HNP-18-001, Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (Sscs) for Nuclear Power Reactors.

Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (Sscs) for Nuclear Power Reactors.

ML18033B768
Person / Time
Site:	Harris
Issue date:	02/01/2018
From:	Hamilton T Duke Energy Florida
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
HNP-18-001
Download: ML18033B768 (59)

Text

Tanya M. Hamilton Vice President Harris Nuclear Plant 5413 Shearon Harris Road New Hill, NC 27562-9300 10 CFR 50.90 10 CFR 50.69 February 1, 2018 Serial: HNP-18-001 Attn: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 Shearon Harris Nuclear Power Plant, Unit No. 1 Docket No. 50-400 / Renewed Facility Operating License No. NPF- 63

Subject:

Application to Adopt 10 CFR 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors" Ladies and Gentlemen:

In accordance with the provisions of 10 CFR 50.69 and 10 CFR 50.90, Duke Energy LLC (Duke Energy) is requesting an amendment to the license of Shearon Harris Nuclear Power Plant (HNP), Unit No. 1.

The proposed amendment would modify the licensing basis, by the addition of a License Condition, to allow for the implementation of the provisions of 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors. The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with this regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety.

The enclosure to this letter provides the basis for the proposed change to the HNP, Unit 1 Operating License. The categorization process being implemented through this change is consistent with Nuclear Energy Institute (NEI) 00-04, 10 CFR 50.69 SSC Categorization Guideline," Revision 0 dated July 2005 which was endorsed by the U.S. Nuclear Regulatory Commission (NRC) in Regulatory Guide 1.201, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance",

Revision 1, May 2006. Attachment 1 of the enclosure provides a list of categorization prerequisites. Use of the categorization process on a plant system will only occur after these prerequisites are met.

www.duke-energy.com

U.S. Nuclear Regulatory Commission HNP-18-001 Page2 The NRC has previously reviewed the technical adequacy of the HNP Probabilistic Risk Assessment (PAA) models identified in this application, with routine maintenance updates applied, for:

• Letter from the NRC to HNP, "Issuance of Amendments Regarding Risk-Informed Justifications for the Relocation of Specific Surveillance Frequency Requirements to a Licensee-Controlled Program", November 29, 2016 (ADAMS Accession No. ML16200A285) (Reference 12)

• Letter from the NRC to HNP, "Issuance of Amendments Regarding Adoption of National Fire Protection Association Standard 805, "Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants", December 28, 201 O (ADAMS Accession No. ML102510852) (Reference 13)

Duke Energy requests that the NRC utilize the review of the PRA technical adequacy for those applications when performing the review for this application.

Duke Energy requests approval of the proposed license amendment by February 1, 2019, with the amendment being implemented within 60 days.

In accordance with 10 CFR 50.91, a copy of this application, with attachments, is being provided to the designated North Carolina Official.

This letter contains no regulatory commitments.

Please refer any questions regarding this submittal to Art Zaremba at (980) 373-2062.

I declare under penalty of perjury that the foregoing is true and correct. Executed on February 1, 2018.

Sincerely, Tanya M. Hamilton

Enclosure:

1. Evaluation of the Proposed Change

U.S. Nuclear Regulatory Commission HNP-18-001 Page 3 cc (with enclosure):

C. Haney, Regional Administrator U. S. Nuclear Regulatory Commission - Region II Marquis One Tower 245 Peachtree Center Ave., NE Suite 1200 Atlanta, GA 30303-1257 M.C. Barillas, Project Manager (SHNPP) (Electronic Copy only)

U. S. Nuclear Regulatory Commission One White Flint North, Mail Stop 8 G9A 11555 Rockville Pike Rockville, MD 20852-2738 J. Zeiler, NRC Senior Resident Inspector Shearon Harris Nuclear Power Plant, Unit 1 W. Lee Cox III, Section Chief (Electronic Copy Only)

Radiation Protection Section North Carolina Department of Health and Human Services 1645 Mail Service Center Raleigh, NC 27699-145 lee.cox@dhhs.nc.gov

Enclosure HNP-18-001 Evaluation of the Proposed Change TABLE OF CONTENTS 1

SUMMARY

DESCRIPTION ................................................................................................ 3 2 DETAILED DESCRIPTION ................................................................................................ 3 2.1 CURRENT REGULATORY REQUIREMENTS ........................................................... 3 2.2 REASON FOR PROPOSED CHANGE ...................................................................... 3

2.3 DESCRIPTION

OF THE PROPOSED CHANGE ........................................................ 4 3 TECHNICAL EVALUATION ............................................................................................... 5 3.1 CATEGORIZATION PROCESS DESCRIPTION (10 CFR 50.69(b)(2)(i)) ................... 5 3.1.1 Overall Categorization Process ................................................................. 5 3.1.2 Passive Categorization Process .............................................................. 10 3.2 TECHNICAL ADEQUACY EVALUATION (10 CFR 50.69(b)(2)(ii)) ......................... 12 3.2.1 Internal Events and Internal Flooding ..................................................... 12 3.2.2 Fire Hazards .............................................................................................. 12 3.2.3 Seismic Hazards ....................................................................................... 12 3.2.4 Other External Hazards ............................................................................ 13 3.2.5 Low Power & Shutdown ........................................................................... 13 3.2.6 PRA Maintenance and Updates ............................................................... 13 3.2.7 PRA Uncertainty Evaluations ................................................................... 14 3.3 PRA REVIEW PROCESS RESULTS (10 CFR 50.69(b)(2)(iii)) ................................ 14 3.4 RISK EVALUATIONS (10 CFR 50.69(b)(2)(iv)) ....................................................... 16 4 REGULATORY EVALUATION ......................................................................................... 17 4.1 APPLICABLE REGULATORY REQUIREMENTS/CRITERIA .................................. 17 4.2 NO SIGNIFICANT HAZARDS CONSIDERATION ANAL YSIS ................................. 17

4.3 CONCLUSION

S ....................................................................................................... 19 5 ENVIRONMENTAL CONSIDERATION ............................................................................ 19 6 REFERENCES ................................................................................................................. 20

Enclosure HNP-18-001 LIST OF ATTACHMENTS : List of Categorization Prerequisites .............................................. 22 : Description of PRA Models Used in Categorization ....................... 23 : Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open ltems .................................................................... 24 : External Hazards Screening .......................................................... .44 : Progressive Screening Approach for Addressing External Hazards

.................................................................................................................. 50 : Disposition of Key Assumptions/Sources of Uncertainty .............. 51 11

Enclosure HNP-18-001 1

SUMMARY

DESCRIPTION The proposed amendment would modify the licensing basis to allow for the implementation of the provisions of Title 10 of the Code of Federal Regulations (10 CFR), Part 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors. The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with this regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety.

2 DETAILED DESCRIPTION 2.1 CURRENT REGULATORY REQUIREMENTS The U.S. Nuclear Regulatory Commission (NRC) has established a set of regulatory requirements for commercial nuclear reactors to ensure that a reactor facility does not impose an undue risk to the health and safety of the public, thereby providing reasonable assurance of adequate protection to public health and safety. The current body of NRC regulations and their implementation are largely based on a "deterministic" approach.

This deterministic approach establishes requirements for engineering margin and quality assurance in design, manufacture, and construction. In addition, it assumes that adverse conditions can exist (e.g., equipment failures and human errors) and establishes a specific set of design basis events (DBEs). The deterministic approach then requires that the facility include safety systems capable of preventing or mitigating the consequences of those DBEs to protect public health and safety. Those SSCs necessary to defend against the DBEs are defined as "safety-related," and these SSCs are the subject of many regulatory requirements, herein referred to as special treatments, designed to ensure that they are of high quality and high reliability, and have the capability to perform during postulated design basis conditions.

Treatment includes, but is not limited to, quality assurance, testing, inspection, condition monitoring, assessment, evaluation, and resolution of deviations. The distinction between "treatment" and "special treatment" is the degree of NRC specification as to what must be implemented for particular SSCs or for particular conditions. Typically, the regulations establish the scope of SSCs that receive special treatment using one of three different terms: "safety-related," "important to safety," or "basic component." The terms "safety-related "and "basic component" are defined in the regulations, while "important to safety," used principally in the general design criteria (GDC) of Appendix A to 10 CFR Part 50, is not explicitly defined.

2.2 REASON FOR PROPOSED CHANGE A probabilistic approach to regulation enhances and extends the traditional deterministic approach by allowing consideration of a broader set of potential challenges to safety, providing a logical means for prioritizing these challenges based on safety significance, and allowing consideration of a broader set of resources to defend against these challenges. In contrast to the deterministic approach, Probabilistic Risk Assessments (PRAs) address credible initiating events by assessing the event frequency. Mitigating system reliability is then assessed, including the potential for common cause failures. The probabilistic approach to regulation is 3

Enclosure HNP-18-001 an extension and enhancement of traditional regulation by considering risk in a comprehensive manner.

To take advantage of the safety enhancements available through the use of PRA, in 2004 the NRC published a new regulation, 10 CFR 50.69. The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with the regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety.

The rule contains requirements on how a licensee categorizes SSCs using a risk-informed process, adjusts treatment requirements consistent with the relative significance of the SSC, and manages the process over the lifetime of the plant. A risk-informed categorization process is employed to determine the safety significance of SSCs and place the SSCs into one of four risk-informed safety class (RISC) categories. The determination of safety significance is performed by an integrated decision-making process, as described by NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline (Reference 1), which uses both risk insights and traditional engineering insights. The safety functions include the design basis functions, as well as functions credited for severe accidents (including external events). Special or alternative treatment for the SSCs is applied as necessary to maintain functionality and reliability, and is a function of the SSC categorization results and associated bases. Finally, periodic assessment activities are conducted to make adjustments to the categorization and/or treatment processes as needed so that SSCs continue to meet all applicable requirements.

The rule does not allow for the elimination of SSC functional requirements or allow equipment that is required by the deterministic design basis to be removed from the facility. Instead, the rule enables licensees to focus their resources on SSCs that make a significant contribution to plant safety. For SSCs that are categorized as high safety significant, existing treatment requirements are maintained or enhanced. Conversely, for SSCs that do not significantly contribute to plant safety on an individual basis, the rule allows an alternative risk-informed approach to treatment that provides reasonable, though reduced, level of confidence that these SSCs will satisfy functional requirements.

Implementation of 10 CFR 50.69 will allow Duke Energy to improve focus on equipment that has safety significance resulting in improved plant safety.

2.3 DESCRIPTION

OF THE PROPOSED CHANGE Duke Energy proposes the addition of the following condition to the renewed operating license of HNP, Unit 1 to document the NRC's approval of the use 10 CFR 50.69.

Duke Energy is approved to implement 10 CFR 50.69 using the processes for categorization of Risk-Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC-4 structures, systems, and components (SSCs) specified in the license amendment request dated February 1, 2018.

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

4

Enclosure HNP-18-001 3 TECHNICAL EVALUATION 10 CFR 50.69 specifies the information to be provided by a licensee requesting adoption of the regulation. This request conforms to the requirements of 10 CFR 50.69(b)(2), which states:

A licensee voluntarily choosing to implement this section shall submit an application for license amendment under 10 CFR 50.90 that contains the following information:

(i) A description of the process for categorization of RISC-1, RISC-2, RISC-3 and RISC-4 SSCs.

(ii) A description of the measures taken to assure that the quality and level of detail of the systematic processes that evaluate the plant for internal and external events during normal operation, low power, and shutdown (including the plant-specific probabilistic risk assessment (PRA), margins-type approaches, or other systematic evaluation techniques used to evaluate severe accident vulnerabilities) are adequate for the categorization of SSCs.

(iii) Results of the PRA review process conducted to meet § 50.69(c)(1)(i).

(iv) A description of, and basis for acceptability of, the evaluations to be conducted to satisfy § 50.69(c)(1)(iv). The evaluations must include the effects of common cause interaction susceptibility, and the potential impacts from known degradation mechanisms for both active and passive functions, and address internally and externally initiated events and plant operating modes (e.g., full power and shutdown conditions).

Each of these submittal requirements are addressed in the proceeding sections.

