 3.0.RR), it appears that Error Factors were assigned to both Beta and Gamma distributions in the Type Code table instead of using variance values.

F&O Number: 8-5 Technical Element: QU Detailed Problem

Description:

Based on a review of the CAFTA database file (PRA-MT-DA-CDF-OPT Rev 3.0.RR), it appears that Error Factors were assigned to both Beta and Gamma distributions in the Type Code table instead of using variance values. In Attachment 1 of the Data notebook (PRA-MT-DA), the same type codes listed have assigned variance values for their Beta or Gamma distribution. This appears to be a discrepancy in the way the data was utilized in estimating the CDF uncertainty intervals. (This F&O originated from SR QU-E3)

Proposed Solution: Revise the distribution parameters in the Type Code table of the CAFTA database such that they are consistent with the PRA documentation. If necessary, the parametric uncertainty analysis may need to be re-performed in order to more accurately estimate the ODE and LERF uncertainty intervals.

Risk Impact: For RG 1.200 compliance in order to meet Capability Category II, the mechanisms listed under Category III of the Standard are required to be qualitatively addressed.

Actual Solution:

The Uncertainty Parameters that were implemented in CAFTA were reviewed to assure the data is using the proper uncertainty parameter (Error factor or variance) according to the type of Distribution (Gamma, Beta, and Iognormal). The data notebook [Reference 42] was updated to be consistent with the CAFTA database. A list of the appropriate parameters with the distribution type is listed in the Data notebook

[Reference 42], Section 2.

Impact on ILRT Extension:

The ILRT application used the Rev. 3.2 model. These updates have been made in previous models.

Therefore, there is no impact to the ILRT extension.

Page 61 of 142 Revision 22 Page 61 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I13-0047 (IE)

Brief Problem

Description:

It appears that the Category Ill items, such as pipe whip, humidity, condensation, and temperature were not qualitatively addressed (see NRC Resolution, which is required for Cat. 11)(This F&O originated from SR IFSN-A6)

F&O Number: 8-8 Technical Element: IFSN Detailed Problem

Description:

It appears that the Category Ill items, such as pipe whip, humidity, condensation, and temperature were not qualitatively addressed (see NRC Resolution, which is required for Cat. II). (This F&O originated from SR IFSN-A6)

Proposed Solution: The mechanisms listed for Capability Category Ill should be qualitatively addressed using conservative methods and treatments to show what additional impact, if any, may be imposed on existing internal flood scenarios.

Risk Impact: Basis for Significance for RG 1.200 compliance in order to meet Capability Category II, the mechanisms listed under Category Ill of the Standard are required to be qualitatively addressed. This will have little to no impact of CDF or LERF.

Actual Solution:

Per the resolution requested from the Peer Review, a qualitative assessment was performed for the following flood failure mechanisms to meet Capability Category II criteria:

- Submergence

- Spray

- Jet Impingement

- Pipe Whip

- Humidity

- Condensation

- Temperature Spray and submergence effects are specifically discussed and accounted for throughout the Internal Flooding Accident Sequence Notebook [Reference 47] for those internal flooding scenarios that are impacted. All internal flood initiators account for submergence and spray.

Jet Impingement and Pipe Whip are assumed to have no effect on the internal flooding analysis unless specifically stated in the internal flooding scenario. This assumption is based on the research provided in NUREG/CR-3231 which found that these potential impacts of pipe breaks require very specific pipe spacing/orientation, rarely result in a complete (guillotine) break, and even if pipe break occurs, significant reduction in cross sectional area of the target pipe follows. The instances which all these conditions are met are few in MNGP and the probability of these types of events coincident with a flood initiator is sufficiently remote. Assumption #5 was added to the "General Assumption" Section 2.2 of the Internal Flooding Accident Sequence Notebook, PRA-MT-I F-AS [Reference 47].

Humidity, Condensation, and temperature effects are assumed to be encompassed in the bounding, conservative assumption that all spray floods in the MNGP flood model fail the entire room where the flood exists irrespective of room size or pipe orientation. Assumption #6 was added to the "General Assumption' Section 2.2 of the Internal Flooding Accident Sequence Notebook, PRA-MT-IF-AS

[Reference 47].

Impact on ILRT Extension:

The ILRT application used the Rev. 3.2 model. These updates have been made in previous models.

Therefore, there is no impact to the ILRT extension.

Revision 2 Page 62 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension A.4. Monticello PRA Response to Fire PRA Peer Review Findings Change Number: MT-15-0014 F&O Number: 1-18 Associated SR(s): PP-B5 Detailed Problem

Description:

During conduct of the plant walk down on 3/4/2015 two such separation elements were identified that are representative of the elements that should be credited for separation. The double doors located in the barrier separating FZ-2C and FZ-2B are held open with fusible link hold-open devices. Another example is the normally open fire damper located in the barrier separating FZ-2A and FZ-2B. These two instances are examples only and should not be considered indicative of all such occurrences. Information concerning the credit of such elements should be added to the justification for separation of such Fire Zones. Accordingly this SR is judged to be Met at CC I.

Proposed Solution: Ensure that available, active fire barrier elements are credited in the partitioning.

Basis for Significance: Satisfaction of CCII for this SR requires crediting active fire barrier elements such as active fire doors.

Actual Solution:

• Section 3.0 has been revised such that fire dampers are not included in the list of non-credited active partitioning features. Instead, the Plant Boundary and Partitioning Notebook [Reference 48] clearly states that fire dampers located in credited fire barriers are credited in the plant partitioning scheme. The failure probability of these dampers to contain fire effects is captured in the multi-compartment analysis.

• Section 3.0 has also been revised to state that normally open fire doors that are held open by a fusible link are also credited in the plant partitioning scheme. The only normally open fire doors that are credited in the analysis are Doors 41 0A and 410OB, which separate Fire Zone 2B and Fire Zone 20.

By crediting this active feature, an update to the multi-compartment analysis was also necessary.

Specifically, the barrier failure probability for these doors was set equal to a screening value of 0.1; a typical normally closed doorway is assigned a barrier failure probability of 7.4E-03.

It should be noted that no other active partitioning features, such as a water curtain, are credited in the plant partitioning scheme.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 63 of 142 Revision 22 Page 63 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0042 F&O Number: 2-3 Associated SR(s): PP-B7, PP-C3 Detailed Problem

Description:

According to the Section 4.0 of the Plant Boundary and Partitioning Notebook confirmatory walk downs of the plant partitioning was performed to verify the conditions and characteristics of the credited partitioning elements for each Fire Zone and to verify that the zone drawings reflect as-built conditions. According to the notebook the information obtained during these walk downs is documented in the Monticello Fire Modeling Database and in Tables A-i and A-2 of the notebook.

Table A-i of the plant partitioning notebook includes walk down notes which provide a list of the Fire Areas and Fire Zones that are considered in the Fire PRA. Specifically this table lists Fire Area, Fire Zone, Room Elevations, Building Name, Description, and FHA Drawing No. Table A-2 provides the confirmatory walk down documentation which entails the Fire Zone ID, originator and review initials and preparer and reviewer dates. Neither table includes information specific to partitioning element characteristics.

According to Section 4.0 of the Plant Boundary and Partitioning Notebook Fire Zone information from the plant partitioning task is contained in the Plant Fire Modeling Database (FMDB) in tables tblCompartmentlnfo, tblRooms, and tblZones. The information in these tables was reviewed and found to contain very little information concerning the partitioning element characteristics. Most of the information contained in these table concerns information associated with location (i.e., building, elevation, Fire Zone, Fire Area, transient mapping, etc.), cable loading, influencing factors, detection, suppression, instrument air details, etc. The only information that pertains to partitioning element characteristics is wall material, wall thickness, and no. of doors. These fields are populated as follows for every Fire Zone: wall material

= concrete; wall thickness = 2ft; no. of doors = 1.

Based on this review, the documentation provided does not support conduct of a confirmatory walkdown that confirmed the conditions and characteristics of credited partitioning elements.

Proposed Solution: Provide documentation that addresses the acceptability of the credited partitioning elements.

Basis for Significance: The requirement is to perform confirmatory walkdowns that confirm the conditions and characteristics of credited partitioning elements.

Actual Solution:

The appendices to the Plant boundary and Partitioning Notebook [Reference 48] have been updated to include scans of the notes taken during the confirmatory walkdowns conducted in support of the plant partitioning task. These notes provide documentation of the conditions and characteristics of credited partitioning elements.

Impact on ILRT Extension:

This is a documentation issue and is resolved. There is no impact on the ILRT Extension Risk Analysis.

Page 64 of 142 Revision 22 Page 64 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5400-CAC-0 Evauaton f Rik Sgniicace o Pemannt IRT xtesio Change Number: MT-15-0043 F&O Number: 2-4 Associated SR(s): PP-B2, PP-C3 Detailed Problem

Description:

According to the Section 3.0 of the Plant Boundary and Partitioning Notebook the FPRA credits nonrated-fire barriers as detailed in Table 3-2. Table 3-2 provides a listing of each credited non-rated-fire barrier.

The information provided includes Fire Zone, Adjacent Zone, Orientation to Adjacent Zone, Barrier Type, Construction and Walk down Comments. The walk down comments included in this table typically state

'Barrier Observed'; three exceptions provide a little detail concerning openings in the barrier. Reference is made to the Monticello Updated Safety Analysis Report, Fire Protection Program, Updated Fire Hazard Analysis Revision 30, with regard to barrier construction and to the Plant Partitioning Walk down Notes.

However, the notebook provides no justification/evaluation that would indicate that the credited non-fire-rated barriers should substantially contain the damaging effects of fire.

Proposed Solution: Provide documentation that addresses the acceptability of the credited partitioning elements.

Basis for Significance: The requirement is to JUSTIFY that the credited non-fire rated barriers will substantially contain the damaging effects of fire.

Actual Solution:

The appendices to the Plant boundary and Partitioning Notebook [Reference 48] have been updated to include scans of the notes taken during the confirmatory walkdowns conducted in support of the plant partitioning task. These notes provide documentation of the conditions and characteristics of credited partitioning elements.

Impact on ILRT Extension:

This is a documentation issue and is resolved. There is no impact on the ILRT Extension Risk Analysis.

Page 65 of 142 Revision 22 Revision Page 65 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0053 F&O Number: 4-1 Associated SR(s): PP-Al, PP-C2 Detailed Problem

Description:

The Global Analysis Boundary excludes several buildings and structures in Section 2.0 of Notebook 01601 5-RPT-02, however, and there is no detailed discussion related to the impact on an adjacent PAU such as distance between structures and/or building construction.

Proposed Solution: Provide additional documentation regarding the basis for screening of excluded structures including building construction and actual distances to adequately justify excluding the structures from potential impact on FPRA components in an adjacent PAU.

Basis for Significance: There is a potential for buildings/structures screened out of the global analysis boundary that could impact adjacent buildings/PAUs that contain FPRA components.

Actual Solution:

Section 2.0 of the Plant Boundary Definition and Partitioning Notebook [Reference 48] has been revised to more clearly document the basis by which buildings within the global analysis boundary were screened.

Revision 0 of the Plant Boundary Definition and Partitioning Notebook [Reference 48] screened a number of the locations on the basis that the screened building did not contain plant systems or components contributing to fire risk.

The revised Plant Boundary Definition and Partitioning Notebook [Reference 48] includes an evaluation of the potential impacts of fires occurring in these screened locations. Specifically, this evaluation ensures that a fire occurring in these screened locations will not impact plant systems or components contributing to fire risk that are located in other plant buildings within the global analysis boundary.

Impact on ILRT Extension:

The F&O is resolved. There is no impact on the ILRT Extension Risk Analysis.

Revision 2 Revison 2Page 66 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0008 F&O Number: 1-12 Associated SR(s): ES-Al, ES-A3, ES-A4, ES-A5, ES-A6 Detailed Problem

Description:

A review for plant-specific MSOs was performed as part of the expert panel process, but the FPRA development team did not produce documentation of a thorough review. Therefore the identification of equipment including spurious operation related to initiating events or plant response may not be complete. Plant-specific MSO review would include, but is not limited to, 1) a P&ID review of all plant systems for potential MSO scenarios that impact the FPRA development, 2) identification of ISLOCA pathways screened from the FPIE PRA and, 3) for LERF, a review of containment isolation pathways screened from consideration from FPIE LERF that are relevant to the FPRA LERF PRM in the context of fire-induced spurious operations.

Proposed Solution: Perform a more thorough review of MNGP plant systems for potential MSO scenarios that are not addressed by the generic BWR MSO scenarios, including plant-specific spurious operations or MSO scenarios that cause or contribute to initiating events, or plant response.

Basis for Significance: Review for plant-specific MSOs would potentially identify spurious operations that cause or contribute to initiating events.

Actual Solution:

After the peer review, a plant-specific MSO review was held. An expert panel was re-convened with most of the members of the original FPRA MSO review panel taking part. The panel included experts from PRA, safe shutdown, and plant systems. During the meeting the panel reviewed P&lDs of all plant systems for potential MSO scenarios that impact the FPRA development, ISLOCA pathways and also containment isolation pathways. It was determined that all of the plant-specific MSOs had been identified previously and were included in the original MSO review.

The review of the plant-specific MSOs is now clearly referenced in the ES notebook [Reference 49].

Impact on ILRT Extension:

The F&O resolution identifies that the FPRA model accounted for all MSOs. The documentation has been updated to reflect the resolution. There is no impact to the ILRT Extension Analysis.

Revision 2 Revison 2Page 67 of 142

54003-CALC-02 of Risk Significance of Permanent ILRT Extension 5400-CAL-02Evaluation Change Number: MT-15-0010 F&O Number: 1-14 Associated SR(s): ES-Cl Detailed Problem

Description:

Section 5.5, Table 3 and Table 4 identify additional mitigating, instrumentation, and diagnostic equipment important to human response in the event of a fire. The peer review examined the instruments identified and issues were identified:

MHVPLOCAL-YEF - No cues are identified (HFE is not in the table).

No cue appears to be modeled for ALT-OIL-Y, yet Table 3 lists FI-4393 as a cue.

The ALOWFUEL-Y is used for DG 1 and DG 2 modeling but selects instrumentation for DG 13. DG 13 was used as a proxy for the other two diesels. The day tank instrumentation is not correct for 13 DG and should be revisited to model the correct instruments.

No cues are modeled for ALT-I NJ-PB-Y and ALT-INJ-PD2-Y. The FPRA development team indicated during the review week that: 'For these HFEs, there is no significant dependency on indication. The failure of all high pressure and low pressure injection systems cannot be missed by the operators, which will lead them to explore alternate means of injection.' However, no review was performed of the potential for spurious indication (ES-C2) to mislead the operators regarding status of core cooling I operation of an EGOS pump.

C4H-EASY-Y - Loss of ammeter / voltmeter for either load center appears to fail the operator action for both load centers, which appears conservative.

ALOWFUELHY and ALOWFUEL-Y were carried over from the internal events PRA and are anticipated to be removed in the next revision of the Internal Events model due to plant modifications. Based on this, the Fire PRA may also be updated accordingly to remove these HFEs. In the case these HFEs are elected to remain in the Fire PRA model, the underlying cue modeling may need further refinement to tie each tank to its associated indication. FS-3236 and FS-3237 are in the model under gates A-INSTR-11I and A-INSTR-12.

Cues listed for ADG13BFD-Y in ES notebook Table 3 are FIDGI/C-08 and F/DG2/C-292. The HRA Calculator indicates that both cues are needed to perform the action. Only F/DGI/C-08 modeled (gate AA024-1). The FPRA development team indicated during the review week that: 'In case of SBO, there will be multiple cues in the control room (loss of lights, loss of equipment) that will lead the operators to use OGi13 as a backup to feed essential loads. It seems that Basic Event AICC08FRQR was conservatively inserted here and could be removed altogether from Gate AAO24-1.' Therefore further work is needed to ensure the modeling and documentation are reasonable I representative.

Cues for ALTBATCHGY documented as 'No indication, visual verification,' which is unclear. The FPRA development team indicated during the review week that: 'This HFE is related to ADG1 3BFD-Y, discussed previously. In case of SBO, it is expected that there would be multiple cues that would lead the operators to provide power to battery chargers, making the direct modeling of such cues in the model unnecessary.' Therefore further work is needed to ensure the modeling and documentation are reasonable I representative.

ALTINJNOMY: Remarks for ALTINJNOMY say Reactor water level at ASDS, but the gate modeled for the cues for ALTINJNOMY is the same gate modeled for ALTINJMINY and ALTINJHRSY. The FPRA development team indicated during the review week that: 'The notebook indicates that reactor water level indication is available at the ASDS panel, but this key monitoring indication is also available in the control

.room.' Further work is needed to ensure the modeling and documentation are reasonable I representative.

Proposed Solution: Identify instrumentation that is relevant to the operator actions for which HFEs are defined or modified to account for the context of fire scenarios in the Fire PRA, per SRs HRA-BI and HRA-B2.

Basis for Significance: Several issues identified, and therefore a finding is assessed.

Revision 2 Page 68 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Actual Solution:

MHVPLOCAL-YEF - The HFE name is actually "MHPVLOCAL-YEF". The cue for this HFE identified by the Fire HRA is drywell pressure above 2 psig, so the HFE and its associated instrumentation were added to Table 3 of the ES Notebook [Reference 49] and to the FPRA model.

ALT-OIL-Y - The ES Notebook [Reference 49] was corrected to remove FI-4393. The cue for ALT-OIL-Y is that the alternate means to provide fuel to the DGs has failed. The current FPRA modeling is correct, but will be coordinated in the future with changes to the internal events model along with related HFEs ALOWFUEL-Y and ALOWFUELHY (see below).

ALOWFUEL-Y and ALOWFUELHY -

ALOWFUELHY has been removed from the internal events model and the modeling of the diesel oil system has been revised to include the following HFEs:

OALTIL.Y Fail to align fuel oil supply from gas powered pump or supply DFP tank with division 1 FOTPs OLOWFUEL-Y Fail to start second diesel oil pump in division iffirst pump fails There are 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> available to refuel the diesel generators (as indicated in the time window data of the HFE*), at which point the fire is expected to be extinguished. The operators would be aware that the fuel supply to the diesel needs to be checked. In particular, Step 1 of sections E.1 and E.2 of Operations Procedure B.09.08-05 directs the operators to record EDG parameters on the log sheet contained in procedure 2301, EDG Operating Logs. Procedure 2301 requires hourly logging of Day Tank Fuel Oil Level as well as Base Tank Fuel Oil Level for an EDG that is in operation. Within the fuel oil day tank room for each of the EDG's, there is a local level indicator (LIS-1 528 and LIS-1 529) for the day tanks (T-45A, and T-45B respectively). Mounted on each of the EDG base tanks, there is base tank fuel oil level indication. Thus, indication for the level would always be available (as least as long as the fire is not in the room, but if it is, the tank is not credited in the Fire PRA). Therefore, the current modeling of the Fire PRA, which includes failure of the human actions by fire-induced loss of level sensors is conservative and overestimates the risk.

ALT-INJ-PB-Y and ALT-INJ-PD2-Y - BWR flow charts are designed to prompt multiple parameter checks for RPV level, RPV pressure and drywell pressure. Given the list of indications for these HFEs in ES Notebook [Reference 49] Table 3, it is unlikely that a single spurious indication could mislead the operators. In addition, spurious indications for these level and pressure instruments are routinely addressed in operator classroom and simulator training. Therefore, no specific review is planned.

C4H-EASY-Y - No ammeter/voltmeter is needed, so the instrumentation gate associated with this HFE was deleted from the model. The ES notebook [Reference 49] removed the instruments from Table 3.

ADG1 3BFD-Y - No frequency meter is needed, therefore basic event AICC08FRQR was deleted from the FPRA model. The ES notebook [Reference 49] removed the instruments from Table 3 and change the Remarks to, "In case of SBO, there will be multiple cues in the control room (loss of lights, loss of equipment)."

ALTBATCHGY - In case of SBO, it is expected that there would be multiple cues that would lead the operators to provide power to battery chargers, the direct modeling of such cues in the model is unnecessary and so was deleted from the FPRA model. This was coordinated with the model changes for ADG13BFD-Y and the text in Table 3 of the ES Notebook was clarified [Reference 49].

ALTINJNOMY, ALTINJMINY and ALTINJHRSY - The current modeling strategy is considered to be correct. Alternate injection will be performed from the control room, using the instrumentation available there.

To address the F&O, the following actions were taken:

• Changed Table 3 of the ES Notebook [Reference 49] to include the control room indication; Page 69 of 142 Revision 22 Page 69 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension

• Clarified the note in Table 3 of the ES notebook [Reference 49] to state that RPV level indication is also available at the ASDS panel, as modeled by Gate L-RX-LVL (LI-41 08 and LI.-41 07 are indications at the ASDS panel);

• In the fault tree, clarified at Gate L-RX-LVL that the indication is located at the ASDS panel.

Impact on ILRT Extension:

The impact of this HEP is small because the action timing is long. There is negligible impact to the ILRT Extension Analysis.

Page 70 of 142 Revision 2 Page 70 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0011 F&O Number: 1-15 Associated SR(s): ES-C2 Detailed Problem

Description:

No documentation is provided of a review to identify instrumentation associated with each operator action to be addressed in the FPRA whereby one of the modes of failure to be considered is spurious operation of the instrument.

Proposed Solution: Identify instrumentation associated with each operator action to be addressed in the FPRA based on fire-induced failure of any single instrument whereby one of the modes of failure to be considered is spurious operation of the instrument.

Basis for Significance: The potential for fire-induced spurious operations of instrumentation to impact the successful performance of operator actions needs to be considered.

Actual Solution:

The Fire NRA Notebook [Reference 45] Appendix G documents the detailed procedure review that was performed to identify single instruments that if spuriously operated would be likely to cause an undesired operator response because there was no clear requirement in the procedure to check or verify the instrument reading before taking an action. Such instances are rare due to continual industry and internal plant reviews of procedures.

