Text

Supplement to Application for Technical Specification Change Regarding Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee Controlled Program
	ML15272A443
Person / Time
Site:	Harris
Issue date:	09/29/2015
From:	Waldrep B; Duke Energy Progress
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	HNP-15-083, TAC MF6583
	Download: ML15272A443 (94)
	v • d • e

Benjamin C. Waldrep Vice President Harris Nuclear Plant 5413 Shearon Harris Road New Hill NC 27562-9300 919.362.2000 10 CFR 50.90 September 29, 2015 Serial: HNP-15-083 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 Shearon Harris Nuclear Power Plant (HNP), Unit 1 Docket No. 50-400/Renewed License No. NPF-63

Subject:

SUPPLEMENT TO HARRIS NUCLEAR PLANT APPLICATION FOR TECHNICAL SPECIFICATION CHANGE REGARDING RISK-INFORMED JUSTIFICATION FOR THE RELOCATION OF SPECIFIC SURVEILLANCE FREQUENCY REQUIREMENTS TO A LICENSEE CONTROLLED PROGRAM

References:

1. Duke Energy letter, Harris Nuclear Plant, Unit No. 1, Application for Technical Specification Change Regarding Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee Controlled Program, dated August 18, 2015 (ML15236A254).

2. Nuclear Regulatory Commission letter, Shearon Harris Nuclear Power Plant, Unit 1 -

Supplemental Information Needed For Acceptance of Requested Licensing Action for Technical Specification Change Regarding Risk-Informed Justification For the Relocation of Specific Surveillance Frequency Requirements to a Licensee Controlled Program (TAC No. MF6583), dated September 18, 2015 (ML15259A435)

Ladies and Gentlemen:

In accordance with the provisions of Title 10 of the Code of Federal Regulations (10 CFR Part 50.90), Application for Amendment of License, Construction Permit, or Early Site Permit, Duke Energy Progress, Inc. (Duke Energy) submitted a request for an amendment to the Technical Specifications (TS) for Shearon Harris Nuclear Power Plant, Unit 1 (HNP) (Reference 1).

Reference 2 specified that the NRC staff has reviewed this application and concluded that the information delineated in the enclosure to Reference 2 is necessary to enable the staff to make an independent assessment regarding the acceptability of the proposed amendment in terms of regulatory requirements and the protection of public health and safety and the environment. In response to the request for supplemental information provided in Reference 2, HNP is submitting the enclosed additional information to support acceptance review of Reference 1.

This information is provided in Enclosure 1.

This document contains no new Regulatory Commitments.

Please refer any questions regarding this submittal to John Caves at (919) 362-2406.

XVQXFOHDUUHJXODWRU\\Commission KQS

SDJH

Ldeclare under SHQDOW\\of perjury that the foregoing is true and correct. Executed on September 29,

VLQFHUHO\\

Benjamin FZDOGUHS Vice SUHVLGHQWShearon Harris Nuclear SRZHUSODQW HQFORVXUH

1. VXSSOHPHQWDOLQIRUPDWLRQNeeded for Acceptance of Requested Licensing Action cc:

Mr. J. D. Austin, NRC VUResident LQVSHFWRUKQS Mr. W. L. Cox, LLLSection Chief, N.C.

Ms. M. EDULOODVNRC SURMHFWManager, KQS Mr. V. M. Mccree, NRC UHJLRQDOAdministrator, Region LL

U.S. Nuclear Regulatory Commission HNP-15-083 Page 3 bc:

Duncan Brewer John Caves David Cummings Jim Eayres Donald Griffith Tanya Hamilton Brian McCabe Sean OConnor Ryan Treadway Ben Waldrep HNP NSRB Paula Hamilton Nuclear Records

HNP-15-083 SHEARON HARRIS NUCLEAR POWER PLANT, UNIT NO. 1 DOCKET NO. 50-400 / RENEWED LICENSE NO. NPF-63 SUPPLEMENT TO HARRIS NUCLEAR PLANT APPLICATION FOR TECHNICAL SPECIFICATION CHANGE REGARDING RISK-INFORMED JUSTIFICATION FOR THE RELOCATION OF SPECIFIC SURVEILLANCE FREQUENCY REQUIREMENTS TO A LICENSEE CONTROLLED PROGRAM Supplemental Information Needed for Acceptance of Requested Licensing Action (91 pages)

U.S. Nuclear Regulatory Commission Page 2 of 91 HNP-15-083, Enclosure 1 Shearon Harris Nuclear Power Plant, Unit No. 1 Docket No. 50-400 / Renewed License No. NPF-63 Supplement to Harris Nuclear Plant Application for Technical Specification Change Regarding Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee-Controlled Program Supplemental Information Needed for Acceptance of Requested Licensing Action

1.0 INTRODUCTION

By letter dated September 18, 2015 (Agencywide Documents Access and Management System Accession No. ML15259A435), the U.S. Nuclear Regulatory Commission (NRC) requested that Duke Energy Progress, Inc. (Duke Energy) supplement the Harris Nuclear Plant (HNP) application for relocation of specific surveillance frequency requirements to a licensee-controlled program. Two insufficiencies related to the technical adequacy of the internal events probabilistic risk assessment (PRA) were identified, and supplemental information was requested to enable the NRC staff to begin its detailed review. Duke Energy's response is provided herein with the requested information on the PRA technical adequacy.

2.0 INSUFFICIENCIES The license amendment request (LAR) states that the HNP, Unit 1, internal events probabilistic risk assessment (PRA), "meets the requirements of the American Society of Mechanical Engineers/American Nuclear Society standard as endorsed by Regulatory Guide (RG) 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," at an appropriate capability category to support the HNP Surveillance Frequency Control Program [SFCP]." Based on the list of peer reviews included in Section 4.1 of Enclosure 2 to the LAR, the most recent peer review of the internal events, not including internal flooding, PRA was performed in 2007 against RG 1.200, Revision 1.

a. Provide the facts and observations (F&Os) from the peer reviews and gap assessments of the internal events PRA which are open, not met, or met a capability category I, and explanation of how the F&Os were dispositioned for this application.

b. Provide an overview of the changes in the internal events PRA that occurred after the 2007 peer review, and clarify whether any of these changes qualify as a PRA upgrade that would require a focused scope peer review.

3.0 DUKE ENERGY RESPONSE Duke Energy's responses to the NRC's request for supplemental information are provided in the following paragraphs. Paragraphs 3.a and 3.b refer to the insufficiencies identified in paragraphs 2.a and 2.b, respectively, as identified above.

a. The F&Os that were considered resolved but open following the 2007 peer review for Internal Events (i.e., the review of record) are provided in Table 1 of this Enclosure. There

U.S. Nuclear Regulatory Commission Page 3 of 91 HNP-15-083, Enclosure 1 are no F&Os that were not met or were met at capability category I. The resolutions for all twelve (12) of the F&Os in Table 1 were provided to and reviewed by the peer review teams for the HNP Fire PRA and the HNP Internal Flooding PRA described in the HNP application for relocation of specific surveillance frequency requirements to a licensee-controlled program. The impact of the disposition of each F&O for the HNP SFCP application is also provided in Table 1.

A summary of the assessment of the HNP Internal Events PRA against each of the eight (8) technical elements (i.e., high level requirements) of ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2, is provided in Tables 2 through 9, respectively, of this Enclosure.

Finally, the historical, closed internal events F&Os from peer reviews that were conducted prior to the 2007 peer review of record are provided in Table 10 of this Enclosure.

b. There have been four (4), formal model of record (MOR) revisions since 2007, and each upgrade was peer reviewed:

2007 Internal Events Update. The 2007 revision to the internal events model of record (MOR) incorporated findings and observations (F&O) resolutions for the April 2006 HNP PRA Self-Assessment in order to meet ASME/ANS Internal Events Standard (Revision 1) for Category II compliance. A peer review was performed to support the NFPA 805 license submittal. Major revisions included expansion of plant-specific data, Human Reliability Analysis (HRA) updates, and addition of new or more detailed heating, ventilation and air conditioning (HVAC) models for CSIP rooms, Switchgear rooms, and Emergency Service Water (ESW) pump rooms. The model revision also included addition of logic to address fire induced multiple spurious failures, developed in conjunction with HNP adoption of the NFPA 805 program for fire induced vulnerabilities. Other general updates to the model included an update to the initiating event frequencies, revision of the station blackout (SBO) induced seal LOCA, and Loss of offsite power (LOOP) recovery. Motor Control center modeling was improved to support the NFPA 805 LAR with the required level of detail. These updates were peer reviewed in the 2007 Industry Peer Review, and the resolved but open resolutions are provided in Table 1.

2010 Internal Events Update. The 2010 revision was to incorporate model changes and the final, as-built alternate seal injection (ASI) system. The major change for the 2010 update was the addition of the Alternate Seal Injection - Dedicated Shutdown Diesel Generator (ASI-DSDG) to the MOR. The installation of the ASI-DSDG modification provided a diverse and redundant power source for alternate seal injection and also to the emergency DC battery chargers, as described in HNP's NFPA 805 LAR. This reduced the effect of the 4-hour coping duration of the batteries by providing a means to supply DC power to the DC busses during SBO. The LOOP initiator was separated into plant, grid, switchyard and weather induced LOOPs, which allowed the model to apply recovery actions to the higher frequency events (plant and switchyard). Other changes related to de-energizing charging pump discharge header cross-connect valves, adding temporary air compressors, and updates from fire model were added to the 2010 model. This was not an upgrade and a peer review was not required for these revisions.

2013 Fire Update. The 2013 revision implemented resolutions for the previously identified conservatisms in the fire model. The main changes involved updating human failure events, dependency analysis, and recovery rule files. Other updates included additional walkdowns to identify fixed and transient ignition sources, crediting of implemented plant modifications,

U.S. Nuclear Regulatory Commission Page 4 of 91 HNP-15-083, Enclosure 1 and updates to fire frequency bin numbers to match the newest version of NUREG/CR-6850. This was not an upgrade and a peer review was not required for these revisions.

2014 Internal Flooding Only Upgrade. The 2014 revision was focused on the internal flooding portion of the HNP PRA model. A comprehensive flooding analysis was performed in order to meet the supporting requirements of the IFPRA portion of the PRA standard. The most noteworthy changes to the flooding model included the addition of spray effects and high energy line breaks (HELB) and their associated impacts on PRA equipment not previously included. The analysis resulted in the identification and quantification of flood-induced scenarios that were incorporated into the model. The IFPRA was peer reviewed in 2014 in accordance with ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2.

Since 2007, the HNP PRA model has also been used to support PRA applications, and to assist in decision making with regard to the design, licensing, operation, and maintenance of the plant. Engineering changes, including equipment modifications, procedure changes, and plant performance (data), have been assessed and incorporated (per Duke Energy procedure) into the HNP model, as appropriate, in order to reflect the as-built and as-operated plant. These PRA maintenance activities do not qualify as PRA upgrades that would require an additional focused peer review. There have been no methodology changes or significant changes in scope or capability (other than the Fire and Internal Flood models described previously in this section) that impact the significant accident progression sequences. Therefore, no additional focused peer reviews of the Internal Events PRA have been required.

U.S. Nuclear Regulatory Commission Page 5 of 91 HNP-15-083, Enclosure 1 Table 1. Resolved but Open F&Os from 2007 Industry Peer Review of the HNP Internal Events PRA.

F&O #

Finding Resolution 5b Impact DA-C1-01 A value of 0.33 was used for number of failures when there were no failures in preparing generic failure data (page 7 of Appendix B-component database development). The 0.33 value was not based on well known, generally accepted statistical approaches. Use of Jefferys non-informative prior, for this case it is equivalent to assuming 0.5 failures when there are no failures, is a more rigorous way.

The use of a Jeffreys non-informative prior is the generally accepted approach for addressing a lack of specific prior data when performing a Bayesian update. The referenced development of a generic database utilized in the HNP PSA is not based on a Bayesian approach and is not related to the plant-specific update process where the generic data is updated based on plant-specific experience. The generic database is taken from contractor report (Reference 1) and is an aggregation of available data sources that include both industry raw data and generic estimations to define a best-estimate generic estimate that reflects both actual industry experience and a broad range of opinions related to failure rates. The aggregation approach is a standard statistical analysis and the two sources are first aggregated separately and then combined. Since no adjustment to the generic estimations is made during the process, all failure rates based solely on generic estimates can be excluded from this discussion and no issue exists for resolution.

Of the 140 generic failure rates provided in the referenced report, only 59 have historical plant data and the remaining 81 failure rates do not utilize the estimate factor. These 81 are correct without any consideration of the selection of the 0.33 failure approach. Of the remaining 59, only 34 actually applied the 0.33 factor so that an additional 25 failure rates are unaffected.

The remaining 34 did use the 0.33 failure approach for at least one of the plant data records. The appropriateness of this approach for these failure rates is discussed below.

The use of the 0.33 value was previously judged to not be dispositioned adequately (ML101750604). In 2015, therefore, the 0.33 values were all changed to 0.5 as part of a plant-specific data update that was performed and incorporated into the HNP PRA working model for PRA applications.

The 2015 updated data will be used for analyses to be performed under the SFCP when implemented. There is no additional impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 6 of 91 HNP-15-083, Enclosure 1 Table 1. Resolved but Open F&Os from 2007 Industry Peer Review of the HNP Internal Events PRA.

F&O #

Finding Resolution 5b Impact For the failure events that utilize some measure of historical plant data, the plant data from available sources was used to generate a log-normally-distributed failure rate distribution based on a statistical assessment using each plant data source as an individual data point (also called a plant-to-plant variability). This distribution represents an industry generic value based on actual collected plant data.

This statistical assessment is based on collected data points and is not in any way related to the Jeffreys uninformed prior assumption so the comment is not appropriate when dealing with a lack of failures. In contrast, a failure rate must be estimated by using an upper bound approach. The development of a failure rate for a case with zero failures is documented in Reference 2 and utilizes a Chi-squared distribution assuming two degrees of freedom.

This is typically considered a 95 percentile value and is considered to be very conservative when estimating the mean failure rate.

An alternative approach is to assume that for all plant data sources with no data that 0.33 failures have occurred.

Reference 3 indicates that this is a more realistic estimate for the expected value than the Chi-squared approach. This approach was used for cases when there were no failures indicated by the plant data.

It is important to remember that in this context plant data refers to a historical experience at another plant and is not HNP-specific plant data and it is not representative of a desire to develop a Bayesian updated value for HNP but

U.S. Nuclear Regulatory Commission Page 7 of 91 HNP-15-083, Enclosure 1 Table 1. Resolved but Open F&Os from 2007 Industry Peer Review of the HNP Internal Events PRA.

F&O #

Finding Resolution 5b Impact rather to generate an industry failure rate distribution using plant-to-plant variability.

Using the plant data from the various sources the distribution is developed and a mean value is found. It is then combined arithmetically with the other generic sources to arrive at an aggregate value. Therefore, the use of the 0.33 factor has only a small impact on the distribution of the plant data mean value which is then combined with the generic failure rate mean values to define a new generic failure rate.

The use of 0.33 is not associated with a Bayesian updating activity but a statistical assessment of data. The use of the value is based on a documented approach for estimating a failure rate and it is applied appropriately for the analysis being performed. It is only applied for some of the failure rate data and is always combined with other generic estimates to form an aggregated mean value such that the actual selection of the value (0.33 or 0.5) has very little if any impact on the outcome. Therefore, the current approach is valid and no changes are required.

The discussion in Appendix B was changed to eliminate confusion introduced through the one third failure discussion.

References

1. Young, R., Documentation of the RSC Generic Database for PSA Studies, Rev. 1, Ricky Summitt Consulting, Inc.,

RSC 97-90, April 1999.