The NRC has previously reviewed the technical adequacy of the HNP PRA model identified in this application, with routine maintenance updates applied, for:

• License Amendment Regarding Risk-Informed Justifications for the Relocation of Specific Surveillance Frequency Requirements to a Licensee-Controlled Program, November 29, 2016, ADAMS Accession No. ML16200A285, (Reference 12);

• License Amendment Regarding Adoption of National Fire Protection Association Standard 805, June 28, 2010, ADAMS Accession No. ML10750602, (Reference 13).

Duke Energy requests that the NRC utilize the review of the PRA technical adequacy for those applications when performing the review for this application.

3.1 CATEGORIZATION PROCESS DESCRIPTION (10 CFR 50.69(b)(2)(i))

3.1.1 Overall Categorization Process Duke Energy will implement the risk categorization process in accordance with the NEI 00-04, Revision 0, as endorsed by Regulatory Guide (RG) 1.201, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance, (Reference 2). NEI 00-04 Section 1.5 states Due to the varying levels of 5

Enclosure HNP-18-001 uncertainty and degrees of conservatism in the spectrum of risk contributors, the risk significance of SSCs is assessed separately from each of five risk perspectives and used to identify SSCs that are potentially safety-significant. Separate evaluation is appropriate to avoid reliance on a combined result that may mask the results of individual risk contributors.

The process to categorize each system will be consistent with the guidance in NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline, as endorsed by RG 1.201. RG 1.201 states that the implementation of all processes described in NEI 00-04 (i.e., Sections 2 through 12) is integral to providing reasonable confidence and that all aspects of NEI 00-04 must be followed to achieve reasonable confidence in the evaluations required by §50.69(c)(1)(iv).

However, neither RG 1.201 nor NEI 00-04 prescribe a particular sequence or order for each of the elements to be completed. Therefore, the order in which each of the elements of the categorization process (listed below) is completed is flexible and as long as they are all completed they may even be performed in parallel. Note that NEI 00-04 only requires the seven qualitative criteria in Section 9.2 of NEI 00-04 (Item 3 in the list below) to be completed for components/functions categorized as LSS by all other elements. Similarly, NEI 00-04 only requires the defense-in-depth assessment (Item 4 in the list below) to be completed for safety related active components/functions categorized as LSS by all other elements.

1. PRA-based evaluations (e.g., the internal events, internal flooding, and fire PRAs)

2. non-PRA approaches (e.g., seismic safe shutdown equipment list (SSEL), other external events screening, and shutdown assessment)

3. Seven qualitative criteria in Section 9.2 of NEI 00-04

4. the defense-in-depth assessment

5. the passive categorization methodology Categorization of SSCs will be completed per the NEI 00-04 process, as endorsed by RG 1.201, which includes the determination of safety significance through the various elements identified above. The results of these elements are used as inputs to arrive at a preliminary component categorization (i.e., High Safety Significant (HSS) or Low Safety Significant (LSS))

that is presented to the Integrated Decision-Making Panel (IDP). Note: the term preliminary HSS or LSS is synonymous with the NEI 00-04 term candidate HSS or LSS. A component or function is preliminarily categorized as HSS if any element of the process results in a preliminary HSS determination in accordance with Table 1 below. The safety significance determination of each element, identified above, is independent of each other and therefore the sequence of the elements does not impact the resulting preliminary categorization of each component or function. Consistent with NEI 00-04, the categorization of a component or function will only be preliminary until it has been confirmed by the IDP. Once the IDP confirms that the categorization process was followed appropriately, the final Risk Informed Safety Class (RISC) category can be assigned.

The IDP may direct and approve detailed categorization of components in accordance with NEI 00-04 Section 10.2. The IDP may always elect to change a preliminary LSS component or function to HSS, however the ability to change component categorization from preliminary HSS to LSS is limited. This ability is only available to the IDP for select process steps as described in NEI 00-04 and endorsed by RG 1.201. Table 3-1 summarizes these IDP limitations in NEI 00-04. The steps of the process are performed at either the function level, component level, or both. This is also summarized in the Table 3-1. A component is assigned its final RISC category upon approval by the IDP.

6

Enclosure HNP-18-001 Table 3-1: IDP Changes from Preliminary HSS to LSS Drives Categorization Step - IDP Change Element Evaluation Level Associated NEI 00-04 Section HSS to LSS Functions Internal Events Base Not Allowed Yes Case - Section 5.1 Fire, Seismic and Other External Events Allowable No Base Case Risk (PRA Component Modeled) PRA Sensitivity Allowable No Studies Integral PRA Assessment - Not Allowed Yes Section 5.6 Fire, Seismic and Other External Component Not Allowed No Risk (Non- Hazards -

modeled)

Shutdown - Section Function/Component Not Allowed No 5.5 Core Damage -

Function/Component Not Allowed Yes Section 6.1 Defense-in-Depth Containment -

Component Not Allowed Yes Section 6.2 Qualitative Considerations -

Function Allowable N/A Criteria Section 9.2 Passive Passive - Section 4 Segment/Component Not Allowed No The mapping of components to system functions is used in some categorization process steps to facilitate preliminary categorization of components. Specifically, functions with mapped components that are determined to be HSS by the PRA-based assessment (i.e., Internal events PRA or Integral PRA assessment) or defense-in-depth evaluation will be initially treated as HSS. However, NEI 00-04 Section 10.2 allows detailed categorization which can result in some components mapped to HSS functions being treated as LSS; and Section 4.0 discusses additional functions that may be identified (e.g., fill and drain) to group and consider potentially LSS components that may have been initially associated with a HSS function but which do not support the critical attributes of that HSS function. Note that certain steps of the categorization process are performed at a component level (e.g. Passive, Non-PRA-modeled hazards - see Table 3-1). These components from the component level assessments will remain HSS (IDP cannot override) regardless of the significance of the functions to which they are mapped.

Therefore, if a HSS component is mapped to a LSS function, that component will remain HSS.

7

Enclosure HNP-18-001 If an LSS component is mapped to an HSS function, that component may be driven HSS based on Table 1 above, or may remain LSS.

The following are clarifications to be applied to the NEI 00-04 categorization process:

• The Integrated Decision Making Panel (IDP) will be composed of a group of at least five experts who collectively have expertise in plant operation, design (mechanical and electrical) engineering, system engineering, safety analysis, and PRA. At least three members of the IDP will have a minimum of five years of experience at the plant, and there will be at least one member of the IDP who has a minimum of three years of experience in the modeling and updating of the plant-specific PRA.

• The IDP will be trained in the specific technical aspects and requirements related to the categorization process. Training will address at a minimum the purpose of the categorization; present treatment requirements for SSCs including requirements for design basis events; PRA fundamentals; details of the plant specific PRA including the modeling, scope, and assumptions, the interpretation of risk importance measures, and the role of sensitivity studies and the change-in-risk evaluations; and the defense-in-depth philosophy and requirements to maintain this philosophy.

• The decision criteria for the IDP for categorizing SSCs as safety significant or low safety-significant pursuant to 10 CFR 50.69(f)(1) will be documented in Duke Energy procedures.

Decisions of the IDP will be arrived at by consensus. Differing opinions will be documented and resolved, if possible. If a resolution cannot be achieved concerning the safety significance of an SSC, then the SSC will be classified as safety-significant.

• Passive characterization will be performed using the processes described in Section 3.1.2.

Consistent with NEI 00-04, an HSS determination by the passive categorization process cannot be changed by the IDP.

• An unreliability factor of 3 will be used for the sensitivity studies described in Section 8 of NEI 00-04. The factor of 3 was chosen as it is representative of the typical error factor of basic events used in the PRA model.

• NEI 00-04 Section 7 requires assigning the safety significance of functions to be preliminary HSS if it is supported by an SSC determined to be HSS from the PRA-based assessment in Section 5 or the defense-in-depth assessment in Section 6, but does not require this for SSCs determined to be HSS from non-PRA-based, deterministic assessments in Section 5.

This position was accepted by the NRC staff in the Vogtle Safety Evaluation (SE, Reference

17) which states if any SSC is identified as HSS from either the integrated PRA component safety significance assessment (Section 5 of NEI 00-04) or the defense-in-depth assessment (Section 6), the associated system function(s) would be identified as HSS.

• Once a system function is identified as HSS, then all the components that support that function are preliminary HSS. The Integrated Decision-making Panel (IDP) must intervene to assign any of these HSS Function components to LSS.

• With regard to the criteria that consider whether the active function is called out or relied upon in the plant Emergency/Abnormal Operating Procedures, Duke Energy will not take 8

Enclosure HNP-18-001 credit for alternate means unless the alternate means are proceduralized and included in Licensed Operator Training.

The risk analysis being implemented for each hazard is described:

• Internal Event Risks: The HNP Internal Events working model is the Model of Record based on the plant configuration as of December, 2017 (MOR2017). The NRC has previously reviewed the technical adequacy of the HNP PRA model identified in this application for:

• License Amendment Regarding Risk-Informed Justifications for the Relocation of Specific Surveillance Frequency Requirements to a Licensee-Controlled Program, November 29, 2016 (ADAMS Accession No. ML16200A285) (Reference 12)

• License Amendment Regarding Adoption of National Fire Protection Association Standard 805, Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants (Reference 13)

• Internal Flood Risks model version HNP_Flood_2014_R1(2014). The NRC has previously reviewed the technical acceptability of the HNP PRA model identified in this application for:

• License Amendment Regarding Risk-Informed Justifications for the Relocation of Specific Surveillance Frequency Requirements to a Licensee-Controlled Program (CAC No. MF6S83), November 29, 2016 (ADAMS Accession No. ML16200A285)

(Reference 12)

• License Amendment Regarding Adoption of National Fire Protection Association Standard 805, Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants (Reference 13)

• Fire Risks: Fire PRA model version HNP_2010, January 2014. The NRC has previously reviewed the technical adequacy of previous versions of the HNP PRA model identified in this application for the following applications:

• License Amendment Regarding Risk-Informed Justifications for the Relocation of Specific Surveillance Frequency Requirements to a Licensee-Controlled Program (CAC No. MF6S83), November 29, 2016 (ADAMS Accession No. ML16200A285)

(Reference 12)

• License Amendment Regarding Adoption of National Fire Protection Association Standard 805, Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants (Reference 13)

• Seismic Risks: Seismic Safe Shutdown Equipment List (SSEL) from the IPEEE seismic margins analysis accepted by NRC SE dated January 14, 2000 (Reference 15)

• Other External Risks (e.g., tornados, external floods, etc.): Using the IPEEE screening process as approved by NRC SE dated January 14, 2000 (Reference 15) the other external hazards were determined to be insignificant contributors to plant risk 9

Enclosure HNP-18-001

• Low Power and Shutdown Risks: Qualitative defense-in-depth (DID) shutdown model for shutdown configuration risk management (CRM) based on the framework for DID provided in NUMARC 91-06, Guidance for Industry Actions to Assess Shutdown Management (Reference 3), which provides guidance for assessing and enhancing safety during shutdown operations.

A change to the categorization process that is outside the bounds specified above (e.g.,

change from a seismic margins approach to a seismic PRA approach) will not be used without prior NRC approval. The SSC categorization process documentation will include the following elements:

1. Program procedures used in the categorization

2. System functions, identified and categorized with the associated bases

3. Mapping of components to support function(s)

4. PRA model results, including sensitivity studies

5. Hazards analyses, as applicable

6. Passive categorization results and bases

7. Categorization results including all associated bases and RISC classifications

8. Component critical attributes for HSS SSCs

9. Results of periodic reviews and SSC performance evaluations

10. IDP meeting minutes and qualification/training records for the IDP members 3.1.2 Passive Categorization Process For the purposes of 10 CFR 50.69 categorization, passive components are those components that have a pressure retaining function. Passive components and the passive function of active components will be evaluated using the Arkansas Nuclear One (ANO) Risk-Informed Repair/Replacement Activities (RI-RRA) methodology consistent with the SE issued by the Office of Nuclear Reactor Regulation (Reference 4).