As a result of this review, fifteen (15) such procedure cases (involving eighteen different instruments) were identified and are listed in Fire NRA Notebook Table 5-2 [Reference 45]. a further review was performed by Xcel staff with significant system and operations knowledge, as well as by the fire HRA team. As a result of this review, the updated disposition of the eighteen (18) indications is the following:

• Nine (9) were not credited in the fire PRA model because the equipment associated with the instruments is already considered failed during a fire;

• Four (4) were found to have been miscategorized as leading to an undesired action because operator disablement of the system or equipment when it is specifically required to function is not considered credible.

• Three (3) were not modeled because the postulated undesired operator action, to shut down equipment one by one until the ground is identified, is not considered credible, given that operators are generally aware of potential spurious signals caused by fire; and

• Two (2) were not needed in the model because the cable-induced failure causing the spurious indication already causes the failure of the component (EDG) functional state.

Table 5-2 of the Fire NRA Notebook [Reference 45] has been updated accordingly and the Equipment Selection [Reference 49] Notebook section 5.5.2 was revised as necessary to include documentation of this update.

Regarding spurious operation of instruments associated with modeled operator actions (HFEs), as noted in F&O 1-22, the fire NRA modeling strategy has been to presume degraded cues and to penalize the HFE on that basis. This strategy is consistent with the guidance in NUREG-1 921 for considering the impact of confusing or less than optimal cues due to fire on operator performance.

Impact on ILRT Extension:

The F&O resolution identifies documentation updates that have been completed. There is no impact on the ILRT Risk Extension Analysis.

Page 71 of 142 Revision 22 Page 71 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0012 F&O Number: 1-16 Associated SR(s): ES-Al, ES-A4, ES-A5, ES-A6 Detailed Problem

Description:

The FPIE initiating events analysis reviewed plant systems for initiating events potential and screened out the systems as applicable. No documentation was provided for the FPRA development to review this screening to determine whether any screening performed for the FPIE is not applicable in the context of fire. The peer review examined this list in the FPIE internal events notebook and identified one system to consider for inclusion in the FPRA: Off gas holdup. Failure of the system can cause loss of condenser vacuum, and this is implicitly treated in the EPIE PRA by the loss of condenser initiating event. However, such impact could result from fire damage, and therefore would need to be considered for the FPRA equipment selection.

Proposed Solution: Review the FPIE initiating events development for screening of initiating events for internal events that do no remain valid in the context of fire, and include the applicable equipment on the FPRA equipment list.

Basis for Significance: Systematic issue Actual Solution:

All systems that were considered for initiating events in the FPIE were considered for the FPRA. No systems that were screened for the internal events initiating events analysis were required to be added for the FPRA.

The offgas holdup system is considered in the Fire PRA and is modeled in the CDR (Main Condenser) system tree. Components from this system were included in the FPRA ES and had cable selection performed. This system was modeled in the FPRA at the time of peer review and is still included in the current model.

The following offgas holdup system components are modeled in the FPRA. Details about how these are modeled can be found in the ES database and PRM model.

BE NAME BE Description Passport Equipld GCMCl001AR12 Offgas compressor C-i1001A fails to run C-i1001A GCMC1001BRl2 Offgas compressor C-i1001B fails to run C-1001B GCMCl001lBS OG COMPRESSOR C-I O01B FAILS TO START C-l00iB GCMC1002AR12 Chiller compressor C-i1002A fails to run C-1002A GCMC100O2BR1 2 Chiller compressor C-1002B fails to run C-1002B GCMC1 002BS CHILLER COMPRESSOR C-1002B FAILS TO START C-i1002B GPMP100O2AR1 2 CHILLED WATER PUMP P-i1002A FAILS TO RUN P-i1002A GPMP100O2BR1 2 CHILLED WATER PUMP P-i1002B FAILS TO RUN P-i1002B GPMPI1002BS CHILLED WATER PUMP P-i1002B FAILS TO START P-i 002B GVACV1 928F AOV CV-i1928 FAILS TO REMAIN OPEN CV-i1928 GVACV7583F AOV HCV-7583 FAILS TO REMAIN OPEN HCV-7583 GVACV7583N AOV HCV-7583 FAILS TO OPEN HCV-7583 Impact on ILRT Extension:

This F&O is resolved. The model included the appropriate treatment for all Internal Event model initiating events. There is no impact on the ILRT Extension Risk Analysis.

Page 72 of 142 Revision 22 Page 72 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0018 F&O Number: 1-21 Associated SR(s): HR-Fl, HR-F2, ES-C2, HRA-B4, HRA-E1 Detailed Problem

Description:

No documentation of inclusion of the undesired operator actions documented in Table 5.2 of the HRA notebook into the FPRA was provided in the FPRA notebooks, in particular the plant response model notebook.

The peer review observed that impacts for level transmitters related to undesired actions (LS-1 3-74, FT-1095A, FT-i1095B) were modeled incidentally in the FPRA, but the functional states related to spurious operation were not included for these transmitters on the FPRA equipment list nor included in the FPRA, and no corresponding undesired HFEs were defined. 150/151-510-A and 150/151-510-B and 150/151-510-C are related to a potential undesired action that could stop P-61, but no functional states related to spurious operation were identified in the equipment selection nor included in the FPRA and no undesired HFE was modeled. The FPRA development team indicated that P-61 is assumed to be failed for the FPRA development, but the review team suggests that it is better to include the modeling and assume that it also is failed (due to the potential that later PRA updates could credit P-61, and this potential undesired action would need to be captured).

No functional states related to spurious operation were identified in the equipment selection nor included in the FPRA and no undesired HFE(s) was modeled related toTS-7048, TS-7056, TS-7050, TS-7058.

The FPRA development team indicated that the undesired HFE(s) that would arise from spurious operation of these instruments related to SW operation, which they indicated was not modeled in the FPRA. However, SW was observed to be modeled in the FPRA.

No functional states related to spurious operation were identified in the equipment selection nor included in the FPRA and no undesired HFE(s) was modeled related 186-502, TIS-7320, 159N/DGI, and 159N/DG2. (This F&O originated from SR HRA-B4)

Proposed Solution: Include HFEs for cases where fire-induced instrumentation failure of any single instrument could cause an undesired operator action.

Basis for Significance: The FPRA does not included modeling of HFEs for cases where fire-induced instrumentation failure of any single instrument could cause an undesired operator action.

Actual Solution:

As stated in the response to F&O 1-15, Fire HRA Notebook [Reference 45] Table 5-2 lists the fifteen (15) procedure cases (involving eighteen different instruments) that were originally identified where single instrument spurious operation was considered likely to cause an undesired operator response.

In response to this F&O, a further review was performed by Xcel staff with significant system and operations knowledge, as well as by the fire HRA team. As a result of this review, the updated disposition of the eighteen (18) indications is the following:

• Nine (9) were not credited in the fire PRA model because the equipment associated with the instruments is already considered failed during a fire;

• Four (4) were found to have been miscategorized as leading to an undesired action because operator disablement of the system or equipment when it is specifically required to function is not considered credible.

• Three (3) were not modeled because the postulated undesired operator action, to shut down equipment one by one until the ground is identified, is not considered credible, given that operators are generally aware of potential spurious signals caused by fire; and

• Two (2) were not needed in the model because the cable-induced failure causing the spurious indication already causes the failure of the component (EDG) functional state.

Revision 2 Revison 2Page 73 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Table 5-2 of the Fire HRA Notebook [Reference 45] has been updated accordingly and the Equipment Selection Notebook [Reference 49] was revised as necessary to include documentation of this update (Section 5.5.2).

It should be noted, however, that in several cases, it has been suggested that a warning could be added to the procedure in question that the signal is spurious in case of a fire in particular Fire Zones.

Impact on ILRT Extension:

The F&O resolution indicates that documentation of the review has been added to the Fire HRA notebook

[Reference 45]. This F&O has no impact on the ILRT Extension Risk Analysis.

Page 74 of 142 Revision 22 Page 74 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0029 F&O Number: 1-35 Associated SR(S): ES-C2 Detailed Problem

Description:

Instruments were identified from the review of ARPs whose spurious operation could result in undesired operator actions, but it is not clear from the FPRA documentation whether these instrument spurious operations were added to the FPRA equipment list. Later confirmation was made during the review that some of the identified instruments were not added to the FPRA equipment list.

Proposed Solution: Include instrumentation whose fire-induced failure, including Spurious indication, even ifthey are not relevant to the HFEs for which instrumentation is identified within the scope defined by ES-Cl, on the FPRA equipment list if the failure could cause an undesired operator action related to that portion of the plant design credited in the analysis.

Basis for Significance: Instrumentation whose fire-induced failure, including spurious indication, even if they are not relevant to the HFEs for which instrumentation is identified within the scope defined by ES-Cl, is to be included on the FPRA equipment list ifthe failure could cause an undesired operator action related to that portion of the plant design credited in the analysis.

Actual Solution:

As stated in the responses to F&Os 1-15 and 1-21, the fifteen (15) procedure cases (involving eighteen different instruments) that were identified where single instruments that if spuriously operated would be likely to cause an undesired operator response are listed in Fire HRA Notebook [Reference 451 Table 5.2.

The scope defined by ES-Cl refers to HRA-Bl, which in turn refers to HRA-Al, whose scope is the internal events HFEs carried over to the fire HRA. The procedure review included the full spectrum of AOPs, EOPs and ARPs, not just those associated with the internal events HFEs credited in the Fire PRA.

The results of the procedure review are summarized in Table 5.2 and documented in detail in Appendix G of the Fire HRA notebook [Reference 45].

Upon the issuance of the question posed in this and other F&Os during the Peer Review, the list of instrumentation identified in Table 5.2 was reviewed by Xcel staff with significant operations and training background, as well as by the fire HRA team. As a result, the updated disposition of the eighteen (18) indications is the following:

• Nine (9) were not credited in the fire PRA model because the equipment associated with the instruments is already considered failed during a fire;

• Four (4) were found to have been miscategorized as leading to an undesired action because operator disablement of the system or equipment when it is specifically required to function is not considered credible.

• Three (3) were not modeled because the postulated undesired operator action, to shut down equipment one by one until the ground is identified, is not considered credible, given that operators are generally aware of potential spurious signals caused by fire; and

• Two (2) were not needed in the model because the cable-induced failure causing the spurious indication already causes the failure of the component (EDG) functional state.

Table 5-2 of the Fire HRA Notebook [Reference 45] has been updated accordingly and the Plant Response Model [Reference 50] and Equipment Selection Notebook [Reference 49] will be revised as necessary to include documentation of this update.

It should be noted, however, that in several cases, it has been suggested that a warning could be added to the procedure in question that the signal is spurious in case of a fire in particular Fire Zones.

Impact on ILRT Extension:

The F&O resolution indicates that documentation of the review has been added to the Fire HRA notebook

[Reference 45]. This F&O has no impact on the ILRT Extension Risk Analysis.

Revision 2 Page 75 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0089 F&O Number: 5-2 Associated SR(s): ES-A1, ES-A4, ES-A5, ES-A6, ES-B2 Detailed Problem

Description:

The evaluation of potential MSOs included in the Equipment Selection and Plant Response Model Notebooks, 01601 5-RPT-03, were, in general, found to be very narrowly focused and based largely on the assessments originally developed for fire safe shutdown. Further, a review of these assessments revealed incomplete evaluation or treatment of various MSOs. Specific examples are cited below:

MSO 2a - Spurious head vent was scr'eened based on line size for the safe shutdown analysis. However, spurious head vent involves a loss of RCS integrity and needs to be retained per ES-A5 and equipment are to be placed on the FPRA equipment list.

MSO 2b - The MSO was considered by the FPRA development to be a high consequence initiation event (non-isolable LOCA outside containment). It was evaluated as such, and determined to require four spurious actuations. Therefore, it was not required to be added to the model, per ES-A6. However, the peer review noted that three spurious actuations will produce MSO 2b: two MSIVs spuriously open on a steam line (inboard and outboard), and one of two turbine bypass valves fail to close (BPV-1 1 or BPV-12), and therefore will be retained per ES-A6 and equipment placed on the FPRA equipment list and developed in the plant response model.

MSO 2i Spurious Drywell Spray valves - There is no discussion of impact on LPCI.

MSO 2d - Not modeled, based on small LOCA leakage potential (40-70 gpm). However, MSO 2d involves a loss of RCS integrity and needs to be retained per ES-AS and equipment are to be placed on the FPRA equipment list.

MSO 2e - This MSO involves a fire induced LOCA through the SCRAM discharge volume; screened from the FPRA equipment list using cable selection I routing arguments. Cable selection / routing arguments are not applicable to the equipment selection process and are not an applicable bases for ES screening.

MSO 5g - Asynchronous paralleling of onsite power sources. Included in the model, but the potential initiating event impacts are not documented. Support system initiating events are modeled by the general transient event tree in the MNGP PRA model, so probably a documentation issue only, unless the loss of two buses due to the asynchronous paralleling alters the applicability to the general transient event tree.

MSO 2-New Potential pumping of suppression pool to the CST. Screened based on plant modifications to prevent pumping of suppression pool to the CST. Regardless of modifications, the pertinent equipment would need to be included on the FPRA equipment list unless a means is found to screen them (e.g., based on the number of spurious operations, or based on passive devices such as orifices or manual valves). If orifices used, would need to reference the thermal hydraulic calculation.

MSO 21, 2-new-6 Assessment of spurious CS or RHR without flow paths does not include impact on the increase in temperature of the suppression pool from spuriously running pumps. Also, the potential impacts from pump running on minimum flow for an extended period not discussed (the possibility for pump damage). The potential for pump dead-heading was addressed by assessment of MSOs through plant modifications. Modifications address fire safe shutdown, but it is not clear whether these modifications permit screening from the PRA / FPRA equipment list.

MSO 2m Assessment seems to be inconclusive. It states that three phase hot shorts 'appear to be required'. It also references a manual valve that is not identified on the drawings. This is only a documentation issue only; there is need only to clarify the documentation.

Flow diversion scenarios for HPCI and RCIC do not evaluate transfer of inventory from Pool to CST and vice versa (including CST overfill)

MSO 4r,s,t,u - Containment overpressure is not included in the model, despite being critical to the operation of CS and RHR pumps. Justification is provided for exclusion of major valves, but there was no evaluation of all of the potential spurious operations that could reduce containment overpressure. In addition, the MSO evaluation report identifies several treatments for alternate safe shutdown.

Modifications address fire safe shutdown, but it is not clear whether these modifications permit screening Revision 2 Page 76 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension from the PRA I FPRA equipment list (For example, one plant modification made for 4s allows fire safe shutdown to address the MSO from the alternate shutdown panel. The PRA may model scenarios that don't involve alternate shutdown that could be impacted by MSO 4s).

MSO 5a This MSO is not addressed. The modeling only treats failure of load shed. It does not address diesel challenges due to simultaneous 9or out of sequence) breaker closures or overloading due to multiple sequential breaker closures.

MSO 5d The evaluation of spurious RHRSW does not take into account that RHRSW flow path is normally isolated by valves at the heat exchangers.

MSO 5f It is not clear that the evaluation of paralleling the Diesel with offsite power is complete. Divisional separation does not provide an allowable basis to screen equipment from the FPRA equipment list. It only addresses 'most cases' and refers to a mod on only one of the diesel generators.

There is no discussion of combinations of MSOs e.g., cumulative impact on inventory control function of SORV plus head vent, or multiple recirc pump fail to trip, etc.

MSO 5h - Based on discussion with FPRA development team, MNGP switchyards are synchronized, however, it was difficult for the review team to ascertain this from the documentation.

There is no discussion of combinations of MSOs such as spurious head vent plus a single SRV, or failure of two recirc pumps to trip.

Proposed Solution: Complete review of generic MSOs and address MSO combinations.

Basis for Significance: This F&O is classified as a finding as several of the MSOs in question could prove to be risk significant.

Actual Solution:

After the peer review, generic MSOs evaluations were reviewed and revised to provide additional detail and clarification, and include new evaluations for a number of MSOs. MSO combinations were considered and addressed where applicable. Updated MSO evaluations are documented in the Equipment Selection [Reference 49] and Plant Response Model Notebooks [Reference 501. The specific concerns cited in this F&O were addressed as follows:

MSO 2a - Evaluation revised to provide details related to the basis for screening; the scenario is screened based on thermal-hydraulic analysis performed and documented in EC 20901 and EC 20902.

MSO 2b - MSO developed and included in model. Evaluation revised.

MSO 2i - EC 20669 QF-0525 installs a shorting circuit using control room switches 10A-S9AIB for RHR Valves MO-2020 and MO-2021, respectively. The installation of a shorting circuit ensures that the RHR Drywell Spray Outboard Isolation Valves, MO-2020 (Division 1) and MO-2021 (Division 2), remain in their normal closed position in the event of a fire. No operator action is required to preclude spurious opening of MO-2020 or MO-2021.

MSO 2d - Evaluation revised to provide details related to the basis for screening; the scenario is screened based on thermal-hydraulic analysis performed and documented in EC 20901 and EC 20902.

MSO 2e - Evaluation revised to provide details related to the basis for screening; the scenario is screened based on thermal-hydraulic analysis performed and documented in EC 20901 and EC 20902.

MSO 5g - Evaluation was revised to include a discussion of how the MSO was incorporated into the model sequence logic.

MSO 2-New-2 - Evaluation revised to discuss consequences of all potential sources of water to the CST.

MSO remains screened. Evaluation of flow diversion scenarios for HPCI and RCIC that transfer inventory from Pool to CST and vice versa (including CST overfill) are included.

MSO 21, 2-new The evaluation of MSO 2-new-6 includes the assessment of the CS and RHR spurious starts. An increase in temperature of the suppression pool is not considered for evaluation at MNGP due to timing for the event.

MSO 2m - Documentation issue only. Evaluation revised to clarify.

MSO 4r,s,t,u - Evaluations revised to address all of potential spurious operations that could reduce containment overpressure. EC 20901 includes MSO's originally screened out as being "insignificant" to Revision 2 Page 77 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension assess the risk of combined MSO's, up to a maximum of four simultaneous spuriously operating components. In all MSO cases, the acceptance criteria are met. It was determined upon review of MSO 4r that its disposition was sufficient.

MSO 5a - MSO evaluation provided to address potential DG failures due to additional components loading. Evaluation includes input from plant systems analysts.

MSO 5d - The evaluation was updated to further clarify that the spurious start of the RHRSW pumps is not included due to the current modeling bounding the MSO. The CVs that isolate the RHRSW pumps are modeled in the logic and fail the pump. A spurious start of the pump would also require a failure of the CVs, which is already modeled. Therefore modeling spurious start of the pump is unnecessary.

MSO 5f - The evaluation was updated to clarify that the modification installed precludes the MSO from occurring.

MSO 5h - Evaluation revised to discuss switchyard breaker operation. All are controlled either locally in the subyard and/or from the grid system control center. The only breakers in the switchyard that can be operated from the Monticello Plant Control Room are the main generator output breakers.

Text was added to the MSO section to clarify that combinations of MSOs, such as spurious head vent plus a single SRV, or failure of two recirc pumps to trip, were considered during the MSO expert panel meeting, but no additional scenarios were identified.

The updated MSO evaluations are included in the referenced ES and PRM notebooks [References 49 and 50].

Impact on ILRT Extension:

Each MSO issue has been addressed and the model has been revised. There is no direct impact to the ILRT Extension Analysis.

Page 78 of 142 Revision 22 Page 78 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0090 F&O Number: 5-3 Associated SR(s): ES-B1, ES-DI Detailed Problem

Description:

The following deficiencies were noted in the ES documentation:

1. There is no documentation of the basis for exclusion of SSEL components. This had to be provided informally by the PRA team.

2. The list of screened components in Table D-1 includes events that should retain their random failure values as well as those that should be failed.

3. The MSO evaluation table is not consistent in use of 'not modeled' vs 'modeled' in its disposition column. In some cases these entries conflict with the discussion of the assessment of the MSO.

4. In some cases, the MSO Evaluation table in the ES report is not consistent with the similar table in the PRM report.

5. These are several basic events that have no basis for screening in table D-1.

Proposed Solution: Provide a separate table that includes disposition of all SSEL components and make changes as necessary to ensure consistency, completeness and clarity of documentation.

Basis for Significance: This is considered a finding based on the need for additional information to be provided in order to evaluate SR ES-B2.

Actual Solution:

1. The documentation of SSEL dispositions is included in the updated ES notebook [Reference 49] and ES database.

2. The update ES notebook [Reference 49] includes updated text that indicates that all screened components will retain their random failures. There is also now a column that indicates if a component is always failed in the model.

3. The MSO table in the updated notebook text is updated to reflect the proper "modeled" or "not modeled" dispositions.

4. The MSO tables in the updated ES report and PRM report have been revised so they are consistent.

5. A review of the basic events in D-1 was performed and the updated ES Notebook [Reference 49]

includes a screening basis for all entries.

Impact on ILRT Extension:

This documentation F&O has been resolved. There is no impact on the ILRT Extension Risk Analysis.

Page 79 of 142 Revision 22 Page 79 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0091 F&O Number: 5-4 Associated SR(s): ES-Al, ES-A4, ES-A5, ES-A6, ES-B2 Detailed Problem

Description:

Fault propagation sequences (single spurious or no spurious) are not modeled and can have a significant impact on mitigation. An example would be the fault of a 4 kV load cable and damage to its breaker of dc power source that prevents the breaker from opening. The incoming breaker (from offsite power or diesel) would open de-energizing the bus. If the incoming breaker is also impacted, the sequence could include loss of the next upstream bus as well.

Proposed Solution: Include fault propagation logic in the model for breakers with separate control circuits.

Basis for Significance: This F&O is a finding given that the omitted sequences have a high potential to be risk significant.

