Text

Evaluation of Risk Significance of Permanent ILRT Extension (54003-CALC-02, Rev. 3)
	ML16174A371
Person / Time
Site:	Catawba
Issue date:	06/07/2016
From:	Sattler J; Jensen Hughes
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
Shared Package
ML16174A372	List: CNS-16-035, License Amendment Request to Revise Technical Specifications Permanent Extension of Type a and Type C Leak Rate Test Frequencies, Responses to NRC Requests for Additional Information CAC Nos. MF7265 and MF7266; ML16174A371;
References
	54003-CALC-02, CAC MF 7266, CAC MF7265, CNS-16-035
	Download: ML16174A371 (199)
	v • d • e

Attachment "Evaluation of Risk Significance of Permanent ILRT Extension", 54003-CALC-02, Revision 3 0

JENSEN HUGHES Advancing the Science of Safety Catawba Nuclear Station:

Evaluation of Risk Significance of Permanent ILRT Extension 54003-CALC-02 Prepared for:

Catawba Nuclear Station Project

Title:

Permanent ILRT Extension Revision: 3 Preparer: Justin Sattler Reviewer: Kelly Wright Review Method Approved by: Matt Johnson Revision 3 Name and Date

~, i~~.tally signed by Justin Sattler ate: 2016.06.07 09:25:17-05'00'

~0...il Signed by Matt Johnson with permission from Kelly Wright per telecom fW\\ ~

. "* ~

~.-~i.~.*)tally signed by Matt Johnson I UY l ~ ~

~-a~e: 2016.06.07 09:33:33-05*00*

Design Review ~ Alternate Calculation D

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension REVISION RECORD

SUMMARY

Revision 0

2 3

Revision 3 Revision Summary Initial Issue Updated report, per Duke request, for updated Internal Flood and Fire PRA results.

Updated report, per minor Duke comments.

Incorporated RAI responses. Added references 50-70 to support RAJ responses. Added Sections 5.3.6 and 5.3.7. Updated Table A-3. Added Attachment 2 for RAI responses.

Page 2of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension TABLE OF CONTENTS 1.0 PURPOSE...................................................................................................................... 4 2.0 SCOPE........................................................................................................................... 4

3.0 REFERENCES

............................................................................................................... 6 4.0 ASSUMPTIONS AND LIMITATIONS...*......................................................................... 10 5.0 METHODOLOGY and analysis...................................................................................... 11 5.1 lnputs.......................................................................................................................... 11 5.1.1 General Resources Available............................................................................... 11 5.1.2 Plant Specific Inputs............................................................................................ 14 5.1.3 Impact of Extension on Detection of Component Failures that Lead to Leakage (Small and Large).............................................................................................. 16 5.2 Analysis.............................................*........................................................................ 17 5.2.1 Step 1 - Quantify the Baseline Risk in Terms of Frequency per Reactor Year..... 18 5.2.2 Step 2 - Develop Plant-Specific Person-Rem Dose (Population Dose)................ 21 5.2.3 Step 3 - Evaluate Risk Impact of Extending Type A Test Interval from 1 Oto 15 Years................................................................................................................. 22 5.2.4 Step 4 - Determine the Change in Risk in Terms of LERF................................... 24 5.2.5 Step 5 - Determine the Impact on the Conditional Containment Failure Probability

.......................................................................................................................... 25 5.2.6 Impact of Extension on Detection of Steel Liner Corrosion that Leads to Leakage

............................................................. :............................................................ 25 5.3 Sensitivities................................................................................................................. 28 5.3.1 Potential Impact from External Events Contribution............................................. 28 5.3.2 Potential Impact from Steel Liner Corrosion Likelihood........................................ 30 5.3.3 Expert Elicitation Sensitivity................................................................................. 32 5.3.4 Large Leak Probability Sensitivity Study.............................................................. 33 5.3.5 SGTR Success Criteria........................................................................................ 34 5.3.6 Remove Credit for ISLOCA Isolation MO Vs......................................................... 34 5.3.7 Failure Data Update............................................................................................. 35 6.0 RESUL TS...................................................................................................................... 35

7.0 CONCLUSION

S AND RECOMMENDATIONS.............................................................. 36 A.................................................................................................................. 38 B................................................................................................................ 182 Revision 3 Page 3of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 1.0 PURPOSE The purpose of this analysis is to provide a risk assessment of permanently extending the currently allowed containment Type A Integrated Leak Rate Test (ILRT) to fifteen years. The extension would allow for substantial cost savings as the ILRT could be deferred for additional scheduled refueling outages for the Catawba Nuclear Station (CNS). The risk assessment follows the guidelines from NEI 94-01, Revision 3-A [Reference 1], the methodology used in EPRI TR-104285 [Reference 2], the NEI "Interim Guidance for Performing Risk Impact Assessments in Support of One-Time Extensions for Containment Integrated Leakage Rate Test Surveillance Intervals" from November 2001 [Reference 3], the NRG regulatory guidance on the use of Probabilistic Risk Assessment (PRA) as stated in Regulatory Guide 1.200 as applied to ILRT interval extensions, risk insights in support of a request for a plant's licensing basis as outlined in Regulatory Guide (RG) 1.174 [Reference 4], the methodology used for Catawba to estimate the likelihood and risk implications of corrosion-induced leakage of steel liners going undetected during the extended test interval [Reference 5], and the methodology used in EPRI 1018243, Revision 2-A of EPRI 1009325 [Reference 24].

2.0 SCOPE Revisions to 1 OCFR50, Appendix J (Option B) allow individual plants to extend the Integrated Leak Rate Test (ILRT) Type A surveillance testing frequency requirement from three in ten years to at least once in ten years. The revised Type A frequency is based on an acceptable performance history defined as two consecutive periodic Type A tests at least 24 months apart in which the calculated performance leakage rate was less than limiting containment leakage rate of 1 La.

The basis for the current 10-year test interval is provided in Section 11.0 of NEI 94-01, Revision 0, and established in 1995 during development of the performance-based Option B to Appendix J. Section 11.0 of NEI 94-01 states that NUREG-1493, "Performance-Based Containment Leak Test Program," September 1995 [Reference 6], provides the technical basis to support rulemaking to revise leakage rate testing requirements contained in Option B to Appendix J. The basis consisted of qualitative and quantitative assessment of the ri~k impact (in terms of increased public dose) associated with a range of extended leakage rate test intervals. To supplement the NRC's rulemaking basis, NEI undertook a similar study. The results of that study are documented in Electric Power Research Institute (EPRI) Research Project TR-104285, "Risk Impact Assessment of Revised Containment Leak Rate Testing Intervals.';

The NRC report on performance-based leak testing, NUREG-1493, analyzed the effects of containment leakage on the health and safety of the public and the benefits realized from the containment leak rate testing. In that analysis, it was determined that for a representative PWR plant (i.e., Surry), that containment isolation failures contribute less than 0.1 % to the latent risks from reactor accidents. Consequently, it is desirable to show that extending the ILRT interval will not lead to a substantial increase in risk from containment isolation failures for CNS.

NEI 94-01 Revision 2-A contains a Safety Evaluation Report that supports using EPRI Report No. 1009325 Revision 2-A, "Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals," for performing risk impact assessments in support of ILRT extensions [Reference 24].

The Guidance provided in Appendix H of EPRI Report No. 1009325 Revision 2-A builds on the EPRI Risk Assessment methodology, EPRI TR-104285. This methodology is followed to determine the appropriate risk information for use in evaluating the impact of the proposed ILRT changes.

It should be noted that containment leak-tight integrity is also verified through periodic in-service Revision 3 Page 4of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension inspections conducted in accordance with the requirements of the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code Section XI. More specifically, Subsection IWE provides the rules and requirements for in-service inspection of Class MC pressure-retaining components and their integral attachments, and of metallic shell and penetration liners of Class CC pressure-retaining components and their integral attachments in light-water cooled plants. Furthermore, NRC regulations 10 CFR 50.55a(b)(2)(ix)(E) require licensees to conduct visual inspections of the accessible areas of the interior of the containment. The associated change to NEI 94-01 will require that visual examinations be conducted during at least three other outages, and in the outage during which the ILRT is being conducted. These requirements will not be changed as a result of the extended ILRT interval. In addition, Appendix J, Type B local leak tests performed to verify the leak-tight integrity of containment penetration bellows, airlocks, seals, and gaskets are also not affected by the change to the Type A test frequency.

The acceptance guidelines in RG 1.17 4 are used to assess the acceptability of this permanent extension of the Type A test interval beyond that established during the Option B rulemaking of Appendix J. RG 1.174 defines very small changes in the risk-acceptance guidelines as increases in Core Damage Frequency (CDF) less than 1 o-s per reactor year and increases in Large Early Release Frequency (LERF) less than 10-7 per reactor year. Since the Type A test does not impact CDF, the relevant criterion is the change in LERF. RG 1.174 also defines small changes in LERF as below 10-s per reactor year. RG 1.17 4 discusses defense-in-depth and encourages the use of risk analysis techniques to help ensure and show that key principles, such as the defense-in-depth philosophy, are met. Therefore, the increase in the Conditional Containment Failure Probability (CCFP), which helps ensure the defense-in-depth philosophy is maintained, is also calculated.

Regarding CCFP, changes of up to 1.1 % have been accepted by the NRC for the one-time requests for extension of ILRT intervals. In context, it is noted that a CCFP of 1/10 (10%) has been approved for application to evolutionary light water designs. Given these perspectives, a change in the CCFP of up to 1.5% is assumed to be small.

In addition, the total annual risk (person rem/year population dose) is examined to demonstrate the relative change in this parameter. While no acceptance guidelines for these additional figures of merit are published, examinations of NUREG-1493 and Safety EvalLJation Reports (SER) for one-time interval extension (summarized in Appendix G of Reference 24) indicate a range of incremental increases in population dose that have been accepted by the NRC. The range of incremental population dose increases is from ::;0.01 to 0.2 person-rem/year and/or 0.002% to 0.46% of the total accident dose. The total doses for the spectrum of all accidents (NUREG-1493 [Reference 6], Figure 7-2) result in health effects that are at least two orders of magnitude less than the NRC Safety Goal Risk. Given these perspectives, a very small population dose is defined as an increase from the baseline interval (3 tests per 10 years) dose of ::;1.0 person-rem per year or 1 % of the total baseline dose, whichever is less restrictive for the risk impact assessment of the proposed extended ILRT interval.

For those plants that credit containment overpressure for the mitigation of design basis accidents, a brief description of whether overpressure is required should be included in this section. In addition, if overpressure is included in the assessment, other risk metrics such as CDF should be described and reported.

Revision 3 Page 5of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension

3.0 REFERENCES

The following references were used in this calculation:

1. Revision 3-A to Industry Guideline for Implementing Performance-Based Option of 10 CFR Part 50, Appendix J, NEI 94-01, July 2012.

2. Risk Impact Assessment of Revised Containment Leak Rate Testing lnteNals, EPRI, Palo Alto, CA EPRI TR-104285, August 1994.

3. Interim Guidance for Performing Risk Impact Assessments in Support of One-Time Extensions for Containment Integrated Leakage Rate Test SuNeillance lnteNals, Revision 4, developed for NEI by EPRI and Data Systems and Solutions, November 2001.

4. An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Regulatory Guide 1.174, May 2011.

5. Response to Request for Additional Information Concerning the License Amendment Request for a One-Time Integrated Leakage Rate Test Extension, Letter from Mr. C. H.

Cruse (Calvert Cliffs Nuclear Power Plant) to NRC Document Control Desk, Docket No.

50-317, March 27, 2002.

6. Performance-Based Containment Leak-Test Program, NUREG-1493, September 1995.

7. Evaluation of Severe Accident Risks: Surry Unit 1, Main Report NUREG/CR-4551, SAND86-1309, Volume 3, Revision 1, Part 1, October 1990.

8. Letter from R. J~ Barrett (Entergy) to U. S. Nuclear Regulatory Commission, IPN-01-007, January 18, 2001.

9. United States Nuclear Regulatory Commission, Indian Point Nuclear Generating Unit No. 3 - Issuance of Amendment Re: Frequency of Performance-Based Leakage Rate Testing (TAC No. MB0178), April 17, 2001.

10. Impact of Containment Building Leakage on LWR Accident Risk, Oak Ridge National Laboratory, NUREG/CR-3539, ORNL/TM-8964, April 1984.

11. Reliability Analysis of Containment Isolation Systems, Pacific Northwest Laboratory, NUREG/CR-4220, PNL-5432, June 1985..

12. Technical Findings and Regulatory Analysis for Generic Safety Issue 11.E.4.3

'Containment Integrity Check', NUREG-1273, April 1988.

13. Review of Light Water Reactor Regulatory Requirements, Pacific Northwest Laboratory, NUREG/CR-4330, PNL-5809, Volume 2, June 1986.

14. Shutdown Risk Impact Assessment for Extended Containment Leakage Testing Intervals Utilizing ORAM', EPRI, Palo Alto, CA, TR-105189, Final Report, May 1995.

15. Severe Accident Risks: An Assessment for Five U. S. Nuclear Power Plants, NUREG-1150, December 1990.

16. United States Nuclear Regulatory Commission, Reactor Safety Study, WASH-1400, October 1975.

17. Calculation CNC-1535.00-00-0131, Revision 2, Catawba Nuclear Station, "Catawba PRA Rev. 3b."

Revision 3 Page 6of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension

18. Calculation CNC-1535.00-00-0192, Revision 2, Catawba Nuclear Station, "Catawba Nuclear Station PRA RAI 03 Response Documentation."

19. Calculation CNC-1535.07-00-0020, Catawba Nuclear Station, "Catawba Nuclear Station Severe Accident Mitigation Design Alternatives (SAMDAs) Analysis for License Renewal."

20. Anthony R. Pietrangelo, One-time extensions of containment integrated leak rate test interval - additional information, NEI letter to Administrative Points of Contact, November 30, 2001.

21. Letter from J. A. Hutton (Exelon, Peach Bottom) to U. S. Nuclear Regulatory Commission, Docket No. 50-278, License No. DPR-56, LAR-01-00430, dated May 30, 2001.

22. Risk Assessment for Joseph M. Farley Nuclear Plant Regarding /LRT (Type A)

Extension Request, prepared for Southern Nuclear Operating Co. by ERIN Engineering and Research, P0293010002-1929-030602, March 2002.

23. Letter from D. E. Young (Florida Power, Crystal River) to U.S. Nuclear Regulatory Commission, 3F0401-11, d~ted April 25, 2001.

24. Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals, R.evision 2-A of 1009325, EPRI, Palo Alto, CA. 1018243, October 2008.

25. Risk Assessment for Vogtle Electric Generating Plant Regarding the ILRT (Type A)

Extension Request, prepared for Southern Nuclear Operating Co. by ERIN Engineering and Research, February 2003.

26. Perspectives Gained from the IPEEE Program, USNRC, NUREG-1742, April 2002.

27. Catawba Nuclear Station Procedure, PT/1/A/4200/01A, "Containment Integrated Leak Rate Test."

28. Letter L-14 -121, ML14111A291, FENOC Evaluation of the Proposed Amendment, Beaver Valley Power Station, Unit Nos.. 1 and 2, April 2014.

29. Technical Letter Report ML112070867, Containment Liner Corrosion Operating Experience Summary, Revision 1, August 2011.

30. ML021580235, Duke Energy Corporation, "One-Time Extension of Integrated Leak Rate Testing (ILRT) Interval," May 29, 2002.

31. Armstrong, J., Simplified Level 2 Modeling Guidelines: WOG PROJECT: PA-RMSC-0088, Westinghouse, WCAP-16341-P, November 2005.

32. IPEEE, "Catawba Nuclear Station: IPEEE Submittal Report," June 21, 1994.

33. Transition Report, "Transition to 10 CFR 50.48(c) - NFPA 805: Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants, 2001 Edition," ML13276A503, ML13276A504, and ML13276A505, September 25, 2013.

34. Calculation CNC-1535.00-00-0154, Revision 1, Catawba Nuclear Station, "CNS High Wind Probabilistic Risk Assessment (HWPRA)."

35. NFPA 805 Implementation Management Update, June 29, 2015.

36. Westinghouse Attachment to L TR-RAM-13-01: "Focused Scope RG 1.200 PRA Review Against ASME/ANS PRA Standard Requirements for the Catawba and McGuire Large Early Release Frequency Probabilistic Risk Assessments," January 2013.

Revision 3 Page 7of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension

37. Catawba Nuclear Station Internal Flooding PRA Focused Peer Review Report, AREVA NP Inc., February 2013

38. Internal Flooding PRA Peer Review Facts and Observations Resolutions for Catawba Nuclear Station Units 1 and 2, L TR-RAM-11-13-008, June 2013.

39. Calculation CNC-1535.00-00-0151, Revision 1, Catawba Nuclear Station, "Flood PRA Modeling and Quantification for Catawba Nuclear Station Units 1 & 2."

40. Calculation RWA-1430-001, Revision 0, Catawba Nuclear Station, "Catawba Battery Room Temperature Response Following Loss of Ventilation," March 2015.

41. Calculation RWA-1430-002, Revision 0, Catawba Nuclear Station, "Catawba Control Room Temperature Response Following Loss of Ventilation," March 2015.

42. Calculation RWA-1430-003, Revision 0, Catawba Nuclear Station, "Catawba Switch Gear Room Temperature Response Following Loss of Ventilation," February 2015.

43. Calculation CNC-1535.00-00.0118, Revision 0, Catawba Nuclear Station, "Catawba Nuclear Station Success Criteria Notebook," 2010.

44. Letter from Yan Gao (Westinghouse) to U.S. Nuclear Regulatory Commission, L TR-RAM-11-13-077, "Catawba Nuclear Plants RG 1.200 High Wind PRA Peer Review Report," Revision 0, January 2014.

45. SAA Short Form #336, Revision 0, Prepared by A. Mironenko, December 2014.

46. EPRI Technical Report 1016741, "Support System Initiating Events," December 2008.

47. Work Request 20008836, "Replace Fasteners Turbine Building Walls," Unit 1, October 2015.

48. Work Order Package 02118879, "Resecure Fasteners A-Train T. B. W. Wall During OTG," Unit 2, Finished October 7, 2013.

49. Work Order Package 02165104, "2ST: (A-Train) TB Bldg Fastener Securement Project,"

Unit 2, Finished March 9, 2015.

50. Calculation CNC-1535.00-0059, Revision 0, Catawba Nuclear Station, "External Events

- Seismic Analysis."

51. National Technical Systems, "Seismic Fragilities of Structures and Components at the Catawba Nuclear Station," March 1986.

52. Lettis Consultants International, "Catawba Seismic Hazard and Screening Report -

Calculation of Seismic Hazards for CEUS Sites - Project 1041 ", October 2013.

53. Calculation CNC-1535.00-00-0028, Revision 0, Catawba Nuclear Station, "Common Cause Analysis," October 2005.

54. NUREG/CR-6928, Industry-Average Performance for Components and Initiating Events at U.S. Commercial Nuclear Power Plants, 201 O Parameter Estimation Update, September 2012.

55. Calculation CNC-1535.00-00-0111, Revision 2, "CNS Fire PRA (FPRA) Model Development Report," January 2016.

56. Calculation DPC-1535.00-00-0010, Revision 2, "Definition of Core Damage for PRA Application," February 2016.

Revision 3 Page 8 of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension

57. Calculation CNC-1535.00-00-0114, Revision 0, "Potential Internal Initiating Events for the Catawba PRA," February 2010.

58. Generic Issue 199, "Seismic Risk Evaluations for Operating Reactors," Appendix A, "Seismic Core-Damage Frequency Estimates," August 2010.

59. Generic Issue 199, "Seismic Risk Evaluations for Operating Reactors," Appendix C, "Plant-Level Fragility Data," August 2010.

60. Calculation DPC-1535.00-00-0013, "PRA Quality Self-Assessment," Revision 2, November 2009.

61. Operating License Renewal, Environmental Report, Attachments C-E, Sequoyah Nuclear Plant, ML13024A010.

62. Transition to a Risk-Informed, Performance-Based Fire Protection Program, Enclosure 3, ML13140A398.

63. Calculation MCC-1535.00-00-0183, Revision 0, McGuire Nuclear Station, "McGuire Rev.

3c PRA Model Integration."

64. Calculation MDN-000-999-2008-0151, Revision 1, Watts Bar Nuclear, "Probabilistic Risk Assessment-Summary," ML14177A167.

65. Calculation MCC-1535.00-00-0172, Revision 1, McGuire Nuclear Station, "Assessment of McGuire PRA Model Technical Adequacy for the RI-ISi Application."

66. Calculation CNC-1535.00..:00-0182, Revision 0, "Catawba Nuclear Station Probabilistic Risk Assessment Section 1.0: Component Data Development," May 2015.

67. "ST2198 DEC Environmental Qualification (EQ) Equipment Report" Consolidated Asset Suite, Duke Energy Software, Version 8.0.1, FA Build Date June 18, 2015.

68. Catawba Nuclear Station Updated Final Safety Analysis Report, Revision 17, Effective Date October 17, 2013.

69. Calculation CNC-1535.00-00-0155, "Catawba PRA Quality Self-Assessment," Revision 0, April 2013.

70. Calculation CNC-1535.00-00-0029, "Catawba PRA Revision 2 Failure Rate and Maintenance Unavailability Data," Revision 0, January 2006.

Revision 3 Page 9of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 4.0 ASSUMPTIONS AND LIMITATIONS The following assumptions were used in the calculation:

The technical adequacy of the CNS PRA is either consistent with the requirements of Regulatory Guide 1.200 or where gaps exist, the gaps have been addressed, as is relevant to this ILRT interval extension, as detailed in Attachment 1.

The CNS Level 1 and Level 2 internal events PRA models provide representative results. The current internal events PRA model (Revision 3b) does not contain a full Level 2 PRA, but previous models contain a full Level 2 PRA. Where detail is needed from a Level 2 PRA, the results from the previous revisions are scaled using the current revision's total risk. It is a reasonable assumption that this scaling does not significantly affect the conclusions of this analysis.

Even though CNS has two units, there is only one internal events PRA model because the two units are very similar. It is assumed that the two units are similar enough that the one internal events PRA model accurately models both units.

It is appropriate to use the CNS internal events PRA model to effectively describe the risk change attributable to the ILRT extension. An extensive sensitivity study is done in Section 5.3.1 to show the effect of including external event models for the ILRT extension. The Seismic PRA and Fire PRA (model fire_cr3a_r3v14) are used for this sensitivity analysis.

Accident classes describing radionuclide release end states are defined consistent with EPRI methodology [Reference 2].

The representative containment leakage for Class 1 sequences is 1 La. Class 3 accounts for increased leakage due to Type A inspection failures.

The representative containment leakage for Class 3a sequences is 1 Ola based on the previously approved methodology performed for Indian Point Unit 3 [Reference 8, Reference 9].

The representative containment leakage for Class 3b sequences is 1 OOLa based on the guidance provided 'in EPRI Report No. 1009325, Revision 2-A (EPRI 1018243)

[Reference 24].

The Class 3b can be very. conservatively categorized as LERF based on the previously approved methodology [Reference 8, Reference 9].

The impact on population doses from containment bypass scenarios is not altered by the proposed ILRT extension, but is accounted for in the EPRI methodology as a separate entry for comparison purposes. Since the containment bypass contribution to population dose is fixed, no changes in the conclusions from this analysis will result from this separate categorization.

The reduction in ILRT frequency does not impact the reliability of containment isolation valves to close in response to a containment isolation signal.

Revision 3 Page 10of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5.0 METHODOLOGY AND ANALYSIS 5.1 Inputs This section summarizes the general resources available as input (Section 5.1.1) and the plant specific resources required (Section 5.1.2).

5.1.1 General Resources Available Various industry studies on containment leakage risk assessment are briefly summarized here:

1.

NUREG/CR-3539 [Reference 1 OJ

2.

NUREG/CR-4220 [Reference 11J

3.

NUREG-1273[Reference12J

4.

NUREG/CR-4330 [Reference 13J

5.

EPRI TR-105189 [Reference 14J

6.

NUREG-1493 [Reference 6J

7.

EPRI TR-104285 [Reference 2J

8.

NUREG-1150 [Reference 15J and NUREG/CR-4551 [Reference 7J

9.

NEI Interim Guidance [Reference 3, Reference 20J

10.

Calvert Cliffs liner corrosion analysis [Reference 5J

11.

EPRI Report No. 1009325, Revision 2-A (EPRI 1018243), Appendix H [Reference 24J This first study is applicable because it provides one basis for the threshold that could be used in the Level 2 PRA for the size of containment leakage that is considered significant and is to be included in the model. The second study is applicable because it provides a basis of the probability for significant pre-existing containment leakage at the time of a core damage accident. The third study is applicable because it is a subsequent study to NUREG/CR-4220 that undertook a more extensive evaluation of the same database. The fourth study provides an assessment of the impact of different containment leakage rates on plant risk. The fifth study provides an assessment of the impact on shutdown risk from ILRT test interval extension. The sixth study is the NRC's cost-benefit analysis of various alternative approaches regarding extending the test intervals and increasing the allowable leakage rates for containment integrated and local leak rate tests. The seventh study is an EPRI study of the impact of extending ILRT and local leak rate test (LLRT) intervals on at-power public risk. The eighth study provides an ex-plant consequence analysis for a 50-mile radius surrounding a plant that is used as the basis for the consequence analysis of the ILRT interval extension for CNS. The*

ninth study includes the NEI recommended methodology (promulgated in two letters) for evaluating the risk associated with obtaining a one-time extension of the ILRT interval. The tenth study addresses the impact of age-related degradation of the containment liners on ILRT evaluations. Finally, the eleventh study builds on the previous work and includes a recommended methodology and template for evaluating the risk associated with a permanent 15-year extension of the I LRT interval.

NUREG/CR-3539 [Reference 1 OJ Oak Ridge National Laboratory documented a study of the impact of containment leak rates on public risk in NUREG/CR-3539. This study uses information from WASH-1400 [Reference 16J as the basis for its risk sensitivity calculations. ORNL concluded that the impact of leakage rates on LWR accident risks is relatively small.

NUREG/CR-4220 [Reference 11J NUREG/CR-4220 is a study performed by Pacific Northwest Laboratories for the NRC in 1985.

The study reviewed over two thousand LERs, ILRT reports and other related records to Revision 3 Page 11 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension calculate the unavailability of containment due to leakage.

NUREG-1273 [Reference 121 A subsequent NRC study, NUREG-1273, performed a more extensive evaluation of the NUREG/CR-4220 database. This assessment noted that about one-third of the reported events were leakages that were immediately detected and corrected. In addition, this study noted that local leak rate tests can detect "essentially all potential degradations" of the containment isolation system.

NUREG/CR-4330 [Reference 131 NUREG/CR-4330 is a study that examined the risk impacts associated with increasing the allowable containment leakage rates. The details of this report have no direct impact on the modeling approach of the ILRT test interval extension, as NUREG/CR-4330 focuses on leakage rate and the ILRT test interval extension study focuses on the frequency of testing intervals.

However, the general conclusions of NUREG/CR-4330 are consistent with NUREG/CR-3539 and other similar containment leakage risk studies:

"... the effect of containment leakage on overall accident risk is small since risk is dominated by accident sequences that result in failure or bypass of containment."

EPRI TR-105189 [Reference 141 The EPRI study TR-105189 is useful to the ILRT test interval extension risk assessment because it provides insight regarding the impact of containment testing on shutdown risk. This study contains a quantitative evaluation (using the EPRI ORAM software) for two reference plants (a BWR-4 and a PWR) of the impact of extending ILRT and LLRT test intervals on shutdown risk. The conclusion from the study is that a small, but measurable, safety benefit is realized from extending the test intervals.

NUREG-1493 [Reference 61 NUREG-1493 is the NRC's cost:.benefit analysis for proposed alternatives to reduce containment leakage testing intervals and/or relax allowable leakage rates. The NRC conclusions are consistent with other similar containment leakage risk studies:

Reduction in ILRT frequency from 3per10 years to 1 per 20 years results in an "imperceptible" increase in risk.

Given the insensitivity of risk to the containment leak rate and the small fraction of leak paths detected solely by Type A testing, increasing the interval between integrated leak rate tests is possible with minimal impact on public risk.

EPRI TR-104285 [Reference 21 Extending the risk assessment impact beyond shutdown (the earlier EPRI TR-105189 study),

the EPRI TR-104285 study is a quantitative evaluation of the impact of extending ILRT and LLRT test intervals on at-power public risk. This study combined IPE Level 2 models with NUREG-1150 Level 3 population dose models to perform the analysis. The study also used the approach of NUREG-1493 in calculating the increase in pre-existing leakage probability due to extending the ILRT and LLRT test intervals.

EPRI TR-104285 uses a simplified Containment Event Tree to subdivide representative core damage frequencies into eight classes of containment response to a core damage accident:

1.

Containment intact and isolated

2.

Containment isolation failures dependent upon the core damage accident

3.

Type A (ILRT) related containment isolation failures Revision 3 Page 12of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension

4.

Type B (LLRT) related containment isolation failures

5.

Type C (LLRT) related containment isolation failures

6.

Other penetration related containment isolation failures

7.

Containment failures due to core damage accident phenomena

8.

Containment bypass Consistent with the other containment leakage risk assessment studies, this study concluded:

"... the proposed CLRT (Containment Leak Rate Tests) frequency changes would have a minimal safety impact. The change in risk determined by the analyses is small in both absolute and relative terms. For example, for the PWR analyzed, the change is about 0.04 person-rem per year... "

NUREG-1150 [Reference 151 and NUREG/CR-4551 [Reference 71 NUREG-1150 and the technical basis, NUREG/CR-4551; provide an ex-plant consequence analysis for a spectrum of accidents including a severe accident with the containment remaining intact (i.e., Tech Spec Leakage). This ex-plant consequence analysis is calculated for the 50-mile radial area surrounding Surry. The ex-plant calculation can be delineated to total person-rern for each identified Accident Progression Bin (APB) from NUREG/CR-4551.. With the CNS Level 2 model end~states assigned to one of the NUREG/CR-4551 APBs, it is considered adequate to represent CNS. (The meteorology and site differences other than population are assumed not to play a significant role in this evaluation.)

NEI Interim Guidance for Performing Risk Impact Assessments In Support of One-Time Extensions for Containment Integrated Leakage Rate Test Surveillance Intervals [Reference 3, Reference 201 The guidance provided in this document builds on the EPRI risk impact assessment methodology [Reference 2] and the NRC performance-based containment leakage test program

[Reference 6], and considers approaches utilized in various submittals, including Indian Point 3 (and associated NRC SER) and Crystal River.

Calvert Cliffs Response to Request for Additional Information Concerning the License Amendment for a One-Time Integrated Leakage Rate Test Extension [Reference 51 This submittal to the NRC describes a method for determining the change in likelihood, due to extending the ILRT, of detecting liner corrosion, and the corresponding change in risk. The methodology was developed for Calvert Cliffs iri response to a request for additional information regarding how the potential leakage due to age-related degradation mechanisms was factored into the risk assessment for the ILRT one-time extension. The Calvert Cliffs analysis was performed for a concrete cylinder and dome and a concrete basemat, each with a steel liner.

EPRI Report No. 1009325, Revision 2-A, Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals [Reference 24]

This report provides a generally applicable assessment of the risk involved in extension of ILRT test intervals to permanent 15-year intervals. Appendix H of this document provides guidance for performing plant-specific supplemental risk impact assessments and builds on the previous EPRI risk impact assessment methodology [Reference 2] and the NRC performance-based containment leakage test program [Reference 6], and considers approaches utilized in various submittals, including Indian Point 3 (and associated NRC SER) and Crystal River.

The approach included in this guidance document is used in the CNS assessment to determine the estimated increase in risk associated with the ILRT extension. This document includes the bases for the values assigned in determining the probability of leakage for the EPRI Class 3a and 3b scenarios in this analysis, as described in Section 5.2.

Revision 3 Page 13of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5.1.2 Plant Specific Inputs The plant-specific information used to perform the CNS ILRT Extension Risk Assessment includes the following:

Level 1 Model results [Reference 17]

Release category definitions used in the Level 2 Model [Reference 19]

Dose within a 50-mile radius [Reference 19]

ILRT results to demonstrate adequacy of the administrative and hardware issues

[Reference 30]

CNS Model The Internal Events PRA Model that is used for CNS is characteristic of the as-built plant. The current Level 1 model (CNS PRA Model Version cr3b) [Reference 17] is a linked fault tree model. The Internal Flood PRA was updated; the GDF is 3.92E-5/year, and the LERF is 5.42E-7/year [Reference 39]. The total GDF is 5.48E-5/year, and the total LERF is 1. 75E-6/year with the updated Internal Flooding analysis [Reference 39]. The results documented in Reference 17 include GDF and LERF contributors from legacy fire and tornado PRAs. These contributors have been superseded by updated Fire PRA and High Wind PRA models (see section 5.3.1 for discussion of the Fire and High Wind PRA results). Therefore, the GDF and LERF from the legacy fire and tornado PRAs are not applicable and have been removed from the total GDF and LERF values that are used in this analysis. See Section 5.2.1 for details of this GDF and LERF removal. Table 5-1 and Table 5-2 provide a summary of the Internal Events GDF and LERF results for CNS PRA Model Version cr3b with the legacy fire and tornado risk removed.

The total Fire GDF is 3.57E-5/year for Unit 1 and 3.64E-5/year for Unit 2; the total Fire LERF is 3.41 E-6/year for Unit 1 and 3.48E-6 for Unit 2 [Section 3.0 of Reference 18]. Refer to Section 5.3.1 for further details on external events as they pertain to this analysis.

Revision 3 Table 5 Internal Events CDF (CNS PRA Model Version cr3b)

Internal Events Internal Floods Transients LOCAs SGTR RPV ISLOCA Total Internal Events CDF Total Internal Events CDF (Excluding ISLOCA & SGTR)

Frequency (per year) 3.92E-05 1.01 E-05 2.48E-06 4.63E-07 4.55E-08 4.36E-07 5.27E-05 5.18E-05 Page 14of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Table 5 Internal Events LERF (CNS PRA Model Version cr3b)

Internal Events Frequency (per year)

Internal Floods 5.58E-07 Transients 2.40E-07 LOCAs 3.30E-08 SGTR 4.00E-07 RPV 4.73E-10 IS LO CA 4.44E-07 Total Internal Events LERF 1.67E-06 Population Dose Calculations The population dose calculation was reported in the CNS SAMOA [Reference 19]. Table 5-3 presents dose exposures calculated from methodology described in Reference 1 and data from Reference 30. Reference 30 provides the population dose (person-rem) for Classes 1, 2, 6, 7, and 8; Class 3a and 3b population dose values are calculated from the Class 1 population dose and represented as 1 Ola and 1 OOLa, respectively, as guidance in Reference 1 dictates.

Accident Class 2

3a 3b 4

5 6

7 8

1.

10

L.

2.

100

L.

Table 5 Population Dose Description Containment Remains Intact Containment Isolation Failures Independent or Random Isolation Failures SMALL Independent or Random Isolation Failures LARGE Isolation Failure in which pre-existing leakage is not dependent on sequence progression. Type B test Failures Isolation Failure in which pre-existing leakage is not dependent on sequence progression. Type C test Failures Isolation Failure that can be verified by IST/IS or surveillance Containment Failure induced by severe accident Accidents in which containment is by-passed Release (person-rem) 1.72E+03 9.41E+04 1.72E+041 1.72E+052 n/a n/a n/a 7.69E+05 8.08E+063

3.

The Class 8 dose value differs from the value presented in Reference 30 because the dose is weighted based on frequency of the two Class 8 contributors: ISLOCA and SGTR.

Release Category Definitions Table 5-4 defines the accident classes used in the ILRT extension evaluation, which is consistent with the EPRI methodology [Reference 2]. These containment failure classifications are used in this analysis to determine the risk impact of extending the Containment Type A test interval, as described in Section 5.2 of this report.

Revision 3 Page 15of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Class 2

3 4

5 6

7 8

5.1.3 Table 5 EPRI Containment Failure Classification [Reference 2]

Description Containment remains intact including accident sequences that do not lead to containment failure in the long term. The release of fission products (and attendant consequences) is determined by the maximum allowable leakage rate values La, under Appendix J for that plant.

Containment isolation failures (as reported in the Individual Plant Examinations) including those accidents in which there is a failure to isolate the containment.

Independent (or random) isolation failures include those accidents in which the pre-existing isolation failure to seal (i.e., provide a leak-tight containment) is not dependent on the sequence in progress.

Independent (or random) isolation failures include those accidents in which the pre-existing isolation failure to seal is not dependent on the sequence in progress. This class is similar to Class 3 isolation failures, but is applicable to sequences involving Type B tests and their potential failures. These are the Type B-tested components that have isolated, but exhibit excessive leakage.

Independent (or random) isolation failures including those accidents in which the pre-existing isolation failure to seal is not dependent on the sequence in progress. This class is similar to Class 4 isolation failures, but is applicable to sequences involving Type C test and their potential failures.

Containment isolation failures including those leak paths covered in the plant test and maintenance requirements or verified per in-seNice inspection and testing (ISl/IST) program.

Accidents involving containment failure induced by severe accident phenomena. Changes in Appendix J testing requirements do not impact these accidents.

Accidents in which the containment is bypassed (either as an initial condition or induced by phenomena) are included in Class 8. Changes in Appendix J testing requirements do not impact these accidents.

Impact of Extension on Detection of Component Failures that Lead to Leakage

{Small and Large)

The ILRT can detect a number ofcomponent failures such as liner breach, failure of certain bellows arrangements, and failure of some sealing surfaces, which can lead to leakage. The proposed ILRT test inteNal extension may influence the conditional probability of detecting these types of failures. To ensure that this effect is properly addressed, the EPRI Class 3 accident class, as defined in Table 5-3, is divided into two sub-classes, Class 3a and Class 3b, representing small and large leakage failures respectively.

The probability of the EPRI Class 3a and Class 3b failures is determined consistent with the EPRI Guidance [Reference 24]. For Class 3a, the probability is based on the maximum likelihood estimate of failure (arithmetic average) from the available data (i.e., 2 "small" failures in 217 tests leads to "large" failures in 217 tests (i.e., 2 I 217 = 0.0092). For Class 3b, the probability is based on the Jeffreys non-informative prior (i.e., 0.5 I 218 = 0.0023).

In a follow-up letter [Reference 20] to their ILRT guidance document [Reference 3], NEI issued additional information concerning the potential that the calculated delta LERF values for several plants may fall above the "very small change" guidelines of the NRC Regulatory Guide 1.174

[Reference 4]. This additional NEI information includes a discussion of conseNatisms in the quantitative guidance for bLERF. NEI describes ways to demonstrate that, using plant-specific calculations, the bLERF is smaller than that calculated by the simplified method.

The supplemental information states:

The methodology employed for determining LERF (Class 3b frequency) involves conservatively multiplying the GDF by the failure probability for this class (3b} of accident. This was done for simplicity and to maintain conservatism. However, some plant-specific accident classes leading to core damage are likely to include individual sequences that either may already (independently) cause a LERF or could never cause a LERF, and are thus not associated with a Revision 3 Page 16of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension postulated large Type A containment leakage path (LERF). These contributors can be removed from Class 3b in the evaluation of LERF by multiplying the Class 3b probability by only that portion of GDF that may be impacted by Type A leakage.

The application of this additional guidance to the analysis for CNS, as detailed in Section 5.2, involves subtracting the LERF from the GDF that is applied to Class 3b. To be consistent, the same change is made to the Class 3a CDF, even though these events are not considered.

LERF.

Consistent with the NEI Guidance [Reference 3], the change in the leak detection probability can be estimated by comparing the average time that a leak could exist without detection. For example, the average time that a leak could go undetected with a three-year test interval is 1.5 years (3 years I 2), and the average time that a leak could exist without detection for a ten-year interval is 5 years (1 O years I 2). This change would lead to a non-detection probability that is a factor of 3.33 (5.0/1.5) higher for the probability of a leak that is detectable only by ILRT testing.

Correspondingly, an extension of the I LRT interval to 15 years can be estimated to lead to a factor of 5 ((15/2)/1.5) increase in the non-detection probability of a leak.

It should be noted that using the methodology discussed above is very conservative compared to previous submittals (e.g., the IP3 request for a one-time ILRT extension that was approved by the NRG [Reference 9]) because it does not factor in the possibility that the failu_res could be detected by other tests (e.g., the Type B local leak rate tests that will still occur). Eliminating this possibility conservatively over-estimates the factor increases attributable to the ILRT extension.

5.2 Analysis The application of the approach based on the guidance contained iri EPRI Report No. 1009325, Revision 2-A, Appendix H [Reference 24], EPRI TR-104285 [Reference 2] and previous risk assessment submittals on this subject [References 5, 8, 21, 22, and 23] have led to the following results. The results are displayed according to the eight accident classes defined in*

the EPRI report, as described in Table 5-5.

The analysis performed examined CNS-specific accident sequences in which the containment remains intact or the containment is impaired. Specifically, the breakdown of the severe accidents, contributing to risk, was considered in the following manner:

Core damage sequences in which the containment remains intact initially and in the long term (EPRI TR-104285, Class 1 sequences [Reference 2]).

Core damage sequences in which containment integrity is impaired due to random isolation failures of plant components other than those associated with Type B or Type C test components. For example, liner breach or bellow leakage (EPRI TR-104285, Class 3 sequences [Reference 2]).

Accident sequences involving containment bypassed (EPRI TR-104285, Class 8 sequences [Reference 2]), large containment isolation failures (EPRI TR-104285, Class 2 sequences [Reference 2]), and small containment isolation "failure-to-seal" events (EPRI TR-104285, Class 4 and 5 sequences [Reference 2]) are accounted for in this evaluation as part of the baseline risk profile. However, they are not affected by the ILRT frequency change.

Class 4 and 5 sequences are impacted by changes in Type B and C test intervals; therefore, changes in the Type A test interval do not impact these sequences.

Revision 3 Page 17of198

54003-CALC-02 Accident Classes (Containment Release Type) 2 3a 3b 4

6 7

8 CDF Evaluation of Risk Significance of Permanent ILRT Extension Table 5 EPRI Accident Class Definitions Description No Containment Failure Large Isolation Failures (Failure to Close)

Small Isolation Failures (Liner Breach)

Large Isolation Failures (Liner Breach)

Small Isolation Failures (Failure to Seal - Type B)

Small Isolation Failures (Failure to Seal - Type C) other Isolation Failures (e.g., Dependent Failures)

Failures Induced by Phenomena (Early and Late)

Bypass (Interfacing System LOCA)

All CET End States (Including Very Low and No Release)

The steps taken to perform this risk assessment evaluation are as follows:

Step 1 - Quantify the baseline risk in terms of frequency per reactor year for each of the accident classes presented in Table 5-5.

Step 2 - Develop plant-specifjc person-rem dose (population dose) per reactor year for each of the eight accident classes.

Step 3 - Evaluate risk impact of extending Type A test interval from 3 in 1 O years to 1 in 15 years and 1 in 1 O years to 1 in 15 years.

Step 4 - Determine the change in risk in terms of Large Early Release Frequency (LERF) in accordance with RG 1.17 4 [Reference 4 ].

Step 5 - Determine the impact on the Conditional Containment Failure Probability (CCFP).

5.2.1 Step 1 ~Quantify the Baseline Risk in Terms of Frequency per Reactor Year As previously described, the extension of the Type A interval does not influence those accident progressions that involve large containment isolation failures, Type B or Type C testing, or containment failure induced by severe accident phenomena.

For the assessment of ILRT impacts on the risk profile, the potential for pre-existing leaks is included in the model. (These events are represented by the Class 3 sequences in EPRI TR-104285 [Reference 2].) The question on containment integrity was modified to include the probability of a liner breach or bellows failure (due to excessive leakage) at the time of core damage. Two failure modes were considered for the Class 3 sequences. These are Class 3a (small breach) and Class 3b (large breach).

The frequencies for the severe accident classes defined in Table 5-5 were developed for CNS by first determining the frequencies for Classes 1, 2, 6, 7, and 8. Table 5-6 presents the grouping of each release category in EPRI Classes based on the associated description. Table 5-7 presents the frequency and EPRI category for each sequence and the totals of each EPRI classification. Table 5-8 provides a summary of the accident sequence frequencies that can lead to radionuclide release to the public and have been derived consistent with the definitions of accident classes defined in EPRI TR-104285 [Reference 2], the NEI Interim Guidance

[Reference 3], and guidance provided in EPRI Report No. 1009325, Revision 2,-A [Reference 24]. Adjustments were made to the Class 3b and hence Class 1 frequencies to account for the Revision 3 Page 18of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension impact of undetected corrosion of the steel liner per the methodology described in Section 5.2.6.

Note: calculations were performed with more digits than shown in this section. Therefore, minor differences may occur if the calculations in these sections are followed explicitly.

The Catawba PRA Rev. 3b model [Reference 17] contains risk contribution from internal events and external events (fire and tornadoes). For the baseline analysis in Section 5.2, only internal events will be addressed. External events (fire, tornadoes, and seismic) will be addressed in a sensitivity in Section 5.3.1 using updated PRA models. Using the total GDF of 5.48E-5 and finding the contribution from the Fussell-Vesely (FV) importance measure for fire (initiators

%FCBLR, %FCR, %FOG, %FETB, and %FKC) to total 3.1 % and tornadoes (initiator

%TORNSW) to be 0.8% for GDF, the fire GDF contribution is 1.72E-6 and the tornado GDF contribution is 4.20E-7. Using the total LERF of 1.75E-6, the total fire FV of 2.2%, and the tornado FV of 2.2%, the fire LERF contribution is 3.79E-8 and the tornado LERF contribution is 3.80E-8. Therefore, for this analysis the GDF is 5.27E-5, and the LERF is 1.67E-6.

Class 3 Sequences. This group consists of all core damage accident progression bins for which a pre-existing leakage in the containment structure (e.g., containment liner) exists that can only be detected by performing a Type A ILRT. The probability of leakage detectable by a Type A ILRT is calcu'lated to determine the impact of extending the testing interval. The Class 3 calculation is divided into two classes: Class 3a is defined as a small liner breach (La < leakage

< 10La), and Class 3b is defined as a large liner breach (10La <leakage< 100L~).

Data reported in EPRI 1009325, Revision 2-A [Reference 24] states that two events could have been detected only during the performance of an ILRT and thus impact risk due to change in ILRT frequency. There were a total of 217 successful ILRTs during this data collection period.

Therefore, the probability of leakage is determined for Class 3a as shown in the following equation:

2 Pciass3a = 217 = 0.0092 Multiplying the GDF by the probability of a Class 3a leak yields the Class 3a frequency contribution in accordance with guidance provided in Reference 24. As described in Section 5.1.3, additional consideration is made to not apply failure probabilities on those cases that are already LERF scenarios. Therefore, LERF contributions from GDF are removed. The frequency of a Class 3a failure is calculated by the following equation:

Freqclass3a = Pclass3a * (CDF - LERF) 2

= 217 *(5.27E-5 -1.67E-6) = 4.70E-7 In the database of 217 ILRTs, there are zero containment leakage events that could result in a large early release. Therefore, the Jeffreys non-informative prior is used to estimate a failure rate and is illustrated in the following equations:

Number of Failures+ 1/2 Jeffreys Failure Probability=

N b

f T 1

um ero ests +

0+1/2 Pciass3b = 217 + 1 = 0.0023 The frequency of a Class 3b failure is calculated by the following equation:

Freqclass3b = Pclass3b * (CDF - LERF)

= ~

(5.27E-5 -1.67E-6) = 1.17E-7 218 For this analysis, the associated containment leakage for Class 3a is 1 Ola and for Class 3b is Revision 3 Page 19of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 1 OOLa. These assignments are consistent with the guidance provided in Reference 24.

Class 1 Sequences. This group consists of all core damage accident progression bins for which the containment remains intact (modeled as Technical Specification Leakage). Since the PRA model does not contain a Level 2 model, Class 1 is calculated as CDF - LERF. This overestimates the Intact frequency, which is conservative for this analysis because it leads to a higher calculated change in risk due to extending the ILRT frequency. The frequency per year is initially determined from the EPRI Accident Class 1 frequency listed in Table 5-7 and then subtracting the EPRI Class 3a and 3b frequency (to preserve total CDF), calculated below:

Freqclass1 = Freqclass1 - (Freqclass3a - Freqclass3b)

Class 2 Sequences. This group consists of core damage accident progression bins with large containment isolation failures. This is calculated by ANDing the ZL gate (Large Containment Isolation Failure) with a flag to calculate the contribution of large containment isolation failure to Lf:RF. Since this flag is in cutsets that contribute 0.214% of LERF, which is 1.67E-6, the Class 2 contribution is 3.58E-9. The frequency per year for these sequences is obtained from the EPRI Accident Class 2 frequency listed in Table 5-7.

Class 4 Sequ*ences. This group consists of all core damage accident progression bins for which containment isolation failure-to-seal of Type B test components occurs. Because these failures are detected by Type B tests which are unaffected by the Typ~ A ILRT, this group is not evaluated any further in the analysis, consistent with approved methodology.

Class 5 Sequences. This group consists of all core damage accident progression bins for which a containment isolation failure-to-seal of Type C test components occurs. Because the failures are detected by Type C tests which are unaffected by the Type A ILRT, this group is not evaluated any further in this analysis, consistent with approved methodology.

Class 6 Sequences. These are sequences that involve core damage accident progression bins for which a failure-to-seal containment leakage due to failure to isolate the containment occurs.

These sequences are dominated by misalignment of containment isolation valves following a test/maintenance evolution. All other failure modes are bounded by the Class 2 assumptions.

This accident class is also not evaluated further.

Class 7 Sequences. This group consists of all core damage accident progression bins in which containment failure is induced by severe accident phenomena (e.g., overpressure). This

frequency is calculated by subtracting the Class 1, 2, and 8 frequencies from the total CDF. For this analysis, the frequency is determined from the EPRI Accident Class 7 frequency listed in Table 5-7.

Class 8 Sequences. This group consists of all core damage accident progression bins in which containment bypass or SGTR occur, which contribute 25.8% and 23.3%, respectively, of LERF; LERF frequencies are shown in Table 5-6. For this analysis, the total frequency is listed in Table 5-7.

LERF quantification is distributed into EPRI categories based on release categories. Table 5-5 shows this distribution.

Revision 3 Page 20 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Table 5 Release Category Frequencies Containment End State EPRI Category Frequency (/yr)

Intact Containment 1

5.10E-05 Large Isolation Failure 2

3.58E-09 Failures Induced by Phenomr;ina 7

8.49E-07 Other Containment Bypass 8

4.32E-07 SGTR 8

3.90E-07 Table 5-7 -Accident Class Frequencies EPRI Category Frequency (/yr)

Class 1 5.10E-05 Class 2 3.58E-09 Class 6 N/A - Included in Class 2 Class 7 8.49E-07 Class 8 8.22E-07 Total (GDF) 5.27E-05 Table 5 Baseline Risk Profile Class Description Frequency (/yr)

No containment failure 5.04E-052 2

Large containment isolation failures 3.58E-09 3a Small isolation failures (liner breach) 4.?0E-07 3b Large isolation failures (liner breach) 1.17E-07 4

Small isolation failures - failure to seal (type B) 5 Small isolation failures - failure to seal (type C) 6 Containment isolation failures (dependent failure, personnel errors) 7 Severe accident phenomena induced failure (early and late) 8.49E-07 8

Containment bypass 8.22E-07 Total 5.27E-05

1.

E represents a probabilistically insignificant value or a Class that is unaffected by the Type A ILRT.

2.

The Class 3a and 3b frequencies are subtracted from Class 1 to preserve total CDF.

5.2.2 Step 2 - Develop Plant-Specific Person-Rem Dose (Population Dose)

Plant-specific release analyses were performed to estimate the person-rem doses to the population within a 50-mile radius from the plant. The releases are based on CNS-specific dose calculations summarized in Table 5-3. Table 5-3 provides a correlation of CNS population dose to EPRI Accident Class. Table 5-10 provides population dose for each EPRI accident class.

The population dose for EPRI Accident Classes 3a and 3b were calculated based on the guidance provided in EPRI Report No. 1009325, Revision 2-A [Reference 24] as follows:

EPRI Class 3a Population Dose= 10

1.72E+3 = 1.72£+4 EPR/ Class 3b Population Dose= 100

1.72E+3 = 1.72E+5 Revision 3 Page 21 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Table 5 Mapping of Population Dose to EPRI Accident Class EPRI Category Frequency (/yr)

Dose (person-rem)

Class 1 5.04E-05 1.72E+03 Class 2 3.58E-09 9.41E+04 Class 6 N/A - Included in Class 2 Class 7 8.49E-07 7.69E+05 Class 8 8.22E-07 8.08E+061

1.

The Class 8 dose value differs from the value presented in Reference 30 because the dose is weighted based on frequency of the two Class 8 contributors: ISLOCA and SGTR.*

Class Table 5 Baseline Population Doses Description Population Dose (person-rem)

No containment failure 1.72E+03 2

Large containment isolation failures 9.41E+04 3a Small isolation failures (liner breach) 1.72E+041 3b Large isolation failures (liner breach) 1.72E+052 4

Small isolation failures - failure to seal (type B)

N/A 5

Small isolation failures - failure to seal (type C)

N/A 6

Containment isolation failures (dependent failure, personnel errors)

N/A 7

Severe accident phenomena induced failure (early and late) 7.69E+05 8

Containment bypass 8.08E+063

1.

10*La

2.

1 OO*La

3.

The Class 8 dose value differs from the value presented in Reference 30 because the dose is weighted based on frequency of the two Class 8 contributors: ISLOCA and SGTR.

5.2.3 Step 3 - Evaluate Risk Impact of Extending Type A Test Interval from 10 to 15 Years The next step is to evaluate the risk impact of extending the test interval from its current 10-year interval to a 15-year interval. To do this, an evaluation must first be made of the risk associated with the 10-year interval, since the base case applies to 3-year interval (i.e., a simplified representation of a 3-to-1 O interval).

Risk Impact Due to 10-Year Test Interval As previously stated, Type A tests impact only Class 3 sequences. For Class 3 sequences, the release magnitude is not impacted by the change in test interval (a small or large breach remains the same, even though the probability of not detecting the breach increases). Thus, only the frequency of Class 3a and Class 3b sequences is impacted. The risk contribution is changed based on the NEI guidance as described in Section 5.1.3 by a factor of 10/3 compared to the base case values. The Class 3a and 3b frequencies are calculated as follows:

10 2

Freqczass3aloyr = - * -

(CDF - LERF) = - * -

S.10E-5 = 1.57E-6 3

217 3

217 Freqczass3b 1oyr =

1 3° * ;:8 * (CDF - LERF) =

1 3° * ;:8

S.10E-5 = 3.90E-7 The results of the calculation for a 10-year interval are presented in Table 5-11.

Revision 3 Page 22 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Table 5 Risk Profile for Once in 10 Year ILRT Class Description Frequency Contribution Population Dose Population

(/yr)

(%)

(person-rem)

Dose Rate (person-rem/yr)

No containment failure2 4.90E-05 93.11%

1.72E+03 8.43E-02 2

Large containment isolation 3.58E-09 0.01%

9.41E+04 3.37E-04 failures 3a Small isolation failures (liner 1.57E-06 2.97%

1.72E+04 2.69E-02 breach) 3b Large isolation failures 3.90E-07 0.74%

1.72E+05 6.70E-02 (liner breach) 4 Small isolation failures -

£1

£1 failure to seal (type B) 5 Small isolation failures -

£1

£1 failure to seal (type C)

Containment isolation 6

failures (dependent failure,

£1

£1 personnel errors)

Severe accident 7

phenomena induced failure 8.49E-07 1.61%

7.69E+05 6.52E-01 (early and late) 8 Containment bypass 8.22E-07 1.56%

8.08E+06 6.64E+OO Total 5.27E-05 7.48E+OO

1.

E represents a probabilistically insignificant value or a Class that is unaffected by the Type A ILRT.

2.

The Class 1 frequency is reduced by the frequency of Class 3a and Class 3b in order to preserve total CDF.

Risk lm1;2act Due to 15-Year Test Interval The risk contribution for a 15-year interval is calculated in a manner similar to the 10-year interval. The difference is in the increase in probability of leakage in Classes 3a and 3b. For this case, the value used in the analysis is a factor of 5 compared to the 3-year interval value, as described in Section 5.1.3. The Class 3a and 3b frequencies are calculated as follows:

15 2

2 Freqczass3a15yr = - * -

(CDF - LERF) = 5 * -

5.lOE-5 = 2.35E-6 3

217 217 Freqczass3b15yr =

1 3

5

2*:8 * (CDF - LERF) = 5

2*:3

5.lOE-5 = 5.85E-7 The results of the calculation for a 15-year interval are presented in Table 5-12.

Revision 3 Page 23 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Table 5 Risk Profile for Once in 15 Year ILRT Class Description Frequency Contribution Population Dose Population

(/yr)

(%)

(person-rem)

Dose Rate (person-rem/yr)

No containment failure2 4.SOE-05 91.25%

1.72E+03 8.26E-02 2

Large containment 3.58E-09 0.01%

9.41E+04 3.37E-04 isolation failures 3a Small isolation failures 2.35E-06 4.46%

1.72E+04 4.04E-02 (liner breach) 3b Large isolation failures 5.85E-07 1.11%

1.72E+05 1.01 E-01 (liner breach) 4 Small isolation failures -

E1 E1 E1 E1 failure to seal (type B) 5 Small isolation failures -

E1 E1 E1 E1 failure to seal (type C)

Containment isolation 6

failures (dependent failure, E1 E1 E1 E1 personnel errors)

Severe accident 7

phenomena induced failure 8.49E-07 1.61%

7.69E+05 6.52E-01 (early and late) 8 Containment bypass 8.22E-07 1.56%

8.08E+06 6.64E+OO Total 5.27E-05 7.52E+OO

1.

E represents a probabilistically insignificant value or a Class that is unaffected by the Type A ILRT.

2.

The Class 1 frequency is reduced by the frequency of Class 3a and Class 3b in order to preserve total CDF.

5.2.4 Step 4 - Determine the Change in Risk in Terms of LERF The risk increase associated with extending the ILRT interval involves the potential that a core damage event that normally would result in only a small radioactive release from an intact containment could, in fact, result in a larger release due to the increase in probability of failure to detect a pre-existing leak. With strict adherence to the EPRI guidance, 100% of the Class 3b contribution would be considered LERF.

Regulatory Guide 1.174 [Reference 4] provides guidance for determining the risk impact of plant-specific changes to the licensing basis. RG 1.17 4 [Reference 4] defines very small changes in risk as resulting in increases of CDF less than 10-5/year and increases in LERF less than 10-7/year, and small changes in LERF as less than 10-5/year. Since containment overpressure is not required in support of ECCS performance to mitigate design basis accidents at CNS, the ILRT extension does not impact CDF. Therefore, the relevant risk-impact metric is LERF.

For CNS, 100% of the frequency of Class 3b sequences can be used as a very conservative first-order estimate to approximate the potential increase in LERF from the ILRT interval extension (consistent with the EPRI guidance methodology). Based on a 10-year test interval from Table 5-11, the Class 3b frequency is 3.90E-07/year; based on a 15-year test interval from Table 5-12, the Class 3b frequency is 5.85E-07/year. Thus, the increase in the overall probability of LERF due to Class 3b sequences that is due to increasing the ILRT test interval from 3 to 15 years is 4.68E-07/year. Similarly, the increase due to increasing the interval from 1 Oto 15 years is 1.95E-07/year. As can be seen, even with the conservatisms included in the Revision 3 Page 24 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension evaluation (per the EPRI methodology), the estimated change in LERF is within the criteria for a small change when comparing the 15-year results to the current 10-year requirement and the original 3-year requirement. Table 5-13 summarizes these results.

Table 5 Impact on LERF due to Extended Type A *Testing Intervals ILRT Inspection Interval 3 Years (baseline) 10 Years 15 Years Class 3b (Type A LERF) 1.17E-07 3.90E-07 5.85E-07 LlLERF (3 year baseline) 4.68E-07 LlLERF (1 O year baseline) 1.95E-07 The increase in the overall probability of LERF due to Class 3b sequences is greater than 10-1.

As stated in RG 1.17 4 [Reference 4], "When the calculated increase in LERF is in the range of 10-7 per reactor year to 1 o-s per reactor year, applications will be considered only if it can be reasonably shown that the total LERF is less than 1 o-s per reactor year." Baseline LERF (excluding external events) is 1.67E-6/year (1.75E-6/year if fire and tornado are included).

Therefore, there is significant margin for both the ~LERF and baseline LERF to the upper limits of Region II in RG 1.174 [Reference 4].

5.2.5 Step 5 - Determine the Impact on the Conditional Containment Failure Probability Another parameter that the NRC guidance in RG 1.17 4 [Reference 4] states can provide input into the decision-making process is the change in the conditional containment failure probability (CCFP). The CCFP is defined as the probability of containment failure given the occurrence of an accident. This probability can be expressed using the following equation:

CCFP = 1 - f (ncf)

CDF where f(ncf) is the frequency of those sequences that do not result in containment failure; this frequency is determined by summing the Class 1 and Class 3a results [Reference 24]. Table 5-14 shows the steps and results of this calculation. The difference in CCFP between the 3-year test interval and 15-year test interval is 0.888%.

Table 5 Impact on CCFP due to Extended Type A Testing Intervals ILRT Inspection Interval 3 Years (baseline) 10 Years 15 Years f(ncf) (/yr) 5.09E-05 5.06E-05 5.04E-05 f(ncf)/CDF 0.966 0.961 0.957 CCFP 0.0340 0.0392 0.0429 LlCCFP (3 year baseline) 0.888%

LlCCFP (10 year baseline) 0.370%

As stated in Section 2.0, a change in the CCFP of up to 1.5% is assumed to be small. The increase in the CCFP from the 3 in 10 year interval to 1 in 15 year interval is 0.888%. Therefore, this increase is judged to be very small.

5.2.6 Impact of Extension on Detection of Steel Liner Corrosion that Leads to Leakage An estimate of the likelihood and risk implications of corrosion-induced leakage of the steel liners occurring and going undetected during the extended test interval is evaluated using a methodology similar to the Calvert Cliffs liner corrosion analysis [Reference 5]. The Calvert Revision 3 Page 25 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Cliffs analysis was performed for a concrete cylinder and dome and a concrete basemat, each with a steel liner.

The following approach is used to determine the change in likelihood, due to extending the ILRT, of detecting corrosion of the containment steel liner. This likelihood is then used to determine the resulting change in risk. Consistent with the Calvert Cliffs analysis, the following issues are addressed:

Differences between the containment basemat and the containment cylinder and dome The historical steel liner flaw likelihood due to concealed corrosion The impact of aging The corrosion leakage dependency on containment pressure The.likelihood. that visual inspections will be effective at detecting a flaw Assumptions Consistent with the Calvert Cliffs analysis, a half failure is assumed for basemat concealed liner corrosion due to the lack of identified failures (See Table 5-15, Step 1).

The two corrosion events used to estimate the liner flaw probability in the Calvert Cliffs previous analysis are assumed to still be applicable.

Consistent with the Calvert Cliffs ~nalysis, the estimated historical flaw probability is also limited to 5.5 years to reflect the years since September 1996 when 1 O CFR 50.55a started requiring visual inspection. Additional success data was not used to limit the aging impact of this corrosion issue, even though inspections were being performed prior to this date (and have been performed since the time frame of the Calvert Cliffs analysis)

(See Table 5-4, Step 1).

Consistent with the Calvert Cliffs analysis, the steel liner flaw iikelihood is assumed to double every five years. This is based solely on judgment and is included in this analysis to address the increased likelihood of corrosion as the steel liner ages (See Table 5-15, Steps 2 and 3). Sensitivity studies are included that address doubling this rate every ten years and every two years.

In the Calvert Cliffs analysis, the likelihood of the containment atmosphere reaching the outside atmosphere, given that a liner.flaw exists, was estimated as 1.1 % for the cylinder.

and dome, and 0.11 % (10% of the cylinder failure probability) for the basemat. These values were determined from an assessment of the probability versus containment pressure. For CNS, the ILRT is performed at or slightly below the design pressure of 15 psig [Reference 27]. Probabilities of 1 % for the cylinder and dome, and 0.1 % for the basemat are used in this analysis, and sensitivity studies are included in Section 5.3.2 (See Table 5-15, Step 4).

Consistent with the Calvert Cliffs analysis, the likelihood of leakage escape (due to crack formation) in the basemat region is considered to be less likely than the containment cylinder and dome region (See Table 5-15, Step 4).

Consistent with the Calvert Cliffs analysis, a 5% visual inspection detection failure likelihood given the flaw is visible and a total detection failure likelihood of 10% is used.

To date, all liner corrosion events have been detected through visual inspection (See Table 5-15, Step 5).

Consistent with the Calvert Cliffs analysis, all non-detectable containment failures are assumed to result in early releases. This approach avoids a detailed analysis of containment failure timing and operator recovery actions.

Revision 3 Page 26 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Step 2

3 4

5 6

Table 5 Steel Liner Corrosion Base Case Description Historical liner flaw likelihood Failure data: containment location specific Success data: based on 70 steel-lined containments and 5.5 years since the 10CFR 50.55a requirements of periodic visual inspections of containment surfaces Aged adjusted liner flaw likelihood During the 15-year interval, assume failure rate doubles every five years (14.9% increase per year). The average for the 5th to 1 oth year set to the historical failure rate.

Increase in flaw likelihood between 3 and 15 years Uses aged adjusted liner flaw likelihood (Step 2),

assuming failure rate doubles every five years.

Likelihood of breach in containment given liner flaw Visual inspection detection failure likelihood Likelihood of non-detected containment leakage (Steps 3 x 4 x

5)

Containment Cylinder and Dome (85%)

Events: 2 (Brunswick 2 and North Anna 2) 2 I (70 x 5.5) = 5.19E-03 Year average 5-10 15 Failure rate 2.05E-03 5.19E-03 1.43E-02 15 year average= 6.44E-03 0.73% (1 to 3 years) 4.18% (1 to 10 years) 9.66% (1to15 years) 1%

10%

5% failure to identify visual flaws plus 5% likelihood that the flaw is not visible (not through-cylinder but could be detected by ILRT).

All events have been detected through visual inspection. 5%

visible failure detection is a conservative assumption.

0.00073% (3 years) 0.73% x 1% x 10%

0.00418% (10 years) 4.18% x 1% x 10%

0.00966% (15 years) 9.66% x 1% x 10%

Containment Basemat (15%)

Events: 0 Assume a half failure 0.5 / (70 x 5.5) = 1.30E-03 Year Failure rate 5.13E-04 average 5-10 1.30E-03 15 3.57E-03 15 year average= 1.61 E-03 0.18% (1 to 3 years) 1.04% (1 to 10 years) 2.41 % (1 to 15 years) 0.1%

100%

Cannot be visually inspected 0.000180% (3 years) 0.18% x 0.1 % x 100%

0.00104% (1 O years) 1.04% x 0.1% x 100%

0.00241 % (15 years) 2.41%x0.1%x100%

The total likelihood of the corrosion-induced, non-detected containment leakage is the sum of Step 6 for the containment cylinder and dome, and the containment basemat, as summarized below for CNS.

Table 5-16-Total Likelihood on Non-Detected Containment Leakage Due to Corrosion for CNS Description At 3 years: 0.00073% + 0.000180% = 0.00091 %

At 10 years: 0.00418% + 0.00104% = 0.00522%

At 15 years: 0.00966% + 0.00241% = 0.01207%

Revision 3 Page 27 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension The above factors are applied to those core damage accidents that are not already independently LERF or that could never result in LERF.

