ML12297A341

Supplemental Information in Support of the NRC Acceptance Review of the License Amendment Request for a One-Time Change to Technical Specification 3.8.4, DC Sources-Operating, to Support Shared Vital Battery Replacement

ML12297A341
Person / Time
Site:	McGuire, Mcguire
Issue date:	10/18/2012
From:	Capps S Duke Energy Carolinas
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
Download: ML12297A341 (83)

Text

Duke STEVEN D. CAPPS Vice President JEnergye McGuire Nuclear Station Duke Energy MG01 VP / 12700 Hagers Ferry Rd.

Huntersville, NC 28078 980-875-4805 980-875-4809 fax Steven. Capps@duke-energy.com October 18, 2012 10 CFR 50.90 U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 ATTENTION: Document Control Desk

Subject:

Duke Energy Carolinas, LLC McGuire Nuclear Station, Units 1 and 2 Docket Nos. 50-369 and 50-370 Supplemental Information in Support of the NRC Acceptance Review of the License Amendment Request for a One-Time Change to Technical Specification 3.8.4, "DC Sources-Operating," to Support Shared Vital Battery Replacement By letter dated August 9, 2012, Duke Energy Carolinas, LLC (Duke Energy) submitted a License Amendment Request (LAR) for McGuire Nuclear Station, Units 1 and 2 (McGuire). The proposed LAR would revise the McGuire Technical Specification (TS) 3.8.4, Condition A, to allow replacement of the existing 125 Volt DC Shared Vital Batteries while at power. This proposed LAR would be applicable one-time for each of the four Battery channels.

The NRC staff performed an acceptance review of the LAR and concluded that additional information is necessary for the NRC staff to make an independent assessment regarding the acceptability of the proposed LAR. By letter dated September 28, 2012, the NRC staff provided the request for supplemental information. The NRC staff requested Duke Energy provide this supplemental information by October 18, 2012.

The Attachments to this letter provide the responses to the supplemental requests. Please note Tables 1, 2, and 6 of the LAR dated August 9, 2012 are being replaced by Attachment 2 in this Supplement. Tables 3, 4, and 5 of the LAR were unchanged.

The conclusions reached in the original determination that the LAR contains No Significant Hazards Considerations and the basis for the categorical exclusion from performing an Environmental/Impact Statement have not changed as a result of this request for supplemental information. In addition, there are no new Regulatory Commitments made in this LAR supplement.

www. duke-energy com

October 18, 2012 Nuclear Regulatory Commission Page 2 Please contact Lee A. Hentz at 980-875-4187 if additional questions arise regarding this LAR.

Sincerely, Steven D. Capps Attachments cc w/ Attachments:

V. M. McCree Administrator, Region II U.S. Nuclear Regulatory Commission Marquis One Tower 245 Peachtree Center Ave., NE, Suite 1200 Atlanta, GA 30303-1257 J. Zeiler NRC Senior Resident Inspector McGuire Nuclear Station J. H. Thompson, Project Manager U.S. Nuclear Regulatory Commission 11555 Rockville Pike Mail Stop 0-8 G9A Rockville, MD 20852-2738 W. L. Cox, III, Section Chief North Carolina Department of Environment and Natural Resources Division of Environmental Health Radiation Protection Section 1645 Mail Service Center Raleigh, NC 27699-1645

October 18, 2012 Nuclear Regulatory Commission Page 3 Steven D. Capps affirms that he is the person who subscribed his name to the foregoing statement, and that all the matters and facts set forth herein are true and correct to the best of his knowledge.

Steven D. Capps, e President, McGuire Nuclear Station Subscribed and sworn to me:

10/01t Date

('

Notary Public My commission expires:

" Date ý0(111')

Supplemental Information in Support of NRC Acceptance Review of the McGuire TS 3.8.4 LAR to Support Shared Vital Battery Replacement The U.S. Nuclear Regulatory Commission (NRC) staff has reviewed your LAR and concluded that the information requests below are necessary to enable the NRC staff to make an independent assessment regarding the acceptability of the proposed LAR.

1. External risk quantification states that probabilistic risk assessment (PRA) results have not been provided because peer reviews have not been performed. Seismic and other external risk quantification for the application is necessary and must be addressed by a PRA if they are significant contributors. Please clarify what the estimated risk contributions are from the external hazards for this application for total core damage frequency (CDF) and large early release frequency (LERF) and describe their potential impact on the change in CDF and LERF.

Duke Energy Response:

Seismic The seismically induced CDF for the base model is approximately 1 E-05/yr. The vital batteries are not a significant contributor to seismic core damage frequency, because the vital batteries are located in a seismically qualified structure and are seismically mounted. The McGuire seismic model does not currently contain a LERF module, but both seismic CDF and LERF are judged to be unaffected by the vital battery maintenance for the following reasons:

It is expected that a seismic event of sufficient magnitude to damage a vital DC System, Structure, or Component (SSC) will likely damage multiple vital DC SSCs. The seismic model assumes that that either no battery fails or they all fail during seismic events. This indicates that the risk impact of having a battery out of service for maintenance is unaffected by a seismic event.

A seismic event could result in a loss of off-site power (LOOP), but since the seismic Initiating Event Frequency (IEF) is approximately two orders of magnitude less than the LOOP IEF, LOOP events are significantly more likely to occur due to non-seismic events and are considered bounding.

Based on the above considerations, the analysis for the vital battery LAR application is not considered to be sensitive to failures of vital DC SSCs caused by seismic events.

High Winds/Tornado The high wind/tornado induced CDF for the base case in this application is approximately 2E-06/yr and LERF is 2E-07/yr. The vital batteries are located in an area of the Auxiliary Building that is hardened against damage to equipment due to high wind/tornado. The sum of the base case cut sets with high wind/tornado as the initiator and containing vital battery failures is approximately 3E-08/yr for CDF and 1 E-09 for LERF. This indicates that the vital batteries are not a significant contributor to sequences initiated by high winds/tornados. Both seismic CDF 1

and LERF are judged to be unaffected by the vital battery maintenance for the following reasons:

It is expected that a high wind/tornado event of sufficient magnitude to damage a vital DC SSC will likely damage multiple vital DC SSCs. The high wind/tornado model assumes that either no battery fails or they all fail during high wind/tornado events. This indicates that the risk impact of having a battery out of service for maintenance is unaffected by a high wind/tornado event.

A high wind/tornado event could result in a LOOP, but since the high wind/tornado IEF is approximately two orders of magnitude less than the LOOP IEF, LOOP events are significantly more likely to occur due to initiators other than high wind/tornado and are considered bounding.

Based on the above considerations, the analysis for the vital battery LAR application is not considered to be sensitive to failures of vital DC SSCs caused by high wind/tornado events.

External Flood Due to the elevation of the site above the potential external flood sources, external flooding has been screened as being insignificant to the McGuire PRA model. This screening utilizes insights from a Duke internal study, as well as from Chapter 2 of the McGuire Updated Final Safety Analysis Report (UFSAR). All postulated flooding events are of equal or lesser damage potential than the external flooding events for which the plant has been designed. This was determined by evaluation of the UFSAR information.

Lake Norman is the largest potential source of external flood water. The site is protected from Lake Norman water levels by an earthen dike up to an elevation of 780 feet (ft). The earthen dike is protected from wave forces by riprap stones as described in the UFSAR. All postulated flooding events in the UFSAR are below the top of the earthen dike.

Lake Norman full pond elevation= 760 ft Probable maximum flood of Lake Norman= 767.9 ft Probable maximum flood of Lake Norman plus wave= 773.9 ft Upstream dam failure plus wave= 767.71 ft Probable maximum hurricane wind of 96mph at full pond= 774.75 ft for maximum waves and 772.24 ft for significant waves Postulated failure of Cowan Ford dam results in a maximum downstream water elevation of 721 ft which is below site grade level of 760 ft.

Probable maximum precipitation water level on site is 760.375 ft. Entrances into the buildings are at 760.5 ft which is above the maximum water level.

2

2. Fire risk quantification. Sufficient level of information on the fire PRA will be needed for performing an acceptance review of the fire PRA for the application. This includes identification and technical justification of any unreviewed analysis methods (UAMs), as well as a description of other method differences from NUREG/CR-6850 (as supplemented) or the National Fire Protection Association Standard 805, "Performance Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants,"

(NFPA-805) frequently asked question (FAQ) guidance, and their significance for the application. If a position on a previous UAM has been established on a method by the NRC, please confirm that the accepted version of the UAM is used per the NRC position and, if not, then provide a revised analysis and results using an accepted approach.

Duke Energy Response:

The McGuire Fire PRA (FPRA) methods were reviewed by a peer review team prior to Revision 1 to NEI 07-12 which introduced the term "unreviewed analysis method" or UAM to provide FPRA peer review guidance:

"An observation regarding the use of methods unfamiliar to the review team. Such an observation is appropriate when the review team does not possess the expertise necessary to evaluate the technical adequacy of methods used in the FPRA."

The industry formed a review panel led by EPRI to evaluate UAM facts & observations (F&Os) generated during a peer review or to address UAMs identified in advance of a peer review.

Some of the methods approved for use by the expert review panel were utilized in the McGuire FPRA. It should be noted that the McGuire FPRA is currently being updated in advance of the NFPA-805 LAR submittal.

In a letter to NEI dated June 21, 2012 the NRC documented their positions on four (4) industry methods and documented their non-acceptance of EPRI 1022993, "Evaluation of Peak Heat Release Rates in Electrical Cabinet Fires." EPRI 1022993 was never formally sent to the NRC by NEI for review as were the other four methods and it has not been evaluated for inclusion in the McGuire FPRA, so it is not discussed herein. The NRC positions on the 4 methods and the relationship to the McGuire FPRA are summarized as follows:

1. Frequencies for Cable Fires Initiated by Welding and Cutting - accepted with no clarification. The McGuire FPRA did not utilize the updated frequencies in the proposed method. However, McGuire did utilize an "adjustment factor' to account for failure to protect the target in accordance with station directives governing hotwork activities.

Since both treatments offer a comparable frequency reduction, the peer reviewed hotwork transient treatment utilized in the McGuire FPRA is not considered to be UAM.

2. Clarification for Transient Fires - accepted with minor clarification. The McGuire FPRA uses the 75th percentile in most fire compartments where smaller transient fuel packages are expected based on the types of areas and associated transient controls.

Varying transient fire size is not considered a departure from NUREG/CR-6850 guidance and is therefore not considered to be UAM.

3. Alignment Factor for Pump Oil Fires - accepted with modification. The McGuire FPRA does not currently utilize this method for Bin 21 pump fire scenarios but will incorporate this treatment in a future update. However, a variation of this method was applied to the 3

reactor coolant pump (RCP) fire scenarios based on the guidance provided in FAQ 08-0044 for main feedwater pump (MFW) pump fire scenarios. Since the treatment in the McGuire FPRA was peer reviewed and the severity factors are consistent with proposed NRC adjustments, this treatment is not considered to be UAM.

4. Electrical Cabinet Fire Treatment Refinement Details - not endorsed. The McGuire FPRA utilized this method and is currently undergoing revision to replace the alignment factors with severity factors based on the applicable NUREGICR-6850 heat release rate profile. This update only impacts the severity factor since the target damage is based on the applicable 98th percentile heat release rate.

From the above, the electrical cabinet fire treatment, while reviewed by a peer review team and subsequently approved by the EPRI-led Fire PRA Methods Review Panel, would be considered by the NRC to be a UAM today. However, identifying other McGuire FPRA method differences from NUREG/CR-6850 is less certain. From Volume 1, page xi of NUREG/CR-6850:

The methods documented in this report represent the current state-of-the-art in fire PRA practice. Certain aspects of PRA continue to evolve and likely will see additional developments in the near future. Such developments should be easily captured within the overall analysis framework described here. It is important to emphasize that while specific aspects of the analysis process will likely evolve, the overall analysis framework represents a stable and well-proven platform and should not be subject to fundamental changes in the foreseeable future.

Accordingly, a number of refinements are necessary to complete a FPRA that are not explicitly addressed in NUREG/CR-6850 or the FAQ process. To the extent practical, the NUREG/CR-6850 refinements applied in the McGuire FPRA that might be of interest to the NRC have been identified below; however, Duke does not consider these refinements to be UAM:

Credit for hotwork administrative controls Credit for transient (placement) administrative controls Credit for industry experience in non-severe RCP scenarios Credit for hot short duration for DC circuits A sensitivity analysis was performed and documented for each of the identified treatments in the McGuire Fire PRA Summary Report. Since these treatments are not considered to represent UAM, the sensitivity analysis was not repeated. Therefore, the sensitivity analysis provided herein is confined to the electrical cabinet alignment factors utilized in the McGuire FPRA. The sensitivity analysis also addresses the projected risk offset by incorporating revised fire ignition frequencies from EPRI Interim Report No. 1016735. FAQ 08-0048 communicated the NRC's acceptance of the updated frequencies which are being incorporated into the McGuire FPRA update currently in process. Some bin frequencies have actually increased, so a risk reduction will not occur for every scenario. However, the bin frequencies associated with the scenarios where the electrical cabinet alignment factors were applied decreased rather significantly.

The adjusted delta risk (ACDF) for vital battery EVCA replacement increased from 1.5E-08 to 1.9E-08 due to the electrical cabinet factor UAM. Most of the delta risk associated with case EVCA is from Turbine Building (TB) and Service Building (SRV) scenarios which are not impacted by the electrical cabinet factor UAM.

4

Attachment I The overall increase in fire CDF associated with removing the electrical cabinet factor treatment is offset by the decrease from utilizing the updated EPRI frequencies which were approved for use in FAQ 08-0048. However, this offset is not required to demonstrate that the impact on the delta risk is insignificant. Therefore, the conclusions relative to delta risk remain unchanged without crediting the updated EPRI frequencies.

The following assumptions were applied for the UAM sensitivity analysis:

1. Sensitivity analysis to address UAM was only performed for one of the vital battery cases for Unit 1. Vital battery EVCA was considered representative of the four main cases (EVCB, EVCC, & EVDD) for both units.

2. The sensitivity of UAM on the LERF or delta LERF results is not required. The delta CDF results are below the acceptance threshold for delta LERF.

5

3. The text is not clear as to if the identification of facts and observations (F&Os) on the fire and internal events PRAs that do not meet capability Category II of the "Standard for Levell/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, American Society of Mechanical Engineers I American Nuclear Society (ASME/ANS) RA-Sa-2009," is complete and if all such F&Os are evaluated and dispositioned for the application (i.e., capability category not met or Category I). Please clarify if the information provided in the application addresses all F&Os for which capability Category II was not achieved. If not, please provide the complete list and the disposition of these F&Os for this application.

Duke Energy Response:

The original submittal information did not include the closed F&Os from the internal events peer review. These have been consolidated with the open F&Os in new Table A. 1, along with the disposition. The internal events peer review F&Os did not address Capability Categories, because the peer review was performed using the process outlined in NEI 00-02.

Internal Events Peer Review There were 37 total peer review F&Os. 19 of the F&Os open, and 18 are closed. The information in the original LAR submittal only provided the 19 F&Os that are open. A new table is provided in Attachment 2 (Table A. 1) which contains all 37 peer review F&Os, and indicates for each F&O if it is open or closed, along with the disposition. This new Table replaces Table 1 of Attachment 4 of the LAR dated August 9, 2012.

New Table A.1 contains revised disposition comments for open F&Os Nos. 4, 5, 6, 8, 9, 10, 11, and 19.

The internal events peer review was completed in 2002 using the process outlined in NEI 00-02. The NEI 00-02 process did not evaluate the PRA against Capability Categories. Instead, each PRA technical element and sub-element was graded to indicate the relative PRA capability for use in applications. The grading process cannot be directly correlated to a Capability Category. However, beginning with Revision 1 of Regulatory Guide (RG) 1.200, and continuing through current Revision 3 of RG 1.200, the NRC has indicated that historical uses of the peer review process in NEI 00-02 can be used to demonstrate that the PRA is adequate to support a risk informed application, so long as the staff's regulatory positions contained in RG 1.200 appendices are taken into account. The McGuire internal events PRA has been evaluated against the staffs regulatory positions, and is judged to meet the requirements for adequacy identified in Regulatory Guide 1.200 Appendix B.