Actual Solution:

A review was performed of the fault propagation sequences that could occur for specific fire scenarios.

The cable pairs that can cause the faults on the upstream buses were checked to ensure that all pairs that were both failed in specific fire scenarios had the upstream bus failures included in the scenarios as well. This process was documented in the PRM notebook [Reference 50].

Impact on ILRT Extension:

The resolution to the F&O indicates that fault propagation is appropriately modeled. There is no impact on the ILRT Extension Analysis.

Page 80 of 142 Revision 22 Page 80 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0092 F&O Number: 5-5 Associated SR(s): CS-B 1, CS-C4 Detailed Problem

Description:

For power supplies addressed by existing coordination analyses, the studies must be reviewed to confirm coordination exists for fire PRA credited power supplies for the configurations credited in the fire PRA. In some cases a study may conclude that a power supply is not coordinated, requires credit for cable length to achieve coordination, or is only coordinated in certain power distribution configurations (e.g., not cross-tied).

For power supplies not previously evaluated, the evaluation must be performed.

For those power supplies credited in the fire PRA that are not adequately coordinated, adjustments to the cable mapping and/or modeling of the components must be made. (This F&O originated from SR CS-BI)

Proposed Solution: Review existing overcurrent protection analyses to confirm that coordination exists for fire PRA credited power supplies for the configurations credited in the fire PRA. Evaluate power supplies not addressed by existing calculations. Identify any additional circuits and cables whose failure could challenge power supply availability due to inadequate electrical overcurrent protective device coordination.

Basis for Significance: An evaluation of electrical coordination was not performed and has the potential for risk significant impact on the fire PRA.

Actual Solution:

This is an open F&O. A sensitivity analysis is documented in the Fire PRA Sensitivity and Uncertainty Notebook section 5.3.1 [Reference 40]. The sensitivity analysis summary is documented in section 5.3.5 of this calculation.

Impact on ILRT Extension:

A sensitivity was performed in Section 5.3.5 to assess the potential quantitative impact of incorporating power supply coordination into the Fire PRA. The results of the sensitivity study show a very small increase in the Fire CDF and LERF. Therefore, there is negligible impact from this open F&O on the usage of the Fire PRA CDF and LERF in the ILRT Extension Risk Analysis.

Page 81 of 142 Revision 22 Revision Page 81 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0093 F&O Number: 5-6 Associated SR(s): CS-Cl Detailed Problem

Description:

The review team noted the following documentation items associated with the CS element:

1. Assumption number 4 in Section 4 of the CS notebook states: 'It was assumed that the cable selection and circuit analysis that supported the Appendix R Safe Shutdown Equipment List (SSEL) was complete and correct. This information as previously documented in the Monticello Appendix R Database (MNGP APPR.mdb) as part of the Appendix R Safe Shutdown Analysis (SSA). A review of these components was completed to determine ifthe cable selection for Appendix R was appropriate and/or bounding for Fire PRA applications'. Per interview with FPRA development team, existing Appendix R circuit analyses were, in fact, not assumed to be complete and correct. Each package was validated using modern criteria - not simply reviewed for applicability. This is an important and necessary activity and the documentation should be clarified to identify that it was performed. Section 5.2 should also be revised.

2. In Table B-5 of the ES notebook, MSIV-ISOL-A:AvaiI:Avail is not currently used in the fire PRA and can be deleted.

3. Table 0-1 of the ES notebook, which identifies relays screened from CS, also includes relays that are 'included' by virtue of equivalence to other components or pseudo-components. Additional data should be provided to identify how they are included (reference the analyzed event), and would be better presented in a separate table.

(This F&O originated from SR CS-C2)

Proposed Solution: Make the necessary document changes.

Basis for Significance: This is considered a finding as item I is the validation of a critical input and must be properly represented in the documentation.

Actual Solution:

1. Assumption 4 of Section 4.0 and Case I of Section 5.2 has been updated to better clarify that Appendix R circuit analysis packages were validated for usage in the Fire PRA.

2. N/A to this notebook, update performed in the PRM notebook [Reference 50].

3. N/A to this notebook, update performed in the ES notebook [Reference 49].

Impact on ILRT Extension:

This documentation finding has no impact on the ILRT Extension Analysis.

Page 82 of 142 Revision 22 Page 82 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0094 F&O Number: 5-7 Associated SR(s): CS-Al Detailed Problem

Description:

The circuit analyses for some pseudo-components were found to be broad and merit further refinement.

For example, the circuit analyses for the spurious ADS pseudo-components include cables that are must fail in combination to result in spurious ADS.

Proposed Solution: Refine circuit analyses associated with risk significant failures.

Basis for Significance: Conservatisms exist in circuit analysis associated with risk significant failures.

Actual Solution:

The circuit analysis for pseudo-components and all components are analyzed at a functional state level to match the basic events in the Fire PRA model. All risk significant basic events as identified during cutset reviews are evaluated to determine whether further detailed circuit analysis can be performed in order to reduce any conservatisms in the circuit analysis of the corresponding function state.

The circuit analysis and function states for the ADS pseudo-components were developed in the MNGP Fire PRA at a train level (A and B) instead of for each ADS Initiation relay due to the common cables (different conductors) associated with the 2E-K6A and 2E-K7A relays (similar for B), see drawing NX-7831-143-2. This cable routing on the main scheme of the pseudo eliminates some of the conservativeness of the ADS Initiation relay contacts being in series with each other, see NX-7831-143-2.

However, conservatism does exist in the pseudo components by including off scheme cables that affect the spurious actuation of relays 2E-K6A and 2E-K7A.

For the ADS pseudo-components, the circuit analysis has now been broken down from two pseudos into four, one for each ADS Initiation relay.

ADS-CHANN EL-K6A:Avail:Non-Spur ADS-CHANN EL-K7A:Avail:Non-Spur ADS-CHANNEL-K6B:AvaiI:Non-Spur ADS-CHANN EL-K7B:Avail:Non-Spur The Fire PRA model has been updated to incorporate AND gate logic of each ADS Initiation pseudo on a train level.

Impact on ILRT Extension:

The results of this F&O resolution are that the spurious ADS pseudo components still have conservative cable selection, so the Fire induced CDF and LERF are conservative for the ILRT Application.

Page 83 of 142 Revision 22 Page 83 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent !LRT Extension Change Number: MT-15-0022 F&O Number: 1-26 Associated SR(s): AS-Al0, AS-A4, AS-A5, AS-A7, PRM-B5, PRM-C1 Detailed Problem

Description:

The alternate shutdown (ASD) accident sequence development is developed for the case in which 40 minutes are available to establish alternate shutdown to establish core cooling through the use of core spray train B and decay heat removal through RHR train B3.

Issues were identified associated with the accident sequence and system modeling development for ASD:

Spurious SRV opening due to hot short impact is not addressed by the ASO modeling. Analysis performed under EPU and MSO conditions (EC 20955) demonstrated that spurious operation of the SRVs in the ASDS scenario for seven minutes would not adversely impact Monticello's safe shutdown analysis, and would not jeopardize the safe and stable condition of the fuel. Based on observation by the peer review, the referenced calculation, EC 20955, does not support this claim in that time frame. The peer review team queried regarding the time available for one SRV open to reach core damage, and the FPRA development team indicated 17 minutes are available. Therefore, two 'relevant accident sequences are presented, which are not modeled: 1) SRVs spuriously open for seven minutes or less and reclose due to hot short(s) going to ground; the time available to perform ASD may need to be adjusted for this case. The FPRA development team performed a MAAP run for the peer review team and found that 30 minutes are available to perform ASD is one SRV spuriously opens for seven minutes and recloses, and 27 minutes are available if two SRVs are spuriously open for seven minutes. These T/H results significantly impact the timing for the HFE development for ASD (as currently modeled in the HRA calculator, there would be insufficient time available to execute ASO). This strongly suggests that additional HFEs would need to be identified for this particular ASD sequence; and 2) SRVs spuriously open and do not reclose in time to be mitigated by ASD or to prevent core damage, including probabilities for hot short duration. (This F&O originated from SR PRM-B9)

Proposed Solution: Ensure that the accident sequence development for alternate shutdown accounts for all applicable MSO scenarios.

Basis for Significance: ASD is a risk-significant FPRA contributor.

Actual Solution:

Draft T/H analyses were recently performed to ascertain the time available for human actions at the ASDS panel. These T/H analyses account for various numbers of SRVs spuriously opening, each yielding a different time window. The ASD model and associated human failure events (HFEs) have been updated accordingly to reflect the latest data.

Impact on ILRT Extension:

The T/H analysis is finalized [Reference 38]. The F&O is resolved, and there should be no impact on the ILRT Extension Risk Analysis.

Revision 2 Revison 2Page 84 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0035 F&O Number: 1-40 Associated SR(s): SY-A5 Detailed Problem

Description:

System modeling was added for: alternate shutdown modeling, instrumentation that supports operator actions modeled by the FPRA, as well as system modeling for MSOs 2c, 2j, 2k, 2o, 2ai, 2aj, 3a, 3b, 3c, and 5a (failure of load shed only), 5g, 7a. No documentation is provided on the consideration of the potential effects of alternate system alignments.

MSO scenarios introduce new equipment and new flow paths into the PRA, which potentially are impacted by alternate system alignments. As an example, MSO 2c models spurious opening of the steam line drains, and an alternate system alignment could alter the destination of the leakage flow. The FPRA development team would need to at least examine the potential for any of the new components / flow paths modeled, and document what they found. No documentation and no self-assessment of SY-A5 were provided in the notebooks.

Proposed Solution: Include the effects of both normal and alternate system alignments, to the extent needed for CDF and LERF determination.

Basis for Significance: Potential alternate alignments need to be considered in the development of system models.

Actual Solution:

Normal, alternate, and emergency system alignments are captured by the use of flags in the internal events PRA model as documented in Section 1 of each of the PRA system notebooks.

Review of new system modeling for MSOs, alternate shutdown, and added instrumentation, did not identify any system alignments that were not already considered as part of the internal events modeling.

The PRM notebook [Reference 50] has been revised to include a statement about the review of potential alignments.

Impact on ILRT Extension:

The F&O is resolved and there is no impact on the ILRT Extension Risk Analysis.

Page 85 of 142 Revision 22 Page 85 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0050 F&O Number: 3-6 Associated SR(s): PRM-B1 0 Detailed Problem

Description:

The Fire PRA plant response model was not successfully modified to fail SSCs not selected in the ES element. Representative examples of this include:

1. In the PRM notebook, the basis for exclusion of MSO 5j is that 'Monticello does not credit operation of service water', however, service water is not failed in the logic model.

2. In section 3.2 of the PRM notebook Water, it states that use of the Fire Water System as a back-up to LPCI is not credited, however, this is not failed in the model.

3. In both the ES notebook and PRM notebook, it is stated that CRDH and SLBC were not used in the fire PRA, however, these are not successfully failed in the model. They were failed by putting appropriate flags set to 1.0 in the model. However, basic events for SBLCS components (L) and HFE's appear in the results. Basic events for CR0 pump random failures (J) also appear in the model, with random failure probabilities. If the systems are correctly FLAGGED out, there should not be random failures of these systems. If the correct component is flagged, the logical 1.0 should propagate to the top of the tree, eliminating all other random failures. The fact that random events for these systems appear in cutsets indicate the correct basic event has not been chosen to be flagged.

This particular example is not expected to be risk significant.

4. Individual components identified in Table D-1 of the ES notebook as not credited were not failed in the PRM [e.g., FPAP1AXXXR12-S - CONDENSATE PUMP P-1A FAILS TO RUN (SHORT TERM)]

5. Conversely - Basic events that were not failed in the model, yet were not included in table C-i as credited [e.g., ABSLPCIAXG - LPCI MCC FAULT (MCC-133A)]

Proposed Solution: For systems equipment that were included in the Internal Events PRA but were not selected in the ES element, and that are potentially vulnerable to fire-induced failure, are to be failed in the worst possible failure mode, including spurious operation.

Basis for Significance: Inadvertent credit for non-selected equipment is a potentially risk significant error.

Actual Solution:

At the time of peer review, the documentation for this particular file lagged behind the model updates and therefore did not appropriately reflect what was modeled. Both the flag file and the documentation has been updated to reflect the non-credited components in the master flag file appropriately. In addition, components that did not have cable selection have been either failed or dispositioned appropriately in the notebook.

A review of the ES notebook [Reference 49] and master flag file was completed and both files were updated to properly reflect the components and systems that were not credited in the model.

Systems affected by these updates include the fire water system, service water, CRDH and SBLC.

Impact on ILRT Extension:

This F&O is resolved and there is no impact on the ILRT Risk Extension Analysis.

Page 86 of 142 Revision 22 Page 86 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0051 F&O Number: 3-8 Associated SR(s): AS-A9, PRM-B7, SC-A3, SC-B1, SC-B3, SC-B5, SC-Cl, SC-C2 Detailed Problem

Description:

The peer review identified cases where new or modified success criteria would be needed to support the Fire PRA, as discussed below, but no thermal hydraulic calculations or success criteria development were found specifically developed for the FPRA.

Based on the review by peers, the following issues were identified. These are based on limited time to review and are only examples.

Regarding spurious SRV opening due to hot short impact analysis performed under EPU and MSO conditions (EC 20955) demonstrated that spurious operation of the SRVs in the ASDS scenario for seven minutes would not adversely impact Monticello's safe shutdown analysis, and would not jeopardize the safe and stable condition of the fuel. Based on observation by the peer review, the referenced calculation, EC 20955, does not support this claim. The peer review team queried regarding the time available for one SRV open to reach core damage, and the FPRA development team indicated 17 minutes is available, but no specific thermal hydraulic calculation was documented. Therefore, thermal hydraulic calculations need to be developed or referenced to support ASD accident sequence modeling for the cases in which spuriously open SRV(s) reclose as well as spuriously open SRV(s) do not reclose.

T/H calculations are needed for the following FPRA cases:

A) 1 SRV open for 7 minutes: Time at which injection must occur to prevent core damage.

B) 2 SRV open for 7 minutes: Time at which injection must occur to prevent core damage.

C) SRVs spuriously open and do not reclose in time to be mitigated by ASD or to prevent core damage, including probabilities for hot short duration.

The need for success criteria development has been noted by the peer review for MSO 5a (additional loads on diesel): the number of additional loads and the specific impact to the diesels have not been determined. The success criteria development will need be confirmed to be consistent with the features, procedures, and operating philosophy of the plant. (This F&O originated from SR PRM-B7)

Proposed Solution: Identify any cases where new or modified success criteria will be needed to support the Fire PRA consistent with the HLR-SCA and HLR-SC-B of Section 2 and their supporting requirements.

Basis for Significance: ASD modeling is risk-significant. MSO 5a was screened from FPRA modeling without success criteria consideration for the DGs.

Actual Solution:

Regarding spurious SRV openings, draft T/H analyses were recently performed to ascertain the time available for human actions at the ASDS panel. These T/H analyses account for various numbers of SRVs spuriously opening, each yielding a different time window. The ASD model and associated human failure events (HFEs) have been updated accordingly to reflect the latest data.

The modeling for MSO 5a was developed using input from plant personnel and is documented in the PRM notebook [Reference 50]. The modeling is considered to be conservative and is based on the features, procedures, and operating philosophy of the plant. The MSO results in the total loss of the EDG.

Impact on ILRT Extension:

The T/H analysis is finalized [Reference 38]. There is no impact to the ILRT extension analysis.

Page 87 of 142 Revision 22 Page 87 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0106 F&O Number: 6-8 Associated SR(s): PRM-CI, AS-C2, AS-Cl, SC-Cl, SC-C2, SY-Ci, SY-C2 Detailed Problem

Description:

Appendix B of the Plant Response Model notebook documents the modeling changes made for the FPRA, but does not go into detail for all of the logic changes made to create the fire PRA. The peer review noted that 798 gates added to the FPIE PRA model for the FPRA development, and 427 FPIE gates were altered for the FPRA. Detailed information should be provided for how the FPIE PRA model was converted into the fire PRA, including system modeling, success criteria development, and accident sequence analysis.

A more thorough discussion is required on the development of the ASD logic, including the back referenced SRs in AS/SC/SY/DA. Regarding the alternate shutdown modeling, Section B.4 provides a brief description of the development for the alternate shutdown model. However, limited discussion is provided on logic changes made to the system models for alternate shutdown, and the new events added. The new ASD logic created basic events associated with unique cable failures. No details are provided in the documentation to support that effort. More documentation also is needed of the processes used to develop accident sequences and treat dependencies in accident sequences, including the inputs, methods, and results, such as: the success criteria established, a description of the accident progression, and the interface of the accident sequence model with plant damage states.

Proposed Solution: Document the Fire PRA plant response model consistent with HLR-PRM-C, HLR-AS-C, HLR-SC-C, and HLR-SY-C and their SRs, in a manner that facilitates Fire PRA applications, upgrades, and peer review.

Basis for Significance: Documentation of the system modeling, success criteria development, and accident sequence analysis is needed to facilitate PRA applications, upgrades, and peer review.

Actual Solution:

The PRM notebook [Reference 50] was updated to include a more detailed description of the changes made to the internal events modeling for the FPRA. Several tables were added to Appendix B to clarify changes made to the system fault trees. These tables include information for changes related to ASD, power supply dependencies, MSO modeling, and other unique cable selection updates made for fire-specific failures.

The discussion on the development of the ASD logic in Appendix B.4 was also updated and more detail was added in the PRM notebook [Reference 50] as well as the HRA notebook [Reference 46]. Detailed discussion was added on logic changes made to the system models for alternate shutdown, and the new events that were added, including the special basic events for components that have alternate cable selection when they are operated from the ASD panel. Additional information on success criteria used for ASD sequences was also added based on new MAAP runs that were performed to refine the ASD logic.

Impact on ILRT Extension:

The F&O is documentation related and is closed. There is no impact on the ILRT Extension Risk Analysis.

Page 88 of 142 Revision 22 Page 88 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-01 07 F&O Number: 6-9 Associated SR(s): SY-A19, PRM-Bg, SY-Al, SY-A16, SY-A14, SY-B9, SY-B5 Detailed Problem

Description:

Common cause and test and maintenance, and pre-initiator human error basic events for core spray and RHR are missing from the ASD Logic. Additionally, the alternate shutdown modeling of core spray train B is also missing the failure mode for: 'CS Pump P-208B to run after the first hour.' Also, the review found that power supplies for some of the active components were missing from the alternate shutdown logic.

(This F&O originated from SR DA-E2)

Proposed Solution: Include component failure mode basic events and system dependencies for system modeling added for the FPRA consistent with HLR-SY-A, and HLR-SY-B.

Basis for Significance: Missing random failure basic events underestimate the unavailabilities of systems and trains modeled for alternate shutdown, which has a risk-significant impact on the FPRA results.

Actual Solution:

Some of the new basic events that were added to the model were not linked to existing type code data.

The model was updated so that all new basic events are connected to existing Type codes so that the proper data are connected and existing data documentation is correlated.

RHR and CS logic for ASO have been reviewed and basic events for common cause failures, test and maintenance, as well as pre-initiator human failure events (HFEs) have been added where appropriate.

CPCP208BXTI2-ASD (CS PUMP P-208B FAILS TO RUN 1ST HOUR) has been added to the ASD logic.

The ASD logics were updated after the peer review to remove conservatism in the overall modeling approach and this pump was included in the updated modeling.

A detailed review of all power supplies in the model was completed and the appropriate supplies have been added to the model. This is documented in Appendix B of the PRM notebook [Reference 50].

Impact on ILRT Extension:

The F&O is resolved, and is no impact on the ILRT Extension Risk Analysis.

Page 89 of 142 Revision 22 Page 89 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0097 F&O Number: 6-Il Associated SR(s): PRM-B9, SY-Al, UNC-A2, DA-E2 Detailed Problem

Description:

Basic events added to the FPRA associated with the following failure modes have failure probabilities set to zero:

UPS panel fault Circuit breaker fails to remain open Circuit breaker fails to open Fused disconnect switch, fuse spuriously fails Transformer fault CS pump fails to start CS pump fails to run 1st hour MOV fails to remain open MOV fails to open MOV fails to close 125 VDC distribution panel fault AOV fails to remain closed AOV fails to remain open Level transmitter spurious operation RHR Pump fails to run RHR Pump fails to start Solenoid valve fails to transfer (This F&O originated from SR SY-A2)

Proposed Solution: Include failure probabilities for system modeling added for the FPRA consistent with HLR-SY-A, and HLR-SY-B.

Basis for Significance: Basic event probabilities of zero underestimate the unavailabilities of systems and trains modeled for the FPRA, including the alternate shutdown modeling, which has a risk-significant impact on the FPRA results.

Actual Solution:

A full review of the basic events in the model was completed and all events that had no associated unavailability data were updated to use type code data where necessary. The basic events that previously did not have unavailability data were all newly added for the FPRA and mostly associated with ASD.

In the case of the UPS panel fault and any other basic events that were split out to represent primary and alternate or AC and DC power supplies, these unavailabilities are captured in the original BE associated with the specific component. These new BEs are only used for fire impacts and are only set to true in specific fire scenarios.

Impact on ILRT Extension:

The F&O is resolved and there is no impact on the ILRT Extension Risk Analysis.

Page 90 of 142 Revision 22 Page 90 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-01 08 F&O Number: 7-3 Associated SR(s): PRM-A4, PRM-CI, SY-Al, PRM-B9 Detailed Problem

Description:

The purpose SR PRM-A4 is to confirm that the plant response model is constructed in such a manner that it reflects the failure of identified equipment due to the loss of the associated equipment selected cables.

Based on the review by peers, the following issues were identified. These are based on limited time to review and are only examples.