The two corrosion events that were initiated from the non-visible (backside) portion of the containment liner used to estimate the liner flaw probability in the Calvert Cliffs analysis are assumed to be applicable to this containment analysis. These events, one at North Anna Unit 2 (September 1999) caused by timber embedded in the concrete immediately behind the containment liner, and one at Brunswick Unit 2 (April 1999) caused by a cloth work glove embedded in the concrete next to the liner, were initiated from the nonvisible (backside) portion of the containment liner. A search of the NRC website LER database identified two additional events have occurred since the Calvert Cliffs analysis was performed. In January 2000, a 3/16-inch circular through-liner hole was found at Cook Nuclear Plant Unit 2 caused by a wooden brush handle embedded immediately behind the containment liner. The other event occurred in April 2009, where a through-liner hole approximately 3/8-inch by 1-inch in size was identified in the Beaver Valley Power Station Unit 1 (BVPS-1) containment liner caused by pitting originating from the concrete side due to a piece of wood that was left behind during the original -

construction that came in contact with the steel liner. Two other containment liner through-wall hole events occurred at Turkey Point Units 3 and 4 in October 2010 and November 2006, respectively. However, these events originated from the visible side caused by the failure of the coating system, which was not designed for periodic immersion service, and are not considered to be applicable to this analysis. More recently, in October 2013; some through-wall containment liner holes were identified at BVPS-1, with a combined total area of approximately 0.395 square inches. The cause of these through-wall liner holes was attributed to corrosion originating from the outside concrete surface due to the presence of rayon fiber foreign material that was left behind during the original construction and was contacting the steel liner

[Reference 28]. For risk evaluation purposes, these five total corrosion events occurring in 66 operating plants with steel containment liners over a 17.1 year period from September 1996 to October 4, 2013 (i.e., 5/(66*17.1) = 4.43E-03) are bounded by the estimated historical flaw probability based on the two events in the 5.5 year period of the Calvert Cliffs analysis (i.e.,

2/(70*5.5) = 5.19E-03) incorporated in the EPRI guidance.

5.3 Sensitivities 5.3.1 Potential Impact from External Events Contribution An assessment of the impact of external events is performed. The primary purpose for this investigation is the determination of the total LERF following an increase in the ILRT testing interval from 3 in 10 years to 1 in 15 years.

Catawba is transitioning to NFPA805 licensing basis for fire protection and submitted a License Amendment Request (LAR) [Reference 33]. This.transition includes performing a Fire PRA and installing modifications to reduce the fire-induced CDF and LERF. It is anticipated that many, but not all, of the Fire PRA related modifications will be completed by the next scheduled ILRT.

The next scheduled ILRTs for the two units are fall 2016 and spring 2018. Compensatory measures have been implemented to reduce the fire risk until the modifications that reduce the Fire PRA CDF and LERF are implemented. These measures may be actions to reduce fire initiating event probabilities, actions to improve suppression probability, and/or actions to recover or protect systems that mitigate core damage and large early release accident sequences. Therefore, the Fire PRA model is deemed applicable for this calculation.

The Fire PRA model fire_cr3a_r3v14 was used to obtain the fire CDF and LERF values

[Reference 18]. To reduce conservatism in the model, the methodology of subtracting existing Revision 3 Page 28 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension LERF from GDF is also applied to the Fire PRA model. The following shows the calculation for Class 3b:

0.5 Frequlclass3b = Pclass3b * (CDF - LERF) = 218 * (3.57£ 3.41£-6) = 7.41£-8 0.5 Frequ2class3b = Pc1ass3b * (CDF - LERF) = 218 * (3.64£ 3.48£-6) = 7.55£-8 10 10 0.5 Fre%1class3blOyr = 3

Pc1ass3b * (CDF - LERF) = 3

218 * (3.57£ 3.41£-6) = 2.47E-7 10 10 0.5 Frequ2class3bl0yr = -

Pclass3b * (CDF - LERF) = -*-* (3.64£ 3.48£-6) = 2.52E-7 3

3 218 15

~5 Frequ1c1ass3bl5yr = -

Pciass3b * (CDF - LERF) = 5 * -* (3.57£ 3.41£-6) = 3.70E-7 3

218 15 0.5 FreqU2class3b15yr = -* Pc1ass3b * (CDF - LERF) = 5 * -

(3.64£ 3.48£-6) = 3.78E-7 3

218 The Seismic PRA results from the IPEEE Seismic PRA estimate a CDF of 1.6E-5/year

[Reference 32]. The cr3b model contains a Seismic PRA model; when only the seismic portion of this model is quantified (cr3b_seismic.cut), the CDF is 1.15E-5. Applying the internal event LERF/CDF ratio to the seismic CDF yields an estimated seismic LERF of 3.62E-7, as shown by the equation below.

LERFseismic ~ CDFseismic

LERFrn I CD Fm= 1.15E-5

1.67E-6 I 5.27E-5 = 3.62E-7 Subtracting seismic LERF from GDF, the Class 3b frequency can be calculated by the following formulas:

Freqc1ass3b = Pciass3b * (CDF - LERF) = ;~~ * (1.15E-5 -3.62E-7) = 2.55E-8 10 10 0.5 Freqc1ass3b10yr = -

Pc1ass3b * (CDF - LERF) = - *- * (1.15E-5 -3.62E-7) = 8.52E-8 3

3 218 15 15 0.5 Freqc1ass3b15yr = -

Pc1ass3b * (CDF - LERF) = - *- * (1.15E-5 -3.62E-7)= 1.28E-7 3

3 218 As stated in Section 7.6 of the high wind (HW) PRA [Reference 34], the GDF and LERF are 7.02E-6 and 6.48E-7, respectively. At the time of the original HW PRA development, many of the siding panels on the Turbine Building were not sufficiently fastened to provide full protection against high winds, resulting in relatively high fragilities. This had a considerable effect on the CDF and LERF. Analyses were performed on the fragilities of equipment within the Turbine Building and the CNS Main Transformers, which were shown to be vulnerable to siding impact.

As evidenced by the completed work orders to replace the wall fasteners on the Turbine Building, Catawba has since sufficiently fastened the siding panels [References 47-49].

Therefore, the model with the fasteners fixed is used for this application.

Subtracting HW LERF from CDF, the Class 3b frequency can be calculated by the following formulas:

Freqclass3b = Pc1ass3b * (CDF - LERF) = ;~~ * (7.02E-6 -6.48E-7) = 1.46E-8 10 10 05 Freqc1ass3b1oyr = -

Pc1ass3b * (CDF - LERF) = - * - * (7.02E-6 -6.48E-7) = 4.87E-8 3

3 218 Ll Ll M

Freqczass3bl5yr = -

Pc1ass3b * (CDF - LERF) = - * - * (7.02E-6 -6.48E-7)= 7.31E-8 3

3 218 Revision 3 Page 29 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension The fire, seismic, and high wind contributions to Class 3b frequencies are then combined to obtain the total external event contribution to Class 3b frequencies. The change ln LERF is calculated for the 1 in 10 year and 1 in 15 year cases and the change defined for the external events in Table 5-17.

Table 5 Unit 1 CNS External Event Impact on ILRT LERF Calculation Hazard EPRI Accident Class 3b Frequency LERF Increase (from 3 per 1 O years to 1.

3per10 year 1 per10year 1 per 15 years per 15 years)

External Events 1.14E-07 3.81 E-07 5.71E-07 4.57E-07 Internal Events 1.17E-07 3.90E-07 5.85E-07 4.68E-07 Combined 2.31E-07 7.70E-07 1.16E-06 9.25E-07 Table 5 Unit 2 CNS External Event Impact on ILRT LERF Calculation Hazard EPRI Accident Class 3b Frequency LE.RF Increase (from 3per10 years to 1 3per10 year 1 per 10 year 1 per 15 years per 15 years)

External Events 1.16E-07 3.86E-07 5.78E-07 4.63E-07 Internal Events 1.17E-07 3.90E-07 5.85E-07 4.68E-07 Combined 2.33E-07 7.75E-07 1.16E-06 9.30E-07 The internal event results are also provided to allow a composite value to be defined. When both the internal and external event contributions are combined, the total change in LERF of 9.25E-7 for Unit 1 and 9.30E-7 for Unit 2 meets the guidance for small change in risk, as it exceeds 1.0E-7/yr and remains less than 1.0E-6 change in LERF. For this change in LERF to be acceptable, total LERF must be less than 1.0E-5. The total LERF value is calculated below:

LERFu1 = LERFinternaI + LERFseismic + LERFurnre + LERFHw + LERFc1ass3Bincrease

= 1.67E-6/yr + 3.66E-7 /yr+ 3.41E-6/yr + 6.48E -7 /yr+ 9.25E-7/yr= 7.02E-6/yr LERFu2 = LERFinternaI + LERFseismic + LERF u2nre + LERFHw + LERFc1ass3Bincrease

= 1.67E-6/yr + 3.66E-7 /yr+ 3.48E-6/yr + 6.48E-7 /yr+ 9.30E-7 jyr = 7.10E-6/yr Although the total change in LERF is somewhat close to the Regulatory Guide 1.17 4 limit

[Reference 4] when external event risk is included, several conservative assumptions were made in this ILRT analysis, as discussed in Sections 4.0, 5.1.3, 5.2.1, and 5.2.4; therefore the total change in LERF is considered conservative for this application. As specified in Regulatory Guide 1.17 4 [Reference 4], since the total LERF is less than 1.0E-5, it is acceptable for the bLERF to be between 1.0E-7 and 1.0E-6.

5.3.2 Potential Impact from Steel Liner Corrosion Likelihood A quantitative assessment of the contribution of steel liner corrosion likelihood impact was performed for the risk impact assessment for extended ILRT intervals. As a sensitivity run, the internal event CDF was used to calculate the Class 3b frequency. The impact on the Class 3b frequency due to increases in the ILRT surveillance interval was calculated for steel liner corrosion likelihood using the relationships described in Section 5.2.6. The EPRI Category 3b frequencies for the 3 per 10-year, 10-year, and 15-year I LRT intervals were quantified using the Revision 3 Page 30 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension internal events CDF. The change in the LERF, change in CCFP, and change in Annual Dose Rate due to extending the ILRT interval from 3 in 10 years to 1 in 10 years, or to 1 in 15 years are provided in Table 5-19-Table 5-21. The steel liner corrosion likelihood was increased by a factor of 1000, 10000, and 100000. Except for extreme factors of 10000 and 100000, the corrosion likelihood is relatively insensitive to the results.

Table 5 Steel Liner Corrosion Sensitivity Case: 38 Contribution 3b 3b 3b LERF LERF LERF Frequency Frequency Frequency Increase Increase Increase (3-per-10 (1-per-10 (1-per-15 (3-per-10 to (3-per-1 O to (1-per-10 to year ILRT) year ILRT) yearlLRT) 1-per-10) 1-per-15) 1-per-15)

Internal Event 38 1.17E-07 3.90E-07 5.85E-07 2.73E-07 4.68E-07 1.95E-07 Contribution Corrosion Likelihood 2.71E-10 9.41E-10 1.50E-09 6.?0E-10 1.23E-09 5.62E-10 x 1000 Corrosion Likelihood 2.93E-,10 1.36E-09 2.96E-09 1.0?E-09 2.67E-09 1.60E-09 x 10000 Corrosion Likelihood 5.12E-10

5.56E-09 1.75E-08 5.05E-09 1.?0E-08 1.20E-08.

x 100000

Table 5 Steel Liner Corrosion Sensitivity: CCFP CCFP CCFP CCFP CCFp CCFP CCFP Increase Increase Increase (3-per-10 (1-per-10 (1-per-15

(3-per-10 to (3-per.:1 O to (1-per-10 to year ILRT) year ILRT) yearlLRT) 1-per-10) 1-per-15) 1-per-15)

Baseline 3.40E-02 3.92E-02 4.29E-02 5.18E-03 8.88E~03 3.?0E-03 CCFP Corrosion Likelihood 3.40E-02 3.93E-02 4.30E-02 5.23E-03 8.96E-03 3.73E-03 x 1000 Corrosion Likelihood 3.42E-02 3.99E-02 4.39E-02 5.65E-03 9.69E-03 4.04E-03 x 10000 Corrosion Likelihood 3.60E-02 4.59E-02 5.30E-02 9.90E-03 1.?0E-02 7.0?E-03 x 100000 Revision 3 Page 31 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Table 5 Steel Liner Corrosion Sensitivity: Dose Rate Dose Rate Dose Rate Dose Rate Dose Rate Dose Rate Dose Rate Increase Increase Increase (3-per-10 (1-per-10 (1-per-15 year (3-per-10 to (3-per-10 to 1-(1-per-10 to year ILRT) year ILRT)

ILRT) 1-per-10) per-15) 1-per-15)

Dose Rate 2.01E-02 6.70E-02 1.01E-01 4.69E-02 8.05E-02 3.35E-02 Corrosion Likelihood 2.03E-02 7.05E-02 1.13E-01 5.02E-02 9.24E-02 4.22E-02 x 1000 Corrosion Likelihood 2.19E-02 1.02E-01 2.22E-01 8.01E-02 2.00E-01 1.20E-01 x 10000 Corrosion Likelihood 3.84E-02 4.17E-01 1.31E+OO 3.79E-01 1.28E+OO 8.97E-01 x 100000 5.3.3 Expert Elicitation Sensitivity Another sensitivity case on the impacts of assumptions regarding pre-existing containment defect or flaw probabilities of occurrence and magnitude, or size of the flaw, is performed as described in Reference 24. In this sensitivity case, an expert elicitation was conducted to develop probabilities for pre-existing containment defects that would be detected by the I LRT only based on the historical testing data.

Using the expert knowledge, this information was extrapolated into a probability-versus-magnitude relationship for pre-existing containment defects [Reference 24]. The failure mechanism analysis also used the historical ILRT data augmented with expert judgment to develop the results. Details of the expert elicitation process and results are contained in Reference 24. The expert elicitation process has the advantage of considering the available data for small leakage events, which have occurred in the data, and extrapolate those events and probabilities of occurrence to the potential for large magnitude leakage events.

The expert elicitation results are used to develop sensitivity cases for the risk impact assessment. Employing the results requires the application of the ILRT interval methodology using the expert elicitation to change the probability of pre-existing leakage in the containment.

The baseline assessment uses the Jeffreys non-informative prior and the expert elicitation sensitivity study uses the results of the expert elicitation. In addition, given the relationship between leakage magnitude and probability, larger leakage that is more representative of large early release frequency, can be reflected. For the purposes of this sensitivity, the same leakage magnitudes that are used in the basic methodology (i.e., 10 La for small and 100 La for large) are used here. Table 5-22 presents the magnitudes and probabilities associated with the Jeffreys non-informative prior and the expert elicitation used in the base methodology and this sensitivity case.

Table 5 CNS Summary of ILRT Extension Using Expert Elicitation Values (from Reference 24)

Leakage Size (La)

Jeffreys Non-Informative Expert Elicitation Mean Percent Reduction Prior Probability of Occurrence 10 2.70E-02 3.BBE-03 86%

100 2.70E-03 9.86E-04 64%

Taking the baseline analysis and using the values provided in Table 5-10 -Table 5-12 for the expert elicitation sensitivity yields the results in Table 5-23.

Revision 3 Page 32 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Table 5 CNS Summary of ILRT Extension Using Expert Elicitation Values Accident ILRT Interval Class 3 per 10 Years 1 per 10 Years 1 per 15 Years Base Adjusted Dose Dose Rate Frequency Dose Rate Frequency Dose Rate Frequency Base (person-(person-(person-(person-Frequency rem) rem/yr) rem/yr) rem/yr) 1 5.10E-05 5.0?E-05 1.72E+03 8.73E-02 5.02E-05 8.63E-02 4.97E-05 8.56E-02 2

3.58E-09 3.58E-09 9.41E+04 3.37E-04 3.58E-09 3.37E-04 3.58E-09 3.37E-04 3a N/A 1.98E-07 1.72E+04 3.40E-03 6.59E-07 1.13E-02 9.89E-07 1.?0E-02 3b N/A 5.03E-08 1.72E+05 8.65E-03 1.68E-07 2.88E-02 2.51E-07 4.32E-02 6

O.OOE+OO O.OOE+OO O.OOE+OO O.OOE+OO 0.00E+OO O.OOE_+OO O.OOE+OO O.OOE+OO 7

8.49E-07 8.49E-07 7.69E+05 6.52E-01 8.49E-07 6.52E-01 8.49E-07 6.52E-01 8

8.22E-07 8.22E-07 8.08E+06 6.64E+OO 8.22E-07 6.64E+OO 8.22E-07 6.64E+OO Totals 5.27E-05 5.27E-05 9.14E+06 7.40E+OO 5.27E-05 7.42E+OO 5.27E-05 7.44E+OO LlLERF (3 per NIA 1.17E-07 2.01E-07 10 vrs base)

LlLERF (1 per NIA NIA 8.38E-08 10 yrs base)

CCFP 3.27%

3.50%

3.66%

The results illustrate how the expert elicitation reduces the overall change in LERF and the overall results are more favorable with regard to the change in risk.

5.3.4 Large Leak Probability Sensitivity Study The large leak probability is a vital portion of determining the Class 3b frequency. CNS had previously calculated the large leak probability using the WCAP method. Table 5-24 presents the large leak probabilities for the baseline test, 10 year test interval, and 15 year test interval.

Table 5-24 was developed using the same process as to calculate Class 3b.

Table 5 CNS Large Leak Probabilities Using the WCAP Method Test Interval WCAP Large Leak Probability EPRI Accident Class 3b Frequency 3 per 10 years 2.47E-4 1.26E-08 10 years 7.41E-4 3.78E-08 15 years 1.11 E-3 5.66E-08 Using the same EPRI approach, but with an updated Class 3b frequency calculated from the WCAP large leak probability data, Table 5-25 contains the final results.

Table 5 Impact on LERF due to Extended Type A Testing Intervals with WCAP CDF ILRT Inspection Interval 3 Years (baseline) 10 Years 15 Years Class 3b (Type A LERF) 1.26E-08 3.78E-08 5.66E-08 LlLERF (3 year baseline) 4.40E-08 LlLERF (1 O year baseline) 1.88E-08 These results demonstrate that the EPRI methodology is conservative when used to calculate a large leak probability as compared to the WCAP method.

Revision 3 Page 33 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5.3.5 SGTR Success Criteria In response to F&O AS-04, a sensitivity was performed to conservatively change the PRA model logic to approximate the SGTR success criteria changes necessary to reconstruct the SGTR portion of the model. Changes in Success Criteria modeling are based on guidance provided in Reference 43. Since no top logic was deleted from the model (failure logic was added), the risk can only increase as a result of this sensitivity. Under the SGTR Containment Bypass logic, OR gate G086 was added to add new logic; under gate G086, three OR gates (G067, G087, G099) were added to represent three sets of accident scenarios that lead to core damage following a SGTR initiating event. Under gate G067 is AND gates G063, G068, and G073; under gate G087 is AND gates G088 and G089; and under gate G099 is AND gates G100 and G101 with scenario failure logic. Table 5-26 describes the scenario failure logic (and model gates) for these seven gates.

Gate G063 Table 5 Added SGTR Failure Scenarios SGTR Scenario Description SSHR Success; Failure of SG Isolation (YOLARGE), High Pressure Injection (YU), SG Depressurization (YD3SG)

SSHR Success; G068 Failure of SG Isolation (YOLARGE), High Pressure Injection (YU), RHR via Shutdown Cooling (SC-LX1)

G073 G088 G089 G100 SSHR Success; Failure of SG Isolation (YOLARGE), FWST Refill (NDORWSTDHE), Primary System Depressurization using Sprays (YD1) or Pressurizer PORV (YD2)

SSHR and SG Isolation Success; Failure of High Pressure Injection (YU), Primary System Depressurization using Sprays (YD1) or Pressurizer PORV (YD2), SG Depressurization (YD3SG)

SSHR and SG Isolation Success; Failure of FWST Refill (NDORWSTDHE), Primary System Depressurization using Sprays (YD1) or Pressurizer PORV (YD2), SG Depressurization (YD3SG)

Failure of SSHR (F1), Feed and Bleed (SBPU10, YU)

G101 Failure of SSHR (F1 ), High Pressure Sump Recirculation (SX03)

1.

Gate SC-LX is replicated from LX; the only difference is the gates for RHR suction from the sump (L 107R, L207R) are replaced with suction from the corresponding hot leg (loop C hot leg for ND pump B, loop B hot leg for ND pump A).

Total GDF increases by less than 1 %; therefore, there is only a negligible change in Class 3b frequency. Total LERF increases significantly. Therefore, the only significant effect this sensitivity has on the ILRT extension application is to the overall LERF criteria for Region II in RG 1.174 [Reference 4]. This sensitivity results in a LERF increase of 3.0E-7/year. Therefore, baseline LERF (excluding external events) is 1.97E-6/year (2.05E-6/year if fire and tornado risk from the original quantification is included [Reference 17]), and there is still significant margin for both the b.LERF and baseline LERF to the upper limits of Region II in RG 1.17 4 [Reference 4].

5.3.6 Remove Credit for ISLOCA Isolation MOVs The cr3b model used in this analysis credits ISLOCA isolation MOVs; however, industry guidance is to remove credit for these MOVs. A sensitivity study was performed where credit was removed for the ISLOCA isolation MOVs (Nl178B and Nl173A). The failure data for check valve rupture (CVR) was also updated to the data presented in the 2010 Parameter Estimation Update of NUREG/CR-6928 [Reference 54]; this helps mitigate risk increase from removing the ISLOCA isolation MOV credit. Since the change was similar for GDF and LERF, b.LERF did not change. Using the internal events model with the updated internal flood model [Reference 39],

removing credit for MOVs Nl178B and Nl173A, and updating the check valve failure rate, GDF and LERF were each estimated to decrease by 2.28E-8.

Revision 3 Page 34 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 5.3.7 Failure Data Update As mentioned in F&O DA-02 (see Table A-1), some of the failure data used in the PRA model for the ILRT extension analysis was outdated. A recent data update incorporated generic failure data through 2010 and plant-specific failure data through 2013 [Reference 66]. A sensitivity was performed to estimate the effect of updating the data in the Internal Events PRA model. The updated type code data was mapped to the existing type codes in the cr3b model. Then, the updated type codes were input into the cr3b model. Since this sensitivity focuses on the Internal Events model, legacy fire and tornado and internal flood risk was excluded. As stated in Section 5.1.2, the CDF with legacy fire and tornado risk removed is 5.27E-5, and the Internal Flood CDF is 3.92E-5. Therefore, the Internal Events CDF is 1.35E-5. As stated in Section 5.1.2, the LERF with legacy fire and tornado risk removed is 1.67E-6, and the Internal Flood LERF is 5.58E-7.

Therefore, the Internal Events LERF is 1.12E-6. The Internal Events CDF decreased slightly from 1.35E-5 to approximately 1.30E-5 and the LERF decreased from 1.12E-6 to approximately 6.53E-7 (note: these values are rounded slightly to maintain consistency with the risk values reported in References 17 and 39).

6.0 RESULTS The results from this ILRT extension risk assessment for CNS are summarized in Table 6-1.

Table 6 ILRT Extension Summary Class Dose Base Case Extend to Extend to (person-rem) 3 in 10 Years 1 in 10 Years 1in15 Years CDFNear Person-CDFNear Person-CDFNear Person-RemNear RemNear Rem/Year 1.72E+03 5.04E-05 8.67E-02 4.90E-05 8.43E-02 4.80E-05 8.26E-02 2

9.41E+04 3.58E-09 3.37E-04 3.58E-09 3.37E-04 3.58E-09 3.37E-04 3a 1.72E+04 4.70E-07 8.08E-03 1.57E-06 2.69E-02 2.35E-06 4.04E-02 3b 1.72E+05 1.17E-07 2.01E-02 3.90E-07 6.70E-02 5.85E-07 1.01 E-01 6

0.00E+OO 0.00E+OO O.OOE+OO O.OOE+OO O.OOE+OO O.OOE+OO O.OOE+OO 7

7.69E+05 8.49E-07 6.52E-01 8.49E-07 6.52E-01 8.49E-07 6.52E-01 8

8.08E+06 8.22E-07 6.64E+OO 8.22E-07 6.64E+OO 8.22E-07 6.64E+OO Total 5.27E-05 7.41E+OO 5.27E-05 7.48E+OO 5.27E-05 7.52E+OO I*.

1 ILRT Dose Rate from 3a and 3b b.Total From 3 Years NIA 6.34E-02 1.09E-01 Dose Rate From 10 Years NIA NIA 4.53E-02

%b.Dose From 3 Years NIA 0.86%

1.47%

Rate From 10 Years NIA NIA 0.61%

<<f,-

>'*J'

-~

3 bF requency (L ERF )

From 3 Years NIA 2.73E-07 4.68E-07 b.LERF From 10 Years NIA NIA 1.95E-07 I.

CCFP%

From 3 Years NIA 0.518%

0.888%

b.CCFP%

From 10 Years NIA NIA 0.370%

Revision 3 Page 35 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension 7.0 CONCLUSIONS AND RECOMMENDATIONS Based on the results from Section 5.2 and the sensitivity calculations presented in Section 5.3, the following conclusions regarding the assessment of the plant risk are associated with extending the Type A ILRT test frequency to 15 years:

Regulatory Guide 1.17 4 [Reference 4] provides guidance for determining the risk impact of plant-specific changes to the licensing basis. Regulatory Guide 1.17 4 defines very small changes in risk as resulting in increases of CDF less than 1.0E-06/year and increases in LERF less than 1.0E-07/year. Since the ILRT does not impact CDF, the relevant criterion is LERF. The increase in LERF resulting from a change in the Type A ILRT test interval from 3 in 10 years to 1 in 15 years is estimated as 4.68E-07/year using the EPRI guidance (this value increases negligibly if the risk impact of corrosion-induced leakage of the steel liners occurring and going undetected during the extended test interval is included), and baseline LERF is 1.67E-6. As such, the estimated change in LERF is determined to be "small" using the acceptance guidelines of Regulatory Guide 1.17 4 [Reference 4].

The effect resulting from changing the Type A test frequency to 1-per-15 years, measured as an increase to the total integrated plant risk for those accident sequences influenced by Type A testing, is 0.109 person-rem/year. EPRI Report No. 1009325, Revision 2-A [Reference 24] states that a very small population dose is defined as an increase of:::; 1.0 person-rem per year, or:::; 1 % of the total population dose, whichever is less restrictive for the risk impact assessment of the extended ILRT intervals. The results of this calculation meet these criteria. Moreover, the risk impact for the ILRT extension when compared to other severe accident risks is negligible.

The increase in the conditional containment failure probability from the 3 in 1 O year interval to 1 in 15 year interval is 0.888%. EPRI Report No. 1009325, Revision 2-A

[Reference 24] states that increases in CCFP of:::; 1.5% is very small. Therefore, this increase is judged to be very small.

Therefore, increasing the ILRT interval to 15 years is considered to be insignificant since it represents a very small change to the CNS risk profile.

Previous Assessments The NRC in NUREG-1493 [Reference 6] has previously concluded that:

Reducing the frequency of Type A tests (ILRTs) from 3 per 1 O years to 1 per 20 years was found to lead to an imperceptible increase in risk. The estimated increase in risk is very small because ILRTs identify only a few potential containment leakage paths that cannot be identified by Type B or Type C testing, and the leaks that hc;ive been found by Type A tests have been only marginally above existing requirements.

Given the insensitivity of risk to containment leakage rate and the small fraction of leakage paths detected solely by Type A testing, increasing the interval between integrated leakage-rate tests is possible with minimal impact on public risk. The impact of relaxing the ILRT frequency beyond 1 in 20 years has not been evaluated. Beyond testing the performance of containment penetrations, ILRTs also test integrity of the containment structure.

Revision3 Page 36 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension The findings for CNS confirm these general findings on a plant-specific basis considering the severe accidents evaluated for CNS, the CNS containment failure modes, and the local population surrounding CNS.

Revision 3 Page 37 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension A.

ATTACHMENT 1 A.1.

Internal Events PRA Quality Statement for Permanent 15-Year ILRT Extension The CNS internal events PRA model (Revision 3b) is used to calculate GDF and LERF for the permanent 15-year ILRT extension. Any elements of the supporting requirements detailed in ASME/ANS RA-Sa-2009 that could be significantly affected by the application are required to meet Capability Category II requirements.

The internal events PRA provides an adequate base model for the development of the permanent 15-year ILRT extension. In accordance with RG 1.200, the most recent full scope CNS Internal Events PRA Peer Review was performed in March 2002 using the peer review process described in NEI 00-02 (Attachment U of Reference 33). More recently, focused scope peer reviews have been conducted on the CNS LERF PRA model and the CNS Internal Flooding PRA model. The results from these focus scope peer reviews are discussed in section A.1.1 for LERF and A.1.2 for Internal Flooding.

In March 2002, the CNS internal events PRA model received a peer review to certify the acceptability of PRAs before a consensus PRA Standard was available. The industry-developed process and methodology outlined in NEI 00-02 was used for the peer review. The review process was originally developed and used by the Boiling Water Reactor Owners Group (BWROG) and subsequently broadened to be an industry-applicable process through the NEI Risk Applications Task Force.

Revision 2b of the CNS internal events PRA was the model of record at the time of the peer review. The Revision 3 model was used as the basis for the Fire PRA model which supports the NFPA 805 transition.

The NEI 00-02 Peer Review process used grades to assess the relative techni.cal merits and capabilities of each sub-element reviewed. The grades provide guidance on appropriate use of the information covered by the sub-element for risk-informed applications. Per NEI 05-04, Revision 2, "Process for Performing Internal Events PRA Peer Review$ Using the ASME/ANS PRA Standard", in general, the following approximate correspondence exists between the NEI 00-02 grading system and the ASME/ ANS PRA Standard RA-Sa-2009:

NEI 00-02 ASME PRA Standard Grade 1 No equivalent "grade" Grade 2 Capability Category I Grade 3 Capability Category II Grade 4 Capability Category Ill Approximately 73% of the graded sub-elements received grades of 3 or higher. None of the sub-elements received a grade of 1 (or contingent 2), and 27 % of the sub-elements received a grade of 2 or contingent 3 (roughly 75% of this group was contingent grade 3).

F&Os from the 2002 peer review were assigned a significance level of A, B, C, D, or S based on guidance in NEI 00-02. Significance level A and B are equivalent to "Findings" in NEI 05-04 Revision 2. There were no level A F&Os; there were 32 level B F&Os, and 1 superior notation.

In the time since the NEI 00-02 peer review, focused peer reviews have been performed for the internal flood and LERF models, which supersede one of the 32 F&Os.

In 2008, Duke Energy performed a self-assessment that evaluated the differences between the original peer review against NEI 00-02 and RA-S-2008 of the ASME/ANS PRA Standard, as endorsed by Regulatory Guide 1.200, Revision 1.

Revision 3 Page 38 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension In 2013, Duke Energy performed a self-assessment against the ASME/ANS PRA Standard RA-Sa~2009 supporting requirements, as endorsed by Reg. Guide 1.200 Revision 2.

Table A-1 presents an assessment of all ASME/ANS PRA Standard RA-Sa-2009 supporting requirements that were assessed to be "Not Met" at the equivalent of Capability Category II in the 2002 peer review, were not assessed in the 2002 peer review (no equivalent NEI 00-02 sub-elements), or were assessed to be "Met" but had related Findings. Regulatory Guide 1.200, Appendix B was used to correlate NEI 00-02 sub-elements to ASME/ANS PRA Standard RA-Sa-2009 supporting requirements for the assessments. F&Os from the 2002 peer review are dispositioned for the applicable ASME/ANS PRA Standard RA-Sa-2009 SRs.

All changes to the CNS internal events PRA model since the last full-scope peer review have been reviewed and, with the exception of the LERF and Internal Flood PRA models for which focused-scope peer reviews were performed, there are no changes that are considered PRA upgrades as defined in ASME/ANS-RA-Sa-2009, as endorsed by Regulatory Guide 1.200 Revision 2. The CNS Internal Events PRA was judged to meet Capability Category II consistent with RG 1.200 guidance.

A.1.1 LERF PRA Quality Statement In December 2012, a focused scope peer review was performed of the CNS LERF PRA against selected requirements of the ASME/ANS PRA Standard RA-Sa-2009, and any Clarifications and.Qualifications provided in the NRC endorsement of the Standard contained in Revision 2 to RG 1.200. The peer review was performed using the process defined in NEI 05-04. The scope of the review was limited to the High Level Requirements and SRs in Part 2, Requirements for Internal Events At-Power PRA, Tables 2-2.8-1 and 2-2.8-2 through 2-2.8-8, of the ASME/ANS PRA Standard. The model reviewed was the LERF portion of CNS Internal Events PRA Model.

The ASME/ANS PRA Standard contains a total of 41 numbered SRs for the LERF portion of the internal events standard requirements. Two of the LERF SRs were determined to be not applicable to the CNS LERF PRA. Of the 39 applicable SRs, 26 SRs, ot 67%, were rated as SR Met, Capability Category I/II, or greater. Only two SRs were not met. However, 11, or 28%, of the SRs were assessed at Capability Category I. CNS uses a LERF model based on the simplified U~RF model in NUREG/CR-6595. While a NUREG/CR-6595 model is classified as Capability Category I, the NRC has determined this to be of sufficient capability to support risk-informed applications.

In the course of this review, 9 new F&Os were prepared, including 6 suggestions and 3 findings.

Table A-2 lists the 13 SRs that were assessed at Capability Category I or Not Met and the related findings, including the peer review assessment comments, the disposition and status for each of the findings, and an assessment of the impact on the ILRT extension application.

A.1.2 Internal Flood PRA Quality Statement In September 2012, a focused scope peer review was performed of the CNS Internal Flood PRA using the NEI 05-04 process and the ASME PRA Standard AS ME/ANS RA-Sa-2009, along with the NRC clarifications provided in Regulatory Guide 1.200, Revision 2. The peer review concluded that 56 of the total 62 numbered SRs outlined within the 2009 ASME PRA Standard for At-Power Internal Flood met Capability Category II or greater. Five of the SRs were rated as Not Met and 1 was rated as CC I.

The independent peer review identified 17 new F&Os which are comprised of 9 findings, 7 suggestions, and 1 best practice. Table A-3 presents the SRs and related F&O findings, including the peer review assessment comments, the disposition and status for each of the findings, and an assessment of the impact on the ILRT extension application.

Revision 3 Page 39 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension A.2.

Fire PRA Quality Statement for Permanent 15-Year ILRT Extension In accordance with RG 1.205 position 4.3:

"The licensee should submit the documentation described in Section 4.2 of Regulatory Guide 1.200 to address the baseline PRA and application-specific analyses. For PRA Standard "supporting requirements" important to the NFPA 805 risk assessments, the NRC position is that Capability Category JI is generally acceptable."

The Catawba Internal Events model was also updated to support the Catawba Fire PRA. The CNS Fire PRA Peer Review was performed on July 12-16, 2010 using RG 1.200, Revision 2, the combined PRA standard, ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Revision 2, and the NEI 07-12 Fire PRA peer review process (Attachment V of Reference 33). The purpose of this review was to provide a method for establishing the technical quality and adequacy of the Fire PRA for the spectrum of potential risk-informed plant licensing applications for which the Fire PRA may be used. The peer review findings were addressed and the dispositions reviewed to validate that no changes were made which meet the definition of a PRA model upgrade per RG 1.200. Therefore, no additional peer reviews, partial scope or focused scope, were required to be conducted for the CNS Fire PRA.

"T:he CNS Fire PRA was judged to meet Capability Category II consistent with RG 1.205 guidance. A total of twenty (20) F&O findings and twenty-nine (29) F&O suggestions (plus 1 best practice F&O) were generated. The capability categories ate defined in ASME/ANS RA-Sa-2009, Part 4, "Requirements for Fires At-Power PRA." The peer review report noted that there were 13 SRs where the standard was not met. Sixteen F&Os were issued against SRs which met Capability Category I (some classified as "findings" and some addressed via "suggestions"). The findings have been resolved with the dispositions summarized in Table A-4.

The impact of those areas where only the Capability Category I requirement was met is summarized in Table A-5. All F&Os that were defined as suggestions have been dispositioned.

No changes were made in the resolution of the findings that meet the definition of a model

upgrade as defined by RG 1.200; therefore, a follow-up peer review is not required. The Fire PRA is judged to be adequate to support the ILRT extension.

A.3.

High Wind PRA Quality Statement for Permanent 15-Year ILRT Extension The HWPRA was assessed by a peer team against ASME/ANS PRA standard with RG 1.200 Revision 2 clarifications in August of 2013. The peer team documented the Facts and Observations (F&Os) that pertain to the CNS HWPRA in LTR-RAM-11-13-077 [Reference 44].

Each of these F&Os are resolved or dispositioned in order to ensure the capability category of each individual Standard Requirement is met so that the CNS HWPRA can be used to support risk-informed applications. Table A-6 shows the findings and resolutions.

Revision 3 Page 40 of 198

54003-CALC-02 SR IE-A1 IE-A2 2009 ASME/ANS Cat II Requirement IDENTIFY those initiating events that challenge normal plant operation and that require successful mitigation to prevent core damage using a structured, systematic process for identifying initiating events that accounts for plant-specific features. For example, such a systematic approach may employ master logic diagrams, heat balance fault trees, or failure niodes and effects analysis (FMEA). Existing lists of known initiators are also commonly employed as a starting point.

INCLUDE in the spectrum of internal-event challenges considered at least the following general categories:

(a) Transients. INCLUDE among the transients both equipment and human-induced events that disrupt the plant and leave the primary system pressure boundary intact.

(b) LOCAs. INCLUDE in the LOCA category both equipment and human-induced events that disrupt the plant by causing a breach in the core coolant system with a resulting loss of core coolant inventory.

DIFFERENTIATE the LOCA initiators, using a defined rationale for the differentiation. Examples of LOCA types include (1) Small LOCAs. Examples: reactor coolant pump seal LOCAs, small pipe breaks (2) Medium LOCAs.

Examples: stuck open safety or relief valves (3) Large LOCAs.

Exam les: inadvertent ADS, Revision 3 Status Dispositioned Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation F&O IE-03: Although SAAG 691 states that a review of plant systems was performed to search for support initiators, documentation of the review was not located. Each system notebook includes a section indicating whether or not it was determined that loss of that system leads to an initiating event.

However, there was no discussion in SAAG 691 or the system notebooks to indicate that the process followed was sufficiently structured to capture potential initiators across various system alignments and support system alignments, and to consider initiating event precursors.

This finding was made against NEI SR IE-10 with grade 3 being contingent on its resolution.

F&O IE-06: The Loss of HVAC initiator was removed, because operators may shut down the plant from remote locations (the Auxiliary Shutdown Panel and the SSF) if the Control Room is incapable of maintaining inventory control. This is an inadequate reason to omit an IE. If loss of HVAC causes a plant trip and requires SSD from the ASP, that sequence should be identified and modeled. Note that the switchgear room may also be affected by failed HVAC. A particular example is the possibility that the switchgear chiller is working, in which case the operators may not diagnose the situation in time.

Disposition The NEI SRs applicable to this ASME SR are IE-7, IE-8, IE-9, and IE-1 o, and there are no industry self-assessment actions and no NRC objections. The original Peer Review rated IE-7 and IE-9 as "3" and IE-8 and IE-10 as "3 with contingencies." IE-10 has one level "B" F&O: IE-03.

F&O IE-03: Support systems were reviewed to identify plant specific initiating events and documentation of the review and approach has been added to CNC-1535.00-00-0114 Rev 0.

Since the Peer Review rated all of the applicable NEI SRs as "3" and there are no remaining open level "B" F&Os, this ASME SR is now Met Cat II.

The NEI SRs applicable to this ASME SR are IE-5, IE-7, IE-9, and IE-10, and there are no NRC objections. There is an industry action to confirm that the appropriate initiators were included. The original Peer Review rated IE-7 and IE-9 as "3" and IE-5 and IE-10 as "3 with contingencies." IE-5 has one level "B" F&O: IE-06; IE-10 has one level "B" F&O: IE-03. F&O IE-03 is more applicable to SRs IE-A1, IE-A5 and IE-A6, and is dispositioned under those SRs.

F&O IE-06: This SR is not met because the loss of switchgear HVAC initiating event is not included in the PRA. Any additional risk added by including the VC/YC systems in the PRA model would be small and would not have a significant impact on results for the ILRT extension application.

Impact on ILRT Extension There were no F&Os with "A" level of significance at CNS and there are no remaining open F&Os with "B" level of significance related to this SR. There is no impact to the ILRT extension.

Room heat-up analyses were performed for the switchgear rooms, battery rooms, and the control room

[References 40, 41, and 42].

The results of these analyses show that equipment in these rooms will not be adversely impacted by the loss of HVAC over the 24-hour mission time. There is no impact to the ILRT extension.

Page 41 of 198

54003-CALC-02 SR JE-A5 2009 ASME/ANS Cat II Requirement component ruptures (4) Excessive LOCAs (LOCAs that cannot be mitigated by any combination of engineered systems). Example:

reactor pressure vessel rupture (5)

LOCAs Outside Containment.

Example: primary system pipe breaks outside containment (BWRs).

(c) SGTRs. INCLUDE spontaneous rupture of a steam generator tube (PWRs).

(d) ISLOCAs. INCLUDE postulated events in systems interfacing with the reactor coolant system that could fail or be operated in such a manner as to result in an uncontrolled loss of core coolant outside the containment [e.g.,

interfacing systems LOCAs (ISLOCAs)].

(e) Special initiators (e.g., support systems failures, instrument line breaks) [Note (1)].

PERFORM a systematic evaluation of each system, including support systems, to assess the possibility of an initiating event occurring due to a failure of the system.

USE a structured approach [such as a system-by-system review of initiating event potential, or a failure modes and effects analysis (FMEA), or other systematic process] to assess and document the possibility of an initiating event resulting from individual systems or train failures.

Revision 3 Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation F&O IE-03: Although SAAG 691 states that a review of plant systems was performed to search for support initiators, documentation of the review was not located. Each system notebook includes a section indicating whether or not it was determined that loss of that system leads to an initiating event.

However, there was no discussion in SAAG 691 or the system notebooks to indicate that the process followed was sufficiently structured to capture potential initiators across various system alignments and support system alignments, and to consider initiating event precursors.

This finding was made against NEI SR IE-1 O with grade 3 being contingent on its resolution.

Disposition The NEI SRs applicable to this ASME SR are IE-5, IE-7, IE-9, and JE-10, and there are no NRC objections. There is an industry action to check for initiating events that can be caused by a train failure or a system failure. The original Peer Review rated IE-7 and IE-9 as "3" and IE-5 and IE-10 as "3 with contingencies." IE-5 has one level "B" F&O: JE-06; JE-10 has one level "B" F&O: JE-03. F&O IE-06 is more applicable to SR IE-A2 and is dispositioned under that SR.

F &O I E-03: Support systems were reviewed to identify plant specific initiating events and documentation of the review and approach has been added to CNC-1535.00-00-0114 Rev 0. Thi~ is considered to resolve the finding and achieve grade 3 of N El SR I meet CAT II of theASME SR.

Impact on ILRT Extension Based on the disposition, the requirements of Cat II are considered met. There is no impact to the ILRT extension.

Page 42 of 198

54003-CALC-02 SR IE-A6 IE-AB IE-A9 2009 ASME/ANS Cat 11 Requirement When performing the systematic evaluation required in IE-AS, INCLUDE initiating events resulting from multiple failures, if the equipment failures result from common cause, and from routine system alignments.

INTERVIEW plant personnel (e.g.,

operations, maintenance, engineering, safety analysis) to determine if potential initiating events have been overlooked.

REVIEW plant-specific operating experience for initiating event precursors, for identifying additional initiating events. For example, plant-specific experience with intake structure clogging might indicate that loss of intake structures should be identified as a potential initiating event.

Revision 3 Status Dispositioned Open Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation F&O IE-03: Although SAAG 691 states that a review of plant systems was performed to search for support initiators, documentation of the review was not located. Each system notebook includes a section indicating whether or not it was determined that Joss of that system leads to an initiating event.

However, there was no discussion in SAAG 691 or the system notebooks to indicate that the process followed was sufficiently structured to capture potential initiators across various system alignments and support system alignments, and to consider initiating event precursors.

This finding was made against NEI SR IE-10 with grade 3 being contingent on its resolution.

None F&O IE-03: Although SAAG 691 states that a review of plant systems was performed to search for support initiators, documentation of the review was not located. Each system notebook includes a section indicating whether or not it was determined that Joss of that system leads to an initiating event.

However, there was no discussion in SAAG 691 or the system notebooks to indicate that the process followed was sufficiently structured to capture potential initiators across various system alignments and support system alignments, and to consider initiatin event recursors.

Disposition The NEJ SRs applicable to this ASME SR are IE-5, IE-7, IE-9, and IE-10, and there are no NRC objections. There is an industry action to check for initiating events that can be caused by multiple failures, if the equipment failures result from a common cause or from routine system alignments. The original Peer Review rated IE-7 and IE-9 as "3" and IE-5 and IE-10 as "3 with contingencies." IE-5 has one level "B" F&O: JE-06; IE-10 has one level "B" F&O: IE-03. F&O IE-06 is more applicable to SR IE-A2 and is dispositioned under that SR.

F &O I E-03: Support systems were reviewed to identify plant specific initiating events and documentation of the review and approach has been added to CNC-1535.00-00-0114 Rev 0. CNC-1535.00-00-0114 Rev 0 documents the reviews of the common cause failure events and review of maintenance rule function for consideration of initiating events from multiple failures. This is considered to resolve the finding and achieve grade 3 of NEI SR I meet CAT II of the ASME SR.

There are no NEI SRs applicable to this ASME SR.

An extensive search for initiating events has been performed in CNC-1535.00-00-0114 Rev 0, so it is unlikely that interviews with plant personnel would result in the addition of any new initiators to the internal events model. However, the interviews need to be performed and documented.

Self-assessment DPC-1535.00-00-0013 indicates that this requirement has not been met for CNS. Specifically, no interviews with plant personnel have been performed or documented.

The NEI SRs applicable to this ASME SR are IE-10 and IE-16, and there are no industry self-assessment actions and no NRG objections.

The original Peer Review rated IE-16 as "3" and IE-10 as "3 with contingencies." IE-10 has one level "B" F&O: IE-03.

F&O IE-03: Plant-specific operating experience has been reviewed for initiating event precursors. This review is documented in CNC-1535.00-00-0114 Rev 0. This is considered to resolve the finding and achieve grade 3 of NEI SR I meet CAT II of the ASME SR.

Impact on ILRT Extension Based on the disposition, the requirements of Cat II are considered met. There is no impact to the ILRT extension.

Based on the disposition, the requirements for this SR are considered not met, but it is unlikely that interviews with plant personnel would change the model in a way that would affect the JLRT extension. There is no impact to the ILRT extension.

There were no F&Os with "A" level of significance at CNS and there are no remaining open F&Os with "B" level of significance related to this SR. No impact on the ILRT extension.

Page 43 of 198

54003-CALC-02 SR IE-82 IE-CS IE-C6 2009 ASME/ANS Cat II Requirement USE a structured, systematic process for grouping initiating events. For example, such a systematic approach may employ master logic diagrams, heat balance fault trees, or failure modes and effects analysis (FMEA).

CALCULATE initiating event frequencies on a reactor year basis

[Note (1}]. INCLUDE in the initiating event analysis the plant availability, such that the frequencies are weighted by the fraction of time the plant is at-power.

USE as screening criteria no higher than the following characteristics (or more stringent characteristics as devised by the analyst) to eliminate initiating events or groups from further evaluation:

(a) the frequency of the event is less than 1 E-7 per reactor year

(/yr), and the event does not involve either an ISLOCA, containment bypass, or reactor pressure vessel rupture Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Status Finding/Observation This finding was made against NEI SR IE-1 o with grade 3 being contingent on its resolution.

Disposilioned None Dispositioned None Dispositioned F&O IE-06: The Loss of HVAC initiator was removed, because operators may shut down the plant from remote locations (the Auxiliary Shutdown Panel and the SSF) if the Control Room is incapable of maintaining inventory control. This is an inadequate reason to omit an IE. If loss of HVAC causes a plant trip and requires SSD from the ASP, that sequence should be identified and modeled. Note that the switchgear room may also be affected by failed HVAC. A particular example is the possibility that the switchgear chiller is working, in which case the operators may not diagnose the situation in lime.

Disposition The NEI SRs applicable to this ASME SR are IE-4 and IE-7, and there are no industry self-assessment actions and no NRC objections. The original Peer Review rated IE-7 as "3" and IE-4 as "3 with contingencies." There were no F&Os with "A" level of significance at CNS and there are no level "B" F&Os associated with either of these NEI SRs.

Initialing events were combined into groups and a systematic approach was used as documented in CNC-1535.00-00-0114 Rev 0 and CNC-1535.00-00-0031 Rev 0 (SAAG 691).

Self-assessment DPC-1535.00-00-0013, Rev. 3 indicates that this requirement has not been met for CNS. Specifically, documentation of a structured, systematic approach to grouping initiating events was found to need enhancement.

There are no NEI SRs applicable to this ASME SR. Initiating event frequencies are calculated on a reactor year basis. The plant availability factor is included in the calculations. This is considered to meet CAT II of the ASME/ANS PRA Standard.

There are no NEI SRs applicable to this ASME SR. Although IE-C6 does not correlate directly to an NEI SR assessed by the peer review team, F&O IE-06 is judged lo be applicable to this SR. The loss of Switchgear and Control Room HVAC systems are not modeled as initiating events in the Catawba PRA, and are excluded based on judgment, but the criteria in I E-C6 should be used to justify the exclusion. Any additional risk added by including the VC/YC systems in the PRA model would be small and would not have a significant impact on the ILRT extension application.

Impact on ILRT Extension There were no F&Os with "A" level of significance at CNS and there are no level "B" F&Os related to this SR.

Documentation issue has no impact on the ILRT extension.

Based on the disposition, the requirements of Cat II are considered met. There is no impact to the ILRT extension.

Room heat-up analyses were performed for the switchgear rooms, battery rooms, and the control room

[References 40, 41, and 42].

The results of these analyses show that equipment in these rooms will not be adversely impacted by the loss of HVAC over the 24-hour mission time. There is no impact to the ILRT extension.

Page 44 of 198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement (b) the frequency of the event is less than 1 E-6/yr, and core damage could not occur unless at least two trains of mitigating systems are failed independent of the initiator, or (c) the resulting reactor shutdown is not an immediate occurrence. That is, the event does not require the plant to go to shutdown conditions until sufficient time has expired during which* the initiating event conditions, with a high degree of certainty (based on supporting calculations), are detected and corrected before normal plant operation is curtailed (either administratively or automatically).

If either criterion (a) or (b) above is used, then CONFIRM that the value specified in the criterion meets the applicable requirements in Data Analysis (2-2.6) and Level 1 Quantification (2-2.7).

IE-CS If fault tree modeling is used for initiating events, QUANTIFY the initiating event frequency [as opposed to the probability of an initiating event over a specific time frame, which is the usual fault tree quantification model described in Systems Analysis (2-2.4)].

MODIFY, as necessary, the fault tree computational methods that are used so that the top event quantification produces a failure frequency rather than a top event probability as normally computed.

USE the applicable requirements in Revision 3 Status Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation F&O IE-OB: The estimation of the frequency of the loss service water (RN) is incorrect in the application of common cause factors. A "mission time" of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is used to describe the failure of all four pumps in the calculation of a yearly frequency. The equation used is basically:

Lambda*72 hours

Beta

Gamma

Delta.

Note that Lambda*72 hours is the frequency of a pump failing to run for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The CCF factors are dimensionless and represent the failure of the other three pumps.

The equation above calculates the frequency of failure in* a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months period. The "mission time" must be consistent with the frequency being calculated.

That is, one would expect the frequency for an 18 Disposition There are no NEI SRs applicable to this ASME SR. Although IE-CB does not correlate directly to an NEI SR assessed by the peer review team, F&O IE-08 is judged to be applicable to this SR. The F&O remains open (PRA Tracker C-03-0049) to implement a widely-accepted approach for CCF treatment of components in initiator analyses once developed.

Impact on ILRT Extension At the time this F&O was issued, there was no industry consensus on how to model CCFs across running and standby trains in IE fault trees. Since then, EPRI has published guidance in technical report 1016741[Reference46].

For Catawba, the exposure time frame for potential common cause run failure is based on a consideration of mean time to repair (MTTR) and Tech. Spec. Comi:>letion Page 45 of 198

54003-CALC-02 SR IE-C10 2009 ASME/ANS Cat II Requirement Data Analysis (2-2.6) for the data used in the fault-tree quantification.

If fault-tree modeling is used for initiating events, CAPTURE within the initiating event fault tree models all relevant combinations of events involving the annual frequency of one component failure combined with the unavailability (or failure during the repair time of the first component) of other components.

Revision 3 Status Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation month period (a refueling cycle) to be 1.5 times the frequency for a year. The current equation would provide the same frequency for a year, a refueling cycle, or the life of the plant. Ignoring a plant availability factor, the annual frequency is given by:

Lambda'8760 hours0.101 days 2.433 hours 0.0145 weeks 0.00333 months

Beta

Gamma

Delta.

Given the set of MGL parameters, the current equation underestimates the frequency by a factor of 365/3 - 122.

One upper bound is provided by NUREG/CR-5750, which estimates the frequency at about 1 E-3 per critical operating year. This value is based on individual unit critical years, and may not be appropriate for cases where the failure is a station failure, not a single unit failure. An alternative approach is to develop, via NUREG/CR-4780 techniques, more realistic MGL parameters that deal with loss of a system as an initiating event not as a design basis function.

Note the discussion does not question the MGL parameters. The point being made is the use of the parameters in calculating the frequency.

F&O IE-08: The estimation of the frequency of the loss service water (RN) is incorrect in the application of common cause factors. A "mission time" of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is used to describe the failure of all four pumps in the calculation of a yearly frequency. The equation used is basically:

Lambda'72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months

Beta

Gamma

Delta.

- Note that Lambda*72 hours is the frequency of a pump failing to run for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The CCF factors Disposition There are no NEI SRs applicable to this ASME SR. Although IE-CB does not correlate direcUy to an NEI SR assessed by the peer review team, F&O IE-08 is judged to be applicable to this SR. The F&O remains open (PRATracker C-03-0049) to implement a widely-accepted approach for CCF treatment of components in initiator analyses once developed.

Impact on ILRT Extension Time rather than application of a full year, consistent with the guidance provided in Reference 46. The EPRI document recommends using a 24-hour MTTR in the IE fault trees for model simplification and to yield results that are not excessively conservative.

Also, use of a 24-hour MTTR mission period allows use of the same value in every model. The EPRI guidance notes that use of Tech.

Spec. Completion Time periods is also a viable option that typically yields somewhat more conservative results. Since the industry consensus modeling approach is used in the Catawba PRA, the CNS loss of service water frequency is not underestimated and is appropriate. Therefore, there is no impact on the overall CDF and LERF. Therefore, there is no impact to the ILRT extension.

At the time this F&O was issued, there was no industry consensus on how to model CCFs across running and standby trains in IE fault trees. Since then, EPRI has published guidance in technical report 1016741 [Reference46].

Page 46of198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement IE-C12 COMPARE results and EXPLAIN differences in the initiating event analysis with generic data sources Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Status Finding/Observation are dimensionless and represent the failure of the other three pumps.

The equation above calculates the frequency of failure in a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months period. The "mission time" must be consistent with the frequency being calculated.

That is, one would expect the frequency for an 18 month period (a refueling cycle) to be 1.5 times the frequency for a year. The current equation would provide the same frequency for a year, a refueling cycle, or the life of the plant. Ignoring a plant availability factor, the annual frequency is given by:

Lambda*8760 hours

Beta

Gamma* Delta.

Given the set of MGL parameters, the current equation underestimates the frequency by a factor of 365/3 - 122.

One upper bound is provided by NUREG/CR-5750, which estimates the frequency at about 1 E-3 per critical operating year. This value is based on individual unit critical years, and may not be appropriate for cases where the failure is a station failure, not a single unit failure. An alternative approach is to develop, via NUREG/CR-4780 techniques, more realistic MGL parameters that deal with loss of a system as an initiating event not as a design basis function.

Note the discussion does not question the MGL parameters. The point being made is the use of the

.parameters in calculating the frequency.

Dispositioned F&O IE-04: The initiating event frequency for a stuck open PORV or safety valve is taken from NUREG/CR-5750 but is conservative for the Disposition The NEI SR applicable to this ASME SR is IE-13, and there are no industry self-assessment actions and no NRG objections. IE-13 was given a grade of "2" with F&O IE-04.

Impact on ILRT Extension For Catawba, the exposure time frame for potential common cause run failure is based on a consideration of mean time to repair (MTTR) and Tech. Spec. Completion Time rather than application of a full year, consistent with the guidance provided in Reference 46. The EPRI document recommends using a 24-hour MTTR in the IE fault trees for model simplification and to yield results that are not excessively conservative.

Also, use of a 24-hour MTTR mission period allows use of the same value in every model. The EPRI guidance notes that use of Tech.

Spec. Completion Time periods is also a viable option that typically yields somewhat more conservative results. Since the industry consensus modeling approach is used in the Catawba PRA, the CNS loss of service water frequency is not underestimated and is appropriate. Therefore, there is no impact on the overall GDF and LERF. Therefore, there is no impact to the ILRT extension.

There were no F&Os with "A" level of significance at CNS and there are no Page 47 of 198

54003-CALC-02 SR IE-C14 2009 AS ME/ANS Cat II Requirement to provide a reasonableness check of the results.

In the JSLOCA frequency analysis, INCLUDE the following features of plant and procedures that influence the ISLOCA frequency:

(a) configuration of potential pathways including numbers and types of valves and their relevant failure modes and the existence, size, and positioning of relief valves (b) provision of protective interlocks (c) relevant surveillance test procedures (d) the capability of secondary system piping (e) isolation capabilities given high flow/differential pressure conditions that might exist following breach of the secondary system Status Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation following reasons. The NUREG assigned a value to these events based on a non-informative prior updated with O events and the total number of critical reactor years in the study. In the case of a spurious opening of a primary safety valve, the model should address the potential for the valve to close as the pressure decreased, effectively terminating the Joss of coolant. The evaluation of the subsequent reclosure of the PORV is not as straightforward. The cause of the opening PORV would need to be addressed. However, either the PORV could be closed or the block valve could be closed.

None Disposition F &O I E-04 appears to be an observation of conservatism in usage of generic industry data for stuck open SRV and PORV initiating events.

However, this treatment is judged to be appropriate, and so this is considered to meet CAT II of the ASME/ANS PRA Standard.

The NEI SR applicable to this ASME SR is IE-14, and there are no NRG objections. There is an industry action to confirm that secondary pipe system capability and isolation capability under high flow or differential pressures are included. The original Peer Review rated this NEI SR as "3". There were no F&Os with "N level of significance at CNS and there are no level "B" F&Os associated with this NEI SR.

Even though the NEI equivalent to this SR was assessed to be Grade 3 by the peer review team in 2002, the industry action relates to PRA Tracker Open Item C-02-0001, which indicates this item is still open.

Credit may have been given to MOVs that will not function under the differential pressure conditions that result from ruptured check valves.

This item could result in an increase in the probability of certain ISLOCAs and may impact the base model CDF and LERF.

Impact on ILRT Extension remaining open F&Os with "B" level of significance related to this SR. In addition, use of generic data for stuck open PO RV or safety valve initiating event frequency is conservative and judged to be appropriate. There is negligible impact to the ILRT extension.

If credit for the MOVs is removed, the base internal events CDF and LERF will increase. Impact on the internal events PRA LERF is expected to be greater than impact on CDF. The CDF/LERF and delta CDF/LERF values are in the middle of Region II of the RG 1.174 acceptance criteria, and the expected increase in CDF/LERF with credit for the MOVs removed is small enough that the risk metrics would remain in Region II. The ILRT extension impact is expected to be insignificant.

IE-C15 CHARACTERIZE the uncertainty in Dispositioned None There are no NEI SRs applicable to this ASME SR.

Based on the disposition, Cat II of the PRA Standard is the initiating event frequencies and PROVIDE mean values for use in Revision 3 There is no equivalent NEI SR, however, the CNS self-assessment evaluated this SR as being met, and there is documentation of the Page 48 of 198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement the quantification of the PRA results.

AS-A 1 USE a method for accident sequence analysis that AS-A2 (a) explicitly models the appropriate combinations of system responses and operator actions that affect the key safety functions for each modeled initiating event; (b) includes a graphical representation of the accident sequences in an "event tree structure" or equivalent such that the accident sequence progression is displayed; and (c) provides a framework to support sequence quantification.

For each modeled initiating event, IDENTIFY the key safety functions that are necessary to reach a safe, stable state and prevent core damage. [See Note (1).]

Revision 3 Status Open Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation AS-04: There were several observations on the modeling of event 03 in the SGTR tree:

Event 03 is generally defined as the event to cooldown to RHR conditions using 2/3 SG for depressurization. 03 includes the HEP YAGRCOLOHE, which is directed by ECA 3.1 and 3.2.

1. 03 is defined as "primary system cooldown via secondary system depressurization". Primary system depressurization must be accomplished in some sequences (YD10203, YOD3, YUOD3), by either PORV, aux spray, or main spray. These functions are not included in 03.

2. Sequence YU003 needs a T/H justification that 03 can actually prevent core damage in this circumstance. This sequence has no injection* and no SG isolation. This is "core cooling recovery" with an unisolated SGTR. ECA3 specifies cool down at less than 1 OOF/hr. The core cannot be maintained covered for the amount of time it takes to cooldown to RHR conditions at 1 OOF/hr. Suggested resolution is to use a separate function for this heading, using an operator action directed by FRC.1 and without RCP operating.

3. Sequence YUD1 QD3. comment #2 applies to this sequence as well. This is a stuck open relief PORV with no injection.

AS-04: There were several observations on the modeling of event 03 in the SGTR tree:

Event 03 is generally defined as the event to cooldown to RHR conditions using 2/3 SG for depressurization. 03 includes the HEP YAGRCOLDHE, which is directed by ECA 3.1 and 3.2.

1. 03 is defined as "primary system cooldown via secondary system depressurization". Primary system depressurization must be accomplished in some sequences (YD10203, YOD3, YUOD3), by Disposition Impact on ILRT Extension mean value and error factor for the initiating event frequencies, so this met. There is no impact on is considered to meet CAT II of the AS ME/ANS.PRA Standard.

the ILRT extension The NEI SRs applicable to this ASME SR are AS-4 and AS-8, and there are no industry self-assessment actions and no NRC objections.

The original Peer Review rated AS-4 as "3" and AS-8 as "3 with contingencies." AS-8 has one level "B" F&O: AS-04.

F&O AS-04 is only applicable to SGTR events. The modeling of SGTR events was changed to be consistent with industry standards using the guidance in WCAP-15955. Success criteria runs were performed for the MNS PRA and are applicable to CNS.

Reconstruction of the CNS SGTR success criteria is needed to close this F&O.

The NEI SRs applicable to this ASME SR are AS-6, AS-7, AS-8, AS-9, and AS-17, and there are no industry self-assessment actions and no NRC objections. The original Peer Review rated AS-6 and AS-17 as "3" and AS-7, AS-8 and AS-9 as "3 with contingencies." AS-8 has one level "B" F&O: AS-04, and AS-9 has one level "B" F&O: AS-07.

F&O AS-04 is only applicable to SGTR events. The modeling of SGTR events was changed to be consistent with industry standards using the guidance in WCAP-15955. Success criteria runs were performed for the MNS PRA and are applicable to CNS.

There were no F&Os with "A" level of significance at CNS. Open level "B" F&O AS-04 is only applicable to SGTR events. A sensitivity was done in Section 5.3.5 to approximate the necessary SGTR success criteria modeling changes. Changes in Success Criteria modeling are based on guidance provided in Reference 43.

Other than a small change to overall risk, there is no impact on the ILRT extension.

There were no F&Os with "A" level of significance at CNS. Open level "B" F&O AS-04 is only applicable to SGTR events. A sensitivity was done in Section 5.3.5 to approximate the necessary SGTR success criteria modeling changes. Changes in Success Criteria modeling are based on guidance Page 49of198

54003-CALC-02 SR AS-A3 2009 AS ME/ANS Cat II Requirement For each modeled initiating event, using the success criteria defined for each key safety function (in accordance with SR SC-A3),

IDENTIFY the systems that can be used to mitigate the initiator. [See Note (1).]

Revision 3 Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation either PORV, aux spray, or main spray. These functions are not included in D3.

2. Sequence YUOD3 needs a T/H justification that D3 can actually prevent core damage in this circumstance. This sequence has no injection and no SG isolation. This is "core cooling recovery" with an unisolated SGTR. ECA3 specifies cool down at less than 1 OOF/hr. The core cannot be maintained covered for the amount of time it takes to cooldown to RHR conditions at 100F/hr. Suggested resolution is to use a separate function for this heading, using an operator action directed by FRC.1 and without RCP operating.

3. Sequence YUD1QD3. comment#2 applies to this sequence as well. This is a stuck open relief PORV with no injection.

AS-07: The success criteria for AFW for SGTR is 1 CA pump to 2 steam generators. The ruptured SG is assumed to be one of the two steam generators that supply steam to the turbine-driven AFW pump.

In the Catawba Rev. 2b fault tree model, however, the dependency of the TDP on the SGTR initiator is not modeled. Thus, the TDP supply is not degraded by the initiating event in the model logic, so the model is incorrect.

(This item is already on the list of corrective actions for the Catawba PRA, and Duke has indicated that it will be implemented in the Rev. 3 PRA.)

TH-03: Success Criteria analyses were not done for the range of possible plant conditions to which they are applied. For example, MLOCA success criteria analyses are done for a 3.5 inch break (file SAAG 96), while the MLOCA is defined as a 2 to 5 inch break. The combinations of systems and operator recoveries that are defined as success at 3.5 inches may not be success at 2 inches or at 5 inches. This issue also applies to large LOCA (8.25 ft2 break analyzed in SAAG 97) vs a break range down to 6 inches, and small LOCA (1 inch break Disposition Reconstruction of the CNS SGTR success criteria is needed to close this F&O.

F&O AS-07 is only applicable to SGTR events. The CA notebook was updated to reflect the correct success criteria due to SGTR loss of AFW pump, so AS-07 is considered resolved. As scheduled, the dependency of the TDAFW pump on the SGTR initiator was incorporated in the Rev. 3 PRA. Since this ILRT extension analysis uses Rev. 3b, this issue is resolved [Reference 17].

The NEI SRs applicable to this ASME SR are AS-17, AS-7, and SY-17, and there are no industry self-assessment actions and no NRC objections. The original Peer Review rated AS-17 as "3" and AS-8 and SY-17 as "3 with contingencies." SY-17 has two level "B" F&Os:

TH-03 and SY-03.

F &O TH As part of establishing success criteria, a series of analyses were performed over a range of applications to ensure that computer codes employed provided realistic results. Success criteria sensitivities included analyses for a range of possible conditions, including the LOCA break sizes and availability of accumulators. In Impact on ILRT Extension provided in Reference 43.

Other than a small change to overall risk, there is no impact on the ILRT extension.

Peer Review F&O SY-03 is still open. While the success criteria have been updated, it has not been incorporated into the PRA model.

However, there are no significant changes to the success criteria [Reference 45], so the impact on the PRA results is expected to be negligible and not Page 50 of.198

54003-CALC-02 SR AS-A5 2009 ASME/ANS Cat 11 Requirement DEFINE the accident sequence model in a manner that is consistent with the plant-specific: system design, EOPs, abnormal procedures, and plant transient response.

Revision 3 Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation analyzed, SAAG 95) vs. break sizes from 3/8 to 2 inches. Further, it was not clear that the MLOCA MAAP runs adequately match the accident sequence being modeled in the PRA. Cases in SAAG 96 do not appear to disable accumulators when defining the minimum ECC requirements, but accumulators are not required by the resulting MLOCA success criteria. Also, MAAP is not an appropriate code to use in performing analyses for rapid blowdown events such as large and some medium LOCAs.