2. Handbook of Parameter Estimation for Probabilistic Risk

U.S. Nuclear Regulatory Commission Page 8 of 91 HNP-15-083, Enclosure 1 Table 1. Resolved but Open F&Os from 2007 Industry Peer Review of the HNP Internal Events PRA.

F&O #

Finding Resolution 5b Impact Assessment, U.S. Nuclear Regulatory Commission, NUREG/CR-6823, September 2003

3. Welker, E. and M. Lipow, Estimating the Exponential Failure Rate from Data with No Failure Events, TRW Systems Group, January 1974.

DA-C4-01 On page 23 of Appendix B -

Component Database development, it was stated if a chiller trips and within an hour is restarted by the operator, after which it runs successfully, this would not be considered as a failure This event should be counted as 1 failure and 1 success event because in an emergency situation there may not be an hour available for waiting and/or recovery.

A review of the P.S. data indicates that this is not a specific example from plant experience but rather a hypothetical situation that is not consistent with the PSA data collection.

It was determined that if a component trips while operating, that the trip, regardless of reason, would be categorized as maintenance rule functional failure. It would therefore have been counted as a failure to run for the PSA failure rate calculation. The only exception, is if the trip was due to a component outside the component boundary that is specifically modeled in the PSA. The discussion on this type of failures has been removed to avoid confusion.

Documentation was updated for clarity.

There is no impact to the 5b application.

DA-C8-01 The time that components were configured in standby was not estimated. Note that only MOV failure data update needs this kind of information for this PRA.

The requirement refers to components that use standby failures and clearly have standby time and operational time.

All components types using plant specific data use demand only failure rates except ten infrequently tested MOVs use standby failures rates. Because functional failures are recorded for failure to stroke from the standby position to the operational position and from the operational position to the standby position, the only time components are technically not in standby with regard to failure monitoring is during travel. The average fraction of travel time, is less than 0.01%. Applying this time reduction in standby time has no impact on the calculated failure rate at the precision The model data and documentation were updated to address this finding. There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 9 of 91 HNP-15-083, Enclosure 1 Table 1. Resolved but Open F&Os from 2007 Industry Peer Review of the HNP Internal Events PRA.

F&O #

Finding Resolution 5b Impact calculated and with consideration of the normal uncertainty bounds.

MOV spurious operation was also reviewed because this is a similar calculation to the standby failure to operate calculation. The same rules apply for definitions of functional failures. If a valve transferred from its standby position to its non-standby position, and vice-versa, regardless of function, a failure would be applied.

Therefore, there is no time that a valve is not in standby.

However, there are four valves that were included in the population that have power removed during plant power operations, such that the potential for spurious operation is essentially eliminated so that the standby state of these valves is not representative of the modeled failure mode.

There are four of such valves used in the plant specific data calculation. Their contribution to the total valve exposure time has been removed from the data calculation.

The overall impact is an increase of 3.5% of the valve transferring failure rate and potential increase in CDF of approximately 0.02%.

The following files were updated from this finding.

BayesComponents.xls, HNP_MOV_Data.xls, Appendix B:

HNP-F-PSA-0023, HNP_2007.RR

U.S. Nuclear Regulatory Commission Page 10 of 91 HNP-15-083, Enclosure 1 Table 1. Resolved but Open F&Os from 2007 Industry Peer Review of the HNP Internal Events PRA.

F&O #

Finding Resolution 5b Impact DA-C10-01 It was CC-I because no evidence could be found to prove CC-II is met. It could be CC-II if it can be shown that partial test results were not counted as valid test (see example in Cat II requirements)

The finding questions if counted tests completely or partially exposes all elements of the modeled failure modes. The SR for capability categories I, II are the same for counting valid tests. In short, partial tests should not be used as valid tests if all elements of the modeled failures mode are not tested. CC-II further states that if component failures are decomposed into sub-elements, then use tests that exercise the specific sub-element being modeled. CC-III says to decompose failure modes into sub-elements that are fully tested.

The specific example cited from the standard, ASME RA-SB-2005, is for models that include load sequencers in the EDG component boundary. Typically, the load sequencer is only tested every 18 months instead of monthly with the EDG operability test. Therefore, the only valid test should be the 18 month test if the load sequencer is not broken out of the component boundary.

Appendix B (Ref. HNP-F/PSA-0023, Attachment 2) lists the component boundaries and states that the HNP EDG component boundary excludes the load sequencer. The HNP load sequencer is explicitly modeled in the ESFAS system.

A more appropriate example for HNP is for infrequently tested valves. A stroke test for a motor-operated-valve (MOV) may not appropriately verify the movement of a valve body at the same test interval. HNP uses sub-elements for MOVs representing the motor operator and the valve body with the appropriate tests as the basis.

Section 10 (Ref. HNP-F/PSA-0034) provides The analysis was reviewed, and documentation was updated to demonstrate CC-II/III. There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 11 of 91 HNP-15-083, Enclosure 1 Table 1. Resolved but Open F&Os from 2007 Industry Peer Review of the HNP Internal Events PRA.

F&O #

Finding Resolution 5b Impact documentation for how HNP sub-divides component failure modes based on testing exposure which is consistent with SR DA-C10 Category III.

Other components, using plant specific data, were reviewed for partial test opportunities, like pumps and motors. Since actual operational and demand data is collected and only test retuning component to operability or placing in service are used, no partial test were found.

(See Appendix B for data collection methods) The specific test for each component failure mode and sub-element are documented in each system notebook.

Because only complete tests for the specific component boundary are counted, and failure modes are decomposed into sub-elements where sub-elements are exposed differently, HNP not only meets CC-II but also meets category CC-III for SR DA-C10.

DA-D6-01 The component boundary for EDG defined in generic source NUREG/CR-5497 (Reference

24) is not consistent with the boundary defined in component database (Attachment 2 of Appendix B - component database development). There is no evidence that a systematic comparison was performed for other component boundaries.

Make sure that component boundaries are consistent For plant specific data using maintenance rule data, breakers associated with DGs or pumps are tracked in both the component and the ac-power monitoring groups. PSA systems are considered safety significant for maintenance rule. Functional failures of the breakers always are applied to the safety significant system. Therefore, functional failures of breakers are within the PSA component data boundary and within the MR component data boundary.

For other components, the task included reviewing NUREG/CR-5497 for boundary consistency, identification of outliers. The following outliers were identified and corrected as appropriate:

Data and documentation were updated to address the finding. There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 12 of 91 HNP-15-083, Enclosure 1 Table 1. Resolved but Open F&Os from 2007 Industry Peer Review of the HNP Internal Events PRA.

F&O #

Finding Resolution 5b Impact between component failure data and CCF database EDG output breakers changed to be included in the EDG component boundary Battery charger input and output breakers were changed to be included in the component boundary AFW TDP trip and governor valves were changed to be included in the component boundary.

For the above cases, breakers were modeled uniquely, but no CCF were modeled. The independent failures were set to zero so the events could be retained to account for use in mapping databases associated with EOOS and FRANC.

Their associated system notebooks were updated.

Appendix B definitions on component boundaries were revised and a statement was added indicating that boundaries for CCFs and independent failures were verified to be consistent Appendix B Attachment 2 was updated.

DA-D6-02 It was not shown that generic MGL parameters are consistent with plant experience. It is recommended to show, using a proper statistical method, that MGL parameters are consistent with plant experience.

The PS data used for the component failure modes in the PSA was reviewed for potential CCFs. No failures were identified that could be categorized as common cause failures. Beta estimators for the plant specific experience were produced using a statistical approach. The MGL values used in Appendix B were converted to Beta estimators and compared to the plant specific values. Due to a low population of plant specific failure experience, the derived Beta estimators for most of the component types provide no statistical insights for a comparison to the generic MGLs. For component groups experiencing a large number of failures, some insights can be gained. The results were reviewed based on percent difference in the Beta estimators between the generic values and the plant specific values. The following component types had a Documentation on the analysis was added to address the finding. There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 13 of 91 HNP-15-083, Enclosure 1 Table 1. Resolved but Open F&Os from 2007 Industry Peer Review of the HNP Internal Events PRA.

F&O #

Finding Resolution 5b Impact difference in Beta estimators greater than 50%.

MOVs and AOVs - the plant specific Beta value were based on the total MOV (or AOV) failures across multiple systems and was somewhat smaller than values used in the model. However, the model uses specific CCFs for various systems based on data available in NUREG/CR-5497 and from RSC 01-17. If the plant specific failures were broken up by system, then there would be insufficient data for a meaningful comparison. Therefore, the values that are currently in use are considered to be adequate based on a lack of plant experience.

Chillers - There are a large number of chiller failures, many are repetitive failures but no common cause failures were assumed based on time of failure. The Beta factor used in the PSA comes from EPRI TR-100382 and is approximately an order of magnitude greater than the plant experience for failure to run. A detailed review of the plant data may indicate some common cause aspects to reduce the difference. However, currently the CCF of the chillers contributes less than 1% to the CDF using the higher generic value. Therefore, a more detailed assessment and potential reduction of the CCF is not merited at this time.

Air compressors A & B. The generic Beta estimator for CCF to run of compressors is approximately 55% higher than the plant specific experience. The CCF of the compressors contributes less than 1% to the CDF using the higher generic value. Therefore, a more detailed assessment and potential reduction of the CCF is not merited at this time.

U.S. Nuclear Regulatory Commission Page 14 of 91 HNP-15-083, Enclosure 1 Table 1. Resolved but Open F&Os from 2007 Industry Peer Review of the HNP Internal Events PRA.

F&O #

Finding Resolution 5b Impact DA-D6-03 MGL parameter values are different according to testing schemes. MGL parameters in NUREG/CR-5497 are based on staggered testing scheme. No investigation was made to check if MGL parameters based on staggered testing are applicable to this PRA. Make sure that MGL parameters for proper testing scheme are used.

HNP uses MGLs representing both staggered and non-staggered testing. These MGLs were initially applied without consideration of the impact of component testing schemes. The MGLs used from NUREG/CR-5497 are based on staggered testing and appropriately represents testing practices for major safety train equipment. For components separated by trains that are tested online, this finding is not an issue.

A review of the specific components using NUREG/CR-5497 values was performed. The following components were found to inappropriately use the staggered testing assumption: SI to RCS loop check valves, AFW to SG check valves, SG PORVs, PRZ PORVs, PRZ SRVs, and RHR hot leg suction MOVs. Given a non-conservatism existed, a sensitivity study was performed that determined the impact of correcting these MGLs to non-staggered testing would result in an increase in CDF of less than 5%.

Therefore, this finding has a minimal impact on the PSA results.

The MGLs used from report RSC 01-17 provide MGLs for generic components. This source is used for the balance of component CCFs not found in NUREG/CR-5497. The MGLs developed in this document are based on the same underlying data used in NUREG/CR-5497, but use the more conservative non-staggered testing assumption. A known conservatism is that pumps that are tested on a staggered basis use this data and therefore produce conservative CDF results. A typical example is the CCW pumps. No sensitivity study was performed to determine Resolution of this F&O accounted for staggered and non-staggered testing.

This data was incorporated into the model and the documentation was updated. There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 15 of 91 HNP-15-083, Enclosure 1 Table 1. Resolved but Open F&Os from 2007 Industry Peer Review of the HNP Internal Events PRA.

F&O #

Finding Resolution 5b Impact the impact of correcting these conservative MGL parameters because impact vectors are not readily available to perform the study. However, the current PSA results are known to be conservative.

An action item (NTM 49072-48) is open to correct the CCF events to use MGLs representing the appropriate testing scheme during the next model update. The overall impact on PSA results is expected to be a reduction in CDF due to the important components using the more conservative non-staggered assumption.

QU-E3-01 Per discussions with HNP staff, type codes are assigned to all basic events representing independent component failures. However, common cause events are not assigned type codes. There is a data correlation between common cause events, e.g., for 3 Charging Pumps (A, B, and C),

there is a correlation between the 2 out of 3 combination [A B], [A C], and [B C].

Recommend type codes be assigned to common cause events. In addition, it is recommended to enhance HNP-F/PSA-0001 to include a description of the process for assigning type codes.

The first paragraph does not refer to a finding. Category II is met. Comment refers to bringing up the uncertainty analysis to Category III. No action is required.

Appendix B (HNP-F/PSA-0023) provides a listing of plant specific and generic component types using type codes.

Basic events not falling into those categories of failures use probabilities calculated outside of the fault tree. These include common cause failures, initiating events, split fractions, operator actions, and recoveries. Although this recommendation requires no action, this information has been added to Appendix B for clarification as section B.5.

Documentation was updated for clarification. There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 16 of 91 HNP-15-083, Enclosure 1 Table 1. Resolved but Open F&Os from 2007 Industry Peer Review of the HNP Internal Events PRA.

F&O #

Finding Resolution 5b Impact HR-D3-01 SR HR-D3 requires that each detailed evaluation of a pre-initiator HFE include an assessment of the quality of the written procedures and the quality of the man-machine interface. While Harris does identify the specific procedures for each action, they use a blanket assumption that the HNP procedures are accurate and consistent with the plant configuration. (See Assumption 6 in section 2.6 of Appendix E.)

There seems to be no evaluation of the man-machine interface.

This assumption is justified since the procedures performing maintenance and restoring systems from maintenance are step-by-step procedures that include step sign-offs for place keeping and, in many instances, a reviewer or verifier sign-off for key steps. The procedures also have twenty years of performance with improvements added based on the experience gained. The plant has a proceduralized labeling program (PLP-610, Equipment Identification and Numbering System) for plant piping and HVAC components and the proceduralized work management program (ADM-NGGC-0104, Work Management Process) requires Controlled Wiring Diagrams in work packages for electrical / I&C work.

Added to section 2.6 #6 of HNP-F/PSA-0070 Documentation was updated to address this finding. There is no impact to the 5b application.

HR-D6-01 Harris uses the HRA Toolbook for quantifying their pre-initiator HEPs. For the pre-initiator HEPs, Harris basically uses the ASEP approach and treats the ASEP Basic HEPs as means with the associated error factors. However, as defined on page xv of NUREG/CR-4772, the ASEP BHEP values are medians for a log-normal distribution. Thus, the treatment of the BHEP values for the pre-The spreadsheets in the HRA Toolbox have been changed to use the mean instead of median values to determine the pre-initiator HEP values. Values have been updated in the calculation and the model.

Resolution of this F&O updated the spreadsheets in the HRA Toolbox and in the model. There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 17 of 91 HNP-15-083, Enclosure 1 Table 1. Resolved but Open F&Os from 2007 Industry Peer Review of the HNP Internal Events PRA.

F&O #

Finding Resolution 5b Impact initiators is mathematically incorrect. Note that in the HRA TOOLBOOK Users Guide (SAROS 21-16), this issue was specifically identified and evaluated. The contention was that the ASEP values were intended to be bounding, screening values and that they were so conservative that treating them as means still yielded conservative results with respect to an equivalent THERP analysis with the proper conversion from medians to means. While the reviewers appreciate this issue, the treatment is still mathematically incorrect. NOTE: the HEPs generated by using this approach are considered to still be somewhat conservative with respect to a detailed analysis using THERP. An inquiry will be made to the ASME CRNM with respect to this issue.

U.S. Nuclear Regulatory Commission Page 18 of 91 HNP-15-083, Enclosure 1 Table 1. Resolved but Open F&Os from 2007 Industry Peer Review of the HNP Internal Events PRA.

F&O #

Finding Resolution 5b Impact HR-F2-01 The review team could not find evidence that sequence specific timing estimates were used.

The particular case examined was Feed and Bleed. Only one Feed and Bleed HEP was found and the timing to support this appeared to not be based on a limiting case.