The fault tree modeling of essential cues for HFE HPI-CNTRLY is not correct. The cues are modeled under gate F-HEP-CNTRLML, and ANDed with the medium LOCA initiator IE_MLOCA 2.72E-4/yr (with no FPRA IE modeled there). The FPRA development team concurred that the cues modeling gate LRPV-INSTR should be input into OR gate F020 (Ored with HPI-CNTRLY).

Equipment Selection report 01601 5-RPT-03 Table B-2 identifies ADS-CHANNEL-A:AvaiI:Non-Spur and ADS-CHANNEL-B:AvaiI:Non-Spur low level pseudo functions and equipment dependencies. It was determined during CS that the cables were properly mapped to the ADS pseudo component. Equipment SV271A, C, and D are dependent on both ADS A and B channel cables. However, review of the FRANX database FPRA ODE 2-2 determined improper Component to basic event mapping was made to the PRM. ADS channel A is mapped to SV271A and ADS channel B is mapped to the remaining SV271C and D.

A review of pseudo components MSIV-ISOL-A:Avail:Avail and LLS-DIV-B1 :Avail: Non-Spur as identified in the ES procedure determined there was no modeling of the component to basic event relationship. From peer discussion it was determined that the noted pseudo-components were determined not required in the model following cut set review by the utility.

In addition, there was no evidence that the interlocks on the cable selection data worksheets were reviewed and properly incorporated into the PRM.

Proposed Solution: Perform the review of equipment selected through to PRM basic events to confirm the Fire PRA plant response model is consistent with the scope and location of equipment and cables (accounting for cable damage effects on the equipment of interest) per Section 4.2.2 and Section 4.2.3.

Basis for Significance: From the review performed it appears there may be two PRM related areas requiring additional review. Review the PRM model for correct component to basic event mapping particularly in areas where component mapping is directed to more than one channel or division of components. And, identify and correct the appropriate documentation of selected equipment and/or response modeling.

Actual Solution:

Following the peer review, a review of the pseudo component and interlock modeling was performed and changes were incorporated into the model. This is documented in the updated FPRA PRM notebook

[Reference 50]. The logic for MSIV-ISOL pseudos was added at this time. The logic for the ADS-CHANNEL pseudos was also updated. New, more specific, ADS channel pseudos were added to the model as described in F&O 5-7 and replaced the existing ADS-CHANNEL-A and ADS-CHANNEL-B components.

The instrumentation modeling for HPI-CNTRLY was also fixed in the model. The gate I-HEP-HPI-CNTRL, which is an OR gate with the HEP and instrumentation gate L-RPV-INSTR, was included in gate 1038 where the original HEP was in the model.

Impact on ILRT Extension:

The F&O is resolved and there is no impact on the ILRT Extension Risk Analysis.

Page 91 of 142 Revision 22 Page 91 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0044 F&O Number: 2-10 Associated SR(s): FSS-C5 Detailed Problem

Description:

The damage mechanism for soldered piping (instrument air) is discussed resulting in a conclusion that piping located in a plume should be considered damaged, however a criterion for this damage is not established.

Proposed Solution: Establish a measurable damage criterion for soldered piping and provide the corresponding justification.

Basis for Significance: This SR requires the justification of damage criteria used in the Fire PRA. The criterion suggested for soldered piping needs to be fully developed and justified. Instrument air is fire risk-significant.

Actual Solution:

Appendix F of the Single Compartment Analysis Notebook [Reference 51] documents the methodology used to evaluate fire scenarios that may cause the depressurization of the instrument air piping. Such an event is assumed to lead to failure of the instrument air system in the Fire PRA model.

In Appendix F.3 of the Single Compartment Analysis Notebook [Reference 51], Piping Specification Standard PSRS_PSRS1 13_1 is referenced. This specification standard indicates that the fittings in the instrument air piping system are silver brazed. Silver brazing is a joining process whereby a non-ferrous filler alloy is heated to its melting temperature; this melting temperature is usually above 800°F (430°C) and distributed between two or more close-fitting parts by capillary attraction. At its liquid temperature, the molten filler metal interacts with a thin layer of the base metal, cooling to form an exceptionally strong, sealed joint due to grain structure interaction.

The brazing process temperatures are in the range of pre-flashover conditions in a fire event (approximately 600°C). The brazing process temperature is well within the range of fire plume conditions at a relatively short distance from the fire. Therefore, the analysis conservatively assumes that any piping exposed to fire plume conditions will cause a failure of the piping.

Document Condition Evaluation 01390623-01 indicates that the instrument air compressors would not be able to maintain adequate flow and pressure if a 2 inch line break were to occur. The Fire PRA assumes that depressurization will occur in those instances where the failed piping is at least 1.5 inches in diameter.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Revision 2 Revison 2Page 92 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0055 F&O Number: 4-11 Associated SR(s): FSS-D4 Detailed Problem

Description:

An initial ambient temperature of 20°C was utilized in the fire modeling calculations for all MNGP fire zones. This ambient temperature does not appear to be appropriate for areas that are not temperature controlled such as the Turbine Building, Diesel Generator Building, and areas of the Reactor Building.

Proposed Solution: Utilize an appropriate initial ambient temperature for non-temperature controlled areas and update the fire modeling calculations as necessary.

Basis for Significance: The use of a higher initial ambient temperature could impact the required HRR, damage time, and therefore, the severity factors and non-suppression probabilities.

Actual Solution:

The fire modeling calculations in the MNGP Fire PRA are performed with the in the following three fire models:

1. The Heskestad's Fire Plume Temperature Correlation (see Section 5.3.1 of NUREG 1805)

2. The Point Source Flame Radiation Model (see Section 9.3 of NUREG1 805)

3. The Zone Model CFAST mostly used for determination of hot gas layer development inside a fire zone.

Validation studies were conducted for the use of these models in the MNGP Fire PRA. Chapter 4 of NUREG 1934 lists the following model biases. Values larger than 1.0 indicate that the models tend to over predict the relevant fire condition. In contrast, values less than 1.0 indicate that the values are under-predicted.

• Between 0.73 and 0.94 for the Heskestad's Fire Plume Temperature correlation. It should be noted that these values are based on experiments where plume temperatures measured inside the hot gas layer, and therefore, are not fully applicable to zone of influence calculations in the early stages of the fire before the hot gas layer develops.

• Between 1.42 and 2.02 for the Point Source Flame Radiation model (ambient temperature is not a factor in this calculations), and

• 1.06 for the hot gas layer temperature in CFAST.

NUREG 1934, Table 4.1, reports that CFAST over predicts hot gas layer temperatures by six percent.

The MNGP fire PRA utilizes the thermoplastic damage criteria of 205oC therefore six percent of the damage criteria is approximately 12 degrees Celsius. Given the over-predictions in the models listed above, together with the conservative use of heat release rate values (98th percent values are recommended in NUREG/CR-6850 for screening purposes), relatively small changes in the ambient temperature will not affect the predictions and the corresponding implementation in the Fire PRA.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 93 of 142 Revision 22 Page 93 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0064 F&O Number: 4-20 Associated SR(s): FSS-C5, FSS-D9 Detailed Problem

Description:

Although the damage criteria for sensitive electronics is defined in the Single Compartment Analysis Notebook 016015-RPT-06 and zones of influence (critical distances) are calculated in the Fire Modeling Database, there is no specific discussion of how specific sensitive electronics at Monticello are analyzed in the FPRA.

Proposed Solution: The Single Compartment Analysis Notebook 01 601 5-RPT-06 and the Fire Modeling Database require an update to specifically discuss the treatment of sensitive electronic targets, for temperature, heat flux, and smoke impacts, in the FPRA including the use of the guidance in Fire PRA FAQ 13-0004.

Basis for Significance: There is no documentation ensuring the sensitive electronics have been addressed in accordance with the damage criteria of NUREG/CR-6850 or analyzed in accordance with the guidance in Fire PRA FAQ 13-0004.

Actual Solution:

The Fire PRA Single Compartment Analysis notebook [Reference 51] has been updated to reflect the analysis associated with sensitive electronics. The treatment of sensitive electronics is as follows:

1. In Fire Zone 8, all the cabinets are closed. Therefore, the guidance in FAQ 13-0004 is applicable.

That is, the fire generated conditions associated with damaging thermoset cables are necessary to damage sensitive electronics inside a closed cabinet. Specifically to this fire zone: 1)

Electrical cabinets that are both ignition sources and targets are failed at ignition time, failing all the sensitive electronics inside the panel, 2) The adjacent bank of cabinet is failed at the time of the first cable tray failure above the ignition source, which fails sensitive electronics in the adjacent panel, 3) the hot gas layer scenario for the room fails all the targets in the fire zone at the thermoplastic damage temperature of (approximately 200 00), which fail all sensitive electronics in the room, 4) the multi compartment scenarios where Fire Zone 8 is the 'exposed" compartment credit the manual suppression at the time of the hot gas layer in the 'exposed" (i.e.,

in Fire Zone 8)- therefore the sensitive electronics in inside the panels are failed at the thermoplastic damage criteria in the room.

2. In Fire Zone 9, FAQ 13-0004 does not apply to the main control board because the back of the board is open. The FAQ however applies to any sensitive electronics in the closed cabinets behind the main control board. For the specific case of the closed cabinets behind the main control board, as well as for the main control board panels, the control room is abandoned at temperatures around 100 °C (see Appendix A of 01 601 5-RPT-07), at which point no equipment is credited, regardless if the panels are open or closed. Currently, the model does not credit any suppression where the control room is the exposed compartment. Therefore, targets in the control room are assumed to fail at ignition.

For all other fire zones, there are no open panels containing sensitive electronics. During plant walkdowns, observations confirmed that all panels were closed. Therefore, the guidance in FAQ 13-0004 is applicable. That is, the fire generated conditions associated with damaging thermoset cables are necessary to damage sensitive electronics inside a closed cabinet.

Impact on ILRT Extension:

This is a documentation F&O and is resolved. There is no impact to the 1LRT Extension Risk Analysis.

Page 94 of 142 Revision 22 Revision Page 94 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0065 F&O Number: 4-21 Associated SR(s): FSS-C8 Detailed Problem

Description:

A technical basis for the fire resistance of the embedded cables credited in the Fire PRA analysis is not provided.

Proposed Solution: The technical basis for the fire resistance of any credited embedded cables should be established. The integrity of all credited cable 'protection' should be established with respect to potential fire related exposure to which the protection may be exposed (direct flame impingement, HEAF, etc.).

Basis for Significance: The FPRA currently 'protects' embedded cables from damage due to fire impacts without technical justification ensuring the integrity of the embedded protection for all fire scenarios.

Actual Solution:

The MNGP Single Compartment Analysis Notebook [Reference 51] has been updated to clarify the technical basis used to establish target sets for embedded or wrapped cables:

• There are no fire wraps credited in the Fire PRA at MNGP. Therefore, no fire wrap credit is included in the detailed fire modeling analysis.

• Electrical raceways that are fully embedded (e.g., those located within the floor slab or within a wall) are not vulnerable to fire effects. The concrete will prevent direct flame impingement, contain HEAF events, and prevent heating of these raceways by combustion products.

Inspection of the barriers is conducted in accordance with Procedure 0275-01: Fire Barrier Penetration Seal Visual Inspection, which ensures that there are no cracks or vulnerabilities in the material in which the raceway is embedded.

A list of embedded raceways has also been added to the Single Compartment Analysis Notebook

[Reference 51].

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 95 of 142 Revision 22 Page 95 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0066 F&O Number: 4-22 Associated SR(s): FSS-D1, FSS-D2 Detailed Problem

Description:

The combined effects of a hot gas layer and plume or radiant damage to a target are not considered in the fire modeling. There is no specific threshold over which the fire modeling tools are identified as being used outside their limits.

The detection/suppression model is critical for application of the severity factor and non-suppression probabilities. Although the inputs (distance to detector/sprinkler) are conservative, the model used is not validated and may not be conservative.

Proposed Solution: Provide a specific threshold over which the hot gas layer effects need to be addressed. Provide a modified methodology for incorporating these effects when significant. Provide V&V basis and applicability range for the DETACT model used or utilize a model that has already been verified and validated.

Basis for Significance: The plume hot gas layer interaction could impact the plume temperature at targets and thus impact time to damage, severity factors, and non-suppression probabilities. There is a potential that the DETACT model does not provide conservative results.

Actual Solution:

For targets located above the fire, Heskestad plume temperature equation (

Reference:

NUREG-1 805) is used to calculate the temperature of the fire plume at the target closest to the source. Using this equation, the critical heat release rate can be calculated for each source. The time at which this target is damaged is equal to the time at which the ignition source reaches the critical heat release, using the guidance on fire growth times in NUREG/CR-6850; transient sources reach their 98th percentile peak heat release in 2 minutes and fixed ignition sources reach their 98th percentile peak heat release rate in 12 minutes.

As a conservatism, the MNGP Fire PRA assumes that all targets located within the 98th percentile Zone of Influence (ZOI) are damaged at the time at which the first (nearest) target is damaged. In other words, the time to damage for all targets within the 98th percentile ZOI is equal to the time at which the critical heat release rate is achieved.

By assuming that all targets in the ZOI are lost when the first target is damaged, the MNGP Fire PRA postulates damage early in the scenario progression. At this early time in the scenario, the temperature of the hot gas layer has not appreciably changed. In other words, the temperature of the fire zone remains close to ambient. Therefore, the temperature predicted by the Heskestad plume equation is appropriate for use in the MNGP Fire PRA.

Impact on ILRT Extension:

The F&O is resolved and there is no impact to the ILRT Extension Risk Analysis.

Page 96 of 142 Revision 22 Revision Page 96 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0067 F&O Number: 4-23 Associated SR(s): FSS-D7 Detailed Problem

Description:

There is no generic estimate or plant-specific value assigned to the non-suppression probability.

Proposed Solution: Assign a plant-specific unavailability value for the credited suppression and detection systems to be included to the nonsuppression probabilities.

Alternatively, assign a generic estimate for unavailability and perform a review of the suppression and detection systems for outlier behavior relative to system unavailability.

Basis for Significance: The non-suppression values are only based on the NUREG/CR-6850 generic values for unreliability with no account for unavailability.

Actual Solution:

Halon Suppression System Unlike many other automatic suppression systems used in U.S. nuclear plants, the halon suppression system in the cable spreading room is subject to the Maintenance Rule program. The Maintenance Rule Program sets strict availability and reliability criteria for this system. As such, a plant-specific unavailability value of 4E-3 is fully supported by the requirements of this program and the documented availability data.

In the MNGP Fire PRA, the non-suppression probability for each credited automatic suppression system is equal to the sum of the plant-specific unavailability for that system and the generic system unreliability given in Appendix P of NUREG/CR-6850. In the case of the halon suppression system, the generic system unreliability is equal to 0.05. Therefore, the total non-suppression probability for the cable spreading room halon suppression system is equal to 0.054.

All Other Credited Detection and Suppression Systems Plant specific unavailability values for the credited suppression and detection systems were developed through a search of the Passport Action Tracking Database for a 10-year period from 9/18/2005 to 7/15/2015.

The resulting data export consisted of the dates and times at which a fire impairment was established and then closed. [See Section 6.1.3.3 for the tables used to calculate the unavailability values.] Given the impairment durations documented in the preceding table, the total unavailability factor for the system type can be calculated by dividing the total unavailability of each system type (the sum of the duration of the impairments on those systems) over the time period from which the data was taken (3587 days). In the MNGP Fire PRA, the non-suppression probability for each credited automatic suppression system is equal to the sum of the plant-specific unavailability for that system and the generic system unreliability given in Appendix P of NUREG/CR-6850. [The total plant-specific unavailability and generic system unreliability values are given in Section 6.1.3.3.] The MNGP Fire Modeling Database has been updated to reflect this revised non-suppression probability to include the plant specific unavailability value.

Impact on ILRT Extension:

The F&O is resolved and there is no impact to the ILRT Extension Risk Analysis.

Page 97 of 142 Revision 22 Revision Page 97 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0068 F&O Number: 4-24 Associated SR(s): FSS-D7 Detailed Problem

Description:

The automatic Halon system in the Cable Spreading Room is assigned a non-suppression probability of 0.004 based on the Maintenance Rule program which indicates that 'the system has been available 99.6% of the time since 2006, at least by the rules of the Maintenance Rule Program'.

Proposed Solution: Update the non-suppression probability for the Cable Spreading Room automatic Halon system to incorporate the NUREG/CR-6850 unreliability value and the plant-specific unavailability value.

Basis for Significance: The FPRA is incorrectly utilizing the unavailability value (0.004) for the non-suppression probability for this system which should account for unreliability and unavailability.

Actual Solution:

Unlike many other automatic suppression systems used in U.S. nuclear plants, the halon suppression system in the cable spreading room is subject to the Maintenance Rule program. The Maintenance Rule Program sets strict availability and reliability criteria for this system. As such, a plant-specific unavailability value of 4E-3 is fully supported by the requirements of this program and the documented availability data.

In the MNGP Fire PRA, the non-suppression probability for each credited automatic suppression system is equal to the sum of the plant-specific unavailability for that system and the generic system unreliability given in Appendix P of NUREG/CR-6850. In the case of the halon suppression system, the generic system unreliability is equal to 0.05. Therefore, the total non-suppression probability for the cable spreading room halon suppression system is equal to 0.054.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 98 of 142 Revision 22 Page 98 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0072 F&O Number: 4-28 Associated SR(s): FSS-A2 Detailed Problem

Description:

Cables assigned to the Yard fire zone located in manholes and duct banks are not included in the whole compartment burn scenario.

Additionally, bus duct targets are not included as FPRA targets damaged in whole compartment/hot gas layer scenarios in fire zones where they are located.

Proposed Solution: Include cables in the yard manholes/duct banks as FPRA targets in the Yard whole compartment burn scenario or alternatively, perform detailed fire modeling of the yard to justify exclusion of the cables in the yard from fire scenarios located aboveground.

Include bus duct targets as damaged in the FPRA for all fire zone scenarios that could impact the bus ducts, including whole compartment burns and hot gas layer scenarios.

Basis for Significance: The risk impact of these targets have not been analyzed.

Actual Solution:

The fire scenario associated with full zone damage for Fire Zone Yard has been corrected to include all cables in manholes and duct banks located in this zone. Specifically, components that are directly mapped to functional states and Basic Events are now included.

To include all Basic Events for components and cables found in the Yard, the following verifications were conducted:

1. The fire scenario associated with full zone damage to the Yard, which is originated and maintained in the Fire modeling Database was reviewed to ensure that all the targets mapped to the Yard were accounted for.

2. The FRANX quantification tables (i.e., FRANX Scenarios table and FRANX Zone To Raceway table) generated in the fire modeling database and exported to FRANX were reviewed to ensure that the Yard scenario was appropriately specified.

3. The FRANX quantification was reviewed to ensure that the scenario was treated and quantified correctly FRANX.

The risk contribution of the full zone burn in the Yard is now correctly accounted for in the MNGP Fire PRA.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 99 of 142 Revision 22 Page 99 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5400-CAC-0 Evluaionof iskSigifianc ofPeranet IRT xtesio Change Number: MT-15-0073 F&O Number: 4-29 Associated SR(s): FSS-AI, FQ-A3 Detailed Problem

Description:

Appendix E of the Single Compartment Analysis Notebook 016015-RPT-06 identifies that scenarios for cable fires caused by welding and cutting and self-ignited cable fires result in high total COF contributions and further evaluation and refinement will be completed after risk reduction activities are completed.

These scenarios are not currently quantified in the FPRA model.

Proposed Solution: Perform risk reduction refinements of the scenarios for cable fires caused by welding and cutting and self-ignited cable fires and include the scenarios in the FPRA quantification.

Basis for Significance: Probable risk-significant impact Actual Solution:

The risk contribution for self-ignited cable fires and cable fires due to welding and cutting have been included in the Fire PRA following the guidance described in FAQ 13-0005. Appendix E.2 of the Single Compartment Analysis Notebook [Reference 51] has been updated to reflect this analysis.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 100 of 142 Revision 22 Page 100 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0076 F&O Number: 4-31 Associated SR(s): FSS-A2, FSS-A3, FSS-A5, FSS-B2, FSS-D3, FQ-E1 Detailed Problem

Description:

The current Fire PRA model contains numerous risk significant fire scenarios that are modeled as bounding fire scenarios (whole compartment burns) resulting in unrealistically high CDF/LERF values.

Additionally, for fire zones where detailed fire modeling was performed, numerous bounding assumptions have been applied without further refinement. These include the following:

• Heat release rates of 1002 kW were utilized for closed electrical cabinets, including MCCs.

• Transient scenarios fail all targets up to the ceiling without consideration of the zone of influence.

• Fixed and transient scenarios are mapped to all targets located within a 'transient zone' without consideration of actual zone of influence of the scenario.

• The use of bounding areas and volumes in the CFAST model groups which are smaller than the actual fire zone configuration.

• The use of a peak heat release rate for motor (electrical) fires of 211 kW as opposed to the 69 kW heat release rate identified in NUREG/CR-6850.

• The use of bounding heat release rate calculations in FLASH-CAT for electrical cabinet fires, transient fires, and fixed sources including spread/propagation of cable trays (including tray stack configurations) as opposed to actual plant configurations.

• The use of a single door opening in the CFAST hot gas layer calculations as opposed to the actual openings of the fire zone.

• Failing all conduits in the PAU for every scenario in the PAU.

• Instrument air piping when exposed to fire plume conditions is considered damaged by fire scenario regardless of temperature of the piping and elevation above the source.

Assignment the worst case abandonment probability to each MCR ignition source configuration regardless of ventilation condition.

Proposed Solution: Perform detailed scenario analysis for risk significant fire scenarios presently modeled as bounding whole compartment burns and refine bounding assumptions of current detailed fire modeling scenarios.

Basis for Significance: The use of bounding fire scenarios provides unrealistically high CDF/LERF values.

