BSEP 17-0098, Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (Sscs) for Nuclear Power Reactors

Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (Sscs) for Nuclear Power Reactors

ML18010A344
Person / Time
Site:	Brunswick
Issue date:	01/10/2018
From:	William Gideon Duke Energy Progress
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
BSEP 17-0098
Download: ML18010A344 (62)

Text

William R. Gideon Vice President Brunswick Nuclear Plant P.O. Box 10429 Southport, NC 28461 o: 910.832.3698 10 CFR 50.90 10 CFR 50.69 January 10, 2018 Serial: BSEP 17-0098 U.S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555-0001 Brunswick Steam Electric Plant, Units Nos. 1 and 2 Renewed Facility Operating License Nos. DPR-71 and DPR-62 Docket Nos. 50-325 and 50-324

Subject:

Application to Adopt 10 CFR 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors" In accordance with the provisions of 10 CFR 50.69 and 10 CFR 50.90, Duke Energy Progress, LLC (Duke Energy) is requesting an amendment to the license of Brunswick Steam Electric Plant (BSEP), Units Nos. 1 and 2.

The proposed amendment would modify the licensing basis, by the addition of a License Condition, to allow for the implementation of the provisions of 10 CFR 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors." The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with this regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety.

The enclosure to this letter provides the basis for the proposed change to the BSEP, Units 1 and 2 Operating Licenses. The categorization process being implemented through this change is consistent with Nuclear Energy Institute (NEI) 00-04, "10 CFR 50.69 SSC Categorization Guideline," Revision 0, July 2005 which was endorsed by the NRC in Regulatory Guide 1.201, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance", Revision 1, May 2006. Attachment 1 of the enclosure provides a list of categorization prerequisites. Use of the categorization process on a plant system will only occur after these prerequisites are met.

( ~ DUKE ENERGY

U.S. Nuclear Regulatory Commission BSEP 17-0098 Page2 The NRG has previously reviewed the technical adequacy of the BSEP Probabilistic Risk Assessment (PAA) models identified in this application, with routine maintenance updates applied, for:

Letter from the NRC to BSEP, "Issuance of Amendments Regarding request to Relocate Specific Surveillance Frequencies to Licensee Controlled Program,"

May 24, 2017 (ADAMS Accession No. ML17096A129)

Letter from the NRC to BSEP, "Issuance of Amendments to Adopt NFPA 805 Performance-Based Standard for Fire Protection Program in Accordance with 1 0 CFR 50.48(c)," January 28, 2015 (ADAMS Accession No. ML14310A808)

Duke Energy requests that the NRG utilize the review of the PAA technical adequacy for these application when performing the review for this application.

Duke Energy requests approval of the proposed license amendment by January 16, 2019, with the amendment being implemented within 60 days.

In accordance with 1 0 CFR 50.91, a copy of this application, with attachments, is being provided to the designated North Carolina Official.

This letter contains no regulatory commitments.

Please refer any questions regarding this submittal to Art Zaremba at (980) 373-2062.

I declare under penalty of perjury that the foregoing is true and correct. Executed on January 10, 2018.

s;v William R. Gideon

Enclosure:

1. Evaluation of the Proposed Change

U.S. Nuclear Regulatory Commission BSEP 17-0098 Page 3 cc (with enclosure):

C. Haney, Regional Administrator U. S. Nuclear Regulatory Commission - Region II Marquis One Tower 245 Peachtree Center Ave., NE Suite 1200 Atlanta, GA 30303-1257 A.L. Hon, Project Manager (BSEP) (Electronic Copy only)

U. S. Nuclear Regulatory Commission One White Flint North, Mail Stop 8 G9A 11555 Rockville Pike Rockville, MD 20852-2738 Andrew.Hon@nrc.gov G. Smith, NRC Senior Resident Inspector 8470 River Road Southport, NC 28461-8869 Chair - North Carolina Utilities Commission (Electronic Copy only) 4325 Mail Service Center Raleigh, NC 27699-4300 swatson@ncuc.net W. Lee Cox III, Section Chief (Electronic Copy Only)

Radiation Protection Section North Carolina Department of Health and Human Services 1645 Mail Service Center Raleigh, NC 27699-145 lee.cox@dhhs.nc.gov

U.S. Nuclear Regulatory Commission BSEP 17-0098 Page 4 bcc (with enclosure):

W.R. Gideon M.C. Nolan A.H. Zaremba L. Grzeck M. Braeden B. Murray A. Young J. Varnedoe H. Szews L. Martin K. Nolan D. Cummings ELL File: (Corporate)

BSEP 17-0098 Enclosure i

Evaluation of the Proposed Change TABLE OF CONTENTS 1

SUMMARY

DESCRIPTION.................................................................................................. 3 2

DETAILED DESCRIPTION.................................................................................................. 3 2.1 CURRENT REGULATORY REQUIREMENTS............................................................ 3 2.2 REASON FOR PROPOSED CHANGE........................................................................ 3

2.3 DESCRIPTION

OF THE PROPOSED CHANGE......................................................... 4 3

TECHNICAL EVALUATION................................................................................................. 5 3.1 CATEGORIZATION PROCESS DESCRIPTION (10 CFR 50.69(B)(2)(I))................... 5 3.1.1 Overall Categorization Process.................................................................. 5 3.1.2 Passive Categorization Process............................................................... 10 3.2 TECHNICAL ADEQUACY EVALUATION (10 CFR 50.69(B)(2)(II)).......................... 12 3.2.1 Internal Events and Internal Flooding...................................................... 12 3.2.2 Fire Hazards................................................................................................ 12 3.2.3 Seismic Hazards......................................................................................... 12 3.2.4 Other External Hazards.............................................................................. 13 3.2.5 Low Power & Shutdown............................................................................ 13 3.2.6 PRA Maintenance and Updates................................................................ 14 3.2.7 PRA Uncertainty Evaluations.................................................................... 14 3.3 PRA REVIEW PROCESS RESULTS (10 CFR 50.69(B)(2)(III))................................ 15 3.4 RISK EVALUATIONS (10 CFR 50.69(B)(2)(IV))....................................................... 16 4

REGULATORY EVALUATION.......................................................................................... 16 4.1 APPLICABLE REGULATORY REQUIREMENTS/CRITERIA.................................. 16 4.2 NO SIGNIFICANT HAZARDS CONSIDERATION ANALYSIS................................. 17

4.3 CONCLUSION

S......................................................................................................... 18 5

ENVIRONMENTAL CONSIDERATION............................................................................. 18 6

REFERENCES................................................................................................................... 19

BSEP 17-0098 Enclosure ii LIST OF ATTACHMENTS

List of Categorization Prerequisites.............................................................. 21 : Description of PRA Models Used in Categorization..................................... 22 : Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items............................................................................................ 23 : External Hazards Screening........................................................................... 50 : Progressive Screening Approach for Addressing External Hazards.......... 54 : Disposition of Key Assumptions/Sources of Uncertainty........................... 55

BSEP 17-0098 Enclosure 3

1

SUMMARY

DESCRIPTION The proposed amendment would modify the licensing basis to allow for the implementation of the provisions of Title 10 of the Code of Federal Regulations (10 CFR), Part 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors." The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with this regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety.

2 DETAILED DESCRIPTION 2.1 CURRENT REGULATORY REQUIREMENTS The NRC has established a set of regulatory requirements for commercial nuclear reactors to ensure that a reactor facility does not impose an undue risk to the health and safety of the public, thereby providing reasonable assurance of adequate protection to public health and safety. The current body of NRC regulations and their implementation are largely based on a "deterministic" approach.

This deterministic approach establishes requirements for engineering margin and quality assurance in design, manufacture, and construction. In addition, it assumes that adverse conditions can exist (e.g., equipment failures and human errors) and establishes a specific set of design basis events (DBEs). The deterministic approach then requires that the facility include safety systems capable of preventing or mitigating the consequences of those DBEs to protect public health and safety. The Structures, Systems and Components (SSCs) necessary to defend against the DBEs are defined as "safety-related," and these SSCs are the subject of many regulatory requirements, herein referred to as "special treatments," designed to ensure that they are of high quality and high reliability, and have the capability to perform during postulated design basis conditions. Treatment includes, but is not limited to, quality assurance, testing, inspection, condition monitoring, assessment, evaluation, and resolution of deviations.

The distinction between "treatment" and "special treatment" is the degree of NRC specification as to what must be implemented for particular SSCs or for particular conditions. Typically, the regulations establish the scope of SSCs that receive special treatment using one of three different terms: "safety-related," "important to safety," or "basic component." The terms "safety-related "and "basic component" are defined in the regulations, while "important to safety," used principally in the general design criteria (GDC) of Appendix A to 10 CFR Part 50, is not explicitly defined.

2.2 REASON FOR PROPOSED CHANGE A probabilistic approach to regulation enhances and extends the traditional deterministic approach by allowing consideration of a broader set of potential challenges to safety, providing a logical means for prioritizing these challenges based on safety significance, and allowing consideration of a broader set of resources to defend against these challenges. In contrast to the deterministic approach, Probabilistic Risk Assessments (PRAs) address credible initiating events by assessing the event frequency. Mitigating system reliability is then assessed,

BSEP 17-0098 Enclosure 4

including the potential for common cause failures. The probabilistic approach to regulation is an extension and enhancement of traditional regulation by considering risk in a comprehensive manner.

To take advantage of the safety enhancements available through the use of PRA, in 2004 the NRC published a new regulation, 10 CFR 50.69. The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with the regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety.

The rule contains requirements on how a licensee categorizes SSCs using a risk-informed process, adjusts treatment requirements consistent with the relative significance of the SSC, and manages the process over the lifetime of the plant. A risk-informed categorization process is employed to determine the safety significance of SSCs and place the SSCs into one of four risk-informed safety class (RISC) categories. The determination of safety significance is performed by an integrated decision-making process, as described by NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline (Reference 1), which uses both risk insights and traditional engineering insights. The safety functions include the design basis functions, as well as functions credited for severe accidents (including external events). Special or alternative treatment for the SSCs is applied as necessary to maintain functionality and reliability, and is a function of the SSC categorization results and associated bases. Finally, periodic assessment activities are conducted to make adjustments to the categorization and/or treatment processes as needed so that SSCs continue to meet all applicable requirements.

The rule does not allow for the elimination of SSC functional requirements or allow equipment that is required by the deterministic design basis to be removed from the facility. Instead, the rule enables licensees to focus their resources on SSCs that make a significant contribution to plant safety. For SSCs that are categorized as high safety significant, existing treatment requirements are maintained or enhanced. Conversely, for SSCs that do not significantly contribute to plant safety on an individual basis, the rule allows an alternative risk-informed approach to treatment that provides reasonable, though reduced, level of confidence that these SSCs will satisfy functional requirements.

Implementation of 10 CFR 50.69 will allow Duke Energy to improve focus on equipment that has safety significance resulting in improved plant safety.