The team was referred to the success criteria in Appendix D of the HNP PRA. The feed and bleed success criteria were based on a transient case and success time for opening a primary PORV. The team believed that other cases such as small LOCA may be more time limiting.

MAAP runs were conducted to confirm that the current timing for feed-and bleed initiation used in the HRA was appropriate for steam generator tube rupture and S1 LOCA. Four cases were run, one SGTR and three S1 LOCAs cases for the upper, mid, and lower break range.

Core damage did not occur in any case for feed and bleed initiated at 75 minutes, which is the limiting time used for transient sequences. Appendix D was updated to reflect additional MAAP cases that were run.

Resolution of this F&O updated documentation of the MAAP runs that were completed.

There is no impact to the 5b application.

HR-G9-01 NUREG-1278 contains median values that do not appear to be converted to means before being used in the HNP PRA.

For example, spreadsheet HNP-CP.XLS contains individual tables that reference THERP median values. These values are multiplied by factors to account for stress in individual actions, but they are never converted to means.

The spreadsheets in the HRA Toolbox have been changed to use the mean instead of median values to determine the post-initiator HEP values. Values have been updated in the calculation and the model.

Resolution of this F&O updated the spreadsheets in the HRA Toolbox and in the model. There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 19 of 91 HNP-15-083, Enclosure 1 Table 2:

HNP Assessment of Supporting Requirement (SR) Capability Categories For Initiating Events (IE), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category HLR SR I

II III Met Not Met N/A HLR-IE-A IE-A1 ALL X

IE-A2 ALL X

IE-A3 ALL X

IE-A4 I/II X

IE-A5 II X

IE-A6 II X

IE-A7 ALL X

IE-A8 II X

IE-A9 II X

IE-A10 ALL X

HLR-IE-B IE-B1 ALL X

IE-B2 ALL X

IE-B3 II X

IE-B4 ALL X

IE-B5 ALL X

HLR-IE-C IE-C1 ALL X

IE-C2 ALL X

IE-C3 ALL X

IE-C4 ALL X

IE-C5 I/II X

IE-C6 ALL X

IE-C7 I/II X

IE-C8 ALL X

IE-C9 ALL X

IE-C10 ALL X

IE-C11 ALL X

IE-C12 ALL X

IE-C13 I/II X

IE-C14 I/II X

IE-C15 ALL X

HLR-IE-D IE-D1 ALL X

IE-D2 ALL X

IE-D3 ALL X

U.S. Nuclear Regulatory Commission Page 20 of 91 HNP-15-083, Enclosure 1 Table 3:

HNP Assessment of Supporting Requirement (SR) Capability Categories For Accident Sequences (AS), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category HLR SR I

II III Met Not Met N/A HLR-AS-A AS-A1 ALL X

AS-A2 ALL X

AS-A3 ALL X

AS-A4 ALL X

AS-A5 ALL X

AS-A6 ALL X

AS-A7 I/II X

AS-A8 ALL X

AS-A9 II X

AS-A10 II X

AS-A11 ALL X

HLR-AS-B AS-B1 ALL X

AS-B2 ALL X

AS-B3 ALL X

AS-B4 ALL X

AS-B5 ALL X

AS-B6 ALL X

AS-B7 ALL X

HLR-AS-C AS-C1 ALL X

AS-C2 ALL X

AS-C3 ALL X

U.S. Nuclear Regulatory Commission Page 21 of 91 HNP-15-083, Enclosure 1 Table 4:

HNP Assessment of Supporting Requirement (SR) Capability Categories For Success Criteria (SC), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category HLR SR I

II III Met Not Met N/A HLR-SC-A SC-A1 ALL X

SC-A2 II/III X

SC-A3 ALL X

SC-A4 ALL X

SC-A5 II/III X

SC-A6 ALL X

HLR-SC-B SC-B1 II X

SC-B2 II/III X

SC-B3 ALL X

SC-B4 ALL X

SC-B5 ALL X

HLR-SC-C SC-C1 ALL X

SC-C2 ALL X

SC-C3 ALL X

U.S. Nuclear Regulatory Commission Page 22 of 91 HNP-15-083, Enclosure 1 Table 5:

HNP Assessment of Supporting Requirement (SR) Capability Categories For System Analysis (SY), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category HLR SR I

II III Met Not Met N/A HLR-SY-A SY-A1 ALL X

SY-A2 ALL X

SY-A3 ALL X

SY-A4 II/III X

SY-A5 ALL X

SY-A6 ALL X

SY-A7 I/II X

SY-A8 ALL X

SY-A9 ALL X

SY-A10 ALL X

SY-A11 ALL X

SY-A12 ALL X

SY-A13 ALL X

SY-A14 ALL X

SY-A15 ALL X

SY-A16 I/II X

SY-A17 ALL X

SY-A18 ALL X

SY-A19 ALL X

SY-A20 ALL X

SY-A21 ALL X

SY-A22 II X

SY-A23 ALL X

SY-A24 ALL X

HLR-SY-B SY-B1 II/III X

SY-B2 I/II X

SY-B3 ALL X

SY-B4 ALL X

SY-B5 ALL X

SY-B6 ALL X

U.S. Nuclear Regulatory Commission Page 23 of 91 HNP-15-083, Enclosure 1 Table 5, continued:

HNP Assessment of Supporting Requirement (SR) Capability Categories For System Analysis (SY), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category HLR SR I

II III Met Not Met N/A HLR-SY-B SY-B7 II X

(contd)

SY-B8 ALL X

SY-B9 ALL X

SY-B10 II/III X

SY-B11 ALL X

SY-B12 ALL X

SY-B13 ALL X

SY-B14 ALL X

SY-B15 ALL X

HLR-SY-C SY-C1 ALL X

SY-C2 ALL X

SY-C3 ALL X

U.S. Nuclear Regulatory Commission Page 24 of 91 HNP-15-083, Enclosure 1 Table 6:

HNP Assessment of Supporting Requirement (SR) Capability Categories For Human Reliability (HR), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category HLR SR I

II III Met Not Met N/A HLR-HR-A HR-A1 ALL X

HR-A2 ALL X

HR-A3 ALL X

HLR-HR-B HR-B1 II/III X

HR-B2 ALL X

HLR-HR-C HR-C1 ALL X

HR-C2 II/III X

HR-C3 ALL X

HLR-HR-D HR-D1 ALL X

HR-D2 II X

HR-D3 II/III X

HR-D4 ALL X

HR-D5 ALL X

HR-D6 ALL X

HR-D7 I/II X

HLR-HR-E HR-E1 ALL X

HR-E2 ALL X

HR-E3 II/III X

HR-E4 II/III X

HLR-HR-F HR-F1 I/II X

HR-F2 II X

HLR-HR-G HR-G1 II X

HR-G2 ALL X

HR-G3 II/III X

HR-G4 II X

HR-G5 II X

HR-G6 ALL X

HR-G7 ALL X

HR-G8 ALL X

HLR-HR-H HR-H1 II X

HR-H2 ALL X

HR-H3 ALL X

U.S. Nuclear Regulatory Commission Page 25 of 91 HNP-15-083, Enclosure 1 Table 6:

HNP Assessment of Supporting Requirement (SR) Capability Categories For Human Reliability (HR), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category HLR SR I

II III Met Not Met N/A HLR-HR-I HR-I1 ALL X

HR-I2 ALL X

HR-I3 ALL X

U.S. Nuclear Regulatory Commission Page 26 of 91 HNP-15-083, Enclosure 1 Table 7:

HNP Assessment of Supporting Requirement (SR) Capability Categories For Data Analysis (DA), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category HLR SR I

II III Met Not Met N/A HLR-DA-A DA-A1 ALL X

DA-A2 ALL X

DA-A3 ALL X

DA-A4 ALL X

HLR-DA-B DA-B1 II X

DA-B2 I/II X

HLR-DA-C DA-C1 ALL X

DA-C2 ALL X

DA-C3 ALL X

DA-C4 ALL X

DA-C5 ALL X

DA-C6 ALL X

DA-C7 II/III X

DA-C8 II/III X

DA-C9 I/II X

DA-C10 II X

DA-C11 ALL X

DA-C12 ALL X

DA-C13 II/III X

DA-C14 ALL X

DA-C15 ALL X

DA-C16 ALL X

HLR-DA-D DA-D1 II X

DA-D2 ALL X

DA-D3 II X

DA-D4 II/III X

DA-D5 II X

DA-D6 II X

DA-D7 ALL X

DA-D8 II X

U.S. Nuclear Regulatory Commission Page 27 of 91 HNP-15-083, Enclosure 1 Table 7:

HNP Assessment of Supporting Requirement (SR) Capability Categories For Data Analysis (DA), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category HLR SR I

II III Met Not Met N/A HLR-DA-E DA-E1 ALL X

DA-E2 ALL X

DA-E3 ALL X

U.S. Nuclear Regulatory Commission Page 28 of 91 HNP-15-083, Enclosure 1 Table 8:

HNP Assessment of Supporting Requirement (SR) Capability Categories For Quantification (QU), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category HLR SR I

II III Met Not Met N/A HLR-QU-A QU-A1 ALL X

QU-A2 ALL X

QU-A3 II X

QU-A4 ALL X

QU-A5 ALL X

HLR-QU-B QU-B1 ALL X

QU-B2 ALL X

QU-B3 ALL X

QU-B4 ALL X

QU-B5 ALL X

QU-B6 ALL X

QU-B7 ALL X

QU-B8 ALL X

QU-B9 ALL X

QU-B10 ALL X

HLR-QU-C QU-C1 ALL X

QU-C2 ALL X

QU-C3 ALL X

HLR-QU-D QU-D1 ALL X

QU-D2 ALL X

QU-D3 ALL X

QU-D4 II/III X

QU-D5 ALL X

QU-D6 II/III X

QU-D7 ALL X

HLR-QU-E QU-E1 ALL X

QU-E2 ALL X

QU-E3 II X

QU-E4 ALL X

U.S. Nuclear Regulatory Commission Page 29 of 91 HNP-15-083, Enclosure 1 Table 8:

HNP Assessment of Supporting Requirement (SR) Capability Categories For Quantification (QU), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category HLR SR I

II III Met Not Met N/A HLR-QU-F QU-F1 ALL X

QU-F2 ALL X

QU-F3 II/III X

QU-F4 ALL X

QU-F5 ALL X

QU-F6 ALL X

U.S. Nuclear Regulatory Commission Page 30 of 91 HNP-15-083, Enclosure 1 Table 9:

HNP Assessment of Supporting Requirement (SR) Capability Categories For LERF Analysis (LE), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category HLR SR I

II III Met Not Met N/A HLR-LE-A LE-A1 ALL X

LE-A2 ALL X

LE-A3 ALL X

LE-A4 ALL X

LE-A5 ALL X

HLR-LE-B LE-B1 III X

LE-B2 II X

LE-B3 ALL X

HLR-LE-C LE-C1 II X

LE-C2 II/III X

LE-C3 II/III X

LE-C4 II X

LE-C5 II X

LE-C6 ALL X

LE-C7 ALL X

LE-C8 ALL X

LE-C9 II/III X

LE-C10 II X

LE-C11 II/III X

LE-C12 II X

LE-C13 II/III X

HLR-LE-D LE-D1 II X

LE-D2 II X

LE-D3 II X

LE-D4 II X

LE-D5 II X

LE-D6 II X

LE-D7 II X

HLR-LE-E LE-E1 ALL X

LE-E2 II X

LE-E3 II X

LE-E4 ALL X

U.S. Nuclear Regulatory Commission Page 31 of 91 HNP-15-083, Enclosure 1 Table 9:

HNP Assessment of Supporting Requirement (SR) Capability Categories For LERF Analysis (LE), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category HLR SR I

II III Met Not Met N/A HLR-LE-F LE-F1 II/III X

LE-F2 ALL X

LE-F3 ALL X

HLR-LE-G LE-G1 ALL X

LE-G2 ALL X

LE-G3 II/III X

LE-G4 ALL X

LE-G5 ALL X

LE-G6 ALL X

U.S. Nuclear Regulatory Commission Page 32 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact 01-IE-A3a Table 3.3 of Section 3 contains outdated IPE data for Transient Initiating Event Categories.

The current Table 3.3 had IPE data in it. The WOG PSA Comparison Database, Revision 4, 2003 was used to develop a new table.

Data tables and documentation were updated.

There is no impact to the 5b application.

02-IE-A5 Additional documentation is needed to indicate how events occurring during shut-down are evaluated.

The plant events occurring at power and during shutdown were reviewed. Events occurring during shutdown that were applicable to power operations were included in the frequency of the initiating events, such as LOSP. A discussion was added to Section 3.0 Documentation was added per the finding. There is no impact to the 5b application.

03-IE-A6 No documentation of interviews with plant personnel to determine if potential initiating events have been overlooked.

An LER review was performed to determine any potential missed IEs. LERs affecting initiating events or systems were added to the IE analysis and system notebooks respectively. There were no new initiating events identified.

No new interviews were considered necessary because the PSA personnel continually consult plant personnel for various applications and the model periodic updates.

Additionally, the IPE received a Plant Technical Support review and a number of notebooks have undergone system engineer review.

Documentation was updated to reflect the analysis performed. There is no impact to the 5b application.

04-IE-A7 Plant-specific operating experience for identifying IE precursors has apparently not been examined since 1995, including review of LERs and other applicable information.

An LER review was performed from initial IPE development through 2006 to determine any potential missed IEs. LERs affecting initiating events or systems were added to the IE analysis and system notebooks respectively. There were no new initiating events identified.

Documentation was updated to reflect the analysis performed. There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 33 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact 05-IE-B3 Some EPRI subgroup initiating events appear to be in groupings that behave differently from other events in the group. For example, loss of condenser vacuum and loss of circulating water (vs. say rod drop) - if there is a loss of condenser vacuum, secondary side equipment will not be available.

Therefore, credit cannot be given to steam dumps, main feedwater, etc. These events seem to have different impacts on plant and system response than other events in the same grouping which is not in accordance with the PRA Procedures Guide.

It was determined that the groupings of the EPRI subgroup IEs were appropriately matched to the HNP initiating events. For HNP a loss of condenser or loss of circulating water would not impact the availability of FW, so these events can be grouped in %T3. The availability of FW or steam dumps is based on a plant specific split fraction of the %T3 and %T1 events. Rod drop events would go in the manual trip category %T1.

As part of this F&O the following were performed:

Reviewed the change logs for changes in initiators with emphasis on %T1, T2, T3, T7, T8.

Updated plant specific initiating event spreadsheet using current LER data through 2005 and generic data from NUREG/CR-5750 that was re-categorized to match HNPs breakdown of IEs. Re-categorized excessive feedwater to

%T3 versus %T7. Verified that removal of prior IE %T8 was appropriate based on NUREG categories and signal inter-dependencies. Additionally, the HNP IE spreadsheet is being converted back to a moment-matching update method (as prior revisions of the HNP PSA used) to gain more realistic data results. The justification for this is taken from an RSC, Inc. engineering calculation provided to HNP in 2002. From this document:

Overall, it appears that the discrete method has several weaknesses that are not present in the moment-matching approach. The discrete method is dependent on the interval selection and does not necessarily provide a single Updated the initiating event analysis and documentation.

There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 34 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact rule for all cases. In fact, the analysis shows how a more refined interval selection can both increase and decrease the result. The method also consistently penalizes the analysis by generating failure rates in excess of the generic rate although no atypical performance is found due to the need to include a failure contribution to be able to perform the update. This bias could influence the selection of important components and risk ranking. Since the moment-matching method produces consistent results, the risk ranking should not be impacted regardless of the failure rate estimation.