Internal Events Self Assessment There were 52 self assessment findings, and 8 have been closed to Capability Category I1. These closed findings were included in the original LAR, but were not clearly identified as having been closed to Capability Category I1. A new Table is provided in Attachment 2 (Table A.2) which contains the 52 self assessment findings with comments identifying 6

for each finding whether it is open or closed. This new Table replaces Table 2 of of the LAR dated August 9, 2012.

Flood modeling update peer review There were 17 peer review F&Os, and all 17 have been closed to Capability Category I1.

The disposition for each F&O was provided in Table 5 of Attachment 4 of the LAR dated August 9, 2012. No changes were made to this Table.

Fire PRA peer review The fire PRA peer review was completed in 2009 using the process outlined in NEI 07-12, Rev 0, Draft Version H. The peer review process was used to determine the technical capability and adequacy of an FPRA relative to the technical requirements in the ASME/ANS Combined PRA Standard (Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant, February 2009). There were 23 finding F&Os from the McGuire FPRA Peer Review. These 23 findings, along with 7 SRs that were assigned Capability Category I, are provided in new Table A.6 of Attachment 2. This new Table replaces Table 6 of Attachment 4 of the LAR dated August 9, 2012. Of these findings, two remain open, and the remaining are closed. The status, and final capability category for each of these findings is also provided in new Table A.6.

7

4. The submittal contains F&O dispositions in Attachment 4 of the LAR. However, for both the internal events PRA and the fire PRA, it is not clear that the significance of the F&Os to the application have been addressed for all the F&Os presented. Please clarify, and revise as necessary, the disposition of the F&Os for this application. If the F&O has been resolved, please summarize what action was taken to resolve the F&O. If the F&O is not resolved, please provide the evaluation of the impact of the F&O on this application.

Duke Energy Response:

The original submittal information did not include the closed F&Os from the internal events peer review. These have been consolidated with the open F&Os in new Table A. 1, along with the disposition. The internal events peer review F&Os did not address Capability Categories, because the peer review was performed using the process outlined in NEI 00-02.

Internal events peer review There were 37 total peer review F&Os. 19 of the F&Os open, and 18 are closed. The information in the original LAR only provided the 19 F&Os that are open. New Table A. 1 contains all 37 peer review F&Os, and indicates for each F&O if it is open or closed, along with the disposition.

Internal Events self assessment findings There were 52 self assessment findings, and 8 have been closed to Capability Category II. These closed findings were included in the original submittal, but were not clearly identified as having been closed to Capability Category I1. New Table A.2 contains the 52 self assessment findings with comments identifying for each finding whether it is open or closed.

Flood modelinq update peer review There were 17 peer review F&Os, and all 17 have been closed to Capability Category II.

The disposition for each F&O was provided in Table 5 of the original LAR dated August 9, 2012.

Fire PRA peer review The status and final capability category for each finding is provided in new Table A.6.

SRs assigned a Capability Category I are also addressed in new Table A.6 8

uA-Z; r-M.

i racker item

• ivi-u'-uu-i The failure rate of CMS in Rev. 2 and in the generic data of Rev. 3 is 2.9E-2 in both, but after Bayesian updating, in Rev. 3, the failure rate is 3.2E-5. The demand data for CMR and CMS grouped Reciprocating Compressors A, B, C, D, E, & F, and Compressor WA1, 1A2, 1B1,

& 1B2 together.

Compressors WA1, 1B1, 1A2, 1B2 only have 1 start and 8760 hours0.101 days <br />2.433 hours <br />0.0145 weeks <br />0.00333 months <br /> running for each, whereas the Reciprocating Compressors have 54 starts and 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> running for each. Given the significantly different operating experience, these two kinds of compressors should not be grouped together to evaluate the failure rate.

The failure rate for the compressor is significantly reduced from Rev 2 to Rev 3 and is greatly below the generic data. The reviewers suspect that this is because of the inappropriate combination of the demands and failures noted above.

Possible Resolution: Separate the compressors into two groups and evaluate the failure rates separately.

The air compressors identified in this F&O are not significant for event sequences involving vital DC control power. Dominant event sequences related to vital DC control power are LOOP events that rely on the diesel air compressors, which are not impacted by this F&O.

IE-2; PRA Tracker Item # M-02-0022 This F&O is open.

Loss of HVAC initiator was removed, because Information in the Basis for Selected Licensee Commitment (SLC) 16.9.22 operators may shut down the plant from remote (Switchgear Room Ventilation System) indicates that the purpose of the switchgear locations (the Auxiliary Shutdown Panel and the room HVAC is to assure equipment service life, and short term failure of the HVAC SSF) if the Control Room is incapable of maintaining does not affect operability. This F&O will not impact the risk evaluation for the vital 2

inventory control. Not only the control room, but also battery LAR application.

the switch gear room may be affected by the failed HVAC. A particular example of interest is the possibility that the switch gear room AHU might fail but the HVAC chiller is working, in which case operators may not realize the situation in time. CDF 1

[flay Ut: difeCleU UY SUGn all irilu~awi.

Possible Resolution: Perform/document additional evaluation of loss of switchgear room HVAC and, if appropriate, develop a new event tree to analyze the sequence of loss of switch gear room cooling.

3 ST-I; PRA Tracker Item # M-02-0023 An analysis is available of the effect of overpressurizing the RHR discharge line to the RCS.

The analysis considers the effect of static pressure on the piping integrity by comparing the calculated hoop stress from static RCS pressure and the ultimate strength of the piping. The results show that expected hoop stresses are below the ultimate strength and thus piping failures are not expected to occur. The analysis then assesses the impact of damaging all sealant materials in the lines (gaskets, valve packing, etc.) to conclude that the break area can be conservatively bounded by a 13.5 inch equivalent diameter break. Based on this, all ISLOCAs go to core damage.

The present approach does not consider dynamic effects of the isolation valve failures with respect to piping integrity. The present approach also does not factor in later industry generic analyses and methodology, e.g., NUREG/CR-5744. If piping failures are considered to have a non-zero failure probability, then other specific failure locations can be considered for which some response is available This F&O is open.

Implementation of the new ISLOCA methodology (WCAP-1 7154-P, Rev. 0) is expected to result in a decrease in CDF and LERF. The conclusions of the vital battery LAR risk evaluation are conservative.

2

LU dVUIU LUU[d UdIIIdyU.

tAZ UUL;UIIIUIILUU III NUREG/CR-5744, other components such as RHR heat exchanger components, flanges, etc. often represent the weak links. Rather than consider these as a single equivalent large break, as was done for the current McGuire ISLOCA evaluation, specific scenarios could be addressed explicitly, following the NUREG methodology. In addition, there would be a scenario involving a small but nonzero pipe rupture probability to address.

In summary, assigning a zero probability of gross piping system rupture due to a simple pipe hoop stress computation is not consistent with current PRA practice for these events; the present approach may not be sufficiently realistic, and may overstate the ISLOCA CDF contribution.

Since the ISLOCA is the major contributor to LERF, changes in the ISLOCA model could have a significant impact on the McGuire LERF calculations.

Possible Resolution: Consider implementing the more recent methodology, including the dynamic effects of valve rupture on piping integrity and possibly incorporating the results of the ongoing risk-informed in-service inspection of piping study if appropriate, to ensure that the McGuire approach is sufficiently realistic.

3

LI-D; I" r-I rICKer Itein i IVI-UZ-UUtO There is a significant amount of operator action and equipment recovery credited in the CET.

I it1s r" t its open.

The CET methodology referred to in this F&O is no longer utilized in the estimation of the large early release frequency. This F&O is not applicable to the LERF estimates provided in this LAR, because LERF is now evaluated using the methodology in NUREG/CR-6595.

• There is insufficient basis presented for the recovery probabilities. Since the present CET was done before the development of McGuire SAMG, the basis for the recovery probabilities is not clear, are they from the EOPs? from EPRI-TR-101689? from Draft WOG SAMG?

. The basis for the operator action success is not apparent; a rigorous HRA does not appear to have been used.

4

. It appears that the equipment recovery was determined from a review of the cut sets that end up in each PDS. This avoids double counting of equipment usage as long as the Level 1 PRA "recovery" is adequately designated in the PDS.

The split fractions used in the CET should be more rigorously developed, especially for the operator actions.

Proposed Resolution: Implement a more rigorous treatment of HRA, including supporting timing and success criteria analyses if necessary, to quantify CET operator actions and equipment recovery.

L2-9; PRA Tracker Item # M-02-0026 This F&O is open.

The McGuire CET is more complete than most The CET methodology referred to in this F&O is no longer utilized in the estimation of industry efforts in terms of the modeling of the large early release frequency. This F&O is not applicable to the LERF estimates equipment recovery and post-core damage operator provided in this LAR, because LERF is now evaluated using the methodology in actions. However, this modeling was done prior to NUREG/CR-6595.

the development of the McGuire SAMG. Thus the 4

t;*- i may not oe consistent witn current acciuent management practices at McGuire station.

Could impact CET results, but not likely to impact LERF results.

L2-10; PRA Tracker Item # M-02-0027 This F&O is open.

The Level 2 analysis was done with MAP 3b, The GET methodology referred to in this F&O is no longer utilized in the estimation of Versions 11 and 16. Significant improvements to the large early release frequency. This F&O is not applicable to the LERF estimates MAAP code models have been implemented in both provided in this LAR, because LERF is now evaluated using the methodology in MAAP 3b (up to Version 21) and MAAP 4.0 since NUREG/CR-6595.

that time. The impact of these improvements on the McGuire Level 2 and LERF results is unclear.

Could impact CET results, but is not likely to impact LERF results. Thus, for applications sensitive to releases other than LERF, this could be important.

TH-6; PRA Tracker Item # M-02-0028 This F&O is open.

There is no room heatup analysis notebook /

This F&O is under evaluation as part of the in-progress McGuire PRA model update.

evaluation of loss of HVAC to equipment rooms for Equipment rooms that have not been screened or previously modeled will be the McGuire PRA, and apparently no retrievable modeled as part of the update. Based on the results of a recent model update at room heatup calculations or documentation to Oconee, it is the judgment of the analyst that any potential impact from HVAC failures support the assumption that room cooling need not at McGuire would be small and would not change the overall conclusions of the vital be modeled in the PRA. Other PRAs have found battery LAR analysis.

that room cooling is required for some rooms such 7

as electrical equipment rooms and small rooms housing critical pumps. (Internal Duke correspondence, and past interactions with NRC, have also identified this as an area requiring attention.)

Failure of room cooling is typically detectable such that recovery actions are possible to limit impacts.

However, without an evaluation, it is difficult to 5

acerqain Wcooing for e quipme nti s uccess requiring cooling for equipment success.

Proposed Resolution: Perform an evaluation, with equipment room-specific calculations, if possible, of the potential for, and magnitude of the room heatup for rooms housing electrical equipment, pumps, and other key equipment credited in the PRA. Document the basis for any determinations that equipment will survive the anticipated room heatups, and model loss of room cooling as a failure mode in the system fault trees (with recoveries as appropriate) for equipment that may not survive the anticipated heatup for the PRA mission time.

SY-3; PRA Tracker Item # M-02-0029 Appendix F.5, Auxiliary Feedwater System (CA) states that "If, during CA operation, the suction pressure drops below a preset pressure for three seconds, the RN (Nuclear Service Water) System water source is aligned automatically" [pg. F.5-7, Rev 3]. Design Basis Specification for the CA System, Spec. MCS-1592.CA-00-0001, Revision 12, page 50, section 31.3.2.6 lists six valves that must automatically swap position (closed to open) to provide nuclear service water to the suction of the auxiliary feedwater pumps based on the response of six suction pressure switches. These pressure switches do not seem to be modeled nor is an operator action to open the six RN suction supply valves to CA due to CCF of the pressure switches to provide signal to automatically open the supply valves.

This F&O is open.

The F&O has not been administratively closed, but the technical issue has been addressed. The boundary of an AFW motor-operated valve includes the internal piece-part (i.e., gate, stem), motor operator, circuit breaker, power leads, sensors and logic circuit. Only sensors unique to the operation of the individual valve are included within the boundary of a motor-operated valve. Thus, the pressure switches in question would be part of the valve boundary rather than treated as a separate failure mode. This F&O will not impact the risk evaluation for the vital battery LAR application.

8 6

Mn operator action to open nte rmm suppiy lo %,/

Ai the event of automatic swapover failure could be an important event in the PRA model; the impact of the actuation logic components should also be addressed so that the model is complete.

Proposed Resolution: Evaluate the need for modeling of the pressure switches and/or operator action discussed above; incorporate into the model or document the rationale for excludinq.

SY-4; PRA Tracker Item # M-02-0030 The Nuclear Service Water (RN) supply to the Auxiliary Feedwater System (CA) contains a total of six valves which must open automatically (3 per train) to provide RN to the auxiliary feedwater pumps suction. The model does not appear to include any common-cause failure of these valves to open to provide water to the CA system.

The common-cause failure of these valves could be a significant contributor to cut sets involving the failure of the CA system.

Possible Resolution: Consider adding CCF events for the RN/CA supply to the CA pump suction, or providing, in the documentation, the rationale for excluding this.

This F&O is open.

The F&O has not been administratively closed, but the technical issue has been addressed. As with the disposition of Item # 8 for Change Form M-02-0029, the pressure switches in question would be part of the valve boundary rather than treated as a separate failure mode. Thus, their common cause failures would not be included in the fault tree as well. This F&O will not impact the risk evaluation for the vital battery LAR application.

9 7

Li--

I

-rl*/

I [d;;I1I II III ft IVI-UV -UUO) I The McGuire Flood Analysis assumes that only 15%

of the flood probability value is applicable to the CA Pump room even though the primary flood contribution effect comes from the CA room. The RN suction piping and strainers are located in the CA room, including a stainless steel expansion bellows of 0.05 thickness (minimum). The previous value used in the PRA for the flood probability from this room was 50% and there appears to be limited basis for the reduction. When 50% is used in the flooding calculations, the flood probability goes from 4.41 E-6 10 to 1.47E-5. This increases core melt frequency by about 5%.

High flooding failure probability produces a significant increase in core melt frequency.

Possible Resolution: Provide a sound engineering basis for the percentage of flooding probability to be assigned to the CA room. Alternatively (or in addition), determine and document the sensitivity of the PRA results to the selected value, and identify this as a key PRA assumption if appropriate.

I I Ila, r-(XW m: Upu*I, This has been addressed in the internal flood update to the PRA model, and is included in the model used for the risk evaluation for the vital battery LAR application.

The F&O has not been administratively closed, but the technical issue has been addressed and is complete.

8

i.r--,L, I-I, I IdOUl I IMI, I

Vt IVI-U -UU.JI.

The Flood Analysis for the CA Pump room uses a calculation to determine the effective leakage area for the RN suction expansion bellows (thickness from' 0.05 to 0.5 inches) so that a leakage flow can be calculated. The calculated leakage rate from the RN expansion bellows (0.05 inches minimum thickness) is essentially the same as that calculated for the 30 inch service water piping which is 0.375 inches thick.

Thus, it seems that the leakage rate from a break in the expansion bellows could be understated. If so, the time before critical flood levels are reached could 1 be less than currently predicted.

The potential loss of safety related equipment could occur much more rapidly than expected adversely affecting core melt frequency.

Possible Resolution: Review the Flood Analysis to ensure calculated leakage rates have a sound basis and reflect expected leakage rates and provide updated flood probabilities as necessary. If there are uncertainties in the expected leakage rates, evaluate their impacts via sensitivity or uncertainty evaluation as aDproDriate.

This F&O is open.

This has been addressed in the internal flood update to the PRA model, and is included in the model used for the risk evaluation for the vital battery LAR application.

The F&O has not been administratively closed, but the technical issue has been addressed and is complete.

