ML17179A161

Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (Sscs) for Nuclear Power Plants

ML17179A161
Person / Time
Site:	Limerick
Issue date:	06/28/2017
From:	Jim Barstow Exelon Generation Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
Download: ML17179A161 (122)

Text

200 Exelon Way Kennett Square, PA 19348 www.exeloncorp.com 10 CFR 50.90 10 CFR 50.69 June 28, 2017 U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 ATTN: Document Control Desk Limerick Generating Station, Units 1 and 2 Renewed Facility Operating License Nos. NPF-39 and NPF-85 NRC Docket Nos. 50-352 and 50-353

Subject:

Application to Adopt 10 CFR 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Plants" In accordance with the provisions of 10 CFR 50.69, and 10 CFR 50.90, "Application for amendment of license, construction permit, or early site permit," Exelon Generation Company, LLC (Exelon) is requesting an amendment to the Renewed Facility Operating License Nos. NPF-39 and NPF-85 for Limerick Generating Station (Limerick), Units 1 and 2, respectively.

The proposed amendment would modify the licensing basis by the addition of a license condition to allow for the implementation of the provisions of Title 10 of the Code of Federal Regulations (10 CFR), Part 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Plants." The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with this regulation.

For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety.

The enclosure to this letter provides the basis for the proposed change to the Limerick, Units 1 and 2, Renewed Facility Operating Licenses. The categorization process being implemented through this change is consistent with NEI 00-04, "10 CFR 50.69 SSC Categorization Guideline," Revision 0, dated July 2005, which was endorsed by the NRC in Regulatory Guide 1.201, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance," Revision 1, dated May 2006. Attachment 1 of the enclosure provides a list of categorization prerequisites. Use of the categorization process on a plant system will only occur after these prerequisites are met.

Exelon intends to submit a separate license amendment request to revise Limerick, Unit 1 and Unit 2, Technical Specifications to adopt TSTF-505, Revision 1, "Provide Risk Informed Extended Completion Times - RITSTF Initiative 4b," within the next five months using the same Probabilistic Risk Assessment (PRA) model described in the enclosure to this letter.

Exelon requests that the NRC coordinate their review of the PRA technical adequacy

License Amendment Request Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 June 28, 2017 Page 2 description in Sections 3.2 and 3.3 of this enclosure for both applications. This would reduce the number of Exelon and NRC resources necessary to complete the review of the applications. This request should not be considered a linked requested licensing action (RLA), as the details of the PRA models in each LAR are complete which will allow the NRC staff to independently review and approve each LAR on their own merits without regard to the results from the review of the other.

Note that the NRC observed the closure review of open PRA Facts and Observations (F&Os) for Limerick, Units 1 and 2, in July 2016. This was part of the industry pilot effort to develop a process for performing an industry focused scope independent closeout assessment of "Finding" level F&Os of record from prior PRA peer reviews against the ASME/ANS PRA standard. Included in this license amendment application in Attachment 3 are all of the Findings from that closure review per agreement with the NRC. Within, Attachment 3a provides the open and partially resolved F&Os and b provides the closed F&Os.

The proposed change has been reviewed by the Limerick Plant Operations Review Committee in accordance with the requirements of the Exelon Quality Assurance Program.

Exelon requests approval of the proposed license amendment by June 28, 2018, with the amendment being implemented within 60 days.

In accordance with 10 CFR 50.91, "Notice for public comment; State consultation,"

paragraph (b), Exelon is notifying the Commonwealth of Pennsylvania of this application for license amendment by transmitting a copy of this letter and its attachments to the designated State Official.

This letter contains no regulatory-commitments.

If you should have any questions regarding this submittal, please contact Glenn Stewart at 610-765-5529.

I declare under penalty of perjury that the foregoing is true and correct. Executed on this 281h day of June 2017.

RespectfuS iJM\\I, ~ ~

James Barstow Director - Licensing and Regulatory Affairs Exelon Generation Company, LLC

Enclosure:

Evaluation of the Proposed Change cc:

USNRC Region I, Regional Administrator USNRC Project Manager, Limerick USNRC Senior Resident Inspector, Limerick Director, Bureau of Radiation Protection - Pennsylvania Department of Environmental Protection

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 i

Enclosure Evaluation of the Proposed Change TABLE OF CONTENTS 1

SUMMARY

DESCRIPTION..................................................................................... 3 2

DETAILED DESCRIPTION..................................................................................... 4 2.1 CURRENT REGULATORY REQUIREMENTS.......................................................4 2.2 REASON FOR PROPOSED CHANGE.....................................................................4

2.3 DESCRIPTION

OF THE PROPOSED CHANGE...................................................6 3

TECHNICAL EVALUATION..................................................................................... 7 3.1 CATEGORIZATION PROCESS DESCRIPTION (10 CFR 50.69(b)(2)(i)).8 Overall Categorization Process.............................................................8 3.1.1 Passive Categorization Process..........................................................10 3.1.2 3.2 TECHNICAL ADEQUACY EVALUATION (10 CFR 50.69(b)(2)(ii))..........11 Internal Events and Internal Flooding.............................................11 3.2.1 Fire Hazards...............................................................................................12 3.2.2 Seismic Hazards........................................................................................12 3.2.3 Other External Hazards.........................................................................13 3.2.4 Low Power & Shutdown........................................................................13 3.2.5 PRA Maintenance and Updates...........................................................13 3.2.6 PRA Uncertainty Evaluations...............................................................14 3.2.7 3.3 PRA REVIEW PROCESS RESULTS (10 CFR 50.69(b)(2)(iii))..................15 3.4 RISK EVALUATIONS (10 CFR 50.69(b)(2)(iv))..........................................15 4

REGULATORY EVALUATION............................................................................... 17 4.1 APPLICABLE REGULATORY REQUIREMENTS/CRITERIA.........................17 4.2 NO SIGNIFICANT HAZARDS CONSIDERATION ANALYSIS.....................17

4.3 CONCLUSION

S.........................................................................................................19 5

ENVIRONMENTAL CONSIDERATION................................................................ 20 6

REFERENCES......................................................................................................... 21

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 ii LIST OF ATTACHMENTS

List of Categorization Prerequisites................................................... 23 : Description of PRA Models used in Categorization............................. 24 : Disposition and Resolution of Peer Review Findings and Self-Assessment Items.................................................................... 25 a: Open and Partially Resolved Peer Review Findings........................... 26 b: Resolved Peer Review Findings....................................................... 54 : External Hazards Screening............................................................. 112 : Progressive Screening Approach for Addressing External Hazards....... 120

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 3

1

SUMMARY

DESCRIPTION The proposed amendment would modify the licensing basis for Limerick Generating Station (Limerick), Units 1 and 2, by the addition of a license condition to allow for the implementation of the provisions of Title 10 of the Code of Federal Regulations (10 CFR), Part 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Plants." The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with this regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety.

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 4

2 DETAILED DESCRIPTION 2.1 CURRENT REGULATORY REQUIREMENTS The Nuclear Regulatory Commission (NRC) has established a set of regulatory requirements for commercial nuclear reactors to ensure that a reactor facility does not impose an undue risk to the health and safety of the public, thereby providing reasonable assurance of adequate protection to public health and safety. The current body of NRC regulations and their implementation are largely based on a "deterministic" approach.

This deterministic approach establishes requirements for engineering margin and quality assurance in design, manufacture, and construction. In addition, it assumes that adverse conditions can exist (e.g., equipment failures and human errors) and establishes a specific set of design basis events (DBEs). The deterministic approach then requires that the facility include safety systems capable of preventing or mitigating the consequences of those DBEs to protect public health and safety. Those SSCs necessary to defend against the DBEs are defined as "safety-related," and these SSCs are the subject of many regulatory requirements, herein referred to as "special treatments," designed to ensure that they are of high quality and high reliability, and have the capability to perform during postulated design basis conditions. Treatment includes, but is not limited to, quality assurance, testing, inspection, condition monitoring, assessment, evaluation, and resolution of deviations. The distinction between "treatment" and "special treatment" is the degree of NRC specification as to what must be implemented for particular SSCs or for particular conditions. Typically, the regulations establish the scope of SSCs that receive special treatment using one of three different terms: "safety-related," "important to safety," or "basic component."

The terms "safety-related "and "basic component" are defined in the regulations, while "important to safety," used principally in the general design criteria (GDC) of Appendix A to 10 CFR Part 50, is not explicitly defined.

2.2 REASON FOR PROPOSED CHANGE A probabilistic approach to regulation enhances and extends the traditional deterministic approach by allowing consideration of a broader set of potential challenges to safety, providing a logical means for prioritizing these challenges based on safety significance, and allowing consideration of a broader set of resources to defend against these challenges. In contrast to the deterministic approach, Probabilistic Risk Assessments (PRAs) address credible initiating events by assessing the event frequency. Mitigating system reliability is then assessed, including the potential for common cause failures. The probabilistic approach to regulation is an extension and enhancement of traditional regulation by considering risk in a comprehensive manner.

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 5

To take advantage of the safety enhancements available through the use of PRA, in 2004 the NRC published a new regulation, 10 CFR 50.69. The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with the regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety.

The rule contains requirements on how a licensee categorizes SSCs using a risk-informed process, adjusts treatment requirements consistent with the relative significance of the SSC, and manages the process over the lifetime of the plant. A risk-informed categorization process is employed to determine the safety significance of SSCs and place the SSCs into one of four risk-informed safety class (RISC) categories.

The determination of safety significance is performed by an integrated decision-making process, as described by NEI 00-04, "10 CFR 50.69 SSC Categorization Guideline" (Reference 1), which uses both risk insights and traditional engineering insights. The safety functions include the design basis functions, as well as functions credited for severe accidents (including external events). Special or alternative treatment for the SSCs is applied as necessary to maintain functionality and reliability, and is a function of the SSC categorization results and associated bases. Finally, periodic assessment activities are conducted to make adjustments to the categorization and/or treatment processes as needed so that SSCs continue to meet all applicable requirements.

The rule does not allow for the elimination of SSC functional requirements or allow equipment that is required by the deterministic design basis to be removed from the facility. Instead, the rule enables licensees to focus their resources on SSCs that make a significant contribution to plant safety. For SSCs that are categorized as high safety significant, existing treatment requirements are maintained or enhanced. Conversely, for SSCs that do not significantly contribute to plant safety on an individual basis, the rule allows an alternative risk-informed approach to treatment that provides reasonable, though reduced, level of confidence that these SSCs will satisfy functional requirements.

Implementation of 10 CFR 50.69 will allow Exelon to improve focus on equipment that has safety significance resulting in improved plant safety.

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 6

2.3 DESCRIPTION

OF THE PROPOSED CHANGE Exelon proposes the addition of the following condition to the renewed facility operating licenses of Limerick, Units 1 and 2, to document the NRC's approval of the use of 10 CFR 50.69.

Exelon is approved to implement 10 CFR 50.69 using the processes for categorization of Risk-Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC-4 structures, systems, and components (SSCs) specified in the license amendment dated [DATE].

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 7

3 TECHNICAL EVALUATION 10 CFR 50.69 specifies the information to be provided by a licensee requesting adoption of the regulation. This request conforms to the requirements of 10 CFR 50.69(b)(2), which states:

A licensee voluntarily choosing to implement this section shall submit an application for license amendment under § 50.90 that contains the following information:

(i) A description of the process for categorization of RISC-1, RISC-2, RISC-3 and RISC-4 SSCs.

(ii) A description of the measures taken to assure that the quality and level of detail of the systematic processes that evaluate the plant for internal and external events during normal operation, low power, and shutdown (including the plant-specific probabilistic risk assessment (PRA), margins-type approaches, or other systematic evaluation techniques used to evaluate severe accident vulnerabilities) are adequate for the categorization of SSCs.

(iii) Results of the PRA review process conducted to meet § 50.69(c)(1)(i).

(iv) A description of, and basis for acceptability of, the evaluations to be conducted to satisfy § 50.69(c)(1)(iv). The evaluations must include the effects of common cause interaction susceptibility, and the potential impacts from known degradation mechanisms for both active and passive functions, and address internally and externally initiated events and plant operating modes (e.g., full power and shutdown conditions).

Each of these submittal requirements is addressed in the proceeding sections.

Exelon intends to submit a separate license amendment request to revise technical specifications to adopt TSTF-505, Revision 1, "Provide Risk Informed Extended Completion Times - RITSTF Initiative 4b," for Limerick, Units 1 and 2, within the next five months using the same PRA model described in this enclosure. Exelon requests that the NRC coordinate their review of the PRA technical adequacy description in Sections 3.2 and 3.3 of this enclosure for both applications. This would reduce the number of Exelon and NRC resources necessary to complete the review of the applications. This request should not be considered a linked requested licensing action (RLA), as the details of the PRA models in each LAR are complete which will allow the NRC staff to independently review and approve each LAR on their own merits without regard to the results from the review of the other.

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 8

Note that the NRC observed the closure review of open PRA Facts and Observations (F&Os) for Limerick, Units 1 and 2, in July 2016. This was part of the industry pilot effort to develop a process for performing an industry focused scope independent closeout assessment of "Finding" level F&Os of record from prior PRA peer reviews against the ASME/ANS PRA standard. Included in this license amendment application in Attachment 3 are all of the Findings from that closure review per agreement with the NRC. Within Attachment 3, Attachment 3a provides the open and partially resolved F&Os and Attachment 3b provides the closed F&Os.

3.1 CATEGORIZATION PROCESS DESCRIPTION (10 CFR 50.69(b)(2)(i))

Overall Categorization Process 3.1.1 Exelon will implement the risk categorization process in accordance with NEI 00-04, Revision 0, as endorsed by RG 1.201, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance," (Reference 2). NEI 00-04, Section 1.5, states "Due to the varying levels of uncertainty and degrees of conservatism in the spectrum of risk contributors, the risk significance of SSCs is assessed separately from each of five risk perspectives and used to identify SSCs that are potentially safety-significant." Separate evaluation is appropriate to avoid reliance on a combined result that may mask the results of individual risk contributors.

The following are clarifications to be applied to the NEI 00-04 categorization process:

The Integrated Decision-making Panel (IDP) will be composed of a group of at least five experts who collectively have expertise in plant operation, design (mechanical and electrical) engineering, system engineering, safety analysis, and probabilistic risk assessment. At least three members of the IDP will have a minimum of five years of experience at the plant, and there will be at least one member of the IDP who has a minimum of three years of experience in modeling and updating of the plant-specific PRA.

The IDP will be trained in the specific technical aspects and requirements related to the categorization process. Training will address at a minimum the purpose of the categorization; present treatment requirements for SSCs including requirements for: design basis events; PRA fundamentals; details of the plant specific PRA including the modeling, scope, and assumptions, the interpretation of risk importance measures, and the role of sensitivity studies and the change-in-risk evaluations; and the defense-in-depth philosophy and requirements to maintain this philosophy.

The decision criteria for the IDP for categorizing SSCs as safety significant or low safety-significant pursuant to § 50.69(f)(1) will be documented in Exelon

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 9

procedures. Decisions of the IDP will be arrived at by consensus. Differing opinions will be documented and resolved, if possible. If a resolution cannot be achieved concerning the safety significance of an SSC, then the SSC will be classified as safety-significant.

Passive characterization will be performed using the processes described in Section 3.1.2 of this enclosure.

An unreliability factor of 3 will be used for the sensitivity studies described in Section 8 of NEI 00-04. The factor of 3 was chosen as it is representative of the typical error factor of basic events used in the PRA model.

• Exelon will require that if any SSC is identified as high safety significant (HSS) from either the integrated PRA component safety significance assessment (Section 5 of NEI 00-04) or the defense-in-depth assessment (Section 6 of NEI 00-04), the associated system function(s) would be identified as HSS.

• Once a system function is identified as HSS, then all the components that support that function are preliminary HSS. The Integrated Decision-making Panel (IDP) must intervene to assign any of these HSS Function components to LSS.

• For the risk-informed categorization assessment, for the criteria that consider whether the active function is called out or relied upon in the plant Emergency/Abnormal Operating Procedures, Exelon will not take credit for alternate means unless the alternate means are proceduralized and included in Licensed Operator training.

The risk analysis being implemented for each hazard is described:

• Internal Event Risks: Internal events including internal flooding PRA model LG113A and LG213A, January 2014.

• Fire Risks: Fire PRA model versions LG113A2F0 and LG213A2F0, May 2016.

• Seismic Risks: Success Path Component List (SPCL) from the IPEEE seismic analysis accepted by NRC SER dated February 28, 2000, TAC NOS. M83636 and M83637 (Reference 3).

• Other External Risks (e.g., tornados, external floods, etc.): Using the IPEEE screening process as approved by NRC SER dated February 28, 2000, TAC NOS.

M83636 and M83637. The other external hazards were determined to be insignificant contributors to plant risk.

• Low Power and Shutdown Risks: Qualitative defense-in-depth (DID) shutdown model for shutdown configuration risk management (CRM) based on the framework for DID provided in NUMARC 91-06, "Guidance for Industry Actions to Assess Shutdown Management" (Reference 4), which provides guidance for assessing and enhancing safety during shutdown operations.

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 10 A change to the categorization process that is outside the bounds specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach) will not be used without prior NRC approval. The SSC categorization process documentation will include the following elements:

1.

Program procedures used in the categorization

2.

System functions, identified and categorized with the associated bases

3.

Mapping of components to support function(s)

4.

PRA model results, including sensitivity studies

5.

Hazards analyses, as applicable

6.

Passive categorization results and bases

7.

Categorization results including all associated bases and RISC classifications

8.

Component critical attributes for HSS SSCs

9.

Results of periodic reviews and SSC performance evaluations

10.

IDP meeting minutes and qualification/training records for the IDP members Passive Categorization Process 3.1.2 For the purposes of 10 CFR 50.69 categorization, passive components are those components that have a pressure retaining function. Passive components and the passive function of active components will be evaluated using the Risk-Informed Repair/Replacement Activities (RI-RRA) methodology consistent with the Safety Evaluation Report (SER) issued by the Office of Nuclear Reactor Regulation: "Request for Alternative ANO2-R&R-004, Revision 1, Request to Use Risk-informed Safety Classification and Treatment for Repair/Replacement Activities in Class 2 and 3 Moderate and High Energy Systems, Third and Fourth 10-Year In-service Inspection Intervals," dated April 22, 2009 (ML090930246).

The RI-RRA methodology is a risk-informed safety classification and treatment program for repair/replacement activities (RI-RRA methodology) for pressure retaining items and their associated supports. In this method, the component failure is assumed with a probability of 1.0 and only the consequence evaluation is performed. It additionally applies deterministic considerations (e.g., defense in depth, safety margins) in determining safety significance. Component supports are assigned the same safety significance as the highest passively ranked component within the bounds of the associated analytical pipe stress model.

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 11 The use of this method was previously approved to be used for a 10 CFR 50.69 application by NRC in the final Safety Evaluation for the Vogtle Electric Generating Plant (Vogtle) dated December 17, 2014 (Reference 5). The RI-RRA method as approved for use at Vogtle for 10 CFR 50.69 does not have any plant specific aspects and is generic. It relies on the conditional core damage and large early release probabilities associated with postulated ruptures. Safety significance is generally measured by the frequency and the consequence of the event. However, this RI-RRA process categorizes components solely based on consequence, which measures the safety significance of the passive component given that it ruptures. This approach is conservative compared to including the rupture frequency in the categorization as this approach will not allow the categorization of SSCs to be affected by any changes in frequency due to changes in treatment. Therefore, the RI-RRA methodology for passive categorization is acceptable and appropriate for use at Limerick, Units 1 and 2, for 10 CFR 50.69.

3.2 TECHNICAL ADEQUACY EVALUATION (10 CFR 50.69(b)(2)(ii))

The following sections demonstrate that the quality and level of detail of the processes used in categorization of SSCs are adequate. All the PRA models described below have been peer reviewed and there are no PRA upgrades that have not been peer reviewed.

Internal Events and Internal Flooding 3.2.1 The Limerick categorization process for the internal events and flooding hazard will use the plant-specific PRA model. The Exelon risk management process ensures that the PRA model used in this application reflects the as-built and as-operated plant for each of the Limerick units. Attachment 2 of this enclosure identifies the applicable internal events and internal flooding PRA models.

Peer reviews of the PRA models for the Full Power Internal Events (FPIE) and Internal Flood (IF) models were performed in 2005 and 2008, respectively. Additionally, a gap assessment to the current standard, ASME/ANS Ra-Sa-2009 (Reference 6), and RG 1.200, Revision 2 (Reference 7) has been performed. The gap assessment did not identify any deficiencies that were not identified by the peer reviews or were not previously self-identified with respect to the new standard.

The 2005 FPIE peer review findings and the 2008 IF peer review findings were addressed and in July 2016 a review of the peer review findings and the resolutions was performed by an independent review team (Reference 8). The independent review team concluded that, for the FPIE, three findings were not resolved. Two of the three findings are documentation related, and one of the findings can be addressed by a minor model change. For the Internal Flood (IF) findings, the review team concluded that one finding was not resolved and that seven findings were partially resolved. The eight unresolved IF findings are mostly related to minor model enhancements and

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 12 documentation issues. All findings have been dispositioned in Attachment 3 of this enclosure.