Another possible drawback for the discrete evaluation is that it appears to inherently discount the quantity of plant data collected since it only included the failure rate and variance into the calculation as second order terms. For example, a plant that collected 1 failure in 100 hours0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months would be treated in a similar manner as a plant with 10 failures in 1000 hours0.0116 days 0.278 hours 0.00165 weeks 3.805e-4 months since the failure rate would be the same. This seems counter to the desire to reflect the inclusion of plant-specific characteristics into the analysis to gain true understanding of plant performance.

Although both methods may be utilized in the industry, the moment-matching approach seems to be more appropriate and should be used in data analyses. Reasons for this selection include:

1. It is statistically valid and maintains distribution consistency during the update

2. It is not impacted by any user-defined function such as

U.S. Nuclear Regulatory Commission Page 35 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact the number of intervals chosen

3. It produces consistent results between failure rate cases such that rank order is not biased

4. It does not produce illogical results for cases where no failure data has occurred and there is no reason to predict poor performance

5. It allows for continued data collection to impact the update even when the plant data indicates that failure rate is unchanged Other tasks associated with the completion of this F&O included:

Developed split fraction for loss of steam dumps.

Updated split fractions for plant trips that feed water was lost and had to be restarted.

Updated split fractions for plant trips with RCS pressure challenges.

Corrected gates #MRST and #QT102 (See notes below)

Update Section 3 for appropriate documentation of the impact of initiators on plant response. Including Updating Tables C.2 and C.3 as necessary to verify that the existing breakdown of initiators (especially T1 and T3) adequately capture the plant response.

Document steam dump/condenser availability spit fraction

U.S. Nuclear Regulatory Commission Page 36 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact in the SG system notebook.

Update Table D.9 Updated the frequency of AC/DC bus failure to use a generic type code frequency as opposed to a published NUREG/CR-5750 frequency or newer data. This was done to be consistent with other bus failures in the model and to fault tree based IE models. Additionally, there is some debate over if the published frequency values are per bus or per plant, so proper use was not certain.

Updated LOSP frequency through 2005 and document.

The HNP IE spreadsheet LOSP calculations were converted back to a combined probability of non-recovery curve method (as prior revisions of the HNP PSA used) to gain more realistic data results. The justification for this is that a single curve type analysis (power fit, log normal, exponential, Weibull fit, etc.) will either overestimate or underestimate the recovery probability for cases where larger component failures occur (such as EDG run failures at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ). A composite curve is required to provide a more accurate solution.

Notes: (Pre-correction)

For HNP, feedwater is not lost on a loss of condenser vacuum; however a split fraction is used to indicate initiators where FW is not available.

Steam dumps would be assumed to be lost on a loss of

U.S. Nuclear Regulatory Commission Page 37 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact condenser vacuum. There is no system notebook containing a complete description of the steam dumps. A number of initiators are modeled to fail the steam dumps.

Loss of instrument air appears to be missing as a failure of the steam dumps. However, that failure also fails feedwater so the omission is not consequential.

Gate #MRST is incorrect. It is allowing OPER-46 to recover feedwater for all transient initiating events. (Some initiating events fail FW by fault tree linking but not all)

HNP INITIATING EVENTS.XLS categorizes %T1 as manual reactor trip and %T3 as automatic reactor trip. This was done to facilitate the W ATWS methodology. The plant specific events appear to be mapped to match those categories, but it is not clear if the underlying generic data is mapped appropriately.

The old model break down was %T1, reactor trip, %T2, reactor trip with pressure challenge, and %T3, turbine trip.

The current PORV challenge split fractions are being applied to %T1, T3 (X-RCSPC) and %T4 (X%4LIFT) only, The application to T4p is missing (basis for denominator).

Table D.9 appears to be correct, except that Reactor trip (both automatic and manual) is mislabeled as Turbine trip.

The main steam notebook needs to be broadened to discuss how steam dumps are credited and what initiators are assumed to fail it.

U.S. Nuclear Regulatory Commission Page 38 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact The system notebooks already include the impact of initiators on the system.

The current breakdown of %T1, %T3 and %T7 are consistent with the data in NUREG/CR-5750. The loss of condenser vacuum will be rolled in to %T3 with an added split fraction to account for plant specific events where condenser steam dumps could not be used to recover feedwater so that only CST makeup to the condenser is credited.

NUREG/CR-5750 only includes spurious ESFAS (group QR9) actuation that accounts for categories 9 and 10 in NUREG/CR-3862. In Table D.13 of 5750, all 22 of the PWR events resulted in MSIV closure. Tables 2 and 6 of 3862 indicated the category 10 causes MSIV closures.

Category 9 was grouped in the same transient group in some of the other PSAs with an expected MSIV closure.

A review of the plant specific design is as follows:

Low PRZ P >> SI signal Low Steam Line P >> SI signal CT Hi 1 (3psi on 2/3 Channels 2-4) >> SI signal CT Hi 2 (3psi on 2/3 channels 2-4) >> MSIV Closure CT Hi 3 (10psi on 2/4 channels 1-4) >> Phase B

U.S. Nuclear Regulatory Commission Page 39 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact SI Signal >> Phase A, ESF actuations and FW isolation Phase A >> CT isolation of NSW, RCP seal return, letdown, sampling and instrument air Phase B >> CT isolation of CCW to RCPs and actuation of CT spray Tech. Specs. allow one of the above CT channels to be failed and placed in test indefinitely (energized in actuated state). Another channel may be tested if the failed channel is bypassed so that a 2/3 or 4 condition is not actuated from the test. The time limit on the bypass is 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

The tech spec confirms that it is possible that operator error (failure to bypass), or common cause failures (second failure occurring while first is still in test) could lead to actuation.

Since both SI actuations (group 9) and containment pressure problems (group 10) are documented in the NUREGs as causing MSIV closure in the historical events, it is assumed (without further LER review) that the most probable scenarios are inadvertent actuations at the instrument channel level and not in the logic cabinets. This has been confirmed by plant operations staff. This means that 2 CT channels, if actuated would likely result in satisfying all the set points and result in SI, Phase A, MSIV Isolation, and Phase B. This is consistent with the current modeling approach.

U.S. Nuclear Regulatory Commission Page 40 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact The placement of group 20 (excess feedwater) into the spurious ESFAS class based on the assumption that overcooling the RCS would cause a pressure drop in the PRZ and cause an SI is an incorrect assessment. There is no indication in the NUREG/CR-5750 records of this condition. Plant personnel have confirmed that the more likely outcome is that the overcooling of the SGs would result in a reactivity spike that would manage RCS pressure and prevent the SI. The actual trip mechanism will be a race between feedwater isolation on high SG level or reactor high reactivity. In either event, the outcome is an automatic Reactor trip to be placed in event %T3 instead of

%T7.

06-IE-C11 ASME SR IE-C11 states For rare initiating events, USE industry generic data and INCLUDE plant-specific functions." No evidence was found to indicate plant-specific functions were included for rare events.

The purpose of this F&O is to be sure for rare events, that plant specific aspects that make the occurrence of the event unique for HNP is included, especially if a rare event has occurred at HNP. HNP has experienced no rare events.

Initiating events were reviewed and where appropriate a discussion of plant specific experience or design was considered. The following considerations were made:

LOCA: HNP uses 4 break sizes. Actual pipe segment counts were used to split the generic 3 categories into 4:

Discussion was added that no insights would be gained from updating the generic estimate with un-informed plant experience.

SGTR: HNP derived a SGTR frequency based on a generic estimate of individual tube failure multiplied by the number Documentation of rare events was improved. There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 41 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact of SG tubes to address plant specific aspects.

SLB: Secondary Line Break is not a rare event based on generic industry frequency of 1.4E-2, but was included in this discussion for completeness. The generic data appears to be less representative of current industry experience, so plant specific experience of no events at HNP was included by performing a Bayes update of the generic experience to lower the event frequency to a more realistic value.

ATWS: Harris models ATWS as a response to a plant transient. It is not considered an initiating event.

LOSP: By ASME definition, LOSP is not a rare event based on industry experience, but was included in this discussion for completeness. Plant specific aspects were included in the analysis of the industry data for applicability to HNP to consider such things as plant location, administrative control, and design of the switchyard and electrical distribution system. A Bayes update was performed, but the large amount of industry data, dominates the result.

ISLOCA: HNP uses a plant specific analysis of ISLOCA based on generic valve failure rates. Data is acceptable.

Appendix C and Section 3 were updated to note above findings.

U.S. Nuclear Regulatory Commission Page 42 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact 07-IE-D3 The key assumptions and key sources of uncertainty associated with the initiating event analysis do not appear to be documented.

Seventy-four (74) assumptions regarding IE were identified in Section 3 and Appendix C, and were evaluated to determine their effect on PRA results. The results of this evaluation are included in Appendix U, Uncertainty Analysis.

Resolution of this F&O included analysis and documentation of uncertainties. There is no impact to the 5b application.

08-AS-A2 Although safety functions and success criteria are contained in the AS notebook, they are not well organized and do not have clear links from the specific accident sequence to the supporting references.

Added table to each event tree development section that lists safety functions, success criteria, and sequence tops events. For SR-A3, the requirement is to identify initiating events with special handling. There are no initiating events that require special handling because the event tree tops model functions and not specific systems. The effects of specific initiators are addressed by fault tree linking. For SR-A4, the requirement is to identify the operator actions required and provide references. The major procedures for the event tree tops were added as well as the associated operator actions. For SR-A5, the requirement to define the accident logical progression was already met. The ESDs already define the accident progression, plus the description associated with the event trees discusses the accident progression. The ATWS event tree section was expanded to discuss the accident progression; no other action is required. For SR-A9, the requirement to reference the SC basis was accomplished by adding cross references in the same tables to the SC sections of other sources.

Resolution of this F&O added documentation to make clear links from the accident sequence to the reference. There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 43 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact 09-AS-A2 The list of safety functions in AS Table 4.1 should be expanded to include:

- reactor pressure control

- reactor coolant inventory control.

Table 4.1 was expanded to added additional safety functions and supporting systems.

Resolution of this F&O expanded the referenced table as necessary. There is no impact to the 5b application.

10-AS-A6 Most event tree descriptions do not include any discussion of the ordering sequence.

Added a general discussion in section 4.0 on the basis of the ordering of event trees.

Resolution of this F&O added a general discussion of the ordering sequence in event tree descriptions.

There is no impact to the 5b application.

11-AS-A8 The end state of the Event Trees is not specifically defined to be stable or core damage.

A general discussion was added to Section 4.0 that defines core damage as uncovered fuel and success as a safe stable state. Specific core damage temperatures were also added. A brief discussion of the core damage bins and early/late classification in the event trees was added.

Resolution of this F&O added a discussion to the documentation that defines core damage and success. There is no impact to the 5b application.

12-AS-A9 The T-H code requirements for acceptability need to be stated.

Duke Energy Progress, Inc.,

uses MAAP for most PSA specific T-H analysis. There is some question from NRC about MAAP acceptability.

The PSA success criteria and accident sequence development is based on T/H runs from both RELAP and MAAP 3.0b. The MAAP analyses are well documented and are considered to be acceptable for PSA purposes. The MAAP code was edited and recompiled for HNP specific considerations. No major changes to success criteria are expected from an upgrade to MAAP 4.05 or higher version.

Resolution of this F&O justified the acceptability of the use of MAAP code.

There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 44 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact 13-AS-B1 The impact of initiators on mitigating systems is not specifically discussed in the documentation.

The system notebooks already include a discussion of impact of various IEs on the systems.

An initiator-to-system impact dependency matrix was added to the Section 3.0 report. The matrix indicates the extent of damage to systems from each initiator.

Resolution of this F&O added a dependency matrix linking the impact of initiators to mitigating systems.

There is no impact to the 5b application.

14-AS-B5a The use and impact of system alignments is not adequately discussed.

The existing flag section in each system notebook was updated to list the alignment flag events affecting the system. Most alignment flags are tied to protected train flags.

The plant generally operates with one train in service and the other in standby. Because it is equally likely that either train is in service, alignment flags are quantified with a value of 0.5. The contribution difference between the protected train A and protected train B is less than 1%.

(F-V of 0.125 vs. 0.129) No insights are identified that need to be added to the accident sequence discussion.

The resolution of the F&O updated the flag section within the system notebook to address the impact of system alignments. There is no impact to the 5b application.

15-AS-C3 Key Assumptions and Key Sources of Uncertainty are not specifically identified.

Ninety-three (93) assumptions were identified for AS/SC in Section 4 and Appendices D, F, and G. They were evaluated to determine their effects on PRA results. The 93 assumptions apply to either accident sequence definition or success criteria. An additional 48 assumptions have been identified for Appendices H (ISLOCA) and R (LOSP Recovery). They were also evaluated for their effects on PRA results. The results of these evaluations are presented in Appendix U, Uncertainty Analysis.

Resolution of this F&O specifically identified the assumptions for AS/SC. There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 45 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact 16-AS-A10 The AS/IE documentation supporting the modeling of accident sequences based on systems and operator responses is weak.

The accident sequences are based on functions rather than systems. The combined documentation of Section 3.0 and 4.0 discuss the standard approach of fault tree linking with small event trees used in the HNP model. The effects of initiating events is embedded in the system fault tree models. The linking of these models to the functional logic ensures that sufficient detail is present to propagate the effects of initiating events through the accident sequences.

A short discussion was added to Section 4.1.1 that states the following: The event trees model mitigating system functions. These do not vary with various types of transient initiating events. Additionally, the effects of specific initiating events on systems was added to Section 3.0. The specific operator responses associated with the mitigating functions was documented in Section 4.0 and Appendix D.

The discussion was expanded in Section 4.0 and cross-referenced to procedures and appropriate section of Appendix D.

Resolution of this F&O added a section clarifying the modeling of accident sequences. There is no impact to the 5b application.

17-AS-B3 No discussion of phenomenological conditions which address this SR was noted.

This F&O addresses pre-core damage environmental effects on success of components. A review of plant systems indicates the following areas of interest:

1. The impact of LOCAs and F&B cooling on containment equipment include:

a. RHR SD Cooling MOVs

b. RCS PORVs and BVs

c. Containment Instrumentation

d. Fan Coolers (Level II)

e. Containment Isolation Valves (Level II)

f. Containment Sump Valves Resolution of this F&O evaluated the phenomenological conditions for several areas of interest. The documentation was updated to reflect the additional analysis. There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 46 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact

2. Sump plugging

3. Spray and humidity concerns from Internal flooding on RAB

4. Impact of MSLB on AFW TDP inlet valves, MSIVs, SG PORVs and Steam Dumps

5. HVAC and room heat-up.

The above items are resolved as follows:

1. Based on FSAR, the design basis accident valve temperature maximum is 245°F for LBLOCA. All components in containment are qualified to operate after reaching this temperature. Generally, MAAP runs indicate that with 1 train of sprays and 1 train of fan coolers, the containment temperature remains below this value. For scenarios without fan coolers and sprays, the temperature typically exceeds 300°F if there is a LOCA or loss of secondary heat removal.

1a: RHR shutdown cooling valves are only modeled for small LOCAs (including transient induced and SGTR) and successful secondary heat removal. Based on report RSC-06-13, containment conditions will not exceed 200°F and will not exceed the evaluated EQ temperatures.