2.3 DESCRIPTION

OF THE PROPOSED CHANGE Duke Energy proposes the addition of the following condition to the renewed operating licenses of BSEP, Units 1 and 2 to document the NRC's approval of the use 10 CFR 50.69.

Duke Energy is approved to implement 10 CFR 50.69 using the processes for categorization of Risk-Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC-4 SSCs specified in the license amendment request dated January 10, 2018.

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

BSEP 17-0098 Enclosure 5

3 TECHNICAL EVALUATION 10 CFR 50.69 specifies the information to be provided by a licensee requesting adoption of the regulation. This request conforms to the requirements of 10 CFR 50.69(b)(2), which states:

A licensee voluntarily choosing to implement this section shall submit an application for license amendment under 10 CFR 50.90 that contains the following information:

(i) A description of the process for categorization of RISC-1, RISC-2, RISC-3 and RISC-4 SSCs.

(ii) A description of the measures taken to assure that the quality and level of detail of the systematic processes that evaluate the plant for internal and external events during normal operation, low power, and shutdown (including the plant-specific probabilistic risk assessment (PRA), margins-type approaches, or other systematic evaluation techniques used to evaluate severe accident vulnerabilities) are adequate for the categorization of SSCs.

(iii) Results of the PRA review process conducted to meet 10 CFR 50.69(c)(1)(i).

(iv) A description of, and basis for acceptability of, the evaluations to be conducted to satisfy § 50.69(c)(1)(iv). The evaluations must include the effects of common cause interaction susceptibility, and the potential impacts from known degradation mechanisms for both active and passive functions, and address internally and externally initiated events and plant operating modes (e.g., full power and shutdown conditions).

Each of these submittal requirements are addressed in the following sections.

The NRC has previously reviewed the technical adequacy of the BSEP Probabilistic Risk Assessment (PRA) models identified in this application, with routine maintenance updates applied, for:

License Amendment for Technical Specification Change Regarding Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee-Controlled Program, May 24, 2017, ADAMS Accession No. ML17096A129 License Amendment to Adopt NFPA 805 Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants, January 28, 2015, ADAMS Accession No. ML14310A808 Duke Energy requests that the NRC utilize the review of the PRA technical adequacy for these applications when performing the review for this application.

3.1 CATEGORIZATION PROCESS DESCRIPTION (10 CFR 50.69(b)(2)(i))

3.1.1 Overall Categorization Process Duke Energy will implement the risk categorization process in accordance with the NEI 00-04, Revision 0, as endorsed by Regulatory Guide (RG) 1.201, "Guidelines for Categorizing

BSEP 17-0098 Enclosure 6

Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance," (Reference 2). NEI 00-04 Section 1.5 states "Due to the varying levels of uncertainty and degrees of conservatism in the spectrum of risk contributors, the risk significance of SSCs is assessed separately from each of five risk perspectives and used to identify SSCs that are potentially safety-significant." A separate evaluation is appropriate to avoid reliance on a combined result that may mask the results of individual risk contributors.

The process to categorize each system will be consistent with the guidance in NEI 00-04, "10 CFR 50.69 SSC Categorization Guideline," as endorsed by RG 1.201. RG 1.201 states that "the implementation of all processes described in NEI 00-04 (i.e., Sections 2 through 12) is integral to providing reasonable confidence" and that "all aspects of NEI 00-04 must be followed to achieve reasonable confidence in the evaluations required by §50.69(c)(1)(iv)."

However, neither RG 1.201 nor NEI 00-04 prescribe a particular sequence or order for each of the elements to be completed. Therefore, the order in which each of the elements of the categorization process (listed below) is completed is flexible and as long as they are all completed they may even be performed in parallel. Note that NEI 00-04 only requires the seven qualitative criteria in Section 9.2 of NEI 00-04 (Item 3 in the list below) to be completed for components/functions categorized as LSS by all other elements. Similarly, NEI 00-04 only requires the defense-in-depth assessment (Item 4 in the list below) to be completed for safety related active components/functions categorized as LSS by all other elements.

1.

PRA-based evaluations (e.g., the internal events, internal flooding, fire, high winds, and external flood PRAs)

2.

non-PRA approaches (e.g., seismic safe shutdown equipment list (SSEL), other external events screening, and shutdown assessment)

3.

seven qualitative criteria in Section 9.2 of NEI 00-04

4.

the defense-in-depth assessment

5.

the passive categorization methodology Categorization of SSCs will be completed per the NEI 00-04 process, as endorsed by RG 1.201, which includes the determination of safety significance through the various elements identified above. The results of these elements are used as inputs to arrive at a preliminary component categorization (i.e., High Safety Significant (HSS) or Low Safety Significant (LSS))

that is presented to the Integrated Decision-Making Panel (IDP). Note: the term "preliminary HSS or LSS" is synonymous with the NEI 00-04 term "candidate HSS or LSS." A component or function is preliminarily categorized as HSS if any element of the process results in a preliminary HSS determination in accordance with Table 1 below. The safety significance determination of each element, identified above, is independent of each other and therefore the sequence of the elements does not impact the resulting preliminary categorization of each component or function. Consistent with NEI 00-04, the categorization of a component or function will only be "preliminary" until it has been confirmed by the IDP. Once the IDP confirms that the categorization process was followed appropriately, the final Risk Informed Safety Class (RISC) category can be assigned.

The IDP may direct and approve detailed categorization of components in accordance with NEI 00-04 Section 10.2. The IDP may always elect to change a preliminary LSS component or function to HSS, however the ability to change component categorization from preliminary HSS to LSS is limited. This ability is only available to the IDP for select process steps as described in NEI 00-04 and endorsed by RG 1.201. Table 3-1 summarizes these IDP limitations in NEI 00-04. The steps of the process are performed at either the function level, component

BSEP 17-0098 Enclosure 7

level, or both. This is also summarized in the Table 3-1. A component is assigned its final RISC category upon approval by the IDP.

Table 3-1: IDP Changes from Preliminary HSS to LSS Element Categorization Step -

NEI 00-04 Section Evaluation Level IDP Change HSS to LSS Drives Associated Functions Risk (PRA Modeled)

Internal Events Base Case - Section 5.1 Component Not Allowed Yes Fire, Seismic and Other External Events Base Case Allowable No PRA Sensitivity Studies Allowable No Integral PRA Assessment -

Section 5.6 Not Allowed Yes Risk (Non-modeled)

Fire, Seismic and Other External Hazards -

Component Not Allowed No Shutdown - Section 5.5 Function/Component Not Allowed No Defense-in-Depth Core Damage -

Section 6.1 Function/Component Not Allowed Yes Containment -

Section 6.2 Component Not Allowed Yes Qualitative Criteria Considerations -

Section 9.2 Function Allowable N/A Passive Passive - Section 4 Segment/Component Not Allowed No The mapping of components to system functions is used in some categorization process steps to facilitate preliminary categorization of components. Specifically, functions with mapped components that are determined to be HSS by the PRA-based assessment (i.e., Internal events PRA or Integral PRA assessment) or defense-in-depth evaluation will be initially treated as HSS. However, NEI 00-04 Section 10.2 allows detailed categorization which can result in some components mapped to HSS functions being treated as LSS; and Section 4.0 discusses additional functions that may be identified (e.g., fill and drain) to group and consider potentially LSS components that may have been initially associated with a HSS function but which do not support the critical attributes of that HSS function. Note that certain steps of the categorization process are performed at a component level (e.g., Passive, Non-PRA-modeled hazards - see

BSEP 17-0098 Enclosure 8

Table 3-1). These components from the component level assessments will remain HSS (IDP cannot override) regardless of the significance of the functions to which they are mapped.

Therefore, if a HSS component is mapped to a LSS function, that component will remain HSS.

If an LSS component is mapped to an HSS function, that component may be driven HSS based on Table 3-1 above, or may remain LSS.

The following are clarifications to be applied to the NEI 00-04 categorization process:

The Integrated Decision Making Panel (IDP) will be composed of a group of at least five experts who collectively have expertise in plant operation, design (mechanical and electrical) engineering, system engineering, safety analysis, and probabilistic risk assessment. At least three members of the IDP will have a minimum of five years of experience at the plant, and there will be at least one member of the IDP who has a minimum of three years of experience in the modeling and updating of the plant-specific PRA.

The IDP will be trained in the specific technical aspects and requirements related to the categorization process. Training will address at a minimum the purpose of the categorization; present treatment requirements for SSCs including requirements for design basis events; PRA fundamentals; details of the plant specific PRA including the modeling, scope, and assumptions, the interpretation of risk importance measures, and the role of sensitivity studies and the change-in-risk evaluations; and the defense-in-depth philosophy and requirements to maintain this philosophy.

The decision criteria for the IDP for categorizing SSCs as safety significant or low safety-significant pursuant to 10 CFR 50.69(f)(1) will be documented in Duke Energy procedures.

Decisions of the IDP will be arrived at by consensus. Differing opinions will be documented and resolved, if possible. If a resolution cannot be achieved concerning the safety significance of an SSC, then the SSC will be classified as safety-significant.

Passive characterization will be performed using the processes described in Section 3.1.2 of this enclosure. Consistent with NEI 00-04, an HSS determination by the passive categorization process cannot be changed by the IDP.

An unreliability factor of 3 will be used for the sensitivity studies described in Section 8 of NEI 00-04. The factor of 3 was chosen as it is representative of the typical error factor of basic events used in the PRA model.

NEI 00-04 Section 7 requires assigning the safety significance of functions to be preliminary HSS if it is supported by an SSC determined to be HSS from the PRA-based assessment in Section 5, but does not require this for SSCs determined to be HSS from non-PRA-based, deterministic assessments in Section 5. This requirement is further clarified in the Vogtle SER (Reference 15) which states "if any SSC is identified as HSS from either the integrated PRA component safety significance assessment (Section 5 of NEI 00-04) or the defense-in-depth assessment (Section 6), the associated system function(s) would be identified as HSS."

BSEP 17-0098 Enclosure 9

Once a system function is identified as HSS, then all the components that support that function are preliminary HSS. The IDP must intervene to assign any of these HSS Function components to low safety significance (LSS).

With regard to the criteria that consider whether the active function is called out or relied upon in the plant Emergency/Abnormal Operating Procedures, Duke Energy will not take credit for alternate means unless the alternate means are proceduralized and included in Licensed Operator Training.