Actual Solution:

The Fire PRA has been developed following the guidance in NUREG/CR-6850. Accordingly, the analysis is initially quantified with conservative assumptions in the definition of the fire scenarios. Conservatisms are removed on an as needed basis as part of the cut set review and risk reduction activities. Cut set reviews and risk reduction activities continued after the peer review. Consequently, some of the conservatisms listed in the F&O have been addressed. In each case, the removal of a conservatism is evaluated to determine the most efficient means of reducing risk.

• In the case of MCC's and Switchgear cabinets, the heat release rate probability distributions have been updated to the ones associated with electrical cabinets with one cable bundle listed in Appendix G of NUREG/CR-6850.

• Transient zones extend from the floor slab to the ceiling slab. By mapping all of the identified targets to the, the Fire PRA assumes that a transient fire may occur anywhere (i.e., at any elevation) in the transient zone.

• .. In Step 1 of Detailed Fire Modeling, all targets in each transient zone are assigned to the ignition

• sources located within that transient zone. Iffuture risk reduction activities warrant a refined approach, the zone of influence of each ignition source will be considered.

Revision 2 Page 101 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension

- The use of bounding volumes in CFAST ensures that the bounding scenario is analyzed. Ifthe FPRA results indicate that the time to hot gas layer formation is overly conservative, then additional CFAST simulations may be considered.

• The peak heat release rate of motor (electrical) fires was updated to 69 kW as opposed to 211 kW per NUREG/CR-6850.

N The use of bounding heat release rate calculations in FLASH-CAT ensures that the uncertainties in the input parameters for the FLASH-CAT method are accounted for.

N The use of a single door opening in the CFAST hot gas layer calculations ensures that the bounding scenario is analyzed. If the FPRA results indicate that the time to hot gas layer formation is overly conservative, then additional CFAST simulations may be considered.

• On an as needed basis, the mapping of conduits to specific fire scenarios has been completed as required for risk reduction by the cut set review process. This approach is used in some scenarios in place of mapping all conduits in the PAU to every scenario in the PAU.

• The assumption that piping exposed to fire plume conditions are damaged by fire limited the scope of the drawing review and walkdowns that supported the development of these scenarios.

The use of the worst-case abandonment probability for each MCR ignition source configuration ensures that changes to the ventilation condition do not require re-analysis of the Fire PRA scenarios.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 102 of 142 Revision 22 Page 102of142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0077 F&O Number: 4-32 Associated SR(s): FSS-A5 Detailed Problem

Description:

The Single Compartment Analysis Notebook 016015-RPT-06 states that electrical cabinet heights are assumed to be 1.8 m (6 ft.) above the floor in the CFAST fire modeling applications. Additionally, the cable trays at MNGP were modeled with 0.46 m (1.5 ft) height between cable trays in a stack, a typical tray arrangement; this value is used in the FLASH-CAT application. Cable tray assumptions in FLASHCAT include that each cable tray contains 61 cables, is two foot in width, and 75% percent of the cable will burn completely. These bounding assumptions may not accurately reflect the as-built configurations and provide non-conservative results.

Proposed Solution: Provide justification that these assumptions reflect or bound all as-built configurations that they are applied to.

Basis for Significance: The use of these assumptions may not accurately reflect plant configurations and could be non-conservative.

Actual Solution:

The following list describes the basis for each of the inputs and provides a basis by which these results bound the as-built configurations. By ensuring that the modeled conditions bound the as-built conditions, it is ensured that results of the Fire PRA are conservative. In each case, future cut set reviews and risk reduction activities may warrant removal of such bounding assumptions. Removal of these conservatisms is evaluated on an as-needed basis.

• Electrical cabinet are assumed to be 6 feet in height. Ignition source walkdowns did not identify any outlier cabinets that are significantly taller than 6 feet. By using the largest typical cabinet height, the calculated time to hot gas layer formation is conservatively calculated. This calculation is conservative because the taller the height at which the fire occurs, the less volume is available above the fire. This smaller volume will reach the critical damage temperature in less time.

• The FLASH-CAT application assumes a distance of 0.46 m (1.5 ft) between cable trays in a stack.

FLASH-CAT was programmed using the equations given in NUREG/CR-7010. In the tests documented in NUREG/CR-7010, the vertical distance between the trays ranged from 0.23 m to 0.46 m (9 in. to 18 in.).

• It is important to note that the burning length of the trays ignited is equal to

• L_(n+1)=L~n+2(h_(n+l) tan(35°))

• where L is length, n is the cable tray index, and h is the vertical distance between trays

• By using this maximum vertical distance between cable trays, the FLASH-CAT model calculates the maximum length ignited in each successive tray.

• The average number of cables installed in a cable tray segment at MNGP is 61. While this value is an average, this number does not affect the calculation since fuel burnout is not expected over the duration of the simulation.

• Inspection of the MNGP raceway drawings indicate that the maximum tray width is 0.61 m (2 ft). By using this maximum tray width, the maximum heat release rate contribution from the burning cable trays is calculated.

The mass fraction of the non-metallic part of the cable that remains after a fire is known as the char yield.

NUREG/CR-701 0 recommends that a char yield value of 0. This value corresponds with approximately 100% of the non-metallic mass of the cable being consumed by a fire. This represents the maximum contribution to the heat release rate from burning thermoplastic cables.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 103 of 142 Revision 22 Page 103of142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0078 F&O Number: 4-33 Associated SR(s): FSS-A5 Detailed Problem

Description:

Wall and corner effects are not accounted for in the FLASH-CAT modeling for heat release rate calculations that are used for the CFAST hot gas layer models.

Proposed Solution: Incorporate wall and corner effects in the FLASH-CAT heat release rate calculations.

Basis for Significance: The HRR rates calculated in FLASH-CAT may be non-conservative for certain fire scenarios impacting hot gas layer timing.

Actual Solution:

The FLASH-CAT modeling of heat release rates using the CFAST hot gas layer models predict hot gas layer formation using bounding assumptions. By ensuring that the modeled conditions bound the as-built conditions, it is ensured that results of the FLASH-CAT model are conservative. These conservatisms include:

• Maximum flame spread rate for thermoplastic cables (0.9 mm/sec)

• Maximum heat release rate per unit area of thermoplastic cable (250 kW/m2)

• Bounding value of cable mass per unit length (0.75 kg/in)

• Bounding value of plastic yield (0.75), which bounds all cables tested in NUREG/CR 7010

• Char yield value of 0. This value corresponds with approximately 100% of the non-metallic mass of the cable being consumed by a fire. This represents the maximum contribution to the heat release rate from burning thermoplastic cables.

• All cable trays are assumed to be 2 ft wide, which is the maximum width measured on the cable tray layout drawings.

N Maximum vertical distance between trays modeled in NUREG/CR-7010 (18 in.)

• Maximum heat release rates of transient fires (317 kW) and electrical cabinet fires (1002 kW).

These heat release rates are equal to the 98th percentile from Table E-1 of NUREG/CR-6850.

• Flame is assumed to spread through up to 12 vertically stacked cable trays, which bounds the as-built plant configuration.

Such conservatisms bound the heat release rates resulting from wall and corner effects.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 104 of 142 Revision 22 Page 104 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0039 F&O Number: 2-1 Associated SR(s): PP-B3, PP-C3 Detailed Problem

Description:

The requirement for this SR is to JUSTIFY credited spatial separation. This section does not provide the required justification. The documentation should include an evaluation that establishes why the separation provided by "space" will ensure that the adverse effects of fire will be substantially contained in each of the adjacent PAUs.

Proposed Solution: Each credited spatial separation barrier should be justified to establish that the barrier will substantially contain the adverse effects of fire.

Basis for Significance: This SR requires that justification be provided for credited spatial separation; no such justification is provided.

Actual Solution:

As stated in Section 3.0 of the Plant Boundary and Partitioning Notebook [Reference 48], the spatial separation between fire zones is not expected to "substantially confine" fire generated conditions such as smoke.

Instead, the probability that fire generated effects propagate across this boundary is captured in the multi-compartment analysis. In the cases where spatial separation is credited between fire zones, a barrier failure probability of 1.0 is assigned to these multi-compartment scenarios. Per the guidance of NUREG/CR-6850, multi-compartment combinations are screened where a hot gas layer is not expected in the exposing zone.

Further, the qualitative assessment provided in the resolution to F&O 4-14 qualitatively addresses the localized effects of fires near openings at credited boundaries. The assessment suggests that the localized fire effects near boundaries is low.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 105 of 142 Revision 22 Page 105 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0054 F&O Number: 4-10 Associated SR(s): FSS-G2 Detailed Problem

Description:

Several MCA zone combinations are screened quantitatively in the Multi-Zone Analysis Notebook 01601 5-RPT-08 based on having a frequency of occurrence of less than 1E-08. However, there is no justification for the screening threshold providing reasonable assurance that the cumulative contribution of the screened physical analysis unit combinations are of low risk significance.

Proposed Solution: Provide detailed justification that the 1E-08 screening is an acceptable threshold for the plant to ensure that the contribution of the cumulative screened combinations are of low risk significance.

Basis for Significance: 1E-08 screening is typically an industry accepted threshold however, no justification is provided.

Actual Solution:

Scenarios with a frequency of occurrence of less than 1E-08 were screened on the basis that when multiplied by the CCDP or CLERP, the total core damage or large early release frequency of these scenario would be insignificant.

In the interest of understanding the cumulative risk contribution of these screened fire scenarios, the FPRA Multi-Zone Analysis Notebook [Reference 52] has been updated to include the total scenario frequency for these screened scenarios. The total scenario frequency for all of the scenarios screened using this criteria is 3.99E-07. This value is the sum of the scenario frequencies for all multi-zone scenarios that were screened because their frequency of occurrence was less than I1E-08. This value does not include the scenario frequency of those multi-zone scenarios that were screened using another basis, such as the lack of a hot gas layer formed in the exposing zone or no new Basic Events impacted in the exposed zone.

It follows that if the CCDP (CLERP) for each scenario was applied, then the total COF (LERF) for these scenarios would be insignificant to the total risk calculation. The total CDF, which is calculated using assuming a OCCP of 1.0, represents less than 1% of the total CDF for MNGP. On this basis, these scenarios are screened from further analysis.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 106 of 142 Revision 22 Page 106 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0057 F&O Number: 4-14 Associated SR(s): FSS-G2 Detailed Problem

Description:

For multi-zone scenario combinations that are screening due to no hot gas layer in the exposed fire zone, there is no consideration for localized target damage in the exposed compartment due to fire exposure near the barrier opening (i.e., targets located in the flow path of postulated hot gases from the exposing fire zone).

Proposed Solution: Perform an assessment for multi-zone analysis to confirm that the screened scenarios do not have targets in the postulated hot gas flow path.

Basis for Significance: Not expected to be significant but there is a potential for additional FPRA target damage.

Actual Solution:

The multi compartment analysis in the MGNP Fire PRA has been developed and implemented following the guidance described in Chapter 11 of NUREG/CR-6850. Consistent with this guidance, multi compartment scenarios have been screened if no hot gas layer scenario is expected in the exposing fire zone. That is, an exposing fire zone that does not generate a hot gas layer scenario is not expected to damage targets in the exposing fire zone.

The fire scenarios described in this finding are outside the recommended guidance in NUREG/CR-6850.

Therefore, these scenarios have not been explicitly analyzed in the MGNP Fire PRA. A number of factors suggest that the risk contribution of these scenarios is low. These factors include:

• Location of Fixed Ignition Sources: Damage to components in the adjacent zone is likely to occur only for fixed ignition sources located near the zone boundary. Only a portion of the ignition sources in a given zone are found near these zone boundaries. Further, it follows that fixed ignition sources located away from the zone boundaries are not likely to damage components in the adjacent zone without propagating through secondary combustibles. In the case of fire propagation through intervening combustibles, there will be time available for manual or automatic suppression, thereby reducing the risk contribution of these scenarios. Therefore, the overall risk contribution of fixed ignition sources is low.

• Location of Transient Ignition Sources: Only transient fire sources that start and are sustained near a fire zone boundary are capable of damaging components in the adjacent zone. By crediting a geometry factor (i.e., a floor area ratio), only a portion of the ignition frequency of the transient fires postulated in the exposing zone would contribute to the total risk of these localized scenarios. Further, the effects of certain transient fires types, such as cable fires and transient fires due to hotwork, are mitigated by prompt detection and prompt suppression activities.

Therefore, it is unlikely that a hotwork fire would damage targets in the adjacent zone. Fire modeling treatments of self-ignited cable fires and junction box fires ensure that damage to targets in the adjacent zone is unlikely. Therefore, only general transients, of which only a portion are located near the boundary, are expected to contribute to the overall risk of these localized scenarios.

• Target Configuration: In order to be damaged by localized fire effects at the boundary, Fire PMA raceways in the adjacent zone would need to be located near that boundary.

• Barrier Features: It is generally accepted that the risk contribution of multi-compartment fires is lower than that of single compartment scenarios. This notion is based on the credited separation features (i.e., fire walls, fire doors, penetration seals, etc.) between fire zones. The failure probability of these separation features is considered to be low.

Consequently, the risk contribution of localized fire effects near zone boundaries is expected to be low.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 107 of 142 Revision 22 Page 107 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-1 5-0058 F&O Number: 4-15 Associated SR(s): FSS-G1 Detailed Problem

Description:

Appendix D identifies the non-suppression probability assigned to each multi-zone scenario combination based on the suppression in the exposing or exposed zone. There were several inconsistencies identified between the zone suppression credited versus the non-suppression probability assigned.

Additionally, the Multi-Zone Analysis Notebook [Reference 52] identifies that Halon suppression 1* not credited in the analysis due to potential barrier openings, however, Appendix D identifies the application of a non-suppression probability for several multi-zone scenarios with only Halon in one of the fire zones.

Proposed Solution: Revise Appendix D of the Multi-Zone Analysis Notebook [Reference 52], the FMDB, and the quantification of the multi-zone scenarios to account for the correct non-suppression probabilities.

Basis for Significance: There is a potential risk impact for changing the non-suppression probabilities between suppression system type, specifically, removing a non-suppression probability for those assigned for Halon protected zones.

Actual Solution:

A comprehensive review of the automatic suppression credit for the multi compartment scenarios was conducted to eliminate the inconsistencies identified during the peer review. In addition, the automatic Halon system is not credited in the multi compartment analysis. The table in the fire modeling database listing the credit for automatic suppression has been updated.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 108 of 142 Revision 22 Page 108 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0059 F&O Number: 4-16 Associated SR(s): FSS-G1 Detailed Problem

Description:

Several fire zones are protected by partial suppression systems which are credited in the multi-zone analysis with no justification to ensure that the partial protection is capable of preventing damage to FPRA targets in the exposed fire zone.

Proposed Solution: Provide appropriate justification that the partial coverage suppression systems credited in the Multi-Zone Analysis Notebook [Reference 52] is capable of preventing FPRA target damage in the exposed zone.

Basis for Significance: There is a possibility that the credit for non-suppression probabilities associated with partial coverage systems may not be appropriate for all multi-zone scenarios.

Actual Solution:

Credit in the multi-compartment analysis for systems providing partial coverage in the fire zones has been removed from the analysis. The table in the fire modeling database listing the credit for automatic suppression has been updated to reflect no credit for systems providing partial coverage (i.e., non-suppression probability has been set to 1.0).

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 109 of 142 Revision 22 Page 109 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5400-CAC-0 Evauaton f Rik Sgniicace o Pemannt IRT xtesio Change Number: MT-I15-0044 F&O Number: 2-5 Associated SR(s): IGN-A7 Detailed Problem

Description:

Section 5.6 discusses the apportionment of generic transient fire ignition frequencies and the development of the influencing factors for each area. The influencing factors were assigned by the FPRA analysts based on engineering judgment and a set of rules documented in Section 5.6.2 of the Ignition Frequency Notebook [Reference 53]. Assignment of these values resulted in a comparatively low result.

Based on the information contained in the Fire Modeling Database the influencing factors average as follows: Maintenance 1.7; Occupancy 2.2; and Storage 1.8. It's typically assumed that these factors will produce an average value, i.e., Medium or 3, by definition. Based on the values stated it appears that the influencing factors may have been underestimated. To increase the accuracy and reliability it's suggested that these values be set or validated by plant operations and maintenance personnel.

For example, numerous fire zones were assigned LOW maintenance factors including H2 Seal Oil/Condensate Pump Area, Turbine Condenser Area, Air Ejector Room, Admin Bldg HVAC Room, ESF Motor Control Center, 13.8 kV Switchgear Rooms, RCIC and HPCI Rooms, Diesel Fuel Oil Pump House, etc. as these zones contain pumps, motors, electrical equipment that would require maintenance.

LOW storage factor was assigned in numerous fire zones including Lube Oil Storage Room, Contaminated Equipment Storage Area, etc. which appear to be defined storage areas in the plant.

Additionally, there are only 13 fire zones that are assigned storage factors greater than LOW.

Proposed Solution: Review the influencing factors with knowledgeable plant personnel to ensure that the factors applied are representative of realistic plant conditions. Consider augmentation of this effort with a review of historical work orders and storage permits to provide definition to the revised factors.

Basis for Significance: By definition, the average of the assigned influencing factors should reflect the average value.

Actual Solution:

A comprehensive review of the influence factors for all the fire zones was conducted to address this finding. As a result of the review, the values for several influence factors were increased to provide a better representation of the transient ignition source likelihood in the fire zone. For example, the storage factor for a number for fire zones was increased to better reflect the storage practices at the fire zone. In addition, the updated influence factors were reviewed by plant personnel. The updated influence factors, documented in the MNGP Fire Ignition Frequency Notebook [Reference 53], are now part of the base model and their impact is reflected in the quantification process.

Impact on ILRT Extension:

This F&O is closed, and there is no impact on the ILRT Extension Risk Analysis.

Page 110 of 142 Revision 22 Page 110 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0088 F&O Number: 4-9 Associated SR(s): IGN-A1, IGN-A7 Detailed Problem

Description:

The Ignition Frequency Notebook 016015-RPT-10 does not utilize the current nuclear power industry guidance for transient influence factors provided in PRA FAQ 12-0064.

Proposed Solution: Utilize the guidance in PRA FAQ 12-0064 for the transient influence factors, including the new factor for hotwork, which is separated from the previous maintenance factor.

Basis for Significance: The guidance in PRA FAQ 12-0064 enhances the guidance previously provided in NUREG/CR-6850. Risk-significant influence on the cable spreading room fire scenarios.

Actual Solution:

Supporting requirement IGN A7 requires a "consistent methodology based on parameters that are expected to influence the likelihood of ignition to apportion high level ignition frequencies". The MNGP utilizes a consistent methodology. The guidance in PRA FAQ 12-0064 describes influence factors lower than the ones available in Chapter 6 of NUREG/CR-6850 for plant configurations that meet specific criteria. For example, influence factors lower than 1.0 can be applied if the room is locked with a key controlling access to general plant personnel. Such configurations are not currently in place in the Fire Zones at MNGP and therefore values less than 1.0 are not used. For the specific guidance of separating hot work from maintenance influence factors, the MNGP Fire PRA reflects both activities in one factor as described in NUREG/CR-6850. To do so, influence factors have been assigned so that they are bounding to each of the activities (i.e., maintenance and/or hotwork activities).

Impact on ILRT Extension:

The F&O is closed, and there is no impact on the ILRT Extension Risk Analysis.

Page 111 of 142 Revision 22 Page 111of142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0100 F&O Number: 6-2 Associated SR(s): IGN-A1, IGN-B1, IGN-B4 Detailed Problem

Description:

The FPRA development review plant-specific experience for fire event outlier experience. No outlier fires were identified for the FPRA. However, subjective criteria (active intervention was needed to prevent potential spread, indications that heat was generated of sufficient intensity and duration to effect components outside the fire source, potentiaJ for secondary combustible ignition) for identifying outlier fire events were not assessed. For example, for one hydrogen fire event, 01003990, that was screened, involved an eight inch flame, which could have damaged equipment.

Additionally, there are several fire events associated with hot work. The results of the hot work fire events may meet the 'objective criteria' specified in the documentation. However, hot work fires should be addressed in the context of whether active intervention was required to suppress the fire.

The methodology discussed in section 5.2.1 of the IGN notebook, does not discuss or review the fire events in the context of the subjective criteria.

Proposed Solution: Apply and document subjective criteria to review plant-specific experience for fire event outlier experience, and update fire frequencies if outliers are found.

Basis for Significance: Subjective criteria not applied in the review of fire events.

Actual Solution:

The following documents the review of the fire events contained within the Fire Ignition Frequencies Notebook [Reference 53] using the criteria given in Section C.2.3 of NUREG/CR-6850 regarding potentially challenging fire events. According to Section 0.2.3 of NUREG/CR-6850, a fire event is to be considered potentially challenging if any one of the following events are true:

• A hose stream, multiple portable fire extinguishers, and/or a fixed fire suppression system (either manually or automatically actuated) were used to suppress the fire

• One or more components outside the boundaries of the ignition source were affected

• Combustible materials outside the boundaries of the fire ignition sources were ignited Further, a fire event may also be considered potentially challenging if any two of the follow features are cited in the fire event report:

• Actuation of an automatic detection system

• A plant trip was experienced

• A reported loss of greater than $5,000 (not including any lost business damages)

• A burning duration or suppression time of 10 minutes or longer A fire was also considered for classification as Potentially Challenging if there was sufficient indication that the fire was self-sustaining:

• It is apparent that active intervention was needed to prevent potential spread.

• Indication that flames or heat was generated of sufficient intensity and duration to cause the ignition of secondary combustibles outside the fire ignition source, or enough to affect components, had such been in close proximity to the ignition source.

• Substantial smoke was generated.

This additional review confirmed the conclusion documented in Section 5.2.1 of the Ignition Frequency Notebook [Reference 53]; specifically, no unusual pattern of fire events can be attributed to a specific ignition source. No update to the generic ignition frequency values is necessary. It is important to note that while several of the events are connected with welding machines and/or welding activities, this result is in line with the generic frequency values for hot work fires given in Supplement 1 to NUREG/CR-6850.