Fire Hazards 3.2.2 The Limerick categorization process for fire hazards will use a peer reviewed plant-specific fire PRA model. The Exelon risk management process ensures that the PRA model used in this application reflects the as-built and as-operated plant for each of the Limerick units. Attachment 2 of this enclosure identifies the applicable Fire PRA model.

A peer review of the Limerick Fire PRA (FPRA) model was performed in November 2011.

The findings were addressed and in July 2016 a review of the FPRA peer review findings and the resolutions was performed by the independent review team (Reference 8). The independent review team concluded that 14 of the findings were either partially resolved or still open. An additional six findings were not assessed by the independent review team since they were assessed as being open prior to the independent review.

All findings have been dispositioned in Attachment 3 of this enclosure.

Seismic Hazards 3.2.3 The Limerick categorization process will use the seismic margins analysis (SMA) performed for the Individual Plant Evaluation-External Events (IPEEE) in response to GL 88-20 (Reference 9) for evaluation of safety significance related to seismic hazards. No plant specific approaches were utilized in development of the SMA. NEI 00-04 approved use of the SMA safe shutdown equipment list (SSEL) (also called the success path component list, or SPCL at Limerick) as a screening process that identifies all system functions and associated SSCs that are involved in the seismic margin success path as HSS. Since the analysis is being used as a screening tool, importance measures are not used to determine safety significance. The NEI 00-04 approach using the SPCL would identify credited equipment as HSS regardless of their capacity, frequency of challenge or level of functional diversity.

An evaluation was performed of the as-built, as-operated plant against the SMA SPCL.

The evaluation was a comparison of the as-built, as-operated plant to the plant configuration originally assessed by the SMA. Differences were reviewed to identify any potential impacts to the equipment credited on the SPCL. Appropriate changes to the credited equipment were identified and documented. This documentation is available for audit. The Exelon risk management program ensures that future changes to the plant will be evaluated to determine their impact on the SMA and risk categorization process.

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 13 Other External Hazards 3.2.4 The Limerick categorization process will use screening results from the Individual Plant Evaluation of External Events (IPEEE) in response to GL 88-20 for evaluation of safety significance related to the following other external hazards:

• High Winds

• External Flooding

• Transportation and Nearby Facility Accidents

• Other External Initiating Events (i.e., other "HFO" Events)

All SSCs credited in other IPEEE external hazards are considered HSS. All other external hazards were screened from applicability to Limerick, Units 1 and 2, per a plant-specific evaluation (Reference 3) in accordance with GL 88-20 and updated to use the criteria in ASME PRA Standard RA-Sa-2009. Attachment 4 of this enclosure lists the results of the other external hazards screening. Attachment 5 of this enclosure provides a summary of the progressive screening approach for external hazards.

Low Power & Shutdown 3.2.5 The Limerick categorization process will use the shutdown safety management plan described in NUMARC 91-06, for evaluation of safety significance related to low power and shutdown conditions.

PRA Maintenance and Updates 3.2.6 The Exelon risk management process ensures that the applicable PRA models used in this application continue to reflect the as-built and as-operated plant for each of the Limerick units. The process delineates the responsibilities and guidelines for updating the PRA models, and includes criteria for both regularly scheduled and interim PRA model updates. The process includes provisions for monitoring potential areas affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, industry operational experience) for assessing the risk impact of unincorporated changes, and for controlling the model and associated computer files. The process will assess the impact of these changes on the plant PRA model in a timely manner but no longer than once every two refueling outages. If there is a significant impact on the PRA model, the SSC categorization will be re-evaluated.

In addition, Exelon will implement a process that addresses the requirements in NEI 00-04, Section 11, "Program Documentation and Change Control." The process will review the results of periodic and interim updates of the plant PRA that may affect the results of the categorization process. If the results are affected, adjustments will be made as necessary to the categorization or treatment processes to maintain the

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 14 validity of the processes. In addition, any PRA model upgrades will be peer reviewed prior to implementing those changes in the PRA model used for categorization.

PRA Uncertainty Evaluations 3.2.7 Uncertainty evaluations associated with any applicable baseline PRA model(s) used in this application were evaluated during the assessment of PRA technical adequacy and confirmed through the self-assessment and peer review processes as discussed in Section 3.3 of this enclosure.

Uncertainty evaluations associated with the risk categorization process are addressed using the processes discussed in Section 8 of NEI 00-04 and in the prescribed sensitivity studies discussed in Section 5 of NEI 00-04.

In the overall risk sensitivity studies, Exelon will utilize a factor of 3 to increase the unavailability or unreliability of LSS components consistent with that approved for Vogtle in Reference 5. Consistent with the NEI 00-04 guidance, Exelon will perform both an initial sensitivity study and a cumulative sensitivity study. The initial sensitivity study applies to the system that is being categorized. In the cumulative sensitivity study, the failure probabilities (unreliability and unavailability, as appropriate) of all LSS components modeled in PRAs for all systems that have been categorized are increased by a factor of 3. This sensitivity study together with the periodic review process assures that the potential cumulative risk increase from the categorization is maintained acceptably low. The performance monitoring process monitors the component performance to ensure that potential increases in failure rates of categorized components are detected and addressed before reaching the rate assumed in the sensitivity study.

Sources of model uncertainty and related assumptions have been identified for the Limerick PRA models using the guidance of NUREG-1855 (Reference 10) and EPRI TR-1016737, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments" (Reference 11).

The detailed process of identifying, characterizing and qualitative screening of model uncertainties is found in Section 5.3 of NUREG-1855 and Section 3.1.1 of EPRI TR-1016737. The process in these references was mostly developed to evaluate the uncertainties associated with the internal events PRA model; however, the approach can be applied to other types of hazard groups.

The list of assumptions and sources of uncertainty have been reviewed to identify those which would be significant for the evaluation of this application. If the Limerick PRA model uses non-conservative treatments, or uses methods not commonly accepted, the underlying assumption or source of uncertainty was reviewed to

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 15 determine its impact on this application. Only those assumptions or sources of uncertainty that could significantly impact the categorization risk calculations were considered key for this application.

Key Limerick PRA model specific assumptions and sources of uncertainty for this application have been identified and dispositioned and are available for NRC audit. The conclusion of this review is that no additional sensitivity analyses are required to address Limerick PRA model specific assumptions or sources of uncertainty.

3.3 PRA REVIEW PROCESS RESULTS (10 CFR 50.69(b)(2)(iii))

The PRA models described in Section 3.2 above have been assessed against RG 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2, consistent with NRC RIS 2007-06.

Specifically, the models were subject to prior peer reviews, and an F&O closure review was conducted in July 2016. of this enclosure provides a summary disposition of:

• Open items and disposition from the Limerick RG 1.200 self-assessment.

• Open findings and disposition of the Limerick PRA peer reviews.

• Identification of and basis for any sensitivity analysis needed to address open findings.

Although the peer review of the fire PRA was performed against RG 1.200, Rev. 2, the peer review of the Internal Events PRA model (including internal flood) was performed prior to the publication of RG 1.200, Rev. 2, and was assessed against the NRC RG 1.200 pilot in July 2004. The internal flood portion of the model was assessed against RG 1.200, Rev. 1 (Reference 12), in May 2008. Therefore, gap assessments were conducted to assess the differences between RG 1.200, Rev. 2, against the prior publications. Those assessments confirmed that the PRA model meets the requirements of RG 1.200, Rev. 2. Results from the assessments are documented and are available for NRC audit.

This information demonstrates that the PRA is of sufficient quality and level of detail to support the categorization process, and has been subjected to a peer review process assessed against a standard or set of acceptance criteria that is endorsed by the NRC as required 10 CFR 50.69(c)(1)(i).

3.4 RISK EVALUATIONS (10 CFR 50.69(b)(2)(iv))

The Limerick 10 CFR 50.69 categorization process will implement the guidance in NEI 00-04. The overall risk evaluation process described in the NEI guidance addresses both

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 16 known degradation mechanisms and common cause interactions, and meets the requirements of §50.69(b)(2)(iv). Sensitivity studies described in NEI 00-04, Section 8, will be used to confirm that the categorization process results in acceptably small increases to core damage frequency (CDF) and large early release frequency (LERF).

The failure rates for equipment and initiating event frequencies used in the PRA include the quantifiable impacts from known degradation mechanisms, as well as other mechanisms (e.g., design errors, manufacturing deficiencies, human errors, etc.).

Subsequent performance monitoring and PRA updates required by the rule will continue to capture this data, and provide timely insights into the need to account for any important new degradation mechanisms.

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 17 4

REGULATORY EVALUATION 4.1 APPLICABLE REGULATORY REQUIREMENTS/CRITERIA The following NRC requirements and guidance documents are applicable to the proposed change:

• The regulations at Title 10 of the Code of Federal Regulations (10 CFR) Part 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors."

• NRC Regulatory Guide 1.201, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance,"

Revision 1, May 2006.

• Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis,"

Revision 2, April 2015.

• Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2, US Nuclear Regulatory Commission, March 2009.

The proposed change is consistent with the applicable regulations and regulatory guidance.

4.2 NO SIGNIFICANT HAZARDS CONSIDERATION ANALYSIS Exelon proposes to modify the licensing basis for Limerick Generating Station, Units 1 and 2, by the addition of a license condition to allow for the voluntary implementation of the provisions of Title 10 of the Code of Federal Regulations (10 CFR), Part 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Plants." The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with this regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety.

Exelon has evaluated whether or not a significant hazards consideration is involved with the proposed amendments by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 18

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed change will permit the use of a risk-informed categorization process to modify the scope of SSCs subject to NRC special treatment requirements and to implement alternative treatments per the regulations. The process used to evaluate SSCs for changes to NRC special treatment requirements and the use of alternative requirements ensures the ability of the SSCs to perform their design function. The potential change to special treatment requirements does not change the design and operation of the SSCs. As a result, the proposed change does not significantly affect any initiators to accidents previously evaluated or the ability to mitigate any accidents previously evaluated. The consequences of the accidents previously evaluated are not affected because the mitigation functions performed by the SSCs assumed in the safety analysis are not being modified. The SSCs required to safely shut down the reactor and maintain it in a safe shutdown condition following an accident will continue to perform their design functions.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed change will permit the use of a risk-informed categorization process to modify the scope of SSCs subject to NRC special treatment requirements and to implement alternative treatments per the regulations. The proposed change does not change the functional requirements, configuration, or method of operation of any SSC. Under the proposed change, no additional plant equipment will be installed.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

The proposed change will permit the use of a risk-informed categorization process to modify the scope of SSCs subject to NRC special treatment

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 19 requirements and to implement alternative treatments per the regulations. The proposed change does not affect any Safety Limits or operating parameters used to establish the safety margin. The safety margins included in analyses of accidents are not affected by the proposed change. The regulation requires that there be no significant effect on plant risk due to any change to the special treatment requirements for SSCs and that the SSCs continue to be capable of performing their design basis functions, as well as to perform any beyond design basis functions consistent with the categorization process and results.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, Exelon concludes that the proposed change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c),

and, accordingly, a finding of "no significant hazards consideration" is justified.

4.3 CONCLUSION

S In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 20 5

ENVIRONMENTAL CONSIDERATION A review has determined that the proposed amendments would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed amendments do not involve (i) a significant hazards consideration, (ii) a significant change in the types or a significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendments meet the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendments.

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 21 6

REFERENCES

1. NEI 00-04, "10 CFR 50.69 SSC Categorization Guideline," Revision 0, Nuclear Energy Institute, July 2005.

2. NRC Regulatory Guide 1.201, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance,"

Revision 1, May 2006.

3. Review of Individual Plant Examination of External Events (IPEEE) Submittal, Limerick Generating Station, Units 1 and 2 (TAC NOS. M83636 and M83637), US Nuclear Regulatory Commission, February 28, 2000.

4. NUMARC 91-06, "Guidelines for Industry Actions to Assess Shutdown Management," December, 1991.

5. Vogtle Electric Generating Plant, Units 1 and 2 - Issuance of Amendments Re: Use of 10 CFR 50.69 (TAC NOS. ME9472 AND ME9473), December 17, 2014.

6. ASME/ANS RA-Sa-2009, Standard for Level l/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, February 2009.

7. Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2, US Nuclear Regulatory Commission, March 2009.

8. JENSEN HUGHES Report 032156-RPT-001, "Limerick Generating Station PRA Finding Level Fact and Observation Technical Review," August 2016.

9. Generic Letter 88-20, "Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10 CFR 50.54(f), Supplement 4," USNRC, June 1991.

10. NUREG-1855, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making," March 2009.

11. EPRI TR-1016737, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments," 2008.

12. Regulatory Guide (RG) 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities,"

Revision 1, January 2007.

13. ASME RA-Sb-2005, "Addenda to ASME RA-S-2002 Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications," December 2005.

14. Limerick Generating Station - Units 1 & 2 Flood Hazard Reevaluation Report (FHRR), NRC ADAMS Accession No. ML15084A586, March 12, 2015.

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 22

15. Regulatory Guide 1.78, "Evaluating the Habitability of a Nuclear Power Plant Control Room During a Postulated Hazardous Chemical Release," Revision 1, December 2001.

16. Regulatory Guide 1.91, "Evaluations and Explosions Postulated to Occur at Nearby Facilities and on Transportation Routes Near Nuclear Power Plants," Revision 2, April 2013.

17. NEI 16-09, Risk-Informed Engineering Programs (10 CFR 50.69) Implementation Guidance, Revision 0, January 2017.

18. Exelon Corrective Action Program IR 870181 A04, "Review of Limerick Offsite Hazardous Chemical Survey," Revision 0, 2008.

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 23 Exelon will establish procedure(s) prior to the use of the categorization process on a plant system. The procedure(s) will contain the elements/steps listed below.

• Integrated Decision-making Panel (IDP) member qualification requirements

• Qualitative assessment of system functions. System functions are qualitatively categorized as preliminary HSS or LSS based on the seven questions in Section 9 of NEI 00-04 (see Section 3.2 of this enclosure). Any component supporting an HSS function is categorized as preliminary HSS. Components supporting an LSS function are categorized as preliminary LSS.

• Component safety significance assessment. Safety significance of active components is assessed through a combination of PRA and non-PRA methods, covering all hazards. Safety significance of passive components is assessed using a methodology for passive components.

• Assessment of defense-in-depth (DID) and safety margin. Components that are categorized as preliminary LSS are evaluated for their role in providing defense-in-depth and safety margin and, if appropriate, upgraded to HSS.

• Review by the Integrated Decision-making Panel. The categorization results are presented to the IDP for review and approval. The IDP reviews the categorization results and makes the final determination on the safety significance of system functions and components.

• Risk sensitivity study. For PRA-modeled components, an overall risk sensitivity study is used to confirm that the population of preliminary LSS components results in acceptably small increases to core damage frequency (CDF) and large early release frequency (LERF) and meets the acceptance guidelines of RG 1.174.

• Periodic reviews are performed to ensure continued categorization validity and acceptable performance for those SSCs that have been categorized.

• Documentation requirements as discussed in Section 3.1.1 of this enclosure.

List of Categorization Prerequisites

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 24 Units Model Baseline CDF Baseline LERF Comments 1 & 2 Full Power Internal Events and Internal Flooding (FPIE)

LG113A (Unit 1)

LG213A (Unit 2) 3.2E-06 (Unit 1) 3.2E-06 (Unit 2) 1.5E-07 (Unit 1) 1.5E-07 (Unit 2) 2013 FPIE PRA Update.

This model represents the current FPIE PRA Model or Record (MOR).

1 & 2 Fire PRA LG113A2F0 (Unit 1)

LG213A2F0 (Unit 2) 1.1E-05 (Unit 1) 1.1E-05 (Unit 2) 1.8E-07 (Unit 1) 2.6E-07 (Unit 2)

Fire Update to reflect the 2013 FPIE PRA Model.

This model represents the current Fire PRA MOR.

Description of PRA Models used in Categorization

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 25 The NRC observed the closure review of open PRA Facts and Observations (F&Os) for Limerick, Units 1 and 2, in July 2016. This was part of the industry pilot effort to develop a process for performing an industry focused scope independent closeout assessment of "Finding" level F&Os of record from prior PRA peer reviews against the ASME/ANS PRA standard. Included in this license amendment application in this Attachment are all of the Findings from that closure review per agreement with the NRC.

a provides the Open and Partially Resolved Findings from the closure review. All of the Open and Partially Resolved Findings will be fully resolved during the next PRA model update. Attachment 3b provides the Resolved Findings from the closure review. For both attachments:

Full Power Internal Events with Internal Flooding Model Findings:

1. Each of the finding IDs that begin the characters IF are from the internal flood peer review. The other findings are from the internal events peer review.

2. The SR listed first is the applicable SR from the standard version the peer review was performed against (RA-Sb-2005, Reference 13) and the second is the applicable SR from the current standard (RA-Sa-2009, Reference 6).

Fire PRA Model Findings:

1. Finding F&Os are associated with a PRA Standard Part 4 SR, and if the finding F&O originated from a Part 2 SR, then the Part 2 SR is listed in parenthesis.

For all entries, the "Disposition for 50.69" column text reflects the assessment of the Finding Closure Review (Reference 8), with an assessment relative to 50.69 added for Open or Partially Resolved items.

Disposition and Resolution of Peer Review Findings and Self-Assessment Items

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 26 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 SY-A11-03 SY-A11 Now SY-A10 Cat I/II/III High pressure makeup is credited for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> without AC available. Per the DC system notebook, the battery life for each division is 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. The model credits running HPCI and RCIC for two hours and when one system is operating the other is secured. However, the procedures that direct this operation are only entered during a SBO. These two systems are vulnerable to DC depletion for scenarios where at least one diesel generator is not failed but the battery chargers for the HPCI and RCIC batteries do not have AC available.

OPEN.

The Event Tree Notebook Section 9 contains the event tree for this scenario. Node U1 is the top event that addresses the extension of operating time from two hours to at least four hours in a serial fashion. A separate sensitivity study which always required the chargers to be available to get out to four hours indicated that there is a negligible impact on the results (i.e., << 1%

increase in CDF).

Based on the sensitivity study, there is no material impact on this application.

HR-A1-01 HR-A1 Cat I/II/III Now:

Not Met (self-identified)

The supporting requirement indicates that the test and maintenance pre-initiators should be derived from a review of procedures and practices.

OPEN.

Very negligible impact. Risk-significant pre-initiators are included in the model. The not met status is related to how they were identified.

Note that the original peer review deemed the approach for identification sufficient.

No material impact on this application since risk-significant contributors that might affect categorization have been identified.

QU-F5-01 QU-F5 Not Met Provide a discussion for the limitations of the quantification process that could impact applications (e.g., online OPEN.

a: Open and Partially Resolved Peer Review Findings

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 27 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 maintenance, MPSI). One of the topics could be the WinNUPRA code limitations on the maximum number of cutsets and its impact on quantification truncation limits The Limerick FPRA summary and quantification notebook discusses the quantification process limitations on applications. However, a similar discussion applicable to the FPIE model documentation is not included for the internal events. WinNUPRA is no longer used in the Limerick PRA and truncation is not applied at a sequence level. Note that the conversion to CAFTA from WinNUPRA did not constitute an upgrade due to the extensive benchmarking of results that was performed as part of the conversion documentation. (Example 11 of the Non Mandatory Appendix 1-A of the ASME / ANS RA-Sa-2009 states that the conversion of one fault tree linking code to another is PRA maintenance.)

This is a documentation issue with no impact on this application.

QU-F6-01 QU-F6 Not Met Other than for HRA, the Limerick documentation does not include the applied definition of "significant." Based on the review, the definitions provided in the ASME PRA Standard appear to have been generally applied.

OPEN.

The definitions in the PRA Standard are applied, but other than for HRA and the definition of a significant sequence in the FPIE model, the Limerick documentation does not include the applied definition of "significant." There is no definition of a significant basic event or a significant cutset, and while the definition of significant sequence is used it is not actually defined.

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 28 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 This is a documentation issue with no impact on this application because significance criteria are explicitly defined in the 50.69 categorization process.

IF-B3-01 IF-B3 Now IFSO-A5 Not Met Analysis of the TECW, RECW, CECW, and DWCW only considers the volume of water in the surge tank, not total system volume. Any system breach would result in gravity draining the system until level reaches that of the break. The TECW and RECW could contain significant volumes such that the scenarios may not be screened. Similarly, a break in the chilled water systems could release more water than in the surge tank. The DECW and RECW systems have automatic makeup to the surge tanks which could add water to the flood source.

PARTIALLY RESOLVED.

The documentation does not clearly identify the reasons for screening. Instead, the internal flood notebook provides a summary of screening in Table B.3.1. Flood scenarios were screened based on hazard which includes a combination of flood source volume and if equipment in the area can be failed by the flood. These details are not included in the notebook.

Appendix C of the notebook provides details of the frequency calculations. In some cases, the frequency calculation may include contribution from systems that do not contribute to the scenario. In these cases, the frequency is overly estimated.