The risk analysis being implemented for each hazard is described:

Internal Event Risks: Internal events PRA model version Model of Record (MOR) 16, June 2017. The NRC has previously reviewed the technical adequacy of previous versions of the BSEP PRA model identified in this application for the following applications:

License Amendment for Technical Specification Change Regarding Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee-Controlled Program, May 24, 2017, ADAMS Accession No. ML17096A129 (Reference 12)

License Amendment to Adopt NFPA 805 Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants (Reference 13)

Internal Flood PRA model version MOR 13, May 2013. The NRC has previously reviewed the technical adequacy of previous versions of the BSEP PRA model identified in this application for the following applications:

License Amendment for Technical Specification Change Regarding Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee-Controlled Program, May 24, 2017, ADAMS Accession No. ML17096A129 (Reference 12)

License Amendment to Adopt NFPA 805 Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants (Reference 13)

Fire Risks: Fire PRA model version BNP-Fire-Rev 5, June 2015. The NRC has previously reviewed the technical adequacy of previous versions of the BSEP PRA model identified in this application for the following applications:

License Amendment for Technical Specification Change Regarding Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee-Controlled Program, May 24, 2017, ADAMS Accession No. ML17096A129 (Reference 12)

License Amendment to Adopt NFPA 805 Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants (Reference 13)

Seismic Risks: Seismic Safe-shutdown Equipment List (SSEL) from the IPEEE seismic analysis accepted by NRC SER dated January 21, 2000, ADAMS Accession No. 9811270046 (Reference 14).

BSEP 17-0098 Enclosure 10 Other External Risks (e.g., tornados, external floods, etc.):

External Flood PRA model version MOR 13, May 2013.

External High Winds PRA model version MOR 13, May 2013.

Using the IPEEE screening process as approved by NRC SER dated January 21, 2000, ADAMS Accession No. 9811270046 (Reference 14) the other external hazards were determined to be insignificant contributors to plant risk.

The NRC has previously reviewed the technical adequacy of previous versions of the BSEP External Flood and High Winds PRA models identified in this application for the following applications:

License Amendment for Technical Specification Change Regarding Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee-Controlled Program, May 24, 2017, ADAMS Accession No. ML17096A129 (Reference 12)

Low Power and Shutdown Risks: Qualitative defense-in-depth (DID) shutdown model for shutdown configuration risk management (CRM) based on the framework for DID provided in NUMARC 91-06, "Guidance for Industry Actions to Assess Shutdown Management" (Reference 3), which provides guidance for assessing and enhancing safety during shutdown operations.

A change to the categorization process that is outside the bounds specified above (e.g.,

change from a seismic margins approach to a seismic probabilistic risk assessment approach) will not be used without prior NRC approval. The SSC categorization process documentation will include the following elements:

1. Program procedures used in the categorization

2. System functions, identified and categorized with the associated bases

3. Mapping of components to support function(s)

4. PRA model results, including sensitivity studies

5. Hazards analyses, as applicable

6. Passive categorization results and bases

7. Categorization results including all associated bases and RISC classifications

8. Component critical attributes for HSS SSCs

9. Results of periodic reviews and SSC performance evaluations

10. IDP meeting minutes and qualification/training records for the IDP members 3.1.2 Passive Categorization Process For the purposes of 10 CFR 50.69 categorization, passive components are those components that have a pressure retaining function. Passive components and the passive function of active components will be evaluated using the Arkansas Nuclear One (ANO) Risk-Informed Repair/Replacement Activities (RI-RRA) methodology consistent with the SER issued by the NRC Office of Nuclear Reactor Regulation (Reference 4).

The RI-RRA methodology is a risk-informed safety classification and treatment program for repair/replacement activities (RI-RRA methodology) for pressure retaining items and their associated supports. In this method, the component failure is assumed with a probability of 1.0

BSEP 17-0098 Enclosure 11 and only the consequence evaluation is performed. It additionally applies deterministic considerations (e.g., defense in depth, safety margins) in determining safety significance.

Component supports are assigned the same safety significance as the highest passively ranked component within the bounds of the associated analytical pipe stress model. Consistent with NEI 00-04, an HSS determination by the passive categorization process cannot be changed by the IDP.

The use of this method was previously approved to be used for a 10 CFR 50.69 application by NRC in the final Safety Evaluation for Vogtle dated December 17, 2014 (Reference 15). The RI-RRA method as approved for use at Vogtle for 10 CFR 50.69 does not have any plant specific aspects and is generic. It relies on the conditional core damage and large early release probabilities associated with postulated ruptures. Safety significance is generally measured by the frequency and the consequence of the event. However, this RI-RRA process categorizes components solely based on consequence, which measures the safety significance of the passive component given that it ruptures. This approach is conservative compared to including the rupture frequency in the categorization as this approach will not allow the categorization of SSCs to be affected by any changes in frequency due to changes in treatment. Therefore, the RI-RRA methodology for passive categorization is acceptable and appropriate for use at BSEP for 10 CFR 50.69.

The methodology does not require modification in order to appropriately categorize Class 1 SSCs. The ASME classification of the SSC does not impact the methodology as it only evaluates the consequence of a rupture of the SSCs pressure boundary. As stated in the Vogtle SER (Reference 15), categorizing solely based on consequence which measures the safety significance of the pipe given that it ruptures is conservative compared to including the rupture frequency in the categorization and the categorization will not be affected by changes in frequency arising from changes to the treatment. Therefore, this methodology is appropriate to apply to ASME Class 1 SSCs, as the consequence evaluation and deterministic considerations are independent of the ASME classification when determining the SSCs safety significance and will maintain this acceptable level of conservatism. The passive categorization process is intended to apply the same risk-informed process accepted in the ANO2-R&R-004 for the passive categorization of Class 2 and 3 components, to Class 1 pressure retaining SSCs in the scope of the system being categorized.

The ANO RI-RRA passive methodology implements the same risk-informed inservice inspection (RI-ISI) consequence evaluation process contained in EPRI TR-112657, "Revised Risk-Informed Inservice Inspection Procedure" supplemented with additional qualitative considerations. The NRC SER of this EPRI topical report was issued by letter on October 28, 1999. Section 3.2.1 of the SER describes the scope of the RI-ISI methodology as:

The full-scope option includes ASME Code Class 1, 2, and 3 piping, piping whose failure could prevent safety-related structures, systems, or components (SSCs) from fulfilling their safety functions, and non-safety-related piping that is relied upon to mitigate accidents for whose failure could cause a reactor scram or actuation of a safety-related system.

While many pressure boundary components (passive components) are not "modeled" in a PRA, the consequence evaluation process of TR-112657, Rev B-A provides an explicit and robust process for determining the importance of pressure boundary components for both moderate and high energy systems. Consistent with the ASME/ANS PRA Standard, this supplementary analysis is used to augment the base PRA information. Further, as discussed above, the methodology uses the consequence portion of EPRI RI-ISI process enhanced with "additional

BSEP 17-0098 Enclosure 12 considerations" which provide an additional layer of confidence for categorizing Class 1 SSCs as well as Class 2, 3 and non-class SSCs.

The same process as it pertains to inservice inspection has been approved for use on the full scope and code class designations of pressure retaining piping and welds in nuclear power plants. It has been determined to be sufficiently robust to assess the consequence risk of Class 1 piping and welds in the context of ISI even without the additional qualitative steps. The ANO RI-RRA has also determined to be sufficiently robust to assess the consequence of all Class 2 and Class 3 SSCs (with the additional qualitative steps) in the context of repair/replacement.

Therefore, the ANO RI-RRA methodology should be sufficiently robust to assess the consequence of the full spectrum of pressure retaining components as well as active components with a pressure retaining function regardless of ASME classification.

3.2 TECHNICAL ADEQUACY EVALUATION (10 CFR 50.69(b)(2)(ii))

The following sections demonstrate that the quality and level of detail of the processes used in categorization of SSCs are adequate. All the PRA models described below have been peer reviewed and there are no PRA upgrades that have not been peer reviewed. The PRA models credited in this request are the same PRA models credited in the License Amendment for Technical Specification Change Regarding Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee-Controlled Program," dated May 24, 2017, ADAMS Accession No. ML17096A129 (Reference 12) and "License Amendment to Adopt NFPA 805 Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants," dated January 28, 2015, ADAMS Accession No. ML14310A808 (Reference 13) with routine maintenance updates applied.

3.2.1 Internal Events and Internal Flooding The BSEP categorization process for the internal events and flooding hazard will use the plant-specific PRA model. The Duke Energy risk management process ensures that the PRA model used in this application reflects the as-built and as-operated plant for each of the BSEP units. at the end of this enclosure identifies the applicable internal events and internal flooding PRA models.

3.2.2 Fire Hazards The BSEP categorization process for fire hazards will use a peer reviewed plant-specific fire PRA model. The internal Fire PRA model was developed consistent with NUREG/CR-6850 and only utilizes methods previously accepted by the NRC. The Duke Energy risk management process ensures that the PRA model used in this application reflects the as-built and as-operated plant for each of the BSEP units. Attachment 2 at the end of this enclosure identifies the applicable Fire PRA model.

3.2.3 Seismic Hazards The BSEP categorization process will use the seismic margins analysis (SMA) performed for the IPEEE in response to GL 88-20, Supplement 4 (Reference 5) for evaluation of safety significance related to seismic hazards. No plant specific approaches were utilized in development of the SMA. The NEI 00-04 approved use of the SMA SSEL as a screening

BSEP 17-0098 Enclosure 13 process identifies all system functions and associated SSCs that are involved in the seismic margin success path as HSS. Since the analysis is being used as a screening tool, importance measures are not used to determine safety significance. The NEI 00-04 approach using the SSEL would identify credited equipment as HSS regardless of their capacity, frequency of challenge or level of functional diversity.

An evaluation was performed of the as-built, as-operated plant against the SSEL. The evaluation was a comparison of the as-built, as-operated plant to the plant configuration originally assessed by the SMA. Differences were reviewed to identify any potential impacts to the equipment credited on the SSEL. Appropriate changes to the credited equipment were identified and documented. This documentation is available for audit. The Duke Energy risk management program ensures that future changes to the plant will be evaluated to determine their impact on the SMA and risk categorization process.

3.2.4 Other External Hazards The BSEP categorization process for the following hazards will use peer-reviewed PRA models (as applicable) in accordance with the ASME PRA Standard RA-Sa-2009 (Reference 9):

High Winds External Flood The Duke Energy risk management process ensures that the PRA model used in this application reflects the as-built and as-operated plant for each of the BSEP units. Attachment 2 at the end of this enclosure identifies the applicable other external hazard PRA models.

All other external hazards were screened from applicability to BSEP units per a plant-specific evaluation in accordance with GL 88-20 (Reference 5) and updated to use the criteria in ASME PRA Standard RA-Sa-2009. Attachment 4 provides a summary of the other external hazards screening results. Attachment 5 provides a summary of the progressive screening approach for external hazards.

As part of the categorization assessment of other external hazard risk, an evaluation is performed to determine if there are components being categorized participate in screened scenarios and whose failure would result in an unscreened scenario. Consistent with the flow chart in Figure 5-6 in Section 5.4 of NEI 00-04, these components would be considered HSS.

All remaining hazards were screened from applicability and considered insignificant for every SSC and, therefore, will not be considered during the categorization process.