The RI-RRA methodology is a risk-informed safety classification and treatment program for repair/replacement activities (RI-RRA methodology) for pressure retaining items and their associated supports. In this method, the component failure is assumed with a probability of 1.0 and only the consequence evaluation is performed. It additionally applies deterministic considerations (e.g., defense in depth, safety margins) in determining safety significance.

Component supports are assigned the same safety significance as the highest passively ranked component within the bounds of the associated analytical pipe stress model. Consistent with NEI 00-04, an HSS determination by the passive categorization process cannot be changed by the IDP.

The use of this method was previously approved to be used for a 10 CFR 50.69 application by NRC in the final SE for Vogtle dated December 17, 2014 (Reference 17). The RI-RRA method as approved for use at Vogtle for 10 CFR 50.69 does not have any plant specific aspects and is generic. It relies on the conditional core damage and large early release probabilities associated with postulated ruptures. Safety significance is generally measured by the frequency and the consequence of the event. However, this RI-RRA process categorizes components solely based on consequence, which measures the safety significance of the passive component given that it ruptures. This approach is conservative compared to including the rupture frequency in the categorization as this approach will not allow the categorization of SSCs to be affected by any changes in frequency due to changes in treatment. Therefore, the 10

Enclosure HNP-18-001 RI-RRA methodology for passive categorization is acceptable and appropriate for use at HNP for 10 CFR 50.69.

The methodology does not require modification in order to appropriately categorize Class 1 SSCs. The ASME classification of the SSC does not impact the methodology as it only evaluates the consequence of a rupture of the SSCs pressure boundary. As stated in the Vogtle SE, categorizing solely based on consequence which measures the safety significance of the pipe given that it ruptures is conservative compared to including the rupture frequency in the categorization and the categorization will not be affected by changes in frequency arising from changes to the treatment. Therefore, this methodology is appropriate to apply to ASME Class 1 SSCs, as the consequence evaluation and deterministic considerations are independent of the ASME classification when determining the SSCs safety significance and will maintain this acceptable level of conservatism. The passive categorization process is intended to apply the same risk-informed process accepted in the ANO2-R&R-004 for the passive categorization of Class 2 and 3 components, to Class 1 pressure retaining SSCs in the scope of the system being categorized.

The ANO RI-RRA passive methodology implements the same risk-informed inservice inspection (RI-ISI) consequence evaluation process contained in EPRI TR-112657, Revised Risk-Informed Inservice Inspection Procedure supplemented with additional qualitative considerations. The NRC Safety Evaluation Report (SER) of this EPRI topical report was issued by letter on October 28, 1999. Section 3.2.1 of the SER describes the scope of the RI-ISI methodology as:

The full-scope option includes ASME Code Class 1, 2, and 3 piping, piping whose failure could prevent safety-related structures, systems, or components (SSCs) from fulfilling their safety functions, and non-safety-related piping that is relied upon to mitigate accidents for whose failure could cause a reactor scram or actuation of a safety-related system.

While many pressure boundary components (passive components) are not modeled in a PRA, the consequence evaluation process of TR-112657, Rev B-A provides an explicit and robust process for determining the importance of pressure boundary components for both moderate and high energy systems. Consistent with the ASME/ANS PRA Standard, this supplementary analysis is used to augment the base PRA information. Further, as discussed above, the methodology uses the consequence portion of EPRI RI-ISI process enhanced with additional considerations which provide an additional layer of confidence for categorizing Class 1 SSCs as well as Class 2, 3 and non-class SSCs.

The same process, as it pertains to ISI, has been approved for use on the full scope and code class designations of pressure retaining piping and welds in nuclear power plants. It has been determined to be sufficiently robust to assess the consequence risk of Class 1 piping and welds in the context of ISI even without the additional qualitative steps. The ANO RI-RRA has also determined to be sufficiently robust to assess the consequence of all Class 2 and Class 3 SSCs (with the additional qualitative steps) in the context of repair/replacement. Therefore, the ANO RI-RRA methodology should be sufficiently robust to assess the consequence of the full spectrum of pressure retaining components as well as active components with a pressure retaining function regardless of ASME classification.

11

Enclosure HNP-18-001 3.2 TECHNICAL ADEQUACY EVALUATION (10 CFR 50.69(b)(2)(ii))

The following sections demonstrate that the quality and level of detail of the processes used in categorization of SSCs are adequate. All the PRA models described below have been peer reviewed and there are no PRA upgrades that have not been peer reviewed. The PRA models credited in this request are the same PRA models credited in the License Amendment Regarding Risk-Informed Justifications for the Relocation of Specific Surveillance Frequency Requirements to a Licensee-Controlled Program, November 29, 2016 ADAMS Accession No. ML16200A285, (Reference 12); and Amendment Regarding Adoption of National Fire Protection Association Standard 805, June 28, 2010 ADAMS Accession No. ML10750602, (Reference 13), with routine maintenance updates applied.

3.2.1 Internal Events and Internal Flooding The HNP categorization process for the internal events and flooding hazard will use the plant-specific PRA model. The Duke Energy risk management process ensures that the PRA model used in this application reflects the as-built and as-operated plant for HNP. Attachment 2 at the end of this enclosure identifies the applicable internal events and internal flooding PRA models.

3.2.2 Fire Hazards The HNP categorization process for fire hazards will use a peer reviewed plant-specific fire PRA model. The internal Fire PRA model was developed consistent with NUREG/CR-6850 and only utilizes methods previously accepted by the NRC. The Duke Energy risk management process ensures that the PRA model used in this application reflects the as-built and as-operated plant for HNP. Attachment 2 at the end of this enclosure identifies the applicable Fire PRA model.

3.2.3 Seismic Hazards The HNP categorization process will use the seismic margins analysis (SMA) performed for the Individual Plant Evaluation-External Events (IPEEE) in response to GL 88-20 (Reference 14) for evaluation of safety significance related to seismic hazards. No plant specific approaches were utilized in development of the SMA. The NEI 00-04 approved use of the SMA Seismic Safe Shutdown Equipment List (SSEL) as a screening process identifies all system functions and associated SSCs that are involved in the seismic margin success path as HSS. Since the analysis is being used as a screening tool, importance measures are not used to determine safety significance. The NEI 00-04 approach using the SSEL would identify credited equipment as HSS regardless of their capacity, frequency of challenge or level of functional diversity.

An evaluation was performed of the as-built, as-operated plant against the SSEL. The evaluation was a comparison of the as-built, as-operated plant to the plant configuration originally assessed by the SMA. Differences were reviewed to identify any potential impacts to the equipment credited on the SSEL. Appropriate changes to the credited equipment were identified and documented. This documentation is available for audit. The Duke Energy risk management program ensures that future changes to the plant will be evaluated to determine their impact on the SMA and risk categorization process.

12

Enclosure HNP-18-001 3.2.4 Other External Hazards All external hazards were screened from applicability to HNP per a plant-specific evaluation in accordance with GL 88-20 (Reference 5) and updated to use the criteria in ASME PRA Standard RA-Sa-2009. Attachment 4 provides a summary of the other external hazards screening results. Attachment 5 provides a summary of the progressive screening approach for external hazards.

As part of the categorization assessment of other external hazard risk, an evaluation is performed to determine if there are components being categorized participate in screened scenarios and whose failure would result in an unscreened scenario. Consistent with the flow chart in Figure 5-6 in Section 5.4 of NEI 00-04, these components would be considered HSS.

All remaining hazards were screened from applicability and considered insignificant for every SSC and, therefore, will not be considered during the categorization process.

3.2.5 Low Power & Shutdown Consistent with NEI 00-04, the HNP categorization process will use the shutdown safety management plan described in NUMARC 91-06, for evaluation of safety significance related to low power and shutdown conditions. The overall process for addressing shutdown risk is illustrated in Figure 5-7 of NEI 00-04.

NUMARC 91-06 specifies that a defense-in-depth approach should be used with respect to each defined shutdown key safety function. The key safety functions defined in NUMARC 91-06 are evaluated for categorization of SSCs.

SSCs that meet the two criteria (i.e., considered part of a primary shutdown safety system or a failure would initiate an event during shutdown conditions) described in Section 5.5 NEI 00-04 will be considered preliminary HSS.

3.2.6 PRA Maintenance and Updates The Duke Energy risk management process ensures that the applicable PRA models used in this application continue to reflect the as-built and as-operated plant for HNP. The process delineates the responsibilities and guidelines for updating the PRA models, and includes criteria for both regularly scheduled and interim PRA model updates. The process includes provisions for monitoring potential areas affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, industry operational experience) for assessing the risk impact of unincorporated changes, and for controlling the model and associated computer files.

The process will assess the impact of these changes on the plant PRA model in a timely manner but no longer than once every two refueling outages. If there is a significant impact on the PRA model, the SSC categorization will be re-evaluated.

In addition, Duke Energy will implement a process that addresses the requirements in NEI 00-04, Section 11, Program Documentation and Change Control. The process will review the results of periodic and interim updates of the plant PRA that may affect the results of the categorization process. If the results are affected, adjustments will be made as necessary to the categorization or treatment processes to maintain the validity of the processes. In addition, any PRA model upgrades will be peer reviewed prior to implementing those changes in the PRA model used for categorization.

13

Enclosure HNP-18-001 3.2.7 PRA Uncertainty Evaluations Uncertainty evaluations associated with any applicable baseline PRA model(s) used in this application were evaluated during the assessment of PRA technical adequacy and confirmed through the self-assessment and peer review processes as discussed in Section 3.3 of this enclosure.

Uncertainty evaluations associated with the risk categorization process are addressed using the processes discussed in Section 8 and in the prescribed sensitivity studies discussed in Section 5 of NEI 00-04.

In the overall risk sensitivity studies Duke Energy will utilize a factor of 3 to increase the unavailability or unreliability of LSS components consistent with that approved for Vogtle in Reference 17. Consistent with the NEI 00-04 guidance, Duke Energy will perform both an initial sensitivity study and a cumulative sensitivity study. The initial sensitivity study applies to the system that is being categorized. In the cumulative sensitivity study, the failure probabilities (i.e.,

unreliability and unavailability, as appropriate) of all LSS components modeled in PRAs for all systems that have been categorized are increased by a factor of 3. This sensitivity study together with the periodic review process assures that the potential cumulative risk increase from the categorization is maintained acceptably low. The performance monitoring process monitors the component performance to ensure that potential increases in failure rates of categorized components are detected and addressed before reaching the rate assumed in the sensitivity study.

The detailed process of identifying, characterizing and qualitative screening of model uncertainties is found in Section 5.3 of NUREG-1855 and Section 3.1.1 of EPRI TR-1016737 (Reference 8). The process in these references was mostly developed to evaluate the uncertainties associated with the internal events PRA model; however, the approach can be applied to other types of hazard groups.

The list of assumptions and sources of uncertainty were reviewed to identify those which would be significant for the evaluation of this application. If the HNP PRA model used a non-conservative treatment, or methods which are not commonly accepted, the underlying assumption or source of uncertainty was reviewed to determine its impact on this application.

Only those assumptions or sources of uncertainty that could significantly impact the risk calculations were considered key for this application.

Key HNP PRA model specific assumptions and sources of uncertainty for this application are identified and dispositioned in Attachment 6. The conclusion of this review is that no additional sensitivity analyses are required to address HNP PRA model specific assumptions or sources of uncertainty.

3.3 PRA REVIEW PROCESS RESULTS (10 CFR 50.69(b)(2)(iii))

The PRA models described in Section 3.2 have been assessed against RG 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2 (Reference 6) consistent with NRC RIS 2007-06.

The HNP internal events PRA model was subject to a self-assessment and a full-scope peer review conducted in 2002 in accordance with guidance in NEI-00-02, Industry PRA Peer 14

Enclosure HNP-18-001 Review Process. In 2006, a self-assessment was conducted to identify supporting requirements that did not meet Category II of the ASME Standard RA-Sb-2005 and RG 1.200, Rev. 1. In 2007, a focused scope industry peer review against two elements was conducted as a follow up to the self-assessment against AMSE Standard RA-Sb-2005 and RG 1.200, Rev. 1.

In July 2017, a focused scope industry peer review was conducted against one model area that was upgraded.