1b: RCS PORVs are required to open following the initial pressure challenge following a plant trip. For the initial pressure challenge, the containment environment is normal and no concerns of environment effects exists. In the event a PORV fails to reclose, the block valve would be closed early in the event before the containment conditions would

U.S. Nuclear Regulatory Commission Page 47 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact appreciably change. The RCS PORVs and Block valves are challenged for feed and bleed cooling for three modeled cases, plant transients, S1 LOCA, and transient induced LOCAs. The PORVs are also challenged for depressurization following a SGTR. MAAP run RSC-CALMAP-2001-0118 indicates for a loss of feedwater, with no containment cooling, the containment upper region temperature reaches 302°F at the time of feed and bleed recirculation. Because feed and bleed are implemented early in the accident, the valves operate before the containment conditions exceed the analyzed limits. If the operator fails to open the PORVs, no credit is given for success. With the fan coolers and sprays operating, the containment conditions remain below the analyzed temperatures. No specific analysis was performed for the long term operability of the PORVs to perform bleed cooling because the probability of failure of the fan coolers or sprays in addition to CSIPs is a small contribution compared to the need of the operator to reset SI and maintain long term instrument air to the containment.

Therefore, containment cooling for PORV operability is considered to be non-risk significant.

1c: Instrumentation in containment provides SG level, pressurizer level and pressure, and containment pressure signals that are important to the PSA. Other signals such as core thermal temperature are not specifically addressed in the PSA. During the early portions of the accident, actuations will occur before significant changes to the containment environment occur. For large and medium LOCAs, long term effects on instrumentation inside

U.S. Nuclear Regulatory Commission Page 48 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact containment are not as critical as the instrumentation for LHSI flow and RWST level which are not affected by the accident. For small LOCAs and transient, if secondary heat removal remains intact, the containment temperatures are analyzed to stay below the EQ analyzed limits even without the containment cooling systems. For loss of secondary heat sink scenarios with feed and bleed cooling underway, the important instrumentation for success involves the RWST level. Steam generator level is not needed.

Instrumentation in containment would remain within EQ analyzed limits until feed and bleed cooling is underway. If pressurizer level and pressure are not available after initiation of feed and bleed cooling, the analyzed success path is to overfill the pressurizer and relieve liquid through the PORVs. For this success path, the availability of pressurizer instrumentation is not significant.

1d: If fan coolers operate, then the containment conditions remain within the EQ analyzed limits during core damage mitigation phase. For severe accident characterized by core damage sequences, the uncertainty of the availability of fan coolers is discussed in Section 8, Containment Response Assessment.

1e: Containment isolation valves operate early in the accident scenarios prior to conditions that would exceed the EQ analyzed limits.

1f: The containment sump valves are outside containment and the post-accident environment is expected to remain within the EQ analyzed limits.

U.S. Nuclear Regulatory Commission Page 49 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact 2: Sump plugging is modeled in the PSA for LOCA and no further action is needed.

3: The internal flooding analysis identified targets of concern. There is no further action required.

4: The equipment in the main steam line tunnel is analyzed in the EQ analysis for design basis main steam line break so that components and instruments of interest, AFWTDP steam emission valves, MSIVs, MS PORVs and SRVS would not be adversely affected by the accident.

5: The PSA includes an HVAC system notebook and supporting room heat-up analysis appendix that identifies those plant areas that require cooling or ventilation for equipment operability concerns. Other F&Os address specific rooms. A discussion of the above concerns has been added to the appropriate system notebooks to close out this F&O.

18-SC-A4 18-SC-C1 18-SC-C2 HNP-F/PSA-0028 R3 Table 4.1 list plant Safety function this table does not list the Key Safety Functions as defined in the ASME standard. These safety functions seemed to be addressed, but there is not a clear trail.

It was determined that combining Appendix D and Section 4 is not desirable. For clarity of understanding the important information is provided in Section 4. The bases and documentation of the bases are provided in the supporting Appendix D. Modifications to these bases in Appendix D need only to be addressed in Section 4 if revised analyses indicate that the information provided in Section 4 is invalidated. This reduces the amount of effort needed to update the model. Changing this approach would mean a major revision to both sections.

Resolution included adding documentation of the success criteria for key safety functions to each event tree and adding MAAP references. There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 50 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact The resolution for this F&O includes.

For SCA4, In conjunction with AS08 the success criteria for the key safety functions were added for each event tree in Section 4.0. The success criteria of the key safety functions are not unique to each modeled initiating event.

For SC-C1, Actions for AS08 meet this requirement.

For SC-C2, the documentation as updated for the F&Os meets the requirement. Appendix D is improved by adding specific references to the MAAP runs as part of F&O 19.

19-SC-B1 19-SC-B4 19-SC-C2 MAAP analysis is not referenced or documented clearly.

Specific MAAP runs were cited in Appendix D.

Appendix D sections were cited in Section 4.0.

This will reduce the amount of revisions required the next time the MAAP runs are updated. The documentation cross-referencing is as follows:

Section 4 >> App. D >> App. F.

Resolution of this F&O is addressed by providing guidance for the layout of specific MAAP references.

There is no impact to the 5b application.

20-SC-A6 Section 4 and Appendix D do not clearly connect EOP to the success criteria and event trees EOP references were cited for each safety function along with the safety function success criteria in section 4.0. The EOP references are already in Appendix D for the major actions discussed.

Resolution of this F&O added EOP references for each safety function/success criteria. There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 51 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact 21-SC-A5 Review SGTR and AFW success criteria to ensure stable end states after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months The AFW long term availability is already addressed in Section 4.0. The reference to the Appendix G calculation has been added regarding CST inventory and depletion.

An analysis for RWST depletion is already included in Appendix D.8.3, A cross reference was added to section 4.0.

The model assumes core damage based on failures during the mission time, regardless of if the core damage occurs after the end of the mission time. Therefore, the mission time measures the time that mitigating functions are available and therefore, stable. This is already addressed in Section 10. No mission times are extended beyond 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to preclude core damage. If RWST inventory runs out prior to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , but core damage occurs after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , core damage is assumed based on a failure to maintain a stable state. However, available time to recovery RWST makeup is based on the available time prior to core damage regardless of the mission time.

Additionally, a calculation reference for success of branch events #XS-CC and #DS-CC was added. The citation is for Appendix G calculation RSC 06-13 HNP RHR Cooling Study Update. This document supersedes RSC-97-15.

Resolution of this F&O added cross references linking relevant analysis.

There is no impact to the 5b application.

22-SC-B2 Verify that engineering judgment is used appropriately.

Engineering Judgment was reviewed as part of the Uncertainty analysis, and the results of the evaluation are included in the Uncertainty Analysis appendix.

Resolution of this F&O updated documentation of the uncertainty analysis. There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 52 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact 23-SC-B5 In Appendix D the success criteria is compared to similar plant designs, this is integrated throughout the document, but the data is from IPE information and should be updated with current information.

A survey of PSA success criteria was solicited from Summer, Beaver Valley 1 & 2, Farley 1 & 2, and North Anna 1 & 2. The survey results for PWRs were reviewed and changes were incorporated into the comparison of plants success criteria throughout Appendix D. Tables for comparison of S2 and S1 LOCA criteria were added also.

Comparisons did not result in any HNP PSA model changes.

Documentation was updated to resolve this finding. There is no impact to the 5b application.

24-SC-C3 Uncertainty analysis may need to be improved.

Ninety-three (93) assumptions were identified in Section 4 and Appendices D, F, and G. They were evaluated to determine their effect on PRA results. The 93 assumptions apply to either accident sequence definition or success criteria. Because accident sequences and success criteria are interrelated in the PRA document, they were not separated in the identification and evaluation of assumptions.

An additional 48 assumptions were identified for Appendices H (ISLOCA) and R (LOSP Recovery). They were evaluated for their effect on PRA results.

Results of the evaluation are included in the Uncertainty Analysis appendix.

Resolution of this F&O included additional analysis and documentation of assumption and uncertainty. No further analysis needed for the 5b application.

25-SY-A3 Not all of the information requested by this requirement was included in the model and the notebooks. Need to include minimum instrumentation required for successful control, System notebooks were reviewed to determine consistency in detail of required instrumentation for operation of the system. Variations in level of detail are appropriate for level of instrumentation required for each system.

The BE file was reviewed to identify instrumentation Instrumentation modeling and documentation within system notebooks were updated, and all

U.S. Nuclear Regulatory Commission Page 53 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact this is going to be helpful for fire risk analysis. No information found about component operability and design limits, need to add this to the notebooks.

modeled but not in the notebooks. New modeled instrumentation to provide placeholders for multiple hot shorts was added to the system notebooks.

Tech. Spec.s were reviewed to identify imitating conditions of operation on each systems instrumentation to determine modeling deficiencies. No new instrumentation was identified for discussion in the system notebooks.

System Descriptions were reviewed to identify the available control room instrumentation. Information on design basis and limits of instrumentation is omitted from notebooks because PSA assumptions are that systems operate as designed and DBDs are generally cited in the system notebooks reference section. In addition, instrument related trips of components are discussed in system notebooks.

The following changes were made:

A.1 HHSI - Added instrumentation available to identify a loss of letdown cooling event. The discussion on loss of letdown cooling was expanded. Added instrumentation related to letdown LOCA to RCDT and charging with letdown isolation induced PZR PORV LOCA.

A.2 RHR - No change A.3 PSI - Minor correction to control discussion A.4 ESFAs - Added list in instrumentation section of instrumentation modeled including new instrumentation gaps were closed.

There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 54 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact added for fire concerns.

A.5 AFW - Added SG level instrumentation discussion used to control AFW flow and listed instrumentation. Added discussion on SG pressure instrumentation that can isolate AFW. Same instrumentation was added to the ESFAS system.

A.6 CFC - No change A.7 SG Relief - Added SG level and pressure instrumentation discussion. Added discussion on SG pressure instrumentation that can isolate main steam.

Same instrumentation is modeled in the ESFAS system.

A.8 RCS - Expanded discussion on PZRs level and pressure instrumentation. Discussed which PZR instrumentation is modeled in the ESFAS system.

A.9 ESW - Added instrumentation related to room cooling A.10 CCW - Organized discussion and added instrument loop for letdown cooling valve.

A.11 EDG - No change A.12 VDC - Added sentence stating that there is no control/protective instrumentation for PSA purposes.

A.13 Inst Power - Added sentence stating that there is no control/protective instrumentation for PSA purposes.

U.S. Nuclear Regulatory Commission Page 55 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact A.14 Instr Air - Added to discussion that all instrumentation providing control and trips are within the compressor and dryer component boundaries. Listed trips and instruments.

Added tag numbers to header pressure instrumentation and PORV accumulator instrumentation available in the control room.

A.15 HVAC - Added instrumentation for switchgear room AHU flow switches as required for new switchgear room cooling model.

A.16 CI - No changes A.17 CT - Added modeled and non-modeled instrumentation A.18 DW - Corrected discussion about automatic control of RWMST level.

A.19 AC - Added pointer to ESFAS for undervoltage sensing relays. Added discussion on breaker position indication on MCB and why not modeled.

A.20 MFW - Identified instrumentation that would cause trips of pumps, Listed instrumentation used to control SG level but that did not need to be modeled.

A.21 NVDC - Added sentence stating that there is no control/protective instrumentation for PSA purposes.

U.S. Nuclear Regulatory Commission Page 56 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact A.22 CVCS - Added instrumentation related to boration, letdown, makeup, charging, and seal injection.

A.23 NSW - No change 26-SY-A4 SR says: PERFORM plant walkdowns and interviews with system engineers and plant operators to confirm that the systems analysis correctly reflects the as-built, as-operated plant.

No checklists, interview sheets, etc. were found to indicate what was done. Suggest they be found or developed.

Plant walkdowns and interviews have been conducted for every major development of the PSA. For the IPE, these walkdowns included spatial and HRA walkdowns to name a few. The pertinent information was included in the system analysis and HRA analysis or other relevant analysis documentation. For internal flooding, the insights from the flooding walkdowns were included in Appendix F. For the IPEEE, walkdown sheets are retained in the historic documentation.

In general for applications, such as Maintenance Rule, SDP, or MSPI, information obtained by interview or walkdown is documented with the analysis or application.

It should be noted that interview and walkdown documentation is not considered to have the authoritative weight as does plant specific design documents and are therefore considered secondary with regard to determining a modeling approach.

In an effort to make walkdown information more readily accessible, Appendix W, Walkdown Documentation, has been created to document information from walkdowns made to meet this requirement and for the fire analysis and other plant walkdowns that can be documented in the future.

Resolution of this F&O added Walkdown documentation to allow for the information to be more readily available. There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 57 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact 27-SY-A8 27-SY-B11 Need to augment discussion of boundaries and data development to clarify whether and how data were developed separately for valve bodies and operators when those two elements are modeled separately.

Need to check, augment modeling of permissives and interlocks. See for example pressure interlock for RH-1, RH-2, containment sump suction valves, charging suction, etc.

A discussion of component boundaries was added to Appendix B.

There are explicit type codes and data development sheets for generic and plant specific data associated with whole valves and valve operators for both demand and time dependent standby failures. Plant specific data was collected for AOVs, HOVs, and MOVs.

Section 10 paragraph 5.11 states that interlocks are modeled explicitly. Interlocks may be pressure/temperature permissives or valve position limit switches. Failures would include, drifting, failure to open/close, spurious operation, or miscalibration. If the interlock is between two valves, the recommended approach is to model the valves required to change positions. If the limit switches are unique to the interlock and not to the installed valve operation, then the limit switch needs to be modeled uniquely. This is especially important when the limit switch is exposed at a different frequency than the installed valve.

The RHR hot leg suction valves interlocks include a low pressure permissive (RCS pressure (PT-402, 403), closed valve interlocks for the RWST (1SI-322 and 1SI-323) and CSIP suction (1RH-25 and 63).

The CSIP suction from RHR has the reverse interlocks on RHR hot leg suction and the alternate mini-flows must be closed.

Interlocks between CSIP suction paths to the VCT or Resolution of this F&O included adding component boundary discussion and details regarding permissives and interlocks to the documentation.

There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 58 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact RWST include a permissive for the respective train VCT valve to close once the RWST valve is open.

ESW valves are interlocked with the associated pump.

Failure of a pump to start is a minimal failure. Failure of the valve to change state due the interlock is counted as a valve failure.

28-SY-A17 SR says: INCLUDE in either the system model or accident sequence modeling those conditions that cause the system to isolate or trip, or those conditions that once exceeded cause the system to fail, or SHOW that their exclusion does not impact the results. For example, conditions that isolate or trip a system include:

(c) adverse environmental conditions (see SY-A20)

No evidence was found that adverse environmental conditions other than floods were evaluated. For example, it is unclear whether an evaluation was performed to confirm that a primary PORV would work in a post-LOCA This F&O has been addressed by resolutions for AS-17 A section to each notebook for environmental effects on equipment has been added.

Resolution of this F&O added documentation for environmental effects. There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 59 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact environment (f&B is credited for small LOCAs). Perform and document evaluations.

29-SY-A19 SR says: IDENTIFY system conditions that cause a loss of desired system function, e.g.,

excessive heat loads, excessive electrical loads, excessive humidity, etc.

No evidence identified that this was performed for excessive humidity. Some evidence found that other conditions were evaluated. Update / upgrade evaluations and documentation This F&O is largely addressed by F&O AS-17.

The system notebooks already include a discussion of the mechanisms for instrumentation induced trips of the systems; no further action is required in that regard.

Heat loads considerations are addressed in the HVAC analysis, and the system notebook system dependencies include HVAC as a dependency. Switchgear room cooling was addressed under separate F&O.

Excessive heat loads due to phenomenological issues such as MSLB and LOCA are addressed in F&O AS-17.

The effect of excessive heat loads on other equipment due to equipment failures is not considered to be credible because plant areas are generally large or open where there are large motors.

Excessive electrical loads can occur if a motor overloads or if additional loads are aligned in a non-design configuration. For motor overloads, breakers include protective trips that protect the motors and the bus. These protective trips are not typically modeled due to their low failure probability. Motor overloads are modeled in the Resolution of this F&O involved adding additional documentation.