3.2.5 Low Power & Shutdown Consistent with NEI 00-04, the BSEP categorization process will use the shutdown safety management plan described in NUMARC 91-06 for evaluation of safety significance related to low power and shutdown conditions. The overall process for addressing shutdown risk is illustrated in Figure 5-7 of NEI 00-04.

NUMARC 91-06 specifies that a defense-in-depth approach should be used with respect to each defined shutdown key safety function. The key safety functions defined in NUMARC 91-06 are evaluated for categorization of SSCs.

BSEP 17-0098 Enclosure 14 SSCs that meet the two criteria (i.e., considered part of a "primary shutdown safety system" or a failure would initiate an event during shutdown conditions) described in Section 5.5 NEI 00-04 will be considered preliminary HSS.

3.2.6 PRA Maintenance and Updates The Duke Energy risk management process ensures that the applicable PRA models used in this application continue to reflect the as-built and as-operated plant for each of the BSEP units.

The process delineates the responsibilities and guidelines for updating the PRA models, and includes criteria for both regularly scheduled and interim PRA model updates. The process includes provisions for monitoring potential areas affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, industry operational experience) for assessing the risk impact of unincorporated changes, and for controlling the model and associated computer files. The process will assess the impact of these changes on the plant PRA model in a timely manner but no longer than once every two refueling outages. If there is a significant impact on the PRA model, the SSC categorization will be re-evaluated.

In addition, Duke Energy will implement a process that addresses the requirements in NEI 00-04, Section 11, "Program Documentation and Change Control." The process will review the results of periodic and interim updates of the plant PRA that may affect the results of the categorization process. If the results are affected, adjustments will be made as necessary to the categorization or treatment processes to maintain the validity of the processes. In addition, any PRA model upgrades will be peer reviewed prior to implementing those changes in the PRA model used for categorization.

3.2.7 PRA Uncertainty Evaluations Uncertainty evaluations associated with any applicable baseline PRA model(s) used in this application were evaluated during the assessment of PRA technical adequacy and confirmed through the self-assessment and peer review processes as discussed in Section 3.3 of this enclosure.

Uncertainty evaluations associated with the risk categorization process are addressed using the processes discussed in Section 8 and in the prescribed sensitivity studies discussed in Section 5 of NEI 00-04.

In the overall risk sensitivity studies Duke Energy will utilize a factor of 3 to increase the unavailability or unreliability of LSS components consistent with that approved for Vogtle (Reference 15). Consistent with the NEI 00-04 guidance, Duke Energy will perform both an initial sensitivity study and a cumulative sensitivity study. The initial sensitivity study applies to the system that is being categorized. In the cumulative sensitivity study, the failure probabilities (i.e.,unreliability and unavailability, as appropriate) of all LSS components modeled in PRAs for all systems that have been categorized are increased by a factor of 3. This sensitivity study together with the periodic review process assures that the potential cumulative risk increase from the categorization is maintained acceptably low. The performance monitoring process monitors the component performance to ensure that potential increases in failure rates of categorized components are detected and addressed before reaching the rate assumed in the sensitivity study.

The detailed process of identifying, characterizing and qualitative screening of model uncertainties is found in Section 5.3 of NUREG-1855 (Reference 7) and Section 3.1.1 of EPRI

BSEP 17-0098 Enclosure 15 TR-1016737 (Reference 8). The process in these references was mostly developed to evaluate the uncertainties associated with the internal events PRA model; however, the approach can be applied to other types of hazard groups.

The list of assumptions and sources of uncertainty were reviewed to identify those which would be significant for the evaluation of this application. If the BSEP PRA model used a non-conservative treatment, or methods that are not commonly accepted, the underlying assumption or source of uncertainty was reviewed to determine its impact on this application. Only those assumptions or sources of uncertainty that could significantly impact the risk calculations were considered key for this application.

Key BSEP PRA model specific assumptions and sources of uncertainty for this application are identified and dispositioned in Attachment 6. The conclusion of this review is that no additional sensitivity analyses are required to address BSEP PRA model specific assumptions or sources of uncertainty except for the following.

When categorizing EDG building HVAC components, perform a detailed review of heat-up analysis, and sensitivities as needed, related to EDG Building HVAC impact on affected switchgear When categorizing RBCCW, perform sensitivities to address the potential that RBCCW is not required for CRD cooling For general categorization activities, address uncertainty for recovery of failed injection equipment after containment failure For general categorization activities, address external events initiating event frequency for initiators at the extreme range 3.3 PRA REVIEW PROCESS RESULTS (10 CFR 50.69(b)(2)(iii))

The PRA models described in Section 3.2 have been assessed against RG 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2 (Reference 6) consistent with NRC RIS 2007-06.

The BSEP internal events PRA model was subject to a self-assessment and a full-scope peer review conducted in June 2010 against RG 1.200 Revision 2.

The BSEP internal flood PRA model was subject to a self-assessment and a full-scope peer review conducted in June 2010 and a focused scope peer review covering 28 SRs conducted in December 2016 both against RG 1.200 Revision 2.

The BSEP Fire PRA model was subject to a self-assessment and a full-scope peer review conducted in February 2012 and a focused scope peer review May 2015 both against RG 1.200 Revision 2.

The BSEP High Winds PRA model was subject to a self-assessment and a full-scope peer review conducted in February 2012 and a focused scope peer review in July 2017 both against RG 1.200 Revision 2.

BSEP 17-0098 Enclosure 16 The BSEP External Flood PRA model was subject to a self-assessment and a full-scope peer review conducted in February 2012 against RG 1.200 Revision 2.

Closed findings were reviewed and closed in August 2017 for BSEP Internal Events, Internal Flood, High Winds, and Fire models using the process documented in Appendix X to NEI 05-04, NEI 07-12 and NEI 12-13, "Close-out of Facts and Observations" (F&Os) (Reference 10) as accepted by NRC in the letter dated May 3, 2017 (ADAMS Accession No. ML17079A427)

(Reference 11). The results of this review have been documented and are available for NRC audit.

provides a summary of the remaining findings and open items, including open findings and disposition of the BSEP peer reviews. There are no open findings for BSEP High Winds model.

The above information demonstrates that the PRA is of sufficient quality and level of detail to support the categorization process, and has been subjected to a peer review process assessed against a standard or set of acceptance criteria that is endorsed by the NRC as required 10 CFR 50.69(c)(1)(i).

3.4 RISK EVALUATIONS (10 CFR 50.69(b)(2)(iv))

The BSEP 10 CFR 50.69 categorization process will implement the guidance in NEI 00-04. The overall risk evaluation process described in the NEI guidance addresses both known degradation mechanisms and common cause interactions, and meets the requirements of 10 CFR 50.69(b)(2)(iv). Sensitivity studies described in NEI 00-04 Section 8 will be used to confirm that the categorization process results in acceptably small increases to core damage frequency (CDF) and large early release frequency (LERF). The failure rates for equipment and initiating event frequencies used in the PRA include the quantifiable impacts from known degradation mechanisms, as well as other mechanisms (e.g., design errors, manufacturing deficiencies, human errors, etc.). Subsequent performance monitoring and PRA updates required by the rule will continue to capture this data, and provide timely insights into the need to account for any important new degradation mechanisms.

4 REGULATORY EVALUATION 4.1 APPLICABLE REGULATORY REQUIREMENTS/CRITERIA The following NRC requirements and guidance documents are applicable to the proposed change.

The regulations of 10 CFR 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors."

NRC Regulatory Guide 1.201, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance," Revision 1, May 2006.

Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 2, April 2015.

BSEP 17-0098 Enclosure 17 Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2, March 2009.

The proposed change is consistent with the applicable regulations and regulatory guidance.

4.2 NO SIGNIFICANT HAZARDS CONSIDERATION ANALYSIS Duke Energy proposes to modify the licensing basis to allow for the voluntary implementation of the provisions of Title 10 of the Code of Federal Regulations (10 CFR), Part 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors." The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with this regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety.

Duke Energy has evaluated whether or not a significant hazards consideration is involved with the proposed amendment(s) by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed change will permit the use of a risk-informed categorization process to modify the scope of SSCs subject to NRC special treatment requirements and to implement alternative treatments per the regulations. The process used to evaluate SSCs for changes to NRC special treatment requirements and the use of alternative requirements ensures the ability of the SSCs to perform their design function. The potential change to special treatment requirements does not change the design and operation of the SSCs. As a result, the proposed change does not significantly affect any initiators to accidents previously evaluated or the ability to mitigate any accidents previously evaluated. The consequences of the accidents previously evaluated are not affected because the mitigation functions performed by the SSCs assumed in the safety analysis are not being modified. The SSCs required to safely shut down the reactor and maintain it in a safe shutdown condition following an accident will continue to perform their design functions.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

BSEP 17-0098 Enclosure 18 The proposed change will permit the use of a risk-informed categorization process to modify the scope of SSCs subject to NRC special treatment requirements and to implement alternative treatments per the regulations. The proposed change does not change the functional requirements, configuration, or method of operation of any SSC.

Under the proposed change, no additional plant equipment will be installed.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

The proposed change will permit the use of a risk-informed categorization process to modify the scope of SSCs subject to NRC special treatment requirements and to implement alternative treatments per the regulations. The proposed change does not affect any Safety Limits or operating parameters used to establish the safety margin.

The safety margins included in analyses of accidents are not affected by the proposed change. The regulation requires that there be no significant effect on plant risk due to any change to the special treatment requirements for SSCs and that the SSCs continue to be capable of performing their design basis functions, as well as to perform any beyond design basis functions consistent with the categorization process and results.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, Duke Energy concludes that the proposed change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of "no significant hazards consideration" is justified.

4.3 CONCLUSION

S In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5 ENVIRONMENTAL CONSIDERATION A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or a significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

BSEP 17-0098 Enclosure 19 6

REFERENCES

1.

NEI 00-04, "10 CFR 50.69 SSC Categorization Guideline," Revision 0, Nuclear Energy Institute, July 2005.

2.

NRC Regulatory Guide 1.201, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance," Revision 1, May 2006.

3.

NUMARC 91-06, "Guidelines for Industry Actions to Assess Shutdown Management,"

December, 1991.

4.

ANO SER Arkansas Nuclear One, Unit 2 - Approval of Request for Alternative AN02-R&R-004, Revision 1, Request to Use Risk-Informed Safety Classification and Treatment for Repair/Replacement Activities in Class 2 and 3 Moderate and High Energy Systems, April 22, 2009 (ADAMS Accession No. ML090930246).

5.

Generic Letter 88-20, "Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10 CFR 50.54(f), Supplement 4," USNRC, June 1991.

6.

Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2, US Nuclear Regulatory Commission, March 2009.

7.

NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, March 2009

8.

EPRI TR-1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, December 2008

9.

ASME/ANS RA-Sa-2009, Standard for Level l/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, dated February 2009

10.

NEI Letter to USNRC, "Final Revision of Appendix X to NEI 05-04/07-12/12-16, Close-Out of Facts and Observations (F&Os)," February 21, 2017, (ADAMS Accession No. ML17086A431).