The documentation and flood scenarios will be reviewed in the next FPIE update. The review will determine if additional scenarios are identified or current scenarios need to be updated. If so, then the scenarios will be added or updated during the next FPIE update.

Potential updating of the FPIE model to address this Finding will have no material impact on this

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 29 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 application since the new PRA results are expected to have minor impacts on the overall results.

IF-C2a-01 IF-C2a Now IFSN-A3 Cat I/II/III No automatic actions were identified as being credited for flood termination or mitigation. Operator actions that are credited with terminating or mitigating a flooding event are generally described in Appendix E. However, the specific actions, such as, "close valve, V-XX," are not described in detail. The analyses shown in Appendix E reference the HRA performed in Appendix F.

PARTIALLY RESOLVED.

Appendix F of the internal flood notebook documents the operator actions credited for internal flood initiators. Appendix F provides detailed plant response, cues, location, timing, and execution information for each credited action. Appendix F references the HRA notebook which provides the HEP calculation worksheets and further details regarding HFEs FHUC31DXI, FHUC32DXI, and FHUC33DXI which are listed on Table F-1. Table F-1 also documents that a screening value of 0.1 was assigned for HFEs FHURB9DXI and FHUCE1DXI. However, there are some discrepancies in the documentation of the operator actions which need to be fixed.

This is a documentation issue with no impact on this application.

IF-C2b-01 IF-C2b Now IFSN-A4 Not Met Appendix E appears to take credit for drains, however calculation of drain capacity was not evident.

OPEN.

A formal analysis of drain capacities has not been performed.

Section E.5 of the internal flood notebook provides a discussion of flood scenarios in Flood Zone RB-FL09. A drain capacity of 60,000 gallons was estimated and credited based on discussion

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 30 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 with engineers and review of plant drawings. A probabilistic estimate of drainage failure is provided to address uncertainties in the drainage capacity. With the exception of Flood Zone RB-FL09, floor drains were not credited to conservatively estimate the time available for operator intervention.

A conservative estimate was used for floor drain credit, which primarily impacts the associated human action importance; therefore, specific analysis is expected to improve the analysis and will have no material impact on this application.

IF-C3b-01, IF-C3b-03 IF-C3b Now IFSN-A8 Cat I IF-C3b-01:

No consideration of barrier unavailability due to maintenance and how such unavailability could affect flood scenarios was documented.

IF-C3b-03:

LG-PRA-012, section 3.3.2.1, page 3-10, first paragraph describes how the EDG rooms are independent by discussing on doors and the corridor. Drains and electrical penetrations that may exist between the EDG rooms. Also, drains between the CE, TE, and RE are not discussed.

PARTIALLY RESOLVED.

Section 3.4.10 of internal flooding notebook documents impacts of barrier unavailability.

Section 3.4.12 documents considerations of backflow in drains where credited. Section 3.4.13 documents considerations of inter-area propagation flow paths. Section 3.4.14 documents considerations of structural analysis of doors where credited.

Section 2.2.11 documents considerations of backflow through drains. The analysis does not explicitly address water entering flood zones via backflow through the drain piping since there are check valves installed in the drains that service the ECCS rooms in the basement of the Reactor Enclosure that prevent propagation of water from

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 31 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 one room to another. Also, most internal drain lines within the plant drain to the Radioactive Waste system, which was observed to have a storage capacity of over 60,000 gallons Thus, backflow through drain lines was not explicitly modeled.

However, specific analysis for drain backflow or determination of the reliability of drain line check valves has been performed.

Check valve failures have small failure probabilities. Inclusion of scenarios with these failures will have negligible risk impact. The minor modeling changes will have no material impact on this application.

IF-D1-01 IF-D1 Now IFEV-A1 Not Met All flooding initiators are classified as either turbine trip or manual shutdown events as documented in Appendix D.

The Limerick model includes loss of service water. TECW, RECW, and AC switchgear as special initiating events.

As shown in Appendix C, several service water breaks are included in the internal flooding analysis, yet it is not clear why the events, were developed as turbine trip events as opposed to loss of service water events. As discussed under SR IF-B3, flooding events involving TECW and RECW were screened based on limited PARTIALLY RESOLVED.

Consistent with the SR IFEV-A1, an evaluation of the flood sources and subsequent scenarios was performed to group the initiating events. The events are generally classified as initiators that include either a turbine trip or manual shutdown event, as appropriate, with the impact of the initiator implied to fail those SSCs that are influenced by both internal flooding and spray effects. Where necessary, sub-scenario frequencies were identified for specific components that were susceptible to nearby spray sources. That is, certain SSCs were

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 32 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 system volume. When flooding involving TECW and RECW are reevaluated, this SR must be considered. The documentation does not describe why flooding events that cause a loss of switchgear are not evaluated as a loss of AC switchgear.

considered vulnerable to only those nearby sources of water that could render that particular component unavailable, i.e., approximately 10 feet within a given spray source.

However, the internal flood notebook does not document the specific mapping of flood scenarios to support system initiating events is not included.

Mapping to support system initiators instead of being subsumed with other initiators and including system failures represents a minor modeling and documentation enhancement and will have no material impact on this application.

IF-E1-01 IF-E1 Now IFQU-A1 Not Met All flooding initiators are classified as either turbine trip or manual shutdown events as documented in Appendix D.

The Limerick model includes loss of service water. TECW, RECW, and AC switchgear as special initiating events.

As shown in Appendix C, several service water breaks are included in the internal flooding analysis, yet it is not clear why the events, were developed as turbine trip events as opposed to loss of service water events. Had flooding sequences been reviewed for applicability, the appropriate accident sequence could have been associated with the proper PARTIALLY RESOLVED.

Consistent with the SR IFEV-A1, an evaluation of the flood sources and subsequent scenarios was performed to group the initiating events. The events are generally classified as initiators that include either a turbine trip or manual shutdown event, as appropriate, with the impact of the initiator implied to fail those SSCs that are influenced by both internal flooding and spray effects. Where necessary, sub-scenario frequencies were identified for specific components that were susceptible to nearby spray sources. That is, certain SSCs were considered vulnerable to only those nearby

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 33 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 internal initiating events group. No documentation of a sequence review was performed.

sources of water that could render that particular component unavailable, i.e., approximately 10 feet within a given spray source.

However, the internal flood notebook does not document the specific mapping of flood scenarios to support system initiating events is not included.

Mapping to support system initiators instead of being subsumed with other initiators and including system failures represents a minor modeling and documentation enhancement and will have no material impact on this application.

IF-E5a-01 IF-E5a Now IFQU-A6 Not Met No systematic assessment of the existing operator actions that are included in flood sequences was performed.

PARTIALLY RESOLVED.

Appendix G of the HRA notebook documents that all Internal Events HEPs were reviewed for internal flood. Most of the HEPs screened, and only those ex-CR actions that would occur earlier than 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> were examined in more detail. The HRA dependency analysis included the individual flood response HEPs as part of the development of the any joint human error probabilities.

However, enhancements to the documentation were identified to include the basis for the initial screening process and include a summary table of all post-initiator HFEs and how each is addressed for flood.

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 34 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 This is a documentation issue with no impact on this application.

IF-E7-01 IF-E7 Now IFQU-A10 Not Met No review or quantification of flood-related LERF sequences is performed or documented.

PARTIALLY RESOLVED.

Section 4.2, Figure 4.2, and Figure 4.4 of the internal flood notebook provide results of flood-related LERF. Flood scenarios or initiators that contribute to LERF are provided. Figure ES-2A and Figure ES-2B of the summary notebook provide flood-related contributions to total LERF.

Section 6.0, Appendix G, Appendix H, and Appendix I of quantification notebook provides the LERF quantification results (including internal flood). Flood-related cutsets are provided.

Sequence contributions to flood-related LERF were quantified including potential containment failure mode contributions (e.g., containment isolation, containment bypass, etc.) to flood-related LERF.

A documentation enhancement was identified to include sequence and damage class contributions to flood-related LERF.

This is a documentation issue with no impact on this application.

1-4 ES-A2 Not Met Review of dependencies (power supply, interlock circuits and instrumentation) was not performed for components whose failure would cause an initiating OPEN.

A systematic review was performed using the internal events model, the safe shutdown

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 35 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 event.

During the peer review, three of four examples of dependency modeling were reviewed with Limerick PRA team and it was concluded that their dependencies are correctly considered. However, in other case of example, LTP94BHWI, evidence of dependency modeling was not provided to review team. It is believed that the pressure transmitter (PT-42-1N094B) needs to be supported by electrical system to perform its function, but the dependency is not included to the fire PRA logic.

Furthermore, the BEs parent event (GHPC2A5) was ANDed with Div. IV gate and no power dependency is modeled under this event also.

The other example was annunciation (KAN24AHWI). Generally, annunciations are supported by AC/DC power.

However, review team couldnt identify any logic of power dependency of annunciations.

Based on the above condition it was concluded that no systematic review of dependency was performed in Limerick analysis, and MSO evaluations.

However FPRA notebooks do not provide documentation that identifies dependencies and how the dependency is modeled.

The modeling of the power supply for LTP94BHWI is for HPCI Auto Initiation. Div. II DC is required for successful Auto HPCI Initiation.

Therefore, the modeling of the Div. II DC power dependency is consistent with HPCI operation.

This modeling approach is similar for CS. That is, the applicable division DC is required for pump operation, as well as, the Auto CS Initiation logic.

Therefore, modeling the DC power dependency higher in the logic fails the pump AND auto and manual initiation. This is consistent with CS operation.

The example of the annunciator (KAN24AHWI) is not modeled for fire induced failure consistent with the HRA assumptions using screening HEPs and not modeling instrumentation for non-significant actions. The annunciator event is modeled for action KHULMIDXI-F which has an F-V of ~1E-6 and a RAW of 1.

This is a documentation issue with no impact on this application.

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 36 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 fire PRA.

1-16 FQ-F1 (QU-B3)

Cat I/II/III Limerick fire PRA was used truncation values of 1E-11 and 1E-12 for CDF and LERF, respectively without checking of convergence.

In case of CDF calculation, 1E-8 was applied for truncation value for CCDP and final cutsets are truncated by 1E-11 after multiplying scenario frequency.

This is applicable only when every scenario frequencies are less than 1E-3.

However, there are some fire scenarios that scenario frequency is more than 1E3.

Therefore, incorrect truncation approach is applied to Limerick fire PRA. LERF case is same as CDF.

Convergence check was performed with only one merged cutset file generated using single cutoff value of 1E-8 in the Limerick fire PRA. SR, QU-B3 is designed to check that the overall model results converge and that no significant accident sequences are inadvertently eliminated.

To meet the SR, QU-B3, it is necessary to generate other merged cutest files by PARTIALLY RESOLVED.

The FPRA summary and quantification notebook, Section 4.1, Table 4-3 and Table 4-4 document the truncation sensitivity analysis performed for CDF and LERF. A CCDP convergence approach is not being used; convergence is based on CDF.

Therefore, this aspect of the Finding is resolved.

The FPRA models of record use a CDF and LERF truncation of 1E-11/yr and 1E-12/yr, respectively.

At these truncations levels a check for convergence resulted in more than a 5% change in CDF and LERF. These truncation limits are more than four orders of magnitude less than the calculated CDF and LERF. The check for convergence did not result in the identification of new risk significant events.

To be resolved in the next Limerick FPRA update.

The impact on the FPRA is minimal.

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 37 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 using different cutoff values and compare them to see if model converges.

2-8 PRM-B6 Cat I/II/III Realistic success criteria and timing was not evaluated and documented for MSIV spurious operation. ASM-03 notebook Section 3.1.1.9 states below:

The combination of the MSIVs spuriously opening was previously included in the ASM-01 model as a break outside containment initiating event. However, during review of the Fire PRA model, it was determined that this logic would be more accurate as leading to a LLOCA.

However, the technical bases supporting this conclusion is lacking (e.g., MAAP runs supporting the conclusion).

OPEN.

The treatment of spurious MSIV opening scenarios currently leads to appropriate success criteria for injection requirements, and a conservative treatment of containment heat removal requirements associated with those scenarios.

The finding indicated that the characterization of a MSIV spurious opening as a LLOCA above TAF was not supported by T/H evaluations. This discussion is not currently included in the FPRA documentation.

The finding is related to the documentation of the justification that spurious MSIV closure success criteria is adequate.

This is a documentation issue with no impact on this application.

2-20 PRM-C1 (SY-C2)

Not Met The FPRA documentation is not complete for the system functions and boundary, the associated success criteria, the modeled components and failure modes including human actions, and a description of modeled dependencies including support system and common OPEN.

The changes to the system models were made using the same methodologies that were utilized for the development of the FPIE models. The changes were documented in separate analysis files or the model change database for

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 38 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 cause failures, including the inputs, methods, and results.

Many model changes refer back to the UREs listed in Table 2-1 of ASM-03 notebook. However, the UREs do not have the pedigree of FPIE system models and they do not meet the requirements of SR SY-C2.

traceability and independently reviewed. The formal documentation associated with these model changes will be captured as part of the normal PRA update process.

This is a documentation issue with no impact on this application.

2-25 FSS-D7 Not met LG-PRA-021.05 Section 10. Generic estimates per NUREG/CR-6850 are used, the system is operational during plant operation, and no outlier behavior has been identified.

However, there is no documentation to verify that: a) the credited fire detection and suppression system is installed and maintained in accordance with applicable codes and standards, and b) the credited system is in a fully operable state during plant operation. Note that walkdown may be required to confirm that fire detection and suppression systems are available in the PAUs crediting such systems.

Also, scope of risk relevant fire suppression and detection systems not identified.

OPEN.

Section 3.8 of the fire modeling treatments notebook documents that the fire protection detection and suppression system impairments were reviewed in 2015. The review determined that the unavailability of the systems is low compared to the generic unreliability value used.

However, no documentation of the details of the review are included in the FPRA notebooks.

This is a documentation issue with no impact on this application.

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 39 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 2-26 FSS-D8 Not Met Several fire scenarios credited the fire detection and suppression systems.

However, the effectiveness in the context of each fire scenario is not analyzed and documented.

Fire detection or suppression system effectiveness depends on, at a minimum, the following: 1) system design complies with applicable codes and standards, and current fire protection engineering practice, 2) the time available to suppress the fire prior to target damage,

3) specific features of physical analysis unit and fire scenario under analysis (e.g., pocketing effects, blockages that might impact plume behaviors or the "visibility" of the fire to detection and suppression systems, and suppression system coverage), and 4) suitability of the installed system given the nature of the fire source being analyzed. The above required documentation is not evident.

OPEN.

The FPRA documentation does not include details of the assessment. The fire modeling treatments notebook, documents the credited systems were assessed to be effective based on plant walkdowns and review of the fire protection program. Table 3-1 lists the systems credited and provides comments for the credited given. Entries without a specific comment are only credited in the multi-compartment analysis. That is, the credit given is only to prevent a fire progressing to an adjacent room. These systems are not credited to prevent damage in the room where the fire originates.

The fire protection health report performance indicators worksheets for multiple years were reviewed to ensure the systems are in compliance with applicable codes and standards.

This is a documentation issue with no impact on this application.

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 40 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 2-31 CF-A1 Cat II/III The fire scenario notebook section 13.3 states that the risk significant basic events were identified for detailed circuit failure evaluation. A check of top scenarios, however, shows that numerous hot short failure probabilities were not set to the generic values.

Based on communication with Limerick risk management team, the majority of these hot short failure probabilities did not need to be incorporated into the reviewed top scenarios because either the scenario does not need to (e.g.,

025_B), or the equipment has already failed with other cable failures (e.g.,

013_F0E1-2).

The review confirmed that Limerick has performed sufficient circuit failure analysis for top risk contributors.

However, the included equipment list in Table 13-2 of the FSS notebook is relatively short, which shows that not all risk significant contributors have been included. Identification of the specific components would require a detailed

'ones' run with post-processing, which was not performed for the peer review due to timing. It should be noted that the benefits to include more circuit OPEN.

The risk significant contributors were reviewed to ensure appropriate generic values were applied for the fire scenarios. The generic aggregate probability is the default value applied. The review identified that because no off scheme cables are damaged in the applicable scenarios that the value is appropriate value. The review is not in the FPRA documentation. For example spurious events ECB0602HOI-AGG and ECB609HOI-AGG are risk significant and applicable to the most significant fire scenario.

For this fire scenario the off scheme cables are not damaged in the fire scenario. Therefore, use of the aggregate probability of 0.4 is appropriate.

This is a documentation issue with no impact on this application.

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 41 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 failure analysis would be much less comparing with the listed components.

On the other hand, some cables were mapped to all failure modes. For example, 1AA11509B is tied to breaker FTO, FTC and FTRC failure modes.

Detailed circuit analysis should limit the failure for a particular fire scenario.

3-4 SF-A2 Not Met The Seismic Fire Interaction and the 1995 IPEEE address the potential for spurious operation or rupture of fire suppression systems however spurious operation of detection systems is not addressed. In addition the potential for loss of habitability due to gaseous system discharge or loss of availability due to diversion of suppressants from areas where they might be needed is not addressed. Therefore the assessment performed in the 1995 IPEEE and accordingly the Seismic Fire Interaction Analysis does not address all of the aspects required by the standard.

Accordingly this SR is considered not met.

PARTIALLY RESOLVED.

Section 3 and 4 of the seismic fire interactions notebook, Sections 3.1.2 and 4.1.2 discuss spurious operation of fire systems. These sections reference the new walkdowns that were performed as part of the Limerick seismic PRA which are documented in the Seismic PRA walkdown notebook.

This document has a discussion of seismic induced degradation or diversion of fire suppression systems and the walkdown checklists include a specific section to check for these situations.

The aspect of the finding not included in the documentation is a discussion of the spurious operation of detection systems.

This is a documentation issue with no impact on this application.

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 42 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 4-4 CS-B1 Not Met Overcurrent coordination and protection analysis was not reviewed in detail for the FPRA. As a result, additional circuits and cables whose failure could challenge power supply availability due to inadequate or unanalyzed electrical overcurrent protective device coordination were not added to the FPRA.

Additionally, power supplies credited in the FPRA using assumed cable routing did not include consideration for possible coordination issues. As a result, all areas that may impact these power supplies may not have been identified.

OPEN.

The FPRA documentation does not include details of the review of electrical overcurrent protective device coordination calculations. A detailed review of the calculations has been performed.

The AC and DC electrical systems, Class 1E and non-Class 1E, are coordinated with the exception of some 208/120V panels. For these panels, the applicable cables are assumed to fail the panels in the FPRA.

Additionally, the review of the calculations did not identify instances where cable length was used to show coordination.

This is a documentation issue with no impact on this application.

4-6 HRA-A3 Cat I The FPRA HRA notebook indicates that:

an action is not likely to be taken based on a single spurious signal.

As a result, no new, undesired operator actions that could result from spurious indications resulting from failure of a single instrument, were identified. The FPRA does not include a review of alarm response procedures or similar for potential alarms that may lead to equipment shutdown, alignment changes, or other operator actions that PARTIALLY RESOLVED As part of the FPRA update, more than 1500 Alarm Response Cards (ARCs) were reviewed. Of these, about 500 ARCs were identified to be potentially important to the FPRA and were reviewed in detail. The detail review resulted in

~50 ARCs that may lead to an undesired operator action that would trip or isolate a piece of equipment given the alarm even if the equipment was not damaged by fire.

Of the 50 ARCs identified, the worst case

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 43 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 could impact the ability to safely shut down the reactor. As a result, this SR is considered not met to CC II.

An operator interview performed during the peer review on this subject indicated that the operator would 'believe their indications' even during a fire, and would perform the actions in response to an alarm in a similar manner as during a non-fire event. In essence, critical equipment would not be shutdown, but other equipment would likely be stopped if a specific trouble alarm occurred.

Overall, the interview confirmed that the general assumption in the Limerick FPRA for not modeling shutdowns due to spurious alarms is not supported.

scenario is where the equipment is tripped or isolated given a spurious alarm. In each of the identified case sufficient time is available for recovery of the equipment if there is not fire damage to the equipment. Therefore, modeling the undesired operator action would consist of the recovery of the equipment, as well. The significance of the undesired action and the failure to recover is estimated to be negligible when compared to the fire induced failures of the equipment and the random failures of the equipment.

The minor model changes will have no material impact on this application.

4-27 PRM-B13 (DA-A4)

Not Met The basic events added to the FPRA are documented in the UREs (e.g., see table 3-1 of ASM-03). However, the details are not provided in the FPRA documentation.

For example, the SRV maintenance probability was changed from 1E-02 to 1E-03 under URE LG2011-038. However, the basis is not included in the FPRA documentation.

Additionally, the basic events added in the documentation are not referenced to the UREs, and tracing each basic event OPEN.

The ASM notebook lists new basic events added to the fire PRA model. There are some that have non-fire random failure probabilities, which are the only ones that this Finding applies to. As noted in the finding, these are only listed in summary form in the ASM notebook. A spot check was performed to determine whether the detailed information on these basic events, type codes, and associated plant specific data was documented in the Data Analysis Notebook (LG-PRA-010). It was determined that this

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 44 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 to the individual UREs is difficult to perform.