SY-03: System success criteria are specified in the system notebooks in sufficient detail to describe the overall fault tree top events, but no basis is provided in the system notebooks for the number of pumps or flow rate requirements. The Reference section 18.1 does not contain a link to an appropriate success criteria calculation. For example, in the KC notebook, it is stated without a source reference that both pumps and the associated heat exchanger

.in a train are required for success when the ND (RHR) heat exchanger is required. Similarly, in Section 12 of the RN notebook, it is stated that the top events simply represent "failure to provide sufficient flow to components requiring cooling without defining a flow rate or number of pumps (in Section 13 of the notebook it does state that failure to provide flow requires failure of all four pump trains). The CA notebook has a similar statement without a tie to a specific basis.

TH-03: Success Criteria analyses were not done for the range of possible plant conditions to which they are applied. For example, MLOCA success criteria analyses are done for a 3.5 inch break (file SAAG 96), while the MLOCA is defined as a 2 to 5 inch break. The combinations of systems and operator recoveries that are defined as success at 3.5 inches may not be success at 2 inches or at 5 inches. This issue also applies to large LOCA (8.25 Disposition addition, a review of other industry design-basis calculations using alternate methods was employed to consider code limitations. This is considered to resolve the finding and achieve grade 3 of the NEI SR/

meet cat II of the ASME SR.

F&O SY-03 -Although XSAA-115 (PRA Modeling Guidelines) has been revised to require success criteria reference to be provided, references to the appropriate system success criteria have not been added to these system notebooks. As a result, this F&O remains open due to incomplete documentation. This F&O remains open with grade 3 of NEI SR I meet CAT II of the ASME SR being not met.

The NEI SRs applicable to this ASME SR are AS-5, AS-18, AS-19, and SY-5, and there are no industry self-assessment actions and no NRC objections. The original Peer Review rated AS-5, AS-19 and SY-5 as "3" and AS-18 as "3 with contingencies." AS-18 has one level "B" F&O: TH-03.

The success criteria for all LOCA events were revisited since the Peer Review. For MLOCA and SLOCA events, thermal/hydraulic calculations were performed at the upper and lower ends of the Impact on ILRT Extension significantly affect the applicability to the ILRT extension.

There were no F&Os with "A" level of significance at CNS and there are no remaining open F&Os with "B" level of significance related to this SR. No impact on the ILRT extension.

Page 51 of 198

54003-CALC-02 SR AS-A7 2009 ASME/ANS Cat II Requirement DELINEATE the possible accident sequences for each modeled initiating event, unless the sequences can be shown to be a non-contribution using qualitative arguments.

Revision 3 Status Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation ft2 break analyzed in SAAG 97) vs a break range down to 6 inches, and small LOCA (1 inch break analyzed, SAAG 95) vs. break sizes from 3/8 to 2 inches. Further, it was not clear that the MLOCA MAAP runs adequately match the accident sequence being modeled in the PRA. Cases in SAAG 96 do not appear to disable accumulators when defining the minimum ECC requirements, but accumulators are not required by the resulting MLOCA success criteria. Also, MAAP is not an appropriate code to use in performing analyses for rapid blowdown events such as large and some medium LOCAs.

AS-04: There were several observations on the modeling of event 03 in the SGTR tree:

Event 03 is generally defined as the event to cooldown to RHR conditions using 2/3 SG for depressurization. 03 includes the HEP YAGRCOLOHE, which is directed by ECA 3.1 and 3.2.

1. 03 is defined as "primary system cooldown via secondary system depressurization". Primary system depressurization must be accomplished in some sequences (Y01 D2D3, YOD3, YUOD3), by either PORV, aux spray, or main spray. These functions are not included in 03.

2. Sequence YUOD3 needs a T/H justification that 03 can actually prevent core damage in this circumstance. This sequence has no injection and no SG isolation. This is "core cooling recovery" with an unisolated SGTR. ECA3 specifies cool down at less than 1 OOF/hr. The core cannot be maintained covered for the amount of time it takes to cooldown to RHR conditions at 1 OOF/hr. Suggested resolution is to use a separate function for this heading, using an operator action directed by FRC.1 and without RCP operating.

3. Sequence YUD1003. comment #2 applies to this sequence as well. This is a stuck open relief PORV with no injection.

Disposition spectrum, as well as at several midpoints where changes in thermal/hydraulic behavior occur to determine the success criteria for those events. Availability of accumulators is also addressed. The design basis requirements for mitigation are used are used as the primary basis the success criteria for LLOCA events. Thus F&O TH-03 has been resolved.

Since the Peer Review rated all of the applicable NEI SRs as "3" and there are no remaining open level "A" or "B" F&Os, this ASME SR is Met Cat II.

The NEI SRs applicable to this ASME SR are AS-4, AS-5, AS-6, AS-7, AS-8, and AS-9, and there are no industry self-assessment actions and no NRC objections. The original Peer Review rated AS-4, AS-5 and AS-6 as "3" and AS-7, AS-8, and AS-9 as "3 with contingencies."

AS-8 has one level "B" F&O: AS-04, and AS-9 has one level "B" F&O:

AS-07.

F&O AS-04 is only applicable to SGTR events. The modeling of SGTR events was changed to be consistent with industry standards using the guidance in WCAP-15955. Success criteria runs were performed for the MNS PRA and are applicable to CNS.

Reconstruction of the CNS SGTR success criteria is needed to close this F&O.

F&O AS-07 is only applicable to SGTR events. The CA notebook was updated to reflect the correct success criteria due to SGTR loss of AFW pump, so AS-07 is considered resolved. As scheduled, the dependency of the TDAFW pump on the SGTR initiator was incorporated in the Rev. 3 PRA. Since this ILRT extension analysis uses Rev. 3b, this issue' is resolved [Reference 17].

Impact on ILRT Extension There were no F&Os with "A" level of significance at CNS. Open level "B" F&O AS-04 is only applicable to SGTR events. A sensitivity was done in Section 5.3.5 to approximate the necessary SGTR success criteria modeling changes. Changes in Success Criteria modeling are based on guidance provided in Reference 43.

other than a small change to overall risk, there is no impact on the ILRT extension.

Page 52of198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement AS-AB DEFINE the end state of the accident progression as occurring when either a core damage state or a steady-state condition has been reached.

Revision 3 Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation AS-07: The success criteria for AFW for SGTR is 1 CA pump to 2 steam generators. The ruptured SG is assumed to be one of the two steam generators that supply steam to the turbine-driven AFW pump.

In the Catawba Rev. 2b fault tree model, however, the dependency of the TOP on the SGTR initiator is not modeled. Thus, the TOP supply is not degraded by the initiating event in the model logic, so the model is incorrect.

(This item is already on the list of corrective actions for the Catawba PRA, and Duke has indicated that it will be implemented in the Rev. 3 PRA.)

TH-02: The original definition of core damage used in the Catawba PRA was the eutectic melting point of the fuel (4040 degF). This has been informally revised (i.e., not in a Workplace Procedure but known to the Duke PRA analysts associated with performing success criteria) based on a McGuire PRA Peer Review observation, to "success criteria is defined as the hottest core node remained below 2000 degF" as predicted by MAAP or other T/H code. The reference used by Duke for this definition is EPRI document NP-6328, "Release of Volatile Fission Products From Irradiated LWR Fuel: Mass Spectrometry Studies", Final Report, April 1989.

The revised criterion is more in line with industry practice. In specific instances, it is possible that the 2000 degF criterion could be pushing the limit of acceptability for the code used, and investigation of the sensitivity of the results to a lower temperature value might be warranted (e.g., the ASME PRA Standard suggests 1800 degF for a code like MAAP, or even 1200 degF ifthere is prolonged core uncovery).

Disposition The NEI SRs applicable to this ASME SR are AS-20, AS-21, AS-22, and AS-23. There are no NRC objections, but since the explicit requirement for steady-state conditions for end state was not contained in NEI 00-02, this should be demonstrated. The original Peer Review rated all of these N El SRs as "3". AS-22 has one level "C" F&O: TH-02, but a similar F&O for McGuire was level "B" so it is retained here.

An evaluation was performed in DPC-1535.00-00-0010 which provides the definition of core damage for PRA applications using the MAAP analysis code, determined to be 2500 F. Section 10.0 of DPC-1535.00-00-0010 states, The temperature criterion of TC RH OT>

1800 'F can be used to establish the time at which core damage occurs. Determining the time at which restoring core cooling prevents TCRHOT from exceeding 1800 'F can be used in human reliability analyses to determine the time parameters for input into the HRA."

This criterion is used in the development of success criteria and timing of operator actions. This evaluation meets the requirements of Section 1-2.2 of the Standard, and thus F&O TH-02 is resolved. The ASME SR is considered Met as reported in Duke self-assessments CNC-1535.00-00-0155 and DPC-1535.00-00-0013.

More recently, McGuire success criteria calculations have been revised to define success criteria as core temperature remains below 2000 Deg F. As noted in MCC-1535.00-00-0172, the difference in time to core damage is not significant when using either 2000 Deg F or 4000 Deg F because the exothermic nature of the zircaloy-water Impact on ILRT Extension References 45 and 56 document the MAAP analysis confirming core damage being defined as 2000 'F has no impact on success criteria. There is no impact on the ILRT extension.

Page 53of198

54003-CALC-02 SR AS-A9 AS-A10 2009 ASME/ANS Cat II Requirement USE realistic, applicable (i.e., from similar plants) thermal hydraulic analyses to determine the accident progression parameters (e.g.,

timing, temperature, pressure, steam) that could potentially affect the operability of the mitigating systems.

In constructing the accident sequence models, INCLUDE, for each modeled initiating event, sufficient detail that differences in Revision 3 Status Dispositioned Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation TH-03: Success Criteria analyses were not done for the range of possible plant conditions to which they are applied. For example, MLOCA success criteria analyses are done for a 3.5 inch break (file SAAG 96), while the MLOCA is defined as a 2 to 5 inch break. The combinations of systems and operator recoveries that are defined as success at 3.5 inches may not be success at 2 inches or at 5 inches. This issue also applies to large LOCA (8.25 ft2 break analyzed in SAAG 97) vs a break range down to 6 inches, and small LOCA (1 inch break analyzed, SAAG 95) vs. break sizes from 3/8 to 2 inches. Further, it was not clear that the MLOCA MAAP runs adequately match the accident sequence being modeled in the PRA. Cases in SAAG 96 do not appear to disable accumulators when defining the minimum ECC requirements, but accumulators are not required by the resulting MLOCA success criteria. Also, MAAP is not an appropriate code to use in performing analyses for rapid blowdown events such as large and some medium LOCAs.

AS-04: There were several observations on the modeling of event 03 in the SGTR tree:

Event 03 is generally defined as the event to cooldown to RHR conditions using 2/3 SG for Disposition reaction rapidly increases the fuel temperature. Therefore, the revised success criterion does not have an impact on the time available for human recoveries or other non-recovery events such as loss of offsite power recoveries. There is also no impact on the equipment required for mitigation of any accident sequence. Even though the Catawba success criteria have not been revised, the conclusions from McGuire are considered applicable to Catawba due to the similarities between the plants.

The core damage criteria using the TCRHOT parameter in the MAAP analyses were examined to determine if using 2000 °F would impact the success criteria results. The success criteria were reanalyzed and updated to show that 2000 °F core damage success criteria were also met [Reference 45].

The NEI SRs applicable to this ASME SR are AS-18 and TH-4. There are no NRC objections, but the focus should be on the environmental conditions challenging the equipment during the accident sequence.

The original Peer Review rated both of these NEI SRs as "3 with contingencies". AS-18 and TH-4 have the same level "B" F&O: TH-

03.

The success criteria for all LOCA events were revisited since the Peer Review. For MLOCA and SLOCA events, thermal/hydraulic calculations were performed at the upper and lower ends of the spectrum, as well as at several midpoints where changes in thermal/hydraulic behavior occur to determine the success criteria for those events. Availability of accumulators is also addressed. The design basis requirements for mitigation are used are used as the primary basis the success criteria for LLOCA events. Thus F&O TH-03 has been resolved.

Since the Peer Review rated all of the applicable NEI SRs as "3" and there are no remaining open level "A" or "B" F&Os, this ASME SR is Met Cat II.

The NEI SRs applicable to this ASME SR are AS-4, AS-5, AS-6, AS-7, AS-8, AS-9, AS-19, SY-5, SY-8, and HR-23, and there are no industry self-assessment actions and no NRC objections. The original Peer Review rated AS-4, AS-5, AS-19, SY-5 and SY-18 as "3" Impact on ILRT Extension There were no F&Os with "A" level of significance at CNS and there are no remaining open F&Os with "B" level of significance related to this SR. No impact on the ILRT extension.

There were no F&Os with "A" level of significance at CNS. Open level "B" F&O AS-04 is only applicable to Page 54 of 198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement requirements on systems and required operator interactions (e.g.,

systems initiations or valve alignment) are captured. Where diverse systems and/or operator actions provide a similar function, if choosing one over another changes the requirements for operator intervention or the need for other systems, MODEL each separately.

Revision 3 Status Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation depressurization. 03 includes the HEP YAGRCOLDHE, which is directed by ECA 3.1 and 3.2.

1. 03 is defined as "primary system cooldown via secondary system depressurization". Primary system depressurization must be accomplished in some sequences (YD10203, YOD3, YUOD3), by either PORV, aux spray, or main spray. These functions are not included in 03.

2. Sequence YUOD3 needs a T/H justification that 03 can actually prevent core damage in this circumstance. This sequence has no injection and no SG isolation. This is "core cooling recovery" with an unisolated SGTR. ECA3 specifies cool down at less than 1 OOF/hr. The core cannot be maintained covered for the amount of time it takes to cooldown to RHR conditions at 1 OOF/hr. Suggested resolution is to use a separate function for this heading, using an operator action directed by FRC.1 and without RCP operating.

3. Sequence YUD1003. comment #2 applies to this sequence as well. This is a stuck open relief PORV with no injection.

AS-07: The success criteria for AFW for SGTR is 1 CA pump to 2 steam generators. The ruptured SG is assumed to be one of the two steam generators that supply steam to the turbine-driven AFW pump.

In the Catawba Rev. 2b fault tree model, however, the dependency of the TDP on the SGTR initiator is not modeled. Thus, the TOP supply is not degraded by the initiating event in the model logic, so the model is incorrect.

(This item is already on the list of corrective actions for the Catawba PRA, and Duke has indicated that it will be implemented in the Rev. 3 PRA.)

F&O HR-05: In the Catawba HRA notebook for PRA Rev 2b (and similarly in the McGuire Rev 3 HRA notebook), the documentation of the bases for Disposition and AS-7, AS-8, AS-9, and HR-23 as "3 with contingencies."

AS-8 has one level "8" F&O: AS-04; AS-9 has one level "B" F&O: AS-07; and HR-23 has one level "B" F&O: HR-05.

F&O AS-04 is only applicable to SGTR events. The modeling of SGTR events was changed to be consistent with industry standards using the guidance in WCAP-15955. Success criteria runs were performed for the MNS PRA and are applicable to CNS.

Reconstruction of the CNS SGTR success criteria is needed to close this F&O.

F&O AS-07 is only applicable to SGTR events. The CA notebook was updated to reflect the correct success criteria due to SGTR loss of AFW pump, so AS-07 is considered resolved. As scheduled, the dependency of the TDAFW pump on the SGTR initiator was incorporated in the Rev. 3 PRA. Since this ILRT extension analysis uses Rev. 3b, this issue is resolved [Reference 17].

Elements of F&O HR-05 related to this F&O are considered resolved.

Success criteria, plant parameters and associated acceptance criteria derived from the success criteria analyses are used to support the timing analysis used in the PRA HRA. References to MMP analysis that support the timing actions are included in the HRA spreadsheets.

Impact on ILRT Extension SGTR events. A sensitivity was done in Section 5.3.5 to approximate the necessary SGTR success criteria modeling changes. Changes in Success Criteria modeling are based on guidance provided in Reference 43.

Other than a small change to overall risk, there is no impact on the ILRT extension.

Page 55 of 198

54003-CALC-02 SR AS-81 2009 ASME/ANS Cat 11 Requirement For each modeled initiating event, IDENTIFY mitigating systems impacted by the occurrence of the initiator and the extent of the impact. INCLUDE the impact of initiating events on mitigating systems in the accident progression either in the accident sequence models or in the system models.

Revision 3 Status Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation the HEPs is not sufficiently specified to assure that the analysis is reproducible. Specifically, the sequence context (e.g., previous failures in the event sequence, concurrent activities, environmental factors, etc.) and procedural steps applicable to each HEP are not consistently provided. Thus, even though there is evidence that the HEP worksheet information is being reviewed by plant Operations personnel, it is not clear that they would have sufficient supporting information with which to make an effective assessment of the HRA.

Similarly, the timing, PSF, stress level, and all other contributing factors to the HEP were printed, but the basis was not provided. It would not have been possible for another analyst to determine the same factors and derive the same number. The lack of such information in the documentation of the HRA limits the ability to verify and reproduce the results, and to determine their applicability in specific scenarios. This finding was made against NEI SR TH-5 with grade 3 being contingent on its resolution.

AS-07: The success criteria for AFW for SGTR is 1 CA pump to 2 steam generators. The ruptured SG is assumed to be one of the two steam generators that supply steam to the turbine-driven AFW pump.

In the Catawba Rev. 2b fault tree model, however, the dependency of the TDP on the SGTR initiator is not modeled. Thus, the TDP supply is not degraded by the initiating event in the model logic, so the model is incorrect.

(This item is already on the list of corrective actions for the Catawba PRA, and Duke has indicated that it will be implemented in the Rev. 3 PRA.)

IE-06: The Loss of HVAC initiator was removed, because operators may shut down the plant from remote locations (the Auxiliary Shutdown Panel and the SSF) if the Control Room is incapable of maintaining inventory control. This is an inadequate reason to omit an IE. If loss of HVAC Disposition The NEI SRs applicable to this ASME SR are IE-4, IE-5, IE-10, AS-4, AS-5, AS-6, AS-7, AS-8, AS-9, AS-10, AS-11, and DE-5, and there are no industry self-assessment actions and no NRC objections. The original Peer Review rated AS-4, AS-5, AS-6 and AS-11 as '3" and all of the other NEI SRs as "3 with contingencies."

IE-5 has one level "B" F&O: IE-06; IE-10 has one level "B" F&O: IE-03; AS-8 has one level "B" F&O: AS-04; AS-9 has one level "B" F&O: AS-07; AS-10 has one level "B" F&O: DE-04; and DE-5 has two level "B" F&Os:

AS-07 and QU-02. Of the F&Os; AS-07, IE-06, and DE-04 appear to be related to this ASME SR, i.e., mitigating systems impacted by the occurrence of the initiator.

F&O AS-07 is only applicable to SGTR events. The CA notebook was updated to reflect the correct success criteria due to SGTR loss of AFW pump, so AS-07 is considered resolved. As scheduled, the dependency of the TDAFW pump on the SGTR initiator was incorporated in the Rev. 3 PRA. Since this ILRT extension analysis uses Rev. 3b, this issue is resolved [Reference 17].

Impact on ILRT Extension Room heat-up analyses were performed for the switchgear rooms, battery rooms, and the control room

[References 40, 41, and 42].

The results of these analyses show that equipment in these rooms will not be adversely impacted by the loss of HVAC over the 24-hour mission time. There is no impact to the ILRT extension.

Page 56of198

54003-CALC-02 SR AS-83 2009 ASME/ANS Cat II Requirement For each accident sequence, IDENTIFY the phenomenological conditions created by the accident progression. Phenomenological impacts include generation of harsh environments affecting temperature, pressure, debris, water levels, humidity, etc. that could impact the success of the system or function under consideration [e.g., loss of pump net positive suction head (NPSH), clogging offlow paths].

INCLUDE the impact of the accident progression phenomena, Revision 3 Status Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation causes a plant trip and requires SSD from the ASP, that sequence should be identified and modeled.

Note that the switchgear room may also be affected by failed HVAC. A particular example is the possibility that the switchgear chiller is working, in which case the operators may not diagnose the situation in time.

DE-04: HVAC cooling of the essential switchgear rooms is stated as being required. The IPE quantitative analysis does not provide adequate success criteria. For example, the following are not specified: temperature limits of equipment, minimum number of Air Handling Units, or minimum number of chillers. The evaluation also states there is no concern within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months provided that only those loads needed to provide core cooling are operated.

There is no discussion of electrical load shedding for those loads not required, and of the human interface to execute load shedding. The human interface can be complex, involving both a discovery process (control room annunciators, or in the case of a local AHU failure, discovery through operator walkaround), and procedures and training to direct operation actions.

DE-04: HVAC cooling of the essential switchgear rooms is stated as being required. The IPE quantitative analysis does not provide adequate success criteria. For example, the following are not specified: temperature limits of equipment, minimum number of Air Handling Units, or minimum number of chillers. The evaluation also states there is no concern within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months provided that only those loads needed to provide core cooling are operated.

There is no discussion of electrical load shedding for those loads not required, and of the human interface to execute load shedding. The human interface can be complex, involving both a discovery process (control room annunciators, or in the case of a local AHU failure, discovery through operator Disposition F&Os IE-06 and DE-04 are not resolved because the loss of switchgear HVAC initiating event is not included in the PRA. Any additional risk added by including the VC/YC systems in the PRA model would be small and would not have a significant impact on the ILRT extension application.

The NEI SRs applicable to this ASME SR are AS-10, SY-11, DE-10, and TH-8, and there are no industry self-assessment actions and no NRC objections. The original Peer Review rated AS-10 and DE-10 as "3 with contingencies" and SY-11 as "2". TH-8 was unrated. AS-10 has one level "B" F&O: DE-04; SY-11 has one level "B" F&O: SY-06; DE-10 has one level "B" F&O: TH-06; TH-8 has one level "B" F&O:

TH-06. Of the F&Os, DE-04, TH-06, and SY-06 appear to be related to this ASME SR, i.e., phenomenological conditions created by the accident progression. F&O DE-06 is also associated with DE-10 but has been superseded by the more recent focus-scope peer review for the Flooding PRA model.

Impact on ILRT Extension Room heat-up analyses were performed for the switchgear rooms, battery rooms, and the control room

[References 40, 41, and 42].

The results of these analyses show that equipment in these rooms will not be adversely impacted by the loss of HVAC over the 24-hour mission time. There is no F&Os DE-04 and TH-06 are not resolved because the Joss of impact to the ILRT switchgear HVAC initiating event is not included in the PRA, and room extension.

heatup calculations for loss of ventilation are not performed for that Page 57of198

54003-CALC-02 SR AS-85 2009 ASME/ANS Cat II Requirement either in the accident sequence models or in the system models.

DEVELOP the accident sequence models to a level of detail sufficient to identify intersystem dependencies and train level interfaces, either in the event trees or through a combination of event tree and fault tree models and associated logic.

Revision 3 Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation walkaround), and procedures and training to direct operation actions.

TH-06: There is no room heatup analysis notebook I evaluation of loss of HVAC to equipment rooms for the Catawba PRA, and apparently no retrievable room heatup calculations or documentation to support the assumption that room cooling need not be modeled in the PRA. Other PRAs have found that room cooling is required for some rooms such as electrical equipment rooms and small rooms housing critical pumps.

(Duke is already aware of this issue.)

SY-06: For Catawba, there was no evaluation of the ability of non-qualified (non-EQ) equipment to survive in a degraded environment following an accident such as a steam line of feedwater line break outside of containment.

QU-02: The IE's for certain support system failures (RN, KC) are not input in the top event logic as a Boolean equation, but rather as a point estimate whose value is derived by solution of the IE fault tree.

However, failures that cause the IE may also affect the mitigating system, such that there is a dependency between the initiating event and the available mitigation. Examples are an electrical bus that failed one train of KC and could fail one train of mitigating equipment. Another example is the operator error in the loss of KC to start the standby train of KC (KKCSTNBDHE). The HRA notebook states this event has dependencies with HYDBACKDHE.

AS-07: The success criteria for AFW for SGTR is 1 CA pump to 2 steam generators. The ruptured SG is assumed to be one of the two steam generators that supply steam to the turbine-driven AFW pump.

In the Catawba Rev. 2b fault tree model, however, Disposition and other locations. Room heatup calculations should be performed in all locations in which HVAC can be lost to justify not modeling those systems and/or determine timing of operator coping actions and equipment damage. If no room heatup calculation is performed, it should be assumed that the HVAC system is required in those locations. The appropriate dependencies should be included in the PRA model, including possible initiating events. Any additional risk added by including the VC/YC systems in the PRA model would be small and would not have a significant impact on the results for the I LRT extension application.

F&O SY-06 is resolved because high-energy line breaks (e.g., steam line breaks and feed line breaks) are addressed in the Internal Flood PRA (Reference 38).

Since Peer Review F&Os DE-04, TH-06, and SY-06 are still open, this ASME SR is Not Met.

The NEI SRs applicable fo this ASME SR are AS-10, AS-11, DE-4, DE-5, DE-6, and QU-25, and there are no industry self-assessment actions and no NRC objections. The original Peer Review rated AS-11 and DE-6 as "3" and AS-10, DE-4, and DE-5 as "3 with contingencies." QU-25 was found not applicable. AS-10 has one level "B" F&O: DE-04; DE-4 has one level "B" F&O: DE-04; DE-5 has two level "B" F&Os: QU-02 and AS-07. Of the F&Os, QU-02 and AS-07 appear to be related to this ASME SR, i.e., intersystems dependencies.

F&O QU-02: System level initiators represented as fully developed sub-tree structures are not in the Rev 3 model. Duke Energy feels that it is acceptable to not develop system level initiators as long as a review for dependencies takes place in the cut set file. This process has been proceduralized and is contained in Section 4 of Workplace Guideline XSAA-103, Guidelines For Determining Risk Significance.

F&O AS-07 is only applicable to SGTR events. The CA notebook was updated to reflect the correct success criteria due to SGTR loss of AFW pump, so AS-07 is considered resolved. As scheduled, the dependency of the TDAFW pump on the SGTR initiator was Impact on ILRT Extension High-energy line breaks (e.g., steam line breaks and feed line breaks) are addressed in the Internal Flood PRA (Reference 38).

This is considered resolved.

There is no impact on the ILRT extension.

Review for dependencies takes place in the cut set file.

This F&O will have no effect on the ILRT extension.

Page 58 of 198

54003-CALC-02 SR SC-A1 2009 ASME/ANS Cat II Requirement USE the definition of "core damage" provided in Section 1-2 of this Standard. If core damage has been defined differently than in Section 1-2, (a) IDENTIFY any substantial differences from the Section 1-2 definition (b) PROVIDE the bases for the selected definition Revision 3 Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation Disposition the dependency of the TDP on the SGTR initiator is incorporated in the Rev. 3 PRA. Since this ILRT extension analysis not modeled. Thus, the TDP supply is not degraded uses Rev. 3b, this issue is resolved [Reference 17].

by the initiating event in the model logic, so the model is incorrect.

(This item is already on the list of corrective actions for the Catawba PRA, and Duke has indicated that it will be implemented in the Rev. 3 PRA.)

TH-02: The original definition of core damage used in the Catawba PRA was the eutectic melting point of the fuel (4040 degF). This has been informally revised (i.e., not in a Workplace Procedure but known to the Duke PRA analysts associated with performing success criteria) based on a McGuire PRA Peer Review observation, to "success criteria is defined as the hottest core node remained below 2000 degF" as predicted by MAAP or other T/H code. The reference used by Duke for this definition is EPRI document NP-6328, "Release of Volatile Fission Products From Irradiated LWR Fuel: Mass Spectrometry Studies", Final Report, April 1989.

The revised criterion is more in line with industry practice. In specific instances, it is possible that the 2000 degF criterion could be pushing the limit of acceptability for the code used, and investigation of the sensitivity of the results to a lower temperature value might be warranted (e.g., the ASME PRA Standard suggests 1800 degF for a code like MAAP, or even 1200 degF ifthere is prolonged core uncovery).

The NEI SRs applicable to this ASME SR are AS-20 and AS-22, and there are no industry self-assessment actions and no NRC objections.

The original Peer Review rated AS-20 as "3" and AS-22 as "3 with contingencies." AS-22 has one level "C" F&O: TH-02, but a similar F&O for McGuire was level "B" so it is retained here.

An evaluation was performed in DPC-1535.00-00-0010 which provides the definition of core damage for PRA applications using the MAAP analysis code, determined to be 2500 F. Section 10.0 of DPC-1535.00-00-001 o states, 'The temperature criterion of TC RH OT>

1800 "F can be used to establish the time at which core damage occurs. Determining the time at which restoring core cooling prevents TCRHOT from exceeding 1800 "F can be used in human reliability analyses to determine the time parameters for input into the HRA."

This criterion is used in the development of success criteria and timing of operator actions. This evaluation meets the requirements of Section 1-2.2 of the Standard, and thus F&O TH-02 is resolved. The ASME SR is considered Met as reported in Duke self-assessments CNC-1535.00-00-0155 and DPC-1535.00-00-0013.

More recently, McGuire success criteria calculations have been revised to define success criteria as core temperature remains below 2000 Deg F. As noted in MCC-1535.00-00-0172, the difference in time to core damage is not significant when using either 2000 Deg F or 4000 Deg F because the exothermic nature of the zircaloy-water reaction rapidly increases the fuel temperature. Therefore, the revised success criterion does not have an impact on the time available for human recoveries or other non-recovery events such as loss of offsite power recoveries. There is also no impact on the equipment required for mitigation of any accident sequence. Even though the Catawba success criteria have not been revised, the conclusions from McGuire Impact on ILRT Extension References 45 and 56 document the MAAP analysis confirming core damage being defined as 2000 "F has no impact on success criteria. There is no impact on the ILRT extension.

Page 59 of 198

54003-CALC-02 SR SC-A2 2009 ASME/ANS Cat II Requirement SPECIFY the plant parameters (e.g., highest node temperature, core collapsed liquid level) and associated acceptance criteria (e.g.,

temperature limit) to be used in determining core damage.

SELECT these parameters such that determination of core damage is as realistic as practical, in a manner consistent with current best practice. DEFINE computer code-predicted acceptance criteria with sufficient margin on the code-calculated values to allow for limitations of the code, sophistication of the models, and uncertainties in the results, in a manner consistent with the requirements specified under H LR-SC-8.

Examples of measures for core damage suitable for Capability Category II/Ill, that have been used in PRAs, include (a) collapsed liquid level less than 1/.3 core height or code-predicted peak core temperature >2,500°F (BWR)

(b) collapsed liquid level below top of active fuel for a prolonged period, Revision 3 Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation F&O TH The original definition of core damage used in the Catawba PRA was the eutectic melting point of the fuel (4040 °F). This has been informally revised (i.e., not in a Workplace Procedure but known to the Duke PRA analysts associated with performing success criteria) based on a McGuire PRA Peer Review observation, to "success criteria is defined as the hottest core node remained below 2000 °F" as predicted by MAAP or other T/H code.

The reference used by Duke for this definition is EPRI document NP-6328, "Release of Volatile Fission Products From Irradiated LWR Fuel: Mass Spectrometry Studies", Final Report, April 1989.

The revised criterion is more in line with industry practice. In specific instances, it is possible that the 2000 °F criterion could be pushing the limit of acceptability for the code used, and investigation of the sensitivity of the results to a lower temperature value might be warranted (e.g., the ASME PRA Standard suggests 1800 °F for a code like MAAP, or even 1200 °F ifthere is prolonged core uncovery).

F&O TH Success Criteria analyses were not done for the range of possible plant conditions to which they are applied. For example, MLOCA success criteria analyses are done for a 3.5 inch break (file SAAG 96), while the MLOCA is defined as a 2 to 5 inch break. The combinations of systems and operator recoveries that are defined as success at 3.5 inches may not be success at 2 inches or at 5 inches. This issue also applies to large LOCA (8.25 ft2 break analyzed in SAAG 97)

Disposition are considered applicable to Catawba due to the similarities between the plants.

The core damage criteria using the TCRHOT parameter in the MAAP analyses were examined to determine if using 2000 °F would impact the success criteria results. The success criteria were reanalyzed and updated to show that 2000 °F core damage success criteria were also met [Reference 45].

The NEI SRs applicable to this ASME SR are TH-4, TH-5, TH-7, and AS-22. There are no industry self-assessment actions and no NRC objections. The original Peer Review rated all of these NEI SRs as "3 with contingencies", except TH-5, which is rated a "2". TH-4 has one level "B" F&O: TH-03; TH-5 has two level "B" F&Os: HR-05 and TH-05; TH-7 has one level "B" F&O: TH-01; and AS-22 has one level "C" F&O: TH-02, but a similar F&O for McGuire was level "B" so it is retained here.

An evaluation was performed in DPC-1535.00-00-0010 which provides the definition of core damage for PRA applications using the MAAP analysis code, determined to be 2500 F. This criterion is used in the development of success criteria and timing of operator actions.

This evaluation meets the requirements of Section 1-2.2 of the Standard, and thus F&O TH-02 is resolved. The ASME SR is considered Met as reported in Duke self-assessments CNC-1535.00-00-0155 and DPC-1535.00-00-0013.

More recently, McGuire success criteria calculations have been revised to define success criteria as core temperature remains below 2000 Deg F. As noted in MCC-1535.00-00-0172, the difference in time to core damage is not significant when using either 2000 Deg F or 4000 Deg F because the exothermic nature of the zircaloy-water reaction rapidly increases the fuel temperature. Therefore, the revised success criterion does not have an impact on the time available for human recoveries or other non-recovery events such as loss of offsite power recoveries. There is also no impact on the equipment required for mitigation of any accident sequence. Even though the Catawba success criteria have not been revised, the conclusions from McGuire are considered applicable to Catawba due to the similarities between the plants.

Impact on ILRT Extension References 45 and 56 document the MAAP analysis confirming core damage being defined as 2000 °F has no impact on success criteria. There is no impact on the ILRT extension.

Peer Review F&O TH-05 is still open. While updated success criteria and timing data has been developed from MAAP 4.0.7 analyses, it has not been incorporated into the model of record.

However, there are no significant changes to the success criteria, so the impact on I LRT extension is expected to be negligible.

Peer Review F&O TH-01 is still open. While the success criteria has been updated, it has not been incorporated into the PRA model.

However, there are no significant changes to the success criteria, so the impact on the ILRT extension is expected to be negligible.

Page 60of198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement or code-predicted core peak node temperature >2,200°F using a code with detailed core modeling; or code-predicted core peak node temperature >1,800°F using a code with simplified (e.g., single-node core model, lumped parameter) core modeling; or code-predicted core exit temperature >1,200°F for 30 min using a code with simplified core modeling (PWR).

Revision 3 Status Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation vs a break range down to 6 inches, and small LOCA (1 inch break analyzed, SAAG 95) vs. break sizes from 3/8 to 2 inches. Further, it was not clear that the MLOCA MAAP runs adequately match the accident sequence being modeled in the PRA.

Cases in SAAG 96 do not appear to disable accumulators when defining the minimum ECC requirements, but accumulators are not required by the resulting MLOCA success criteria. Also, MAAP is not an appropriate code to use in performing analyses for rapid blowdown events such as large and some medium LOCAs.

F&O HR In the Catawba HRA notebook for PRA Rev 2b (and similarly in the McGuire Rev 3 HRA notebook), the documentation of the bases for the HEPs is not sufficiently specified to assure that the analysis is reproducible. Specifically, the sequence context (e.g., previous failures in the event sequence, concurrent activities, environmental factors, etc.) and procedural steps applicable to each HEP are not consistently provided. Thus, even though there is evidence that the HEP worksheet information is being reviewed by plant Operations personnel, it is not clear that they would have sufficient supporting information with which to make an effective assessment of the HRA.

Similarly, the timing, PSF, stress level, and all other contributing factors to the HEP were printed, but the basis was not provided. It would not have been possible for another analyst to determine the same factors and derive the same number. The lack of such information in the documentation of the HRA limits the ability to verify and reproduce the results, and to determine their applicability in specific scenarios.

F&O TH Success Criteria (Level 1 and Level 2) for some systems and sequences are supported by MAAP runs with MAAP 3b, Version 16. This Disposition The core damage criteria using the TCRHOT parameter in the MAAP analyses were examined to determine if using 2000 °F would impact the success criteria results. The success criteria were reanalyzed and updated to show that 2000 °F core damage success criteria were also met [Reference 45].

TH As part of establishing success criteria, a series of analyses were performed over a range of applications to ensure that computer codes employed provided realistic results. Success criteria sensitivities included analyses for a range of possible conditions, including the LOCA break sizes and availability of accumulators. In addition, a review of other industry design-basis calculations using alternate methods was employed to consider code limitations. This is considered to resolve the finding and achieve grade 3 of the NEI SR/

meet cat II of the ASME SR.

HR Success criteria, plant parameters and associated acceptance criteria derived from the success criteria analyses are used to support the timing analysis used in the PRA HRA.

References to MAAP analysis that support the timing actions are included in the HRA spreadsheets. This is considered to resolve the elements of this F&O related to this SR, and achieve grade 3 of the NEI SR/ meet cat II of the ASME SR.

TH An updated success criteria calculation was completed using MAAP 4.0.7 (Section 2.2) and is documented into the updated CNS Success Criteria Notebook. This F&O is dispositioned based on the resolution of the finding and achieve grade 3 of the NEI SR.

However, the CNS Assessment of Peer Review Open Items (May 2013) identifies this F&O as remaining open because the current model of record does not reflect the updated information and as a result the ASME SR is considered Not Met.

TH Operator actions are considered as part of the CNP success criteria analyses with expected operator actions included for SLOCA (Section 3.3), SGTR (Section 3.4), and transient F&B (Section 3.6).

Specific timing information from MAAP analyses can be found in Appendices A through F MAAP. This F&O is dispositioned based on the resolution of the finding and achieve grade 3 of the NEI SR.

However, the CNS Assessment of Peer Review Open Items (May Impact on ILRT Extension Page 61 of 198

54003-CALC-02 SR SC-A3 2009 ASME/ANS Cat II Requirement SPECIFY success criteria for each of the key safety functions identified per SR AS-A2 for each modeled initiating event [Note (2)].

Revision 3 Status Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation version of MAAP has been found to have limitations which can impact conclusions and results. In particular for the Catawba PRA, the simple pressurizer model likely impacts the analyses that involve RCS cooldown and depressurization using SG heat removal by permitting RCS depressurization to match RCS cooldown for transients, without the possible need for pressurizer PO RVs, spray or aux spray.

F&O TH-05 -The HEP worksheets do not clearly refer to success criteria analyses to support timing for operator actions. Although most worksheets include an estimate of the time available for completion of an action, and some refer generally to information from MAAP analyses, specific references to MAAP (or other analysis) cases are not provided.

F&O TH Success Criteria analyses were not done for the range of possible plant conditions to which they are applied. For example, MLOCA success criteria analyses are done for a 3.5 inch break (file SAAG 96), while the MLOCA is defined as a 2 to 5 inch break. The combinations of systems and operator recoveries that are defined as success at 3.5 inches may not be success at 2 inches or at 5 inches. This issue also applies to large LOCA (8.25 ft2 break analyzed in SAAG 97) vs a break range down to 6 inches, and small LOCA (1 inch break analyzed, SAAG 95) vs. break sizes from 3/8 to 2 inches. Further, it was not clear that the MLOCA MAAP runs adequately match the accident sequence being modeled in the PRA.

Cases in SAAG 96 do not appear to disable accumulators when defining the minimum ECC requirements, but accumulators are not required by the resulting MLOCA success criteria. Also, MAAP is not an appropriate code to use in performing analyses for rapid blowdown events such as large and some medium LOCAs. This finding was made Disposition 2013) identifies this F&O as remaining open because the current model of record does not reflect the updated information and as a result the ASME SR is considered Not Met.

The NEI SRs applicable to this ASME SR are AS-7, AS-17, AS-18, SY-17, TH-9, IE-6, SY-8 and DE-5. There are no industry self-assessment actions and no NRC objections. The original Peer Review rated AS-17, IE-6, and SY-8 as "3" and all of the other NEI SRs as "3 with contingencies." AS-18 has one level "B" F&O: TH-03; SY-17 has two level "B" F&Os: SY-03 and TH-03; TH-9 has two level "B" F&Os: TH-05 and TH-06; and DE-5 has two level "B" F&Os: AS-07 and QU-02.

F&O TH As part of establishing success criteria, a series of analyses were performed over a range of applications to ensure that computer codes employed provided realistic results. Success criteria sensitivities included analyses for a range of possible conditions, including the LOCA break sizes and availability of accumulators. In addition, a review of other industry design-basis calculations using alternate methods was employed to consider code limitations. This is considered to resolve the finding and achieve grade 3 of the NEI SR/

meet cat II of the ASME SR.

F&O QU-02: System level initiators represented as fully developed sub-tree structures are not in the Rev 3 model. Duke Energy feels that it is acceptable to not develop system level initiators as long as a Impact on ILRT Extension Room heat-up analyses were performed for the switchgear rooms, battery rooms, and the control room

[References 40, 41, and 42].

The results of these analyses show that equipment in these rooms will not be adversely impacted by the loss of HVAC over the 24-hour mission time. There is no impact to the ILRT extension.

Peer Review F&O TH-05 is still open. While updated success criteria and timing data has been developed from MAAP 4.0.7 analyses, it has not been incorporated into the model of record.

Page 62of198

54003-CALC-02 SR Revision 3 2009 ASME/ANS Cat II Requirement Status Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation against NEI SR AS-18 with grade 3 and SY-17 with a grade 3 being contingent on its resolution.

F&O QU The !E's for certain support system failures (RN, KC) are not input in the top event logic as a Boolean equation, but rather as a point estimate whose value is derived by solution of the IE fault tree. However, failures that cause the IE may also affect the mitigating system, such that there is a dependency between the initiating event and the available mitigation. Examples are an electrical bus that failed one train of KC and could fail one train of mitigating equipment. Another example is the operator error in the loss of KC to start the standby train of KC (KKCSTNBDHE). The HRA notebook states this event has dependencies with HYDBACKDHE.

F&O AS-07. The success criteria for AFW for SGTR is 1 CA pump to 2 steam generators. The ruptured SG is assumed to be one of the two steam generators that supply steam to the turbine-driven AFW pump. In the Catawba Rev. 2b fault tree model, however, the dependency of the TDP on the SGTR initiator is not modeled. Thus, the TDP supply is not degraded by the initiating event in the model logic, so the model is incorrect. (This item is already on the list of corrective actions for the Catawba PRA, and Duke has indicated that it will be implemented in the Rev. 3 PRA.) This finding was made against NEI SR DE-5 with grade 3 being contingent on its resolution.

F&O SY System success criteria are specified in the system notebooks in sufficient detail to describe the overall fault tree top events, but no basis is provided in the system notebooks for the number of pumps or flow rate requirements. The Reference section 18.1 does not contain a link to an appropriate success criteria calculation. For Disposition review for dependencies takes place in the cut set file. This process has been proceduralized and is contained in Section 4 of Workplace Guideline XSAA-103, Guidelines For Determining Risk Significance.

F&O AS-07 is only applicable to SGTR events. The CA notebook was updated to reflect the correct success criteria due to SGTR loss of AFW pump, so AS-07 is considered resolved. As scheduled, the dependency of the TDAFW pump on the SGTR initiator was incorporated in the Rev. 3 PRA. Since this ILRT extension analysis uses Rev. 3b, this issue is resolved [Reference 17].

F&O TH Feed and bleed success criteria changes were implement in Rev. 3 of the Transient Analysis Notebook and supported with MAAP analyses. The MAAP-code acceptance criteria applied are identified in Appendix H, Section 3.4 of the Catawba PRA Rev. 3 Transient Analysis Notebook. This is considered to resolve the finding and achieve grade 3 of NEI SR I meet CAT II of the ASME SR.

F&O SY-03 -Although XSAA-115 (PRA Modeling Guidelines) has been revised to require success criteria reference to be provided, references to the appropriate system success criteria have not been added to these system notebooks. As a result, this F&O remains open due to incomplete documentation. This F&O remains open with grade 3 of NEI SR I meet CAT II of the ASME SR being not met.

F&O TH Operator actions are considered as part of the CNP success criteria analyses with expected operator actions included for SLOCA (Section 3.3), SGTR (Section 3.4), and transient F&B (Section 3.6). Specific timing information from MAAP analyses can be found in Appendices A through F MAAP. This F&O is dispositioned based on the resolution of the finding and achieve grade 3 of the NEI SR. However, the CNS Assessment of Peer Review Open Items (May 2013) identifies this F&O as remaining open because the current model of record does not reflect the updated information and as a result the ASME SR is considered Not Met.

F&O TH CNP PRA Tracker ID C-03-0052 for TH OPEN F&O TH-06 is not resolved because the loss of switchgear HVAC initiating event is not included in the PRA, and room heatup Impact on ILRT Extension However, there are no significant changes to the success criteria, so the impact on the ILRT extension is expected to be negligible.

Peer Review F&O SY-03 is still open due to documentation. While the success criteria has been updated, it has not been incorporated into the PRA model. However, there are no significant changes to the success criteria [Reference 45], so the impact on the ILRT extension is expected to be negligible.

Additionally the success criteria for McGuire, (sister plant for Catawba), has been updated and no change in mitigation equipment was identified.

Page 63 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations SR 2009 ASME/ANS Cat II Status Finding/Observation Disposition Impact on ILRT Extension Requirement example, in the KC notebook, it is stated without a calculations for loss of ventilation are not performed for that and other source reference that both pumps and the locations. Room heatup calculations should be performed in all associated heat exchanger in a train are required locations in which HVAC can be lost to justify not modeling those for success when the ND (RHR) heat exchanger is systems and/or determine timing of operator coping actions and required. Similarly, in Section 12 of the RN equipment damage. If no room heatup calculation is performed, it notebook, it is stated that the top events simply should be assumed that the HVAC system is required in those represent "failure to provide sufficient flow" to locations. The appropriate dependencies should be included in the components requiring cooling without defining a PRA model, including possible initiating events. A recent evaluation flow rate or number of pumps (in Section 13 of the was performed (PIP C-13-05664) to determine the impact on the Fire notebook it does state that failure to provide flow PRA of not including switchgear room and battery HVAC modeling.

requires failure of all four pump trains). The CA The evaluation concluded that any additional risk added by including notebook has a similar statement without a tie to a the VCNC systems in the PRA model would be small and would not specific basis. This finding was made against NEI have a significant impact on the Fire PRA results or results for the SR SY-17 with grade 3 being contingent on its NFPA-805 application.

resolution.

F&O TH-05 -The HEP worksheets do not clearly refer to success criteria analyses to support timing for operator actions. Although most worksheets include an estimate of the time available for completion of an action, and some refer generally to information from MAAP analyses, specific references to MAAP (or other analysis) cases are not provided. This finding was made against NEI SR TH-5 with grade 2.

F&O TH There is no room heatup analysis notebook I evaluation of loss of HVAC to equipment rooms for the Catawba PRA, and apparently no retrievable room heatup calculations or documentation to support the assumption that room cooling need not be modeled in the PRA. Other PRAs have found that room cooling is required for some rooms such as electrical equipment rooms and small rooms housing critical pumps. This finding was made against NEI SR TH-9 with grade 3 being contingent on its resolution.

SC-A4 IDENTIFY mitigating systems that Dispositioned F&O AS The success criteria for AFW for The NEI SRs applicable to this ASME SR are IE-6 and DE-5. There Review for dependencies are shared between units, and the SGTR is 1 CA pump to 2 steam generators. The are no NRC objections, but since the explicit requirement for shared takes place in the cut set file.

manner in which the sharing is ruptured SG is assumed to be one of the two steam mitigating systems between units was not contained in NEI 00-02, this Revision 3 Page 64 of 198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement performed should both units experience a common initiating event (e.g., LOOP).

SC-A6 CONFIRM that the bases for the success criteria are consistent with the features, procedures, and operating philosophy of the plant.

Revision 3 Status Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation generators that supply steam to the turbine-driven AFW pump. In the Catawba Rev. 2b fault tree model, however, the dependency of the TDP on the SGTR initiator is not modeled. Thus, the TOP supply is not degraded by the initiating event in the model logic, so the model is incorrect. (This item is already on the list of corrective actions for the Catawba PRA, and Duke has indicated that it will be implemented in the Rev. 3 PRA.) This finding was made against NEI SR DE-5 with grade 3 being contingent on its resolution.

F&O QU The IE's for certain support system failures (RN, KC) are not input in the top event logic as a Boolean equation, but rather as a point estimate whose value is derived by solution of the IE fault tree. However, failures that cause the IE may also affect the mitigating system, such that there is a dependency between the initiating event and the available mitigation. Examples are an electrical bus that failed one train of KC and could fail one train of mitigating equipment. Another example is the operator error in the loss of KC to start the standby train of KC (KKCSTNBDHE). The HRA notebook states this event has dependencies with HYDBACKDHE. This finding was made against NEI SR DE-5 with grade 3 being contingent on its resolution.

F&O TH Success Criteria analyses were not done for the range of possible plant conditions to which they are applied. For example, MLOCA success criteria analyses are done for a 3.5 inch break (file SAAG 96), while the MLOCA is defined as a 2 to 5 inch break. The combinations of systems and operator recoveries that are defined as success at 3.5 inches may not be success at 2 inches or at 5 inches. This issue also applies to large LOCA (8.25 ft2 break analyzed in SAAG 97) vs a break range down to 6 inches, and small LOCA (1 inch break analyzed, SAAG 95) vs. break sizes Disposition should be demonstrated. The original Peer Review rated IE-6 as "3" and DE-5 as "3 with contingencies." DE-5 has two level "B" F&Os:

AS-07 and QU-02.

F&O AS-07 is only applicable to SGTR events. The CA notebook was updated to reflect the correct success criteria due to SGTR loss of AFW pump, so AS-07 is considered resolved. As scheduled, the dependency of the TDAFW pump on the SGTR initiator was incorporated in the Rev. 3 PRA. Since this ILRT extension analysis uses Rev. 3b, this issue is resolved [Reference 17].

F&O QU-02: System level initiators represented as fully developed sub-tree structures are not in the Rev 3 model. Duke Energy feels that it is acceptable to not develop system level initiators as long as a review for dependencies takes place in the cut set file. This process has been proceduralized and is contained in Section 4 of Workplace Guideline XSAA-103, Guidelines For Determining Risk Significance.

The NEI SRs applicable to this ASME SR are AS-5, AS-18, AS-19, TH-4, TH-5, TH-6, TH-8, ST-4, ST-5, ST-7, ST-9 and SY-5. There are no industry self-assessment actions and no NRC objections. The original Peer Review rated AS-5, AS-19, ST-4 and SY-5 as "3" and AS-18, TH-4, TH-6 and ST-9 as "3 with contingencies." TH-8 and St-5 were unrated. TH-5 is rated a "2." AS-18 has one level "B" F&O: TH-03; TH-4 has one level "B" F&O: TH-03; TH-5 has two level "B" F&Os:

HR-05 and TH-05; and TH-8 has one level "B" F&O: TH-06.

F&O TH-03 -As part of establishing success criteria, a series of analyses were performed over a range of applications to ensure that computer codes employed provided realistic results. Success criteria Impact on ILRT Extension This F &O will have no effect on the ILRT extension.

Room heat-up analyses were performed for the switchgear rooms, battery rooms, and the control room

[References 40, 41, and 42].

The results of these analyses show that equipment in these rooms will not be adversely impacted by the loss of HVAC over the 24-hour mission time. There is no Page 65 of 198

54003-CALC-02 SR Revision 3 2009 ASME/ANS Cat 11 Requirement Status Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation from 3/8 to 2 inches. Further, it was not clear that the MLOCA MAAP runs adequately match the accident sequence being modeled in the PRA.

Cases in SAAG 96 do not appear to disable accumulators when defining the minimum ECC requirements, but accumulators are not required by the resulting MLOCA success criteria. Also, MAAP is not an appropriate code to use in performing analyses for rapid blowdown events such as large and some medium LOCAs. This finding was made against NEI SR AS-18 and TH-4 with grade 3 being contingent on its resolution.

F&O TH-05 -The HEP worksheets do not clearly refer to success criteria analyses to support timing for operator actions. Although most worksheets include an estimate of the time available for completion of an action, and some refer generally to information from MAAP analyses, specific references to MAAP (or other analysis) cases are not provided. This finding was made against NEI SR TH-5 with grade 2.

F&O HR In the Catawba HRA notebook for PRA Rev 2b (and similarly in the McGuire Rev 3 HRA notebook), the documentation of the bases for the HEPs is not sufficiently specified to assure that the analysis is reproducible. Specifically, the sequence context (e.g., previous failures in the event sequence, concurrent activities, environmental factors, etc.) and procedural steps applicable to each HEP are not consistently provided. Thus, even though there is evidence that the HEP worksheet information is being reviewed by plant Operations personnel, it is not clear that they would have sufficient supporting information with which to make an effective assessment of the HRA.

Similarly, the timing, PSF, stress level, and all other contributing factors to the HEP were printed, but the basis was not provided. It would not have been Disposition sensitivities included analyses for a range of possible conditions, including the LOCA break sizes and availability of accumulators. In addition, a review of other industry design-basis calculations using alternate methods was employed to consider code limitations. Th is is considered to resolve the finding and achieve grade 3 of the NEI SR/

meet cat II of the ASME SR.

F&O TH Operator actions are considered as part of the CNP success criteria analyses with expected operator actions included for SLOCA (Section 3.3), SGTR (Section 3.4), and transient F&B (Section 3.6). Specific timing information from MAAP analyses can be found in Appendices A through F MAAP. This F&O is dispositioned based on the resolution of the finding and achieve grade 3 of the NEI SR. However, the CNS Assessment of Peer Review Open Items (May 2013) identifies this F&O as remaining open because the current model of record does not reflect the updated information and as a result the ASME SR is considered Not Met.

F&O HR Success criteria, plant parameters and associated acceptance criteria derived from the success criteria analyses are used to support the timing analysis used in the PRA HRA.

References to MAAP analysis that support the timing actions are included in the HRA spreadsheets. This is considered to resolve the elements of this F&O related to this SR, and achieve grade 3 of the NEI SR/ meet cat II of the ASME SR.

F&O TH CNP PRA Tracker ID C-03-0052 for TH OPEN The loss of HVAC was screened as an initiating event in the CNP model based on judgment that sufficient time would allow for diagnosis of the loss of HVAC and recovery of standby equipment and/or alternate means of cooling. Any additional risk added by including the VC/YC systems in the PRA model would be small and would not have a significant impact on results for the ILRT extension application.

Impact on ILRT Extension impact to the ILRT extension.

Peer Review F&O TH-05 is still open. While updated success criteria and timing data has been developed from MAAP 4.0.7 analyses, it has not been incorporated into the model of record.

However, there are no significant changes to the success criteria [Reference 45], so the impact on the ILRT extension is expected to be negligible.

Page 66of198

54003-CALC-02 SR SC-81 2009 ASME/ANS Cat II Requirement USE appropriate realistic generic analyses/evaluations that are applicable to the plant for thermal/hydraulic, structural, and other supporting engineering bases in support of success criteria requiring detailed computer modeling. (See SC-84.) Realistic models or analyses may be supplemented with plant-specific/generic FSAR or other conservative analysis applicable to the plant, but only if such supplemental analyses do not affect the determination of which combinations of systems and trains of systems are required to respond to an initiating event.

Revision 3 Status Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation possible for another analyst to determine the same factors and derive the same number. The lack of such information in the documentation of the HRA limits the ability to verify and reproduce the results, and to determine their applicability in specific scenarios. This finding was made against NEI SR HR-5 with grade 2.

F&O TH There is no room heatup analysis notebook I evaluation of loss of HVAC to equipment rooms for the Catawba PRA, and apparently no retrievable room heatup calculations or documentation to support the assumption that room cooling need not be modeled in the PRA. Other PRAs have found that room cooling is required for some rooms such as electrical equipment rooms and small rooms housing critical pumps. This finding was made against NEI SR TH-9 with grade 3 being contingent on its resolution.

F&O TH Success Criteria analyses were not done for the range of possible plant conditions to which they are applied. For example, MLOCA success criteria analyses are done for a 3.5 inch break (file SAAG 96), while the MLOCA is defined as a 2 to 5 inch break. The combinations of systems and operator recoveries that are defined as success at 3.5 inches may not be success at 2 inches or at 5 inches. This issue also applies to large LOCA (8.25 ft2 break analyzed in SAAG 97) vs a break range down to 6 inches, and small LOCA (1 inch break analyzed, SAAG 95) vs. break sizes from 3/8 to 2 inches. Further, it was not clear that the MLOCA MAAP runs adequately match the accident sequence being modeled in the PRA.

Cases in SAAG 96 do not appear to disable accumulators when defining the minimum ECC requirements, but accumulators are not required by the resulting MLOCA success criteria. Also, MAAP is not an appropriate code to use in performing analyses for rapid blowdown events such as large Disposition The NEI SRs applicable to this ASME SR are AS-18, SY-17, TH-4, TH-6 and TH-7. There are no industry self-assessment actions and no NRG objections. The original Peer Review rated all of these NEI SRs as "3 with contingencies". AS-18 has one level "8" F&O: TH-03; SY-17 has two level "8" F&Os: SY-03 and TH-03; TH-4 has one level "8" F&O: TH-03; and TH-7 has one level "8" F&O: TH-01.

F&O TH-03 -As part of establishing success criteria, a series of analyses were performed over a range of applications to ensure that computer codes employed provided realistic results. Success criteria sensitivities included analyses for a range of possible conditions, including the LOCA break sizes and availability of accumulators. In addition, a review of other industry design-basis calculations using alternate methods was employed to consider code limitations. This is considered to resolve the finding and achieve grade 3 of the NEI SR/

meet cat II of the ASME SR.

F&O SY Although XSAA-115 (PRA Modeling Guidelines) has been revised to require success criteria reference to be provided, references to the appropriate system success criteria have not been added to these system notebooks. As a result, this F&O remains Impact on ILRT Extension Peer Review F&Os SY-03 and TH-01 are still open.

While the success criteria has been updated, it has not been incorporated into the PRA model. However, there are no significant changes to the success criteria

[Reference 45], so the impact on the ILRT extension is expected tb be negligible.

Additionally the success criteria for McGuire (sister plant for Catawba) has been updated and no change in mitigation equipment was identified.

Page 67 of 198

54003-CALC-02 SR Revision 3 2009 ASME/ANS Cat II Requirement Status Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation and some medium LOCAs. This finding was made against NEI SR AS-18, SY-17 and TH-4 with grade 3 being contingent on its resolution.

F&O SY System success criteria are specified in the system notebooks in sufficient detail to describe the overall fault tree top events, but no basis is provided in the system notebooks for the number of pumps or flow rate requirements. The Reference section 18.1 does not contain a link to an appropriate success criteria calculation. For example, in the KC notebook, it is stated without a source reference that both pumps and the associated heat exchanger in a train are required for success when the ND (RHR) heat exchanger is required. Similarly, in Section 12 of the RN notebook, it is stated that the top events simply represent "failure to provide sufficient flow" to components requiring cooling without defining a flow rate or number of pumps (in Section 13 of the notebook it does state that failure to provide flow requires failure of all four pump trains). The CA notebook has a similar statement without a tie to a specific basis. This finding was made against NEI SR SY-17 with grade 3 being contingent on its resolution.

F&O TH Success Criteria (Level 1 and Level 2) for some systems and sequences are supported by MAAP runs with MAAP 3b, Version 16. This version of MAAP has been found to have limitations which can impact conclusions and results. In particular for the Catawba PRA, the simple pressurizer model likely impacts the analyses that involve RCS cooldown and depressurization using SG heat removal by permitting RCS depressurization to match RCS cooldown for transients, without the possible need for pressurizer PO RVs, spray or aux spray. This finding was made Disposition open due to incomplete documentation. This F&O remains open with grade 3 of NEI SR I meet CAT II of the ASME SR being not met.

F&O TH-01 -An updated success criteria calculation was completed using MAAP 4.0.7 (Section 2.2) and is documented into the updated, CNS Success Criteria Notebook. This F&O is dispositioned based on the resolution of the finding and achieve grade 3 of the NEI SR.

However, the CNS Assessment of Peer Review Open Items (May 2013) identifies this F&O as remaining open because the current model of record does not reflect the updated information and as a result the ASME SR is considered Not Met.

Impact on ILRT Extension Page 68 of 198

54003-CALC-02 SR SC-B2 2009 ASME/ANS Cat 11 Requirement DO NOT USE expert judgment except in those situations in which there is Jack of available information regarding the condition or response of a modeled SSC, or a Jack of analytical methods upon which to base a prediction of SSC condition or response. USE the requirements in 1.-4.3 when implementing an expert judgment process.

SC-B3 When defining success criteria, USE thermal/hydraulic, structural, Revision 3 Status Open Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation against NEJ SR TH-7 with grade 3 being contingent on its resolution.

F&O TH Success Criteria analyses were not done for the range of possible plant conditions to which they are applied. For example, MLOCA success criteria analyses are done for a 3.5 inch break (file SAAG 96), while the MLOCA is defined as a 2 to 5 inch break. The combinations of systems and operator recoveries that are defined as success at 3.5 inches may not be success at 2 inches or at 5 inches. This issue also applies to large LOCA (8.25 ft2 break analyzed in SAAG 97) vs a break range down to 6 inches, and small LOCA (1 inch break analyzed, SAAG 95) vs. break sizes from 3/8 to 2 inches. Further, it was not clear that the MLOCA MAAP runs adequately match the accident sequence being modeled in the PRA.

Cases in SAAG 96 do not appear to disable accumulators when defining the minimum ECC requirements, but accumulators are not required by the resulting MLOCA success criteria. Also, MAAP is not an appropriate code to use in performing analyses for rapid blowdown events such as large and some medium LOCAs. This finding was made against NEJ SR AS-18 and TH-4 with grade 3 being contingent on its resolution.

F&O TH There is no room heatup analysis notebook I evaluation of Joss of HVAC to equipment rooms for the Catawba PRA, and apparently no retrievable room heatup calculations or documentation to support the assumption that room cooling need not be modeled in the PRA. Other PRAs have found that room cooling is required for some rooms such as electrical equipment rooms and small rooms housing critical pumps. This finding was made against NEI SR TH-9 with grade 3 being contingent on its resolution.

F&O TH Success Criteria analyses were not done for the range of possible plant conditions to Disposition The NEI SRs applicable to this ASME SR are TH-4 and TH-8. There are no NRC objections, but the requirement to assess the availability of documentation was not contained in N El 00-02, this should be demonstrated. The original Peer Review rated TH-4 as "3 with contingencies". TH-8 is unrated. TH-4 has one level "B" F&O: TH-03; and TH-8 has one level "B" F&O: TH-06.

F&O TH-03 -As part of establishing success criteria, a series of analyses were performed over a range of applications to ensure that computer codes employed provided realistic results. Success criteria sensitivities included analyses for a range of possible conditions, including the LOCA break sizes and availability of accumulators. In addition, a review of other industry design-basis calculations using alternate methods was employed to consider code limitations. This is considered to resolve the finding and achieve grade 3 of the NEJ SR/

meet cat II of the ASME SR.

F&O TH CNP PRA Tracker ID C-03-0052 for TH OPEN The Joss of HVAC was screened as an initiating event in the CNP model based on judgment that sufficient time would allow for diagnosis of the Joss of HVAC and recovery of standby equipment and/or alternate means of cooling. Any additional risk added by including the VC/YC systems in the PRA model would be small and would not have a significant impact on results for the ILRT extension application.

Impact on ILRT Extension Room heat-up analyses were performed for the switchgear rooms, battery rooms, and the control room

[References 40, 41, and 42].

The results of these analyses show that equipment in these rooms will not be adversely impacted by the Joss of HVAC over the 24-hour mission time. There is no impact to the ILRT extension.

The NEI SRs applicable to this ASME SR are AS-18, TH-4, TH-6 and Peer Review F&O TH-05 is TH-7. There are no industry self-assessment actions and no NRC still open. While updated Page 69of198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement or other analyses/evaluations appropriate to the event being analyzed, and accounting for a level of detail consistent with the initiating event grouping (HLR-IE-8) and accident sequence modeling (HLR-AS-A and HLR-AS-8).

Revision 3 Status Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation which they are applied. For example, MLOCA success criteria analyses are done for a 3.5 inch break (file SAAG 96), while the MLOCA is defined as a 2 to 5 inch break. The combinations of systems and operator recoveries that are defined as success at 3.5 inches may not be success at 2 inches or at 5 inches. This issue also applies to large LOCA (8.25 112 break analyzed in SAAG 97) vs a break range down to 6 inches, and small LOCA (1 inch break analyzed, SAAG 95) vs. break sizes from 3/8 to 2 inches. Further, it was not clear that the MLOCA MAAP runs adequately match the accident sequence being modeled in the PRA.

Cases in SAAG 96 do not appear to disable accumulators when defining the minimum ECC requirements, but accumulators are not required by the resulting MLOCA success criteria. Also, MAAP is not an appropriate code to use in performing analyses for rapid blowdown events such as large and some medium LOCAs. This finding was made against NEI SR AS-18 and TH-4 with grade 3 being contingent on its resolution.

F &O TH-05 -The HEP worksheets do not clearly refer to success criteria analyses to support timing for operator actions. Although most worksheets include an estimate of the time available for completion of an action, and some refer generally to information from MAAP analyses, specific references to MAAP (or other analysis) cases are not provided. This finding was made against NEI SR TH-5 with grade 2.

F&O HR In the Catawba HRA notebook for PRA Rev 2b (and similarly in the McGuire Rev 3 HRA notebook), the documentation of the bases for the HEPs is not sufficiently specified to assure that the analysis is reproducible. Specifically, the sequence context (e.g., previous failures in the event sequence, concurrent activities, Disposition objections. The original Peer Review rated all of these NEI SRs as "3 with contingencies", except TH-5, which is rated a "2". AS-18 has one level "8" F&O: TH-03; TH-4 has one level "8" F&O: TH-03; TH-5 has two level "8" F&Os: HR-05 and TH-05; and TH-7 has one level "8" F&O: TH-01.

F&O TH As part of establishing success criteria, a series of analyses were performed over a range of applications to ensure that computer codes employed provided realistic results. Success criteria sensitivities included analyses for a range of possible conditions, including the LOCA break sizes and availability of accumulators. In addition, a review of other industry design-basis calculations using alternate methods was employed to consider code limitations. This is considered to resolve the finding and achieve grade 3 of the NEI SR/

meet cat II of the ASME SR.

F&O TH Operator actions are considered as part of the CNP success criteria analyses with expected operator actions included for SLOCA (Section 3.3), SGTR (Section 3.4), and transient F&8 (Section 3.6). Specific timing information from MAAP analyses can be found in Appendices A through F MAAP. This F&O is dispositioned based on the resolution of the finding and achieve grade 3 of the NEI SR. However, the CNS Assessment of Peer Review Open Items (May 2013) identifies this F&O as remaining open because the current model of record does not reflect the updated information and as a result the ASME SR is considered Not Met.

F&O HR Success criteria, plant parameters and associated acceptance criteria derived from the success criteria analyses are used to support the timing analysis used in the PRA HRA.

References to MAAP analysis that support the timing actions are included in the HRA spreadsheets. This is considered to resolve the elements of this F&O related to this SR, and achieve grade 3 of the NEI SR/ meet cat II of the ASME SR.

F&O TH-01 -An updated success criteria calculation was completed using MAAP 4.0.7 (Section 2.2) and is documented into the updated CNS Success Criteria Notebook. This F&O is dispositioned based on the resolution of the finding and achieve grade 3 of the NEI SR.

However, the CNS Assessment of Peer Review Open Items (May Impact on ILRT Extension success criteria and timing data has been developed from MAAP 4.0.7 analyses, it has not been incorporated into the model of record.

However, there are no significant changes to the success criteria, so the impact on the ILRT extension is expected to be negligible.

Peer Review F&O TH-01 is still open. While the success criteria has been updated, it has not been incorporated into the PRA model.

However, there are no significant changes to the success criteria [Reference 45], so the impact on the ILRT extension is expected to be negligible.