11.

USNRC Letter to NEI, "U.S. Nuclear Regulatory Commission Acceptance on Nuclear Energy Institute Appendix X to Guidance 05-04, 7-12, and 12-13, Close Out of Facts and Observations (F&Os)," May 3, 2017, (ADAMS Accession Number ML17079A427).

12. USNRC Letter to BSEP, "Issuance of Amendments Regarding request to Relocate Specific Surveillance Frequencies to Licensee Controlled Program," May 24, 2017, (ADAMS Accession No. ML17096A129)

BSEP 17-0098 Enclosure 20

13. USNRC Letter to BSEP, "Issuance of Amendments to Adopt NFPA 805 Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants"

14. USNRC letter, "NRC Staffs Evaluation of the Brunswick Steam Electric Plant, Units 1 and 2, Individual Plant Examination of External Events (IPEEE) Submittal," November 20, 1998 (ADAMS Accession No. 9811270046 & 9811270044).

15. USNRC Letter to Southern Company, Inc., "Vogtle Electric Generating Plant, Units 1 and 2

-Issuance of Amendments Re: Use of 10 CFR 50.69," December 17, 2014, (ADAMS Accession No. ML14237A034).

BSEP 17-0098 Enclosure 21 Duke Energy will establish procedure(s) prior to the use of the categorization process on a plant system. The procedure(s) will contain the elements/steps listed below.

Integrated Decision Making Panel (IDP) member qualification requirements Qualitative assessment of system functions. System functions are qualitatively categorized as preliminary HSS or LSS based on the seven questions in Section 9 of NEI 00-04 (see Section 3.2 of the enclosure). Any component supporting an HSS function is categorized as preliminary HSS. Components supporting an LSS function are categorized as preliminary LSS.

Component safety significance assessment. Safety significance of active components is assessed through a combination of PRA and non-PRA methods, covering all hazards. Safety significance of passive components is assessed using a methodology for passive components.

Assessment of defense in depth (DID) and safety margin. Components that are categorized as preliminary LSS are evaluated for their role in providing defense-in-depth and safety margin and, if appropriate, upgraded to HSS.

Review by the Integrated Decision-making Panel. The categorization results are presented to the lDP for review and approval. The lDP reviews the categorization results and makes the final determination on the safety significance of system functions and components.

Risk sensitivity study. For PRA-modeled components, an overall risk sensitivity study is used to confirm that the population of preliminary LSS components results in acceptably small increases to core damage frequency (CDF) and large early release frequency (LERF) and meets the acceptance guidelines of RG 1.174.

Periodic reviews are performed to ensure continued categorization validity and acceptable performance for those SSCs that have been categorized.

Documentation requirements per Section 3.1.1

List of Categorization Prerequisites

BSEP 17-0098 Enclosure 22 Units Model Baseline CDF Baseline LERF Comments 1 & 2 Full Power Internal Events MOR 16 for both units 2.98E-06 (Unit 1) 3.00E-06 (Unit 2) 1.06E-07 (Unit 1) 1.09E-07 (Unit 2)

This model represents the current FPIE PRA Model of Record (MOR).

1 & 2 Internal Flood MOR 13 for both units 1.27E-06 (Unit 1) 1.66E-06 (Unit 2) 4.41E-08 (Unit 1) 6.52E-08 (Unit 2)

This model represents the current IF PRA MOR.

1 & 2 External Flood PRA MOR 13 for both units 3.44E-07 (Unit 1) 3.47E-07 (Unit 2) 8.40E-10 (Unit 1) 8.40E-10 (Unit 2)

This model represents the current EF PRA MOR.

1 & 2 High Winds PRA MOR 13 for both units 1.60E-05 (Unit 1) 1.56E-05 (Unit 2) 2.44E-07 (Unit 1) 2.08E-7 (Unit 2)

This model represents the current HW PRA MOR.

1 & 2 Fire PRA BNP-Fire-Rev5 for both units 2.09E-05 (Unit 1) 2.45E-05 (Unit 2) 4.58E-06 (Unit 1) 4.53E-06 (Unit 2)

This model represents the current Fire PRA MOR.

Description of PRA Models Used in Categorization

BSEP-17-0098 Enclosure 23 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 XFPR-A11-1 External Flood XFPR-A11 I

There is no evaluation of the potential impact of the external floods on system recoveries credited in the Level 1 PRA.

As noted in Section 4.9 of BNP-PSA-094, recovery of LOOP is not credited, nor is ability to start SAMA DGs. It is not clear however how other system recoveries may be affected (starting DG exhaust fan, etc.), nor how multiple unit affects due to external flooding may impact recovery actions between units. If system recoveries (e.g.,

service water recoveries) are credited in the model, then their potential to be impacted by the external flooding conditions needs to be evaluated.

Recovery of offsite power following an external flood induced LOOP is not credited in the external flood model. The plant procedure for severe weather includes pre-staging personnel in vital areas such as the Diesel Generator Building, Service Water Building, and the Reactor Building ensuring that personnel would be available to perform actions in those areas.

The Human Reliability Events were re-evaluated for feasibility and impact from the external flooding event on their probability of successful completion. The changes made are enough to support the risk metrics required for the 50.69 application. : Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items

BSEP-17-0098, Continued Enclosure 24 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 XFPR-A3-1 External Flood XFPR-A3 XFPR-A5 XFPR-A8 XFPR-A10 Not Met ENSURE the PRA models reflect external flood-caused failures. To provide this assurance documentation is needed for the systematic review for potential impacts of external flooding.

The updated calculation provides criteria for precluding operator actions as not feasible and the non-adjustment of HRA performance shaping factors.

Tables were added to provide the model changes that account for system model failures due to external flooding. The information in the Tables was expanded to address Finding XFPR-A3-01. With these changes, the importance measures needed for the 50.69 categorization program are properly assessed.

BSEP-17-0098, Continued Enclosure 25 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 XFPR-A7-1 External Flood XFPR-A7 Not Met PERFORM an analysis of external hazard-caused dependencies and correlations in a way so that any screening of SSCs appropriately accounts for those dependencies.

The external flooding analysis, by itself, does not model the dependencies and correlations of equipment failure other than the effects from inundation. High winds associated with a strong hurricane would be required to produce the storm surge required to produce the water levels examined. The analysis currently has equipment failure correlated due to submergence of equipment and non-recovery of offsite power. The walkdowns focused on equipment that would be exposed to external flooding outside of existing structures. The only other functions that could be impacted are clogging of the raw water sources prior to equipment failure due to inundation. In the case of hurricanes, inspection is done on the trash racks at the intake and diversion structures for accumulation of trash/debris on the racks. Therefore, the impact of the secondary effects like intake screen clogging due to the external flooding event are not enough to impact the risk metrics used for the 50.69 application.

BSEP-17-0098, Continued Enclosure 26 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 XFPR-C2-1 External Flood XFPR-C2 Not Met The requirement is to document the specific adaptations to the internal events PRA to produce the external flood PRA, and to document the final results as well as selected intermediate results. This has not been performed.

The changes to the internal events model to create the external flooding hazard were added to the external flooding calculation. The discussion and review of results was performed. No issues were noted that would impact the risk metrics used for the 50.69 application.

BSEP-17-0098, Continued Enclosure 27 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 QU-C2-1 Internal Events QU-C2 I/II/III Dependency analysis was performed on the identified HFE combinations (see BNP-PSA-034 and associated spreadsheets). The dependency assessment approach used appears to be appropriate. In developing recovery rules to be applied to the cutsets, maximum combinations of 3 HFEs were included. Any cutsets with greater than three HFEs that meet the recovery rule criteria are recovered to a minimum joint HFE of 1E-6 (and often higher). As a result, there are cutsets that contain more than three HFEs that are being recovered to a higher frequency than may be warranted (either because one or more of the additional HFEs may be independent of the others, or because the joint HFE probability is still above the floor value of 1E-6 (and often higher). As a result, there are cutsets that contain more than three HFEs that are being recovered to a higher frequency than may be warranted (either because one or more of the additional HFEs may be independent of the others, or because the joint HFE probability is still above the floor value of 1E-6 and hence could be reduced further).

BNP-PSA-034 (Revision 17),

Brunswick Nuclear Plant PRA -

Human Reliability Analysis, Section 7.1.5, discusses that dependence between any two or more human failure events that appear in the same cut set were manually examined. Table 9 lists the individual HEPs. Table 10 lists the Summary of Combinations of Post-Initiator, Procedure-Driven (Type CP) HFEs. The highest order dependency event in Table 10 includes several cutsets with 4 HEPs. However, in examining the top 95% cutsets, there were some cutsets with 5 and 6 HEP events that were not explicitly analyzed for dependencies. But with the use of a minimum combination HEP value, there would be little to no change to the current recovery values when adding those additional HEPs to the dependency analysis. The larger bulk of dependencies addressed have produced an HRA with realistic results and

BSEP-17-0098, Continued Enclosure 28 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 QU-C2-1, Continued This conservatism appears to increase the calculated CDF/LERF by at least a modest amount.

would not be notably affected by applying additional dependency recoveries that exist in low significant cutsets, and therefore have no effect on the 10 CFR 50.69 application.

BSEP-17-0098, Continued Enclosure 29 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 3-3 Internal Events HR-E3 I

Operator interview insights are documented in the HRA Calculator.

The information contained in the HRA Calculator was sufficient to demonstrate that Capability Category I was met. However, the information in the HRA did not demonstrate that detailed talk throughs with Operations and Training Personnel were conducted for the purpose of confirming procedure interpretations.

For example, many of the calculations referred only to an interview conducted with a single operator on 9/16-17/2008.

A few calculations referred a "talk through" in January 2008, an operator interview on 3/11/2010, or simulator runs conducted on 1/19/2010. A few calculations (OPER-BLACKSTART, OPER-CNS, OPER-CWSIE) did not have any input on operator interviews.

The purpose and content of these interviews is not evident.

As a resolution to this finding the following was performed:

• Detailed operator interviews were conducted for the purpose of confirming procedure interpretations. PRA documents have been updated to improve their clarity in this area.

• The HFEs mentioned are no longer used in the PRA.

• A generic operator discussion sheet was added to the BNP HRA calculation.

• Operator interviews were stated where applicable in the HRA calculator. If there were any special comments from the operator, they were included in the operator response tab for each operator action.

Since this finding already meets CAT I this finding simply represents an opportunity for enhancement to the documentation and does not affect CDF or the risk metrics for 50.69 categorization.

BSEP-17-0098, Continued Enclosure 30 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 3-4 Internal Events HR-E4 I

While it was documented that simulator observations and talk-throughs were performed in most HRA calculations, there is no evidence that these observations or talk-throughs were used to confirm the response models for the scenarios modeled in the PRA.

For example, there was no interview checklist, simulator/scenario checklist, or other documentation to demonstrate that the HRA analyst confirmed the response models.