The Internal Events PRA model was peer reviewed in 2002 by the PWR Owners Group (PWROG) prior to the issuance of Regulatory Guide 1.200. As a result, self-assessments have been conducted by Duke Energy of the Internal Events PRA model in accordance with Appendix B of RG 1.200 Revision 2 (Reference 6) to address the PRA technical adequacy requirements not considered in the 2002 peer review. The Internal Events PRA technical adequacy (including the 2002 peer review and self-assessment results) has previously been reviewed by the NRC in previous requests noted below:

• License Amendment Regarding Risk-Informed Justifications for the Relocation of Specific Surveillance Frequency Requirements to a Licensee-Controlled Program, November 29, 2016 ADAMS Accession No. ML16200A285, (Reference 12)

• License Amendment Regarding Adoption of National Fire Protection Association Standard 805, June 28, 2010 ADAMS Accession No. ML10750602, (Reference 13)

Upgrades that have occurred since the PWROG peer review in 2002 have been reviewed in accordance with the peer review process. There are no unreviewed PRA upgrades as defined by the ASME PRA Standard RA-Sa-2009 (Reference 10) in the Internal Events PRA model.

The HNP internal flood PRA model was subject to a self-assessment and a full-scope (covering all internal flood SRs) peer review conducted in August 2014 against RG 1.200 Revision 2.

The HNP Fire PRA model was subject to a review conducted by the NRC during the NFPA 805 Pilot process and an additional focused scope industry peer review, both in 2008 in accordance with ANSI/ANS-58.23-2007. Since the reviews of the Fire PRA model were performed prior to the publication of RG 1.200 Rev 2, an self-assessment was conducted to assess the differences between ANSI/ANS-58.23-2007 and the current version of the PRA standard, ASME/ANS RA-Sa-2009. That assessment confirmed there were no technical differences between the two versions of the standard.

Closed findings were reviewed and closed in March 2017 for the Internal Events and Internal Flood models as a pilot for the process documented in the draft of Appendix X to NEI 05-04, NEI 07-12 and NEI 12-13, Close-out of Facts and Observations (F&Os) published at the time of the review. NRC staff observed the pilot closure on-site event held January 31 through February 1, 2017. An assessment has been performed to determine the impact of changes to the guidance between the closure event and the final version endorsed by NRC. The main deltas identified are related to 1) utility and review teams documented determination and justification if each finding resolution is an upgrade verses maintenance update, and 2) the assessment teams confirmation that for the closed F&Os, the aspects of the underlying SRs in ASME/ANS RA-Sa-2009 that were previously not met, or met at CC-I, are now met or met at CC-II. The utility portion of the upgrade verses maintenance assessment was completed globally and did not identify any resolutions as an upgrade. Additionally, the review team determined none of the resolutions were upgrades and this is documented in the final report.

The assessment team confirmed resolution of the findings allowed re-categorization of 15

Enclosure HNP-18-001 capability categories to meet or met at CC-II, as applicable. The results of this review have been documented and are available for NRC audit.

Closed findings were reviewed and closed in October 2017 for the Fire PRA model using the process documented in Appendix X to NEI 05-04, NEI 07-12 and NEI 12-13, Close-out of Facts and Observations (F&Os) (Reference 9) as accepted by NRC in the letter dated May 3, 2017 (ML17079A427) (Reference 12). The results of this review have been documented and are available for NRC audit. provides a summary of the remaining findings and open items, including:

• Open items and disposition from the HNP RG 1.200 self-assessment.

• Open findings and disposition of the HNP peer reviews.

There are no open findings for the HNP Internal Events model.

The attachments identified above demonstrate that the PRA is of sufficient quality and level of detail to support the categorization process, and has been subjected to a peer review process assessed against a standard or set of acceptance criteria that is endorsed by the NRC as required 10 CFR 50.69(c)(1)(i).

3.4 RISK EVALUATIONS (10 CFR 50.69(b)(2)(iv))

The HNP 10 CFR 50.69 categorization process will implement the guidance in NEI 00-04. The overall risk evaluation process described in the NEI guidance addresses both known degradation mechanisms and common cause interactions, and meets the requirements of 10 CFR 50.69(b)(2)(iv). Sensitivity studies described in NEI 00-04 Section 8 will be used to confirm that the categorization process results in acceptably small increases to core damage frequency (CDF) and large early release frequency (LERF). The failure rates for equipment and initiating event frequencies used in the PRA include the quantifiable impacts from known degradation mechanisms, as well as other mechanisms (e.g., design errors, manufacturing deficiencies, human errors, etc.). Subsequent performance monitoring and PRA updates required by the rule will continue to capture this data, and provide timely insights into the need to account for any important new degradation mechanisms.

16

Enclosure HNP-18-001 4 REGULATORY EVALUATION 4.1 APPLICABLE REGULATORY REQUIREMENTS/CRITERIA The following NRC requirements and guidance documents are applicable to the proposed change.

• The regulations at Title 10 of the Code of Federal Regulations (10 CFR) Part 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors."

• NRC Regulatory Guide 1.201, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance, Revision 1, May 2006.

• Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, April 2015.

• Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, US Nuclear Regulatory Commission, March 2009.

The proposed change is consistent with the applicable regulations and regulatory guidance.

4.2 NO SIGNIFICANT HAZARDS CONSIDERATION ANALYSIS Duke Energy proposes to modify the licensing basis to allow for the voluntary implementation of the provisions of Title 10 of the Code of Federal Regulations (10 CFR), Part 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors. The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with this regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety.

Duke Energy has evaluated whether or not a significant hazards consideration is involved with the proposed amendment(s) by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed change will permit the use of a risk-informed categorization process to modify the scope of SSCs subject to NRC special treatment requirements and to implement alternative treatments per the regulations. The process used to evaluate 17

Enclosure HNP-18-001 SSCs for changes to NRC special treatment requirements and the use of alternative requirements ensures the ability of the SSCs to perform their design function. The potential change to special treatment requirements does not change the design and operation of the SSCs. As a result, the proposed change does not significantly affect any initiators to accidents previously evaluated or the ability to mitigate any accidents previously evaluated. The consequences of the accidents previously evaluated are not affected because the mitigation functions performed by the SSCs assumed in the safety analysis are not being modified. The SSCs required to safely shut down the reactor and maintain it in a safe shutdown condition following an accident will continue to perform their design functions.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed change will permit the use of a risk-informed categorization process to modify the scope of SSCs subject to NRC special treatment requirements and to implement alternative treatments per the regulations. The proposed change does not change the functional requirements, configuration, or method of operation of any SSC.

Under the proposed change, no additional plant equipment will be installed.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

The proposed change will permit the use of a risk-informed categorization process to modify the scope of SSCs subject to NRC special treatment requirements and to implement alternative treatments per the regulations. The proposed change does not affect any Safety Limits or operating parameters used to establish the safety margin.

The safety margins included in analyses of accidents are not affected by the proposed change. The regulation requires that there be no significant effect on plant risk due to any change to the special treatment requirements for SSCs and that the SSCs continue to be capable of performing their design basis functions, as well as to perform any beyond design basis functions consistent with the categorization process and results.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, Duke Energy concludes that the proposed change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of "no significant hazards consideration" is justified.

18

Enclosure HNP-18-001

4.3 CONCLUSION

S In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5 ENVIRONMENTAL CONSIDERATION A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or a significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

19

Enclosure HNP-18-001 6 REFERENCES

1. NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline," Revision 0, Nuclear Energy Institute, July 2005.

2. NRC Regulatory Guide 1.201, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance, Revision 1, May 2006.

3. NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management, December, 1991.

4. ANO SE Arkansas Nuclear One, Unit 2 - Approval of Request for Alternative AN02-R&R-004, Revision 1, Request to Use Risk-Informed Safety Classification and Treatment for Repair/Replacement Activities in Class 2 and 3 Moderate and High Energy Systems (TAC NO. MD5250) (ML090930246), April 22, 2009.

5. Generic Letter 88-20, Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10 CFR 50.54(f), Supplement 4, NRC, June 1991.

6. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, US Nuclear Regulatory Commission, March 2009.

7. NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, March 2009

8. EPRI TR-1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, December 2008

9. NEI Letter to NRC, Final Revision of Appendix X to NEI 05-04/07-12/12-16, Close-Out of Facts and Observations (F&Os), February 21, 2017, (ADAMS Accession Number ML17086A431).

10. NRC Letter to Mr. Greg Krueger (NEI), U.S. Nuclear Regulatory Commission Acceptance on Nuclear Energy Institute Appendix X to Guidance 05-04, 7-12, and 12-13, Close Out of Facts and Observations (F&Os), May 3, 2017, (ADAMS Accession Number ML17079A427).

11. Technical Specifications Task Force, TSTF-425, Revision 3, Relocate Surveillance Frequencies to Licensee Control - RITSTF Initiative 5b, March 18, 2009, (ADAMS Accession No. ML090850642).

12. NRC Letter to Shearon Harris Nuclear Power Plant, Unit 1, "Issuance of Amendments Regarding Risk-Informed Justifications for the Relocation of Specific Surveillance Frequency Requirements to a Licensee-Controlled Program" ,

November 29, 2016, (ADAMS Accession No. ML16200A285).

20

Enclosure HNP-18-001

13. NRC Letter to Shearon Harris Nuclear Power Plant, Unit 1, "Issuance of Amendment Regarding Adoption of National Fire Protection Association Standard 805, Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants, December 28, 2010, (ADAMS Accession No. ML102510852)

14. Carolina Power & Light (CP&L) W. R. Robinson Letter to NRC, "Shearon Harris Nuclear Power Plant - Response to Generic Letter 88-20. Supplement 4 - Individual Plant Examination of External Events (IPEEE)", June 30, 1995, (ADAMS Accession No. ML9507060075).

15. NRC Staffs Evaluation of the Shearon Harris Nuclear Power Plant, Unit 1, Individual Plant Examination of External Events (IPEEE) Submittal, January 14, 2000. ML003677142

16. Generic Environmental Impact Statement for License Renewal of Nuclear Plants, Supplement 33, Regarding Shearon Harris Nuclear Power Plant, Unit 1, Final Report, NUREG-1437, Supplement 33, Office of Nuclear Reactor Regulation, August 2008.

17. NRC Letter to Southern Company, Inc., "Vogtle Electric Generating Plant, Units 1 and 2 -

Issuance of Amendments Re: Use of 10 CFR 50.69", December 17, 2014, (ADAMS Accession No. ML14237A034).

21

Enclosure HNP-18-001 Attachment 1: List of Categorization Prerequisites Duke Energy will establish procedure(s) prior to the use of the categorization process on a plant system. The procedure(s) will contain the elements/steps listed below.

• Integrated Decision Making Panel (IDP) member qualification requirements

• Qualitative assessment of system functions. System functions are qualitatively categorized as preliminary HSS or LSS based on the seven criteria in Section 9 of NEI 00-04 (see Section 3.2). Any component supporting an HSS function is categorized as preliminary HSS. Components supporting, an LSS function are categorized as preliminary LSS.

• Component safety significance assessment. Safety significance of active components is assessed through a combination of PRA and non-PRA methods, covering all hazards. Safety significance of passive components is assessed using a methodology for passive components.

• Assessment of defense in depth and safety margin. Components that are categorized as preliminary LSS are evaluated for their role in providing defense-in-depth and safety margin and, if appropriate, upgraded to HSS.

• Review by the Integrated Decision-making Panel. The categorization results are presented to the lDP for review and approval. The lDP reviews the categorization results and makes the final determination on the safety significance of system functions and components.

• Risk sensitivity study. For PRA-modeled components, an overall risk sensitivity study is used to confirm that the population of preliminary LSS components results in acceptably small increases to core damage frequency (CDF) and large early release frequency (LERF) and meets the acceptance guidelines of RG 1.174.

• Periodic reviews are performed to ensure continued categorization validity and acceptable performance for those SSCs that have been categorized.

• Documentation requirements per Section 3.1.1 22

Enclosure HNP-18-001 Attachment 2: Description of PRA Models Used in Categorization Units Model Baseline CDF Baseline LERF Comments Full Power Internal This model Events including represents the 1 Internal Flood 2.85E-06 1.07E-06 current FPIE PRA Model of MOR 2017 Record (MOR).