Further, there is no evidence that the hydrogen fire event is any different from the events used to develop the generic ignition frequency values. No other hydrogen fire events were identified during this review, indicating that no distinct fire event history is attributable to this source.

Impact on ILRT Extension:

The F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Revision 2 Page 112of142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5400-CAC-0 Evluaionof iskSigifianc ofPeranet IRT xtesio Change Number: MT-I15-0101 F&O Number: 6-3 Associated SR(s): IGN-AI Detailed Problem

Description:

Battery Chargers have been counted as either 10 or Bin 15 in the IGN development.

It appears that well sealed low voltage panels (e.g. lighting panels) have been included in the bin 15 count that should be excluded.

Proposed Solution: Assign all battery chargers into Bin 10.

Well-sealed electrical cabinets that have robustly secured doors and that house only circuits below 440V should be excluded from the counting process.

Basis for Significance: Binning assigned not consistent with equipment type.

Sealed low voltage panels should be excluded from the fire ignition frequency count. Their inclusion unduly dilutes the frequency for bin 15 and reduces the panel frequency for higher risk components.

Actual Solution:

The counting of Battery Chargers has been corrected such that all battery chargers are now mapped to Bin 10. This correction is reflected in the Ignition Frequency Notebook [Reference 53].

The counting for electrical cabinets (i.e., Bin 15) follows the guidance in NUREG/CR-6850 and the clarification for well-sealed panels in Supplement 1 to NUREG/CR-6850. Only small, low voltage wall-mounted panels are screened from the count. Lighting panels are not screened if they have doors that do not meet the criteria for well-sealed panels. This approach ensures that future monitoring of condition of panel is unnecessary.

Impact on ILRT Extension:

The F&O is resolved by stating that the lighting panels did not have well sealed doors. There is no impact to the ILRT Extension Risk Analysis.

Revision 2 Revison 2Page 113 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5400-CAC-0 Evauaton f Rik Sgniicace o Pemannt IRT xtesio Change Number: MT-I15-01 02 F&O Number: 6-4 Associated SR(s): IGN-A7, IGN-BI Detailed Problem

Description:

Chapter 7, of NUREG-6850 Supplement 1 provides two counting methods for segmented bus ducts. The analysis currently counts segmented bus ducts as a 1 for each duct in a given compartment. However this does not apportion the total frequency appropriately. The frequency should be weighted for longer lengths (more segments) in any given compartment. The approach would be to choose Option 1 or Option 2 laid out in Chapter 7 of Supplement 1 to NUREG/CR-6850.

Proposed Solution: Apply Supplement 1 guidance for segmented bus ducts.

Basis for Significance: IGN documentation indicates that Supplement 1 guidance was utilized for segmented bus ducts, but observations indicate that it was not.

Actual Solution:

The Monticello Fire PR.A and Ignition Frequency Notebook [Reference 53] have been updated to reflect the use of 'Counting Approach 2" for segmented bus ducts given in Supplement I to NUREG/CR-6850.

This approach assumes that the fire ignition frequency for segmented bus ducts is apportioned equally along the length of the bus duct. First, the analyst measures the total length of segmented bus ducts as well as the length of segmented bus duct found within each fire compartment. A ratio of the length of segmented bus duct within the compartment to the total length is then calculated. The plant-wide fire ignition frequency is then multiplied by the ratio of segmented bus duct lengths for each fire compartment.

This apportions the total frequency in accordance with the guidance.

Impact on ILRT Extension:

This F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Revision 2 Revison 2Page 114 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5400-CAC-0 Evauaton f Rik Sgniicace o Pemannt IRT xtesio Change Number: MT-15-0016 F&O Number: 1-2 Associated SR(s): HR-E4, HRA-A1, HRA-A2, HRA-A4 Detailed Problem

Description:

Talk-throughs to confirm HEPs and to confirm the response models and 'sequence of events' were conducted during the FPRA development. No follow-on talk-throughs were performed to confirm the response models for the finalized FPRA.

The peer review team performed a walk-through of HFE ALTINJMINYEF. During this walk-through, it was discovered that securing suppression pool cooling valves is needed prior to aligning alternate injection.

This step is not considered in the FPRA HFE development for ALTINJMINYEF. This was only a single HFE that the peer review team selected to walk through.

The review team observes that a talk through of the 'sequence of events' to confirm the HRA modeling would provide assurance that the HRA and PRM development reflects the as-built as-operated plant.

(This F&O originated from SR HR-E4)

Proposed Solution: Talk-throughs to confirm HEPs and to confirm the response models and 'sequence of events' as applicable, particularly for risk-significant HFEs.

oasis for Significance: An issue was identified from just one HFE chosen to be walked down.

Actual Solution:

The original internal events HEPs that were carried over to the FPRA were evaluated in detail through operator interviews and simulator exercise experience. Most recently (July 2014), these HFEs were reviewed by Xcel when conducting the version 3.2 update of the internal events HRA.

Fire specific information used to update these HFEs for the Fire PRA was verified with PRA staff with operations and training experience. New walk-throughs, interviews and simulator exercise observations were conducted for the MCR abandonment HFEs as documented in Appendices C and D of the MNGP Fire HRA Notebook [Reference 46].

However, the Execution step analysis of ALTINJMINYEF in the HRA Calculator does appear to omit the following Step 3 of Part 0 of C.5-3203, as discussed in the Finding:

3. Verify CLOSED the following valves:

MO-2020, RHR DIV 1 DRYWELL SPRAY - OUTBOARD.

MO-2006, RHR DIV 1 DISCHARGE TO TORUS OUTBOARD.

MO-2021, RHR DIV 2 DRYWELL SPRAY - OUTBOARD.

MO-2007, RHR DIV 2 DISCHARGE TO TORUS OUTBOARD.

The Execution portion of this HFE was updated accordingly.

In addition, to ensure that the HRA properly reflects the actions required for fire response, the top 15 risk-significant HFEs of the fire PRA were reviewed against the procedures and the HRA notebook [Reference 46] updated to make changes, as relevant. This review did not yield any changes that would adversely impact the risk results.

Impact on ILRT Extension:

This F&O is resolved. There is no impact on the ILRT Extension Risk Analysis.

Page 115 of 142 Revision 22 Page 115 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0025 F&O Number: 1-3 Associated SR(s): HR-E3, HRA-A1, HRA-A4, HRA-CI, HRA-.E1 Detailed Problem

Description:

Fire specific information used to update the FPIE HFEs for the Fire PRA was verified with PRA staff with operations and training experience. However, no specific documentation of these interactions /

verifications was provided.

New HFE RECRHRSVLY appears to have no documentation of an operator interview.

(This F&O originated from SR HR-E3)

Proposed Solution: Provide documentation of talk-throughs with plant operations and training personnel the procedures and sequence of events to confirm that interpretation of the procedures is consistent with plant observations and training procedures. Ensure that all HFEs modeled in the FPRA receive talk-throughs.

Basis for Significance: Documentation of talk-throughs is needed.

Actual Solution:

As discussed in the response to Finding F&O 1-2, the original internal events HEPs that were carried over to the FPRA were evaluated in detail through operator interviews and simulator exercise experience.

Most recently (July 2014), these HFEs were reviewed by Xcel when conducting the version 3.2 update of the internal events HRA.

As this Finding indicates, Xcel PRA staff with operations and training experience verified the fire specific information used to update these HFEs for the Fire PRA. New walk-throughs, interviews and simulator exercise observations were conducted for the MCR abandonment HFEs as documented in Appendices C and D of the Fire HRA Notebook [Reference 46].

The new fire HFE RECRHRSVLY was also reviewed by cognizant PRA staff, as indicated by the Reviewer signature on the BE Data screen for this HFE in the EPRI HRA Calculator file. For completeness of documentation, further information on this review was added to the Operator Interview Insights screen. However, it should be noted that the action is already proceduralized and the timing is based on a Job Performance Measure (JPM) used for operator training. Plans are to modify the plant fire procedure to add specific cognitive direction for the action.

Documentation regarding the Xcel review of the fire HFEs is given in Section 6.4 of the MNGP Fire HRA Notebook [Reference 46].

Impact on ILRT Extension:

This documentation F&O is resolved. There is no impact on the ILRT Extension Risk Analysis.

Page 116 of 142 Revision 22 Page 116 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0034 F&O Number: 1-4 Associated SR(s): HR-El, HR-G3, HR-G4, HRA-AI, HRA-A2, HRA-B3, HRA-C1, HRA-E1, HR-H2 Detailed Problem

Description:

The following observations were made regarding ensuring that the HRA reflects the as-built as-operated plant.

For HFE MHPVLOCAL-YEF - Fail to operate the HPV using N2 bottles to provide Containment Heat Removal During a Fire Event/SBO, no procedure and no timing are documented.

Also, two risk-significant HFEs were added as part of the FPRA model development based on pending /

draft plant procedures:

ADGMANST-Y - Operator fails to manually start EDG when auto start logic fails during SBO and fire. This action was added based on a pending procedure revision to address post-Fukushima issues. Since this is a pending change, later confirmation will be needed to ensure the FPRA model reflects the as-built, as-operated plant.

RECRHRSVLY - Operator Fails to Manually Control RHRSW Valve CV-1 728 or 1729 in Response to Fire-Induced Failure. Procedure step to be added to Plant Fire procedure to direct operators to procedure B08.01 .03-05, Section H.3. Since this is a proposed procedural change, later confirmation will be needed to ensure the FPRA model reflects the as-built, as-operated plant.

Additional HFEs are listed in Appendix F of the HRA notebook that were developed based on recommended procedure modifications. These are: FW-REFLG-Y, Fail to control FW following reference leg leak, and VFILLCST-Y, Fail to refill the CSTs. When these procedures are implemented, the HRA documentation would need to be revised to ensure the HRA reflects the as-built as-operated plant.

(This F&O originated from SR HR-El)

Proposed Solution: For HFEs that are currently developed based on pending procedure changes or draft procedures, ensure the HFEs reflect the as-built as-operated plant when procedure development is complete.

Basis for Significance: The PRA must reflect the as-built as-operated plant.

Actual Solution:

MNGP Operations reviewed the potential procedure modifications identified in Appendix F of the Fire HRA Notebook [Reference 46] and the following dispositions were made:

For HFE MHPVLOCAL-YEF, it was determined that another procedure (C.5-3505, venting primary containment) already references Plant Fire procedure C.4-A.8-05.08 for the necessary actions.

For FW-REFLG-Y, the necessary action is already addressed by the FDW high pump trip switch on C-06 per procedure C.5-2006 Part C.

For VFILLCST-Y the execution procedure was changed to B.08.09-05 in the "Procedures and Training" tab of the HRAC database, which proceduralizes the refill of the CST by truck and references the SAMG.

Regarding ADGMANST-Y, Operations determined that the procedural direction is already addressed in step 26/27 of the SBO procedure C.4-B.09.02.A. Similarly, for RECRHRSVLY, procedure C.5-3203, Alternate Injection for RPV Makeup, already accounts for the necessary actions.

In summary, all actions identified by the Fire HRA as potentially needing procedure changes are already being addressed by such changes or are already proceduralized.

Impact on ILRT Extension:

The procedures have been revised and this F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Page 117 of 142 Revision 22 Page 117 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0036 F&O Number: 1-5 Associated SR(s): HR-El, HRA-Al, HRA-A2, HRA-El Detailed Problem

Description:

For HFE F-ASDCOG-YEF, Failure to Implement ASD Decision to Abandon MC, there is a mismatch in the HFE label (YIF in Calculator and YEF in the PRM). (This F&O originated from SR HR-El)

Proposed Solution: Ensure the HFE labeling in the PRM and the HRA Calculator are consistent.

Basis for Significance: Documentation issue Actual Solution:

The label should be YIF. Note that the HFE was refined and now comes in flavors: F-ASDCOGx-YIF, where x is 1, 3, 4, 6, or F.

The PRM notebook [Reference 50] was corrected.

Impact on ILRT Extension:

This F&O is a documentation issue and is closed. There is no impact to the ILRT Extension Risk Analysis.

Page 118 of 142 Revision 22 Page 118 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0038 F&O Number: 1-7 Associated SR(s): HR-GI, LE-C2, HRA-B1, HRA-B3, HRA-C1, HRA-E1 Detailed Problem

Description:

One HFE with LERF risk-significance, (FV = .006, RAW =1), MHPVASDS-H2-YEF, Fail HP vent from ASDS with containment deinerted for fire outside the MCR, is quantified as a screening HEP, and no cues, procedures/training, event timing have been defined. (This F&O originated from SR HRA-83)

Proposed Solution: Ensure that all HFEs modeled in the FPRA receive complete definitions, including accident sequence specific timing of cues, and time window for successful completion, accident sequence specific procedural guidance (e.g., AOPs, EOPs), the availability of cues or other indications for detection and evaluation errors (d) the specific high-level tasks (e.g., train-level) required to achieve the goal of the response.

Ensure that risk-significant HFEs received detailed HEP quantifications.

Basis for Significance: Risk-significant HFE that has not been defined nor developed with a detailed evaluation.

Actual Solution:

HEPs MHPVASDS-H2-Y, MHPVASDS-PD-Y, and MVENTCONT-H2-Y were removed in the internal events model revision 3.3 and in the Fire PRA and replaced with MHPVASDS-Y since this HEP is fully developed (detailed analysis in the HRA Calculator) and is all actions are similar. MVENTCONT-PB-Y, and MVENTCONT-PD-Y were also removed and replaced with MVENTCONTY (detailed analysis in the HRA Calculator) based on similarity of actions. These actions were initially placed in the internal events model for sensitivities.

Impact on ILRT Extension:

This F&O is closed, and there is no impact to the ILRT Extension Risk Analysis.

Page 119 of 142 Revision 2 Revision 2 Page 119 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0015 F&Q Number: 1-19 Associated SR(s): QU-D5, FQ-E1, FQ-F1, HR-G7, HR-H3, HRA-CI, QU-C2, LE-E4, LE-F2, UNC-A2 Detailed Problem

Description:

The HRA dependency analysis uses a joint HEP floor of 1E-7, which is low relative to the guidance (which recommends 1E-6 or 1E-5 depending on the scenario / sequence) particularly in the context of fire scenarios.

The peer review examined the risk-significant dependent HFE combinations risk achievement worth significance and found none with HFE combination probabilities less than 1E-5. However, dependent combinations with low floors may be truncated by the 1 E-12 truncation level. Therefore, it is unknown whether the use of the I1E-7 floor produces a risk-significant impact.

(This F&O originated from SR QU-D5)

Proposed Solution: Examine through sensitivity studies whether use of a higher joint HEP floor, or a lower PRA truncation, would produce risk-significant changes to the FPRA results, and consider the use of a higher joint HEP floor if so.

Basis for Significance: Potential risk-significant impact.

Actual Solution:

The dependency analysis was revised and performed with a general joint HEP floor set to 1.0E-05. For some combinations that involve long-term decay heat removal actions or LERF-reduction specific actions, a minimum joint HEP floor of 1E-06 was used. Maintaining a lower minimum joint probability for these combinations is appropriate because they will take place many hours after the fire, at which point the activation of the Technical Support Center (TSC) would be able to provide a mind frame that allows for a 1E-06 minimum joint dependency threshold. This is documented in the Fire Human Reliability Analysis Notebook [Reference 46].

Impact on ILRT Extension:

This F&O is closed, and there is no impact to the ILRT Extension Risk Analysis.

Page 120 of 142 Revision 22 Page 120 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0019 F&O Number: 1-22 Associated SR(s): HRA-CI Detailed Problem

Description:

The following HFEs contribute significantly to the FPRA results (FV value for the HEP is above 0.005 or the HFE combination(s) in which some appear are above 0.005):

ADGMANST-Y - Operator fails to manually start EDG when auto start logic fails during SBO and fire C4H-EASY-YEF - Fail to restore loads (simple CR action) after LOSP and ECCS load shed given a fire outside the MCR HPI-CNTRLYEF - Fail to control FW, HPCI, or RCIC following a transient given a fire outside the MCR HPI-CNTRLYIF - Fail to control FW, HPCI, or RCIC following a transient given a fire inside the MCR MHPVLOCAL-YEF - Fail to operate the HPV using N2 bottles to provide Containment Heat Removal During a Fire Event/SBO RECBKRVLVYEF - Fail to locally operate breaker or valve on loss of 125 VDC or other circuit failure (exMCR fire)

XDEP40MINYEF - Fail to depressurize within 40 minutes (transient, no SORV) given a fire outside the MCR The HEPs for these HFEs are quantified from the perspective that the relevant cues are degraded (some but not all of the cues are unavailable or spuriously operating). Consideration has not been given to modeling versions of the HFEs where cues are not degraded, and therefore more realistically 'taking into account the context presented by the fire scenarios in the Fire PRA'.

The FPRA development team indicated that because the operators may be distracted by spurious fire induced alarms or misleading ancillary instrumentation not explicitly modeled in the Fire PRA logic. It was considered that failing to account for this possibility may cause the fire risk to be inadequately represented in the model. This is considered by the review team to be a reasonable assessment for the initial FPRA quantifications. However, further consideration is judged to be warranted to assess whether consideration be given to modeling HFEs for the condition where cues are available for the action.

Proposed Solution: Consider defining and modeling HFEs for applicable fire scenarios in which cues are not impacted.

Basis for Significance: Potential risk-significant impact Actual Solution:

The issue of operator distraction or confusion from spurious or potentially contradictory cues has been a key concern of U.S. NRC personnel involved in evaluating and auditing fire HRA. Since the current modeling approach to assess fire HFEs by presuming degraded cues addresses those concerns and is, by the Peer Review's admission "considered by the review team to be a reasonable assessment for the initial FPRA quantifications", no changes were made. Furthermore, these distinctions are not required by the ASME PRA standard. Since this is only a slightly conservative assumption, it does not significantly impact the PRA model and its insights.

Impact on ILRT Extension:

The F&O is resolved. There is no impact on the ILRT Extension Risk Analysis.

Page 121 of 142 Revision 22 Page 121 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0049 F&O Number: 3-4 Associated SR(s): AS-Al0, AS-A4, PRM-B5, PRM-B6, PRM-CI, HRA-B3, HRA-Cl Detailed Problem

Description:

The dominant HFE for the PRA is the failure to provide safe shutdown after control room evacuation.

These actions are aggregated into 3 HFE's, one for a) cognition to evacuate the main control room, b) establishing EDG, c) all other execution actions required for safe shutdown. HFE for a) and b) appear to be reasonable. HFE for c) is quantified by adding 29 separate actions into an aggregated HFE. 21 of the 29 actions are 'recovered'. However, the HRA of the execution error has several unsupported (or weakly supported) assumptions and calculations. The required manpower for this action is only 4 staff. The number of staff required for recovery of 21 actions in 25 minutes is not discussed or justified. The timing is to start at 10 minutes, be completed by 40 minutes and takes 25 minutes to complete. Of the 21 actions applied with recovery, 4 are High dependence and 17 are medium dependence. The timing to substantiate medium dependency is not justified. (This F&O originated from SR HRA-D2)

Proposed Solution: Develop a supportable basis for the aggregate execution HFE for control room evacuation. Provide sensitivity studies for assumptions about manpower, timing, recovery, and dependency.

Basis for Significance: Potentially risk-significant impact Actual Solution:

As part of the path forward for the resolution of F&O 1-20, the HFE execution actions were re-evaluated to 1) remove the extraneous actions that are not credited for mitigation purposes, and 2) group together under separate, individual HFEs the sets of actions that accomplish the same function (pressure/inventory control, and decay heat removal).

In addition, as part of the path forward for the resolution of F&O 1-26, the time windows for the actions supporting ASO were refined into various cases representative of the latest timing data associated with various fire scenarios.

These refinements provide a more realistic representation of the HFEs modeled for MCR abandonment, and a firmer basis for the assumptions made about manpower, timing, recovery, and dependency.

The analysis is documented in Section 8.0 of the Fire HRA Notebook [Reference 46].

Impact on ILRT Extension:

The F&O is resolved. There is no impact on the ILRT Extension Risk Analysis.

Page 122 of 142 Revision 22 Page 122 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-01 04 F&O Number: 6-6 Associated SR(s): AS-Al10, HR-G3, AS-A4, PRM-B5, PRM-B6, PRM-C1, HRA-B3, HRA-CI, HRA-A2 Detailed Problem

Description:

The entry condition for the C.4-C Abnormal Procedures requires the plant operations to determine control room evacuation is required. For cases where the fire is burning for longer than ten minutes as directed by the procedure, or abandonment is imminently obvious, the decision to abandon may be more obvious and indicative of the timing assumed. However, for fires that are suppressed earlier than ten minutes, the cognitive decision to transfer control may require more time than the 10-minute time delay modeled in the PRA, which impacts the time available to perform the ASD actions modeled by HFE, F-ASDEXE-YIF.

Currently the Tsw for F-ASDEXE-YIF is 40 minutes, the Tdelay is 10 minutes, the Tcog is 0 minutes and Texe is 25 minutes, leaving 5 minutes for recovery. However, if the decision to leave the control room is more than 10 minutes, less time will be available for recovery (potentially changing the recommended dependence for recovering execution errors from high dependence to complete dependence) and potentially insufficient time will be available to perform alternate shutdown.

For example, for fire scenario FC9-MCR-1 P-C-263A, a back panel in the main control room is suppressed within five minutes, and only the panel is damaged. Control room is modeled to be eventually abandoned due insufficient control of the plant, and the review team considers that the cognitive decision to transfer control may require more time than 10-minutes time postulated.

The peer review also observed that the alternate shutdown modeling does not account for differences in timing that could arise from MSO scenarios (e.g., SRVs spuriously open).

(This F&O originated from SR HRA-B2)

Proposed Solution: Evaluate the timing defined for the alternate shutdown actions to ensure the HFE definition and modeling to ensure model realism.