As a resolution to this finding the HRA documentation has been updated to reference applicable simulator runs, operator interviews, and checklists.

This finding meets CAT I and is a document enhancement issue only. This finding does not affect CDF or the risk metrics for 50.69 categorization.

BSEP-17-0098, Continued Enclosure 31 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 3-12 Internal Events LE-C3 I

As discussed in BNP-PSA-049, Appendix D, Section D.1, the CET structure allows for the identification of recovery and repair actions that can terminate or mitigate the progression of a severe accident. This process was incorporated into the original analysis, rather than performing a review of significant accident progression sequences and then incorporating repair, as would be inferred from the standard. However, it does not appear that significant accident progression sequences were reviewed.

The BNP LERF model includes two operator recovery actions for cases of instrumentation or control problems as a part of the original analysis. These recovery actions take into account plant conditions for feasibility, as well as use bounding repair rates for instrumentation repairs in the exponential failure model. This treatment is consistent with the repair justification requirements of CCII for SR LE-C3. Because these actions were incorporated in the original analysis, this SR is met at CCI. If a full review of significant accident progression sequences for equipment repair was performed, credit would be minimal and would not have a significant impact on calculation of importance measures. Therefore, there is no impact on the 50.69 application.

BSEP-17-0098, Continued Enclosure 32 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 3-11 Internal Events LE-C10 LE-C12 I

There is no evidence that significant accident sequences were reviewed to determine if engineering analyses could support continued equipment operation or operator actions to reduce LERF. It was noted that this conservative approach with respect to equipment survivability was documented in the uncertainty analysis (BNP-PSA-075, Table 1, Item 236).

No credit for equipment survivability or human actions in adverse environments is taken in the BNP LERF model that would satisfy SR LE-C10 or LE-C12. Not crediting continued equipment operation beyond equipment qualification limits or equipment that could be impacted by containment failure is adequate for identifying risk significant SSCs.

Credit for equipment survivability beyond qualification limits or operator actions in adverse environments is not expected to change the LERF risk profile significantly. Therefore, there is no impact on the 50.69 application.

BSEP-17-0098, Continued Enclosure 33 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 3-13 Internal Events LE-C13 I

BNP-PSA-049, Section 3.1.2 notes that the treatment of scrubbing by the reactor building is treated in a conservative method. This conservative approach was identified in the uncertainty analysis (BNP-PSA-075, Table 1, Item 217).

The BSEP LERF model does not provide any credit for scrubbing in the reactor building, and therefore is treated in a conservative manner consistent with CCI. This lack of scrubbing credit does not affect the CDF results or the relative component importance to CDF.

Including a scrubbing credit to applicable LERF scenarios would result in some level of reduction in the overall LERF results, but would not have a significant impact on the relative component importance measures. Therefore, there is no impact on the 50.69 application.

1-11 Internal Events SC-B3 I/II/III For small break LOCA, the high end of water break is approximately 1-inch diameter, RCIC is credited for HPI for success, but no MAAP run was performed to demonstrate the success.

No changes have been made to the model in response to this F&O.

A specific MAAP analysis was performed to confirm that RCIC is a success path for a 1-inch diameter break. This is a documentation issue and does not impact the 50.69 application.

BSEP-17-0098, Continued Enclosure 34 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 IFSN-A8 Internal Flood IFSN-A8 I

From IFSO-A4, the effects of gaskets and expansion joint failures were not propagated beyond failing the attached equipment.

Section F.4.8 discusses the propagation between rooms, and basis for drain paths. No propagation from gaskets or expansion joints was modeled.

The CDF and LERF contributions from gasket and expansion joint failures, including effects from propagation, have been included in the internal flooding models. BSEP IFPRA calculations contain the listing of expansion joints and gaskets along with their failure rates. The component failures have been mapped to the associated initiating events in the model. New scenarios and their propagation impacts based on similar pipes in the flood zone have been developed and assessed for the expansion joint and gasket flooding scenarios. The circulating expansion joints are not risk significant to the BSEP IFPRA risk as circulating water piping does not contribute a significant amount to CDF/LERF and circulating water expansion joint ruptures represent a small portion of the total rupture frequency for IFPRA. Therefore this will not impact the risk metrics (importance measures) used for the 50.69 application.

BSEP-17-0098, Continued Enclosure 35 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 IFSO-B2 Internal Flood IFSO-B2 II The IFSO-A section lacks documentation on several modeling requirements that are shown to be correct through investigation.

• In IFSO-A1, no drain backflow propagation identification provided in the documentation. Investigation shows that drains flow to an exterior rad waste building floor drain collection tank from all locations which would justify the assumption in [BNP-PSA-035 Section] F.1.3; however there is no discussion, drawings, or justification provided in the analysis for screening

• In IFSO-A1 there is little to no documentation of doors and door failures contributing to propagation and critical height determination.

• Capacity of the sources per IFSO-A5 is not documented, it was identified this information is in the flooding database but it is not discussed in the flooding calculation.

• The system diagrams and system description for the Liquid Radwaste System were collected, reviewed, and documented in the IFPRA calculation as described in the response to IFSN-B2. The floor drain flow to the Radwaste Building and the conclusion that drain backflow is not a flooding concern in the other buildings was verified.

• The documentation of door failure critical height determination has been included per the response to IFSN-A2.

• A list of all potential flood sources was updated and documented as described in the response to IFSNA15. The capacities of those systems retained for further assessment are included in the updated documentation and

BSEP-17-0098, Continued Enclosure 36 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 IFSO-B2, Continued were compared to the capacities from the database table used in the flooding propagation analysis.

Capacities used for all sources in the original propagation analysis bounded the capacities for all systems described in the response to IFSN-A15.

Therefore, there is no impact on 50.69 application.

BSEP-17-0098, Continued Enclosure 37 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 3-6 Internal Events HR-G3 I/II/III In general, the HRA calculator file was reviewed and found to provide an assessment of the performance shaping factors listed in the SR for the HEP calculations. Some detail in the calculations could be enhanced. For example, the operator action OPER-LDSHD calculation does not have the cognitive procedure listed and does not address the training requirements.

Calculations for OPERMSIVCBP and OPER-DEPRESS1 state that simulator and classroom training are provided but does not provide a frequency. The calculations for OPER-DCDG and OPER-N2SUPPLY do not address training, the cognitive procedure or the staffing requirements. Problems were noted with the HRA calculation for OPER-DCDG. Specifically, no execution failure probabilities were assigned to the tasks of starting and connecting the DG. Additionally, the calculation may not have considered all of the necessary breaker manipulations.

As a resolution to this finding HFEs were analyzed and plant specific and scenario-specific performance shaping factors such as training were added if applicable. Procedures and training frequencies for operator actions noted in the finding have been added to the documentation. The standard is met and this is an opportunity for enhancement to the documentation and does not affect CDF or the risk metrics for 50.69 categorization.

BSEP-17-0098, Continued Enclosure 38 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 1-19 Internal Events LE-E1 I/II/III Parameter values were selected with regards to the PRA Standard's requirements for HR and DA.

Consideration of severe accident conditions upon these parameters is provided in Appendix M, or in some instances Appendix C, of the BNP-PSA-049 notebook. Section G of LE notebook captures the human error modeling, and incorporated the general methodology approach used in Level 1 HRA.

However, the data values documented in BNP-PSA-049 were developed during a previous PRA update. It appears that some values may need to be updated to be consistent with changes in the Level 1 data. For example, OSP recovery values (such as ACP1XHE-MN-OFFE) are not consistent with the current OSP recovery curve (and LOSP is now categorized by type of OSP failure as opposed to a composite value). On the other hand, changes in component failure data appear to have been updated in the Level 2 trees. However, the documentation does not indicate that the values shown in BNP-PSA-049 have been superseded.

A check was performed on the level 2 model for both BSEP units to determine if any data needed to be updated due to their risk significance. Only 4 events were found and all of them had either a FV in the x10-3 range or a RAW of

1. Because of the small number of events that could have a need to be updated but were not, the relatively low value of FV for three of the retained events, and the relatively low RAW value on the remaining event, the effect on 50.69 applications is negligible.

BSEP-17-0098, Continued Enclosure 39 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 IFEV-A5 Internal Flood IFEV-A5 Not Met New Methodology was applied to use pipe length and flood and major flood frequency based on diameter and flow rate. The analysis should have evaluated flood frequency for small pipe and flows, and Flood frequency AND Major Flood frequency for large pipe and flows. However, the analysis only applied major flood frequencies to large pipe, omitting flood frequency from large pipe which is the dominant frequency.

Table F.15 provides the different frequencies from the EPRI Tech Report, but they are applied incorrectly in the analysis as shown in Table F.16.

The existing flood scenario frequencies have been adjusted to include both the Electric Power Research Institute (EPRI) Flood and Major Flood initiating event frequencies. Table F.15 of the internal flooding calculation provides a mapping of piping frequencies and their associated system designation. The updated EPRI values are from TR 3002000079. Since the flooding frequency data in the calculation and the EPRI data have different pipe size breakpoints, the pipe size intervals were adjusted to match.

The corresponding frequencies were then adjusted by the ratio of new EPRI flood and major flood frequency to existing major flood frequency. The appropriate multiplier was then applied to each scenario based on pipe size and fluid system type. This assumes all floods are Major Floods that bound both Flood and Major Flood frequency contributions. Therefore, this open F&O would not affect results in a manner that would impact the 10CFR 50.69 application.

BSEP-17-0098, Continued Enclosure 40 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 IFQU-A5 Internal Flood IFQU-A5 Not Met The operator action referred to in the resolution for mitigation of SW floods and the XOPER_F25 HFE satisfy approved HRA methodology. The assumed screening value for HFE XOPER_F60 (1E-3/XOPER_F25) is still credited in the analysis and satisfies the condition specified in the ASME PRA Standard for a significant event with regard to the FV importance measure.

A scenario-specific human error probability (HEP) that meets the requirements of the Standard was developed (i.e., see response to F&Os IFSN-A3 and IFQU-A6) and included in the updated model and quantification. The guidance in SR HR-F1 of Section 2-2.5 of the Standard for developing human failure events (HFEs) was followed, and the HRA Calculator, v5.1, which meets the requirements of the Standard, was used. An operator interview was conducted on February 6, 2017, to validate the procedures and assumptions used as the basis for the modeling.

All assumptions and bases for the performance shaping factors (PSFs) were documented in the HRA Calculator. Dependency analysis was considered for both CDF and LERF in regards to the new flooding operator action, and documentation of dependency levels has been included in the assessment. The accident sequences were assessed

BSEP-17-0098, Continued Enclosure 41 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 IFQU-A5, Continued in the cutset review, and descriptions of the top cutsets were included in the documentation.

Detailed modeling of XOPER_F60 yields a human error probably lower than the one previously used (combination human error probability of 1E-3 (XOPER_F25 and XOPER_F60)). Therefore the current analysis is conservative but does not impact risk insights for the 50.69 application.