Page 70 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations SR 2009 ASME/ANS Cat II Status Finding/Observation Disposition Impact on ILRT Extension Requirement environmental factors, etc.) and procedural steps 2013) identifies this F&O as remaining open because the current applicable to each HEP are not consistently model of record does not reflect the updated information and as a provided. Thus, even though there is evidence that result the ASME SR is considered Not Met.

the HEP worksheet information is being reviewed by plant Operations personnel, it is not clear that they would have sufficient supporting information with which to make an effective assessment of the HRA.

Similarly, the timing, PSF, stress level, and all other contributing factors to the HEP were printed, but the basis was not provided. It would not have been possible for another analyst to determine the same factors and derive the same number. The lack of such information in the documentation of the HRA limits the ability to verify and reproduce the results, and to determine their applicability in specific scenarios. This finding was made against NEI SR TH-5 with grade 2.

F&O TH Success Criteria (Level 1 and Level 2) for some systems and sequences are supported by MAAP runs with MAAP 3b, Version 16. This version of MAAP has been found to have limitations which can impact conclusions and results. In particular for the Catawba PRA, the simple pressurizer model likely impacts the analyses that involve RCS cooldown and depressurization using SG heat removal by permitting RCS depressurization to match RCS cooldown for transients, without the possible need for pressurizer PO RVs, spray or aux spray. This finding was made against NEI SR TH-7 with grade 3 being contingent on its resolution.

SC-84 USE analysis models and computer Open F&O TH Success Criteria analyses were not The NEI SRs applicable to this ASME SR are AS-18, TH-4, TH-6, and Peer Review F&O TH-01 is codes that have sufficient capability done for the range of possible plant conditions to TH-7. There are no industry self-assessment actions and no NRC still open. While the success to model the conditions of interest in which they are applied. For example, MLOCA objections. The original Peer Review rated all of these NEI SRs as "3 criteria have been updated, the determination of success criteria success criteria analyses are done for a 3.5 inch with contingencies". AS-18 has one level "B" F&O: TH-03; TH-4 has it has not been incorporated for CDF, and that provide results break (file SAAG 96), while the MLOCA is defined one level "B" F&O: TH-03; and TH-7 has one level "B" F&O: TH-01.

into the PRA model.

representative of the plant. A as a 2 to 5 inch break. The combinations of However, there are no qualitative evaluation of a relevant systems and operator recoveries that are defined as F&O TH-03 -As part of establishing success criteria, a series of significant changes to the aeelication of codes, models, or success at 3.5 inches ma~ not be success at 2 anal~ses were eerformed over a range of aeelications to ensure that success criteria [Reference Revision 3 Page 71 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations SR 2009 ASME/ANS Cat II Status Finding/Observation Disposition Impact on ILRT Extension Requirement analyses that has been used for a inches or at 5 inches. This issue also applies to computer codes employed provided realistic results. Success criteria 45], so the impact on the similar class of plant (e.g., Owner's large LOCA (8.25 ft2 break analyzed in SAAG 97) sensitivities included analyses for a range of possible conditions, ILRT extension is expected Group generic studies) may be vs a break range down to 6 inches, and small LOCA including the LOCA break sizes and availability of accumulators. In to be negligible.

used. USE computer codes and (1 inch break analyzed, SAAG 95} vs. break sizes addition, a review of other industry design-basis calculations using models only within known limits of from 3/8 to 2 inches. Further, it was not clear that alternate methods was employed to consider code limitations. This is applicability.

the MLOCA MAAP runs adequately match the considered to resolve the finding and achieve grade 3 of the NEI SR/

accident sequence being modeled in the PRA.

meet cat II of the ASME SR.

Cases in SAAG 96 do not appear to disable accumulators when defining the minimum ECG F&O TH-01 -An updated success criteria calculation was completed requirements, but accumulators are not required by using MAAP 4.0.7 (Section 2.2) and is documented into the updated the resulting MLOCA success criteria. Also, MAAP CNS Success Criteria Notebook. This F&O is dispositioned based on is not an appropriate code to use in performing the resolution of the finding and achieve grade 3 of the NEI SR.

analyses for rapid blowdown events such as large However, the CNS Assessment of Peer Review Open Items (May and some medium LOCAs. This finding was made 2013) identifies this F&O as remaining open because the current against NEI SR AS-18 and TH-4 with grade 3 being model of record does not reflect the updated information and as a contingent on its resolution.

result the ASME SR is considered Not Met.

F&O TH Success Criteria (Level 1 and Level 2) for some systems and sequences are supported by MAAP runs with MAAP 3b, Version 16. This version of MAAP has been found to have limitations which can impact conclusions and results. In particular for the Catawba PRA, the simple pressurizer model likely impacts the analyses that involve RCS cooldown and depressurization using SG heat removal by permitting RCS depressurization to match RCS cooldown for transients, without the possible need for pressurizer PORVs, spray or aux spray. This finding was made against NEI SR TH-7 with grade 3 being contingent on its resolution.

SC-BS CHECK the reasonableness and Open F&O TH Success Criteria (Level 1 and Level 2) The NEI SRs applicable to this ASME SR are TH-7 and TH-9. There Room heat-up analyses acceptability of the results of the for some systems and sequences are supported by are no industry self-assessment actions and no NRG objections. The were performed for the thermal/hydraulic, structural, or MAAP runs with MAAP 3b, Version 16. This original Peer Review rated both of these NEI SRs as "3 with switchgear rooms, battery other supporting engineering bases version of MAAP has been found to have limitations contingencies". TH-7 has one level "B" F&O: TH-01; and TH-9 has rooms, and the control room used to support the success criteria.

which can impact conclusions and results. In two level "B" F&Os: TH-05 and TH-06.

[References 40, 41, and 42].

particular for the Catawba PRA, the simple The results of these Examples of methods to achieve pressurizer model likely impacts the analyses that F&O TH An updated success criteria calculation was completed analyses show that this include:

involve RCS cooldown and deeressurization usin2 using MAAP 4.0.7 !Section 2.2l and is documented into the uedated esuiement in these rooms Revision 3 Page 72of198

54003-CALC-02 SR SC-C1 2009 ASME/ANS Cat 11 Requirement (a) comparison with results of the same analyses performed for similar plants, accounting for differences in unique plant features (b) comparison with results of similar analyses performed with other plant-specific codes (c) check by other means appropriate to the particular analysis DOCUMENT the success criteria in a manner that facilitates PRA applications, upgrades, and peer review.

Revision 3 Status Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation SG heat removal by permitting RCS depressurization to match RCS cooldown for transients, without the possible need for pressurizer PO RVs, spray or aux spray. This finding was made against NEI SR TH-7 with grade 3 being contingent on its resolution.

F&O TH-05 -The HEP worksheets do not clearly refer to success criteria analyses to support timing for operator actions. Although most worksheets include an estimate of the time available for completion of an action, and some refer generally to information from MAAP analyses, specific references to MAAP (or other analysis) cases are not provided. This finding was made against NEI SR TH-5 with grade 2.

F&O TH There is no room heatup analysis notebook I evaluation of loss of HVAC to equipment rooms for the Catawba PRA, and apparently no retrievable room heatup calculations or documentation to support the assumption that room cooling need not be modeled in the PRA. Other PRAs have found that room cooling is required for some rooms such as electrical equipment rooms and small rooms housing critical pumps. This finding was made against NEI SR TH-9 with grade 3 being contingent on its resolution.

F&O TH Success Criteria analyses were not done for the range of possible plant conditions to which they are applied. For example, MLOCA success criteria analyses are done for a 3.5 inch break (file SAAG 96), while the MLOCA is defined as a 2 to 5 inch break. The combinations of systems and operator recoveries that are defined as success at 3.5 inches may not be success at 2 Disposition CNS Success Criteria Notebook. This F&O is dispositioned based on the resolution of the finding and achieve grade 3 of the NEI SR.

However, the CNS Assessment of Peer Review Open Items (May 2013) identifies this F&O as remaining open because the current model of record does not reflect the updated information and as a result the ASME SR is considered Not Met.

F&O TH Operator actions are considered as part of the CNP success criteria analyses with expected operator actions included for SLOCA (Section 3.3), SGTR (Section 3.4), and transient F&B (Section 3.6). Specific timing information from MAAP analyses can be found in Appendices A through F MAAP. This F&O is dispositioned based on the resolution of the finding and achieve grade 3 of the NEI SR. However, the CNS Assessment of Peer Review Open Items (May 2013) identifies this F&O as remaining open because the current model of record does not reflect the updated information and as a result the ASME SR is considered Not Met.

F&O TH CNP PRA Tracker ID C-03-0052 for TH OPEN The loss of HVAC was screened as an initiating event in the CNP model based on judgment that sufficient time would allow for diagnosis of the loss of HVAC and recovery of standby equipment and/or alternate means of cooling. Any additional risk added by including the VCfYC systems in the PRA model would be small and would not have a significant impact on results for the ILRT extension application.

The NEI SRs applicable to this ASME SR are ST-13, SY-10, SY-17, SY-27, TH-8, TH-9, TH-10, AS-17, AS-18, AS-24 and HR-30. There are no industry self-assessment actions and no NRC objections. The original Peer Review rated ST-13, TH-10, AS-17, and AS-24 as "3" and SY-17, ST-27, TH-9, and AS-18 as "3 with contingencies." TH-8 and HR-30 were unrated. SY-10 is rated a "2." SY-10 has one level "B" F&O: TH-06; SY-17 has two level "B" F&Os: SY-03 and TH-03; SY-27 has one level "B" F&O: SY-03; TH-8 has one level "B" F&O:

Impact on ILRT Extension will not be adversely impacted by the loss of HVAC over the 24-hour mission time. There is no impact to the ILRT extension.

Peer Review F&O TH-05 is still open. While updated success criteria and timing data has been developed from MAAP 4.0.7 analyses, it has not been incorporated into the model of record.

However, there are no significant changes to the success criteria [Reference 45], so the impact on the ILRT extension is expected to be negligible.

Peer Review F&O TH-01 is still open. While the success criteria have been updated, it has not been incorporated into the PRA model.

However, there are no significant changes to the success criteria, so the impact on the ILRT extension is expected to be negligible.

Room heat-up analyses were performed for the switchgear rooms, battery rooms, and the control room

[References 40, 41, and 42].

The results of these analyses show that equipment in these rooms Page 73of198

54003-CALC-02 SR Revision 3 2009 ASME/ANS Cat II Requirement Status Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation inches or at 5 inches. This issue also applies to large LOCA (8.25 ft2 break analyzed in SAAG 97) vs a break range down to 6 inches, and small LOCA (1 inch break analyzed, SAAG 95) vs. break sizes from 3/8 to 2 inches. Further, it was not clear that the MLOCA MAAP runs adequately match the accident sequence being modeled in the PRA.

Cases in SAAG 96 do not appear to disable accumulators when defining the minimum ECC requirements, but accumulators are not required by the resulting MLOCA success criteria. Also, MAAP is not an appropriate code to use in performing analyses for rapid blowdown events such as large and some medium LOCAs. This finding was made against NEI SR AS-18 and SY-17 with grade 3 being contingent on its resolution.

F&O HR In the Catawba HRA notebook for PRA Rev 2b (and similctrly in the McGuire Rev 3 HRA notebook), the documentation of the bases for the HEPs is not sufficiently specified to assure that the analysis is reproducible. Specifically, the sequence context (e.g., previous failures in the event sequence, concurrent activities, environmental factors, etc.) and procedural steps applicable to each HEP are not consistently provided. Thus, even though there is evidence that the HEP worksheet information is being reviewed by plant Operations personnel, it is not clear that they would have sufficient supporting information with which to make an effective assessment of the HRA.

Similarly, the timing, PSF, stress level, and all other contributing factors to the HEP were printed, but the basis was not provided. It would not have been possible for another analyst to determine the same factors and derive the same number. The lack of such information in the documentation of the HRA limits the ability to verify and reproduce the results, and to determine their applicability in specific scenarios. This finding was made against NEI SR Disposition Impact on ILRT Extension TH-06; TH-9 has two level "B" F&Os: TH-05 and TH-06; AS-18 has will not be adversely one level "B" F&O: TH-03; and HR-30 has one level "B" F&O: HR-05. impacted by the loss of HVAC over the 24-hour F&O TH-03 -As part of establishing success criteria, a series of analyses were performed over a range of applications to ensure that computer codes employed provided realistic results. Success criteria sensitivities included analyses for a range of possible conditions, including the LOCA break sizes and availability of accumulators. In addition, a review of other industry design-basis calculations using alternate methods was employed to consider code limitations. This is considered to resolve the finding and achieve grade 3 of the NEI SR/

meet cat II of the ASME SR.

F&O HR Success criteria, plant parameters and associated acceptance criteria derived from the success criteria analyses are used to support the timing analysis used in the PRA HRA.

References to MAAP analysis that support the timing actions are included in the HRA spreadsheets. This is considered to resolve the elements of this F&O related to this SR, and achieve grade 3 of the NEI SR/ meet cat II of the ASME SR.

F&O TH CNP PRA Tracker ID C-03-0052 for TH OPEN The loss of HVAC was screened as an initiating event in the CNP model based on judgment that sufficient time would allow for diagnosis of the loss of HVAC and recovery of standby equipment and/or alternate means of cooling. Any additional risk added by including the VC/YC systems in the PRA model would be small and would not have a significant impact on results for the ILRT extension application.

F&O SY-03 -Although XSAA-115 (PRA Modeling Guidelines) has been revised to require success criteria reference to be provided, references to the appropriate system success criteria have not been added to these system notebooks. As a result, this F&O remains open due to incomplete documentation. This F&O remains open with grade 3 of NEI SR I meet CAT II of the ASME SR being not met.

mission time. There is no impact to the ILRT extension.

Peer Review F&O SY-03 is still open. While the success criteria have been updated, it has not been incorporated into the PRA model.

However, there are no significant changes to the success criteria [Reference 45], so the impact on the ILRT extension is expected to be negligible.

Additionally the success criteria for McGuire, (sister plant for Catawba), has been updated and no change in mitigation equipment was identified.

Page 74of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations SR 2009 ASME/ANS Cat II Status Finding/Observation Disposition Impact on ILRT Extension Requirement HR-30 with grade 2.

F&O TH There is no room heatup analysis notebook I evaluation of loss of HVAC to equipment rooms for the Catawba PRA, and apparently no retrievable room heatup calculations or documentation to support the assumption that room cooling need not be modeled in the PRA. Other PRAs have found that room cooling is required for some rooms such as electrical equipment rooms and small rooms housing critical pumps. This finding was made against NEI SR TH-9 with grade 3 being contingent on its resolution.

F&O SY System success criteria are specified in the system notebooks in sufficient detail to describe the overall fault tree top events, but no basis is provided in the system notebooks for the number of pumps or flow rate requirements. The Reference section 18.1 does not contain a link to an appropriate success criteria calculation. For example, in the KC notebook, it is stated without a source reference that both pumps and the associated heat exchanger in a train are required for success when the ND (RH R) heat exchanger is required. Similarly, in Section 12 of the RN notebook, it is stated that the top events simply represent "failure to provide sufficient flow" to components requiring cooling without defining a flow rate or number of pumps (in Section 13 of the notebook it does state that failure to provide flow requires failure of all four pump trains). The CA notebook has a similar statement without a tie to a specific basis. This finding was made against NEI SR SY-17 with grade 3 being contingent on its resolution.

SC-C2 DOCUMENT the processes used to Open F&O TH Success Criteria analyses were not The NEI SRs applicable to this ASME SR are ST-13, SY-10, SY-17, Room heat-up analyses develop overall PRA success done for the range of possible plant conditions to SY-27, TH-8, TH-9, TH-10, AS-17, AS-18, AS-24 and HR-30. There were performed for the criteria and the supporting which they are applied. For example, MLOCA are no NRG objections, but the requirement to assess the availability switchgear rooms, battery engineering bases, including the success criteria analyses are done for a 3.5 inch of documentation was not explicitly contained in NEI 00-02, this rooms, and the control room Revision 3 Page 75of198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement inputs, methods, and results. For example, this documentation typically includes:

(a) the definition of core damage used in the PRA including the bases for any selected parameter value used in the definition (e.g.,

peak cladding temperature or reactor vessel level)

(b) calculations (generic and plant-specific) or other references used to establish success criteria, and identification of cases for which they are used (c) identification of computer codes or other methods used to establish plant-specific success criteria (d) a description of the limitations (e.g., potential conservatisms or limitations that could challenge the applicability of computer models in certain cases) of the calculations or codes (e) the uses of expert judgment within the PRA, and rationale for such uses (f) a summary of success criteria for the available mitigating systems and human actions for each accident initiating group modeled in the PRA (g) the basis for establishing the time available for human actions Revision 3 Status Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation break (file SAAG 96), while the MLOCA is defined as a 2 to 5 inch break. The combinations of systems and operator recoveries that are defined as success at 3.5 inches may not be success at 2 inches or at 5 inches. This issue also applies to large LOCA (8.25 ft2 break analyzed in SAAG 97) vs a break range down to 6 inches, and small LOCA (1 inch break analyzed, SAAG 95) vs. break sizes from 3/8 to 2 inches. Further, it was not clear that the MLOCA MAAP runs adequately match the accident sequence being modeled in the PRA.

Cases in SAAG 96 do not appear to disable accumulators when defining the minimum ECC requirements, but accumulators are not required by the resulting MLOCA success criteria. Also, MAAP is not an appropriate code to use in performing analyses for rapid blowdown events such as large and some medium LOCAs.

This finding was made against NEI SR AS-18 and SY-17 with grade 3 being contingent on its resolution.

F&O HR In the Catawba HRA notebook for PRA Rev 2b (and similarly in the McGuire Rev 3 HRA notebook), the documentation of the bases for the HEPs is not sufficiently specified to assure that the analysis is reproducible. Specifically, the sequence context (e.g., previous failures in the event sequence, concurrent activities, environmental factors, etc.) and procedural steps applicable to each HEP are not consistently provided. Thus, even though there is evidence that the HEP worksheet information is being reviewed by plant Operations personnel, it is not clear that they would have sufficient supporting information with which to make an effective assessment of the HRA.

Similarly, the timing, PSF, stress level, and all other contributing factors to the HEP were printed, but the basis was not provided. It would not have been possible for another analyst to determine the same Disposition should be demonstrated. The original Peer Review rated ST-13, TH-10, AS-17, and AS-24 as "3" and SY-17, ST-27, TH-9, and AS-18 as "3 with contingencies." TH-8 and HR-30 were unrated. SY-10 is rated a "2." SY-10 has one level "B" F&O: TH-06; SY-17 has two level "B" F&Os: SY-03 and TH-03; SY-27 has one level "B" F&O: SY-03; TH-8 has one level "B" F&O: TH-06; TH-9 has two level "B" F&Os: TH-05 and TH-06; AS-18 has one level "B" F&O: TH-03; and HR-30 has one level "B" F&O: HR-05.

F&O TH-03 -As part of establishing success criteria, a series of analyses were performed over a range of applications to ensure that computer codes employed provided realistic results. Success criteria sensitivities included analyses for a range of possible conditions, including the LOCA break sizes and availability of accumulators. In addition, a review of other industry design-basis calculations using alternate methods was employed to consider code limitations. This is considered to resolve the finding and achieve grade 3 of the NEI SR/

meet cat II of the ASME SR.

F&O HR Success criteria, plant parameters and associated acceptance criteria derived from the success criteria analyses are used to support the timing analysis used in the PRA HRA.

References to MAAP analysis that support the timing actions are included in the HRA spreadsheets. This is considered to resolve the elements of this F&O related to this SR, and achieve grade 3 of the NEI SR/ meet cat II of the ASME SR.

F&O TH CNP PRA Tracker ID C-03-0052 for TH OPEN The loss of HVAC was screened as an initiating event in the CNP model based on judgment that sufficient time would allow for diagnosis of the loss of HVAC and recovery of standby equipment and/or alternate means of cooling. Any additional risk added by including the VC/YC systems in the PRA model would be small and would not have a significant impact on results for the ILRT extension application.

F&O SY-03 -Although XSAA-115 (PRA Modeling Guidelines) has been revised to require success criteria reference to be provided, references to the appropriate system success criteria have not been added to these system notebooks. As a result, this F&O remains Impact on ILRT Extension

[References 40, 41, and 42].

The results of these analyses show that equipment in these rooms will not be adversely impacted by the loss of HVAC over the 24-hour mission time. There is no impact to the ILRT extension.

Peer Review F&O SY-03 is still open. While the success criteria have been updated, it has not been incorporated into the PRA model.

However, there are no significant changes to the success criteria [Reference 45], so the impact on the ILRT extension is expected to be negligible.

Additionally the success criteria for McGuire, (sister plant for Catawba), has been updated and no change in mitigation equipment was identified.

Page 76of198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement (h) descriptions of processes used to define success criteria for grouped initiating events or accident sequences Revision 3 Status Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation factors and derive the same number. The Jack of such information in the documentation of the H RA limits the ability to verify and reproduce the results, and to determine their applicability in specific scenarios. This finding was made against NEI SR HR-30 with grade 2.

F&O TH There is no room heatup analysis notebook I evaluation of Joss of HVAC to equipment rooms for the Catawba PRA, and apparently no retrievable room heatup calculations or documentation to support the assumption that room cooling need not be modeled in the PRA. Other PRAs have found that room cooling is required for some rooms such as electrical equipment rooms and small rooms housing critical pumps. This finding was made against NEI SR TH-9 with grade 3 being contingent on its resolution.

F&O SY System success criteria are specified in the system notebooks in sufficient detail to describe the overall fault tree top events, but no basis is provided in the system notebooks for the number of pumps or flow rate requirements. The Reference section 18.1 does not contain a link to an appropriate success criteria calculation. For example, in the KC notebook, it is stated without a source reference that both pumps and the associated heat exchanger in a train are required for success when the ND (RHR) heat exchanger is required. Similarly, in Section 12 of the RN notebook, it is stated that the top events simply represent "failure to provide sufficient flow" to components requiring cooling without defining a flow rate or number of pumps (in Section 13 of the notebook it does state that failure to provide flow requires failure of all four pump trains). The CA notebook has a similar statement without a tie to a specific basis. This finding was made against NEI Disposition open due to incomplete documentation. This F&O remains open with grade 3 of N El SR I meet CAT II of the ASME SR being not met.

Impact on ILRT Extension Page 77of198

54003-CALC-02 SR SY-A4 SY-AS 2009 ASME/ANS Cat 11 Requirement PERFORM plant walkdowns and interviews with knowledgeable plant personnel (e.g., engineering, plant operations, etc.) to confirm that the systems analysis correctly reflects the as-built, as-operated plant.

INCLUDE the effects of both normal and alternate system alignments, to the extent needed for CDF and LERF determination.

Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Status Dispositioned Finding/Observation SR SY-17 with grade 3 being contingent on its resolution.

None Dispositioned None Disposition NEI 00-02 does not have a precise equivalent to SY-A4. System analysis subelements DE-11, SY-10, and SY footnote S provide partial coverage. DE-11 requires walkdowns but specifies walkdowns to examine spatial dependencies, not, as SY-A4 requires, to confirm that the systems analysis correctly reflects the as-built, as-operated plant. Likewise, SY-1 O including Footnote S and F&O TH-06 specifically concern spatial or environmental dependencies, which are assessed as part of SRs SY-A21 and SY-A22. F&O TH-06 does not apply to SR SY-A4. Therefore the Grade 3 given to DE-11 and the Grade 2 given to SY-1 O by the peer review team do not apply to SR SY-A4. Compliance with SR-A4 is assessed by reference to the peer review teams notes on SY-10 and DE-11. The 2002 peer review's notes show that the peer review team specifically reviewed walkdown notes oriented to confirming that the systems analysis correctly reflects the as-built, as-operated plant (see notes R4 and R19 below).

Therefore, SY-A4 is considered met. The proposed resolution in Table C of the self-assessment suggests an enhancement to system documentation (see below). Completion of the enhancement will solidify the assessment that SR SY-A4 is met.

Self-assessment Table C indicates the following resolution under SY-A4: Enhance the system documentation to include an up-to-date system walkdown checklist and system engineer review for each system. Consider revising workplace procedure XSAA-106 to require that such documentation be revisited with each major PRA revision.

SY-AS corresponds to NEI 00-02 subelements SY-8, SY-11, QU-12, and QU-13, which provide partial coverage. Because subelement SY-11 and associated F&O SY-06 are limited to consideration of system performance in degraded environments, they are not closely related to this SR, and are assessed as part of SRs SY-A21, SY-A22, and SY-B14. QU-12 and especially QU-13 refer to model asymmetry, which does not cover the effects of normal and alternate alignments.

QU-12 and QU-13 were given a Grade 3 by the peer review team.SY-8 is also related to modeling normal and alternate alignments to the extent that it mentions test and maintenance availabilities, but does Impact on ILRT Extension Self-assessment Table E assesses the impact as follows: To support system model development, walkdowns and plant personnel interviews were performed. However, documentation of an up-to date system walkdown is not included with each system notebook. This documentation issue does not impact the ILRT extension.

Based on the disposition, the requirements of Cat JI are considered met. There is no impact on the ILRT extension.

Page 78 of 198

54003-CALC-02 SR SY-A10 2009 ASME/ANS Cat II Requirement INCORPORATE the effect of variable success criteria (i.e.,

success criteria that change as a function of plant status) into the system modeling. Example causes of variable system success criteria are:

(a) different accident scenarios.

Different success criteria are required for some systems to mitigate different accident scenarios (e.g., the number of pumps required to operate in some systems is dependent upon the modeled initiating event);

(b) dependence on other components. Success criteria for some systems are also dependent on the success of another component in the system (e.g.,

operation of additional pumps in some cooling water systems is required if non-critical loads are not isolated);

(c) lime dependence. Success criteria for some systems are time-dependent (e.g., two pumps are Revision 3 Status Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation F&O DE-04: HVAC cooling of the essential switchgear rooms is staled as being required. The IPE quantitative analysis does not provide adequate success criteria. For example, the following are not specified: temperature limits of equipment, minimum number of Air Handling Units, or minimum number of chillers. The evaluation also states there is no concern within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months provided that only those loads needed to provide core cooling are operated.

There is no discussion of electrical load shedding for those loads not required, and of the human interface to execute load shedding. The human interface can be complex, involving both a discovery process (control room annunciators, or in the case of a local AHU failure, discovery through operator walkaround), and procedures and training to direct operation actions.

F&O AS-01: SAAG 427 describes the ATWS event tree analysis. Section 4, event B, describes how main feedwater is recovered after an A TWS. The probabilities used for main feedwater recovery are

.05, following a T2 (Loss of Load) and.2 following a T4 (Loss of MFW). In the non-ATWS analysis, the following non-recoveries (From SAAG 427) are:

T1 non-rec =.05 T4 - non-rec=.1 Considering that the critical time for FW to come on line in an A TWS event involving a loss of main feedwater is very short, even for conditions of favorable MTC, the use of non-recovery probabilities of this magnitude does not appear lo be justified without supporting analyses.

Disposition not fully cover the requirement to model normal and alternate alignments. SY-8 was given a Grade 3 by the peer review team.

By self-assessment, it was determined that normal and alternate system alignments are included to the extent necessary for GDF and LERF determination. Fault tree top events are included for GDF and LERF. This is considered sufficient to meet CAT II of the ASME/ANS PRA Standard.

SY-A10 corresponds to NEI 00-02 system analysis subelements SY-12, SY-13, SY-17, and SY-23 and accident sequence subelements AS-10, AS-13, AS-16, AS-17, and AS-18. The 2002 peer review team assigned unconditional Grade 3 lo AS-13, AS-17, SY-12, SY-13, and SY-13, and a contingent Grade 3 to AS-10, AS-16, AS-18 and SY-17 with level "B" F&Os: DE-04, AS-01, SY-03 and TH-03. F&O DE-04 (PRA Tracker Item C-03-0052) and TH-03 (PRAT racker Item C 0050) are both open.

F&O DE-04 is not resolved because the loss of switchgear HVAC initialing event is not included in the PRA. Any additional risk added by including the VC/YC systems in the PRA model would be small and would not have a significant impact on results for the ILRT extension application.

F&O AS Credit for Main Feedwater has been removed from the A TWS model, which resolves this F&O. Recovery for MFW in A TWS events initiated by a loss of feedwater has no impact on Fire PRA.

F&O TH-03 -As part of establishing success criteria, a series of analyses were performed over a range of applications to ensure that computer codes employed provided realistic results. Success criteria sensitivities included analyses for a range of possible conditions, including the LOCA break sizes and availability of accumulators. In addition, a review of other industry design-basis calculations using alternate methods was employed to consider code limitations. This is considered to resolve the finding and achieve grade 3 of the NEI SR/

meet cat II of the ASME SR.

F&O SY-03 -Although XSAA-115 (PRA Modeling Guidelines) has been revised to require success criteria reference to be provided, references to the appropriate system success criteria have not been Impact on ILRT Extension Room heat-up analyses were performed for the switchgear rooms, battery rooms, and the control room

[References 40, 41, and 42].

The results of these analyses show that equipment in these rooms will not be adversely impacted by the loss of HVAC over the 24-hour mission time. There is no impact to the ILRT extension.

Peer Review F&O SY-03 is still open. While the success criteria have been updated, it has not been incorporated into the PRA model.

However, there are no significant changes to the success criteria [Reference 45]. so the impact on the ILRT extension is expected to be negligible.

Additionally the success criteria for McGuire, (sister plant for Catawba), has"been updated and no change in mitigation equipment was identified.

Page 79of198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement required to provide the needed flow early following an accident initiator, but only one is required for mitigation later following the accident);

(d) sharing of a system between units. Success criteria may be affected when both units are challenged by the same initiating event (e.g., LOOP).

Revision 3 Status Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation F&O TH-03: Success Criteria analyses were not done for the range of possible plant conditions to which they are applied. For example, MLOCA success criteria analyses are done for a 3.5 inch break {file SAAG 96), while the MLOCA is defined as a 2 to 5 inch break. The combinations of systems and operator recoveries that are defined as success at 3.5 inches may not be success at 2 inches or at 5 inches. This issue also applies to large LOCA (8.25 ft2 break analyzed in SAAG 97) vs a break range down to 6 inches, and small LOCA (1 inch break analyzed, SAAG 95) vs. break sizes from 3/8 to 2 inches.

Further, it was not clear that the MLOCA MAAP runs adequately match the accident sequence being modeled in the PRA. Cases in SAAG 96 do not appear to disable accumulators when defining the minimum ECC requirements, but accumulators are not required by the resulting MLOCA success criteria.

Also, MAAP is not an appropriate code to use in performing analyses for rapid blowdown events such as large and some medium LOCAs.

F&O SY-03: System success criteria are specified in the system notebooks in sufficient detail to describe the overall fault tree top events, but no basis is provided in the system notebooks for the number of pumps or flow rate requirements. The Reference section 18.1 does not contain a link to an appropriate success criteria calculation. For example, in the KC notebook, it is stated without a source reference that both pumps and the associated heat exchanger in a train are required for success when the ND (RHR) heat exchanger is required. Similarly, in Section 12 of the RN notebook, it is stated that the top events simply represent "failure to provide sufficient flow" to components requiring cooling without defining a Disposition added to the system notebooks. As a result, this F&O remains open due to incomplete documentation. This F&O remains open with grade 3 of NEI SR I meet CAT II of the ASME SR being not met.

Impact on ILRT Extension Page 80of198

54003-CALC-02 SR SY-A11 SY-A12 2009 ASME/ANS Cat 11 Requirement INCLUDE in the system model those failures of the equipment and components that would affect system operability (as identified in the system success criteria), except when excluded using the criteria in SY-A15.

This equipment includes both active components (e.g., pumps, valves, and air compressors) and passive components (e.g., piping, heat exchangers, and tanks) required for system operation.

DO NOT INCLUDE in a system model component failures that would be beneficial to system operation, unless omission would distort the results.

Example of a beneficial failure: A Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Status Open Finding/Observation flow rate or number of pumps (in Section 13 of the notebook it does state that failure to provide flow requires failure of all four pump trains). The CA notebook has a similar statement without a tie to a specific basis.

None Dispositioned None Disposition The peer review found that the NEJ 00-02 subelements SY-6, SY-7, SY-8, SY-9, SY-12, SY-13, and SY-14 were met at Grade 3.

However, RG 1.200, Rev 2 indicates that the subelements listed provide only partial coverage. As evidenced by the note below from the peer review report, the peer review team considered the modeling of passive failures. Because the requirement for including passive failures is different in subelement SY-7 and SY-A 11, this SR is considered not met.

With respect to passive failure, the peer review report notes that:

(R 11) Passive failures were found in the model for check valves leaks and ruptures, heat exchanger leaks and fouling, orifice plugging, and valves transferring closed. An event for Service Water (RN) failure due to clams was also noted.

Per Duke self-assessment, the system models include multiple failure modes for most components, and all modeled components and associated failure modes are documented in the system notebooks.

Assumptions regarding components or failure modes excluded from the model are documented in the assumptions section of the system write-ups. Passive failures such as tanks and heat exchangers are modeled, although passive piping failures are generally not modeled since they are probabilistically insignificant. (A few exceptions: basic event BWSTPTHDEX, "Pipe Rupture Fails Flow From the BWST;"

SUMPRECDEX, "Pipe Rupture Fails Flow From the RE Emergency Sump;" WSSPJPEDEX, "Random Pipe Break in SSW System.")

According to RG 1.200, Rev. 2, this SR is not fully covered by NEI 00-

02. Partial coverage is provided by subelements SY-6, SY-7, SY-8, SY-9, SY-12, SY-13, SY-14 which were all met at Grade 3. The peer review report does not provide evidence that beneficial failures were excluded. Therefore, this SR was not fully evaluated in the 2003 peer review. The two Catawba PRA Quality Self-Assessments (DPC-1535.00-00-0013 and CNC-1535.00-00-0155) found that this SR is Impact on ILRT Extension Passive equipment typically has high reliability.

Therefore, passive equipment is not expected to contribute significantly to risk. Multiple spurious operations are considered in the PRA. There is no impact on the ILRT extension.

Based on the disposition, the requirements of Cat II are considered met. There is no impact on the ILRT extension.

Page 81 of 198

54003-CALC-02 SR SY-A13 2009 ASMEIANS Cat II Requirement failure of an instrument in such a fashion as to generate a required actuation signal.

INCLUDE those failures that can cause flow diversion pathways that result in failure to meet the system success criteria.

Revision 3 Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations FindinglObservation F&O: SY-04: In the KC System Notebook (SAAG File No. 294), there is no basis provided in Section 11.3 for excluding the failure to isolate the Non-Essential Reactor Building Header from the fault trees. In discussion with the PRA engineer responsible for the notebook update, it was determined that three valves need to fail to close for flow diversion to take place, but there could be a common cause failure of these valves that was not justified to be excluded.

F&O SY-03: System success criteria are specified in the system notebooks in sufficient detail to describe the overall fault tree top events, but no basis is provided in the system notebooks for the number of pumps or flaw rate requirements. The Reference section 18.1 does not contain a link to an appropriate success criteria calculation. For example, in the KC notebook, it is stated without a source reference that both pumps and the associated heat exchanger in a train are required for success when the ND (RHR) heat exchanger is required. Similarly, in Section 12 of the RN notebook, it is stated that the top events simply represent "failure to provide sufficient flow" to components requiring cooling without defining a flow rate or number of pumps (in Section 13 of the notebook it does state that failure to provide flow requires failure of all four pump trains). The CA notebook has a similar statement without a tie to a specific basis.

F&O TH-03: Success Criteria analyses were not done for the range of possible plant conditions to which they are applied. For example, MLOCA success criteria analyses are done for a 3.5 inch Disposition met, and noted that beneficial failures are not included in the system models. By the nature of the system analysis methodology (fault trees), such failures are not easily included, because lower level failures result in failure of higher level functions.

SY-A13 corresponds to NEI 00-02 subelements SY-15 and SY-17.

F&Os SY-04 and TH-03 are also associated with this SR. Although neither subelement SY-15 norSY-17 specifically requires diversion pathways to be considered, F&O SY-04 makes it clear that the peer reviewers evaluated the sufficiency of the modeling of flow diversions.

The F&O has been addressed by justifying excluding the potential diversion flowpath in the system notebook. In order for an open flow path to the non-essential header to starve flow to required components there would have to be failures of multiple components (pumps and valves). The following assumption has been added to the KC system notebook: "The reactor building non-essential headers are not included in the fault tree as potential diversion pathways. In addition to failure of the reactor non-essential headers valves (KC3, -

18, -228, and -230), valves KC338, -424, and -425, which receive an Sp signal to close, would have to fail. Common cause failure of all of the involved valves is considered probabilistically insignificant."

CNC-1535.00-00-0038, Section K.11.3 "Assumptions" provides some qualitative consideration based upon the number of valves that would be required to fail. In addition CNC-1535.00-00-0011, Section 3.1, provides discussion regarding consideration of the loss of KC due to flow diversion pathway.

F&O SY-04 is closed by the clarification in the system notebook. The F&O itself is evidence that the peer review assessed to some extent whether diversion flow paths were adequately modeled. However, because NEI 00-02 does not explicitly require flow diversion pathways to be considered, the SR is considered not met at Category II.

F&O TH As part of establishing success criteria, a series of analyses were performed over a range of applications to ensure that computer codes employed provided realistic results. Success criteria sensitivities included analyses for a range of possible conditions, including the LOCA break sizes and availability of accumulators. In addition, a review of other industry design-basis calculations using Impact on ILRT Extension Flow diversion is considered in the PRA. There is no impact on the ILRT extension.

Peer Review F&O SY-03 is still open. While the success criteria have been updated, it has not been incorporated into the PRA model.

However, there are no significant changes to the success criteria [Reference 45], so the impact on the ILRT extension is expected to be negligible.

Additionally the success criteria for McGuire, (sister plant for Catawba), has been updated and no change in mitigation equipment was identified.

Page 82 of 198

54003-CALC-02 SR SY-A15 2009 ASME/ANS Cat 11 Requirement In meeting SY-A11 and SY-A14, contributors to system unavailability and unreliability (i.e., components and specific failure modes) may be excluded from the model if one of the following screening criteria is met (a) A component may be excluded from the system model if the total failure probability of the component failure modes resulting in the same effect on system operation is at least two orders of magnitude lower than the highest failure probability of the other components in the same system train that results in the same effect on system operation.

(b) One or more failure modes for a component may be excluded from Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Status Finding/Observation break (file SAAG 96), while the MLOCA is defined as a 2 to 5 inch break. The combinations of systems and operator recoveries that are defined as success at 3.5 inches may not be success at 2 inches or at 5 inches. This issue also applies to large LOCA (8.25 ft2 break analyzed in SAAG 97) vs a break range down to 6 inches, and small LOCA (1 inch break analyzed, SAAG 95) vs. break sizes from 3/8 to 2 inches.

Further, it was not clear that the MLOCA MAAP runs adequately match the accident sequence being modeled in the PRA. Cases in SAAG 96 do not appear to disable accumulators when defining the minimum ECC requirements, but accumulators are not required by the resulting MLOCA success criteria.

Also, MAAP*is not an appropriate code to use in performing analyses for rapid blowdown events such as large and some medium LOCAs.

Dispositioned None Disposition alternate methods was employed to consider code limitations. This is considered to resolve the finding and achieve grade 3 of the NEI SR/

meet cat II of the ASME SR.

F&O SY-03 -Although XSAA-115 (PRA Modeling Guidelines) has been revised to require success criteria reference to be provided, references to the appropriate system success criteria have not been added to the system notebooks. As a result, this F&O remains open due to incomplete documentation. This F&O remains open with grade 3 of NEI SR I meet CAT II of the ASME SR being not met.

This SR is not covered in NEI 00-02. Therefore, this SR was not evaluated in the 2002 peer review. The Catawba PRA Quality Self-Assessment (CNC-1535.00-00-0155) found that this SR is met. The earlier self-assessment noted that some failure modes are excluded in a qualitative fashion rather than by using quantitative criteria. It was noted that it was an issue of not documenting the quantitative evaluations for screening.

Impact on ILRT Extension Based on the disposition, the requirements of Cat II are considered met. There is no impact on the ILRT extension.

Page 83of198

54003-CALC-02 SR SY-A18 2009 ASME/ANS Cat II Requirement the systems model if the contribution of them to the total failure rate or probability is less than 1 % of the total failure rate or probability for that component, when their effects on system operation are the same INCLUDE in either the system model or accident sequence modeling those conditions that cause the system to isolate or trip, or those conditions that once exceeded cause the system to fail, or SHOW that their exclusion does not impact the results. For example, conditions that isolate or trip a system include:

(a) system-related parameters such as a high temperature within the system (b) external parameters used to protect the system from other failures [e.g., the high reactor pressure vessel (RPV) water level isolation signal used to prevent water intrusion into the turbines of the RCIC and HPCI pumps of a BWR]

(c) adverse environmental conditions (see SY-A22)

Revision 3 Status Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation F&O SY-06: For Catawba, there was no evaluation of the ability of non-qualified (non-EQ) equipment to survive in a degraded environment following an accident such as a steam line of feedwater line break outside of containment.

F&O TH-03: Success Criteria analyses were not done for the range of possible plant conditions to which they are applied. For example, MLOCA success criteria analyses are done for a 3.5 inch break (file SAAG 96), while the MLOCA is defined as a 2 to 5 inch break. The combinations of systems and operator recoveries that are defined as success at 3.5 inches may not be success at 2 inches or at 5 inches. This issue also applies to large LOCA (8.25 ft2 break analyzed in SAAG 97) vs a break range down to 6 inches, and small LOCA (1 inch break analyzed, SAAG 95) vs. break sizes from 3/8 to 2 inches.

Further, it was not clear that the MLOCA MAAP runs adequately match the accident sequence being modeled in the PRA. Cases in SAAG 96 do not appear to disable accumulators when defining the minimum ECC requirements, but accumulators are not required by the resulting MLOCA success criteria.

Also, MAAP is not an appropriate code to use in performing analyses for rapid blowdown events such as large and some medium LOCAs.

F&O SY-03: System success criteria are specified in the system notebooks in sufficient detail to describe the overall fault tree top events, but no Disposition SY-A18 corresponds to NEI 00-02AS-13, SY-10, SY-11, SY-13, and SY-17. The peer review gave Grade 2 to SY-10 and SY-11, which have to do with the proper consideration of spatial dependencies and adverse environmental conditions (notes R 19 and R20 below are given by the peer review team in support of Grade 2.) SY-17, which treats the bases for success criteria, received a contingent Grade 3 due to level "B" F&Os TH-03 and SY-03. This SR is considered not met at Category II because the corresponding NEI 00-02 subelements are not given Grade 3 or better.

R19. Evidence of plant walkdowns being performed was found in the design-basis calculation performed for the flooding analysis. The only spatial information in the system notebooks is a basic description of equipment locations. No discussion of room cooling dependence for systems was found in the system notebooks and heatup calculations were not retrievable (see F&O TH-06).

R20. The PRA staff confirmed that there was no search performed for non-qualified equipment that was credited in the PRA to perform in degraded environments. See F&O SY-06.

F&O SY-06 is resolved because high-energy line breaks (e.g., steam line breaks and feed line breaks) are addressed in the Internal Flood PRA (Reference 38).

F&O TH As part of establishing success criteria, a series of analyses were performed over a range of applications to ensure that computer codes employed provided realistic results. Success criteria sensitivities included analyses for a range of possible conditions, including the LOCA break sizes and availability of accumulators. In addition, a review of other industry design-basis calculations using alternate methods was employed to consider code limitations. This is Impact on ILRT Extension Room heat-up analyses were performed for the switchgear rooms, battery rooms, and the control room

[References 40, 41, and 42].

The results of these analyses show that equipment in these rooms will not be adversely impacted by the loss of HVAC over the 24-hour mission time. There is no impact to the ILRT extension.

High-energy line breaks (e.g., steam line breaks and feed line breaks) are addressed in the Internal Flood PRA (Reference 38).

This is considered resolved.

There is no impact on the ILRT extension.

Page 84of198

54003-CALC-02 SR SY-A20 2009 ASME/ANS Cat 11 Requirement INCLUDE events representing the simultaneous unavailability of redundant equipment when this is a result of planned activity (see DA-C14).

Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Status Finding/Observation basis is provided in the system notebooks for the number of pumps or flow rate requirements. The Reference section 18.1 does not contain a link to an appropriate success criteria calculation. For example, in the KC notebook, it is stated without a source reference that both pumps and the associated heat exchanger in a train are required for success when the ND (RHR) heat exchanger is required. Similarly, in Section 12 of the RN notebook, it is stated that the top events simply represent "failure to provide sufficient flow" to components requiring cooling without defining a flow rate or number of pumps (in Section 13 of the notebook it does state that failure to provide flow requires failure of all four pump trains). The CA notebook has a similar statement without a tie to a specific basis.

F&O TH-06: There is no room heatup analysis notebook I evaluation of loss of HVAC to equipment rooms for the Catawba PRA, and apparently no retrievable room heatup calculations or documentation to support the assumption that room cooling need not be modeled in the PRA. Other PRAs have found that room cooling is required for some rooms such as electrical equipment rooms and small rooms housing critical pumps.

(Duke is already aware of this issue.)

Dispositioned None Disposition considered to resolve the finding and achieve grade 3 of the NEI SR/

meet cat II of the ASME SR.

F&O SY-03 -Although XSAA-115 (PRA Modeling Guidelines) has been revised to require success criteria reference to be provided, references to the appropriate system success criteria have not been added to the system notebooks. As a result, this F&O remains open due to incomplete documentation. This F&O remains open with grade 3 of NEI SR I meet CAT II of the ASME SR being not met.

F&O TH CNP PRA Tracker ID C-03-0052 for TH OPEN The loss of HVAC was screened as an initiating event in the CNP model based on judgment that sufficient time would allow for diagnosis of the loss of HVAC and recovery of standby equipment and/or alternate means of cooling. Any additional risk added by including the VCIYC systems in the PRA model would be small and would not have a significant impact on results for the ILRT extension application.

This SR is not covered in NEI 00-02. Therefore, this SR was not evaluated in the 2003 peer review. The Catawba PRA Quality Self-Assessments (DPC-1535.00-00-0013 and CNC-1535.00-00-0155) found that this SR is met noting that maintenance events are generally treated as independent within the PRA model, however, after the model is solved, cut sets involving coincident maintenance are deleted where such combinations are prohibited by the technical specifications, as documented in the model integration notebook. Cut sets involving coincident maintenance combinations prohibited by the on line risk assessment tool are retained, but have their probability reduced.

Impact on ILRT Extension Based on the disposition, the requirements of Cat II of the ASME/ANS Standard are considered to be met. There is no impact on the ILRT extension.

Page 85 of 198

54003-CALC-02 SR SY-A21 2009 ASME/ANS Cat II Requirement IDENTIFY system conditions that cause a loss of desired system function, (e.g., excessive heat loads, excessive electrical loads, excessive humidity, etc.).

Revision 3 Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation F&O TH-03: Success Criteria analyses were not done for the range of possible plant conditions to which they are applied. For example, MLOCA success criteria analyses are done for a 3.5 inch break (file SAAG 96), while the MLOCA is defined as a 2 to 5 inch break. The combinations of systems and operator recoveries that are defined as success at 3.5 inches may not be success at 2 inches or at 5 inches. This issue also applies to large LOCA (8.25 ft2 break analyzed in SAAG 97) vs a break range down to 6 inches, and small LOCA (1 inch break analyzed, SAAG 95) vs. break sizes from 3/B to 2 inches.

Further, it was not clear that the MLOCA MAAP runs adequately match the accident sequence being modeled in the PRA. Cases in SAAG 96 do not appear to disable accumulators when defining the minimum ECC requirements, but accumulators are not required by the resulting MLOCA success criteria.

Also, MAAP is not an appropriate code to use in performing analyses for rapid blowdown events such as large and some medium LOCAs.

F&O TH-06: There is no room heatup analysis notebook I evaluation of loss of HVAC to equipment rooms for the Catawba PRA, and apparently no retrievable room heatup calculations or documentation to support the assumption that room cooling need not be modeled in the PRA. Other PRAs have found that room cooling is required for some rooms such as electrical equipment rooms and small rooms housing critical pumps.

(Duke is already aware of this issue.)

F&O SY-03: System success criteria are specified in the system notebooks in sufficient detail to describe the overall fault tree top events, but no basis is provided in the system notebooks for the number of pumps or flow rate requirements. The Disposition RG 1.200 Rev. 2 maps several NEI 00-02 subelements to this SR:

AS-18, DE-10, SY-11, SY-13, SY-17, and TH-8. The 2002 peer review report associates the following level "B" F&Os to one or more of these subelements: TH-03, TH-06, SY-03, and SY-06. F&O DE-06 is also associated with DE-10 but has been superseded by the more recent focus-scope peer review for the Flooding PRA model. Based on the 2002 peer review report's assignment of Grade 2 to subelement SY-11, and contingent Grade 3 to subelements SY-17, AS-18, and DE-10 the SR is considered not met at SR Category II.

F&O TH-03 -As part of establishing success criteria, a series of analyses were performed over a range of applications to ensure that computer codes employed provided realistic results. Success criteria sensitivities included analyses for a range of possible conditions, including the LOCA break sizes and availability of accumulators. In addition, a review of other industry design-basis calculations using alternate methods was employed to consider code limitations. This is considered to resolve the finding and achieve grade 3 of the NEI SR/

meet cat II of the ASME SR.

F&O TH CNP PRA Tracker ID C-03-0052 for TH OPEN The loss of HVAC was screened as an initiating event in the CNP model based on judgment that sufficient time would allow for diagnosis of the loss of HVAC and recovery of standby equipment and/or alternate means of cooling. Any additional risk added by including the VC/YC systems in the PRA model would be small and would not have a significant impact on results for the ILRT extension application.

F&O SY-03 -Although XSAA-115 (PRA Modeling Guidelines) has been revised to require success criteria reference to be provided, references to the appropriate system success criteria have not been added to the system notebooks. As a result, this F&O remains open due to incomplete documentation. This F&O remains open with grade 3 of NEI SR I meet CAT II of the ASME SR being not met.

F&O SY-06 is resolved because high-energy line breaks (e.g., steam line breaks and feed line breaks) are addressed in the Internal Flood PRA (Reference 38).

Impact on ILRT Extension High-energy line breaks (e.g., steam line breaks and feed line breaks) are addressed in the Internal Flood PRA (Reference 38).

This is considered resolved.

There is no impact on the ILRT extension.

Room heat-up analyses were performed for the switchgear rooms, battery rooms, and the control room

[References 40, 41, and 42].

The results of these analyses show that equipment in these rooms will not be adversely impacted by the loss of HVAC over the 24-hour mission time. There is no impact to the ILRT extension.

Peer Review F&O SY-03 is still open. While the success criteria have been updated, it has not been incorporated into the PRA model.

However, there are no significant changes to the success criteria [Reference 45], so the impact on the ILRT extension is expected to be negligible.

Additionally the success criteria for McGuire, (sister plant for Catawba), has been updated and no change in Page 86 of 198

54003-CALC-02 SR SY-A22 2009 ASME/ANS Cat 11 Requirement TAKE CREDIT for system or component operability only if an analysis exists to demonstrate that rated or design capabilities are not exceeded.

Revision 3 Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation Reference section 18.1 does not contain a link to an appropriate success criteria calculation. For example, in the KC notebook, it is stated without a source reference that both pumps and the associated heat exchanger in a train are required for success when the ND (RHR) heat exchanger is required. Similarly, in Section 12 of the RN notebook, it is stated that the top events simply represent "failure to provide sufficient flow" to components requiring cooling without defining a flow rate or number of pumps (in Section 13 of the notebook it does state that failure to provide flow requires failure of all four pump trains). The CA notebook has a similar statement without a tie to a specific basis.

F&O SY-06: For Catawba, there was no evaluation of the ability of non-qualified (non-EQ) equipment to survive in a degraded environment following an accident such as a steam line of feedwater line break outside of containment.

F&O: SY-04: In the KC System Notebook (SAAG File No. 294), there is no basis provided in Section 11.3 for excluding the failure to isolate the Non-Essential Reactor Building Header from the fault trees. In discussion with the PRA engineer responsible for the notebook update, it was determined that three valves need to fail to close for flow diversion to take place, but there could be a common cause failure of these valves that was not justified to be excluded.

F&O SY-06: For Catawba, there was no evaluation of the ability of non-qualified (non-EQ) equipment to survive in a degraded environment following an accident such as a steam line of feedwater line break outside of containment.

F&O TH-06: There is no room heatup analysis notebook I evaluation of Joss of HVAC to equipment Disposition RG 1.200 Rev. 2 maps several NEI 00-02 subelements to this SR:

AS-19, SY-5, SY-11, SY-13, SY-22, and TH-8. The 2002 peer review report assigns Grade 2 to subelement SY-11 and contingent Grade 3 to subelement SY-22. In addition NEI 00-02 only provides partial coverage of this SR. Therefore, the SR is considered not met at SR Category II.

The 2002 peer review report associates the following level "B" F&Os to one or more of these subelements: TH-06, SY-04, and SY-06.

F&O SY-04 has been addressed by justifying excluding the potential diversion flowpath in the system notebook. The following assumption has been added to the KC system notebook: "The reactor building non-essential headers are not included in the fault tree as potential diversion pathways. In addition to failure of the reactor non-essential headers valves (KC3, -18, -228, and-230), valves KC338, -424, and -

425, which receive an Sp signal to close, would have to fail. Common Impact on ILRT Extension mitigation equipment was identified.

Room heat-up analyses were performed for the switchgear rooms, battery rooms, and the control room

[References 40, 41, and 42].

The results of these analyses show that equipment in these rooms will not be adversely impacted by the loss of HVAC over the 24-hour mission time. There is no impact to the ILRT extension.

High-energy line breaks (e.g., steam line breaks and feed line breaks) are addressed in the Internal Page 87of198

54003-CALC-02 SR SY-85 2009 ASME/ANS Cat II Requirement ACCOUNT explicitly for the modeled system's dependency on support systems or interfacing systems in the modeling process.

This may be accomplished in one of the following ways:

(a) for the fault tree linking approach by modeling the dependencies as a link to an appropriate event or gale in the support system fault tree; (b) for the linked event tree approach, by using event tree logic rules, or calculating a probability for each split fraction conditional on the scenario definition.

Revision 3 Status Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation rooms for the Catawba PRA, and apparently no retrievable room heatup calculations or documentation to support the assumption that room cooling need not be modeled in the PRA. Other PRAs have found that room cooling is required for some rooms such as electrical equipment rooms and small rooms housing critical pumps.

(Duke is already aware of this issue.)

F&O DE-04: HVAC cooling of the essential switchgear rooms is stated as being required. The IPE quantitative analysis does not provide adequate success criteria. For example, the following are not specified: temperature limits of equipment, minimum number of Air Handling Units, or minimum number of chillers. The evaluation also states there is no concern within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months provided that only those loads needed to provide core cooling are operated.

There is no discussion of electrical load shedding for those loads not required, and of the human interface to execute load shedding. The human interface can be complex, involving both a discovery process (control room annunciators, or in the case of a local AHU failure, discovery through operator walkaround), and procedures and training to direct operation actions.

F&O QU-02: The IE's for certain support system failures (RN, KC) are not input in the top event logic Disposition cause failure of all of the involved valves is considered probabilistically insignificant."

F&O TH CNP PRA Tracker ID C-03-0052 for TH OPEN The loss of HVAC was screened as an initiating event in the CNP model based on judgment that sufficient time would allow for diagnosis of the loss of HVAC and recovery of standby equipment and/or alternate means of cooling. Any additional risk added by including the VC/YC systems in the PRA model would be small and would not have a significant impact on results for the ILRT extension application.

F&O SY-06 is not resolved because an evaluation of potential adverse effects on equipment operation due to degraded environmental conditions resulting from accidents in the PRA model has not been performed for events like steam line breaks and feed line breaks (Ref: PRA Tracker C-03-0055). The FPRA considers the impact of fire on the environment in the HGL analysis. High energy line breaks are not relevant to the FPRA.

This SR is covered by NEI 00-02 subelements DE-4, DE-5, DE-6, and SY-12. The 2002 peer review report assigns Grade 3 to subelements DE-6 and SY-12 and contingent Grade 3 to subelements DE-4 and DE-5. Level "B" F&Os associated with subelements DE-4 and DE-5 are DE-04, QU-02, and AS-07.

F&O DE-04 is not resolved because the loss of switchgear HVAC initiating event is not included in the PRA. A recent evaluation was performed (PIP C-13-05664) to determine the impact on the Fire PRA of not including switchgear room and battery HVAC modeling. The evaluation concluded that any additional risk added by including the VC/YC systems in the PRA model would be small and would not have a significant impact on the Fire PRA results or results for the NFPA-805 application.

F&O QU-02: System level initiators represented as fully developed sub-tree structures are not in the Rev 3 model. Duke Energy feels that it is acceptable to not develop system level initiators as long as a review for dependencies takes place in the cut set file. This process Impact on ILRT Extension Flood PRA (Reference 38).

This is considered resolved.

There is no impact on the ILRT extension.

Room heat-up analyses were performed for the switchgear rooms, battery rooms, and the control room

[References 40, 41, and 42].

The results of these analyses show that equipment in these rooms will not be adversely impacted by the loss of HVAC over the 24-hour mission time. There is no impact to the ILRT extension.

System level initiators modeled directly as fault trees will have little effect on the ILRT extension.

Page 88of198

54003-CALC-02 SR SY-87 2009 ASME/ANS Cat II Requirement BASE support system modeling on realistic success criteria and timing, unless a conservative approach can be justified (i.e., if their use does not impact risk significant contributors.)

Revision 3 Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation as a boolean equation, but rather as a point estimate whose value is derived by solution of the IE fault tree.

However, failures that cause the IE may also affect the mitigating system, such that there is a dependency between the initiating event and the available mitigation. Examples are an electrical bus that failed one train of KC and could fail one train of mitigating equipment. Another example is the operator error in the loss of KC to start the standby train of KC (KKCSTNBDHE). The HRA notebook states this event has dependencies with HYDBACKDHE.

F&O AS-07: The success criteria for AFW for SGTR is 1 CA pump to 2 steam generators. The ruptured SG is assumed to be one of the two steam generators that supply steam to the turbine-driven AFW pump. In the Catawba Rev. 2b fault tree model, however, the dependency of the TDP on the SGTR initialer is not modeled. Thus. the TDP supply is not degraded by the initiating event in the model logic, so the model is incorrect.

(This item is already on the list of corrective actions for the Catawba PRA, and Duke has indicated that it will be implemented in the Rev. 3 PRA.)

F&O: SY-03: System success criteria are specified in the system notebooks in sufficient detail to describe the overall fault tree top events, but no basis is provided in the system notebooks for the number of pumps or flow rate requirements. The Reference section 18.1 does not contain a link to an appropriate success criteria calculation. For example, in the KC notebook, it is stated without a source reference that both pumps and the associated heat exchanger in a train are required for success when the ND (RHR) heat exchanger is required. Similarly, in Section 12 of the RN notebook, it is stated that the top events simply represent "failure to provide sufficient flow" to Disposition has been proceduralized and is contained in Section 4 of Workplace Guideline XSAA-103, Guidelines For Determining Risk Significance.

F&O AS-07 is only applicable to SGTR events. The CA notebook was updated to reflect the correct success criteria due to SGTR loss of AFW pump, so AS-07 is considered resolved. As scheduled, the dependency of the TDAFW pump on the SGTR initiator was incorporated in the Rev. 3 PRA. Since this ILRT extension analysis uses Rev. 3b, this issue is resolved [Reference 17].

This SR is covered by NEI 00-02 subelements AS-18, SY-13, SY-17, TH-7, and TH-8. The 2002 peer review gave contingent Grade 3 to subelements SY-17 and TH-7. Therefore, this SR is not met at Category II. Associated level "B" F&Os are: TH-01, TH-03, TH-06 and SY-03.

F&O SY-03 -Although XSAA-115 (PRA Modeling Guidelines) has been revised to require success criteria reference to be provided, references to the appropriate system success criteria have not been added to the system notebooks. As a result, this F&O remains open due to incomplete documentation. This F&O remains open with grade 3 of NEI SR I meet CAT II of the ASME SR being not met.

Impact on ILRT Extension Peer Review F&O SY-03 is still open. While the success criteria have been updated, it has not been incorporated into the PRA model.

However, there are no significant changes to the success criteria, so the impact on the ILRT extension is negligible.

Additionally, the success criteria for McGuire, (sister plant for Catawba), has been updated and no change in Page 89of198

54003-CALC-02 SR Revision 3 2009 ASME/ANS Cat II Requirement Status Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation components requiring cooling without defining a flow rate or number of pumps (in Section 13 of the notebook it does state that failure to provide flow requires failure of all four pump trains). The CA notebook has a similar statement without a tie to a specific basis.

F&O TH-01: Success Criteria (Level 1 and Level 2) for some systems and sequences are supported by MAAP runs with MAAP 3b, Version 16. This version of MAAP has been found to have limitations which can impact conclusions and results. In particular for the Catawba PRA, the simple pressurizer model likely impacts the analyses that involve RCS cooldown and depressurization using SG heat removal by permitting RCS depressurization to match RCS cooldown for transients, without the possible need for pressurizer PO RVs, spray or aux spray.

F&O TH-03: Success Criteria analyses were not done for the range of possible plant conditions to which they are applied. For example, MLOCA success criteria analyses are done for a 3.5 inch break (file SAAG 96), while the MLOCA is defined as a 2 to 5 inch break. The combinations of systems and operator recoveries that are defined as success at 3.5 inches may not be success at 2 inches or at 5 inches. This issue also applies to large LOCA (8.25 ft2 break analyzed in SAAG 97) vs a break range down to 6 inches, and small LOCA (1 inch break analyzed, SAAG 95) vs. break sizes from 3/8 to 2 inches.

Further, ii was not clear that the MLOCA MAAP runs adequately match the accident sequence being modeled in the PRA. Cases in SAAG 96 do not appear to disable accumulators when defining the minimum ECC requirements, but accumulators are not required by the resulting MLOCA success criteria.

Disposition TH An updated success criteria calculation was completed using MAAP 4.0.7 (Section 2.2) and is documented into the updated CNS Success Criteria Notebook. This F&O is dispositioned based on the resolution of the finding and achieve grade 3 of the NEI SR.

However, the CNS Assessment of Peer Review Open Items (May 2013) identifies this F&O as remaining open because the current model of record does not reflect the updated information and as a result the ASME SR is considered Not Met.

F&O TH As part of establishing success criteria, a series of analyses were performed over a range of applications to ensure that computer codes employed provided realistic results. Success criteria sensitivities included analyses for a range of possible conditions, including the LOCA break sizes and availability of accumulators. In addition, a review of other industry design-basis calculations using alternate methods was employed to consider code limitations. This is considered to resolve the finding and achieve grade 3 of the NEI SR/

meet cat II of the ASME SR.

F&O TH CNP PRA Tracker ID C-03-0052 for TH OPEN F &O TH-06 is not resolved because the loss of switchgear HVAC initiating event is not included in the PRA, and room heatup calculations for loss of ventilation are not performed for that and other locations. Room heatup calculations should be performed in all locations in which HVAC can be lost to justify not modeling those systems and/or determine timing of operator coping actions and equipment damage. If no room heatup calculation is performed, it should be assumed that the HVAC system is required in those locations. The appropriate dependencies should be included in the PRA model, including possible initiating events. Any additional risk added by including the VC/YC systems in the PRA model would be small and would not have a significant impact on results for the ILRT extension application.

Impact on ILRT Extension mitigation equipment was identified.

Room heat-up analyses were performed for the switchgear rooms, battery rooms, and the control room

[References 40, 41, and 42].

The results of these analyses show that equipment in these rooms will not be adversely impacted by the loss of HVAC over the 24-hour mission time. There is no impact to the ILRT extension.

Page 90of198

54003-CALC-02 SR SY-88 SY-810 2009 ASME/ANS Cat II Requirement IDENTIFY spatial and environmental hazards that may impact multiple systems or redundant components in the same system, and ACCOUNT for them in the system fault tree or the accident sequence evaluation.

Example: Use results of plant walkdowns as a source of information regarding spatial/environmental hazards, for resolution of spatial/environmental issues, or evaluation of the impacts of such hazards.

MODEL those systems that are required for initiation and actuation of a system. In the model quantification, INCLUDE the presence of the conditions needed for automatic actuation (e.g., low vessel water level). INCLUDE Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Status Finding/Observation Also, MAAP is not an appropriate code to use in performing analyses for rapid blowdown events such as large and some medium LOCAs.

F&O TH-06: There is no room heatup analysis notebook I evaluation of loss of HVAC to equipment rooms for the Catawba PRA, and apparently no retrievable room heatup calculations or documentation to support the assumption that room cooling need not be modeled in the PRA. Other PRAs have found that room cooling is required for some rooms such as electrical equipment rooms and small rooms housing critical pumps.

(Duke is already aware of this issue.)

Open F&O TH-06: There is no room heatup analysis notebook I evaluation of Joss of HVAC to equipment rooms for the Catawba PRA, and apparently no retrievable room heatup calculations or documentation to support the assumption that room cooling need not be modeled in the PRA. Other PRAs have found that room cooling is required for some rooms such as electrical equipment rooms and small rooms housing critical pumps.

(Duke is already aware of this issue.)

Dispositioned None Disposition This SR is covered by NEI 00-02 subelements DE-11 and SY-1 o.

This SR covers the same requirement as NEI 00-02 subelement SY-10, but is more specific. The 2002 peer review gave Grade 2 to SY-1 o. Therefore, this SR is not met at Category II.

F&O TH CNP PRA Tracker ID C-03-0052 for TH OPEN F&O TH-06 is not resolved because the loss of switchgear HVAC initiating event is not included in the PRA, and room heatup calculations for loss of ventilation are not performed for that and other locations. Room heatup calculations should be performed in all locations in which HVAC can be lost to justify not modeling those systems and/or determine timing of operator coping actions and equipment damage. If no room heatup calculation is performed, it should be assumed that the HVAC system is required in those locations. The appropriate dependencies should be included in the PRA model, including possible initiating events. Any additional risk added by including the VC/YC systems in the PRA model would be small and would not have a significant impact on results for the ILRT extension application.

This SR is covered by NEI 00-02 subelements SY-8, SY-12 and SY-

13. Even though the 2002 peer review gave unconditional Grade 3 to all of these NEI 00-02 subelements, NEI 00-02 does not explicitly address permissives and control logic. The reviewers' notes in the peer review report do not show that they assessed the model with respect to permissives and control logic. Therefore, the peer review cannot be used to fully assess compliance with this requirement. The Impact on ILRT Extension Room heat-up analyses were performed for the switchgear rooms, battery rooms, and the control room

[References 40, 41, and 42].

The results of these analyses show that equipment in these rooms will not be adversely impacted by the loss of HVAC over the 24-hour mission time. There is no impact to the ILRT extension.

Based on the disposition, the requirements of Cat II of the ASME/ANS Standard are considered to be met. There is no impact on the ILRT extension.

Page 91 of 198

54003-CALC-02 SR SY-B12 SY-B13 SY-B14 2009 ASME/ANS Cat II Requirement permissive and lockout signals that are required to complete actuation logic.

DO NOT USE proceduralized recovery actions as the sole basis for eliminating a support system from the model; however, INCLUDE these recovery actions in the model quantification. For example, it is not acceptable to not model a system such as HVAC or CCW on the basis that there are procedures for dealing with losses of these systems.

Some systems use components and equipment that are required for operation 6f other systems.

INCLUDE components that, using the criteria in SY-A15, may be screened from each system model individually, if their failure affects more than one system (e.g., a common suction pipe feeding two separate systems).

IDENTIFY SSCs that may be required to operate in conditions, beyond their environmental qualifications. INCLUDE dependent failures of multiple SSCs that result from operation in these adverse conditions. Examples of degraded environments include (a) LOCA inside containment with failure of containment heat removal (b) safety relief valve operability Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Status Finding/Observation Dispositioned None Dispositioned None Open.