Basis for Significance: Potential risk-significant impact Actual Solution:

T/H analyses documented in PRA-CALC-15-003 ("Fire PRA MAAP Analysis") were recently performed to ascertain the time available for human actions at the ASDS panel. These T/H analyses account for various levels of fire damage (for example, the numbers of SRVs spuriously opening), each yielding a different time window.

As part of the resolution of the present F&O and also F&Os 1-20 and 1-26, several human failure events (HFEs) were developed to more realistically represent the timeline of needed human actions under the various fire damage configurations mentioned above.

Refer to Section 8.0 of the Fire HRA Notebook [Reference 46] for details of the analysis.

The HFEs were developed in concert to ensure a coherent integration of their timeline and enhance model realism. With that approach, the timing for the cognitive decision to abandon for fire scenarios that eventually lead to a loss of control was based on the functional impacts of the fire, in particular with regard to reactor pressure and inventory control functions. Because these specific functions are called out in the first minutes following plant trip (i.e., need to establish high-pressure injection, and depressurize if it is unavailable), the operators would be alerted to their loss early in the process. In that respect, the actual duration of the fire is of secondary importance or irrelevant altogether. This is also true of those fire scenarios that eventually lead to loss of control but over a relatively long time window (for example, 40 min as opposed to 20 mai). For these fire scenarios, the decision to abandon is determined by the functions that are lost, not by the duration of the fire. Finally, if the fire affects key systems relatively late in the process (for example, a high-pressure injection system runs initially, but then fails after 15 min), the time window for deciding to abandon would shift, at least, by the amount of time during which cooling occurred.

Impact on ILRT Extension:

This F&O is resolved. There is no impact to the ILRT Extension Risk Analysis.

Revision 2 Page 123 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0031 F&O Number: 1-37 Associated SR(s): QU-D7, EQ-El Detailed Problem

Description:

No documentation was provided of a review of the importance of components and basic events to determine that they make logical sense.

Proposed Solution: Review the importance of components and basic events to determine that they make logical sense.

Basis for Significance: Review of the importance of components and basic events to determine that they make logical sense is required.

Actual Solution:

The FPRA Quantification notebook [Reference 36] at the time of peer review did not include descriptions of the importance results that were listed in Section 5.4. The updated notebook [Reference 36] includes a summary of the importances for each table of importance results and details on the reasoning for their importance.

Impact on ILRT Extension:

This is a documentation F&O and is closed. There is no impact on the ILRT Extension Analysis.

Change Number: MT-I15-0096 F&O Number: 6-10 Associated SR(s): QU-B2, QU-B3, LE-E4, FQ-D1, FQ-B1 Detailed Problem

Description:

No LERF convergence test for the quantification truncation level was performed.

Proposed Solution: Perform truncation convergence test for LERF.

Basis for Significance: Test for convergence required.

Actual Solution:

The updated FPRA Quantification notebook [Reference 36] includes a LERF convergence test and associated documentation.

Impact on ILRT Extension:

The F&O is resolved, and there is no impact on the ILRT Extension Analysis.

Page 124 of 142 Revision 22 Revision Page 124of142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0037 F&O Number: 1-6 Associated SR(s): QU-E1, QU-E2, AS-C3, DA-E3, HR-13, LE-F3, LE-G4, QU-E4, QU-F4, QU-F5, FSS-H9, IGN-B5, UNC-A1, FQ-F1, HRA-E1, SC-C3, SY-C3, UNC-A2 Detailed Problem

Description:

The treatment of uncertainties is documented in the Uncertainty and Sensitivity notebook, 016015-RPT-15 Rev. la. The Uncertainty and Sensitivity notebook documents a significant effort to identify sources of model uncertainty, however, the spectrum of uncertainties documented is considered incomplete particularly with respect to assumptions made as part of the FPRA development that have not been identified or characterized as model uncertainties in the Uncertainty and Sensitivity notebook and also, in some cases, generic FPRA model uncertainties recommended for inclusion by EPRI 1026511, PRA Applications and Uncertainty.

A) The following summarizes potential additional areas of modeling uncertainty suggested to consider and document:

ES - Additional potential sources of model uncertainty that arise from MNGP FPRA ES notebook assumptions, but not documented by the Uncertainty and Sensitivity notebook are: 1) the screening of MSO scenarios based on the number of hot shorts, 2) passive components have been excluded from the equipment selection, but no discussion is provided for potential heat impacts to indications that rely on reference legs, 3) instrument air piping is appropriately assumed to be failed due to soldiered joints for specific fire scenarios, but modeling uncertainty may be introduced based on the locations of this piping relative to the zones of influence.

PRM - Additional potential sources of model uncertainty that arise from MNGP FPRA PRM notebook assumptions, but not documented by the Uncertainty and Sensitivity notebook are: 1) Assigning the same initiating event to all scenarios in a compartment is conservative. In reality, the operators may initiate a controlled shutdown, precluding some equipment failures; 2) the underlying assumptions and uncertainties identified in MNGP PRA Rev 3.1 PRA model apply to the FPRA as well, and these appear to be discussed in the Uncertainty and Sensitivity notebook; 3) the fire water system alternate supply to RHR via LPCI has not been included due to assumed low significance, but may be revisited later in order to refine the FPRA model.

IGN - Additional potential sources of model uncertainty that arise from MNGP FPRA IGN notebook assumptions, but not documented by the Uncertainty and Sensitivity notebook are: 1) for zones where the analysis shows no cable loading information (i.e. no PRA related cables), a value is used to account for non-PRA related cable loading in the zone; 2) Fire ignition frequencies remain constant over time; 3)

Among the plants, total ignition frequency is the same for the same equipment type, regardless of differences in the quantity and characteristics of the equipment type that may exist in the plant; 4) Within each plant, the likelihood of fire ignition is the same across an equipment type. For example, pumps are assumed to have the same ignition frequency regardless of size, usage level, working environment, etc.

FSS - Some additional sources model uncertainties to consider would be the impact of hot short events to alternate shutdown, the treatment of smoke effects on equipment, and selection of main control board scenarios. Additionally, the following potential sources of model uncertainty were identified by the review team: 1) all cable is assumed to be unqualified for damage and heat release rate. This assumption introduces potential conservative results where qualified cables may be present; 2) performance of CFAST modeling using standardized evaluation volumes that are used to represent actual compartment spaces introduces the potential for conservative and non-conservative results; 3) the treatment of compartment configuration is considered minimal because it is taken from plant drawings, however the actual modeling treatment introduces uncertainty.

CF - An additional potential source of model uncertainty that arises from MNGP FPRA CF notebook assumptions, but not documented by the Uncertainty and Sensitivity notebook is: except as noted in the circuit failure mode notebook, the conditional probability of circuit failure leading to the failure mode of interest given fire-induced cable damage is assumed to be 1.

HRA - Additional potential sources of model uncertainty that arise from MNGP FPRA HRA notebook Revision 2 Page 125 of 142

54003-CALC-02 of Risk Significance of Permanent ILRT Extension 5400-CAL-02Evaluation assumptions, but not documented by the Uncertainty and Sensitivity notebook are: 1) Operator access to areas of the plant controlled by card reader access is determined to have a negligible effect on the timing of operator action performance in this analysis; 2) The crew is aware of the fire location within a short time (i.e. within the first ~-10 minutes of a significant indication of non-normal condition by fire alarms, multiple equipment alarms, and automatic trip); 3) It is assumed that most fires will be extinguished or contained within 70 minutes of the start of the fire, except for more challenging fires (i.e., turbine generator [TIG]

fires, outdoor transformers, high-energy arcing faults, and flammable gas fires). For this reason, operator actions occurring more than 60 minutes after the start of the fire are generally assumed not to be penalized for fire effects; 4) The crew is aware of the need for a plant trip (if it is not automatic); 5) The crew is aware of the need to implement the fire brigade; 6) The crew is aware of the potential for unusual plant behavior as a result of the fire; 7) In general, a fire anywhere in the plant introduces new accident contextual factors and potential dependencies among human actions beyond those typically treated in the internal events PRA that increase (mildly or significantly) the potential for unsafe actions during an accident sequence; 8) Even if one or more Control Room staff members is used to assist in ex-control room activities such as aiding the fire brigade, the minimum allowable number of operators remains available in the Control Room to manage the safe shutdown of the plant, and the crew makeup is similar to that assumed in the Internal Events PRA.

EQ - Assumptions documented in the FQ notebook introduce sources of modeling uncertainty that have not been documented in the Uncertainty and Sensitivity notebook: 1) For 'full-compartment burn' scenarios, all raceways, conduits, and components within the fire compartment, as provided by FRANX, are assumed to fail or operate spuriously, as applicable, with assigned circuit failure mode probabilities if specified. 'Full compartment burn' scenarios are those in which no detailed analysis has been performed and the full compartment is failed at the time of fire ignition; 2) For unscreened multi-compartment fire scenarios, it is assumed that all raceways, conduits, and components within both the exposing fire zone and the exposed fire zone 01601 5-RPT-14 Task Interfaces and Assumptions Revision la Page 7 are failed or operate spuriously, as applicable, with assigned circuit failure mode probabilities if specified, if the fire mitigating systems, such as the fire barrier and the detection/suppression system(s) fail to operate; 3) It is assumed that certain fires in the main control room (Fire Area 9) or relay room (Fire Area

8) may force control room abandonment, requiring the plant to be shutdown manually from outside the main control room (i.e., at the ASDS). One additional modeling uncertainty to consider would be the potential impact of multiple conservatisms to the FPRA results (recommended for inclusion by EPRI 1026511 PRA Applications and Uncertainty).LERF - No identification / characterization of LERF sources of model uncertainty and related assumptions was found in the FPRA documentation.

AS - No model uncertainties associated with the alternate shutdown modeling are provided or characterized.

SC - Regarding spurious SRV opening due to hot short impact analysis performed under EPU and MSO conditions (EC 20955) demonstrated that spurious operation of the SRVs in the ASDS scenario for seven minutes would not adversely impact Monticello's safe shutdown analysis, and would not jeopardize the safe and stable condition of the fuel. Based on observation by the peer review, the referenced calculation, EC 20955, does not support this claim.

SY - No sources of modeling uncertainty and related assumptions are identified for SY.

B) Further, the effects to the FPRA are addressed in very general terms and not specifically characterized. The following summarizes the peer review observations:

ES - One source of modeling uncertainty is identified by the Uncertainty and Sensitivity notebook, which is that the systems assumed to be failed introduce conservatism, with no further discussion. No characterization is provided on the degree to which the conservatism impacts the results, and which portions of the FPRA and the FPRA results are significantly impacted.

PRM - The Uncertainty and Sensitivity notebook reviewed the FPIE sources of model uncertainty, and considered these in the context of fire: 1) the potential to open doors for DG fire pump alternate HVAC are based on room heat up calculations, which have inherent uncertainties, and for fire, the DG fire pump has an enhanced role as a source of alternate injection, thus magnifying the uncertainties, but no specific characterization is provided, such as the quantitative magnitude of the uncertainties to the base FPRA model, 2) operator action for replacement of nitrogen bottles has a system time window of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, but calculations show that the bottles will satisfy the 24-hour mission time, which has a significant impact on Revision 2 Page 126 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5403-CLC-2 Ealutio o Rik Sgniicace f ermnen ILT Etenio the FPRA results, but no further discussion is provided on the magnitude of this impact nor areas of the PRA significantly impacted; 3) HPCI NPSH is modeled in the FPIE PRA to not require closure of MO-2064, although such closure is required by the design basis documented. This modeling approach was carried over into the Fire PRA and as such is a source of uncertainty, potentially magnified by the fact that fire-induced spurious operation could prevent successful closure of the valve, but no specific characterization of the impact to the FPRA model is provided.

HRA - Uncertainties introduced by the industry consensus dependent HRA methodology utilized for the MNGP FPRA are discussed very well, but no characterization of the affect to the PRA is provided, such as the HFE combinations that are risk-significant and a discussion regarding the level of realism represented by this risk-significant combinations.

C) Last, the sources of model uncertainty documented in the Uncertainty and Sensitivity notebook do not specifically document the related assumptions. Conversely, generally for the assumptions documented in each of the FPRA notebooks sources of model uncertainty have not been documented. These issues may be remedied by 1) identifying and documenting the related assumptions for each model uncertainty documented in the Uncertainty and Sensitivity notebook, and 2) rolling up the assumptions documented in each of the notebooks for the FPRA technical elements, placing them into the Uncertainty and Sensitivity Notebook, and documenting the model uncertainties related to each of the assumptions.

(This F&O originated from SR HR-13)

Proposed Solution: Document a more thorough spectrum of sources of model uncertainty, and characterize the impact to the PRA results of each identified model uncertainty.

For each source of model uncertainty, document the related assumptions.

Basis for Significance: Characterization of uncertainty is good, but is not thorough, particularly with respect to assumptions made as part of the FPRA development that have not been identified characterized as model uncertainties in the Uncertainty and Sensitivity notebook.

Section 1 of RG 1.200, 'A Technically Acceptable PRA,' is clear on stating that the impact to the FPRA results is to be characterized:

'Sources of uncertainty (both parameter and model) are identified and their impact on the results assessed. A source of model uncertainty is one that is related to an issue for which there is no consensus approach or model (e.g., choice of data source, success criteria, reactor coolant pressure seal LOCA model, human reliability model) and where the choice of approach or model is known to have an impact on the PRA results in terms of introducing new accident sequences, changing the relative importance of sequences, or significantly affecting the overall CDF, LERF, or LRF estimates that might have an impact on the use of the PRA in decision-making.'

Additionally, characterization of model uncertainties includes identifying the related assumptions.

Actual Solution:

A table was added to Appendix B of the Fire PRA Uncertainty and Sensitivity Analysis, which addresses assumptions listed for each of the individual analyses for the fire PRA. Each of these assumptions is evaluated as to whether or not it is a source of uncertainty in the Fire PRA as well as the overall impact to the Fire PRA.

Impact on ILRT Extension:

This documentation related F&O is closed. There is no impact on the ILRT Extension Risk Analysis.

Page 127 of 142 Revision 22 Page 127 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0045 F&O Number: 2-6 Associated SR(s): SF-A4 Detailed Problem

Description:

Section 6.4 and 6.5 of the Seismic Fire Interaction Notebook provide a discussion of how plant fire detection and suppression systems may be expected to respond to a seismic event including discussion of the potential impact of system actuations. Section 7.0 of the notebook includes a discussion of how these failures may impact plant response however this discussion is not clearly linked to a review of the plant seismic response procedures.

Proposed Solution: Document the plant seismic response procedures evaluated and document the potential impact of a seismically induced fire and spurious actuation of a fire system to the performance of seismic responses.

Basis for Significance: This SR requires the performance of a qualitative assessment of the potential impact of seismically induced fires and spurious actuation of fire detection/suppression systems review on a seismic response based on review of the plant seismic response procedures.

Actual Solution:

Procedure 4 AWI-08.01 .01, Section 4.5.4 states that site management personnel are responsible for

• Ensuring medically qualified personnel complete fire brigade training

• Ensuring that the content of the brigade training is adequate. This training consists of, in part, a review of all fire protection procedures and strategies.

Such a review of all fire protection procedures and strategies will help in preparing the fire brigade for response following a seismic event.

Additionally, Operations Manual C.4-B.05.14.A, provides direction to isolate close fire protection valve FP-37 (To Admin & Rx Building Headers) if a significant fire system leak occurs in the Plant Administration Building. If FP-37 does not close, then direction is given to close additional valves FP-49, FP-36, and FP-1 14. Isolation of the fire protection system to the Plant Administration Building is required to reduce the risk of flooding the Access Control areas to a depth of 20 inches that would impact I125VDC and 250 VDC battery operability.

Impact on ILRT Extension:

The F&O is closed, and there is no impact on the ILRT Extension Analysis.

Page 128 of 142 Revision 22 Revision Page 128 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0046 F&O Number: 2-7 Associated SR(s): SF-A5 Detailed Problem

Description:

Section 6.6 of the Seismic Fire Interaction Notebook provides a discussion of the potential impact of a seismic event on manual firefighting efforts. The discussion centers around the challenges that the fire brigade may face and the potential for loss of access to their equipment for fighting fires. The discussion does not include an assessment of the fire brigade training procedures or the extent to which this training prepares the brigade members to response to a seismically induced fire response. The discussion of the availability of firefighting material establishes that this equipment is stored in two separate areas and it concludes that this separation should provide access to one or the other following a seismic event, however no justification for this conclusion is provided.

Proposed Solution: Review and assess the fire brigade training procedures with respect to their preparation for response to a seismic event and provide justification for the post-earthquake availability of necessary firefighting resources.

Basis for Significance: SR requires that the fire brigade training procedures be reviewed to assess the extent to which the brigade is prepared for response to a seismic event and their ability to respond with respect availability of firefighting equipment and resources.

Actual Solution:

Procedure 4 AWl-08.01 .01, Section 4.5.4 states that site management personnel are responsible for

• Ensuring medically qualified personnel complete fire brigade training

• Ensuring that the content of the brigade training is adequate. This training consists of, in part, a review of all fire protection procedures and strategies.

Such a review of all fire protection procedures and strategies will help in the preparation of a post-seismic event firefighting resources.

Operations Manual C.4-B.05.14.A, provides direction to isolate close fire protection valve FP-37 (To Admin & Rx Building Headers) if a significant fire system leak occurs in the Plant Administration Building.

If FP-37 does not close, then direction is given to close additional valves FP-49, FP-36, and FP-114.

Isolation of the fire protection system to the Plant Administration Building is required to reduce the risk of flooding the Access Control areas to a depth of 20 inches that would impact 125VDC and 250 VDC battery operability.

Classroom and hands-on debris removal and tool use/safety training is provided to fire brigade members under MNGP lesson plan MT-OPS-FB-006L. This training covers the use of equipment used to clear debris in the aftermath of natural events including earthquakes. Redundant debris removal equipment is stored in multiple locations to assure protection and access to equipment is reasonably assured following a seismic event.

Impact on ILRT Extension:

The F&O is closed, and there is no impact on the ILRT Extension Analysis.

Page 129 of 142 Revision 22 Page 129 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0086 F&O Number: 4-7 Associated SR(s): SF-A3 Detailed Problem

Description:

Section 6.5 states that the procedure to provide alternative fire water directly from the river depends on the fire main being intact. The notebook does not document the assessment of the common cause failure of the yard mains and provide justification for the ability to suppress fires for this failure.

Proposed Solution: Include the assessment of the impact of the common cause failure of the yard mains on the potential to provide fire suppression capability.

Basis for Significance: The notebook does not address suppression capability in the event of the unavailability of the fire main.

Actual Solution:

Site Procedure A.8-02.06, Fire System Management Strategies, provides directions to isolate portions of the fire system in the event of damage or inadvertent actuation. Additionally, this procedure also provides directions to setup a Portable Diesel Fire Pump in order to supply water to backfeed the fire system or to supply water to the plant bypassing all of the fire system.

By this site procedure, the fire brigade is directed to choose the connection point for the portable diesel fire pump. The following options are listed in the procedure in order of preference:

CONNECT one 5-inch supply hose to Fire system at 5-inch Storz connection at north end of #11 Cooling Tower.

CONNECT two 5-inch supply hoses to Fire system at hydrants. [Note: If the Intake Structure was isolated in Step 5.f., feeding Fire system thru Hydrant House #2 is NOT available and a further away hydrant will have to be used.]

CONNECT one 2-1 /2-inch hose to the fire system at Hydrant House #2 (PDP suction from Intake).

In the event that a portion of the fire main is unavailable following a seismic event, the fire brigade is directed to isolate those portions of the system. After the unavailable portions of the fire main are isolated, the fire brigade will choose the appropriate connection point for the portable diesel fire pump, thereby delivering water to the fire system.

In addition, Operations Procedure C.5-3203 (Use of Alternate Injection systems for RPV Makeup) Part D prescribes makeup to the reactor vessel using the fire crosstie to LPCI, which depend on major portions of the fire main being intact. New sections of the C.5-3203 procedure (Parts F and H) now accommodate portable fire pump tie-in to LPCI using fire hoses, thus not being dependent on the fire main being intact.

Impact on ILRT Extension:

The F&O is closed, and there is no impact on the ILRT Extension Analysis.

Page 130 of 142 Revision 22 Revision Page 130 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0007 F&O Number: 1-10 Associated SR~s): LE-F2, UNG-A1 Detailed Problem

Description:

The Fire Quantification notebook, 016015-RPT-14 Rev. la) documents the FPRA results, including discussion of significant fire scenarios, and documentation of the contributions of fire risk by PAU. No discussion is provided however of a review of the contributors from the perspective of reasonableness to assure that excessive conservatisms have not skewed the results. The FPRA development team acknowledges the need for enhancing FPRA realism in light of the relatively high CDF and LERF results, and high risk contributions from specific PAUs, multi-compartment fire scenarios, and one particular HFE carried over from internal events PRA. These enhancements are still underway.

Proposed Solution: Review risk contributors for reasonableness (e.g., to assure excessive conservatisms have not skewed the results, level of plant-specificity is appropriate for significant contributors, etc.).

Basis for Significance: A review of risk contributors for reasonableness is needed to demonstrate technical adequacy of the FPRA.

Actual Solution:

Cutset reviews were performed during the update of the FPRA and during those reviews reasonableness of modeling and results was considered, especially the LERF model. Particular attention was paid to ensure that excessive conservatisms in the model were modified to ensure that the model was sufficiently realistic.

The cutset reviews were documented in the updated FPRA Quantification notebook and included to document the review of reasonableness in the model [Reference 36].

Impact on ILRT Extension:

Since the model was refined to increase realism, the F&O is closed, and there is no impact on the ILRT Extension Analysis.