9

I/r-4ý I"1"t'g I idUhV ILEIl ift IVI"UVV-UU0.

No specific guidance is given regarding modeling of system dependencies in the system notebooks; however, a highly knowledgeable analyst could reproduce the given results. A dependency matrix is provided but contains little detailed explanation of how dependencies were determined. Flood Analysis does not seem to provide detail required to reproduce the results except by a highly knowledgeable analyst.

This F&O is open.

This is a documentation issue. The peer review comments indicate that a highly knowledgeable analyst could reproduce the given results. This indicates that there is not an issue with the analysis; rather the issue is with documentation needing improvement. There is no impact on the analysis performed for the vital battery LAR application.

Sufficient guidance should be provided to explain how dependencies are treated in the PRA, such that the approach can be explained, reviewed, and defended, and so that future PRA updates are performed correctly and consistently.

Possible Resolution: Provide guidance for treatment of dependencies, including types of dependencies treated in the model, approaches used to model dependencies, and important considerations regarding how dependencies may affect the model and results.

10

i m-i; rma i racker item

• ivi-uz-uusq Many of the T/H success criteria applied in the MNS PRA have been performed with older versions of the MAAP code, MAAP3B revision 16 or earlier. Many improvements have been implemented in the MAAP code since this time. The success criteria database should be reconstituted by employing MAAP4 or other currently accepted codes/analyses. This review should include but not necessarily be limited to the following:

- pumps and accumulators required for large LOCA

- break ranges for various LOCA sizes

- pumps required for small and medium LOCAs 13

- containment response to small LOCA - NS operates

- feed and bleed success criteria

- SGTR success criteria Actual F&O Wording: Success criteria for some systems are supported by MAAP runs with MAAP 3b, Version 16. This version of MAAP has been found to have deficiencies which can impact conclusions and results. In particular for the McGuire PRA, the simple pressurizer model impacts the analyses that involve RCS cooldown and depressurization using SG heat removal by permitting RCS depressurization to match RCS cooldown for transients, without the possible need for pressurizer PORVs, spray or aux spray.

i nis rou i, open.

MNS success criteria runs were performed by a vendor since the peer review was performed, and found similar results to the previous analyses. This F&O is not expected to affect the overall conclusions of the vital battery LAR application.

TH-3; PRA Tracker Item # M-02-0048 This F&O is open.

Success Criteria analyses were not done for the MNS success criteria runs were performed by a vendor since the peer review was range of possible plant conditions to which they are performed, and found similar results to the previous analyses. This F&O is not 14 applied. For example, MLOCA success criteria expected to affect the overall conclusions of the vital battery LAR application.

analyses are done for a 3.5 inch break, while the MLOCA is defined as a 2 to 5 inch break. The combinations of systems and operator recoveries 11

VinaI are uenu1[U d5 Z5uUU*;b dL O.U 11UH*Ub 11,dy,,uL uU success at 2 inches or at 5 inches. This issue also applies to large LOCA (8.25 ft2 break analyzed) vs a break range down to 6 inches, and small LOCA (1 inch break analyzed) vs. break sizes from 3/8 to 2 inches.

Also, MAAP is not an appropriate code to use in performing analyses for rapid blowdown events such as larqe and some medium LOCAs.

15 TH-4; PRA Tracker Item # M-02-0049 Success Criteria do not appear to have been sufficiently reviewed. The reviewers identified several apparent errors in the MAAP analyses, including the following:

1) The MLOCA MAAP runs do not appear to disable accumulators when defining the minimum ECC requirements, but accumulators are not required by the resulting MLOCA success criteria.

2) The secondary side heat removal case (SAAG-98) shows no RCS pressure increase when 180 gpm of CA is supplied to 1SG and NC pumps are tripped.

3) For the FIB case, it appears that full CA was used in the MAAP run rather than the defined success criteria of 1 CA pump to 2 SG.

This F&O is open.

MNS success criteria runs were performed by a vendor since the peer review was performed, and found similar results to the previous analyses. This F&O is not expected to affect the overall conclusions of the vital battery LAR application.

12

16 IH-5; FIKA i racker item ; m-uz-uuou There do not appear to be success criteria analyses to support timing for operator actions. Further, most analysis do not include the effects of possible operator interventions. Even where they do, the minimum time window for operator action is not analyzed. For example, in the feed and bleed case, two pressurizer PORVs are opened at 10% SG level (per EOPs) and flow from 1 ECC pump is modeled.

This results in a core heatup to about 1800 F. If this were to be used to define the basis for an operator action success, the results would have to be interpreted as indicating that there must be instantaneous operator actions without any recovery time for the HRA analysis. Analyses should be available to support available time windows for modeled operator actions. Further, the success criteria analyses should reflect impacts of anticipated operator interventions.

This F&O is not expected to affect the overall conclusions of the vital battery LAR submittal.

I nis I-&u is open.

A recent update of the Oconee PRA model demonstrated that the HRA methodology for operator actions used at the time of the McGuire peer review produced conservative results, largely due to overestimation of the impact of dependencies.

HR-1; PRA Tracker Item # M-02-0065 Table 2 of SAAG-501 lists the pre-initiator His considered in the analysis. The table does not include His for modeling instrument miscalibration events.

Further, no systematic process to identify pre-initiator human actions is identified in the HRA calc.

This F&O is open.

Based on preliminary evaluations using the EPRI HRA calculator, calibration errors that result in failure of a single channel are expected to fall in the low 10-3 range.

Calibration errors that result in failure of multiple channels are expected to fall in the low 10-5 range. Relative to post-initiator Human Error Probabilities (HEPs),

equipment random failure rates and maintenance unavailability, calibration HEPs are not expected to contribute significantly to overall equipment unavailability. Recent modeling updates for the Oconee PRA support this position. This F&O is not expected to affect the overall conclusions of the vital battery LAR submittal.

17 13

18 1l-n-; FKA i racker item ; M-Uz-UUbi Some of the Type Cp His are evaluated using the HCR model. For these, the only performance shaping factors considered are time available and operator response time. Table 4 of SAAG-501 lists the potential effects of additional PSFs, such as operator experience, but table 4 does not appear to have been applied in the quantification of HI events.

i nis r-&u is open.

A recent update of the Oconee PRA model demonstrated that the HRA methodology for operator actions used at the time of the McGuire peer review produced conservative results, largely due to overestimation of the impact of dependencies.

This F&O is not expected to affect the overall conclusions of the vital battery LAR submittal.

~1-19 HR-6; PRA Tracker Item # M-02-0069 In Rev 3, the documentation of the HEPs for single events is not reproducible. The HRA method calculated 3 different HEP contributors for each HI

[HCR, P(e) and P(c)]. In many circumstances, one element is assumed to be dominant and the others are neglected. In support of this, summary judgments are made like - "execution errors were assessed negligible", "event not evaluated in detail because was time critical", "cause based calculation not performed because action is time critical". The time isnot referenced to any T/H basis or generic analysis. The basis for assumptions and criteria is not documented.

In general, there is limited documentation for the HRA in the following areas.

1. The sequence context of each HI is not stated.

2. The previous failures in the event sequence, the performance shaping factors, or stress levels are not stated.

3. Procedural steps applicable to each HEP are not consistently provided.

4. Basis (T/H) for timing of each action is not provided.

The lack of these types of information in the documentation of the HRA limits the ability to verify and reproduce the results, and to determine their This F&O is open.

This is a documentation issue. The basis for the HRA timing analysis was not documented. The lack of documentation is being corrected during the on-going McGuire PRA model update.

This F&O is not expected to affect the overall conclusions of the vital battery LAR submittal.

-4 14

20 IE-5; PRA Tracker Form # M-02-0024 SAAG File 594 (Initiating Events calc.) lists those support systems for which failure is included as an initiating event but does not clearly document the basis for exclusion of other support system failures such as Vital AC. A more structured approach for screening support system initiating events should be documented.

Related to this modeling of special initiating events are the following observations:

1. The loss of Vital I&C Power is modeled as loss of panel D based on the fact that this panel supports two PORVs. However, the potential impacts of loss of panel A on other supported components is not clearly addressed.

2. The basis for not including loss of the 125 V DC Auxiliary Control Power panel as a special initiatina This F&O is closed.

Revision 2 to XSAA-1 15, WORKPLACE PROCEDURE FOR PRA MODELING GUIDELINES added new section 16.1 as follows: PLANT LEVEL INITIATORS "Perform a systematic evaluation of each system to assess the possibility of an initiating event occurring due to a failure of the system." NOTE: One reference source is the Maintenance Rule SSC Summary Sheets. The "Scoping Information" Section provides a listing of system functions that could cause a Reactor Trip or a Safety System Actuation. This section also provides information if the loss of function could result in a safety system failure. Another source is interviews with plant personnel.

15

event when at at iwu 5Ui tjvw Kb IIwts

,,v L

uu I uu in plant operating history is not documented.

It is likely that the excluded failures are less important than those modeled, but a clear basis for the determination of which special initiating events to model should be provided, especially for events that have previously occurred at the plant.

21 IE-6; PIP G-00-424 Action # 3 The method used for calculating generic prior distributions for Bayesian updating seems to underestimate the generic frequencies. The McGuire approach combines the experienced failures into one bin and calculates a single generic prior based on this experience and the time period covered. The typical industry approach would be to use published generic values to define the prior mean and distribution or to input industry experience into a two-stage Bayesian update process which generates a generic mean and distribution for use in Bayesian updating the plant-specific data. It is not clear that the approach used for McGuire produces equivalent results.

Initiatina event values mav be underestimated.

This F&O is closed.

The McGuire initiator frequency calculation for PRA Revision 3 has been revised to include the basis for when to use plant-specific data, generic (industry) data, or fault tree solution. When industry data is used (based on NUREG/CR-5750 to define the prior mean and distribution) it is Bayesian updated using plant specific data. The methodology for Bayesian updating is described in the McGuire initiator frequency calculation. In addition, the small LOCA (SL) initiator has been subdivided into different LOCA groups (i.e., RCPSL - reactor coolant pump seal LOCA, PORV - one or more pressurizer PORVs fail to fully reseat after opening, SAFETY - one or more pressurizer safety valves fail to fully reseat after opening, and SL - small pipe break LOCAs) as defined in NUREG/CR-5750.

16

22 LOOP and SBO sequences are quantified using the transient event tree rather than a special event tree.

Only 2 sequences on the transient event tree result in cutsets for SBO (class 7,14). After success of seal integrity and SSHR, no further systems/function are required for by the model for successful mitigation. Furthermore, there is no time phasing for SBO. In Rev 2, effects of battery depletion in long term station blackout are neglected. An operator error for failure to control AFW TDP after battery depletion is included, but the issue of restoration of AC power after battery depletion is not addressed.

The SBO quantification neglects two classes of sequences which have been shown to be important at other plants -

1) Long term battery depletion

2) seal LOCA occurring at less than 90 min after loss of seal cooling

3) seal LOCA occurring later than 5 hr after loss of seal cooling

4) sequences in which offsite power is recovered while a seal LOCA is in progress, but the core is still covered at the time of OSP recovery.

This was assigned a significance A, because of the very low probability of SBO CD sequences in the current results, which is not typical of results for similar plants that have addressed the types of considerations listed above.

I III ro IJ IM, lUW;U.

The following corrective actions have been taken to resolve this item:

1.

The ac power model has been revised to include the impact of battery depletion with subsequent recovery of offsite power. Event PACBRKRRHE, "Failure to Manually Close Essential Bus Supply Breakers Given dc Power is Lost," was added to the fault tree.

2.

The previous RCP seal LOCA model, based on WCAP-1 0541, rev. 2, has been replaced using the WOG2000 seal leakage model. The new McGuire model includes high seal leak rates prior to 90 min. as well as after 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

3.

If offsite power is recovered prior to core uncovery, then core damage may be averted. This is consistent with the new McGuire RCP seal LOCA model.

17

This F&O is closed.

An initiator event of a SGTR has been added to the CA tree as identified in the Proposed CA.

Success criteria for AFW for SGTR is AFW flow to 2/3 SG, assuming the ruptured generator is not fed.

The logic in the fault tree model is 2/4 SG. An IE FLAG for SGTR is needed for the "B" SG, in accordance with the report write-up such that credit is not taken for the ruptured SG.

Need to ensure that the AFW logic is correct.

23

+

AS-4; PIP G=00-424 Action # 6 Restoration of seal cooling:

The time to connect the SSF is 15 minutes. The operator error associated with restoration of cooling is based on a time constraint of 15 minutes. Current WOG ERG recommendation for restoration of seal cooling is that if seal cooling is lost for 15 minutes, thermal barrier cooling is to be re-established prior to restoring seal injection flow. The WOG recommendation is to prevent shocking of the seal with cold water which could lead to seal failure itself.

The success path for the SSF would have seal injection flow restored prior to 15 minutes and there would be no seal shocking or induced seal failure.

There are two potential failures paths for the SSF -

a) failure to restore seal cooling at any time, and b) restoration of seal cooling after the 15 minute time frame, leading to induced seal failure. The second path is not addressed in the McGuire PRA.

This F&O is closed.

The previous RCP seal LOCA model has been replaced using the WOG2000 seal leakage model. Based on the rather large seal leakage rates provided in the new model, McGuire specific MAAP runs were performed to estimate core uncovery time for various cases (see SAAG 519 for details). In all cases, the core uncovery time was less than 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.

The PRA does not model restoration of seal cooling after the 15 minute time frame.

While shock-induced seal failure could increase seal leakage flows, it is not expected to significantly impact the time to core uncovery due to the already high assumed leakage rates.

24 18

• eai Taiiure arEer DoaCKOUL is aireauy inciuueu in Enu model. This failure path represents an additional failure mode which should be examined. It was labeled a "B", because the worst result is to raise SLOCA probability during blackout. It would not add a new sequence to the PRA.

AS-5; PIP G-00-424 Action # 7 WCAP 10451, Rev 2 is the basis for seal LOCA in MPRA Rev2. The WCAP model provides probability of core damage up to eight hours from the time of loss of seal cooling. The McGuire SBO model extends to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, but stops the risk of core uncovery due to seal LOCA at 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The remainder of seal sequences are neglected.

The assumption in the allowable cross-connect times for AC power have the effect of neglecting any seal failures prior to 90 minutes.

In effect, seal failures are only considered between 90 minutes and 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. There is no explanation or justification for doing this.

Rev 3 models address all probability of seal failures, but Rev 3 is not complete at the time of this review and so was not reviewed.

This F&O is closed.

For the McGuire PRA Rev. 3 update, the new WOG2000 RCP seal leakage model is used. The new McGuire model includes high seal leak rates prior to 90 min. as well as after 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

25 19

I i1ls Wds blIlllUdllg d J-% UU LU Lilt: UilUbUdly,UW CDF from SBO and the possibility some sequences are missing.

TH-2; PIP G 424 Action # 12 Success Criteria for core damage in SAAG calculation records (e.g., Medium LOCA and Feed and Bleed) is given as 4040 degree F, which corresponds to eutectic melting point of the fuel.

Industry practice is to use something in the neighborhood of 2000 degree F because most of the fission products are released at temperatures just above that point. Clad damage becomes widespread at about 2200 F and volatile fission product species are released from the core matrix at 2400 to 3000 F. Thus, risk (LERF) is important from that point forward.

None of the success criteria runs reviewed predicted that temperatures would exceed about 1800 F, so the overall results are not likely to be impacted, but it is important to clearly define the core damage assumption for the PRA.

This F&O is closed.

The McGuire success criteria calculations (SAAG File Nos. 95, 96, 97, 98) have been revised to define success criteria as core temperature remains below 2000 Deg F.

This only involved a wording change from: " success criteria is defined as the hottest core node remained below 4040 Deg F" to the following statement: "success criteria is defined as the hottest core node remained below 2000 Deg F". In addition, a reference for the 2000 Deg F is included in these calculations, which is EPRI document NP-6328, "Release of Volatile Fission Products From Irradiated LWR Fuel:

Mass Spectrometry Studies", Final Report, April 1989.