This model represents the Internal Flood current Internal 1 5.76E-6 4.77E-7 Flood PRA HNP_Flood_2014_R1 Model of Record (MOR).

This model Fire PRA represents the 1 1.5E-05 2.08E-06 current Fire HNP_2010 PRA Model of Record (MOR).

23

Enclosure HNP-18-001 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items Finding Supporting Capability Description Disposition for 50.69 Number Requirement(s) Category (CC)

Finding: Flow through floor drains is The analysis of the floor 1-9 IFSN-A4 calculated and documented in internal drainage system was revised for Not Met flooding PRA. However, it appears that the Reactor Auxiliary Building Internal flow is incorrectly calculated for situations (RAB), and the supporting Flood when multiple floor drains are connected requirement was evaluated to to one drain line. be Met for the RAB by the F&O Closure team. For buildings The calculations shown in HNP-F-PSA-other than the RAB, however, 0091 show a capacity per floor drain and the qualitative evaluation that the total capacity in each flood area is the was done was not included in average capacity per drain multiplied by the documentation. Buildings the number of floor drains. However, no other than the RAB are open to discussion of how multiple drains are the outside so water will not connected to common drain line is accumulate from backflow provided. When multiple drains flow through floor drains. The through a common drain line, the flow assessment of other buildings from each successive drain greatly will be documented, but it is not reduces the flow from each drain in the expected to impact the results of system.

the IFPRA or of component From the F&O Closure team: Item is categorization under partially closed. Section 6.3.6 of and 10CFR50.69.

Attachment 4 to Calculation HNP-F/PSA-0091 document the revised analysis of the drainage system in RAB. Based on this analysis for RAB, for spray events resulting in a flow rate of less than 100 gpm, the resulting flood is within the capacity of the drain system and will not result in submergence of SSCs in the flood originating compartment. For scenarios other than sprays, no credit is taken in the flood propagation analysis for 24

Enclosure Attachment 3, Continued HNP-18-001 Finding Supporting Capability Description Disposition for 50.69 Number Requirement(s) Category (CC) beneficial removal of water from a flood compartment through the floor drains. For buildings other than RAB, however, drain analysis was not performed and no qualitative evaluation was documented. In particular, upper elevations in the Turbine Building (TB) could potentially flow downward to the basement and caused additional damage to PRA equipment in the TB basement (e.g., condensate pumps, etc.).

The assessment of door failure heights is Door failure assumptions based 1-18 IFSN-B3 Not Met evaluated in the internal flooding PRA. on a plant Civil calculation were The analysis of doors is based entirely on included, scenarios were Internal assumptions; however, these reassessed, and documentation Flood assumptions are not listed in the was updated. The F&O Closure assumptions section of the team, however, stated that the documentation. analysis did not include all critical failure modes The standard requires that assumptions (specifically, did not include be listed and characterized. Civil warping of the door resulting in Calculation HNP-C/RAB-1008, Rev. 0 failure to latch), and that the provides a Harris-specific analysis that door failure criteria used may indicates a standard 3X7 tornado door not be appropriate for all door can withstand a sustained pressure of 1.5 types. The team recommended psig away from the doorframe with a that the specific criteria used for safety factor of 4. Based on this pressure door failure be re-examined to loading, it was estimated that the door ensure that realistic criteria is failure differential flood height is at least being used. Reexamination is 6.5 feet (note that the estimated door not expected to significantly failure differential flood height at Fort change the timing or impacts of 25

Enclosure Attachment 3, Continued HNP-18-001 Finding Supporting Capability Description Disposition for 50.69 Number Requirement(s) Category (CC)

Calhoun was even higher). However, the any flooding sequence (because critical failure modes evaluated in Civil of the very large rooms at HNP),

Calculation HNP-C/RAB-1008, Rev. 0 and is not expected to affect only include failures of door frame, door categorization under latch, door hinge plate, and door hinge 10CFR50.69.

1-18 pin. The analysis did not consider warping Cont'd of door resulting in failure to latch. For fire doors, the warping failure mode may be more vulnerable than the other failure modes, based on the analysis of fire door manufacturer test data for another U.S.

nuclear plant.

Also, the evaluation performed in Civil Calculation HNP-C/RAB-1008, Rev. 0 is for tornado door which is considered to be stronger than the standard fire doors and non-fire rated normal egress doors. As such, the door failure criterion of 6.5 feet of differential flood height should not be applied to the fire doors and normal egress doors.

It is not clear if this door failure differential flood height was applied to the RAB doors. If yes, it is inappropriate. If no, the use of the criteria of 1 foot/3 feet mentioned in the EPRI IFPRA guidance report appears to be too conservative for the RAB fire doors.

26

Enclosure Attachment 3, Continued HNP-18-001 Finding Supporting Capability Description Disposition for 50.69 Number Requirement(s) Category (CC)

Flood alarms are identified in the HRA The specific alarms that might 1-7 IFSN-A2 CC-II analyses. However, the alarms are not be available to indicate floods or specifically identified, nor are the alarms leaks in a specific compartment Internal correlated to the flood source that causes have been added which results Flood the flooding event. in this Supporting Requirement being MET. Documentation was Table 7-2 of HNP-F/PSA-0094 lists revised to list the alarms or alarms and indications that can be used indications of leaks or flooding to identify the flooding conditions in each per compartment as well as the of the flood compartments. However, the specific alarms to aid in flood alarms and indications listed in Table 7-2 identification in a particular area.

may not be always sufficient or clear (with the exception of Fire Water system, The F&O closure team Chilled Water System, CCW, Circulating suggested, however, that the Water system, CVCS, SW, etc.) for use to documentation might not be identify the specific flood sources that sufficient or clear (for a subset cause the flooding conditions. SR IFSN- of systems) to identify the A2 requires the identification of flood specific source that caused a alarms for each flood source and each flood. Duke Energy disagrees flood area. with the closure teams suggestion. HNPs Ops procedures are symptom based diagnostic procedures that are not tied to specific sources, and the indicators and alarms help the operator diagnose location and source of flood. Dominant sources have relevant alarms identified. There is no direct correlation between specific indications and alarms to specific flood sources. There will be no impact on the 27

Enclosure Attachment 3, Continued HNP-18-001 Finding Supporting Capability Description Disposition for 50.69 Number Requirement(s) Category (CC) classification of components under 10CFR50.69 as a result of the suggestion.

Flooding events caused by human Plant level pipe break data on 1-16 IFSO-A4 CC-II induced actions such as overfilling of floods caused by human-tanks, flow diversion etc., are not induced maintenance errors and addressed. generic best estimates of Internal associated plant level flood Maintenance-induced flooding Flood frequencies are included per frequencies by system and by flood Revision 3 of the EPRI pipe compartment are evaluated in Section failure rate report (EPRI TR 6.8.3 of HNP-F/PSA-0093. It appears 3002000079). This includes that the apportionment of the human errors such as overfilling maintenance-induced flood frequencies of tanks and flow diversion that by system to individual flood compartment result in floods. Human errors is not performed in a manner consistent resulting in pressure boundary with the characteristics of the failures are included in direct maintenance-induced flooding since it failures involving failure of the was done by the fraction of the system pressure boundary caused by pipe length located in each flood degradation mechanisms, compartment (although it follows exactly loading conditions, and human the guidance provided in EPRI Report error. To complement the 3002000079).

generic data, HNP Operating Maintenance-induced flooding scenarios Experience (OE) was reviewed are modeled in Sections 7.3.4 and 7.4.2 for maintenance-induced flood (as well as Attachment 9) of HNP-F/PSA- events and documented in the 0092 for CCW heat exchangers and IFPRA analysis.

ESCW chillers in Flood Compartments The F&O closure team FLC17b (RAB Elevation 236) and recommended that Duke Energy FLC18a (RAB Elevation 261),

contact the author of the EPRI respectively. Insufficient description is document to verify that the 28

Enclosure Attachment 3, Continued HNP-18-001 Finding Supporting Capability Description Disposition for 50.69 Number Requirement(s) Category (CC) provided for the screening process used maintenance induced flooding to select the maintenance-induced frequencies have been flooding scenarios included in the HNP apportioned across flood IFPRA model. compartment correctly, and that an additional sensitivity be With no proper justification, the 1-16 performed on the potential maintenance-induced flooding Cont'd impact of underestimating frequencies apportioned to flood maintenance-induced flooding compartments other than the above two frequencies. Since compartments were not accounted for in maintenance-induced flooding is the IFPRA model. Since the frequency of not a significant contributor to maintenance induced flooding was CDF/LERF, and since HNP is a derived from actual industry events, the single unit site with no shared frequencies apportioned to the flood systems, it is expected that compartments not selected for flood additional validation of the scenario modeling cannot be discarded results will not impact unless it can be demonstrated that no CDF/LERF or the component open maintenance (including both PM categorization under and CM) can be performed on the subject 10CFR50.69.

fluid system during power operation.

SR HR-G4 requires that the analyses be The HRA calculation has been 1-19 IEQU-A5 CC-II based on realistic estimates of the time to revised to include the specific receive cues. The analyses used an alarms that indicate floods in assumption of 5 minutes to receive cues each flood area. Documentation Internal and assumed that service water low of analysis of the RAB sump Flood pressure alarms would be received. level alarms has been added, Experience shows that only for extremely and the expected time for floor large breaks would low pressure alarms drain alarms from spray events be received and no analyses were seen in each flood area is included.

that justified use of low pressure alarms The new information was for the HNP flood scenarios. No incorporated into the HRA timing 29

Enclosure Attachment 3, Continued HNP-18-001 Finding Supporting Capability Description Disposition for 50.69 Number Requirement(s) Category (CC) evaluation of the time to receive drain and and scenario development per sump alarms was provided. The basis for the suggested resolution. A timing of the events analyzed was a simulator exercises was scenario evaluated in the FSAR and that performed and observed to timing may not be applicable to the validate the assumptions, and scenarios evaluated in the HNP IF PRA. performance shaping factors 1-19 were based on the observed Analysis of RAB sump level alarms was Cont'd operator actions from the documented in Table 7-4 of Calculation exercise. The F&O Closure HNP-F/PSA-0094 for a spray event with a team, however, disagreed with leak rate of 100 gpm and a flood event the analysis, stating that the 5 with a break flow of 2,000 gpm. However, minute time to recognize the cue the timings of the low pressure and high and begin trouble shooting is not flow alarms are not addressed (i.e., no sufficient to support the evaluation was found). The sump level identification of the specific flood alarms will support the identification of a source. They believe, despite flooding condition. However, it is not the simulator exercise, that no sufficient to support the identification of basis is provided to justify the the specific flood source. No basis is time allowed to diagnose and provided to justify that 5 minutes are take initial action for any flood sufficient to diagnose the flood source other than service water break.

and make decision on how to isolate the Duke Energy performed a break.

sensitivity where the time to recognize the cues and begin identification was increased by a factor of 3, and there was minimal impact on the flooding results. This supporting requirement is MET, and no impact on component categorization under 10CFR50.69 is expected due to 30

Enclosure Attachment 3, Continued HNP-18-001 Finding Supporting Capability Description Disposition for 50.69 Number Requirement(s) Category (CC) this recommendation.