F&O: SY-06: For Catawba, there was no evaluation of the ability of non-qualified (non-EQ) equipment to survive in a degraded environment following an accident such as a steam line of feedwater line break outside of containment.

Disposition Catawba PRA Quality Self-Assessments (DPC-1535.00-00-0013 and CNC-1535.00-00-0155) determined that this SR is met, noting that systems required for initiation and actuation of other systems (e.g.,

ESFAS) are explicitly modeled, and the presence of conditions needed for automatic actuation and permissive and lockout signals required to complete actuation logic are included.

This SR is not covered in NEI 00-02. The Catawba PRA Quality Self-Assessments (DPC-1535.00-00-0013 and CNC-1535.00-00-0155) found that this SR is met, noting that no systems are excluded based on proceduralized recovery actions. In addition, proceduralized recovery actions are modeled for some support systems (e.g.,

manually actuate systems after ESFAS failure).

NEI 00-02 does not fully address this SR; subelements DE-6 and AS-6 partially address it. Therefore, compliance with this SR was not completely evaluated in the 2002 peer review. However, the peer review gave unconditional Grade 3 to both of these NEI 00-02 subelements, The Catawba PRA Quality Self-Assessments (DPC-1535.00-00-0013 and CNC-1535.00-00-0155) found that this SR is met, noting that the system notebooks include assumptions regarding components or failure modes excluded from the model. Piping and other passive failures are not modeled if they are probabilistically insignificant. However, some pipe breaks and passive failure of tanks and heat exchangers are modeled.

This SR is covered by NEI 00-02 subelement SY-11. Subelement SY-11 received a Grade 3 contingent on resolution of F&O SY-06.

F&O SY-06 is not resolved because an evaluation of potential adverse effects on equipment operation due to degraded environmental conditions resulting from accidents in the PRA model has not been performed for events like steam line breaks and feed line breaks (Ref: PRA Tracker C-03-0055). The FPRA considers the impact of fire on the environment in the HGL analysis. High energy line breaks are not relevant to the FPRA.

Impact on ILRT Extension Based on the disposition, the requirements of Cat II of the ASME/ANS Standard are considered to be met. There is no impact on the ILRT extension.

Based on the disposition, the requirements of Cat II of the ASME/ANS Standard are considered to be met. There is no impact on the ILRT extension.

The FPRA considers the impact of fire on the environment in the HGL analysis. High-energy line breaks (e.g., steam line breaks and feed line breaks) are addressed in the Internal Flood PRA (Reference 38).

The Joss of containment boundary (i.e., a crack in the containment liner that could Page 92 of 198

54003-CALC-02 SR SY-C1 2009 ASME/ANS Cat II Requirement (small LOCA, drywell spray, severe accident) (for BWRs)

(c) steam line breaks outside containment (d) debris that could plug screens/filters (both internal and external to the plant)

(e) heating of the water supply (e.g.,

BWR suppression pool, PWR containment sump) that could affect pump operability (f) loss of NPSH for pumps (g) steam binding of pumps (h) harsh environments induced by containment venting, failure of the containment venting ducts, or failure of the containment boundary that may occur prior to the onset of core damage DOCUMENT the systems analysis in a manner that facilitates PRA applications, upgrades, and peer review.

Revision 3 Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation F&O SY-03: System success criteria are specified in the system notebooks in sufficient detail to describe the overall fault tree top events, but no basis is provided in the system notebooks for the number of pumps or flow rate requirements. The Reference section 18.1 does not contain a link to an appropriate success criteria calculation. For example, in the KC notebook, it is stated without a source reference that both pumps and the associated heat exchanger in a train are required for success when the ND (RHR) heat exchanger is required. Similarly, in Section 12 of the RN notebook, it is stated that the top events simply represent "failure to provide sufficient flow" to components requiring cooling without defining a flow rate or number of pumps On Section 13 of the notebook it does state that failure to provide flow requires failure of all four pump trains). The CA notebook has a similar statement without a tie to a specific basis.

Disposition The SR is not met at Category II because the peer review gave Grade 2 to subelement SY-11.

SY-C1 corresponds to NEl-00-02 subelements SY-5, SY-6, SY-9, SY-18, SY-23, SY-25, SY-26, SY-27. The 2002 peer review report gives Grade 3 to these subelements except SY-27 which is contingent on resolution of F&O SY-03. Based on the 2002 peer review report's contingent Grade 3 for subelement SY-27, the SR is considered not met at SR Category II.

F&O SY-03 -Although XSAA-115 (PRA Modeling Guidelines) has been revised to require success criteria reference to be provided, references to the appropriate system success criteria have not been added to the system notebooks. As a result, this F&O remains open due to incomplete documentation. This F&O remains open with grade 3 of NEI SR I meet CAT II of the ASME SR being not met.

Impact on ILRT Extension be detected by an ILRT),

which may communicate a harsh environment from inside containment to the containment annulus, does not affect the conclusion that the ILRT extension is not impacted. There is no equipment in the containment annulus that is not qualified for a harsh environment that is credited to mitigate an accident that would create a harsh environment in the CNS PRA model [References 67 and 68]. This is considered resolved. There is no impact on the ILRT extension.

No impact from documentation changes.

Page 93 of 198

54003-CALC-02 SR SY-C2 2009 ASME/ANS Cat II Requirement DOCUMENT the system functions and boundary, the associated success criteria, the modeled components and failure modes including human actions, and a description of modeled dependencies including support system and common cause failures, including the inputs, methods, and results. For example, this documentation typically includes:

(a) system function and operation under normal and emergency operations (b) system model boundary (c) system schematic illustrating all equipment and components necessary for system operation (d) information and calculations to support equipment operability considerations and assumptions (e) actual operational history indicating any past problems in the system operation (f) system success criteria and relationship to accident sequence models (g) human actions necessary for operation of system (h) reference to system-related test and maintenance procedures (i) system dependencies and shared component interface

0) component spatial information (k) assumptions or simplifications made in development of the system models (I) the components and failure modes included in the model and

ustification for an exclusion of Revision 3 Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation F&O SY-03: System success criteria are specified in the system notebooks in sufficient detail to describe the overall fault tree top events, but no basis is provided in the system notebooks for the number of pumps or flow rate requirements. The

-Reference section 18.1 does not contain a link to an appropriate success criteria calculation. For example, in the KC notebook, it is stated without a source reference that both pumps and the associated heat exchanger in a train are required for success when the ND (RHR) heat exchanger is required. Similarly, in Section 12 of the RN notebook, it is stated that the top events simply represent "failure to provide sufficient flow" to components requiring cooling without defining a flow rate or number of pumps (in Section 13 of the notebook it does state that failure to provide flow requires failure of all four pump trains). The CA notebook has a similar statement without a tie to a specific basis.

F&O DE-01: No specific guidance is given regarding modeling of system dependencies in the system notebooks; however, a highly knowledgeable analyst could reproduce the given results. A dependency matrix is provided but contains little detailed explanation of how dependencies were determined. The Internal Flood Analysis does not seem to provide the detail required to reproduce the results except by a highly knowledgeable analyst.

Disposition The peer review found that the NEl-00-02 subelements corresponding to SR SY-C2 (SY-5, SY-6, SY-9, SY-18, SY-23, SY-25, SY-26, and SY-27), according to RG 1.200, Rev. 2, were met at Grade 3 (with a contingent grade for SY-27 corresponding to F&O SY-03). In addition, RG 1.200 Rev. 2 indicates that the corresponding NEl-00-02 subelements only partially cover the current requirements in the SR.

Therefore, the SR is considered not met.

F&O SY-03-Although XSAA-115 (PRA Modeling Guidelines) has been revised to require success criteria reference to be provided, references to the appropriate system success criteria have not been added to the system notebooks. As a result, this F&O remains open due to incomplete documentation. This F&O remains open with grade 3 of NEI SR I meet CAT II of the ASME SR being not met.

F&O DE-01: PRA Modeling Guidelines XSAA-115 was revised to provide guidance regarding modeling of system dependencies.

Impact on ILRT Extension No impact from documentation changes.

Page 94of198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement components and failure modes (m) a description of the modularization process (if used)

(n) records of resolution of logic loops developed during fault tree linking (if used)

(o) results of the system model evaluations (p) results of sensitivity studies (if used)

(q) the sources of the above information (e.g., completed checklist from walkdowns, notes from discussions with plant personnel)

(r) basic events in the system fault trees so that they are traceable to modules and to cutsets.

(s) the nomenclature used in the system models.

HR-B1 If screening is performed, ESTABLISH rules for screening individual activities from further consideration.

Example: Screen maintenance and test activities from further consideration only if (a) equipment is automatically re-aligned on system demand, or (b) following maintenance activities, a post-maintenance functional test is performed that reveals misalignment, or (c) equipment position is indicated in the control room, status is routinely checked, and realignment Revision 3 Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation F&O HR-02: A screening value of 3E-3 was initially used for all pre-initiator HEPs. There were 7 HEPs quantified in more detail, because the HEP importance was too high. However, there were 7 Latent Human Error events with a 3E-3 probability in the top 100 importance events in the CR2b quantification.

This observation does not necessarily have a large impact on the PRA results. However, per the HR subtier criteria, screening H EPs should not be used for actions appearing in important contributors.

Disposition The NEI SRs applicable to this ASME SR are HR-5 and HR-6, and there are no industry self-assessment actions and no NRG objections.

The original Peer Review rated HR-5 as "3" but HR-6 as "2" with associated level "B" F&Os HR-02 and TH-05. TH-05 does not seem relevant to this SR because pre-initiator HEPs are not based on thermal-hydraulics timing.

Both Self-assessments identified this element as N/A on the basis that "Screening is not performed."

Section 2.1 of the revised HRA Cale CNC-1535.00-00-0030 states that "The screening values permitted those pre-initiator actions that could be important with respect to the frequencies of core-damage sequences to be highlighted during the quantification process.

Interactions that were not important to any of the core-damage sequences based on use of the screening values were not modeled or quantified further.

Those interactions that surfaced as potentially important during the sequence quantification process were then evaluated in more detail in the second stage." As a result, Table 2. Summary of Pre-Initiator Impact on ILRT Extension There is no impact to the ILRT extension since pre-initiator (Type A) human actions are not modified.

Page 95of198

54003-CALC-02 SR HR-82 2009 ASME/ANS Cat II Requirement can be affected from the control room, or (d) equipment status is required to be checked frequently (i.e., at least once a shift)

DO NOT screen activities that could simultaneously have an impact on multiple trains of a redundant system or diverse systems (HR-A3).

Revision 3 Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation F&O HR-02: A screening value of 3E-3 was initially used for all pre-initiator HEPs. There were 7 HEPs quantified in more detail, because the HEP importance was too high. However, there were 7 Latent Human Error events with a 3E-3 probability in the top 100 importance events in the CR2b quantification.

This observation does not necessarily have a large impact on the PRA results. However, per the HR subtier criteria, screening HEPs should not be used for actions appearing in important contributors.

Disposition (Type A) Human Interactions shows that 23 of the 56 pre-initiators were quantified with detailed analysis.

F&O HR-02: F&O HR-02 remains open (Ref: PRATracker C-03-0058) to provide detailed quantification of the dominant pre-initiator HEPs.

Detailed evaluations have been performed for 24 of 58 (41%) of the pre-initiator human error events (LHEs). Different LHEs may be more significant for fire than for internal event sequences since a fire can fail multiple components. However, cut sets that contain the screening value LHEs would be expected to decrease in importance since detailed evaluations tend to lower the probabilities assigned to the LH Es. Review of the cutsets data verified incorporation of mean LH E values into the database.

The NEI SRs applicable to this ASME SR are DA-5, DA-6, HR-5, HR-6, HR-7, and HR-26, and there are no NRC objections. There is an industry action to ensure single actions with multiple train consequences are evaluated in pre-initiators, since the screening rules in HR-6 do not preclude screening of activities that can affect multiple trains of a system. The original Peer Review rated DA-5, HR-5, HR-7, and HR-26 as "3", but HR-6 as "2" with associated level "B" F&Os HR-02 and TH-05, and DA-6 was "N/A". TH-05 does not seem relevant to this SR because pre-initiator HEPs are not based on thermal-hydraulics timing. DA-5 also has one level "B" F&Os: DA-01, but this F&O is not related to this SR, since the F&O is on component boundaries.

Both Self-assessments identified this element as N/A on the basis that "Screening is not performed."

CNC-1535.00-00-0030, Appendix F Catawba Nuclear Station Miscalibration Human Reliability Analysis discusses HR-82 in Section 3, Screening. It states that "According to the ASME PRA Standard supporting requirement HR-82, activities that could simultaneously impact multiple trains of redundant or diverse equipment are not to be screened out. The simultaneous impact does not mean that an activity simultaneously impacts redundant trains while the activity is being performed, but that the activity or activities performed in a procedure can render redundant or diverse trains unavailable simultaneously.

For example, a calibration procedure would sequentially step through the calibrations of redundant channels measuring the same Impact on ILRT Extension There is no impact to the ILRT extension since pre-initiator (Type A) human actions are not modified.

Page 96 of 198

54003-CALC-02 SR HR-D1 2009 ASME/ANS Cat II Requirement ESTIMATE the probabilities of human failure events using a systematic process. Acceptable methods include THERP [2-5] and ASEP [2-6].

Revision 3 Status Dis positioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation F&O HR-02: A screening value of 3E-3 was initially used for all pre-initiator HEPs. There were 7 HEPs quantified in more detail, because the HEP importance was too high. However, there were 7 Latent Human Error events with a 3E-3 probability in the top 100 importance events in the CR2b quantification.

This observation does not necessarily have a large impact on the PRA results. However, per the HR subtier criteria, screening HEPs should not be used for actions appearing in important contributors.

Disposition parameter. Although only one channel is calibrated at a time, more than one channel may be miscalibrated - impacting redundant channels simultaneously. In general, calibration activities performed on redundant channels should therefore not be screened out."

F&O HR-02: F&O HR-02 remains open (Ref: PRATracker C-03-0058) to provide detailed quantification of the dominant pre-initiator HEPs.

Detailed evaluations have been performed for 24 of 58 (41 %) of the pre-initiator human error events (LHEs). Different LHEs may be more significant for fire than for internal event sequences since a fire can fail multiple components. However, cut sets that contain the screening value LH Es would be expected to decrease in importance since detailed evaluations tend to lower the probabilities assigned to the LH Es. Review of the cutsets data verified incorporation of mean LH E values into the database.

The NEI SR applicable to this ASME SR is HR-6, and there are no industry self-assessment actions and no NRC objections. The original Peer Review rated HR-6 as "2" with associated level "B" F&Os HR-02 and TH-05. TH-05 does not seem relevant to this SR because pre-initiator HEPs are not based on thermal-hydraulics timing.

Section 2.1 of the revised HRA Cale CNC-1535.00-00-0030 states that "The screening values permitted those pre-initiator actions that could be important with respect to the frequencies of core-damage sequences to be highlighted during the quantification process.

Interactions that were not important to any of the core-damage sequences based on use of the screening values were not modeled or quantified further.

Those interactions that surfaced as potentially important during the sequence quantification process were then evaluated in more detail in the second stage." As a result, Table 2. Summary of Pre-Initiator (Type A) Human Interactions shows that 23 of the 56 pre-initiators were quantified with detailed analysis.

F&O HR-02: F&O HR-02 remains open (Ref: PRATracker C-03-0058) to provide detailed quantification of the dominant pre-initiator HEPs.

Detailed evaluations have been performed for 24 of 58 (41%) of the pre-initiator human error events (LHEs). Different LHEs may be more Impact on ILRT Extension There is no impact to the I LRT extension since pre-initiator (Type A) human actions are not modified.

Page 97of198

54003-CALC-02 SR HR-02 2009 ASME/ANS Cat II Requirement For significant HFEs, USE detailed assessments in the quantification of pre-initiator HEPs. USE screening values based on a simple model, such as ASEP in the quantification of the pre-initiator HEPs for non-significant human failure basic events. When bounding values are used, ENSURE they are based on limiting cases from models such as ASEP [2-6].

HR-D3 For each detailed human error probability assessment, INCLUDE in the evaluation process the Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Status Dispositioned Finding/Observation F&O HR-02: A screening value of 3E-3 was initially used for all pre-initiator HEPs. There were 7 HEPs quantified in more detail, because the HEP importance was too high. However, there were 7 Latent Human Error events with a 3E-3 probability in the top 100 importance events in the CR2b quantification.

This observation does not necessarily have a large impact on the PRA results. However, per the HR subtier criteria, screening H EPs should not be used for actions appearing in important contributors.

Dispositioned None Disposition significant for fire than for internal event sequences since a fire can fail multiple components. However, cut sets that contain the screening value LHEs would be expected to decrease in importance since detailed evaluations tend to lower the probabilities assigned to the LH Es. Review of the cutsets data verified incorporation of mean LH E values into the database.

The NEI SR applicable to this ASME SR is HR-6, and there are no industry self-assessment actions and no NRC objections. The original Peer Review rated HR-6 as "2" with associated level "B" F&Os HR-02 and TH-05. TH-05 does not seem relevant to this SR because pre-initiator HEPs are not based on thermal-hydraulics timing.

Section 2.1 of the revised HRA Cale CNC-1535.00-00-0030 states that "The screening values permitted those pre-initiator actions that could be important with respect to the frequencies of core-damage sequences to be highlighted during the quantification process.

Interactions that were not important to any of the core-damage sequences based on use of the screening values were not modeled or quantified further.

Those interactions that surfaced as potentially important during the sequence quantification process were then evaluated in more detail in the second stage." As a result, Table 2. Summary of Pre-Initiator (Type A) Human Interactions shows that 23 of the 56 pre-initiators were quantified with detailed analysis.

F&O HR-02: F&O HR-02 remains open (Ref: PRATracker C-03-0058) to provide detailed quantification of the dominant pre-initiator HEPs.

Detailed evaluations have been performed for 24 of 58 (41 %) of the pre-initiator human error events (LHEs). Different LHEs may be more significant for fire than for internal event sequences since a fire can fail multiple components. However, cut sets that contain the screening value LHEs would be expected to decrease in importance since detailed evaluations tend to lower the probabilities assigned to the LHEs. Review of the cutsets data verified incorporation of mean LH E values into the database.

Impact on ILRT Extension There is no impact to the ILRT extension since pre-initiator (Type A) human actions are not modified.

NEI 00-02 does not explicitly address this SR and states "This item is There is no impact to the implicitly included in the peer review of HRA by virtue of the ILRT extension since pre-assessment of the crew's ability to implement the procedure in an Page 98 of 198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement following plant-specific relevant information:

(a) the quality of written procedures (for performing tasks) and administrative controls (for independent review)

(b) the quality of the human-machine interface, including both the equipment configuration, and instrumentation and control layout HR-D4 When taking into account self-recovery or recovery from other crew members in estimating HEPs for specific HF Es, USE pre-initiator recovery factors in a manner consistent with selected methodology. If recovery of pre-initiator errors is credited (a) ESTABLISH the maximum credit that can be given for multiple recovery opportunities (b) USE the following information to assess the potential for recovery of pre-initiator:

(1) post-maintenance or post-Revision 3 Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation F&O HR-02: A screening value of 3E-3 was initially used for all pre-initiator HEPs. There were 7 HEPs quantified in more detail, because the HEP importance was too high. However, there were 7 Latent Human Error events with a 3E-3 probability in the top 100 importance events in the CR2b quantification.

This observation does not necessarily have a large impact on the PRA results. However, per the HR subtier criteria, screening HEPs should not be used for actions appearing in important contributors.

Disposition Impact on ILRT Extension effective and controlled manner. The pre-initiator HRA adequacy is initiator (Type A) human determined reasonable and representative considering the procedure actions are not modified.

quality."

CNC-1535.00-00-0030, Rev. 2, July 2012, HRA Cale, section 3.1 Quantification of Type A Interactions states that "Once each pre-initiator human interaction was further defined in terms of the specific failures of interest, the conditions that would affect their probabilities of occurrence were identified. These conditions, which were drawn from Table 5-2 of the ASEP methodology, include the following [Ref.

6]:

(1) Whether status of the unavailable component would be indicated by a compelling signal in the control room.

(2) Whether component status would be positively verified by a post-maintenance or post-calibration test.

(3) Whether there would be a requirement for an independent verification of the status of the component after test or maintenance activities.

(4) Whether there would be a check of the component status each shift or each day, using a written checklist.

An event tree was constructed to provide a framework for applying these conditions in evaluating individual pre-initiator interactions."

The NEI SR applicable to this ASME SR is HR-6, and there are no NRC objections. There is an industry action to use the ASME/ANS PRA Standard for requirements, since NEI 00-02 does not explicitly cite the treatment of recovery actions for pre-initiators. The original Peer Review rated HR-6 as "2" with associated level "B" F&Os HR-02 and TH-05. TH-05 does not seem relevant lo this SR because pre-initiator HEPs are not based on thermal-hydraulics timing.

The Type A operator action quantification spreadsheets addressed post maintenance testing, independent verification and separate checks using an event tree approach.

F&O HR-02: F&O HR-02 remains open (Ref: PRATracker C-03-0058) to provide detailed quantification of the dominant pre-initiator HEPs.

Detailed evaluations have been performed for 24 of 58 (41 %) of the pre-initiator human error events (LHEs). Different LHEs may be more significant for fire than for internal event sequences since a fire can fail multiple components. However, cut sets that contain the There is no impact to the ILRT extension since pre-initiator (Type A) human actions are not modified.

Page 99 of 198

54003-CALC-02 SR 2009 ASME/ANS Cat fl Requirement calibration tests required and performed by procedure (2) independent verification, using a written check-off list, that verifies component status following maintenance/testing (3) a separate check of component status made at a later time, using a written check-off list, by the original performer (4) work shift or daily checks of component status, using a written check-off list.

HR-D6 PROVIDE an assessment of the uncertainty in the HEPs in a manner consistent with the quantification approach. USE mean values when providing point estimates of HEPs.

HR-E1 When identifying the key human response actions REVIEW:

(a) the plant-specific emergency operating procedures, and other relevant procedures (e.g., AOPs, annunciator response procedures) in the context of the accident scenarios (b) system operation such that an understanding of how the system(s)

Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Status Finding/Observation Dispositioned None Dispositioned F&O HR-04: The operating staff at the plant had some input to the HRA in the beginning, but it is not obvious a thorough review of the dominant operator actions by the plant staff had been done, nor was it obvious there had been any feedback of their comments into the analysis.

The level of detail and relation to the operating procedures is sparse. In some instances, the procedural steps are not mentioned. In some places, the reference to the procedure is incorrect, such as the emergency primary depressurization reference to ES 1.3, which actually occurs in FRC.1.

Disposition screening value LHEs would be expected to decrease in importance since detailed evaluations tend to lower the probabilities assigned to the LHEs. Review of the cutsets data verified incorporation of mean LHE values into the database.

NEI 00-02 does not address this supporting requirement.

DPC-1535.00-00-013, Rev. 2. 2008 Self-assessment identified this in Table 3 as Not Met and in Table C as an Open Item.

DPC-1535.00-00-013, Rev. 2., 2008 Self-assessment Table 1 states that "The Type A HEPs are not identified to be mean values and error factors are not provided in the summary table of the HR notebook (Table 2)." This is not uncommon in HRA.

CNC-1535.00-00-0155, Rev. 0, 2013 Self-assessment states that this is Met and cites the Catawba Rev. 3a PRA Database as a reference.

The NEI SRs applicable to this ASME SR are HR-9, HR-10, HR-16, AS-19, and SY-5, and there are no industry self-assessment actions and no NRC objections. The original Peer Review rated HR-9, AS-19, and SY-5 as "3", but HR-1 o and HR-16 as "2" with associated level "B" F&Os HR-05 and HR-04, respectively.

F&Os HR-04 and HR-05: While these F&Os remain open (PRATracker items C-03-0059 and C-03-0060); CNC-1535.00 0030 contains the information needed to ascertain that the requirements for this SR are met, as noted below in the self-assessment and the discussion from CNC-1535.00-00-0030.

Impact on ILRT Extension There is no impact to the ILRT extension since pre-initiator (Type A) human actions are not modified.

Based on a review of the HR and SY notebooks, the identification of key human response actions employed reviews of the plant-specific operating procedures, including the emergency procedures and the various abnormal procedures, as well as human interfaces with systems operation. The issues raised by the peer review were addressed Page 100of198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement functions and the human interfaces with the system is obtained HR-E2 IDENTIFY those actions (a) required to initiate (for those systems not automatically initiated),

operate, control, isolate, or terminate those systems and components used in preventing or mitigating core damage as defined by the success criteria (e.g.,

operator initiates RHR)

(b) performed by the control room staff either in response to procedural direction or as skill-of-the-craft to diagnose and then Revision 3 Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation F&O HR-05: In the Catawba HRA notebook for PRA Rev 2b (and similarly in the McGuire Rev 3 HRA notebook), the documentation of the bases for the HEPs is not sufficiently specified to assure that the analysis is reproducible. Specifically, the sequence context (e.g., previous failures in the event sequence, concurrent activities, environmental factors, etc.) and procedural steps applicable to each HEP are not consistently provided. Thus, even though there is evidence that the HEP worksheet information is being reviewed by plant Operations personnel, it is not clear that they would have sufficient supporting information with which to make an effective assessment of the HRA.

Similarly, the timing, PSF, stress level, and all other contributing factors to the HEP were printed, but the basis was not provided. It would not have been possible for another analyst to determine the same factors and derive the same number.

The lack of such information in the documentation of the HRA limits the ability to verify and reproduce the results, and to determine their applicability in specific scenarios.

F&O HR-04: The operating staff at the plant had some input to the HRA in the beginning, but it is not obvious a thorough review of the dominant operator actions by the plant staff had been done, nor was it obvious there had been any feedback of their comments into the analysis.

The level of detail and relation to the operating procedures is sparse. In some instances, the procedural steps are not mentioned. In some places, the reference to the procedure is incorrect, such as the emergency primary depressurization reference to ES 1.3, which actually occurs in FRC.1.

F&O HR-05: In the Catawba HRA notebook for PRA Rev 2b (and similarly in the McGuire Rev 3 HRA Disposition DPC-1535.00-00-013, Rev. 2., 2008 Self-assessment Table 1 considers this SR to be met on the following basis: "Based on a review of the HR and SY notebooks, the identification of key human response actions employed reviews of the plant-specific operating procedures, including the emergency procedures and the various abnormal procedures, as well as human interfaces with systems operation."

Section 2.2 of Rev. 2 of the HRA Cale CNC-1535.00-00-0030 states that, "To delineate system response to particular types of upset events, it can be as important to understand the intended response of the operating crew in using the system as it is to understand the design of the system itself. Thus, in defining the sequence delineation for particular initiating events, it was necessary to review carefully the operating procedures, including the emergency procedures and the various abnormal procedures. This review was aimed at identifying any operator-driven considerations that would affect the modeling process, such as the priorities that might come into play when multiple options were available for maintaining core cooling, or the cues that might indicate the need to change operating modes. These procedure reviews were augmented by obtaining input from operators. This was done by having current and former operators review the sequence logic and system fault trees; through extensive discussions with operators regarding specific scenarios; and, to the extent possible, by observing simulator exercises."

The NEI SRs applicable to this ASME SR are HR-8, HR-9, HR-10, HR-21, HR-22, HR-23, and HR-25, and there are no industry self-assessment actions and no NRC objections. The original Peer Review rated HR-8, HR-9, HR-21 and HR-25 as "3" and HR-22 and HR-23 as "3 with contingencies." HR-10 was rated "2" with associated level "B" F&O HR-05. Also, NEI SRs HR-22 and HR-23 have F&Os HR-04 and HR-05, respectively.

F&Os HR-04 and HR-05: While these F&Os remain open (PRATracker items C-03-0059 and C-03-0060); CNC-1535.00 0030 contains the information needed to ascertain that the requirements for this SR are met, as noted below in the self-assessment and the discussion from CNC-1535.00-00-0030.

DPC-1535.00-00-013, Rev. 2., 2008 Self-assessment Table 1 Impact on ILRT Extension through added discussion in the HRA Cale. There is no impact on the ILRT extension.

Based on a review of the HR and SY notebooks, the identification of key human response actions employed reviews of the plant-specific operating procedures, including the emergency procedures and the various abnormal procedures, as well as human interfaces with systems operation. The issues raised by the peer review were addressed through added discussion in the HRA Cale. There is no Page 101 of 198

54003-CALC-02 SR HR-E3 2009 ASME/ANS Cat II Requirement recover a failed function, system, or component that is used in the performance of a response action as identified in H R-H 1.

TALK THROUGH (i.e., review in detail) with plant operations and training personnel the procedures and sequence of events to confirm that interpretation of the procedures is consistent with plant observations and training procedures.

Revision 3 Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation notebook), the documentation of the bases for the HEPs is not sufficiently specified to assure that the analysis is reproducible. Specifically, the sequence context (e.g., previous failures in the event sequence, concurrent activities, environmental factors, etc.) and procedural steps applicable to each HEP are not consistently provided. Thus, even though there is evidence that the HEP worksheet information is being reviewed by plant Operations personnel, it is not clear that they would have sufficient supporting information with which to make an effective assessment of the H RA.

Similarly, the timing, PSF, stress level, and all other contributing factors to the HEP were printed, but the basis was not provided. It would not have been possible for another analyst to determine the same factors and derive the same number.

The lack of such information in the documentation of the H RA limits the ability to verify and reproduce the results, and to determine their applicability in specific scenarios.

F&O HR-04: The operating staff at the plant had some input to the HRA in the beginning, but it is not obvious a thorough review of the dominant operator actions by the plant staff had been done, nor was it obvious there had been any feedback of their comments into the analysis.

The level of detail and relation to the operating procedures is sparse. In some instances, the procedural steps are not mentioned. In some places, the reference to the procedure is incorrect, such as the emergency primary depressurization reference to ES 1.3, which actually occurs in FRC.1.

F&O HR-05: In the Catawba HRA notebook for PRA Rev 2b (and similarly in the McGuire Rev 3 HRA notebook), the documentation of the bases for the Disposition Impact on ILRT Extension considers this SR to be met on the following basis: "The identification impact on the ILRT of human response actions included those actions required to initiate, extension.

operate, control, isolate, or terminate those systems and components modeled by the PRA, as well as those actions performed by the control room staff either in response to procedural direction or as skill-of-the-craft to recover a failed function, system or component."

Section 2.2 of Rev. 2 of the HRA Cale CNC-1535.00-00-0030 states that" To delineate system response to particular types of upset events, it can be as important to understand the intended response of the operating crew in using the system as it is to understand the design of the system itself. Thus, in defining the sequence delineation for particular initiating events, it was necessary to review carefully the operating procedures, including the emergency procedures and the various abnormal procedures. This review was aimed at identifying any operator-driven considerations that would affect the modeling process, such as the priorities that might come into play when multiple options were available for maintaining core cooling, or the cues that might indicate the need to change operating modes. These procedure reviews were augmented by obtaining input from operators. This was done by having current and former operators review the sequence logic and system fault trees; through extensive discussions with operators regarding specific scenarios; and, to the extent possible, by observing simulator exercises."

The NEI SRs applicable to this ASME SR are HR-10, HR-14, and HR-20, and there are no industry self-assessment actions and no NRC objections. The original Peer Review rated all of these NEI SRs as "2" with associated level "B" F&Os HR-04 and HR-05.

F&Os HR-04 and HR-05: While these F&Os remain open (PRATracker items C-03-0059 and C-03-0060); CNC-1535.00 0030 contains the information needed to ascertain that the requirements for this SR are met, as noted below in the self-assessment and the discussion from CNC-1535.00-00-0030.

DPC-1535.00-00-013, Rev. 2. 2008 Self-assessment Table 1 considers this SR to be met on the following basis: "As documented in the HR notebook, talk-th roughs with plant operations have been performed to confirm that interpretation of the procedures is consistent with plant observations and training procedures. This was Based on the disposition, the requirements of Cat II are*

considered met. There is no impact to the ILRT extension.

Page 102of198

54003-CALC-02 SR HR-E4 2009 ASME/ANS Cat 11 Requirement USE simulator observations or talk*

throughs with operators to confirm the response models for scenarios modeled.

Revision 3 Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A*1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation HEPs is not sufficiently specified to assure that the analysis is reproducible. Specifically, the sequence context (e.g., previous failures in the event sequence, concurrent activities, environmental factors, etc.) and procedural steps applicable to each HEP are not consistently provided. Thus, even though there is evidence that the HEP worksheet information is being reviewed by plant Operations personnel, it is not clear that they would have sufficient supporting information with which to make an effective assessment of the HRA.

Similarly, the timing, PSF, stress level, and all other contributing factors to the HEP were printed, but the basis was not provided. It would not have been possible for another analyst to determine the same factors and derive the same number.

The lack of such information in the documentation of the HRA limits the ability to verify and reproduce the results, and to determine their applicability in specific scenarios.

F&O HR-04: The operating staff at the plant had some input to the HRA in the beginning, but it is not obvious a thorough review of the dominant operator actions by the plant staff had been done, nor was it obvious there had been any feedback of their comments into the analysis.

The level of detail and relation to the operating procedures is sparse. In some instances, the procedural steps are not mentioned. In some places, the reference to the procedure is incorrect, such as the emergency primary depressurization reference to ES 1.3, which actually occurs in FRC.1.

Disposition done by having operators review the sequence logic and system fault trees, through extensive discussions with operators regarding specific scenarios.

11 Section 4 of Rev. 2 of the HRA Cale CNC-1535.00-00-0030 states that: "The quantification of the human interactions required input from operations personnel, who often provided input on timing and qualitative insights that led to changes in the definition or application of specific events. The assessment for each event was reviewed in detail by at least one other PRA analyst. Review of the overall reasonableness of the events and their treatment was also gained during the final review of the sequence cut sets. This review process included both other members of the PRA project team and Catawba operations personnel."

The NEI SRs applicable to this ASME SR are HR-14 and HR-16, and there are no industry self-assessment actions and no NRG objections.

The original Peer Review rated both of these NEI SRs as "2" with associated level "B" F&O HR-04.

F&O HR-04: While this F&O remains open (PRATracker items C 0059), CNC-1535.00-00-0030 contains the information needed to ascertain that the requirements for this SR are met, as noted below in the self-assessment and the discussion from CNC-1535.00-00-0030.

DPC-1535.00-00-013, Rev. 2. 2008 Self-assessment Table 1 considers this SR to be met on the following basis: "As documented in the HR notebook, talk-throughs with plant operations have been performed to confirm the response models for scenarios modeled.

This was done by having operators review the sequence logic and system fault trees, through extensive discussions with operators regarding specific scenarios, and, to the extent possible, by observing simulator exercises."

Section 2.2 of Rev. 2 of the HRA Cale CNC-1535.00-00-0030 states that:

Impact on ILRT Extension Based on the disposition, the requirements of Cat II are considered met. There is no impact to the ILRT extension.

Page 103of198

54003-CALC-02 SR HR-F1 2009 ASME/ANS Cat II Requirement DEFINE human failure events (HFEs) that represent the impact of the human failures at the function, system, train, or component level as appropriate. Failures to correctly perform several responses may be grouped into one HFE if the impact of the failures is similar or can be conservatively bounded.

Revision 3 Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation F&O HR-04: The operating staff at the plant had some input to the HRA in the beginning, but it is not obvious a thorough review of the dominant operator actions by the plant staff had been done, nor was it obvious there had been any feedback of their comments into the analysis.

The level of detail and relation to the operating procedures is sparse. In some instances, the procedural steps are not mentioned. In some places, the reference to the procedure is incorrect, such as the emergency primary depressurization reference to ES 1.3, which actually occurs in FRC.1.

Disposition

'To delineate system response to particular types of upset events, it can be as important to understand the intended response of the operating crew in using the system as it is to understand the design of the system itself. Thus, in defining the sequence delineation for particular initiating events, it was necessary to review carefully the operating procedures, including the emergency procedures and the various abnormal procedures. This review was aimed at identifying any operator-driven considerations that would affect the modeling process, such as the priorities that might come into play when multiple options were available for maintaining core cooling, or the cues that might indicate the need to change operating modes. These procedure reviews were augmented by obtaining input from operators. This was done by having current and former operators review the sequence logic and system fault trees; through extensive discussions with operators regarding specific scenarios; and, to the extent possible, by observing simulator exercises."

The NEI SRs applicable to this ASME SR are HR-16, AS-19, and SY-5, and there are no industry self-assessment actions and no NRG objections. The original Peer Review rated AS-19 and SY-5 as "3",

but HR-16 as "2" with associated level "B" F&O HR-04.

F&O HR-04: While this F&O remains open (PRATracker items C 0059), CNC-1535.00-00-0030 contains the information needed to ascertain that the requirements for this SR are met, as noted below in the self-assessment.

DPC-1535.00-00-013, Rev. 2. 2008 Self-assessment Table 1 considers this SR to be met on the following basis: "Based on a review of the PRA documentation, the PRA defines human failure events at the appropriate level: function, system, train, or component level."

Section 2.2 of Rev. 2 of the HRA Cale CNC-1535.00-00-0030 states that:

"Type GP interactions in the logic models were included at the highest level consistent with their effects. For example, the failure to initiate feed-and-bleed cooling following a total Joss of feedwater is included in the supporting logic for the corresponding events in the event trees, rather than being broken down into individual faults associated with each piece of equipment in the system fault trees. This treatment Impact on ILRT Extension Based on the disposition, the requirements of Cat II are considered met. There is no impact to the ILRT extension.

Page 104of198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement HR-F2 COMPLETE THE DEFINITION of the H FEs by specifying (a) accident sequence specific timing of cues, and time window for successful completion (b) accident sequence specific procedural guidance (e.g., AOPs, and EOPs)

(c) the availability of cues and other indications for detection and evaluation errors (d) the specific high level tasks (e.g., train level) required to achieve the goal of the response Revision 3 Status Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation F&O HR-04: The operating staff at the plant had some input to the HRA in the beginning, but it is not obvious a thorough review of the dominant operator actions by the plant staff had been done, nor was it obvious there had been any feedback of their comments into the analysis.

The level of detail and relation to the operating procedures is sparse. In some instances, the procedural steps are not mentioned. In some places, the reference to the procedure is incorrect, such as the emergency primary depressurization reference to ES 1.3, which actually occurs in FRC.1.

F&O HR-05: In the Catawba HRA notebook for PRA Rev 2b (and similarly in the Catawba Rev 3 HRA notebook), the documentation of the bases for the HEPs is not sufficiently specified to assure that the analysis is reproducible. Specifically, the sequence context (e.g., previous failures in the event sequence, concurrent activities, environmental factors, etc.) and procedural steps applicable to each HEP are not consistentiy provided. Thus, even though there is evidence that the HEP worksheet information is being reviewed by plant Operations personnel, it is not clear that they would have sufficient supporting information with which to make an effective assessment of the HRA.

Similarly, the timing, PSF, stress level, and all other contributing factors to the HEP were printed, but the basis was not provided. It would not have been possible for another analyst to determine the same factors and derive the same number.

The lack of such information in the documentation of the HRA limits the ability to verify and reproduce the results, and to determine their applicability in specific scenarios.

F&O TH-05: The HEP worksheets do not clearly Disposition helps to highlight the events, and focuses consideration on cognitive aspects of the response to upset conditions."

The NEI SRs applicable to this ASME SR are HR-11, HR-16, HR-17, HR-19, HR-20, AS-19, and SY-5, and there are no NRC objections.

There is an industry action to determine whether the requirements of the ASME/ANS PRA Standard are met. The original Peer Review rated AS-19 and SY-5 as "3", but HR-16, HR-17, HR-19, and HR-20 as "2", with associated level "B" F&Os HR-04, HR-05, TH-05, and HR-04, respectively. HR-11 was assessed as "NA".

F&O TH Operator actions are considered as part of the CNP success criteria analyses with expected operator actions included for SLOCA (Section 3.3), SGTR (Section 3.4), and transient F&B (Section 3.6). Specific timing information from MAAP analyses can be found in Appendices A through F MAAP. This F&O is dispositioned based on the resolution of the finding and achieve grade 3 of the NEI SR. However, the CNS Assessment of Peer Review Open Items (May 2013) identifies this F&O as remaining open because the current model of record does not reflect the updated information and as a result the ASME SR is considered Not Met.

The date stamp on the HEP Excel Spreadsheets is still 2005 so it is not apparent that any updates have been made. No Thermal-hydraulic analyses are referenced as the basis for the accident sequence specific timing for cues or overall time window, as required by the SR.

F&O HR-05: While this F&O remains open (PRATracker item C 0060) for documentation issues, success criteria, plant parameters and associated acceptance criteria derived from the success criteria analyses are used to support the timing analysis used in the PRA HRA. References to MAAP analysis that support the timing actions are included in the HRA spreadsheets.

F&O HR-04: While this F&O remains open (PRATracker item C 0059), CNC-1535.00-00-0030 contains the information needed to ascertain that the requirements for this SR are met, as noted below in the discussion from CNC-1535.00-00-0030.

Impact on ILRT Extension F&Os HR-04 and HR-05 are considered met, with minor documentation items open.

Peer Review F&O TH-05 is still open. While updated success criteria and timing data has been developed from MAAP 4.0.7 analyses, it has not been incorporated into the model of record.

However, there are no significant changes to the success criteria [Reference 45], so the impact on the ILRT extension is expected to be negligible.

Page 105of198

54003-CALC-02 SR HR-G1 2009 ASME/ANS Cat II Requirement PERFORM detailed analyses for the estimation of HEPs for significant HFEs. USE screening values for HEPs for non-significant human failure basic events.

Revision 3 Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation refer to success criteria analyses to support timing for operator actions. Although most worksheets include an estimate of the time available for completion of an action, and some refer generally to information from MAAP analyses, specific references to MAAP (or other analysis) cases are not provided.

F&O HR-05: In the Catawba HRA notebook for PRA Rev 2b (and similarly in the Catawba Rev 3 HRA notebook), the documentation of the bases for the HEPs is not sufficiently specified to assure that the analysis is reproducible. Specifically, the sequence context (e.g., previous failures in the event sequence, concurrent activities, environmental factors, etc.) and procedural steps applicable to each HEP are not consistently provided. Thus, even though there is evidence that the HEP worksheet information is being reviewed by plant Operations personnel, it is not clear that they would have sufficient supporting information with which to make an effective assessment of the H RA.

Similarly, the timing, PSF, stress level, and all other contributing factors to the HEP were printed, but the basis was not provided. It would not have been possible for another analyst to determine the same factors and derive the same number.

The lack of such information in the documentation of the HRA limits the ability to verify and reproduce Disposition Section 2.2 of Rev. 2 of the HRA Cale CNC-1535.00-00-0030 states that:

"To delineate system response to particular types of upset events, it can be as important to understand the intended response of the operating crew in using the system as ii is to understand the design of the system itself. Thus, in defining the sequence delineation for particular initiating events, it was necessary to review carefully the operating procedures, including the emergency procedures and the various abnormal procedures. This review was aimed at identifying any operator-driven considerations that would affect the modeling process, such as the priorities that might come into play when multiple options were available for maintaining core cooling, or the cues that might indicate the need to change operating modes. These procedure reviews were augmented by obtaining input from operators. This was done by having current and former operators review the sequence logic and system fault trees; through extensive discussions with operators regarding specific scenarios; and, to the extent possible, by observing simulator exercises."

The NEI SRs applicable to this ASME SR are HR-15, HR-17, and HR-18, and there are no industry self-assessment actions and no NRC objections. The original Peer Review rated HR-15 as "3", but HR-17 as "2", with associated level "B" F&O HR-05. HR-18 was assessed as "N/A" (F&Os of HR-05, HR-09 and TH-05 were cited but they are not directly relevant lo this SR).

DPC-1535.00-00-013, Rev. 2. 2008 Self-assessment Table 1 considers this SR to be met on the following basis: "The Type C HRA uses detailed analyses for the estimation of H EPs for significant HFEs. The human cognitive reliability model or the caused-based approach was used to quantify cognition errors, and an abbreviated version of TH ERP to quantify execution errors. Screening values have been used for HEPs for non-significant human failure basic events."

Impact on ILRT Extension Based on the disposition, the requirements of Cat II are considered met. There is no impact to the ILRT extension. Detailed analysis has been performed for significant HFEs.

Page 106of198

54003-CALC-02 SR HR-G3 2009 ASME/ANS Cat II Requirement When estimating HEPs EVALUATE the impact of the following plant-specific and scenario-specific performance shaping factors:

(a) quality [type (classroom or simulator) and frequency] of the operator training or experience (b) quality of the written procedures and administrative controls (c) availability of instrumentation needed to take corrective actions (d) degree of clarity of the cues/indications (e) human-machine interface (f) time available and time required to complete the response (g) complexity of the required response (h) environment (e.g., lighting; heat, radiation) under which the operator is working (i) accessibility of the equipment requiring manipulation (j) necessity, adequacy, and availability of special tools, parts, clothing, etc.

HR-G4 BASE the time available to complete actions on appropriate Revision 3 Status Dispositioned Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation the results, and to determine their applicability in specific scenarios.

F&O HR-05: In the Catawba HRA notebook for PRA Rev 2b (and similarly in the McGuire Rev 3 HRA notebook), the documentation of the bases for the HEPs is not sufficiently specified to assure that the analysis is reproducible. Specifically, the sequence context (e.g., previous failures in the event sequence, concurrent activities, environmental factors, etc.) and procedural steps applicable to each HEP are not consistently provided. Thus, even though there is evidence that the HEP worksheet information is being reviewed by plant Operations personnel, it is not clear that they would have sufficient supporting information with which to make an effective assessment of the HRA.

Similarly, the timing, PSF, stress level, and all other contributing factors to the HEP were printed, but the basis was not provided. It would not have been possible for another analyst to determine the same factors and derive the same number.

The lack of such information in the documentation of the HRA limits the ability to verify and reproduce the results, and to determine their applicability in specific scenarios.

This finding was made against NEI SR HR-17 with an assignment of grade 2.

Disposition The NEI SRs applicable to this ASME SR are HR-17 and HR-18, and there are no industry self-assessment actions and no NRC objections.

The original Peer Review rated HR-17 as "2, with associated level "B" F&O HR-05. HR-18 was assessed as "N/A" (F&Os of HR-05, HR-09 and TH-05 were cited but they are not directly relevant to this SR).

Reg Guide 1.200, Rev. 2, Table B-4 states that "NEI 00-02 does not explicitly enumerate the same level of detail that is included in the ASME standard. However, by invoking the standard HRA methodologies the performance shape factors are necessarily evaluated. The peer review team experience is relied upon to investigate the PRA given general guidance and criteria."

CNC-1535.00-00-0030, Rev. 2, July 2012, HRA Cale., Section 3.2 Quantification of Type Cp Interactions provides more detailed explanations for the HRA methods used and the PSFs that were considered using the HCR and Cause Based methods.

Impact on ILRT Extension Based on a review of the HR and SY notebooks, the identification of key human response actions employed reviews of the plant-specific operating procedures, including the emergency procedures and the various abnormal procedures, as well as human interfaces with systems operation. The issues raised by the peer review were addressed through added discussion in the HRA Cale. There is no impact on the ILRT extension.

F&O HR-04: The operating staff at the plant had The NEI SRs applicable to this ASME SR are HR-18, HR-19, HR-20, F&O HR-04 is considered some input to the HRA in the beginning, but it is not and AS-13, and there are no industry self-assessment actions and no met, with minor Page 107of198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement realistic generic thermal-hydraulic analyses, or simulation from similar plants (e.g., plant of similar design and operation). SPECIFY the point in lime at which operators are expected to receive relevant indications.

Revision 3 Status Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation obvious a thorough review of the dominant operator actions by the plant staff had been done, nor was it obvious there had been any feedback of their comments into the analysis.

The level of detail and relation to the operating procedures is sparse. In some instances, the procedural steps are not mentioned. In some places, the reference to the procedure is incorrect, such as the emergency primary depressurization reference to ES 1.3, which actually occurs in FRC.1.

F&O TH-05: The HEP worksheets do not clearly refer to success criteria analyses to support timing for operator actions. Although most worksheets include an estimate of the lime available for completion of an action, and some refer generally to information from MAAP analyses, specific references to MAAP (or other analysis) cases are not provided.

Disposition NRC objections. The original Peer Review rated AS-13 as "3", but HR-19 and HR-20 as "2", with associated level "B" F&Os TH-05 and HR-04, respectively. HR-18 was assessed as "N/A" (F&Os of HR-05, H R-09 and TH-05 were cited but they are not directly relevant to this SR).

F&O TH Operator actions are considered as part of the CNP success criteria analyses with expected operator actions included for SLOCA (Section 3.3), SGTR (Section 3.4), and transient F&B (Section 3.6). Specific timing information from MAAP analyses can be found in Appendices A through F MAAP. This F&O is disposilioned based on the resolution of the finding and achieve grade 3 of the NEI SR. However, the CNS Assessment of Peer Review Open Items (May 2013) identifies this F&O as remaining open because the current model of record does not reflect the updated information and as a result the ASME SR is considered Not Met.

The date stamp on the HEP Excel Spreadsheets is still 2005 so it is not apparent that any updates have been made. No Thermal-hydraulic analyses are referenced as the basis for the accident sequence specific timing for cues or overall time window, as required by the SR.

F&O HR-04: While this F&O remains open (PRATracker items C 0059), CNC-1535.00-00-0030 contains the information needed to ascertain that the requirements for this SR are met, as noted below in the self-assessment and the discussion from CNC-1535.00-00-0030.

DPC-1535.00-00-013, Rev. 2. 2008 Self-assessment considers this SR to be met.

Section 4 of Rev. 2 of the HRA Cale CNC-1535.00-00-0030 states that" "The quantification of the human interactions required input from operations personnel, who often provided input on liming and qualitative insights that led to changes in the definition or application of specific events. The assessment for each event was reviewed in detail by at least one other PRA analyst. Review of the overall reasonableness of the events and their treatment was also gained during the final review of the sequence cut sets. This review process included both other members of the PRA project team and Catawba Impact on ILRT Extension documentation items open.

Peer Review F&O TH-05 is still open. While updated success criteria and liming data has been developed from MAAP 4.0.7 analyses, ii has not been incorporated into the model of record.

However, there are no significant changes to the success criteria [Reference 45], so the impact on the ILRT extension is expected to be negligible.

Page 108of198

54003-CALC-02 SR HR-G5 2009 ASME/ANS Cat II Requirement When needed, BASE the required time to complete actions for significant HFEs on action time measurements in either walkthroughs or talk-throughs of the procedures or simulator observations.

Revision 3 Status Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation F&O HR-04: The operating staff at the plant had some input to the HRA in the beginning, but it is not obvious a thorough review of the dominant operator actions by the plant staff had been done, nor was it obvious there had been any feedback of their comments into the analysis.

The level of detail and relation to the operating procedures is sparse. In some instances, the procedural steps are not mentioned. In some places, the reference to the procedure is incorrect, such as the emergency primary depressurization reference to ES 1.3, which actually occurs in FRC.1.

F&O HR-09: Define the four time parameters for all HEPs. Document the basis for all four times for each HEP. Make similar HEPs consistent with each other. Requanlify HEP with new time data.

Disposition operations personnel."

CNC-1535.00-00-0030, Rev. 2, July 2012, HRA Cale., Section 3.2.1 The Human Cognitive Reliability Model slates: "Ideally, the response and execution times would be collected from simulator exercises and actual plant events. In most cases, however, it was not practical to collect sufficient information, so the estimates of the SR Os were used.

The total time available was generally obtained from thermal-hydraulic calculations for the accidents of interest (e.g., from MAAP analyses, hand calculations, or other sources). Once the type of cognitive processing was determined and the time estimates were available, the correlation was quantified for failure to accomplish the action of interest within the available time window, TW, which represents the net time available to formulate the response to an event."

The NEI SRs applicable to this ASME SR are HR-16, HR-18, and HR-20, and there are no NRG objections. There is an industry action to evaluate proper inputs per the ASME/ANS PRA Standard or cite peer review documentation/conclusions or examples from your model. The original Peer Review rated HR-16 and HR-20 as "2", with associated level "B" F&O HR-04. HR-18 was assessed as "NA" (F&Os of HR-05, HR-09 and TH-05 were cited but they are not directly relevant to this SR).

F&O HR-09: Addressed in Catawba Human Reliability Analysis CNC-1535.00-00-0030. F&O remains open (PRATracker C-03-0066) with action to define and document the four time parameters for all HEPs.

Any changes to the H EPs are expected to be small. The internal events PRA human actions have been conservatively modified for application in the FPRA.

F&O HR-04: While this F&O remains open (PRATracker items C 0059), CNC-1535.00-00-0030 contains the information needed to ascertain that the requirements for this SR are met, as noted below in the self-assessment and the discussion from CNC-1535.00-00-0030.

DPC-1535.00-00-013, Rev. 2. 2008 Self-assessment considers this SR to be met.

Section 4 of Rev. 2 of the HRA Cale CNC-1535.00-00-0030 states that" Impact on ILRT Extension Based on a review of the HR and SY notebooks, the identification of key human response actions employed reviews of the plant-specific operating procedures, including the emergency procedures and the various abnormal procedures, as well as human interfaces with systems operation. The issues raised by the peer review were addressed through added discussion in the HRA Cale. There is no impact on the ILRT extension.

Page 109of198

54003-CALC-02 SR HR-G6 2009 ASME/ANS Cat 11 Requirement CHECK the consistency of the post-initiator HEP quantifications.

REVIEW the HF Es and their final HEPs relative to each other to check their reasonableness given the scenario context, plant history, procedures, operational practices, and experience.

Revision 3 Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation F&O QU-05: Event NDORWSTDHE: This is a recovery action to terminate the NV and NI pumps in the event of failure of ND to provide recirculation after a SL. The event was quantified on the basis of tripping the pumps within 18 minutes. RWST refill was assumed to occur (from undescribed source) and pumps were restarted to continue injection.

This recovery event is applied to a) loss of KC pumps b) SNSDRNVLHE - drain plug blockage c) CCF of ND pumps.

The recovery event is intended to provide injection flow for the long term commensurate with the RWST make-up capability. The time of some of these failure is 20 minutes, when injection requirements are beyond the make-up capability of the RWST. Secondly, there are cutsets representing heat removal that cannot be recovered by continued Disposition "The quantification of the human interactions required input from operations personnel, who often provided input on timing and qualitative insights that led to changes in the definition or application of specific events. The assessment for each event was reviewed in detail by at least one other PRA analyst. Review of the overall reasonableness of the events and their treatment was also gained during the final review of the sequence cut sets. This review process included both other members of the PRA project team and Catawba operations personnel."

CNC-1535.00-00-0030, Rev. 2, July 2012, HRA Cale., Section 3.2.1 The Human Cognitive Reliability Model states: "Ideally, the response and execution times would be collected from simulator exercises and actual plant events. In most cases, however, ii was not practical to collect sufficient information, so the estimates of the SR Os were used.

The total time available was generally obtained from thermal-hydraulic calculations for the accidents of interest (e.g., from MAAP analyses, hand calculations, or other sources). Once the type of cognitive processing was determined and the time estimates were available, the correlation was quantified for failure to accomplish the action of interest within the available time window, TW, which represents the net time available to formulate the response to an event."

The NEI SRs applicable to this ASME SR is HR-12, and there are no NRC objections. There is an industry action to ensure they are met by citing peer review documentation/conclusions or examples from your model. The original Peer Review rated HR-12 as "3", with associated level "B" F&O QU-05.

F&O QU-05: Event NDORWSTDHE has been redefined and failure probability recalculated for the Catawba Rev 3a PRA Model Integration Notebook.

In DPC-1535.00-00-013, it is noted that the PRA notebooks do not document a review of the HFEs and their final HEPs relative to each other to check reasonableness given the scenario context, plant history, procedures, operational practices, and experience, and this SR is considered Not Met.

Impact on ILRT Extension HFEs are reviewed by knowledgeable site personnel to assure high quality. Recent update of the Oconee PRA model demonstrated that the HRA methodology for operator actions used at the time of the Catawba peer review produced conservative results, largely due to overestimation of the impact of dependencies. This issue is not expected to affect the overall conclusions of the ILRT extension LAR submittal.

Page 110of198

54003-CALC-02 SR HR-G8 HR-H1 2009 ASME/ANS Cat 11 Requirement Characterize the uncertainty in the estimates of the HEPs in a manner consistent with the quantification approach, and PROVIDE mean values for use in the quantification of the PRA results.

INCLUDE operator recovery actions that can restore the functions, systems, or components on an as-needed basis to provide a more realistic evaluation of significant accident sequences.

Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Status Finding/Observation injection of HHSI. The sequence needs continuous injection of HHSI and heat removal from containment.

Dispositioned None Dispositioned F&O HR-04: The operating staff at the plant had some input to the HRA in the beginning, but it is not obvious a thorough review of the *dominant operator actions by the plant staff had been done, nor was it obvious there had been any feedback of their comments into the analysis.

The level of detail and relation to the operating procedures is sparse. Jn some instances, the procedural steps are not mentioned. In some places, the reference to the procedure is incorrect, such as the emergency primary depressurization reference to ES 1.3, which actually occurs in FRC.1.

F&O HR-05: Jn the Catawba HRA notebook for PRA Rev 2b (and similarly in the Catawba Rev 3 HRA notebook), the documentation of the bases for the HEPs is not sufficiently specified to assure that the analysis is reproducible. Specifically, the sequence context (e.g., previous failures in the event sequence, concurrent activities, environmental factors, etc.) and procedural steps applicable to each HEP are not consistently provided. Thus, even though there is evidence that the HEP worksheet information is being reviewed by plant Operations personnel, it is not clear that they would Disposition Self-assessment, CNC-1535.00-00-0155, also lists this SR as Not Met. It is noted that, as part of model integration and results review, the probabilities associated with human error events and their reasonableness given the scenarios in which they occur are reviewed.

To fully meet this SR, it is recommended that a meeting be held with the PRA model integrator, the HRA specialist and plant operators to perform a formal consistency check of the post-initiator human error probability quantifications.

NEJ 00-02 does not address this supporting requirement. DPC-1535.00-00-013, Rev. 2. 2008 Self-assessment identified this in Table 3 as Not Met and in Table C as an Open Item.

CNC-1535.00-00-0155, Rev. O, 2013 Self-assessment states that this is Met and cites the Catawba Rev. 3a PRA Database as a reference, which includes uncertainty parameters and mean values for use in quantification.

The NEJ SRs applicable to this ASME SR are HR-21, HR-22, and HR-23, and there are no industry self-assessment actions and no NRC objections. The original Peer Review rated HR-21 as "3" and HR-22 and HR-23 as "3 with contingencies." NEI SRs HR-22 and HR-23 have level "B" F&Os HR-04 and HR-05, respectively.

F&Os HR-04 and HR-05: While these F&Os remain open (PRATracker items C-03-0059 and C-03-0060); CNC-1535.00 0030 contains the information needed to ascertain that the requirements for this SR are met, as noted below in the discussion from CNC-1535.00-00-0030.

CNC-1535.00-00-0030, Rev. 2, July 2012, HRA Cale, Section 3.3 Quantification for Non-Recovery (Type CR) Interactions says: "The consideration of actions that would constitute non-recovery events is outlined in Section 2.5. As noted, there, some of the non-recovery events assessed in this study represented failures to respond to the Joss of a system or function in a manner that was not explicitly directed by procedures. These events were added to the sequence-level minimal cut sets after the solution process. This process was originally accomplished by adding events to the cut sets on an individual basis. More recently, the addition of the events has been automated through the use of the QRECOVER program, which allows the analyst to define a set of rules which, if satisfied, cause the event Impact on ILRT Extension However, this review needs to be better documented. No impact on the ILRT extension is expected.

Uncertainties in the internal events H EPs are fed into the HRA. No impact to the ILRT extension.

Based on a review of the HR and SY notebooks, the identification of key human response actions employed reviews of the plant-specific operating procedures, including the emergency procedures and the various abnormal procedures, as well as human interfaces with systems operation. The issues raised by the peer review were addressed through added discussion in the HRA Cale. There is no impact on the ILRT extension.

Page 111 of 198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement HR-H2 CREDIT operator recovery actions only if, on a plant-specific basis, the following occur:

(a) a procedure is available and operator training has included the action as part of crew's training, or justification for the omission for one or both is provided (b) "cues" (e.g., alarms) that alert the operator to the recovery action provided procedure, training, or skill of the craft exist (c) attention is given to the relevant performance shaping factors provided in HR-G3 (d) there is sufficient manpower to perform the action.

Revision 3 Status Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation have sufficient supporting information with which to make an effective assessment of the HRA.

Similarly, the timing, PSF, stress level, and all other contributing factors to the HEP were printed, but the basis was not provided. It would not have been possible for another analyst to determine the same factors and derive the same number.

The lack of such information in the documentation of the HRA limits the ability to verify and reproduce the results, and to determine their applicability in specific scenarios.

F&O HR-04: The operating staff at the plant had some input to the HRA in the beginning, but it is not obvious a thorough review of the dominant operator actions by the plant staff had been done, nor was it obvious there had been any feedback of their comments into the analysis.

The level of detail and relation to the operating procedures is sparse. In some instances, the procedural steps are not mentioned. In some places,, the reference to the procedure is incorrect, such as the emergency primary depressurization reference to ES 1.3, which actually occurs in FRC.1.

F&O HR-05: In the Catawba HRA notebook for PRA Rev 2b (and similarly in the Catawba Rev 3 HRA notebook), the documentation of the bases for the HEPs is not sufficiently specified to assure that the analysis is reproducible. Specifically, the sequence context (e.g., previous failures in the event sequence, concurrent activities, environmental factors, etc.) and procedural steps applicable to each HEP are not consistently provided. Thus, even though there is evidence that the HEP worksheet information is being reviewed by plant Operations personnel, it is not clear that they would have sufficient supporting information with which to make an effective assessment of the HRA.

Similarly, the timing, PSF, stress level, and all other contributing factors to the HEP were printed, but the Disposition to be added. The rules are formulated in terms of the combinations of events that must appear in a cut set (and, in some cases, the events that must not be present) for a particular recovery action to be valid."

The NEI SRs applicable to this ASME SR are HR-22 and HR-23, and there are no industry self-assessment actions and no NRC objections.

The original Peer Review rated both of these NEI SRs as "3 with contingencies". NEI SRs HR-22 and HR-23 have level "B" F&Os HR-04 and HR-05, respectively.

F&Os HR-04 and HR-05: While these F&Os remain open (PRATracker items C-03-0059 and C-03-0060); CNC-1535.00 0030 contains the information needed to ascertain that the requirements for this SR are met, as noted below in the discussion from CNC-1535.00-00-0030.

CNC-1535.00-00-0030, Rev. 2, July 2012, HRA Cale, Section 3.3 Quantification for Non-Recovery (Type CR) Interactions says: "The consideration of actions that would constitute non-recovery events is outlined in Section 2.5. As noted, there, some of the non-recovery events assessed in this study represented failures to respond to the loss of a system or function in a manner that was not explicitly directed by procedures. These events were added to the sequence-level minimal cut sets after the solution process. This process was originally accomplished by adding events to the cut sets on an individual basis. More recently, the addition of the events has been automated through the use of the QRECOVER program, which allows the analyst to define a set of rules which, if satisfied, cause the event to be added. The rules are formulated in terms of the combinations of events that must appear in a cut set (and, in some cases, the events that must not be present) for a particular recovery action to be valid."

Impact on ILRT Extension Based on a review of the HR and SY notebooks, the identification of key human response actions employed reviews of the plant-specific operating procedures, including the emergency procedures and the various abnormal procedures, as well as human interfaces with systems operation. The issues raised by the peer review were addressed through added discussion in the HRA Cale. There is no impact on the ILRT extension.

Page 112of198

54003-CALC-02 SR DA-A1 2009 ASME/ANS Cat II Requirement IDENTIFY from the systems analysis the basic events for which probabilities are required.

Examples of basic events include:

(a) independent or common cause failure of a component or system to start or change state on demand (b) independent or common cause failure of a component or system to continue operating or provide a required function for a defined lime period (c) equipment unavailable to perform its required function due to being out of service for maintenance (d) equipment unavailable to perform its required function due to being in test mode (e) failure to recover a function or system (e.g., failure to recover off site-power)

(f) failure to repair a component, system, or function in a defined time period Revision 3 Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation basis was not provided. It would not have been possible for another analyst to determine the same factors and derive the same number.

The lack of such information in the documentation of the HRA limits the ability to verify and reproduce the results, and to determine their applicability in specific scenarios.

F&O DA-02: Some of the generic data from SAROS is quite dated, including WASH-1400, NUREG/CR-2815, Zion PRA, and NUREG/CR-4550. More recent generic data should be pursued. Component failures should be defined such that they encompass only those failures that would disable the component over the PRA mission time. It appears that this has not been considered.

Specific examples of less than adequate reliability data characterization were identified through review of Tables 1 and 3 in SAAG-655, Catawba PRA Rev.

3 Failure Rate and Maintenance Unavailability Data.

First, repeat events in a short duration, where there was insufficient component repair should be counted as one event. An example is PIP nos. 2-C97-2481 and 2-C97-2637 on 7 /29/97 and 8/12/97 for incoming breaker 2CXl-5C. The first failure occurred "for no apparent reason", but the second failure was attributed to a failed relay. The first event should be omitted as a component failure as the component was left in the degraded condition.

Second, component degradation that results in failure to meet normal criteria (e.g., to avoid component life degradation), may not impact the component mission for the PRA. For example, PIP no. O-C98-2057 involved a 617/98 event for trouble alarms for VI compressor F, and the compressor motor was found smoking. The evaluation addressed concern with overheating and insulation breakdown, but did not address whether run to failure would survive PRA mission. Similar pump failures due to routine vibration testing exceeding Disposition Impact on ILRT Extension The CNS PRA model includes events of all of the types shown (other Based on the disposition, the than component repair, which is not considered in the model).

CNS PRA model meets the The 2009 ASME/ANS Cat II requirements for DA-A1 were evaluated in part under NEI technical elements DA-4, DA-5, DA-15, SY-8, and SY-15 in the 2002 Catawba Peer Review. The peer review team assigned PSA grade of 3 to DA-5, SY-8, and SY-14. DA-4 and DA-15 were assigned a PSA grade of 3 contingent on resolution of F&Os DA-02, DA-05, and DA-06. F&O DA-02 is related to generic data sources; see SR DA-C1 for disposition. F&O DA-05 is related to specific component unavailabilities; see SR DA-C14 for disposition.

F&O DA-06 concerns MOV rupture error factors; see SR DA-03 for disposition.

requirements of Cat II for this SR. Minor changes to the random failure rate of the components is not significant in the risk evaluations.

There is negligible impact to the ILRT extension.

Page 113of198

54003-CALC-02 SR Revision 3 2009 ASME/ANS Cat II Requirement Status Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation limits were found (LPR 28 & 1A, WO 93020502 &

PIP 1-C93-1124).

F&O DA-05: The unavailabilities computed for the basic events for PORV block valve closure, RNC031BDEX, 033ADEX, and 035BDEX, assume that each PORV is closed one week per quarter.

However, there is no history of PORV closures for any extended period of time in the last few years.

While this does use plant-specific data, the benefit derived from it is limited due to the highly conservative assumption regarding PORV out of service time.

F&O DA-06: In SAAG 342, there is development of a failure probability for the rupture of an MOV. The type code for this event is MVR. This type code is used in the calculation of the ISLOCA frequency.

In the SAROS database, this distribution is composed of three equally weighted distributions.

The three distributions have error factors of close to 10.0. The error factor assigned to MVR is -2.6.

This is impossible - the error factor should be close to ten. The following provides additional explanation of this issue.

Often it is useful to develop a distribution based on combining several distributions. That is f(,\\) = Li wi fi(,\\), i =1... n. Such an operation often does not possess a closed solution and Monte Carlo (MC) simulations are required. However, care must be taken in implementing the MC solution. People are often tempted to set up a MC process where one iteration for I is based on taking samples from the weighted sum of samples from each of the fi(,\\)'s.