26 20

0.1r-O; rlr M.*-UU-'I'.

/.*,.LIUII ft 1V There are two operator actions modeled which take credit for aligning Unit 2 RN supply, RNLOUT2RHE and RNUNIT2RHE; however, common-cause failure events for the failure of all RN pumps or all RN filter/strainers are not modeled.

I III* ratJ Mo %AVIUU.

The RN fault tree has been updated to incorporate common cause failures of all RN pumps (both units) and the common cause failure of all strainers (both units).

27 Since Unit 2 is used to help recover Unit I RN, then common-cause failures such as flooding, filter plugging, etc. could affect all RN pumps or filter/strainers and should be addressed in the model.

-4

+

28 SY-7; PIP G-00-424 Action # 20 The following comments apply to the T10 initiating event tree (Loss of KC):

1. Common cause failure of the two normally running pumps is noted as having been removed in Revision 2. Since failure of the normally running pumps must be followed by start of the standby pumps, an annualized common cause failure of the two normally operating pumps is appropriate.

2. Cutsets with more than one annualized frequency should be eliminated and one of the failures replaced with a mission time event. For example, the top cutset for the T1 0 solve contains events KKC01A2PPR and KKC01A1PPR which both have annual mission times. These two random failures should be replaced with a common cause event.

3. The T10 and KCTOP fault trees do not contain operator action events for start of the standby pumps. This may be valid for the KCTOP tree if it can be shown that all sequences where KC is credited result in an SS or LOSP start, but the This F&O is closed.

1) It was recommended that a common cause failure to run of the two (Train A) operating pumps be added to the model. No change is required. Although the common cause failure to run identified in the Proposed CA is not in the model, an adequate substitute common cause failure is included. Justification/explanation is as follows. The KC System normally has two pumps running. Upon their failure, the two standby pumps are started. The success criterion for the Loss of KC Initiator evaluation is to have at least one pump running. Our model includes a common cause failure of the standby pumps to start, and a common cause failure of 4/4 pumps to run. A more detailed model could be developed with multiple 2/2 common cause failures included. However, due to the uncertainties of the common cause values, the 4/4 common cause failure to run should adequately address potential common cause run failures.

2) It was recommended that cutsets with more than one annualized frequency be eliminated and replaced with a mission time event. This change was implemented by writing a new recovery rule file to correct this error.

3) It was recommended that a new event be added to model the failure of the operators to start the standby pumps. No change is required. This eventis already included in both the system tree and the initiator tree. It is designated as KKCSTNBDHE, "Operator Fails to Start The Standby KC Train."

4) It was recommended that the model include additional valve failures that will result 21

UY.tldLUI IdlWUIr LU ZLIl LL LII% ZLdIIIULy PUIlIlIJZ ZIIUUIU UtJ included in the T10 solve.

4. Transfer close of valves in the RCP cooling header are not accounted for. Although these failures do not cause loss of all KC, they would result in reactor trip with partial loss of seal cooling. For example, if only the three MOVs in the supply and return headers to the RCPs (1 KC338B, 1 KC424B and 1 KC425A) are considered, this would have an initating event value of 2.06E-04. In addition there are several manual valves in common portions of the piping which would cause loss of RCP motor cooling if they transferred close.

The noted problems could lead to underestimation of the T1 0 initiating event frequency and underestimation of human error contributions to the CDF.

in an isolated RCP cooling header. This change is not necessary. As explained in the T10 write-up, a failure of a valve in the RCP header would lead to a loss of cooling flow, loss of RCPs, and a resulting reactor trip (which is covered by T1).

There would not, however, be a loss of KC. Flow would still be available to the ND heat exchanger and the AB non-essential header. To include these failures would over-predict the likelihood of the Loss of KC initiating events.

-i 29 DA-5; PIP G-00-424 Action # 22 and 23 CCF modeling:

There is no evidence of a systematic process to identify and include common cause failures of similar components. There are several cases.where the McGuire station has component groups of similar design, location, maintenance, manufacture, lubrication, and cooling, ie., RN pumps, PORV's.

One set is similar components associated with the onsite power AC power system. The 2 DG assigned to Unit I have a common cause to run and start.

The output breaders for the DG and the feed breakers for the emergency buses do not have a This F&O is closed.

In response to comments from the McGuire PRA Peer Review, the system faults trees were reviewed and the following list of common cause basic events were identified and quantified. These events have been added to calculation SAAG-613 which contains the common cause analysis for the McGuire PRA Rev. 3 Update. The incorporation of these new common cause events in the McGuire PRA model successfully addresses the concerns of this corrective action.

DC Power (Batteries)

B.E. Name Description Probability DDABAT4COM Common Cause Failure of Batteries EVCA, EVCB, EVCC, & EVCD 2.4E-06 DDAOOABCOM Common Cause Failure of Batteries EVCA & EVCB 22

k.,.,- event.

fnlU we reviewers uIu [oWL riutw '..,r ui the SSF and station DG's. There might be commonalities in fuel oil or maintenance that would warrant at least a minimal CCF factor applied to all three DG's.

Specifically, for the onsite AC power system, there are no CCF of:

1. 4160v bus feed breakers

2. DG output breakers

3. DG fuel oil transfer pumps

4. station batteries

5. no CCF analysis for SSF DG and main DG Other components noted without common cause failure are:

6. all RN pumps

7. ECCS injection valves The noted CCFs could have an impact on PRA results and should be reviewed for inclusion in the PRA.

DDAOOADCOM Common Cause Failure of Batteries EVCA & EVCD 1.6E-05 DDAOABCCOM Common Cause Failure of Batteries EVCA, EVCB, & EVCC 7.3E-06 DDAOABDCOM Common Cause Failure of Batteries EVCA, EVCB, & EVCD 7.3E-06 DDAOBCDCOM Common Cause Failure of Batteries EVCB, EVCC, & EVCD 7.3E-06 DDAOACDCOM Common Cause Failure of Batteries EVCA, EVCC, & EVCD 7.3E-06 DDA00CDCOM Common Cause Failure of Batteries EVCC & EVCD 1.6E-05 These events are located in the McGuire DC Fault Tree adjacent to each of the corresponding independent failures of the batteries (DDCEVCABYF, DDCEVCBBYF, DDCEVCCBYF, DDCEVCDBYF).

Diesel Generator / 4kV Power B.E. Name Description Probability JFDPMPSCOM Common Cause Failure of Fuel Oil Transfer Pumps to Run 6.9E-05 JFDPMPRCOM Common Cause Failure of Fuel Oil Transfer Pumps to Start 5.6E-06 JDGET01COM Common Cause Failure of 4KV Feed Breakers To Open (ETA-i, ETB-1) 1.OE-04 JDGET14COM Common Cause Failure of D/G Output Breakers To Close 3.7E-05 JSFFUELCOM Common Cause Failure of Both EDGs and SSF Diesel (Fuel Delivery) 1.4E-04 23

DULF] lUr l d[lr 5llU L

I, IU[IlIT1UII ]Ub IdlllUl tI I

IUb IlllUU* W dIt U dUU IU I Lilt: UIt.*l

%t=,[ IIldLUI Fuel Oil Transfer Pumps. Two events were added for the power D/G connections to the essential buses. JDGET01COM is located in the Diesel Generator/ Load Sequencer Tree adjacent to events JDGETA1C40 and JDGETB1C40. The DIG output breakers (ETA-14/ETB-14) are interlocked with the associated normal feed breakers on each essential bus (ETA-1/ETB-1).

JDGET14COM is located in the Diesel Generator / Load Sequencer Tree adjacent to events JDGEA14C40 and JDGEB14C40.

The only identifiable common link between the SSF Diesel and the EDGs is that they take delivery of the same fuel. The SSF has its own fuel oil storage tanks, and is in every other way completely diverse from the EDGs. However, a small factor is retained for this coupling mechanism. The event (JSFFUELCOM) is quantified as 3 of 3 failing to run, with a factor of ten reduction for only being exposed to a single category of failure cause ("bad fuel"). This event is located in both the Diesel Generator Tree and the SSF Tree.

RN Pumps and Strainers B.E. Name Description Probability WRN04PRCOM Common Cause Failure of All (4) McGuire RN Pumps To Run 4.4E-06 WRN04STCOMCommon Cause Failure of All (4) McGuire RN Pump Strainers 2.8E-07 These events are located in the McGuire RN Fault Tree adjacent to each of the existing common cause failure events for the RN pumps and strainers (WRNABPRCOM, WRNABSTCOM).

24

'-ut.lo VdIVtS B.E. Name Description Probability INIOCLACOM Common Cause Failure of NI Checkvalves From CLAs To Open 6.8E-05 ININCCKCOM Common Cause Failure of Common Primary Checkvalves To Open 1.3E-06 ININICKCOM Common Cause Failure of NI Injection Checkvalves To Open 2.OE-05 LNDCLCVCOM Common Cause Failure of ND Cold Leg Injection Checkvalves To Open 5.5E-06 Event INIOCLACOM represents the failure of a combination of NI checkvalves to open (NI-59, NI-60, NI-70, NI-71, NI-81, NI-82, NI-93, and NI-94) such that 2 or more Cold Leg Accumulators (CLA) do not inject into the NC System. Since it is assumed in the PRA LOCA model that the inventory of the CLA on the faulted NC loop goes out the break, a factor of 2 reduction is taken to account for the chance that 1 of the failed checkvalves is also on the faulted NC loop. In this case, the 2 good CLA trains will successfully inject to the reactor vessel, and 1 of the failed checkvalves is of no consequence. This event is located with the independent failure events for these checkvalves in the "LU" branch of the PRA Top Logic.

Event ININCCKCOM represents a failure of all 4 common NI checkvalves to open (NI-60, NI-71, NI-82, and NI-94). This event results in the failure of injection pathways except for the NV System. This event is located in the ND Tree, NI Tree, and in the "LU" branch of the PRA Top Logic.

Event ININICKCOM represents a failure of a combination of NI checkvalves to open (NI-171, NI-60, NI-169, NI-71, NI-166, NI-82, NI-164, and NI-94) such that all 4 NI injection pathways fail to inject into the NC System. This event is located in the NI System model.

Event LNDCLCVCOM represents a failure of a combination of NI checkvalves to open (NI-175, NI-60, NI-176, NI-71, NI-180, NI-82, NI-181, and NI-94) such that all 4 25

ND injection pathways fail to inject into the NC System.

NI System model.

(*Note: The specific combination of failure of NI-60, -71, -82, & -94 was not counted in the quantification of INIOCLACOM, ININICKCOM, or LNDCLCVCOM because it is accounted for in event ININCCKCOM.)

30 HR-5; PIP G-00-424 Action # 24 In Rev 2, there was no documentation of the identification of dependent human error events in the same cutset. This effort is being done for Rev 3, but Rev 3 is not implemented as of the date of this review.

The Peer review of the Rev 3 HEP dependency analysis found:

a) the bases/criteria for the selection of dependency factors are notstated and appear to be applied inconsistently for similar events-in particular, credit for SSF to prevent seal LOCA for SBO, loss of RN, fire and seismic is not consistent.

b) limited reference to the procedural direction for dependent actions, i.e., the dependent actions could be called by the same procedural step and are therefore highly dependent and this analysis would not show it.

c) the value of the final HEP is dependent on the order in which the HEPs are arran qed. Because the This F&O is closed.

The HEP dependency analysis has been added to MNS Human Reliability Analysis SAAG 501. The process/basis/criteria for the selection of dependency factors is described in section 3.2.4. The dependency quantification worksheets have been added in Appendix D. Inconsistencies identified during the peer review have been resolved. Procedural guidance for the dependent actions is identified in the individual action quantifications in Appendix B and C. The sequence of events for the dependency evaluation is described in the "situation" and "relative timing" sections of the individual worksheets in Appendix D. The basis for the decision on each dependency factor is described in the appropriate sections on the worksheets. This updated information has been incorporated in MNS PRA Rev. 3.

26

sequence or events is not ciear anu tne proceuurai direction is not stated, the order of HEPs is left up to the analyst.

d) the basis for decision on each dependency factor is not documented and does not appear to be readily reproducible.

e) lack of guidance for the above.

This is significance A because there is no apparent identification and correction for dependent human errors in Rev. 2. Although this effort is underway in Rev. 3, it was not in place for the review. Risk applications at this time are based on Rev. 2, which does not have the dependent HE evaluation.

HR-8; PIP G-00-424 Action # 27 In Rev 3, the calc sheet for RNUNIT2RHE states that the resultant calculation is the product of RNLOUT2RHE and this event, which has a probability of.1, for a total non-recovery probability of 0.03, So, this result is the product of 2 recoveries.

This violates the time constraints set down in the recovery file.

This F&O is closed.

The two operator actions RNUNIT2RHE and RNLOUTRHE have been deleted and replaced with two new operator actions WRVBACKDHE and WRNUNT2DHE in the RN system PRA model for MNS PRA Rev. 3. These two operator actions account for the operator failure to align RV backup cooling or failure to cross-connect RN from the other unit. An equipment failure event WRVBACKDEX has also been added to the RN system PRA model to account for equipment failures of the RV system. Operator action failure probability quantification for WRVBACKDHE and WRNUNT2DHE is included in the MNS Human Reliability Analysis Notebook SAAG 501.

31 27

ur_-'; rir

.%2-UU-Q.Q /LIUII if' O Review of several systems indicates that similar components within a system are not consistently included in a common cause group. Examples where CCF is not sufficiently considered include RN header cross-connect valves, CA suction supply valves from the RN flowpath, Safety Injection Cold/Hot Leg Injection check valves, KC system train valves, etc I 1IIb rai'J Ib L*IUbU.

A review of the PRA model identified 19 new common cause basic events that were incorporated into the MPRA Rev. 3 Common Cause Analysis (SAAG-613). These changes were addressed under corrective actions #22 and #23 of PIP G-00-424.

Also, the common cause analysis process was updated.

32 When CCF events are not modeled for important components, the overall risk of that component being unavailable can be understated causing the core melt frequency to be understated.

33 QU-1; PIP G-00-424 Action # 34 Written guidance to describe the quantification process was not available. The McGuire PRA makes use of a top logic fault tree for quantification of accident sequences. The process for building, validating and reviewing the top logic fault tree is complex, requiring the collection and integration of a diverse set of information from all parts of the PRA.

A description of this process, guidance on key inputs and sources, and interpretation of outputs, was not available.

Any PRA quantification process is complex and prone to error if explicit guidance is not available.

This F&O is closed.

An Integration Notebook (SAAG 679) has been developed to discuss the processes used to:

- build the integrated plant model (database and fault tree),

- select an appropriate truncation limit,

- solve the model,

- apply recoveries,

- resolve human error dependencies, and

- assign plant damage states.

The notebook also provides a high level summary of the results and a comparison with the Rev.2 results.

28

uu-z; t-ir-u-uu-444 Action *.)a Much of the sequence "recovery" is added to the sequences by means of cut-set editing rather than integration into the fault tree top logic. In doing this, some potential hardware failures have been neglected. Recovery was not done systematically over all sequences, but rather recovery rules were written by hand and as such were only written for high CDF sequences.

I nis rotu 1m iI eIu.

The recovery process has been enhanced to separate the equipment and human error failure modes. For example, to address the hardware failures associated with aligning RN via the cross-tie to the other unit, common cause failure of the RN pumps and RN pump strainers were added to the fault tree logic. Similarly, basic event POPXCONDEX models the possibility that a LOSP also affects the other unit. The McGuire CDF Model Integration Notebook (SAAG 679) describes the processes used to apply recovery events and to resolve human error dependencies for cutsets containing multiple human.error events. Annotated copies of the rule files used to apply the recoveries are included in the notebook. Each general recovery event is commented to explain why the recovery applies. In cases where it might not be obvious why a recovery is applied to specific sequences, the recovery rules are commented to provide the rationale.

34 An example of these concerns is that alignment of RN gives no consideration of the hardware faults or the condition of the operating status of Unit 2. At least one RN pump at unit 2 is always assumed to be available for cross-tie to unit 1, which may not be the case during modes 5 and 6 at Unit 2.