It is not clear from the review of the ASM notebook that all events are documented in the UREs. For example, AHUXTRDXD is listed in the HUMAN ERROR PROBABILITY FAULT TREE, but it is not clear what URE is used. Another example, JRM19BMMI0, is documented in 3.1.1.2.2 (RHRSW Loop B radiation monitor miscalibration basic event), but the basis of the event is not provided.

Many of the FPRA basic events are based on failure rates, with exposure or run times. However, there is no documentation of the exposure and run times in the documentation.

Overall, the basis for new basic events in the FPRA is not documented sufficient to meet the DA-A/B requirements of the standard.

information is not provided, so the Finding is not resolved The finding is related to providing better documentation of the review that was performed.

This is a documentation issue with no impact on this application.

4-30 IGN-A7 Cat I/II/III The Limerick method appears to include the following inconsistencies with the NUREG/CR-6850 method:

Air compressors counted include the EDG Starting air compressors and misc.

compressors. The total count should only PARTIALLY RESOLVED.

The Ignition Frequency Notebook (LG-PA-021.56) documents the method used for ignition source counting. The counting for air compressors (bin 9), misc. hydrogen fires (bin 19), and iso-phase bus ducts (bin 16.2) were revised, as suggested

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 45 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 include the service and instrument air compressors.

Bin 19 includes the Containment hydrogen recombiner package and Containment H2 Recombiner Skid; which does not normally include hydrogen.

However, no other misc. hydrogen fires are postulated.

Bin 18 fires are listed as partitioned based on the cable amount in each area, but are set to zero in the ISDS Bin 17, Hydrogen tanks, is listed with a frequency as applicable to Limerick, but no sources are identified in the ignition counting.

Bin 13, dryers, are listed as applicable to Limerick with a frequency, but none are counted.

Bin 16d (Isophase bus ducts) is not counted in the ISDS or assigned to a specific PAU.

by the Peer Review, and in accordance with the methods from NUREG/CR-6850. Those bins with zero frequencies are justified in Section 3.1.7 and Appendix B, such as RCPs (bin 2), self-ignited cable fires (bin 12), dryers (bin 13), and hydrogen tanks (bin 17).

The F&O response for junction boxes (bin 18) indicates that the fire risk from junction boxes are not included because the risk is negligible.

The FAQ 13-006 is referenced, however it has not been implemented. The F&O response seems to indicate that the F&O is "Open" for junction box fires. The Exelon PRA team indicated that junction box fires will be added to the FPRA consistent with the industry guidance in FAQ 13-0006.

The F&O response for counting of bin 17, Hydrogen Tanks, indicates that the yard hydrogen tanks are "a significant distance away from plant locations. Therefore, a PAU for the tank area was not included and a count of 0 is used."

It is recommended that the H2 tank be included in the existing Yard PAU, and then screened out due to no targets in the zone of influence.

To be resolved in the next Limerick PRA update.

The fire risk from junction boxes (bin 18) have not been included. Limerick cable data is

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 46 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 available to the Junction Boxes. Application of FAQ 13-0006 will result in a very low ignition frequency (<1E-6 per Junction Box) and limited damage. Thus, inclusion of Junction Boxes will be negligible to the results of the FPRA.

The finding will be resolved and reflected in the next FPRA update.

4-33 FSS-C1 Cat II Reviewed MCA scenarios do not include detailed modeling, including the use of multiple HRRs, fire growth, decay, etc. in the analysis.

For example, scenario 020_FZZ1-4 from PAU 20 to 22 (Cable spread room) assumes all PAU 20 fire scenarios (and their associated Ignition frequencies), if not suppressed, will result in a HGL in PAUs 20 and 22. These include cabinet fires, inverters and transients. In this case, the cable trays are located above several cabinets, where fairly small cabinet fires may result in overhead cable tray fires. However, additional detailed analysis could be performed to determine which cabinets would not cause this issue, calculation of the fire growth in the cabinet and cable trays, calculation of the HGL timing, analysis of the HRR for transient fires that can cause a HGL, and other steps discussed OPEN.

LG-PRA-021.07.04 (MCA - Multi-Compartment Analysis Notebook) and LG-PRA-021.07.02 (FMT

- Fire Modeling Treatments Notebook) state that detailed fire modeling for multi-compartment scenarios is performed, consistent with the fire modeling performed for single compartment analyses.

For an MCA scenario, the inputs for the detailed fire modeling of the exposing fire zone are used.

The resolution to the example from the F&O is that an MCA scenario from PAU 20 (inverter room) to 22 (cable spreading room) is screened since both rooms lead to abandonment scenarios.

The portion of the F&O not resolved is documentation and justification of which ignition sources within the PAU are contributing to the ignition frequencies for the MCA scenario.

The remaining aspect is a FPRA documentation issue with no impact on this application.

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 47 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 in FSS C1-8.

Other MCA scenarios include HGL Severity Factors. However, it does not appear that a 2-point fire model was used, or additional factors such as growth and decay, etc.

4-34 FSS-G1 Not Met The ignition frequencies used in the scenario analysis do not include the ignition source data sheets, and support for the differences is not provided. In reviewing the results of several scenarios with the PRA staff, the reason appears to be the removal of some sealed electrical cabinets (explained in the scenario description) as well as, and more importantly, the removal of the transient fires from consideration.

For example, scenario 020_FZZ1-4 is listed in the IGN notebook as having a total frequency of 8.22E04/year with 18 cabinets. The MCA scenario sheet in the FSS report however does not list all the cabinets, and uses a 2.30E-04/year ignition frequency. In this case, the transient scenarios are not analyzed, nor are they included in any detailed fire scenario for PAU 20. Similarly, PAUs 12, 13, 25, 39, includes no analysis of transient fires.

OPEN.

The finding has not been addressed. The current finding states that the documentation did not indicate any specific basis or analysis supporting the screening of these transient fires. The documentation still does not provide such justification.

The finding is related to providing better documentation of the review that was performed.

This is a documentation issue with no impact on this application.

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 48 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 These are both examples, but in both cases fire scenarios similar to the ones analyzed can occur as a result of transient fires. For area 20, the scenarios involving ignition of overhead cable trays can occur as a result of a large transient fire under or near a cable tray, or by ignition of a cabinet adjacent to the transient fire.

Review of the documentation did not indicate any specific basis or analysis supporting the screening of these transient fires.

4-35 FSS-G2 Not Met The MCA notebook includes both qualitative and quantitative screening criteria. The qualitative screening includes a number of scenarios where it is considered unlikely to have a large transient fire in the area. In comparing this to the Ignition frequency calculations, these areas do not have negligible transient frequencies.

The qualitative argument associated with no possible transient of concern appears subjective, and basically infers an argument of a low HRR in these areas in comparison to others. However, there is little basis for this subjectivity given.

OPEN.

Page 3-6 of FMT (Fire Modeling Treatments) notebook, transient fires of 60 kW and 140 kW are considered representative for transients in small areas that lack the space for storage and multiple pieces of equipment to perform maintenance on. Documentation is needed that identifies the locations with the low HRR transient fires and provides justifications regarding the size of the areas, the equipment requiring maintenance, and typical transient packages for the PAUs.

The finding is related to providing better documentation of the review that was performed.

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 49 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 Note that the recent ERIN approach for adjusting transient HRRs was recently reviewed by the Industry Fire PRA methods panel, and adjustment is possible but is required to be supported by review of transient packages possible in each area.

See screening criteria 2.08 and any area with NO listed in Table A-3 of the MCA for 237 kw fires.

This is a documentation issue with no impact on this application.

4-47 FQ-D1 (LE-E2)

Not Met The FPRA used the Level II parameters, which included characterization of the accident progression phenomena including realistic estimates for significant accident sequences.

However, a review of the parameters such as DW/WW integrity, containment flooding, WW venting, RB effectiveness, timing for declaring of emergency (including failure to do so) and other parameters was not performed. Reviews at similar plants indicated fire induced impacts of DW and WW Integrity, including containment flooding, WW venting, and fire induced failures of support systems and cooling.

Example events from the Quantification Importance Measures (> 1E-02 F-V) include B--OPDHR-EAL2F--, 1DIPH-DI1--

OPEN.

Reviewed Section 3.9.3 of the Plant Response Model Notebook, LG-PRA-021.55. That section describes the process to ensure that the LERF analysis is appropriate for the fire scenarios included in the fire PRA model. The following is considered: In addition, Section 4.8 and Appendix E of the Plant Response Model Notebook discuss the handling of the LERF analysis. The MCRAB analysis sequences are the only new sequences in comparison to the FPIE PRA model. The other Level 2 sequences are the same as used in the FPIE PRA model and BE Mapping accounts for the fire induced failures of components modeled in those sequences.

The finding is related to providing better documentation of the review that was performed.

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 50 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69

--S--, 1ISHUOPNEQLINH--, BPHCFXDXI, 1CZOPO2ADD---H--, 1CZPH-STINRT-S--,

and numerous others. Several of these appear to be potentially affected by the fire, and the importance measures also include HEPS not included in the Level 1 PRA.

This is a documentation issue with no impact on this application.

4-50 CF-A2 Cat I/II/III LG-PRA-021.05 Section 13.0 and Appendix D provides the methodology and results of the application of conditional probabilities.

Methodology follows industry guidance per NUREG/CR-6850 and supplement 1.

Uncertainty is qualitatively discussed in LG-PRA-021.01, Table 5-1.

However, the uncertainty parameters for the CF probabilities is not provided in the FPRA documentation or included in the CAFTA RR file for propagation through the uncertainty calculations.

PARTIALLY RESOLVED.

Section 3.3 of LG-PRA-021.12 (Uncertainty and Sensitivity Notebook) details the uncertainty analysis. Section 3.4.4 of LG-PRA-021.12 lists the calculation of the variance for the beta distributions. The beta uncertainty parameters from NUREG/CR-7150 Vol 2 were used to calculate the variance and applied against the type code based in the.rr file for each spurious operation and duration events. Basic events were verified to be linked to the appropriate type codes.

CAFTA files were reviewed and appropriate uncertainty parameters were assigned to type codes for spurious probabilities and spurious duration probabilities for all circuits except for the ungrounded DC circuit breaker aggregate. Upon discussion and review with Exelon engineers, it was determined that a gamma distribution was incorrectly calculated for the ungrounded DC circuit breaker aggregate in the current model.

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 51 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 Minimal impact on this application.

6-8 FSS-D8 Not Met Suppression and detection effectiveness

[in the context of each fire scenario] was not identified in the Fire PRA documentation.

OPEN.

The FPRA documentation does not include details of the assessment. The fire modeling treatments notebook, documents the credited systems were assessed to be effective based on plant walkdowns and review the fire protection program. Table 3-1 lists the systems credited and provides comments for the credited given. Entries without a specific comment are only credited in the multi-compartment analysis. That is, the credit given is only to prevent a fire progressing to an adjacent room. These systems are not credited to prevent damage in the room where the fire originates.

The fire protection health report performance indicators worksheets for multiple years were reviewed to ensure the systems are in compliance with applicable codes and standards.

The finding disposition is related to providing better documentation for the review that was performed.

This is a documentation issue with no impact on this application.

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 52 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 6-10 FSS-E3 Cat I Individual fire modeling references generally provide qualitative uncertainty treatment and in some cases sensitivity studies.

The individual fire sources are treated in the fire scenario workbook, Attachment B. Statistical representations are not provided.

OPEN.

The FPRA does not include the fire modeling parameter uncertainty. Statistical representations were provided for the scenario frequencies, non-suppression probabilities, and severity factors.

Extending the uncertainty evaluations to the fire modeling inputs for significant fire scenarios would not significantly impact the results of the final uncertainty analysis.

The minor modeling changes will have no material impact on this application and won't will not change the overall categorization results. The 50.69 categorization process includes sensitivity evaluations to account for model uncertainty impacts on results.

6-12 FSS-H5 Not Met Fire modeling outputs are documented in Scenario Development Report and applicable fire modeling documents. The parameter uncertainty of the output is not analyzed for each fire scenario established fire scenario as is required for Cat II.

OPEN.

The FPRA does not document the fire modeling parameter uncertainty. The finding is related to finding 6-10.

This is a documentation issue with no impact on this application.

N/A (SELF IDENTIFIED)

FSS-C6 Cat I/II SR FSS-C6 is related to the damage threshold of fire PRA targets. The NUREG/CR-6931 THIEF model from the EPRI FIVE software (EPRI 3002000830, Rev. 2) estimates the thermal response OPEN.

Although the original finding for this SR was resolved, a focused scope peer review was completed in June 2017 on the implementation of

License Amendment Request Enclosure Adopt 10 CFR 50.69 a Docket Nos. 50-352 and 50-353 53 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 of cables and was implemented in the fire modeling during the 2015 update.

This model was included as part of the 2016 independent review of the Limerick Fire PRA 2011 peer review F&Os that occurred as part of the industry F&O Closure review pilot process.

Subsequently, the use of the new model was determined to potentially satisfy the definition of a PRA upgrade per the ASME/ANS PRA Standard.

the THIEF model. This focused scope review involved a broader range of SRs than just FSS-C6 to ensure the use of THIEF was appropriately implemented in the PRA model.

The implementation of THIEF at LGS has been verified to be correct as supported by the focused scope peer review. The two findings identified in the focused scope review are being resolved in the current (2017) model update, and implementation of THIEF in the Fire PRA is being better documented.

The resolution will have no impact on this application.

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 54 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 IE-A7-01 IE-A7 Now IE-A9 Cat I Category II requires a review of initiating event precursors. There was no documentation demonstrating that this review was performed.

RESOLVED.

Appendix D of the initiating event notebook contains a listing of all LERs over the ten year period preceding the last PRA update and their disposition in terms of their relevance to PRA initiating events.

IE-D3-01 IE-D3 Cat I/II/III Key assumptions and key sources of uncertainty are not specifically identified in the documentation by element. The summary document does include a list of key model uncertainties and includes a number of sensitivity cases, however it is not clear that it goes far enough to support the intent of the latest requirements. A systematic process should be documented considering each of the standard PRA elements, including appropriate definitions.

It is recognized that EPRI is preparing a product intended to address this issue and Limerick is a pilot plant. A draft of the EPRI uncertainty report for Limerick was provided which RESOLVED.

The Summary Notebook includes a comprehensive characterization of key assumptions and model uncertainty. The results of that assessment are factored into the identification of potentially key assumptions for applications of the model.

b: Resolved Peer Review Findings

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 55 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 represents the state of the art in this area. When finalized, this document is expected to meet the intent of the supporting requirements.

AS-A5/A6-01 AS-A5 Cat I/II/III MSIV re-opening is modeled in many of the transient event trees. It is unclear whether this action would be directed via EOPs (either 100 or 101) or other procedures. This action provides minimal mitigative potential due to the timing and equipment necessary for successful operation or restoration of FW and PCS in short term scenarios.

Also, recovery of feedwater is also modeled in transient event trees and fault trees. FW recovery requires MSIV re-opening and provides limited mitigative potential. In the IORV/SORV event tree, both MSIV re-opening and FW recovery are modeled. It is likely that level control issues as well as action timing would prevent MSIV re-opening for a large spectrum of initiating events in which it is credited.

RESOLVED.

As a result of Finding 86 (FPIE PR) QU-A4-01, which questioned credit for FW/PCS recovery, credit for re-opening the MSIVs was removed during the 2008 update.

AS-B3-01 AS-B3 Cat I/II/III Loss of coolant accidents outside primary containment are modeled in several event trees. The discussion contained in the event tree notebook RESOLVED.

Sections 18 and 19 of the Event Tree Notebook documents the consideration of other impacts of

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 56 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 indicates that there are no additional impacts associated with the breaks of RWCU, main steam, HPCI and others when the break occurs outside the containment.

breaks outside containment, and a basis was provided for cases where no impacts were expected. There was a discussion of how RHRSW would be failed in the case of an ISLOCA in one of two core spray lines.

AS-B6-01 AS-B6 Now AS-B7 Cat I/II/III Vapor suppression via manual actuation of drywell sprays and rapid depressurization are each assigned an HEP of 0.1 for medium LOCAs. This results in a combined HEP for the two actions ("ANDed" together) of 1E-02 per demand. It is judged that these actions should be assigned a high probability of failure given the timing of the event sequence, specifically the timing to reach containment failure.

RESOLVED.

The two separate actions were combined into a single action, VHUDS1DXI "FAILURE TO CONTROL CONTAINMENT PRESSURE IN MLOCA WITH VS BYPASS," with a common cognitive. This represents the likelihood that the operators fail to recognize the need to control containment pressure (which fails all methods) or that they fail to execute the control using one of the two available methods. The individual 0.1 screening HEPs were replaced with a detailed analysis to develop an overall HEP that accounts for the dependencies.

SC/SY-B1-01 SC-B1 Cat II The success of fire water makeup to the vessel to prevent core damage after depressurization needs a rigorous analysis. Currently, the fire pump and operator action to crosstie fire protection water to RHR is modeled as a "super component" with a probability of failure of 0.5.

Reportedly, the probability is high to include the uncertainty as to whether or not the fire protection system can RESOLVED.

A detailed HRA calculation was performed for aligning fire water makeup to the reactor vessel as documented in FPIE PRA Post Initiator Calculation:

A29 (Operator fails to cross-tie fire water to RHR).

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 57 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 actually prevent core damage after depressurizing the reactor and within four hours after an initiating event.

The failure to crosstie fire water to RHR appears in the third highest frequency core damage cutset and has a RAW of 1.05. Choosing a 0.5 probability of failure for this event is tantamount to using a screening value. Screening values should not appear in the dominant cutsets.

SC/HR-B1-03 SC-B1 Cat II The HRA calculation for manual depressurization for Medium LOCA events (HRA Notebook Calculation

1. 45) credits an available time of 22 minutes based on MAAP run LI0035a.

MAAP Case LI0035a (Success Criteria Notebook, Table A-1) states that the break area is 0.01 ft 2

(equivalent to a 1.4" diameter line break) for the Medium LOCA event.

This break size seems more consistent with a Small LOCA event. This same issue exists for MAAP Cases LI0031, LI0033, and LI0035.

Using a larger break size (e.g., 4" diameter) could significantly decrease the estimated time available to manually depressurize for Medium RESOLVED.

A detailed HRA calculation was performed for operator failure to initiate emergency depressurization (medium LOCA, steam break) as documented in FPIE PRA Post Initiator Calculation:

A14 (AHUSS1DXI, operators fail to initiate emergency depressurization (medium LOCA, steam break).

A detailed HRA calculation was performed for operator failure to initiate emergency depressurization (medium LOCA, water break) as documented in FPIE PRA Post Initiator Calculation A16 (AHUWS1DXI, operators fail to initiate emergency depressurization (medium LOCA, water break).

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 58 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 LOCA events.

SY-A6-03 SY-A6 Cat I/II/III The HVAC notebook excludes CCF of EDG fans based on it being included in the EDG CCF values. This may not be true. If HVAC failures were included in the EDG, then HVAC modeling for EDGs is not required at all.

RESOLVED.

Appendix I of the data notebook, Volume 1 Table I-1 defines the equipment boundaries. For the EDGs Room heating and ventilating is not included. Appendix A, Section A.10 of the data notebook, Volume 2 documents the CCF analysis for the EDG ventilation fans. The CCF for failure pairs are included for the fans.

SY-A11-01 SY-A11 Now SY-A10 Cat I/II/III The diesel cooling, after a LOOP event, credits ESW and RHRSW.

RHRSW has two locked closed valves that must be opened and the RHRSW pumps manually started in order to establish cooling to the diesels. Early flag events fail this crosstie with operator action WHURSWDX10.

However, when the long term flag, XHOSHR, is used the crosstie succeeds 90% of the time. It is inappropriate to credit RHRSW for diesel cooling since, given a LOOP, the diesels auto start and require cooling within a few minutes. RHRSW being available via the crosstie after 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> does not meet the immediate cooling requirement. It is understood that the EDGs will trip on high temperature for LOOP events. Given this trip occurs, RESOLVED.

The logic for crediting RHRSW to ESW cross-tie capability is removed in the current model.

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 59 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 the model should account for the operator action and time involved in reestablishing cooling and restarting the EDGs.

SY-A11-04 SY-A11 Now SY-A10 Cat I/II/III Fault tree GEP11423 (typical) is used as the ESW power supply for pump A of loop A. This fault tree credits cross tying the 4 KV buses. Ultimately, the 4 KV cross tying is credited for the ESW power when ESW is cooling the diesels. No credit should be given for 4 KV crossties to power ESW when ESW is cooling the diesels since there is insufficient time to perform this task before the diesels overheat. The application of the 4KV crosstie should only be used in scenarios where the powered equipment is not needed until the crosstie can be accomplished per the plant procedures. This same concern applies to the 480V loads that are fed from 4KV.

RESOLVED.

The model logic was changed to only credit crosstie actions > 2hrs. See the 4kV system notebook.

SY-A12b-01 SY-A12b Now SY-A13 Not Met The failure of the HPCI minimum flow valve to close will cause a flow diversion which can challenge the CST inventory. The minimum flow valve failure to close should be modeled and water inventory addressed. Note: if HPCI is operated with elevated suppression pool temperatures, switching HPCI suction to the RESOLVED.