There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 60 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact component boundary as reliability data. There are no recovery actions that align equipment in an unanalyzed configuration.

To protect the EDG from starting overload, the bus loads shed. This is explicitly modeled in the PSA due to consequence. Bus failure by short circuit is another bus overload mechanism that is modeled. There are no overload conditions identified outside of these existing conditions.

Regarding excessive humidity, the resolutions to F&O AS-17 addresses phenomenological humidity concerns within the containment and main steam tunnel. For LOCA and MSLB, the equipment in those areas are already analyzed for humidity, temperature, and radiation as part of the licensing basis. There are no other areas where excessive humidity are expected for accidents modeled in the fault trees.

For accidents developed by a specific analysis, ISLOCA and Internal flooding, the effects of humidity are bounded by the existing analysis.

The flooding analysis included assessment of the impact of floods and sprays on equipment. Humidity from internal flooding is not a limiting concern due to low temperature water. Water depth or spray is a limiting concern. Piping failures following an accident are not considered credible and are not modeled, so concerns for humidity are excluded.

U.S. Nuclear Regulatory Commission Page 61 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact For ISLOCA, no credit for mitigations of a pipe break in the RAB is given, so no further analysis is required for excessive heat or humidity loads.

The above discussions were added to the system notebooks where appropriate.

A discussion of flooding and humidity effects from RWST pipe break flood was added to the RHR system notebook.

A statement to the effect that the effects of flooding, spray, and humidity are addressed in the internal flooding notebook and was added to system notebooks for ESW, NSW, CSIP, CCW, AFW and ac-power.

30-SY-A20 30-SY-B15 SR says: TAKE CREDIT for system or component operability only if an analysis exists to demonstrate that rated or design capabilities are not exceeded.

Operability considered in sense of can be used successfully, not Tech Spec definition.

Consider PORV operability, containment sump level indication, etc. in post-LOCA environment. Also, failure of Resolution for AS-17 addresses containment component operability for LOCAs and main steam tunnel component operability for MSLB.

NPSH issues for small LOCA with no containment heat removal have been analyzed in MAAP analysis. For example, two bounding cases, RSC-CALMAP-2001-1112 for LBLOCA and RSC-CALMAP-2001-1116 for S1 LOCA both were run with no containment cooling and demonstrated that NPSH was not an issue to the RHR pump suctions. This is verified by absence of the inadequate NPSH flag in the MAAP run summary files.

Another analysis, (RSC-06-13) indicates that with secondary heat removal and no containment cooling, the Resolution of this F&O added the necessary references and additional calculations. There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 62 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact containment heat removal systems (spray, fan coolers) is not modeled as causing inoperability of SSCs in containment. Evaluate SSCs in containment to ensure that they could continue to function in this environment.

See also SY-B17: (may need to address steamline break environment in some plant spaces) IDENTIFY SSCs that may be required to operate in conditions beyond their environmental qualifications.

INCLUDE dependent failures of multiple SSCs that result from operation in these adverse conditions. Examples of degraded environments include:

(a) LOCA inside containment with failure of containment heat removal (b) safety relief valve operability (small LOCA, drywell spray, severe accident) (for BWRs)

(c) steam line breaks outside containment (d) debris that could plug HHSI pumps can draw from the RHR pump heat exchangers with no CCW cooling. The latter of these calculations is discussed in the success criteria notebook, Appendix D. These calculations have been referenced in the RHR and HHSI notebooks.

NPSH issues for HHSI on a loss of VCT has been added to the system notebooks as an assumed failure. A calculation of the time to VCT overheating or loss of level was added to appendix G.

RHR suction swaps automatically on RWST level, not containment sump level, so sump level indication failure from environmental concerns is not a failure of RHR. A discussion was added to the RHR notebook regarding containment environment effects on RHR system signals.

Room cooling concerns are addressed by specific analyses.

U.S. Nuclear Regulatory Commission Page 63 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact screens/filters (both internal and external to the plant)

(e) heating of the water supply (e.g., BWR suppression pool, PWR containment sump) that could affect pump operability (f) loss of NPSH for pumps (g) steam binding of pumps 31-SY-B8 SR says: IDENTIFY spatial and environmental hazards that may impact multiple systems or redundant components in the same system, and ACCOUNT for them in the system fault tree or the accident sequence evaluation.

Example: Use results of plant walkdowns as a source of information regarding spatial/environmental hazards, for resolution of spatial /

environmental issues, or evaluation of the impacts of such hazards.

No evidence of plants walkdowns (checklists, evaluations, etc.) were found.

Need to develop these.

Plant walkdowns and interviews have been conducted for every major development of the PSA. For the IPE, these walkdowns included spatial and HRA walkdowns to name a few. The pertinent information was included in the system analysis and HRA analysis or other relevant analysis documentation. For internal flooding, the insights from the flooding walkdowns were included in Appendix F. For the IPEEE, walkdown sheets are retained in the historic documentation.

In general for applications, such as Maintenance Rule, SDP, or MSPI, information obtained by interview or walkdown is documented with the analysis or application.

It should be noted that interview and walkdown documentation is not considered to have the authoritative weight as does plant specific design documents and are therefore considered secondary with regard to determining a modeling approach.

In an effort to make walkdown information more readily accessible, Appendix W, Walkdown Documentation, has been created to document information for meeting this Resolution of this F&O added documentation of plant walkdowns.

There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 64 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact requirement and for documenting other walkdowns.

32-SY-B13 SR says: DO NOT USE proceduralized recovery actions as the sole basis for eliminating a support system from the model; however, INCLUDE these recovery actions in the model quantification. For example, it is not acceptable to not model a system such as HVAC or CCW on the basis that there are procedures for dealing with losses of these systems.

This was apparently done for the switchgear rooms. Need to correct. Check if other instances occur.

Four cases of crediting proceduralized and non-proceduralized recovery were found to be credited or assumed insignificant contributors. They include:

1. Loss of Switchgear Room cooling: The original assumption was that operator had time to open doors to preclude room heat-up and no model was necessary. A detailed room cooling analysis was performed and the determined requirements for success were included in the model. The potential for procedure changes is in review to reduce the impact. An operator action with value of 1.0 was added to determine the potential risk reduction of potential procedure changes.

2. Loss of ESW pump room cooling: Existing conservative room heat-up calculations indicate a loss of ventilation will cause the ESW pumps to overheat. This analysis was assumed to be conservative and not best estimate. Based on engineering judgment, room cooling was not modeled.

In the absence of a detailed room heat-up analysis, it was considered prudent to include the requirement in the model. Given there is no procedural guidance or HVAC analysis, there is large uncertainty if success is possible through alternate ventilation methods. An operator action with probability of 1.0 was added to determine the potential importance and benefit of performing further analysis.

3. Loss of letdown cooling: There was an assumption that loss of letdown cooling would be mitigated by operations Resolution of this F&O included updating the room heat-up analysis and documentation.

There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 65 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact and not affect CSIP operation. However, further review indicated this is a potential loss of CSIP suction if CCW is lost to the letdown heat exchanger, resulting in introduction of steam to the VCT. Calculations for available response time show that this is a potentially significant event. The model was updated to model this failure and take credit for existing procedural guidance for manual letdown isolation.

4. Loss of VCT level control. A similar assumption was found for LT-112/115, VCT level. However, spurious high level would result in a flow diversion of VCT makeup to the RHT. If operators failed to manually isolate the flow diversion, this would also fail auto swapover to RWST so a failure of the running CSIP would occur on loss of suction as the VCT depletes. The presence of only one train of level indication on the MCB exacerbates this failure if that is the train that malfunctions to the high level state. Like item 3, the available response time is very limited. The model was updated to model this failure and take credit for existing procedural guidance, as well as simulator training on this scenario.

Documentation was updated in system notebooks and Room heat-up analysis accordingly.

33-SY-C2 SR says: DOCUMENT the system functions and boundary, the associated success criteria, the modeled components and failure modes including human actions, and a description of modeled dependencies Resolution includes:

(d) No specific action is required; system boundary and success criteria are documented. Other F&Os will address operability considerations and assumptions. In general, design basis is adequate.

Resolution of this F&O included reviewing LERs and adding documentation.

There is no impact to the 5b

U.S. Nuclear Regulatory Commission Page 66 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact including support system and common cause failures, including the inputs, methods, and results. For example, this documentation typically includes:

(d) information and calculations to support equipment operability considerations and assumptions (e) actual operational history indicating any past problems in the system operation (j) component spatial information (o) results of the system model evaluations (p) results of sensitivity studies (if used)

(q) the sources of the above information, (e.g., completed checklist from walkdowns, notes from discussions with plant personnel)

Several of these elements were not found. Add to system notebooks.

(e) LERs were reviewed and information was added to system notebooks (f) There is some component spatial information in the system notebooks. The fire walk downs are using a check list that includes spatial information. This will be documented as a separate Appendix W. If considered relative to internal or flooding events, additional information will be added to the system notebooks.

(o & p) The current fault tree structure does not support system model quantification. The existing system notebooks include system level insights. The summary document includes relative component and system level importance. No other action is required.

(q) The system notebooks already include a complete list of references. The check list from the walk downs will be included in a separate Appendix.

application.

U.S. Nuclear Regulatory Commission Page 67 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact 34-SY-C3 SR says: DOCUMENT the key assumptions and key sources uncertainty associated with the systems analysis.

Key sources of uncertainty were not identified. Add this information.

Four hundred twenty-five (425) assumptions associated with the systems analysis (Appendices A.1 through A.23) were identified. They were evaluated to determine their effect on PRA results.

Results of the evaluation are included in Appendix U, Uncertainty Analysis.

Resolution of this F&O compiled all assumptions and added documentation on uncertainty analysis. There is no impact to the 5b application.

52-HR-HLR-A The pre-initiator human reliability analysis does not appear to meet HLR-A in several aspects. This F&O applies to all aspects of the pre-initiator analysis.

1. There is no evidence of a rigorous search for pre-initiator alignment errors caused by maintenance and testing activities as required by A1.

2. There is no evidence of a search for single activities which can affect two redundant trains as required by A3 and B2.

3. The screening process for mis-calibration errors is not identified as required by A2.

A new calculation was created to upgrade pre-initiator F&Os to ASME/ANS Standard Capability Category II.

Resolution of this F&O created a new calculation to update pre-initiator HRA to meet the Standard. There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 68 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact

4. The quantification process for the mis-calibration errors does not provide enough detail to be reproducible. The quantification process does not meet the requirements of D2, D3, D4, D5, D6, D7. Based on these observations, the original pre-initiator analysis does not meet the ASME criteria. A complete pre-initiator analysis should be done from the beginning.

53-HR-D1 Spreadsheet shows several RHR misalignments that are quantified from NSAC-154.

These are not included in the final report. NSAC method may not be acceptable based on the SR.

The NSAC method provides detailed recovery event trees /

fault trees that incorporate the individual elements using the SHARP1 and NUREG/CR-1278 methods for the ISLOCA pre-initiator HRA events. This is sufficient to meet the objective of accounting for systematic methods of determining pre and post initiator actions.

Resolution of this F&O added documentation to justify the use of the NSAC method.

There is no impact to the 5b application.

54-HR-G6 No evidence of REVIEW of the HFEs and their final HEPs relative to each other to check their reasonableness given the scenario context, plant history, procedures, operational practices, and experience was performed.

The methodology used forces consistency given scenario context, procedures, operational practices and timed responses. The final HFEs and HEPs were reviewed against each other for consistency.

Resolution of this F&O included review and documentation of final HFEs and HEPs. There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 69 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact 55-HR-G9 From the Table in Annex B of Appendix E, it appears the error factors of the HEP values are estimated at 10 if the HEP is less than 1E-3 and 5 if the HEP is greater than 1E-3. This is OK< except for some HEP greater than.1. In fact, there are 2 HEP at.5, with an EF of 5, which makes the upper bound on a lognormal 3.15.

Some HEPs for Cr actions have EF of 3.

Suggest the EF on HEP >.1 be changed to 3 and EF on HEP>

.5 be changed to 1.0. If these are input into UNCERT with a lognormal distribution, the answers will be incorrect.

HEP error factors in the CAFTA database were adjusted.

Calculation was updated to explain special cases for error factors at end of summary Table E-6.

Resolution of this F&O included adjusting HEP error factors in the CAFTA database and updating documentation.

There is no impact to the 5b application.

56-HR-H2 Tables E3 and E4 allow a Cr type event to be used if there is no procedural guidance directing the action. This is in conflict with the SR requirements for Category II. It is not known if any Cr actually lack a corresponding procedure. This is a comment about the HNPPRA process for identification of Cr actions.

Credit for non-proceduralized recoveries WITHOUT JUSTIFICATION was removed from calculation and model.

Element HR-H2(a) allows for justification if procedures or training are lacking for an HRA. Non-proceduralized recoveries OPER-22 and OPER-42 remain with justification.

Resolution for this F&O removed all non-proceduralized recoveries without justifications. There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 70 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact Suggest revision of Table E-3 to eliminate credit for actions with no procedure.

57-HR-H2 A review of the HEP dependency combinations generated several comments on the resulting combinations.

OPER-7: The use of this HFE and the definition of the HFE should be made clear, which may result in different timing and a different numerical result.

The HFE appears to be a pre-initiator action. The action occurs when a VCT valve spuriously closes to the CSIP suction without the concurrent opening of a RWST valve. The running pump is assumed to fail due to loss of suction. The operator has 8 minutes to diagnose the loss of suction, provide alternate suction to the other pump and start the standby pump. The calc sheet states a 13 minute time window, which would imply he OPER-7 Comment Resolution:

Clarify the wording to:

Upon the loss of Component Cooling Water, the Reactor Coolant Pumps require seal injection in order to avoid a Reactor Coolant Pump Seal LOCA. The major contributor to this is the spurious closure of the Motor Operated Valves 1CS-165 or 1CS-166. This action recognizes that the running CSIP would fail on loss of suction and that a suction flow path would need to be re-established and the alternate CSIP would need to be started in order to preclude a seal LOCA.

The event addresses the potential that the flow path to the running charging pump can be lost without a corresponding swap of the CSIP source to the RWST. The VCT valve closes and blocks flow. The loss of suction will fail the running pump if not acted upon within 5 minutes. The failure of the operators to identify the loss of suction before starting the standby CSIP is assumed to result in the failure of both CSIPs. The timing assumes the pump is running.

The most critical timing is for the loss of Reactor Coolant Pump seal injection with a loss of CCW at the same time.

In this case the operator has 13 minutes to get a CSIP Resolution of this F&O addressed issues concerning the individual and combination operator actions.

Documentation was updated to reflect the updated analyses. There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 71 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact has a chance to save the running pump, which is not the case. It should also be noted that the 13 minute time window is for loss of RCP seal cooling.

This event only fails seal injection flow. CCW to the thermal barrier is not affected by this event.

OPER-67: There may be a typo in the calculation sheet for this event. The write-up lists 3 procedures APP-ALB-023, AOP-26, AOP-22. AOP-22 should be AOP-26.

OPER-68: This event is not used in the model and should be removed from the documentation to avoid confusion.

OPER-70: This action is for installation of the spare CSIP pump after failure of the running pump.

Spare pump installation requires 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . The Pc calculation uses 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months as the time available for the action to be completed (basis not running with a suction source. The response time includes review of alarm procedure (APP-ALB-006) and the RCP abnormal procedure AOP-0018. Then to determine the cause of the alarm is low flow and determine the cause is loss of suction flow path. Thus 5 minute response time is appropriate as walked through with operators on 11/1/05.

This AOP-018 directs the operator to Attachment 4. will also direct the establishment of a suction flow path.