There is no process document for the recovery analysis to describe

1. which sequences are recovered

2. how many recoveries are added to each sequence

3. how to decide which recovery is applicable to which sequence.

The cutset/sequence recovery analysis for the McGuire PRA is an extension of the accident sequence development and integral to the quantification and interpretation of results. As implemented in the PRA as reviewed, the process makes it difficult to determine the adequacy and appropriateness of these PRA elements.

29

35

%AU

• E, Ir" UUU'i1.&' "PLLIUII ".)I The quantification cutoff (truncation level) for Rev 2 was 1E-8. The truncation for Rev 3 is 1E-9. The McGuire PRA staff has quantified the PRA at cutoffs of 1E-10 and 1E-11 and shown that the model results converge (to about 3.9E-05 at the time of this review). The sub-element criteria, however, require that four orders of magnitude from total LERF be used to get a grade 2 or 3. The quantified value of LERF is 2E-7 as of this review, so the base line cutoff for LERF quantification per the sub-element criterion would need to be 2 E-1 1 to get a grade 3 for this element. Use of a lower cutoff should be possible using the available quantification software.

It is important to demonstrate that an appropriately low truncation value is used in the quantification.

I III*

-Oi&J It, LIUVWU.

For McGuire PRA Rev. 3, a truncation limit of I E-1 1 is used to solve for LERF-related sequences. These include ISLOCA sequences, SGTR sequences which involve containment bypass, and containment isolation failure sequences. Since this truncation limit is more than four orders of magnitude below LERF, this corrective action may closed.

36 L2-7; PIP G-00-424 Action # 41 The method of determining LERF is significantly different for the McGuire PRA compared to other industry applications. The McGuire process involves going through a plant specific Level 3 analysis to determine which release categories have an early fatality contribution. The criteria used is a mean early fatality conditional probability of 0.5 as determined by the CRAC-2 / MACCS computer codes. This results in many McGuire PRA core damage sequences being classified as non-LERF, whereas they would typically be classified as LERF in more commonly used industry approaches. Use of the McGuire LERF approach results in most unisolated containment sequences and most SGTR sequences being non-LERF, whereas this would not be the case if other industry approaches, such as the NRC LERF definition or the WOG LERF definition.

This F&O is closed.

The CET methodology referred to in this F&O is no longer utilized in the estimation of the large early release frequency. LERF is now evaluated using the methodology in NUREG/CR-6595.

30

1. Inconsistency with de-facto industry standards, and

2. Dependence on the accuracy of the MAAP fission product models and the CRAC-2 / MACCS consequence models. Neither of those were reviewed in detail during this review, since they are beyond the current peer review scope.

3. The McGuire LERF definition depends on 95%

evacuation. There is no documentation of time between declaratrion of a General Emergency (which supports the initiation of evacuation) and completion of evacuation to assure that the cutsets in each PDS are properly grouped. Also, there is no documentation of consideration of the impact of external initiating events (e.g., seismic, where 20%

of the CDF ends up in RC501, which is below the 0.5 fatality criterion, but depends on effective evacuation) on capability to perform a 95%

evacuation in the same time frame as that currently used for LERF consideration.

The McGuire LERF definition is significantly different than most of the rest of industry. Since the definition used directly impacts the LERF for McGuire, the 2nd and 3rd issues above should be addressed before the model is used to support applications.

31

MU-1; I-11-r -UU-4Z4 ACtiOn;F 40 Proposed PRA Model Change forms are used to identify modeling problems and plant changes for consideration in the update process. The following potential problems were noted in this process:

I nis r-&U is ciosea.

On 12/19/2000 Revision 4 to XSAA-106 Workplace Procedure for PRA Maintenance and Update was approved. This revision formalized a new process for preparing and controlling PRA change requests that addressed the issues in the problem description of this corrective action. This process was effective 1/1/2001.

1. Although there appears to be an intent that a central repository of these forms be maintained, the responsible analyst could not state with certainty that there is consistent application of this intent in that the original forrms are sometimes distributed to the applicable system modelers rather than copies. This leads to the potential for forms to be misplaced and the possibility that intended changes are not incorporated.

2. The Proposed PRA Model Change forms are not 37 consistently reviewed and approved due to the absence of a requirement for timely review and approval. One PRA Update form dated 6/3/98 was reviewed which reported a problem with RN Train Maintenance events not causing diesel failure following an LOSP. The risk significance was marked Unknown and no apparent attempt was made to investigate the potential impact on the Revision 2 results, even though the problem was determined to be a potentially incorrect breaking of circular logic.

3. There is no closure mechanism for ensuring that all changes have been incorporated into a model revision or disposed of by evaluation. The current process relies on the system notebook reviewers to verify implementation of proposed changes.

However, without a central database or repositorv of 32

proposed changes, the reviewer can only check those forms passed along to him by the system notebook preparer. For example, a Prposed PRA Model Change for was found which evaluated LER 369/97-09 as representing a potential unmodeled dependence within the CA system, an impact on automatic operation of the PORVs and a potential dual-unit initiating event. The appropriate system model changes appear to have been incorporated, but the rationale for not adding a dual-unit trip initiating event on loss of the 125V DC Auxiliary Control Panel is not documented. Likewise, a proposed change form dated 3/29/99 documents a flood event in the McGuire CA pump room.

However, this event is not listed in the flood events table for the latest revision of the flooding study and does not appear to have been considered through Bayesian updating of generic flood data as suggested in the proposed resolution.

4. It is not clear that the Proposed PRA Model Change forms are distributed to all of the analysts potentially affected by the change. A proposed change noting that the SSF is not typically manned during a T6 event was found in the Transient Analysis notebook. However, it appears that this change affects the SSF system model and was not incorporated into Revision 3 of the SSF fault tree.

There is no evidence that the noted process implementation problems have a significant impact on CDF, but it appears that the process could allow items with potentially significant impact to "slip through the cracks."

33

1 ror eacn acuuunm sequtvi~u, iuLr,,- It-T i

LU phenomenological conditions created by the accident progression. Phenomenological impacts include generation of harsh environments affecting temperature, pressure, debris, water levels, humidity, etc. that could impact the success of the system or function under consideration [e.g., loss of pump net positive suction head (NPSH), clogging of flow paths]. INCLUDE the impact of the accident progression phenomena, either in the accident sequence models or in the system models.

/-L;UlUWI IL WC~LIUI UIlU notebooks and system model notebooks should identify those environmental effects of the initiating event and the impact on mitigation systems.

I lil uilu it Up II.

Phenomenological effects are already considered in the model, but were not well documented. This is not expected to impact the overall conclusions of the vital battery LAR application.

DA-AI a DA-Ala (old)

DA-A2 (new)

ESTABLISH definitions of SSC boundaries, failure modes, and success criteria consistent with corresponding basic event definitions in Systems Analysis (SY-A5, SY-A7, SY-A8, SY-Al0 through SY-A13 and SY-B4) for failure rates and common cause failure parameters, and ESTABLISH boundaries of unavailability events consistent with corresponding definitions in Systems Analysis (SY-A18).

Revise the data calc. to discuss component boundaries definitions.

No 2

This finding is open.

The Oconee PRA model was recently updated, and the Systems Analysis in the updated model was found to be consistent with the previous modeling. The McGuire PRA model was developed by the same personnel using a similar process. Therefore, this gap is considered to be a documentation issue and will not affect the overall conclusions of the vital battery LAR application.

DA-B1 For parameter estimation, GROUP components Revise the data calc. to Partial This finding is open.

according to type (e.g., motor-operated pump, segregate standby and This is a refinement to the air-operated valve) and according to the operating component equipment failure rates. However, characteristics of their usage to the extent data. Segregate since most components are 3

supported by data: (a) mission type (e.g.,

components by service grouped appropriately, the overall standby, operating) (b) service condition (e.g.,

condition to the extent impact should be small. This gap is clean vs. untreated water, air) supported by the data.

not expected to affect the overall conclusions of the vital battery LAR application.

34

distribution and mean value of a parameter, CHECK that the posterior distribution is reasonable given the relative weight of evidence provided by the prior and the plant-specific data.

Examples of tests to ensure that the updating is accomplished correctly and that the generic parameter estimates are consistent with the plant-specific application include the following:

(a) confirmation that the Bayesian updating does 4

not produce a posterior distribution with a single bin histogram (b) examination of the cause of any unusual (e.g., multimodal) posterior distribution shapes (c) examination of inconsistencies between the prior distribution and the plant-specific evidence to confirm that they are appropriate (d) confirmation that the Bayesian updating algorithm provides meaningful results over the range of values being considered (e) confirmation of the reasonableness of the posterior distribution mean value documentation to include a discussion of the specific checks performed on the Bayesian-updated data, as required by this SR.

I I II* UIny 1

I5 U1JWu ll.

This is a documentation issue only.

Workplace procedures are in place to ensure that the Bayesian update results are reviewed for reasonableness by the data analyst.

DA-D6 USE generic common cause failure probabilities Provide documentation in Partial This finding is open.

consistent with available plant experience.

SAAG 637 of the The self assessment team indicated EVALUATE the common cause failure comparison of the that none of the open items are probabilities consistent with the component component boundaries expected to have a significant boundaries.

assumed for the generic impact on the PRA results or 5

CCF estimates to those insights. No technical issues were assumed in the McGuire identified for this gap. This is a PRA to ensure that these documentation issue only and is not boundaries are expected to affect the overall consistent.

conclusions of the vital battery LAR application.

35

HR-A2 IDENTIFY, through a review of procedures and Enhance the HRA to Partial This finding is open.

practices, those calibration activities that if consider the potential for Based on preliminary evaluations performed incorrectly can have an adverse calibration errors.

using the EPRI HRA calculator, impact on the automatic initiation of standby calibration errors that result in safety equipment.

failure of a single channel are expected to fall in the low 10-3 range. Calibration errors that result in failure of multiple channels are expected to fall in the low 10-5 range. Relative to post-initiator 6

Human Error Probabilities (HEPs),

equipment random failure rates and maintenance unavailability, calibration HEPs are not expected to contribute significantly to overall equipment unavailability. Recent modeling updates for the Oconee PRA support this position. This F&O is not expected to affect the overall conclusions of the vital battery LAR application.

36

tK-/-3 iUr-I'J I H-T wnicn or inose work pracices iuenmiry maintenance ana 11o0 i nis Tinaing is open.

identified above (HR-Al, HR-A2) involve a calibration activities that Based on preliminary evaluations mechanism that simultaneously affects could simultaneously using the EPRI HRA calculator, equipment in either different trains of a affect equipment in either calibration errors that result in redundant system or diverse systems [e.g., use different trains of a failure of a single channel are of common calibration equipment by the same redundant system or expected to fall in the low 10-3 crew on the same shift, a maintenance or test diverse systems.

range. Calibration errors that result activity that requires realignment of an entire in failure of multiple channels are system (e.g., SLCS)].

expected to fall in the low 10-5 range. Relative to post-initiator 7

Human Error Probabilities (HEPs),

equipment random failure rates and maintenance unavailability, calibration HEPs are not expected to contribute significantly to overall equipment unavailability. Recent modeling updates for the Oconee PRA support this position. This F&O is not expected to affect the overall conclusions of the vital battery LAR submittal.

HR-D6 PROVIDE an assessment of the uncertainty in Develop mean values for Yes This item has been closed to the HEPs. USE mean values when providing pre-initiator HEPs.

Capability Category I1.

point estimates of HEPs.

Mean values for pre-initiator HEPs have been developed and are in use.

37

9 VV Illt.Il I LI I l:IdUlIly r-Irr-b* lZV/-%LU/% I I-LI IV I[I I

IUL; of the following plant-specific and scenario-specific performance shaping factors: (a) quality

[type (classroom or simulator) and frequency] of the operator training or experience (b) quality of the written procedures and administrative controls (c) availability of instrumentation needed to take corrective actions (d) degree of clarity of the meaning of the cues/indications (e) human-machine interface (f) time available and time required to complete the response (g) complexity of detection, diagnosis and decision-making, and executing the required response (h) environment (e.g., lighting, heat, radiation) under which the operator is working (i) accessibility of the equipment requiring manipulation (j) necessity, adequacy, and availability of special tools, parts, clothing, etc.

LjuI.U ;Ul I I tIII III IIHUH : U;CIII the influence of performance shaping factors on execution human error probabilities.

I IIIt, IIIUlll9 I* UJJ Ell.

A recent update of the Oconee PRA model demonstrated that the HRA methodology for operator actions used at the time of the McGuire peer review produced conservative results, largely due to overestimation of the impact of dependencies.

This F&O is not expected to affect the overall conclusions of the vital battery LAR submittal.

HR-G4 BASE the time available to complete actions on Enhance HRA Partial This finding is open.

appropriate realistic generic thermal-hydraulic documentation Same as response to gap for SR analyses, or simulation from similar plants (e.g.,

accordingly.

HR-G3.

10 plant of similar design and operation) (See SC-B4.). SPECIFY the point in time at which operators are expected to receive relevant indications.

HR-G6 CHECK the consistency of the post-initiator HEP Document a review of the No This finding is open.

quantifications. REVIEW the HFEs and their HFEs and their final Same as response to gap for SR final HEPs relative to each other to check their HEPs relative to each HR-G3.

reasonableness given the scenario context, other to confirm their 11 plant history, procedures, operational practices, reasonableness given and experience, the scenario context, plant history, procedures, operational practices, and experience.

38

(old)

I.,rdl duLL::L ll_:

LI Il UIlUlItdlIIly I LI It (z.bLIIIlILtb Ui the HEPs, and PROVIDE mean values for use in the quantification of the PRA results.

LJIVV*:*I IIIttdilI VdUllU%-, IUI post-initiator HEPs.

This item has been closed to Capability Category II.

12 HR-G8 (new)

Mean values for post-initiator HEPs have been developed and are in use.

HR-H2 CREDIT operator recovery actions only if, on a Develop more detailed Partial This finding is open.

plant-specific basis: (a) a procedure is available documentation of Same as response to gap for SR and operator training has included the action as operator cues, relevant HR-G3.

part of crew's training, or justification for the performance shaping omission for one or both is provided (b) "cues" factors, and availability of 13 (e.g., alarms) that alert the operator to the sufficient manpower to recovery action provided procedure, training, or perform the action.

skill of the craft exist (c) attention is given to the relevant performance shaping factors provided in HR-G3 (d) there is sufficient manpower to perform the action IE-A1 IDENTIFY those initiating events that challenge Enhance the IE Partial This finding is open.

normal plant operation and that require documentation (as was The McGuire PRA model is successful mitigation to prevent core damage done in OSC-9068).

undergoing a complete update, and using a structured, systematic process for the complete list of Initiating Events identifying initiating events that accounts for in the update was found to be 14 plant-specific features. For example, such a consistent with the previous systematic approach may employ master logic modeling. Therefore, this gap is diagrams, heat balance fault trees, or failure considered to be a documentation modes and effects analysis (FMEA). Existing issue and will not affect the overall lists of known initiators are also commonly conclusions of the vital battery LAR I employed as a starting point.

application.

39

I M-PO Mr-~VirVV tue pldIIL-tiJ:U~lII. IliILIdLI~ll tCVCIIL reii:1U1iui d IC:VIUW 01U ilt:

-di Licl I Ilib 1111U11I9 lb UpralI.

experience of all initiators to ensure that the list plant-specific initiating PRA Change Form M-07-0012 of challenges accounts for plant experience. See event experience of all identifies two flooding events that also IE-A7 initiators to ensure that were not initially included in the the list of challenges quantification of the CA Pump accounts for plant Room flood frequency. This has experience.

been addressed by the flood model update to the internal events PRA, 15 which was used for the vital battery LAR application analysis.

Similarly, a review of the PIP database for fire events that did not lead to plant trip could affect the frequency of a fire initiator. This has been addressed in the recently completed Fire PRA. Other initiators (except for ATWS) result in plant trip and the generation of an LER.