1-19 Cont'd While the IFPRA documentation identifies Documentation has been added 2-3 IFSN-A3 CC-II the automatic and manual actions that to describe the automatic have the ability to terminate or contain actions by the sump pumps as propagation for the four events requiring well as the manual operator Internal HRA, the documentation does not include actions to align the pumps to Flood similar actions for the remaining sources additional tanks. In addition, the and areas. manual operator actions that can be implemented to mitigate Section 7.2 of Calculation HNP-F/PSA-the flooding condition and 0094 describes the automatic actions by propagation in the affected flood the sump pumps as well as the manual compartments have been operator actions to align the pumps to identified.

additional tanks. In addition, Table 7-2 of HNP-F/PSA-0094 identifies the manual The F&O closure team, operator actions that can be implemented however, stated that no manual to mitigate the flooding condition and action (e.g., break isolation) is propagation in the affected flood identified for many of the flood compartments. However, no manual compartments. Most of the action (e.g., break isolation) is identified manual actions identified are for many of the flood compartments. Most proceduralized opening doors of the manual actions identified are to non-critical areas. No opening doors to non-critical areas. In considerations were given to Table 7-2, no considerations were given isolation of the ruptured or to isolation of the ruptured or leaking leaking piping system by closing piping system by closing specific MOVs or specific MOVs or manual manual valves. Nevertheless, isolation valves. Nevertheless, isolation actions are modeled for many of the flood actions are modeled for many of scenarios. They are just not listed in the flood scenarios but they are 31

Enclosure Attachment 3, Continued HNP-18-001 Finding Supporting Capability Description Disposition for 50.69 Number Requirement(s) Category (CC)

Table 7-2. just not listed in the documentation. This is a 2-3 documentation issue only and Cont'd will not affect component classification under 10CFR50.69.

Not all flood failure mechanisms are An analysis of high energy line 2-4 IFSN-A6 CC-I/II/III considered in the susceptibility of breaks (HELBs) has been IFEV-A5 Partially components to flood-induced failures. performed, and a new appendix Internal Closed HELBs alone can result in high humidity describing the analysis has Flood and temperature which in turn will result in been added to the IFPRA fire sprinkler discharge. documentation. The accident scenarios have been updated to Attachment 10 to Calculation HNP-include HELBs and the resulting F/PSA-0091, Revision 1 provides the effects. Jet impingement, pipe evaluation of such flood failure whip, high temperature and high mechanisms as jet impingement, pipe humidity effects have been whip, high temperature, high humidity, considered.

compartment pressurization, etc. that may result from the high energy line breaks The F&O closure team stated, (HELB). A criterion of 20 feet (for pipes however, that additional analysis with inner diameter less than 24) or 10D needs to be performed to (for pipes with inner diameter greater than demonstrate that the effects of

24) was used to determine whether an high temperature and high SSC or fire protection sprinkler would be humidity beyond the zone of impacted by the effects of HELB. While influence (ZOI) for the HELB the criteria of 20 feet/10D is adequate for (i.e., 20 feet or 10X the pipe ID, the analysis of jet impingement and pipe whichever is larger) would not whip, there is no analysis documented to cause additional PRA demonstrate that the effects of high component damage in the large humidity and high temperature resulting rooms at HNP. The ZOI from failure of high energy piping would calculation is based on SNL 32

Enclosure Attachment 3, Continued HNP-18-001 Finding Supporting Capability Description Disposition for 50.69 Number Requirement(s) Category (CC) not propagate beyond 20 feet/10D analyses and has been causing SSCs failures. accepted by the NRC in previous industry submittals.

According to the HNP PRA staff, the only The additional analysis is flood compartment in which not all PRA 2-4 beyond the requirements of the equipment is failed by a HELB scenario is Cont'd Standard and will have no a large room in the RAB, in which the 20 impact on the classification of feet/10D zone of influence (ZOI) was components under applied. The temperature as a function of 10CFR50.69.

time in RAB at Elevation 261 after a MSLB in the steam tunnel (with door D10 to RAB open) was analyzed. The results indicate that, near the sprinkler header, the ceiling temperature reached is unlikely to activate the sprinklers. And, the peak temperature in the immediate proximity of Instrument Racks A1-R33 and A1-R22 (located directly outside of Door D10) would experience the direct effects of the steam plume coming through Door D10.

Relative humidity in the area near Instrument Rack A1-R33 (El. 263.25),

which is bounding, reaches 100% for more than 20 minutes. Relative humidity values near the chillers and HVAC equipment peak at 100%.

The high energy lines in the RAB includes the steam supply line to the TDAFW pump and the charging lines. Although the steam lines for the TDAFW pump pass through RAB 236 elevation, the steam isolation valves located in the 33

Enclosure Attachment 3, Continued HNP-18-001 Finding Supporting Capability Description Disposition for 50.69 Number Requirement(s) Category (CC) steam tunnel are normally closed during power operation, except during the TDAFW pump test. As such, this area is 2-4 only exposed to the potential of a high Cont'd energy line break during the TDAFW pump test.

The HNP IFPRA needs to verify that no PRA equipment would be impacted by high humidity or high temperature beyond the 20 feet / 10D ZOI, even for the rupture of the TDAFW pump steam supply line.

2-8 While a great number of maintenance In communications with IFEV-A7 CC-I/II induced flooding frequencies were Operations personnel, it was calculated, no evidence could be found determined that the only Internal that they were ever included in the model. maintenance-induced flooding Flood events that could occur in Mode Maintenance-induced flooding scenarios 1 are the CCW heat exchangers are modeled in Sections 7.3.4 and 7.4.2 and the ESCW chillers. These (as well as Attachment 9) for CCW heat two flood compartments exchangers and ESCW chillers in Flood decision trees were modified to Compartments FLC17b (RAB Elevation include Maintenance-Induced 236) and FLC18a (RAB Elevation 261),

flooding as a failure mechanism, respectively. Insufficient detailed and scenarios were developed.

description is provided for the screening process used to select the maintenance- The F&O Closure team stated, induced flooding scenarios included in the however, that while these IFPRA model. scenarios are indeed modeled, insufficient detailed description During the onsite resolution review, it was is provided for the screening indicated by the HNP Operations that process used to select the open PM will not be performed on the maintenance-induced flooding CCW heat exchangers and ESCW chillers scenarios. They further stated 34

Enclosure Attachment 3, Continued HNP-18-001 Finding Supporting Capability Description Disposition for 50.69 Number Requirement(s) Category (CC) during power operation. that since the frequency of maintenance induced flooding is Since the frequency of maintenance derived from actual industry induced flooding is derived from actual events, the frequencies industry events, the frequencies apportioned to the flood apportioned to the flood compartments 2-8 compartments not selected for not selected for flood scenario modeling Cont'd flood scenario modeling cannot cannot be discarded unless it can be be discarded unless it can be demonstrated that no open maintenance demonstrated that no open (including both PM and CM) can be maintenance (including both PM performed on the subject fluid system and CM) can be performed on during power operation.

the subject fluid system during power operation. Additional documentation needs to be added on how we selected the maintenance-induced flooding scenarios, and need to assess whether or not the maintenance induced flooding frequency was apportioned properly. This is a documentation issue and will have no impact on the classification of components under 10CFR50.69.

The FRANX software was used to Top CDF/LERF cutsets are 2-11 IFQU-A7 CC-II quantify the HNP internal flooding model presented, and the top which utilizes the fault tree linking contributing flooding scenarios Internal approach. SR QU-A2 of Section 2.2-7 have been included in the Flood states that the frequencies of individual documentation. A complete sequences need to be estimated for CDF listing of the quantified and this was not done for internal CDF/LERF results for flooding scenarios are provided in 35

Enclosure Attachment 3, Continued HNP-18-001 Finding Supporting Capability Description Disposition for 50.69 Number Requirement(s) Category (CC) flooding. Attachments to the documentation.

Top CDF/LERF cutsets are presented in Table 5.1-1/5.2-1 and Attachments L/M of The F&O Closure team, Calculation HNP-F/PSA-0095. The however, indicated that quantified CDF/LERF results of the top documentation of quantified 2-11 contributing flooding scenarios are given sequences for flooding Cont'd in Tables 5.1-2/5.2-2. Complete listing of scenarios are not provided. This the quantified CDF/LERF results for is a documentation issue only, flooding scenarios are provided in and there is no impact on Attachments J/K to Calculation HNP- component classification under F/PSA-0095. 10CFR50.69.

Based on Duke PRA staff, FRANX includes calculation for accident sequences for LERF, but not for CDF.

Figures 5.6.1 and 5.6.2 show CDF by what is labeled as the sequence type, which are actually by IE, not sequence. In any event, estimates of the accident sequences are not included in the documentation.

The FRANX software was used to The HNP dependency analysis 2-12 IFQU-A7 CC-II quantify the HNP internal flooding model has been included in the IFPRA which utilizes the fault tree linking documentation. The approach. The FRANX model is documentation states that there Internal configured to apply recovery actions. A is no dependency between the Flood truncation of 1E-08 was applied for the flood mitigation actions and the CCDP which is considered sufficiently low subsequent operator actions to capture an appropriate number of carried over from the internal cutsets to calculate an accurate CDF. The events PRA since the time flooding model was quantified similarly to between these actions are the internal events model which included sufficiently long (essentially 36

Enclosure Attachment 3, Continued HNP-18-001 Finding Supporting Capability Description Disposition for 50.69 Number Requirement(s) Category (CC) the removal of cutsets with mutually hours).

exclusive events. The documentation This is a documentation issue states that the new HEPs associated with only, and there is no impact on 2-12 flooding were assumed to be independent component classification under Cont'd of any other HEP in a scenario, however 10CFR50.69.

QU-C2 in Section 2.27 states that dependency between HEPs in a cutset or sequence must be assessed.

Section 7.7 of HNP-F/PSA-0094 indicates that there is no dependency between the flood mitigation actions and the subsequent operator actions carried over from the internal events PRA since the time between these actions are sufficiently long (essentially hours).

However, a specific combination-by-combination evaluation of the dependency should be provided to demonstrate that indeed there is insufficient dependency between these two groups of operator actions.

The current analysis does not address Supporting Requirement FSS-FSS-F3-01 FSS-F3 this requirement of the standard. CC-I F3 remained largely unchanged I requires a qualitative assessment of the from ANSI/ANS-58.23-2007, for Fire ASME/ANS RA- risk associated with the selected fire which Finding FSS-F3 was S-2007 (draft) ASME/ANS scenarios (i.e., scenarios associated with initiated, to ASME/ANS RA-Sa-RA-Sa-2009 fire induced failure of structural steel 2009, for which the Capability structures). No clear scenario description Category I was determined.

is currently available. It is recommended that the scenarios in the turbine building Capability Category I was based are described from the point of view of fire on the qualitative assessment of 37

Enclosure Attachment 3, Continued HNP-18-001 Finding Supporting Capability Description Disposition for 50.69 Number Requirement(s) Category (CC)

PRA scenarios. For a CC-I, the qualitative exposed structural steel which is scenario description should include an documented as Attachment 8 to ignition source, possible targets, impacts HNP-F/PSA-0079, Rev. 3.

to the plant operation (e.g. turbine trip, However, Attachment 1 of EC reactor trip, etc), and how the reactor will 409388, Rev. 0, subsequently be shut down after the event. documented a quantitative assessment of exposed FSS-F3-01 structural steel that is sufficient Cont'd to meet Capability Category II/III.

There is no impact to the application.

HR-G1 was incorporated by reference. Supporting Requirements HRA-HRA-C1-3 HRA-C1 The approach to determining which HEPs C1 and HR-G1 remained largely I/II/III are developed using a detailed analysis unchanged from ASME/ANS Fire ASME/ANS RA- does not conform to the standard RA-S-2007 (draft) for which S-2007 (draft) ANSI/ANS- definition of significant for capability Finding HRA-C1-1 was initiated 58.23-2007 category II. Given the fact that the model to ANSI/ANS-58.23-2007 for is still in development, this is which the Capability Category understandable. I/II/III was determined. For ASME/ANS RA-Sa-2009, Supporting Requirement HRA-C1 was assigned Capability Categories of I, II, and III, but Support Requirement HR-G1 remained largely unchanged.

Capability Category II was determined for HRA-C1.

Tables 61 and 62 of HNP-F/PSA-0079, Rev. 3, list 38

Enclosure Attachment 3, Continued HNP-18-001 Finding Supporting Capability Description Disposition for 50.69 Number Requirement(s) Category (CC) significant operator actions having a FV greater than 0.005 or RAW greater than 2, respectively. Section 7.1.3 of HNP-F/PSA-0075, Rev. 2, describes the selection of HFEs for detailed analysis. Based on established criteria (e.g.,

HRA-C1-3 inadequate instrumentation or Cont'd short time window), some significant HFEs were not selected for detailed analysis and were instead conservatively assumed to be failed or left at a screening value. However, the significant operators actions that were selected for detailed analysis are sufficient to provide the risk insights for the 50.69 Application.