This is incorrect. This, in effect, loses data and results in a unimodal function. In the case of two equally weighted functions A and B where every point on A is less than any point on B, the lower points of A and the higher points of B would not be Disposition Impact on ILRT Extension Page 114of198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement DA-A2 ESTABLISH definitions of SSC boundaries, failure modes, and success criteria in a manner consistent with corresponding basic event definitions in Systems Analysis (SY-AS, SY-A7, SY-AB, SY-A9 through SY-A14 and SY-B4) for failure rates and common cause failure parameters, and ESTABLISH boundaries of unavailability events in a manner consistent with corresponding definitions in Systems Analysis (SY-A19).

DA-A3 USE an appropriate probability model for each basic event.

Examples include (a) binomial distributions for failure on demand (b) Poisson distributions for standby and operating failures and initiating events DA-A4 IDENTIFY the parameter to be estimated and the data required for estimation. Examples are as follows:

Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Status Finding/Observation in the resulting distribution. While the mean is preserved, the variance is understated and is incorrect. The proper method is to obtain samples for A, weight them, and put them in a pool. Then obtain samples for B, weight them, and put them in the pool. The points in the pool are MC distribution and, in this case, would be bi-modal. Note that page 5-38 of NUREG/CR-2300 uses the above equation and notes that it may produce a non-unimodal distribution.

Dispositioned None Dispositioned None Dispositioned F&O DA-02: Some of the generic data from SAR OS is quite dated, including WASH-1400, NUREG/CR-2815, Zion PRA, and NUREG/CR-4550. More recent generic data should be pursued. Component failures should be defined such that they Disposition N El 00-02 did not address this supporting requirement. A review of the Catawba CAFTA Model of Record was completed to define existing failure modes (both in type-code and/or basic event file). The process was used to define a complete set of required data, which was used to define the failure modes. The boundaries are set by the data source and/or system modeling. The database development calculation (DPC-1535.00-00-0016) includes a listing of each of the specific component type/failure mode combinations that are considered, along with component boundaries definitions.

NEI 00-02 did not address this supporting requirement. A review of the Catawba CAFTA Model of Record was completed to define existing failure modes (both in type-code and/or basic event file). The process was used to define a complete set of required data, which includes failures per demand and time-dependent failures.

Appropriate failure models are used for each event type.

The appropriate parameters necessary for each type of basic event have been identified and the required data has been collected and documented in calculation CNC-1535.00-00-0029 and its attached spreadsheets, and in the generic database, DPC-1535.00-00-0016.

Impact on ILRT Extension Based on the disposition, the CNS PRA model meets the requirements of Cat II for this SR. Minor changes to the random failure rate of the components is not significant in the risk evaluations.

There is negligible impact to the ILRT extension.

Based on the disposition, the CNS PRA model meets the Minor changes to the random failure rate of the components is not significant in the risk evaluations.

There is negligible impact to the ILRT extension.

Update of the generic data addressed concerns of the peer review team. Minor changes to the random failure rate of the Page 115of198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement (a) For failures on demand, the parameter is the probability of failure, and the data required are the number of failures given a number of demands.

(b) For standby failures, operating failures, and initiating events, the parameter is the failure rate, and the data required are the number of failures in the total (standby or operating) time.

(c) For unavailability due to test or maintenance, the parameter is the unavailability on demand, and the alternatives for the data required include (1) the total time.of unavailability OR a list of the maintenance events with their durations, together with the total time required to be available; OR (2) the number of maintenance or test acts, their average duration, and the total time required to be available.

Revision 3 Status Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation encompass only those failures that would disable the component over the PRA mission time. It appears that this has not been considered.

Specific examples of less than adequate reliability data characterization were identified through review of Tables 1 and 3 in SAAG-655, Catawba PRA Rev.

3 Failure Rate and Maintenance Unavailability Data.

First, repeat events in a short duration, where there was insufficient component repair should be counted as one event. An example is PIP nos. 2-C97-2481 and 2-C97-2637 on 7/29/97 and 8/12/97 for incoming breaker 2CXl-5C. The first failure occurred "for no apparent reason", but the second failure was attributed to a failed relay. The first event should be omitted as a component failure as the component was left in the degraded condition.

Second, component degradation that results in failure to meet normal criteria (e.g., to avoid component life degradation), may not impact the component mission for the PRA. For example, PIP no. O-C98-2057 involved a 617/98 event for trouble alarms for VI compressor F, and the compressor motor was found smoking. The evaluation addressed concern with overheating and insulation breakdown, but did not address whether run to failure would survive PRA mission. Similar pump failures due to routine vibration testing exceeding limits were found (LPR 28 & 1A, WO 93020502 &

PIP 1-C93-1124).

F&O DA-06: In SAAG 342, there is development of a failure probability for the rupture of an MOV. The type code for this event is MVR. This type code is used in the calculation of the IS LO CA frequency.

In the SAROS database, this distribution is composed of three equally weighted distributions.

The three distributions have error factors of close to 10.0. The error factor assigned to MVR is -2.6.

This is impossible - the error factor should be close Disposition The 2009 ASME/ANS Cat II requirements for DA-A4 were evaluated in part under NEI technical elements DA-4, DA-5, DA-6, DA-7, and SY-8 in the 2002 Catawba Peer Review. The peer review team assigned PSA grade of 3 to DA-5, DA-7 and SY-8. DA-6 was found to be not applicable to CNS. DA-4 was assigned a PSA grade of 3 contingent on resolution of F&Os DA-02, DA-04, and DA-06. F&O DA-02 is related to generic data sources; see SR DA-C1 for disposition.

DA-04 is Level C and does not need to be addressed. F&O DA-06 concerns MOV rupture error factors; see SR DA-03 for disposition.

Impact on ILRT Extension components is not significant in the risk evaluations.

There is negligible impact to the ILRT extension.

Page 116of198

54003-CALC-02 SR DA-81 2009 ASME/ANS Cat 11 Requirement For parameter estimation, GROUP components according to type (e.g.,

motor-operated pump, air-operated valve) and according to the characteristics of their usage to the extent supported by data:

(a) mission type (e.g., standby, operating)

(b) service condition (e.g., clean vs.

untreated water, air)

Revision 3 Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation to ten. The following provides additional explanation of this issue.

Often it is useful to develop a distribution based on combining several distributions. That is f(A) = Li wi fi(A), i =1... n. Such an operation often does not possess a closed solution and Monte Carlo (MC) simulations are required. However, care must be taken in implementing the MC solution. People are often tempted to set up a MC process where one iteration for I is based on taking samples from the weighted sum of samples from each of the fi(A)'s.

This is incorrect. This, in effect, loses data and results in a unimodal function. In the case of two equally weighted functions A and B where every point on A is less than any point on B, the lower points of A and the higher points of B would not be in the resulting distribution. While the mean is preserved, the variance is understated and is incorrect. The proper method is to obtain samples for A, weight them, and put them in a pool. Then obtain samples for B, weight them, and put them in the pool. The points in the pool are MC distribution and, in this case, would be bi-modal. Note that page 5-38 of NUREG/CR-2300 uses the above equation and notes that it may produce a non-unimodal distribution.

F&O DA-01: Workplace Procedure XSAA-110 is the primary data gathering procedure. It is supplemented by SAAG-655, Catawba PRA Revision 3 Failure Rate And Maintenance Unavailability Data, and SAAG-670, the CCF analysis report. Also, noteworthy is attachment 3, which includes the CCF checklist. Additional details are provided by SAAG File 579 (Rev. 2b Summary Report) and the Rev 2 Summary Report.

The data guidance is generally adequate; however it does not address component boundaries.

Component boundaries are apparent from the data as in the specific example in F&O DA-02, i.e., the Disposition The 2009 ASME/ANS Cat II requirements for DA-81 were evaluated under NEI technical element DA-5 in the 2002 Catawba Peer Review.

The peer review team assigned PSA grade of 3 to DA-5, however, one Level B F&O was issued related to DA-5. F&O DA-01 was addressed in the referenced generic database development.

Specifically, component boundaries are defined, time-dependent events for components such as motor-operated valves and check valves are developed, restrictions on the use of demand failures are provided, and data for standby vs. alternating and clean vs. water components are developed.

Impact on ILRT Extension Based on the disposition, the CNS PRA model meets the requirements of Cat II for this SR. Minor changes to the random failure rate of the components is not significant in the risk evaluations.

There is negligible impact to the ILRT extension.

Page 117of198

54003-CALC-02 SR DA-B2 DA-C1 2009 ASME/ANS Cat II Requirement DO NOT INCLUDE outliers in the definition of a group (e.g., do not group valves that are never tested and unlikely to be operated with those that are tested or otherwise manipulated frequently)

OBTAIN generic parameter estimates from recognized sources.

ENSURE that the parameter definitions and boundary conditions are consistent with those established in response to DA-A 1 to DA-A4. (Example: some sources include the breaker within the pump boundary, whereas others do not.)

DO NOT INCLUDE generic data for unavailability due to test, maintenance, and repair unless it can be established that the data is consistent with the test and maintenance philosophies for the subject plant.

Examples of parameter estimates and associated sources include (a) component failure rates and probabilities: NUREG/CR-4639 [2-7], NUREG/CR-4550 [2-3],

Revision 3 Status Dispositioned Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation incoming breaker and panelboard BLF. However, these should be defined in the guidance.

F&O DA-01: Workplace Procedure XSAA-110 is the primary data gathering procedure. It is supplemented by SAAG-655, Catawba PRA Revision 3 Failure Rate And Maintenance Unavailability Data, and SAAG-670, the CCF analysis report. Also, noteworthy is attachment 3, which includes the CCF checklist. Additional details are provided by SAAG File 579 (Rev. 2b Summary Report) and the Rev 2 Summary Report.

The data guidance is generally adequate; however it does not address component boundaries.

Component boundaries are apparent from the data as in the specific example in F&O DA-02, i.e., the incoming breaker and panelboard BLF. However, these should be defined in the guidance.

F&O DA-02: Some of the generic data from SAR OS is quite dated, including WASH-1400, NUREG/CR-2815, Zion PRA, and NUREG/CR-4550. More recent generic data should be pursued. Component failures should be defined such that they encompass only those failures that would disable the component over the PRA mission time. It appears that this has not been considered.

Specific examples of Jess than adequate reliability data characterization were identified.through review of Tables 1 and 3 in SAAG-655, Catawba PRA Rev.

3 Failure Rate and Maintenance Unavailability Data.

First, repeat events in a short duration, where there was insufficient component repair should be counted. as one event. An example is PIP nos. 2-C97-2481 and 2-C97-2637 on 7/29/97 and 8/12/97 for incoming breaker 2CXl-5C. The first failure occurred "for no apparent reason", but the second failure was attributed to a failed relay. The first event should be omitted as a component failure as the component was left in the degraded condition.

Second, component degradation that results in Disposition The 2009 ASME/ANS Cat II requirements for DA-B2 were evaluated under NEI technical elements DA-5 and DA-6 in the 2002 Catawba Peer Review. DA-6 was found to be not applicable to CNS. The peer review team assigned PSA grade of 3 to DA-5, however, one Level B F&O was issued related to DA-5. F&O DA-01 was addressed in the referenced generic database development as noted in DA-B1 disposition. No outlier components were inappropriately included in the established groupings. For unique failure modes (e.g. pressurizer safety valves and PO RVs), unique failure probabilities are developed.

The 2009 ASME/ANS Cat II requirements for DA-C1 were evaluated under NEI technical elements DA-4, DA-7, DA-9, DA-19, and DA-20 in the 2002 Catawba Peer Review. The peer review team assigned PSA grade of 3. to DA-7, DA-9, DA-19 and DA-20. DA-4 was assigned a PSA grade of 3 contingent on resolution of Level B F&Os DA-02 and DA-06. F&Os DA-02 was addressed by development and compilation of equipment failure rates for generic components as documented in DPC-1535.00-00-0016. The report, however, is limited to random independent failures for demand and time-dependent failures. F&O DA-02 remains open and is tracked as open item C 0057. F&O DA-06 concerns MOV rupture error factors; see SR DA-D3 for disposition.

Impact on ILRT Extension Based on the disposition, the CNS PRA model meets the requirements of Cat II for this SR. Minor changes to the random failure rate of the components is not significant in the risk evaluations.

There is negligible impact to the I LRT extension.

Minor changes to the random failure rate of the components is not significant iri the risk evaluations. There is negligible impact to the ILRT extension.

Page 118of198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement NUREG-1715 [2-21), NUREG/CR-6928 [2-20)

(b) common cause failures:

NUREG/CR-5497 [2-8),

NUREG/CR-6268 [2-9)

(c) AC off-site power recovery:

NUREG/CR-5496 [2-10),

NUREG/CR-5032 [2-11)

(d) component recovery.

See NUREG/CR-6823 [2-1) for a listing of additional data sources.

Revision 3 Status Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation failure to meet normal criteria (e.g., to avoid component life degradation), may not impact the component mission for the PRA. For example, PIP no. O-C98-2057 involved a 617/98 event for trouble alarms for VI compressor F, and the compressor motor was found smoking. The evaluation addressed concern with overheating and insulation breakdown, but did not address whether run to failure would survive PRA mission. Similar pump failures due to routine vibration testing exceeding limits were found (LPR 28 & 1A, WO 93020502 &

PIP 1-C93-1124).

F&O DA-06: In SAAG 342, there is development of a failure probability for the rupture of an MOV. The type code for this event is MVR. This type code is used in the calculation of the ISLOCA frequency.

In the SAROS database, this distribution is composed of three equally weighted distributions.

The three distributions have error factors of close to 10.0. The error factor assigned to MVR is -2.6.

This is impossible - the error factor should be close to ten. The following provides additional explanation of this issue.

Often it is useful to develop a distribution based on combining several distributions. That is f(l\\) = Li wi fi(l\\), i =1... n. Such an operation often does not possess a closed solution and Monte Carlo (MC) simulations are required. However, care must be taken in implementing the MC solution. People are often tempted to set up a MC process where one iteration for I is based on taking samples from the weighted sum of samples from each of the fi(l\\)'s.

This is incorrect. This, in effect, loses data and results in a unimodal function. In the case of two equally weighted functions A and B where every point on A is less than any point on B, the lower points of A and the higher points of B would not be in the resulting distribution. While the mean is Disposition Impact on ILRT Extension Page 119of198

54003-CALC-02 SR DA-C2 2009 ASME/ANS Cat II Requirement COLLECT plant-specific data for the basic event/parameter grouping corresponding to that defined by requirement DA-A1, DA-A3, DA-A4, DA-B1, and DA-B2.

Revision 3 Status Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation preserved, the variance is understated and is incorrect. The proper method is to obtain samples for A, weight them, and put them in a pool. Then obtain samples for B, weight them, and put them in the pool. The points in the pool are MC distribution and, in this case, would be bi-modal. Note that page 5-38 of NUREG/CR-2300 uses the above equation and notes that it may produce a non-unimodal distribution.

F&O DA-01: Workplace Procedure XSAA-110 is the primary data gathering procedure. It is supplemented by SAAG-655, Catawba PRA Revision 3 Failure Rate And Maintenance Unavailability Data, and SAAG-670, the CCF analysis report. Also, noteworthy is attachment 3, which includes the CCF checklist. Additional details are provided by SAAG File 579 (Rev. 2b Summary Report) and the Rev 2 Summary Report.

The data guidance is generally adequate; however it does not address component boundaries.

Component boundaries are apparent from the data as in the specific example in F&O DA-02, i.e., the incoming breaker and panelboard BLF. However, these should be defined in the guidance.

F&O DA-02: Some of the generic data from SAROS is quite dated, including WASH-1400, NUREG/CR-2815, Zion PRA, and NUREG/CR-4550. More recent generic data should be pursued. Component failures should be defined such that they encompass only those failures that would disable the component over the PRA mission time. It appears that this has not been considered.

Specific examples of less than adequate reliability data characterization were identified through review of Tables 1 and 3 in SAAG-655, Catawba PRA Rev.

3 Failure Rate and Maintenance Unavailability Data.

First, repeat events in a short duration, where there was insufficient component repair should be Disposition The plant-specific equipment failure data collected is captured in Maintenance Rule Experience Documents thru 2005 (SAAG 866).

The events, failure modes, and parameters for which data are collected appear to be consistent with those used in the system models, and are collected for groups of components.

The 2009 ASME/ANS Cat II requirements for DA-C2 were evaluated under NEI technical elements DA-4, DA-5, DA-6, DA-7, DA-14, DA-15, DA-19, and DA-20 in the 2002 Catawba Peer Review. The peer review team assigned PSA grade of 3 to DA-5, DA-7, DA-9, DA-19 and DA-20. DA-4 was assigned a PSA grade of 3 contingent on resolution of Level B F&Os DA-02 and DA-06. DA-6 and DA-14 were found to be not applicable to CNS. F&O DA-01: F&O was issued related to component boundaries (see SR DA-B1 for disposition).

F&O DA-02 is related to generic data sources; see SR DA-C1 for disposition. F&O DA-02 remains open and is tracked as open item C-03-0057. See SR DA-D3 for DA-06 disposition. F&O DA-05 is related to specific component unavailabilities; see SR DA-C14 for disposition.

F&O DA-06 concerns MOV rupture error factors; see SR DA-D3 for disposition.

Impact on ILRT Extension Minor changes to the random failure rate of the components is not significant in the risk evaluations. There is negligible impact to the ILRT extension.

Page 120of198

54003-CALC-02 SR Revision 3 2009 ASME/ANS Cat II Requirement Status Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation counted as one event. An example is PIP nos. 2-C97-2481 and 2-C97-2637 on 7/29/97 and 8/12/97 for incoming breaker 2CXl-5C. The first failure occurred "for no apparent reason". but the second failure was attributed to a failed relay. The first event should be omitted as a component failure as the component was left in the degraded condition.

Second, component degradation that results in failure to meet normal criteria (e.g., to avoid component life degradation), may not impact the component mission for the PRA. For example, PIP no. O-C98-2057 involved a 617/98 event for trouble alarms for VI compressor F, and the compressor motor was found smoking. The evaluation addressed concern with overheating and insulation breakdown, but did not address whether run to failure would survive PRA mission. Similar pump failures due to routine vibration testing exceeding limits were found (LPR 28 & 1A, WO 93020502 &

PIP 1-C93-1124).

F&O DA-05: The unavailabilities computed for the basic events for PORV block valve closure, RNC031BDEX, 033ADEX, and 035BDEX, assume that each PORV is closed one week per quarter.

However, there is no history of PORV closures for any extended period of time in the last few years.

While this does use plant-specific data, the benefit derived from it is limited due to the highly conservative assumption regarding PORV out of service time.

F&O DA-06: In SAAG 342, there is development of a failure probability for the rupture of an MOV. The type code for this event is MVR. This type code is used in the calculation of the ISLOCA frequency.

In the SAROS database, this distribution is composed of three equally weighted distributions.

The three distributions have error factors of close to 10.0. The error factor assigned to MVR is -2.6.

Disposition Impact on ILRT Extension Page 121 of 198

54003-CALC-02 SR 2009 ASME/ANS Cat 11 Requirement DA-C3 COLLECT plant-specific data, in a manner consistent with uniformity in design, operational practices, and experience. JUSTIFY the rationale for screening or disregarding plant-specific data (e.g., plant design modifications, changes in operating practices).

Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Status Finding/Observation This is impossible - the error factor should be close to ten. The following provides additional explanation of this issue.

Often it is useful to develop a distribution based on combining several distributions. That is f(A) = Li wi fi(A), i =1... n. Such an operation often does not possess a closed solution and Monte Carlo (MC) simulations are required. However, care must be taken in implementing the MC solution. People are often tempted to set up a MC process where one iteration for I is based on taking samples from the weighted sum of samples from each of the fi(A)'s.

This is incorrect. This, in effect, loses data and results in a unimodal function. In the case of two equally weighted functions A and B where every point on A is less than any point on B, the lower points of A and the higher points of B would not be in the resulting distribution. While the mean is preserved, the variance is understated and is incorrect. The proper method is to obtain samples for A, weight them, and put theni in a pool. Then obtain samples for B, weight them, and put them in the pool. The points in the pool are MC distribution and, in this case, would be bi-modal. Note that page 5-38 of NUREG/CR-2300 uses the above equation and notes that it may produce a non-unimodal distribution.

Dispositioned None.

Disposition The scope of NEI 00-02 only partially addresses this supporting requirement. For N El technical elements that are partially related to this SR, the F&Os from the 2002 Catawba peer review are more closely associated other SRs and are addressed as part of SR DA-81 and DA-C1.

The plant-specific equipment failure data collected is captured in Maintenance Rule Experience Documents thru 2005 (SAAG 866).

The events, failure modes, and parameters for which data are collected appear to be consistent with those used in the system models, and are collected for groups of components. The data is collected for groups of components. The Maintenance Rule Impact on ILRT Extension Based on the disposition, the CNS PRA model meets the requirements of Cat II for this SR. In addition, any minor changes to the random failure rate of the components is not significant in the risk evaluations. There is negligible impact to the ILRT extension.

Page 122 of 198

54003-CALC-02 SR DA-C4 2009 ASME/ANS Cat II Requirement When evaluating maintenance or other relevant records to extract plant-specific component failure event data, DEVELOP a clear basis for the identification of events as failures.

DISTINGUISH between those degraded states for which a failure, as modeled in the PRA, would have occurred during the mission and those for which a failure would not have occurred (e.g., slow pick-up to rated speed).

INCLUDE all failures that would have resulted in a failure to perform the mission as defined in the PRA.

Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Status Finding/Observation Dispositioned None Disposition Experience data tables identify those failures which apply to PRA components and failure modes, and those which are not PRA components (and therefore excluded).

The scope of NEI 00-02 did not address this supporting requirement.

The Workplace Procedure for Developing PRA Data (XSAA-110) provides specific guidelines for counting failures and demands for PRA purposes. In particular, a failure is counted only if the component would have failed to perform its function as defined in the PRA, under conditions applicable to the PRA. Numerous examples are provided.

The plant-specific equipment failure data collected is captured in Maintenance Rule Experience Documents thru 2005 (SAAG 866).

The Maintenance Rule Experience data tables identify those failures which apply to PRA components and those which are not PRA components, as well as the specific applicable failure mode.

Impact on ILRT Extension Based on the disposition, the CNS PRA model meets the requirements of Cat II for this SR. In addition, any minor changes to the random failure rate of the components is not significant in the risk evaluations. There is negligible impact to the ILRT extension.

DA-CS COUNT repeated plant-specific Dispositioned None The scope of NEI 00-02 did not address this supporting requirement.

The Workplace Procedure for Developing PRA Data (XSAA-110) specifies that repeated component failures occurring within a short period of time be counted as a single failure if there is a single, repetitive problem that causes the failures. In addition, only one demand is to be counted. The plant-specific equipment failure data collected is captured in Maintenance Rule Experience Documents thru 2005 (SAAG 866).

Based on the disposition, the CNS PRA model meets the requirements of Cat II for this SR. In addition, any minor changes to the random failure rate of the components is not significant in the risk evaluations. There is negligible impact to the ILRT extension.

component failures occurring within a short time interval as a single failure if there is a single, repetitive problem that causes the failures. In addition, COUNT only one demand.

DA-CB When required, USE plant-specific operational records to determine the time that components were configured in their standby status.

Revision 3 Open None The scope of NEI 00-02 did not address this supporting requirement.

The denominators for calculation of plant-specific equipment failure data are determined in SAAG 492 by estimating the number of demands, run hours, or exposure hours for each component in the PRA. Each PRA system analyst reviewed each basic event in their system to determine the average annual number of demands, or the average number of operating hours or exposure hours for each component. However, ot~er than some very brief analyst comments, This is a documentation issue that does not impact the PRA model. In additioh, any minor changes to the random failure rates of components is not significant in the risk evaluations. There Page 123of198

54003-CALC-02 SR DA-C9 2009 ASME/ANS Cat II Requirement ESTIMATE operational time from surveillance test practices for standby components, and from actual operational data.

Revision 3 Status Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation F&O DA-02: Some of the generic data from SAR OS is quite dated, including WASH-1400, NUREG/CR-2815, Zion PRA, and NUREG/CR-4550. More recent generic data should be pursued. Component failures should be defined such that they encompass only those failures that would disable the component over the PRA mission time. It appears that this has not been considered.

Specific examples of less than adequate reliability data characterization were identified through review of Tables 1 and 3 in SAAG-655, Catawba PRA Rev.

3 Failure Rate and Maintenance Unavailability Data.

First, repeat events in a short duration, where there was insufficient component repair should be counted as one event. An example is PIP nos. 2-C97-2481 and 2-C97-2637 on 7/29/97 and 8/12/97 for incoming breaker 2CXl-5C. The first failure occurred "for no apparent reason", but the second failure was attributed to a failed relay. The first event should be omitted as a component failure as the component was left in the degraded condition.

Second, component degradation that results in failure to meet normal criteria (e.g., to avoid component life degradation), may not impact the component mission for the PRA. For example, PIP no. O-C98-2057 involved a 6/7/98 event for trouble alarms for VI compressor F, and the compressor motor was found smoking. The evaluation addressed concern with overheating and insulation breakdown, but did not address whether run to failure would survive PRA mission. Similar pump failures due to routine vibration testing exceeding limits were found (LPR 28 & 1A, WO 93020502 &

PIP 1-C93-1124).

Disposition there is no documented basis for the estimates provided and no determination of the time components are configured in standby. The documentation should be revised to clearly indicate how the time components are configured in their standby status is determined.

The Workplace Procedure for Developing PRA Data (XSAA-110) specifies that equipment demands are counted based on actual operating experience, surveillance tests, preventive maintenance tests and unplanned demands. The denominators for calculation of plant-specific equipment failure data are determined in SAAG 492 by estimating the number of demands, run hours, or exposure hours for each component in the PRA. Each PRA system analyst reviewed each basic event in their system to determine the average annual number of demands, or the average number of operating hours or exposure hours for each component. Other than some very brief analyst comments, there is no documented basis for the estimates provided and no relationship shown between the surveillance test practices and operational data and the values in the denominator notebook. The documentation should be revised to clearly indicate the relationship between the surveillance test practices and operational data and the values in the denominator notebook.

The 2009 ASME/ANS Cat II requirements for DA-C9 were evaluated under NEI technical elements DA-4, DA-6, and DA-7 in the 2002 Catawba Peer Review. The peer review team assigned PSA grade of 3 to DA-7. DA-4 was assigned a PSA grade of 3 contingent on resolution of Level B F&Os DA-02 and DA-06. Element DA-6 was found to be not applicable to CNS.

F&O DA-02 is related to generic data sources; see SR DA-C1 for disposition. F&O DA-02 remains open and is tracked as open item C-03-0057. F&O DA-06 concerns MOV rupture error factors; see SR DA-D3 for disposition.

Impact on ILRT Extension is negligible impact to the ILRT extension.

This is a documentation issue that does not impact the PRA model. In addition, any minor changes to the random failure rates of components is not significant in the risk evaluations. Fire risk is dominated by fire impacts. There is negligible impact to the ILRT extension.

Page 124of198

54003-CALC-02 SR DA-C10 2009 ASME/ANS Cat II Requirement When using surveillance test data, REVIEW the test procedure to determine whether a test should be credited for each possible failure Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Status Finding/Observation F&O DA-06; In SAAG 342, there is development of a failure probability for the rupture of an MOV. The type code for this event is MVR. This type code is used in the calculation of the ISLOCA frequency.

In the SAROS database, this distribution is composed of three equally weighted distributions.

The three distributions have error factors of close to 10.0. The error factor assigned to MVR is -2.6.

This is impossible - the error factor should be close to ten. The following provides additional explanation of this issue.

Often it is useful to develop a distribution based on combining several distributions. That is f(A) = Li wi fi(A}, i =1... n. Such an operation often does not possess a closed solution and Monte Carlo (MC) simulations are required. However, care must be taken in implementing the MC solution. People are often tempted to set up a MC process where one iteration for I is based on taking samples from the weighted sum of samples from each of the fi(A)'s.

This is incorrect. This, in effect, loses data and results in a unimodal function. In the case of two equally weighted functions A and B where every point on A is less than any point on B, the lower points of A and the higher points of B would not be in the resulting distribution. While the mean is preserved, the variance is understated and is incorrect. The proper method is to obtain samples for A, weight them, and put them in a pool. Then obtain samples for B, weight them, and put them in the pool. The points in the pool are MC distribution and, in this case, would be bi-modal. Note that page 5-38 of NUREG/CR-2300 uses the above equation and notes that it may produce a non-unimodal distribution.

Dispositioned None Disposition The scope of NEI 00-02 did not address this supporting requirement.

The Workplace Procedure for Developing PRA Data (XSAA-110) specifies that equipment demands are counted based on actual operating experience, surveillance tests, preventive maintenance Impact on ILRT Extension Based on the disposition, the CNS PRA model meets the requirements of Cat II for this SR. In addition, any Page 125of198

54003-CALC-02 SR DA-C11 DA-C12 2009 ASME/ANS Cat II Requirement mode. COUNT only completed tests or unplanned operational demands as success for component operation. If the component failure mode is decomposed into sub-elements (or causes) that are fully tested, then USE tests that exercise specific sub-elements in their evaluation. Thus, one sub-element sometimes has many more successes than another. [Example:

a diesel generator is tested more frequently than the load sequencer.

IF the sequencer were to be included in the diesel generator boundary, the number of valid tests would be significantly decreased.]

When using data on maintenance and testing durations to estimate unavailabilities at the component, train, or system level, as required by the system model, only INCLUDE those maintenance or test activities that could leave the component, train, or system unable to perform its function when demanded.

When an unavailability of a front line system component is caused by an unavailability of a support system, COUNT the unavailability towards that of the support system and not the front line system, in order to avoid double counting and to capture the support system dependency properly.

Revision 3 Status Open Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation None None Disposition tests and unplanned demands. The denominators for calculation of plant-specific equipment failure data are determined in SAAG 492 by estimating the number of demands, run hours, or exposure hours for each component in the PRA.

The scope of NEI 00-02 did not address this supporting requirement.

The plant-specific equipment failure data collected is captured in Maintenance Rule Experience Documents thru 2005 (SAAG 866).

Plant-specific unavailabilities are presented for about 25 component/trains. The unavailability data is based on that collected for performance reporting for INPO. Unavailabilities are listed in the system notebooks, however the basis for these unavailability values is not provided (only a list or summary description of applicable maintenance practices or procedures is provided). The documentation should be revised to provide a clearer basis for the unavailability values.

The scope of NEI 00-02 did not address this supporting requirement.

The plant-specific equipment failure data collected is captured in Maintenance Rule Experience Documents thru 2005 (SAAG 866).

Plant-specific unavailabilities are presented for about 25 component/trains. The unavailability data is based on that collected for performance reporting for INPO. Unavailabilities are listed in the system notebooks, the basis for these unavailability values is not provided (only a list or summary description of applicable maintenance practices or procedures is provided). The documentation should be revised to provide a clearer basis for the unavailability values.

Impact on ILRT Extension minor changes to the unavailability of the components is not significant in the risk evaluations There is negligible impact to the ILRT extension.

This is a documentation issue that does not impact the PRA model. In addition, any minor changes to the unavailability of components is not significant in the risk evaluations. There is negligible impact to the ILRT extension.

Page 126of198

54003-CALC-02 SR DA-C13 DA-C14 2009 ASME/ANS Cat II Requirement EVALUATE the duration of the actual time that the equipment was unavailable for each contributing activity. Since maintenance outages are a function of the plant status, INCLUDE only outages occurring during plant at power.

Special attention should be paid to the case of a multi-plant site with shared systems, when the Specifications (TS) requirements can be different depending on the status of both plants. Accurate modeling generally leads to a particular allocation of outage data among basic events to take this mode dependence into account. In the case that reliable estimates or the start and finish times are not available, INTERVIEW the knowledgeable plant personnel (e.g., engineering, plant operations, etc.) to generate estimates of ranges in the unavailable time per maintenance act for components, trains, or systems for which the unavailabilities are significant basic events.

EXAMINE coincident unavailability due to maintenance for redundant equipment (both intrasystem and intersystem) that is a result of a planned, repetitive activity based on actual plant experience.

CALCULATE coincident maintenance unavailabilities that are a result of a planned, repetitive activity that reflect actual plant experience. Such coincident maintenance unavailability can Revision 3 Status Open Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation None F&O DA-05: The unavailabilities computed for the basic events for PORV block valve closure, RNC031 BDEX, 033ADEX, and 035BDEX, assume that each PORV is closed one week per quarter.

However, there is no history of PORV closures for any extended period of time in the last few years.

While this does use plant-specific data, the benefit derived from it is limited due to the highly conservative assumption regarding PORV out of service time.

Disposition The scope of NEI 00-02 did not address this supporting requirement.

The plant-specific equipment failure data collected is captured in Maintenance Rule Experience Documents thru 2005 (SAAG 866).

Plant-specific unavailabilities are presented for about 25 component/trains. The unavailability data is based on that collected for performance reporting for INPO. There is no documentation of the duration due to each contributing activity or of the treatment for shared components. In addition, the unavailabilities for the remaining systems are either based on screening values or left to be calculated by the system analyst. The documentation should be revised to provide a clearer basis for the unavailability values.

The scope of NEI 00-02 did not address this supporting requirement.

However, level "B" F&O DA-05 is considered to be most closely related to SR DA-C14. Maintenance restrictions imposed by the Tech.

Specs. or the Maintenance Rule a(4) program are addressed by the model solution process as follows. The maintenance basic events are generally treated as independent within the PRA model. After the model is solved, cut sets involving coincident maintenance are deleted where such combinations are prohibited by the technical specifications, as documented in the model integration notebook. Cut sets involving coincident maintenance combinations allowed by the technical specifications but prohibited by the on line risk assessment tool are retained, but have their probability reduced.

Impact on ILRT Extension This is a documentation issue that does not impact the PRA model. In addition, any minor changes to the unavailability of components is not significant in the risk evaluations. There is negligible impact to the ILRT extension.

Based on the disposition, the CNS PRA model meets the requirements of Cat II for this SR. In addition, any minor changes to the unavailability of components is not significant in the risk evaluations. There is negligible impact to the ILRT extension.

Page 127 of 198

54003-CALC-02 SR DA-C16 2009 ASME/ANS Cat II Requirement arise, for example, for plant systems that have "installed spares" (i.e., plant systems that have more redundancy than is addressed by tech specs). For example (intrasystem case), the charging system in some plants has a third train that may be out of service for extended periods of time coincident with one of the other trains and yet is in compliance with tech specs.

Examples of intersystem unavailability include plants that routinely take out multiple components on a "train schedule" (such as AFW train A and HPI train A at a PWR, or RHR train A and LPCS train A at a BWR).

Data on recovery from loss of offsite power, loss of service water, etc.

are rare on a plant-specific basis. If available, for each recovery, COLLECT the associated recovery time with the recovery time being the period from identification of the system or function failure until the system or function is returned to service.

Revision 3 Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation F&O IE-04: The initiating event frequency for a stuck open PORV or safety valve is taken from NUREG/CR-5750 but is conservative for the following reasons. The NU REG assigned a value to these events based on a non-informative prior updated with o events and the total number of critical reactor years in the study. In the case of a spurious opening of a primary safety valve, the model should address the potential for the valve to close as the pressure decreased, effectively terminating the loss of coolant. The evaluation of the subsequent reclosure of the PORV is not as straightforward. The cause of the opening PORV would need to be addressed. However, either the PORV could be closed or the block valve could be closed.

F&O AS-01: SAAG 427 describes the A TWS event tree analysis. Section 4, event B, describes how main feedwater is recovered after an A TWS. The probabilities used for main feedwater recovery are

.05, following a T2 (Loss of Load) and.2 following a Disposition Maintenance tasks that require a component to be out of service are performed under the same work window. For example, a pump lubrication PM could be bundled with the PM for its supply breaker.

However, this type of maintenance coordination does not involve more than one train of equipment, and does not result in the plant taking on more risk.

From SAAG 655, F&O DA-05 was addressed by revising unavailabilities of PORV block valves to more realistic values.

Catawba uses the EPRI report, Losses of Off-Site Power at U.S.

Nuclear Power Plants Data, which includes the recovery time associated with each event. No plant specific recovery data is collected.

The 2009 ASME/ANS Cat II requirements for DA-C16 were evaluated under NEI technical elements IE-13, IE-15, IE-16, AS-16, DA-15, SY-24, and QU-18 in the 2002 Catawba Peer Review. Level B F&Os associated with these elements are F&O IE-04, AS-01, DA-05, and QU-05.

F &O I E-04 appears to be an observation of conservatism in usage of generic industry data for stuck open SRV and PORV initiating events and is judged to be applicable to I E-C 12. However, this treatment is judged to be appropriate and that this F&O does not apply to DA-C16.

F&O AS-01: Credit for Main Feedwater has been removed from the ATWS model, which resolves this F&O. Recovery for MFW in ATWS events initiated by a loss of feedwater has no impact on Fire PRA.

F&O DA-05 is related to specific component unavailabilities; see SR DA-C14 for disposition.

Impact on ILRT Extension There were no F&Os with "A" level of significance at CNS and there are no open Level B F&Os related to this SR. The CNS PRA model meets the requirements of Cat II for this SR. There is no impact to the ILRT extension.

Page 128of198

54003-CALC-02 SR Revision 3 2009 ASME/ANS Cat II Requirement Status Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation T4 (Loss of MFW). In the non-ATWS analysis, the following non-recoveries (From SAAG 427) are: T1 non-rec=.05, T 4 - non-rec =.1. Considering that the critical time for FW to come on line in an A TWS event involving a loss of main feedwater is very short, even for conditions of favorable MTC, the use of non-recovery probabilities of this magnitude does not appear to be justified without supporting analyses.

F&O DA-05: The unavailabilities computed for the basic events for PORV block valve closure, RNC031BDEX, 033ADEX, and 035BDEX, assume that each PORV is closed one week per quarter.

However, there is no history of PORV closures for any extended period of time in the last few years.

While this does use plant-specific data, the benefit derived from it is limited due to the highly conservative assumption regarding PORV out of service time.

F&O QU-05: Event NDORWSTDHE: This is a recovery action to terminate the NV and NI pumps in the event of failure of ND to provide recirculation after a SL. The event was quantified on the basis of tripping the pumps within 18 minutes. RWST refill was assumed to occur (from undescribed source) and pumps were restarted to continue injection.

This recovery event is applied to a) loss of KC pumps b) SNSDRNVLHE - drain plug blockage c) CCF of ND pumps.

The recovery event is intended to provide injection flow for the long term commensurate with the RWST make-up capability. The time of some of these failure is 20 minutes, when injection requirements are beyond the make-up capability of the RWST. Secondly, there are cutsets representing heat removal that cannot be recovered by continued injection of HHS!. The sequence needs continuous Disposition F&O QU-05: Event NDORWSTDHE has been redefined and failure probability recalculated for the Catawba Rev 3a PRA Model Integration Notebook.

Impact on ILRT Extension Page 129of198

54003-CALC-02 SR DA-D1 DA-D2 DA-D3 2009 ASME/ANS Cat II Requirement CALCULATE realistic parameter estimates for significant basic events based on relevant generic and plant-specific evidence unless it is justified that there are adequate plant-specific data to characterize the parameter value and its uncertainty. When it is necessary to combine evidence from generic and plant-specific data, USE a Bayes update process or equivalent statistical process that assigns appropriate weight to the statistical significance of the generic and plant-specific evidence and provides an appropriate characterization of uncertainty.

CHOOSE prior distributions as either noninformative, or representative of variability in industry data. CALCULATE parameter estimates for the remaining events by using generic Industry data.

If neither plant-specific data nor generic parameter estimates are available for the parameter associated with a specific basic event, USE data or estimates for the most similar equipment available, adjusting if necessary to account for differences.

Alternatively, USE expert judgment and document the rationale behind the choice of parameter values.

PROVIDE a mean value of, and a statistical representation of the Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Status Dispositioned Finding/Observation injection of HHSI and heat removal from containment.

F&O DA-OB: Another example of conservatism is the SBO following trip event, PACBOFTDEX. This event in the top 100 cutsets has a 1 E-3 probability, and has not been updated since the IPE.

Dispositioned None Open F&O DA-06: In SAAG 342, there is development of a failure probability for the rupture of an MOV. The Disposition NEI 00-02 does not address this supporting requirement. However, level "B" F&O DA-08 is considered to be most closely related to SR DA-D1. Calculation CNC-1535.00-00-0029 documents a Bayesian update of generic component failure data with plant-specific experience. Where plant-specific data is not available, the generic data is used. Generic data has been updated as documented in DPC-1535.00-00-0016. Actual component unavailability data is derived from Maintenance Rule unavailability data.

F&O DA-08: The ac power notebook documents the development of the current value, which is within an acceptable range, e.g. another Westinghouse plant uses 2.4E-3 for LOOP following general transient. This F&O is considered resolved.

NEI 00-02 does not address this supporting requirement. Use of multiple data sources provides a means to define sources for all generic failure data. If exception is taken, the departure is defined and the basis provided. The SSF diesel generator data is an example of a departure. No specific instances were identified in which neither generic or plant-specific data is not available.

Uncertainty distribution data has been calculated for all of the Bayesian-updated failure data. However, the data and CCF calcs Impact on ILRT Extension Based on the disposition, the CNS PRA model meets the requirements of Cat II for this SR. Any minor changes to the random failure rate of the components is not significant in the risk evaluations. There is negligible impact to the ILRT extension.

Based on the disposition, the CNS PRA model meets the requirements of Cat II for this SR. Any minor changes to the random failure rate of the components is not significant in the risk evaluations. There is negligible impact to the ILRT extension.

This is a documentation issue that does not impact Page 130of198

54003-CALC-02 SR DA-D4 2009 ASME/ANS Cat II Requirement uncertainty intervals for, the parameter estimates of significant basic events. Acceptable systematic methods include Bayesian updating, frequentist method, or expert judgment.

When the Bayesian approach is used to derive a distribution and mean value of a parameter, CHECK that the posterior distribution is reasonable given the relative weight of evidence provided by the prior Revision 3 Status Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation type code for this event is MVR. This type code is used in the calculation of the ISLOCA frequency.

In the SAROS database, this distribution is composed of three equally weighted distributions.

The three distributions have error factors of close to 10.0. The error factor assigned to MVR is -2.6.

This is impossible - the error factor should be close to ten. The following provides additional explanation of this issue.

Often it is useful to develop a distribution based on combining several distributions. That is f(A} = ~i wi fi(A), i =1... n. Such an operation often does not possess a closed solution and Monte Carlo (MC) simulations are required. However, care must be taken in implementing the MC solution. People are often tempted to set up a MC process where one iteration for I is based on taking samples from the weighted sum of samples from each of the fi(A)'s.

This is incorrect. This, in effect, loses data and results in a unimodal function. In the case of two equally weighted functions A and B where every point on A is less than any point on B, the lower points of A and the higher points of B would not be in the resulting distribution. While the mean is preserved, the variance is understated and is incorrect. The proper method is to obtain samples for A, weight them, and put them in a pool. Then obtain samples for B, weight them, and put them in the pool. The points in the pool are MC distribution and, in this case, would be bi-modal. Note that page 5-38 of NUREG/CR-2300 uses the above equation and notes that it may produce a non-unimodal distribution.

None Disposition (CNC-1535.00-00-0029 and CNC-1535.00-00-0028) do not document the error factors to be used for maintenance unavailability and CCF events. A review of the CAFTA database indicates that maintenance unavailability events have been assigned an error factor of 3 and CCFs have been assigned an error factor of 1 o. However, no basis for the use of these error factors is provided. Documentation should be revised to provide the basis for error factors.

NE! 00-02 does not address this supporting requirement under the DA technical element; it is only partially addressed under QU-30, which was assigned a PSA grade of 3 by the 2002 CNS peer review team.

However, F&O DA-06, issued at the 2002 Catawba peer review is most closely aligned with this SR.

F&O DA-06: As noted in revision 1 to CNC-1535.00-00-0029, type code MVR error factor value was revised to 6.5, and Bayesian Mean was revised from 4.28E-08 to 4.08E-08, based on MVR generic ER =

6.

NEI 00-02 does not address this supporting requirement. There is no evidence in the documentation that the specific checks required by this SR have been performed on the Bayesian-updated data to ensure that the data is appropriate. However, a verification of the proper operation of the software within the expected data range (item d of the SR) was performed. A quick review of the current data did not Impact on ILRT Extension the PRA model. In addition, any minor changes to the uncertainty distributions of component failure rates is not significant in the risk evaluations. There is negligible impact to the ILRT extension.

This is a documentation issue that does not impact the PRA model. Any minor changes to the random failure rates of components is not significant in the risk Page 131 of 198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement and the plant-specific data.

Examples of tests to ensure that the updating is accomplished correctly and that the generic parameter estimates are consistent with the plant-specific application include the following:

(a) confirmation that the Bayesian updating does not produce a posterior distribution with a single bin histogram (b) examination of the cause of any unusual (e.g., multimodal) posterior distribution shapes (c) examination of inconsistencies between the prior distribution and the plant-specific evidence to confirm that they are appropriate (d) confirmation that the Bayesian updating algorithm provides meaningful results over the range of values being considered (e) confirmation of the reasonableness of the posterior distribution mean value OA-05 USE one of the following models for estimating CCF parameters for significant CCF basic events:

(a) Alpha Factor Model (b) Basic Parameter Model (c) Multiple Greek Letter Model Revision 3 Status Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation None Disposition reveal any unusual or unexpected results. Documentation should be revised to provide the basis for error factors.

The 2009 ASME/ANS Cat II requirements for OA-05 were partially evaluated under NEI technical elements OA-8 thru OA-14 in the 2002 Catawba Peer Review. The peer review team assigned PSA grade of 3 to OA-8 thru OA-12. OA-13 and OA-14 were found to be not applicable. F&O OA-09 is related to element OA-12, which is Level "C" and is not addressed.

The CNS PRA uses a "modified" MGL method as documented in CNC-1535.00-00-0028 (SAAG 670). In lieu of incorporating separate events for various combinations of 2 failures, 3 failures, etc., a set of Impact on ILRT Extension evaluations. There is negligible impact to the ILRT extension.

The CNS PRA uses a "modified" MGL method.

This is a documentation issue that does not impact the PRA model. There is negligible impact to the ILRT extension.

Page 132of198

54003-CALC-02 SR DA-D6 2009 ASME/ANS Cat II Requirement (d) Binomial Failure Rate Model JUSTIFY the use of alternative methods (i.e., provide evidence of peer review or verification of the method that demonstrates its acceptability).

USE generic common cause failure probabilities consistent with available plant experience.

EVALUATE the common cause failure probabilities in a manner consistent with the component boundaries DA-DB If modifications to plant design or operating practice lead to a condition where past data are no longer representative of current performance, LIMIT the use of old data:

(a) If the modification involves new equipment or a practice where generic parameter estimates are available, USE the generic parameter estimates updated with plant-specific data as it becomes available for significant basic events; or (b) If the modification is unique to the extent that generic parameter estimates are not available and only limited experience is available following the change, then Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Status Finding/Observation Open None Dispositioned None Disposition combined CCF probability events are developed that include the relevant combinations of CCF failures that could impact system function. The approach appears reasonable. Generic estimates for error factors are used for the common cause events. However, the documentation for the selection of specific error factors used is not included in the CCF analysis.

The 2009 ASME/ANS Cat II requirements for DA-06 were partially evaluated under NE! technical elements DA-B thru DA-14 in the 2002 Catawba Peer Review. The peer review team assigned PSA.grade of 3 to DA-B thru DA-12. DA-13 and DA-14 were found to be not applicable. F&O DA-09 is related to element DA-12, which is Level "C" and is not addressed Plant-specific CCF failure documentation (CNC-1535.00-00-0028) was reviewed to ensure that the generic CCF probabilities are consistent with plant experience and component boundaries, although the CCF documentation needs to be enhanced to discuss component boundaries. However, there is no impact on the PRA [Reference 60].

NE! 00-02 does not address this supporting requirement. The referenced data analyses consider the applicability of the data. As noted in DPC-1535.00-00-0016, in most instances, a generic industry value and Catawba-specific experience are combined using a Bayesian update. In addition, Catawba has a living PRA database program (PRA Tracker) to provide the means for formal documentation, tracking and resolution of any potential changes to the PRA based on plant modifications, discovered errors or industry information. When an issue is identified that calls into question some aspect of the PRA model or related analysis, or if during the review of a site design change package some issue is identified, the issue is entered into the PRA Tracker program, and tracked to closure.

Impact on ILRT Extension CCF probabilities are consistent with plant experience and component boundaries, although the CCF documentation needs to be enhanced to discuss component boundaries.

However, there is no impact on the PRA [Reference 60].

Therefore, there is no impact to the I LRT extension.

Based on disposition, the CNS PRA model meets the requirements of Cat II for this SR. There is no impact to the ILRT extension.

Page 133 of 198

54003-CALC-02 SR DA-E1 2009 ASME/ANS Cat II Requirement ANALYZE the impact of the change and assess the hypothetical effect on the historical data to determine to what extent the data can be used.

DOCUMENT the data analysis in a manner that facilitates PRA applications, upgrades, and peer review.

Revision 3 Status Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation F&O DA-01: Workplace Procedure XSAA-110 is the primary data gathering procedure. It is supplemented by SAAG-655, Catawba PRA Revision 3 Failure Rate And Maintenance Unavailability Data, and SAAG-670, the CCF analysis report. Also, noteworthy is attachment 3, which includes the CCF checklist. Additional details are provided by SAAG File 579 (Rev. 2b Summary Report) and the Rev 2 Summary Report.

The data guidance is generally adequate; however it does not address component boundaries.

Component boundaries are apparent from the data as in the specific example in F&O DA-02, i.e., the incoming breaker and panelboard BLF. However, these should be defined in the guidance.

F&O DA-06: In SAAG 342, there is development of a failure probability for the rupture of an MOV. The type code for this event is MVR. This type code is used in the calculation of the ISLOCA frequency.

In the SAROS database, this distribution is composed of three equally weighted distributions.

The three distributions have error factors of close to 10.0. The error factor assigned ta MVR is -2.6.

This is impassible - the error factor should be close to ten. The following provides additional explanation of this issue.

Often it is useful to develop a distribution based on combining several distributions. That is f(ll) = Li wi fi(ll), i =1... n. Such an operation often does not possess a closed solution and Mante Carla (MC) simulations are required. However, care must be taken in implementing the MC solution. People are often tempted to set up a MC process where one Disposition The data analysis is appropriately documented in a manner that facilitates PRA applications, upgrades, and peer review, except as noted by the assessment comments and recommendations of other DA supporting requirements.

The 2009 ASME/ANS Cat II requirements for DA-E1 were evaluated under NEI technical elements DA-1, DA-19 and DA-20 in the 2002 Catawba Peer Review. The peer review team assigned PSA grade of 3 to DA-19 and 20. DA-1 was assigned a PSA grade of 3 contingent on resolution of F&Os DA-01 and DA-06.

F&O DA-01 was addressed in the referenced generic database development. Specifically, component boundaries are defined, time-dependent events for components such as motor-operated valves and check valves are developed, restrictions on the use of demand failures are provided, and data for standby vs. alternating and clean vs. water components are developed.

F&O DA-06: As noted in revision 1 ta CNC-1535.00-00-0029, type code MVR error factor value was revised to 6.5, and Bayesian Mean was revised from 4.28E-08 to 4.0BE-08, based on MVR generic ER =

6.

Impact on ILRT Extension Based an the disposition, the CNS PRA model meets the requirements of Cat JI far this documentation SR; however, there is a documentation issue that does not impact the PRA model. There is no impact to the ILRT extension.

Page 134of198

54003-CALC-02 SR DA-E2 2009 ASME/ANS Cat II Requirement DOCUMENT the processes used for data parameter definition, grouping, and collection including parameter selection and estimation, including the inputs, methods, and results. For example, this documentation typically includes (a) system and component boundaries used to establish component failure probabilities (b) the model used to evaluate each basic event probability (c) sources for generic parameter estimates (d) the plant-specific sources of data (e) the time periods for which plant-specific data were gathered Revision 3 Status Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation iteration for I is based on taking samples from the weighted sum of samples from each of the fi(A)'s.

This is incorrect. This, in effect, loses data and results in a unimodal function. In the case of two equally weighted functions A and B where every point on A is less than any point on B, the lower points of A and the higher points of B would not be in the resulting distribution. While the mean is preserved, the variance is understated and is incorrect. The proper method is to obtain samples for A, weight them, and put them in a pool. Then obtain samples for B, weight them, and put them in the pool. The points in the pool are MC distribution and, in this case, would be bi-modal. Note that page 5-38 of NUREG/CR-2300 uses the above equation and notes that it may produce a non-unimodal distribution.

F&O DA-01: Workplace Procedure XSAA-110 is the primary data gathering procedure. It is supplemented by SAAG-655, Catawba PRA Revision 3 Failure Rate And Maintenance Unavailability Data, and SAAG-670, the CCF analysis report. Also, noteworthy is attachment 3, which includes the CCF checklist. Additional details are provided by SAAG File 579 (Rev. 2b Summary Report) and the Rev 2 Summary Report.

The data guidance is generally adequate; however it does not address component boundaries.

Component boundaries are apparent from the data as in the specific example in F&O DA-02, i.e., the incoming breaker and panelboard BLF. However, these should be defined in the guidance.

F&O DA-06: In SAAG 342, there is development of a failure probability for the rupture of an MOV. The type code for this event is MVR. This type code is used in the calculation of the ISLOCA frequency.

In the SAROS database, this distribution is composed of three equally weighted distributions.

The three distributions have error factors of close to Disposition The existing data documentation provided in CNC-1535.00-00-0028 and CNC-1535.00-00-0029 address most, but not all, of the specific items noted in this SR. More documentation needs to be added to discuss the exclusion of plant-specific data (e.g., pre-Maintenance Rule data), and the development of uncertainty estimates for Maintenance unavailability and CCF events.

The 2009 ASME/ANS Cat II requirements for DA-E1 were evaluated under NEI technical elements DA-1, DA-19 and DA-20 in the 2002 Catawba Peer Review. The peer review team assigned PSA grade of 3 to DA-19 and 20. DA-1 was assigned a PSA grade of 3 contingent on resolution of F&Os DA-01 and DA-06.

F&O DA-01 was addressed in the referenced generic database development. Specifically, component boundaries are defined, time-dependent events for components such as motor-operated valves and check valves are developed, restrictions on the use of demand failures are provided, and data for standby vs. alternating and clean vs. water components are developed.

F&O DA-06: As noted in revision 1 to CNC-1535.00-00-0029, type code MVR error factor value was revised to 6.5, and Bayesian Mean Impact on ILRT Extension Based on the disposition, the CNS PRA model meets the requirements of Cat II for this SR. There is no impact to the I LRT extension.

Page 135of198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement (f) justification for exclusion of any data (g) the basis for the estimates of common cause failure probabilities, including justification for screening or mapping of generic and plant-specific data (h) the rationale for any distributions used as priors for Bayesian updates, where applicable (i) parameter estimate including the characterization of uncertainty, as appropriate.

DA-E3 DOCUMENT the sources of model uncertainty and related assumptions (as identified in QU-E1 and QU-E2) associated with the data analysis.

QU-A2 PROVIDE estimates of the individual sequences in a manner consistent with the estimation of Revision 3 Status Open Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation 1 o.o. The error factor assigned to MVR is -2.6.

This is impossible - the error factor should be close to ten. The following provides additional explanation of this issue.

Often it is useful to develop a distribution based on combining several distributions. That is f(,\\) = Li wi fi(A), i =1... n. Such an operation often does not possess a closed solution and Monte Carlo (MC) simulations are required. However, care must be taken in implementing the MC solution. People are often tempted to set up a MC process where one iteration for I is based on taking samples from the weighted sum of samples from each of the fi(A)'s.

This is incorrect. This, in effect, loses data and results in a unimodal function. In the case of two equally weighted functions A and B where every point on A is less than any point on B, the lower points of A and the higher points of B would not be in the resulting distribution. While the mean is preserved, the variance is understated and is incorrect. The proper method is to obtain samples for A, weight them, and put them in a pool. Then obtain samples for B, weight them, and put them in the pool. The points in the pool are MC distribution and, in this case, would be bi-modal. Note that page 5-38 of NUREG/CR-2300 uses the above equation and notes that it may produce a non-unimodal distribution.

None F&O QU-12: The Conditional core damage Probability of several Initiators from the CR2b results were evaluated. The results are:

Disposition was revised from 4.28E-08 to 4.08E-08, based on MVR generic ER =

6.

NEI 00-02 does not address this supporting requirement under the DA technical element; it is only partially addressed under QU technical element. The methodology, search and rationale are included in the documentation in order to support the prior supporting requirements.

The data selection meets the intent by not deviating from the accepted consensus values for failure rates which is consistent with guidance document. However, The data analysis calculations, do not explicitly include an "Assumptions" section.

The NEI SR applicable to-this ASME SR is QU-8, and there are no industry self-assessment actions and no NRC objections. The original Peer Review rated this NEI SR as "3 with contingencies", with Impact on ILRT Extension The disposition identifies a documentation issue that does not impact the PRA model. There is no impact to the ILRT extension.

There is no impact to the ILRT extension.

Page 136of198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement total CDF to identify significant accident sequences/cutsets and confirm the logic is appropriately reflected. The estimates may be accomplished by using either fault tree linking or event trees with conditional split fractions.

QU-A3 ESTIMATE the mean GDF accounting for the "state-of-knowledge" correlation between event probabilities when significant

[Note (1)).

QU-A4 SELECT a method that is capable of discriminating the contributors to the GDF commensurate with the level of detail in the model.

Revision 3 Status Dispositioned Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation 8.3DE-D3 Loss Of RN 8.38E-D3 Loss Of KC 5.D4E-03 Small LOCA 2.30E-04 Secondary Line Break Inside Containment 5.47E-05 LOOP 1.24E-05 Inadvertent SS Actuation 1.24E-05 Loss Of Instrument Air 1.04E-05 Steamline Break Outside Containment 9.54E-06 FDW Line Break Outside Containment 2.26E-06 Loss Of Main Feedwater 2.89E-06 SGTR

7. 75E-07 Loss Of Load 5.01 E-07 Reactor Trip These results show a discrepancy between Small LOCA and SGTR that is not consistent with what is normally seen in PRAs in the industry. The CCDP for small LOCA and SGTR are usually in the same order of magnitude because the initiators have similar mitigation functions such as safety injection, secondary side heat removal, primary caoldown and depressurizatian, and long term injection if caoldown and depressurizatian are not successful.

A difference of 3 orders of magnitude is unusual.

Also, the CCDP value far the Loss of Instrument Air probability is identical to the Inadvertent SS Actuation probability (to 3 significant figures), which seemed surprising.

None F&O QU-12: The Conditional core damage Probability of several Initiators from the CR2b results were evaluated. The results are:

8.30E-03 Loss Of RN 8.38E-03 Loss Of KC Disposition associated level "B" F&O QU-12.

F&O QU-12: The Catawba PRA has updated the small LOCA (SL) initiator to be redefined to only include small pipe breaks. The SL and SGTR initiating event frequencies are found in the CNS U1&2 internal initiator events frequency data notebook. This is considered to resolve the finding.

The Catawba PRA model consists of a top logic fault tree that links the fault tree models for the frontline and support systems, and is solved to produce an overall GDF and LERF. Results for individual accident sequences are not calculated, although individual cutsets are provided in order to review the overall model logic. This ASME SR is considered still open.

There are no NEI SRs applicable to this ASME SR.

An uncertainty analysis is performed for both CDF and LERF to estimate the mean values from internal and external (excluding seismic) events. The analysis is described in the Catawba Rev 3a PRA Madel Integration Notebook. A correlation factor has been developed and is used to apply a multiplier ta those IS LO CA cut sets having two MVR or CVR type code events in the same cut set.

The NEI SRs applicable to this ASME SR are QU-4, QU-8, QU-9, QU-10, QU-11, QU-12, and QU-13, and there are no industry self-assessment actions and no NRG objections. The original Peer Review rated QU-4, QU-9, QU-10 and QU-12 as "3" and QU-8 and QU-11 as "3 with contingencies." QU-8 has one level "B" F&O: QU-Impact on ILRT Extension The Catawba PRA model consists of a top logic fault tree that links the fault tree models for the frontline and support systems, and is solved to produce an overall CDF and LERF. Results for individual accident sequences are not calculated, although individual cutsets are provided in order ta review the overall model logic. This ASME SR is considered still open. However, this has no impact an the results of the ILRT extension.

Based on the disposition, the requirements of Cat II are considered met. There is no impact to the ILRT extension.

Based an the disposition, this SR is considered met.

There is no impact to the ILRT extension.

Page 137of198

54003-CALC-02 SR Revision 3 2009 ASME/ANS Cat II Requirement Status Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation 5.04E-03 Small LOCA 2.30E-04 Secondary Line Break Inside Containment 5.47E-05 LOOP 1.24E-05 Inadvertent SS Actuation 1.24E-05 Loss Of Instrument Air 1.04E-05 Steamline Break Outside Containment 9.54E-06 FDW Line Break Outside Containment 2.26E-06 Loss Of Main Feedwater 2.89E-06 SGTR 7.75E-07 Loss Of Load 5.01 E-07 Reactor Trip These results show a discrepancy between Small LOCA and SGTR that is not consistent with what is normally seen in PRAs in the industry. The CCDP for small LOCA and SGTR are usually in the same order of magnitude because the initiators have similar mitigation functions such as safety injection, secondary side heat removal, primary cooldown and depressurization, and long term injection if cooldown and depressurization are not successful.

A difference of 3 orders of magnitude is unusual.

Also, the CCDP value for the Loss of Instrument Air probability is identical to the Inadvertent SS Actuation probability (to 3 significant figures), which seemed surprising.

QU-02: The IE's for certain support system failures (RN, KC) are not input in the top event logic as a Boolean equation, but rather as a point estimate whose value is derived by solution of the IE fault tree.

However, failures that cause the IE may also affect the mitigating system, such that there is a dependency between the initiating event and the available mitigation. Examples are an electrical bus that failed one train of KC and could fail one train of mitigating equipment. Another example is the operator error in the Joss of KC to start the standby train of KC (KKCSTNBDHE). The HRA notebook Disposition 12; and QU-11 has one level "B" F&O: QU-02.

F&O QU-12: The Catawba PRA has updated the small LOCA (SL) initiator to be redefined to only include small pipe breaks. The SL and SGTR initiating event frequencies are found in the CNS U1 &2 internal initiator events frequency data notebook. This is considered to resolve the finding F&O QU-02: System level initiators represented as fully developed sub-tree structures are not in the Rev 3 model. Duke Energy feels that it is acceptable to not develop system level initiators as long as a review for dependencies takes place in the cut set file. This process has been proceduralized and is contained in Section 4 of Workplace Guideline XSAA-103, Guidelines For Determining Risk Significance.

The Catawba PRA model consists of a top logic fault tree that links the fault tree models for the fron!Jine and support systems, and is solved to produce an overall GDF and LERF. The results produced include individual cutsets (consisting of basic event combinations) that are provided in order to determine the significant and non-significant contributors to CDF. The CNS self-assessment considered this SR met.

Impact on ILRT Extension Page 138of198

54003-CALC-02 SR QU-A5 2009 ASME/ANS Cat II Requirement INCLUDE recovery actions in the quantification process in applicable sequences and cut sets (see HR-H 1, HR-H2, and HR-H3).

QU-82 TRUNCATE accident sequences and associated system models at a sufficiently low cutoff value that dependencies associated with Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Status Dispositioned Finding/Observation states this event has dependencies with HYD8ACKDHE.

F&O QU-05: Event NDaRWSTDHE: This is a recovery action to terminate the NV and NI pumps in the event of failure of ND to provide recirculation after a SL. The event was quantified on the basis of tripping the pumps within 18 minutes. RWST refill was assumed to occur (from undescribed source) and pumps were restarted to continue injection.

This recovery event is applied to a) loss of KC pumps b) SNSDRNVLHE - drain plug blockage c) CCF of ND pumps.

The recovery event is intended to provide injection flow for the long term commensurate with the RWST make-up capability. The time of some of these failure is 2a minutes, when injection requirements are beyond the make-up capability of the RWST. Secondly, there are cutsets representing heat removal that cannot be recovered by continued injection of HHSI. The sequence needs continuous injection of HHSI and heat removal from containment.

F&O QU-a8: Documentation of mutually exclusive events is limited to the text file, cr2b rul.txt.

The rule recovery file allows different numbers of max recoveries depending on the combinations in question.

There is no documentation regarding how the max recoveries were established for each set of events.

Examples of the content of the file are D8LMAINT, DELSEQ, and NSHEATEX, which function as recoveries set to a.a Note that this applies to recovery events as well as deleted combinations.

Dispositioned F&O QU-a1: The truncation limit of the baseline CDF at 1 E-9 is not low enough to defend convergence toward a stable result. This is shown on page 12 of SAAG-579. Use of the 1 E-9 Disposition The NEI SRs applicable to this ASME SR are QU-18 and QU-19, and there are no industry self-assessment actions and no NRG objections.

The original Peer Review rated QU-18 as "3" and QU-19 as "3 with contingencies," with associated level "8" F&Os QU-a5 and QU-a8, respectively.

Catawba Rev 3a PRA Model Integration Notebook describes the general recovery rules development and describes development of the recovery rules to address dependencies among HEP combinations. Some comments are included in the general rule files to describe the basis for the included recovery rules and the HRA documentation includes a spreadsheet which determines HEP dependencies and the associated recoveries needed.

F&O QU-a5: Event NDORWSTDHE has been redefined and failure probability recalculated for the Catawba Rev 3a PRA Model Integration Notebook.

F&O QU-a8 is tied to the corresponding NEI SR QU-19.The F&O applies to SR QU-88 and is not evaluated against SR QU-A4.

The NEI SRs applicable to this ASME SR are QU-21, QU-22, QU-23, and QU-24, and there are no NRG objections. There is an industry action to confirm that this requirement is met. The original Peer Review rated QU-21, QU-22 and QU-23 as "3" and QU-24 as "3 with Impact on ILRT Extension There were no F&Os with

'A" level of significance at CNS and there are no remaining open level "B" F&Os related to this SR.

There is no impact on the ILRT extension.

There were no F&Os with "A" level of significance at CNS and there are no remaining open level "8" Page 139 of 198

54003-CALC-02 SR QU-83 QU-86 2009 ASME/ANS Cat II Requirement significant cutsets or accident sequences are not eliminated.

NOTE: Truncation should be carefully assessed in cases where cutsets are merged to create a solution (e.g., where system level cutsets are merged to create sequence level cutsets).

ESTABLISH truncation limits by an iterative process of demonstrating that the overall model results converge and that no significant accident sequences are inadvertently eliminated. For example, convergence can be considered sufficient when successive reductions in truncation value of one decade result in decreasing changes in COF or LERF, and the final change is less than 5%.

ACCOUNT for system successes in addition to system failures in the evaluation of accident sequences to the extent needed for realistic estimation of COF. This accounting may be accomplished by using numerical quantification of success probability, complementary logic, or a delete term approximation and includes the treatment of transfers among event trees where the Revision 3 Status Oispositioned Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation truncation limit yields 4485 cutsets, while the 1E-10 truncation limit yields 31512 cutsets. Thus, although the PRA runs using 1 E-9 are capturing about 85% of the COF predicted with a cutoff of 1 E-10, they are capturing only 13% of the cutsets using the 1 E-1 O truncation limit.

F&O QU-01: The truncation limit of the baseline COF at 1 E-9 is not low enough to defend convergence toward a stable result. This is shown on page 12 of SAAG-579. Use of the 1 E-9 truncation limit yields 4485 cutsets, while the 1E-10 truncation limit yields 31512 cutsets. Thus, although the PRA runs using 1 E-9 are capturing about 85% of the COF predicted with a cutoff of 1 E-1 O, they are capturing only 13% of the cutsets using the 1E-10 truncation limit.