IE-A3a REVIEW generic analyses of similar plants to Ensure the list of Partial This finding is open.

(old) assess whether the list of challenges included in challenges included in Same as response to gap for SR the model accounts for industry experience, the McGuire PRA IE-Al.

IE-A4 accounts for industry 16 (new) experience using a more recent reference, such as the WOG PSA Model and Results Comparison Database - Revision 4.

40

I r- -/A.t+I (old)

IE-A5 (new) 17 rr--rirumvi d

, a ybLdLiU*

tVdJUdLauI UI* u*dr system where necessary (e.g., down to the subsystem or train level), including support systems, to assess the possibility of an initiating event occurring due to a failure of the system.

USE a structured approach [such as a system-by-system review of initiating event potential, or an FMEA (failure modes and effects analysis),

or other systematic process] to assess and document the possibility of an initiating event resulting from individual systems or train failures.

r'iuvIuU UUrnU11nU1aLdLIUfI U1 a systematic evaluation of all plant systems, including support systems (including those not explicitly modeled in the PRA), to assess the possibility of an initiating event occurring due to a failure of the system.

i nib ]1uing9 ib open.

Same as response to gap for SR IE-Al.

IE-A4a When performing the systematic evaluation Enhance the IE Partial This finding is open.

(old) required in IE-A4 (new SR number is IE-A5),

documentation (as was Same as response to gap for SR INCLUDE initiating events resulting from done in OSC-9068).

IE-Al.

18 IE-A6 multiple failures, if the equipment failures result (new) from a common cause, and from system alignments resulting from preventive and corrective maintenance.

IE-A5 In the identification of the initiating events, Enhance the IE Partial This finding is open.

(old)

INCORPORATE (a) events that have occurred documentation (as was Same as response to gap for SR at conditions other than at-power operation (i.e.,

done in OSC-9068).

IE-Al.

IE-A7 during low-power or shutdown conditions), and 19 (new) for which it is determined that the event could also occur during at-power operation. (b) events resulting in a controlled shutdown that includes a scram prior to reaching low-power conditions, unless it is determined that an event is not applicable to at-power operation.

IE-A6 INTERVIEW plant personnel (e.g., operations, Obtain plant personnel No This finding is open.

20 (old) maintenance, engineering, safety analysis) to input (as was done in Same as response to gap for SR IE-A8 determine if potential initiating events have been OSC-9068).

IE-Al.

(new) overlooked.

I 41

I1-Al (old) 21 IE-A9 (new)

REVIEW plant-specific operating experience for initiating event precursors, for the purpose of identifying additional initiating events. For example, plant specific experience with intake structure clogging might indicate that loss of intake structures should be identified as a potential initiatinq event.

precursor events for their potential to be initiating events.

I Ili lIIlUIny Ib uprll.

Same as response to gap for SR IE-AI.

IE-B1 COMBINE initiating events into groups to Enhance the IE No This finding is open.

facilitate definition of accident sequences in the documentation (as was Same as response to gap for SR 22 Accident Sequence Analysis element (para.

done in OSC-9068).

IE-A1.

4.5.2) and to facilitate quantification in the Quantification element (para. 4.5.8).

IE-B2 USE astructured, systematic process for Document a structured, Partial Same as response to gap for SR grouping initiating events. For example, such a systematic grouping of IE-Al.

23 systematic approach may employ master logic initiating events (as was diagrams, heat balance fault trees, or failure done in OSC-9068).

modes and effects analysis (FMEA).

IE-B3 GROUP initiating events only when the following Enhance documentation Partial This finding is open.

can be assured: (a) events can be considered of the grouping process Same as response to gap for SR similar in terms of plant response, success (as was done in OSC-IE-Al.

criteria, timing, and the effect on the operability 9068).

and performance of operators and relevant mitigating systems; or (b) events can be 24 subsumed into a group and bounded by the worst case impacts within the "new" group. DO NOT SUBSUME events into a group unless: (1) the impacts are comparable to or less than those of the remaining events in that group, AND (2) it is demonstrated that such grouping does not impact significant accident sequences.

IE-D3 DOCUMENT the assumptions and sources Enhance the IE No This finding is open.

25 uncertainty with the initiating event analysis.

documentation (as was Same as response to gap for SR done in OSC-9068).

IE-Al.

42

Ir-DI (old)

IFSO-A5 (new) 26 ri'{l Ud,.ll bUUIU;*, d1lU ILb IUZIII.IIIVU lIdIIUtl mechanism, IDENTIFY the characteristic of release and the capacity of the source.

INCLUDE: (a) a characterization of the breach, including type (e.g., leak, rupture, spray) (b) range of flow rates (c) capacity of source (e.g.,

gallons of water) (d) the pressure and temperature of the source I-I II I l I.;

LII% I I I IICdI Flood analysis to address the potential for spray, jet impingement, and pipe whip failures.

Additionally, document how these failures are included in the quantification.

J IIM IIL*III IlCl* UUIEII FlU-U LU Capability Category II.

This has been addressed by the flood model update to the internal events PRA which was used for the vital battery LAR application analysis.

IF-C2c (old)

IFSN-A5 (new)

For each flood area not screened out using the requirements under IF-Bib, IDENTIFY the SSCs located in each defined flood area and along flood propagation paths that are modeled in the internal events PRA model as being required to respond to an initiating event or whose failure would challenge normal plant operation, and are susceptible to flood. For each identified SSC, IDENTIFY, for the purpose of determining its susceptibility per IF-C3, its spatial location in the area and any flooding mitigative features (e.g.,

shielding, flood or spray capability ratings).

27 Given the expected increase in number of flood areas needed to satisfy requirement IF-Al, additional equipment will need to be identified and discussed in order to meet the requirements of the ASME Standard. The current flooding analysis does not discuss flood mitigative features and this will have to be corrected to satisfy the requirements of the ASME Standard.

Yes This item has been closed to Capability Category II.

This has been addressed by the flood model update to the internal events PRA which was used for the vital battery LAR application analysis.

43

(old)

IFSN-A6 (new) ru[

I,

oou, IuHIIlIIUu I[I Ir--LL/L;, IuLIm I i-I

IIt, susceptibility of each SSC in a flood area to flood-induced failure mechanisms. INCLUDE failure by submergence and spray in the identification process. ASSESS qualitatively the impact of flood-induced mechanisms that are not formally addressed (e.g., using the mechanisms listed under Capability Category III of this requirement), by using conservative assumptions.

28 I IIU UUlII:IIL IIUUUlIly analysis identifies the submergence failure height of the equipment important to accident mitigation, but, except for the Aux. Shutdown Panel, never addresses the impact of spray.

Spray as a failure mechanism needs to be addressed in the analysis or a note made explaining why it was omitted.

I 11,b ILWIII IId4 UVWI L,1UbWU LU Capability Category II.

This has been addressed by the flood model update to the internal events PRA which was used for the vital battery LAR application analysis.

IF-C3b IDENTIFY inter-area propagation through the Provide more analysis of Yes This item has been closed to (old) normal flow path from one area to another via flood propagation Capability Category I1.

drain lines; and areas connected via back flow flowpaths. Address This has been addressed by the IFSN-through drain lines involving failed check valves, potential structural failure flood model update to the internal A8 pipe and cable penetrations (including cable of doors or walls due to events PRA which was used for the (new) trays), doors, stairwells, hatchways, and HVAC flooding loads and the vital battery LAR application ducts. INCLUDE potential for striuctural failure potential for barrier analysis.

(e.g., of doors or walls) due to flooding loads unavailability.

and the potential for barrier unavailability, including maintenance activities.

IF-E6b INCLUDE, in the quantification, both the direct Address potential indirect Yes This item has been closed to (old) effects of the flood (e.g., loss of cooling from a effects.

Capability Category I!.

service water train due to an associated pipe This has been addressed by the 30 IFQU-rupture) and indirect effects such as flood model update to the internal A9 submergence, jet impingement, and pipe whip, events PRA which was used for the (new) as applicable.

vital battery LAR application analysis.

IF-F2 DOCUMENT the process used to identify flood Need to document how Yes This item has been closed to 31 (old) sources, flood areas, flood pathways, flood the analysis addressed Capability Category II.

scenarios, and their screening, and internal flood all of the items identified This has been addressed by the N/A model development and quantification. For in this requirement.

flood model update to the internal 44

example, this documentation typically includes (a) flood sources identified in the analysis, rules used to screen out these sources, and the resulting list of sources to be further examined (b) flood areas used in the analysis and the reason for eliminating areas from further analysis (c) propagation pathways between flood areas and assumptions, calculations, or other bases for eliminating or justifying propagation pathways (d) accident mitigating features and barriers credited in the analysis, the extent to which they were credited, and associated justification (e) assumptions or calculations used in the determination of the impacts of submergence, spray, temperature, or other flood-induced effects on equipment operability (f) screening criteria used in the analysis (g) flooding scenarios considered, screened, and retained (h) description of how the internal event analysis models were modified to model these remaining internal flooding scenarios (i) flood frequencies, component unreliabilities/unavailabilities, and HEPs used in the analysis (i.e., the data values unique to the flooding analysis) (j) calculations or other analyses used to support or refine the flooding evaluation (k) results of the internal flooding analysis, consistent with the quantification requirements provided in HLR QU-D events PRA which was used for the vital battery LAR application analysis.

LE-C6 In crediting HFEs that support the accident Explicitly model RCS Partial This finding is open.

(old) progression analysis, USE the applicable depressurization for This issue affects some small requirements of para. 4.5.5, as appropriate for small LOCAs and LOCAs. Because the small LOCA 32 LE-C7 the level of detail of the analysis.

perform the dependency contribution to LERF is small, the (new) analysis on the HEPs.

impact to the analysis for the vital battery LAR application is insignificant.

45

rM-rUvIuL-unceUrUway danday* I L1ud n

UMLMU, uet sources of uncertainty and includes sensitivity studies for the significant contributors to LERF.

33 I-'t!llUl((I dI[U [UUL;UlII1III.

sensitivity studies to determine the impact of the assumptions and sources of model uncertainty on the LERF results.

I 111b 1IlilUlIl9 Is UFJ:1l.

Same as response to gap for SR DA-D6.

LE-F3 34 IDENTIFY contributors to LERF and characterize LERF uncertainties consistent with the applicable requirements of Tables 4.5.8-2(d) and 4.5.8-2(e). NOTE: The supporting requirements in these tables are written in CDF language. Under this requirement, the applicable requirements of Table 4.5.8 should be interpreted based on LERF, including characterizing key modeling uncertainties associated with the applicable contributors from Table 4.5.9-3. For example, supporting requirement QU-D5 addresses the significant contributors to CDF. Under this requirement, the contributors would be identified based on their contribution to LERF.

Compare LERF results and uncertainties to similar plants and include in the LERF documentation.

Partial.

This finding is open.

Same as response to gap for SR DA-D6.

LE-G3 DOCUMENT the relative contribution of Evaluate the relative Partial This finding is open.

contributors (i.e., plant damage states, accident contribution of the Same as response to gap for SR 35 progression sequences, phenomena, various contributors to DA-D6.

containment challenges, containment failure the total LERF.

modes) to LERF.

LE-G4 DOCUMENT assumptions and sources of-Perform and document Partial This finding is open.

uncertainty associated with the LERF analysis, sensitivity studies to Same as response to gap for SR including results and important insights from determine the impact of DA-D6.

36 sensitivity studies.

the assumptions and sources of model uncertainty on the LERF results.

I 46

IUI-N I Ir-T iim-iiatons in mne L would impact applications.

37 InluIUUU III t.lc LrIr -

documentation an assessment that identifies the limitations in the LERF analysis that could impact applications.

1 111 11tautog Ib upul..

Same as response to gap for SR DA-D6.

LE-G6 DOCUMENT the quantitative definition used for Provide a discussion of Partial This finding is open.

38 significant accident progression sequence. If the significant cut sets Same as response to gap for SR other than the definition used in Section 2, and sequences.

DA-D6.

JUSTIFY the alternative.

QU-D3 COMPARE results to those from similar plants Perform and document a No This finding is open.

(old) and IDENTIFY causes for significant differences, comparison of results Same as response to gap for SR 39 For example: Why is LOCA a large contributor between the MNS PRA DA-D6.

QU-D4 for one plant and not another?

and other similar plants.

(new)

QU-E4 EVALUATE the sensitivity of the results to Perform and document a No This finding is open.

model uncertainties and assumptions using set of sensitivity cases to Same as response to gap for SR sensitivity analyses [Note (1)].

determine the impact of DA-D6.

40 the assumptions and sources of model uncertainty on the results.

QU-F2 DOCUMENT the model integration process, Expand the Partial This finding is open.

including any recovery analysis, and the results documentation of PRA Same as response to gap for SR of the quantification including uncertainty and model results to address DA-D6.

sensitivity analyses. For example, all required items.

documentation typically includes (a) records of the process/results when adding nonrecovery 41 terms as part of the final quantification (b) records of the cutset review process (c) a general description of the quantification process including accounting for systems successes, the truncation values used, how recovery and post-initiator HFEs are applied (d) the process and results for establishing the truncation screening 47

values Tor unai quartnudiuo ami Ut111UraUd~l L11d convergence towards a stable result was achieved (e) the total plant CDF and contributions from the different initiating events and accident classes (f) the accident sequences and their contributing cutsets (g) equipment or human actions that are the key factors in causing the accident sequences to be nonsignificant (h) the results of all sensitivity studies (i) the uncertainty distribution for the total CDF () importance measure results (k) a list of mutually exclusive events eliminated from the resulting cutsets and their bases for Elimination (I) asymmetries in quantitative modeling to provide application users the necessary understanding regarding why such asymmetries are present in the model (m) the process used to illustrate the computer code(s) used to perform the quantification will yield correct results process QU-F6 DOCUMENT the quantitative definition used for Document the required Partial This finding is open.

significant basic event, significant cutset, definitions.

Same as response to gap for SR 42 significant accident sequence. If other than the DA-D6.

definition used in Section 2, JUSTIFY the alternative.

SC-A4 SPECIFY success criteria for each of the key Improve the Partial This finding is open.

(old) safety functions identified per SR AS-A2 for documentation on the TH MNS success criteria runs were each modeled initiating event [Note (2)].

bases for all safety performed by a vendor since the SC-A3 function success criteria peer review was performed, and (new) for all initiators, found similar results to the previous analyses. This F&O is not expected to affect the overall conclusions of the vital battery LAR application.

48

44 Lkl-,l'-\\.o, Lilt: I UIbldUII*II*,

dlIIU dLA; AL, -IIILy UI the results of the thermal/hydraulic, structural, or other supporting engineering bases used to support the success criteria. Examples of methods to achieve this include: (a) comparison with results of the same analyses performed for similar plants, accounting for differences in unique plant features (b) comparison with results of similar analyses performed with other plant-specific codes (c) check by other means appropriate to the particular analysis r

vIU-l eVIUlVILALe LlIdIL di I acceptability review of the T/H analyses is performed.

a 111b IIniUIIlI lb UiJEll.

Same as response to gap for SR SC-A4.

SC-Cl DOCUMENT the success criteria in a manner Improve the Partial This finding is open.

that facilitates PRA applications, upgrades, and documentation on the TH Same as response to gap for SR 45 peer review, bases for all safety SC-A4.

function success criteria for all initiators.

49

.-LIZ uutuivrit-N i ine processes usea to oeveiop overall PRA success criteria and the supporting engineering bases, including the inputs, methods, and results. For example, this documentation typically includes: (a) the definition of core damage used in the PRA including the bases for any selected parameter value used in the definition (e.g., peak cladding temperature or reactor vessel level) (b) calculations (generic and plant-specific) or other references used to establish success criteria, and identification of cases for which they are used (c) identification of computer codes or 46 other methods used to establish plant-specific success criteria (d) a description of the limitations (e.g., potential conservatisms or limitations that could challenge the applicability of computer models in certain cases) of the calculations or codes (e) the uses of expert judgment within the PRA, and rationale for such uses (f) a summary of success criteria for the available mitigating systems and human actions for each accident initiating group modeled in the PRA (g) the basis for establishing the time available for human actions (h) descriptions of processes used to define success criteria for grouped initiating events or accident sequences improve Ine documentation on the TH bases for all safety function success criteria for all initiators.