The lack of water to the running pump should result in a lack of charging flow and a Charging Pump Disch Header High-Low Flow alarm (ALB-6-1-1). The response for this alarm is to check high versus low and for low flow (charging relative to letdown), the suction alignment must be checked. However, it does not stop the pump and if the failure is due to valve faults (dominant case), it is reasonable to assume that the running pump will fail.

However this alarm procedure will have to suction path check and provides guidance to restore the suction path before starting the standby CSIP. Additionally the operators will enter AOP-003, Malfunction of Reactor Makeup Control, if the isolation of the VCT is due to instrument malfunction. If the VCT level is being maintained then the operator will be directed to recover using the VCT and open the applicable suction valves.

Note that OPER-42 is a closely related action that is currently listed as non-proceduralized action. PATH-1 step 8 may provide the indication before the pumps fail.

U.S. Nuclear Regulatory Commission Page 72 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact explained). In order for this event to be meaningful in the sequence of events, there must be a sequence where the plant can be without HHSI for 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , which is not likely. In addition, if the HFE is used during a LOCA or feed and bleed, it must be shown that plant personnel have access to the CSIP room during the LOCA. If this is a pre-initiator HFE, then it is not necessary, because the unavailability of the standby CSIP will include this contribution.

OPER-30 & OPER-64: These HFEs appear to be related and should appear in the same sequence of events. However, they have different timing, procedural direction and probabilities. OPER-30 is failure to establish long term injection source to the RWST from the BAT system. The HEP is 7E-5.

OPER-64 is for opening Demin valves to the RMWST on Low water level. The HEP is 1.7E-3.

OPER-42 wording:

If an SI signal occurs the two supply valves from the volume control tank (VCT) to close and the two supply valves from the RWST to open. If the RWST valves do not open, the VCT will quickly run out of water and the CSIP pumps will fill with vapor. This can cause the failure of the CSIP pumps. It is assumed that the pumps can run without damage for ~5 minutes.

There are annunciators for pump trouble but that would not occur until after pump failure. Also, Path-1 directs operators to check the valve alignment if insufficient injection is present but it occurs too late to be effective.

The operator action addresses the potential that the operators will diagnose the situation based on valve positions for the CVCS valves that are displayed by red and green lights above each valve switch on the control board. The operators must notice that at least one of four of the valve positions are incorrect. It is believed that if they see one mis-positioned valve, they will check and correct the other three valves associated with this action as needed. The operators are trained to scan the control board repeatedly as soon as they get an initiator. However, it is not assured that they would select the CVCS panel as their first selection.

OPER-67 Comment Resolution:

Typo corrected in documentation.

U.S. Nuclear Regulatory Commission Page 73 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact OPER-D21: Combination of OPER 41 and OPER 30. The write-up states there is an intervening success of HHSI initiation. But this is not true.

The HHSI is initiated very early in response to the SGTR. There are no obvious successes between failure of OPER-41 and OPER-30. The time between these events is long and may still lead to zero dependence.

OPER-D50: Combination of OPER-11 (fail to switch inst.

bus to back-up supply) and OPER-26) fail to control AFW from control room. The OPER 26 event is for operation of AFW from the main control room. The OPER-11 event occurs after an instrument bus, as directed by ALB-015. With no instrument power, the operator must go locally to the AFW pump and manipulate the controls by hand. The correct HEP for this situation should be OPER-66, which has a probability of.012 rather than OPER-68 Comment Resolution:

OPER-68 removed from the model.

OPER-70 Comment Resolution:

Plant has been modified and OPER-70 has been updated since comment was made. Comment is no longer relevant.

Of other note, the execution phase of the recovery has three more required actions for locking open 1CS-748 and 1CS-749 and locking closed 1CS-747. All of the actions except for closing the transfer switch have independent verification resulting in a HEP of 3.7E-3 instead of 7.3E-3.

OPER-30 & OPER-64 Comment Resolution:

The nominal time for the OPER-30 action is 300 minutes that would start within about 30 minutes of the SGTR diagnosis; nominal time for OPER-64 is 432 minutes with a cue time at 399 minutes into the event. There are different alarms for cues. There are no intervening successes in the scenario. The long time between actions could lead to the events being considered independent.

OPER-D21 Comment Resolution:

The nominal time for the OPER-30 action is 300 minutes; nominal time for OPER-41 is 120 minutes. There are different alarms for cues. There are no intervening successes in the scenario. The long time between the events results in the events being considered independent.

OPER-D50 Comment Resolution:

OPER-11 and OPER-26 are mutually exclusive. The recoveries using these two events should be given the HEP

U.S. Nuclear Regulatory Commission Page 74 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact 8E-4 (for OPER-26). This is not an HRA problem, but is more likely a problem in sequence development.

The OPER-26 HFE should not be used in the same logic combination as the OPER-11 event.

OPER-T3: Combination OPER-35 (Fail to Manually Start AFW from control room); OPER-42 Align CSIP Suction for SI; OPER Take Local Control of TDAFWP. The timing of these events as stated in the dependency analysis is not correct. The first event is OPER-35. The second event should be OPER-66. If both of these fail, the next step is feed and bleed whereupon the failure of CSIP suction may occur. See OPER-T4 for correct order of similar events.

OPER-T5: Does not appear in the RAW base cutsets. Should be removed from documentation.

for the combination of OPER-11 and OPER-66. OPER-D50 is addressed in rule recovery file using OPER-D20 value of 7.8E-3. Currently neither OPERD50 nor OPER-D20 show up in the cutsets at a 1E-11 truncation level.

OPER-T3 Comment Resolution:

The need to prevent failing the CSIP pumps on loss of suction occurs before taking manual control of AFW outside of the control room. Order is correct.

OPER-T5 Comment Resolution:

Agree that it could be removed from rule recovery file, but keeping in case it shows up under increased truncation or with components out of service.

OPER-Q11 Comment Resolution:

The logic is convoluted. The spurious SI results in a seal LOCA which eventually requires SI to actuate to prevent core damage.

OPER-Q13 Comment Resolution:

Recovery has a intervening successful local start of the TDAFW pump OPER-66.

OPER-Q14 Comment Resolution:

The Harris thermal hydraulics analysis has a success path with secondary cooling and just RHR recirculation without service water.

U.S. Nuclear Regulatory Commission Page 75 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact OPER-Q11:

OPER-38 fail to manually initiate SI OPER-42 fail to align CSIP suction OPER-20S fail to reopen RCP CCW isolation valves OPER-4 fail to open containment sump valves.

This combination of events is strange. The write-up states the initiating event is a plant trip with spurious SI. If so, then there is no reason to initiate SI.

The sequence results in a seal LOCA. Same comment applies to Q-12.

OPER-Q13:

OPER-35 fail to manually start AFW OPER-46 fail to align MFW OPER-26 fail to control SG level OPER-3 fail to start feed and bleed.

This combination does not make sense, unless there is an

U.S. Nuclear Regulatory Commission Page 76 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact intervening success of OPER

66. The first two events fail all AFW, which leaves no place for OPER26.

OPER-Q14:

OPER-10 Fail to start ESW OPER-19 Failure to start NSW OPER-9 Failure to initiate RCS cooldown OPER-17 Fail to establish HHSR This combination appears does not make sense, unless it appears in a non-minimal LERF sequence. The first two events cause loss of all ESW. That means CCW is also lost. A seal LOCA occurs, with no way to remove decay heat.

35-DA-B1 All valves and other non-major equipment uses generic data grouped by type. Category II requires consideration for service conditions.

Plant specific data scope was expanded to include:

CSIP swing pump, CCW swing pump, motor-operated valves, pneumatically-operated valves, hydraulically-operated valves, pressurizer PORVs, SG PORVs, heat exchangers, batteries, battery chargers, instrument air compressors, startup transformers and axial fans.

Service conditions are accounted for by using plant specific data. For larger populations, such as MOVs, service The use of plant-specific data was expanded, and additional components were included in the data analysis There is no impact to the 5b application..

U.S. Nuclear Regulatory Commission Page 77 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact conditions were evaluated for cases with raw water and demineralized water. There were no failures associated with raw water and thus, no insights gained by separating the grouping. MOV failures are dominated by motor-operator failure and not valve body failures. In general, the service conditions are best modeled by modeling the exposure time. Both demand failure rates and time dependent failure rates were developed. The criteria for use of the different failure rates were updated in Appendix B, Data, and in the Section 10, Ground Rules.

36-DA-B2 No discussion of outliers was found in the documentation.

There were no outliers found with regard to component unavailability. With regard to exposure times and environmental effects, the system notebooks are considered the appropriate location to document outliers.

The system notebooks include tables with component exposure times and reference test or inspections. These tables were made current and each notebook includes a discussion of infrequently tested equipment. There are no other outliers identified, other than infrequently tested components.

Components tested at least every refueling cycle are not considered outliers.

The most notable outliner is the ESW to AFW supply line.

These valves are periodically inspected but over a long period of time. Their valve bodies are modeled separately.

No action was required, except to update the current documentation.

Resolution of this F&O updated existing documentation with regard to outliers.

There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 78 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact 37-DA-C1 HNP uses generic parameter estimates for unavailability.

Generic estimates are only used for the ESFAS system.

These values are well documented.

The ESW headers generic unavailability is subtracted from the system train plant specific unavailability so that the total remains plant specific. The remainder of the unavailability data is plant specific. No further action is required for this F&O.

Documentation on the unavailability estimates used was clarified. There is no impact to the 5b application..

38-DA-C5 Very little discussion could be found about rules for counting demands and failures.

In general, pump starts were taken from OSI PI. Only one start is counted if multiple starts occurred during the same test (assumed less than 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months apart.)

For valve strokes, only the test stoke that is timed or used to place the component in service is counted. Returning the valve to its normal standby alignment is not counted during a test. (This detail is assumed based on time between strokes in OSI-PI, typically less frequent than 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .)

Resolution of this F&O added clarification on the collection of demands and failures. There is no impact to the 5b application.

39-DA-C10 The correlation of tests that are counted to model failure modes is not clear Discussion was added to correlate collected test data to modeled failure modes by defining failures that constitute a PSA functional failure, and a non-PSA functional failure.

Specifically, out-of-spec. stroke times are not PSA failures.

Component trips and subsequent restarts with no corrective action are not failures. This type of information was included in Appendix B.

Resolution of this F&O added discussion on the correlation of collected test data to the respective failure modes.

There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 79 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact 40-DA-C13 There is no discussion of coincident maintenance except for the identification of mutually exclusive events Coincident maintenance unavailability at HNP is controlled by the 12 week rolling schedule. Generally, only coincident maintenance within the same train is permitted. The protected train flags are mutually exclusive and prevent cross train maintenance in the model results. The potential for coincident maintenance in the same train is calculated in the fault tree as the product of two or more unavailability events. This is the extent of the analysis and no documentation is required.

Coincident maintenance unavailability is identified for swing trains with the A or B train components for CCW pumps and CSIPs. Data was collected for the coincident time periods and subtracted from the independent maintenance unavailability. The coincident events are modeled explicitly and are mutually exclusive with the independent events.

Another collected coincident unavailability is the alignment of the PORV block valves.

The coincident unavailability documentation was updated or added in Appendix B and the respective system notebooks.

The discussion of mutually exclusive events are documented in system notebooks.

Resolution of this F&O updated coincident unavailability documentation.

There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 80 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact 59-DA-D6 No discussion or evaluation was found regarding the consistency of CCF data to HNP component boundaries HNP meets the requirements of DA-D6. No action was required.

About half of the MGLs come from NUREG/CR-5497 and the other half from RSC 01-17. The underlying data used in NUREG/CR-5497 is not available. RSC 01-17 provides for many components a generic composite based on information related to similar component groups. To the degree possible, common cause components were mapped to equivalent HNP failure events. The following improvements were made:

A discussion of component boundaries was added.

Data source references were verified and corrected as necessary.

Component, MGL selection was corrected in some cases.

Updated MGLs data was used from NUREG/CR-5497 if available.

Resolution of this F&O included the addition of discussion on component boundaries. There is no impact to the 5b application.

41-DA-D7 There is limited discussion of the basis for determined data collection windows.

The reliability data collection windows is based on available OSI-PI data and extrapolated back to initial time period that maintenance rule functional failures were recorded. A discussion of the reliability data time window was added to Appendix B.

The availability data windows are based on MR unavailability performance monitoring group data and are not extrapolated. The goal was to collect as much data between 1996 and the end of 2005. Because the initial Resolution of this F&O included adding a section on the reliability data time window in the documentation.

There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 81 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact start date of recording unavailability varied from system to system, start windows varied from 1996 to 2000. Some unavailability data is no longer collected so that the window ended prematurely of 2005.

Appendix B includes a discussion of the various unavailability time windows.

42-QU-A2b SR says: ESTIMATE the mean CDF from internal events, accounting for the state-of-knowledge correlation between event probabilities when significant (see NOTE (1)).

No evidence found that this was commonly done. Investigate and redevelop data as required.

Normal uncertainty analysis has been run on revised model.

Reviewed cutsets to identify cutsets with multiple failures of the same type (TCs and CCFs) to determine any uncertainty correlations. There were no cutsets identified with the same type failure occurring in multiple systems.

Therefore, no variations in service conditions were reviewed to determine potential effects on the failure probabilities of similar components in different systems.

No outliers were identified.

Resolution of this F&O included assessment of the SOKC and the uncertainty analysis.

Documentation was updated. There is no impact to the 5b application.

46-QU-D3 Supporting Requirement QU-D3 requires:

The quantification results compared to other similar plants and identify causes for significant differences. For example: Why is LOCA a large contributor for one plant and not for another. The Quantification Notebook and other Notebooks do not have any evidence that Documentation of the comparison has been added to the HNP PRA Summary Document.

Resolution of this F&O added documentation of results. There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 82 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact this was done.

60-QU-E43 A more robust sensitivity analysis related to key assumptions is needed.

Forty-four (44) assumptions associated with data (Appendix B) were identified and evaluated to determine their effect on PRA results. Results of the evaluation are included in Appendix U, Uncertainty Analysis.

No assumptions were identified for the quantification process itself (Section 5).

Resolution of this F&O included review of assumptions and documentation of uncertainties. There is no impact to the 5b application.

58-LE-A4

1. The development of the event trees may not be sufficient to uniquely identify the conditions required for Level 2 analysis. This deficiency pertains to the ability to discern operability status of ECCS. The Level 1 event trees ask functional questions for events such as H, D, X, G. Functional failure could be caused by operator error, front line system or support system.

2. The Level 1 sequence is then assigned to a single CDB, depending on the set of failures assigned to represent the sequence.

The Level 2 analysis evaluated the status of the Low Pressure Injection (LPI) for each Plant Damage State (PDS) by a manual review of the dominant cutsets of each PDS (stated on page 76 of Section 8 of the PRA).

Therefore, for the baseline Level 2 analysis, the determination of LPI availability is accurate for all potentially significant LERF PDSs. 49-LE To exactly determine the status of the LPI system, another top event would need to be added to the Containment Safeguards Event Tree (CSET), with an additional question about LPI status added to the end of each branch of the CSET. This would double the number of CSETs from 18 to 36, thereby doubling the number of PDSs from 344 to 688.

Because the 344 PDSs are already a very large number to consider, it is undesirable to double this number to 688.

Therefore, some simplification is utilized in the Level 2 analysis, but the following evaluation demonstrates that simplification is acceptable.

Resolution of this F&O included an update of the Level-2 analysis and development of additional documentation.

There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 83 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact

3. The 28 CDBs are expanded into 344 PDS, through a process which was not documented for this review.

4. A split fraction for LERF is then calculated for each PDS and the split fraction is assigned back to the Level 1 sequence. It is not clear how the 344 PDS split fractions are assigned to the 28 CDBs.