F&O AS-04: There were several observations on the modeling of event 03 in the SGTR tree:

Event 03 is generally defined as the event to cooldown to RHR conditions using 2/3 SG for depressurization. 03 includes the HEP YAGRCOLOHE, which is directed by ECA 3.1 and 3.2.

1. 03 is defined as "primary system coofdown via secondary system depressurization". Primary system depressurization must be accomplished in some sequences (Y010203, Y003, YU003), by either PORV, aux spray, or main spray. These functions are not included in 03.

Disposition contingencies." QU-24 has one level "B" F&O: QU-01.

F&O QU-01: Catawba Rev 3a PRA Model Integration Notebook documents that a truncation study was performed to calculate the truncation limit that would meet the criteria of being four orders of magnitude below the calculated baseline COF and captures 90% of the bounding COF risk and the percent change in increase in calculated COF should be less than 5% from the previous decade. A truncation limit of 5.0E-10 for COF (and 5.0E-11 for LERF) was calculated to meet the criteria. This is considered to resolve the finding and achieve grade 3 of NEI SR I meet CAT II of the ASME SR The NEI SRs applicable to this ASME SR are QU-21, QU-22, QU-23, and QU-24, and there are no NRC objections. There is an industry action to confirm that the final truncation limit is such that convergence toward a stable COF is achieved. The original Peer Review rated QU-21, QU-22 and QU-23 as "3" and QU-24 as "3 with contingencies." QU-24 ha one level "B" F&O: QU-01.

F&O QU-01: Catawba Rev 3a PRA Model Integration Notebook documents that a truncation study was performed to calculate the truncation limit that would meet the criteria of being four orders of magnitude below the calculated baseline COF and captures 90% of the bounding COF risk and the percent change in increase in calculated COF should be fess than 5% from the previous decade. A truncation limit of 5.0E-10 for COF (and 5.0E-11 for LERF) was calculated to meet the criteria. This is considered to resolve the finding and achieve grade 3 of NEI SR I meet CAT II of the ASME SR The NEI SRs applicable to this ASME SR are AS-8, AS-9, QU-4, QU-20, and QU-25, and there are no NRC objections. There is an industry action to check for proper accounting of success terms. The original Peer Review rated QU-4 and QU-20 as "3" and AS-8 and AS-9 as "3 with contingencies." QU-25 is rated as "NA". AS-8 has one level "B" F&O: AS-04; and AS-9 has one level "B" F&O: AS-07.

In the Catawba Rev 3a PRA Model Integration Notebook system successes are credited by post-processing recovery rules.

F&O AS-04 is only applicable to SGTR events. The modeling of SGTR events was changed to be consistent with industry standards using the guidance in WCAP-15955. Success criteria runs were Impact on ILRT Extension F&Os related to this SR.

There is no impact on the I LRT extension.

There were no F&Os with "A" level of significance at CNS and there are no remaining open level "B" F&Os related to this SR.

There is no impact on the I LRT extension.

There were no F&Os with "A" level of significance at CNS. Open level "B" F&O AS-04 is only applicable to SGTR events. A sensitivity was done in Section 5.3.5 to approximate the necessary SGTR success criteria modeling changes. Changes in Success Criteria modeling are based on guidance provided in Reference 43.

Other than a small change to Page 140of198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement "successes" may not be transferred between event trees.

QU-B7 IDENTIFY cutsets (or sequences) containing mutually exclusive events in the results.

Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Status Finding/Observation

2. Sequence YUOD3 needs a T/H justification that 03 can actually prevent core damage in this circumstance. This sequence has no injection and no SG isolation. This is "core cooling recovery" with an unisolated SGTR. ECA3 specifies cool down at less than 1 OOF/hr. The core cannot be maintained covered for the amount of time it takes to cooldown to RHR conditions at 1 OOF/hr. Suggested resolution is to use a separate function for this heading, using an operator action directed by FRC.1 and without RCP operating.

3. Sequence YUD1QD3. comment #2 applies to this sequence as well. This is a stuck open relief PORV with no injection.

F&O AS-07: The success criteria for AFW for SGTR is 1 CA pump to 2 steam generators. The ruptured SG is assumed to be one of the two steam generators that supply steam to the turbine-driven AFW pump. In the Catawba Rev. 2b fault tree model, however, the dependency of the TOP on the SGTR initiator is not modeled. Thus, the TOP supply is not degraded by the initiating event in the model logic, so the model is incorrect.

(This item is already on the list of corrective actions for the Catawba PRA, and Duke has indicated that it will be implemented in the Rev. 3 PRA.)

Dispositioned F&O QU-08: Documentation of mutually exclusive events is limited to the text file, cr2b_rul.txt.

The rule recovery file allows different numbers of max recoveries depending on the combinations in question.

There is no documentation regarding how the max recoveries were established for each set of events.

Examples of the content of the file are DBLMAINT, DELSEQ, and NSHEATEX, which function as recoveries set to 0.0 Note that this applies to recovery events as well as deleted combinations.

Disposition performed for the MNS PRA and are applicable to CNS.

Reconstruction of the CNS SGTR success criteria is needed to close this F&O.

F&O AS-07 is only applicable to SGTR events. The CA notebook was updated to reflect the correct success criteria due to SGTR loss of AFW pump, so AS-07 is considered resolved. As scheduled, the dependency of the TDAFW pump on the SGTR initiator was incorporated in the Rev. 3 PRA. Since this ILRT extension analysis uses Rev. 3b, this issue is resolved [Reference 17].

This is considered to resolve the findings and achieve grade 3 of NEI SR I meet CAT II of the ASME SR.

The NEI SR applicable to this ASME SR is QU-26, and there are no industry self-assessment actions and no NRG objections. The original Peer Review rated this NEI SRs as "3", with associated level "B" F&O QU-08.

F&O QU-08: Mutually exclusive event combinations (e.g., double initiating events, double maintenance, and other invalid combinations of events) are included in the general recovery rule file for the purpose of eliminating cutsets with those combinations from the quantification results which is shown in Catawba Rev 3a PRA Model Integration Notebook. The NEI grade of 3 was assigned to the correlated element. GDF and LERF Model Integration notebook Impact on ILRT Extension overall risk, there is no impact on the ILRT extension.

There were no F&Os with "A" level of significance at CNS, and there are no remaining open level "B" F&Os related to this SR.

There is no impact on the I LRT extension.

Page 141 of 198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement QU-BB CORRECT cutsets containing mutually exclusive events by either QU-C1 (a) developing logic to eliminate mutually exclusive situations, or (b) deleting cutsets containing mutually exclusive events IDENTIFY cutsets with multiple HFEs that potentially impact significant accident sequences/cutsets by requantifying the PRA model with HEP values set to values that are sufficiently high that the cutsets are not truncated.

The final quantification of these post-initiator HFEs may be done at the cutset level or saved sequence level.

Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Status Finding/Observation Dispositioned F&O QU-OB: Documentation of mutually exclusive events is limited to the text file, cr2b_rul.txt.

Dispositioned The rule recovery file allows different numbers of max recoveries depending on the combinations in question.

There is no documentation regarding how the max recoveries were established for each set of events.

Examples of the content of the file are DBLMAINT, DELSEQ, and NSHEATEX, which function as recoveries set to 0.0 Note that this applies to recovery events as well as deleted combinations.

QU-02: The IE's for certain support system failures (RN, KC) are not input in the top event logic as a Boolean equation, but rather as a point estimate whose value is derived by solution of the IE fault tree.

However, failures that cause the IE may also affect the mitigating system, such that there is a dependency betWeen the initiating event and the available mitigation. Examples are an electrical bus that failed one train of KC and could fail one train of mitigating equipment. Another example is the operator error in the loss of KC to start the standby train of KC (KKCSTNBDHE). The HRA notebook states this event has dependencies with HYDBACKDHE.

Disposition 1535.00-00-0061 and Results and Insights for Catawba PRA 1535.00-00-0075 were revised and this F&O is considered resolved.

The NEI SR applicable to this ASME SR is QU-26, and there are no industry self-assessment actions and no NRC objections. The original Peer Review rated this NEI SR as "3", with associated level "B" F&O QU-OB.

F&O QU-08: Mutually exclusive event combinations (e.g., double initiating events, double maintenance, and other invalid combinations of events) are included in the general recovery rule file for the purpose of eliminating cutsets with those combinations from the quantification results which is shown in Catawba Rev 3a PRA Model Integration Notebook. The NEI grade of 3 was assigned to the correlated element. CDF and LERF Model Integration notebook 1535.00-00-0061 and Results and Insights for Catawba PRA 1535.00-00-0075 were revised and this F&O is considered resolved.

The NEI SRs applicable to this ASME SR are QU-10, QU-17, HR-26, and H R-27, and there are no industry self-assessment actions and no NRC objections. The original Peer Review rated QU-10, HR-26 and HR-27 as "3" and QU-17 as "3 with contingencies." QU-17 has one level "B" F&O: QU-02.

Catawba Rev 3a PRA Model Integration Notebook describes the steps taken to solve the tree at 5.0E-11 (an order of magnitude lower than the typical truncation) with a special database where HFEs with a nominal value of less than 0.1 have been increased to 0.1 to ensure that cutsets involving multiple human events are not truncated and can be evaluated for dependencies. The identified combinations are evaluated and quantified by an HRA analyst. Multiple human error events within a cut set are replaced with a single human error event that considers the sequence of the operator actions and their interdependence.

F&O QU-02: System level initiators represented as fully developed sub-tree structures are not in the Rev 3 model. Duke Energy feels that it is acceptable to not develop system level initiators as long as a review for dependencies takes place in the cut set file. This process has been proceduralized and is contained in Section 4 of Workplace Guideline XSAA-103, Guidelines For Determining Risk Significance.

Impact on ILRT Extension There were no F&Os with "A" level of significance at CNS and there are no remaining open level "B" F&Os related to this SR.

There is no impact on the ILRT extension.

Based on the disposition, this SR is considered met.

There is no impact to the ILRT extension.

Page 142of198

54003-CALC-02 SR QU-C2 QU-D4 2009 ASME/ANS Cat II Requirement ASSESS the degree of dependency between the HFEs in the cutset or sequence in accordance with HR-D5 and HR-G7.

COMPARE results to those from similar plants and IDENTIFY causes for significant differences.

For example: Why is LOCA a large contributor for one plant and not another?

Revision 3 Status Dispositioned Open Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation QU-02: The IE's for certain support system failures (RN, KC) are not input in the top event logic as a Boolean equation, but rather as a point estimate whose value is derived by solution of the IE fault tree.

However, failures that cause the IE may also affect the mitigating system, such that there is a dependency between the initialing. event and the available mitigation. Examples are an electrical bus that failed one train of KC and could fail one train of mitigating equipment. Another example is the operator error in the loss of KC to start the standby train of KC (KKCSTNBDHE). The HRA notebook states this event has dependencies with HYDBACKDHE.

F&O QU-12: The Conditional core damage Probability of several Initiators from the CR2b results were evaluated. The results are:

8.30E-03 Loss Of RN 8.3BE-03 Loss Of KC 5.04E-03 Small LOCA 2.30E-04 Secondary Line Break Inside Containment 5.47E-05 LOOP 1.24E-05 Inadvertent SS Actuation 1.24E-05 Loss Of Instrument Air 1.04E-05 Steamline Break Outside Containment 9.54E-06 FDW Line Break Outside Containment 2.26E-06 Loss Of Main Feedwater 2.89E-06 SGTR 7.75E-07 Loss Of Load 5.01 E-07 Reactor Trip These results show a discrepancy between Small Disposition The NE! SRs applicable to this ASME SR are QU-10 and QU-17, and there are no NRC objections. There is an industry action to verify dependencies in cutsets/sequences are assessed. The original Peer Review rated QU-10 as "3" and QU-17 as "3 with contingencies." QU-17 has one level "B" F&O: QU-02.

Catawba Rev 3a PRA Model Integration Notebook describes the steps taken to solve the tree at 5.0E-11 (an order of magnitude lower than the typical truncation) with a special database where HFEs with a nominal value of less than 0.1 have been increased to 0.1 to ensure that cutsets involving multiple human events are not truncated and can be evaluated for dependencies. The identified combinations are evaluated and quantified by an HRA analyst. Multiple human error events within a cut set are replaced with a single human error event that considers the sequence of the operator actions and their interdependence.

F&O QU-02: System level initiators represented as fully developed sub-tree structures are not in the Rev 3 model. Duke Energy feels that it is acceptable to not develop system level initiators as long as a review for dependencies takes place in the cut set file. This process has been proceduralized and is contained in Section 4 of Workplace Guideline XSAA-103, Guidelines For Determining Risk Significance.

The NEI SRs applicable to this ASME SR are QU-8, QU-11, and QU-31, and there are no industry self-assessment actions and no NRG objections. The original Peer Review rated QU-31 as "3" and QU-8 and QU-11 as "3 with contingencies." QU-8 has one level "B" F&O:

QU-02; and QU-11 has one level "B" F&O: QU-12. Only F&O QU-12 is related to this ASME SR.

F&O QU-12: The Catawba PRA has updated the small LOCA (SL) initiator to be redefined to only include small pipe breaks. The SL and SGTR initiating event frequencies are found in the CNS U1 &2 internal initiator events frequency data notebook. This is considered to resolve the finding.

Catawba needs to perform and document a comparison of results between the CNS PRA and other similar plants to be incorporated into the Catawba PRA model integration notebook.

Impact on ILRT Extension Based on the disposition, this SR is considered met.

There is no impact to the ILRT extension.

Page 143of198

54003-CALC-02 SR QU-D6 2009 ASME/ANS Cat II Requirement IDENTIFY significant contributors to GDF, such as initiating events, accident sequences, equipment failures, common cause failures, and operator errors. INCLUDE SSCs and operator actions that contribute to initiating event frequencies and event mitigation.

Revision 3 Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation LOCA and SGTR that is not consistent with what is normally seen in PRAs in the industry. The CCDP for small LOCA and SGTR are usually in the same order of magnitude because the initiators have similar mitigation functions such as safety injection, secondary side heat removal, primary cooldown and depressurization, and long term injection if cooldown and depressurization are not successful.

A difference of 3 orders of magnitude is unusual.

Also, the CCDP value for the Loss of Instrument Air probability is identical to the Inadvertent SS Actuation probability (to 3 significant figures), which seemed surprising.

F&O QU-12: The Conditional core damage Probability of several Initiators from the CR2b results were evaluated. The results are:

8.30E-03 Loss Of RN 8.38E-03 Loss Of KC 5.04E-03 Small LOCA 2.30E-04 Secondary Line Break Inside Containment 5.47E-05 LOOP 1.24E-05 Inadvertent SS Actuation 1.24E-05 Loss Of Instrument Air 1.D4E-D5 Steamline Break Outside Containment 9.54E-06 FDW Line Break Outside Containment 2.26E-06 Loss Of Main Feedwater 2.89E-06 SGTR 7.75E-D7 Loss Of Load 5.01 E-07 Reactor Trip These results show a discrepancy between Small LOCA and SGTR that is not consistent with what is normally seen in PRAs in the industry. The CCDP for small LOCA and SGTR are usually in the same order of magnitude because the initiators have similar mitigation functions such as safety injection, secondary side heat removal, primary cooldown and depressurization, and long term injection if cooldown and depressurization are not successful.

A difference of 3 orders of magnitude is unusual.

Also, the CCDP value for the Loss of Instrument Air Disposition The NEI SRs applicable to this ASME SR are QU-8 and QU-31, and there are no NRG objections. There is an industry action to confirm that this requirement is met. The original Peer Review rated QU-31 as "3" and QU-8 as "3 with contingencies." QU-8 has one level "B" F&O: QU-02.

The Results and Insights from Catawba PRA Notebook provides a summary of the GDF results by IE, the most important operator actions and top SSCs.

F&O QU-12: The Catawba PRA has updated the small LOCA (SL) initiator to be redefined to only include small pipe breaks. The SL and SGTR initiating event frequencies are found in the CNS U1 &2 internal initiator events frequency data notebook. This is considered to resolve the finding and achieve grade 3 of NEI SR I meet CAT II of the ASME SR Impact on ILRT Extension There were no F&Os with "A" level of significance at CNS and there are no remaining open level "B" F&Os related to this SR.

There is no impact to the ILRT extension.

Page 144of198

54003-CALC-02 SR 2009 ASME/ANS Cat 11 Requirement QU-07 REVIEW the importance of components and basic events to determine that they make logical sense.

QU-E3 ESTIMATE the uncertainty interval of the CDF results. ESTIMATE the uncertainty intervals associated with parameter uncertainties (DA-03, HR-06, HR-GS, IE-C15), taking into account the "state-of-knowledge" correlation.

QU-E4 For each source of model uncertainty and related assumption identified in QU-E1 and QU-E2, respectively, IDENTIFY how the PRA model is affected (e.g.,

introduction of a new basic event, changes to basic event probabilities, change in success criterion, introduction of a new initiating event) [Note (1)].

QU-F2 DOCUMENT the model integration process including any recovery analysis, and the results of the quantification including uncertainty and sensitivity analyses. For example, documentation typically Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Status Finding/Observation probability is identical to the Inadvertent SS Actuation probability (to 3 significant figures), which seemed surprising.

Dispositioned None Dispositioned None Dispositioned None Dispositioned F&O QU-04: More guidance or creation of a procedure is needed to address the quantification steps. For example, there is no desktop guide or procedure as there is for developing system fault trees. There is no discussion in any of the documentation on what codes are used for the Disposition There are no NEI SRs applicable to this ASME SR. The Results and Insights from Catawba PRA Notebook provides the importances and top SSCs.

The NEI SR applicable to this ASME SR is QU-30, and there are no industry self-assessment actions and no NRC objections. The original Peer Review rated this NEI SR as "3". There are no level "A" or "B" F&Os associated with this NEI SR. NEI 00-02 only partially addresses this supporting requirement under QU-30.

An uncertainty analysis is performed for both CDF and LERF to estimate the mean values from internal and external (excluding seismic) events. The analysis is described in the Catawba Rev 3a PRA Model Integration Notebook. A correlation factor has been developed and is used to apply a multiplier to those ISLOCA cut sets having two MVR or CVR type code events in the same cut set.

The NEI SRs applicable to this ASME SR are QU-28, QU-29, and QU-30, and there are no industry self-assessment actions and no NRC objections. The original Peer Review rated all of these NEI SRs as "3". There were no F&Os with "A" level of significance at CNS and there are no level "B" F&Os associated with any of these NEI SRs.

NEI 00-02 only partially addresses this supporting requirement under QU-28, QU-29 and QU-30.

Although general modeling assumptions are provided in the PRA Modeling Guidelines (XSAA-115) and specific assumptions related to system design, operation, and modeling are documented in the various PRA notebooks, the sensitivity of the results to model uncertainties and assumptions has not been thoroughly documented.

The NEI SRs applicable to this ASME SR are QU-4, QU-12, QU-13, QU-27, QU-28, QU-31, QU-32, and MU-7, and there are no industry self-assessment actions and no NRC objections. The original Peer Review rated all of these NEI SRs as "3". There were no F&Os with "A" level of significance at CNS. Level "B" F&O QU-04 was written Impact on ILRT Extension Based on the disposition, the requirements of Cat II are considered met. There is no impact to the ILRT extension.

There were no F&Os with "A" level of significance at CNS and there are no level "B" F&Os related to this SR.

There is no impact to the I LRT extension.

With the sensitivity of the model and characterization of uncertainties unknown there is potential to impact the ILRT extension.

However the impact is expected to be minimal.

There were no F&Os with "A" level of significance at CNS and there are no remaining open level "B" F&Os related to this SR.

Page 145of198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement includes (a) records of the process/results when adding non-recovery terms as part of the final quantification (b) records of the cutset review process (c) a general description of the quantification process including accounting for systems successes, the truncation values used, how recovery and post-initiator HFEs are applied (d) the process and results for establishing the truncation screening values for final quantification demonstrating that convergence towards a stable result was achieved (e) the total plant GDF and contributions from the different initiating events and accident classes (f) the accident sequences and their contributing cutsets (g) equipment or human actions that are the key factors in causing the accidents to be non-dominant (h) the results of all sensitivity studies (i) the uncertainty distribution for the total GDF

0) importance measure results (k) a list of mutually exclusive events eliminated from the resulting cutsets and their bases for elimination (I) asymmetries in quantitative modeling to provide application users the necessary understanding of the reasons such asymmetries Revision 3 Status Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations Finding/Observation quantification process, or what files are needed to establish the CAFTA run parameters. Develop quantification guidance for PSA analysts. This should include information on the quantification codes and the run parameters. Standards for quantification commensurate with the application type should be included.

Disposition Impact on ILRT Extension against NEI subelement QU-3 which is not mapped to any of the SRs There is no impact to the in the current PRA Standard, however, it is associated with this SR.

ILRT extension.

F&O QU-04: SAAG 791, Catawba Rev 3 PRA Integration Notebook (1535.00-00-0061), has been greatly expanded with respect to providing quantification guidance for PSA analysts.

The model integration process and basic quantification results are documented in the Catawba Rev 3a PRA Model Integration Notebook. However the documentation of the PRA model needs to be expanded to address all required items. This is documented in the Level C F&O QU-10. The NEI grade of 3 was assigned to each correlated element.

Page 146of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events PRA Peer Review - Facts and Observations SR 2009 ASME/ANS Cat II Requirement are present in the model (m) the process used to illustrate the computer code(s) used to perform the quantification will yield correct results process QU-F3 DOCUMENT the significant contributors (such as initiating events, accident sequences, basic events) to CDF in the PRA results summary. PROVIDE a detailed description of significant accident sequences or functional failure groups.

QU-F4 DOCUMENT the characterization of the sources of model uncertainty and related assumptions (as identified in QU-E4).

QU-F5 DOCUMENT limitations in the quantification process that would impact applications.

Status Dispositioned None Dispositioned None Dispositioned None QU-F6 DOCUMENT the quantitative Dispositioned None definition used for significant basic event, significant cutset, and significant accident sequence. If it is Revision 3 Finding/Observation Disposition The NEI SR applicable to this ASME SR is QU-31, and there are no industry self-assessment actions and no NRC objections. The original Peer Review rated this NEI SR as "3". There were no F&Os with "A" level of significance at CNS and there are no level "B" F&Os associated with this NEI SR. NEI 00-02 only partially addresses this supporting requirement under QU-31.

The Results and Insights from Catawba PRA Notebook provides a summary of the CDF results by IE, the most important operator actions and top SSCs.

The NEI SRs applicable to this ASME SR are QU-27, QU-28, and Q U-32, and there are no industry self-assessment actions and no NRG objections. The original Peer Review rated all of these NEI SRs as "3". There were no F&Os with "A" level of significance at CNS and there are no level "B" F&Os associated with any of these NEI SRs.

NEI 00-02 only partially addresses this supporting requirement under QU-27, QU-28, and QU-32.

General modeling assumptions are provided in the PRA Modeling Guidelines (XSAA-115) and specific assumptions related to system design, operation, and modeling are documented in the various PRA notebooks.

There are no NEI SRs applicable to this ASME SR. The PRA Modeling Guidelines (XSAA-115) describes some basic MAAP limitations. For applications, workplace procedure XSAA 103 describes the need to resolve the integrated model if the failure probability associated with a modeled SSC increases. The procedure also notes that the initiator model is resolved prior to resolving the integrated model if an SSC of interest is included in an initiator fault tree.

There are no NEI SRs applicable to this ASME SR. The Results and Insights from Catawba PRA notebook identifies the risk-significant accident sequences, systems, components and operator actions.

However there is no discussion of a specific quantitative definition for Impact on ILRT Extension There were no F&Os with "A" level of significance at CNS and there are no level "B" F&Os related to this SR.

There is no impact to the ILRT extension.

There were no F&Os with "A" level of significance at CNS and there are no level "B" F&Os related to this SR.

There is no impact to the ILRT extension.

Based on the disposition, the requirements of Cat II are considered met. There is no impact to the ILRT extension.

Based on the disposition, the requirements of Cat II are considered met. There is no Page 147of198

54003-CALC-02 SR 2009 ASME/ANS Cat 11 Requirement other than the definition used in Part 2, JUSTIFY the.alternative.

Revision3 Status Evaluation of Risk Significance of Permanent ILRT Extension Table A-1 Internal Events.PRA Peer Review - Facts and Observations Finding/Observation Disposition significant basic events, cutsets, accident sequences or functional failures.

Impact on ILRT Extension impact to the ILRT extension.

Page 148of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Table A-2 LERF PRA Peer Review - Facts and Observations SR 2009 ASME/ANS Cat II Requirement Status Finding/Observation LE-82 DETERMINE the containment challenges Dispositioned None (e.g., temperature, pressure loads, debris impingement) resulting from contributors identified in LE-81 using applicable generic or plant-specific analyses for significant containment challenges. USE conservative treatment or a combination of conservative and realistic treatment for non-significant containment challenges. If generic calculations are used in support of the assessment, JUSTIFY applicability to the plant being evaluated.

LE-C1 DEVELOP accident sequences to a level of Dispositioned None detail to account for the potential contributors identified in LE-81 and analyzed in LE-82.

Compare the containment challenges analyzed in LE-8 with the containment structural capability analyzed in LE-D and identify accident progressions that have the potential for a large early release. JUSTIFY any generic or plant-specific calculations or references used to categorize releases as non-LERF contributors based on release magnitude or timing. NUREG/CR-6595, App.

A [2-16] provides an acceptable definition of LERF source terms.

LE-C3 REVIEW significant accident progression Dispositioned None sequences resulting in a large early release to determine if repair of equipment can be credited. JUSTIFY credit given for repair (i.e.,

ensure that plant conditions do not preclude repair and actuarial data exists from which to estimate the repair failure probability [see SY-A24, DA-C15, and DA-DB]). AC power recovery based on generic data applicable to the plant is acceptable.

LE-C4 INCLUDE model logic necessary to provide a Dispositioned None realistic estimation of the significant accident progression sequences resulting in a large early release. INCLUDE mitigating actions by Revision 3 Disposition Per Reference 36, LERF model is sufficient to support risk-informed applications.

Per Reference 36, LERF model is sufficient to support risk-informed applications.

Impact on ILRT Extension Limitations with the NUREG/CR-6595 LERF approach used for Catawba include consideration of whether the estimated LERF is significantly below (about an order of magnitude or more) the R.G. 1.174 acceptance guideline. Duke believes the LERF model to be conservative and believes the NUREG/CR-6595 method is acceptable since it produces adequate risk insights. Overall, the impacts to the ILRT extension are expected to be minimal.

Limitations with the NUREG/CR-6595 LERF approach used for Catawba include consideration of whether the estimated LERF is significantly below (about an order of magnitude or more) the R.G.1.174 acceptance guideline. Duke believes the LERF model to be conservative and believes the NUREG/CR-6595 method is acceptable for fire since it produces adequate risk insights. Overall, the impacts to the ILRT extension are expected to be minimal.

Limitations with the NUREG/CR-6595 LERF approach used for Catawba include consideration of whether the estimated LERF is significantly below (about an order of magnitude or more) the R.G. 1.174 acceptance guideline. Duke believes the LERF model to be conservative and believes the NUREG/CR-6595 method is acceptable for fire since it produces adequate risk insights. Overall, the impacts to the ILRT extension are expected to be minimal.

Limitations with the NUREG/CR-6595 LERF approach used for Catawba include consideration of whether the estimated LERF is significantly below (about an order of magnitude or more) the R.G. 1.174 acceptance Page 149of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Table A-2 LERF PRA Peer Review - Facts and Observations SR 2009 ASME/ANS Cat II Requirement operating staff, effect of fission product scrubbing on radionuclide release, and expected beneficial failures in significant accident progression sequences. PROVIDE technical justification (by plant-specific or applicable generic calculations demonstrating the feasibility of the actions, scrubbing mechanisms, or beneficial failures) supporting the inclusion of any of these features.

Status LE-C9 JUSTIFY any credit given for equipment Dispositioned None survivability or human actions under adverse environments.

.LE-JUSTIFY any credit given for equipment Dispositioned None C 11 survivability or human actions that could be impacted by containment failure.

LE-D2 EVALUATE the impact of containment seals, Dispositioned None penetrations, hatches, drywell heads (BWRs),

and vent pipe bellows and INCLUDE as potential containment challenges, as required. If generic analyses are used in support of the assessment, JUSTIFY applicability to the plant being evaluated.

Revision 3 Finding/Observation Disposition Per Reference 36, LERF model is sufficient to support risk-informed applications.

Per Reference 36, LERF model is sufficient to support risk-informed applications.

Impact on ILRT Extension guideline. Duke believes the LERF model to be conservative and believes the NUREG/CR-6595 method is acceptable for fire since it produces adequate risk insights. Overall, the impacts to the ILRT extension are expected to be minimal.

Limitations with the NUREG/CR-6595 LERF approach used for Catawba include consideration of whether the estimated LERF is significantly below (about an order of magnitude or more) the R.G. 1.174 acceptance guideline. Duke believes the LERF model to be conservative and believes the NUREG/CR-6595 method is acceptable for fire since it produces adequate risk insights. Overall, the impacts to the ILRT extension are expected to be minimal.

Page 150of198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement LE-D3 When containment failure location [Note (1)]

affects the event classification of the accident progression as a large early release, DEFINE failure location based on a realistic containment assessment that accounts for plant-specific features. If generic analyses are used in support of the assessment, JUSTIFY applicability to the plant being evaluated.

LE-D6 PERFORM an analysis of thermally induced SG tube rupture that includes plant specific procedures and design features and conditions that could impact tube failure. An acceptable approach is one that arrives at plant-specific split fractions by selecting the SG tube conditional failure probabilities based on NUREG-1570 [2-17] or similar evaluation for induced SG failure of a similarly designed SGs and loop piping.

SELECT failure probabilities based on (a) RCS and SG post-accident conditions to sufficient to describe the important risk outcomes (b) secondary side conditions including plant-specific treatment of MSSV and ADV failures JUSTIFY assumptions and selection of key inputs. An acceptable justification can be obtained by the extrapolation of the information in NUREG-1570 [17] to obtain plant-specific models, use of reasonably bounding assumptions, or performance of sensitivity studies indicating low sensitivity to changes in the range in question.

LE-E2 USE realistic parameter estimates to characterize accident progression phenomena for significant accident Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-2 LERF PRA Peer Review - Facts and Observations Status Finding/Observation Dispositioned None Dispositioned None Open LE-E2-01 (F): Catawba basically used the conservative parameter estimates from NUREG/CR-6595 to characterize the Disposition Per Reference 36, LERF model is sufficient to support risk-informed applications.

Per Reference 36, LERF model is sufficient to support risk-informed applications.

The Westinghouse focused peer review concluded that the Catawba LERF model was Impact on ILRT Extension Limitations with the NUREG/CR-6595 LERF approach used for Catawba include consideration of whether the estimated LERF is significantly below (about an order of magnitude or more) the R.G. 1.174 acceptance guideline. Duke believes the LERF model to be conservative and believes the NUREG/CR-6595 method is acceptable for fire since it produces adequate risk insights. Overall, the impacts to the ILRT extension are expected to be minimal.

Limitations with the NUREG/CR-6595 LERF approach used for Catawba include consideration of whether the estimated LERF is significantly below (about an order of magnitude or more) the R.G. 1.174 acceptance guideline. Duke believes the LERF model to be conservative and believes the NUREG/CR-6595 method is acceptable for fire since it produces adequate risk insights. Overall, the impacts to the ILRT extension are expected to be minimal.

When the Westinghouse documentation recommendation is implemented, the SR will meet Cat I. Then, per Reference 36, the LERF model is Page 151 of 198

54003-CALC-02 SR LE-F1 2009 ASME/ANS Cat II Requirement progression sequences resulting in a large early release. USE conservative or a combination of conservative and realistic estimates for non-significant accident progression sequences resulting in a large early release.

PERFORM a quantitative evaluation of the relative contribution to LERF from plant damage states and significant LERF contributors from Table 2-2.8-3.

Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-2 LERF PRA Peer Review - Facts and Observations Status Finding/Observation accident progression phenomena. This approach would satisfy CC-I. However, Duke is using the Conditional Containment Failure Probabilities (CCFPs) from Rev. 0 of NUREG/CR-6595 rather than the more restrictive values from Revision 1. To meet this requirement would require using the NUREG/CR-6595, Rev. 1 CCFP values or providing an engineering analysis to defend use of the older values.

At the time of the peer review, Duke did have a white paper, "Conditional Containment Failure Probabilities for the McGuire and Catawba Large Early Release Frequency Models", November 2012, (Reference 10) that discusses the basis for the use of the CC FPs from Revision 0 of NUREG/CR-6595. However, this white paper was not provided as part of the official documentation for the review and as such, was not directly reviewed. A later review of this white paper indicates that Duke appears to have a reasonable basis for using the revision 0 CCFP values based on plant-specific analysis. Duke should include this information in their LERF analysis reports.

Dispositioned LE-G3-01 (F): In CNC-1535.00-00-061, Catawba documents the significant contributors to LERF in terms of contribution by initiating events. However, they did not document the relative contribution of contributors such as plant damage states, accident progression sequences, phenomena, containment challenges and containment failure modes.

To move from CC-I to CC-11/111, Catawba needs to evaluate the relative contributions Disposition adequate to meet Cat J; however, the LERF report needed to include the Duke white paper addressing the use of CCFPs from Rev 0 of the NUREG as opposed to Rev 1.

The Duke white paper reviewed the supporting analyses for the conditional containment failure probabilities provided in the various revisions to NUREG/CR-6595. Based on the plant specific analyses performed, the CCFPs utilized in the current CNS LERF analyses (based on NUREG/CR-6595 original issue) are judged to be better estimates than the estimates available from NUREG/CR-6427 or NUREG/CR-6595 revision 1 and are appropriate for a LERF model at CC I. The CNS peer review noted that the position paper appeared to be a reasonable basis for using the NUREG/CR-6595 revision o results. Duke also believes that the NUREG/CR-6595 revision O results are better estimates than the revision 1 results.

Per Reference 36, LERF model is sufficient to support risk-informed applications.

Impact on ILRT Extension sufficient to support risk-informed applications.

Limitations with the NUREG/CR-6595 LERF approach used for Catawba include consideration of whether the estimated LERF is significantly below (about an order of magnitude or more) the R.G. 1.174 acceptance guideline. Duke believes the LERF model to be conservative and believes the NUREG/CR-6595 method is acceptable for fire since it produces adequate risk insights. Overall, the impacts to the ILRT extension are expected to be minimal.

Page 152of198

54003-CALC-02 SR 2009 ASME/ANS Cat II Requirement LE-G3 DOCUMENT the relative contribution of contributors (i.e., plant damage states, accident progression sequences, phenomena, containment challenges, containment failure modes) to LERF.

LE-GS DOCUMENT the quantitative definition used for significant accident progression sequence.

If other than the definition used in Section 2, JUSTIFY the alternative.

Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-2 LERF PRA Peer Review - Facts and Observations Status Finding/Observation to LERF by such things as plant damage states, accident progression sequences, phenomena, containment challenges, and containment failure modes.

Dispositioned LE-G3-01 (F): In CNC-1535.00-00-061, Catawba documents the significant contributors to LERF in terms of contribution by initiating events. However, they did not document the relative contribution of contributors such as plant damage states, accident progression sequences, phenomena, containment challenges and containment failure modes.

To move from CC-I to CC-11/111, Catawba needs to evaluate the relative contributions to LERF by such things as plant damage states, accident progression sequences, phenomena, containment challenges, and containment failure modes.

Open LE-G6-01 (F): Catawba did not document the quantitative definition of significant accident progression sequence.

Catawba needs to add a definition for significant accident progression sequence to CNC-1535.00-00-0143, Rev. 0 or CNC-1535.00-00-061. This can be accomplished by adding a specific definition of referencing the appropriate definition in Section 1-2 of RA-Sa-2009.

Disposition The Westinghouse report suggested that improving this SR to a Cat II would require evaluating the relative contributions to LERF by such things as plant damage states, accident progression sequences, phenomena, containment challenges and containment failure modes. Meeting Cat I already satisfies the application and improving to Cat II would only result in improved documentation.

The Westinghouse report suggested that Catawba add a definition for significant accident progression sequence to the documentation.

Impact on ILRT Extension Per Reference 36, LERF model is sufficient to support risk-informed applications. Limitations with the NUREG/CR-6595 LERF approach used for Catawba include consideration of whether the estimated LERF is significantly below (about an order of magnitude or more) the R.G. 1.174 acceptance guideline. Duke believes the LERF model to be conservative and believes the NUREG/CR-6595 method is acceptable for fire since it produces adequate risk insights.

Overall, the impacts to the ILRT extension are expected to be minimal.

Per Reference 36, LERF model is sufficient to support risk-informed applications. This finding is documentation only and does not impact the ILRT extension.

Page 153of198

54003-CALC-02 SR IFPP-A2 Revision 3 2009 ASME/ANS Cat II Requirement DEFINE flood areas at the level of individual rooms or combined rooms/halls for which plant design features exist to restrict flooding.

Evaluation of Risk Significance of Permanent ILRT Extension Table A-3 Internal Flood PRA Peer Review - Facts and Observations Status Finding/Observation Dispositioned IFPP-A2-01 (F): Discrepancies exist regarding the defining of flood areas at the level of individual rooms. The CNS PRA clearly meets Capability Category I which is based on defining flood areas at the building level. There are some areas within the buildings which are not clearly part of flood areas, where boundaries are vaguely defined, or for where the flood area boundaries are defined inconsistent with the requirements of the Standard.

Pipe trenches on AB522 are not included in any of the Flood Areas as defined in Att. A to the -022 calculation.

The flood Zone boundary between 594A01 and 594A05 goes through the middle of a hallway south of the HVAC room (similarly for Unit 2 side).

There is no discussion on why this is an appropriate boundary for a flood zone. It appears this flood zone should have been defined by the walls and doors to the immediate south of the Main Control Room. Floods could clearly propagate without being impeded as this flood boundary was defined.

Given the number of rooms with enclosed doors and flood sources within the plant, the Flood Zones would have been better defined with greater level of detail. As done, this results in many flooding barriers within a Zone. The AB522 flood area, for example, could have been subdivided since the Containment Spray (NS) and Residual Heat Removal (ND) pumps are in separate rooms, with the ND pumps behind doors. Also, while liquid will spray down into all of these rooms, propagation within the room complex could differ depending on flood sources at higher elevations.

Figure A-3 in CN-RAM-11-022 shows an incorrect location of the NI pump rooms and NV pump rooms. Room 233 is not defined as part of any Disposition Per LTR-RAM-11-13-008, flood zone drawings were evaluated and updated to provide required level of detail to meet Cat II.

Impact on ILRT Extension Per Reference 38, flood zone drawings were evaluated and updated to provide required level of detail to meet Cat II.

Therefore, this is resolved and there is no impact to the ILRT extension.

Page 154of198

54003-CALC-02 SR IFPP-A5 IFPP-B3 IFSO-A1 2009 ASME/ANS Cat II Requirement CONDUCT plant walkdown(s) to verify the accuracy of information obtained from plant information sources and to obtain or verify:

(a) spatial information needed for the development of flood areas (b) plant design features credited in defining flood areas.

Note: Walkdown(s) may be done in conjunction with the requirements of IFSO-A6, IFSN-A17, and IFQU-A11.

DOCUMENT sources of model uncertainty and related assumptions (as identified in QU-E1 and QU-E2) associated with the internal flood plant partitioning.

For each flood area, IDENTIFY the potential sources of flooding [Note (1)].

INCLUDE:

(a) equipment (e.g., piping, valves, pumps) located in the area that are connected to fluid systems (e.g.,

circulating water system, service water system, fire protection system, component cooling water system, feedwater system, condensate and steam systems, and reactor coolant system)

(b) plant internal sources of flooding (e.g., tanks or pools) located in the flood area (c) plant external sources of flooding Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-3 Internal Flood PRA Peer Review - Facts and Observations Status Finding/Observation Flood Area in the Appendix A Figures. Details of flood zone boundaries south of zone 560Z09 are unclear.

Dispositioned IFSO-A6-01 (F): Walkdowns were completed however, there were some discrepancies in walkdown notes. See IFSO-A6.

Dispositioned IFSO-B3-01 (F): No discussion of impact of sources of uncertainty with respect to partitioning was documented.

No discussion of impact of sources of uncertainty with respect to flooding sources was documented.

Dispositioned IFSO-A1-01 (F): For each flood area, the potential sources of flooding are to be identified, including equipment (e.g., piping, valves, pumps, tanks) located in the area. Section 5.5 (Table 5-4) documents potential flood sources for each flood area; however some flood areas are missing potential sources of flooding:

Turbine Building (577T) does not include Conventional Low Pressure Service Water (RL) or Recirculating Cooling Water System (KR).

Sections 5.3.11 and 5.3.12 indicate these piping systems are in the Turbine Building but failure of these systems is not addressed. Likewise, steam (HELB) systems are not included (e.g., Main Steam, Extraction Steam, Reheat Steam, etc).

No piping Jess than or equal to 2-inch diameter is included for flooding and this pipe is not Disposition Per L TR-RAM-11-13-008, walkdown documentation was revised to resolve discrepancies noted by the peer review team.

Per L TR-RAM-11-13-008, the existing documentation was reviewed and two additional assumptions were added to cover any associated uncertainties related to source or plant partitioning.

Per L TR-RAM-11-13-008, missing flood sources were added and relevant scenarios were carried forward into the other calculation notes and adequately documented.

Impact on ILRT Extension This is a documentation issue and is resolved [Reference 38]. Therefore, there is no impact on the I LRT extension.

This is a documentation issue and is resolved [Reference 38]. Therefore, there is no impact on the I LRT extension.

This issue is resolved [Reference 38]

and incorporated into the internal flood model [Reference 39] used in this analysis. Therefore, there is no impact on the I LRT extension.

Page 155of198

54003-CALC-02 SR IFSO-A2 IFSO-A5 2009 ASME/ANS Cat II Requirement (e.g., reservoirs or rivers) that are connected to the area through some system or structure (d) in-leakage from other flood areas (e.g., backflow through drains, doorways, etc.)

For multi-unit sites with shared systems or structures, INCLUDE any potential sources with multi-unit or cross-unit impacts.

For each source and its identified failure mechanism, IDENTIFY the characteristic of release and the capacity of the source. INCLUDE:

(a) a characterization of the breach, including type (e.g., leak, rupture, spray)

(b) flow rate (c) capacity of source (e.g., gallons of water)

(d) the pressure and temperature of the source Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-3 Internal Flood PRA Peer Review - Facts and Observations Status Finding/Observation considered as spray source in most areas.

Drinking Water (YD) piping was not included as a flood or spray source. *Drinking Water system is in the Internal Events PRA model (HYDBACKTRM, YD System is Unavailable) as backup cooling to the 1 A NV pump. Failure of this piping may fail that function and flood spray other SSCs.

Many tanks (e.g., Liquid Waste Tanks) were identified on the Peer Review walkdowns that are not documented as potential flood sources.

Dispositioned IFSO-A2-01 (F): One important case where the cross-unit impact is not considered is the consideration of a cross-unit flood from one turbine building affecting the other turbine building.

Flooding in one turbine building can propagate to the other turbine building, per Figure 5-1 of CN-RAM-11-022 and per General Arrangement drawings. This cross-unit source should have been considered but was not considered.

Discussion of how flooding of Unit 2 offsite power transformers in zone 577T02 would or would not impact Unit 1 is not documented.

Dispositioned IFSO-AS-01 (F): The internal flooding PRA documentation does not identify system capacities for many systems, nor does it identify flow rates for most releases, not does it identify the pressure and temperature of the source.

While flood breach size is characterized in Assumption 9 of CN-RAM-11-023, maximum flow rates for failures in individual systems are not provided. Capacity of sources are discussed for some systems in CN-RAM-11-022 (e.g., Nuclear Service Water infinite capacity, volume of RWST for ECCS breaks), system capacities that would be released are not documented or identified for most systems (e.g., KC, for which a surge tank volume is identified but that does not correspond to the entire system/train volume subject to release).

Disposition Per L TR-RAM-11-13-008, after review of plant characteristics, there was found to be no cross unit impact on the offsite power transformers.

Documentation was revised to include this review.

Per LTR-RAM-11-13-008, documentation was revised to include tables showing system capacities, flow, pressure and temperature to ensure that the information needed for flood sources is documented. References for all values are included in the tables.

Impact on ILRT Extension There was found to be no cross-unit impact [Reference 38]. Documentation was revised to include this review.

There is no impact on the ILRT extension.

This is a documentation issue and is resolved [Reference 38]. Therefore, there is no impact on the ILRT extension.

Page 156of198

54003-CALC-02 SR IFSO-A6 Revision 3 2009 ASME/ANS Cat II Requirement CONDUCT plant walkdown(s) to verify the accuracy of information obtained from plant information sources and to detennine or verify the location of flood sources and in-leakage pathways.

Note: Walkdown(s) may be done in conjunction with the requirements of IFPP-A5, IFSN-A17, and IFQU-A11.

Evaluation of Risk Significance of Permanent ILRT Extension Table A-3 Internal Flood PRA Peer Review - Facts and Observations Status Finding/Observation (refer also to discussion relating to documentation under SR IFSN-B1 and its Finding)

Dispositioned IFSO-A6-01 (F): Discrepancies exist in Walkdown Notes.

Walkdown notes identify a number of rooms which are part of the 554A01 and 554A02 Flood Areas as at elevation 560'.

Walkdown notes for 577 A01 general area does not list CCW HX's, which are very large components, as flood sources. Various radwaste tanks located in general areas in teh auxiliary building were apparently not identified in teh walkdown notes.

Note no equipment elevation information is provided for the 577 A02 or 577 A03 (rooms 419 and 427) mechanical penetration area PRA equipment in the walkdown notes.

Main control room walkdown notes indicate two double watertight doors to the main control room.

Drawing CN-1040-04 appears to show at least three double doors and three other doors that are not identified in the walkdown notes.

Note Table B-1 of CN-RAM-11-023 lists an 18 inch critical height for CA pumps, whereas Table B-2 uses a 16 inch critical height.

Note the header on many of the walkdown notes is incorrect. The 560A01 general area has a header of "Aux. Bldg. 577' General Area." (p,212 ff.) The 577 General area 577 A01 has a heading referencing to a stairwell. This introduces some confusion in checking the information in !eh walkdown notes, including checks for validity. No walkdown sheets for Rooms 205A, 215, and 215B.

It is inefficient to have the walkdown notes indexed Disposition Per L TR-RAM-11-13-008, walkdown documentation was revised to resolve discrepancies noted by the peer review team.

Impact on ILRT Extension Walkdown documentation was revised to resolve discrepancies [Reference 38]. This is a documentation issue and is resolved. Therefore, there is no impact on the ILRT extension.

Page 157of198

54003-CALC-02 SR IFSO-B1 IFSO-B3 IFSN-A7 Revision 3 2009 ASME/ANS Cat II Requirement DOCUMENT the internal flood sources in a manner that facilitates PRA applications, upgrades, and peer review.

DOCUMENT sources of model uncertainty and related assumptions (as identified in QU-E1 and QU-E2) associated with the internal flood sources.

In applying SR IFSN-A6 to determine susceptibility of SS Cs to flood-induced failure mechanisms, TAKE CREDIT for the operability of SSCs identified in IFSN-A5 with respect to internal flooding impacts only if supported by an appropriate combination of (a) lest or operational data (b) engineering analysis (c) expert judgment Evaluation of Risk Significance of Permanent ILRT Extension Table A-3 Internal Flood PRA Peer Review - Facts and Observations Status Finding/Observation based on roam descriptions rather than by Flood Areas or Room Numbers with no map of room numbers provided.

Dispositioned IFSN-B1-01 (F): The documentation was found lacking either supporting calculations that produced applied values (e.g., flood rates) or references to calculations outside the IFPRA documentation.

References to calculations such as break flow were not identified.

Dispositioned IFSO-B3-01 {F): No discussion of impact of sources of uncertainty with respect to partitioning was documented.

No discussion of impact of sources of uncertainty with respect to flooding sources was documented.

Dispositioned IFSN-A7-01 (F): Catawba is assuming that floor drains are capable of responding to Spray (1 OOGPM) events so that such events do not need to be analyzed or further evaluated. Many Internal Flooding PRA's do not take any credit for drains, even for 1 OOGPM Spray events, due to generally poor maintenance practices and availability for Sump Pumps, as well as due to the possibility that whatever flood event is going on will cause any debris in the room (self-generated or left after maintenance) to clog the drains and/or damage sump pumps. Generally, Preventive Maintenance Tasks or surveillance requirements for drains should exist prior to crediting the drains for flood Disposition Flood rates were based on EPRI methodology to support the IEF generation for given scenarios of spray, flood, major flood or HELB. For flood rates this resulted in evaluating the upper bound of a system's capacity and assigning the appropriate failure mechanisms (e.g. for a system with a 1,000 gpm max flow rate spray and floods were deemed appropriate failure mechanisms). All calculations used and references were adequately explained and documented throughout the analysis. For example the drain flaw rate calculations were performed and documented in a manner which would allow for them to be reproduced independently. The documents were re-examined and no other calculations were found to need additional documentation or clarification.

Per LTR-RAM-11-13-008, the existing documentation was reviewed and two additional assumptions were added to cover any associated uncertainties related to source or plant partitioning.

Per L TR-RAM-11-13-008, the finding was addressed by re-evaluating the credit of drains in the source of the spray. The drain system at CNS was only credited for spray scenarios in which the flow rate from the associated break is 1 OOgpm or fess. This was substantiated by documented calculations in which one drain was shown to be able to accommodate over 1 OOgpm with a minimal amount of standing water. This credit was considered conservative and was not taken for flood and major flood mitigation or timing. Additionally all PRA-related components are considered failed within the originating flood Impact on ILRT Extension This is a documentation issue and is resolved [Reference 38]. Therefore, there is no impact on the ILRT extension.

This is a documentation issue and is resolved [Reference 38]. Therefore, there is no impact on the ILRT extension.

This issue is resolved [Reference 38]

and incorporated into the internal flood model [Reference 39] used in this analysis. Therefore, there is no impact on the I LRT extension.

Page 158of198

54003-CALC-02 SR IFSN-A10 Revision 3 2009 ASME/ANS Cat II Requirement DEVELOP flood scenarios (i.e., the set of information regarding the flood area, source, flood rate and source capacity, operator actions, and SSC damage that together form the boundary conditions for the interface with the internal events PRA) by examining the equipment and relevant plant features in the flood area and areas in potential propagation paths, giving credit for appropriate flood mitigation systems or operator actions, and identifying susceptible SSCs.

Status Dispositioned Evaluation of Risk Significance of Permanent ILRT Extension Table A-3 Internal Flood PRA Peer Review - Facts and Observations Finding/Observation mitigation. Also, the geometry of the drain system should be investigated to ensure that it is not prone to blockages (e.g., check valve failures).

This assumption would specifically impact not evaluating a 1 OOGPM spray scenario in the Diesel Generator buildings, since if undetected this would flood the diesel room to four feet and then start flooding the switchgear areas. It would be legitimate to credit the drains in the switchgear areas ~walkdown notes indicate five 6 inch diameter drains in the switchgear rooms (zone 560A05 and 560A06). Water height for a 100 GPM release would be minimal, less than one inch, so the equipment in the switchgear rooms would not be damaged if the flood progressed to that point.

While in general drains outside the immediate area would suffice to prevent flooding, this needs to be confirmed given the small number of drains that are reported for the large Aux. Bldg. general areas.

IFSN-A10-01 (F): CN-RAM-12-005, Identification and Estimation of Initiating Event Frequencies, Table 5-4, CNS Passive System Failure Frequency by Flood Area:

Table 5-4 (page 33) lists KF as a potential flood source in flood area 543A01. There is no flood or major flood initiator for KF in this flood area in Table 5-5, CNS Passive System Failure Frequency by Initiator. There is no scenario developed for failure of this piping (see CN-RAM-11-023, Characterization of Flood Scenarios, Section 5.4.2).

Table 5-4 (page 33) lists CS and KR as potential flood sources in flood area 543A02. There are no flood initiators for CS or KR in this flood area in Table 5-5. There are no scenarios developed for failure of these piping systems in this area (see CN-RAM-11-023, Section 5.4.3).

Disposition area. Documentation was revised to reflect the re-evaluation of credit for drains.

IFSN-A10-01: Per LTR-RAM-11-13-008, the initiating event frequency documentation and scenario documentation was re-examined to determine whether all potential flood sources are identified and evaluated. Identified discrepancies, including the KF piping in flood area 543A01, were added to the analysis and documentation was revised.

IFSO-A 1-01: Per L TR-RAM-11-13-008, missing flood sources were added and relevant scenarios were carried forward into the other calculation notes and adequately documented.

Impact on ILRT Extension This issue is resolved [Reference 38]

and incorporated into the internal flood model [Reference 39] used in this analysis. Therefore, there is no impact on the ILRT extension.

Page 159of198

54003-CALC-02 SR IFSN-A11 Revision 3 2009 ASME/ANS Cat II Requirement For multi-unit sites with shared systems or structures, INCLUDE multi-unit scenarios.

Evaluation of Risk Significance of Permanent ILRT Extension Table A-3 Internal Flood PRA Peer Review - Facts and Observations Status Finding/Observation IFSO-A1-01 (F): IFSO-A1-01 (F): For each flood area, the potential sources of flooding are to be identified, including equipment (e.g., piping, valves, pumps, tanks) located in the area. Section 5.5 (Table 5-4) documents potential flood sources for each flood area; however some flood areas are missing potential sources of flooding:

Turbine Building (577T) does not include Conventional Low Pressure Service Water (RL) or Recirculating Cooling Water System (KR).

Sections 5.3.11 and 5.3.12 indicate these piping systems are in the Turbine Building but failure of these systems is not addressed. Likewise, steam (HELB) systems are not included (e.g., Main Steam, Extraction Steam, Reheat Steam, etc).

No piping less than or equal to 2-inch diameter is included for flooding and this pipe is not considered as spray source in most areas.

Drinking Water (YD) piping was not included as a flood or spray source. Drinking Water system is in the Internal Events PRA model (HYDBACKTRM, YD System is Unavailable) as backup cooling to the 1A NV pump. Failure of this piping may fail that function and flood spray other SS Cs.

Many tanks (e.g., Liquid Waste Tanks) were identified on the Peer Review walkdowns that are not documented as potential flood sources.

Dispositioned IFSO-A2-01 (F): One important case where the cross-unit impact is not considered is the consideration of a cross-unit flood from one turbine building affecting the other turbine building.

Flooding in one turbine building can propagate to the other turbine building, per Figure 5-1 of CN-RAM-11-022 and per General Arrangement drawings. This cross-unit source should have been considered but was not considered.

Disposition Per L TR-RAM-11-13-008, after review of plant characteristics, there was found to be no cross unit impact on the offsite power transformers.

Documentation was revised to include this review.

Impact on ILRT Extension There was found to be no cross-unit impact [Reference 38]. Documentation was revised to include this review.

There is no impact on the ILRT extension.

Page 160of198

54003-CALC-02 SR IFSN-81 IFEV-A4 IFEV-A5 Revision 3 2009 ASME/ANS Cat II Requirement DOCUMENT the internal flood scenarios in a manner that facilitates PRA applications, upgrades, and peer review.

For multi-unit sites with shared systems or structures, INCLUDE multi-unit impacts on SSCs and plant-initiating events caused by internal flood scenario groups.

DETERMINE the flood-initiating event frequency for each flood scenario group by using the applicable requirements in 2-2.1.

Evaluation of Risk Significance of Permanent ILRT Extension Table A-3 Internal Flood PRA Peer Review - Facts and Observations Status Finding/Observation Discussion of how flooding of Unit 2 offsite power transformers in zone 577T02 would or would not impact Unit 1 is not documented.

Dispositioned IFSN-81-01 (F): The documentation was found lacking either supporting calculations that produced applied values (e.g., flood rates) or references to calculations outside the IFPRA documentation.

References to calculations such as break flow were not identified.

Dispositioned IFSO-A2-01 (F): One important case where the cross-unit impact is not considered is the consideration of a cross-unit flood from one turbine building affecting the other turbine building.

Flooding in one turbine building can propagate to the other turbine building, per Figure 5-1 of CN-RAM-11-022 and per General Arrangement drawings. This cross-unit source should have been considered but was not considered.

Discussion of how flooding of Unit 2 offsite power transformers in zone 577T02 would or would not impact Unit 1 is not documented.

Dispositioned IFSO-A1-01: For each flood area, the potential sources of flooding are to be identified, including equipment (e.g., piping, valves, pumps, tanks) located in the area. Section 5.5 (Table 5-4) documents potential flood sources for each flood area; however some flood areas are missing potential sources of flooding:

Disposition Flood rates were based on EPRI methodology to support !tie I EF generation for given scenarios of spray, flood, major flood or HEL8. For flood rates this resulted in evaluating the upper bound of a system's capacity and assigning the appropriate failure mechanisms (e.g. for a system with a 1,000 gpm max flow rate spray and floods were deemed appropriate failure mechanisms). All calculations used and references were adequately explained and documented throughout the analysis. For example the drain flow rate calculations were performed and documented in a manner which would allow for them to be reproduced independently. The documents were re-examined and no other calculations were found to need additional documentation or clarification.

Per L TR-RAM-11-13-008, after review of plant characteristics, there was found to be no cross unit impact on the offsite power transformers.

Documentation was revised to include this review.

Per L TR-RAM-11-13-008, missing flood sources were added and relevant scenarios were carried forward into the other calculation notes and adequately documented.

Impact on ILRT Extension This is a documentation issue and is resolved [Reference 38]. Therefore, there is no impact on the ILRT extension.

There was found to be no cross-unit impact [Reference 38]. Documentation was revised to include this review.

There is no impact on the ILRT extension.

This issue is resolved [Reference 38]

and incorporated into the internal flood model [Reference 39] used in this analysis. Therefore, there is no impact on the ILRT extension.

Page 161 of 198

54003-CALC-02 SR IFEV-B1 Revision 3 2009 ASME/ANS Cat II Requirement DOCUMENT the internal flood-induced initiating events in a manner that facilitates PRA applications, upgrades, and peer review.

Evaluation of Risk Significance of Permanent ILRT Extension Table A-3 Internal Flood PRA Peer Review - Facts and Observations Status Finding/Observation Turbine Building (577T) does not include Conventional Low Pressure Service Water (RL) or Recirculating Cooling Water System (KR).

Sections 5.3.11 and 5.3.12 indicate these piping systems are in the Turbine Building but failure of these systems is not addressed. Likewise, steam (HELB) systems are not included (e.g., Main Steam, Extraction Steam, Reheat Steam, etc).

No piping less than or equal to 2-inch diameter is included for flooding and this pipe is not considered as spray source in most areas.

Drinking Water (YD) piping was not included as a flood or spray source. Drinking Water system is in the Internal Events PRA model (HYDBACKTRM, YD System is Unavailable) as backup cooling to the 1A NV pump. Failure of this piping may fail that function and flood spray other SSCs.

Many tanks (e.g., Liquid Waste Tanks) were identified on the Peer Review walkdowns that are not documented as potential flood sources.

Dispositioned IFSN-B1-01 (F): The documentation was found lacking either supporting calculations that produced applied values (e.g., flood rates) or references to calculations outside the IFPRA documentation.

References to calculations such as break flow were not identified.

Disposition Flood rates were based on EPRI methodology to support the IEF generation for given scenarios of spray, flood, major flood or HELB. For flood rates this resulted in evaluating the upper bound of a system's capacity and assigning the appropriate failure mechanisms (e.g. for a system with a 1, ODO gpm max flow rate spray and floods were deemed appropriate failure mechanisms). All calculations used and references were adequately explained and documented throughout the analysis. For example the drain flow rate calculations were performed and documented in a manner which would allow for them to be reproduced independently. The documents were re-examined and no other calculations were found to need additional documentation or clarification.

Impact on ILRT Extension This is a documentation issue and is resolved [Reference 38]. Therefore, there is no impact on the ILRT extension.

Page 162of198

54003-CALC-02 SR CS-A11-01 CS-81-01 CS-C3 (no F&O)

Topic IDENTIFY instances where cable routing is assumed.

ANALYZE all electrical distribution buses credited in the FPRA Plant Response Model for proper overcurrent coordination and protection.

If the provision of SR CS-A 11 is used, DOCUMENT the assumed cable routing and the basis for concluding that the routing is reasonable in a manner that facilitates FPRA applications, upgrades, and peer review.

Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-4 Fire PRA Peer Review - Facts and Observations Status Closed I Met Closed/CC-I Closed I Met Finding The "Y3" assessment in Appendix B of CNC-1535.00-00-0109 excludes cables for a small number of components that are not in the ARTRAK (e.g., 7 components for Air). While the routing of the cables from the electrical panel to the compressor may be sufficient to determine that power is available, the compressor itself has instrumentation and controls, that could cause spurious trips or spurious starts that do not appear to be included in the review of Y3 components and may not be limited to the routing areas in the assumed routing. For instance, the compressor control cable will likely go to the control room for switches, alarms and other controls. Similar information would be needed for other systems credited in the Y3 list as well.

This SR was judged to be not met.

CNS performed a review of their existing electrical overcurrent coordination and protection analysis. As a result of this review, CNS identified a number of deficiencies in terms of scope and level of detail. CNS is currently in the process of completely redoing their electrical overcurrent coordination and protection analysis. The new analysis will increase the level of detail and increase the scope to include all Appendix R equipment, the PRA equipment and the NPO equipment. As part of this re-analysis, CNS is making plant modifications as needed. However, at this time, this analysis is not complete. SR considered met at CC-I.

The review of the components selected for Y3 in Appendix B do not provide justification that the components and routings for Y3 are a complete list and that the systems can be credited in all of the fire areas and scenarios where they have been excluded from the UNL list. This SR was judged to be not met.

Disposition An assumption was added to the FPRA Summary Report to indicate that the Y3 components are based on assumed routing. The Y3 list of basic events was developed considering both power and control cables in which each Y3 component could be credited. Sensitivity analysis performed in the FPRA Summary Report show that the impact of the Y3 components on quantification is relatively minimal. Credit by exclusion was used as a reasonable alternative to cable routing of Fire PRA components of lesser importance. Since this F&O has been closed and met, there is negligible impact to the ILRT extension.

The update of the breaker coordination and protection analysis was completed subsequent to the peer review and has since been incorporated into the Fire PRA. Breaker coordination related interlocks from pseudo components modeled in DATATRAK that were tabulated in Section 6.0 of the CNS Appendix R Coordination Study (Document No. 32-9043224) have been included in the Fire PRA as described in the Cable Selection Report. The model used for the ILRT extension application included this update; therefore, there is no impact to the ILRT extension.

Refer to disposition for cross-referenced F&O CS-A 11-01.

Page 163of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Table A-4 Fire PRA Peer Review - Facts and Observations SR Topic Status Finding Disposition ES-C1-01 IDENTIFY instrumentation Closed I Met HRA events are reviewed for instrumentation in Additional details were added to Appendix B of the that is relevant to the attachment B of CNC-1535.00-00-0108 revision 0. The Component Selection calculation to support the quantification of HEPs for documentation for HRA events that do not have redundant (multiple trains) and diverse (multiple operator actions that are to instrumentation in the internal events model is not parameters such as level and pressure) argument.

be addressed in the FPRA clear. Instrumentation is described in general terms Since this F&O has been closed and met, there is and quantified per SR without information on the number of trains or the negligible impact to the ILRT extension.

HRAC 1.

number of instruments available. There is not enough documentation to justify the diverse and redundant argument. This SR was judged to be not met.

ES-C2-01 IDENTIFY instrumentation Closed I CC-The Equipment Selection calculation CNC-1535.00 The Component Selection calculation was associated with each II 0108 revision 0, addresses spurious instrumentation updated to include additional details of the operator action to be under "Errors of Commission." This section states "No instrument review including the names of the addressed, based on fire-specific instruments were identified that would cause reviewers. Using the guidance provided in Section induced failure of any single an undesired operator action without first taking one or

9. 7 of the calculation and their firsthand instrument whereby one of more confirmatory actions." The results of the knowledge of CNS, the reviewers evaluated the the modes of failure to be assessment are provided, but no details are provided applicable EP(s), OP(s), & AP(s) in order to considered is spurious on who performed the review, what method was used, determine the important parameters that would be operation of the instrument.

and what procedures were reviewed. This SR was relied on for successful execution of each judged to be not met.

modeled operator action. Since this F&O has been closed and met, there is negligible impact to the ILRT extension.

FQ-A2-01 For each fire scenario Closed I Met Loss of Offsite Power (LOOP) events are not The Fire PRA model was updated to collect offsite selected per the FSS adequately represented in the Fire PRA model.

power cables under 1/2SYS-OSP which have requirements that will be Scenarios resulting in a LOOP are modeled by setting been linked to basic event PACBOFTDEX under quantified as a contributor

% T1 to TRUE along with the basic events for 6900V new gate TQ76A to address LOOP logic. This to fire-induced plant CDF Switchgear 1TA/1TD and transformers 1ATC/1ATD.

assures that the LOOP affects are reflected in the and/or LERF, IDENTIFY However, this does not satisfy all the LOOP logic, such PORV, IA, MFW, and SRV logic structure. Since the specific initiating event as the PORV and SRV response following a LOOP, this F&O has been closed and met, there is or events (e.g., general impact on Instrument Air and the ability to recover Main negligible impact to the ILRT extension.

transient. LOOP) that will Feedwater. SR judged to be met.

be used to quantify CDF and LERF.

FQ-F1-01 DOCUMENT the CDF and Closed I Met There are asymmetries in the model results between A discussion of the model asymmetries and the LERF analyses in train A and B; this is due to the assumption that A train potential impact on the Fire PRA results has been accordance with the components are normally running and B train added to the Fire PRA Model Development report.

HLRQU-F and HLR-LE-G components are in standby (and thus all maintenance Additionally, a comparison of risk results and Revision 3 Page 164of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Table A-4 Fire PRA Peer Review - Facts and Observations SR Topic Status Finding Disposition high level requirements and is assigned to that train). This results in asymmetrical importance measures for A-train versus 8-train fire their supporting results and is not discussed in the document. This SR areas and selected equipment demonstrated the requirements in the ASME was judged to be not met.

impact from model asymmetry to be insignificant PRA Standard and with respect to FRE conclusions based on 1.17 4 DEVELOP a basis acceptance thresholds (refer to Section 6.2.5).

supporting the claim of Since this F&O has been closed and met, there is nonapplicability of any of negligible impact to the ILRT extension.

the requirements under HLR-QU-A Part 2.

FQ-F1-02 DOCUMENT the CDF and Closed I Met Many specific details from HLR-QU-F and HLR-LE-G An appendix to the CNS Fire PRA Summary LERF analyses in are not documented. Specifically:

Report has been added to include an importance accordance with the

- QU-F2: Review process, identification of key measure report from the integrated cutset results HLRQU-F and HLR-LE-G equipment and operator actions, bases for mutually to address QU-F2 (the key equipment/actions).

high level requirements and exclusive events, and the process used to illustrate Sections 3.1 and 3.2 of the Model Development their supporting computer code correctness.

Report have had additional discussion provided to requirements in the ASME

- QU-F5 and LE-G5: Limitations in the quantification address LE-G2 (Spurious NS, VX). Section 4.0 of PRA Standard and process that would impact applications.

the Model Development Report addresses the DEVELOP a basis quantitative definition of significant, QU-F6 and supporting the claim of

- QU-F6 and LE-G6: Quantitative definition for LE-G6. Section 7.0 of the Application Calculation nonapplicability of any of

'significant'.

and Sections 2.2 of the model development report the requirements under

- LE-G2: Containment failure analysis and failure have been updated to addresses QUF2 and LE-HLR-QU-A Part 2.

probability estimate for containment implosion due to G5 (computer code correctness and limitations).

spurious NS or VX activation.

Section 6.2 of the Model Development report was updated to provide the basis for mutually exclusive event recovery rules. Since this F&O has been closed and met, there is negligible impact to the ILRT extension.