Revision 2 Revison 2Page 131 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0024 F&O Number: 1-29 Associated SR(s): FSS-B2 Detailed Problem

Description:

The Main Control Room Analysis Notebook 01601 5-RPT-07 incorporates a 10 minute propagation to adjacent panels based on the guidance in Appendix S of NUREG/CR-6850. The lack of Main Control Board partitioning between panels may not support the use of the Appendix S timing.

Proposed Solution: Assess the Main Control Board partitioning between panels to ensure the Appendix S propagation timing is appropriate and provide justification. Alternatively, utilize a method to model the propagation between panels.

Basis for Significance: The propagation timing to the adjacent panels would impact the non-suppression probabilities and time to abandonment.

Actual Solution:

Per Appendix S of NUREG/CR-6850, the propagation time between panels was assumed to be ten minutes when there is a potential for cables in an adjacent panel to be in contact with the panel boundaries. The MNGP Fire PRA uses this ten minute propagation time, which is the value recommended in the guidance. However, due to the lack of partitioning between panels of the Main Control Board, an additional sensitivity analysis was conducted to evaluate the impact of changes to this propagation time.

The sensitivity analysis postulates fire propagation between panels at both five and fifteen minutes after ignition. In order to minimize the flow of combustion products out of the model domain and develop a conservative analysis, it is assumed the mechanical ventilation system is inoperative and all doors remain closed. The results for the abandonment times for the sensitivity analysis are shown in Table 1 below.

Sensitivity to the Time for Cabinet Propagation when the Mechanical Ventilation is Inoperative and All Doors Remain Closed Abandonment Time (min)

Fire Scenario Sensitivity Condition Bin 4 Heat Bin 8 Heat Bin 12 Heat Release Rate Release Rate Release Rate Base (10 minutes) 10.5 (T) 7.0 (T) 5.6 (T)

MCR Open Electronic Cabinet;5miue8.(T66()55()

Multiple Bundles; Spreads5miue8.(T66()55()

15 minutes 10.6 (T) 7.0 (T) 5.6 (T)

The results are considered to be not sensitive to variations in the assumed time for propagation between cabinets. The sensitivity results are discussed below.

• Multiple cable bundle electrical panel fire in the MCR (propagating), variations in abandonment time was less than 2 minutes for a very conservative propagation time of 5 mai. For a propagation time of 15 min, the resulting abandonment time was very similar to the one obtained with the base assumption of 10 minutes.

• Multiple cable bundle electrical panel fire in the MCR (propagating), variations in abandonment time was less than 1 minutes for a very conservative propagation time of 5 min. For a propagation time of 15 min the resulting abandonment time was very similar to the one obtained with the base assumption of 10 minutes.

Since the results of the sensitivity analysis does not suggest large differences in the abandonment times, particularly for the conservative assumption of 5 minutes of propagation between panels, the results assuming 10 minute propagation following the guidance of NUREG/CR-6850 are justified.

Impact on ILRT Extension:

The F&O is closed, and there is no impact on the ILRT Extension Analysis.

Revision 2 Page 132 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0060 F&O Number: 4-17 Associated SR(s): FSS-B2 Detailed Problem

Description:

The Main Control Room Analysis Notebook identifies a non-suppression value for fires limited to the panel based on a time to prompt suppression of 'about 3 minutes'.

Proposed Solution: Provide detailed justification in the Main Control Room Analysis Notebook to support the use of a prompt suppression value in addition to the non-suppression values calculated in the CFAST abandonment models.

Basis for Significance: There is no justification for this value of the time of 3 minutes to prompt suppression.

Actual Solution:

The second revision of manual fire suppression events contained within Supplement 1 to NUREG/CR-6850 reflects the overall process of manual fire suppression in a more continuous manner, crediting suppression activities which begin as soon as a fire has been detected. In the case of the Main Control Room, operators staff this location on a permanent basis. Therefore a fire event that is promptly suppressed accounts for manual suppression by operators before the fire ignition source develops and spreads. Most fires will burn out or be detected by operators in the incipient stage and will be extinguished before spreading.

Supplement I to NUREG/CR-6850 gives manual non-suppression probability for the Main Control Room of 0.33 min-1. Using this value, the time available for suppression prior to spread beyond localized effects is 1/0.33 min-1 . This calculation yields an average time to manual suppression of 3 minutes.

This average time to manual suppression corresponds to values presented in Table 9-1 of the Main Control Room Abandonment Notebook [Reference 54]. In comparison to the values given in Appendix L of NUREG/CR-6850, the likelihood of damage of localized targets used in the Monticello Fire PRA exceeds even the largest value given in Figure L-1 of NUREG/CR-6850. In the MNGP Fire PRA, the split fraction for a fire that is promptly suppressed (i.e., the fire damage remains very localized, which is consistent with all of the main control room fire events considered in the development of the generic frequency value), is obtained solving the exponential distribution for Pr(t < 3 minutes) = 0.63. This is the probability that the damage is limited to the ignition source within the panel by prompt suppression activities. The conditional likelihood of "very localized damage" in NUREG/CR-6850, is much smaller, 8.5E-03.

Impact on ILRT Extension:

The F&O is closed, and there is no impact on the ILRT Extension Analysis.

Page 133 of 142 Revision 22 Page 133of142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent LLRT Extension Change Number: MT-I15-0082 F&O Number: 4-38 Associated SR(s): FSS-B2 Detailed Problem

Description:

The Main Control Room Analysis Notebook 016015-RPT-07 does not address the potential of transient scenarios impacting multiple MCBs or panels. The analysis only assigns a geometric factor of 0.01 for the fraction of transient fire frequency for transients adjacent to the panels which is applied to each panel scenario.

Proposed Solution: Postulate transient scenarios in the Main Control Room that could impact multiple MCBs or panels based on their location on the floor with respect to the zone of influence. Additionally, provide technical justification for the geometric factor of 0.01 for the fraction of transient fires added to the electrical panel frequency.

Basis for Significance: Scenarios do not address the risk impact of fire damage to multiple MOBs or panels.

Actual Solution:

The following F&O response is broken down into two sections: (1) Correction to the use of geometric factor and (2) Revised approach to address potential transient scenarios impacting multiple MCBs or panels.

(1) Correction to Use of Geometric Factor Using the point source flame radiation model described in Section 9.2.5 of the Report 01601 5-RPT-07, it was determined that a transient fire may damage a MCB panel or electrical cabinet if the transient fire is located within 4 feet of that panel.

Using this critical distance, the open floor area around each panel is then measured. This open floor area is used to determine the geometric weighting fraction for each MCB Panel and Electrical Cabinet in the MCR. In Figure 1, the shaded area indicates the open floor area within which a postulated transient fire would damage the panel or cabinet.

PaeEecrcal cabinet or Main rtta..

ithcont*rol Board Panel LItn Panel Length "

Figure 10-1: - Example of Main Control Room Transient Fire Area After measuring the width and length of each panel, the open area around each panel is calculated.

This area is then divided by the total floor area of the Main Control Room to determine the geometric ratio. The risk contribution of transient fires is then captured by adding the geometrically weighted transient fire frequency to the fixed source frequency for each analyzed scenario.

Page 134 of 142 Revision 22 Page 134 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension (2) Revised Approach to Transient Fires Impacting More than One Panel As described in Section 9.1.1 of Report 016015-RPT-07, there are five sequences that describe each fire postulated in the Main Control Room. For each of these five sequences, the ignition frequency of the transient fires calculated in Item (1) of this F&O response is added to the ignition frequency of the panel.

In the cases of Sequences 3 and 4, the fire continues to grow after prompt suppression fails. Sequences 3 and 4 include targets damaged by the radiative fire effects of the ignition source. In other words, MOB panels and electrical cabinets within the radiative zone of influence of the ignition source are damaged during Sequences 3 and 4.

A portion of the transient ignition frequency is mapped to each ignition source and to each Sequence for that ignition source. As such, the analysis captures transient fires that, when prompt suppression fails, cause damage to more than one MOB panel or electrical cabinet based on their location within the transient fire area.

Impact on ILRT Extension:

The F&O is closed, and there is no impact on the ILRT Extension Analysis.

Page 135 of 142 Revision 22 Page 135 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0083 F&O Number: 4-40 Associated SR(s): FSS-B2 Detailed Problem

Description:

The Main Control Room Analysis Notebook 016015-RPT-07 does not address the impact of a transient fire behind the open panels igniting cables inside of the panel.

Proposed Solution: Address the potential for a transient fire located behind an open electrical panel igniting the cables inside of the panel.

Basis for Significance: Potential increases in heat release rate of scenarios are not addressed and could impact risk.

Actual Solution:

Transient fires adjacent to panels in the Main Control Room are assumed to damage panels by assigning the same impacts as fixed-ignition source scenarios originating in the panel. Using this approach, the transient fire frequency is added to the fixed-source frequency in order to reduce the number of scenarios postulated in the control room, and, at the same time, include the transient frequency contribution to fire risk.

It is important to note that the ignition of the cables inside of an open panel by a transient ignition source does not change the impact of the fires; the damage to each panel by a transient fire is equivalent to the panel igniting on its own.

Further, fires igniting within each panel are evaluated for propagation to adjacent panels. By adding the transient fire frequency to the fixed ignition source frequency in these scenarios, the potential for a transient fire to ignite cables in more than one cabinet is already captured.

With regards to the MCR abandonment analysis, it is not necessary to analyze an additional fuel package fire scenario in which a transient fire ignites cables inside of an open panel. Ignition of these secondary combustibles would not measurably impact the time to abandonment calculations presented in Section 6.0 of the MCR Notebook [Reference 54]. Regardless of the location of the transient fuel package (open, wall, corner) and of the environmental conditions (functionality of HVAC, open/closed entry doors),

abandonment conditions were achieved before the fire reached a peak heat release rate of 317 kW.

Importantly, the peak heat release rate of the transient scenario is achieved two minutes after ignition.

Following guidance in Appendix R of NUREG/CR-6850, the exposed cables are not expected to ignite until at least 5 minutes after ignition. Therefore, abandonment conditions would have been achieved prior ignition of these exposed cables.

Impact on ILRT Extension:

• ..The F&O is closed, and there is no impact on the ILRT Extension Analysis.

Revision 2 Revison 2Page 136 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0084 F&O Number: 4-42 Associated SR(s): FSS-B2 Detailed Problem

Description:

The Main Control Room Analysis Notebook 016015-RPT-07 does not reduce the total available floor area by removing equipment floor space when calculating the transient fire frequencies.

Proposed Solution: Reduce the available floor area for transients by removing equipment floor space and recalculate the transient scenario fire frequencies.

Basis for Significance: The reduction of the total available floor area would impact the individual transient fire frequencies.

Actual Solution:

The Main Control Room Analysis Notebook [Reference 54] has been updated such that the transient fire frequencies in the MCR are calculated using the available floor area; the available floor area is calculating by subtracting the equipment floor space from the total floor area of the main control room.

The Monticello Fire PRA postulates a transient fire in front of each panel in the Main Control Room.

These postulated transient fires are considered to have the same impacts as the fixed-ignition-source scenarios originating on the panel. The frequency of these postulated transient fires includes a geometry factor. This geometry factor apportions the total transient frequency assigned to the Main Control Room to the floor area near the panel under consideration. This geometry factor is equal to the ratio of the floor area in which a transient fire may damage a panel (approximately 16 sq. ft) to the total available floor area in which a transient fire may occur. The total available floor area is equal to the total floor area of the Main Control Room (2250 sq. ft) minus the areas of the floor that are permanently occupied by plant equipment (653 sq. ft). The total available floor area in which a transient fire may occur is equal to 1,597 sq. ft.

Impact on ILRT Extension:

The F&O is closed, and there is no impact on the ILRT Extension Analysis.

Page 137 of 142 Revision 2 Revision 2 Page 137 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0109 F&O Number: 7-4 Associated SR(s): SY-AI, PRM-B1, PRM-B9, PRM-C1, FQ-A2 Detailed Problem

Description:

It is not clear if the internal events PRA initiating events and accident sequences applicable to two or more SRVs open similar to LLOCA have been correctly applied. If it is deemed that opening of two or more SRVs does not need to mimic LLOCA, then provisions for a new initiating event, success criteria and accident sequence is required.

PRM calculation 01601 5-RPT-05, MSO 3a and 3b for potential opening of two or more SRVs added additional logic to the PRM. Potential opening of all SRVs mimics sequences similar to Large LOCA.

Review of the PRM calculation noted in section 6.0 that the initiating events and accident sequences embodied in the MNGP internal events model are used as the basis for development of the FPRA model.

Additional information received from the utility representative regarding the review of internal events initiating events determined that Large LOCA was deemed not applicable to the FPRA. Review of the PRM CAFTA model located MSO failure of more than one SRV via gate F_SORV_2of8 with parents to gates different from LLOCA. If it is deemed that opening of all SRVs does not need to mimic LLOCA, then provisions for a new initiating event, success criteria and accident sequence is required.

(This F&O originated from SR PRM-BI)

Proposed Solution: When internal events PRA initiating events and accident sequences for CDF and /

or LERF are utilized, ensure that the FPRA sequences are definitively modeled.

Basis for Significance: It is not clear ifthe internal events PRA initiating events and accident sequences applicable to all SRVs open similar to LLOCA have been correctly applied.

Actual Solution:

The logic in the PRM was updated to map the correct logic to the LLOCA initiating logic. This includes the F_SORV_20F8 gate that models 2 of the 8 SRVs spuriously opening (MSO 3a/b).

Section 6.1 of the PRM notebook [Reference 50] was updated to state the Large LOCA event tree was determined to be applicable to the modeling the plant response to fire-induced spurious opening of two or more SRVs, and the PRM notebook [Reference 50] was revised to clarify the treatment given to fire-induced spurious opening of two or more SRVs.

Impact on ILRT Extension:

There is no impact on the ILRT Extension Risk Analysis.

Revision 2 Revison 2Page 138 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0030 F&O Number: 1-36 Associated SR(s): QU-D2, EQ-El Detailed Problem

Description:

The Quantification notebook documents the sequences of events for the dominant CDF and LERF fire scenarios. However, based on the issues identified for the CS and PRM elements, the review team concludes that cutset reviews were not performed to the extent needed to ensure FPRA model realism.

Proposed Solution: Review the results of the PRA for modeling consistency (e.g., event sequence model's consistency with systems models and success criteria) and operational consistency (e.g., plant configuration, procedures, and plant-specific and industry experience).

Basis for Significance: Risk-significant issues were identified in the FPRA model that would have been observable by review of results, and therefore the review team finds the review the review of results of the PRA for modeling consistency to be insufficient.

Actual Solution:

At the time of peer review, the CDF and LERF numbers were higher than acceptable. This was known going in to review. One of the factors contributing to the high risk values is model conservatisms. Detailed cutset reviews were performed during the quantification process and were documented in the Quantification notebook [Reference 361, however, there were known conservatisms.

After the peer review, the model was refined to address F&Os and reduce risk, including updated ASD modeling, additional CFMLA, etc. Additional cutset reviews were performed. Model realism was considered carefully during these reviews and the reviews were documented as part of the updated Quantification notebook [Reference 36].

Impact on ILRT Extension:

Since the model was refined to increase realism, the F&O is closed, and there is no impact on the ILRT Extension Analysis.

Page 139 of 142 Revision 22 Page 139 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0021 F&O Number: 1-24 Associated SR(s): LE-F2, QU-D5, PRM-A4, PRM-C1, FQ-A3, FQ-Fl, QU-B1, FQ-B1, UNC-A2 Detailed Problem

Description:

The peer review noted issues related to the output produced from the fire modeling database FMDB.

FMDB contains queries that combine the fire scenario information and the cable selection and location information into the tables utilized by FRANX to quantify the FPRA scenarios:

The review team noted that equipment impacts from fire damage for a full burnup scenario of the yard were not translating from the cable selection to the plant response model. Fire damage impacts therefore were missing from the fire scenario modeled. Further review indicated that items coded as '2, for example, in the zone-to-raceway table were not translating into fire impacts due to a missing query in the FM DR. This impacted fire scenarios for the yard, and the scenarios that end with EC5 (i.e., scenarios in which the ignition source is an electrical cabinet for which only the cabinet itself was damaged), in addition to other scenarios.

The review team also noted that all fire scenarios involving HEAF their respective targets are not include were not included in the FPRA PRM modeling.

Based on these observations, the review team did not have confidence that the FMDB demonstrated the capability to generate appropriate results.

Proposed Solution: Demonstrate that the FMDB generates appropriate results as well as outputs to FRANX through a process of verification.

Construct the Fire PRA plant response model consistent with the scope and location of equipment and cables (accounting for cable damage effects on the equipment of interest) per Section 4.2.2 and Section 4.2.3.

Basis for Significance: Potential risk-significant impacts.

Actual Solution:

The fire scenario associated with full zone damage to the Yard has been corrected. To do so, the following verifications have been conducted:

1. The fire scenario associated with full zone damage to the Yard, which is originated and maintained in the Fire modeling Database was reviewed to ensure that all the targets mapped to the Yard were accounted for.

2. The FRANX quantification tables (i.e., FRANX Scenarios table and FRANX Zone To Raceway table) generated in the fire modeling database and exported to FRANX were reviewed to ensure that the Yard scenario was appropriately specified.

3. The FRANX quantification was reviewed to ensure that the scenario was treated and quantified correctly FRANX.

The risk contribution of the full zone burn in the Yard is now correctly accounted for in the MNGP Fire PRA.

Impact on ILRT Extension:

Since the model was refined, the F&O is closed, and there is no impact on the ILRT Extension Analysis.

Revision 2 Revison 2Page 140 of 142

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-15-0085 F&O Number: 4-6 Associated SR(s): IGN-AlO, UNC-A2 Detailed Problem

Description:

A sensitivity analysis was not performed for fire ignition frequency bins characterized by an alpha from EPRI 1016735 analysis that are less than or equal to 1 as required by Supplement 1Ito NUREG/CR-6850.

Proposed Solution: Perform and document the sensitivity analysis for fire ignition frequency bins with alpha less than I as required by Supplement 1 to NUREG/CR-6850 in order to utilize the updated ignition frequency values.

Basis for Significance: Supplement 1 to NUREG/CR-6850 requires a sensitivity analysis to be completed in order to utilize the updated fire ignition frequency values.

Actual Solution:

A sensitivity analysis case has been created to quantify the impact of using the generic fire ignition frequencies in NUREG/CR-6850. The Fire PRA has been quantified with the fire ignition frequencies listed in Chapter 6 of NUREG/CR-6850 for those bins with Alpha values less than or equal to 1.0. The results of the quantification are documented in the MNGP UNC Notebook [Reference 40]. The process for quantifying the Fire PRA with these frequencies is identical to the one in the base quantification. That is, the applicable generic frequencies from NUREG/CR-6850 are stored in the Fire Modeling Database and propagated through the fire scenario frequency quantification. The fire scenario frequencies are then imported into FRANX to complete the quantification process.

Impact on ILRT Extension:

The F&O is closed with the completion of 016015-RPT-15 Revision 3, and there is no impact on the ILRT Extension Analysis.

Change Number: MT-I15-0047 F&O Number: 3-10 Associated SR(s): LE-G5, QU-F5, FQ-FI, UNC-A2 Detailed Problem

Description:

LE G-5 requires discussion of modeling limitations and impact on results. This was not performed Proposed Solution: Add discussion of limitations Basis for Significance: There is no documentation of modeling limitations and effect on applications.

Actual Solution:

A discussion of LERF modeling limitations and the potential impact on results was added to the Quantification notebook [Reference 36]. The discussion was added to Section 3 of the quantification notebook [Reference 36].

Impact on ILRT Extension:

The documentation F&O is closed, and there is no impact on the ILRT Extension Analysis.

Page 141 of 142 Revision 22 Page 141 of 142

54003-CALC-02 5400-CAL-02Evaluation of Risk Significance of Permanent ILRT Extension Change Number: MT-I15-0105 F&O Number: 6-7 Associated SR(s): PRM-B2, PRM-C1 Detailed Problem

Description:

The peer review exceptions and deficiencies for the 2013 Internal Events PRA were entered and resolved in the POD database and was used as the starting basis for Fire PRA model. However, it does not appear from the documentation that a verification of the internal events PRA dispositions from the 2013 peer review was performed to ensure they do not adversely affect the Fire PRA model, as required by the standard.

From a cursory review of the internal event deficiencies, FPIE F/Os 7-15, 7-17 and 4-2 revealed concerns regarding HRA assumptions and potential impact on the quantification. There is no evidence in the documentation that these concerns were evaluated in the context of the fire PRA.

Proposed Solution: Verify the peer review exceptions and deficiencies for the Internal Events PRA are dispositioned, and the disposition does not adversely affect the development of the Fire PRA plant response model.

Basis for Significance: As required by the standard, the development of the FPRA requires a verification of the dispositions to the peer review exceptions and deficiencies to ensure they not adversely affect the development of the Fire PRA plant response model.

Actual Solution:

Internal Events F&Os 7-15, 7-17 and 4-2 were closed and incorporated in the Internal Events PRA model, which was the basis for the Fire PRA model. The Internal Events PRA model has been reviewed to ensure technical adequacy. Therefore, the concerns of these F&Os have been addressed in the Fire PRA.

The dependency analysis was revised and performed with a general joint HEP floor set to 1.0E-05. For some combinations that involve long-term decay heat removal actions or LERF-reduction specific actions, a minimum joint HEP floor of 1E-06 was used. Maintaining a lower minimum joint probability for these combinations is appropriate because they will take place many hours after the fire, at which point the activation of the Technical Support Center (TSC) would be able to provide a mind frame that allows for a 1 E-06 minimum joint dependency threshold. This is documented in the Fire Human Reliability Analysis Notebook [Reference 46].

Impact on ILRT Extension:

Since the Internal Event PRA F&Os are closed, there is no impact on the ILRT Extension Analysis.

Page 142 of 142 Revision 22 Page 142 of 142