I "is TfuIig is open.

Same as response to gap for SR SC-A4.

50

SY-A14 In meeting SY-A12 and SY-A13, contributors to (old) system unavailability and unreliability (i.e.,

components and specific failure modes) may be SY-Al 5 excluded from the model if one of the following (new) screening criteria is met: (a) A component may be excluded from the system model if the total failure probability of the component failure modes resulting in the same effect on system 47 operation is at least two orders of magnitude lower than the highest failure probability of the other components in the same system train that results in the same effect on system operation.

(b) One or more failure modes for a component may be excluded from the systems model if the contribution of them to the total failure rate or probability is less than 1% of the total failure rate or probability for that component, when their effects on system operation are the same.

Provide quantitative evaluations for screening.

This finding is open.

Same as response to gap for SR DA-D6.

SY-A4 PERFORM plant walkdowns and interviews with Enhance the system Partial This finding is open.

system engineers and plant operators to confirm documentation to include Same as response to gap for SR that the systems analysis correctly reflects the an up-to-date system DA-D6.

as-built, as-operated plant.

walkdown checklist and system engineer review 48 for each system.

Consider revising workplace procedure XSAA-106 to require that such documentation be revisited with each major PRA revision.

51

49 ESTABLISH the boundaries of the components required for system operation. MATCH the definitions used to establish the component failure data. For example, a control circuit for a pump does not need to be included as a separate basic event (or events) in the system model if the pump failure data used in quantifying the system model include control circuit failures. MODEL as separate basic events of the model, those subcomponents (e.g., a valve limit switch that is associated with a permissive signal for another component) that are shared by another component or affect another component, in order to account for the dependent failure mechanism.

Enhance systems analysis documentation to discuss component boundaries.

This finding is open.

Same as response to gap for SR DA-D6.

SY-B8 IDENTIFY spatial and environmental hazards that may impact multiple systems or redundant components in the same system, and ACCOUNT for them in the system fault tree or the accident sequence evaluation. Example:

Use results of plant walkdowns as a source of information regarding spatial/environmental hazards, for resolution of spatial/environmental issues, or evaluation of the impacts of such hazards.

50 Per Duke's PRA modeling guidelines, ensure that a walkdown/system engineer interview checklist is included in each system notebook.

Based on the results of the system walkdown, summarize in the system write-up any possible spatial dependencies or environmental hazards that may impact system operation.

Partial This finding is open.

Same as response to gap for SR DA-D6.

52

YT-b'I (old)

SY-B14 (new) 51 iuL-ri i ir I

ST P

tnat may ue requireu Lu operate in conditions beyond their environmental qualifications. INCLUDE dependent failures of multiple SSCs that result from operation in these adverse conditions. Examples of degraded environments include: (a) LOCA inside containment with failure of containment heat removal (b) safety relief valve operability (small LOCA, drywell spray, severe accident) (for BWRs) (c) steam line breaks outside containment (d) debris that could plug screens/filters (both internal and external to the plant) (e) heating of the water supply (e.g., BWR suppression pool, PWR containment sump) that could affect pump operability (f) loss of NPSH for pumps (g) steam binding of pumps (h) harsh environments induced by containment venting or failure that may occur prior to the onset of core damaqe I 11* imT1paCL, Uo auvurSb environmental conditions on SSC reliability is considered but not documented.

I IIIm 1I]111ui Iu upell.

Same as response to gap for SR DA-D6.

SY-C2 52 DOCUMENT the system functions and boundary, the associated success criteria, the modeled components and failure modes including human actions, and a description of modeled dependencies including support system and common cause failures, including the inputs, methods, and results. For example, this documentation typically includes: (a) system function and operation under normal and emergency operations (b) system model boundary (c) system schematic illustrating all equipment and components necessary for system operation (d) information and calculations to support equipment operability considerations and assumptions (e) actual operational history indicating any past problems in the system operation (f) system success Enhance system model documentation to comply with all ASME PRA Standard requirements.

Partial This finding is open.

Same as response to gap for SR DA-D6.

53

crILUIid dIIU IUIdLIUIIII.P LU d;LIUUIIL bquLIIL;U models (g) human actions necessary for operation of system (h) reference to system-related test and maintenance procedures (i) system dependencies and shared component interface (j) component spatial information (k) assumptions or simplifications made in development of the system models (I) the components and failure modes included in the model and justification for any exclusion of components and failure modes (m) a description of the modularization process (if used) (n) records of resolution of logicloops developed during fault tree linking (if used) (o) results of the system model evaluations (p) results of sensitivity studies (if used) (q) the sources of the above information (e.g., completed checklist from walkdowns, notes from discussions with plant personnel) (r) basic events in the system fault trees so that they are traceable to modules and to cutsets. (s) the nomenclature used in the system models.

54

1 CS-C1-NA (no F&O)

Document the cable selection and location methodology applied in the Fire PRA in a manner that facilitates Fire PRA applications, upgrades, and peer review.

The Cable Selection document is well organized, but requires more detail in order to facilitate Fire PRA applications, upgrades and peer review.

Therefore, the SR is judged to be not met.

Closed/

Met Enhanced details on Y1 and Y2 cables were added to section 2 of the Cable Selection Report. The report states that Y1 and Y2 cables are comprised of thermoset cables constructed with flame retardant cross-linked polyethylene insulation, an interlocking armor and a PVC exterior jacket.

If the provision of SR CS-Al 1 is used, document the assumed As noted for SR CS-Al 1, assumed cable routing A clearer basis for the Y3 cable routing cable routing and the basis for appears to be reasonable, however more was included in section 2.3 of the Cable 2

CS-C3-01 concluding that the routing is detailed documentation is judged to be needed to Closed/

Selection Calculation. Additionally, reasonable in a manner that facilitate Fire PRA applications, upgrades and Met cable selection has since been facilitates Fire PRA peer review. Therefore, the SR is judged to be expanded to address numerous Y3 applications, upgrades, and not met.

components.

peer review.

Results from Section 6.0 of the The electrical distribution system over current McGuire Appendix R Coordination The lecrica ditriutio sytemovercurentStudy have been included in the FPRA coordination and protection analysis is judged to within the cable footprint for the be reasonable based on review. However, wti h

al otrn o h Document the review of the documentation is not yet complete. Therefore, affected components as discussed in electrical distribution system documentato is not met.

Therefore, Section 2.1.2 of the Cable Selection overcurrentthe SR is judged to be not met. Additionally, the Report. The required power sources 3

oecn nain an electrical distribution system overcurrent Open for the Y2 components have since been CS-C4-O1 protection analysis in a manner coordination and protection analysis does not yet evaluated for breaker coordination that facilitates Fire PRA includebreakercoordintionrevluationaofith application, upgrades, and peer include breaker coordination evaluations of the concerns. While documentation within reviewadditional power supplies evaluated for the fire the FPRA has not been completed, the PRA (power supplies awith Y2 additional cable footprint has an components, including the evaluation of offsite inconsequential impact on the FPRA power availability).

results and the delta risk associated with the vital battery replacement.

55

Characterize ignition source intensity using a realistic time-dependent fire growth profile for significant contributors as appropriate to the ignition source.

4 FSS-C2-01 Expand fire scenarios that predict target fire damage to include HRR associated with cable fires. Alternatively severity factors may be applied to these scenarios such that low HRR fires are screened out and higher HRR are calculated as causing full room burnout.

Closed/

CC-I As discussed in Section 9.2 of the Fire Scenario Report, the horizontal material burnout for cables in tray stacks tends to follow a 35 degree angle as the fire spreads upward above the lowest tray.

Therefore, horizontal propagation (flame spread) is adequately captured within the horizontal zone of influence provided in the Generic Fire Modeling Treatments. The vertical zone of influence was typically extended to the ceiling following initial tray impact so additional HRR contribution is irrelevant to the vertical zone of influence.

Consequently, the HRR contribution of armored cables has no impact on the applied zone of influence. EIR 51-9160514-000 (Performance Characteristics of Duke Armored Cables Under Fire Exposure) suggests that armored cables will not contribute to fire growth and spread and armored cables with an outer PVC jacket do not contribute to fire growth when located in the HGL. Nevertheless, the hot gas layer evaluation includes margin to accommodate additional HRR contribution beyond the peak HRR associated with the piloted ignited source. Consequently, the applied approach has no impact on the vital battery replacement LAR.

Justify that the damage criteria The MNS FPRA uses thermo set damage criteria Closed/

EIR 51-9160514-000 (Performance 5

FSS-C5-01 used in the Fire PRA are for all cable damage criteria. The most common CC-I/I Characteristics of Duke Armored representative of the damage cable type in the plant is armored thermo set C1/1Cables Under Fire Exposure) 56

targets associated with each fire scenario.

cable with a thermoplastic coating. Based on the discussion in NUREG/CR-6850, Section H.1.3 certain configurations of this type of cable exhibit thermoplastic damage criteria due to fire from the thermoplastic coating engulfing the armored cables. This damage occurs because the thermo set cable is exposed to flame temperatures which are well above the maximum thermo set damage temperatures (i.e., > 915 Deg F for > 1 min. Ref.

NUREG/CR-6850 Table H-5). Discussion of this issue in calculation MCC-1535.00-00-0104 (Draft), Section 6.1 indicates that pooling of the thermoplastic material is not expected in any configuration however disposition of the potential for thermoplastic ignition and subsequent damage to thermoplastic insulated circuits should be addressed to fully justify this position.

concluded that armored cable types similar to those used at Duke nuclear power stations exhibit flame spread and fire propagation characteristics consistent with cable types considered non-propagating/IEEE 383 equivalent.

As discussed in Section 6.1 of the Fire Scenario Report, the cables predominately used at McGuire are constructed with flame retardant cross-linked polyethylene (XLPE) insulation protected by galvanized steel armor with an exterior flame-retardant PVC jacket. The recommended treatment for this configuration is provided in Section H.1.3 of NUREG/CR-6850.

MNS does not have a significant concentration of non-armored cables. It is acknowledged that a small percentage of installed cables confined to some video, communication, and data applications are not armored; however, the low concentration of non-qualified cables, which are not associated with credited circuits, is insufficient to impact the results.

57

6 FSS-C5-02 Justify that the damage criteria used in the Fire PRA are representative of the damage targets associated with each fire scenario.

The MNS FPRA uses thermo set damage criteria for all cable damage criteria. The most common cable type in the plant is armored thermo set cable with a thermoplastic coating. In addition to these cables, thermoplastic cables are included in some raceways and locations (Reference cables routed through Control Room floor).

Raceways that include both thermoplastic and thermo set cables should have a thermoplastic damage criteria applied because failure and ignition of the thermoplastic cable will lead to rapid failure of the adjacent thermo set cables (Ref. NUREG/CR-6850, Section H.1.3).

This finding could affect the generic Zone-of-Influence used to perform screening of ignition sources. If thermoplastic damage criteria are required the ZOI must be expanded to encompass this damage. The absence of thermoplastic cables in cable raceways that credit thermo set damage criteria should be verified to justify use of those criteria.

Closed/

CC-I/I1 Non-armored (but not necessarily thermoplastic) cables at MNS are primarily related to security and communication (phone, LAN, or fiber optic cables). The low concentration of non-qualified cables, which are not associated with credited circuits, is considered insufficient to impact the results.

58

For any physical analysis unit that represents a significant contributor to fire risk, select and apply fire modeling tools such that the scenario analysis provides reasonable assurance that the fire risk contribution of each unscreened physical analysis unit can be either bounded or realistically characterized.

The zone of influence identified in the battery room includes some potentially non-conservative credit for the panel above the vital inverters (1 EVID and 2EVID) as a radiant energy shield.

Consideration of damage to adjacent panels (1EVID and 2EVID again) may be overly conservative given the location of the vents for these panels (at the top of the panels).

Additional basis for credit for the heat shield and other deviations from the Generic Treatments specified in the Scenario Report, in the battery room and other areas, needs to be provided.

The basis for not overlapping damage to abutting electrical cabinets (i.e., switchgear cubicles) to ensure all potential damage scenarios are enveloped requires further justification (e.g. FA 15-17, scenarios B4 & B6).

7 FSS-D3-01 Closed/

CC-II The covers above the inverters and battery chargers are no longer credited as radiant energy shields preventing target damage in the MNS FPRA.

It is common to create a single fire scenario to address both Unit 1 & 2 ignition sources simultaneously. During quantification of the Unit I FPRA, the Unit 2 failure(s) do not significantly contribute to the fire risk. During quantification of the Unit 2 FPRA, the Unit 1 failure(s) do not significantly contribute. This approach does not result in over-estimating damage.

No scenarios have been identified where the approach deviated from the Generic Fire Modeling Treatments.

59

8 HRA-Al-01 For each fire scenario, for each safe shutdown action carried over from the Internal Events PRA, determine whether or not each action remains relevant and valid in the context of the Fire PRA consistent with the scope of selected equipment per the ES element and plant response model per the PRM element of this Standard, and in accordance with HLR-HR_E and its SRs in Part 2 with the following clarifications:

(a)Where SR HR-El mentions "in the context of the accident scenarios," specific attention is to be given to the fact these are fire scenarios, and (b) Develop a defined basis to support the claim of non-applicability of any of the requirements under HLR-HR-E in Part 2.

At least one human action was found that the timing from the internal events model would not be applicable for all fire scenarios in an identified enclosure. No adjustment for this timing change was made in the HEP. Additionally, the lack of internal events pre-initiators and the use of median vs. mean values from the internal events PRA will requires some level of reanalysis and re-quantification of the fire CDF once incorporated. See F&Os PRM-B2-01 and PRM-Bl-01.

Closed/

Met The FPRA Model Report has been updated to document the review of the quantification of basic event RNCBLKVDHE which revealed that the HEP is not sensitive to the time available even with 3 PORVs open based on MAAP runs. Consequently, no adjustment to the HEP for this action is required for the possibility of multiple spurious PORV operation.

60

9 HRA-A2-01 For each fire scenario, identify any new fire-specific safe shutdown actions called out in the plant fire response procedures in a manner consistent with the scope of selected equipment from the ES and PRM elements of the RA-S-2009 standard and in accordance with HLR-HR-E and its SRs in Part 2.

The listing of the failures in the Summary document and the Appendix B listing of Operator actions did not match either each other or the CAFTA model or recovery file.

Consolidate and verify multiple listings. Develop and document consistent fire HRA in Summary document, Operator Action Appendices, CAFTA model, and Recovery Files.

Closed/

Met Inconsistencies among the HFE evaluation document, Appendix B of the Component Selection calculation and the CAFTA model were reconciled.

10 HRA-A2-02 For each fire scenario, identify any new fire-specific safe shutdown actions called out in the plant fire response procedures in a manner consistent with the scope of selected equipment from the ES and PRM elements of the RA-S-2009 standard and in accordance with HLR-HR-E and its SRs in Part 2.

New operator action developed in support of the fire PRA, FCACAST2DHE, instructs operators to close valves, (1CA7AC and 1CA9B), from the MCR. In the fire response procedure AP-45 for Enclosures 5 (Step 4), Enclosure 7 (Step 3) et.

al., these valves are opened and the breakers opened to prevent the valve changing state. This prior procedural action and the impact on the subsequent HEP does not appear to have been incorporated.

Update FCACAST2DHE to address plant equipment state at time action will need to be taken.

Closed/

Met Renamed to FCACA02DHE and revised HRA to address as an X-CR action.

61

11 HRA-Cl-01 For each selected fire scenario, quantify the HEPs for all HFEs, accident sequences that survive initial quantification and account for relevant fire-related effects using conservative estimates, in accordance with the SRs for HLR-HR-G in Part 2 set forth under CC-I.

Methodology used for development of dependent human action failure probabilities is not standard and is not referenced. Standard methodology for determining failure rate for dependent human errors is described in detail in NUREG/CR-1278 Chapter 7.