The HPCI injection line has a diameter of 14". The min flow line has an orifice with a diameter of 1.7". Given these diameters, the flow area of the injection line is approximately 150 sq. in. and the flow area of the min flow line is approximately 4 sq. in. A general assumption used in many PRAs that has been traditionally accepted is that a flow

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 60 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 suppression pool can cause HPCI to fail from inadequate lube oil cooling.

diversion with area less than 10% of the main flow path is considered negligible (because of conservatisms in the design basis) without the need to perform a specific analysis. Therefore, modeling of this flow diversion is not required.

SY-A13-01 SY-A13 Now SY-A14 Cat I/II/III Spurious operation of instruments and transmitters that can trip a mitigating system have not been included in the system fault trees. Note that the ASME Standard makes a distinction between miscalibration and spurious operation.

RESOLVED.

The data notebook, Table D-1 documents the failure probability for miscalibration and spurious operation. The failure probability for spurious operation are two orders of magnitude less than those for miscalibration (spurious operation 1% of miscalibration). SR SY-A14 states "One or more failure modes for a component may be excluded from the systems model if the contribution of them to the total failure rate or probability is less than 1% of the total failure rate or probability for that component, when their effects on system operation are the same." Therefore, excluding the spurious operation failure mode is acceptable.

SY-B8-01 SY-B8 Cat I/II/III A calculation justifying HPCI operation beyond six hours is needed. It is not adequate to assume that if suppression pool cooling is available HPCI room cooling is available.

RESOLVED.

A best-estimate analysis of room heatup for HPCI was performed (it was also performed for RCIC, although this was not a subject of the Finding).

The calculation (CC-AA-309-1001, Rev. 7, Calc LM-0400) shows that the room temperatures for each room reach a stable temperature after a few hours and that temperature is maintained from that point forward by natural processes. In each case, temperature margin against failure is maintained.

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 61 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 Therefore, room cooling is not required.

HR-G4-01 HR-G4 Cat III The assumed time available to manually depressurize the RPV for non-ATWS events is assumed to be 55 minutes, based on the time to core damage (HRA Notebook, Appendix A, Calculation 33, MAAP Case LI0008).

Using the entire time to core damage as the time available for manual depressurization could be non-conservative. The HRA Notebook states that "Once depressurization starts, steam cooling will prevent core damage, thus depressurization is credited to the point of when core damage is estimated to begin." This statement is judged not to be supported by the Limerick MAAP cases.

A similar MAAP case (Case LI0012) indicates that if manual RPV depressurization with 2 SRVs is initiated at 49 minutes (i.e., time to TAF + 30 minutes), core damage would still occur at 54 minutes. MAAP Case LI0012 appears not to support using the entire time to core damage as the time available for manual RPV depressurization. In addition, MAAP RESOLVED.

Appendix A of the HRA Notebook (LG-PRA-004, Rev. 3) shows that the time used for time available to depressurize (using two valves) is 38.9 minutes. It is stated that this is based on analysis provided in the SC notebook, section 3.3.2.

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 62 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 Case LI0011 indicates that if manual RPV depressurization with 2 SRVs is initiated at 39 minutes (i.e., time to TAF + 20 minutes), then core damage can be averted.

HR-H3/I1-01 HR-H3 Cat I/II/III Common cause operator error events are included across system boundaries, but it appears that some cross system combinations are not addressed, but rather are dismissed as risk negligible.

RESOLVED.

The HRA notebook Section 5.2 discusses the process used to identify the HFE combinations that have the potential to be significant risk contributors due to dependency analysis. The process followed, which sets the HEPs to artificially high values so that the combinations come to the top, is typical of current practice across the industry. The dependency levels are based on consideration of PSFs and implemented in the HRAC, with manual adjustments made based on specific review of the combinations. This process makes no distinction regarding whether or not the dependency is across system boundaries since all HFEs are assigned the same high values, thus all important combinations are captured. Additional details on the analysis of key combinations are provided in Appendix H.

DA-B1-01 DA-B1 Cat II Category II requires usage characteristics to be included in the component grouping. The use of maintenance rule data may take this into account for some components, however, there is no discussion to RESOLVED.

The updated data analysis utilizes groupings consistent with the available data including the recently implemented generic data from NUREG/CR-6928. Section 2.6 and Appendix F of

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 63 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 support the extent to which this requirement is met.

the data notebook provides a description of type codes used in the model.

DA-B2-01 DA-B2 Cat I/II There is no discussion of unique components or how outliers (if any) were treated. No specific examples were found that created an issue, however there is no assurance that they were evaluated.

RESOLVED.

Section 2.6 and Appendix B of the data notebook provides a description of plant-specific data used in the model. Section B.1 documents that the plant specific data analysis included consideration for excluding outliers in the data. That is, infrequently tested/operated components were not included in the plant specific data update group.

DA-C6-01 DA-C6 Not Met The methods used to determine exposures (demands, runtime, etc.)

were not documented. The reviewer could not validate how demands were obtained.

RESOLVED.

The data notebook was updated to clearly identify the MSPI as the primary data source for demands, runtime, etc., with the Maintenance rule providing functional failure data. Component failure data, demands, and run hours compiled by Limerick system managers was used for some key SSCs that are not within the scope of the Limerick Maintenance Rule Programs data collection and reporting efforts or the Limerick MSPI basis document. The results of the data collection was confirmed with system engineer interviews. See Appendix B of the Data Notebook for details of the discussions held with the system managers.

DA-C7-01 DA-C7 Not Met The methods used to determine exposures (demands, runtime, etc.)

were not documented. The reviewer could not validate how demands were obtained.

RESOLVED.

See DA-C6 disposition

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 64 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 DA-C10-01 DA-C10 Cat II There is no documentation to support this requirement. If surveillance test data was not used then this SR is "n/a". Otherwise, additional documentation is needed to determine how surveillance test data was used as a basis to count component demands to validate that the SR is met.

RESOLVED.

Section C.4, Table C-4, of the data notebook, Volume 1 includes details on the basic events that are calculated using quarterly or bi-annual surveillance interval.

Tables B-3 through B-6 provide the plant specific maintenance rule and MSPI component experience data. The use of this data is sufficient to meet the intent of the SR.

DA-C12-01 DA-C12 Now DA-C13 Cat I/II/III Category II requires interviews of maintenance and operations for significant basic events. The significant basic events are not specifically defined although the documentation indicates that engineering had input. It is likely that engineering used maintenance and operations input but this is not documented.

RESOLVED.

The maintenance data is taken directly from the MSPI when possible. In the situations that reliable estimates for particular equipment are not available, interviews with system engineers were performed to generate/confirm the unavailability estimates used in the PRA. During the 2013 PRA Update system manager interviews, system unavailability was discussed with the respective system manager. The change in the unavailability value in comparison to the previous update (2008 PRA Update) was discussed. During this discussion, reasons for the unavailability values increasing or decreasing were provided. These notes are documented in Appendix H of the data notebook, Volume 1.

DA-C14-01 DA-C14 Now DA-C15 Cat I/II/III Hardware recoveries are applied to EDG, IA, RHR, RHRSW, and ESW.

There was no plant specific data used RESOLVED.

Appendix G of LG-PRA-010 Data 2013 V1

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 65 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 to determine Mean Time To Repair (MTTR) values and some of the data sources (WASH-1400 and IEEE-500) are dated. Standard practice excludes hardware recoveries, especially when there is minimal benefit. The summary document indicates about a 1% CDF impact due to the hard ware recoveries. A second recovery term is also applied in the level 2 fault trees with very little explanation.

addresses the hardware recoveries are applied to EDG, IA, RHR, RHRSW, and ESW. Section G.1 addresses recovery estimates and G.2 addresses repair estimates.

Section G.2.1.13 of LG-PRA-010 Data 2013 V1 addresses EDG repair times. Section G.2.2 addresses IA repair time. Section G.2.3 addresses RHR. RRHSW, and ESW repair times.

QU-A4-01 QU-B4 Cat I/II/III The quantification results provide credit for hardware recovery of FW/PCS, ESW, RHRSW, and EDGs based on WASH-1400 MTTR models or other repair models. There appears to be more credit for hardware recovery than in most industry PRAs. (See similar F&O for supporting requirement DA-C14.)

RESOLVED.

Credit for repair of EDGs, and RHRSW, RHR, and ESW pumps was removed from the model as part of the 2008 update. Recovery of FW/PCS requires re-opening of the MSIVs. Credit for re-opening the MSIVs was also removed during the 2008 update.

QU-B4-01 QU-B4 Not Met There are several cases where basic event probabilities exceed 0.1. In some cases, the basic event probabilities are significantly greater than 0.1 and occasionally 1.0 is used to represent logic or events that are no longer used. In these cases, the rare event approximation is not valid.

When used under "OR" gates, this treatment can be excessively conservative and potentially invalid.

RESOLVED.

The issue is addressed by the conversion to CAFTA, the associated use of TRUEs (.T.) as opposed to 1.0 probabilities, and the upper bound algorithm in CAFTA. Most of the basic events that have values greater than 0.1, have a probability of 1.0 (not credited HEPs, flag events, recovery tags, etc.). These are set to.T. in either the flag file or the recovery file. Those events that are greater than 0.1 but not 1.0 are mostly Level 2

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 66 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 In addition, this treatment can increase the complexity of model review since some events that appear in the logic are actually not used (i.e.,

assigned a failure probability of 1.0).

See also supporting requirements AS-C1 and QU-B8.

phenomenological basic events in which there may be little basis to refine the point estimate..There are also some HEPs that could have a probability greater than 0.1 which are refined during the HRA update. Other basic events could be fractional multipliers (0.5 of the time pump A is running and 0.5 of the time pump B is running) which are modeled under AND gates. For those 1.0 events that represent logic or events that are no longer used (repair events, etc.), the basic events are set to.T. in the flag file which compresses that particular logic out during quantification.

QU-B8-01 QU-B8 Now QU-B9 Not Met There are several cases where logic in the model has been "disabled" via the use of failure rates of 1.0. Several cases are noted as follows:

LPIC "A" fault tree page 7 models the cross-tie for A&C but the HEP values used are 1.0 for all cases.

Accident class IIID event tree contains nodes that are not used since the conditions for the failure of containment are know prior to entering the event tree.

LPI fault tree (VTR 2),

specifically the gates for early injection and the basic event for operators fail to open RHRSW cross-tie are assigned a 1.0.

In the event tree notebook, RESOLVED.

For those 1.0 events that represent logic or events that are no longer used (repair events, etc.), the basic events are set to.T. in the flag file which compresses that particular logic out during quantification.

The LPCI A cross tie value for realigning the crossover valve DHU82XDXI was set to 1.0 in the fault tree and.T. in the flag file.

Accident Class nodal basic events not used are set to.T. in the flag file. The Level 2 Notebook provides details on the containment event trees (CET).

The RHRSW crosstie for injection action specific to MLOCA scenarios (JHU073DXI) which is set to 1.0

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 67 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 page 22-12, gate GBD2532 is an "OR" gate with event HHUFWXDX1 which is set to a probability of 1.0.

This treatment poses several issues.

These include the unnecessary complexity of the model, difficulty in reviewing the model as well as the increased potential for misinterpretation of the model. In addition, in certain circumstances the mathematics of Boolean logic may be adversely impacted due to violation of the rare event approximation as well as the generation of non-minimal cutsets.

and.T. in the flag file.

Basic Event HHUFWXDXI Failure To Isolate HPCI Injection Through Core Spray Line (ATWS) is set to 1.0 in the model and.T. in the flag file.

QU-D1c-01 QU-D1c Now QU-D3 Cat II/III In Table 3.5-1 of the PRA Summary Notebook, LERF cutset #3 (2.94E-9/yr) appears to be non-minimal compared to LERF cutset #2 (1.32E-8/yr). Cutset #2 includes an HEP of 1.0 for RHRSW crosstie injection. A secondary failure of 0.223 to preclude the RHRSW crosstie is non-minimal compared to cutset #2. This leads to a conservative result. Eliminating this cutset would reduce the LERF by approximately 5%.

RESOLVED.

For those 1.0 events that represent logic or events that are no longer used (repair events, etc.), the basic events are set to.T. in the flag file which compresses that particular logic out during quantification. The modeling continues to be captured in the CAFTA model for historical purposes.

QU-D3-01 QU-D3 Now QU-D4 Not Met The PRA Summary Notebook provides a table to compare CDF results to other Exelon plants. However, the RESOLVED.

Table 4.6-1 compares the current CDF results for

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 68 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 documentation does not provide any discussion for the differences in the results.

all BWR Exelon PRAs as a function of Accident Class. The CDF for Limerick is in the middle range for the Exelon BWR plants. Table 4.6-2 provides a detailed contribution breakdown by initiating event. The notes to this table also provide discussion of differences.

The comparison of the Limerick PRA is performed on two levels: The plant system comparison and the model comparison These comparisons allow the insights derived from the uncertainty analysis on a similar plant to assist in the identification of insights on Limerick. The comparison plant used here is a composite or "typical" plant. The first examination addresses the plant system comparison. Table I.5-3, Critical Safety Functions At Limerick Compared With "Generic" BWR,"

compares the plant systems and identifies the potential impact on the risk spectrum.

LE-C9a-01 LE-C9a Now LE-C11 Cat II/III For Loss of Vapor Suppression events (Level 1 Accident Class 3D), the Level 2 analysis is modeled with a detailed containment event tree. Most industry Level 2 PRAs model Loss of Vapor Suppression core damage events as leading directly to a Large, Early Release for the following reasons:

• Loss of Vapor Suppression events would cause a rapid pressurization of the drywell and result in drywell overpressure. The Level 2 node that RESOLVED.

Treatment of vapor suppression failure cases (Accident Class 3D) now lead directly to a Large, Early Release. Reviewed the Level 2 Fault and Event Trees for the DI, RX, and CZ nodes and confirmed that the probabilities were set to 1.0 which are subsequently set to.T. in the flag files to effectively remove the logic during quantification.

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 69 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 addresses the status of the drywell (DI node) should have a probability of 1.0 instead of 0.26. *The failure of the drywell could have a significant impact on the ability for continued RPV injection (e.g., pinching of the injection piping). This would lead to high failure probability for in-vessel recovery (Level 2 RX node). *The Level 2 Containment Intact node (CZ node) should be 1.0 because early containment failure is guaranteed for Loss of Vapor Suppression events.

IF-C3-01 IF-C3 Now IFSN-A6 Cat I Failure by spray and submergence were considered for all internal flooding initiating events. Section 2.2.5 stated that dynamic effects of pipe breaks were considered in the design process and that the effects were not considered further in the internal flooding PRA. No documentation of the specific equipment evaluated in the PRA compared to equipment considered in the design analyses, e.g., EQ lists, was documented Since the PRA can credit non-safety-related equipment, relying on design basis evaluations to dismiss these dynamic effects may credit equipment that cannot withstand the effects considered in the design RESOLVED.

Pipe whip effects were investigated and determined to not be a concern for piping containing moderate energy water sources. Jet impingement effects were also determined to not be a concern for piping encapsulated by aluminum lagging. Section 3.4.9 of the internal flood notebook provides additional information to address pipe whip and jet impingement concerns.

Any damage inflicted on plant equipment due to sprays from a pipe rupture were shown to affect only those components located within a radius of influence of about 16 feet, which implies that whether due to water sprays or jet impingement, equipment located within this radius of influence was considered to be rendered unavailable.

Section 3.4.18 addresses pipe whipping due to

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 70 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 analysis. Also, the PRA models may evaluate breaks beyond those of the design basis.

HELB.

IF-E6-01 IF-E6 Now IFQU-A7 Not Met No quantification of flood-related LERF is performed or documented.

RESOLVED.

Section 4.2, Figure 4.2, and Figure 4.4 of the internal flood notebook provide results of flood-related LERF. Flood scenarios that contribute to LERF are quantified. Figure ES-2A and Figure ES-3B of the summary notebook provide flood-related contributions to total LERF.

IF-F3-01 IF-F3 Now IFQU-B3 Not Met Discussion of Issue: Sources of uncertainty and assumptions associated with the internal flooding analysis were not documented in the analyses reviewed.

RESOLVED.

The internal flood notebook was updated to include uncertainty and assumptions. Section 2.2 includes assumptions and Appendix G includes uncertainty and sensitivity.

1-1 ES-C1 Not Met No instrumentation related to the operator actions are identified and modeled in Limerick fire PRA.

This results in a limited amount of instrumentation included in the equipment list, consisting of the SSEL instruments (Rx Level, Pressure, etc.).

Additionally, the FPRA modeling does not fully model the impact of failed instruments. In particular, the HRA is performed assuming the non-credited instruments are not available. Overall, the resulting HEPs are conservative RESOLVED.

Instrumentation supporting human failure events is currently explicitly modeled in the Fire PRA. The plant response model has been expanded to include explicit logic for the instrumentation. The documentation is available in both the equipment selection and plant response model notebooks The appropriate instruments have been assigned and modeled for the corresponding human failure events in the HRA analysis.

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 71 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 resulting in an overall estimate of CDF from operator failures that is conservative.

1-8 IGN-B5 CC I/II/III Section 1.3.3 of the FIF Notebook describes the assumptions and uncertainty sources. However, these uncertainty parameters for fire ignition frequencies are changed to other distribution types from the original (ex: variance to lognormal in the final quantification), but no description is provided for the impact on uncertainty changes.

RESOLVED.

The lognormal distributions from NUREG-2169 were used to quantify uncertainty. These distributions are documented in the ignition frequency and uncertainty notebooks.

1-11 HRA-A2 Cat I/II/III Procedures referred for this operator actions are SE-1 and SE-6 which are dedicated to remote shutdown and alternate shutdown. However, the operator actions are applied to other sequences as well as MCR abandonment scenario.

- SE-1 or SE-6 is applicable for only when specific condition is provided to operators as described in the procedures.

- This operator action requires at least one of multiple cue information.

Without modeling of indication(s), the HEP should be 1.0.

RESOLVED.

The discussion provided in the assessment of this HFE in the fire HRA notebook states that credit for the local action is based on a general instruction to try to open the valve, and that because of the training given at Limerick the operators would try all means to open the valve, including locally, even if not specifically stated in the procedure (that is, the operators interpret the instruction "open the valve" as including local operation if remote operation fails). Some credit in such an instance is reasonable. The HRA modelling takes credit for the existence of a procedure (other than SE-1 and SE-

6) that gets the operators to that point during non-abandonment scenarios. In this case, the non-abandonment procedure T-102 PRIMARY CONTAINMENT CONTROL would lead to an

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 72 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69

- for information, note that internal logic doesn't have a auto signal logic as well as manual action.

Reviewers key concern raised for SR, HRA-A2 is the potential unavailability of cue information due to fire damage and this concern is not limited to the OA, JHUSPVDX10. Other examples identified are AHUXTRDXI(-R1) and ZHULVCDXI.

In case of AHUXTRDXI(-R1), HRA report (LG-PRA-021.04) presents some of cue information and HEP was calculated based on the availability of indications in the MCR and relied on fact that SSEL has RPV pressure and level instruments. To support validity of HEP calculated for AHUXTRDXI (-

R1), availabilities of cue information including their dependencies (power, interlock) need to be reviewed for every related scenario or to be included in the logic model.

However, it was identified that neither of the above were addressed in the Limerick fire PRA for these example events.

instruction calling for the re-alignment. OP-LG103-102-1002STRATEGIES FOR SUCCESSFUL TRANSIENT MITIGATION would provide for critical parameter monitoring that would also lead to instructions for re-alignment. Thus there are other, non-abandonment procedures that would lead to the actions.

The FPRA was updated to include the credited cues in the logic model. Appendix D of the equipment selection notebook and Appendix A of the fire HRA notebook provides the details regarding which instruments are included for each action. The general assumption regarding the availability of instruments because the instrument is on the SSEL is no longer used. Instrumentation logic (and the applicable power supplies) is included with the operator actions as applicable.

Cables are included in the FPRA model such that if a cable is damaged in a given fire scenario then the instrumentation logic would fail.

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 73 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 1-15 HRA-A2 (HR-E3)

Not Met No discussion is provided in PRA-021-04 of the FPRA for review and interpretation of the procedures with plant operations or training personnel to confirm that interpretation is consistent with plant operational and training practices.

RESOLVED.

The fire HRA Notebook, Appendix D includes a discussion of the operator interviews conducted that covered the following general areas:

• General control room practices

• Operations response in fire events

• Performance Shaping Factors expected in fire events

• Potential undesired operation actions in response to fire-induced instrumentation failures

• Plant procedures and performance shaping factors (PSFs) for post-fire shutdown rom outside the control room In addition, in the detailed HFE analyses contained in Appendix A notes in certain cases additional interviews were conducted to address specific actions where further clarification was deemed necessary. Appendix E of the FPIE HRA notebook contains summaries of interviews conducted in 2004, 2008 and 2013. These included discussions of specific HFEs. Again, Appendix A provides examples where additional interviews were conducted as needed.