There is no impact to the application.

HR-G6 was incorporated by reference. It Supporting Requirements HRA-HRA-C1-6 HRA-C1 is too early in the process for this C1 and HR-G6 remained largely I/II/III supporting requirement to have been unchanged from ASME/ANS Fire ASME/ANS RA- achieved satisfactorily, since only a few RA-S-2007 (draft) for which S-2007 (draft) ANSI/ANS- HFEs have been developed in detail. Finding HRA-C1-6 was initiated 58.23-2007 to ANSI/ANS-58.23-2007 for which the Capability Category I/II/III was determined. For ASME/ANS RA-Sa-2009, 39

Enclosure Attachment 3, Continued HNP-18-001 Finding Supporting Capability Description Disposition for 50.69 Number Requirement(s) Category (CC)

Supporting Requirement HRA-C1 was assigned Capability Categories of I, II, and III, but Support Requirement HR-G6 remained largely unchanged.

Capability Category II was determined for HRA-C1.

HRA-C1-6 Plant-specific and scenario-Cont'd specific influences on human performance were addressed by a well-defined and self-consistent process, as described in Section 7.1.3 of HNP-F/PSA-0075, Rev. 2. This ensured the results were logical and consistent with inputs and method of analysis.

There is no impact to the application.

The definition of significant contributor in Supporting Requirement FQ-E1 FQ-E1-2 FQ-E1 the PRA standard includes the idea of and the Supporting NOT MET summing, in rank order, the fire Requirements for HLR-QU-D Fire ASME/ANS RA- sequences and considering any in the top and HLR-LE-F remained largely S-2007 (draft) ANSI/ANS- 95%, or any that individually contribute unchanged from ASME/ANS 58.23-2007 1% or more, as significant. This RA-S-2007 (draft), for which determination has not been made for fire Finding FQ-E1-2 was initiated, CDF or LERF. Harris does not appear to to ANSI/ANS-58.23-2007, for use the definition as provided in the PRA which the NOT MET was standard. determined, to ASME/ANS RA-Sa-2009.

40

Enclosure Attachment 3, Continued HNP-18-001 Finding Supporting Capability Description Disposition for 50.69 Number Requirement(s) Category (CC)

This SR continues to be NOT MET. This is a documentation-only issue and does not affect quantification of risk.

There is no impact to the application.

QU-F2 - Several of the recommended Supporting Requirement FQ-F1 FQ-F1-1 FQ-F1 documentation requirements are not in and the Supporting I/II/III place, specifically items b, e, f, g, i, j, m. Requirements for HLR-QU-F Fire ASME/ANS RA- and HLR-LE-G remained largely S-2007 (draft) ASME/ANS unchanged from ASME/ANS RA-Sa-2009 RA-S-2007 (draft), for which Finding FQ-F1-1 was initiated, to ASME/ANS RA-Sa-2009, for which the Capability Category I/II/III was determined.

HNP-F/PSA-0079, Rev. 3, documents the majority of the typical documentation requirements:

b) Attachment 32 documents records of the cutset review process.

e) Section 6.0 documents the total plant CDF and contribution from the different initiating events, however accident sequences were not individually 41

Enclosure Attachment 3, Continued HNP-18-001 Finding Supporting Capability Description Disposition for 50.69 Number Requirement(s) Category (CC) documented.

f) Accident sequences were not individually documented.

g) Table 62 documents equipment and human actions with RAW > 2.0. In addition, Section 6.4 FQ-F1-1 includes insights which make Cont'd note of particular credit taken to mitigate potentially-dominant accidents.

i) Section 7.0 documents the uncertainty distribution for the total CDF.

j) Tables 61 and 62 documents importance measure results.

m) Section 3.0 documents the use of qualified software and controlled electronic input files. Section 5.5 documents the process the development of the FRANX input files an operation of FRANX.

Section 10.0 documents the controlled electronic output files.

This is a documentation-only issue. There is no impact to the application.

QU-F3 - There is currently no record of Supporting Requirement FQ-F1 FQ-F1-2 FQ-F1 significant contributors to fire CDF. and the Supporting I/II/III Requirements for HLR-QU-F 42

Enclosure Attachment 3, Continued HNP-18-001 Finding Supporting Capability Description Disposition for 50.69 Number Requirement(s) Category (CC)

Fire ASME/ANS RA- ASME/ANS and HLR-LE-G remained largely S-2007 (draft) RA-Sa-2009 unchanged from ASME/ANS RA-S-2007 (draft), for which Finding FQ-F1-2 was initiated, to ASME/ANS RA-Sa-2009, for which the Capability Category I/II/III was determined.

FQ-F1-2 Section 6.0 of HNP-F/PSA-Cont'd 0079, Rev. 3, documents the significant contributors to CDF, however accident sequences were not individually documented. This is a documentation-only issue.

There is no impact to the application.

43

Enclosure HNP-18-001 Attachment 4: External Hazards Screening Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a)

Aircraft impact analysis is discussed in the HNP UFSAR section 3.5.1.6 and the HNP IPEEE section 5.5.1. HNP is remote from federal airways, airports, airport approaches, military installation or airspace usage and, therefore, an Aircraft Impact Y PS2 aircraft hazard analysis is not required.

The acceptance criteria from the SRP section 3.5.1.6 are met, thus no further screening is required. Changes since the IPEEE were analyzed in conjunction with industry assessments of other forms of sabotage.

Avalanche Y C3 Not applicable to the site topography.

Sudden influxes not applicable to the plant design. Slowly developing growth Biological Event Y C3, C5 can be detected and mitigated by surveillance.

Not applicable to the site because of Coastal Erosion Y C3 location.

Plant design eliminates drought as a Drought Y C2, C5 concern; and event is slowly developing.

External flooding and local intense precipitation analysis are discussed in the HNP UFSAR section 3.4.1.1 and the HNP IPEEE section 5.4. The design basis for this event meets the criteria in the1975 Standard Review Plan (SRP) such that no safety-related External Flooding Y PS2 structures will be jeopardized as a result of the maximum still water level or wave run-up resulting from a probable maximum flood (PMF), or storm water accumulated at the plant site due to a probable maximum precipitation (PMP). Thus external floods are not a significant hazard.

44

Enclosure Attachment 4, Continued HNP-18-001 Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a)

Assessment of high winds is discussed in the HNP UFSAR section 3.3 and IPEEE section 5.3. The plant structures are designed to withstand the design wind load and the effects of tornado missiles. Thus, design basis Extreme Wind or for this event meets the criteria in Y PS2, C2 Tornado the1975 Standard Review Plan (SRP).

Additionally, the most likely damage would be a loss of offsite power that is already included in the internal events model.

Fog Y C1 Negligible impact on the plant.

Event cannot occur close enough to Forest or Range Fire Y C3 the plant.

Damage potential is lower than for Frost Y C1 events for which the plant is designed.

Damage potential is lower than other events for which the plant is designed.

Hail Y C1, C4 Potential flooding is addressed in the external flooding assessment.

Damage potential is lower than for High Summer Y C1, C5 events for which the plant is designed.

Temperature Impacts are slow to develop.

High Tide, Lake Not applicable to the site because of Y C3 Level, or River Stage location.

Addressed under Extreme Wind, Hurricane Y C4 Tornado, and External Flooding.

Not applicable to the site because of location. Plant is designed for freezing Ice Cover Y C3, C4, C5 temperatures which are infrequent and short in duration. Impacts are slow to develop.

Nearby facility accidents are discussed Industrial or Military in the HNP UFSAR section 2.2 and the Y PS2 Facility Accident HNP IPEEE section 5.5.3. The industrial facilities and their products 45

Enclosure Attachment 4, Continued HNP-18-001 Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a) are located such distances from the plant site that they will pose no safety hazard to the plant site. Significant military facilities (support base for Army training operations) are located beyond 30 miles from the plant site, and therefore they will not pose any safety hazard to the plant site. Thus, the design basis for this event meets the criteria in the1975 SRP (RGs 1.91 and 1.78)

An internal flooding PRA that meets the requirements of ASME/ANS RA-Internal Flooding N Detailed PRA Sa-2009 has been developed and will be used for 10CFR50.69 characterization.

The HNP fire PRA developed for the NFPA 805 amendment and that meets Internal Fire N Detailed PRA the requirements of ASME/ANS RA-Sa-2009 will be used for 10CFR50.69 characterization.

Not applicable to the site because of Landslide Y C3 topography.

Lightning strikes causing loss of offsite power or turbine trip are contributors to the initiating event frequencies for Lightning Y C4 these events. However, other causes are also included. The impacts are no greater than already modeled in the internal events PRA.

Plant design eliminates low reservoir Low Lake Level or Y C2, C5 levels as a concern. Slowly developing River Stage event that can be easily mitigated.

Extended freezing temperatures are Low Winter rare, the plant is designed for such Y C1, C5 Temperature events, and their impacts are slow to develop.

46

Enclosure Attachment 4, Continued HNP-18-001 Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a)

Meteorite or Satellite Y C2 Negligible impact to the site.

Impact Pipeline accidents are discussed in the HNP UFSAR section 2.2.3.2 and the HNP IPEE section 5.5.3.3. The effects of a pipeline accident generating missiles, fire, and seismic impacts are analyzed and determined to pose no hazard to the plant. HNP structures are design to withstand missiles at high energy than missiles generated from this event. The potential fire from the migrating cloud of flammable or detonable propane was evaluated and Pipeline Accident Y PS2 due to distance from the plant and site geography poses no hazard to the plant. Critical plant structures are designed so that they are able to withstand the overpressures and ground motions generated from a pipeline accident, hence it is concluded that a detonation of propane from the nearby pipeline will not result in unacceptable consequences. Thus, the design basis for this event meets the criteria in the1975 SRP Analyses of on-site chemicals has Release of Chemicals concluded that there is no credible Y C1 in Onsite Storage impact on toxic gas or chemical hazards.

Not applicable to the site because of River Diversion Y C3 location and plant design.

Not applicable to the site because of Sand or Dust Storm Y C3 location Not applicable to the site because of Seiche Y C3 location.

The Seismic Margins Assessment Seismic Activity N Seismic Margins (SMA) developed for the IPEEE will be Assessment used for categorization.

47

Enclosure Attachment 4, Continued HNP-18-001 Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a)

The event damage potential is less than other events for which the plant is Snow Y C1 designed. Potential flooding impacts covered under external flooding.

The potential for this hazard is low at Soil Shrink-Swell the site, the plant design considers this Y C1, C5 Consolidation hazard, and the hazard is slowly developing and can be mitigated.

Not applicable to the site because of Storm Surge Y C1 location.

Toxic gas covered under release of chemicals in onsite storage, industrial Toxic Gas Y C2, C4 or military facility accident, and transportation accident.

Analyses of road and rail accidents are assessed in UFSAR section 2.2.3 and IPEEE Section 5.5.2. Release of toxic chemicals causing a control room habitability concern due to an accident in the vicinity of the site is negligible.

Marine accident not applicable to the site because of location. Aviation and Transportation pipeline accidents covered under Y PS2, C3, C4 Accident those specific categories. The plant is design to withstand the blast loading and associated missiles from a nearby transportation of explosives event.

Thus, transportation accidents pose no hazard to HNP or are evaluated by other events. Thus, potential transportation accidents meet the 1975 SRP requirements.

Not applicable to the site because of Tsunami Y C3 location.

The probability of turbine generated missiles impacting HNP buildings and Turbine-Generated equipment is determined in UFSAR Y C2 Missiles Section3.5.1.3.4 to be less than 1E-6/yr. Potential accidents meet the 1975 SRP requirements for the design 48

Enclosure Attachment 4, Continued HNP-18-001 Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a) of the turbine and other potentially impacted buildings and equipment.

Not applicable to the site because of Volcanic Activity Y C3 location.

Not applicable to the site because of Waves Y C3 location.

Note a - See Attachment 5 for descriptions of the screening criteria.