5. It is also not clear how operability of low pressure systems is considered when they are not asked on the level 1 event tree.

6. It is not clear how the dependence of OPER-IV is maintained through the Level 1 and Level 2.

There are two independent trains of RHR, which provide the means for late LPI. If support systems are available, the failure probability of the RHR system is dominated by the common cause failures (CCFs) to start, run or valve failure.

From gate LINJ of HNP_06.CAF, these CCFs have probabilities of 2.00E-4, 2.50E-5, and 2.20E-5, respectively. The combined CCF probability of RHR is therefore 2.47E-4. Even if the system failure probability were on the order of 1E-3 (e.g., if one train was unavailable due to maintenance), the impact on the total LERF would be negligible when this probability is multiplied by the frequency of the PDSs. For example, a PDS with a frequency of 1E-6 would have a maximum possible effect on LERF of 1E-3

1E-6 = 1E-9. The real impact would be even lower.

Given that the independent failure of RHR is not a significant issue, the real question is how are supporting systems status considered for a given cutset. To consider this question, the similarity of supporting systems between RHR and Containment Spray injection are examined. Per gate S007 of HNP_06.CAF, the Containment Spray Pump A power dependencies are 125 VDC bus DP-1A-SA and 480 VAC bus 1A2-SA. Per gate L094, the dependencies for RHR Pump A are the same. Per gates S016 and L096, the Containment Spray Pump B and RHR Pump B also share power supplies (125 VDC bus DP-1B-SB and 480 VAC bus 1B2-SB). Since the Containment Spray injection is considered in the CSET end states, success of Spray injection means that the power supply for Spray injection is available, so power supply for RHR must also be available.

U.S. Nuclear Regulatory Commission Page 84 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact If the Containment Sprays failed to inject, then it is possible that the failure was due to support system failure. For the Harris Level 2 analysis, it will therefore be assumed that CSET end states M, N, O, P, Q and R (each has failure of spray injection) should indicate LPI unavailability. This is partially conservative in that the sprays can fail independently which would not cause LPI failure, but this conservatism is considered small and acceptable.

The Containment Event Tree (CET) in HNP_LEVEL_2-slm.XLS (sheet PDSFLAG), was then examined. As seen in cells T33 to T376, LPI is not credited (FL-LPI = 1) for any PDSs in which Containment Spray Injection is failed (CSET end states M, N, O, P, Q, R), except for 7M, 7P, 12M, 15M, all of which are shown in the spreadsheet in bold red, indicating that they contained no cutsets above the truncation. The only exceptions are B16N and B18R, which are not shown in red, but have FL-LPI set to 0. These two PDSs are SGTR, and the LPI status is not relevant.

Therefore, to ensure that LPI is not credited in any PDS for which Containment Spray injection has failed, HNP_LEVEL_2-slm.XLS (sheet PDSFLAG) cells T153, T156, T243, T297, T340 and T363 are all changed from 0 to 1.

Regarding the question of dependence of OPER-IV with operator actions in the Level 1 analysis, these actions can be considered independent. OPER-IV represents the operator action to open the PORVs late in an accident sequence when core damage is likely (high core exit thermocouple temperature). During an event, operators are

U.S. Nuclear Regulatory Commission Page 85 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact repeatedly guided to check the status of the critical safety functions, and a loss of core cooling directs to EOPFRC-C.1. The procedure repeatedly checks the status of secondary side cooling, which is failed in high pressure sequences. The cue for opening a Pressurizer PORV (core exit thermocouple temperature >1200°F) is independent of other cues for Level 1 operator actions, and the timing of OPER-IV is separate (i.e., later) from the Level 1 actions.

Therefore, OPER-IV is considered independent of the level 1 operator actions.

This evaluation has been added to PRA Section 8.5.2.1.

48-LE-D4 The requirement is to perform a realistic evaluation of secondary side isolation capability for SGTR accidents.

There are two observations discussed here.

1. SGTR (IE) events with MSIV fail to close are considered a LERF. No credit is given for the retention capability of the TSV, and main condenser.

Considering the SGTR sequences are 80% of LERF, this may be a conservative assumption. The HNP-PRA meets Category 1 in this regard.

1. Per gate #WR of the HNP_06.CAF fault tree, the MSIV failure to close contribution to SG isolation failure is 2.4E-3.

The contribution from the other component failures is (1.3E-3 + 7.7E-3 =) 9.0E-3. Therefore, the MSIV failure contributes only 2.4E-3 / (9.0E-3 + 2.4E-3) = 21% of the isolation failure probability. A detailed modeling fission product behavior in the TSV and main condenser would be difficult and contain large uncertainties since the systems would be exposed to conditions and particles for which they were not designed. Some portion of the 21% of isolation failures would still result a large, early release condition (a 50% success of holdup would yield approximately a 10%

reduction in SGTR LERF). Therefore, given the difficulty of modeling of fission product holdup and the fact that the reduction in SGTR LERF would be small, the conservative assumption is considered acceptable.

2. The Induced SGTR model developed in response to Resolution of this F&O added a discussion of analysis done for evaluation of secondary side isolation capability for SGTR accidents. There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 86 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact

2. For SGTR (IE) events with the SGSV cycling, the release is assumed to be small, based on MAAP analysis (which is acceptable). However, the probability of the SGSV failing to reclose is based in the Level 1 analysis. The duty cycle and environment of the SGSV during the core melt processes is not considered. The probability of.0077 for SGSV fail to reclose may not be appropriate for the Level 2 accident space. This aspect of analysis does not meet the SR.

Observation 49 evaluated the probability of a SGSV sticking open during the core damage progression. Event 2 of the ISGTR event tree (PRA Section 8.3.2, Figures 8.9 and 8.10) evaluated the probability of a stuck open SG relief or safety valve, given the large number of cycles (assumed to be 70 cycles) through the core damage progression. The ISGTR model evaluated the chance of a stuck valve occurring in any of the three SGs to be 0.15 (all SGs intact=0.85). Since there are 3 SGs, the probability that the stuck open valve would be in the SG with the SGTR would be 0.15/3, or 0.05. Therefore, those SGTR sequences in which there was no initial failure of SG isolation (Level 1 event tree top event W) will be assigned a 0.05 conditional probability of SG isolation failure during the progression to core damage. This applies to SGTR sequences RPY, RBX, RBH, RUG, and RUP (i.e., CDBs B1, B3, B6, and B16). Note that sequence RUB is not included because it is already binned as a large bypass.

Failure of the long term SG isolation will be treated as having the same effect as if the SG isolation had failed prior to core damage as is modeled in the Level 1 event tree. Therefore, in the CET (file HNP_LEVEL_2.XLS sheet CETEXEC), the IFL split fraction is modified to assign a 0.05 conditional probability of a stuck relief valve, given no stuck relief valve from the Level 1 model.

This discussion has been added to PRA Section 8.5.2.5.

U.S. Nuclear Regulatory Commission Page 87 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact 49-LE-D5 The Level II categorically dismisses induced SGTR during an accident, stated in 8.3.4 of HNP Report. A qualitative reason is provided -

water will remain in the loop seal, preventing natural circulation. RCP will not be started unless there is water in the secondary side of the SG.

This position is not substantiated for all sequences considered.

An Induced SGTR (ISGTR) model was developed and included, based on the guidance in NUREG-1570, Risk Assessment of Severe Accident-Induced Steam Generator Tube Rupture, USNRC, March 1998. Section 8 of the PRA documentation and the Level 2 results have been updated to reflect the ISGTR model and results.

Resolution of this F&O included the development of an ISGTR model.

There is no impact to the 5b application.

50-LE-E1 There are 2 HFE events in the Level 2. They are OPER-IV (fail to depressurize and inject LPI and OP_H2REC (failure to preclude hydrogen burn following recovery. There are 3 other recovery events, which represent failure to recover ac-power. These are based on the OSP recovery curve from historical experience and are not a concern for this F&O.

OPER-IV has a probability of.1 and OP_H2REC has a probability of.001. These probabilities are qualitatively assessed with no basis given The OPER_IV probability has been analyzed with a detailed HRA evaluation, which is added to Section 8.7 of the PRA document. The value has been updated in PRA Section 8.5.2.1 and Table 8.9.

Per Section 8.5.2.9 of the PRA, OP_H2REC actually represents the probability of success in preventing a hydrogen burn (0.999 probability of failure, not 0.001 probability of failure as indicated in Observation 50), which is essentially 100% failure. The event exists in the model only to allow for sensitivity analysis. Therefore, no further evaluation of OP_H2REC is needed.

Resolution of this F&O includes an evaluation of OPER_IV and development of additional documentation.

There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 88 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact for the selection of probability.

This does not meet the SR.

43-LE-E3 The definition of LERF states that any sequence for which release occurs within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months of core uncovery is early. For timing of Early vs LATE, some plants use the emergency plan to identify when a site emergency would be declared and evacuation would be started. This is often prior to core uncovery.

Using an earlier starting point for evacuation than core uncovery, may result in the late SGTR sequences from being LERF.

Per Section 9 of the PRA, the Early definition for Harris is not strictly within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months of core damage, but state that alternative definitions can be justified based on event sequence characteristics. For example, long-term loss of decay heat removal sequences in which a long time exists between event initiation and core damage may be considered as non-large early release scenarios, if the facility emergency plan would allow time for emergency protective action prior to radionuclide release. Additionally, if time periods of less than four hours (from vessel breach) can be justified based on plant specific procedures and emergency response features, an alternate definition can be used.

Applying this definition to SGTR, it is unlikely that the SSO would declare a General Emergency (GE) preemptively for a SGTR. The Harris EAL flowpaths have a provision to declare a GE if AFW flow of 210 kpph is not available with RVLIS <62%, but other than this, the general approach is not to declare a GE until 3 fission product barriers are breached.

There are provisions for declaring a Site Emergency (SE) for some equipment unavailability, but this would not necessarily lead to any public evacuations. In the event of a GE, the Harris Plant merely provides recommendations Resolution of this F&O referenced discussion on the definition of what early means as related to HNP LERF. There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 89 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact to State and County authorities for sheltering and evacuation. These authorities can choose to act on the recommendations, act early on the recommendations or not act at all. Given the uncertainties surrounding the question of when the SGTR sequences would result in a general emergency, the conservative assumption of Early vs. Late timing is considered appropriate.

44-LE-F1 44-LE-F2 The SR requires review of contributors for reasonableness. The HNP PRA does not meet this SR on several counts.

1) The contributors are not identified or ranked.

2) There are no uncertainties associated with the level 2 analysis.

3) There are no sensitivity studies performed which vary the parameters (although justification for the selected values is given).

4) There are no alternate results showing the effect of alternate assumptions.

There are some important assumptions in the Level 2 which could affect results:

1) In the new Section 8.8, the LERF contributors are identified and ranked.

2) The Level 2 uncertainties are evaluated through the use of sensitivities in Sections 8.1.4 for MAAP and the new Section 8.8.3 for the rest of the LERF.

3) The new Section 8.8.3 varies selected parameters for which assumptions and uncertainty were believed possible to have a significant impact on LERF

4) The new Section 8.8.3 provides the results by varying key assumptions.

a) It is difficult to defend a SGTR with a stuck open relief valve no being LERF, but in any case, this assumption does not significantly affect the results. Release Category 5 represents SGTR with a stuck relief valve and some scrubbing; RC 5C is the same but no scrubbing. Per HNP_

SUMMARY

_2006.XLS, worksheet CNMT FAILURE, the frequency of RC 5 is 1.66E-7/yr, compared to 9.07E-7/yr for RC 5C. Therefore, even if some of RC 5 were justified to not be part of the LERF, it would not significantly alter the results or conclusions. Given the difficulty of justifying RC 5 as non-LERF, the current assumptions are appropriate.

Resolution of this F&O included various improvements on the level 2 analysis.

There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 90 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact a) all SGTR CDF sequences with SO SRV are LERF.

b) All SGTR CDF sequences with SRV intact are not LERF.

c) Induced SGTR are not possible in any case.

d) Scrubbing is ultimately not credited.

e) Containment overpressure failure is always underground at the base mat, resulting in a filtered released.

b) The statement that all SGTR CDF sequences with SRV intact are not LERF is incorrect. Per Section 9, all SGTR sequences were binned to LER.

c) Induced SGTR has been added to the model in the new Section 8.3.2.

d) Scrubbing is credited in CET top event SRCS.

Containment overpressure failure location sensitivity to LERF was examined in sensitivity #2 in the new Section 8.8.3. The LERF is not sensitive to the assumption because of the very small contribution to LERF from non-bypass releases.

45-LE-F3 The SR requires the identification and characterization of contributors to LERF. The method employed at HNP-PRA for LERF does not retain the individual elements of the LERF process. The LERF split fractions are developed through a spreadsheet quantification process, which does not retain event names or uncertainty factors. The split fractions are then attached to the appropriate Level 1 sequences. The Level 2 contributing elements are not tracked through the It is true that the spreadsheet methodology does not allow for a detailed uncertainty analysis of the Level 2 results.

However, the majority of uncertainty in Level 2 analyses is due to the phenomenological uncertainties, for which quantitative uncertainty bounds usually have no basis.

Therefore, the method used is to evaluate the key phenomenological uncertainties through sensitivity analyses. These sensitivities are presented in the new Section 8.8.3.

Resolution of this F&O provided justification for the existing method and references to the appropriate documentation.

There is no impact to the 5b application.

U.S. Nuclear Regulatory Commission Page 91 of 91 HNP-15-083, Enclosure 1 Table 10. Historical, Closed Internal Events F&Os From Peer Reviews Conducted Prior To The 2007 Peer Review Of Record.

F&O #

Finding Resolution 5b Impact quantification process, so the results cannot be manipulated to examine the importance of each one to the overall results.

For example, it is possible to find the contribution of DCH to LERF. It is not possible to find the uncertainties associated with each Level 2 issues.

51-LE-G6 Document the quantitative definition used for significant accident progression sequences. If other than the definition used in Section 2, Justify the alternative.

The HNP PSA needs to document the quantitative definition and provide justification if other than Section 2 definition.

The following text is added to Section 8.0 of the PRA:

The Level 2 assessment is developed to analyze the significant accident progression sequences. The ASME PRA Standard (Reference 24) defines a significant accident progression sequences as: one of the set of accident sequences contributing to large early release frequency that, when rank-ordered by decreasing frequency, aggregate to a specified percentage of the large early release frequency, or that individually contribute more than a specified percentage of large early release frequency. For this version of the standard, the aggregate percentage is 95% and the individual percentage is 1%.

However, since the Level 2 model must be developed before the relative sequence contribution to LERF can be determined, the HNP Level 2 analyzed all of the Level 1 core damage sequences and Plant Damage States (see Section 7) that had cutsets greater than the truncation limit used in the model. No sequences were eliminated from the calculations.

Resolution of this F&O added documentation about the quantitative definition for significant accident progression sequences. There is no impact to the 5b application.

v t e Letter Sequence Supplement
TAC:MF6583, Relocate Surveillance Frequencies to Licensee Control - RITSTF Initiative 5B (Open)
Initiation Request, Request Acceptance, Acceptance Supplement, Supplement Administration Questions Answers 5 February 2016 Results Approval... Other: ML16173A057
MONTHYEAR2015-09-29 [Table View]

HNP-15-083, Supplement to Application for Technical Specification Change Regarding Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee Controlled Program

Text

Subject:

References:

1.0 INTRODUCTION

SUMMARY

Navigation menu

HNP-15-083, Supplement to Application for Technical Specification Change Regarding Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee Controlled Program

Text

Subject:

References:

1.0 INTRODUCTION

SUMMARY

Navigation menu

Search