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 74 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 1-19 FQ-F1 (LE-F3)

Not Met LERF uncertainty distribution is provided in Figure 5-2 and 5-4 for Unit 1 and Unit 2, respectively.

However, LERF specific uncertainty and assumptions or limitations, were not provided in the results. For example, no discussion of LERF sources of uncertainty are documented in Table 5-1 of the quantification notebook.

Additionally, the Limerick fire PRA has no review results of containment isolation system which is a potential source of uncertainty.

RESOLVED.

LERF specific assumptions are discussed in Table 3-1 of the uncertainty notebook. An uncertainty matrix for each of the 16 NUREG/CR-6850 tasks is provided in Table 3-1, NUREG/CR-6850 uncertainty matrix that includes LERF assumptions.

There is also a more detailed discussion in Section 3.2 of same notebook.

2-3 CS-A4 Cat II/III Based on discussion with Limerick risk management team, an assumption has been made that instruments were not identified by assuming that safe shutdown analysis ensured that one train of instrument is always available.

As a result, the identification of instruments was not performed.

However, such treatment may not be adequate for multi-compartment analysis, which could potentially fail multiple channels of instruments.

RESOLVED.

Instrumentation supporting human failure events is now explicitly modeled in the FPRA. The plant response model has been expanded to include explicit logic for the instrumentation. The documentation is available in both the equipment selection and plant response model notebooks.

The appropriate instruments have been assigned and modeled for the corresponding human failure events in the HRA analysis.

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 75 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 2-5 PRM-A4 Cat II/III A number of excluded fire impact items (~400,000) were included in FRANX FireImpact table. However, the technical basis was not evident.

Additionally, the basis for this table, including the source of the table information, is not provided.

Finally; the scenario report includes a list of excluded events and targets, but does not include the listing of events in the FireImpact table.

RESOLVED.

The basis for the table was added to the fire scenario development notebook. PAU targets are identified based on walkdown observations and drawing reviews by qualified Exelon personnel.

PAU targets are included in the scenario reports in Appendix A of the fire scenario development notebook. This walkdown data is then entered into the ARCPlus' Fire PRA module software where the data is maintained. ARCPlus' Fire PRA module software develops the FRANX file which includes the inputs to the FireImpacts table. It is noted that per the FRANX users manual, FRANX uses the table to store the excluded targets.

The ARCPlus' software is a software product in which the code was verified to correctly populate the FRANX tables.

2-7 CS-A6 Cat I/II/III The self-assessment indicates that the requirement of CS-A6 is met by the follows:

Circuit failure modes associated with the effects of de-energizing as a result of the operation of overcurrent protective devices was considered when performing circuit analysis to find additional cables.

However, no discussion in Section 4 of RESOLVED.

The cable selection methodology identified in NUREG/CR-6850, specifically in Section 3.3 of the notebook, and states that, for FPRA selected components, cables that can result in the overcurrent protective device responding to a hot short should be included. A review of Specification NE-294, Exelon Specification for Post-Fire Safe Shutdown Program Requirements, Section 5.4, determined that for FSSD cable, the same methodology was applied.

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 76 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 LG-PRA-021.03, Model Development Notebook is included. Table F-1 is not evident either.

2-11 PRM-C1 (SY-A4)

Not Met There is no evidence that plant walkdowns and interviews with knowledgeable plant personnel (e.g.,

engineering, plant operations, etc.) to confirm that the systems analysis correctly reflects the as-built, as-operated plant. The MSO expert panel reviewed the Limerick-applicable MSO scenarios. However, the model changes for MSO scenarios in final FPRA models have not been confirmed by plant walkdowns and interviews with knowledgeable plant personnel.

RESOLVED.

The MSO process is documented in a series of locations. Appendix B of equipment selection notebook provides the results of the expert panel assessment of the MSOs and the disposition as to whether or not the MSO would be modeled in the FPRA. There is a series of detailed individual technical evaluations for the MSOs that provide details about the assessment of each MSO. Where the disposition is that the MSO needs to be modeled in the FPRA, the technical evaluation includes appendices for the MSO Fault Tree, P &

IDs, MSO Component Circuit Analysis Data Sheets and MSO Component Circuit Analysis Marked Up Schematics The plant system engineers, who qualify as "knowledgeable individuals" with respect to this SR, were directly involved in the development of these technical assessments. Their involvement meets the intent of the SR.

2-12 PRM-B12 Cat I/II/III In the Unit 1 CCDP cutsets for 026_F0A scenario, 3 initiating event (IE) flags were set to some values that add up to 100%. However, in this cutset file, there is another significant IE flag $VLP, which contributes to RESOLVED.

The initiating event treatment has been fully updated since the peer review. Currently, there is an event tree that map fire scenarios to the corresponding tree in the fault tree. The revised

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 77 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 more than 20% CDF.

The treatment with IE flags does not seem to be appropriate.

approach of using the fire initiating event decision tree (FIEDT) allows the fire induced initiating event logic to propagate through the appropriate event tree sequences. Therefore, there is a mapping of components to the specific initiating event that triggered in each scenario.

The treatment is documented in the Fire PRA PRM notebook LG-PRA-021.55 Section 4.2 and Appendix D (the decision tree is described in detailed in Appendix D).

2-14 PRM-A4 Cat I/II/III Section 11.0 of the Fire Scenario Notebook (LGPRA-021.05) documents the conditional plant trip probabilities.

This treatment is not consistent with the ES/CS task results. Once a fire scenario is developed, the fire is assumed to have resulted in a plant trip, either due to immediate plant response or manual shutdown per Tech Spec. A conditional trip probability should not be applied. For example; in the EDG room, the model shows a loss of the EDG, loss of the AC bus and loss of the DC bus. A plant shutdown would be required, and a conditional probability of trip should not be credited. Additionally, the conditional probability is applied for scenarios in the main control room; which would likely result in a RESOLVED.

The conditional trip probabilities were removed from the model. Opposite unit scenarios with no impact result in a manual shutdown. This represents a small conservatism in the fire risk.

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 78 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 shutdown for a challenging fire.

As for the impact to the other unit, detailed fire modeling and plant response procedures should be evaluated to determine whether the other unit would be tripped or not.

2-15 PRM-C1 (SY-B1)

Cat I/II/III A number of CCF BE probabilities were listed in ASM-02 and ASM-03 notebooks.

However, the calculation methods and data sources for generating CCF basic events and failure probabilities are not documented.

For example, MV HF type code used for the new CCF event is not documented in the FPIE DA notebook.

RESOLVED.

The current version of the Data Notebook contains this and other CCF type code data that were added for the fire PRA. Data Notebook, Rev 2, Volume 1 Table D-1 provides the parameters and source for the independent failure of the type code. Data Notebook, Rev 2, Volume 2 provides the CCF parameters and source (either a generic source reference or a type-code specific calculation in Appendix A) for the CCF type codes.

2-19 PRM-C1 (AS-C3)

Not Met The sources of model uncertainty and related assumptions for the added or modified system models, the added MCRAB event tree with respected to accident sequences, success criteria were not documented.

RESOLVED.

Table 3-1 and Section 3.2.14 of uncertainty notebook provide a discussion of the sources of model uncertainty. Model uncertainty is generally considered to be those things that are not (cannot) be addressed through parametric uncertainty analysis (e.g., assumptions used where another equally valid assumption could have been. Section E.5 of the plant response model notebook provides additional sources of uncertainty specific to MCRAB.

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 79 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 2-21 FSS-A6 Cat I/II LG-PRA-021.05, Fire Scenario Notebook, Appendices A and B document the fire scenarios. At least one scenario is defined for each main control board where more than one function is failed.

In the FRANX model, some MCR fire scenarios have a severity factor to account for the conditional trip probability. However, inside these MCR fire scenarios, MCRAB sequences are embedded (by setting IE flag $RSP to a value for the specific MCRAB scenario). Therefore, this treatment is not appropriate for the MCRAB scenarios.

RESOLVED.

The conditional plant trip probability has been completely removed from the Fire PRA model. No fire scenario receives credit for conditional trip probability in the model. In the specific case of the main control room, a fire in either a Unit 1 or Unit 2 electrical cabinet or main control board that results in abandonment conditions is modeled as a plant trip for both units given that the operators will be leaving the MCR to shutdown both units using the remote shutdown methods 2-24 FSS-C6 Cat I/II A number of cabinet fires were evaluated with scenario-specific non-suppression probabilities that account for target damage times based on the thermal response of the damage target. This method is documented in Appendix E of LG-PRA-021.05, Fire Scenario Notebook. Table 10-2 documented the resulted non-suppression probabilities based on the Mathcad calculations. Appendix E documented the assumptions and a sample of the calculation. However, the detailed calculations have not RESOLVED.

The use of the Mathcad calculation has been replaced in the current version of the FPRA with the use of the Fire Modeling Workbook approach, which is described in detailed in the fire modeling treatments notebook. The workbook approach was reviewed for selected fire scenarios to ensure that the fire growth for both the ignition source and secondary combustibles is correctly implemented in the analysis and that the time to target damage has been updated. The fire modeling workbook approach calculates time to target damage using the THIEF model (which is documented in

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 80 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 been formally documented and verified.

The process to use this method has not been developed to ensure consistent use and results.

Supplement 1 to NUREG 1805) with representative cable properties.

2-27 FSS-F1 Cat III LG-PRA-021.07, Exposed Structural Steel Analysis, documents the consideration of unprotected structural steel. Section 1.1 documents the assumptions used in this analysis.

Assumption 3 states that failure of more than one structural steel member is required before threat of building collapse is challenged. The basis supporting this assumption is engineering judgment. Due to the significance of this assumption (all scenarios were screened out), the technical basis should be enhanced to include some civil engineering design information.

RESOLVED.

Table 1.1-1 of the structural steel notebook provides the basis for the assumption that more than one structural steel member is required before threat of building collapse. The basis includes the following: "the building design is performed in accordance with ACI and AISC design codes. These industry codes contain provisions that ensure ductile behavior of members and their connections. The scenario involving the loss of a single column results in localized damage and loss of function (excessive deformations), but not likely collapse. However, a failure of two or more major vertical steel columns engages a larger portion of the building and would likely exceed the capacities of adjacent floor, beam, and column members."

2-28 FSS-F1 Cat III LG-PRA-021.07, Exposed Structural Steel Analysis, Table 2-1, includes the walkdown results. PAUs 93 and 106 are AIR COMPRESSOR AREA, EHC POWER UNIT AREA, AND TURBINE LUBE OIL STORAGE TANK AREA.

However, these two PAUs were RESOLVED.

The structural steel notebook documents that fires in PAUs 93 and 106, involving lube oil storage tanks, are included in the structural steel analysis.

Appendix A of the fire scenario development notebook documents that catastrophic scenarios

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 81 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 screened by stating that high hazard sources were not identified in PAU and therefore walkdowns for structural steel were not performed.

This does not seem to be appropriate.

including collapse of the turbine building are included in the PRA.

2-29 FSS-F3 Not Met A qualitative assessment has been performed for area in which a high hazard source and structural steel has been identified. However, the quantitative assessment of the risk of the selected fire scenarios including collapse of the exposed structural steel was not performed.

RESOLVED.

A quantitative assessment of the risk that includes a collapse of the turbine building has been included. As shown in the SS notebook (Section 4), the FSS notebook (Appendix A) and the Summary and Quantification notebook (Tables B-1 and B-2), structural steel scenarios that collapse the turbine building are quantified in the FPRA 2-30 FSS-H10 Not Met Walkdowns to develop the fire scenarios was performed. However, the walkdown process has not been documented, i.e. formal walkdown procedure has not been used which describes the purpose of each walkdown conducted, dates, participants and results.

Per the SR note: Typical walkdown results may include the purpose of each walkdown conducted, dates and participants, supporting calculations (if any), and information gained. This was not documented as a part of the FPRA.

RESOLVED.

The walkdown notebook provides guidance when performing walkdowns for plant partitioning, fire ignition frequency, and fire scenario selection.

Scenario summary reports are included in Appendix A of the FSS notebook. The F&O response indicates that additional details are maintained in the ARCPlus' software.

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 82 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 3-2 PP-B7 Not Met Confirmatory walkdowns were not performed to confirm the conditions and characteristics of the credited partitioning elements. According to the response to question 03-05

'Confirmatory walkdowns were not performed to confirm the conditions and characteristics of the credited partitioning elements. The use of Fire Areas, as defined in the regulatory fire protection program, was judged to provide assurance that the conditions and characteristic of credited partitioning elements are as stated in the Fire Safe Shutdown Analysis (FSSA).'

RESOLVED.

Section 3.2.7 of the plant partitioning notebook documents that confirmatory walkdowns were conducted in October 2015. Appendix B gives a description of each barrier.

3-3 SF-A1 Not Met The scenario walkdowns documented in the 1995 IPEEE only report identifying scenarios where flammable gas or liquid storage vessels could create a significant fire hazard due to a seismic event. Investigation of other unique fire scenarios is not documented.

RESOLVED.

Section 3 and 4 of the seismic fire interactions notebook were reviewed, and sections 3.1.1 and 4.1.1 discuss unique interactions. These sections reference new walkdowns that were performed.

Additionally, the Seismic PRA walkdown notebook includes discussion of observed interactions and the walkdown checklists include a specific section to check for these interactions.

3-5 SF-A3 Not Met Review of Appendix I of the Limerick Fire Scenario Notebook indicates that spurious operation of the fire suppression systems is conducted however common cause failure of RESOLVED.

The seismic fire interactions notebook, Section 4.1.3 addresses this finding. An assessment was performed of potential common cause failures of

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 83 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 these systems is not addressed.

Review of the 1995 IPEEE Seismic/Fire Interaction reflects this as well; common cause failure of fire suppression systems is not addressed.

the fire suppressions systems in the plant. The assessment concluded that there were no significant vulnerabilities in this regard.

3-6 SF-B1 Not Met The Seismic Fire Interaction Analysis is based on the 1995 IPEEE. Accordingly this analysis is 16 years old and should be revisited to ensure accuracy of the information contained. In addition this analysis does not satisfy all of the requirements of ANS RA-Sa-2009 for Seismic Fire Interaction Analysis. This results in analysis and documentation that does not satisfy the intent of the Seismic Fire Interaction Analysis.

RESOLVED.

As noted, while originating in SF-B1 the finding exists because of the Findings on SF-A1 to SF-A5 (the documentation is incomplete because the analyses for those SRs was not adequately performed). The documentation has been updated.

3-8 FSS-C2 Cat II/III Time dependent growth curves are used to describe fire growth in profiles in risk significant contributors in scenarios that are investigated using detailed fire modeling methods such as CFAST and the Expansion of Generic Fire Modeling Treatment technique described in Section 10 of the Fire Scenario Notebook. Additional detailed fire modeling is required and planned for some risk significant scenarios.

This level of modeling has not been provided for all risk significant PAUs.

RESOLVED.

The fire modeling treatments notebook lists the detailed fire scenarios defined for the risk significant rooms.

The fire modeling treatments notebook, Section 3.3 describes the heat release rate growth profile implemented in the fire modeling analysis, which is consistent with the guidance in Appendix G of NUREG/CR-6850.

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 84 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 3-12 FSS-A1 Cat I/II/III During conduct of the Peer Review walkdown several locations were identified that would have been expected to have been selected as transient scenarios because of low cable trays or cable trays penetrating the floor. Discussion in the field indicated that some of these locations were not selected as transient scenarios. Examples of such locations include cable tray installations along the south wall of PAU 025, low cable trays located between column lines M5 and N5 and K18 to K91 in PAU 94, and cable trays located above storage areas in PAU 107 at column line N39.2.

These examples are simply representative and are not expected to be inclusive of all potential scenarios.

RESOLVED.

Walkdowns were conducted in areas in which bounding transients were not included to identify potential pinch point locations. New transient scenarios were added to address the specific examples from the F&O, as documented in the fire scenario selection notebook, Appendix A. Transient scenarios have expanded from 168 transient scenarios in the peer review model to 283 transient scenarios in the current model (excluding full room scenarios), indicating that many new transient scenarios were added.

3-14 FSS-A1 Cat I/II During conduct of the Peer Review walkdown target selection for fire scenarios was challenged in several locations. This was performed by reviewing the targets found in the field against the Scenario Definition Report Targets using the appropriate ZOI information from Appendix C of the Fire Scenario Report. This exercise was fully conducted for two initiators; RESOLVED.

Section 3.2.3.1 of the fire scenario development notebook documents that target set identification is based on plant walkdowns and drawing reviews.

The target set for each scenario is listed in Appendix A of the notebook. Missing targets identified during the peer review were related to a new system that had been added after the FPRA targets had been identified. Walkdowns were

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 85 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 PAU 0107: T01-2 and PAU 013 F0E1-

2.

This exercise was conducted to validate selection of the targets listed and to determine if any potential risk relevant targets were missed. Because Fire PRA raceway data was used during target selection it was expected that raceway targets would be found in the field that were not listed as targets. Field identified targets that were not listed in the Scenario Definition Report Targets were listed for later disposition.

Seven potential targets were identified for PAU 0107: T01-2. Of these, one was determined to be potentially risk relevant but not included in the target selection for this scenario.

Seven potential targets were identified for PAU 013: F0E1-2. Of these, two were determined to be potentially risk relevant but not included in the target selection for this scenario. This scenario involved a medium voltage Switchgear HEAF; the risk relevant cables were captured in the scenario by their endpoints in the cabinet.

performed to identify additional targets to be added. The particular examples of targets missed were corrected.

The FPRA is now maintained in the ARCPlusTM Fire PRA module software. To ensure new targets are not excluded, when new targets are added to the ARCPlusTM software the targets are then included for all scenarios for the locations the targets are located. The analyst then must perform the necessary analysis/walkdowns to manually exclude the targets as applicable. This was the process used during this update and will be used to maintain and update the FPRA moving forward.

Exelon procedure CC-AA-102, Design Input and Configuration Change Impact Screening, is the process used to identify if a modification will have an impact on the fire risk. If it is determined that a modification may impact the fire risk a URE is created to track the modification to ensure the FPRA is appropriately updated.

Additionally the FPRA maintenance and update procedure requires review of modifications for impact on the FPRA.

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 86 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 Details of the target raceways that are not included in these scenarios are provided in the response to question LGS-99-06.

4-1 ES-A1 Not Met The Limerick FPRA modeling does not include identification of equipment whose failure, including spurious operation, caused by an initiating fire would contribute to or otherwise cause an automatic trip, a manual trip per procedure direction, or would invoke a limiting condition of operation (LCO) that would necessitate a shutdown.

Table 3-1 of the Model Development calculation provides the results of a comparison of the CDF (CCDP) given an initiating event in comparison to a turbine trip followed by a loss of the system. The differences are shown as small for all listed Initiating Events.

However, the discussion does not include any comparison of CCDPs for various fire scenarios (with equipment failed, or a discussion on the expected timing and thermo hydraulics following each event. As a result, although the difference for the base CCDP may be small, the impact for specific fire RESOLVED.

Induced initiating event logic to propagate through the appropriate event tree sequences. Therefore, there is a mapping of components to the specific initiating event that triggered in each scenario.

The treatment is documented in the plant response notebook, Section 4.2 and Appendix D

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 87 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 scenarios may be much larger. A question asked about the top 10 scenarios indicated a small difference in most of the top 10 scenarios, if modeled differently. In almost all cases, the existing modeling is slightly non-conservative. For example, the top scenario would have a CCDP of 9.72E-02 versus 9.67E-02 (in the existing model), if modeled as a loss of RECW or loss of FW.

Additionally, the verification performed to model the results in Table 3-1 are produced by basically setting CCF values to true to model the impact of system failures. These failure events do not have any cables assigned. As a result, there does not appear to be documentation that all of the equipment that is included in the initiating event modeling are mapped with specific cable routing performed.

As clarified in the note, the Initiating Events modeled in the FPRA are basically expected to be modeled in the same manner that initiating events are modeled under the IE requirements in Section 2. Without specific identification of equipment

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 88 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 that can cause an initiating event, this requirement cannot be met.

4-2 ES-A5 Not Met The FPRA model did not include potential initiating events that were identified in the MSO expert panel review. For example, MSO scenario 2ai was not considered for FPRA modeling, due to credit for Level 8 trip. Appendix I of the model development calculation lists this as not applicable to Limerick. However, an overfeed can occur at Limerick, with the TD FW pumps. As a result, no review of the number of MSOs required to cause the scenario was performed.

RESOLVED.

The initiating event treatment has been updated since the peer review. Now a fire initiating event decision tree (FIEDT) is used that allows the fire induced initiating event logic to propagate through the appropriate event tree sequences. Therefore, there is a mapping of components to the specific initiating event that triggered in each scenario.

The treatment is documented in the plant response model notebook, Section 4.2 and Appendix D (the decision tree is described in detailed in Appendix D).

The MSO scenarios have been incorporated into the PRA model using a systematic process that includes a comprehensive review of the generic MSO list from both a PRA and deterministic perspective. The documentation is available in both the equipment selection and plant response model notebooks. The appropriate MSO scenarios have been included in the plant response model. A disposition for each scenario, including those screened from the plant response model, is available. The specific scenario listed in the finding as an example, i.e., scenario 2ai, is currently modeled in the FPRA.