49

Enclosure HNP-18-001 Attachment 5: Progressive Screening Approach for Addressing External Hazards Event Analysis Criterion Source Comments C1. Event damage potential is < NUREG/CR-2300 and Initial Preliminary events for which plant is ASME/ANS Standard Screening designed. RA-Sa-2009 C2. Event has lower mean NUREG/CR-2300 and frequency and no worse ASME/ANS Standard consequences than other events RA-Sa-2009 analyzed.

NUREG/CR-2300 and C3. Event cannot occur close ASME/ANS Standard enough to the plant to affect it.

RA-Sa-2009 NUREG/CR-2300 and Not used to screen.

C4. Event is included in the ASME/ANS Standard Used only to include definition of another event.

RA-Sa-2009 within another event.

C5. Event develops slowly, allowing adequate time to ASME/ANS Standard eliminate or mitigate the threat.

PS1. Design basis hazard Progressive ASME/ANS Standard cannot cause a core damage Screening RA-Sa-2009 accident.

PS2. Design basis for the event NUREG-1407 and meets the criteria in the NRC ASME/ANS Standard 1975 Standard Review Plan RA-Sa-2009 (SRP).

PS3. Design basis event mean NUREG-1407 as frequency is < 1E-5/y and the modified in mean conditional core damage ASME/ANS Standard probability is < 0.1. RA-Sa-2009 NUREG-1407 and PS4. Bounding mean CDF is <

ASME/ANS Standard 1E-6/y.

RA-Sa-2009 Screening not successful. PRA NUREG-1407 and Detailed PRA needs to meet requirements in ASME/ANS Standard the ASME/ANS PRA Standard. RA-Sa-2009 50

Enclosure HNP-18-001 Attachment 6: Disposition of Key Assumptions/Sources of Uncertainty

1. Assumption/

Discussion Disposition Uncertainty 1 Reactor Transient-induced loss of coolant accident (LOCA) The approach utilized for modeling RCP Coolant sequences are significant contributors to core damage seal LOCA frequencies is consistent with Pump Seal risk. These are typically reactor coolant pump (RCP) industry practice. The NEI 00-04 LOCA Model seal LOCAs caused by a loss of seal cooling (normal sensitivity studies will be used to and alternate), due to station blackout, loss of CCW determine whether other conditions initiators, or other general transients leading to a loss might lead to SSCs being safety of CVCS and CCW cooling. HNP uses the WOG 2000 significant. The assessment of the RCP seal failure model which assumes RCP seal uncertainties, therefore, is appropriately leakage every time both Seal Injection and Thermal included in this risk-informed application.

Barrier Cooling are lost.

2 Loss of Off- Loss of off-site power (LOOP) initiating events have The approach utilized for modeling the Site Power been shown to be important contributors to CDF due to LOOP frequencies and the recovery (LOOP) the potential for station blackout and the reliance of probabilities is consistent with industry Frequencies many frontline systems on AC power. The LOOP practice. The NEI 00-04 sensitivity initiator was separated into plant, grid, switchyard, and studies will be used to determine weather induced LOOPs, which allowed the model to whether other conditions might lead to apply recovery actions to the higher frequency events SSCs being safety significant. The (i.e., plant and switchyard). HNP used generic industry assessment of the uncertainties, data to calculate LOOP frequencies. therefore, is appropriately included in this risk-informed application.

3 Fire Modeling The HNP Fire PRA (FPRA) model complies with the Updated, NRC-approved FPRA NUREG/CR-6850 methodology that includes technologies will be incorporated in the uncertainties from the inherent randomness in HNP FPRA model as they become elements that comprise the FPRA model, and from the available in accordance with the normal state of knowledge in these elements as the FPRA PRA maintenance and update (MU) technology continues to evolve. These include the fire procedures. The NEI 00-04 sensitivity ignition frequencies, heat release rates, fire growth studies will be used to determine curves, fire suppression failure probabilities, severity whether other conditions might lead to factors, and post-initiator human failure event SSCs being safety significant. The probabilities. While the approaches used in the HNP assessment of the uncertainties, FPRA are NRC-approved methodologies, they are still therefore, is appropriately included in constrained by the relatively limited data on fire events this risk-informed application.

at Nuclear Power Plants.

51

Enclosure HNP-18-001 Attachment 6, Continued

1. Assumption/

Discussion Disposition Uncertainty 4 Fire Damage Harris cables are Kerite which is a type of Temperature of Thermoset material. Kerite has a slightly lower This conservatism in the Fire PRA Zone Cables and damage and ignition temperature than most of influence could result in some SSCs associated Zone Thermoset. Due to no NRR endorsed testing of being classified as HSS due to assumed of Influence Kerite cables the Harris FPRA is based upon a loss of alternate success paths, when in Thermoplastic fire zone of influence. This is a larger fact they are LSS. Harris Fire PRA may ZOI than Kerite actual ZOI. This results in a be updated in the future to reduce the potentially conservative results for non-suppression ZOI and time to damage to reflect the probability, and time to damage and zone of actual capabilities of the Kerite damage. After the Harris Fire PRA was completed, cables. The impact of the uncertainties, NRR Research tested Kerite cable damage therefore, is appropriately understood in properties and determined they will fail and then this risk-informed application and no ignite approximately 75°C higher than Thermoplastic further sensitivities are required.

cables.

5 Incipient The HNP Fire PRA assumes Incipient Detection Incipient detection at HNP is credited in Detection System functions as outlined in NUREG 2180 with cabinets where fires would result in high sensitivity for the some exceptions specifically due to the way Harris conditional core damage probabilities very early Operations staff respond to Alert and Alarms due to a significant amount of warning fire . Industry data supports a much more sensitive equipment being failed by a fire if the detection system response such that fires in cabinets with this system entire cabinet is failed or if the fire installed have a much lower probability of a fire or impacts targets outside the cabinet.

fire damage beyond the original faulted component. The current methodology is based on NRC FAQ 08-0046 and credits incipient detection for limiting some initiating events to a fire that only impacts a single component for about 90% of the fires. The remaining 10% of the fires result in external target damage similar to NUREG 2180. In the NUREG 2180 methodology, fire initiating events results in damage to the entire cabinet or damage to targets outside the cabinet. While the NUREG 2180 methodology will increase overall fire CDF and LERF, in the 50.69 categorization process failure of 52

Enclosure HNP-18-001 Attachment 6, Continued

1. Assumption/

Discussion Disposition Uncertainty 5 cont'd cont'd equipment due to fire effects decreases the risk importance measures (i.e.,

RAW and F-V) for that equipment.

Because the equipment is failed by the initiating event, its random failure is not considered in the scenario and it does not contribute to the components RAW or F-V. This will tend to drive components toward a lower safety significance for fire risk. Additionally, increasing the overall fire CDF will place more weight on the fire importance measures than those from other hazards when performing the integral assessment (i.e., weighted average importances) used in the 50.69 categorization process. Since the fire RAW and F-V of the SSCs will tend to be understated using the NUREG-2180 methodology, this will again have the potential to drive SSCs toward a lower safety significance. Therefore, the overall impact of using the current FAQ 08-0046 method is that it is not expected that any SSCs would be categorized as LSS that would be categorized HSS using the NUREG 2180 methodology, while there is a strong possibility that some SSCs will be categorized as HSS that would be categorized as LSS applying the NUREG 2180 methodology. As such, no further sensitivities are required.

53

Enclosure HNP-18-001 Attachment 6, Continued

1. Assumption/

Discussion Disposition Uncertainty 6 Fire PRA plant The Harris Fire PRA in general assumes that This assumption would make the safety response model secondary heat removal and off-site power are lost related SSCs more important than they for nearly all fire scenarios. This assumption was might otherwise be due to lack of data in used because of the lack of routing data for these cable locations and functions. The cables in the Turbine Building. impact of the uncertainties, therefore, is appropriately understood in this risk-informed application and no further sensitivities are required.

7 TD AFW The turbine-driven auxiliary feedwater pump This conservative assumption could Modeling (TDAFWP) is conservatively assumed to impact the failure probability of the immediately fail if no flow is available to steam human error event for performing bleed generators B and C (i.e., the steam flow available as and feed cooling. The NEI 00-04 the generator dries out is neglected). This is a sensitivity studies explicitly require conservative assumption used to simplify the model. setting human error basic events to the SG dryout times ranging from 43 to 56 minutes (with 5th and 95th percentile values as a and without RCPs operating, respectively). Although sensitivity. The assessment of the crediting the use of the TDAFWP would shorten uncertainties, therefore, is appropriately these dryout times slightly, its use could provide addressed by the sensitivity studies considerable cooldown and depressurization of the required by this risk-informed secondary and RCS before there is insufficient application.

steam to operate the TDAFWP. This would extent the time available for operators to implement bleed and feed cooling.

8 Condenser The condenser steam dump system is not explicitly This results in the Steam Generator Dump Modeling modeled; however, a common cause event for the PORVs and code safeties potentially and secondary six air-operated valves is included as the hardware having slightly more risk significance heat removal failure which would prevent this subsystem from than they would be if the detailed functioning. modeling of this alternate means of heat removal was performed. However, the impact is conservative and expected to be insignificant. The impact of the uncertainties, therefore, is appropriately understood in this risk-informed application and no further sensitivities are required.

54

Enclosure HNP-18-001 Attachment 6, Continued

1. Assumption/

Discussion Disposition Uncertainty 9 Level of detail of The PRA model assumes that the spray valves This results in the Pressurizer PORVs system model and/or the reactor coolant pumps are unavailable, potentially having slightly more risk for RCS and the RCS PORVs are always required to significance than they would if the function. Assuming that the reactor coolant pumps detailed modeling of this alternate are unavailable is reasonable given that a reactor means of RCS depressurization was trip would have occurred already in these performed. However, the impact is sequences at the time depressurization is required. conservative and expected to be insignificant. The impact of the uncertainties, therefore, is appropriately understood in this risk-informed application and no further sensitivities are required.

10 Off-site Power For all external events at Harris, it is generally This results in a potential increase in Recovery assumed that off-site power is lost with the initiating the importance of several SSCs related event and not recoverable. The HNP Switchyard is a to LOOP events (TDAFW, EDGs).

significant node in the Duke Energy distribution However, the impact is conservative for system with 8 lines that come from multiple these SSCs. The impact of the directions. This suggests that off-site power may uncertainties, therefore, is appropriately not be lost or can be recovered via at least one understood in this risk-informed path. application and no further sensitivities are required.

11 System Depletion of the batteries was modeled without Crediting of DC load shedding would modeling DC taking credit for shedding of DC loads to prolong not allow the batteries to last the entire Batteries battery life. 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time and as such would only provide additional time for recovery of offsite power or other operator actions. This is expected to have a negligible impact on SSC importances. The impact of the uncertainties, therefore, is appropriately understood in this risk-informed application and no further sensitivities are required.

55

Enclosure HNP-18-001 Attachment 6, Continued

1. Assumption/

Discussion Disposition Uncertainty 12 HRA Modeling Any cutsets with more than four HFE are not Given that a floor value is applied to and evaluated for more than four HFEs and the HFE combinations, including additional Dependency additional actions are considered completely HFEs beyond four is expected to have dependent and assigned a value of 1.0 in the a negligible impact. Additionally the recovery file. NEI 00-04 sensitivity studies explicitly require setting human error basic events to the 5th and 95th percentile values as a sensitivity. The assessment of the uncertainties, therefore, is appropriately addressed by the sensitivity studies required by this risk-informed application.

13 HRA Modeling In the internal events PRA model a lower bound of 1 The NEI 00-04 sensitivity studies and x 10-5 was enforced as the limiting HEP in any two explicitly require setting human error dependency dependent HEPs in a cutset. For cutsets with three basic events to the 5th and 95th HEPs a lower bound of 1E-06 was used. The percentile values as a sensitivity. The decision to use a lower bound on combinations of assessment of the uncertainties, dependent HEPs in a cut set is based on the therefore, is appropriately addressed by assumption that the state of the art in characterizing the sensitivity studies required by this the dependence between HFEs is not sufficiently risk-informed application.

advanced to be confident of the credibility of very low probabilities for combinations of HFEs. As is stated, the selection of the lower bounds is based on guidance provided in NUREG-1792.

56