Screening values used for multiple individual HFEs following quantification.

The SR is judged to be met at CC I.

Closed/

CC-I Joint dependencies have been recalculated using methodology consistent with NUREG/CR-1278; therefore, the F&O has been satisfactorily addressed. Important operator actions are reviewed to ensure the use of the HEP multipliers (fire adjustments) for individual HFEs do not introduce over-conservatism.

Accordingly, CC-I for this SR has no impact on the vital battery replacement LAR.

.1

.1 4

Document the Fire PRA HRA including (a) those fire-related influences that affect the methods, processes, or assumptions used as well as the identification and quantification of the HFEs/HEPs in accordance with HLR-HR-I and its SRs in Part 2, and develop a defined basis to support the claim of non-applicability of any of the requirements under HLR-HR-I in Part 2, and (b) any defined bases to support the claim of non-applicability of any of the referenced requirements in Part 2 beyond that already covered by the clarifications in the Part.

12 HRA-E1-01 There is no traceable path from the documented definition of screening criteria to the documented HEP values for use in the FPRA. The SR is judged to be not met.

Closed/

Met The criteria used to adjust HEPs in Appendix B of the FPRA Model Report outlined in section 5.3 has been updated to eliminate inconsistencies.

The report provides details on increasing the HEP value by a specified factor depending on action time and complexity of the action for operator actions inside and outside the control room.

13 MU-B3-01 Changes to a PRA due to PRA Update the reference in XSAA-106 to point to Closed/

The reference has been updated by maintenance and PRA upgrade ASME/ANS RA-Sa-2009.

Met Duke Energy.

62

shall meet the requirements of the Technical Requirements Section of each respective Part of this Standard.

14 1 PP-B2-01 If partitioning credits wall, ceiling, or floor elements that lack a fire resistance rating, justify the judgment that the credited element will substantially contain the damaging effects of fires given the nature of the fire sources present in each compartment separated by the nonrated partitioning element.

Section 7.1 of plant partitioning and ignition frequency calculation states "The fire compartments were mapped directly to fire areas; therefore no crediting of partitioning features that do meet the formal NUREG/CR-6850 criteria for compartments was applied.

Consequently, MNS 'compartments' are enclosed rooms with rated fire barriers." Drawing MC-1384-07.17-00 Note (1) states that six HVAC penetrations through the reactor building wall do not contain fire dampers - there is no mention of this in the partitioning documentation or why this is acceptable. Fire areas 25 to 32 and/or 33.

Additional examples in F&O description. The SR is not met.

Closed/

CC-Il/Ill Since fire compartments correspond to fire area boundaries, the FPRA did not disposition the fire protection drawing notes. The fire scenario walkdowns would evaluate non-credited barriers that are relied on to truncate the zone of influence and identify targets in exposed compartments from an adjacent exposing compartment. For example, the six non-rated HVAC penetrations through the reactor building wall (per drawing MC-1384-07.17-00) have no impact on the FPRA.

Similarly the open communication between FA 4 and FA 14 and between FA 14 and FA 21 via the open stairwells has no impact on the FPRA. There are no in-situ combustibles or fixed ignition sources which would contribute to fire propagating across the boundary.

Since fire compartments correspond to No description of walkdown for plant partitioning fire area boundaries, the burden for Conduct a confirmatory was given in the documentation. Nothing noted maintaining the condition of the walkdown of locations within the that a walkdown related to plant partitioning global analysis boundary to occurred. Discussion with plant analyst Closed/

portioning elements is programmatically 15 PP-37-01 confirm the conditions and determined that additional walkdown information Met addressed. Fire boundary conditions and characteristics were documented in characteristics of credited related to plant partitioning was not confirmed or therMuti-tme Analysis partitioning elements.

documented since the plant partitioning is based (pendixDofathe S nario upon room barriers. Therefore, the SR is not met.

under the fire Zone Configuration 63

Notes column. Additionally, walkdown results will be appended to a future revision of the Fire Scenario Report, but this update is judged not to be required to meet the SR.

Fire Area boundaries are described in Document the general nature Description of the general nature and key or the Fire Protection Design Basis and key or unique features of unique features of the partitioning elements is Specification (MCS-1465.00-00-0008).

the partitioning elements that limited to a single statement that plant fire No non-conforming conditions were define each physical analysis areas/rooms are used as the plant partitions.

Closed/

noted during the FPRA walkdowns.

16 PP-C3-01 analyit This is not sufficient documentation of these Met Additionally, walkdown results will be in a manner that facilitatesioi elements as fire barriers as noted in F&O PP-B2-appended to a future revision of the PRA applications, upgrades,

01. Basis for Significance: Documentation does Fire Scenario Report, but this update is and peer review, not meet the requirement to describe elements of judged not to be required to meet the the partitioning.

SR.

Appendix E of the McGuire and Catawba PRA While calibration errors may be fully or Technical Adequacy for NFPA-805 report partially included in the random failure provides exceptions and deficiencies for the event probabilities and not modeled as Internal Events PRA. Of the 55 open SRs, 14 are specific calibration events, pre-initiator Verify the peer review of a technical nature. All dispositions were HEPs are included in the PRA/FPRA exceptions and deficiencies for documented to not adversely affect the model. The deficiency identified as the Internal Events PRA are development of the Fire PRA plant response Partially having a potentially significant impact 17 PRM-B2-01 dispositioned, and the model. However, the findings are judged to not Closed/

on the FPRA has been addressed disposition does not adversely be conclusive. In particular, basic event data is Met (refer to PRM-B1I1-01). The potential affect the development of the out-of-date (pre-NUREG/CR-6928), which impact on the vital battery replacement Fire PRA plant response model. doesn't account for running/standby components.

from internal events open items is Additionally, no pre-initiator HEPs have been addressed in Table I of the LAR.

modeled. Certain pre-initiator HEPs have the potential to impact the PRA results with some The FPRA risk increases associated significance. For example, miscalibration of with the proposed battery alignments 64

RWST and containment sump level indicators could potentially be significant for an ice condenser plant. Therefore, the SR is judged to be not met.

are very small with considerable margin to the acceptance criteria specified in RG-1.174. The items identified in this finding are small perturbations to the analysis results. This is especially true since the risk is dominated by station blackout sequences for which these concerns are not applicable. The conclusions regarding satisfying the acceptance criteria are not changed by this finding.

Median HEP values are utilized for the internal events related HFEs. Mean values are required.

Model all operator actions and Basis for Significance: Potentially significant Duke has updated the HEP values as Modeloperator i

ncstions impactClosed/

necessary to address the use of mean 18 PRM-B11-01 operator influences in impate.

values. The updated HEP values have accrdnce w thes HtaarA.

Possible Resolution: Revise the HRA to model been incorporated into the FPRA element of this Standard.

mean HEPs, rather than median HEPs.

quantification.

Consider documenting the internal events HRA in the HRA Calculator to be consistent with HEP development for the fire PRA.

65

19 SF-A2-01 For those physical analysis units within the Fire PRA global plant analysis boundary, (a)

Review installed fire detection and suppression systems and provide a qualitative assessment of the potential for either failure (e.g., rupture or unavailability) or spurious operation during an earthquake, and (b) Assess the potential impact of system rupture or spurious operation on post-earthquake plant response including the potential for flooding relative to water-based fire suppression system, loss of habitability for gaseous suppression systems, and the potential for diversion of suppressants from areas where they might be needed for those fire suppression systems associated with a common suppressant supply.

Addressed by walkdown review with the exception of loss of habitability and suppression system diversion. The SR is judged to be not met.

Closed/

Met No impact on quantification (seismic-fire interaction is purely qualitative per NUREG/CR-6850. The FPRA Summary Report has been updated to address habitability impacts beyond what was captured in the IPEEE documentation.

The Halon cylinders are located in the Turbine Building basement. In the unlikely event of an earthquake causing a cylinder to rupture, the Halon would be dissipated over the very large volume of the Turbine Building and the resulting concentration levels would not be expected to significantly impact habitability.

66

20 SF-A3-01 Assess the potential for common-cause failure of multiple fire suppression systems due to the seismically induced failure of supporting systems such as fire pumps, fire water storage tanks, yard mains, gaseous suppression storage tanks, or building standpipes.

This item is not directly addressed in the FPRA MCS-1465 00-00-0008, Rev. 9 (FP DBD) indicates (Section C. 18.4) that fire pumps are located in a non-seismic Cat III intake. Not clear if this indicates a potential common mode failure.

A reference to procedures for recovering from a loss of fire water system pumps was provided (OPIOIB16400/002 D) and appears to address the specific concern identified above. An evaluation of other potential common cause losses of fire system equipment appears to be necessary to meet this requirement. This SR is judged to be not met.

Closed/

Met No impact on quantification (seismic-fire interaction is purely qualitative per NUREG/CR-6850. The Fire Protection Specification notes that the fire pumps are located in a non-seismic structure.

In the event that the fire pumps are disabled, TSC Volume 2, Enclosures 46

& 47 provide for the deployment of a portable (Hale) pump or use of the CACST to pressurize the RY header if necessary for fire suppression (stated in the Summary Report, section 3.13).

4

+/-

21 SF-A4-01 Review plant seismic response procedures and Qualitatively assess the potential that seismically induced fire, or the spurious operation of fire suppression systems, might compromise post-earthquake plant response.

Need Procedures required by the SR. Therefore, this SR is judged to be not met.

Closed/

Met No impact on quantification (seismic-fire interaction is purely qualitative per NUREG/CR-6850). It is noted that Earthquake Procedure RP/O/A/5700/007 does not reference fire response procedure AP-45 or TSC Volume 2, Enclosure 46 & 47; however, in the event of a seismic induced fire it is expected that multiple procedures will be used in parallel as necessary. The entry conditions for the fire response procedure (via fire alarm annunciator or report of a fire) apply at all times and under any plant operating conditions.

67

22 SF-A5-01 Review (a) plant fire brigade training procedures and assess the extent to which training has prepared firefighting personnel to respond to potential fire alarms and fires in the wake of an earthquake and (b) the storage and placement of firefighting support equipment and fire brigade access routes, and (c) assess the potential that an earthquake might compromise one or more of these features.

Need Procedures required by the SR. Therefore, this SR is judged to be not met.

Closed/

Met No impact on quantification of FPRA or Change Evaluations (seismic-fire interaction is purely qualitative per NUREG/CR-6850). See qualitative discussion of seismic fires in the McGuire Fire PRA Summary Report.

4 4

4 23 FSS-H2-NA (no F&O)

DOCUMENT a basis for target damage mechanisms and thresholds used in the analysis, including references for any plant-specific or target-specific performance criteria applied in the analysis.

The Hughes report "Generic Fire Modeling Treatments", prepared for ERIN, Project Number 1SPH02902.030, is the basis for thresholds used to identify the fire targets. While the application is plant-specific, the report itself is generic.

Therefore, this SR is judged to be met at Capability Category I.

CC-I The Generic Fire Modeling Treatments were developed for use as a bounding analysis for scoping fire modeling, therefore CC-I was assigned. Further refinement of the targets will not impact the conclusions of this analysis. The status of this SR is deemed acceptable for this application of the fire PRA.

68

24 PP-B3-NA (no F&O)

If spatial separation is credited as a partitioning feature, JUSTIFY the judgment that spatial separation is sufficient to substantially contain the damaging effects of any fire that might be postulated in each of the fire compartments created as a result of crediting this feature.

Section 7.1 of plant partitioning and ignition frequency calculation states "The fire compartments were mapped directly to fire areas; therefore no crediting of partitioning features that do meet the formal NUREG/CR-6850 criteria for compartments was applied.

Consequently, MNS 'compartments' are enclosed rooms with rated fire barriers". There is no crediting of spatial separation as a fire barrier.

The SR is judged to be met at CC I.

The capability category is acceptable for this application because spatial separation was not credited for separation in the MNS Fire PRA.

CC-I T

f

+

4 25 PP-B5-NA (no F&O)

DEFINE AND JUSTIFY the basis and criteria applied when active fire barrier elements (such as normally open fire doors, water curtains, and fire dampers) are credited in partitioning.

Section 7.1 of plant partitioning and ignition frequency calculation states "The fire compartments were mapped directly to fire areas; therefore no crediting of partitioning features that do meet the formal NUREG/CR-6850 criteria for compartments was applied.

Consequently, MNS 'compartments' are enclosed rooms with rated fire barriers". No active fire barrier elements are credited as fire barriers.

The SR is judged to be met at CC I.

CC-I The capability category is acceptable for this application because active fire barriers were not credited for separation in the MNS Fire PRA.

69

FSS-C1-01 26 For each selected fire scenario, ASSIGN characteristics 'to the ignition source using a two point fire intensity model that encompass low likelihood, but potentially risk contributing, fire events in the context of both fire intensity and duration given the nature of the fire ignition sources present Fire modeling was conducted via generic fire modeling from which Zones-of-Influence (ZOI) for specific initiator types was generated. The ZOIs were used to define bounding fire characteristics for each fire scenario. Fire scenarios were not considered to spread beyond the initial ZOI due to the typical construction of cable in the plant (i.e., armored thermo set cable with a thermoplastic coating). An F&O was generated concerning the lack of fire spread beyond the ZOI for fire scenarios where damage is identified.

Because bounding fire initiator characteristics are assigned for each scenario this SR is met at CC I.

CC-I See responses for FSS-C2-01 and FSS-C5-01 for discussion of fire spread. The capability category is acceptable for this application because, as recognized by the Peer Review team, bounding fire initiator characteristics are assigned to the fire scenarios.

If a severity factor is credited in the analysis, ENSURE that (a) the severity factor remains 27 FSS-C4-NA (no F&O) independent of other quantification factors (b) the severity factor reflects the fire event set used to estimate fire frequency (c) the severity factor reflects the conditions and assumptions of the specific fire scenarios under analysis, and (d) a technical basis supporting the severity factor's determination is provided.

Calculation MCC-1535.00-00-0104 (Draft),

identifies severity factors for a number of fire initiators in the analysis. These severity factors are based on the results of generic fire modeling; accordingly they provide bounding for the conditions and assumptions of specific scenarios.

Based on this restriction this SR is met at CC I.

CC-I The capability category is acceptable for this application because, as recognized by the Peer Review team, the conditions and assumptions for the scenarios are bounding.

70

28 FSS-D7-NA (no F&O)

In crediting fire detection and suppression systems, USE generic estimates of total system unavailability provided that (a) the credited system is installed and maintained in accordance with applicable codes and standards (b) the credited system is in a fully operable state during plant operation, and (c) the system has not experienced outlier behavior relative to system unavailability.

MNS FPRA uses NUREG/CR-6850 detection system reliability. This SR is judged to be met at CC I.

CC-I Fire system availability/unavailability is not specifically addressed. However, as indicated limited credit for suppression was taken in the analysis.

Availability / unavailability is not applicable to the credit for prompt suppression for the hotwork fire scenarios. Credit for manual or automatic suppression was taken in the multi-compartment analysis (MCA);

however, the MCA is a screening analysis and is largely unaffected by the additional precision associated with suppression system unavailability. CC I is acceptable for the application.

29 FSS-E3-NA (no F&O)

PROVIDE a mean value of, and statistical representation of, the uncertainty intervals for the parameters used for modeling the significant fire scenarios.

Generic fire modeling treatments address uncertainties associated the analysis. The SR is judged to be met at CC I.

CC-I No action required. CC I is acceptable for the application. It is understood that methods for developing the statistical representation of the uncertainty intervals and mean values currently do not exist.

71

If, per SR FSS-F1, one or more scenarios are selected, COMPLETE a quantitative assessment of the risk of the selected fire scenarios, including collapse of the exposed structural steel.

30 FSS-F3-NA (no F&O)

No quantitative evaluation performed (Fire Scenario Report Section 3.2). The SR is judged to be met at CC I.

CC-I No scenarios were selected for SR FSS-F1, therefore, CCII/Ill does not apply. The status of this SR is deemed acceptable for this application of the fire PRA

.1 72