IFQU-A6 Internal Flood IFQU-A6 Not Met See IFQU-A5 Finding See IFQU-A5 Finding

BSEP-17-0098, Continued Enclosure 42 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 IFQU-B2 Internal Flood IFQU-B2 I/II/III The documentation did not justify screening of the flood sources, and did not explain sufficiently the description of cutsets and sequences for dominant floods. There is an inconsistency in documentation between how conventional service water and nuclear service water are identified in the flood analysis, flood database, and PRA model sequences.

Documentation of the processes used to determine the applicable flooding sequences and the quantification of the model has been added in accordance with the requirements of the Standard. The accident sequences/cutsets were reviewed of consistency and correctness, and the sequence-specific HEP that was added was validated. The basis for this documentation F&O included several specific items that have also been addressed individually.

The process that describes how flood sources were screened was documented, and the list of potential flood sources retained for further analysis has been updated (i.e., see F&O responses IFSN-A15 and IFSN A16). The fault trees and initiating event frequencies have been updated based on changes documented in the other F&O responses, and the model has been requantified. The detailed descriptions of the cutsets and accident sequences

BSEP-17-0098, Continued Enclosure 43 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 IFQU-B2, Continued have been added. The Conventional Service Water and Nuclear Service Water modeling has been validated and clarified.

Differences were attributed to a variation in the initiating event frequencies used. These frequencies were reviewed and modifications made to ensure both units used the same methodology.

These corrections eliminated differences in the results between units. Therefore, this open F&O would not affect results in a manner that would impact the 10CFR 50.69 application.

BSEP-17-0098, Continued Enclosure 44 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 1-34 Fire FSS-G2 Met I/II/III A screening value for rated barrier probability of 1E-2 was applied. This may not be bounding depending on the features of the barrier (doors, penetrations, dampers).

The BSEP fire PRA quantification calculation has been revised and the screening of HGL Multi Compartment Analysis has been performed in accordance with NUREG/CR-6850. The screening value of 0.1 was used on the exposing compartment to screen out compartments from the MCA analysis. However, the 0.1 barrier failure probability was also inappropriately applied for certain fire compartment combinations where the partitioning element was open. This is expected to have no more than a minimal impact on the 50.69 application.

BSEP-17-0098, Continued Enclosure 45 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 1-36 Fire QU-B2 QU-B3 FQ-B1 QU-F2 FQ-F1 NOT MET NOT MET MET I/II/III MET I/II/III MET I/II/III Truncation in the CDF and LERF was varied, based upon the CCDP/CLERP.

For example, CCDP of 1.0 uses a truncation of 1.0, while a CCDP of 1E-03 uses a truncation of 1E-07. Overall, the process using the ones run results in difficultly running FRANC at a very low cutoff.

A review of the truncation levels was performed. Hundreds of the sequences have truncation within a factor of 100 or less of the CCDP. Several of these sequences were re-run, and the new CDFs were compared to the original CDFs. Changes in the results vary from about 5% to as much as 25%.

Many of the sequences affected are in the top 25 fire sequences.

Additionally, a large number of scenarios are listed with zero CCDP.

When these were re-run with lower truncation values, cutsets were generated. This can be important for scenarios with higher ignition frequencies.

The truncation approach has been changed in Rev 1 of the quantification calculation in response to this F&O. Scenarios are now run at an effective truncation of 1E-09/yr for CDF and 1E-10/yr for LERF which is more than four orders of magnitude below the resulting CDF and LERF plant totals. The previously identified software limitations, that prevent meeting the 5%

convergence criterion when the model is quantified with ONEs to diagnose fire effects, would not be applicable when the model is quantified with TRUEs for the 50.69 application. Therefore, there is no impact on the application.

BSEP-17-0098, Continued Enclosure 46 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 2-22 Fire CF-A1 CF-B1 Met I Met I/II/III BNP-PSA-080 Section 4.3.4, Fire Induced Spurious Event Probabilities, document the methods used for conditional failure probabilities for fire-induced circuit failures. Circuit Analysis was performed in change package BNP-0137 to determine the probability of a spurious operation for various cables. Risk significant contributors were not identified (quantification was complete later in the process) and utilized thus cannot met the capability category CC-II.

For example, the Unit 1 CDF importance results include the following spurious events for which conditional probabilities have not been developed:

HPC1PPS-SA-N12A_TPRESSURE SWITCH E41-N012A SPURIOUSLY ACTUATES HPC1PPS-SA-N12C_TPRESSURE SWITCH E41-N012C SPURIOUSLY ACTUATES RCI1TME-HI-021B_TTEMPERATURE ELEMENT E51-TE-N021B SPURIOUS OPERATION RCI1TME-HI-022B_TTEMPERATURE ELEMENT E51-TE-N022B SPURIOUS OPERATION Spurious cable failures were analyzed, and probabilities were included in the Fire PRA.

Conditional failure probabilities were assigned to the most risk significant contributors, causing them to become less risk significant and allowing these less risk significant contributors to appear relatively more risk significant. More could have been done, but the iterative process stopped when satisfactory results were obtained.

The current analysis is conservative in that for cases where specific conditional probabilities have not been developed, failure or spurious operation is given a probability of 1.0. Therefore, there is no impact on the application.

BSEP-17-0098, Continued Enclosure 47 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 2-22, contd RCI1PPS-SA-N012A_TPRESSURE SWITCH E51-N012A SPURIOUS OPERATION RCI1PPS-SA-N012C_TPRESSURE SWITCH E51-N012C SPURIOUS OPERATION HPC1PPS-SA-N12B_TPRESSURE SWITCH E41-N012B SPURIOUSLY ACTUATES HPC1PPS-SA-N12D_TPRESSURE SWITCH E41-N012D SPURIOUSLY ACTUATES SRV1SRV-CO-F013G_TNON-ADS SAFETY RELIEF VALVE B21-F013G SPURIOUSLY OPENS RHR1MDP-SA-C002C_TRHR PUMP E11-C002C SPURIOUS START DUE TO FIRE RCI1PPS-SA-N012B_TPRESSURE SWITCH E51-N012B SPURIOUS OPERATION RCI1PPS-SA-N012D_TPRESSURE SWITCH E51-N012D SPURIOUS OPERATION HPC1PPS-SA-N17A_TPRESSURE SWITCH E41-N017A SPURIOUS OPERATION HPC1PPS-SA-N17B_TPRESSURE SWITCH E41-N017B SPURIOUS OPERATION SWS1PPS-SAP129L_TPRESSURE SWITCH PS129 SPURIOUS OPERATION FAILS LOW ISOLATES

BSEP-17-0098, Continued Enclosure 48 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 2-22, contd SWS1PPS-SAP129L_TPRESSURE SWITCH PS129 SPURIOUS OPERATION FAILS LOW ISOLATES HEADER Note that if the instrument spurious operations above are not caused by a hot short, detailed circuit analysis is likely not needed. However, the valve and pump spurious operation would likely benefit from additional analysis.

4-1 Fire FSS-A1 NOT MET The BSEP FPRA calculates using:

1) A severity factor 0.1, where 90% of the fires are contained within the MCC

2) HRR severity factors are treated independently, similar to other cabinets.

In lieu of an accepted generic method at the time, BSEP used the analysis method piloted at HNP.

However, FAQ 14-0009 has since then been issued and uses a breaching factor of 0.23. The impact on the 50.69 application is expected to be small.

6-4 Fire FSS-G4 MET I Passive fire barriers with a fire resistance rating are credited in the multicompartment analysis. The failure rates used are those prescribed in NUREG 6850, however, the worst case value for failure probability of the barrier is used.

Walkdowns were performed to gather the targets and barriers between the exposing and This is expected to have no more than a minimal impact on the 50.69 application exposed compartments.

BSEP-17-0098, Continued Enclosure 49 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 6-5 Fire FSS-G2 MET I/II/III Screening methodology is provided in BNP-PSA-080, Section 6.0.

However: the MCA screening did not consider the impact of possible localized effect (e.g., damage to equipment) near penetrations and barriers.

In addition, a screening value was used without justification and the cumulative risk for the screened scenarios was not evaluated.

As described in Attachment 7 to BNP-PSA-080, plant walkdowns were performed to identify targets in the exposed compartments near the barriers separating the exposing and exposed compartments. The localized damage in the adjacent compartment near barriers for all compartments that screened out and for compartments where MCA was performed but did not achieve a HGL in the combined compartments was included. The localized targets of the adjacent compartment were added to the HGL evaluation for the exposed compartment. Neither the guidance in NUREG/CR-6850 nor Supporting Requirement FSSG2 in ASME/ANS RA-Sa-2009 requires an evaluation of the cumulative risk of the screened scenarios to justify the definition of a screening value.

There is no impact on the application.

BSEP-17-0098 Enclosure 50 External Hazard Screening Result Screened?

(Y/N)

Screening Criterion (Note a)

Comment Aircraft Impact Y

PS4 Aircraft impact analysis is discussed in section 5.5.1 of the BSEP IPEEE. This hazard is screened based on <1E-06 CDF, given an initiating event frequency of 1.3E-06/yr and a CCDP of 0.1. This CCDP is considered very conservative based on the design strength of Class I buildings.

Avalanche Y

C3 Not applicable because of site topography/location.

Biological Event Y

C5 Algae blooms and other biological influxes are slowly developing and can be detected and mitigated by surveillance.

Coastal Erosion Y

C1 Plant design eliminates costal erosion as a concern.

Drought Y

C1 Plant design eliminates drought as a concern.

External Flooding N

Detailed PRA External flooding analyses are included in the internal events PRA.

Extreme Wind or Tornado N

Detailed PRA PRA analysis of high winds is included Fog Y

C1 Negligible impact on the plant.

Forest or Range Fire Y

C3 Event cannot occur close enough to the plant.

Frost Y

C1 Damage potential is lower than for other events for which the plant is designed.

Hail Y

C1 Damage potential is lower than for other events for which the plant is designed.

High Summer Temperature Y

C2, C5 Damage potential is lower than for other events for which the plant is designed.

Impacts are slow to develop.

High Tide, Lake Level, or River Stage Y

C1, C4 Damage potential is lower than for other events for which the plant is designed.

Included in hurricane assessment. : External Hazards Screening

BSEP-17-0098, Continued Enclosure 51 External Hazard Screening Result Screened?

(Y/N)

Screening Criterion (Note a)

Comment Hurricane N

Detailed PRA Included in the high winds PRA.

Ice Cover Y

C1, C5 Plant is designed for freezing temperatures which are infrequent and short in duration. Impacts are slow to develop.

Industrial or Military Facility Accident Y

C1, PS1 Nearby facility accidents are discussed in section 2.2.2 of the BSEP UFSAR and in sections 5.5.2 and 5.5.3 of the BSEP IPEEE. These facilities are located at such distances from the plant site that any accidents will be well within the design basis of the plant.