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 89 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 4-8 FSS-G6 Cat II/III The Battery Room Fires assume a 69kw HRR for batteries, per Table 11-

1. However, the analysis does not include the possibility of a hydrogen fire, as defined in the Misc. Hydrogen Fires bin. The HRR and damage zone for these fires is discussed in NUREG/CR-6850, N.2.4.

Failure to include Hydrogen Fires in the battery rooms affects the Ignition Frequency Calculation, the fire modeling as well as the Multi-Compartment Analysis from these compartments.

RESOLVED.

NUREG/CR-6850 states that bin 19, misc.

hydrogen fires, does NOT include battery rooms.

Therefore, the finding that miscellaneous hydrogen fires bin need to be included in battery rooms is not in agreement with NUREG/CR-6850.

4-9 FSS-G2 Not Met The MCA notebook includes both qualitative and quantitative screening criteria. The quantitative screening criteria used for the MCA is set at 1E-07/year. See the MCA notebook, Section 4 for a discussion on screening. This is applied for screening of MCA sequences, where the ignition frequency, severity factor, non-suppression and CCDP are applied. As applied, the contribution of screened PAUs can be significant, especially if the CCDP is near 1.0 as it is for many of the MCA scenarios.

RESOLVED.

No quantitative screening is performed on the multi compartment scenarios that survived the qualitative screening step. That is, there is no longer the screening of multi compartments based on a threshold value. If a multi compartment combination is determined to survive qualitative screening, a scenario is developed, quantified and maintained as a risk contributor in the FPRA model. This process is documented in section 3.3 of the multi-compartment notebook.

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 90 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 4-11 CS-A2 Cat II LG-PRA-021.03 Section 4 includes a discussion of the cable selection process and analysis using NE-0294.

Once the equipment and cables are selected, the process involves the identification of all cables and circuits, including hot shorts, which would affect equipment.

However, the documentation of the components with no cables due to primary component mapping is not clear in the FPRA documentation.

RESOLVED.

The complete fire PRA equipment list is included in Appendix A of LG-PRA-021.52, the Equipment Selection report. Table A-1 includes a "CODE" column in which some Fire PRA basic events are designated as CODE N2, which indicated that the basic event is not connected to a Fire PRA component ID because the specific equipment does not have cables in the Fire PRA.

For many of these components, the cables are included with a Fire PRA ID, such as a primary component, that represents the failure. Primary components are identified in the Comments column in Table A-1 of LG-PRA-021.52.

Similarly, Table C-1 of LG-PRA-021.52 provides disposition of safe shutdown equipment and identifies if cables are mapped to another component. These relationships are also included in Table A-1 of the CS notebook (LG-PRA-021.53),

in which a sub-component, if applicable, is listed in the INDMS column.

4-16 FSS-C4 Cat II The low voltage cabinet Severity Factors were applied to Inverters in the FPRA. Per the guidance in the draft methodology, the severity factor should only be applied to cabinets containing no power components, and only low power instrumentation, RESOLVED.

This finding is related to the application of the severity factors following a draft methodology that was not consistent with the guidance in Chapter 8 of NUREG/CR-6850. This methodology has been removed from the model and no longer used.

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 91 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 relays, etc.

The Fire PRA has been updated to apply severity factors consistent with the guidance in NUREG/CR-6850 as described in the Fire Modeling Treatments notebook LG-PRA-021.07.02. Currently, severity factors are applied to electrical cabinets that are not modeled as high energy or low energy arcing faults. That is, high and low energy arcing fault scenarios do not credit severity factors as calculated following the methodology in Chapter 8/Appendix E of NUREG/CR-6850 (i.e., a severity factor of 1.0 is applied).

4-17 FSS-C4 Cat II The Electrical Cabinet Severity Factors are applied in a few locations in the FPRA. However, the approach is not yet reviewed by the Industry FPRA methods panel. As a result, use of these severity factors is considered an Unreviewed Analytical Method.

RESOLVED.

The use of the Unreviewed Analytical Method and the Expansion of Generic Fire Modeling Treatment technique has been replaced in the latest version of the Fire PRA with the use of the Fire Modeling Workbook approach, which is described in detailed in the Fire Modeling Treatments notebook LG-PRA-021.07.02.

The workbook approach was reviewed for selected fire scenarios to ensure that the fire growth for both the ignition source and secondary combustibles is correctly implemented in the analysis and that the time to target damage has been updated from the unreviewed analytical method. The fire modeling workbook approach calculates time to target damage using the THIEF model (which is documented in Supplement 1 to

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 92 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 NUREG 1805) with representative cable properties.

4-18 PRM-B2 Not Met A review of the FPIE Peer Review F&Os related to FPRA did not include a review of all F&Os (including suggestions) from the FPIE Peer Review. SR lists exceptions and deficiencies. Note that suggestions in the internal events could be more important to the FPRA in some cases.

RESOLVED.

The plant response model notebook, Appendix C provides a disposition of the internal events peer review items. Internal events PRA peer review suggestions have been incorporated into the PRA (i.e., there are no open suggestions) 4-19 PRM-B2 Not Met An assessment of the FPIE PRA was not provided against Addendum A of the standard as part of the FPRA documentation.

RESOLVED.

An assessment of the internal events PRA against Addendum A has been performed and is documented in the roadmap notebook.

4-21 PRM-C1 (AS-A3)

Not Met The Main Control Room Abandonment (MCRAB) event tree is developed using the existing Limerick process, allowing for explicit modeling of systems, operator actions, and key safety functions. The event tree is shown in Figure 3-25 of ASM-03. Key Safety Functions are listed in 3.1.1.13.1. However, the ASM-03 discussion does not clearly document the success criteria for each key safety function. For example, On page 3-12 of the Limerick PRA Event Tree Notebook, success criteria for depressurization using ADS includes a full discussion of timing (via MAAP),

RESOLVED.

A check was made of the basis for the time available for actions from the RSP in the HRA. The action to depressurize from the RSP (AHUX1RDXI-FRA, OPS FAILS TO DEPRESSURIZE AT RSP PER SE-1) has an available action time of 38.9 minutes, based on T/H run LI0010. The conditions of this run are loss of all injection and one LPCI train available, and while based on the non-abandonment condition is the same as for MCRAB, so not additional run would be required.

A similar check was made for the action to utilize RCIC from the RSP (RHURSPDXI-FRA, OPERATOR FAILS TO USE RCIC FOR RPV LEVEL CONTROL

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 93 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 systems required, components required (2SRVs), expected operator actions, etc. This type of discussion is not provided for the MCRAB event tree.

FROM RSP). The time available to perform this action was 45 minutes, however it was noted that the T/H run supporting this action was also LI0010, which as noted was for depressurization and LPI. Subsequently, the PRA team stated that a more representative run was LI0014, which shows that core damage has not occurred by 45 minutes with no injection and no action (LI0001 shows the same thing), but neither shows the precise case where RCIC is started at 45 minutes although it could be implied that this would be successful. The PRA team ultimately provided a set of plots for the case where RCIC was started at 45 minutes, which conclusively shows that CD is averted.

4-23 PRM-C1 (AS-A9)

Cat I/II/III MCRAB Event tree uses existing FPIE success criteria and T-H analysis. This was not confirmed in the documentation as applicable to the new event tree development.

RESOLVED.

A review and spot check was conducted of how the T/H runs were used to support the success criteria for MCRAB actions. In general, the use of internal events and/or fire non-abandonment T/H runs for MCRAB actions is appropriate when the scenario details match closely enough. The use of the runs is adequately documented in the HRAC file.

4-25 PRM-C1 (LE-C12)

Not Met The FPRA documentation did not include any review of significant accident progress sequences (with respect to fire) to determine operator actions or engineering analysis that could be included in the FPRA that could reduce LERF.

RESOLVED.

Reviewed Section 4 of the Summary and Quantification Notebook (LG-PRA021.11).

Several reviews were performed and the significant contributors to LERF were reviewed, including review of top cutsets.

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 94 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 4-26 FSS-C4 Cat II The FPRA FSS report page 6-1 lists that All Motor Control Centers (MCC) have been treated as closed, sealed and robust in which damage beyond the ignition source was not postulated.

Per the electrical cabinet FAQ 043, MCCs are never considered sealed, based on two events in the EPRI DB where fire propagated from the MCCs.

Additionally, the ERIN supplemental report and the GE BWROG report shows a rough severity factor of 0.1 to 0.2 for MCCs, meaning some percentage of fires will get out of the MCCs.

RESOLVED.

The F&O response indicates that the latest guidance in FAQ 14-0009 has been applied and damage beyond the MCC is postulated. This was corroborated by Section 3.5 (Table 3-3) of LG-PRA-021.07.01, in which the severity factor of 0.043, based on qualified MCC, thermoset target cables, and target distance of 0.5 ft is listed as an input. In addition, the FSS notebook (Appendix A) and the Summary and Quantification notebook (Tables B-1 and B-2) include scenarios involving sealed MCCs that propagate (for example 027_00B131_L_Y). In the F&O response, no justification is provided for crediting qualified MCC and thermoset cables, however, the peer review assessment was "Met Cat 1-2" for FSS-C5 (JUSTIFY that the damage criteria used in the Fire PRA are representative of the damage targets associated with each fire Scenario), based on the plant using damage criteria for thermoset cables.

The PRA team provided documentation indicating that cables at Limerick are thermoset.

4-31 PRM-B13 (DA-C2)

Not Met Most new FPRA components are based on existing FPIE parameters, where plant specific data was performed.

However, new failure probabilities and parameters in the FPRA do not have plant specific data reviews in the FPRA.

RESOLVED.

The current version of the Data Notebook contains this and other CCF type code data that were added for the fire PRA. Data Notebook, Rev 2, Volume 1 (LG-PRA-010) Table D-1 provides the parameters and source for the independent failure of the type code. Tables B-3 through B-6 provide

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 95 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 For example, a new type code not in the FPIE is included in the FPRA: MV HF. Additionally, other events not using the generic type code should be reviewed for possible plant specific data review.

the plant specific maintenance rule and MSPI component experience data.

4-32 HRA-C1 Not Met The FPIE HEP KHUSPPDX10 was based on an alarm response, and is now a procedural driven action from FSSG-3022 in the FPRA. However, the action for failure to perform the procedural step for the control room action is not included in the HEP.

Action JHUSPVDX10 was based on the FPIE HRA, but as implemented in the FPRA (without full indication or alarms available), the operator action should include a non-proceduralized diagnosis of the failure of SPC based on rising SP temperature. This operator action step is not included in the FPRA analysis for this action.

These are just examples. It appears there are other HEPs with similar issues; where the FPIE operator actions are different (different procedures, different actions) for the FPRA.

RESOLVED.

As regards the issue that certain actions should be modeled as being implemented without full indications and alarms, the indications for HFEs evaluated using detailed modeling are now included in the model directly and their failure fails the action (see Finding 1-11) unless there are alternative alarms available.

This latter case is addressed generically through cue delay (see Finding 4-41), which is applied whether or not the primary instruments are lost.

Therefore, the issue of non-proceduralized diagnosis due to loss of indications or alarms is directly addressed in the modeling, and there is no credit given for the non-proceduralized case. In addition, for CBDTM, the fire HEP is developed assuming there is no alarm (Pcb is changed from "alarm" to monitor.)

All significant (F-V > 0.005 or RAW>2) are evaluated using detailed modeling, as are many of the non-significant ones, but there are non-significant ones that use screening HEPs. These

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 96 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 A utility comment was provided and reviewed by the peer review team.

The comment included an argument that inclusion of the modeling of the procedural step was a matter of analyst preference. However, review of the standard indicates that both diagnosis and performance HEPs are required to be modeled. On the second action; the comment noted that the actual manipulation of the valve was not proceduralized, since local manipulation of an MOV can be accomplished without explicit procedural direction. Although this may be true; local operator action failure should be considered in the overall HEP. Since these were just examples (F&O disposition should look at other similar HEPs), and given the more complete modeling will result in the HEPs changing, the F&O was retained.

may not have the instrumentation modeled.

On the surface this appears to be questionable because if the instrumentation was modeled then in certain scenarios the HEP would be effectively 1.0.

Also, the contention that CC II for SR HRA-C1 implies instrumentation availability does not have to be considered if a screening HEP is used is incorrect. However, setting the HEP to 1.0 is essentially the definition of RAW - how important is the HFE versus not crediting the action (HEP=1), so it can be concluded that not including the instrumentation when the HFE RAW is less than 2 should not be significant.

Resolution of this issue will have no impact on the 50.69 application.

4-36 FSS-G4 Not Met In the MCA, the barrier failure probability assigned to each scenario is based on the worst case barrier failure probability. However, the NUREG/CR-6850 approach as well as previous approaches guides analysts to sum up the failure probability for each possible failure path. For RESOLVED.

The MCA notebook indicates that "The MCA barrier failure probability classification is determined by the summation of all applicable barrier types. In the case of a particular barrier containing more than one of the same element (e.g., more than one door), only one failure probability is applied

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 97 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 example, if there is a door and a fire wall with penetrations, the barrier failure probability is the sum of the two individual rates.

for that element." This was confirmed by identifying the credited barriers listed in MCA interaction matrix (Appendix A), identifying the barrier failure probability values from Table 3-1 for each barrier, summing the applicable values and comparing to the BFP value in the FSS notebook, Appendix A, for the particular scenario.

4-37 HRA-D1 Not Met Recovery Actions are included in the Table 2-1 listing of the HRA notebook.

This table includes the recovery events already indicated in the Fire Response Procedures.

The process to include actions was performed using an iterative process; adding actions when needed to address the risk significant sequences.

However, a review of the existing PRA results, including the LERF results, did not include a complete review of cutsets for possible recovery actions that can restore the functions, systems, or components to provide a more realistic evaluation of significant accident sequences.

RESOLVED.

At the on-site review the FPRA team produced their hand-written notes from the cutset reviews.

These notes contained comments about HRA actions to add credit for recovery actions. These actions were then assigned to the HRA lead to develop the necessary HFEs and HEPs. The actions identified were found in the FHRA Notebook (LG-PRA-021.09) and incorporated in the model. It is suggested that the cutset review notes should be incorporated into the documentation.

4-40 HRA-A2 Cat I/II/III Several operator actions are included in the FPRA that appear to be crediting local action of MOVs where 92-18 protection is not present. As a result, spurious operation of the valve RESOLVED.

LG-PRA-021.52 was reviewed. Table B-1 is a compilation of the disposition of MSOs. 5K is the generic MSO for 92-18 valves. The comments

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 98 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 may occur, bypassing the limit and torque switches, resulting in the valve motor or stem failure. As a result, local action may not be possible, given the spurious operation continues for some time.

column states "MOVs with the 92 18 concern are not recovered in the FPRA."

Table A-1 contains the basic event disposition for the equipment selected for the fire PRA. A number of valves were identified as having a potential 92-18 issue, and the comment column for each states "Mapped for 92-18 potential." A spot check was done of the modeling approach in CAFTA/FRANX for these valves. The gate structure was such that the valve failed without any recovery credit for certain fire scenarios. In addition to the valve failing, it was noted that the recovery action was also mapped in FRANX such that it was listed as "affected equipment" that was failed in certain fire scenarios.

4-41 HRA-B1 Cat I/II In many cases, the delay time assumed for diagnosis of an action for Fire is adjusted by 2 minutes from the FPIE timing. Review of several events indicates that since the procedural guidance is much different in the case of the fire, and the actions may no longer be driven by alarm response, the 2 minute time delay is inappropriate. This is especially applicable for actions where the alarm or indications are not on the SSEL.

Review of a Limerick operator during the peer review on local actions during RESOLVED.

LG-PRA-021.09 Appendix D discusses the operator interviews and presents the case for applying a two-minute time delay. As explained in that document, the two minutes applies only to account for cue delay. The delay appears to be primarily related to the need for the operators to consider secondary indications to confirm plant status because primary indications may be giving false readings and also for general distraction due to the fire. It is not intended to account for other delays that affect execution.

Also, it was noted that the indications are now

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 99 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 fire in the cable room may not occur until an hour. However, the FPRA models these basically as 14 minutes based on 2 minutes longer than the FPIE modeling.

modeled directly in the fire PRA (see discussion above under F&O 1-11) and failed indication will fail the action, the adjusted HEP for the fire PRA is only applied when there is sufficient information available for the diagnosis, so in this case the two minute delay is in line with what has been used in other fire PRAs for adjusting T-delay - it is neither generally conservative nor generally optimistic and so represents a reasonable assumption (and a source of uncertainty).

4-44 HRA-E1 (HR-I3)

Not Met Uncertainty bounds for each HEP are provided in Attachment A of the HRA Notebook. The FQ notebook Table 5-1 includes one item on general HEP uncertainty (HEPS are highly uncertain), but does not include any discussion on related specific Limerick FPRA assumptions or sources of uncertainty. For example, without tracing much of the non-SSEL instrumentation, the treatment for recovery actions and non-SSEL indicated HEPs is very conservative.

Additionally, the modeling of fire impacts, including the time delay assumptions, additional stress factors and other modeling methods applied provides additional uncertainty that may be considered.

RESOLVED.

Table 3-1 and Section 3.2.14 of LG-PRA-021.12 provide a discussion of the sources of model uncertainty. Model uncertainty is generally considered to be those things that are not (cannot) be addressed through parametric uncertainty analysis (e.g., assumptions used where another equally valid assumption could have been used).

While the list is relatively short and it could be argued that there are other items that could be considered to constitute HRA model uncertainty (for example, the selection of the quantification model used as opposed to another acceptable model), these are judgement calls by the analyst.

What cannot be disputed is that sources of model uncertainty were considered and identified, which is what is required.

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 100 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 4-45 FSS-C1 Cat II Some risk significant scenarios involve full room burnout. For example PAU 43W top scenario for LERF.

RESOLVED.

LG-PRA-021.11 (Summary and quantification) indicate that the top contributors for CDF and LERF do not include full room burnout scenarios.

For example, Figures 4-5 through 4-7 show that the top scenarios for CDF and LERF are the Remote Shutdown Panels, switchgear HEAFs, transient fires, MCA oil fire, and electrical panel fires.

4-48 HRA-C1 Not Met HEP for control room abandonment for an area 25 fire is modeled using a screening value of 0.1 with no detailed modeling of credited equipment.

RESOLVED.

Area 25 is the AER. The AER is not an abandonment area, and so MCRAB does not apply.

The 0.1 value was a screening CCDP applied in the absence of detailed fire modeling, and no abandonment credit is applied.

Detailed fire modeling has now been done for the AER, and examining the FRANX file shows that there are well over 100 fire scenarios in the AER (as opposed to only a single scenario in the model that was peer reviewed).

Those scenarios are now treated in the same way as other scenarios in the plant fire model - specific equipment fails as the result of fire impacts and the same HEPs are applied as appropriate. A spot check was made in the FRANX file that showed that the scenarios had cable impacts mapped. A spot check was made in the integrated fault tree

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 101 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 (with fire scenarios inserted) and it was seen that the AER scenario impacts were modeled for each impact alongside other scenarios that had the same impact.

4-51 FQ-F1 (QU-B1)

Not Met Limerick fire PRA model was quantified in two forms: CAFTA and FRANX. FTREX was used as a quantification Engine.

However, the FPRA documentation does not discuss the method-specific limitations and features that could impact the results.

RESOLVED.

Reviewed Appendix G, "Model Quantification Limitations" of LG-PRA-021.11, "Summary and Quantification Notebook." Limitations with referenced code versions are provided in Appendix G. Appendix G summarizes the some of the potential critical limitations that may influence the FPRA model quantification and its application related to the use of the CAFTA suite of codes. A discussion of the limitations associated with using FRANX for the FPRA model development process is also provided.

4-52 FQ-F1 (QU-D1 Cat I/II/III Review of significant sequences was performed and documented in the quantification notebook. However, the review to show the logic of the cutsets or sequences is correct was not documented.

Additionally, a review of the results of the PRA for modeling consistency (e.g., event sequence model's consistency with systems models and success criteria) and operational consistency (e.g., plant configuration, procedures, and plant specific and RESOLVED.

Section 4.2.7 of the Summary and Quantification Notebook documented review.

Table 4-4 and Table 4-5 summarize the top 10 CDF cutsets from quantification of the Unit 1 and Unit 2 Single-Top Fire PRA model, respectively.

Table 4-6 and Table 4-7 summarize the top 10 LERF cutsets from quantification of the Unit 1 and Unit 2 SingleTopFire PRA model, respectively.

The cutsets were reviewed for reasonableness and were determined to make logical sense. The review of the cutsets indicates that the results are

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 102 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 industry experience) was not included in the FPRA documentation.

A review of the results to determine that the flag event settings, mutually exclusive event rules, and recovery rules yield logical results was also not documented.

A review of a sampling of nonsignificant accident cutsets or sequences to determine they are reasonable and have physical meaning was not performed.

A review of the importance of components and basic events to determine that they make logical sense was not documented in the FPRA quantification notebook.

The above should be provided also for LERF (See LE-F SRs).

consistent with the system models and associated success criteria, and that the flag event settings, mutually exclusive event rules, and recovery rules yield logical results.