FSS-A1-01 IDENTIFY all risk-relevant Closed I Met Documentation of the potential sources of fire in each The Fire Scenario report documentation was ignition sources, both fixed compartment has not been completed. SR judged to be updated to list the ignition sources that were and transient, in each met.

screened from quantification for each fire unscreened physical compartment. Since this F&O has been closed analysis unit within the and met, there is negligible impact to the ILRT global analysis boundary.

extension.

FSS-A2-01 GROUP all risk-relevant Addressed Target Sets and related Failure Modes are not listed in As described in the CNS Fire Scenario Report, damage targets in each with no a comprehensive and organized fashion, and then only those targets within the zone of influence of unscreened physical impacts to linked to ignition sources. Example: For FA1, targets an ignition source (which may also be a target as Revision 3 Page 165of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Table A-4 Fire PRA Peer Review-Facts and Observations SR Topic Status Finding Disposition analysis unit within the the NFPA are (1) trays in pump room, (2) NS Pump 1A motor, (3) in the case of an NS pump) are identified for a global analysis boundary 805 NS Pump 1A itself, (4) NS Pump 1A motor junction given scenario. It was considered not practical to into one or more damage application I box, etc. Tray identification may be needed in some fire group target sets and then locate ignition sources.

target sets and for each Met areas. Then postulated ignition sources are linked to However, a list of scenarios where a specific target set, SPECIFY the each target or group of targets (i.e., oil leak to pump target was impacted (either a tray target or a equipment and cable and motor, etc.). SR judged to be met.

specific component) can be derived using the failures, including FRANC database. Note that all of the targets in specification of the failure the NS and ND pump rooms in FA 1 were modes.

assumed to be failed by the pump fire. Since this F&O has been met, there is negligible impact to the ILRT extension.

FSS-H10-DOCUMENT the walkdown Closed I Met Fire Area walkdown notes were input to a computer The fire scenario walkdown information has been 01 process and results.

database, but no output has been created for appended to the Fire Scenario Report (Appendix documentation purposes. In addition, plant drawings F) for documentation purposes. CN-1209 series identifying the fire areas and the ratings of boundaries drawings identify the fire areas and boundaries.

to these fire areas have not been found. SR judged to Since this F&O has been closed and met, there is be met.

negligible impact to the ILRT extension.

HRA-A2-01 For each fire scenario, N/A This requirement states that HRAs are identified in a The goal is to have a post transition plant with as identify any new fire-manner similar to HLR-HR-E from part 2 of the few fire specific actions as possible.

specific safe shutdown standard with emphasis on fire scenarios. SR HR-E1 Consequently, no fire specific actions are added actions called out in the discusses a systematic review of the applicable to the Fire PRA model. Any important actions plant fire response procedures for operator actions of interest. However, identified as necessary to reduce risk can be procedures in a manner the Fire Modeling documentation does not discuss the added to the procedures and model at a later consistent with the scope of review of Plant Fire procedure or other applicable time. No operator actions have been identified at selected equipment from procedures to identify fire specific actions. If this review this time; the requirement is N/A at this time. Since the ES and PRM elements was performed, then some evidence of the actions this F&O is N/A, there is negligible impact to the of the RA-S-2009 standard considered should be provided. The SR was judged to ILRT extension.

and in accordance with be not met.

HLR-HR-E and its SRs in Part 2.

HRA-A4-01 TALK THROUGH (i.e.,

Addressed Information on operator walk-throughs or talk-throughs The Fire PRA uses a set of multipliers as review in detail) with plant with no for the impact of fires on the operator actions is not described in the model development report to operations and training impacts to present in CNC-1535.00-00-0111. There is information account for fire impacts on human reliability. This personnel the procedures the NFPA in the HRA calculator sheets for the new operator process is intended to implicitly account for (in a and sequence of events to 805 actions developed but it has no information concerning conservative manner) factors influencing operator confirm that interpretation when these actions where discussed or with whom.

performance such as fire effects on Revision 3 Page 166of198

54003-CALC-02 SR HRA-83-01 HRA-C1-02 Topic of the procedures relevant to actions identified in SRs HRA-A1, HRA-A2, and HRA-A3 is consistent with plant operational and training practices.

COMPLETE the definitions of HFEs identified previously in HRA-81 and HRA-82 of this Standard and, within the context in the fire scenarios in the Fire PRA, specify the following:

accident sequence specific timing of cues, time window for completion and procedure guidance. Also specify the availability of indications for detection and high-level tasks needed to achieve the goal of the response.

For each selected fire scenario, quantify the HEPs for all HFEs, accident sequences that survive initial quantification and account for relevant fire-related effects using Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-4 Fire PRA Peer Review - Facts and Observations Status Finding application I This information should be maintained as backup CC-I information or included in the applicable document.

Addressed with no impacts to the NFPA 805 application I CC-I Closed/ CC-II Also, if the talk-th roughs have not been updated since the IPE or IPEEE days, the procedural changes may require updating for the FPRA. SR considered met at CC-I.

The methodology for HRA adjustments does not explicitly address instrumentation, timing and procedural impacts other than simple vs. complex actions, which per HRA-81-01 were noted as not defined in the documentation. The SR was judged to be not met.

A finding from the FPIE evaluation stated that HEPs are not converted from medians to means. This issue was said to be addressed with a sensitivity case.

However, this issue should be addressed in the Fire PRA. SR considered met at CC-I.

Disposition instrumentation, operator stress, and possible impact on timing. This conservative approach is judged to be consistent with a CC-I approach as indicated in SR HRA-C1 of the standard. With the HRA at CC-I, the Fire PRA results possess a conservative bias from this aspect of the analysis.

With overall risk metric results of the Fire PRA acceptable, the conservatism does not impede the use of the Fire PRA for the transition to NFPA 805. No actions have been taken to bring this HRA element to CC-II. The only potential effects on the ILRT extension are conservative; therefore, this F&O does not adversely affect the ILRT extension.

The HEP multiplier process is intended to implicitly address timing, procedure use, and instrument availability (when considered along with the instrument review documented in the component selection calculation). No changes have been made to bring the HRA to CC-II. Any effects on the ILRT extension are small and would not have a significant impact on results for the ILRT extension application.

The HEP values have been converted from median to mean in the Fire PRA model. Since this F&O has been closed and met, there is negligible impact to the ILRT extension.

Page 167of198

54003-CALC-02 SR HRA-D2-01 PRM-82-01 Topic conservative estimates, in accordance with the SRs for HLR-HR-G in Part 2 set forth under CC-I.

[HR-H2] CREDIT operator recovery actions only if a procedure is available and operator training has included the action as part of crew's training, or justification for the omission for one or both is provided.

Verify the peer review exceptions and deficiencies for the Internal Events PRA are dispositioned, and the disposition does not adversely affect the development of the Fire PRA plant response model.

Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-4 Fire PRA Peer Review - Facts and Observations Status Closed I Met Addressed with no significant impacts to the NFPA 805 application I Met Finding The one recovery action developed for the Fire PRA (TSSPZRLRHE) is not proceduralized nor is it trained on. There is no discussion of why this action can be credited, which is contrary to the requirements of HR-H2 so this SR is Not Met.

Section 4 of CNC-1535.00-00-0111 addresses PRA model quality for fire PRA use. Two potentially significant items not addressed are HRA pre-initiators (HR-A3 and HR-06) and failure probability data (DA-

81) from DPC-1535.00-00-0013 revision 2. Section 4 of the FPRA Model Development should address these two items. This SR was judged to be not met.

Disposition TSSPZRLRHE is not a "fire recovery" in the context of NFPA 805. This is an action added to the Fire PRA model to address a specific accident sequence (not fire specific) that was not yet included in the internal events model. Section 5.1 of the Model Development Report has been updated to better describe the basis for crediting this operator action. The only other non-proceduralized actions in the FPRA results are actions SMAN001 RHE and SMAN002RHE, which are the failure to swap to sump recirculation in the event of a common cause failure of the FWST level transmitters during FWST drawdown (SMAN001 RHE for a small LOCA; SMAN002RHE for a medium or large LOCA). Even with these two HEPs set to 1.0 there is no change to the FPRA risk results. Even though this action is not proceduralized, it has been demonstrated in simulator exercises that the crews will use alternate indications to successfully perform the swap. Since this F&O has been closed and met, there is negligible impact to the ILRT extension.

The CNS internal events peer review was conducted under NEI 00-02. There is no internal event PRA finding which corresponds to element HR-06 in the ASME/ANS PRA Standard; however, the HEPs have been quantified using mean values in the Fire PRA. There were no internal events peer review findings against HR-A3. No changes have been made to the Fire PRA.

Compared to post-initiator HEPs and fire induced failures, latent human error probabilities, equipment random failure rates and maintenance Page 168of198

54003-CALC-02 SR PRM-85-01 Topic For those fire-induced initiating events included in the Internal Events PRA model, REVIEW the corresponding accident sequence models and IDENTIFY any existing accident sequences that will require modification based on unique aspects of the plant fire response procedures in accordance with HLR-AS-A and HLRAS-B of the ASME PRA Standard and their support requirements and IDENTIFY any new accident sequences that Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-4 Fire PRA Peer Review - Facts and Observations Status Finding Closed I Met Reactor trip was used for fire initiating events in the model, although feedwater is failed due to lack of routing information. The plant response model is not the same for the plant trip and loss of feedwater initiating events, for example the probability of lifting a PORV or SRV is 1 E-2 for loss of feedwater and 1 E-3 for plant trip. The SR was judged to be met.

Disposition unavailability, calibration HEPs and misalignment of multiple trains of equipment are not expected to contribute significantly to overall equipment unavailability. Thus there is no material impact on the Fire PRA and no changes to the pre-initiator human error modeling have been made for the Fire PRA. The internal events peer review identified a finding against DA-81 (F&O DA-01) which noted that the data development workplace procedure did not identify component boundaries.

The finding went on to note that component boundaries are apparent from the data. The change to the workplace procedure does not impact the Fire PRA quantification and no examples where the data was found to be incorrect were identified. Modest changes to the random failure rates have little impact on the results as fire-induced failures are far more significant in the Fire PRA results. Since this F&O has been met, there is negligible impact to the ILRT extension.

The Fire PRA model was modified to add gate IEFIRES which enables the fire initiating events to inherit the plant response logic for any transient event. The transient logic in the IEPRA and consequently the Fire PRA includes transfers to all of the necessary support systems logic. Updated Section 6.3 of the Fire PRA Model Development report. Since this F&O has been closed and met, there is negligible impact to the ILRT extension.

Page 169of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Table A-4 Fire PRA Peer Review - Facts and Observations SR Topic Status Finding Disposition might result from a fire event that were not included in the Internal Events PRA in accordance with HLRAS-A and HLR-AS-8 of the ASME PRA Standard and their supporting requirements.

PRM-86-01 MODEL accident Closed I Met CNS added several new accident sequences to Section 5.1 of the Fire PRA Model Development sequences for any new address some fire-specific issues that were not part of report has been updated to provide additional initiating events identified the base PRA. The model was reviewed and generally basis for the action and the assumed HEP value.

per PRM-82 and any found to follow the process from the internal events Note that this HEP is not an NFPA 805 fire-accident sequences PRA. The one issue was identified in that one of the specific recovery event. Since this F&O has been identified per PRM-84 new sequences included a new operator action, closed and met, there is negligible impact to the reflective of the possible TSSPZRLRHE, but did not provide a basis for the ILRT extension.

plant responses to the fire-assumed timing. In the HRA quantification section, induced initiating events in CNS indicated that this was an ex-control room action accordance with HLR-AS-A with more than an hour available to perform the action.

and HR-AS-8 and their SRs However, CNS did not provide the basis for saying that in the ASME PRA Standard more than an hour was available.

and DEVELOP a defined basis to support the claim of nonapplicability of any of these requirements in the ASME PRA Standard.

PRM-87-01 IDENTIFY any cases where Closed I Met The self-assessment indicated that success criteria A discussion addressing success criteria has been new or modified success issues were considered in the Model Development added to the Fire PRA Model Development report criteria will be needed to Report. However, no evidence could be found that (section 3.4). Since this F&O has been closed and support the FPRA success criteria had been discussed in the Model met, there is negligible impact to the ILRT consistent with the HLR-Development report. The SR was judged to be not met.

extension.

SC-A and HLR-SC-8 of the ASME PRA Standard and their SRs.

PRM-811 MODEL all operator actions Closed I Met This SR is judged to be not met because of a number Refer to disposition for cross-referenced F&Os (no F&O) and operator influences in of issues associated with the identification and PRM-86-01, HRA-A4-01, & HRA-81-01. Since this incorporation of fire related HFEs. See HRA F&Os.

Revision 3 Page 170of198

54003-CALC-02 SR SF-A3-01 SF-A5-01 Topic accordance with the HRA element of this standard.

ASSESS the potential for common-cause failure of multiple fire suppression systems due to the seismically-induced failure of supporting systems such as fire pumps, fire water storage tanks, yard mains, gaseous suppression storage tanks, or building stand-pipes.

Review (a} plant fire brigade training procedures and assess the extent to which training has prepared firefighting personnel to respond to potential fire alarms and fires in the wake of an earthquake and (b) the storage and placement of firefighting support equipment and fire brigade access routes, and (c) assess the potential that an earthquake might compromise one or more of these features.

Revision 3 Evaluation of Risk Significance of Permanent ILRT Extension Table A-4 Fire PRA Peer Review - Facts and Observations Status Finding Closed I Met The seismic/fire interaction evaluation is discussed in Section 3.13 of CNC-1535.00-00-0112. In general, CNS relies upon the assessments performed for the IPEEE analyses, in particular, the walkdowns. The IPEEE walkdown is documented in CNC-1435.00 0007 and the overall IPEEE is documented in the IPEEE Submittal Report. There is no indication in the documents provided that both seismic-induced fire as well as seismic-induced failure of fire mitigation systems has been considered. The SR was judged to be not met.

Closed I Met This SR basically requires that CNS qualitatively assess their existing fire brigade training procedures to determine if the training has prepared the brigade to respond to fire alarms after an earthquake, to review their staging of fire mitigation equipment and to assess whether or not the occurrence of a seismically induced fire and any associated damage might compromise either of these elements. The CNS seismic/fire interaction evaluation is discussed in Section 3.13 of CNC-1535.00-00-0112. In general, CNS relies upon the assessments performed for the IPEEE analyses, in particular, the walkdowns. The IPEEE walkdown is documented in CNC-1435.00-00-0007 and the overall IPEEE is documented in the IPEEE Submittal Report.

A review of these documents does not show any evaluation of a seismically induced fire and the potential impacts on brigade response and equipment staging.

Disposition F&O has been closed and met, there is negligible impact to the ILRT extension.

Section 3.13 of the Fire PRA Summary report has been updated to indicate that both seismic-induced fire and seismic-induced failure of fire mitigation systems were considered in the seismic/fire interaction evaluation. No impact on quantification. Since this F&O has been closed and met, there is negligible impact to the ILRT extension.

Section 3.13 of the Fire PRA Summary Report has been updated to include an evaluation of seismically induced fire and the potential impacts on brigade response and equipment staging. No impact on quantification. Since this F&O has been closed and met, there is negligible impact to the ILRT extension.

Page 171 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension SR PP-B3 PP-B5 CS-B1 FSS-B2 Revision 3 Table A-5 Fire PRA - Category I Summary Topic Status Spatial separation not relied upon for compartment assignments. This SR, PP-B3, is judged to be met at CC-I since no spatial separation is credited and CC-II/Ill requires crediting of spatial separation as credited in the regulatory fire protection program.

Basis for Significance: As performed, adequate compartmentalization is used for the Catawba fire PRA. Possible Resolution: For CC-11/111, refinement of the compartmentalization to smaller compartment is required. (F&O PRM-B3-01)

No active fire barrier elements are credited for Catawba Fire PRA compartmentalization. The credited passive fire barriers correspond to barriers credited in the regulatory fire protection program.

Basis for Significance: The Catawba fire PRA credits only fire rated passive barriers. In order to meet Capability Category 111111, crediting of active fire barrier elements in fire compartment boundaries, with appropriate justification, is necessary.

Possible Resolution:

If CC-111111 is

desired, the PRA compartmentalization must be revised with credits for active fire barriers, with appropriate justification. (F&O PRM-B5-01)

CNS performed a review of their existing electrical over-current coordination and protection analysis. As a result of this review, CNS identified a number of deficiencies in terms of scope and level of detail. CNS is currently in the process of completely redoing their electrical over-current coordination and protection analysis. The new analysis will increase the level of detail and to increase the scope to include all Appendix R equipment, the PRA equipment and the NPO equipment. As part of this re-analysis, CNS is making plant modifications as needed. However, at this time, this analysis is not complete.

Basis for Significance: A review of the existing electrical over-current coordination and protection analysis is required to meet the SR even at the CC-I level. Possible Resolution: To move from CC-I up to CC-111111 complete the ongoing update of the electrical over-current coordination and protection analysis and formally issue the report. (F&O CS-B1-01)

Section 3.1.3 of CNC-1535.00-00-010 and Appendix E of that document identifying fire-driven parameters necessitating abandonment discuss the conditions that are assumed for fire scenarios W1 and W2 addressed in the document. A bounding type analysis for the control room was performed. To achieve Capability Category II requires a realistic characterization. The scenario analyzed are bounding in nature but could be tweaked for more realism and analysis with additional detail in order to achieve a Capability Category II rating.

Basis for Significance: Analysis presented satisfies Capability Category I requirements. Possible Resolution: If Capability Category II is desired, perform As indicated by the reviewer, adequate compartmentalization is used for the CNS Fire PRA. Not crediting spatial separation as a partitioning feature is conservative; therefore, CC-I for this SR is acceptable for the NFPA 805 application. The only potential effects on the ILRT extension are conservative; therefore, this F&O does not adversely affect the ILRT extension.

The Catawba Fire PRA analysis did not credit active barriers for partitioning, which is a conservative treatment. CC-I for this SR is acceptable for the NFPA 805 application. The only potential effects on the ILRT extension are conservative; therefore, this F&O does not adversely affect the ILRT extension.

The update of the breaker coordination and protection analysis was completed subsequent to the peer review and has since been incorporated into the Fire PRA. In some cases, the Fire PRA results were updated to reflect a larger cable footprint for affected power sources by including cables for uncoordinated loads (via related pseudo components). In other cases, the Fire PRA credited modifications to minimize or eliminate the coordination issues. This SR is now considered met at CC-11/111. The model used for the ILRT extension application included this update; therefore, there is no impact to the ILRT extension.

The MCR abandonment evaluation employed acceptable fire modeling methods and the calculated CCDP is based on the proceduralized success path provided by the SSF. CC-I for this SR is bounding; therefore CC-I is considered acceptable for the NFPA 805 application. However, the contribution of MCR abandonment is not inordinate to the overall fire CDF/LERF. The only potential effects on the ILRT extension are conservative; therefore, this F&O does not adversely affect the ILRT extension.

Page 172of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension SR FSS-C1 FSS-C2 FSS-C3 FSS-F2 FSS-F3 Revision 3 Table A-5 Fire PRA - Category I Summary Topic Status additional control room analysis with more realistically modeled scenarios, crediting panel design and other specific features of the Catawba control room design. (F&O FSS-B2-01)

A two-point treatment was used for isolated selected scenarios such as low energy panels but not for "each selected" scenario.

Basis for Significance: Analysis performed addresses Capability Category I requirements and more but not to the extent to qualify for a Capability Category II rating. Possible Resolution: If Capability Category II rating is desired, a preponderance of evaluated scenarios should be evaluated using two-point methodology. (F&O FSS-C1-01)

Peak heat release rates reflected in NUREG 6850 were utilized. Time-dependent growth heat release rate curves were not discussed.

Basis for Significance: Analysis performed meets industry practice. Possible Resolution: If Capability Category II rating is desired, then additional analysis utilizing time-dependent heat release rate information is required. (F&O FSS-C2-

01)

Burn out was considered in analysis for hot gas layer impact but did not seem to be based on fuel exhaustion but rather taking the room condition to total involvement. Additional discussion and detail addressing fuel exhaustion is required for improved rating.

Basis for Significance: Analysis performed appears to satisfy requirement but does not address detail for higher than Capability Category I rating. Possible Resolution: If Capability Category 111111 is desired, additional analysis considering the impact of fuel exhaustion in each compartment is required. (F&O FSS-C3-01)

Structural collapse is not deemed likely or addressed further. This meets Capability Category I which does not have any requirements identified. The discussion of structural collapse is qualitative in nature which does not meet the requirements for Capability Category 111111 structural collapse analyses.

Basis for Significance: Capability Category I has no requirements identified, so that SR CC-I is met. Capability Category 11/111 required more in-depth scenario development, identifying the criteria for structural collapse. Possible Resolution:

If Capability Category 111111 is desired, then more detailed structural analysis is required to be incorporated into the model. However, this may not always be cost effective. (F&O FSS-F2-01)

No quantitative discussion is provided. A qualitative discussion of structural collapse is provided in Section 3.2 of CNC-1535.00-00-011.

The Fire PRA analysis was updated to increase the number of scenario refinements using a 2-point treatment. Analysis has since been updated; SR now considered met at CC-II. The model used for the ILRT extension application included this update; therefore, there is no impact to the ILRT extension.

Time-dependent HRR profiles have since been incorporated into numerous high risk scenarios. Analysis has since been updated; SR now considered met at CC-II. The model used for the ILRT extension application included this update; therefore, there is no impact to the ILRT extension.

The treatment for the hot gas layer is a conservative screening evaluation; therefore CC-I is considered acceptable for the NFPA 805 application. The only potential effects on the ILRT extension are conservative; therefore, this F&O does not adversely affect the ILRT extension.

The Fire PRA locations were reviewed and determined to not meet the definition in FSS-F1. Therefore, this SR is N/A.

Therefore, this F&O does not adversely affect the ILRT extension.

The Fire PRA locations were reviewed and determined to not meet the definition in FSS-F1. Therefore, this SR is N/A.

Page 173of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension SR FSS-G4 FSS-H2 HRA-A3 Revision 3 Table A-5 Fire PRA - Category I Summary Topic Status Basis for Significance: Qualitative discussion meets criterion for Capability Category I. Capability Category 11/111 requires specific risk determination for structural collapse. Possible Resolution: If Capability Category 11/111 grading is required, then update of the Catawba Fire PRA is required that specifically determines fire risk resulting in structural collapse as per the SR. (F&O FSS-F3-

01)

Plans indicate that some three-hour boundaries are constructed with two-hour block with grout filled cells. No justification for this arrangement and its adequacy was provided. This is also a plant partitioning issue.

Basis for Significance: Used three-hour fire rated fire area boundaries and allowed for barrier failure in screening analysis, Attachment 4 of the Fire Scenario Report [CNC-1535.00-00-011 OJ.

Possible resolution: To achieve Capability Category 11, provide original plant construction documents and/or industry test information and building code acceptance information to justify the validity of two-hour block with grout filled cells being equivalent to a three-hour barrier. (F&O FSS-G4-01)

Duke testing was not used. Hughes report was the default report for damage mechanisms resulting in zone of influence damage criteria.

Basis for Significance: Used zone of influence scoping and documented in Generic Fire Modeling Treatments Report for project 1 SPH.02902.030 and CNC-1535.00-00-0110. Thresholds for target damage were based on industry criteria for damage with zone of influence assessment for Catawba. Catawba specific damage criteria were not used. Possible Resolution: In order to meet Capability Category 11/111 classification, the use of Catawba plant-specific damage criteria is required. Determination of plant-specific damage criteria is required with a well document technical basis. Revise and update the Fire PRA as noted above. (F&O FSS-H2-01)

The Equipment Selection Calculation CNC-1535.00-00-0108 revision 0, addresses spurious instrumentation under "Errors of Commission". This section states "No specific instruments were identified that would cause an undesired operator action without first taking one or more confirmatory actions". The results of the assessment are provided, but no details are provided on who performed the review, what method was used, and what procedures were reviewed.

Basis for Significance: There is not sufficient documentation to determine the SR is met. Possible Resolution: Add documentation describing what procedures were reviewed, what method was applied during the review, and what the qualification of the individual performing the review was. (F&O ES-C2-01)

Therefore, this F&O does not adversely affect the ILRT extension.

While conditions within the plant may still be impacted by the fire event, the major actions associated with fire mitigation are assumed to be complete within a 1 to 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months time frame. From NUREG/CR-6850, fire barriers with a minimum fire protection endurance rating of one hour can be credited to prevent the spread of fire. Therefore, the difference between a 2 or 3 hour3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months barrier rating is inconsequential to the Fire PRA. Therefore, this F&O is inconsequential the ILRT extension.

The damage criteria applied in the Generic Fire Modeling Treatments are taken from NUREG/CR-6850. No plant-specific data is available for use in lieu of NUREG/CR-6850. Since the plant-specific ignition sources are comparable to those in the Generic Fire Modeling Treatments, use of ZOI information based on the generic configurations is considered acceptable for the NFPA 805 application. Therefore, this F&O does not adversely affect the ILRT extension.

Analysis has since been updated; SR now considered met at CC-II. The model used for the ILRT extension application included this update; therefore, there is no impact to the ILRT extension.

Page 174 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension SR HRA-A4 HRA-B4 HRA-C1 Revision 3 Table A-5 Fire PRA - Category I Summary Topic Status Information on operator walk-throughs or talk-throughs for the impact of fires on the operator actions is not presented in CNC-1535.00-00-0111. There is information in the HRA Calculator sheets for the new operator actions developed, but it has no information concerning when these actions were discussed or with whom. This information should be maintained as backup information or included in the applicable document. Also, if the talk-throughs have not been updated since the IPE or IPEEE days, the procedural changes may require updating for the FPRA.

Basis for Significance: A review of procedural impacts for the fire is required to determine correct impacts on the HEPs due to events such as fire. Talk-throughs will also help verify that any additional actions are not missed.

Possible Resolution: If talk-throughs were performed for this FPRA, the information should be maintained as backup information or included in the applicable document. If the talk-th roughs have not been performed or adequately documented since the IPEEE, then the talk-throughs should be performed and documented in a manner that will help fUture updates. (F&O HRA-A4-01)

HRA events are reviewed for instrumentation in Attachment B of CNC-1535.00-00-0108, Rev. 0. The documentation for HRA events that do not have instrumentation in the internal events model is not clear. Instrumentation is described in general terms without any information on the number of trains or the number of instruments available. There is not enough documentation to justify the diverse and redundant argument.

Basis for Significance: Based on the available documentation, reviewers were unable to determine if the instrumentation supporting credited HRA events was diverse and redundant enough to credit associated events. Possible Resolution:

Provided additional details on the number, type, and trains of instrumentation being credited. (F&O ES-C1-01)

A finding from the FPIE evaluation stated that HEPs are not converted from medians to means. This issue was said to be addressed with a sensitivity case.

However, this issue should be addressed in the Fire PRA.

Basis for Significance: This finding will have a minor impact on post-accident HEP, but will cause a 2-3 times increase in pre-accident HEPs. Possible Resolution: Ensure that the HEPs are completely based on means rather than medians. (F&O HRA-C1-02)

The Fire PRA uses a set of multipliers as described in the model development report to account for fire impacts on human reliability. This process is intended to implicitly account for (in a conservative manner) factors influencing operator performance such as fire effects on instrumentation, operator stress, and possible impact on timing. This conservative approach is judged to be consistent with a CC-I approach as indicated in SR HRA-C 1 of the standard. With the HRA at CC-I, the Fire PRA results possess a conservative bias from this aspect of the analysis.

With overall risk metric results of the Fire PRA acceptable, the conservatism does not impede the use of the Fire PRA for the transition to NFPA 805. CC-I is considered acceptable for the NFPA 805 application. The only potential effects on the ILRT extension are conservative; therefore, this F&O does not adversely affect the ILRT extension.

Analysis has since been updated; SR now considered met at CC-II. The model used for the ILRT extension application included this update; therefore, there is no impact to the ILRT extension.

The Fire PRA uses a set of multipliers as described in the model development report to account for fire impacts on human reliability. This process is intended to implicitly account for (in a conservative manner) factors influencing operator performance such as fire effects on instrumentation, operator stress, and possible impact on timing. This conservative approach is judged to be consistent with a CC-I approach as indicated in SR HRA-C1 of the standard. With the HRA at CC-I, the Fire PRA results possess a conservative bias from this aspect of the analysis.

With overall risk metric results of the Fire PRA acceptable, the conservatism does not impede the use of the Fire PRA for the Page 175of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension SR HRA-01 Revision 3 Table A-5 Fire PRA - Category I Summary Topic Status CNS added several new accident sequences to address some fire-specific issues that were not part of the base PRA. The model was reviewed and generally found to follow the process from the internal events PRA. One issue was identified: One of the new sequences included a new operator action, TSSPZRLRHE, but the documentation did not provide a basis for the assumed timing. In the HRA quantification section, CNS indicated that this was an ex-control room action with more an hour was available to perform the action.

However, CNS did not provide the basis for saying that more than an hour was available.

Basis for Significance: This important information needs to be documented in relation to inclusion of a new operator action in the PRA. Possible Resolution:

CNS needs to explicitly define the basis for stating that more than an hour is available to perform an ex-control room fire-specific action. Also, CNS should review all ex-control room actions to confirm that they have reasonable bases for the assumed time available. (F&O PRM-86-01) transition to NFPA 805. CC-I is considered acceptable for the NFPA 805 application. The only potential effects on the ILRT extension are conservative; therefore, this F&O does not adversely affect the ILRT extension.

The Fire PRA uses a set of multipliers as described in the model development report to account for fire impacts on human reliability. This process is intended to implicitly account for (in a conservative manner) factors influencing operator performance such as fire effects on instrumentation, operator stress, and possible impact on timing. This conservative approach is judged to be consistent with a CC-I approach as indicated in SR HRA-C1 of the standard. With the HRA at CC-I, the Fire PRA results possess a conservative bias from this aspect of the analysis.

With overall risk metric results of the Fire P RA acceptable, the conservatism does not impede the use of the Fire PRA for the transition to NFPA 805. CC-I is considered acceptable for the NFPA 805 application. The only potential effects on the ILRT extension are conservative; therefore, this F&O does not adversely affect the ILRT extension.

Page 176of198

54003-CALC-02 F&O#

WPR-A1-02 WPR-A1-03 Revision 3 Review Element WPR-A1 WPR-A1 Level Finding Finding Evaluation of Risk Significance of Permanent ILRT Extension Table A High Wind PRA F&Os and Resolutions Issue SR CC 1/11/111 Ensure that wind-caused initiating events that give rise to significant accident sequences and/or significant accident progression sequences are included in the wind PRA system model using a systematic process.

Discussion: Assumption 5 in Section 6.1 of CNC-1535.00-00-0154 does not reflect the as-built as-operated plant and impacts the cutsets in the model.

Basis for Significance: Assumption 5 in Section 6.1 of the CNC-1535.00-00-0154 states: "A high wind initiating event is assumed to have the operators tripping the reactor if there is also high wind failure of a SSC modeled in the fault tree." This assumption is not correct based on the directions provided in procedure RP/O/A/5000/007. Refer to WPR-A 1-01 for discussion on consideration of RP/O/A/5000/007 procedures. This does not reflect the as-built as-operated plant and impacts the cutsets in the model.

Possible Resolution: Proposed solution: Delete this assumption and associated model logic.

Actual Resolution: The assumption has been deleted. The model logic has been revised as discussed in the resolution to WPR A 1-01 to induce a reactor trip for each applicable High Wind initiating event per the procedure.

ILRT Extension: Since this Finding has been resolved, there is not effect on the ILRT extension.

SR CC 1/11/111 Ensure that wind-caused initiating events that give rise to significant accident sequences and/or significant accident progression sequences are included in the wind PRA system model using a systematic process.

Discussion: No discussion was provided for screening out failure modes that could result in the loss of ultimate heat sink due to a high wind event other than those related to the class 1 structures housing the service water system.

Basis for Significance: No discussion was provided for screening out failure modes that could result in the loss of ultimate heat sink due to a high wind event other than those related to the class 1 structures housing the service water system. This initiator is important since it can affect multiple units. For example, no discussion was provided to evaluate the consequences of wind borne debris being deposited in the lake supplying safety related cooling water and choking off the intake. The basis for significance is that a potential major initiator that can affect both units is not evaluated.

Possible Resolution: Evaluate the potential for losing ultimate heat sink due to debris blocking the intake.

Actual Resolution: The potential for losing the ultimate heat sink due to debris blocking the intake has been evaluated and judged to be insignificant in the CNS HWPRA. The CNS unit's intake suction through piping located near the bottom of the lake. It is considered unlikely that sufficient debris would be in the lake and that the debris Page 177of198

54003-CALC-02 F&O#

WPR-A4-01 Review Element WPR-A4 Level Finding Evaluation of Risk Significance of Permanent ILRT Extension Table A High Wind PRA F&Os and Resolutions Issue would sink to the low level intake and plug the intake. Documentation of this judgment has been added to section 7.3.2.16 of CNC-1535.00-00-0154 Revision 1.

ILRT Extension: Since this Finding has been resolved, there is not effect on the ILRT extension.

SR CC 1/11/111 In each of the following aspects of the high wind PRA systems-analysis work, SATISFY the corresponding requirements in Part 2, except where they are not applicable or where this Part includes additional requirements.

DEVELOP a defined basis to support the claimed non-applicability of any exceptions. The aspects governed by this requirement are:

(a) initiating-event analysis, (b) accident-sequence analysis, (c) success-criteria analysis,

{d) systems analysis, (e) data analysis, (f) human-reliability analysis, (g) use of expert judgment.

When Part 2 requirements are used FOLLOW the capability category designations in Part 2, and for consistency use the same Capability Category in this analysis.

Discussion: There was no documented evidence in CNC-1535.00-00-0154, the CNS HWPRA report, to show that the high wind PRA systems-analysis work SATISFIES the corresponding requirements in Part 2 (of the PRA Standard). A defined basis to support non-applicability of any exceptions was not included. Peer Review Team did not have the time to perform a detailed review of the assessment of Part 2 i.e., P2A (calc DPC-1535.00-00-0013, PRA Quality Self-Assessment, received during the review). It is not within the scope that the Peer Review Team scope to perform the assessment of Part 2 SRs as part of this Peer Review. Without being provided with a compliance review of Part 2 SRs, the Peer Review also cannot judge that the technical elements as specified in the applicable Part 2 SRs are satisfied or not. So this F&O asks for more evidence and systematic assessment of the applicable SRs in Part 2 to meet this SR WPR-A4 and document it accordingly.

Basis for Significance: No evidence of satisfying the requirements of Part 2, or basis for exceptions to the Revision 3 Page 178 of 198

54003-CALC-02 F&O#

WPR-A4-02 Revision 3 Review Element WPR-A4 Level Finding Evaluation of Risk Significance of Permanent ILRT Extension Table A High Wind PRA F&Os and Resolutions Issue requirements, was provided or cross referenced in CNC-1535.00-00-0154, the CNS HWPRA report.

Possible Resolution: Document that the requirements of Part 2 are satisfied. Whenever an exception is taken, the PRA team needs to be cognizant of the underlying rationale for the specific Part 2 requirement so as to ensure that this rationale is considered when the exception is taken.

Actual Resolution: Documentation of compliance to the part 2 SRs is provided in appendix Hof CNC-1535.00 0154. The CNS model is undergoing update to R.G. 1.200 Rev. 2 and all deficiencies noted in the assessment will be corrected. None of the deficiencies has an impact on the HWPRA results.

ILRT Extension: Since this Finding has been resolved, there is not effect on the ILRT extension.

SR CC 11111111 In each of the following aspects of the high wind PRA systems-analysis work, SATISFY the corresponding requirements in Part 2, except where they are not applicable or where this Part includes additional requirements.

DEVELOP a defined basis to support the claimed non-applicability of any exceptions. The aspects governed by this requirement are:

(a) initiating-event analysis, (b) accident-sequence analysis, (c) success-criteria analysis, (d) systems analysis, (e) data analysis, (f) human-reliability analysis, (g) use of expert judgment.

When Part 2 requirements are used FOLLOW the capability category designations in Part 2, and for consistency use the same Capability Category in this analysis.

Discussion: Peer Review Team disagrees with some of the assessment results as stated in the P2A (DPC-1535.00-00-0013, PRA Quality Self-Assessment) report.

Basis for Significance: For example, SY-B7 is a CCI because the base system modeling used conservative Page 179of198

54003-CALC-02 F&O#

WPR-C3-01 Revision 3 Review Element WPR-C3 (also affects WPR-A10)

Level Finding Evaluation of Risk Significance of Permanent ILRT Extension Table A High Wind PRA F&Os and Resolutions Issue success criteria verses realistic as required to meet CCII - the peer review team would need to review the high wind analysis in detail to understand if the risk importance of low speed straight winds is justified. Also, given its significant importance the impact of the siding on the AC system should be documented in a system notebook to address compliance with SY-B9. We see no evidence that the AC notebook was modified or that a new notebook addressing structures was developed in compliance with SY-B9; e.g. siding integrity is essential for maintaining the integrity of the AC system during "low-speed" straight winds - these issues need to be documented in accordance with the SY requirements described in SY-C2.

Possible Resolution: Review the P2A assessment in detail, correct any errors and enhance the documentation. If a materially important mistake is discovered, its impact shall be analyzed and appropriate action taken.

Actual Resolution: Documentation of compliance to the part 2 SRs is provided in appendix Hof CNC-1535.00 0154. The CNS model is undergoing update to R.G. 1.200 Rev. 2 and all deficiencies noted in the assessment will be corrected. None of the deficiencies has an impact on the HWPRA results.

ILRT Extension: Since none of the deficiencies have an impact on the HWPRA results, there is not effect on the ILRT extension.

SR CC 1/11/111 DOCUMENT the sources of model uncertainty and related assumptions associated with the high wind plant response model development.

Discussion: Several assumptions in CNC-1535.00-00-0154, Section 6.1 need clarification:

Assumption 1 states that one tornado missile hit to a PRA SSC results in functional failure except for the main transformers in the Yard, which require two missile hits. No basis is provided for this assumption. Was fragility of the component considered or was any missile at any speed assumed to result in a functional failure? Why are two missiles needed for a functional failure of the main transformers and how were the two missiles modeled?

Assumption 4 states: F2 and greater peak gusty winds at CNS will automatically induce a LOOP. Explain basis why an F2 or greater peak gust wind automatically induces LOOP verses >F1 or >F3, for example.

Assumption 5 states: A high wind initiating event is assumed to have the operators tripping the reactor if there is also high wind failure of a SSC modeled in the fault tree. Procedure RP/O/N5000/007 requires operators take both units to hot shutdown for winds 73mph or higher - without a concurrent high wind failure. As such this assumption does not reflect the way the operators will respond.

Page 180of198

54003-CALC-02 F&O#

Revision 3 Review Element Level Evaluation of Risk Significance of Permanent ILRT Extension Table A High Wind PRA F&Os and Resolutions Issue Assumption 6 states: Conservatism is introduced when initiating event %T3, LOOP, and the High Wind-Induced LOOP events are OR'd under the same parent gate. Some High Wind-Induced LOOP events may be double counted due to inclusion in the %T3 model frequency. A characterization (e.g. sensitivity analysis) of the impact of this assumption on the model results is needed.

Assumption 7 states: Some components were modeled by high wind analysis. These components had no representation in the fault tree. Only one of the four MSSVs and one of the four MSIVs are modeled due to the Internal Event model assumption of a SGTR occurs on SG "B. Thus high wind fragilities on the other three MSSV/MSIVs are not in the fault tree. The example did not clarify if this is a conservative assumption - please explain why this assumption is conservative and if a sensitivity analysis is needed.

Assumption 8 states: System YD is the Drinking Water System is assumed failed for all high wind events. A basis is needed for this assumption including the impact on model results.

Assumption 11 states: This analysis is for Unit 1 with shared Unit 2 SSCs. Applicability of Unit 2 with shared Unit 1 SSCs is assumed for this analysis. Explain why was Unit 1 selected and why a Unit 2 model is not needed. Is the internal events CDF and LERF for Unit 1 significantly different from Unit 2?

Assumption 1 in CNC-1535.00-00-0154 Appendix A Section 8.1. CREDITING RECOVERY OF SEAL INJECTION AFTER FIRST HOUR states: Straight Line or Tornado Wind conditions will not prevent access to the SSF after one hour has elapsed from the Wind-Induced LOOP Initiating Event. What Is the basis for this assumption? It is previously stated that reaching the SSF requires travelling 100 feet outside. Debris and structural integrity issues may preclude using this path, this would not only lead to path and door blockage but personnel safety. Access may require obtaining debris removal equipment and performing structural reviews which may not be possible within one hour. In addition, the Calculation Section Addressed reference for SR WPR-C3 in Table 4-1 should be Section 6.0, not Section 7.3.3.

Basis for Significance: Basis for key assumptions must be clear to facilitate review, applications and future updates.

Possible Resolution: Improve the quality of the assumptions in the High Wind PRA report.

Actual Resolution: Each of the assumptions has been reviewed and several have been clarified and/or enhanced.

Assumptions 1, 5, 6, and 7 have been deleted as they were determined to be inapplicable. Assumptions 4, 8, 11 and Assumption 1 in Appendix G have been revised and enhanced to provide a clearer basis for each. The only model change that resulted from this review is the assumption that a failure of a PRA SSC is required to induce the wind initiating event in the model. This assumption has been removed as a reactor trip was modeled in accordance with RP/O/A/5000/007.

ILRT Extension: Since this Finding has been resolved, there is not effect on the ILRT extension.

Page 181 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension

8.

ATTACHMENT 2 RAl-02a,b Question:

RAl-02a: Page 9. What is the basis for assuming no impact on the reliability of containment isolation valves to close when demanded by an isolation signal given the test interval is increased? If there is an impact, but the assumption is that it is negligible, provide justification, preferably quantitative.

RAl-02b: Page 16. Accident sequences involving large and small isolation failures, including "failure-to-seal" events for the latter, are cited as not being affected by the ILRT frequency change. Do any of these failures potentially result from components whose failure probability is test-interval dependent? If not, confirm. If so, justify the statement that there is no effect. Page

19. This assumption is repeated for Class 6 Sequences, citing dominance due to misalignment of containment isolation valves following test/maintenance.

Response

The reduction in ILRT frequency does not impact the reliability of containment isolation valves to close in response to a containment isolation signal. The assumption is taken directly from the risk impact assessment template provided in EPRI 1018243 (1009325) [Section 3.0 of Appendix H in Reference 24]. The ILRT does not test for or affect the failure rate of containment isolation valves. The definition of the classes is given in Section 4.3 of Reference 24. The containment isolation valves are addressed in the Type C containment leakage surveillance testing frequency program per 1 OCFR 50 Appendix J (Class 5). Failure to seal is addressed in the Type B containment leakage surveillance testing frequency program per 1 OCFR 50 Appendix J (Class 4).

Revision 3 Page 182of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension RAl-02c Question:

Pages 28-29. A seismic core damage frequency (CDF) of 1.65E-5/y from the Catawba Individual Plant Examination of External Events (IPEEE) is cited. More recent updates per letter dated September 2, 2010, "Safety/Risk Assessment Results for Generic Issue 199," estimate a seismic CDF using the 2008 United States Geological Survey (USGS) Seismic Hazard Curves for Catawba of 3.7E-5/y (Table D-1, weakest link model). The Catawba analysis used a seismic CDF of 1.15E-5/y to estimate the Class 3b frequency. If the Generic Issue (Gl)-199 results were used instead, the results would be as shown below.

Class Multiplier Failure Rate Seismic CDF LERF/CDF Ratio Frequency 3b 1.00E+OO 2.29E-03 3.70E-05 3.17E-02 8.22E-08 3b-10 3.33E+OO 2.29E-03 3.70E-05 3.17E-02 2.74E-07 3b-15 5.00E+OO 2.29E-03 3.70E-05 3.17E-02 4.11 E-07 These exceed the frequencies calculated using the IPEEE by 5.67E-8/y, 1.89E-7/y and 2.83E-7/y for the three intervals, respectively. These result in the following changes to Tables 5-17 and 5-18.

Class 3 per 10 1 per 10 1 per 15 LERF Increase External 1.71 E-07 5.70E-07 8.54E-07 6.83E-07 Internal 1.17E-07 3.90E-07 5.85E-07 4.68E-07 Combined 2.88E-07 9.60E-07 1.44E-06 1.15E-06 Class 3 per 10 1 per 1 O 1 per 15 LERF Increase External 1.73E-07 5.75E-07 8.61 E-07 6.88E-07 Internal 1.17E-07 3.90E-07 5.85E-07 4.68E-07 Combined 2.90E-07 9.65E-07 1.45E-06 1.16E-06 The combined results now slightly exceed the allowed total change in LERF of 1 E-6/y for "small" changes. The total LERFs for the two units using the Gl-199 results are now as follows:

U1 = 1.67E-6/y + (3.7E-5/y x 0.0317) + 3.41 E-6/y +6.48E-7/y + 1.15E-6/y = 8.05E-6/y U2 = 1.67E-6/y + (3. 7E-5/y x 0.0317) + 3.48E-6/y +6.48E-7/y + 1.16E-6/y = 8.13E-6/y These remain below 1 E-5/y. Page 29 of Attachment 5 to the licensee's LAR states, in part, that:

Although the total change in LERF is somewhat close to the Regulatory Guide 1.17 4 limit [when calculated using the Seismic CDF from the IPEEE] when external event risk is included, several conservative assumptions were made in this ILRT analysis, as discussed in Sections 4.0, 5.1.3, 5.2.1, and 5.2.4; therefore the total change in LERF is considered conservative for this application.

Revision 3 Page 183of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension Given the delta-LERF now slightly exceeds the RG-1.174 threshold for "small" changes, address the role of the cited conservatisms in justifying the acceptability of the LERF increases.

Alternatively, provide a reassessment of the seismic risk based on the more recent USGS Seismic Hazard Curves in lieu of that used in the Gl-199 reference, such that the RG-1.174 threshold is not exceeded.

Response

Following the methodology from Reference 24 introduces several conservatisms in the b.LERF calculation, leading to a conservative value; a lower b.LERF value would be more realistic. Data used to estimate the initial probability of ILRT failure were conservatively classified; containment leakage events that would not significantly affect population dose and/or LERF calculations were included in the estimation of the ILRT failure probability. This conservatively increases the probability of a Class 3b containment leak failure in the analysis, which conservatively increases the b.LERF calculation.

The analysis assumes every containment leak event results in a LERF. Previous analyses have used 35La to represent the Class 3b containment leak and assumed this leakage resulted in a LERF. This was considered conservative. According to Reference.24, based on the exchange of a single containment volume within a 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months period, leakage of 600La to 6000La would be a more realistic containment leakage rate that would result in a LERF. However, there are no events that have occurred in the database that would constitute a large early reiease pathway.

The highest known leakage event has a leakage of 21 La. This conservatively increases the b.LERF calculation.

Thus, low containment leakage rates (low La values) with higher probabilities of occurrence are used to represent a large early release. Both the probability of a Class 3b containment leak and the leak being assumed large enough to result in a LERF are conservative for the b.LERF calculation.

The analysis methodology assumes that all Class 1 sequences coincident with a Class 3b leak failure would result in a LERF. However, some Class 1 sequences have successful operation of containment sprays, which would scrub potential releases below the large threshold and preclude a large early release even if there were a 1 OOLa leak in containment; this refinement was not used in this ILRT extension analysis. This conservatively increases the b.LERF calculation.

The analysis methodology uses a factor of 5 for the change in leak detection probability. This is conservative because it does not factor in the possibility that the failures could be detected by other means. This conservatively increases the b.LERF calculation.

In addition to the cited conservatisms in the ILRT extension analysis methodology, the estimate of the total b.LERF from external events, and particularly the contribution due to the seismic hazard, is uncertain and subject to further examination to assess the impact of the uncertainty on the ILRT extension analyses and the conclusion that the b.LERF associated with the extended test interval can be considered "small" per the R.G. 1.174 criteria.

The seismic CDF value reported in Section 5.3.1 is the value given in the current SPRA model of record [Reference 50]. This number was generated using the 1989 EPRI plant hazard data for Catawba as well as SSC fragility values given in a 1986 report prepared for Catawba by National Technical Systems [Reference 51]. These same inputs were those used in the preparation of the Catawba 1995 IPEEE report, as reviewed and accepted by the NRC.

The most recent SSE-GMRS comparison data for Catawba [Reference 52] shows that predicted earthquakes with low spectral frequencies are less than the design basis. The new GMRS is not Revision 3 Page 184of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension estimated to exceed the design SSE until the 5 to 6 Hz range. The current industry consensus is that the higher spectral frequencies are considered less damaging to plant structures and equipment. Further, low frequency earthquakes have a higher probability of occurrence than high frequency earthquakes. Since the lower spectral frequencies would produce the more damaging earthquakes and the Catawba site is designed to withstand seismic events in this range, the Catawba seismic GDF value is appropriate as stated based upon the best available information.

In addition to the assessment of the CNS seismic PRA model, the methodology in the Generic Issue 199 (Gl-199) report was reviewed. Figure A-4 and Equation 27 of Gl-199 [Reference 58]

indicates the "weak link" model is based on analytical assumptions that could introduce a conservative bias in the plant fragility assessment. The probability of failure depends on "how close" the Uniform Hazard Spectrum (UHS) is to the spectral fragility curve. A review of Appendix C, Plant Fragility Data [Reference 59], indicates that a plant fragility model with an assumed f3c of 0.4 was derived from the IPEEE analysis SPRA results and used for the Gl-199 quantification. The Catawba SPRA model used for this analysis is based on a best-estimate plant logic model with calculated fragilities for key components and structures.

Given this uncertainty in the seismic GDF estimates, including that provided' in the Gl-199

[Reference 58] report which, when used with the conservatism in the overall ILRT extension analysis methodology, slightly exceeds the allowed total change in LERF of 1 E-6/y for "small" changes, it is reasonable to conclude that the b.LERF is "small" per the criteria in R.G. 1.17 4

[Reference 4].

Revision 3 Page 185of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension RAl-03a Question:

Pages 42. A fact and observation (F&O) for IE-A8 remains Open, but is determined not to impact the ILRT extension because it is "unlikely" that plant personnel interviews would uncover any new initiating events. In performing the "extensive search" for initiating events referenced in the disposition, was simulator experience or other types of experience that might be obtained only through personnel interviews considered?

Response

The analysis performed in Reference 57 uses many different sources of information to develop an extensive list of potential internal initiating events for nuclear power plants. This study provides a reasonably complete identification of initiating events. One of the tasks for the maintenance rule expert panel is to review all systems/subsystems in the plant for the capability for the function failing to possibly cause a plant trip or safety system actuation. For all systems/subsystems identified to potentially cause a plant transient, plant personnel were interviewed and provided their expertise related to the function failing and the plant response.

Also, if applicable, if the function spuriously performed, plant personnel provided information on plant response. It is assumed that this provides a reasonable review for initiating events that may have been overlooked.

Although simulator experience was not directly used for this search, several other types of experience, including personnel interviews, was used. To arrive at a list of initiating events, an extensive literature search was performed including plant-specific events that have occurred at-power, review for events that occurred at shutdown that could also occur at-power, precursor events that could potentially be initiating events, system-by-system (including support systems) review with plant personnel, generic analyses, and PRA databases [Reference 57]. Those sources include previous PRAs, Catawba precursor events, industry precursor events, Catawba Maintenance Rule function lists, plant personnel review for potential initiators, Catawba common cause failure events, EPRI Technical report 1003113 for shutdown conditions, WOG PSA Model and Results Comparison Database, NUREG/CR-5750, and NUREG/CR-6928.

As documented in Attachment 4 of Reference 57, approximately 34 system engineers were interviewed for initiating event identification; thus, plant experience that might be obtained only through personnel interview was considered in the extensive search for initiating events.

Revision 3 Page 186of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension RAl-03b Question:

Page 47. Although not cited as an F&O at the time of the 2002 Peer Review, an action required for IE-C14 remains Open due to the need to incorporate updated industry guidance on removing credit for motor operated valves (MOVs) that could impact the LERF. With External Events included, the total LERF is - 7E-06/y for each unit (- 8E-06/y when the Gl199 seismic CDFs are incorporated, as per RAI 02.c). Provide a basis, preferably quantitative, to justify that the expected increase in CDF/LERF with credit for the MOVs removed is small enough that the risk metrics would remain in Region II.

Response

The ISLOCA isolation MOVs are not risk-significant. The increase in risk from removing credit from MO Vs NI 1788 and NI 173A in the internal events model is offset by updating the failure data for check valve rupture (CVR), which helps mitigate the assumed failure of the MOVs, to the data presented in the 201 O Parameter Estimation Update of NUREG/CR-6928 [Reference 54]. Since the change is similar for CDF and LERF, b.LERF does not change. Using the internal events model with the updated internal flood model [Reference 39], removing credit for MOVs

Nl178B and Nl173A, and updating the check valve failure rate, CDF and LERF are each estimated to decrease by 2.28E-8.

The sensitivity study of removing credit for the ISLOCA isolation MOVs and updating the failure data for the check valves does not change b.LERF and does not result in an increase in overall risk. Therefore, the ILRT extension analysis result is within the guidelines in Regulatory Guide 1.17 4 [Reference 4] for a small change in risk, as detailed in Section 5.3.1.

Revision 3 Page 187of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension RAl-03c Question:

Pages 52, 57-60. F&Os for AS-AS, SC-A1 and SC-A2 are Dispositioned, but it appears that confirmation that the results from using a 2000F criterion for core damage vs. 2500°F via the Modular Accident Analysis Program (MAAP) have not been evaluated, at least not via MAAP itself. Other justification for not revising the criterion for Catawba (i.e., similarity to McGuire) is cited, but it is not clear that this MAAP confirmation has been performed for the McGuire Nuclear Station, Units 1 and 2, either. Explain if the MAAP confirmation has been done; if not, justify why basing Catawba success criteria on MAAP runs using 2500°F vs. 2000°F for core damage remain valid.

Response

The MAAP confirmation has been done [References 45, 56, and 65]. The core damage criteria using the TCRHOT parameter in the MAAP analyses were examined to determine if using 2000

°F would impact the success criteria results. In response to the initial finding from the peer review that 4040 °F core damage success criteria was out of line with the industry, the success criteria were reanalyzed and updated to show that 2000 °F core damage success criteria were also met [Reference 45]. Based on a review of the T/H runs performed in support of success criteria and HRA timing analysis for verification, there is no impact on the results if core damage is defined as 2000°F as the F&Os describe. There was no change in the success criteria

[References 45, 56, and 65].

Revision 3 Page 188of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension RAl-03d,e Question:

RAl-03d: Pages 54-55, 136-137. F&Os for AS-81 and QU-86 remain Open and cited the need to correct the probabilistic risk assessment (PRA) to correctly account for the dependency of the turbine-driven pump (TOP) on the steam generator tube rupture (SGTR) initiator, scheduled for incorporation into the Rev. 3 PRA. Confirm that this correction has been incorporated. If not, provide a sensitivity analysis of the effect on LERF and metrics for the ILRT extension that incorporates this correction.

RAl-03e: Pages 56 and 62-63. F&Os for AS-85 and SC-A4 are Dispositioned. One item of concern was failure to model the degraded condition of the supply to the TOP given an SGTR.

The disposition cites an update to reflect the correct success criteria due to SGTR loss of the auxiliary feedwater (AFW) pump. Confirm that this update corrected the deficiency related to the degraded supply to the TOP given an SGTR.

Response

The dependency of the TOAFW pump on the SGTR initiator was incorporated in the Rev., 3 PRA. Since this ILRT extension analysis uses Rev. 3b, this issue is resolved [Reference 17].

The F&O dispositions in Table A-1 have been updated to indicate this model update is complete.

Revision 3 Page 189of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension RAl-03f Question:

Pages 89-90. An F&O for SY-814 remains Open, although concerns related to high-energy line breaks are considered resolved. However, Revision 2 of Regulatory Guide (RG)-1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," adds the following example to the supporting requirement (SR): "(h) harsh environments induced by containment venting, failure of the containment venting ducts, or failure of the containment boundary that may occur prior to the onset of core damage." Confirm that consideration of this additional example does not affect the conclusion that the I LRT extension is not impacted.

Response

The loss of containment boundary (i.e., a crack in the containment liner that could be detected by an ILRT), which may communicate a harsh environment from inside containment to the containment annulus, does not affect the conclusion that the ILRT extension is not impacted.

There is no equipment in the containment annulus that is not qualified for a harsh environment that is credited to mitigate an accident that would create a harsh environment in the CNS PRA model [References 67 and 68].

The ILRT extension analysis disposition for SY-814 has been updated to include the NRC clarification from Regulatory Guide 1.200 Rev 2 to include this discussion.

Revision 3 Page 190of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension RAl-03g Question:

Pages 101-102, 104-105. F&Os for HR-F2 and HR-G4 remain Open, citing the need to incorporate updated information related to operator actions into the PRA model. While citing no significant changes to the success criteria as the basis for negligible impact on the ILRT extension, it is not clear whether there are potentially other aspects of the PRA besides success criteria that might be affected by the needed incorporation of the operator actions. Explain further the conclusion of negligible impact despite the need to still incorporate these operator actions into the PRA model.

Response

The analysis of the new success criteria referenced in above F&Os, compared to the current PRA success criteria in regard to systems/components required and time windows for operator actions, concluded that the current success criteria are bounding or have not changed in their application as a result of the update. Therefore, the success criteria used in the PRA are acceptable and no changes are required. F&Os HR-04 and HR-05 are considered met technically, with minor documentation items open.

Revision 3 Page 191 of 198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension RAl-03h,i Question:

RAl-03h: Pages 109-113. F&Os for DA-A1 and DA-A4 are Dispositioned regarding the use of outdated generic data based on "minor changes to random failure rate[s] of the components

[are] not significant in the risk evaluations." However, it is unclear whether more recent generic data sources were reviewed such that the assertion that any changes would be "minor" is justified. Pages 114-116. An F&O for DA-C1 remains Open but appears to address the concern in the previous two F&Os in that it cites use of NUREG/CR-6928, "Industry-Average Performance for Components and Initiating Events at U.S. Commercial Nuclear Power Plants,"

(through 2010) as the primary data source for generic parameter estimates.. If this explanation is applicable to the previous two Dispositioned F&Os, confirm. If not, explain what reviews were performed, even if the generic data were not updated, to confirm that any changes would be "minor."

RAl-03i: Pages 116-118. An F&O for DA-C2 remains Open, citing collection of plant-specific failure data from Maintenance Rule documents through 2005. This suggests that the current failure data used in the PRA are at least 10 years old. The basis for "negligible impact" on the ILRT extension is that "minor changes" to random failure rates are not significant. Provide a basis for concluding that the plant-specific data used in the PRA, current only through 2005, remain representative of the past 1 O years of operation at Catawba such that the conclusion that any changes to failure data remain "minor" is justified. Note: Related to this F&O are three for DA-C11, C12 and C13 on Pages 122-123. While remaining Open due to the need for documentation, please justify all references to the 2005 limit date for collection of plant-specific failure data such that the similar conclusion of "negligible impact."

Response

A recent data update incorporated generic failure data through 201 O and plant-specific failure data through 2013 [Reference 66]. The updated type codes were input into the cr3b model; the Internal Events CDF (Internal Flood excluded) decreased slightly from 1.35E-5 to approximately 1.30E-5 and the LERF decreased from 1.12E-6 to approximately 6.53E-7. Since the CDF and LERF decrease, the open F&O disposition and older plant specific data period do not impact the conclusion of the ILRT extension risk analysis. See Section 5.3.7 for further details.

Revision 3 Page 192of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension RAl-03j Question:

Page 128. Although not cited as an F&O at the time of the 2002 Peer Review, an action, cited as "documentation," required for DA-05 remains Open. However, it is unclear that this is only a documentation issue, as it discusses the use of a "modified" multiple Greek letter (MGL) method for common-cause failure (CCF) analysis. It is unclear how far from the standard MGL method this "modification" diverges or whether it is adequately representative. Non-mandatory Appendix 1-A of ASME/ANS RA-Sa-2009, "Addenda to ASME/ANS RA-S-2008: Standard for Level 1/LERF PRA for Nuclear Power Plant Applications," ASME 2009, discusses PRA Maintenance and Upgrade and cites "new treatment of common cause failure" as a potential type of PRA Upgrade. Explain whether or not this "modified" MGL method constitutes a PRA Upgrade and why. If it constitutes an Upgrade, provide a sensitivity evaluation of its effect until a Focused-Scope Peer Review can be completed.

Response

During the development of system models, the PRA system analyst must create one or more basic events to model the impact of potential common cause failures for the common cause component groups (CCCGs) identified in each system. A "modified" MGL approach is used to identify and quantify common cause basic events (CCBEs) for the Catawba PRA model. In a "full" MGL application, a basic event is created for every combination of component failures.

However, in an attempt to simplify the fault tree logic and reduce the total number of cutsets, the various individual common cause failure combinations are grouped into a single basic event.

Each PRA system analyst also has the option to model each specific combination separately if this treatment is warranted [Reference 53].

The above description of the "modified" MGL approach is neither an update nor an upgrade to the PRA as defined in AS ME/ANS RA-Sa-2009. It is a. method to simplify the fault tree logic by grouping basic events.

Revision 3 Page 193of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension RAl-03k Question:

Pages 128-129. Although not cited as an F&O at the time of the 2002 Peer Review, an action cited for DA-D6 remains Open. Although it is assumed that any effect on CCF rates would be minor, thereby negligibly impacting the ILRT extension, this needs to be confirmed by comparing the component boundaries used in the CCF generic estimates with those assumed for the PRA. Confirm that the component boundaries assumed for the PRA assure that the generic CCF estimates are adequate.

Response

Inherent in the development of CCCGs and CCBEs and using generic data is the agreement of component boundaries assumed for the PRA and the generic CCF estimates [Reference 53].

The CNS model was reviewed and the modeling of CCF data in the fault tree was verified to be correct and the CCF basic events appropriately match the boundaries for the basic events that model the components for which CCF is modeled [Reference 60]; therefore, the CCF estimates are adequate. The disposition and impact statement for DA-D6 was updc;ited in Table A-1 to reflect this information.

Revision 3 Page 194of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension RAl-031 Question:

Pages 138-139. An F&O for QU-04 remains Open citing the need to compare the Catawba PRA results with those from similar plants. Provide assurance that, at least for those results which are relevant to the ILRT extension, the Catawba results are consistent with similar plants or, where not, the difference can be adequately explained.

Response

Catawba is a Westinghouse PWR with an Ice Condenser Containment. The internal events CDF and LERF are the relevant metric for the ILRT extension since the methodology in Reference 24 is based on total CDF and LERF. A table of similar plants with total internal events CDF and LERF is shown below. As shown in the table, CNS internal events CDF and LERF is within the same range as the CDF and LERF for similar plants.

Revision 3 Table B Internal Events Risk Comparison Plant Reference#

CDF LERF Sequoyah 1 61 1.29E-05 5.93E-06*

Sequoyah 2 61 1.18E-05 5.89E-06*

Watts Bar 1 64 1.01 E-05 5.49E-07 Watts Bar 2 64 1.06E-05 5.88E-07 DC Cook 1 62 1.33E-05 2.?0E-06 DC Cook 2 62 1.32E-05 2.?0E-06 Catawba 1&2 17 1.26E-05 1.11 E-06 McGuire 1&2 63 1.05E-05 2.13E-06

Note: LERF values are reported for internal events and internal flood risk combined. Sufficient information to separate internal events and internal flood risk was not publicly available.

Page 195of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension RAl-03m Question:

Pages 149-157. Although considered Dispositioned, numerous F&Os for IFPP-A2 through IFEV-81 justify an insignificant impact on the ILRT extension due to "internal flooding represent[ing] such a small portion of the internal events risk." However, Tables 5-1 and 5-2 in the enclosure to the licensee's LAR indicate that internal flooding contributes (3.92E5)/(5.27E-5)= 0.74 to total internal GDF and (5.58E-7)/(1.67E-6) = 0.33 to total internal LERF, Le., it is the dominant contributor in each case. If, as cited, internal flooding resolutions do not significantly impact the ILRT extension, provide appropriate justifications for all these F&Os being Dispositioned.

Response

Internal flooding represents significant impact to internal events GDF and LERF. The internal flooding dispositions have been updated in Table A-3. All of the F&Os have been resolved; therefore, there.is no impact on this ILRT extension analysis.

Revision 3 Page 196of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension RAl-03n Question:

Pages 160-161. An F&O for FSS-A2 is Dis positioned, but it is unclear whether the clarification from Revision 2 of RG-1.200 was addressed. This clarification adds "including spurious operation" to the requirement to specify failure modes for equipment and cables in the target sets. Confirm that this additional failure mode was addressed.

Response

The CNS license amendment request (LAR) to transition to NFPA 805 documents the analysis associated with the plant transitioning to NFPA 805. A portion of the analysis addressed spurious operation of single (SO) and multiple components (MSO). Duke Energy responded to the following NRC RAls regarding clarification of how spurious operation(s) were dispositioned in the analysis:

PRA RAI 17.b (treatment of spurious action for cabinet fires)

PRA RAI 19 (modeling of multiple spurious operations)

Furthermore, the results of these RAI responses were incorporated into the FPRA quantification results and were documented in the response to PRA RAI 03 [Reference 18].

Revision 3 Page 197of198

54003-CALC-02 Evaluation of Risk Significance of Permanent ILRT Extension RAl-030 Question:

Pages 162-163. An F&O for HRA-02 (referencing HR-H2) is Dispositioned based on the operator action in question not being a "recovery action" in the context of National Fire Protection Association (NFPA) Standard 805. The NFPA-805 definition of a "recovery action" is not relevant when dispositioning "recovery actions" in the context of PRA/human reliability analysis (HRA). If this action constitutes a "recovery" in the context of PRA/HRA, typically post-processed after cut-set generation, then the requirements of HR-H2 apply. Given this action has been credited, indicate (1) if it is proceduralized and trained on, as required for crediting under HR-H2; (2) if not, provide the basis for crediting it; or (3) why, despite its meeting neither (1) nor (2), it does not pose more than a negligible impact on the ILRT extension.

Response

The basis for application of action TSSPZRLRHE in the FPRA model is provided in CNS FPRA Model Development Report [Reference 55].

Action TSSPZRLRHE is required several hours into SSF operation if the SSF letdown has been lost. The need for action would be expected to be directed by the TSC as a response to increasing pressurizer level. The time available for the TSC to become staffed and evaluate the loss of letdown is sufficiently long to expect that action will be taken. The modeled response is a controlled reduction in RCS temperature, using the SG PO RVs, to allow shrinkage to offset the volume addition from the SSF SMP. The SG PORVs can be opened manually if normal operation is not possible. Manual operation of the SG PO RVs to reduce RCS temperature is proceduralized for other plant responses but not specifically as a means to control pressurizer level.

HRA-02 references HR-H2. HR-H2 states to "credit operator recovery actions only if a procedure is available and operator training has included the action as part of crew's training, or justification for the omission for one or both is provided." The only other non-proceduralized actions in the FPRA results are actions SMAN001 RHE and SMAN002RHE, which are the failure to swap to sump recirculation in the event of a common cause failure of the FWST level transmitters during FWST drawdown (SMAN001 RHE for a small LOCA; SMAN002RHE for a medium or large LOCA). Even with these two HEPs set to 1.0 there is no change to the FPRA risk results. Even though this action is not proceduralized, it has been demonstrated in simulator exercises that the crews will use alternate indications to successfully perform the swap.

Revision 3 Page 198of198

v t e Letter Sequence Other
CAC:MF7265, (Approved, Closed)
Initiation Request Acceptance Administration Questions 22 April 2016 22 April 2016 28 April 2016 Answers 20 June 2016 Results Approval Other: ML16174A371
MONTHYEAR2016-04-28 [Table View]

ML16174A371

Text

Title:

SUMMARY

3.0 REFERENCES

7.0 CONCLUSION

3.0 REFERENCES

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Navigation menu

Search