Internal Flooding N

Detailed PRA An internal flooding PRA that meets the requirements of ASME/ANS RA-Sa-2009 has been developed and will be used for 10CFR50.69 characterization Internal Fire N

Detailed PRA The BSEP fire PRA developed for NFPA 805 meets the requirements of ASME/ANS RA-Sa-2009 will be used for 10CFR50.69 characterization.

Landslide Y

C3 Not applicable to the site because of topography.

Lightning Y

C4 Lightning strikes causing loss of offsite power or turbine trip are included as one contributor to the initiating event frequencies. The impacts are already modeled in the internal events PRA.

Low Lake Level or River Stage Y

C1 Plant design eliminates this hazard.

Low Winter Temperature Y

C1, C5 Extended freezing temperatures are rare, the plant is designed for such events, and their impacts are slow to develop.

Meteorite or Satellite Impact Y

C2 Negligible impact to the site.

Pipeline Accident Y

PS2 Pipeline accidents are discussed in section 2.2.3 of the BSEP UFSAR and in section 5.5.4 of the BSEP IPEEE. The worst case fires and potential gas leakage

BSEP-17-0098, Continued Enclosure 52 External Hazard Screening Result Screened?

(Y/N)

Screening Criterion (Note a)

Comment are well within the design basis of the plant.

Release of Chemicals in Onsite Storage Y

PS1 Onsite storage of hazardous chemicals is discussed in section 2.2.2 of the BSEP UFSAR, and is limited and not a concern to the site. Potential detonation of onsite hydrogen storage is discussed in section 2.2.2 of the BSEP UFSAR and in section 5.5.5 of the BSEP IPEEE. Separation distances are maintained between stored hydrogen and safe shutdown equipment such that there is no impact on plant risk.

River Diversion Y

C3 Not applicable to the site.

Sand or Dust Storm Y

C3 Not applicable to the site.

Seiche Y

C4 Included in hurricane assessment.

Seismic Activity N

SMA The Seismic Margins Assessment (SMA) developed for the IPEEE will be used for categorization.

Snow Y

C1, C4 The event damage potential is less than other events for which the plant is designed. Potential flooding impacts bounded by external flooding.

Soil Shrink-Swell Consolidation Y

C1 The potential for this hazard is low at the site, and the plant design considers this hazard.

Storm Surge Y

C4 Included in hurricane assessment.

Toxic Gas Y

C2, C4 Toxic chemical storage on site is limited and not a concern to the site. Included in assessment of industrial facility accidents.

Transportation Accident Y

C2, C4 Transportation accidents are discussed in section 2.2.2 of the BSEP UFSAR and in section 5.5.6 of the BSEP IPEEE. All chemical and hazardous material events are considered to be bounded by an explosion at the Sunny Point munitions storage facility. Assessment of a potential explosion is included in Industrial or Military Facility Accident.

BSEP-17-0098, Continued Enclosure 53 External Hazard Screening Result Screened?

(Y/N)

Screening Criterion (Note a)

Comment Tsunami Y

C4 Included in hurricane assessment.

Turbine-Generated Missiles Y

PS1 Turbine missiles are discussed in section 3.5.1.2 of the BSEP UFSAR and in section 5.3.2 of the BSEP IPEEE. The probability that a turbine missile will be generated is not present due to material properties and low stress levels.

Additionally, safety-related SSCs in proximity to the turbine are protected by Class 1 structures.

Volcanic Activity Y

C3 Not applicable to the site because of location.

Waves Y

C4 Included in hurricane assessment.

Note a - See Attachment 5 for descriptions of the screening criteria.

BSEP-17-0098 Enclosure 54 Event Analysis Criterion Source Comments Initial Preliminary Screening C1. Event damage potential is less than events for which plant is designed.

NUREG/CR-2300 and ASME/ANS Standard RA-Sa-2009 C2. Event has lower mean frequency and no worse consequences than other events analyzed.

NUREG/CR-2300 and ASME/ANS Standard RA-Sa-2009 C3. Event cannot occur close enough to the plant to affect it.

NUREG/CR-2300 and ASME/ANS Standard RA-Sa-2009 C4. Event is included in the definition of another event.

NUREG/CR-2300 and ASME/ANS Standard RA-Sa-2009 Not used to screen.

Used only to include within another event.

C5. Event develops slowly, allowing adequate time to eliminate or mitigate the threat.

ASME/ANS Standard Progressive Screening PS1. Design basis hazard cannot cause a core damage accident.

ASME/ANS Standard RA-Sa-2009 PS2. Design basis for the event meets the criteria in the NRC 1975 Standard Review Plan (SRP).

NUREG-1407 and ASME/ANS Standard RA-Sa-2009 PS3. Design basis event mean frequency is < 1E-5/y and the mean conditional core damage probability is < 0.1.

NUREG-1407 as modified in ASME/ANS Standard RA-Sa-2009 PS4. Bounding mean CDF is <

1E-6/y.

NUREG-1407 and ASME/ANS Standard RA-Sa-2009 Detailed PRA Screening not successful. PRA needs to meet requirements in the ASME/ANS PRA Standard.

NUREG-1407 and ASME/ANS Standard RA-Sa-2009

Progressive Screening Approach for Addressing External Hazards

BSEP-17-0098 Enclosure 55

Disposition of Key Assumptions/Sources of Uncertainty Assumption/

Uncertainty Discussion Disposition 1

DC Power availability and battery life The DC power system at BSEP is a significant contributor to plant risk.

Assessment of battery depletion times, the associated accident sequence timing, and the related success criteria were included in the uncertainty assessment performed in accordance with NUREG-1855.

The assessment of the DC power system in the BSEP PRA model uses NRC-approved methods and is used to develop the key importance measures for modeled SSCs. In accordance with NEI 00-04, sensitivity studies will be used to determine whether other conditions might lead to the component being safety significant. The assessment of the uncertainties, therefore, is appropriately included in this risk-informed application.

2 Loss of Off-Site Power (LOOP)

Frequencies Loss of off-site power (LOOP) initiating events have been shown to be important contributors to CDF due to the potential for station blackout and the reliance of many frontline systems on AC power. The LOOP initiator was separated into plant, grid, switchyard, and weather induced LOOPs, which allowed the model to apply recovery actions to the higher frequency events (i.e., plant and switchyard). BSEP used generic industry data to calculate LOOP frequencies.

The approach utilized for modeling the LOOP frequencies and the recovery probabilities is consistent with industry practice. The NEI 00-04 sensitivity studies will be used to determine whether other conditions might lead to SSCs being safety significant. The assessment of the uncertainties, therefore, is appropriately included in this risk-informed application.

BSEP-17-0098 Enclosure, Continued 56 Assumption/

Uncertainty Discussion Disposition 3

Fire Modeling The BSEP Fire PRA (FPRA) model complies with the NUREG/CR-6850 methodology that includes uncertainties from the inherent randomness in elements that comprise the FPRA model, and from the state of knowledge in these elements as the FPRA technology continues to evolve.

These include the fire ignition frequencies, heat release rates, fire growth curves, fire suppression failure probabilities, severity factors, and post-initiator human failure event probabilities. While the approaches used in the BSEP FPRA are NRC-approved methodologies, they are still constrained by the relatively limited data on fire events at Nuclear Power Plants.

Updated, NRC-approved FPRA technologies will be incorporated in the BSEP FPRA model as they become available in accordance with the normal PRA maintenance and update (MU) procedures. In accordance with NEI 00-04, sensitivity studies will be used to determine whether other conditions might lead to the component being safety significant. The assessment of the uncertainties, therefore, is appropriately addressed by the sensitivity studies required by this risk-informed application.

4 HVAC Model of Switchgear Ventilation and Supporting GOTHIC Analysis GOTHIC analysis for Switchgear HVAC requirements is not a bounding case and shows only one of 8 HVAC fans needed for room cooling. Additional GOTHIC analysis for more bounding cases is expected to show no change in conclusions.

Screening of HVAC for Switchgear rooms needs to consider the level of detail in the GOTHIC analysis that supports the HVAC modeling. Therefore this uncertainty will be addressed as individual systems are categorized in this risk-informed application.

5 Equipment Recovery Credit There are minimal or no credit for recovery of failed equipment and the loss of adequate injection at the time of containment failure. These conservative assumptions are used because only limited information is available on human response and equipment capability under such adverse conditions.

This assumption could result in some SSCs being classified as HSS due to assumed loss of alternate success paths, when in fact they are LSS. Therefore this uncertainty will be addressed as individual systems are categorized in this risk-informed application.

BSEP-17-0098 Enclosure, Continued 57 Assumption/

Uncertainty Discussion Disposition 6

Human Reliability Analysis To quantify the cognitive portion, the higher of the probabilities suggested by the HCR/ORE (Human Cognitive Reliability/Operator Reliability Experiments) model or the cause-based approach was used. This implicitly reflects an assumption that one or the other better accounts for the dominant processes. Lower-bound values were also used in place of the calculated results, when very low probabilities were assessed for some events.

The NEI 00-04 sensitivity studies explicitly require setting human error basic events to the 5th and 95th percentile values as a sensitivity.

The assessment of the uncertainties, therefore, is appropriately addressed by the sensitivity studies required by this risk-informed application.

7 DC Power Dependency Following battery failure or maintenance, it is assumed that the associated charger output breaker will trip on overvoltage from motors starting on the bus, such that DC power to the bus will fail.

HPCI DC motors have in at least one instance caused this occurrence.

In accordance with NEI 00-04, sensitivity studies will be used to determine whether other conditions might lead to the component being safety significant. This includes setting maintenance unavailability terms to zero and setting common cause failure event to their 5th and 95th percentile values, and increasing the unreliability of all LSS SSCs by a factor of 3. The assessment of the uncertainties, therefore, is appropriately addressed by the sensitivity studies required by this risk-informed application.

8 Modeling of CRD Support Systems A conservative assumption is made that the CRD system fails without Reactor Building Closed Cooling Water (RBCCW) cooling and is modeled accordingly. Discussions with Operations and Systems Engineering personnel indicate that the CRD pumps may actually have been run with RBCCW inadvertently isolated with no degradation to the CRD pumps, however there is currently no documentation of this.

This assumption could result in some SSCs (i.e., RBCCW) being classified as HSS due to assumed loss of alternate success paths, when in fact they are LSS.

Therefore this uncertainty will be addressed as individual systems are categorized in this risk-informed application.

BSEP-17-0098 Enclosure, Continued 58 Assumption/

Uncertainty Discussion Disposition 9

Initiating Event Frequency External Events at the Extreme Ranges For External Flooding, High Straight line winds (200mph+) and Tornados (F5s) the Initiating Events for the very rare events is believe to be assigned a frequency higher than actual. With no supporting data the frequency is at these extremes is a best fit curve type analysis.

This assumption could result in some SSCs being classified as HSS due to assumed loss of alternate success paths, when in fact they are LSS. Therefore this uncertainty will be addressed as individual systems are categorized in this risk-informed application.