As part of the final cutset review, multiple cutsets were selected at random for each decade that is relevant in the cutset file (both CDF and LERF).

Also, the bottom cutsets for CDF and LERF, respectively, were reviewed in order to identify the non-significant cutsets.

These cutsets were evaluated in a similar way as the ones documented in Tables 4-4 through 4-7, but are not documented in this notebook.

These cutset reviews for CDF and LERF evaluated top cutsets, as well as cutsets randomly chosen in the cutset file. Cutset searches were also performed to look for particular type of scenarios (e.g., MCR abandonment, MSOs) that were often nonsignificant cutsets. Changes were identified based on these cutset reviews and incorporated into the final fire model.

The details of these reviews are not documented in the PRA notebooks, but at the on-site review the FPRA team produced their hand-written notes from the cutset reviews. These notes demonstrated that the cutset reviews sufficient to support these confirmations were conducted, that issues were identified, and that actions were assigned to address the issues. However, the

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 103 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 cutset review notes were not incorporated into the PRA documentation.

4-53 FQ-F1 (QU-F6)

The quantitative definition used for significant basic event, significant cutset, and significant accident sequence was not referenced or provided in the FPRA documentation.

RESOLVED.

The FPRA uses definitions consistent with the standard per Section 3.5 of the summary and quantification notebook:

Significant Basic Event: A basic event that contributes significantly to the computed risks for a specific hazard group. For internal events, this includes any basic event that has an FV importance greater than 0.005 or a RAW importance greater than 2.

Significant Cutset: One of the set of cutsets resulting from the analysis of a specific hazard group that, when rank ordered by decreasing frequency, sum to a specified percentage of the core damage frequency (or large early release frequency) for that hazard group, or that individually contribute more than a specified percentage of core damage frequency (or large early release frequency). For this version of the Standard, the summed percentage is 95% and the individual percentage is 1% of the applicable hazard group.

Significant Accident Sequence: One of the set of accident sequences resulting from the analysis of a specific hazard group, defined at the functional or

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 104 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 systematic level, that, when rank-ordered by decreasing frequency, sum to a specified percentage of the core damage frequency for that hazard group, or that individually contribute more than a specified percentage of core damage frequency. For this version of the Standard, the summed percentage is 95% and the individual percentage is 1% of the applicable hazard group 5-1 PP-C2 Not Met The analysis is good in identifying those locations outside the PA but within the OCA; however, it is silent in terms of those locations that were screened from further consideration.

RESOLVED.

As stated in the F&O, the documentation at the time of the peer review did not include a comprehensive listing of structures in the GAB and those that were qualitatively screened.

To resolve the F&O the plant partitioning report and qualitative screening report were revised. The plant partitioning report includes a comprehensive listing of structures in the licensee controlled area included as part of the GAB. Then, the qualitatively screening report provides a comprehensive listing of those structures screened.

For example, PAUs ADMIN (Admin. Tower) and BLR (Boiler Building) are identified in Figure 4-1, which shows the GAB, and also listed in Table 4-1 of the QLS notebook, which indicates that they are screened because "This PAU does not contain PRA equipment, cables, and a fire in the PAU does not result in a required manual or automatic plant trip or a manual shutdown based on Technical

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 105 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 Specifications."

5-2 ES-A5 Not Met It does not appear that all spurious operations were appropriately dispositioned. For example, generic scenarios 5a, 5d, 5f, were dispositioned as pending; however, no analysis of the MSO applicable to these scenarios were identified.

RESOLVED.

The MSO scenarios have been incorporated into the PRA model using a systematic process that includes a comprehensive review of the generic MSO list from both a PRA and deterministic perspective. The documentation is available in both the equipment selection and plant response model notebooks (LG-PRA-021.52 and LG-PRA-021.55).

The appropriate MSO scenarios have been included in the plant response model. A disposition for each scenario, including those screened from the plant response model, is available. The specific scenarios listed in the finding, i.e. 5a, 5d, 5f, are no longer pending and have been either added to the model or dispositioned. A similar comprehensive approach has been applied to all the MSO scenarios.

5-3 ES-A6 Cat II It does not appear that all spurious operations were appropriately dispositioned. For example, generic scenario 4u was dispositioned as not applicable to Limerick because it is a COP issue. Actually, 4u is not a COP issue, but rather a containment isolation issue, and therefore applicable to Limerick.

RESOLVED.

The MSO scenarios have been incorporated into the PRA model using a systematic process that includes a comprehensive review of the generic MSO list from both a PRA and deterministic perspective. The documentation is available in both the equipment selection and plant response model notebooks (LG-PRA-021.52 and LG-PRA-

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 106 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 021.55).

The appropriate MSO scenarios have been included in the plant response model. A disposition for each scenario, including those screened from the plant response model, is available. The specific scenarios listed in the finding, i.e. 4u, is appropriately dispositioned. A similar comprehensive approach has been applied to all the MSO scenarios.

5-7 IGN-A7 Cat I/II/III A consistent methodology was used to determine ignition frequencies. The method applied uses a 0.1 weighting factor, which is not included in the generic approach referenced in NUREG/CR-6850. Note that the ranking of 1 is listed as a minimal level in NUREG/CR-6850.

RESOLVED.

The Ignition Frequency Notebook (LG-PRA-021.56), Section 3.1.8, explains the method used for calculating transient ignition frequencies. A weighting factor of 0.1, noted by the peer review finding, is no longer used for calculating the ignition frequencies.

The method used is based on NUREG/CR-6850 and FAQ 12-0064, in which ignition frequencies are calculated using influence factors for maintenance, hotwork, storage, and occupancy.

The method documented in LG-PRA-021.56 (Section 3.1.8, Appendix D) is consistent with the guidance in FAQ 12-0064 and therefore the F&O is resolved.

5-10 FQ-F1(LE-F1)

Not Met Significant contributors corresponding plant damage states (accident classes) are required in accordance with FQ-RESOLVED.

Reviewed Section 4 of LG-PRA-021.11. Significant

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 107 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 E1, but this information was not provided in the FPRA documentation.

contributors to LERF are discussed in LG-PRA-021.11 (Summary and Quantification Notebook):

Section 4.2.1, Figures 4-1 through 4-4, provide Physical Analysis Unit (PAU) contributions for CDF and LERF.

Section 4.2.2, Figures 4-5 through 4-8, provide fire scenario contributions for CDF and LERF.

Section 4.2.6, Figures 4-15 through 4-16, provide CDF accident sequence contributions for LERF In Figure 4-15 and 4-16 for LERF contributors by sequence for Unit 1 and Unit 2, the sequences represent containment event tree end states. The containment event trees include nodes for the various LERF contributors which include those listed in Table 2-2.8-9 of the Standard.

5-12 FMU-C1 Not Met The FPRA configuration control process is documented by Exelon fleet procedure ER-AA-600-1061. Section 2.5 describes the process for assessing pending changes to the model of record (MOR). These reviews are perform on a case-by-case basis, and the independent impact on the model is determined. The procedure is silent in terms of assessing the

'cumulative' impact of multiple changes. Exelon comment on this F&O RESOLVED.

The current revision of the FPRA maintenance and update procedure, ER-AA-600-1061 includes explicit provision for evaluation of the cumulative impact of outstanding changes.

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 108 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 is as follows: "Although the procedure does not specifically mention cumulative impacts, the intent of the statement that includes "evaluate the impact of pending changes to the FMOR" is considered to implicitly include the cumulative nature of the pending changes. This is consistent with the guidance established for control and update of the internal events PRA. This issue was discussed with the reviewer near the end of the peer review. "Although the peer review team agrees that more experienced PRA professionals will understand the implicit requirement; less experience PRA professionals may not understand the requirement. As a result; the F&O remains a finding.

6-2 CS-C2 Cat I/II/III The input version of the cable routing database and related inputs are not provided in the references. Inputs were used from Appendix R, MSO resolution project, and ES related Fire PRA Tasks. This information is fed on other tasks such as scenario development and quantification.

RESOLVED.

Section 4.1 of the cable selection notebook discusses the sources for the data in Table A-1.

Table A-1 identifies the source for each cable to FPRA component. FPRA data is contained in the cable selection notebook tables. INDMS data and MSO data were derived from references 4 and 7, respectively, in Section 5.0 of the cable selection notebook. These references include dates to identify the input version of the data.

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 109 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 6-3 SF-A4 Not Met The Seismic - Fire Interactions results is found in LG-PRA-021.05 Appendix I

- Seismic Fire Interactions.

Impact on post earthquake response by the plant is not addressed. (SR SF-A4)

The report does not address the storage and placement of firefighting equipment nor are the brigade access routes addressed. (SR-SF-A5)

RESOLVED.

The seismic fire interactions notebook, Section 4.1.4 addresses the first part of the finding. An assessment was performed that identified the extent to which needing to enter procedure SE-8 (Fire) would affect the execution of the already entered procedure SE-5 (Earthquake). The section does note some limitations in these areas, which are assessed as minor.

Section 4.1.5 addresses the second part of the finding. An assessment was performed that identified the extent to which the brigade training prepares the brigade to deal with earthquakes access routes and how the earthquake can affect the equipment. The section does note some limitations in these areas.

6-5 FSS-D3 Not Met Limerick uses a bounding approach for the initial treatment of fire scenarios using a generic fire modeling calculation and the information and further information documented in the generic treatments notebook.

One PAU was treated with additional fire modeling (4kV Emergency Switchgear room) with the CFAST fire modeling summarized in the scenario workbook Appendix E. However, a number of other PAUs have results RESOLVED.

The summary and quantification notebook documents the risk significant PAUs. The fire modeling treatments notebook lists the detailed fire scenarios defined for these rooms. The fire modeling treatments notebook describes the fire modeling analysis, which is consistent with the current industry guidance.

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 110 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 that are significant contributors to overall unit fire risk (e.g. PAU 025, Auxiliary Equipment Room). These PAUs/Scenarios could benefit from additional fire modeling.

6-6 FSS-D4 CAT I/II/III Limerick uses a bounding approach for the initial treatment of fire scenarios using a generic fire modeling calculation and the information and further information documented in the generic treatments notebook.

The fire modeling tools include CFAST as used to create the Generic Fire Modeling Treatments (including supplements) and the Main Control Abandonment Analysis.

Technical basis is provided in the treatments/tools above.

The detailed fire modeling was performed for the Switchgear Room fires and the results documented in the scenario development report Attachment G. The basis for a number of inputs was explicitly provided; however, the basis for some of the CFAST inputs was not explicitly provided. For example, a spreadsheet was developed to create the input RESOLVED.

The F&O response indicates that the CFAST analysis is no longer being used in the switchgear HGL analysis, so the F&O is no longer applicable.

Inputs used for HGL calculations in the FMT notebook and the input files for CFAST used in the Main Control Room Abandonment notebooks are provided.

License Amendment Request Enclosure Adopt 10 CFR 50.69 b Docket Nos. 50-352 and 50-353 111 Finding Number Supporting Requirement(s)

Capability Category (CC)

Finding Description Disposition for 50.69 deck for the CFAST model. The spreadsheets and input deck were not available to the peer team to check.

References:

LG-PRA-021.05, Generic Fire Modeling Treatment, Supplement to Generic Fire Modeling Treatment -

Hot Gas Layer, MCRAB Analysis.

6-7 FSS-D7 Not Met Generic estimates per NUREG/CR-6850 are used and the system is operational during plant operation per plant procedures.

No evidence was found to indicate a review for outlier was performed. Also, scope of risk relevant fire suppression and detection systems not identified.

RESOLVED.

Section 3.8 of the fire modeling treatments notebook documents that the fire protection detection and suppression system impairments review. This included a review of the fire protection health report performance indicator worksheet for multiple years. No major failures of systems were identified.

The scope of the FP systems (i.e. a list of all the credited systems, not just risk-relevant areas) is identified in Table 3-1 of the fire modeling treatments notebook.

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 112 External Hazard Screening Result Screened?

(Y/N)

Screening Criterion (Note a)

Comment Aircraft Impact Y

PS2 PS4 Airport hazard is discussed in Limerick UFSAR Section 3.5.1.6.3.

The acceptance criteria of SRP Section 3.5.1.6 are met. The likelihood of a LOOP or plant fire due to aircraft crashes in other areas of the plant (e.g., switchyard) is sufficiently low compared to LOOP and fire events already included in the internal events and fire PRAs.

Avalanche Y

C3 Not applicable to the site because of climate and topography.

Biological Event Y

C3 C5 Sudden influxes not applicable to the plant design. Slowly developing growth can be detected and mitigated by surveillance.

Coastal Erosion Y

C3 Not applicable to the site because of location.

Drought Y

C5 Plant design eliminates drought as a concern and event is slowly developing. : External Hazards Screening

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 113 External Hazard Screening Result Screened?

(Y/N)

Screening Criterion (Note a)

Comment External Flooding Y

C1 The external flooding hazard at the site was recently updated as a result of the post-Fukushima 50.54(f)

Request for Information and the flood hazard reevaluation report (FHRR) was submitted to NRC for review on March 12, 2015 (Reference 14). The results indicate that flooding from rivers and streams (precipitation based) and dam failure are bounded by the current licensing basis (CLB) and do not pose a challenge to the plant.

Flooding from local intense precipitation was evaluated and will not challenge any safety functions at Limerick.

Extreme Wind or Tornado Y

C1 PS4 Capability of SSCs to withstand wind and tornado loadings is discussed in Section 3.3 and 3.5.1.4 of the Limerick UFSAR. The risk due to extreme winds and tornados is small.

Fog Y

C1 Negligible impact on the plant.

Forest or Range Fire Y

C3 Not applicable to the site because of limited vegetation.

Frost Y

C1 Negligible impact on the plant and predictability of the event.

Hail Y

C1 C4 Limited occurrence and bounded by other events for which the plant is designed. Flooding impacts covered under intense precipitation (see External Flooding).

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 114 External Hazard Screening Result Screened?

(Y/N)

Screening Criterion (Note a)

Comment High Summer Temperature Y

C1 C4 Plant is designed for this hazard.

Associated plant trips are rare and are covered in the definition of another event in the PRA model (e.g., transients, loss of condenser).

High Tide, Lake Level, or River Stage Y

C1 C3 High tide or lake level not applicable to the site because of location.

Impact of high river stage is slow to develop.

Hurricane Y

C4 Covered under Extreme Wind or Tornado and Intense Precipitation (see External Flooding).

Ice Cover Y

C1 C3 Negligible impact to the site. Ice blockage causing flooding is not applicable to the site because of location. Plant is designed for freezing temperatures, which are infrequent and short in duration.

The plant procedure for severe weather and natural disasters includes attachments for Schuylkill river pump house icing (normal makeup to cooling tower and addresses ESW system winter bypass).

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 115 External Hazard Screening Result Screened?

(Y/N)

Screening Criterion (Note a)

Comment Industrial or Military Facility Accident Y

C1 C3 Explosive hazard impacts and control room habitability impacts meet the 1975 SRP requirements (Regulatory Guides 1.78 and 1.91) (References 15 and 16, respectively).

In addition, UFSAR Section 2.2.3 discusses the impact of industrial and military facilities on the site. There are no military facilities within 5 miles of the site. There are no industrial activities involving explosive storage near the site.

Other potential hazards are evaluated elsewhere in this table (e.g., transportation accidents).

Adequate design provisions and considerations already exist at LGS to account for postulated industrial facility accidents.

Internal Flooding N

None The Limerick Internal Events PRA includes evaluation of risk from internal flooding events.

Internal Fire N

None The Limerick internal Fire PRA addresses risk from internal fire events.

Landslide Y

C3 Not applicable to the site because of topography.

Lightning Y

C1 Lightning strikes causing loss of offsite power or turbine trip are contributors to the initiating event frequencies for these events, which are already modeled in the Limerick internal events PRA.

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 116 External Hazard Screening Result Screened?

(Y/N)

Screening Criterion (Note a)

Comment Low Lake Level or River Stage Y

C3 C5 Low lake level not applicable to the site because of location. Impacts of low river stage event are slow to develop.

Low Winter Temperature Y

C1 C5 The plant is designed for extended freezing events, and their impacts are slow to develop.

Meteorite or Satellite Impact Y

PS4 Negligible impact to the site. The frequency of meteorites greater than 100 lbs. striking the plant is around 1E-8/y and corresponding satellite impacts is around 2E-9/y (Reference 17).

Pipeline Accident Y

C1 The plant is designed for such peak pressures from explosion per UFSAR Section 2.2.3.1.1. UFSAR analyses valid for operating pipelines published by the US Department of Transportation's Pipeline and Hazardous Materials Safety Administration.

Release of Chemicals in Onsite Storage Y

C4 PS1 UFSAR Section 2.2.3.1.3 discusses onsite chemical storage. Detection and isolation capability is provided for chemicals constituting a hazard for the control room. Other spills were determined to have no adverse effects on operation of plant equipment. See also Transportation Accidents.

River Diversion Y

C3 C5 Not applicable to the site because of location. Diversion of the Schuylkill River would be a very slowly developing impact.

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 117 External Hazard Screening Result Screened?

(Y/N)

Screening Criterion (Note a)

Comment Sand or Dust Storm Y

C1 C5 The plant is generally not vulnerable to such events due to location. In any case, the plant is designed for such events, and a procedure instructs operators to replace filters before they become inoperable.

Seiche Y

C1 C3 Not applicable to the site because of location.

Seismic Activity N

None See information in Section 3.2.3 of this application.

Snow Y

C1 C4 The event damage potential is less than other events for which the plant is designed. Potential flooding impacts covered under external flooding. The Plant procedure for severe weather and natural disaster guidelines includes an attachment for Snow.

Soil Shrink-Swell Consolidation Y

C1 C5 The potential for this hazard is low at the site, the plant design considers this hazard, and the hazard is slowly developing and can be mitigated.

Storm Surge Y

C3 Not applicable to the site because of location.

Toxic Gas Y

C4 Toxic gas covered under release of chemicals in onsite storage, industrial or military facility accident, and transportation accident.

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 118 External Hazard Screening Result Screened?

(Y/N)

Screening Criterion (Note a)

Comment Transportation Accident Y

C3 C4 PS2 PS4 Typical truck tanker volume of eighteen chemicals potentially transported via State Route 422 (listed in Regulatory Guide 1.78) were evaluated to determine the significance of the threat to the control room envelope. None of the calculations for the chemicals fall above the limits given in Regulatory Guide 1.78.

Reference 18 also identifies two chemicals that are transported via railway more than 30 times a year (Benzene and Butane). These chemicals were both determined to not impact main control room habitability per analyses of Regulatory Guide 1.78.

Section 2.2.3.1.1 of the UFSAR contains an analysis of accidents on the nearby railway line, highways, or pipelines. The plant is designed to withstand such accidents.

Tsunami Y

C3 Not applicable to the site because of location.

Turbine-Generated Missiles Y

PS2 PS4 Turbine Generated Missiles are evaluated in UFSAR Section 3.5.1.3.

The probability of unacceptable damage from turbine missile is maintained at less than or equal to 1x10-7 per year.

Volcanic Activity Y

C3 Not applicable to the site because of location.

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 119 External Hazard Screening Result Screened?

(Y/N)

Screening Criterion (Note a)

Comment Waves Y

C3 C4 Waves associated with adjacent large bodies of water are not applicable to the site. Waves associated with external flooding are covered under that hazard.

Note a - See Attachment 5 for descriptions of the screening criteria.

License Amendment Request Enclosure Adopt 10 CFR 50.69 Docket Nos. 50-352 and 50-353 120 : Progressive Screening Approach for Addressing External Hazards Event Analysis Criterion Source Comments Initial Preliminary Screening C1. Event damage potential is

< events for which plant is designed.

NUREG/CR-2300 and ASME/ANS Standard RA-Sa-2009 C2. Event has lower mean frequency and no worse consequences than other events analyzed.

NUREG/CR-2300 and ASME/ANS Standard RA-Sa-2009 C3. Event cannot occur close enough to the plant to affect it.

NUREG/CR-2300 and ASME/ANS Standard RA-Sa-2009 C4. Event is included in the definition of another event.

NUREG/CR-2300 and ASME/ANS Standard RA-Sa-2009 Not used to screen.

Used only to include within another event.

C5. Event develops slowly, allowing adequate time to eliminate or mitigate the threat.

ASME/ANS Standard RA-Sa-2009 Progressive Screening PS1. Design basis hazard cannot cause a core damage accident.

ASME/ANS Standard RA-Sa-2009 PS2. Design basis for the event meets the criteria in the NRC 1975 Standard Review Plan (SRP).

NUREG-1407 and ASME/ANS Standard RA-Sa-2009 PS3. Design basis event mean frequency is < 1E-5/y and the mean conditional core damage probability is < 0.1.

NUREG-1407 as modified in ASME/ANS Standard RA-Sa-2009 PS4. Bounding mean CDF is <

1E-6/y.

NUREG-1407 and ASME/ANS Standard RA-Sa-2009 Detailed PRA Screening not successful. PRA needs to meet requirements in the ASME/ANS PRA Standard.

NUREG-1407 and ASME/ANS Standard RA-Sa-2009